2016-09-30  Anders Carlsson  <andersca@apple.com>

        Follow up for <rdar://problem/28567561> Add CSS -webkit-appearance property for Apple Pay buttons

        Reviewed by Dan Bernstein.

        * css/CSSParser.cpp:
        (WebCore::isKeywordPropertyID):
        Add CSSPropertyApplePayButtonStyle and CSSPropertyApplePayButtonType.

        * rendering/RenderThemeCocoa.mm:
        (WebCore::RenderThemeCocoa::paintApplePayButton):
        Make sure to reinitialize the text matrix.

2016-09-30  Babak Shafiei  <bshafiei@apple.com>

        Merge r206181. rdar://problem/28408526

    2016-09-20  Anders Carlsson  <andersca@apple.com>

            Remove "in-store" from "-apple-pay-button-type"
            https://bugs.webkit.org/show_bug.cgi?id=162321
            rdar://problem/28394581

            Reviewed by Beth Dakin.

            * css/CSSPrimitiveValueMappings.h:
            (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
            (WebCore::CSSPrimitiveValue::operator ApplePayButtonType):
            * css/CSSValueKeywords.in:
            * css/parser/CSSParser.cpp:
            (WebCore::isValidKeywordPropertyAndValue):
            * css/parser/CSSParserFastPaths.cpp:
            (WebCore::CSSParserFastPaths::isValidKeywordPropertyAndValue):
            * rendering/RenderThemeCocoa.mm:
            (WebCore::toPKPaymentButtonType):
            * rendering/style/RenderStyleConstants.h:

2016-09-30  Babak Shafiei  <bshafiei@apple.com>

        Merge r205992. rdar://problem/28567557

    2016-09-15  Anders Carlsson  <andersca@apple.com>

            Fix build.

            * platform/spi/cocoa/PassKitSPI.h:

2016-09-30  Babak Shafiei  <bshafiei@apple.com>

        Merge r205980. rdar://problem/28567557

    2016-09-14  Anders Carlsson  <andersca@apple.com>

            Add CSS -webkit-appearance property for Apple Pay buttons
            https://bugs.webkit.org/show_bug.cgi?id=161986

            Reviewed by Dean Jackson.

            Add a new -webkit-appearance property, "-apple-pay-button".
            Also, add two properties, "-apple-pay-button-type" and "-apple-pay-button-style".

            * WebCore.xcodeproj/project.pbxproj:
            Add RenderThemeCocoa.h and RenderThemeCocoa.mm.

            * css/CSSComputedStyleDeclaration.cpp:
            (WebCore::ComputedStyleExtractor::propertyValue):
            Handle CSSPropertyApplePayButtonStyle and CSSPropertyApplePayButtonType.

            * css/CSSPrimitiveValueMappings.h:
            (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
            (WebCore::CSSPrimitiveValue::operator ApplePayButtonStyle):
            (WebCore::CSSPrimitiveValue::operator ApplePayButtonType):
            Add ApplePayButtonStyle and ApplePayButtonType conversion routines.

            * css/CSSPropertyNames.in:
            Add -apple-pay-button-style and -apple-pay-button-type.

            * css/CSSValueKeywords.in:
            Add CSS values.

            * css/parser/CSSParser.cpp:
            (WebCore::isValidKeywordPropertyAndValue):
            Handle CSSPropertyApplePayButtonStyle and CSSPropertyApplePayButtonType.

            * css/parser/CSSParserFastPaths.cpp:
            (WebCore::CSSParserFastPaths::isKeywordPropertyID):
            Handle CSSPropertyApplePayButtonStyle and CSSPropertyApplePayButtonType.

            (WebCore::isAppleLegacyCSSPropertyKeyword):
            New function that returns whether the CSS property should be rewritten to -webkit-.
            We want to rewrite -apple- but not -apple-pay-.

            (WebCore::cssPropertyID):
            Use the newly added isAppleLegacyCSSPropertyKeyword.

            (WebCore::isAppleLegacyCSSValueKeyword):
            Check for "-apple-pay-" in addition to "-apple-system-".

            * platform/ThemeTypes.h:
            Add ApplePayButtonPart.

            * platform/spi/cocoa/PassKitSPI.h:
            Add PKDrawApplePayButton declaration.

            * rendering/RenderTheme.cpp:
            (WebCore::RenderTheme::adjustStyle):
            Handle ApplePayButtonPart.

            (WebCore::RenderTheme::paint):
            Handle ApplePayButtonPart.

            * rendering/RenderTheme.h:
            (WebCore::RenderTheme::adjustApplePayButtonStyle):
            (WebCore::RenderTheme::paintApplePayButton):
            Add new functions.

            * rendering/RenderThemeCocoa.h: Added.
            * rendering/RenderThemeCocoa.mm: Added.
            (WebCore::RenderThemeCocoa::adjustApplePayButtonStyle):
            Adjust the minimum width and minimum height accordingly.

            (WebCore::toPKPaymentButtonStyle):
            (WebCore::toPKPaymentButtonType):
            Helper functions that convert our WebCore types to PK types.

            (WebCore::RenderThemeCocoa::paintApplePayButton):
            Call PKDrawApplePayButton.

            * rendering/RenderThemeIOS.h:
            * rendering/RenderThemeMac.h:
            Inherit from RenderThemeCocoa.

            * rendering/style/RenderStyle.h:
            (WebCore::RenderStyle::applePayButtonStyle):
            (WebCore::RenderStyle::applePayButtonType):
            (WebCore::RenderStyle::setApplePayButtonStyle):
            (WebCore::RenderStyle::setApplePayButtonType):
            (WebCore::RenderStyle::initialApplePayButtonStyle):
            (WebCore::RenderStyle::initialApplePayButtonType):
            * rendering/style/RenderStyleConstants.h:
            * rendering/style/StyleRareInheritedData.cpp:
            (WebCore::StyleRareInheritedData::StyleRareInheritedData):
            (WebCore::StyleRareInheritedData::operator==):
            * rendering/style/StyleRareInheritedData.h:
            Add new style members for the button style and button type properties.

2016-09-29  Babak Shafiei  <bshafiei@apple.com>

        Merge r206556. rdar://problem/28524440

    2016-09-28  Jer Noble  <jer.noble@apple.com>

            CRASH at WebCore::CDMSessionAVStreamSession::update + 950
            https://bugs.webkit.org/show_bug.cgi?id=162701

            Reviewed by Beth Dakin.

            If the SourceBuffer backing a <video> element is removed before CDMSessionAVStreamSession::update() gets
            a chance to run, the protectedSourceBuffer will be null. Just bail early and indicate an error.

            * platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.mm:
            (WebCore::CDMSessionAVStreamSession::update):

2016-09-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r206551. rdar://problem/28526639

    2016-09-28  Wenson Hsieh  <wenson_hsieh@apple.com>

            Some media tests are crashing due to soft-linking failures
            https://bugs.webkit.org/show_bug.cgi?id=162698

            Reviewed by Jer Noble.

            We should be handling soft-linking failures for MRMediaRemoteSetNowPlayingVisibility gracefully. Guards these
            calls with canLoad_MediaRemote_MRMediaRemoteSetParentApplication and also use the
            SOFT_LINK_FUNCTION_MAY_FAIL_FOR_HEADER macro when soft linking.

            * platform/audio/mac/MediaSessionManagerMac.mm:
            (WebCore::MediaSessionManagerMac::updateNowPlayingInfo):
            * platform/mac/MediaRemoteSoftLink.cpp:
            * platform/mac/MediaRemoteSoftLink.h:

2016-09-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r206527. rdar://problem/28499358

    2016-09-27  Wenson Hsieh  <wenson_hsieh@apple.com>

            Adopt MediaRemote SPI to achieve desired Now Playing behavior
            https://bugs.webkit.org/show_bug.cgi?id=162658
            <rdar://problem/28499358>

            Reviewed by Jer Noble.

            Restores the changes previously rolled out in r206444, and adopts new MediaRemote SPI to achieve the desired
            behavior for media in background tabs without breaking other features.

            Introduces 2 new unit tests in NowPlayingControlsTests.

            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::pageAllowsNowPlayingControls):
            * page/Page.cpp:
            (WebCore::Page::setViewState):
            * platform/audio/PlatformMediaSessionManager.h:
            (WebCore::PlatformMediaSessionManager::hasActiveNowPlayingSession):
            * platform/audio/mac/MediaSessionManagerMac.h:
            * platform/audio/mac/MediaSessionManagerMac.mm:
            (WebCore::MediaSessionManagerMac::updateNowPlayingInfo):
            * platform/mac/MediaRemoteSoftLink.cpp:
            * platform/mac/MediaRemoteSoftLink.h:
            * platform/spi/mac/MediaRemoteSPI.h:

2016-09-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r206520. rdar://problem/28412512

    2016-09-28  Jer Noble  <jer.noble@apple.com>

            PiP shows incorrect state of play button.
            https://bugs.webkit.org/show_bug.cgi?id=162652

            Reviewed by Eric Carlson.

            After getting a new WebPlaybackSessionModel, the first thing WebVideoFullscreenInterfaceMac
            should do is query for it's playbackRate() and isPlaying() properties.

            * platform/mac/WebVideoFullscreenInterfaceMac.mm:
            (WebCore::WebVideoFullscreenInterfaceMac::WebVideoFullscreenInterfaceMac):

2016-09-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r206518. rdar://problem/28505032

    2016-09-28  Jer Noble  <jer.noble@apple.com>

            [MSE][Mac] In SourceBufferPrivateAVFObjC::abort(), support reseting parser to the last appended initialization segment.
            https://bugs.webkit.org/show_bug.cgi?id=135164

            Reviewed by Eric Carlson.

            Test: media/media-source/media-source-abort-resets-parser.html

            Use the -[AVStreamDataParser appendStreamData:withFlags:] to implement "resetting" the parser. In this case,
            the parser isn't explicitly reset during resetParserState(), but rather a flag is set so that the next append
            signals a data discontinuity, and the parser is reset at that point.

            Because a previous append operation may be in-flight during this abort(), care must be taken to invalidate any
            operations which may have already started on a background thread. So SourceBufferPrivateAVFObjC will use a
            separate WeakPtrFactory for its append operations, will invalidate any outstanding WeakPtrs during an abort(),
            and will block until the previous append() operation completes.

            This will require the WebAVStreamDataParserListener object to occasionally have it's WeakPtr pointing back to the
            SourceBufferPrivateAVFObjC to be reset after an abort(), so make that ivar an @property. Rather than passing a
            RetainPtr to itself in all the callbacks it handles, the WebAVStreamDataParserListener can just pass in a copy
            of its own WeakPtr (which may be invalidated during an abort()).

            Break the distinct operations of "abort()" and "resetParserState()" into their own methods in SourceBufferPrivate
            and all its subclasses.

            * Modules/mediasource/SourceBuffer.cpp:
            (WebCore::SourceBuffer::resetParserState):
            (WebCore::SourceBuffer::abortIfUpdating):
            * platform/graphics/SourceBufferPrivate.h:
            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
            (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:]):
            (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:withDiscontinuity:]):
            (-[WebAVStreamDataParserListener streamDataParser:didFailToParseStreamDataWithError:]):
            (-[WebAVStreamDataParserListener streamDataParser:didProvideMediaData:forTrackID:mediaType:flags:]):
            (-[WebAVStreamDataParserListener streamDataParser:didReachEndOfTrackWithTrackID:mediaType:]):
            (-[WebAVStreamDataParserListener streamDataParserWillProvideContentKeyRequestInitializationData:forTrackID:]):
            (-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]):
            (WebCore::SourceBufferPrivateAVFObjC::SourceBufferPrivateAVFObjC):
            (WebCore::SourceBufferPrivateAVFObjC::append):
            (WebCore::SourceBufferPrivateAVFObjC::abort):
            (WebCore::SourceBufferPrivateAVFObjC::resetParserState):
            (-[WebAVStreamDataParserListener initWithParser:parent:]): Deleted.
            * platform/graphics/gstreamer/SourceBufferPrivateGStreamer.cpp:
            (WebCore::SourceBufferPrivateGStreamer::resetParserState):
            * platform/graphics/gstreamer/SourceBufferPrivateGStreamer.h:
            * platform/mock/mediasource/MockSourceBufferPrivate.cpp:
            (WebCore::MockSourceBufferPrivate::resetParserState):
            * platform/mock/mediasource/MockSourceBufferPrivate.h:
            * platform/spi/mac/AVFoundationSPI.h:

2016-09-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r206454. rdar://problem/28484193

    2016-09-27  Wenson Hsieh  <wenson_hsieh@apple.com>

            Related videos on YouTube (and YouTube playlists) cause media controls to disappear
            https://bugs.webkit.org/show_bug.cgi?id=162621
            <rdar://problem/28484193>

            Reviewed by Jer Noble.

            Tweaks the main content media heuristic for better Now Playing behavior on YouTube by making the following
            changes:
            - Remove the strict requirement for audio to be actively playing for the session to be able to show
              controls for the purpose of Now Playing, making it the same as our policy for the controls manager.
            - Make playback requirement restrictions apply only for the controls manager. Videos that do not
              autoplay will still have the correct behavior with respect to Now Playing, since we will bail in the
              hasEverNotifiedAboutPlaying() check.
            - Only consider the main content heuristic as preventing media controls from showing up for the purposes
              of the controls manager. Now Playing should instead account for this by preferring elements large
              enough for main content after collecting all of the candidate sessions.

            * html/HTMLMediaElement.cpp:
            (WebCore::mediaElementSessionInfoForSession):
            (WebCore::preferMediaControlsForCandidateSessionOverOtherCandidateSession):
            (WebCore::HTMLMediaElement::updatePlayState):
            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::canShowControlsManager):
            * platform/audio/mac/MediaSessionManagerMac.mm:
            (WebCore::MediaSessionManagerMac::sessionWillBeginPlayback):

2016-09-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r206444. rdar://problem/28496755

    2016-09-27  Wenson Hsieh  <wenson_hsieh@apple.com>

            Some Now Playing behavior is broken after r206315
            https://bugs.webkit.org/show_bug.cgi?id=162625
            <rdar://problem/28496755>

            Reviewed by Jer Noble.

            Reverts the part of our heuristic that disables Now Playing in active tabs in the main window.

            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::pageAllowsNowPlayingControls):
            * page/Page.cpp:
            (WebCore::Page::setViewState):

2016-09-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r206415. rdar://problem/28484047

    2016-09-26  Wenson Hsieh  <wenson_hsieh@apple.com>

            If you play a youtube video from now playing after it finished in Safari, controls disappear
            https://bugs.webkit.org/show_bug.cgi?id=162589
            <rdar://problem/28484047>

            Reviewed by Jer Noble.

            Tweaks the main content heuristic slightly to remove the "mostly in mainframe" requirement in the case of Now
            Playing. This was added in the case of the controls manager as an additional way to identify video elements that
            should not show controls, since we relax audio and video constraints for showing videos in the controls manager,
            so that a video element is prevented from showing controls on grounds of lacking audio only if it has never had
            audio before. In the case of Now Playing, we have stricter requirements for videos, which must have audio, which
            makes the mainframe heuristic not necessary.

            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::canShowControlsManager):

2016-09-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r206399. rdar://problem/28457219

    2016-09-26  Wenson Hsieh  <wenson_hsieh@apple.com>

            Seeking video doesn't update seek position
            https://bugs.webkit.org/show_bug.cgi?id=162575
            <rdar://problem/28457219>

            Reviewed by Jer Noble.

            On ToT, seeking in a video causes the playhead to stutter, and does not actually update media remote's seek
            position. This is partly due to how we do not update media remote with new information when beginning to respond
            to remote seek commands, so media remote continues to think that a playing video is still playing despite the
            user attempting to seek through it.

            To fix this, we introduce timer-based guards around remote seek commands, such that a seek "gesture" begins when
            we receive the first seek command and ends when no seek command has been received in a set amount of time (this
            is 0.5 seconds, which is approximately what other clients around the platform use).

            Also, when responding to a remote seek, perform the seek with no tolerance. This prevents the playhead from
            stuttering at the end of a seek from the final requested destination of the seek to the last actually seeked
            time in the video.

            When beginning to seek, we must pause the media. Through existing mechanisms, this causes the media session
            manager to update its Now Playing information, which informs media remote that we are no longer playing and
            prevents us from stuttering. However, when ending a seek, we must also trigger an additional update to again
            refresh media remote's view of the current time. This prevents a flicker when playing media after seeking.

            Unit tests to be added in a follow-up due to time constraints.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::HTMLMediaElement):
            (WebCore::HTMLMediaElement::handleSeekToPlaybackPosition):
            (WebCore::HTMLMediaElement::seekToPlaybackPositionEndedTimerFired):
            (WebCore::HTMLMediaElement::didReceiveRemoteControlCommand):
            * html/HTMLMediaElement.h:
            * platform/audio/PlatformMediaSessionManager.h:
            (WebCore::PlatformMediaSessionManager::scheduleUpdateNowPlayingInfo):
            (WebCore::PlatformMediaSessionManager::sessionDidEndRemoteScrubbing):
            (WebCore::PlatformMediaSessionManager::sessions): Deleted.
            * platform/audio/mac/MediaSessionManagerMac.h:
            * platform/audio/mac/MediaSessionManagerMac.mm:
            (WebCore::PlatformMediaSessionManager::updateNowPlayingInfoIfNecessary):
            (WebCore::MediaSessionManagerMac::scheduleUpdateNowPlayingInfo):
            (WebCore::MediaSessionManagerMac::sessionDidEndRemoteScrubbing):
            (WebCore::MediaSessionManagerMac::updateNowPlayingInfo):

2016-09-26  Babak Shafiei  <bshafiei@apple.com>

        Merge r206241. rdar://problem/28450514

2016-09-26  Babak Shafiei  <bshafiei@apple.com>

        Merge r206238. rdar://problem/28450514

    2016-09-21  Anders Carlsson  <andersca@apple.com>

            support openPaymentSetup API on ApplePaySession object
            https://bugs.webkit.org/show_bug.cgi?id=162357
            rdar://problem/26776939

            Reviewed by Tim Horton.

            * Modules/applepay/ApplePaySession.cpp:
            (WebCore::ApplePaySession::openPaymentSetup):
            Perform security checks and then call into the PaymentCoordiantor. In its completion handler, we resolve the promise.

            * Modules/applepay/ApplePaySession.h:
            Add new members.

            * Modules/applepay/ApplePaySession.idl:
            Add openPaymentSetup declaration.

            * Modules/applepay/PaymentCoordinator.cpp:
            (WebCore::PaymentCoordinator::openPaymentSetup):
            Call through to the clients.

            * Modules/applepay/PaymentCoordinator.h:
            * Modules/applepay/PaymentCoordinatorClient.h:
            Add new members.

            * loader/EmptyClients.cpp:
            Add new stub.

            * platform/spi/cocoa/PassKitSPI.h:
            Add SPI declaration.

2016-09-26  Babak Shafiei  <bshafiei@apple.com>

        Merge r206350. rdar://problem/28115680

    2016-09-23  Wenson Hsieh  <wenson_hsieh@apple.com>

            Media controls playhead does not animate smoothly while playing
            https://bugs.webkit.org/show_bug.cgi?id=162399
            <rdar://problem/28115680>

            Reviewed by Beth Dakin.

            The media controls playhead currently does not animate smoothly during playback because we don't specify a
            playback rate when updating the WebPlaybackControlsManager's timing value. However, simply setting this timing
            value to the current playback rate (as known to the UI process) results in the UI process receiving multiple
            updates from the web process where the current time is equal (or even less than) the time at which media began
            to play, which results in the playhead seeking backwards to the start time multiple times when playing or
            resuming media.

            To address this, in WebCore, we inform the playback session model of the media time when playback begins (i.e.
            a `playing` or `play` event is fired). This message precedes both the "rate changed" and "current time changed"
            messages.

            Unit tests to be added in a future patch.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::notifyAboutPlaying):
            (WebCore::HTMLMediaElement::setReadyState):
            (WebCore::HTMLMediaElement::playInternal):
            * html/HTMLMediaElement.h:
            (WebCore::HTMLMediaElement::playbackStartedTime):
            * platform/cocoa/WebPlaybackSessionModel.h:
            (WebCore::WebPlaybackSessionModelClient::playbackStartedTimeChanged):
            (WebCore::WebPlaybackSessionModelClient::bufferedTimeChanged): Deleted.
            * platform/cocoa/WebPlaybackSessionModelMediaElement.h:
            * platform/cocoa/WebPlaybackSessionModelMediaElement.mm:
            (WebPlaybackSessionModelMediaElement::updateForEventName):
            (WebPlaybackSessionModelMediaElement::playbackStartedTime):
            * platform/ios/WebVideoFullscreenControllerAVKit.mm:
            * platform/mac/WebPlaybackSessionInterfaceMac.h:
            * platform/mac/WebPlaybackSessionInterfaceMac.mm:
            (WebCore::WebPlaybackSessionInterfaceMac::currentTimeChanged):
            (WebCore::WebPlaybackSessionInterfaceMac::rateChanged):
            (WebCore::WebPlaybackSessionInterfaceMac::beginScrubbing):
            (WebCore::WebPlaybackSessionInterfaceMac::endScrubbing):
            (WebCore::WebPlaybackSessionInterfaceMac::updatePlaybackControlsManagerTiming):

2016-09-23  Babak Shafiei  <bshafiei@apple.com>

        Merge r206322. rdar://problem/28435352

    2016-09-23  Jer Noble  <jer.noble@apple.com>

            Allow Seeking from the now playing controls
            https://bugs.webkit.org/show_bug.cgi?id=162498

            Reviewed by Beth Dakin.

            We already have a handler for seek commands, we just need to register that handler
            with MediaRemote.

            * platform/mac/RemoteCommandListenerMac.mm:
            (WebCore::RemoteCommandListenerMac::updateSupportedCommands):

2016-09-23  Babak Shafiei  <bshafiei@apple.com>

        Merge r204082. rdar://problem/27547583

    2016-08-03  Eric Carlson  <eric.carlson@apple.com>

            [Mac][iOS] Adopt MediaRemote "seek to playback position"
            https://bugs.webkit.org/show_bug.cgi?id=160405
            <rdar://problem/27547583>

            Reviewed by Dean Jackson.

            * platform/ios/RemoteCommandListenerIOS.mm:
            (WebCore::RemoteCommandListenerIOS::RemoteCommandListenerIOS): Fix a typo.

2016-09-23  Babak Shafiei  <bshafiei@apple.com>

        Merge r203982. rdar://problem/27547583

    2016-08-01  Eric Carlson  <eric.carlson@apple.com>

            [Mac][iOS] Adopt MediaRemote "seek to playback position"
            https://bugs.webkit.org/show_bug.cgi?id=160405
            <rdar://problem/27547583>

            Reviewed by Dean Jackson.

            Test: media/remote-control-command-seek.html

            * Modules/webaudio/AudioContext.h: Update for didReceiveRemoteControlCommand argument change.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::didReceiveRemoteControlCommand): Support SeekToPlaybackPositionCommand.
            Drive by fix, support Stop command.
            (WebCore::HTMLMediaElement::supportsSeeking): New.
            * html/HTMLMediaElement.h:

            * platform/RemoteCommandListener.h:
            (WebCore::RemoteCommandListenerClient::didReceiveRemoteControlCommand): Add command argument.
            (WebCore::RemoteCommandListenerClient::supportsSeeking): New.
            (WebCore::RemoteCommandListener::updateSupportedCommands): Ditto.
            (WebCore::RemoteCommandListener::client): Ditto.

            * platform/audio/PlatformMediaSession.cpp:
            (WebCore::PlatformMediaSession::didReceiveRemoteControlCommand): Add command argument.
            (WebCore::PlatformMediaSession::supportsSeeking): New, pass through to client.
            * platform/audio/PlatformMediaSession.h:

            * platform/audio/PlatformMediaSessionManager.cpp:
            (WebCore::PlatformMediaSessionManager::setCurrentSession): Tell remote command listener to
            update supported commands.
            (WebCore::PlatformMediaSessionManager::currentSession): Make const.
            (WebCore::PlatformMediaSessionManager::didReceiveRemoteControlCommand): Add command argument.
            (WebCore::PlatformMediaSessionManager::supportsSeeking): New, pass through to session.
            * platform/audio/PlatformMediaSessionManager.h:

            * platform/ios/RemoteCommandListenerIOS.h:
            (WebCore::RemoteCommandListenerIOS::createWeakPtr):
            * platform/ios/RemoteCommandListenerIOS.mm:
            (WebCore::RemoteCommandListenerIOS::RemoteCommandListenerIOS): Support changePlaybackPositionCommand.
            (WebCore::RemoteCommandListenerIOS::~RemoteCommandListenerIOS): Remove seekToTime target.
            (WebCore::RemoteCommandListenerIOS::updateSupportedCommands): Update changePlaybackPositionCommand.

            * platform/mac/MediaRemoteSoftLink.cpp:
            * platform/mac/MediaRemoteSoftLink.h:

            * platform/mac/RemoteCommandListenerMac.h:
            * platform/mac/RemoteCommandListenerMac.mm:
            (WebCore::RemoteCommandListenerMac::updateSupportedCommands): New, split out of constructor.
            (WebCore::RemoteCommandListenerMac::RemoteCommandListenerMac): Split setup logic out into
            updateSupportedCommands. Support MRMediaRemoteCommandSeekToPlaybackPosition. Don't assert when
            receiving an unsupported command, it happens. Return error when a command isn't supported or
            fails.

            * testing/Internals.cpp:
            (WebCore::Internals::postRemoteControlCommand): Add command argument parameter. Support
            seektoplaybackposition.
            * testing/Internals.h:
            * testing/Internals.idl:

2016-09-23  Babak Shafiei  <bshafiei@apple.com>

        Merge r206315. rdar://problem/28430615

    2016-09-23  Wenson Hsieh  <wenson_hsieh@apple.com>

            MediaSessionManagerMac::nowPlayingEligibleSession() needs to honor the main content heuristic
            https://bugs.webkit.org/show_bug.cgi?id=162480
            <rdar://problem/28430615>

            Reviewed by Jer Noble.

            Changes the implementation of nowPlayingEligibleSession to use bestMediaElementForShowingPlaybackControlsManager
            and also early return nullptr if the current tab the web process is hosted in is the active tab, and the window
            it is hosted in is the main window. This information is derived from the viewState flags in the Page of each
            tab -- whenever the (visible && active) state changes, the Page tells the global media session manager to update
            its Now Playing info. Then, when each MediaElementSession tries to determine whether it can show playback
            controls for the purposes of Now Playing, each session consults its page's visible and active state. If a page
            is both visible and active, no Now Playing controls are allowed for that media session.

            Also adds some slight adjustments to MediaSessionManagerMac::updateNowPlayingInfo, so we reset the title, rate
            and duration of the current active session when clearing out the now playing info. Likewise, when vending an
            active video, if the video information matches that of the current session, we mark m_nowPlayingActive anyways.
            These tweaks prevent us from getting in a bad state when switching between a tab with media and one without.

            Unit tests to come in a future patch.

            * html/HTMLMediaElement.cpp:
            (WebCore::mediaElementSessionInfoForSession):
            (WebCore::mediaSessionMayBeConfusedWithMainContent):
            (WebCore::HTMLMediaElement::bestMediaElementForShowingPlaybackControlsManager):
            (WebCore::HTMLMediaElement::updatePlaybackControlsManager):
            (WebCore::bestMediaSessionForShowingPlaybackControlsManager): Deleted.
            * html/HTMLMediaElement.h:
            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::canShowControlsManager):
            (WebCore::MediaElementSession::pageAllowsNowPlayingControls):
            * html/MediaElementSession.h:
            * page/Page.cpp:
            (WebCore::Page::setViewState):
            (WebCore::Page::isVisibleAndActive):
            * page/Page.h:
            * platform/audio/PlatformMediaSessionManager.cpp:
            (WebCore::PlatformMediaSessionManager::updateNowPlayingInfoIfNecessary):
            * platform/audio/PlatformMediaSessionManager.h:
            * platform/audio/mac/MediaSessionManagerMac.mm:
            (WebCore::PlatformMediaSessionManager::updateNowPlayingInfoIfNecessary):
            (WebCore::MediaSessionManagerMac::nowPlayingEligibleSession):
            (WebCore::MediaSessionManagerMac::updateNowPlayingInfo):

2016-09-23  Babak Shafiei  <bshafiei@apple.com>

        Merge r206272. rdar://problem/28339129

    2016-09-22  Jer Noble  <jer.noble@apple.com>

            Fullscreen controls inoperative in WebKitLegacy web views
            https://bugs.webkit.org/show_bug.cgi?id=162374

            Reviewed by Eric Carlson.

            After r205365, the WebPlaybackSessionInterfaceAVKit was now created after the
            WebPlaybackSessionModel which fed it data, so it no longer received the burst of data upon
            creation. Instead, it should have always asked the model for its cached data as soon as it
            was connected to set up its inital state.

            * platform/ios/WebPlaybackSessionInterfaceAVKit.mm:
            (WebCore::WebPlaybackSessionInterfaceAVKit::WebPlaybackSessionInterfaceAVKit):

2016-09-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r206193. rdar://problem/28376161

    2016-09-20  Jer Noble  <jer.noble@apple.com>

            Adopt MRMediaRemoteSetParentApplication.
            https://bugs.webkit.org/show_bug.cgi?id=162259
            <rdar://problem/28376161>

            Reviewed by Anders Carlsson.

            Allow MediaSessionManagerMac to retrieve the correct parent application identifier
            from a PlatformMediaSession so that it can pass that identifier through to MediaRemote
            via MRMediaRemoteSetParentApplication.

            * Modules/webaudio/AudioContext.cpp:
            (WebCore::AudioContext::sourceApplicationIdentifier):
            * Modules/webaudio/AudioContext.h:
            * platform/audio/PlatformMediaSession.cpp:
            (WebCore::PlatformMediaSession::sourceApplicationIdentifier):
            * platform/audio/PlatformMediaSession.h:
            (WebCore::PlatformMediaSession::resetPlaybackSessionState): Deleted.
            * platform/audio/mac/MediaSessionManagerMac.mm:
            (WebCore::MediaSessionManagerMac::updateNowPlayingInfo):
            * platform/mac/MediaRemoteSoftLink.cpp:
            * platform/mac/MediaRemoteSoftLink.h:


2016-09-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r206027. rdar://problem/28366812

    2016-09-16  Per Arne Vollan  <pvollan@apple.com>

            [Win] Compile fix.
            https://bugs.webkit.org/show_bug.cgi?id=162059

            Reviewed by Alex Christensen.

            If an include file exists in two places in the include paths, we can end up including the file twice,
            since #pragma once will not protect us against this.

            * PlatformWin.cmake: Put WebCore forwarding folder first in include list.

2016-09-16  Babak Shafiei  <bshafiei@apple.com>

        Merge r206006. rdar://problem/27991573

    2016-09-15  Brady Eidson  <beidson@apple.com>

            WKWebView.hasOnlySecureContent always returns "YES" after going back to a CachedPage (even if it has http resources).
            <rdar://problem/27681261> and https://bugs.webkit.org/show_bug.cgi?id=162043

            Reviewed by Brent Fulgham.

            No new tests (Not possible with current testing infrastructure).

            This adds the infrastructure for WebCore to track whether or not a CachedFrame had insecure content at the time
            it was cached, and then to report that back to the client when a CachedPage is restored.

            Since "has insecure content" is currently only tracked in the WK2 UI process, that is the only client of this code.

            * history/CachedFrame.cpp:
            (WebCore::CachedFrame::setHasInsecureContent):
            * history/CachedFrame.h:
            (WebCore::CachedFrame::hasInsecureContent):

            * loader/EmptyClients.h:

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::receivedFirstData):
            (WebCore::FrameLoader::commitProvisionalLoad):
            (WebCore::FrameLoader::dispatchDidCommitLoad):
            * loader/FrameLoader.h:

            * loader/FrameLoaderClient.h:

            * loader/FrameLoaderTypes.h:

2016-09-14  Babak Shafiei  <bshafiei@apple.com>

        Merge r205938. rdar://problem/28227805

    2016-09-14  Wenson Hsieh  <wenson_hsieh@apple.com>

            Media controls behave strangely when changing media sources
            https://bugs.webkit.org/show_bug.cgi?id=161914
            <rdar://problem/28227805>

            Reviewed by Tim Horton.

            Addresses media controls flickering while changing the source of a media element. To accomplish this, we make
            the following changes to the media controls main content heuristic:

            - Prevent elements that are not mostly within the mainframe rect (or elements with empty rects) from showing
              media controls. Many websites that rely on same document navigation will move videos offscreen when navigating
              to a section of their site that does not play media. Without this check, we would not know to hide a video
              element on certain popular websites that use this technique, since the video has been interacted with in the
              past.

            - Rather than check whether a media element currently has video/audio sources, check whether it has ever had
              audio. Many websites will use the same media element across different videos and change only the source, and
              we should not prevent a media element from having media controls on grounds of having no audio or video in
              this case.

            - Rather than add user gesture and playback behavior restrictions before dispatching an ended event, add only
              the gesture restriction immediately, and add the playback restriction after waiting for a grace period only if
              the user has not interacted with the video since ending, and the video is not currently playing or about to
              play. This gives the user a chance to interact with the controls when a video ends, but also allows the page
              to load or begin playing a new video with the same media element without thrashing media control state.

            Adds 3 new API tests.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::HTMLMediaElement):
            (WebCore::HTMLMediaElement::~HTMLMediaElement):
            (WebCore::HTMLMediaElement::mediaPlayerActiveSourceBuffersChanged):
            (WebCore::HTMLMediaElement::seekWithTolerance):
            (WebCore::HTMLMediaElement::beginScrubbing):
            (WebCore::HTMLMediaElement::addBehaviorRestrictionsOnEndIfNecessary):
            (WebCore::HTMLMediaElement::mediaPlayerCharacteristicChanged):
            (WebCore::HTMLMediaElement::playbackControlsManagerBehaviorRestrictionsTimerFired):
            * html/HTMLMediaElement.h:
            (WebCore::HTMLMediaElement::hasEverHadAudio):
            (WebCore::HTMLMediaElement::hasEverHadVideo):
            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::canShowControlsManager):
            (WebCore::isElementRectMostlyInMainFrame):
            * platform/graphics/MediaPlayer.h:
            (WebCore::MediaPlayerClient::mediaPlayerActiveSourceBuffersChanged):
            * platform/graphics/MediaPlayerPrivate.h:
            (WebCore::MediaPlayerPrivateInterface::notifyActiveSourceBuffersChanged):
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
            (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::notifyActiveSourceBuffersChanged):
            * platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:
            (WebCore::MediaSourcePrivateAVFObjC::removeSourceBuffer):
            (WebCore::MediaSourcePrivateAVFObjC::sourceBufferPrivateDidChangeActiveState):

2016-09-14  Babak Shafiei  <bshafiei@apple.com>

        Merge r205870. rdar://problem/28225774

    2016-09-13  Tim Horton  <timothy_horton@apple.com>

            Undoing a candidate insertion results in the replaced text being selected
            https://bugs.webkit.org/show_bug.cgi?id=161894
            <rdar://problem/28225774>

            Reviewed by Simon Fraser.

            Test: editing/mac/spelling/accept-candidate-undo-does-not-select.html

            * WebCore.xcodeproj/project.pbxproj:
            * editing/ReplaceRangeWithTextCommand.cpp: Added.
            (WebCore::ReplaceRangeWithTextCommand::ReplaceRangeWithTextCommand):
            (WebCore::ReplaceRangeWithTextCommand::doApply):
            * editing/ReplaceRangeWithTextCommand.h: Added.
            (WebCore::ReplaceRangeWithTextCommand::create):
            Add a editor command that replaces a range with the given text.

            * editing/Editor.cpp:
            (WebCore::Editor::rangeForTextCheckingResult):
            (WebCore::Editor::handleAcceptedCandidate):
            (WebCore::Editor::selectTextCheckingResult): Deleted.
            * editing/Editor.h:
            Make use of the new editor command to do candidate insertion as a single
            composite operation, so that it is undone as a unit. Otherwise, undo ends up
            undoing the insertion, but not the selection, and we are left with the old
            text, selected, which is undesirable.

2016-09-12  Babak Shafiei  <bshafiei@apple.com>

        Merge r205788. rdar://problem/28245097

    2016-09-11  Tim Horton  <timothy_horton@apple.com>

            Candidates that don't end in spaces shouldn't have spaces arbitrarily appended to them
            https://bugs.webkit.org/show_bug.cgi?id=161846
            <rdar://problem/28245097>

            Reviewed by Beth Dakin.

            Tests: editing/mac/spelling/accept-candidate-without-adding-space.html,
                   editing/mac/spelling/accept-candidate-allows-autocorrect-on-next-word.html

            * editing/Editor.cpp:
            (WebCore::Editor::handleAcceptedCandidate):
            Stop appending a space just because the candidate doesn't end in a space.
            There are languages where that doesn't make sense, and the platform
            guarantees that candidates will always have spaces if they need them.

            Also, adjust the way we compute the AcceptedCandidate document marker range.
            There were two problems with the existing code: it expanded outward from
            the post-insertion cursor in *both* directions, instead of just backwards,
            and it used the length of the replaced text, not the length of the newly
            inserted text (more of the confusion mentioned in r205765).

2016-09-12  Babak Shafiei  <bshafiei@apple.com>

        Merge r205154. rdar://problem/28233330

    2016-08-29  Chris Dumez  <cdumez@apple.com>

            Regression(r204923): It should be possible to set 'Location.href' cross origin
            https://bugs.webkit.org/show_bug.cgi?id=161343
            <rdar://problem/28063361>

            Reviewed by Ryosuke Niwa.

            It should be possible to set 'Location.href' cross origin:
            - https://html.spec.whatwg.org/#crossoriginproperties-(-o-)

            Firefox and Chrome allow this but we throw a SecurityError.

            We already allow setting crossOrigin.window.location which is equivalent.

            No new tests, updated existing test.

            * bindings/js/JSLocationCustom.cpp:
            (WebCore::JSLocation::putDelegate):
            Refactor the [Put] delegate so that it does not log a security error
            when setting 'href' attribute, given that setting it works as expected.
            This fixes a bug in shipping Safari where setting 'href' would work but
            log an error message anyway.

            * bindings/scripts/CodeGeneratorJS.pm:
            (GenerateImplementation):
            Add support for [DoNotCheckSecurityOnSetter] IDL extended attribute,
            in addition to the already supported [DoNotCheckSecurity] and
            [DoNotCheckSecurityOnGetter].

            * page/Location.idl:
            Use [DoNotCheckSecurityOnSetter] on 'href' attribute as it can be
            set cross-origin. This fixes the regression introduced in r204923.

2016-09-12  Babak Shafiei  <bshafiei@apple.com>

        Merge r204943. rdar://problem/28233330

    2016-08-24  Ryan Haddad  <ryanhaddad@apple.com>

            Rebaseline bindings tests after r204923.

            Unreviewed test gardening.

            * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
            (WebCore::jsTestActiveDOMObjectExcitingAttr):
            (WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):

2016-09-12  Babak Shafiei  <bshafiei@apple.com>

        Merge r204923. rdar://problem/28233330

    2016-08-24  Chris Dumez  <cdumez@apple.com>

            It should not be possible to access Location attributes cross origin
            https://bugs.webkit.org/show_bug.cgi?id=161125
            <rdar://problem/27982472>

            Reviewed by Brent Fulgham.

            It should not be possible to access Location attributes cross origin:
            - https://html.spec.whatwg.org/#crossoriginproperties-(-o-)

            We allow access to replace() as per the specification and consistently
            with Firefox. The specification seems to indicate we should allow access
            to 'href' but Firefox does not and we previously did not so I am not
            allowing it in this patch.

            Test: http/tests/security/location-cross-origin.html

            * bindings/scripts/CodeGeneratorJS.pm:
            (GenerateImplementation):
            * page/Location.idl:

2016-09-12  Babak Shafiei  <bshafiei@apple.com>

        Merge r205784. rdar://problem/28230123

    2016-09-10  Wenson Hsieh  <wenson_hsieh@apple.com>

            Apple.com keynote does not display media controls
            https://bugs.webkit.org/show_bug.cgi?id=161833
            <rdar://problem/28230123>

            Reviewed by Tim Horton.

            Tweaks the main content check so that we can distinguish between main content for the purposes of determining
            autoplay policy vs. main content for the purposes of showing media controls. Namely, we make the latter less
            restrictive than the former in terms of the maximum aspect ratio a video can have to be considered the right
            size for main content.

            New unit test in TestWebKitAPI.

            * html/HTMLMediaElement.cpp:
            (WebCore::mediaElementSessionInfoForSession):
            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::canShowControlsManager):
            (WebCore::MediaElementSession::isLargeEnoughForMainContent):
            (WebCore::MediaElementSession::wantsToObserveViewportVisibilityForMediaControls):
            (WebCore::isMainContentForPurposesOfAutoplay):
            (WebCore::isElementLargeEnoughForMainContent):
            (WebCore::MediaElementSession::updateIsMainContent):
            (WebCore::isMainContent): Deleted.
            * html/MediaElementSession.h:

2016-09-12  Babak Shafiei  <bshafiei@apple.com>

        Merge r205765. rdar://problem/28033492

    2016-09-09  Tim Horton  <timothy_horton@apple.com>

            Text replacement candidates don't always overwrite the entire original string
            https://bugs.webkit.org/show_bug.cgi?id=161779
            <rdar://problem/28033492>

            Reviewed by Simon Fraser.

            New test: editing/mac/spelling/accept-candidate-replacing-multiple-words.html.

            * editing/Editor.cpp:
            (WebCore::Editor::contextRangeForCandidateRequest):
            Factor contextRangeForCandidateRequest out of the WebKits, into Editor.
            This just expands to paragraph boundaries from the cursor.

            (WebCore::Editor::selectTextCheckingResult):
            Add selectTextCheckingResult, which, given a TextCheckingResult,
            selects the range represented by the result's location and length, which
            indicate the portion of the context string that the result refers to.
            In the case of accepting a candidate, we want to select that range
            so that our insertion will overwrite it.

            (WebCore::Editor::handleAcceptedCandidate):
            Make use of selectTextCheckingResult instead of just assuming that we want
            to replace the word to the left of the insertion point.

            (WebCore::Editor::stringForCandidateRequest): Deleted.
            * editing/Editor.h:

            * testing/Internals.cpp:
            (WebCore::Internals::handleAcceptedCandidate):
            * testing/Internals.h:
            * testing/Internals.idl:
            Internals' handleAcceptedCandidate assumed (wrongly) that the length
            of a TextCheckerResult was the length of the candidate, when really it is
            the length of the text that the candidate would replace. Adjust this,
            and expose the replacement range to JavaScript, so we can test this.

2016-09-09  Babak Shafiei  <bshafiei@apple.com>

        Merge r204456. rdar://problem/27860536

    2016-08-14  Daniel Bates  <dabates@apple.com>

            Fix compiler errors when building iOS WebKit using the iOS 10 beta SDK
            https://bugs.webkit.org/show_bug.cgi?id=160725

            Reviewed by Sam Weinig.

            * platform/cocoa/ThemeCocoa.mm: Unconditionally include header dlfcn.h as it
            exists in both the public iOS 9.3 SDK and iOS 10 beta SDK.
            * platform/spi/cocoa/CoreTextSPI.h: Add SPI declarations for constants that were
            used in r204107.
            * platform/spi/cocoa/PassKitSPI.h: Remove unnecessary #import statements when
            building with the Apple Internal SDK. Include header PassKit/PassKit.h when
            building for iOS.
            * platform/spi/cocoa/QuartzCoreSPI.h: No need to define CLayer.contentsFormat
            when building with the iOS 10 beta SDK as it is now part of the public API.

2016-09-09  Babak Shafiei  <bshafiei@apple.com>

        Merge r203381. rdar://problem/27860536

    2016-07-18  Anders Carlsson  <andersca@apple.com>

            WebKit nightly fails to build on macOS Sierra
            https://bugs.webkit.org/show_bug.cgi?id=159902
            rdar://problem/27365672

            Reviewed by Tim Horton.

            * Modules/applepay/cocoa/PaymentCocoa.mm:
            * Modules/applepay/cocoa/PaymentContactCocoa.mm:
            * Modules/applepay/cocoa/PaymentMerchantSessionCocoa.mm:
            * Modules/applepay/cocoa/PaymentMethodCocoa.mm:
            Use new PassKitSPI header.

            * WebCore.xcodeproj/project.pbxproj:
            Add new PassKitSPI header.

            * icu/unicode/ucurr.h: Added.
            Add ucurr.h from ICU.

            * platform/spi/cocoa/PassKitSPI.h: Added.
            Add new PassKitSPI header.

2016-09-09  Babak Shafiei  <bshafiei@apple.com>

        Merge r204107. rdar://problem/27860536

    2016-08-03  Myles C. Maxfield  <mmaxfield@apple.com>

            [iOS] SF-Heavy is not accessible from web content
            https://bugs.webkit.org/show_bug.cgi?id=160522
            <rdar://problem/27685273>

            Reviewed by Simon Fraser.

            The mappings we were using from CSS font-weight to CoreText font weight were inaccurate.
            Instead, these new mappings should be used.

            Test: fast/text/system-font-weight.html

            * platform/graphics/ios/FontCacheIOS.mm:
            (WebCore::systemFontModificationAttributes):

2016-09-09  Babak Shafiei  <bshafiei@apple.com>

        Merge r205381. rdar://problem/27806012

    2016-09-02  Beth Dakin  <bdakin@apple.com>

            Need to updateEditorState if an element change edit-ability without changing
            selection
            https://bugs.webkit.org/show_bug.cgi?id=161546
            -and corresponding-
            rdar://problem/27806012

            Reviewed by Ryosuke Niwa.

            Call into the client in case edited state needs to be updated.
            * editing/FrameSelection.cpp:
            (WebCore::FrameSelection::updateAppearanceAfterLayout):
            * loader/EmptyClients.h:
            * page/EditorClient.h:

2016-09-09  Babak Shafiei  <bshafiei@apple.com>

        Merge r205365. rdar://problem/28020157

    2016-07-08  Jer Noble  <jer.noble@apple.com>

            Refactor WebPlaybackSessionModelMediaElement to be client based.
            https://bugs.webkit.org/show_bug.cgi?id=159580

            Reviewed by Eric Carlson.

            Add client callback interfaces to both WebPlaybackSessionModel and WebVideoFullscreenModel, where each object
            can have multiple clients, and so the object will both store current values and also notify those clients
            when the values change. After this change, there is no need to have the models know about their associated
            interfaces explicitly.

            * platform/cocoa/WebPlaybackSessionInterface.h:
            * platform/cocoa/WebPlaybackSessionModel.h:
            (WebCore::WebPlaybackSessionModelClient::~WebPlaybackSessionModelClient):
            (WebCore::WebPlaybackSessionModelClient::durationChanged):
            (WebCore::WebPlaybackSessionModelClient::currentTimeChanged):
            (WebCore::WebPlaybackSessionModelClient::bufferedTimeChanged):
            (WebCore::WebPlaybackSessionModelClient::rateChanged):
            (WebCore::WebPlaybackSessionModelClient::seekableRangesChanged):
            (WebCore::WebPlaybackSessionModelClient::canPlayFastReverseChanged):
            (WebCore::WebPlaybackSessionModelClient::audioMediaSelectionOptionsChanged):
            (WebCore::WebPlaybackSessionModelClient::legibleMediaSelectionOptionsChanged):
            (WebCore::WebPlaybackSessionModelClient::externalPlaybackChanged):
            (WebCore::WebPlaybackSessionModelClient::wirelessVideoPlaybackDisabledChanged):
            * platform/cocoa/WebPlaybackSessionModelMediaElement.h:
            * platform/cocoa/WebPlaybackSessionModelMediaElement.mm:
            (WebPlaybackSessionModelMediaElement::setMediaElement):
            (WebPlaybackSessionModelMediaElement::updateForEventName):
            (WebPlaybackSessionModelMediaElement::addClient):
            (WebPlaybackSessionModelMediaElement::removeClient):
            (WebPlaybackSessionModelMediaElement::updateLegibleOptions):
            (WebPlaybackSessionModelMediaElement::observedEventNames):
            (WebPlaybackSessionModelMediaElement::eventNameAll):
            (WebPlaybackSessionModelMediaElement::audioMediaSelectionOptions):
            (WebPlaybackSessionModelMediaElement::audioMediaSelectedIndex):
            (WebPlaybackSessionModelMediaElement::legibleMediaSelectedIndex):
            (WebPlaybackSessionModelMediaElement::externalPlaybackEnabled):
            (WebPlaybackSessionModelMediaElement::externalPlaybackTargetType):
            (WebPlaybackSessionModelMediaElement::externalPlaybackLocalizedDeviceName):
            (WebPlaybackSessionModelMediaElement::wirelessVideoPlaybackDisabled):
            (WebPlaybackSessionModelMediaElement::setWebPlaybackSessionInterface): Deleted.
            * platform/cocoa/WebVideoFullscreenInterface.h:
            * platform/cocoa/WebVideoFullscreenModel.h:
            (WebCore::WebVideoFullscreenModelClient::~WebVideoFullscreenModelClient):
            * platform/cocoa/WebVideoFullscreenModelVideoElement.h:
            (WebCore::WebVideoFullscreenModelVideoElement::create):
            (WebCore::WebVideoFullscreenModelVideoElement::playbackSessionModel): Deleted.
            * platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
            (WebVideoFullscreenModelVideoElement::WebVideoFullscreenModelVideoElement):
            (WebVideoFullscreenModelVideoElement::setVideoElement):
            (WebVideoFullscreenModelVideoElement::updateForEventName):
            (WebVideoFullscreenModelVideoElement::addClient):
            (WebVideoFullscreenModelVideoElement::removeClient):
            (WebVideoFullscreenModelVideoElement::setHasVideo):
            (WebVideoFullscreenModelVideoElement::setVideoDimensions):
            (WebVideoFullscreenModelVideoElement::setWebVideoFullscreenInterface): Deleted.
            * platform/ios/WebAVPlayerController.h:
            * platform/ios/WebAVPlayerController.mm:
            (-[WebAVPlayerController resetState]): Deleted.
            * platform/ios/WebPlaybackSessionInterfaceAVKit.h:
            (WebCore::WebPlaybackSessionInterfaceAVKitClient::~WebPlaybackSessionInterfaceAVKitClient): Deleted.
            * platform/ios/WebPlaybackSessionInterfaceAVKit.mm:
            (WebCore::WebPlaybackSessionInterfaceAVKit::WebPlaybackSessionInterfaceAVKit):
            (WebCore::WebPlaybackSessionInterfaceAVKit::~WebPlaybackSessionInterfaceAVKit):
            (WebCore::WebPlaybackSessionInterfaceAVKit::resetMediaState):
            (WebCore::WebPlaybackSessionInterfaceAVKit::durationChanged):
            (WebCore::WebPlaybackSessionInterfaceAVKit::currentTimeChanged):
            (WebCore::WebPlaybackSessionInterfaceAVKit::bufferedTimeChanged):
            (WebCore::WebPlaybackSessionInterfaceAVKit::rateChanged):
            (WebCore::WebPlaybackSessionInterfaceAVKit::seekableRangesChanged):
            (WebCore::WebPlaybackSessionInterfaceAVKit::canPlayFastReverseChanged):
            (WebCore::WebPlaybackSessionInterfaceAVKit::audioMediaSelectionOptionsChanged):
            (WebCore::WebPlaybackSessionInterfaceAVKit::legibleMediaSelectionOptionsChanged):
            (WebCore::WebPlaybackSessionInterfaceAVKit::externalPlaybackChanged):
            (WebCore::WebPlaybackSessionInterfaceAVKit::wirelessVideoPlaybackDisabledChanged):
            (WebCore::WebPlaybackSessionInterfaceAVKit::invalidate):
            (WebCore::WebPlaybackSessionInterfaceAVKit::setWebPlaybackSessionModel): Deleted.
            (WebCore::WebPlaybackSessionInterfaceAVKit::setDuration): Deleted.
            (WebCore::WebPlaybackSessionInterfaceAVKit::setCurrentTime): Deleted.
            (WebCore::WebPlaybackSessionInterfaceAVKit::setBufferedTime): Deleted.
            (WebCore::WebPlaybackSessionInterfaceAVKit::setRate): Deleted.
            (WebCore::WebPlaybackSessionInterfaceAVKit::setSeekableRanges): Deleted.
            (WebCore::WebPlaybackSessionInterfaceAVKit::setCanPlayFastReverse): Deleted.
            (WebCore::WebPlaybackSessionInterfaceAVKit::setAudioMediaSelectionOptions): Deleted.
            (WebCore::WebPlaybackSessionInterfaceAVKit::setLegibleMediaSelectionOptions): Deleted.
            (WebCore::WebPlaybackSessionInterfaceAVKit::setExternalPlayback): Deleted.
            (WebCore::WebPlaybackSessionInterfaceAVKit::setWirelessVideoPlaybackDisabled): Deleted.
            (WebCore::WebPlaybackSessionInterfaceAVKit::wirelessVideoPlaybackDisabled): Deleted.
            * platform/ios/WebVideoFullscreenControllerAVKit.mm:
            (WebVideoFullscreenControllerContext::didSetupFullscreen):
            (WebVideoFullscreenControllerContext::didExitFullscreen):
            (WebVideoFullscreenControllerContext::didCleanupFullscreen):
            (WebVideoFullscreenControllerContext::durationChanged):
            (WebVideoFullscreenControllerContext::currentTimeChanged):
            (WebVideoFullscreenControllerContext::bufferedTimeChanged):
            (WebVideoFullscreenControllerContext::rateChanged):
            (WebVideoFullscreenControllerContext::hasVideoChanged):
            (WebVideoFullscreenControllerContext::videoDimensionsChanged):
            (WebVideoFullscreenControllerContext::seekableRangesChanged):
            (WebVideoFullscreenControllerContext::canPlayFastReverseChanged):
            (WebVideoFullscreenControllerContext::audioMediaSelectionOptionsChanged):
            (WebVideoFullscreenControllerContext::legibleMediaSelectionOptionsChanged):
            (WebVideoFullscreenControllerContext::externalPlaybackChanged):
            (WebVideoFullscreenControllerContext::wirelessVideoPlaybackDisabledChanged):
            (WebVideoFullscreenControllerContext::addClient):
            (WebVideoFullscreenControllerContext::removeClient):
            (WebVideoFullscreenControllerContext::requestFullscreenMode):
            (WebVideoFullscreenControllerContext::setVideoLayerFrame):
            (WebVideoFullscreenControllerContext::setVideoLayerGravity):
            (WebVideoFullscreenControllerContext::fullscreenModeChanged):
            (WebVideoFullscreenControllerContext::isVisible):
            (WebVideoFullscreenControllerContext::hasVideo):
            (WebVideoFullscreenControllerContext::videoDimensions):
            (WebVideoFullscreenControllerContext::play):
            (WebVideoFullscreenControllerContext::pause):
            (WebVideoFullscreenControllerContext::togglePlayState):
            (WebVideoFullscreenControllerContext::beginScrubbing):
            (WebVideoFullscreenControllerContext::endScrubbing):
            (WebVideoFullscreenControllerContext::seekToTime):
            (WebVideoFullscreenControllerContext::fastSeek):
            (WebVideoFullscreenControllerContext::beginScanningForward):
            (WebVideoFullscreenControllerContext::beginScanningBackward):
            (WebVideoFullscreenControllerContext::endScanning):
            (WebVideoFullscreenControllerContext::selectAudioMediaOption):
            (WebVideoFullscreenControllerContext::selectLegibleMediaOption):
            (WebVideoFullscreenControllerContext::duration):
            (WebVideoFullscreenControllerContext::currentTime):
            (WebVideoFullscreenControllerContext::bufferedTime):
            (WebVideoFullscreenControllerContext::isPlaying):
            (WebVideoFullscreenControllerContext::playbackRate):
            (WebVideoFullscreenControllerContext::seekableRanges):
            (WebVideoFullscreenControllerContext::canPlayFastReverse):
            (WebVideoFullscreenControllerContext::audioMediaSelectionOptions):
            (WebVideoFullscreenControllerContext::audioMediaSelectedIndex):
            (WebVideoFullscreenControllerContext::legibleMediaSelectionOptions):
            (WebVideoFullscreenControllerContext::legibleMediaSelectedIndex):
            (WebVideoFullscreenControllerContext::externalPlaybackEnabled):
            (WebVideoFullscreenControllerContext::externalPlaybackTargetType):
            (WebVideoFullscreenControllerContext::externalPlaybackLocalizedDeviceName):
            (WebVideoFullscreenControllerContext::wirelessVideoPlaybackDisabled):
            (WebVideoFullscreenControllerContext::setUpFullscreen):
            (WebVideoFullscreenControllerContext::exitFullscreen):
            (WebVideoFullscreenControllerContext::requestHideAndExitFullscreen):
            (WebVideoFullscreenControllerContext::resetMediaState): Deleted.
            (WebVideoFullscreenControllerContext::setDuration): Deleted.
            (WebVideoFullscreenControllerContext::setCurrentTime): Deleted.
            (WebVideoFullscreenControllerContext::setBufferedTime): Deleted.
            (WebVideoFullscreenControllerContext::setRate): Deleted.
            (WebVideoFullscreenControllerContext::setVideoDimensions): Deleted.
            (WebVideoFullscreenControllerContext::setSeekableRanges): Deleted.
            (WebVideoFullscreenControllerContext::setCanPlayFastReverse): Deleted.
            (WebVideoFullscreenControllerContext::setAudioMediaSelectionOptions): Deleted.
            (WebVideoFullscreenControllerContext::setLegibleMediaSelectionOptions): Deleted.
            (WebVideoFullscreenControllerContext::setExternalPlayback): Deleted.
            (WebVideoFullscreenControllerContext::setWirelessVideoPlaybackDisabled): Deleted.
            (WebVideoFullscreenSessionModel::play): Deleted.
            (WebVideoFullscreenSessionModel::pause): Deleted.
            (WebVideoFullscreenSessionModel::togglePlayState): Deleted.
            (WebVideoFullscreenSessionModel::beginScrubbing): Deleted.
            (WebVideoFullscreenSessionModel::endScrubbing): Deleted.
            (WebVideoFullscreenSessionModel::seekToTime): Deleted.
            (WebVideoFullscreenSessionModel::fastSeek): Deleted.
            (WebVideoFullscreenSessionModel::beginScanningForward): Deleted.
            (WebVideoFullscreenSessionModel::beginScanningBackward): Deleted.
            (WebVideoFullscreenSessionModel::endScanning): Deleted.
            (WebVideoFullscreenSessionModel::selectAudioMediaOption): Deleted.
            (WebVideoFullscreenSessionModel::selectLegibleMediaOption): Deleted.
            * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
            * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
            (WebVideoFullscreenInterfaceAVKit::~WebVideoFullscreenInterfaceAVKit):
            (WebVideoFullscreenInterfaceAVKit::setWebVideoFullscreenModel):
            (WebVideoFullscreenInterfaceAVKit::setWebVideoFullscreenChangeObserver):
            (WebVideoFullscreenInterfaceAVKit::hasVideoChanged):
            (WebVideoFullscreenInterfaceAVKit::videoDimensionsChanged):
            (WebVideoFullscreenInterfaceAVKit::externalPlaybackChanged):
            (WebVideoFullscreenInterfaceAVKit::resetMediaState): Deleted.
            (WebVideoFullscreenInterfaceAVKit::setDuration): Deleted.
            (WebVideoFullscreenInterfaceAVKit::setCurrentTime): Deleted.
            (WebVideoFullscreenInterfaceAVKit::setBufferedTime): Deleted.
            (WebVideoFullscreenInterfaceAVKit::setRate): Deleted.
            (WebVideoFullscreenInterfaceAVKit::setVideoDimensions): Deleted.
            (WebVideoFullscreenInterfaceAVKit::setSeekableRanges): Deleted.
            (WebVideoFullscreenInterfaceAVKit::setCanPlayFastReverse): Deleted.
            (WebVideoFullscreenInterfaceAVKit::setAudioMediaSelectionOptions): Deleted.
            (WebVideoFullscreenInterfaceAVKit::setLegibleMediaSelectionOptions): Deleted.
            (WebVideoFullscreenInterfaceAVKit::setExternalPlayback): Deleted.
            (WebVideoFullscreenInterfaceAVKit::externalPlaybackEnabledChanged): Deleted.
            (WebVideoFullscreenInterfaceAVKit::setWirelessVideoPlaybackDisabled): Deleted.
            (WebVideoFullscreenInterfaceAVKit::wirelessVideoPlaybackDisabled): Deleted.
            * platform/mac/WebPlaybackSessionInterfaceMac.h:
            (WebCore::WebPlaybackSessionInterfaceMacClient::~WebPlaybackSessionInterfaceMacClient): Deleted.
            * platform/mac/WebPlaybackSessionInterfaceMac.mm:
            (WebCore::WebPlaybackSessionInterfaceMac::create):
            (WebCore::WebPlaybackSessionInterfaceMac::WebPlaybackSessionInterfaceMac):
            (WebCore::WebPlaybackSessionInterfaceMac::~WebPlaybackSessionInterfaceMac):
            (WebCore::WebPlaybackSessionInterfaceMac::durationChanged):
            (WebCore::WebPlaybackSessionInterfaceMac::currentTimeChanged):
            (WebCore::WebPlaybackSessionInterfaceMac::rateChanged):
            (WebCore::WebPlaybackSessionInterfaceMac::seekableRangesChanged):
            (WebCore::WebPlaybackSessionInterfaceMac::audioMediaSelectionOptionsChanged):
            (WebCore::WebPlaybackSessionInterfaceMac::legibleMediaSelectionOptionsChanged):
            (WebCore::WebPlaybackSessionInterfaceMac::invalidate):
            (WebCore::WebPlaybackSessionInterfaceMac::setWebPlaybackSessionModel): Deleted.
            (WebCore::WebPlaybackSessionInterfaceMac::setClient): Deleted.
            (WebCore::WebPlaybackSessionInterfaceMac::setDuration): Deleted.
            (WebCore::WebPlaybackSessionInterfaceMac::setCurrentTime): Deleted.
            (WebCore::WebPlaybackSessionInterfaceMac::setRate): Deleted.
            (WebCore::WebPlaybackSessionInterfaceMac::setSeekableRanges): Deleted.
            (WebCore::WebPlaybackSessionInterfaceMac::setAudioMediaSelectionOptions): Deleted.
            (WebCore::WebPlaybackSessionInterfaceMac::setLegibleMediaSelectionOptions): Deleted.
            * platform/mac/WebVideoFullscreenInterfaceMac.h:
            * platform/mac/WebVideoFullscreenInterfaceMac.mm:
            (WebCore::WebVideoFullscreenInterfaceMac::WebVideoFullscreenInterfaceMac):
            (WebCore::WebVideoFullscreenInterfaceMac::~WebVideoFullscreenInterfaceMac):
            (WebCore::WebVideoFullscreenInterfaceMac::setWebVideoFullscreenModel):
            (WebCore::WebVideoFullscreenInterfaceMac::externalPlaybackChanged):
            (WebCore::WebVideoFullscreenInterfaceMac::hasVideoChanged):
            (WebCore::WebVideoFullscreenInterfaceMac::videoDimensionsChanged):
            (WebCore::WebVideoFullscreenInterfaceMac::setDuration): Deleted.
            (WebCore::WebVideoFullscreenInterfaceMac::setCurrentTime): Deleted.
            (WebCore::WebVideoFullscreenInterfaceMac::setRate): Deleted.
            (WebCore::WebVideoFullscreenInterfaceMac::setSeekableRanges): Deleted.
            (WebCore::WebVideoFullscreenInterfaceMac::setAudioMediaSelectionOptions): Deleted.
            (WebCore::WebVideoFullscreenInterfaceMac::setLegibleMediaSelectionOptions): Deleted.
            (WebCore::WebVideoFullscreenInterfaceMac::setExternalPlayback): Deleted.
            (WebCore::WebVideoFullscreenInterfaceMac::setVideoDimensions): Deleted.

2016-09-09  Babak Shafiei  <bshafiei@apple.com>

        Merge r205246. rdar://problem/28162589

    2016-08-31  Antti Koivisto  <antti@apple.com>

            REGRESSION (r201701): Unable to copy from CodeMirror editor version used in Jenkins install website
            https://bugs.webkit.org/show_bug.cgi?id=161386
            <rdar://problem/27590077>

            Reviewed by Dan Bernstein.

            This CodeMirror version uses a hidden <textarea> to implement copy/paste. The textarea has width:1px; border-width:1px.
            Jenkins page has also has a stylesheet that contains * { box-sizing:border-box } and as a result the textarea content
            width gets computed as 0. With r201701 we use content size instead of box size for clipping and the textarea content is
            (correctly) considered invisible.

            Add a quirk that allows this to continue working.

            Test: editing/text-iterator/hidden-textarea-selection-quirk.html

            * editing/TextIterator.cpp:
            (WebCore::fullyClipsContents):

2016-09-09  Babak Shafiei  <bshafiei@apple.com>

        Merge r205417. rdar://problem/28018438

    2016-09-03  Wenson Hsieh  <wenson_hsieh@apple.com>

            Media controls behave strangely when videos mute from within a playing handler
            https://bugs.webkit.org/show_bug.cgi?id=161559
            <rdar://problem/28018438>

            Reviewed by Darin Adler.

            Defer showing media controls until after the media element has fired its onplaying handler. This handles cases
            where videos that autoplay may initially meet the criteria for main content, but once the video begins to play,
            the page may change the media in some way (e.g. muting) that makes the video no longer main content. This causes
            media controls to flicker in and out.

            These changes are covered by existing unit tests, which have been refactored to check media controller state
            after all autoplaying videos have begun playing. Also adds an additional unit test.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::notifyAboutPlaying):
            (WebCore::HTMLMediaElement::hasEverNotifiedAboutPlaying):
            * html/HTMLMediaElement.h:
            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::canShowControlsManager):

2016-09-09  Babak Shafiei  <bshafiei@apple.com>

        Merge r205412. rdar://problem/28014919

    2016-09-03  Wenson Hsieh  <wenson_hsieh@apple.com>

            Refactor the heuristic for showing media controls to take all media sessions into account
            https://bugs.webkit.org/show_bug.cgi?id=161503
            <rdar://problem/28033783>

            Reviewed by Darin Adler.

            Currently, when selecting a media session to show playback controls for, we grab the first media session that
            passes our heuristic. Using this method, we are unable to take additional factors into account, such as whether
            another media session's element is scrolled in view, or if another media session has been interacted with more
            recently. To address this, we make the following changes:

                1.  Consider the list of all MediaElementSessions.

                2.  Select only the MediaElementSessions capable of showing media controls and sort the list by a special
                    heuristic that takes visibility and time of last user interaction into account. The first element on
                    this list is the strongest candidate for main content.

                3.  If this strongest candidate is visible in the viewport, or it is playing with audio, we return this
                    as the chosen candidate. Otherwise, we return this session only if no other non-candidate video could be
                    confused as the main content (i.e. the non-candidate video is not only visible in the viewport, but also
                    large enough to be considered main content).

            Using this new method of determining the video to show controls for, we retain previous behavior for pages with
            a single video. On pages with multiple videos, the above logic ensures that if the current controlled video is
            paused, scrolled out of view, and then a new video is scrolled into view, we will either hide media controls to
            avoid confusion if that video could be confused for main content (using the mechanism in step 3), or we
            hook up the media controls to the new video if it satisfies main content (using the mechanism in step 2).

            This patch also adds 6 new TestWebKitAPI unit tests.

            * html/HTMLMediaElement.cpp:
            (WebCore::mediaElementSessionInfoForSession):
            (WebCore::preferMediaControlsForCandidateSessionOverOtherCandidateSession):
            (WebCore::mediaSessionMayBeConfusedWithMainContent):
            (WebCore::bestMediaSessionForShowingPlaybackControlsManager):
            (WebCore::HTMLMediaElement::didAttachRenderers):
            (WebCore::HTMLMediaElement::layoutSizeChanged):
            (WebCore::HTMLMediaElement::isVisibleInViewportChanged):
            (WebCore::HTMLMediaElement::resetPlaybackSessionState):
            (WebCore::HTMLMediaElement::isVisibleInViewport):
            (WebCore::HTMLMediaElement::updatePlaybackControlsManager):
            * html/HTMLMediaElement.h:
            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::removeBehaviorRestriction):
            (WebCore::MediaElementSession::canShowControlsManager):
            (WebCore::MediaElementSession::isLargeEnoughForMainContent):
            (WebCore::MediaElementSession::mostRecentUserInteractionTime):
            (WebCore::MediaElementSession::wantsToObserveViewportVisibilityForMediaControls):
            (WebCore::MediaElementSession::wantsToObserveViewportVisibilityForAutoplay):
            (WebCore::MediaElementSession::resetPlaybackSessionState):
            (WebCore::MediaElementSession::canControlControlsManager): Deleted.
            * html/MediaElementSession.h:
            * platform/audio/PlatformMediaSession.h:
            (WebCore::PlatformMediaSession::resetPlaybackSessionState):
            (WebCore::PlatformMediaSession::canControlControlsManager): Deleted.
            * platform/audio/PlatformMediaSessionManager.cpp:
            (WebCore::PlatformMediaSessionManager::currentSessionsMatching):
            (WebCore::PlatformMediaSessionManager::currentSessionMatching): Deleted.
            * platform/audio/PlatformMediaSessionManager.h:
            * platform/cocoa/WebPlaybackSessionModelMediaElement.mm:
            (WebPlaybackSessionModelMediaElement::setMediaElement):

2016-08-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r205193. rdar://problem/27529052

    2016-08-30  Wenson Hsieh  <wenson_hsieh@apple.com>

            Fix a typo introduced in r205184.
            https://bugs.webkit.org/show_bug.cgi?id=161380

            Reviewed by Tim Horton.

            Fixes a typo in an accessibility string: "Exit fullscreen" => "Exit Fullscreen"

            * platform/LocalizedStrings.cpp:
            (WebCore::exitFullScreenButtonAccessibilityTitle):

2016-08-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r205184. rdar://problem/27529052

    2016-08-30  Wenson Hsieh  <wenson_hsieh@apple.com>

            Exit fullscreen button in fullscreen media playback needs an accessibility string
            https://bugs.webkit.org/show_bug.cgi?id=161380

            Reviewed by Beth Dakin.

            Adds an accessibility string for the exit fullscreen button.

            * English.lproj/Localizable.strings:
            * platform/LocalizedStrings.cpp:
            (WebCore::exitFullScreenButtonAccessibilityTitle):
            * platform/LocalizedStrings.h:

2016-08-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r205044. rdar://problem/27933564

    2016-08-26  Beth Dakin  <bdakin@apple.com>

            charactersAroundPosition can be wrong because it crosses editing boundaries
            https://bugs.webkit.org/show_bug.cgi?id=161215
            -and corresponding-
            rdar://problem/27933564

            Reviewed by Ryosuke Niwa.

            charactersAroundPosition() should not cross editing boundaries. This patch fixes
            that by making nextCharacterBoundaryInDirection() take an
            EditingBoundaryCrossingRule parameter to pass onto VisiblePosition::next() and
            VisiblePosition::previous().

            * editing/VisibleUnits.cpp:
            (WebCore::nextCharacterBoundaryInDirection):
            (WebCore::positionOfNextBoundaryOfGranularity):
            (WebCore::charactersAroundPosition):

2016-08-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r204989. rdar://problem/28015116

    2016-08-25  Wenson Hsieh  <wenson_hsieh@apple.com>

            Dragging against the end of the inline media scrubber causes the media scrubber to hide
            https://bugs.webkit.org/show_bug.cgi?id=161207

            Reviewed by Eric Carlson.

            Previously, we would re-enable behavior restrictions when firing an ended event. However, if the ended event is
            caused by the user seeking to the end of the video, the media controls would be taken away from under the user.
            To prevent this, we don't add the relevant behavior restrictions upon media ended if media was seeking before
            firing the event.

            Tweaked an existing WebKit API test to cover this change.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::mediaPlayerTimeChanged):
            (WebCore::HTMLMediaElement::addBehaviorRestrictionsOnEndIfNecessary):
            * html/HTMLMediaElement.h:
            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::canControlControlsManager):

2016-08-30  Babak Shafiei  <bshafiei@apple.com>

        Merge r204983. rdar://problem/27952772

    2016-08-25  Said Abou-Hallawa  <sabouhallawa@apple.com>

            REGRESSION (r203378): [iOS] The PDF image is rendered stretched if a sub image of it is cached first
            https://bugs.webkit.org/show_bug.cgi?id=160617

            Reviewed by Tim Horton.

            When caching only a sub-image of the PDF ensure the source rectangle starts
            at the top-left of the cached sub-image rectangle. When drawing the cached
            sub-image to the destination context ensure the destination rectangle is the
            sub-image rectangle so no stretching or shrinking happens.

            Test: fast/images/cached-clipped-pdf.html

            * page/Settings.cpp:
            (WebCore::Settings::Settings):
            (WebCore::Settings::setCachedPDFImageEnabled): Deleted.
            * page/Settings.h:
            (WebCore::Settings::isCachedPDFImageEnabled): Deleted.
            * page/Settings.in:
            Change the boolean setting CachedPDFImageEnabled to be enum property and
            rename it PDFImageCachingPolicy. Allow the "PDFImageCachingBelowMemoryLimit"
            option to be available on a;; platforms. The "PDFImageCachingClipBoundsOnly"
            option is added for testing purpose. If forces recaching the PDF with each
            draw and it sets the cached image rectangle to the clipping rectangle.

            * platform/graphics/cg/PDFDocumentImage.cpp:
            (WebCore::PDFDocumentImage::setPdfImageCachingPolicy): Take an enum instead of boolean.
            (WebCore::cachedImageRect):
            (WebCore::PDFDocumentImage::decodedSizeChanged): Enable PDFImageCachingBelowMemoryLimit
            on all platforms.
            (WebCore::PDFDocumentImage::updateCachedImageIfNeeded): Fix the source rectangle
            when caching a sub-image of the PDF.
            (WebCore::PDFDocumentImage::draw): Fix the destination rectangle when drawing
            a sub-image to the destination context.
            (WebCore::PDFDocumentImage::setCachedPDFImageEnabled): Deleted.
            * platform/graphics/cg/PDFDocumentImage.h:

            * rendering/RenderImage.cpp:
            (WebCore::RenderImage::paintIntoRect):

            * testing/InternalSettings.cpp:
            (WebCore::InternalSettings::Backup::Backup):
            (WebCore::InternalSettings::Backup::restoreTo):
            (WebCore::InternalSettings::setPDFImageCachingPolicy):
            (WebCore::InternalSettings::setCachedPDFImageEnabled): Deleted.
            * testing/InternalSettings.h:
            * testing/InternalSettings.idl:
            Change the internal setting CachedPDFImageEnabled to PDFImageCachingPolicy.

2016-08-30  Babak Shafiei  <bshafiei@apple.com>

        Merge r203542. rdar://problem/27991570

    2016-07-21  John Wilander  <wilander@apple.com>

            Block mixed content synchronous XHR
            https://bugs.webkit.org/show_bug.cgi?id=105462
            <rdar://problem/13666424>

            Reviewed by Brent Fulgham.

            Test: http/tests/security/mixedContent/insecure-xhr-sync-in-main-frame.html

            * loader/DocumentThreadableLoader.cpp:
            (WebCore::DocumentThreadableLoader::loadRequest):

2016-08-23  Babak Shafiei  <bshafiei@apple.com>

        Merge r204521. rdar://problem/27075526

    2016-08-16  Brent Fulgham  <bfulgham@apple.com>

            Upgrade-Insecure-Request state is improperly retained between navigations
            https://bugs.webkit.org/show_bug.cgi?id=160905
            <rdar://problem/27075526>

            Reviewed by Andy Estes.

            Correct the handling of Upgrade-Insecure-Request state to match the specification, so that
            performing top-level navigation to sites that do not have the Upgrade-Insecure-Request header
            does not automatically upgrade insecure loads. The same loads performed in an iframe should
            be upgraded.

            The iframe case was already handled in our tests, but a new test is added that models the top-level
            navigation and confirms that an upgrade is not performed.

            Tests: http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/proper-uir-on-navigation.html

            * dom/Document.cpp:
            (WebCore::Document::initContentSecurityPolicy): Properly inherit Upgrade-Insecure-Request state for children
            of existing frames.
            * loader/DocumentWriter.cpp:
            (WebCore::DocumentWriter::begin): Retain the history of upgraded resources (per the specification) so that
            we continue to upgrade resources that were upgraded during earlier navigations. Note that we do NOT want to
            retain the state of the Upgrade-Insecure-Requests header itself.
            * page/csp/ContentSecurityPolicy.cpp:
            (WebCore::ContentSecurityPolicy::copyStateFrom): Update to use new helper function.
            (WebCore::ContentSecurityPolicy::copyUpgradeInsecureRequestStateFrom): New helper function.
            * page/csp/ContentSecurityPolicy.h:

2016-08-23  Babak Shafiei  <bshafiei@apple.com>

        Merge r204610. rdar://problem/27750446

    2016-08-18  Beth Dakin  <bdakin@apple.com>

            Update the accessibility titles for list insertion
            https://bugs.webkit.org/show_bug.cgi?id=160972
            -and corresponding-
            rdar://problem/27750446

            Reviewed by Chris Fleizach.

            Update accessibility titles based on feedback.
            * English.lproj/Localizable.strings:
            * platform/LocalizedStrings.cpp:
            (WebCore::insertListTypeNone):
            (WebCore::insertListTypeBulleted):
            (WebCore::insertListTypeBulletedAccessibilityTitle):
            (WebCore::insertListTypeNumbered):
            (WebCore::insertListTypeNumberedAccessibilityTitle):
            (WebCore::insertListTypeNoneAccessibilityTitle): Deleted.
            * platform/LocalizedStrings.h:

2016-08-17  Babak Shafiei  <bshafiei@apple.com>

        Merge r204587. rdar://problem/27807479

    2016-08-17  Anders Carlsson  <andersca@apple.com>

            Add support for additional networks
            https://bugs.webkit.org/show_bug.cgi?id=160951
            rdar://problem/27807479

            Reviewed by Sam Weinig.

            * Modules/applepay/ApplePaySession.cpp:
            (WebCore::createSupportedNetworks):
            (WebCore::createPaymentRequest):
            (WebCore::ApplePaySession::create):
            * Modules/applepay/PaymentRequest.cpp:
            (WebCore::isAdditionalValidSupportedNetwork):
            (WebCore::PaymentRequest::isValidSupportedNetwork):
            * Modules/applepay/PaymentRequest.h:
            (WebCore::PaymentRequest::supportedNetworks):
            (WebCore::PaymentRequest::setSupportedNetworks):
            * Modules/applepay/PaymentRequestValidator.cpp:
            (WebCore::PaymentRequestValidator::validateSupportedNetworks):
            * Modules/applepay/PaymentRequestValidator.h:

2016-08-09  Babak Shafiei  <bshafiei@apple.com>

        Merge r204274. rdar://problem/27688892

    2016-08-08  Jeremy Jones  <jeremyj@apple.com>

            Clear fullscreen mode state after exiting fullscreen mode to keep state in sync.
            https://bugs.webkit.org/show_bug.cgi?id=160668

            Reviewed by Jon Lee.

            When exiting fullscreen while in auto picture in picture mode, fullscreen mode gets
            out of sync, causing exit fullscreen to fail. This change updates the state
            to keep it correct.

            * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
            (WebVideoFullscreenInterfaceAVKit::exitFullscreen):

2016-08-05  Babak Shafiei  <bshafiei@apple.com>

        Merge r204210. rdar://problem/27592694

    2016-08-05  Jeremy Jones  <jeremyj@apple.com>

            revert r202466 r202546 this causes regressions in media loading with temporary redirects.
            https://bugs.webkit.org/show_bug.cgi?id=160613

            Reviewed by Jon Lee.

            No new tests. Skipping two tests.

            This reverts a change that attempted to fix temporary redirects with media loading.
            The change introduced problems. Reverting this to require media stack to properly
            handle redirects.

            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (WebCore::MediaPlayerPrivateAVFoundationObjC::hasSingleSecurityOrigin):
            * platform/network/cocoa/WebCoreNSURLSession.h:
            * platform/network/cocoa/WebCoreNSURLSession.mm:
            (-[WebCoreNSURLSession initWithResourceLoader:delegate:delegateQueue:]): Deleted.
            (-[WebCoreNSURLSession updateHasSingleSecurityOrigin:]): Deleted.
            (-[WebCoreNSURLSession dataTaskWithRequest:]): Deleted.
            (-[WebCoreNSURLSession dataTaskWithURL:]): Deleted.
            (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]): Deleted.
            (-[WebCoreNSURLSessionDataTask resource:receivedRedirect:request:]): Deleted.

2016-08-05  Babak Shafiei  <bshafiei@apple.com>

        Rollout r204169. rdar://problem/27592694

2016-08-05  Babak Shafiei  <bshafiei@apple.com>

        Merge r204159. rdar://problem/27669831

    2016-08-04  Myles C. Maxfield  <mmaxfield@apple.com>

            [iOS] Some videos in iBooks erroneously go fullscreen
            https://bugs.webkit.org/show_bug.cgi?id=160582
            <rdar://problem/27669831>

            Reviewed by Jon Lee.

            No new tests because we can't currently mock the iBooks application bundle ID.

            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::requiresFullscreenForVideoPlayback):

2016-08-05  Babak Shafiei  <bshafiei@apple.com>

        Merge r204128. rdar://problem/27592694

    2016-08-04  Jeremy Jones  <jeremyj@apple.com>

            Temporary redirected m3u8 streaming stopped working.
            https://bugs.webkit.org/show_bug.cgi?id=160472
            rdar://problem/27592694

            Reviewed by Alex Christensen.

            Test: http/tests/media/hls/hls-redirect.html

            The change for https://trac.webkit.org/changeset/202466 hides knowledge of the temporary redirected URL from
            WebCoreNSURLSession clients. MPEG playlists (e.g. .m3u8) can contain paths relative to the redirected URL.

            This change exposes the redirected URL for MPEG playlists.

            * platform/MIMETypeRegistry.cpp:
            (WebCore::initializeMPEGPlaylistMIMETypes): Added.
            (WebCore::initializeMIMETypeRegistry):
            (WebCore::MIMETypeRegistry::isMPEGPlaylistMIMEType): Added.
            * platform/MIMETypeRegistry.h:
            * platform/network/cocoa/WebCoreNSURLSession.mm:
            (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]): Add MPEG playlist condition.
            (-[WebCoreNSURLSessionDataTask resource:receivedRedirect:request:]): Add MPEG playlist condition.

2016-08-04  Babak Shafiei  <bshafiei@apple.com>

        Rollout r204132. rdar://problem/27685273

2016-08-04  Babak Shafiei  <bshafiei@apple.com>

        Merge r204107. rdar://problem/27685273

    2016-08-03  Myles C. Maxfield  <mmaxfield@apple.com>

            [iOS] SF-Heavy is not accessible from web content
            https://bugs.webkit.org/show_bug.cgi?id=160522
            <rdar://problem/27685273>

            Reviewed by Simon Fraser.

            The mappings we were using from CSS font-weight to CoreText font weight were inaccurate.
            Instead, these new mappings should be used.

            Test: fast/text/system-font-weight.html

            * platform/graphics/ios/FontCacheIOS.mm:
            (WebCore::systemFontModificationAttributes):

2016-08-04  Babak Shafiei  <bshafiei@apple.com>

        Merge r204100. rdar://problem/27310475

    2016-08-03  Eric Carlson  <eric.carlson@apple.com>

            [Mac] Work around AVPlayer setMuted bug
            https://bugs.webkit.org/show_bug.cgi?id=160519
            <rdar://problem/27310475>

            Reviewed by Dean Jackson.

            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h: Only override
            supportsMuting on iOS.

2016-08-03  Babak Shafiei  <bshafiei@apple.com>

        Rollout r204068. rdar://problem/27547583

2016-08-03  Babak Shafiei  <bshafiei@apple.com>

        Rollout r204086. rdar://problem/27547583

2016-08-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r204089. rdar://problem/27313234

    2016-08-03  Eric Carlson  <eric.carlson@apple.com>

            Cleanup HTMLMediaElement track lists.
            https://bugs.webkit.org/show_bug.cgi?id=160470

            Reviewed by Brent Fulgham.

            * html/track/AudioTrack.cpp:
            (WebCore::AudioTrack::willRemove): Remove unnecessary ASSERT and NULL check.

            * html/track/TextTrackList.cpp:
            (TextTrackList::~TextTrackList): Call clearElement so media element and client pointers are
            cleared.

2016-08-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r204082. rdar://problem/27547583

    2016-08-03  Eric Carlson  <eric.carlson@apple.com>

            [Mac][iOS] Adopt MediaRemote "seek to playback position"
            https://bugs.webkit.org/show_bug.cgi?id=160405
            <rdar://problem/27547583>

            Reviewed by Dean Jackson.

            * platform/ios/RemoteCommandListenerIOS.mm:
            (WebCore::RemoteCommandListenerIOS::RemoteCommandListenerIOS): Fix a typo.

2016-08-02  Babak Shafiei  <bshafiei@apple.com>

        Merge r204050. rdar://problem/27313234

    2016-08-02  Eric Carlson  <eric.carlson@apple.com>

            Cleanup HTMLMediaElement track lists.
            https://bugs.webkit.org/show_bug.cgi?id=160470

            Reviewed by David Kilzer.

            Test: media/range-extract-contents-crash.html

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::~HTMLMediaElement):

            * html/track/AudioTrack.cpp:
            (WebCore::AudioTrack::willRemove): ASSERT if media element is NULL.

            * html/track/TextTrackList.cpp:
            (TextTrackList::clearElement): Clear track media element pointers and client.
            * html/track/TextTrackList.h:

            * html/track/TrackListBase.cpp:
            (TrackListBase::~TrackListBase): Call clearElement.
            (TrackListBase::clearElement): Clear track media element pointers and client.
            * html/track/TrackListBase.h:

2016-08-02  Babak Shafiei  <bshafiei@apple.com>

        Merge r204062. rdar://problem/27592936

    2016-08-02  Nan Wang  <n_wang@apple.com>

            AX: Simulated touch events are not working on iOS
            https://bugs.webkit.org/show_bug.cgi?id=160395
            <rdar://problem/27633597>

            Reviewed by Chris Fleizach.

            We should mark the simulated touch as a potential tap otherwise it won't
            be handled on iOS. Also, we need to dispatch both touch start and touch end
            to mimic the real touch events. Last, added a has event listeners check,
            because iOS is dispatching mouse click events for elements without touch event
            listeners.

            Test: accessibility/ios-simulator/press-fires-touch-events.html

            * accessibility/AccessibilityObject.cpp:
            (WebCore::AccessibilityObject::press):
            (WebCore::AccessibilityObject::dispatchTouchEvent):
            * page/ios/EventHandlerIOS.mm:
            (WebCore::EventHandler::dispatchSimulatedTouchEvent):
            * platform/ios/PlatformEventFactoryIOS.mm:
            (WebCore::PlatformTouchEventBuilder::PlatformTouchEventBuilder):

2016-08-02  Babak Shafiei  <bshafiei@apple.com>

        Merge r203955. rdar://problem/27629346

    2016-07-31  Nan Wang  <n_wang@apple.com>

            AX: Add a check for touch event listener on iOS accessibility object
            https://bugs.webkit.org/show_bug.cgi?id=160388

            Reviewed by Chris Fleizach.

            dispatchTouchEvent() is not working correctly within AXPress() sometimes. Need to
            investigate it more in the future. Now, adding a check for the touch event listener
            on the object's node so that iOS can handle dispatching the touch event instead.

            Test: accessibility/ios-simulator/has-touch-event-listener.html

            * accessibility/AccessibilityObject.h:
            * accessibility/ios/AccessibilityObjectIOS.mm:
            (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
            (WebCore::AccessibilityObject::hasTouchEventListener):
            * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
            (appendStringToResult):
            (-[WebAccessibilityObjectWrapper _accessibilityHasTouchEventListener]):
            (-[WebAccessibilityObjectWrapper _accessibilityValueIsAutofilled]):

2016-08-02  Babak Shafiei  <bshafiei@apple.com>

        Merge r203984. rdar://problem/27409854

    2016-08-01  Eric Carlson  <eric.carlson@apple.com>

            [iOS] A video element that does not pause after exiting from fullscreen should be allowed to continue playing inline
            https://bugs.webkit.org/show_bug.cgi?id=160416
            <rdar://problem/27409854>

            Reviewed by Alex Christensen.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::exitFullscreen): If playback normally requires fullscreen but the
            element was not paused when exiting from fullscreen, set the 'playsinline' attribute so we won't
            force fullscreen if playback is paused and resumes, and set the 'controls' attribute so the
            user can control playback.

2016-08-02  Babak Shafiei  <bshafiei@apple.com>

        Merge r203982. rdar://problem/27547583

    2016-08-01  Eric Carlson  <eric.carlson@apple.com>

            [Mac][iOS] Adopt MediaRemote "seek to playback position"
            https://bugs.webkit.org/show_bug.cgi?id=160405
            <rdar://problem/27547583>

            Reviewed by Dean Jackson.

            Test: media/remote-control-command-seek.html

            * Modules/webaudio/AudioContext.h: Update for didReceiveRemoteControlCommand argument change.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::didReceiveRemoteControlCommand): Support SeekToPlaybackPositionCommand.
            Drive by fix, support Stop command.
            (WebCore::HTMLMediaElement::supportsSeeking): New.
            * html/HTMLMediaElement.h:

            * platform/RemoteCommandListener.h:
            (WebCore::RemoteCommandListenerClient::didReceiveRemoteControlCommand): Add command argument.
            (WebCore::RemoteCommandListenerClient::supportsSeeking): New.
            (WebCore::RemoteCommandListener::updateSupportedCommands): Ditto.
            (WebCore::RemoteCommandListener::client): Ditto.

            * platform/audio/PlatformMediaSession.cpp:
            (WebCore::PlatformMediaSession::didReceiveRemoteControlCommand): Add command argument.
            (WebCore::PlatformMediaSession::supportsSeeking): New, pass through to client.
            * platform/audio/PlatformMediaSession.h:

            * platform/audio/PlatformMediaSessionManager.cpp:
            (WebCore::PlatformMediaSessionManager::setCurrentSession): Tell remote command listener to
            update supported commands.
            (WebCore::PlatformMediaSessionManager::currentSession): Make const.
            (WebCore::PlatformMediaSessionManager::didReceiveRemoteControlCommand): Add command argument.
            (WebCore::PlatformMediaSessionManager::supportsSeeking): New, pass through to session.
            * platform/audio/PlatformMediaSessionManager.h:

            * platform/ios/RemoteCommandListenerIOS.h:
            (WebCore::RemoteCommandListenerIOS::createWeakPtr):
            * platform/ios/RemoteCommandListenerIOS.mm:
            (WebCore::RemoteCommandListenerIOS::RemoteCommandListenerIOS): Support changePlaybackPositionCommand.
            (WebCore::RemoteCommandListenerIOS::~RemoteCommandListenerIOS): Remove seekToTime target.
            (WebCore::RemoteCommandListenerIOS::updateSupportedCommands): Update changePlaybackPositionCommand.

            * platform/mac/MediaRemoteSoftLink.cpp:
            * platform/mac/MediaRemoteSoftLink.h:

            * platform/mac/RemoteCommandListenerMac.h:
            * platform/mac/RemoteCommandListenerMac.mm:
            (WebCore::RemoteCommandListenerMac::updateSupportedCommands): New, split out of constructor.
            (WebCore::RemoteCommandListenerMac::RemoteCommandListenerMac): Split setup logic out into
            updateSupportedCommands. Support MRMediaRemoteCommandSeekToPlaybackPosition. Don't assert when
            receiving an unsupported command, it happens. Return error when a command isn't supported or
            fails.

            * testing/Internals.cpp:
            (WebCore::Internals::postRemoteControlCommand): Add command argument parameter. Support
            seektoplaybackposition.
            * testing/Internals.h:
            * testing/Internals.idl:

2016-08-01  Babak Shafiei  <bshafiei@apple.com>

        Merge r203985. rdar://problem/26310261

    2016-08-01  Antti Koivisto  <antti@apple.com>

            REGRESSION(r198943): drop-down menu navigation on fiddlevideo.com doesn't appear on iOS, works on OS X
            https://bugs.webkit.org/show_bug.cgi?id=160406
            rdar://problem/26310261

            Reviewed by Simon Fraser.

            On iOS we generate synthetic mouse events from taps. Click event is generated on tap only if the move event
            doesn't produce visible changes to the document. This is important to make certain types of drop down menus
            work.

            The information on mutations is passed via WKContentObservation side channel which is updated from varous parts
            of the code. Newly visible elements are detected CheckForVisibilityChangeOnRecalcStyle during style resolution.
            This got broken by the style refactoring because it assumes that renderer is mutated along with style computation.
            However mutation is now a separate step performed by RenderTreeUpdater.

            Fix by moving CheckForVisibilityChange to RenderTreeUpdater.

            Test: fast/content-observation/click-event-suppression-on-content-change.html

            * style/RenderTreeUpdater.cpp:
            (WebCore::RenderTreeUpdater::Parent::Parent):
            (WebCore::RenderTreeUpdater::updateElementRenderer):
            (WebCore::RenderTreeUpdater::tearDownRenderer):
            (WebCore::elementImplicitVisibility):
            (WebCore::CheckForVisibilityChange::CheckForVisibilityChange):
            (WebCore::CheckForVisibilityChange::~CheckForVisibilityChange):
            * style/StyleTreeResolver.cpp:
            (WebCore::Style::TreeResolver::createAnimatedElementUpdate):
            (WebCore::Style::TreeResolver::pushParent):
            (WebCore::Style::TreeResolver::resolveComposedTree):
            (WebCore::Style::elementImplicitVisibility): Deleted.
            (WebCore::Style::CheckForVisibilityChangeOnRecalcStyle::CheckForVisibilityChangeOnRecalcStyle): Deleted.
            (WebCore::Style::CheckForVisibilityChangeOnRecalcStyle::~CheckForVisibilityChangeOnRecalcStyle): Deleted.

2016-08-01  Babak Shafiei  <bshafiei@apple.com>

        Roll out r203799.

2016-08-01  Babak Shafiei  <bshafiei@apple.com>

        Merge r203976. rdar://problem/27580049

    2016-08-01  Antti Koivisto  <antti@apple.com>

            REGRESSION (r196383): Drop down CSS menus not working on cnet.com, apmex.com
            https://bugs.webkit.org/show_bug.cgi?id=160390

            Reviewed by Simon Fraser.

            The case here is that we have a rule like

                .enableHover:hover .child { ... }

            and the "enableHover" class is added dynamically. The class change invalidation optimization code would figure out
            that nothing needs to be invalidated as the class change doesn't make the rule match (since :hover doesn't match).

            However for event driven hover to actually work the hover element needs to have its childrenAffectedByHover bit set.
            This bits is set when the selector match is attempted, whether it actually matches or not. Since we optimized away
            the style invalidation we never set the bit either.

            Fix by treating :hover as always matching (==ignored) when collecting rules for invalidation optimization purposes.
            Dynamic pseudo elements are already treated this way for similar reasons.

            Test: fast/selectors/hover-invalidation-descendant-dynamic.html

            * css/SelectorChecker.cpp:
            (WebCore::SelectorChecker::checkOne):

                Match always in CollectingRulesIgnoringVirtualPseudoElements mode (now slightly misnamed).

                This mode is used for optimization purposes in StyleInvalidationAnalysis (which we care about here) and
                StyleSharingResolver. The change is fine for both.

            * cssjit/SelectorCompiler.cpp:
            (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsHovered):

                Same change for the slow path selector checker.

2016-07-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r203931. rdar://problem/27317407

    2016-07-29  Daniel Bates  <dabates@apple.com>

            Crash under HTMLMediaElement::{resolve, reject}PendingPlayPromises() when playback is interrupted
            https://bugs.webkit.org/show_bug.cgi?id=160366
            <rdar://problem/27317407>

            Reviewed by Eric Carlson.

            Fixes a crash/assertion failure in DeferredWrapper::{resolve, rejectWithValue}() caused by a Promise
            being settled twice. In particular, if a system interruption occurs when media.play() is invoked
            the returned Promise may ultimately be settled twice upon cessation of the interruption.

            A Promise can be settled (resolved) exactly once. When a system interruption occurs media
            playback is paused and resumes on cessation of the interruption. Currently we also immediately
            reject the Promise p retuned by media.play() if the interruption occurs during its invocation.
            So, when we resume playback on cessation of an interruption we try to resolve p again. But a
            Promise can only be resolved once and hence we violate the assertions that p has both a valid
            reference to a JSPromiseDeferred object and a reference to the global object of the page.

            Tests: media/non-existent-video-playback-interrupted.html
                   media/video-playback-interrupted.html

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::play): Modified to reject the Promise and return immediately if
            playInternal() returns false.
            (WebCore::HTMLMediaElement::playInternal): Treat an interruption as success and return true
            so that HTMLMediaElement::play() adds the Promise to the end of the list of pending promises.
            We treat an interruption as a success because we will resume playback (assuming the media
            can be loaded and is well-formed) upon cessation of the interruption and therefore can either
            fulfill or reject the Promise object returned by media.play().

2016-07-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r203928. rdar://problem/27179484

    2016-07-29  Wenson Hsieh  <wenson_hsieh@apple.com>

            Media controls are not displayed for some autoplaying videos at certain browser dimensions
            https://bugs.webkit.org/show_bug.cgi?id=160360
            <rdar://problem/27179484>

            Reviewed by Myles C. Maxfield.

            Previously, if a video's aspect ratio fell outside of the range [0.5, 1.8], we would
            not consider it main content and would subsequently not show media controls for it.
            This meant that on many websites that scale video dimensions to match the mainframe,
            if the mainframe is too wide (e.g. full bounds on a widescreen display) we would not
            consider the video to be main content. To fix this, we only consider aspect ratio to
            be a requirement if the video does not already take up most of the space in the
            mainframe.

            Covered by two new TestWebKitAPI unit tests.

            * html/MediaElementSession.cpp:
            (WebCore::isElementLargeRelativeToMainFrame):
            (WebCore::isElementLargeEnoughForMainContent):

2016-07-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r203924. rdar://problem/27355214

    2016-07-29  Zalan Bujtas  <zalan@apple.com>

            Do not set negative rate on AVSampleBufferRenderSynchronizer.
            https://bugs.webkit.org/show_bug.cgi?id=160326
            <rdar://problem/27355214>

            Reviewed by Eric Carlson.

            Test: http/tests/media/media-source/mediasource-play-then-seek-back-with-remote-control.html

            * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
            (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setRateDouble):

2016-07-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r203916. rdar://problem/27594995

    2016-07-29  Myles C. Maxfield  <mmaxfield@apple.com>

            Backspace key removes only the rainbow from the rainbow flag
            https://bugs.webkit.org/show_bug.cgi?id=160349
            <rdar://problem/27594995>

            Reviewed by Dean Jackson.

            In r203330 I added support for new emoji group candidates. I accidentally
            missed one of the new emoji code points.

            Test: editing/deleting/delete-emoji.html

            * platform/text/CharacterProperties.h:
            (WebCore::isEmojiGroupCandidate):

2016-07-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r203913. rdar://problem/27558003

    2016-07-29  Nan Wang  <n_wang@apple.com>

            AX: Media controls accessibility improvement
            https://bugs.webkit.org/show_bug.cgi?id=160223
            <rdar://problem/27558003>

            Reviewed by Eric Carlson.

            Changes in this patch:
            1. Added a change observer for volume slider so that it will handle accessibility
               increment/decrement functions correctly.
            2. Update the timer div's aria-label when time changes.
            3. Added a keydown handler for left/right arrow adjusting the timeline, so that the
               value increment/decrement in a reasonable way.
            4. Changed the mute button's role to checkbox since it only has on/off states.

            Test: media/media-controls-accessibility.html

            * Modules/mediacontrols/mediaControlsApple.js:
            (Controller.prototype.createControls):
            (Controller.prototype.updatePictureInPictureButton):
            (Controller.prototype.timelineStepFromVideoDuration):
            (Controller.prototype.incrementTimelineValue):
            (Controller.prototype.decrementTimelineValue):
            (Controller.prototype.showInlinePlaybackPlaceholderWhenSafe):
            (Controller.prototype.handleTimelineMouseUp):
            (Controller.prototype.handleTimelineKeyDown):
            (Controller.prototype.handleMuteButtonClicked):
            (Controller.prototype.handleMinButtonClicked):
            (Controller.prototype.handleMaxButtonClicked):
            (Controller.prototype.updateVideoVolume):
            (Controller.prototype.handleVolumeSliderInput):
            (Controller.prototype.handleVolumeSliderChange):
            (Controller.prototype.handleVolumeSliderMouseDown):
            (Controller.prototype.updateTime):
            (Controller.prototype.updateControlsWhileScrubbing):
            (Controller.prototype.updateVolume):

2016-07-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r203799. rdar://problem/27556788

    2016-07-27  Eric Carlson  <eric.carlson@apple.com>

            Captions do not render in PiP window when element is hidden
            https://bugs.webkit.org/show_bug.cgi?id=160265
            <rdar://problem/27556788>

            Reviewed by Simon Fraser.

            * html/shadow/MediaControlElements.cpp:
            (WebCore::MediaControlTextTrackContainerElement::createTextTrackRepresentationImage): Pass new flag so
            caption layers are always rendered.

            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::paintLayerContents): Paint non-visible layers when PaintLayerIgnoreVisibility
            flag is set.
            * rendering/RenderLayer.h: Define PaintLayerIgnoreVisibility.

2016-07-29  Babak Shafiei  <bshafiei@apple.com>

        Merge r203904. rdar://problem/27610935

    2016-07-29  Eric Carlson  <eric.carlson@apple.com>

            Change internal AVCaptureDeviceType typedef name
            https://bugs.webkit.org/show_bug.cgi?id=160345
            <rdar://problem/27610935>

            Reviewed by Dean Jackson.

            * platform/mediastream/mac/AVAudioCaptureSource.mm:
            (WebCore::AVAudioCaptureSource::create): AVCaptureDeviceType -> AVCaptureDeviceTypedef
            (WebCore::AVAudioCaptureSource::AVAudioCaptureSource): Ditto.

            * platform/mediastream/mac/AVCaptureDeviceManager.mm:
            (WebCore::AVCaptureDeviceManager::captureDeviceList): Ditto.
            (WebCore::shouldConsiderDeviceInDeviceList): Ditto.
            (WebCore::AVCaptureDeviceManager::refreshCaptureDeviceList): Ditto.
            (WebCore::AVCaptureDeviceManager::createMediaSourceForCaptureDeviceWithConstraints): Ditto.
            (WebCore::AVCaptureDeviceManager::deviceConnected): Ditto.
            (WebCore::AVCaptureDeviceManager::deviceDisconnected): Ditto.
            (-[WebCoreAVCaptureDeviceManagerObserver deviceDisconnected:]): Ditto.

            * platform/mediastream/mac/AVMediaCaptureSource.mm:
            (WebCore::globaVideoCaptureSerialQueue): Ditto.
            (WebCore::AVMediaCaptureSource::AVMediaCaptureSource): Ditto.

            * platform/mediastream/mac/AVVideoCaptureSource.mm:
            (WebCore::AVVideoCaptureSource::create): Ditto.
            (WebCore::AVVideoCaptureSource::AVVideoCaptureSource): Ditto.

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203825. rdar://problem/27578447

    2016-07-28  Dean Jackson  <dino@apple.com>

            REGRESSION (r202880): Default controls pip glyph inverted
            https://bugs.webkit.org/show_bug.cgi?id=160304
            <rdar://problem/27578447>

            Reviewed by Eric Carlson.

            I accidentally committed the "Exit Picture-in-picture" glyph
            for the "Enter Picture-in-picture" buttons :(

            * Modules/mediacontrols/mediaControlsApple.css:
            (video::-webkit-media-controls-panel .picture-in-picture-button):
            Use the correct artwork.

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203789. rdar://problem/27574519

    2016-07-27  Anders Carlsson  <andersca@apple.com>

            Stop accepting the deprecated "requiredShippingAddressFields" and "requiredBillingAddressFields" properties
            https://bugs.webkit.org/show_bug.cgi?id=160264
            rdar://problem/27574519

            Reviewed by Simon Fraser.

            * Modules/applepay/ApplePaySession.cpp:
            (WebCore::createPaymentRequest):
            (WebCore::isValidPaymentRequestPropertyName):

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203801. rdar://problem/26102954

    2016-07-27  Beth Dakin  <bdakin@apple.com>

            Add localizable strings for inserting list types
            https://bugs.webkit.org/show_bug.cgi?id=160233
            -and corresponding-
            rdar://problem/26102954

            Reviewed by Dan Bernstein.

            * English.lproj/Localizable.strings:
            * platform/LocalizedStrings.cpp:
            (WebCore::insertListTypeNone):
            (WebCore::insertListTypeNoneAccessibilityTitle):
            (WebCore::insertListTypeBulleted):
            (WebCore::insertListTypeBulletedAccessibilityTitle):
            (WebCore::insertListTypeNumbered):
            (WebCore::insertListTypeNumberedAccessibilityTitle):
            * platform/LocalizedStrings.h:

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203764. rdar://problem/27434423

    2016-07-26  Myles C. Maxfield  <mmaxfield@apple.com>

            [iOS] SF-Heavy is inaccessible by web content
            https://bugs.webkit.org/show_bug.cgi?id=160186
            <rdar://problem/27434423>

            Reviewed by Dean Jackson.

            Once we create the system font, we need to modify it with the appropriate weight.
            This is because the CoreText API we use to get the system font on iOS does not
            let us choose the exact weight we want.

            Test: fast/text/system-font-weight.html

            * platform/graphics/ios/FontCacheIOS.mm:
            (WebCore::baseSystemFontDescriptor):
            (WebCore::systemFontModificationAttributes):
            (WebCore::systemFontDescriptor):
            (WebCore::platformFontWithFamilySpecialCase):
            * platform/spi/cocoa/CoreTextSPI.h:

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203775. rdar://problem/23325160

    2016-07-27  Carlos Garcia Campos  <cgarcia@igalia.com>

            [Soup] Test http/tests/xmlhttprequest/auth-reject-protection-space.html fails since added in r203743
            https://bugs.webkit.org/show_bug.cgi?id=160235

            Reviewed by Michael Catanzaro.

            It times out in release and crashes in debug due to an ASSERT_NOT_REACHED(). The soup backend doesn't really
            support rejecting the protection space and continuing with the next one, but we can at least continue with the
            request without crendential to make the test pass.

            * platform/network/soup/ResourceHandleSoup.cpp:
            (WebCore::ResourceHandle::receivedChallengeRejection):

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203743. rdar://problem/23325160

    2016-07-26  David Kilzer <ddkilzer@apple.com>

            Networking process crash due to missing -[WebCoreAuthenticationClientAsChallengeSender performDefaultHandlingForAuthenticationChallenge:] implementation
            https://bugs.webkit.org/show_bug.cgi?id=156947
            <rdar://problem/23325160>

            Reviewed by Alex Christensen.

            Test: http/tests/xmlhttprequest/auth-reject-protection-space.html

            * platform/network/mac/AuthenticationMac.mm:
            (-[WebCoreAuthenticationClientAsChallengeSender performDefaultHandlingForAuthenticationChallenge:]): Added.
            (-[WebCoreAuthenticationClientAsChallengeSender rejectProtectionSpaceAndContinueWithChallenge:]): Added.

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203855. rdar://problem/27557968

    2016-07-28  Myles C. Maxfield  <mmaxfield@apple.com>

            Remove deprecated SPI for video inline / fullscreen controls
            https://bugs.webkit.org/show_bug.cgi?id=160318

            Reviewed by Tim Horton.

            r203752 deprecated the SPI allowsInlineMediaPlaybackWithPlaysInlineAttribute
            and allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute (in favor of
            inlineMediaPlaybackRequiresPlaysInlineAttribute). This patch removes the
            deprecated SPI symbols.

            No new tests because there is no behavior change.

            * page/Settings.cpp:
            * page/Settings.in:
            * testing/InternalSettings.cpp:
            (WebCore::InternalSettings::Backup::Backup): Deleted.
            (WebCore::InternalSettings::Backup::restoreTo): Deleted.
            (WebCore::InternalSettings::setAllowsInlineMediaPlaybackWithPlaysInlineAttribute): Deleted.
            (WebCore::InternalSettings::setAllowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute): Deleted.
            * testing/InternalSettings.h:
            * testing/InternalSettings.idl:

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203752. rdar://problem/27557968

    2016-07-26  Myles C. Maxfield  <mmaxfield@apple.com>

            [iPhone] Playing a video on tudou.com plays only sound, no video
            https://bugs.webkit.org/show_bug.cgi?id=160178
            <rdar://problem/27535468>

            Reviewed by Eric Carlson and Dan Bernstein.

            This patch re-implements r203520 in a much simpler way which doesn't involve a new SPI.
            The biggest problem with r203520 is that it make it impossible for a WKWebView to match
            MobileSafari's behavior. Instead of adding this new SPI, a simple version check should
            be used to keep old apps working.

            The new behavior is characterized by the following table:

                                                 |                iOS                 |      Non-iOS
            =============================================================================================
            requiresPlayInlineAttribute == true  | Old app: honor -webkit-playsinline | honor playsinline
                                                 | New app: honor playsinline         | honor playsinline
            ---------------------------------------------------------------------------------------------
            requiresPlayInlineAttribute == false | Always inline                      | Always inline

            Specifically, this patch reverts r203545 which is the commit which actually removes
            the old SPI. As soon as Safari is migrated back to this old SPI, I'll remove the two
            new SPIs added in r203520.

            Tests: media/video-playsinline.html
                   media/video-webkit-playsinline.html

            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::requiresFullscreenForVideoPlayback):
            * page/Settings.cpp:
            * page/Settings.in:
            * testing/InternalSettings.cpp:
            (WebCore::InternalSettings::Backup::Backup):
            (WebCore::InternalSettings::Backup::restoreTo):
            (WebCore::InternalSettings::setInlineMediaPlaybackRequiresPlaysInlineAttribute):
            * testing/InternalSettings.h:
            * testing/InternalSettings.idl:

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203746. rdar://problem/27527151

    2016-07-26  Anders Carlsson  <andersca@apple.com>

            onpaymentauthorized callback not received when authorizing for a second time
            https://bugs.webkit.org/show_bug.cgi?id=160218
            rdar://problem/27527151

            Reviewed by Tim Horton.

            Only null out the active session if the status is a final state status.

            * Modules/applepay/PaymentCoordinator.cpp:
            (WebCore::PaymentCoordinator::completePaymentSession):

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203737. rdar://problem/21090897

    2016-07-26  Eric Carlson  <eric.carlson@apple.com>

            Occasional crash in WebCore::RenderVTTCue::initializeLayoutParameters
            https://bugs.webkit.org/show_bug.cgi?id=160208

            Reviewed by Darin Adler.

            * rendering/RenderVTTCue.cpp:
            (WebCore::RenderVTTCue::initializeLayoutParameters): Return when firstChild is NULL so a
            release build will not crash.

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203711. rdar://problem/27279453

    2016-07-25  Nan Wang  <n_wang@apple.com>

            AX: Expose autoFillButtonType to accessibility
            https://bugs.webkit.org/show_bug.cgi?id=160179

            Reviewed by Chris Fleizach.

            Added a new attribute on Mac to expose the auto-fill button type.

            Changes are covered in modified test.

            * accessibility/AccessibilityObject.cpp:
            (WebCore::AccessibilityObject::isValueAutofillAvailable):
            (WebCore::AccessibilityObject::valueAutofillButtonType):
            (WebCore::AccessibilityObject::isValueAutofilled):
            * accessibility/AccessibilityObject.h:
            (WebCore::AccessibilityObject::passwordFieldValue):
            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
            (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203706. rdar://problem/27457941

    2016-07-25  Jeremy Jones  <jeremyj@apple.com>

            Set MediaRemote playback state based on MediaSession playback state.
            https://bugs.webkit.org/show_bug.cgi?id=160177

            Reviewed by Eric Carlson.

            Use playback session state to update media remote playback state instead of
            unconditionally setting it to playing.

            * platform/audio/mac/MediaSessionManagerMac.mm:
            (WebCore::MediaSessionManagerMac::updateNowPlayingInfo):

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203698. rdar://problem/26986673

    2016-07-25  Wenson Hsieh  <wenson_hsieh@apple.com>

            Media controls should not be displayed for a video until it starts playing
            https://bugs.webkit.org/show_bug.cgi?id=160092
            <rdar://problem/26986673>

            Reviewed by Beth Dakin.

            For videos that have never played back yet, we should not show media controls. To ensure this
            behavior, we ensure that the playback behavior restriction is set upon creating the media
            element. This restriction is then removed when the media element begins to play.

            Added two new WebKit API tests.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::HTMLMediaElement):

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203695. rdar://problem/27010112

    2016-07-25  Brady Eidson  <beidson@apple.com>

            Allow LocalStorage by default for file URLs.
            https://bugs.webkit.org/show_bug.cgi?id=160169

            Reviewed by Brent Fulgham.

            Test: storage/domstorage/localstorage/file-can-access.html

            * page/SecurityOrigin.cpp:
            (WebCore::SecurityOrigin::canAccessStorage): Remove the m_universalAccess check for local URLs.

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203694. rdar://problem/27220338

    2016-07-25  Nan Wang  <n_wang@apple.com>

            AX: AccessibilityRenderObject is adding duplicated children when CSS first-letter is being used.
            https://bugs.webkit.org/show_bug.cgi?id=160155

            Reviewed by Chris Fleizach.

            We were adding the same text node twice if CSS first-letter selector was being used. Added a
            check for the inline continuation so that we only add it once.

            Test: accessibility/mac/css-first-letter-children.html

            * accessibility/AccessibilityRenderObject.cpp:
            (WebCore::firstChildConsideringContinuation):

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203690. rdar://problem/26668526

    2016-07-25  Wenson Hsieh  <wenson_hsieh@apple.com>

            Media controls on apple.com don't disappear when movie finishes playing
            https://bugs.webkit.org/show_bug.cgi?id=160068
            <rdar://problem/26668526>

            Reviewed by Darin Adler.

            When a video ends, it should cause media controls to hide. While current logic
            mostly accounts for this, it does not account for programmatic seeks causing
            the video to lose its 'ended' status before querying for whether or not to
            show media controls.

            Three new API tests: large-video-seek-after-ending.html
            large-video-hides-controls-after-seek-to-end.html
            large-video-seek-to-beginning-and-play-after-ending.html

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::mediaPlayerTimeChanged):
            (WebCore::HTMLMediaElement::setPlaying):
            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::canControlControlsManager):
            * html/MediaElementSession.h:

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203683. rdar://problem/27525634

    2016-07-25  Carlos Garcia Campos  <cgarcia@igalia.com>

            REGRESSION(r200931): Invalid cast in highestAncestorToWrapMarkup()
            https://bugs.webkit.org/show_bug.cgi?id=160163

            Reviewed by Michael Catanzaro.

            Since r200931 the result of enclosingNodeOfType() in highestAncestorToWrapMarkup() is downcasted to Element, but
            the result of enclosingNodeOfType() can be a Node that is not an Element, in this case is Text. The cast is not
            needed at all since that node is passed to editingIgnoresContent() and selectionFromContentsOfNode() and both
            receive a Node not an Element.

            * editing/markup.cpp:
            (WebCore::highestAncestorToWrapMarkup): Remove invalid cast.

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203669. rdar://problem/27285070

    2016-07-24  Nan Wang  <n_wang@apple.com>

            AX: Video Controls: Volume cannot be adjusted using VO.
            https://bugs.webkit.org/show_bug.cgi?id=160107

            Reviewed by Dean Jackson.

            The volume slider in video tag had 0.01 step which caused the screen reader adjusting it slowly.
            Changed the step to 0.05 and added the aria-valuetext attribute to the slider, so that the value
            is spoken in percentage.

            Test: accessibility/mac/video-volume-slider-accessibility.html

            * Modules/mediacontrols/mediaControlsApple.js:
            (Controller.prototype.createControls):
            (Controller.prototype.handleVolumeSliderInput):
            (Controller.prototype.updateVolume):

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203667. rdar://problem/27506489

    2016-07-24  David Kilzer  <ddkilzer@apple.com>

            REGRESSION (r203106): Crash in WebCore::MathMLElement::parseMathMLLength()
            <https://webkit.org/b/160111>
            <rdar://problem/27506489>

            Reviewed by Chris Dumez.

            Test: mathml/mpadded-crash.html

            * mathml/MathMLElement.cpp:
            (WebCore::skipLeadingAndTrailingWhitespace): Change to take
            StringView parameter instead of String to avoid creating a
            temporary String that's released on return.

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203631. rdar://problem/24606557

    2016-07-22  Zalan Bujtas  <zalan@apple.com>

            Handle cases when IOSurface initialization fails.
            https://bugs.webkit.org/show_bug.cgi?id=160006
            <rdar://problem/27495102>

            Reviewed by Tim Horton and Simon Fraser.

            This is an additional fix to r203514 to check if IOSurface initialization was successful.

            Unable to test.

            * platform/graphics/cg/ImageBufferCG.cpp:
            (WebCore::ImageBuffer::ImageBuffer):
            * platform/graphics/cocoa/IOSurface.h: Merge 2 c'tors.
            * platform/graphics/cocoa/IOSurface.mm: Remove redundant IOSurface::create() code.
            (WebCore::IOSurface::create):
            (WebCore::IOSurface::createFromImage):
            (WebCore::IOSurface::IOSurface):
            (WebCore::IOSurface::convertToFormat):

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203629. rdar://problem/27438936

    2016-07-22  Wenson Hsieh  <wenson_hsieh@apple.com>

            Media controls should be displayed for media in media documents
            https://bugs.webkit.org/show_bug.cgi?id=160104
            <rdar://problem/27438936>

            Reviewed by Myles C. Maxfield.

            Make videos that would otherwise not have been large enough or have the right
            aspect ratio cause media controls to appear. This is because media elements in
            a media document are implied to be main content.

            Added a new API test.

            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::canControlControlsManager):

2016-07-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r203622. rdar://problem/27495748

    2016-07-22  Brady Eidson  <beidson@apple.com>

            Removing IndexedDatabases that have stored blobs doesn't remove the blob files.
            https://bugs.webkit.org/show_bug.cgi?id=160089

            Reviewed by Darin Adler.

            Tested by API test IndexedDB.StoreBlobThenDelete.

            Blob filenames exist in the IDB directory with the name "[0-9]+.blob".

            That is, one or more digits, followed by ".blob".

            So when we delete an IndexedDB.sqlite3 and related files, we should delete those blob files as well.

            * Modules/indexeddb/server/IDBServer.cpp:
            (WebCore::IDBServer::removeAllDatabasesForOriginPath):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203626. rdar://problem/27453479

    2016-07-22  Myles C. Maxfield  <mmaxfield@apple.com>

            All dancers with bunny ears are female
            https://bugs.webkit.org/show_bug.cgi?id=160102
            <rdar://problem/27453479>

            Reviewed by Simon Fraser.

            In r203330 I added support for new emoji group candidates. I accidentally
            missed one of the new emoji code points.

            Tests: editing/deleting/delete-emoji.html:
                   fast/text/emoji-gender-2-9.html:
                   fast/text/emoji-gender-9.html:
                   fast/text/emoji-gender-fe0f-9.html:

            * platform/text/CharacterProperties.h:
            (WebCore::isEmojiGroupCandidate):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203606. rdar://problem/27430450

    2016-07-22  Said Abou-Hallawa  <sabouhallawa@apple.com>

            [iOS] REGRESSION(203378): PDFDocumentImage::updateCachedImageIfNeeded() uses the unscaled size when deciding whether to cache the PDF image
            https://bugs.webkit.org/show_bug.cgi?id=159933

            Reviewed by Simon Fraser.

            We need to use the scaled size when deciding whether to cache the PDF image
            or not. This is because ImageBuffer takes the display resolution into account
            which gives higher resolution for the image when zooming.

            * platform/graphics/cg/PDFDocumentImage.cpp:
            (WebCore::PDFDocumentImage::updateCachedImageIfNeeded):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203378. rdar://problem/25876032

    2016-07-18  Said Abou-Hallawa  <sabouhallawa@apple,com>

            [iOS] PDFDocumentImage should cache only a sub image of the PDF when caching the whole image is expensive
            https://bugs.webkit.org/show_bug.cgi?id=158715

            Reviewed by Dean Jackson.

            Test: fast/images/displaced-non-cached-pdf.html

            For iOS, we need to ensure the size of the cached PDF images will not
            exceed some limit. Also we should be caching only a sub image of the PDF
            if caching the whole image will exceed the memory limit.

            * page/Settings.cpp:
            (WebCore::Settings::Settings):
            (WebCore::Settings::setCachedPDFImageEnabled):
            * page/Settings.h:
            (WebCore::Settings::isCachedPDFImageEnabled):
                Add an option to disable caching the PDF images.

            * platform/graphics/cg/PDFDocumentImage.cpp:
            (WebCore::PDFDocumentImage::setCachedPDFImageEnabled):
                Allow the caller of draw() to disable caching the PDF images.

            (WebCore::PDFDocumentImage::cacheParametersMatch):
                Match the context dirty rectangle with the cached image rectangle.

            (WebCore::transformContextForPainting):
                When preparing the context for drawing the PDF, take the location
                of the destination rectangle into account. We do not need to scale
                the location of the source rectangle because we scale the size of
                the rectangle but we don't scale the whole coordinate system.

            (WebCore::cachedImageRect):
                Calculate the rectangle of the cached image such that it does not
                exceed the limit. Start from the center of the dirty rectangle and
                then expand around it.

            (WebCore::PDFDocumentImage::decodedSizeChanged):
                In addition to notifying the ImageObserver, it keeps track of the size
                of all the cached PDF images.

            (WebCore::PDFDocumentImage::updateCachedImageIfNeeded):
                Ensure the size of all the cached images does not exceed the limit

            (WebCore::PDFDocumentImage::destroyDecodedData):
            * platform/graphics/cg/PDFDocumentImage.h:

            * rendering/RenderImage.cpp:
            (WebCore::RenderImage::paintIntoRect):
                Pass the option to disable caching the PDF images to PDFDocumentImage.

            * testing/InternalSettings.cpp:
            (WebCore::InternalSettings::Backup::Backup):
            (WebCore::InternalSettings::Backup::restoreTo):
            (WebCore::InternalSettings::setCachedPDFImageEnabled):
            * testing/InternalSettings.h:
            * testing/InternalSettings.idl:
                Add an internal option to disable caching the PDF images.

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203548. rdar://problem/27474031

    2016-07-21  Darin Adler  <darin@apple.com>

            Remove unneeded content attribute name "playsinline"
            https://bugs.webkit.org/show_bug.cgi?id=160069

            Reviewed by Chris Dumez.

            * html/HTMLVideoElement.idl: Removed explicit content attribute name on Reflect
            attribute since it is the same as the name that the code generator will generate.

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203511. rdar://problem/27474031

    2016-07-21  Chris Dumez  <cdumez@apple.com>

            playsInline IDL attribute has the wrong casing
            https://bugs.webkit.org/show_bug.cgi?id=160029
            <rdar://problem/27474031>

            Reviewed by Jon Lee.

            Fix case from video.playsinline to video.playsInline in order to match
            the specification:
            - https://html.spec.whatwg.org/multipage/embedded-content.html#the-video-element:dom-video-playsinline

            It still reflects the "playsinline" content attribute though, as per
            the specification:
            - https://html.spec.whatwg.org/multipage/embedded-content.html#dom-video-playsinline

            No new tests, updated existing test.

            * html/HTMLVideoElement.idl:

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203545. rdar://problem/26964090

    2016-07-21  Myles C. Maxfield  <mmaxfield@apple.com>

            Remove support for deprecated SPI inlineMediaPlaybackRequiresPlaysInlineAttribute
            https://bugs.webkit.org/show_bug.cgi?id=160066

            Reviewed by Dean Jackson.

            r203520 deprecated inlineMediaPlaybackRequiresPlaysInlineAttribute in favor of
            allowsInlineMediaPlaybackWithPlaysInlineAttribute and
            allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute. The old
            inlineMediaPlaybackRequiresPlaysInlineAttribute is SPI and was never released
            to the public. Therefore, it can be removed safely.

            No new tests because there is no behavior change.

            * page/Settings.cpp:
            * page/Settings.in:
            * testing/InternalSettings.cpp:
            (WebCore::InternalSettings::Backup::Backup): Deleted.
            (WebCore::InternalSettings::Backup::restoreTo): Deleted.
            (WebCore::InternalSettings::setInlineMediaPlaybackRequiresPlaysInlineAttribute): Deleted.
            * testing/InternalSettings.h:
            * testing/InternalSettings.idl:

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203520. rdar://problem/26964090

    2016-07-21  Myles C. Maxfield  <mmaxfield@apple.com>

            [iPhone] Playing a video on tudou.com plays only sound, no video
            https://bugs.webkit.org/show_bug.cgi?id=159967
            <rdar://problem/26964090>

            Reviewed by Jon Lee, Jeremy Jones, and Anders Carlsson.

            WebKit recently starting honoring the playsinline and webkit-playsinline
            attribute on iPhones. However, because these attributes previously did
            nothing, some sites (such as Todou) were setting them on their content
            and expecting that they are not honored. In this specific case, the
            video is absolutely positioned to be 1 pixel x 1 pixel.

            Previously, with iOS 9, apps could set the allowsInlineMediaPlayback
            property on their WKWebView, which would honor the webkit-playsinline
            attribute. Safari on iPhones didn't do this.

            In order to not break these existing apps, it's important that the
            allowsInlineMediaPlayback preference still allows webkit-playsinline
            videos to play inline in apps using WKWebView. However, in Safari, these
            videos should play fullscreen. (Todou videos have webkit-playsinline
            but not playsinline.)

            Therefore, in Safari, videos with playsinline should be inline, but
            videos with webkit-playsinline should be fullscreen. In apps using
            WKWebViews, if the app sets allowsInlineMediaPlayback, then videos with
            playsinline should be inline, and videos with webkit-playsinline should
            also be inline. Videos on iPad and Mac should all be inline by default.

            We can create some truth tables for the cases which need to be covered:

            All apps on Mac / iPad:
            Presence of playsinline | Presence of webkit-playsinline | Result
            ========================|================================|===========
            Not present             | Not present                    | Inline
            Present                 | Not present                    | Inline
            Not Present             | Present                        | Inline
            Present                 | Present                        | Inline

            Safari on iPhone:
            Presence of playsinline | Presence of webkit-playsinline | Result
            ========================|================================|===========
            Not present             | Not present                    | Fullscreen
            Present                 | Not present                    | Inline
            Not Present             | Present                        | Fullscreen
            Present                 | Present                        | Inline

            App on iPhone which sets allowsInlineMediaPlayback:
            Presence of playsinline | Presence of webkit-playsinline | Result
            ========================|================================|===========
            Not present             | Not present                    | Fullscreen
            Present                 | Not present                    | Inline
            Not Present             | Present                        | Inline
            Present                 | Present                        | Inline

            The way to distinguish Safari from another app is to create an SPI
            boolean preference which Safari can set. This is already how the
            iPhone and iPad are differentiated using the requiresPlayInlineAttribute
            which Safari sets but other apps don't. However, this preference is
            no longer sufficient because Safari should now be discriminating
            between the playsinline and webkit-playsinline attributes. Therefore,
            this preference should be extended to two boolean preferences, which
            this patch adds:

            allowsInlineMediaPlaybackWithPlaysInlineAttribute
            allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute

            Safari on iPhone will set
            allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute to true,
            and allowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute to
            false. Other apps on iPhone will get their defaults values (because they
            are SPI) which means they will both be true. On iPad and Mac, apps will
            use the defaults values where both are false.

            This patch adds support for these two preferences, but does not remove
            the existing inlineMediaPlaybackRequiresPlaysInlineAttribute preference.
            I will remove the exising preference as soon as I update Safari to migrate
            off of it.

            Test: media/video-playsinline.html

            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::requiresFullscreenForVideoPlayback):
            * page/Settings.cpp:
            * page/Settings.in:
            * testing/InternalSettings.cpp:
            (WebCore::InternalSettings::Backup::Backup):
            (WebCore::InternalSettings::Backup::restoreTo):
            (WebCore::InternalSettings::setAllowsInlineMediaPlaybackWithPlaysInlineAttribute):
            (WebCore::InternalSettings::setAllowsInlineMediaPlaybackWithWebKitPlaysInlineAttribute):
            * testing/InternalSettings.h:
            * testing/InternalSettings.idl:

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203473. rdar://problem/27180657

    2016-07-20  Wenson Hsieh  <wenson_hsieh@apple.com>

            Pausing autoplayed media should not remove all restrictions for that media element
            https://bugs.webkit.org/show_bug.cgi?id=159988

            Reviewed by Jon Lee.

            Localizes the removal of behavior restrictions introduced in r203464 upon pausing an
            autoplaying video to just affect the hiding or showing of the media controller. This
            prevents pages from using Javascript to start playing autoplaying videos that have
            been paused by the user.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::pause):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203464. rdar://problem/27180657

    2016-07-20  Wenson Hsieh  <wenson_hsieh@apple.com>

            Media controls don't appear when pausing a small autoplaying video
            https://bugs.webkit.org/show_bug.cgi?id=159972
            <rdar://problem/27180657>

            Reviewed by Beth Dakin.

            When pausing an autoplaying video, remove behavior restrictions for the
            initial user gesture and show media controls.

            New WebKit API test. See VideoControlsManagerSingleSmallAutoplayingVideo.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::pause):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203392. rdar://problem/27056844

    2016-07-18  Alex Christensen  <achristensen@webkit.org>

            webbookmarksd needs to use the same AppCache directory as MobileSafari
            https://bugs.webkit.org/show_bug.cgi?id=159912

            Reviewed by Alexey Proskuryakov.

            No new tests.  This only changes behavior for webbookmarksd.

            * platform/RuntimeApplicationChecks.h:
            * platform/RuntimeApplicationChecks.mm:
            (WebCore::IOSApplication::isWebBookmarksD): Added.

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203543. rdar://problem/27429465

    2016-07-21  Dean Jackson  <dino@apple.com>

            REGRESSION (r202927): The internal size of the ImageBuffer is scaled twice by the context scaleFactor
            https://bugs.webkit.org/show_bug.cgi?id=159981
            <rdar://problem/27429465>

            Reviewed by Myles Maxfield.

            The change to propagate color spaces through ImageBuffers created an
            alternate version of createCompatibleBuffer. This version accidentally
            attempted to take the display resolution (i.e. hidpi) into account
            when creating the buffer, which meant it was being applied twice.

            The fix is simply to remove that logic. The caller of the method
            will take the resolution into account, the same way they did
            with the old createCompatibleBuffer method.

            Test: fast/hidpi/pdf-image-scaled.html

            * platform/graphics/cg/ImageBufferCG.cpp:
            (WebCore::ImageBuffer::createCompatibleBuffer): Don't calculate
            a resolution - just use the value of 1.0.

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203538. rdar://problem/27462960

    2016-07-21  Nan Wang  <n_wang@apple.com>

            AX: aria-label not being used correctly in accessible name calculation of heading
            https://bugs.webkit.org/show_bug.cgi?id=160009

            Reviewed by Chris Fleizach.

            Actually we are exposing the correct information for heading objects. On macOS,
            VoiceOver should handle the logic that picks the right information to speak.
            On iOS, VoiceOver is speaking the static text child instead of the heading object.
            So we should set the accessibilityLabel of the static text based on the parent's
            alternate label.

            Test: accessibility/ios-simulator/heading-with-aria-label.html

            * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
            (-[WebAccessibilityObjectWrapper _accessibilityTraitsFromAncestors]):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203518. rdar://problem/21400186

    2016-07-21  Ryosuke Niwa  <rniwa@webkit.org>

            Crash accessing null renderer inside WebCore::DeleteSelectionCommand::doApply
            https://bugs.webkit.org/show_bug.cgi?id=160011

            Reviewed by Chris Dumez.

            Add a null pointer check for renderer() call.

            Unfortunately no new tests since we don't have a reproduction.

            * editing/DeleteSelectionCommand.cpp:
            (WebCore::DeleteSelectionCommand::doApply):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203514. rdar://problem/27208636

    2016-07-21  Zalan Bujtas  <zalan@apple.com>

            Do not keep invalid IOSurface in ImageBufferData.
            https://bugs.webkit.org/show_bug.cgi?id=160005
            <rdar://problem/27208636>

            Reviewed by Simon Fraser.

            When we fail to initialize the IOSurface for the accelerated context, we switch over to
            the non-accelerated code path. Since ImageBufferData::surface is used to indicate whether
            the graphics context is in accelerated mode, we need to reset it when the initialization fails.

            Unable to create a test case.

            * platform/graphics/cg/ImageBufferCG.cpp:
            (WebCore::ImageBuffer::ImageBuffer):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203482. rdar://problem/27442806

    2016-07-19  Ryosuke Niwa  <rniwa@webkit.org>

            iOS: Cannot paste images in RTF content
            https://bugs.webkit.org/show_bug.cgi?id=159964
            <rdar://problem/27442806>

            Reviewed by Enrica Casucci.

            The bug was caused by setDefersLoading(true) not deferring image loading for the parsed fragment.
            Worked around this bug by disabling image loading while parsing the document fragment.

            * editing/ios/EditorIOS.mm:
            (WebCore::Editor::createFragmentAndAddResources):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203450. rdar://problem/21439264

    2016-07-20  Chris Dumez  <cdumez@apple.com>

            PostResolutionCallbackDisabler can resume pending requests while a ResourceLoadSuspender is alive
            https://bugs.webkit.org/show_bug.cgi?id=159962
            <rdar://problem/21439264>

            Reviewed by David Kilzer.

            PostResolutionCallbackDisabler can resume pending requests while a ResourceLoadSuspender
            is alive. We have both PostResolutionCallbackDisabler and ResourceLoadSuspender that
            call LoaderStrategy::suspendPendingRequests() / LoaderStrategy::resumePendingRequests().
            However, PostResolutionCallbackDisabler and ResourceLoadSuspender are not aware of each
            other. It is therefore possible for a PostResolutionCallbackDisabler object to get
            destroyed, causing LoaderStrategy::resumePendingRequests() to be called while a
            ResourceLoadSuspender object is alive.

            This leads to hard to investigate crashes where we end up re-entering WebKit and killing
            the style resolver.

            This patch drops ResourceLoadSuspender and uses PostResolutionCallbackDisabler instead.
            There was only one user of ResourceLoadSuspender and PostResolutionCallbackDisabler
            is better because it manages a resolutionNestingDepth counter internally to make sure
            it only calls LoaderStrategy::resumePendingRequests() once all
            PostResolutionCallbackDisabler instances are destroyed.

            No new tests, there is no easy way to reproduce the crashes.

            * dom/Document.cpp:
            (WebCore::Document::styleForElementIgnoringPendingStylesheets):
            * loader/LoaderStrategy.cpp:
            (WebCore::ResourceLoadSuspender::ResourceLoadSuspender): Deleted.
            (WebCore::ResourceLoadSuspender::~ResourceLoadSuspender): Deleted.
            * loader/LoaderStrategy.h:

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203425. rdar://problem/27488703

    2016-07-19  Zalan Bujtas  <zalan@apple.com>

            REGRESSION(r203415): ASSERTION FAILED: !m_layoutRoot->container() || !m_layoutRoot->container()->needsLayout()
            https://bugs.webkit.org/show_bug.cgi?id=159952

            Reviewed by Simon Fraser.

            Update ASSERTs to reflect new functionality, that is, now we can end up in a state
            where the container (RenderView) of one of the dirty subtrees is dirty.
            See r203415.

            Covered by editing/pasteboard/drag-drop-input-in-svg.svg

            * page/FrameView.cpp:
            (WebCore::FrameView::scheduleRelayoutOfSubtree):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203424. rdar://problem/27391012

    2016-07-19  Dean Jackson  <dino@apple.com>

            REGRESSION(202927): The first slide is the only displayed slide when Quicklooking a Keynote file
            https://bugs.webkit.org/show_bug.cgi?id=159948
            <rdar://problem/27391012>

            Reviewed by Simon Fraser.

            There is an iOS bug (<rdar://problem/27416744>) that is causing us
            to not always get a color space on CGContextRefs. Investigation of this
            exposed some optimizations we can take when we are creating ImageBuffers.
            In particular, if we have a bitmap context or an IOSurfaceContext we
            can simply copy their color space using API. Otherwise we stick with
            the existing CGContextCopyDeviceColorSpace.

            Lastly, if for some reason we are unable to copy the device color space,
            we should fall back to sRGB.

            * platform/graphics/cg/ImageBufferCG.cpp:
            (WebCore::ImageBuffer::createCompatibleBuffer):
            * platform/spi/cg/CoreGraphicsSPI.h: Add some SPI and enums.


2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203415. rdar://problem/27409483

    2016-07-19  Zalan Bujtas  <zalan@apple.com>

            theguardian.co.uk crossword puzzles are sometimes not displaying text
            https://bugs.webkit.org/show_bug.cgi?id=159924
            <rdar://problem/27409483>

            Reviewed by Simon Fraser.

            This patch fixes the case when
            - 2 disjoint subtrees are dirty
            - RenderView is also dirty.
            and we end up not laying out one of the 2 subtrees.

            In FrameView::scheduleRelayoutOfSubtree, we assume that when the RenderView is dirty
            we already have a pending full layout which means that any previous subtree layouts have already been
            converted to full layouts.
            However this assumption is incorrect. RenderView can get dirty without checking if there's
            already a pending subtree layout.
            One option to solve this problem would be to override RenderObject::setNeedsLayout in RenderView
            so that when the RenderView gets dirty, we could also convert any pending subtree layout to full layout.
            However RenderObject::setNeedsLayout is a hot function and making it virtual would impact performance.
            The other option is to always normalize subtree layouts in FrameView::scheduleRelayoutOfSubtree().
            This patch implements the second option.

            Test: fast/misc/subtree-layouts.html

            * page/FrameView.cpp:
            (WebCore::FrameView::scheduleRelayoutOfSubtree):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203414. rdar://problem/26756701

    2016-07-19  Anders Carlsson  <andersca@apple.com>

            Some payment authorization status values should keep the sheet active
            https://bugs.webkit.org/show_bug.cgi?id=159936
            rdar://problem/26756701

            Reviewed by Tim Horton.

            * Modules/applepay/ApplePaySession.cpp:
            (WebCore::ApplePaySession::completePayment):
            Keep the sheet active if the status isn't a final state status.

            * Modules/applepay/PaymentAuthorizationStatus.h:
            (WebCore::isFinalStateStatus):
            Add a new helper function that returns whether a given payment authorization status is "final",
            meaning that once that status has been passed to completePayment, the session is finished.

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203412. rdar://problem/26898984

    2016-07-19  Nan Wang  <n_wang@apple.com>

            AX: Incorrect behavior for word related text marker functions when there's collapsed whitespace
            https://bugs.webkit.org/show_bug.cgi?id=159910

            Reviewed by Chris Fleizach.

            We are getting a bad CharacterOffset when there's collapsed whitespace. Added a TraverseOptionValidateOffset
            option to make sure we are getting the correct CharacterOffset based on the corresponding Range offset. And
            fixed a word navigation issue based on that.

            Test: accessibility/mac/text-marker-word-nav-collapsed-whitespace.html

            * accessibility/AXObjectCache.cpp:
            (WebCore::AXObjectCache::traverseToOffsetInRange):
            (WebCore::AXObjectCache::rangeForNodeContents):
            (WebCore::AXObjectCache::startOrEndCharacterOffsetForRange):
            (WebCore::AXObjectCache::characterOffsetFromVisiblePosition):
            (WebCore::AXObjectCache::rightWordRange):
            (WebCore::AXObjectCache::previousBoundary):
            * accessibility/AXObjectCache.h:
            (WebCore::AXObjectCache::isNodeInUse):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203409. rdar://problem/27182267

    2016-07-19  Simon Fraser  <simon.fraser@apple.com>

            Bubbles appear split for a brief moment in Messages
            https://bugs.webkit.org/show_bug.cgi?id=159915
            rdar://problem/27182267

            Reviewed by David Hyatt.

            RenderView::repaintRootContents() had a long-standing bug in WebView when the
            view is scrolled. repaint() uses visualOverflowRect() but, for the
            RenderView, the visualOverflowRect() is the initial containing block
            which is anchored at 0,0. When the view is scrolled it's clipped out and
            calls to repaintRootContents() have no effect.

            Change repaintRootContents() to use layoutOverflowRect(). ScrollView::repaintContentRectangle()
            will clip it to the view if necessary.

            Test: fast/repaint/scrolled-view-full-repaint.html

            * rendering/RenderView.cpp:
            (WebCore::RenderView::repaintRootContents):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203388. rdar://problem/25740804

    2016-07-18  Jeremy Jones  <jeremyj@apple.com>

            If previous media session interruptions were prevented, still allow subsequent interruptions to try.
            https://bugs.webkit.org/show_bug.cgi?id=157553
            rdar://problem/25740804

            Reviewed by Eric Carlson.

            Test: platform/ios-simulator/media/video-interruption-suspendunderlock.html

            When suspending under lock on iOS, there is first a resign active event, then a
            suspend under lock. PiP prevents resign active from interrupting playback. But it should allow the
            suspend under lock to interrupt playback.

            Currently if there are nested interruptions only the first one is acted upon.

            This change allows subsequent, nested interruptions to have a chance to interrupt playback if the
            previous interruptions were ignored.

            This test is for iPad only, so it must be run manually.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::shouldOverrideBackgroundPlaybackRestriction):
            * platform/audio/PlatformMediaSession.cpp:
            (WebCore::PlatformMediaSession::beginInterruption):
            * testing/Internals.cpp:
            (WebCore::Internals::beginMediaSessionInterruption):

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203380. rdar://problem/27391725

    2016-07-18  Dean Jackson  <dino@apple.com>

            REGRESSION (r202950): Image zoom animations are broken at medium.com (159861)
            https://bugs.webkit.org/show_bug.cgi?id=159906
            <rdar://problem/27391725>

            Reviewed by Simon Fraser.

            The fix for webkit.org/b/157569 in r200769 broke AMP pages.
            The followup fix for webkit.org/b/159450 in r202950 broke Medium pages.

            Revert them both until we have better testing.

            * css/CSSParser.cpp:
            (WebCore::CSSParser::addPropertyWithPrefixingVariant):
            (WebCore::CSSParser::parseValue):
            (WebCore::CSSParser::parseAnimationShorthand):
            (WebCore::CSSParser::parseTransitionShorthand): Deleted.
            * css/CSSPropertyNames.in:
            * css/PropertySetCSSStyleDeclaration.cpp:
            (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
            (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
            (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
            (WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
            * css/StyleProperties.cpp:
            (WebCore::MutableStyleProperties::removeShorthandProperty):
            (WebCore::MutableStyleProperties::removeProperty):
            (WebCore::MutableStyleProperties::removePrefixedOrUnprefixedProperty):
            (WebCore::MutableStyleProperties::setProperty):
            (WebCore::getIndexInShorthandVectorForPrefixingVariant):
            (WebCore::MutableStyleProperties::appendPrefixingVariantProperty):
            (WebCore::MutableStyleProperties::setPrefixingVariantProperty):
            (WebCore::StyleProperties::asText): Deleted.
            * css/StyleProperties.h:

2016-07-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r203362. rdar://problem/27371624

    2016-07-18  Eric Carlson  <eric.carlson@apple.com>

            [MSE][Mac] Pass AVSampleBufferDisplayLayer HDCP status to a newly created key session
            https://bugs.webkit.org/show_bug.cgi?id=159812
            <rdar://problem/27371624>

            Reviewed by Jon Lee.

            No new tests, it isn't possible to test this with our current testing infrastructure.

            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
            (WebCore::SourceBufferPrivateAVFObjC::setCDMSession): Call layerDidReceiveError if there has
            been an HDCP error.
            (WebCore::SourceBufferPrivateAVFObjC::rendererDidReceiveError): Remember an HDCP error.

2016-07-19  Babak Shafiei  <bshafiei@apple.com>

        Merge r203404.

    2016-07-19  Dan Bernstein  <mitz@apple.com>

            <rdar://problem/27420308> WebCore-7602.1.42 fails to build: error: unused parameter 'vm'

            * bindings/js/JSDOMGlobalObject.cpp:
            (WebCore::JSDOMGlobalObject::addBuiltinGlobals): Fixed the !ENABLE(STREAMS_API) build.

2016-07-18  Babak Shafiei  <bshafiei@apple.com>

        Merge patch for rdar://problem/27360961.

    2016-06-23  Dean Jackson  <dino@apple.com>

            Disable some features on safari-602-branch.
            <rdar://problem/27360961>

            * Configurations/FeatureDefines.xcconfig:

2016-07-18  Youenn Fablet  <youenn@apple.com>

        [Streams API] ReadableStream should throw a RangeError in case of NaN highWaterMark
        https://bugs.webkit.org/show_bug.cgi?id=159870

        Reviewed by Xabier Rodriguez-Calvar.

        Covered by rebased test.

        * Modules/streams/StreamInternals.js:
        (validateAndNormalizeQueuingStrategy): Throwing a RangeError in lieu of a TypeError in case of NaN highWaterMark.

2016-07-18  Csaba Osztrogonác  <ossy@webkit.org>

        Windows buildfix after r203338
        https://bugs.webkit.org/show_bug.cgi?id=159875

        Unreviewed buildfix.

        * dom/UserGestureIndicator.h:
        (WebCore::UserGestureToken::addDestructionObserver):

2016-07-18  Carlos Garcia Campos  <cgarcia@igalia.com>

        MemoryPressureHandler doesn't work if cgroups aren't present in Linux
        https://bugs.webkit.org/show_bug.cgi?id=155255

        Reviewed by Sergio Villar Senin.

        Allow to pass an eventFD file descriptor to the MemoryPressureHandler to be monitorized in case cgroups are not
        available.

        * platform/MemoryPressureHandler.h:
        * platform/linux/MemoryPressureHandlerLinux.cpp:

2016-07-17  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Clean up PassRefPtr uses in Modules/encryptedmedia, Modules/speech, and Modules/quota
        https://bugs.webkit.org/show_bug.cgi?id=159701

        Reviewed by Alex Christensen.

        No new tests, no behavior changes.

        * Modules/encryptedmedia/CDM.h:
        * Modules/encryptedmedia/MediaKeySession.h:
        * Modules/encryptedmedia/MediaKeys.h:
        * Modules/quota/DOMWindowQuota.cpp:
        * Modules/quota/StorageErrorCallback.cpp:
        (WebCore::StorageErrorCallback::CallbackTask::CallbackTask):
        * Modules/quota/StorageErrorCallback.h:
        * Modules/quota/StorageInfo.h:
        * Modules/quota/StorageQuota.h:
        * Modules/speech/DOMWindowSpeechSynthesis.cpp:
        * Modules/speech/SpeechSynthesis.cpp:
        (WebCore::SpeechSynthesis::getVoices):
        (WebCore::SpeechSynthesis::startSpeakingImmediately):
        (WebCore::SpeechSynthesis::speak):
        (WebCore::SpeechSynthesis::cancel):
        (WebCore::SpeechSynthesis::handleSpeakingCompleted):
        (WebCore::SpeechSynthesis::boundaryEventOccurred):
        (WebCore::SpeechSynthesis::didStartSpeaking):
        (WebCore::SpeechSynthesis::didPauseSpeaking):
        (WebCore::SpeechSynthesis::didResumeSpeaking):
        (WebCore::SpeechSynthesis::didFinishSpeaking):
        (WebCore::SpeechSynthesis::speakingErrorOccurred):
        * Modules/speech/SpeechSynthesis.h:
        * Modules/speech/SpeechSynthesisEvent.h:
        * Modules/speech/SpeechSynthesisUtterance.h:
        * Modules/speech/SpeechSynthesisVoice.cpp:
        (WebCore::SpeechSynthesisVoice::create):
        (WebCore::SpeechSynthesisVoice::SpeechSynthesisVoice):
        * Modules/speech/SpeechSynthesisVoice.h:
        * platform/PlatformSpeechSynthesizer.h:
        * platform/efl/PlatformSpeechSynthesisProviderEfl.cpp:
        (WebCore::PlatformSpeechSynthesisProviderEfl::fireSpeechEvent):
        * platform/mock/PlatformSpeechSynthesizerMock.cpp:
        (WebCore::PlatformSpeechSynthesizerMock::speakingFinished):
        (WebCore::PlatformSpeechSynthesizerMock::speak):
        (WebCore::PlatformSpeechSynthesizerMock::cancel):
        (WebCore::PlatformSpeechSynthesizerMock::pause):
        (WebCore::PlatformSpeechSynthesizerMock::resume):

2016-07-16  Sam Weinig  <sam@webkit.org>

        [WebKit API] Add SPI to track multiple navigations caused by a single user gesture
        <rdar://problem/26554137>
        https://bugs.webkit.org/show_bug.cgi?id=159856

        Reviewed by Dan Bernstein.

        - Adds a new RefCounted object to represent a unique user gesture, called UserGestureToken.
        - Makes UserGestureIndicator track UserGestureToken.
        - Refines UserGestureIndicator's interface to use Optional and a smaller enum set
          to represent the different initial states.
        - Stores UserGestureTokens on objects that want to forward user gesture state (DOMTimer, 
          postMessage, and ScheduledNavigation) rather than just a boolean.

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::increment):
        (WebCore::AccessibilityNodeObject::decrement):
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::press):
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::executeScriptInWorld):
        (WebCore::ScriptController::executeScript):
        Update for new UserGestureIndicator interface.

        * dom/UserGestureIndicator.cpp:
        (WebCore::currentToken):
        (WebCore::UserGestureToken::~UserGestureToken):
        (WebCore::UserGestureIndicator::UserGestureIndicator):
        (WebCore::UserGestureIndicator::~UserGestureIndicator):
        (WebCore::UserGestureIndicator::currentUserGesture):
        (WebCore::UserGestureIndicator::processingUserGesture):
        (WebCore::UserGestureIndicator::processingUserGestureForMedia):
        (WebCore::isDefinite): Deleted.
        * dom/UserGestureIndicator.h:
        (WebCore::UserGestureToken::create):
        (WebCore::UserGestureToken::state):
        (WebCore::UserGestureToken::processingUserGesture):
        (WebCore::UserGestureToken::processingUserGestureForMedia):
        (WebCore::UserGestureToken::addDestructionObserver):
        (WebCore::UserGestureToken::UserGestureToken):
        Add UserGestureToken and track the current one explicitly.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::didReceiveRemoteControlCommand):
        * inspector/InspectorFrontendClientLocal.cpp:
        (WebCore::InspectorFrontendClientLocal::openInNewTab):
        * inspector/InspectorFrontendHost.cpp:
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::navigate):
        Update for new UserGestureIndicator interface.

        * loader/NavigationAction.cpp:
        (WebCore::NavigationAction::NavigationAction):
        * loader/NavigationAction.h:
        (WebCore::NavigationAction::userGestureToken):
        (WebCore::NavigationAction::processingUserGesture):
        * loader/NavigationScheduler.cpp:
        (WebCore::ScheduledNavigation::ScheduledNavigation):
        (WebCore::ScheduledNavigation::~ScheduledNavigation):
        (WebCore::ScheduledNavigation::lockBackForwardList):
        (WebCore::ScheduledNavigation::wasDuringLoad):
        (WebCore::ScheduledNavigation::isLocationChange):
        (WebCore::ScheduledNavigation::userGestureToForward):
        (WebCore::ScheduledNavigation::clearUserGesture):
        (WebCore::NavigationScheduler::mustLockBackForwardList):
        (WebCore::NavigationScheduler::scheduleFormSubmission):
        (WebCore::ScheduledNavigation::wasUserGesture): Deleted.
        * page/DOMTimer.cpp:
        (WebCore::shouldForwardUserGesture):
        (WebCore::userGestureTokenToForward):
        (WebCore::DOMTimer::DOMTimer):
        (WebCore::DOMTimer::fired):
        * page/DOMTimer.h:
        * page/DOMWindow.cpp:
        (WebCore::PostMessageTimer::PostMessageTimer):
        Store the active UserGestureToken rather than just a bit.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMousePressEvent):
        (WebCore::EventHandler::handleMouseDoubleClickEvent):
        (WebCore::EventHandler::handleMouseReleaseEvent):
        (WebCore::EventHandler::keyEvent):
        (WebCore::EventHandler::handleTouchEvent):
        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::toggleMediaFullscreenState):
        (WebCore::HitTestResult::enterFullscreenForVideo):
        (WebCore::HitTestResult::toggleEnhancedFullscreenForVideo):
        Update for new UserGestureIndicator interface.

2016-07-17  Ryosuke Niwa  <rniwa@webkit.org>

        Rename fastHasAttribute to hasAttributeWithoutSynchronization
        https://bugs.webkit.org/show_bug.cgi?id=159864

        Reviewed by Chris Dumez.

        Renamed Rename fastHasAttribute to hasAttributeWithoutSynchronization for clarity.

        * accessibility/AccessibilityListBoxOption.cpp:
        (WebCore::AccessibilityListBoxOption::isEnabled):
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::hasAttribute):
        (WebCore::AccessibilityObject::getAttribute):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
        * bindings/scripts/CodeGenerator.pm:
        (GetterExpression):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjReflectedBooleanAttr):
        (WebCore::jsTestObjReflectedCustomBooleanAttr):
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj reflectedBooleanAttr]):
        (-[DOMTestObj setReflectedBooleanAttr:]):
        (-[DOMTestObj reflectedCustomBooleanAttr]):
        (-[DOMTestObj setReflectedCustomBooleanAttr:]):
        * dom/Document.cpp:
        (WebCore::Document::hasManifest):
        (WebCore::Document::doctype):
        * dom/Element.h:
        (WebCore::Node::parentElement):
        (WebCore::Element::hasAttributeWithoutSynchronization):
        (WebCore::Element::fastHasAttribute): Deleted.
        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss):
        * editing/markup.cpp:
        (WebCore::createMarkupInternal):
        * html/ColorInputType.cpp:
        (WebCore::ColorInputType::shouldShowSuggestions):
        * html/FileInputType.cpp:
        (WebCore::FileInputType::handleDOMActivateEvent):
        (WebCore::FileInputType::receiveDroppedFiles):
        * html/FormAssociatedElement.cpp:
        (WebCore::FormAssociatedElement::didMoveToNewDocument):
        (WebCore::FormAssociatedElement::insertedInto):
        (WebCore::FormAssociatedElement::removedFrom):
        (WebCore::FormAssociatedElement::formAttributeChanged):
        * html/FormController.cpp:
        (WebCore::ownerFormForState):
        * html/GenericCachedHTMLCollection.cpp:
        (WebCore::GenericCachedHTMLCollection<traversalType>::elementMatches):
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::draggable):
        (WebCore::HTMLAnchorElement::href):
        (WebCore::HTMLAnchorElement::sendPings):
        * html/HTMLAppletElement.cpp:
        (WebCore::HTMLAppletElement::rendererIsNeeded):
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::collectStyleForPresentationAttribute):
        (WebCore::elementAffectsDirectionality):
        (WebCore::setHasDirAutoFlagRecursively):
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::rendererIsNeeded):
        * html/HTMLFieldSetElement.cpp:
        (WebCore::updateFromControlElementsAncestorDisabledStateUnder):
        (WebCore::HTMLFieldSetElement::disabledAttributeChanged):
        (WebCore::HTMLFieldSetElement::disabledStateChanged):
        (WebCore::HTMLFieldSetElement::childrenChanged):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::formNoValidate):
        (WebCore::HTMLFormControlElement::formAction):
        (WebCore::HTMLFormControlElement::computeIsDisabledByFieldsetAncestor):
        (WebCore::shouldAutofocus):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::formElementIndex):
        (WebCore::HTMLFormElement::noValidate):
        * html/HTMLFrameElement.cpp:
        (WebCore::HTMLFrameElement::noResize):
        (WebCore::HTMLFrameElement::didAttachRenderers):
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::parseAttribute):
        (WebCore::HTMLFrameElementBase::location):
        * html/HTMLHRElement.cpp:
        (WebCore::HTMLHRElement::collectStyleForPresentationAttribute):
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::isServerMap):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::finishParsingChildren):
        (WebCore::HTMLInputElement::matchesDefaultPseudoClass):
        (WebCore::HTMLInputElement::isActivatedSubmit):
        (WebCore::HTMLInputElement::reset):
        (WebCore::HTMLInputElement::multiple):
        (WebCore::HTMLInputElement::setSize):
        (WebCore::HTMLInputElement::shouldUseMediaCapture):
        * html/HTMLMarqueeElement.cpp:
        (WebCore::HTMLMarqueeElement::minimumDelay):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::insertedInto):
        (WebCore::HTMLMediaElement::selectMediaResource):
        (WebCore::HTMLMediaElement::loadResource):
        (WebCore::HTMLMediaElement::autoplay):
        (WebCore::HTMLMediaElement::preload):
        (WebCore::HTMLMediaElement::loop):
        (WebCore::HTMLMediaElement::setLoop):
        (WebCore::HTMLMediaElement::controls):
        (WebCore::HTMLMediaElement::setControls):
        (WebCore::HTMLMediaElement::muted):
        (WebCore::HTMLMediaElement::setMuted):
        (WebCore::HTMLMediaElement::selectNextSourceChild):
        (WebCore::HTMLMediaElement::sourceWasAdded):
        (WebCore::HTMLMediaElement::mediaSessionTitle):
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::parseAttribute):
        * html/HTMLOptGroupElement.cpp:
        (WebCore::HTMLOptGroupElement::isDisabledFormControl):
        (WebCore::HTMLOptGroupElement::isFocusable):
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::matchesDefaultPseudoClass):
        (WebCore::HTMLOptionElement::text):
        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::isDeterminate):
        (WebCore::HTMLProgressElement::didElementStateChange):
        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::async):
        (WebCore::HTMLScriptElement::setCrossOrigin):
        (WebCore::HTMLScriptElement::asyncAttributeValue):
        (WebCore::HTMLScriptElement::deferAttributeValue):
        (WebCore::HTMLScriptElement::hasSourceAttribute):
        (WebCore::HTMLScriptElement::dispatchLoadEvent):
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::reset):
        * html/HTMLTrackElement.cpp:
        (WebCore::HTMLTrackElement::isDefault):
        (WebCore::HTMLTrackElement::ensureTrack):
        (WebCore::HTMLTrackElement::loadTimerFired):
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::wirelessVideoPlaybackDisabled):
        (WebCore::MediaElementSession::requiresFullscreenForVideoPlayback):
        (WebCore::MediaElementSession::allowsAutomaticMediaDataLoading):
        * html/SearchInputType.cpp:
        (WebCore::SearchInputType::searchEventsShouldBeDispatched):
        (WebCore::SearchInputType::didSetValueByUserEdit):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::buildObjectForNode):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::shouldTreatURLAsSrcdocDocument):
        (WebCore::FrameLoader::findFrameForNavigation):
        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::notifyFinished):
        * mathml/MathMLSelectElement.cpp:
        (WebCore::MathMLSelectElement::getSelectedSemanticsChild):
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::computePreferredLogicalWidths):
        * rendering/RenderThemeIOS.mm:
        (WebCore::RenderThemeIOS::adjustMenuListButtonStyle):
        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::canUseForWithReason):
        * rendering/svg/RenderSVGResourceClipper.cpp:
        (WebCore::RenderSVGResourceClipper::drawContentIntoMaskImage):
        * svg/SVGAnimateMotionElement.cpp:
        (WebCore::SVGAnimateMotionElement::updateAnimationPath):
        * svg/SVGAnimationElement.cpp:
        (WebCore::SVGAnimationElement::startedActiveInterval):
        (WebCore::SVGAnimationElement::updateAnimation):
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::insertedInto):

2016-07-17  Brady Eidson  <beidson@apple.com>

        Exceptions logged to the JS console should use toString().
        https://bugs.webkit.org/show_bug.cgi?id=159855

        Reviewed by Darin Adler.

        No new tests (No change in behavior).

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::reportException):

        * dom/DOMCoreException.h:
        (WebCore::DOMCoreException::DOMCoreException):

        * dom/ExceptionBase.cpp:
        (WebCore::ExceptionBase::ExceptionBase):
        (WebCore::ExceptionBase::toString):
        (WebCore::ExceptionBase::consoleErrorMessage): Deleted.
        * dom/ExceptionBase.h:
        (WebCore::ExceptionBase::description): Deleted.

        * svg/SVGException.h:

        * xml/XPathException.h:
        (WebCore::XPathException::XPathException):

2016-07-17  Brady Eidson  <beidson@apple.com>

        Update DOMCoreException to use the description in toString().
        https://bugs.webkit.org/show_bug.cgi?id=159857

        Reviewed by Darin Adler.

        No new tests (Covered by changes to existing tests).

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::createDOMException):

        * dom/DOMCoreException.h:
        (WebCore::DOMCoreException::DOMCoreException):
        (WebCore::DOMCoreException::createWithDescriptionAsMessage): Deleted.

2016-07-17  Myles C. Maxfield  <mmaxfield@apple.com>

        Support new emoji group candidates
        https://bugs.webkit.org/show_bug.cgi?id=159755
        <rdar://problem/27325521>

        Reviewed by Dean Jackson.

        There are a few code points which should be able to be joined (with ZWJ) to
        either U+2640 or U+2642 to change the gender of the emoji. These patterns
        should also work with an additional 0xFE0F variation selector. This patch
        adds these new patterns to our existing emoji group candidate infrastructure.

        Tests: fast/text/emoji-gender-2-3.html
               fast/text/emoji-gender-2-4.html
               fast/text/emoji-gender-2-5.html
               fast/text/emoji-gender-2-6.html
               fast/text/emoji-gender-2-7.html
               fast/text/emoji-gender-2-8.html
               fast/text/emoji-gender-2-9.html
               fast/text/emoji-gender-2.html
               fast/text/emoji-gender-3.html
               fast/text/emoji-gender-4.html
               fast/text/emoji-gender-5.html
               fast/text/emoji-gender-6.html
               fast/text/emoji-gender-7.html
               fast/text/emoji-gender-8.html
               fast/text/emoji-gender-9.html
               fast/text/emoji-gender-fe0f-3.html
               fast/text/emoji-gender-fe0f-4.html
               fast/text/emoji-gender-fe0f-5.html
               fast/text/emoji-gender-fe0f-6.html
               fast/text/emoji-gender-fe0f-7.html
               fast/text/emoji-gender-fe0f-8.html
               fast/text/emoji-gender-fe0f-9.html
               fast/text/emoji-gender.html
               fast/text/emoji-num-glyphs.html
               fast/text/emoji-single-parent-family-2.html
               fast/text/emoji-single-parent-family.html

        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Removed incorrect ASSERT()s.
        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::characterRangeCodePath):
        * platform/text/CharacterProperties.h:
        (WebCore::isEmojiGroupCandidate):

2016-07-16  Brady Eidson  <beidson@apple.com>

        Update SVGException to use the description in toString().
        https://bugs.webkit.org/show_bug.cgi?id=159847

        Reviewed by Darin Adler.

        No new tests (Covered by changes to existing tests).

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::reportException): use consoleErrorMessage for now.

        * dom/ExceptionBase.cpp:
        (WebCore::ExceptionBase::consoleErrorMessage):
        * dom/ExceptionBase.h:

        * svg/SVGException.h:

2016-07-16  Chris Dumez  <cdumez@apple.com>

        Use fastHasAttribute() when possible
        https://bugs.webkit.org/show_bug.cgi?id=159838

        Reviewed by Ryosuke Niwa.

        Use fastHasAttribute() when possible, for performance.

        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss):
        * editing/markup.cpp:
        (WebCore::createMarkupInternal):
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::draggable):
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::parseAttribute):
        * mathml/MathMLSelectElement.cpp:
        (WebCore::MathMLSelectElement::getSelectedSemanticsChild):
        * rendering/RenderThemeIOS.mm:
        (WebCore::RenderThemeIOS::adjustMenuListButtonStyle):

2016-07-16  Ryosuke Niwa  <rniwa@webkit.org>

        Rename fastGetAttribute to attributeWithoutSynchronization
        https://bugs.webkit.org/show_bug.cgi?id=159852

        Reviewed by Darin Adler.

        Renamed fastGetAttribute to attributeWithoutSynchronization for clarity.

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::findAriaModalNodes):
        (WebCore::nodeHasRole):
        (WebCore::AXObjectCache::handleLiveRegionCreated):
        (WebCore::AXObjectCache::handleMenuItemSelected):
        (WebCore::AXObjectCache::handleAriaModalChange):
        (WebCore::isNodeAriaVisible):
        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::siblingWithAriaRole):
        (WebCore::AccessibilityNodeObject::titleElementText):
        (WebCore::AccessibilityNodeObject::alternativeTextForWebArea):
        (WebCore::AccessibilityNodeObject::hierarchicalLevel):
        (WebCore::AccessibilityNodeObject::stringValue):
        (WebCore::accessibleNameForNode):
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::contentEditableAttributeIsEnabled):
        (WebCore::AccessibilityObject::getAttribute):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::stringValue):
        (WebCore::AccessibilityRenderObject::exposesTitleUIElement):
        * accessibility/AccessibilitySVGElement.cpp:
        (WebCore::AccessibilitySVGElement::childElementWithMatchingLanguage):
        (WebCore::AccessibilitySVGElement::accessibilityDescription):
        * bindings/objc/DOM.mm:
        (-[DOMHTMLLinkElement _mediaQueryMatches]):
        * bindings/scripts/CodeGenerator.pm:
        (GetterExpression):
        * bindings/scripts/CodeGeneratorObjC.pm:
        (GenerateImplementation):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjReflectedStringAttr):
        * dom/AuthorStyleSheets.cpp:
        (WebCore::AuthorStyleSheets::collectActiveStyleSheets):
        * dom/Document.cpp:
        (WebCore::Document::buildAccessKeyMap):
        (WebCore::Document::processBaseElement):
        * dom/DocumentOrderedMap.cpp:
        (WebCore::DocumentOrderedMap::getElementByLabelForAttribute):
        * dom/Element.cpp:
        (WebCore::Element::imageSourceURL):
        (WebCore::Element::rendererIsNeeded):
        (WebCore::Element::insertedInto):
        (WebCore::Element::removedFrom):
        (WebCore::Element::pseudo):
        (WebCore::Element::setPseudo):
        (WebCore::Element::spellcheckAttributeState):
        (WebCore::Element::canContainRangeEndPoint):
        (WebCore::Element::completeURLsInAttributeValue):
        * dom/Element.h:
        (WebCore::Element::fastHasAttribute):
        (WebCore::Element::attributeWithoutSynchronization):
        (WebCore::Element::fastGetAttribute): Deleted.
        * dom/InlineStyleSheetOwner.cpp:
        (WebCore::InlineStyleSheetOwner::createSheet):
        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::requestScript):
        (WebCore::ScriptElement::executeScript):
        * dom/SlotAssignment.cpp:
        (WebCore::slotNameFromSlotAttribute):
        (WebCore::SlotAssignment::SlotAssignment):
        (WebCore::recursivelyFireSlotChangeEvent):
        (WebCore::SlotAssignment::didChangeSlot):
        (WebCore::SlotAssignment::hostChildElementDidChange):
        (WebCore::SlotAssignment::assignedNodesForSlot):
        (WebCore::SlotAssignment::resolveAllSlotElements):
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::labelElementForId):
        * dom/VisitedLinkState.cpp:
        (WebCore::linkAttribute):
        * editing/ApplyStyleCommand.cpp:
        (WebCore::isLegacyAppleStyleSpan):
        (WebCore::hasNoAttributeOrOnlyStyleAttribute):
        * editing/EditingStyle.cpp:
        (WebCore::EditingStyle::elementIsStyledSpanOrHTMLEquivalent):
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::isInterchangeNewlineNode):
        (WebCore::isInterchangeConvertedSpaceSpan):
        (WebCore::positionAvoidingPrecedingNodes):
        (WebCore::isMailPasteAsQuotationNode):
        (WebCore::isHeaderElement):
        (WebCore::isInlineNodeWithStyle):
        * editing/TextIterator.cpp:
        (WebCore::isRendererReplacedElement):
        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::isDataDetectorLink):
        (WebCore::DataDetection::requiresExtendedContext):
        (WebCore::DataDetection::dataDetectorIdentifier):
        (WebCore::DataDetection::shouldCancelDefaultAction):
        (WebCore::removeResultLinksFromAnchor):
        (WebCore::searchForLinkRemovingExistingDDLinks):
        * editing/gtk/EditorGtk.cpp:
        (WebCore::elementURL):
        * editing/htmlediting.cpp:
        (WebCore::isTabSpanNode):
        (WebCore::isTabSpanTextNode):
        (WebCore::isMailBlockquote):
        (WebCore::caretMinOffset):
        * editing/markup.cpp:
        (WebCore::createFragmentFromMarkup):
        * html/Autofill.cpp:
        (WebCore::AutofillData::createFromHTMLFormControlElement):
        * html/BaseTextInputType.cpp:
        (WebCore::BaseTextInputType::patternMismatch):
        * html/DateInputType.cpp:
        (WebCore::DateInputType::createStepRange):
        * html/DateTimeInputType.cpp:
        (WebCore::DateTimeInputType::createStepRange):
        * html/DateTimeLocalInputType.cpp:
        (WebCore::DateTimeLocalInputType::createStepRange):
        * html/FormAssociatedElement.cpp:
        (WebCore::FormAssociatedElement::findAssociatedForm):
        (WebCore::FormAssociatedElement::resetFormAttributeTargetObserver):
        (WebCore::FormAssociatedElement::formAttributeTargetChanged):
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::draggable):
        (WebCore::HTMLAnchorElement::href):
        (WebCore::HTMLAnchorElement::setHref):
        (WebCore::HTMLAnchorElement::target):
        (WebCore::HTMLAnchorElement::origin):
        (WebCore::HTMLAnchorElement::sendPings):
        (WebCore::HTMLAnchorElement::handleClick):
        * html/HTMLAnchorElement.h:
        (WebCore::HTMLAnchorElement::visitedLinkHash):
        * html/HTMLAppletElement.cpp:
        (WebCore::HTMLAppletElement::updateWidget):
        * html/HTMLAreaElement.cpp:
        (WebCore::HTMLAreaElement::target):
        * html/HTMLAttachmentElement.cpp:
        (WebCore::HTMLAttachmentElement::attachmentTitle):
        (WebCore::HTMLAttachmentElement::attachmentType):
        * html/HTMLBaseElement.cpp:
        (WebCore::HTMLBaseElement::target):
        (WebCore::HTMLBaseElement::href):
        * html/HTMLBodyElement.cpp:
        (WebCore::HTMLBodyElement::addSubresourceAttributeURLs):
        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::value):
        (WebCore::HTMLButtonElement::computeWillValidate):
        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::reset):
        * html/HTMLDocument.cpp:
        (WebCore::HTMLDocument::bgColor):
        (WebCore::HTMLDocument::setBgColor):
        (WebCore::HTMLDocument::fgColor):
        (WebCore::HTMLDocument::setFgColor):
        (WebCore::HTMLDocument::alinkColor):
        (WebCore::HTMLDocument::setAlinkColor):
        (WebCore::HTMLDocument::linkColor):
        (WebCore::HTMLDocument::setLinkColor):
        (WebCore::HTMLDocument::vlinkColor):
        (WebCore::HTMLDocument::setVlinkColor):
        * html/HTMLElement.cpp:
        (WebCore::contentEditableType):
        (WebCore::HTMLElement::collectStyleForPresentationAttribute):
        (WebCore::HTMLElement::dir):
        (WebCore::HTMLElement::setDir):
        (WebCore::HTMLElement::draggable):
        (WebCore::HTMLElement::setDraggable):
        (WebCore::HTMLElement::title):
        (WebCore::HTMLElement::tabIndex):
        (WebCore::HTMLElement::translateAttributeMode):
        (WebCore::HTMLElement::hasDirectionAuto):
        (WebCore::HTMLElement::directionality):
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::imageSourceURL):
        (WebCore::HTMLEmbedElement::addSubresourceAttributeURLs):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::formEnctype):
        (WebCore::HTMLFormControlElement::formMethod):
        (WebCore::HTMLFormControlElement::formAction):
        (WebCore::HTMLFormControlElement::autocorrect):
        (WebCore::HTMLFormControlElement::autocapitalizeType):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::autocorrect):
        (WebCore::HTMLFormElement::autocapitalizeType):
        (WebCore::HTMLFormElement::autocapitalize):
        (WebCore::HTMLFormElement::action):
        (WebCore::HTMLFormElement::setAction):
        (WebCore::HTMLFormElement::target):
        (WebCore::HTMLFormElement::wasUserSubmitted):
        (WebCore::HTMLFormElement::shouldAutocomplete):
        (WebCore::HTMLFormElement::finishParsingChildren):
        (WebCore::HTMLFormElement::autocomplete):
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::location):
        (WebCore::HTMLFrameElementBase::setLocation):
        * html/HTMLHtmlElement.cpp:
        (WebCore::HTMLHtmlElement::insertedByParser):
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::imageSourceURL):
        (WebCore::HTMLImageElement::setBestFitURLAndDPRFromImageCandidate):
        (WebCore::HTMLImageElement::bestFitSourceFromPictureElement):
        (WebCore::HTMLImageElement::selectImageSource):
        (WebCore::HTMLImageElement::altText):
        (WebCore::HTMLImageElement::createElementRenderer):
        (WebCore::HTMLImageElement::width):
        (WebCore::HTMLImageElement::height):
        (WebCore::HTMLImageElement::alt):
        (WebCore::HTMLImageElement::draggable):
        (WebCore::HTMLImageElement::setHeight):
        (WebCore::HTMLImageElement::src):
        (WebCore::HTMLImageElement::setSrc):
        (WebCore::HTMLImageElement::addSubresourceAttributeURLs):
        (WebCore::HTMLImageElement::didMoveToNewDocument):
        (WebCore::HTMLImageElement::isServerMap):
        (WebCore::HTMLImageElement::crossOrigin):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::updateType):
        (WebCore::HTMLInputElement::initializeInputType):
        (WebCore::HTMLInputElement::altText):
        (WebCore::HTMLInputElement::value):
        (WebCore::HTMLInputElement::defaultValue):
        (WebCore::HTMLInputElement::setDefaultValue):
        (WebCore::HTMLInputElement::acceptMIMETypes):
        (WebCore::HTMLInputElement::acceptFileExtensions):
        (WebCore::HTMLInputElement::accept):
        (WebCore::HTMLInputElement::alt):
        (WebCore::HTMLInputElement::effectiveMaxLength):
        (WebCore::HTMLInputElement::src):
        (WebCore::HTMLInputElement::setAutoFilled):
        (WebCore::HTMLInputElement::dataList):
        (WebCore::HTMLInputElement::resetListAttributeTargetObserver):
        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::isKeytypeRSA):
        (WebCore::HTMLKeygenElement::appendFormData):
        * html/HTMLLIElement.cpp:
        (WebCore::HTMLLIElement::didAttachRenderers):
        (WebCore::HTMLLIElement::parseValue):
        * html/HTMLLabelElement.cpp:
        (WebCore::HTMLLabelElement::control):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::crossOrigin):
        (WebCore::HTMLLinkElement::process):
        (WebCore::HTMLLinkElement::href):
        (WebCore::HTMLLinkElement::rel):
        (WebCore::HTMLLinkElement::target):
        (WebCore::HTMLLinkElement::type):
        (WebCore::HTMLLinkElement::iconType):
        * html/HTMLMarqueeElement.cpp:
        (WebCore::HTMLMarqueeElement::scrollAmount):
        (WebCore::HTMLMarqueeElement::setScrollAmount):
        (WebCore::HTMLMarqueeElement::scrollDelay):
        (WebCore::HTMLMarqueeElement::setScrollDelay):
        (WebCore::HTMLMarqueeElement::loop):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::insertedInto):
        (WebCore::HTMLMediaElement::crossOrigin):
        (WebCore::HTMLMediaElement::networkState):
        (WebCore::HTMLMediaElement::mediaSessionTitle):
        (WebCore::HTMLMediaElement::doesHaveAttribute):
        * html/HTMLMetaElement.cpp:
        (WebCore::HTMLMetaElement::process):
        (WebCore::HTMLMetaElement::content):
        (WebCore::HTMLMetaElement::httpEquiv):
        (WebCore::HTMLMetaElement::name):
        * html/HTMLMeterElement.cpp:
        (WebCore::HTMLMeterElement::min):
        (WebCore::HTMLMeterElement::setMin):
        (WebCore::HTMLMeterElement::max):
        (WebCore::HTMLMeterElement::setMax):
        (WebCore::HTMLMeterElement::value):
        (WebCore::HTMLMeterElement::low):
        (WebCore::HTMLMeterElement::high):
        (WebCore::HTMLMeterElement::optimum):
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::shouldAllowQuickTimeClassIdQuirk):
        (WebCore::HTMLObjectElement::hasValidClassId):
        (WebCore::HTMLObjectElement::imageSourceURL):
        (WebCore::HTMLObjectElement::renderFallbackContent):
        (WebCore::HTMLObjectElement::containsJavaApplet):
        (WebCore::HTMLObjectElement::addSubresourceAttributeURLs):
        * html/HTMLOptGroupElement.cpp:
        (WebCore::HTMLOptGroupElement::groupLabelText):
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::value):
        (WebCore::HTMLOptionElement::label):
        * html/HTMLParamElement.cpp:
        (WebCore::HTMLParamElement::value):
        (WebCore::HTMLParamElement::isURLParameter):
        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::value):
        (WebCore::HTMLProgressElement::max):
        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::crossOrigin):
        (WebCore::HTMLScriptElement::src):
        (WebCore::HTMLScriptElement::sourceAttributeValue):
        (WebCore::HTMLScriptElement::charsetAttributeValue):
        (WebCore::HTMLScriptElement::typeAttributeValue):
        (WebCore::HTMLScriptElement::languageAttributeValue):
        (WebCore::HTMLScriptElement::forAttributeValue):
        (WebCore::HTMLScriptElement::eventAttributeValue):
        (WebCore::HTMLScriptElement::asyncAttributeValue):
        * html/HTMLSlotElement.cpp:
        (WebCore::HTMLSlotElement::insertedInto):
        (WebCore::HTMLSlotElement::removedFrom):
        * html/HTMLSourceElement.cpp:
        (WebCore::HTMLSourceElement::media):
        (WebCore::HTMLSourceElement::setMedia):
        (WebCore::HTMLSourceElement::type):
        (WebCore::HTMLSourceElement::setType):
        * html/HTMLTableCellElement.cpp:
        (WebCore::HTMLTableCellElement::colSpanForBindings):
        (WebCore::HTMLTableCellElement::rowSpan):
        (WebCore::HTMLTableCellElement::rowSpanForBindings):
        (WebCore::HTMLTableCellElement::cellIndex):
        (WebCore::HTMLTableCellElement::abbr):
        (WebCore::HTMLTableCellElement::axis):
        (WebCore::HTMLTableCellElement::setColSpanForBindings):
        (WebCore::HTMLTableCellElement::headers):
        (WebCore::HTMLTableCellElement::setRowSpanForBindings):
        (WebCore::HTMLTableCellElement::scope):
        (WebCore::HTMLTableCellElement::addSubresourceAttributeURLs):
        (WebCore::HTMLTableCellElement::cellAbove):
        * html/HTMLTableColElement.cpp:
        (WebCore::HTMLTableColElement::width):
        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::rules):
        (WebCore::HTMLTableElement::summary):
        (WebCore::HTMLTableElement::addSubresourceAttributeURLs):
        * html/HTMLTableSectionElement.cpp:
        (WebCore::HTMLTableSectionElement::align):
        (WebCore::HTMLTableSectionElement::setAlign):
        (WebCore::HTMLTableSectionElement::ch):
        (WebCore::HTMLTableSectionElement::setCh):
        (WebCore::HTMLTableSectionElement::chOff):
        (WebCore::HTMLTableSectionElement::setChOff):
        (WebCore::HTMLTableSectionElement::vAlign):
        (WebCore::HTMLTableSectionElement::setVAlign):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::appendFormData):
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::strippedPlaceholder):
        (WebCore::HTMLTextFormControlElement::isPlaceholderEmpty):
        (WebCore::HTMLTextFormControlElement::directionForFormData):
        * html/HTMLTrackElement.cpp:
        (WebCore::HTMLTrackElement::srclang):
        (WebCore::HTMLTrackElement::label):
        (WebCore::HTMLTrackElement::isDefault):
        (WebCore::HTMLTrackElement::ensureTrack):
        (WebCore::HTMLTrackElement::mediaElementCrossOriginAttribute):
        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::parseAttribute):
        (WebCore::HTMLVideoElement::imageSourceURL):
        * html/ImageInputType.cpp:
        (WebCore::ImageInputType::height):
        (WebCore::ImageInputType::width):
        * html/InputType.cpp:
        (WebCore::InputType::applyStep):
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::wirelessVideoPlaybackDisabled):
        * html/MonthInputType.cpp:
        (WebCore::MonthInputType::createStepRange):
        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::createStepRange):
        (WebCore::NumberInputType::sizeShouldIncludeDecoration):
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::createStepRange):
        (WebCore::RangeInputType::handleKeydownEvent):
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::appendFormData):
        (WebCore::TextFieldInputType::updateAutoFillButton):
        * html/TimeInputType.cpp:
        (WebCore::TimeInputType::createStepRange):
        * html/ValidationMessage.cpp:
        (WebCore::ValidationMessage::updateValidationMessage):
        * html/WeekInputType.cpp:
        (WebCore::WeekInputType::createStepRange):
        * html/track/WebVTTElement.cpp:
        (WebCore::WebVTTElement::createEquivalentHTMLElement):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::buildObjectForFrame):
        * loader/FormSubmission.cpp:
        (WebCore::FormSubmission::create):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::defaultSubstituteDataForURL):
        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::updateFromElement):
        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::isPluginContentAllowedByContentSecurityPolicy):
        * mathml/MathMLElement.cpp:
        (WebCore::MathMLElement::colSpan):
        (WebCore::MathMLElement::rowSpan):
        (WebCore::MathMLElement::childShouldCreateRenderer):
        (WebCore::MathMLElement::defaultEventHandler):
        (WebCore::MathMLElement::cachedMathMLLength):
        * mathml/MathMLFractionElement.cpp:
        (WebCore::MathMLFractionElement::lineThickness):
        (WebCore::MathMLFractionElement::cachedFractionAlignment):
        * mathml/MathMLSelectElement.cpp:
        (WebCore::MathMLSelectElement::getSelectedActionChildAndIndex):
        (WebCore::MathMLSelectElement::getSelectedActionChild):
        (WebCore::MathMLSelectElement::getSelectedSemanticsChild):
        (WebCore::MathMLSelectElement::defaultEventHandler):
        (WebCore::MathMLSelectElement::willRespondToMouseClickEvents):
        (WebCore::MathMLSelectElement::toggle):
        * page/EventHandler.cpp:
        (WebCore::findDropZone):
        * page/Frame.cpp:
        (WebCore::Frame::matchLabelsAgainstElement):
        * page/PageSerializer.cpp:
        (WebCore::PageSerializer::serializeFrame):
        * platform/win/PasteboardWin.cpp:
        (WebCore::Pasteboard::writeImageToDataObject):
        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::altDisplayString):
        * rendering/RenderDetailsMarker.cpp:
        (WebCore::RenderDetailsMarker::isOpen):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::imageMap):
        (WebCore::RenderImage::nodeAtPoint):
        * rendering/RenderMenuList.cpp:
        (RenderMenuList::itemAccessibilityText):
        (RenderMenuList::itemToolTip):
        * rendering/RenderSearchField.cpp:
        (WebCore::RenderSearchField::autosaveName):
        * rendering/RenderThemeIOS.mm:
        (WebCore::getAttachmentProgress):
        (WebCore::AttachmentInfo::AttachmentInfo):
        * rendering/RenderThemeMac.mm:
        (WebCore::AttachmentLayout::layOutSubtitle):
        (WebCore::RenderThemeMac::paintAttachment):
        * rendering/mathml/MathMLStyle.cpp:
        (WebCore::MathMLStyle::resolveMathMLStyle):
        * rendering/mathml/RenderMathMLFenced.cpp:
        (WebCore::RenderMathMLFenced::updateFromElement):
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::setOperatorFlagFromAttribute):
        (WebCore::RenderMathMLOperator::setOperatorFlagFromAttributeValue):
        (WebCore::RenderMathMLOperator::setOperatorProperties):
        * rendering/mathml/RenderMathMLScripts.cpp:
        (WebCore::RenderMathMLScripts::getScriptMetricsAndLayoutIfNeeded):
        * rendering/mathml/RenderMathMLUnderOver.cpp:
        (WebCore::RenderMathMLUnderOver::hasAccent):
        * style/StyleSharingResolver.cpp:
        (WebCore::Style::SharingResolver::canShareStyleWithElement):
        (WebCore::Style::SharingResolver::sharingCandidateHasIdenticalStyleAffectingAttributes):
        * svg/SVGAElement.cpp:
        (WebCore::SVGAElement::title):
        (WebCore::SVGAElement::defaultEventHandler):
        * svg/SVGAltGlyphElement.cpp:
        (WebCore::SVGAltGlyphElement::glyphRef):
        (WebCore::SVGAltGlyphElement::setFormat):
        (WebCore::SVGAltGlyphElement::format):
        (WebCore::SVGAltGlyphElement::childShouldCreateRenderer):
        * svg/SVGAnimationElement.cpp:
        (WebCore::SVGAnimationElement::toValue):
        (WebCore::SVGAnimationElement::byValue):
        (WebCore::SVGAnimationElement::fromValue):
        (WebCore::SVGAnimationElement::isAdditive):
        (WebCore::SVGAnimationElement::isAccumulated):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::xmlbase):
        (WebCore::SVGElement::setXmlbase):
        * svg/SVGFontFaceElement.cpp:
        (WebCore::SVGFontFaceElement::unitsPerEm):
        (WebCore::SVGFontFaceElement::xHeight):
        (WebCore::SVGFontFaceElement::capHeight):
        (WebCore::SVGFontFaceElement::horizontalOriginX):
        (WebCore::SVGFontFaceElement::horizontalOriginY):
        (WebCore::SVGFontFaceElement::horizontalAdvanceX):
        (WebCore::SVGFontFaceElement::verticalOriginX):
        (WebCore::SVGFontFaceElement::verticalOriginY):
        (WebCore::SVGFontFaceElement::verticalAdvanceY):
        (WebCore::SVGFontFaceElement::ascent):
        (WebCore::SVGFontFaceElement::descent):
        * svg/SVGFontFaceNameElement.cpp:
        (WebCore::SVGFontFaceNameElement::srcValue):
        * svg/SVGFontFaceUriElement.cpp:
        (WebCore::SVGFontFaceUriElement::srcValue):
        * svg/SVGGlyphRefElement.cpp:
        (WebCore::SVGGlyphRefElement::glyphRef):
        (WebCore::SVGGlyphRefElement::setGlyphRef):
        * svg/SVGHKernElement.cpp:
        (WebCore::SVGHKernElement::buildHorizontalKerningPair):
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::contentScriptType):
        (WebCore::SVGSVGElement::contentStyleType):
        * svg/SVGStyleElement.cpp:
        (WebCore::SVGStyleElement::media):
        (WebCore::SVGStyleElement::title):
        (WebCore::SVGStyleElement::setTitle):
        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::appendOS2Table):
        (WebCore::SVGToOTFFontConverter::appendCFFTable):
        (WebCore::SVGToOTFFontConverter::appendArabicReplacementSubtable):
        (WebCore::SVGToOTFFontConverter::appendVORGTable):
        (WebCore::SVGToOTFFontConverter::transcodeGlyphPaths):
        (WebCore::SVGToOTFFontConverter::processGlyphElement):
        (WebCore::SVGToOTFFontConverter::compareCodepointsLexicographically):
        (WebCore::SVGToOTFFontConverter::SVGToOTFFontConverter):
        * svg/SVGVKernElement.cpp:
        (WebCore::SVGVKernElement::buildVerticalKerningPair):
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::insertedInto):
        (WebCore::SVGSMILElement::parseAttribute):
        (WebCore::SVGSMILElement::svgAttributeChanged):
        (WebCore::SVGSMILElement::restart):
        (WebCore::SVGSMILElement::fill):
        (WebCore::SVGSMILElement::dur):
        (WebCore::SVGSMILElement::repeatDur):
        (WebCore::SVGSMILElement::repeatCount):
        (WebCore::SVGSMILElement::maxValue):
        (WebCore::SVGSMILElement::minValue):

2016-07-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        ASSERTION FAILED: isMainThread() in ~UniqueIDBDatabase() since r201997
        https://bugs.webkit.org/show_bug.cgi?id=159809

        Reviewed by Brady Eidson.

        In r201997 the UniqueIDBDatabase was protected in executeNextDatabaseTask() because the last reference could be
        removed while the task is performed. However UniqueIDBDatabase is expected to be deleted in the main thread, and
        the destructor asserts when not called in the main thread, but executeNextDatabaseTask() is always called on a
        secondary thread. So, if the protector contains the last reference, the object is deleted in the secondary thread.

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTask): Use callOnMainThread to ensure the object is
        deleted in the main thread in case the protector contains the last reference.

2016-07-15  Chris Dumez  <cdumez@apple.com>

        Use emptyString() / nullAtom when possible
        https://bugs.webkit.org/show_bug.cgi?id=159850

        Reviewed by Ryosuke Niwa.

        Use emptyString() / nullAtom when possible, for performance.

        * Modules/webaudio/AudioNode.cpp:
        (WebCore::AudioNode::channelCountMode):
        (WebCore::AudioNode::channelInterpretation):
        * Modules/webdatabase/DatabaseTracker.cpp:
        (WebCore::DatabaseTracker::tracker):
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::WebSocket):
        (WebCore::WebSocket::didConnect):
        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::subprotocol):
        (WebCore::WebSocketChannel::extensions):
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::supportsPressAction):
        * accessibility/mac/AXObjectCacheMac.mm:
        (WebCore::AXObjectCache::postTextStateChangePlatformNotification):
        * css/CSSPropertySourceData.cpp:
        (WebCore::CSSPropertySourceData::CSSPropertySourceData):
        * css/PageRuleCollector.cpp:
        (WebCore::PageRuleCollector::pageName):
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
        * dom/DocumentMarkerController.cpp:
        (WebCore::DocumentMarkerController::addDictationPhraseWithAlternativesMarker):
        * dom/Element.cpp:
        (WebCore::Element::setPrefix):
        * editing/AlternativeTextController.cpp:
        (WebCore::AlternativeTextController::respondToMarkerAtEndOfWord):
        (WebCore::AlternativeTextController::markerDescriptionForAppliedAlternativeText):
        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::removeNodeAttribute):
        (WebCore::CompositeEditCommand::moveParagraphs):
        * editing/InsertTextCommand.cpp:
        (WebCore::InsertTextCommand::positionInsideTextNode):
        * editing/TextCheckingHelper.cpp:
        (WebCore::TextCheckingHelper::findFirstMisspellingOrBadGrammar):
        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::deleteSelection):
        (WebCore::TypingCommand::deleteKeyPressed):
        (WebCore::TypingCommand::forwardDeleteKeyPressed):
        (WebCore::TypingCommand::insertLineBreak):
        (WebCore::TypingCommand::insertParagraphSeparator):
        * editing/cocoa/EditorCocoa.mm:
        (WebCore::Editor::styleForSelectionStart):
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::stringSelectionForPasteboard):
        (WebCore::Editor::stringSelectionForPasteboardWithImageAltText):
        * fileapi/FileReaderLoader.cpp:
        (WebCore::FileReaderLoader::FileReaderLoader):
        * html/FileInputType.cpp:
        (WebCore::FileInputType::appendFormData):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):
        * html/HTMLOutputElement.cpp:
        (WebCore::HTMLOutputElement::HTMLOutputElement):
        * html/SearchInputType.cpp:
        (WebCore::SearchInputType::handleKeydownEvent):
        * html/TextFieldInputType.cpp:
        (WebCore::autoFillButtonTypeToAccessibilityLabel):
        * html/canvas/WebGLDebugShaders.cpp:
        (WebCore::WebGLDebugShaders::getTranslatedShaderSource):
        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::dispatchContextLostEvent):
        (WebCore::WebGLRenderingContextBase::maybeRestoreContext):
        * html/canvas/WebGLShader.cpp:
        (WebCore::WebGLShader::WebGLShader):
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlStatusDisplayElement::update):
        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::captionMenuOffItem):
        (WebCore::TextTrack::captionMenuAutomaticItem):
        * html/track/VTTRegion.cpp:
        (WebCore::VTTRegion::scroll):
        * html/track/VTTRegion.h:
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::toErrorString):
        (WebCore::InspectorDOMAgent::resolveNode):
        (WebCore::InspectorDOMAgent::documentURLString):
        (WebCore::documentBaseURLString):
        * inspector/InspectorDOMDebuggerAgent.cpp:
        (WebCore::domTypeName):
        * inspector/InspectorFrontendHost.cpp:
        (WebCore::InspectorFrontendHost::localizedStringsURL):
        * inspector/InspectorHistory.cpp:
        (WebCore::InspectorHistory::Action::mergeId):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::reload):
        (WebCore::InspectorPageAgent::frameId):
        (WebCore::InspectorPageAgent::loaderId):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyleSheet::ruleSelector):
        * loader/EmptyClients.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::referrer):
        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::clearFailedLoadURL):
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::didReceiveResponse):
        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::contextMenuItemSelected):
        * page/FrameTree.cpp:
        (WebCore::FrameTree::setName):
        (WebCore::FrameTree::clearName):
        * page/Location.cpp:
        (WebCore::Location::port):
        * platform/network/ProtectionSpaceBase.cpp:
        (WebCore::ProtectionSpaceBase::ProtectionSpaceBase):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::handleElementAttributes):

2016-07-15  Simon Fraser  <simon.fraser@apple.com>

        Repaints rects drawn incorrectly when inspecting a WebView on a Retina display
        https://bugs.webkit.org/show_bug.cgi?id=159824
        rdar://problem/27376305

        Reviewed by Brian Burg.

        InspectorOverlayPage.js set up the canvases with a deviceScaleFactor passed into
        reset(), which comes from the overlay's m_page.deviceScaleFactor(). However, updatePaintRects()
        used window.devicePixelRatio which was always 1.

        Fix by setting the deviceScaleFactor on the m_overlayPage.

        * inspector/InspectorOverlay.cpp:
        (WebCore::InspectorOverlay::overlayPage):

2016-07-15  Myles C. Maxfield  <mmaxfield@apple.com>

        [macOS] Work around crash in [NSAttributedString nextWordFromIndex:forward:]
        https://bugs.webkit.org/show_bug.cgi?id=159842

        Reviewed by Jon Lee.

        <rdar://problem/27380532> describes a crash inside [NSAttributedString nextWordFromIndex:forward:].
        This must be worked around for https://bugs.webkit.org/show_bug.cgi?id=159755 and
        <rdar://problem/27325521>.

        * platform/text/mac/TextBoundaries.mm:
        (WebCore::findNextWordFromIndex):

2016-07-15  Brady Eidson  <beidson@apple.com>

        Update XPathException to use the description in toString().
        https://bugs.webkit.org/show_bug.cgi?id=159848

        Reviewed by Alex Christensen.

        No new tests (Covered by changes to existing tests).

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::createDOMException):
        * xml/XPathException.h:
        (WebCore::XPathException::XPathException):

2016-07-15  Brady Eidson  <beidson@apple.com>

        Change toString() behavior for exceptions constructed with "createWithDescriptionAsMessage".
        https://bugs.webkit.org/show_bug.cgi?id=159839

        Reviewed by Alex Christensen.

        No new tests (Covered by changes to existing tests).

        This is the first step towards extended exception messages for all exception types.

        * dom/ExceptionBase.cpp:
        (WebCore::ExceptionBase::ExceptionBase):
        (WebCore::ExceptionBase::toString):
        * dom/ExceptionBase.h:

2016-07-15  Geoffrey Garen  <ggaren@apple.com>

        Added a makeRef<T> helper
        https://bugs.webkit.org/show_bug.cgi?id=159835

        Reviewed by Andreas Kling.

        Anders told me to!

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::putOrAddOnServer):
        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::deleteDatabase):
        (WebCore::InProcessIDBServer::didDeleteDatabase):
        (WebCore::InProcessIDBServer::openDatabase):
        (WebCore::InProcessIDBServer::didOpenDatabase):
        (WebCore::InProcessIDBServer::didAbortTransaction):
        (WebCore::InProcessIDBServer::didCommitTransaction):
        (WebCore::InProcessIDBServer::didCreateObjectStore):
        (WebCore::InProcessIDBServer::didDeleteObjectStore):
        (WebCore::InProcessIDBServer::didClearObjectStore):
        (WebCore::InProcessIDBServer::didCreateIndex):
        (WebCore::InProcessIDBServer::didDeleteIndex):
        (WebCore::InProcessIDBServer::didPutOrAdd):
        (WebCore::InProcessIDBServer::didGetRecord):
        (WebCore::InProcessIDBServer::didGetCount):
        (WebCore::InProcessIDBServer::didDeleteRecord):
        (WebCore::InProcessIDBServer::didOpenCursor):
        (WebCore::InProcessIDBServer::didIterateCursor):
        (WebCore::InProcessIDBServer::abortTransaction):
        (WebCore::InProcessIDBServer::commitTransaction):
        (WebCore::InProcessIDBServer::didFinishHandlingVersionChangeTransaction):
        (WebCore::InProcessIDBServer::createObjectStore):
        (WebCore::InProcessIDBServer::deleteObjectStore):
        (WebCore::InProcessIDBServer::clearObjectStore):
        (WebCore::InProcessIDBServer::createIndex):
        (WebCore::InProcessIDBServer::deleteIndex):
        (WebCore::InProcessIDBServer::putOrAdd):
        (WebCore::InProcessIDBServer::getRecord):
        (WebCore::InProcessIDBServer::getCount):
        (WebCore::InProcessIDBServer::deleteRecord):
        (WebCore::InProcessIDBServer::openCursor):
        (WebCore::InProcessIDBServer::iterateCursor):
        (WebCore::InProcessIDBServer::establishTransaction):
        (WebCore::InProcessIDBServer::fireVersionChangeEvent):
        (WebCore::InProcessIDBServer::didStartTransaction):
        (WebCore::InProcessIDBServer::didCloseFromServer):
        (WebCore::InProcessIDBServer::notifyOpenDBRequestBlocked):
        (WebCore::InProcessIDBServer::databaseConnectionClosed):
        (WebCore::InProcessIDBServer::abortOpenAndUpgradeNeeded):
        (WebCore::InProcessIDBServer::didFireVersionChangeEvent):
        (WebCore::InProcessIDBServer::openDBRequestCancelled):
        (WebCore::InProcessIDBServer::confirmDidCloseFromServer):
        (WebCore::InProcessIDBServer::getAllDatabaseNames):
        (WebCore::InProcessIDBServer::didGetAllDatabaseNames):
        * Modules/mediastream/MediaDevicesRequest.cpp:
        (WebCore::MediaDevicesRequest::didCompleteTrackSourceInfoRequest):
        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::constraintsValidated):
        (WebCore::UserMediaRequest::userMediaAccessGranted):
        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::scheduleNodeDeletion):
        (WebCore::AudioContext::isPlayingAudioDidChange):
        (WebCore::AudioContext::suspend):
        (WebCore::AudioContext::resume):
        (WebCore::AudioContext::close):
        (WebCore::AudioContext::suspendPlayback):
        (WebCore::AudioContext::mayResumePlayback):
        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
        (WebCore::ThreadableWebSocketChannelClientWrapper::didConnect):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessage):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveBinaryData):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didUpdateBufferedAmount):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didStartClosingHandshake):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessageError):
        (WebCore::ThreadableWebSocketChannelClientWrapper::processPendingTasks):
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect):
        * bindings/js/JSEventListener.h:
        (WebCore::JSEventListener::jsFunction):
        * dom/Node.cpp:
        (WebCore::Node::setTextContent):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::layoutSizeChanged):
        * inspector/CommandLineAPIHost.cpp:
        (WebCore::CommandLineAPIHost::wrapper):
        * platform/graphics/avfoundation/AudioSourceProviderAVFObjC.mm:
        (WebCore::AudioSourceProviderAVFObjC::prepare):
        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
        (WebCore::WebCoreAVCFResourceLoader::invalidate):
        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::invalidate):
        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        (WebVideoFullscreenControllerContext::setExternalPlayback):
        * platform/network/BlobResourceHandle.cpp:
        (WebCore::BlobResourceHandle::start):
        (WebCore::BlobResourceHandle::notifyFinish):
        * platform/network/SocketStreamHandleBase.cpp:
        (WebCore::SocketStreamHandleBase::disconnect):
        * platform/network/curl/CurlDownload.cpp:
        (WebCore::CurlDownload::didReceiveHeader):

2016-07-15  Chris Dumez  <cdumez@apple.com>

        Use fastGetAttribute() / setAttributeWithoutSynchronization() when possible
        https://bugs.webkit.org/show_bug.cgi?id=159793

        Reviewed by Ryosuke Niwa.

        Use fastGetAttribute() / setAttributeWithoutSynchronization() when possible, for performance.

        * Modules/plugins/YouTubePluginReplacement.cpp:
        (WebCore::YouTubePluginReplacement::installReplacement):
        * dom/Element.h:
        (WebCore::Element::setIdAttribute):
        * editing/ApplyStyleCommand.cpp:
        (WebCore::hasNoAttributeOrOnlyStyleAttribute):
        (WebCore::createFontElement):
        (WebCore::ApplyStyleCommand::applyInlineStyleChange):
        * editing/EditingStyle.cpp:
        (WebCore::EditingStyle::elementIsStyledSpanOrHTMLEquivalent):
        * editing/Editor.cpp:
        (WebCore::Editor::setBaseWritingDirection):
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::isMailPasteAsQuotationNode):
        (WebCore::isInlineNodeWithStyle):
        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::detectContentInRange):
        * editing/htmlediting.cpp:
        (WebCore::createTabSpanElement):
        * editing/ios/EditorIOS.mm:
        (WebCore::Editor::setTextAlignmentForChangedBaseWritingDirection):
        (WebCore::Editor::WebContentReader::readURL):
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::WebContentReader::readURL):
        * editing/markup.cpp:
        (WebCore::createFragmentFromText):
        * html/BaseButtonInputType.cpp:
        (WebCore::BaseButtonInputType::setValue):
        * html/BaseCheckableInputType.cpp:
        (WebCore::BaseCheckableInputType::setValue):
        * html/FTPDirectoryDocument.cpp:
        (WebCore::FTPDirectoryDocumentParser::appendEntry):
        (WebCore::FTPDirectoryDocumentParser::createTDForFilename):
        (WebCore::FTPDirectoryDocumentParser::loadDocumentTemplate):
        (WebCore::FTPDirectoryDocumentParser::createBasicDocument):
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::href):
        (WebCore::HTMLAnchorElement::setHref):
        (WebCore::HTMLAnchorElement::target):
        * html/HTMLAreaElement.cpp:
        (WebCore::HTMLAreaElement::target):
        * html/HTMLBaseElement.cpp:
        (WebCore::HTMLBaseElement::setHref):
        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::setType):
        * html/HTMLDetailsElement.cpp:
        (WebCore::HTMLDetailsElement::didAddUserAgentShadowRoot):
        (WebCore::HTMLDetailsElement::toggleOpen):
        * html/HTMLDocument.cpp:
        (WebCore::HTMLDocument::setBgColor):
        (WebCore::HTMLDocument::setFgColor):
        (WebCore::HTMLDocument::setAlinkColor):
        (WebCore::HTMLDocument::setLinkColor):
        (WebCore::HTMLDocument::setVlinkColor):
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::setDir):
        (WebCore::HTMLElement::setContentEditable):
        (WebCore::HTMLElement::setDraggable):
        (WebCore::HTMLElement::setSpellcheck):
        (WebCore::HTMLElement::setTranslate):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::setFormEnctype):
        (WebCore::HTMLFormControlElement::setFormMethod):
        (WebCore::HTMLFormControlElement::setAutocorrect):
        (WebCore::HTMLFormControlElement::setAutocapitalize):
        (WebCore::HTMLFormControlElement::setAutocomplete):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::setAutocorrect):
        (WebCore::HTMLFormElement::setAutocapitalize):
        (WebCore::HTMLFormElement::setAction):
        (WebCore::HTMLFormElement::setEnctype):
        (WebCore::HTMLFormElement::setMethod):
        (WebCore::HTMLFormElement::target):
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::width):
        (WebCore::HTMLImageElement::height):
        (WebCore::HTMLImageElement::setSrc):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setType):
        (WebCore::HTMLInputElement::updateType):
        (WebCore::HTMLInputElement::altText):
        (WebCore::HTMLInputElement::setDefaultValue):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::href):
        (WebCore::HTMLLinkElement::target):
        (WebCore::HTMLLinkElement::type):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setSrc):
        (WebCore::HTMLMediaElement::setPreload):
        * html/HTMLMeterElement.cpp:
        (WebCore::HTMLMeterElement::min):
        (WebCore::HTMLMeterElement::setMin):
        (WebCore::HTMLMeterElement::max):
        (WebCore::HTMLMeterElement::setMax):
        (WebCore::HTMLMeterElement::value):
        (WebCore::HTMLMeterElement::setValue):
        (WebCore::HTMLMeterElement::low):
        (WebCore::HTMLMeterElement::setLow):
        (WebCore::HTMLMeterElement::high):
        (WebCore::HTMLMeterElement::setHigh):
        (WebCore::HTMLMeterElement::optimum):
        (WebCore::HTMLMeterElement::setOptimum):
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::containsJavaApplet):
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::createForJSConstructor):
        (WebCore::HTMLOptionElement::setValue):
        (WebCore::HTMLOptionElement::setLabel):
        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::setValue):
        (WebCore::HTMLProgressElement::setMax):
        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::typeAttributeValue):
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::setMultiple):
        * html/HTMLSourceElement.cpp:
        (WebCore::HTMLSourceElement::setSrc):
        (WebCore::HTMLSourceElement::media):
        (WebCore::HTMLSourceElement::setMedia):
        (WebCore::HTMLSourceElement::type):
        (WebCore::HTMLSourceElement::setType):
        * html/HTMLTableSectionElement.cpp:
        (WebCore::HTMLTableSectionElement::setAlign):
        (WebCore::HTMLTableSectionElement::setCh):
        (WebCore::HTMLTableSectionElement::chOff):
        (WebCore::HTMLTableSectionElement::setChOff):
        (WebCore::HTMLTableSectionElement::setVAlign):
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::updateInnerTextElementEditability):
        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::imageSourceURL):
        * html/HiddenInputType.cpp:
        (WebCore::HiddenInputType::restoreFormControlState):
        (WebCore::HiddenInputType::setValue):
        * html/MediaDocument.cpp:
        (WebCore::MediaDocumentParser::createDocumentStructure):
        (WebCore::MediaDocument::replaceMediaElementTimerFired):
        * html/PluginDocument.cpp:
        (WebCore::PluginDocumentParser::createDocumentStructure):
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::createAutoFillButton):
        (WebCore::TextFieldInputType::updateAutoFillButton):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processIsindexStartTagForInBody):
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlClosedCaptionsContainerElement::create):
        (WebCore::MediaControlTimelineElement::create):
        (WebCore::MediaControlPanelVolumeSliderElement::create):
        (WebCore::MediaControlFullscreenVolumeSliderElement::create):
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SearchFieldCancelButtonElement::SearchFieldCancelButtonElement):
        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
        (WebCore::ImageControlsButtonElementMac::tryCreate):
        * html/shadow/mac/ImageControlsRootElementMac.cpp:
        (WebCore::ImageControlsRootElement::tryCreate):
        * html/track/WebVTTElement.cpp:
        (WebCore::WebVTTElement::createEquivalentHTMLElement):
        * html/track/WebVTTParser.cpp:
        (WebCore::WebVTTTreeBuilder::constructTreeFromToken):
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::createInspectorStyleSheetForDocument):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::buildObjectForFrame):
        * mathml/MathMLSelectElement.cpp:
        (WebCore::MathMLSelectElement::toggle):
        * page/PageSerializer.cpp:
        (WebCore::PageSerializer::serializeFrame):
        * rendering/RenderDetailsMarker.cpp:
        (WebCore::RenderDetailsMarker::isOpen):
        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::updateFromElement):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::setXmlbase):
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::setContentScriptType):
        (WebCore::SVGSVGElement::setContentStyleType):
        * svg/SVGStyleElement.cpp:
        (WebCore::SVGStyleElement::setMedia):
        (WebCore::SVGStyleElement::setTitle):

2016-07-15  Chris Dumez  <cdumez@apple.com>

        Modernize StaticNodeList / StaticElementList
        https://bugs.webkit.org/show_bug.cgi?id=159831

        Reviewed by Ryosuke Niwa.

        Modernize StaticNodeList / StaticElementList. Pass vector to adopt
        as an rvalue reference instead of a non-const reference.

        * bindings/js/JSHTMLAllCollectionCustom.cpp:
        (WebCore::namedItems):
        * dom/ChildListMutationScope.cpp:
        (WebCore::ChildListMutationAccumulator::enqueueMutationRecord):
        * dom/MutationRecord.cpp:
        * dom/SelectorQuery.cpp:
        (WebCore::SelectorDataList::queryAll):
        * dom/StaticNodeList.h:
        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::getRegionsByContent):
        (WebCore::WebKitNamedFlow::getRegions):
        (WebCore::WebKitNamedFlow::getContent):
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::collectIntersectionOrEnclosureList):
        * testing/Internals.cpp:
        (WebCore::Internals::nodesFromRect):

2016-07-15  Brent Fulgham  <bfulgham@apple.com>

        Block insecure script running in a data: frame when the top-level page is HTTPS
        https://bugs.webkit.org/show_bug.cgi?id=125806
        <rdar://problem/27331825>

        Reviewed by Brady Eidson.

        Fix based on a Blink change (patch by <tsepez@chromium.org>):
        <https://chromium.googlesource.com/chromium/blink/+/33e553bd96e040151c1472289a0d80803bfca3a5>

        Test: http/tests/security/mixedContent/insecure-script-in-data-iframe-in-main-frame-blocked.html

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::checkInsecureContent): Check the top-level frame's security state
        before allowing insecure scripts to be used.        

2016-07-15  Chris Dumez  <cdumez@apple.com>

        Let the compiler generate QualifiedName copy constructor and assignment operator
        https://bugs.webkit.org/show_bug.cgi?id=159826

        Reviewed by Alex Christensen.

        Let the compiler generate QualifiedName copy constructor and assignment operator
        as our custom implementation does nothing special. This also makes QualifiedName
        movable as the compiler is now able to generate the move constructor / assignment
        operator as well.

        * dom/QualifiedName.h:
        (WebCore::QualifiedName::QualifiedName): Deleted.
        (WebCore::QualifiedName::operator=): Deleted.

2016-07-15  Antonio Gomes  <tonikitoo@igalia.com>

        ScrollView::setHasHorizontalScrollbar / setHasVerticalScrollbar duplicate their logic
        https://bugs.webkit.org/show_bug.cgi?id=159825

        Patch introduces a (private) method to ScrollView
        to share the code/logic of setHas{Horizontal,Vertical}Scrollbar.

        Reviewed by Simon Fraser.

        No new tests needed.

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::setHasScrollbarInternal):
        (WebCore::ScrollView::setHasHorizontalScrollbar):
        (WebCore::ScrollView::setHasVerticalScrollbar):
        * platform/ScrollView.h:

2016-07-15  Frederic Wang  <fwang@igalia.com>

        MathOperator: Improve alignment for vertical size variant
        https://bugs.webkit.org/show_bug.cgi?id=158866

        Reviewed by Brent Fulgham.

        The MathOperator class may stretch operators with either a large glyph or a glyph assembly.
        In the latter case, the assembly is adjusted to match the stretch ascent and descent
        requested by the callers. But in the former case the glyph ascent and descent are used
        instead. We solve this by making MathOperator::stretchTo only take a targetSize and let
        callers do the vertical alignment they want. This improves the rendering of fences with some
        math fonts (e.g. XITS) and allows to pass the two cases of mo-axis-height-1.html.

        Test: imported/mathml-in-html5/mathml/presentation-markup/operators/mo-axis-height-1.html

        * rendering/mathml/MathOperator.cpp:
        (WebCore::MathOperator::stretchTo): Merge vertical and horizontal stretching into the same
        function with only the targetSize as a parameter.
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::stretchTo): Updated to use the new signature.
        (WebCore::RenderMathMLOperator::verticalStretchedOperatorShift): Helper function to calculate
        the shift necessary to align the baseline of the MathOperator instance with the one of the
        RenderMathMLOperator.
        (WebCore::RenderMathMLOperator::firstLineBaseline): Adjust the baseline.
        * rendering/mathml/RenderMathMLOperator.h: Declare verticalStretchedOperatorShift.
        * rendering/mathml/RenderMathMLRoot.cpp:
        (WebCore::RenderMathMLRoot::layoutBlock): Use the new signature. This function aligns the top
        of the radical with the overbar so we do not need to adjust baseline alignment here.

2016-07-15  Brady Eidson  <beidson@apple.com>

        WebKit should prevent push/replace state with username in URL.
        <rdar://problem/27361737> and https://bugs.webkit.org/show_bug.cgi?id=159818

        Reviewed by Brent Fulgham.

        Test: http/tests/security/history-username-password.html

        * page/History.cpp:
        (WebCore::History::stateObjectAdded): Don't allow URLs with usernames/passwords.

2016-07-15  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r203266.

        This change caused editing/deleting/delete-emoji.html to time
        out on El Capitan, crash under GuardMalloc

        Reverted changeset:

        "Support new emoji group candidates"
        https://bugs.webkit.org/show_bug.cgi?id=159755
        http://trac.webkit.org/changeset/203266

2016-07-15  Frederic Wang  <fwang@igalia.com>

        Move parsing of mfrac attributes into a MathMLFractionElement class
        https://bugs.webkit.org/show_bug.cgi?id=159624

        Reviewed by Brent Fulgham.

        We move the parsing of mfrac attributes to a MathMLFractionElement class. This allows to
        minimize the updates in RenderMathMLFraction and to remove the alignment members. Many of
        the members in updateLayoutParameters are actually only used in layoutBlock and could be
        removed in a follow-up patch. We also improve the resolution of negative line thickness value
        since the MathML recommendation says it should be rounded up to the nearest valid
        value (which is zero) instead of ignoring the attribute and using the line thickness.

        No new tests, already covered by existing tests.

        * CMakeLists.txt: Add MathMLFractionElement.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * mathml/MathMLAllInOne.cpp: Ditto.
        * mathml/MathMLFractionElement.cpp: Added.
        (WebCore::MathMLFractionElement::MathMLFractionElement):
        (WebCore::MathMLFractionElement::create):
        (WebCore::MathMLFractionElement::lineThickness): Return the cached linethickness length,
        parsing it again if it is dirty. This handles the special values "thin", "medium" and "thick"
        or fallback to the general parseMathMLLength for MathML lengths.
        (WebCore::MathMLFractionElement::cachedFractionAlignment): Return the cached alignment value,
        parsing it again if it is dirty.
        (WebCore::MathMLFractionElement::numeratorAlignment): Return the cached alignment.
        (WebCore::MathMLFractionElement::denominatorAlignment): Ditto.
        (WebCore::MathMLFractionElement::parseAttribute): Make attributes dirty.
        (WebCore::MathMLFractionElement::createElementRenderer): Create a RenderMathMLFraction.
        * mathml/MathMLFractionElement.h: Added.
        * mathml/MathMLInlineContainerElement.cpp: We no longer need to handle fraction here.
        (WebCore::MathMLInlineContainerElement::createElementRenderer):
        * mathml/mathtags.in: Use MathMLFractionElement for mfrac.
        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::updateLayoutParameters): New helper function to set the
        layout parameters, replacing updateFromElement. We no longer parse and store the alignment
        values here. We also change the resolution of negative values.
        (WebCore::RenderMathMLFraction::horizontalOffset): Use the enum from MathMLFractionElement.
        (WebCore::RenderMathMLFraction::layoutBlock): We call updateLayoutParameters instead of
        updateFromElement. The numerator and denominator alignments are resolved here.
        (WebCore::RenderMathMLFraction::parseAlignmentAttribute): Deleted. Parsing of alignment
        attribute is now handled in MathMLFractionElement.
        (WebCore::RenderMathMLFraction::updateFromElement): Deleted. Attribute changes are now
        handled in MathMLFractionElement.
        (WebCore::RenderMathMLFraction::styleDidChange): Deleted. Font changes are properly handled.
        * rendering/mathml/RenderMathMLFraction.h: Update declarations.

2016-07-15  Frederic Wang  <fwang@igalia.com>

        Check whether font is nonnull for GlyphData instead of calling GlyphData::isValid()
        https://bugs.webkit.org/show_bug.cgi?id=159783

        Reviewed by Brent Fulgham.

        GlyphData::isValid() returns true for GlyphData with null 'font' pointer when the 'glyph'
        index is nonzero. This behavior is not expected by the MathML code and we have had crashes
        in our test suite in the past on Windows (e.g. bug 140653). We thus replace the call to
        GlyphData::isValid() with a stronger verification: Whether the 'font' pointer is nonzero.

        No new tests, this only makes null pointer checks stronger.

        * rendering/mathml/MathOperator.cpp:
        (WebCore::boundsForGlyph):
        (WebCore::advanceWidthForGlyph):
        (WebCore::MathOperator::getBaseGlyph):
        (WebCore::MathOperator::setSizeVariant):
        (WebCore::MathOperator::fillWithVerticalExtensionGlyph):
        (WebCore::MathOperator::fillWithHorizontalExtensionGlyph):
        (WebCore::MathOperator::paintVerticalGlyphAssembly):
        (WebCore::MathOperator::paintHorizontalGlyphAssembly):
        (WebCore::MathOperator::paint):
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths):
        * rendering/mathml/RenderMathMLToken.cpp:
        (WebCore::RenderMathMLToken::computePreferredLogicalWidths):
        (WebCore::RenderMathMLToken::firstLineBaseline):
        (WebCore::RenderMathMLToken::layoutBlock):
        (WebCore::RenderMathMLToken::paint):
        (WebCore::RenderMathMLToken::paintChildren):

2016-07-15  Frederic Wang  <fwang@igalia.com>

        Add DejaVu Math TeX Gyre to the list of math fonts.
        https://bugs.webkit.org/show_bug.cgi?id=159805

        Reviewed by Brent Fulgham.

        DejaVu 2.36 has a new math font that can be used for MathML rendering. Because this font is
        likely to be installed on many systems (Linux, LibreOffice, etc) we include it in the default
        list of font-families in mathml.css in order to increase the chance to find a math font.

        No new tests, it only affects rendering when DejaVu Math TeX Gyre is installed on the system.

        * css/mathml.css:
        (math):

2016-07-15  Eric Carlson  <eric.carlson@apple.com>

        [MSE] Increase the SourceBuffer "fudge factor"
        https://bugs.webkit.org/show_bug.cgi?id=159813
        <rdar://problem/27372033>

        Reviewed by Jon Lee.
        
        Some media encoding/conversion pipelines are sloppy when doing sample time/timescale
        math, and the error accumulation results in small gaps in the media timeline. r202641
        increased the maximum allowable gap from 0.01 second to one 24fps frame, but it turns
        out that at least one large provider has a significant amount of content encoded with
        up to two 24fps frames.

        No new tests, updated media/media-source/media-source-small-gap.html.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::currentTimeFudgeFactor): Increase maximum gap to 2002 / 24000 frames.

2016-07-15  Rawinder Singh  <rawinder.singh-webkit@cisra.canon.com.au>

        Add final keyword to WebCore/svg classes
        https://bugs.webkit.org/show_bug.cgi?id=159802

        Reviewed by Youenn Fablet.

        Updated classes in the WebCore/svg directory to be marked as final where appropriate.

        * svg/SVGException.h:
        * svg/SVGLengthList.h:
        * svg/SVGMatrix.h:
        * svg/SVGNumberList.h:
        * svg/SVGPaint.h:
        * svg/SVGPathBuilder.h:
        * svg/SVGPathByteStreamBuilder.h:
        * svg/SVGPathByteStreamSource.h:
        * svg/SVGPathSegArcAbs.h:
        * svg/SVGPathSegArcRel.h:
        * svg/SVGPathSegClosePath.h:
        * svg/SVGPathSegCurvetoCubicAbs.h:
        * svg/SVGPathSegCurvetoCubicRel.h:
        * svg/SVGPathSegCurvetoCubicSmoothAbs.h:
        * svg/SVGPathSegCurvetoCubicSmoothRel.h:
        * svg/SVGPathSegCurvetoQuadraticAbs.h:
        * svg/SVGPathSegCurvetoQuadraticRel.h:
        * svg/SVGPathSegCurvetoQuadraticSmoothAbs.h:
        * svg/SVGPathSegCurvetoQuadraticSmoothRel.h:
        * svg/SVGPathSegLinetoAbs.h:
        * svg/SVGPathSegLinetoHorizontalAbs.h:
        * svg/SVGPathSegLinetoHorizontalRel.h:
        * svg/SVGPathSegLinetoRel.h:
        * svg/SVGPathSegLinetoVerticalAbs.h:
        * svg/SVGPathSegLinetoVerticalRel.h:
        * svg/SVGPathSegListBuilder.h:
        * svg/SVGPathSegListSource.h:
        * svg/SVGPathSegMovetoAbs.h:
        * svg/SVGPathSegMovetoRel.h:
        * svg/SVGPathStringSource.h:
        * svg/SVGPathTraversalStateBuilder.h:
        * svg/SVGPointList.h:
        * svg/SVGRenderingIntent.h:
        * svg/SVGStringList.h:
        * svg/SVGTRefElement.cpp:
        * svg/SVGToOTFFontConversion.cpp:
        * svg/SVGTransformList.h:
        * svg/SVGUnitTypes.h:
        * svg/SVGViewSpec.h:
        * svg/SVGZoomEvent.h:
        * svg/animation/SMILTimeContainer.h:
        * svg/animation/SVGSMILElement.cpp:
        * svg/graphics/filters/SVGFEImage.h:
        * svg/graphics/filters/SVGFilter.h:
        * svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
        * svg/properties/SVGAnimatedPropertyTearOff.h:
        * svg/properties/SVGAnimatedTransformListPropertyTearOff.h:
        * svg/properties/SVGMatrixTearOff.h:
        * svg/properties/SVGPathSegListPropertyTearOff.h:
        * svg/properties/SVGStaticListPropertyTearOff.h:
        * svg/properties/SVGStaticPropertyTearOff.h:
        * svg/properties/SVGTransformListPropertyTearOff.h:

2016-07-15  Per Arne Vollan  <pvollan@apple.com>

        Uninitialized variable in DIBPixelData can cause a dangerous memory write
        https://bugs.webkit.org/show_bug.cgi?id=159414

        Reviewed by Brent Fulgham.

        Initialize local BITMAP variable, in case the ::GetObject function that should initialize it
        fails to do so, because the bitmap handle is invalid.

        Tests: Tools/TestWebKitAPI/Tests/WebCore/win/DIBPixelData.cpp

        * platform/graphics/win/DIBPixelData.cpp:
        (WebCore::DIBPixelData::initialize): Initialize local variable.
        (WebCore::DIBPixelData::setRGBABitmapAlpha): Return early if we have no bitmap.
        * platform/graphics/win/DIBPixelData.h: Link fix.

2016-07-14  Yoav Weiss  <yoav@yoav.ws>

        Change CSSParser::sourceSize returning Optional<CSSParser::SourceSize>
        https://bugs.webkit.org/show_bug.cgi?id=159666

        Reviewed by Michael Catanzaro.

        Tests:
            fast/dom/HTMLImageElement/sizes/image-sizes-invalids.html

        * css/CSSGrammar.y.in: Avoid adding SourceSize to source_size_list when the value is a Nullopt.
        * css/CSSParser.cpp:
        (WebCore::CSSParser::sourceSize): Return a Nullopt when an invalid value is encountered.
        * css/CSSParser.h:

2016-07-14  Antonio Gomes  <tonikitoo@igalia.com>

        [RTL Scrollbars] Frame scrollbars don't move to the right when text direction changes to RTL
        https://bugs.webkit.org/show_bug.cgi?id=158252

        Reviewed by Myles C. Maxfield.

        When the 'dir' attribute changes either on body or on the document
        element level, the associated FrameView does not trigger an update on
        the frame level vertical scrollbar.

        Patch adds a 'hook' so that RenderBox::styleDidChange can call in
        order to get the document level scrollbar placed properly in the next
        layout.

        Test: fast/scrolling/rtl-scrollbars-alternate-body-dir-attr-does-not-update-scrollbar-placement.html
              fast/scrolling/rtl-scrollbars-alternate-body-dir-attr-does-not-update-scrollbar-placement-2.html
              fast/scrolling/rtl-scrollbars-alternate-iframe-body-dir-attr-does-not-update-scrollbar-placement.html

        * page/FrameView.cpp:
        (WebCore::FrameView::topContentDirectionDidChange):
        * page/FrameView.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::styleDidChange):

2016-07-14  Myles C. Maxfield  <mmaxfield@apple.com>

        Support new emoji group candidates
        https://bugs.webkit.org/show_bug.cgi?id=159755
        <rdar://problem/27325521>

        Reviewed by Dean Jackson.

        There are a few code points which should be able to be joined (with ZWJ) to
        either U+2640 or U+2642 to change the gender of the emoji. These patterns
        should also work with an additional 0xFE0F variation selector. This patch
        adds these new patterns to our existing emoji group candidate infrastructure.

        Tests: fast/text/emoji-gender-2-3.html
               fast/text/emoji-gender-2-4.html
               fast/text/emoji-gender-2-5.html
               fast/text/emoji-gender-2-6.html
               fast/text/emoji-gender-2-7.html
               fast/text/emoji-gender-2-8.html
               fast/text/emoji-gender-2-9.html
               fast/text/emoji-gender-2.html
               fast/text/emoji-gender-3.html
               fast/text/emoji-gender-4.html
               fast/text/emoji-gender-5.html
               fast/text/emoji-gender-6.html
               fast/text/emoji-gender-7.html
               fast/text/emoji-gender-8.html
               fast/text/emoji-gender-9.html
               fast/text/emoji-gender-fe0f-3.html
               fast/text/emoji-gender-fe0f-4.html
               fast/text/emoji-gender-fe0f-5.html
               fast/text/emoji-gender-fe0f-6.html
               fast/text/emoji-gender-fe0f-7.html
               fast/text/emoji-gender-fe0f-8.html
               fast/text/emoji-gender-fe0f-9.html
               fast/text/emoji-gender.html
               fast/text/emoji-num-glyphs.html
               fast/text/emoji-single-parent-family-2.html
               fast/text/emoji-single-parent-family.html

        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        (WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Removed incorrect ASSERT()s.
        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::characterRangeCodePath):
        * platform/text/CharacterProperties.h:
        (WebCore::isEmojiGroupCandidate):

2016-07-14  Dean Jackson  <dino@apple.com>

        CrashTracer: com.apple.WebKit.WebContent at WebCore: WebCore::MediaQueryEvaluator::evaluate const
        https://bugs.webkit.org/show_bug.cgi?id=159799
        <rdar://problem/27346959>

        Reviewed by Myles Maxfield.

        Speculative fix for this crash, which seems to happen when asking for the Node's
        renderer(). From the incoming crash logs, it is triggered by mutations on
        a <picture> or <img> element, which would require choosing a new source,
        and causing some media queries to evaluate.

        The only place in MediaQueryEvaluator that has anything to do with
        renderers is when gathering up some style information to pass to the
        actual evaluation function. I put a guard against a missing documentElement
        in there.

        * css/MediaQueryEvaluator.cpp:
        (WebCore::MediaQueryEvaluator::evaluate): Make sure documentElement is not
        null.

2016-07-14  Rawinder Singh  <rawinder.singh-webkit@cisra.canon.com.au>

        Update HTML*Element class override methods in final classes
        https://bugs.webkit.org/show_bug.cgi?id=159456

        Reviewed by Youenn Fablet.

        Update HTML*Element classes so that overriden methods in final classes are marked final.
        Also marked HTMLDivElement overriden methods as final since they are not overridden by derived classes.

        * html/HTMLAppletElement.h:
        * html/HTMLAreaElement.h:
        * html/HTMLAttachmentElement.h:
        * html/HTMLAudioElement.h:
        * html/HTMLBRElement.h:
        * html/HTMLBaseElement.h:
        * html/HTMLBodyElement.h:
        * html/HTMLButtonElement.h:
        * html/HTMLCanvasElement.h:
        * html/HTMLDataElement.h:
        * html/HTMLDetailsElement.h:
        * html/HTMLDivElement.h:
        * html/HTMLEmbedElement.h:
        * html/HTMLFieldSetElement.h:
        * html/HTMLFontElement.h:
        * html/HTMLFormElement.h:
        * html/HTMLFrameSetElement.h:
        * html/HTMLHRElement.h:
        * html/HTMLHtmlElement.h:
        * html/HTMLKeygenElement.h:
        * html/HTMLLIElement.h:
        * html/HTMLLabelElement.h:
        * html/HTMLLegendElement.h:
        * html/HTMLLinkElement.h:
        * html/HTMLMapElement.h:
        * html/HTMLMarqueeElement.h:
        * html/HTMLMetaElement.h:
        * html/HTMLMeterElement.h:
        * html/HTMLModElement.h:
        * html/HTMLOListElement.h:
        * html/HTMLObjectElement.h:
        * html/HTMLOptGroupElement.h:
        * html/HTMLOptionElement.h:
        * html/HTMLOutputElement.h:
        * html/HTMLParagraphElement.h:
        * html/HTMLParamElement.h:
        * html/HTMLPreElement.h:
        * html/HTMLProgressElement.h:
        * html/HTMLQuoteElement.h:
        * html/HTMLScriptElement.h:
        * html/HTMLSourceElement.h:
        * html/HTMLStyleElement.h:
        * html/HTMLSummaryElement.h:
        * html/HTMLTableCaptionElement.h:
        * html/HTMLTableColElement.h:
        * html/HTMLTableElement.h:
        * html/HTMLTableSectionElement.h:
        * html/HTMLTemplateElement.h:
        * html/HTMLTextAreaElement.h:
        * html/HTMLTitleElement.h:
        * html/HTMLUListElement.h:
        * html/HTMLUnknownElement.h:
        * html/HTMLVideoElement.h:
        * html/HTMLWBRElement.h:

2016-07-14  Chris Dumez  <cdumez@apple.com>

        Modernize GlyphMetricsMap
        https://bugs.webkit.org/show_bug.cgi?id=159788

        Reviewed by Darin Adler.

        Modernize GlyphMetricsMap a bit.

        * platform/graphics/GlyphMetricsMap.h:
        - Drop WTF_MAKE_NONCOPYABLE as the class is already non-copyable due to having
          to having a std::unique_ptr data member.
        - Drop GlyphMetricsMap default constructor and let the compiler generate it
          instead. This required using inline initialization for m_filledPrimaryPage.

        (WebCore::GlyphMetricsMap::GlyphMetricsPage::GlyphMetricsPage):
        - Make m_metrics data member private as it does not need to be public.
        - Make setMetricsForIndex(unsigned index, const T& metrics) setter private
          as it does not need to be public.
        - Make GlyphMetricsPage(const T& initialValue) constructor explicit as it
          takes only 1 parameter.

        (WebCore::GlyphMetricsMap<T>::locatePageSlowCase):
        - Use HashMap::ensure() to make the code a bit nicer.

2016-07-14  Simon Fraser  <simon.fraser@apple.com>

        [iOS WK2] When scrolling apple.com/music on iPad Pro in landscape, left-hand tiles appear first
        https://bugs.webkit.org/show_bug.cgi?id=159798
        rdar://problem/27362717

        Reviewed by Tim Horton.

        In out-of-visible tiled layers, we always allocated the top-left tile, wasting
        memory and causing ugliness when scrolling that layer into view. This happened
        because getTileIndexRangeForRect() had no way to express the fact that no tiles
        should be created.

        Fix getTileIndexRangeForRect() to return a bool, and fix callers to respect the
        return value.

        Test: compositing/tiling/offscreen-tiled-layer.html

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::dumpAdditionalProperties):
        * platform/graphics/ca/TileGrid.cpp:
        (WebCore::TileGrid::setNeedsDisplayInRect):
        (WebCore::TileGrid::tilesWouldChangeForCoverageRect):
        (WebCore::TileGrid::getTileIndexRangeForRect):
        (WebCore::TileGrid::revalidateTiles):
        (WebCore::TileGrid::ensureTilesForRect):
        (WebCore::TileGrid::extent):
        * platform/graphics/ca/TileGrid.h:

2016-07-14  John Wilander  <wilander@apple.com>

        Remove credentials in URL when accessed through location.href
        https://bugs.webkit.org/show_bug.cgi?id=139562
        <rdar://problem/27331164>

        Reviewed by Brent Fulgham.

        Test: http/tests/security/location-href-clears-username-password.html

        The reason for this change is to not allow scripts on the page to
        exfiltrate username and password from the URL.

        * page/Location.cpp:
        (WebCore::Location::href):
            Now checks if there is a username or password in the URL. If so,
            it copies the URL and removes the username and password.

2016-07-14  Javier Fernandez  <jfernandez@igalia.com>

        [css-grid] Handle min-content/max-content with orthogonal flows
        https://bugs.webkit.org/show_bug.cgi?id=159294

        Reviewed by Darin Adler.

        Currently there is no support for orthogonal flows in many aspects of the
        Grid Layout logic.

        The Grid sizing algorithm should be adapted to this scenario, hence this
        patch focus on the min-content and max-content functions, used to resolve
        content based track sizes.

        There are still issues related to alignment and sizes using percentages,
        but they will be addressed in different patches.

        Tests: fast/css-grid-layout/grid-item-positioning-with-orthogonal-flows.html
               fast/css-grid-layout/grid-item-sizing-with-orthogonal-flows.html
               fast/css-grid-layout/grid-item-spanning-and-orthogonal-flows.html
               fast/css-grid-layout/grid-track-sizing-with-orthogonal-flows.html
               fast/css-grid-layout/grid-track-sizing-with-percentages-and-orthogonal-flows.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeLogicalWidthInRegion):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::GridSizingData::advanceNextState):
        (WebCore::RenderGrid::GridSizingData::isValidTransitionForDirection):
        (WebCore::RenderGrid::computeTrackSizesForDirection):
        (WebCore::RenderGrid::repeatTracksSizingIfNeeded): Added.
        (WebCore::RenderGrid::layoutBlock):
        (WebCore::RenderGrid::computeIntrinsicLogicalWidths):
        (WebCore::RenderGrid::computeIntrinsicLogicalHeight):
        (WebCore::hasOverrideContainingBlockContentSizeForChild):
        (WebCore::overrideContainingBlockContentSizeForChild):
        (WebCore::setOverrideContainingBlockContentSizeForChild):
        (WebCore::shouldClearOverrideContainingBlockContentSizeForChild):
        (WebCore::RenderGrid::gridTrackSize):
        (WebCore::RenderGrid::isOrthogonalChild): Added.
        (WebCore::RenderGrid::logicalHeightForChild):
        (WebCore::RenderGrid::flowAwareDirectionForChild): Added.
        (WebCore::RenderGrid::minSizeForChild):
        (WebCore::RenderGrid::updateOverrideContainingBlockContentSizeForChild):
        (WebCore::RenderGrid::minContentForChild):
        (WebCore::RenderGrid::maxContentForChild):
        (WebCore::RenderGrid::placeItemsOnGrid):
        (WebCore::RenderGrid::layoutPositionedObject):
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        (WebCore::RenderGrid::assumedRowsSizeForOrthogonalChild): Added.
        (WebCore::RenderGrid::gridAreaBreadthForChild):
        (WebCore::RenderGrid::columnAxisPositionForChild):
        (WebCore::RenderGrid::rowAxisPositionForChild):
        (WebCore::RenderGrid::findChildLogicalPosition):
        * rendering/RenderGrid.h:
        (WebCore::RenderGrid::SizingOperation): This enum has been moved to the header file.
        (WebCore::RenderGrid::m_hasAnyOrthogonalChild): New class attribute to know if there are any orthogonal grid items.
        (WebCore::RenderGrid::updateOverrideContainingBlockContentSizeForChild):
        (WebCore::RenderGrid::logicalHeightForChild):
        (WebCore::RenderGrid::gridAreaBreadthForChild):
        (WebCore::RenderGrid::assumedRowsSizeForOrthogonalChild):



2016-07-14  Chris Dumez  <cdumez@apple.com>

        Use emptyString() instead of "" when possible
        https://bugs.webkit.org/show_bug.cgi?id=159789

        Reviewed by Alex Christensen.

        Use emptyString() instead of "" when possible to reduce String allocations.

        * Modules/webdatabase/Database.cpp:
        (WebCore::Database::performOpenAndVerify):
        * css/CSSSelector.h:
        * css/StyleProperties.cpp:
        (WebCore::MutableStyleProperties::removeProperty):
        (WebCore::MutableStyleProperties::removeCustomProperty):
        * editing/TextCheckingHelper.cpp:
        (WebCore::TextCheckingHelper::findFirstMisspellingOrBadGrammar):
        (WebCore::TextCheckingHelper::findFirstBadGrammar):
        * editing/TypingCommand.h:
        (WebCore::TypingCommand::create):
        * fileapi/FileReaderLoader.cpp:
        (WebCore::FileReaderLoader::cleanup):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::fillMediaListChain):
        * page/UserContentURLPattern.cpp:
        (WebCore::UserContentURLPattern::parse):
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::load):
        * platform/gtk/DataObjectGtk.h:
        (WebCore::DataObjectGtk::clearURIList):
        * platform/network/curl/ResourceHandleCurl.cpp:
        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
        * platform/network/curl/ResourceHandleManager.h:
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::layerTreeAsText):
        * rendering/RenderListMarker.cpp:
        (WebCore::RenderListMarker::updateContent):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::noneDashboardRegions):
        * rendering/svg/SVGTextMetrics.cpp:
        (WebCore::SVGTextMetrics::SVGTextMetrics):
        * xml/XPathParser.cpp:
        (WebCore::XPath::Parser::lexString):

2016-07-14  Brent Fulgham  <bfulgham@apple.com>

        editing/spelling/spellcheck-async.html sometimes crashes with GuardMalloc 
        https://bugs.webkit.org/show_bug.cgi?id=142969
        <rdar://problem/27331095>

        Reviewed by Alex Christensen.

        Fix based on a Blink change (patch by <rouslan@chromium.org>):
        <https://chromium.googlesource.com/chromium/blink/+/c713736b122c2224804b2db72f1f711cb47ee260%5E%21/#F1>

        Test: editing/spelling/copy-paste-crash.html
              editing/spelling/spellcheck-async.html

        * editing/SpellChecker.cpp:
        (WebCore::SpellCheckRequest::didSucceed):
        (WebCore::SpellCheckRequest::didCancel):

2016-07-14  Zalan Bujtas  <zalan@apple.com>

        ImageBuffer's succes flag should be set to false at the very beginning of the c'tor.
        https://bugs.webkit.org/show_bug.cgi?id=159784

        Reviewed by Simon Fraser.

        No change in functionality.

        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::ImageBuffer::ImageBuffer):

2016-07-14  Alex Christensen  <achristensen@webkit.org>

        Use SocketProvider to create SocketStreamHandles
        https://bugs.webkit.org/show_bug.cgi?id=159774

        Reviewed by Brady Eidson.

        No new tests.  No change in behaviour.
        
        In r202930 I introduced the SocketProvider, but I used it to make a WebSocketChannel
        instead of a SocketStreamHandle, which is the class I want to make into an interface
        and proxy the web traffic over to the NetworkProcess.

        * CMakeLists.txt:
        * Modules/websockets/ThreadableWebSocketChannel.cpp: Added.
        (WebCore::ThreadableWebSocketChannel::create):
        I removed this in 202930, so this is restoring it from that patch, hence the old copyright.
        * Modules/websockets/ThreadableWebSocketChannel.h:
        (WebCore::ThreadableWebSocketChannel::ThreadableWebSocketChannel):
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect):
        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::WebSocketChannel):
        (WebCore::WebSocketChannel::connect):
        * Modules/websockets/WebSocketChannel.h:
        (WebCore::WebSocketChannel::create):
        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
        (WebCore::WorkerThreadableWebSocketChannel::WorkerThreadableWebSocketChannel):
        (WebCore::WorkerThreadableWebSocketChannel::resume):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::Peer):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveMessageError):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::Bridge):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::~Bridge):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::initialize):
        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
        (WebCore::WorkerThreadableWebSocketChannel::create):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::create):
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/InspectorOverlay.cpp:
        (WebCore::InspectorOverlay::overlayPage):
        * loader/EmptyClients.cpp:
        (WebCore::EmptyEditorClient::registerRedoStep):
        (WebCore::EmptySocketProvider::createWebSocketChannel): Deleted.
        * loader/EmptyClients.h:
        * page/SocketProvider.cpp: Added.
        (WebCore::SocketProvider::createSocketStreamHandle):
        * page/SocketProvider.h:
        (WebCore::SocketProvider::~SocketProvider): Deleted.
        * platform/network/cf/SocketStreamHandle.h:
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::dataChanged):

2016-07-14  Brady Eidson  <beidson@apple.com>

        "User delete" tests are flakey timeouts (and/or DatabaseProcess crashes).
        https://bugs.webkit.org/show_bug.cgi?id=158741

        Reviewed by Alex Christensen.

        No new tests (Covered by existing tests in some configurations)

        - Check if a database hard delete is complete in more places.
        - Asynchronously clear out the hard close protector instead of synchronously.
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::~UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformUnconditionalDeleteBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::didFinishHandlingVersionChange):
        (WebCore::IDBServer::UniqueIDBDatabase::connectionClosedFromClient):
        (WebCore::IDBServer::UniqueIDBDatabase::transactionCompleted):
        (WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTaskReply):
        (WebCore::IDBServer::UniqueIDBDatabase::maybeFinishHardClose):
        (WebCore::IDBServer::UniqueIDBDatabase::isDoneWithHardClose):
        (WebCore::IDBServer::UniqueIDBDatabase::doneWithHardClose): Deleted.

        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        (WebCore::IDBServer::UniqueIDBDatabase::hardClosedForUserDelete):

        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::didAbortTransaction):

2016-07-13  Brent Fulgham  <bfulgham@apple.com>

        CSSStyleSheet members should clear their owner node when destroyed
        https://bugs.webkit.org/show_bug.cgi?id=117470

        Reviewed by Chris Dumez.

        Make sure that CSSStyleSheet members are detached from their owner node when
        the owning object is destroyed.

        I audited other CSSStyleSheet uses, and found one other place where the owner node was not
        being cleared during destruction. The Inspector also uses CSSStyleSheet, but seems to
        handle the node ownership properly.

        Fix based on a Blink change (patch by <haraken@chromium.org>):
        <https://chromium.googlesource.com/chromium/blink/+/c4949bfdeb2a613701afa1410bdae70531b8f6bf>

        Also includes a follow-up fix (patch by <haraken@chromium.org>):
        <https://chromium.googlesource.com/chromium/blink/+/9c3932dc80b33429db3a5873cb266b726c8a19bf>

        No test case. Was found by the Chromium team through review of their crash traces under minor DOM GC.

        * contentextensions/ContentExtensionStyleSheet.cpp:
        (WebCore::ContentExtensions::ContentExtensionStyleSheet::~ContentExtensionStyleSheet):
        * contentextensions/ContentExtensionStyleSheet.h:
        * dom/InlineStyleSheetOwner.cpp:
        (WebCore::InlineStyleSheetOwner::~InlineStyleSheetOwner):
        (WebCore::authorStyleSheetsForElement):

2016-07-14  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !ENABLE(WEB_SOCKETS) build after r202930
        https://bugs.webkit.org/show_bug.cgi?id=159768

        Reviewed by Alex Christensen.

        * loader/EmptyClients.cpp:
        * loader/EmptyClients.h:
        * page/SocketProvider.h:
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::WorkerGlobalScope):
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThread::WorkerThread):

2016-07-14  Youenn Fablet  <youenn@apple.com>

        DOMIterators should be assigned a correct prototype
        https://bugs.webkit.org/show_bug.cgi?id=159115

        Reviewed by Chris Dumez.

        Default iterator object internal prototype property is the Iterator prototype as defined in
        http://heycam.github.io/webidl/#dfn-iterator-prototype-object.
        Linking DOMIterator prototype to IteratorPrototype.
        This allows adding @@iterator property to the result of entries, keys and values methods.
        This in turns allow doing for-of loops on them.

        Covered by updated test.

        * ForwardingHeaders/runtime/IteratorPrototype.h: Added.
        * bindings/js/JSDOMIterator.h: Setting correct prototype and marking next prototype property as enumerable.

2016-07-14  Youenn Fablet  <youenn@apple.com>

        Remove support for value iterators from JSDOMIterator
        https://bugs.webkit.org/show_bug.cgi?id=159293

        Reviewed by Chris Dumez.

        Value iterators are now handled without using DOMIterator.
        Since FontFaceSet is using DOMIterator as an intermediate step towards supporting set-like,
        entries and forEach implementation should be made compliant with set-like.
        This means that item value should be passed instead of an index in entries iterator and forEach callback.

        Covered by updated test.

        * bindings/js/JSDOMIterator.h:
        (WebCore::JSDOMIterator<JSWrapper>::asJS): Pass set item as entries value field.
        (WebCore::appendForEachArguments): Pass set item as second parameter.
        (WebCore::iteratorForEach): Remove index handling.

2016-07-14  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !ENABLE(MATHML) build after r201739
        https://bugs.webkit.org/show_bug.cgi?id=159767

        Reviewed by Alex Christensen.

        * dom/Document.cpp:
        (WebCore::Document::validateCustomElementName):

2016-07-14  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !ENABLE(CSS_IMAGE_SET) build
        https://bugs.webkit.org/show_bug.cgi?id=159766

        Reviewed by Alex Christensen.

        * css/CSSParser.cpp:

2016-07-14  Frederic Wang  <fred.wang@free.fr>

        Cleanup of MathML headers
        https://bugs.webkit.org/show_bug.cgi?id=159336

        Reviewed by Alex Christensen.

        We do some cleanup in MathML headers:
        - Use #pragma once
        - Use final for class that are not extended.
        - Use final instead of override for virtual members that are not overridden by derived classes.
        - Try and reduce the visibility of function members to private or protected as appropriate.
        - Remove useless #include
        - Remove useless class or friendship declaration
        - Remove unused functions

        No new tests, behavior is unchanged.

        * mathml/MathMLElement.h:
        * mathml/MathMLInlineContainerElement.h:
        * mathml/MathMLMathElement.h:
        * mathml/MathMLMencloseElement.h:
        * mathml/MathMLOperatorDictionary.h:
        * mathml/MathMLPaddedElement.h:
        * mathml/MathMLSelectElement.h:
        * mathml/MathMLSpaceElement.h:
        * mathml/MathMLTextElement.h:
        * rendering/mathml/MathOperator.h:
        * rendering/mathml/RenderMathMLBlock.h:
        * rendering/mathml/RenderMathMLFenced.h:
        * rendering/mathml/RenderMathMLFraction.h:
        * rendering/mathml/RenderMathMLMath.h:
        * rendering/mathml/RenderMathMLMenclose.h:
        * rendering/mathml/RenderMathMLOperator.h:
        * rendering/mathml/RenderMathMLRoot.h:
        * rendering/mathml/RenderMathMLRow.cpp:
        (WebCore::RenderMathMLRow::RenderMathMLRow): Deleted. We no longer create anonymous row.
        * rendering/mathml/RenderMathMLRow.h:
        * rendering/mathml/RenderMathMLScripts.h:
        * rendering/mathml/RenderMathMLSpace.h:
        * rendering/mathml/RenderMathMLToken.h:
        * rendering/mathml/RenderMathMLUnderOver.h:

2016-07-14  Alex Christensen  <achristensen@webkit.org>

        Pass SessionID to WebSocketHandle constructor
        https://bugs.webkit.org/show_bug.cgi?id=159772

        Reviewed by Brady Eidson.

        No new tests.  No change in behavior.

        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::connect):
        * platform/network/cf/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::create):
        * platform/network/cf/SocketStreamHandleCFNet.cpp:
        (WebCore::SocketStreamHandle::SocketStreamHandle):
        * platform/network/curl/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::create):
        * platform/network/soup/SocketStreamHandle.h:

2016-07-14  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GLib] Use a GSource instead of a thread to poll memory pressure eventFD in linux implementation
        https://bugs.webkit.org/show_bug.cgi?id=159346

        Reviewed by Antonio Gomes.

        This is a follow up of r203216 to fix wrong use of Optional values.

        * platform/linux/MemoryPressureHandlerLinux.cpp:

2016-07-14  Youenn Fablet  <youenn@apple.com>

        DOM value iterable interfaces should use Array prototype methods
        https://bugs.webkit.org/show_bug.cgi?id=159296

        Reviewed by Chris Dumez and Mark Lam.

        Test: fast/dom/NodeList/nodelist-iterable.html
        Also covered by updated layout test and binding tests.

        For value iterators, copy the iterator methods from Array prototype: as per https://heycam.github.io/webidl/#es-iterable,
        [re: entries] If the interface has a value iterator, then the Function object is the initial value of the "entries" data property of %ArrayPrototype% ([ECMA-262], section 6.1.7.4).
        [re: keys] If the interface has a value iterator, then the Function object is the initial value of the "keys" data property of %ArrayPrototype% ([ECMA-262], section 6.1.7.4).
        [re: forEach] If the interface defines an indexed property getter, then the Function object is the initial value of the "forEach" data property of %ArrayPrototype% ([ECMA-262], section 6.1.7.4).
        [re: Symbol.iterator] If the interface defines an indexed property getter, then the Function object is %ArrayProto_values% ([ECMA-262], section 6.1.7.4).
        [re: values] If the interface has a value iterator, then the Function object is the value of the @@iterator property.

        This change applies only to NodeList at the moment.
        Copy of Array prototype iterator methods is disabled if the interface has no indexed getter.

        * CMakeLists.txt:
        * ForwardingHeaders/builtins/BuiltinNames.h: Added.
        * ForwardingHeaders/builtins/JSCBuiltins.h: Added.
        * ForwardingHeaders/runtime/CommonIdentifiers.h: Added.
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSDOMIterator.cpp: Added.
        (WebCore::addValueIterableMethods): Copy iterator methods from array prototype.
        * bindings/js/JSDOMIterator.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GeneratePropertiesHashTable):
        (GenerateImplementation):
        (IsValueIterableInterface): Introduced to only copy iterator methods if the interface has an indexed getter.
        (IsKeyValueIterableInterface): Introduced to detect whether generating iterator methods.
        (GenerateImplementationIterableFunctions):
        * bindings/scripts/test/GObject/WebKitDOMTestIterable.cpp: Added.
        * bindings/scripts/test/GObject/WebKitDOMTestIterable.h: Added.
        * bindings/scripts/test/GObject/WebKitDOMTestIterablePrivate.h: Added.
        * bindings/scripts/test/JS/JSTestIterable.cpp: Added.
        * bindings/scripts/test/JS/JSTestIterable.h: Added.
        * bindings/scripts/test/JS/JSTestObj.cpp: Updated as TestObj defines both iterable<> and indexed getter.
        * bindings/scripts/test/ObjC/DOMTestIterable.h: Added.
        * bindings/scripts/test/ObjC/DOMTestIterable.mm: Added.
        * bindings/scripts/test/ObjC/DOMTestIterableInternal.h: Added.
        * bindings/scripts/test/TestIterable.idl: Added to handle the case of value iterator without indexed getter defined.
        Array prototype methods should not be copied.
        * bindings/scripts/test/TestObj.idl: Changing to be a value iterator (with indexed getter already defined).
        Array prototype methods should be copied.

2016-07-14  Youenn Fablet  <youenn@apple.com>

        [Fetch API] Request and Response url getter should use URL serialization
        https://bugs.webkit.org/show_bug.cgi?id=159705

        Reviewed by Alex Christensen.

        Tests: fetch/fetch-url-serialization.html
               imported/w3c/web-platform-tests/fetch/api/basic/response-url-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/response-url.html

        Implementing https://url.spec.whatwg.org/#concept-url-serializer and applying it to Request and Response getter.
        Adding a temporary routine to compute url cannot-be-a-base-url flag. The parsing routine should store that
        information in the URL itself.

        Added tests to cover serialization routine. Failing tests are mostly due to limitations of the URL parser.
        Tests do not check for URLs with username and password as Request constructor throws with such URLs.

        * Modules/fetch/FetchRequest.cpp:
        (WebCore::FetchRequest::url): Adding request url serialization, fragment included.
        * Modules/fetch/FetchRequest.h:
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::url): Adding response url serialization, fragment excluded.
        * Modules/fetch/FetchResponse.h:
        * platform/URL.cpp:
        (WebCore::cannotBeABaseURL): Temporary helper function to have a coarse evaluation of url cannot-be-a-base-url flag.
        (WebCore::URL::serialize): Implementation of https://url.spec.whatwg.org/#concept-url-serializer.
        * platform/URL.h:
        (WebCore::URL::hasUser): Helper getter.
        (WebCore::URL::hasPassword): Ditto.
        (WebCore::URL::hasQuery): Ditto.
        (WebCore::URL::hasFragment): Ditto.

2016-07-14  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Const-ify track sizing algorithm
        https://bugs.webkit.org/show_bug.cgi?id=159716

        Reviewed by Carlos Garcia Campos.

        All the methods used to run the track sizing algorithm should not
        modify the state of LayoutGrid. We can safely const-ify all of them
        and remove the ugly const_cast in computeIntrinsicLogicalWidths().

        No new tests needed as there is no change in behavior.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::logicalHeightForChild):
        (WebCore::RenderGrid::minSizeForChild):
        (WebCore::RenderGrid::updateOverrideContainingBlockContentLogicalWidthForChild):
        (WebCore::RenderGrid::minContentForChild):
        (WebCore::RenderGrid::maxContentForChild):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctions):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
        (WebCore::RenderGrid::currentItemSizeForTrackSizeComputationPhase):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForItems):
        (WebCore::RenderGrid::distributeSpaceToTracks):
        * rendering/RenderGrid.h:

2016-07-14  Jer Noble  <jer.noble@apple.com>

        REGRESSION (r202918): LayoutTest media/video-main-content-allow-then-deny.html is flaky, failing almost every time on El Capitan
        https://bugs.webkit.org/show_bug.cgi?id=159533

        Reviewed by Eric Carlson.

        Move the contents of mainContentCheckTimerFired() into updateIsMainContent() so that the
        results of changing the m_isMainContent ivar are acted upon no matter why m_isMainContent
        changes.

        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::mainContentCheckTimerFired):
        (WebCore::MediaElementSession::updateIsMainContent):

2016-07-13  Alex Christensen  <achristensen@webkit.org>

        Modernize WebSocket handle
        https://bugs.webkit.org/show_bug.cgi?id=159750

        Reviewed by Brady Eidson.

        No new tests.  No change in behavior.
        This patch just removes ThreadableWebSocketChannel::InvalidMessage which is never used
        and makes our use of SocketStreamHandleClient a reference instead of a pointer.

        * Modules/websockets/ThreadableWebSocketChannel.h:
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::send):
        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::connect):
        * platform/network/SocketStreamHandleBase.cpp:
        (WebCore::SocketStreamHandleBase::SocketStreamHandleBase):
        (WebCore::SocketStreamHandleBase::send):
        (WebCore::SocketStreamHandleBase::disconnect):
        (WebCore::SocketStreamHandleBase::sendPendingData):
        (WebCore::SocketStreamHandleBase::setClient): Deleted.
        * platform/network/SocketStreamHandleBase.h:
        (WebCore::SocketStreamHandleBase::~SocketStreamHandleBase):
        (WebCore::SocketStreamHandleBase::bufferedAmount):
        (WebCore::SocketStreamHandleBase::client):
        * platform/network/cf/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::create):
        * platform/network/cf/SocketStreamHandleCFNet.cpp:
        (WebCore::SocketStreamHandle::SocketStreamHandle):
        (WebCore::SocketStreamHandle::addCONNECTCredentials):
        (WebCore::SocketStreamHandle::copyCFStreamDescription):
        (WebCore::SocketStreamHandle::readStreamCallback):
        (WebCore::SocketStreamHandle::writeStreamCallback):
        (WebCore::SocketStreamHandle::reportErrorToClient):
        (WebCore::SocketStreamHandle::~SocketStreamHandle):
        (WebCore::SocketStreamHandle::platformClose):
        (WebCore::SocketStreamHandle::port):
        * platform/network/curl/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::create):
        * platform/network/curl/SocketStreamHandleCurl.cpp:
        (WebCore::SocketStreamHandle::SocketStreamHandle):
        (WebCore::SocketStreamHandle::platformClose):
        (WebCore::SocketStreamHandle::readData):
        (WebCore::SocketStreamHandle::didReceiveData):
        (WebCore::SocketStreamHandle::didOpenSocket):
        (WebCore::SocketStreamHandle::createCopy):
        * platform/network/soup/SocketStreamHandle.h:
        * platform/network/soup/SocketStreamHandleSoup.cpp:
        (WebCore::SocketStreamHandle::SocketStreamHandle):
        (WebCore::SocketStreamHandle::~SocketStreamHandle):
        (WebCore::SocketStreamHandle::connected):
        (WebCore::SocketStreamHandle::connectedCallback):
        (WebCore::SocketStreamHandle::readBytes):
        (WebCore::SocketStreamHandle::didFail):
        (WebCore::SocketStreamHandle::writeReady):
        (WebCore::SocketStreamHandle::platformClose):
        (WebCore::SocketStreamHandle::beginWaitingForSocketWritability):

2016-07-13  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GLib] Use a GSource instead of a thread to poll memory pressure eventFD in linux implementation
        https://bugs.webkit.org/show_bug.cgi?id=159346

        Reviewed by Antonio Gomes.

        The eventFD file descriptor is pollable, so it would be much better to use a poll instead of a blocking read in
        a secondary thread and then communicate back to the main thread. This is very easy to do with GSource in GLib,
        so we could use that when GLib is available and keep the current implementation as a fallback.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::m_holdOffTimer): Use a RunLoop timer.
        * platform/MemoryPressureHandler.h:
        * platform/linux/MemoryPressureHandlerLinux.cpp:
        (WebCore::MemoryPressureHandler::EventFDPoller::EventFDPoller): Helper class do the eventFD polling.
        (WebCore::MemoryPressureHandler::logErrorAndCloseFDs): Check if file descriptors are -1 not 0.
        (WebCore::MemoryPressureHandler::install): Return early also if the hold off timer is active. Use EventFDPoller
        to do the polling.
        (WebCore::MemoryPressureHandler::uninstall): Stop the hold off timer and clear the EventFDPoller.

2016-07-13  Benjamin Poulain  <benjamin@webkit.org>

        [CSS][ARMv7] :nth-child() do not reserve enough registers if it is in backtracking chain
        https://bugs.webkit.org/show_bug.cgi?id=159746
        rdar://problem/26156169

        Reviewed by Andreas Kling.

        The generator generateElementIsNthChild() requires 6 registers in style resolution
        to mark previous siblings with generateAddStyleRelationIfResolvingStyle() in the loop.

        We were only reserving 5, which is a problem is the sixth is taken by the backtracking
        register. x86_64 was already requiring 6 for unrelated reasons and ARM64 has so many registers
        that you cannot possibly run out of them in CSS JIT.

        I generalized the x86_64 path to all architectures.
        I did not limit this case to style resolution because the extra register is irrelevant
        in most cases. The only difference is one extra push/pop on ARMv7 if you use querySelector
        with :nth-child in a backtracking chain.

        This problem is covered by the existing test fast/selectors/nth-child-with-backtracking.html

        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::minimumRegisterRequirements): Deleted.

2016-07-13  Chris Dumez  <cdumez@apple.com>

        Drop unnecessary check from ContainerNode::removeChild()
        https://bugs.webkit.org/show_bug.cgi?id=159747

        Reviewed by Andreas Kling.

        Drop unnecessary check from ContainerNode::removeChild() to make sure that
        the parent of the node being removed is |this|. We already do this check
        a few lines above. The only thing that happens in between is the ref'ing
        of the node, which does not cause any JS execution.

        This check was introduced in r55783 because there used to be a call to
        document()->removeFocusedNodeOfSubtree(child.get());
        between the two checks. However, this call has been removed since then
        and the extra parentNode() check was left in.

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::removeChild): Deleted.

2016-07-12  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r202953): Clicking on input[type=file] doesn't open a file picker
        https://bugs.webkit.org/show_bug.cgi?id=159686

        Reviewed by Chris Dumez.

        The bug was caused by DOMActivate event not propagating out of the user-agent shadow tree
        of a file input, and FileInputType not receiving the event to open the file picker.

        Made DOMActivate "composed" event which cross shadow boundaries to fix the bug. The feedback
        was given back to W3C on https://github.com/w3c/webcomponents/issues/513#issuecomment-231851617

        Test: fast/forms/file/open-file-panel.html

        * dom/Event.cpp:
        (WebCore::Event::composed):

2016-07-13  Antti Koivisto  <antti@apple.com>

        v2: WebContent crash due to RELEASE_ASSERT(!m_inLoadPendingImages) in StyleResolver::~StyleResolver()
        https://bugs.webkit.org/show_bug.cgi?id=159722

        Reviewed by Andreas Kling.

        We have crashes where a StyleResolver is deleted underneath pseudoStyleForElement (key parts of the stack):

        0   WebCore::StyleResolver::~StyleResolver
        3   WebCore::AuthorStyleSheets::updateActiveStyleSheets
        4   WebCore::Document::styleResolverChanged
        5   WebKit::WebPage::viewportConfigurationChanged()
        6   WebKit::WebPage::mainFrameDidLayout()
        9   WebCore::FrameLoader::checkCompleted
        13  WebCore::ResourceLoader::cancel
        19  WebKit::WebLoaderStrategy::loadResource
        24  WebCore::Style::loadPendingImage
        27  WebCore::StyleResolver::pseudoStyleForElement
        29  WebCore::RenderTreeUpdater::updateBeforeOrAfterPseudoElement
        33  WebCore::Document::recalcStyle

        This appears to be happening when a content blocker blocks a resource load for an image referenced from a stylesheet
        and triggers synchronous cancellation of the load. With engine in suitable state this can clear style resolver.

        No test, don't know how to make one. This is very timing and engine state dependent.

        * dom/AuthorStyleSheets.cpp:
        (WebCore::AuthorStyleSheets::updateActiveStyleSheets):

        We have an existing check here that prevents destruction of the style resolver when we are in the middle of
        a style resolution. However the old inStyleRecalc() bit no longer covers the render tree update phase. Pseudo
        elements are resolved during render tree update.

        Fix by adding a check for inRenderTreeUpdate() bit too.

        This just fixes a regression. A proper fix would be to gather all resources during style resolution
        and trigger the loads afterwards.

2016-07-13  Frederic Wang  <fred.wang@free.fr>

        Remove padding and margin around the <math> element
        https://bugs.webkit.org/show_bug.cgi?id=157989

        Reviewed by Brent Fulgham.

        No new tests, already covered by existing tests.

        * css/mathml.css:
        (math): Remove padding.
        (math[display="block"]): Remove margin.

2016-07-13  Enrica Casucci  <enrica@apple.com>

        Update supported platforms in xcconfig files to match the sdk names.
        https://bugs.webkit.org/show_bug.cgi?id=159728

        Reviewed by Tim Horton.

        * Configurations/Base.xcconfig:

2016-07-13  Anders Carlsson  <andersca@apple.com>

        "requiredShippingAddressFields" has been deprecated error thrown when using "requiredBillingAddressFields"
        https://bugs.webkit.org/show_bug.cgi?id=159729
        rdar://problem/27314974

        Reviewed by Tim Horton.

        Fix a paste-o.

        * Modules/applepay/ApplePaySession.cpp:
        (WebCore::createPaymentRequest):

2016-07-13  Brent Fulgham  <bfulgham@apple.com>

        [WK1][iOS] Crash when WebSocket attempts to dispatch a mixed content blocker event
        https://bugs.webkit.org/show_bug.cgi?id=159680
        <rdar://problem/22102028>

        Reviewed by Zalan Bujtas.

        WK1 on iOS should not use RunLoop::main(). Instead, it should be dispatching events
        on the WebThread.

        Test: http/tests/ssl/mixedContent/insecure-websocket.html

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect): Do not use RunLoop::main() when we should be using
        the WebThread.

2016-07-13  Frederic Wang  <fwang@igalia.com>

        The display property of many MathML elements can not be overriden by page authors
        https://bugs.webkit.org/show_bug.cgi?id=139403

        The mathml.css user agent stylesheet currently forces most MathML elements to render with
        'display: block'. We remove the !important keyword so that users can override the display
        property, for example to hide elements with 'display: none'. This is consistent with the
        behavior for SVG or HTML elements.

        Reviewed by Brent Fulgham.

        Test: imported/mathml-in-html5/mathml/relations/css-styling/display-1.html

        * css/mathml.css:
        (math):
        (math[display="block"]):
        (ms, mspace, mtext, mi, mn, mo, mrow, mfenced, mfrac, msub, msup, msubsup, mmultiscripts, mprescripts, none, munder, mover, munderover, msqrt, mroot, merror, mphantom, mstyle, menclose, semantics, mpadded, maction):
        (mtd > *):

2016-07-13  Youenn Fablet  <youenn@apple.com>

        [Fetch API] Response should not become disturbed on the ReadableStream creation
        https://bugs.webkit.org/show_bug.cgi?id=159714

        Reviewed by Alex Christensen.

        Covered by rebased test and existing tests.

        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::stop): Making the response disturbed if cancelled.
        * Modules/fetch/FetchResponseSource.cpp:
        (WebCore::FetchResponseSource::firstReadCallback): Start enqueueing as soon as first read is made.
        (WebCore::FetchResponseSource::doStart): Keep the start promise unresolved so that pull is not called.
        FetchResponse is a push source.
        * Modules/fetch/FetchResponseSource.h:
        * Modules/streams/ReadableStreamInternals.js:
        (readFromReadableStreamReader): Calling @firstReadCallback.
        * Modules/streams/ReadableStreamSource.h:
        (WebCore::ReadableStreamSource::firstReadCallback): Default implementation (does nothing).
        * Modules/streams/ReadableStreamSource.idl: Adding firstReadCallback private method.
        * bindings/js/WebCoreBuiltinNames.h: Adding @firstReadCallback.

2016-07-13  Philippe Normand  <pnormand@igalia.com>

        [GStreamer][GL] crash within triggerRepaint
        https://bugs.webkit.org/show_bug.cgi?id=159552

        Reviewed by Xabier Rodriguez-Calvar.

        Revert the un-needed changes introduced in r203056 and use the
        MainThreadNotifier without redundant checks.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
        (WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        (WebCore::MediaPlayerPrivateGStreamer::createWeakPtr):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
        (WebCore::MediaPlayerPrivateGStreamerBase::createWeakPtr): Deleted.

2016-07-13  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GObject DOM bindings API breaks after r203047-

        webkit_dom_document_set_title() and webkit_dom_html_title_element_set_text() now can raise exceptions. 

        * bindings/gobject/WebKitDOMDeprecated.cpp:
        (webkit_dom_document_set_title):
        (webkit_dom_html_title_element_set_text):
        * bindings/gobject/WebKitDOMDeprecated.h:
        * bindings/gobject/WebKitDOMDeprecated.symbols:
        * bindings/gobject/webkitdom.symbols:
        * bindings/scripts/CodeGeneratorGObject.pm:
        (GenerateProperty):
        (FunctionUsedToNotRaiseException):

2016-07-13  Carlos Garcia Campos  <cgarcia@igalia.com>

        [Coordinated Graphics] Remove toCoordinatedGraphicsLayer and use downcast instead
        https://bugs.webkit.org/show_bug.cgi?id=159469

        Reviewed by Michael Catanzaro.

        * page/scrolling/coordinatedgraphics/ScrollingCoordinatorCoordinatedGraphics.cpp:
        (WebCore::ScrollingCoordinatorCoordinatedGraphics::detachFromStateTree):
        (WebCore::ScrollingCoordinatorCoordinatedGraphics::updateViewportConstrainedNode):
        (WebCore::ScrollingCoordinatorCoordinatedGraphics::scrollableAreaScrollLayerDidChange):
        (WebCore::ScrollingCoordinatorCoordinatedGraphics::willDestroyScrollableArea):
        * platform/graphics/GraphicsLayer.h:
        (WebCore::GraphicsLayer::isCoordinatedGraphicsLayer):
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
        (WebCore::toCoordinatedLayerID):
        (WebCore::CoordinatedGraphicsLayer::setShouldUpdateVisibleRect):
        (WebCore::CoordinatedGraphicsLayer::removeFromParent):
        (WebCore::CoordinatedGraphicsLayer::setMaskLayer):
        (WebCore::CoordinatedGraphicsLayer::flushCompositingState):
        (WebCore::CoordinatedGraphicsLayer::syncPendingStateChangesIncludingSubLayers):
        (WebCore::CoordinatedGraphicsLayer::findFirstDescendantWithContentsRecursively):
        (WebCore::CoordinatedGraphicsLayer::updateContentBuffersIncludingSubLayers):
        (WebCore::CoordinatedGraphicsLayer::computeTransformedVisibleRect):
        (WebCore::CoordinatedGraphicsLayer::selfOrAncestorHasActiveTransformAnimation):
        (WebCore::CoordinatedGraphicsLayer::selfOrAncestorHaveNonAffineTransforms):
        (WebCore::toCoordinatedGraphicsLayer): Deleted.
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:

2016-07-12  Youenn Fablet  <youenn@apple.com>

        [Fetch API] isRedirected should be conveyed in workers
        https://bugs.webkit.org/show_bug.cgi?id=159676

        Reviewed by Alex Christensen.

        Passing isRedirected value between threads.
        Rebasing corresponding worker test, even though it is currently skipped (due to crashing flakiness).

        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::crossThreadData):
        (WebCore::ResourceResponseBase::fromCrossThreadData):
        * platform/network/ResourceResponseBase.h:

2016-07-12  Eric Carlson  <eric.carlson@apple.com>

        REGRESSION (r202509): media controls controls enabled AirPlay placeholder is shown
        https://bugs.webkit.org/show_bug.cgi?id=159685
        <rdar://problem/27198899>

        Reviewed by Dean Jackson.

        Test: media/controls/airplay-controls.html

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.shouldShowControls): Split some of the logic out of shouldHaveControls.
        (Controller.prototype.shouldHaveControls): Having controls != showing controls.
        (Controller.prototype.updateControls): Call shouldShowControls, not shouldHaveControls.
        (Controller.prototype.updateWirelessPlaybackStatus): Add 'appletv' to the class when active.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::getCurrentMediaControlsStatus): Call ensureMediaControlsShadowRoot
        in case the controls haven't been created yet.

2016-07-12  Frederic Wang  <fwang@igalia.com>

        Move parsing of mpadded attributes to a MathMLPaddedElement class
        https://bugs.webkit.org/show_bug.cgi?id=159620

        Reviewed by Brent Fulgham.

        No new tests, behavior is unchanged.

        * CMakeLists.txt: Add MathMLPaddedElement files.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * mathml/MathMLAllInOne.cpp: Ditto.
        * mathml/MathMLInlineContainerElement.cpp: Remove handling of mpadded.
        * mathml/MathMLPaddedElement.cpp: Added.
        (WebCore::MathMLPaddedElement::MathMLPaddedElement):
        (WebCore::MathMLPaddedElement::create):
        (WebCore::MathMLPaddedElement::width): Expose width attribute as a MathMLLength until mpadded
        pseudo-units are supported.
        (WebCore::MathMLPaddedElement::height): Ditto.
        (WebCore::MathMLPaddedElement::depth): Ditto
        (WebCore::MathMLPaddedElement::lspace): Ditto.
        (WebCore::MathMLPaddedElement::voffset): Ditto.
        (WebCore::MathMLPaddedElement::parseAttribute): Make length attribute dirty.
        (WebCore::MathMLPaddedElement::createElementRenderer): Moved code from MathMLInlineContainerElement.
        * mathml/MathMLPaddedElement.h: Added.
        * mathml/mathtags.in: Map mapdded to MathMLPaddedElement.
        * rendering/mathml/RenderMathMLPadded.cpp:
        (WebCore::RenderMathMLPadded::resolveWidth): Helper function to resolve width.
        (WebCore::RenderMathMLPadded::resolveAttributes): Helper function to resolve all attributes.
        (WebCore::RenderMathMLPadded::computePreferredLogicalWidths): Use resolveWidth.
        (WebCore::RenderMathMLPadded::layoutBlock): Use resolveAttributes.
        * rendering/mathml/RenderMathMLPadded.h: Add new helper functions to access attributes from
        the MathMLPaddedElement class.

2016-07-12  Andreas Kling  <akling@apple.com>

        [Cocoa] Simulated memory warning doesn't trigger libcache purge.
        <https://webkit.org/b/159688>

        Reviewed by Chris Dumez.

        Since simulated memory warnings will have the "is under memory pressure" flag set,
        we were skipping the libcache purge call.

        Add a separate flag that tracks whether we're under simulated pressure, and always
        prod libcache in that case.

        * platform/MemoryPressureHandler.h:
        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        (WebCore::MemoryPressureHandler::platformReleaseMemory):
        (WebCore::MemoryPressureHandler::install):

2016-07-12  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Purge PassRefPtr in Modules/webdatabase
        https://bugs.webkit.org/show_bug.cgi?id=159255

        Reviewed by Benjamin Poulain.

        As a step to remove PassRefPtr use, this patch cleans it up in Modules/webdatabase.

        Additionally unnecessary spaces and tabs are removed too.

        * Modules/webdatabase/ChangeVersionWrapper.cpp:
        * Modules/webdatabase/DOMWindowWebDatabase.h:
        * Modules/webdatabase/Database.cpp:
        (WebCore::Database::Database):
        (WebCore::Database::~Database):
        (WebCore::Database::scheduleTransaction):
        (WebCore::Database::runTransaction):
        * Modules/webdatabase/Database.h:
        * Modules/webdatabase/DatabaseAuthorizer.cpp:
        (WebCore::DatabaseAuthorizer::allowRead):
        * Modules/webdatabase/DatabaseManager.cpp:
        (WebCore::DatabaseManager::openDatabase):
        (WebCore::DatabaseManager::fullPathForDatabase):
        (WebCore::DatabaseManager::detailsForNameAndOrigin):
        * Modules/webdatabase/DatabaseManager.h:
        * Modules/webdatabase/DatabaseTask.cpp:
        (WebCore::DatabaseTransactionTask::DatabaseTransactionTask):
        * Modules/webdatabase/DatabaseTask.h:
        * Modules/webdatabase/SQLCallbackWrapper.h:
        (WebCore::SQLCallbackWrapper::SQLCallbackWrapper):
        * Modules/webdatabase/SQLResultSetRowList.h:
        * Modules/webdatabase/SQLStatement.cpp:
        (WebCore::SQLStatement::SQLStatement):
        (WebCore::SQLStatement::sqlError):
        (WebCore::SQLStatement::sqlResultSet):
        * Modules/webdatabase/SQLStatement.h:
        * Modules/webdatabase/SQLTransaction.h:
        * Modules/webdatabase/SQLTransactionBackend.cpp:
        (WebCore::SQLTransactionBackend::create):
        (WebCore::SQLTransactionBackend::SQLTransactionBackend):
        (WebCore::SQLTransactionBackend::transactionError):
        * Modules/webdatabase/SQLTransactionBackend.h:

2016-07-11  Dean Jackson  <dino@apple.com>

        REGRESSION (202694): Audio and Video playback controls: Cannot find a position slider to adjust playback position using VO.
        https://bugs.webkit.org/show_bug.cgi?id=159661
        <rdar://problem/27285135>

        Reviewed by Eric Carlson.

        The change in r202694 caused MediaDocuments to not always
        show their scrubber. The fix is to reduce the minimum amount
        of size needed to show the scrubber.

        Test: media/controls/default-size-should-show-scrubber.html

        * Modules/mediacontrols/mediaControlsApple.js: 80 pixels is enough
        to show the scrubber.

2016-07-12  Frederic Wang  <fwang@igalia.com>

        Move MathMLOperatorDictionary from rendering to DOM
        https://bugs.webkit.org/show_bug.cgi?id=159619

        Reviewed by Brent Fulgham.

        No new tests, behavior is unchanged.

        * CMakeLists.txt: Use the new location of MathMLOperatorDictionary files.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * mathml/MathMLAllInOne.cpp: Add MathMLOperatorDictionary.cpp
        * mathml/MathMLOperatorDictionary.cpp: Renamed from Source/WebCore/rendering/mathml/MathMLOperatorDictionary.cpp.
        * mathml/MathMLOperatorDictionary.h: Renamed from Source/WebCore/rendering/mathml/MathMLOperatorDictionary.h.

2016-07-12  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Remove ENABLE_CSS3_TEXT_LINE_BREAK flag
        https://bugs.webkit.org/show_bug.cgi?id=159671

        Reviewed by Csaba Osztrogonác.

        ENABLE_CSS3_TEXT_LINE_BREAK feature was implemented without guards.
        https://bugs.webkit.org/show_bug.cgi?id=89235

        So this guard can be removed in build scripts.

        * Configurations/FeatureDefines.xcconfig:

2016-07-12  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r203059.
        https://bugs.webkit.org/show_bug.cgi?id=159673

        B and R channels now swapped on desktop GL builds (Requested
        by philn on #webkit).

        Reverted changeset:

        "Red and blue colors are swapped in video rendered through
        WebGL when GSTREAMER_GL is enabled"
        https://bugs.webkit.org/show_bug.cgi?id=159621
        http://trac.webkit.org/changeset/203059

2016-07-12  Yoav Weiss  <yoav@yoav.ws>

        js/dom/global-constructors-attributes.html is flaky: ResourceTiming runtime feature leaks between tests
        https://bugs.webkit.org/show_bug.cgi?id=158902

        Reviewed by Benjamin Poulain.

        Adds a new reset() mechanism to RuntimeEnabledFeatures so that they could be brought back to the initial state.
        This reset() is then called from DumpRenderTree and WebKitTestRunner.

        No new tests but hopefully current tests will be less flaky.

        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
        (WebCore::RuntimeEnabledFeatures::reset):
        * bindings/generic/RuntimeEnabledFeatures.h:
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState): reset RuntimeEnabledFeatures.

2016-07-11  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Purge PassRefPtr in platform/efl and platform/mac 
        https://bugs.webkit.org/show_bug.cgi?id=159548

        Reviewed by Alex Christensen.

        Remove all use of PassRefPtr and clean up unnecessary tabs and spaces.
        WebKit2 codes are also changed because of setBufferForType()'s modification.

        No new tests, no behavior changes.

        * platform/PasteboardStrategy.h:
        * platform/PlatformPasteboard.h:
        * platform/PlatformSpeechSynthesizer.h:
        * platform/SerializedPlatformRepresentation.h:
        * platform/efl/PlatformSpeechSynthesisProviderEfl.cpp:
        (WebCore::PlatformSpeechSynthesisProviderEfl::speak):
        * platform/efl/PlatformSpeechSynthesisProviderEfl.h:
        * platform/efl/PlatformSpeechSynthesizerEfl.cpp:
        (WebCore::PlatformSpeechSynthesizer::speak):
        * platform/ios/PlatformPasteboardIOS.mm:
        (WebCore::PlatformPasteboard::setBufferForType):
        * platform/ios/PlatformSpeechSynthesizerIOS.mm:
        (SOFT_LINK_CONSTANT):
        (-[WebSpeechSynthesisWrapper initWithSpeechSynthesizer:]):
        (-[WebSpeechSynthesisWrapper mapSpeechRateToPlatformRate:]):
        (-[WebSpeechSynthesisWrapper speakUtterance:]):
        (-[WebSpeechSynthesisWrapper pause]):
        (-[WebSpeechSynthesisWrapper resume]):
        (-[WebSpeechSynthesisWrapper cancel]):
        (-[WebSpeechSynthesisWrapper speechSynthesizer:didStartSpeechUtterance:]):
        (-[WebSpeechSynthesisWrapper speechSynthesizer:didFinishSpeechUtterance:]):
        (-[WebSpeechSynthesisWrapper speechSynthesizer:didPauseSpeechUtterance:]):
        (-[WebSpeechSynthesisWrapper speechSynthesizer:didContinueSpeechUtterance:]):
        (-[WebSpeechSynthesisWrapper speechSynthesizer:didCancelSpeechUtterance:]):
        (-[WebSpeechSynthesisWrapper speechSynthesizer:willSpeakRangeOfSpeechString:utterance:]):
        (WebCore::PlatformSpeechSynthesizer::speak):
        * platform/mac/PasteboardMac.mm:
        (WebCore::Pasteboard::write):
        * platform/mac/PlatformPasteboardMac.mm:
        (WebCore::PlatformPasteboard::getTypes):
        (WebCore::PlatformPasteboard::getPathnamesForType):
        (WebCore::PlatformPasteboard::color):
        (WebCore::PlatformPasteboard::copy):
        (WebCore::PlatformPasteboard::setBufferForType):
        (WebCore::PlatformPasteboard::setPathnamesForType):
        * platform/mac/PlatformSpeechSynthesizerMac.mm:
        (-[WebSpeechSynthesisWrapper initWithSpeechSynthesizer:]):
        (-[WebSpeechSynthesisWrapper speakUtterance:]):
        (-[WebSpeechSynthesisWrapper pause]):
        (-[WebSpeechSynthesisWrapper resume]):
        (-[WebSpeechSynthesisWrapper cancel]):
        (-[WebSpeechSynthesisWrapper speechSynthesizer:didFinishSpeaking:]):
        (WebCore::PlatformSpeechSynthesizer::initializeVoiceList):
        (WebCore::PlatformSpeechSynthesizer::speak):
        * platform/mac/SerializedPlatformRepresentationMac.h:
        * platform/mac/SerializedPlatformRepresentationMac.mm:
        (WebCore::SerializedPlatformRepresentationMac::data):
        (WebCore::jsValueWithValueInContext):
        * platform/mock/PlatformSpeechSynthesizerMock.cpp:
        (WebCore::PlatformSpeechSynthesizerMock::speakingFinished):
        (WebCore::PlatformSpeechSynthesizerMock::speak):
        (WebCore::PlatformSpeechSynthesizerMock::cancel):
        * platform/mock/PlatformSpeechSynthesizerMock.h:

2016-07-11  Frederic Wang  <fwang@igalia.org>

        Move parsing of mspace attributes to a MathMLSpaceElement class
        https://bugs.webkit.org/show_bug.cgi?id=156795

        Reviewed by Brent Fulgham.

        No new tests, already covered by existing tests.

        * CMakeLists.txt: Add MathMLSpaceElement to the build system.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * mathml/MathMLElement.cpp:
        (WebCore::MathMLElement::cachedMathMLLength): Helper function to returned the cached parsed
        value of a MathML length and parsing the corresponding attribute value if the cache is dirty.
        * mathml/MathMLElement.h: Add a dirty boolean to MathML Length structure. Declare cachedMathMLLength.
        * mathml/MathMLSpaceElement.cpp: New class for the <mspace> element.
        (WebCore::MathMLSpaceElement::MathMLSpaceElement):
        (WebCore::MathMLSpaceElement::create):
        (WebCore::MathMLSpaceElement::parseAttribute): Make width, height, depth attributes dirty.
        (WebCore::MathMLSpaceElement::createElementRenderer):
        * mathml/MathMLSpaceElement.h: New class for the <mspace> element.
        We define MathML lengths for width, height and depth attributes are on the class and expose
        with the corresponding helper functions via memoization.
        * mathml/MathMLTextElement.cpp: Remove handling of mspace from this class.
        (WebCore::MathMLTextElement::createElementRenderer):
        * mathml/mathtags.in: Change the interface for mspace to use the new class.
        * rendering/mathml/RenderMathMLSpace.cpp: Do not store width/height/depth values on the
        renderer and instead just use the corresponding MathML lengths on the element class.
        (WebCore::RenderMathMLSpace::RenderMathMLSpace): Use MathMLSpaceElement and remove member
        initialization.
        (WebCore::RenderMathMLSpace::computePreferredLogicalWidths): Use spaceWidth().
        (WebCore::RenderMathMLSpace::spaceWidth): Helper function to resolve the width attribute value.
        (WebCore::RenderMathMLSpace::getSpaceHeightAndDepth): Ditto for height and depth.
        (WebCore::RenderMathMLSpace::layoutBlock): Use the helper functions to get the mspace metrics.
        (WebCore::RenderMathMLSpace::firstLineBaseline): Ditto.
        (WebCore::RenderMathMLSpace::updateFromElement): Deleted.
        (WebCore::RenderMathMLSpace::styleDidChange): Deleted.
        * rendering/mathml/RenderMathMLSpace.h: Use MathMLSpaceElement, replace members with helper
        functions and and make element() usable from a const instance.

2016-07-11  Frederic Wang  <fwang@igalia.org>

        Create a MathMLLength struct to handle the parsing of MathML length.
        https://bugs.webkit.org/show_bug.cgi?id=156792

        Reviewed by Brent Fulgham.

        We introduce a structure for MathML lengths that will be used in the future to store the
        parsed values in the MathElement class. We also rewrite the parsing function for MathML
        lengths in order to improve efficiency and code reuse. This function is moved into the
        MathElement class and only the conversion to LayoutUnit remains in the renderer classes.

        No new tests, already covered by existing tests.

        * mathml/MathMLElement.cpp:
        (WebCore::parseNamedSpace): Helper function to parse a named space.
        (WebCore::MathMLElement::parseMathMLLength): Parsing function for MathML lengths.
        * mathml/MathMLElement.h: Declare new function and structure to handle MathML lengths.
        * rendering/mathml/RenderMathMLBlock.cpp:
        (WebCore::toUserUnits): Helper function to resolve a MathML length.
        (WebCore::parseMathMLLength): Remove the old parsing code and just use MathMLElement::parseMathMLLength and toUserUnits instead.
        (WebCore::parseMathMLNamedSpace): Deleted.
        * rendering/mathml/RenderMathMLBlock.h: Remove unused function.

2016-07-11  Frederic Wang  <fwang@igalia.com>

        Add support for @href attribute in MathML
        https://bugs.webkit.org/show_bug.cgi?id=85733

        Reviewed by Brent Fulgham.

        We add support for the href attribute from MathML 3 but ignore the deprecated XLink version.
        We also use the code from HTMLAnchorElement SVGAElement to make MathMLElement with a href
        attribute behave as a link.
        Finally, we adjust mathml.css based on rules from the html and svg user agent stylesheets.

        Tests: mathml/mathml-in-html5/href-click-1.html
               mathml/mathml-in-html5/href-click-2.html
               mathml/presentation/href-enter.html
               mathml/presentation/href-style.html
               mathml/presentation/maction-toggle-href.html
               mathml/presentation/semantics-href.html

        * css/mathml.css:
        (:any-link): Set color and mouse cursor of links.
        (:any-link:active): Set color of active links.
        (:focus): Set outline of focused links.
        * mathml/MathMLElement.cpp:
        (WebCore::MathMLElement::parseAttribute): Parse the href attribute.
        (WebCore::MathMLElement::willRespondToMouseClickEvents): Based on HTMLAnchorElement/SVGAElement.
        (WebCore::MathMLElement::defaultEventHandler): Based on HTMLAnchorElement/SVGAElement.
        (WebCore::MathMLElement::canStartSelection): Based on HTMLAnchorElement/SVGAElement.
        (WebCore::MathMLElement::isFocusable): Based on HTMLAnchorElement/SVGAElement.
        (WebCore::MathMLElement::isKeyboardFocusable): Based on HTMLAnchorElement/SVGAElement.
        (WebCore::MathMLElement::isMouseFocusable): Based on HTMLAnchorElement/SVGAElement.
        (WebCore::MathMLElement::isURLAttribute): Based on HTMLAnchorElement/SVGAElement.
        (WebCore::MathMLElement::supportsFocus): Based on HTMLAnchorElement/SVGAElement.
        (WebCore::MathMLElement::tabIndex): Based on HTMLAnchorElement/SVGAElement.
        * mathml/MathMLElement.h: Define new members.
        * mathml/MathMLSelectElement.cpp:
        (WebCore::MathMLSelectElement::willRespondToMouseClickEvents): We also verify whether
        the parent class will respond.
        * mathml/mathattrs.in: Add href attribute.

2016-07-11  Sam Weinig  <sam@webkit.org>

        Speech Synthesis: getting list of voices no longer works
        <rdar://problem/22954120>
        https://bugs.webkit.org/show_bug.cgi?id=159656

        Reviewed by Tim Horton.

        * platform/PlatformSpeechSynthesizer.h:
        * platform/mac/PlatformSpeechSynthesizerMac.mm:
        Default initialize m_voiceListIsInitialized to false so it is
        initialized on both Mac and iOS. Remove the explicit initialization
        from the Mac.

2016-07-11  Simon Fraser  <simon.fraser@apple.com>

        <rdar://problem/27285599> REGRESSION: Assertion under CertificateInfo::trust() every time I focus a text field

        Reviewed by Sam Weinig.

        The assertion added to CertificateInfo::trust() in r203040 is wrong, and is triggered when
        focusing a form field via calls to -[WKWebProcessPlugInFrame _serverTrust], so remove it.

        * platform/network/cf/CertificateInfo.h:
        (WebCore::CertificateInfo::trust):

2016-07-11  Simon Fraser  <simon.fraser@apple.com>

        Deleting in a text input inside an iframe causes the page to scroll incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=159654
        rdar://problem/26805722

        Reviewed by Zalan Bujtas.

        Editor::revealSelectionAfterEditingOperation() needs the same iOS-specific reveal
        behavior as was added for typing in r202295.

        Test: fast/forms/ios/delete-in-input-in-iframe.html

        * editing/Editor.cpp:
        (WebCore::Editor::revealSelectionAfterEditingOperation):

2016-07-11  Andy Estes  <aestes@apple.com>

        Fix indentation in FrameLoaderTypes.h
        https://bugs.webkit.org/show_bug.cgi?id=159650

        Reviewed by Brady Eidson.

        * loader/FrameLoaderTypes.h:

2016-07-11  Myles C. Maxfield  <mmaxfield@apple.com>

        Honor the second argument to FontFaceSet.load and FontFaceSet.check
        https://bugs.webkit.org/show_bug.cgi?id=159607
        <rdar://problem/27284902>

        Reviewed by Zalan Bujtas.

        This second argument is used in conjunction with the unicode-range CSS property, so that
        loading from a FontFaceSet only loads the fonts which actually match the characters given.
        Previously, we hadn't implemented proper support for this unicode-range property, but now
        that we have implemented it, we should honor this second argument.

        Test: fast/text/unicode-range-javascript.html

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::rangesMatchCodePoint):
        * css/CSSFontFace.h:
        * css/CSSFontFaceSet.cpp:
        (WebCore::codePointsFromString):
        (WebCore::CSSFontFaceSet::matchingFaces):

2016-07-11  Zalan Bujtas  <zalan@apple.com>

        Unable to edit fields or drag to select text in Dashboard widgets.
        https://bugs.webkit.org/show_bug.cgi?id=159647
        <rdar://problem/26941698>

        Reviewed by Brent Fulgham.

        RenderObject::computeAbsoluteRepaintRect's first paramenter is no longer in/out. Use the return
        value to set the clip on the dashboard region.

        Not testable.

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::addAnnotatedRegions):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::addAnnotatedRegions):

2016-07-11  Chris Dumez  <cdumez@apple.com>

        Potential null dereference under DocumentLoader::mainReceivedError()
        https://bugs.webkit.org/show_bug.cgi?id=159640
        <rdar://problem/27283372>

        Reviewed by Brady Eidson.

        Move frameLoader() null check a bit earlier in DocumentLoader::mainReceivedError()
        as it was dereferenced before the check.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::mainReceivedError):

2016-07-11  Enrica Casucci  <enrica@apple.com>

        Add synthetic click origin to WKNavigationAction.
        https://bugs.webkit.org/show_bug.cgi?id=159584
        rdar://problem/25610422

        Reviewed by Tim Horton.

        Adding plumbing code to pass synthetic click type
        through WebCore.

        * dom/Element.cpp:
        (WebCore::Element::dispatchMouseEvent):
        (WebCore::Element::dispatchMouseForceWillBegin):
        * dom/MouseEvent.cpp:
        (WebCore::MouseEvent::create):
        (WebCore::MouseEvent::MouseEvent):
        (WebCore::MouseEvent::initMouseEvent):
        (WebCore::MouseEvent::cloneFor):
        * dom/MouseEvent.h:
        (WebCore::MouseEvent::createForBindings):
        (WebCore::MouseEvent::button):
        (WebCore::MouseEvent::syntheticClickType):
        (WebCore::MouseEvent::buttonDown):
        (WebCore::MouseEvent::setRelatedTarget):
        * dom/SimulatedClick.cpp:
        * dom/WheelEvent.cpp:
        (WebCore::WheelEvent::WheelEvent):
        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::showContextMenuAt):
        * page/DragController.cpp:
        (WebCore::createMouseEvent):
        (WebCore::DragController::DragController):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::dispatchDragEvent):
        (WebCore::EventHandler::sendContextMenuEventForKey):
        (WebCore::EventHandler::fakeMouseMoveEventTimerFired):
        * platform/PlatformMouseEvent.h:
        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
        (WebCore::PlatformMouseEvent::clickCount):
        (WebCore::PlatformMouseEvent::modifierFlags):
        (WebCore::PlatformMouseEvent::force):
        (WebCore::PlatformMouseEvent::syntheticClickType):
        * replay/SerializationMethods.cpp:
        (JSC::EncodingTraits<PlatformMouseEvent>::decodeValue):

2016-07-11  Anders Carlsson  <andersca@apple.com>

        Able to open multiple payment sheets in Safari at the same time
        https://bugs.webkit.org/show_bug.cgi?id=159637
        rdar://problem/26411339

        Reviewed by Beth Dakin.

        Fold PaymentCoordinator::showPaymentUI into PaymentCoordinator::beginPaymentSession and
        change the return value of the latter member function to a bool to indicate whether the
        payment UI could be shown (or whether it's already showing).

        * Modules/applepay/ApplePaySession.cpp:
        (WebCore::ApplePaySession::begin):
        Check the return value of beginPaymentSession.

        * Modules/applepay/PaymentCoordinator.cpp:
        (WebCore::PaymentCoordinator::beginPaymentSession):
        This now takes a payment session and returns a boolean.
        (WebCore::PaymentCoordinator::showPaymentUI): Deleted.

        * Modules/applepay/PaymentCoordinator.h:
        * Modules/applepay/PaymentCoordinatorClient.h:
        * loader/EmptyClients.cpp:
        The showPaymentUI client function now returns a bool.

2016-07-11  Nan Wang  <n_wang@apple.com>

        AX: Crash when backspacing in number field with spin button
        https://bugs.webkit.org/show_bug.cgi?id=157830

        Reviewed by Chris Fleizach.

        It's possible to access spin button parts after they've been detached from their parent, which can lead to crashes.
        This adds in a number of redundant safeguards to prevent this and other cases in the future.

        Test: accessibility/spinbutton-crash.html

        * accessibility/AccessibilitySpinButton.cpp:
        (WebCore::AccessibilitySpinButton::incrementButton):
        (WebCore::AccessibilitySpinButton::decrementButton):
        (WebCore::AccessibilitySpinButton::addChildren):

2016-07-11  Chris Dumez  <cdumez@apple.com>

        Possible null dereference under EventHandler::dispatchMouseEvent()
        https://bugs.webkit.org/show_bug.cgi?id=159632
        <rdar://problem/27247619>

        Reviewed by Andreas Kling.

        FrameSelection::toNormalizedRange() can return null even when FrameSelection::isRange()
        returns true so add a null check.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::dispatchMouseEvent):

2016-07-11  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r203064.
        https://bugs.webkit.org/show_bug.cgi?id=159642

        This change causes LayoutTest crashes on WK1 ASan (Requested
        by ryanhaddad on #webkit).

        Reverted changeset:

        "Use refs for ResourceLoaders"
        https://bugs.webkit.org/show_bug.cgi?id=159592
        http://trac.webkit.org/changeset/203064

2016-07-11  Brent Fulgham  <bfulgham@apple.com>

        [WebGL] Check for existing buffer exists for enabled vertex array attributes before permitting glDrawArrays to execute
        https://bugs.webkit.org/show_bug.cgi?id=159590
        <rdar://problem/26865535>

        Reviewed by Dean Jackson.

        Test: fast/canvas/webgl/webgl-drawarrays-crash-2.html

        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::validateVertexAttributes): If enabled array buffer attributes exist,
        ensure that an array buffer has been bound.

2016-07-11  Nan Wang  <n_wang@apple.com>

        AX: WKWebView should have API to prevent pinch-to-zoom always being allowed
        https://bugs.webkit.org/show_bug.cgi?id=158364

        Reviewed by Anders Carlsson.

        Removed the internals settings for viewport force always user scalable.

        Changes are covered in modified tests.

        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::Internals):
        (WebCore::Internals::composedTreeAsText):
        (WebCore::Internals::setLinkPreloadSupport):
        (WebCore::Internals::setViewportForceAlwaysUserScalable): Deleted.
        * testing/Internals.h:
        * testing/Internals.idl:

2016-07-11  Frederic Wang  <fwang@igalia.com>

        Use parameters from the OpenType MATH table for <munderover>
        https://bugs.webkit.org/show_bug.cgi?id=155756

        Reviewed by Brent Fulgham.

        We follow the description from the MathML in HTML5 implementation
        to improve the layout of <munderover> using some constants from the MATH table.

        Tests: imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-1.html
               imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-2.html
               imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-3.html
               imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-4.html
               mathml/presentation/attributes-accent-accentunder-dynamic.html

        * mathml/mathattrs.in: Add accentunder attribute.
        * rendering/mathml/MathMLOperatorDictionary.h: Remove FIXME comment.
        * rendering/mathml/RenderMathMLUnderOver.cpp:
        (WebCore::RenderMathMLUnderOver::hasAccent): Helper function to determine whether
        the over/under script should be treated as an accent.
        (WebCore::RenderMathMLUnderOver::getVerticalParameters): Helper function to read
        some vertical parameters from the MATH table.
        (WebCore::RenderMathMLUnderOver::layoutBlock): Take into account the new vertical
        parameters for the layout of <munderover>.
        * rendering/mathml/RenderMathMLUnderOver.h: Define new helper functions.

2016-07-11  Frederic Wang  <fwang@igalia.com>

        Use Stack* parameters from the OpenType MATH table
        https://bugs.webkit.org/show_bug.cgi?id=155714

        Reviewed by Brent Fulgham.

        Test: mathml/mathml-in-html5/frac-parameters-2.html

        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::updateFromElement): Set the stack parameters when
        the line thickness is zero.
        (WebCore::RenderMathMLFraction::layoutBlock): Correctly set the <mfrac> ascent and
        the denominator vertical offset when the line thickness is zero.
        (WebCore::RenderMathMLFraction::paint): Early return when we actually do not need to
        paint any fraction bar.
        * rendering/mathml/RenderMathMLFraction.h: Define an isStack helper function and define
        members corresponding to stack parameters.

2016-07-11  Frederic Wang  <fwang@igalia.com>

        Add support for mathvariants that cannot be emulated via CSS.
        https://bugs.webkit.org/show_bug.cgi?id=108778

        Reviewed by Brent Fulgham.

        Tests: mathml/mathml-in-html5/mathvariant-transforms-1.html
               mathml/mathml-in-html5/mathvariant-transforms-2.html
               mathml/presentation/mathvariant-inheritance.html
               mathml/presentation/mathvariant-tokens.html

        We remove the old code to emulate partial mathvariant support via CSS and add support
        for all mathvariant values using the technique used for implicit italic on <mi> element.
        We also rely on the MathMLStyle class introduced earlier to support custome MathML style
        and manage inheritance of mathvariant values.
        The function that tries and converts one base character into a transformed mathvariant
        character is based on similar code from Gecko:
        http://hg.mozilla.org/mozilla-central/file/tip/layout/generic/MathMLTextRunFactory.cpp
        Note that we only support transform on token elements with a single character, which
        should cover the most important use cases.

        * css/mathml.css: Remove the CSS rules to emulate some mathvariant values.
        (math[mathvariant="normal"], mstyle[mathvariant="normal"], mo[mathvariant="normal"], mn[mathvariant="normal"], mi[mathvariant="normal"], mtext[mathvariant="normal"], mspace[mathvariant="normal"], ms[mathvariant="normal"]): Deleted.
        (math[mathvariant="bold"], mstyle[mathvariant="bold"], mo[mathvariant="bold"], mn[mathvariant="bold"], mi[mathvariant="bold"], mtext[mathvariant="bold"], mspace[mathvariant="bold"], ms[mathvariant="bold"]): Deleted.
        (math[mathvariant="italic"], mstyle[mathvariant="italic"], mo[mathvariant="italic"], mn[mathvariant="italic"], mi[mathvariant="italic"], mtext[mathvariant="italic"], mspace[mathvariant="italic"], ms[mathvariant="italic"]): Deleted.
        (math[mathvariant="bold-italic"], mstyle[mathvariant="bold-italic"], mo[mathvariant="bold-italic"], mn[mathvariant="bold-italic"], mi[mathvariant="bold-italic"], mtext[mathvariant="bold-italic"], mspace[mathvariant="bold-italic"], ms[mathvariant="bold-italic"]): Deleted.
        * mathml/MathMLInlineContainerElement.cpp: We resolve mathml style when mathvariant changes.
        (WebCore::MathMLInlineContainerElement::parseAttribute):
        * mathml/MathMLMathElement.cpp: ditto.
        (WebCore::MathMLMathElement::parseAttribute):
        * mathml/MathMLTextElement.cpp: ditto.
        (WebCore::MathMLTextElement::parseAttribute):
        * rendering/mathml/MathMLStyle.cpp: Add mathvariant property to the MathML style.
        (WebCore::MathMLStyle::MathMLStyle): Init mathvariant to none.
        (WebCore::MathMLStyle::getMathMLStyle): Helper function to retrieve the MathML style on a renderer.
        (WebCore::MathMLStyle::updateStyleIfNeeded): Take into account change of mathvariant.
        (WebCore::MathMLStyle::parseMathVariant): Helper function to parse a mathvariant attribute.
        (WebCore::MathMLStyle::resolveMathMLStyle): Take into account mathvariant value: it is None
        by default, inherited and can be modified via an attribute on <math>, <mstyle> or token
        elements. We also refactor a bit to share logic between displaystyle and mathvariant.
        (WebCore::MathMLStyle::setDisplayStyle): Deleted.
        * rendering/mathml/MathMLStyle.h: Add mathvariant members and update declarations.
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::updateTokenContent): Call the function from the parent class
        to consider mathvariant on <mo>.
        * rendering/mathml/RenderMathMLToken.cpp:
        We implement a mathVariant function to transform a base character into its transformed mathvariant:
        - There are some regularity that allows to perform this via simple linear transforms.
        - However, there are also many exceptions and we rely on some sorted MathVariantMapping
        tables to handle these cases.
        (WebCore::ExtractKey): Helper function to perform binary searches on MathVariant tables.
        (WebCore::MathVariantMappingSearch): ditto.
        (WebCore::mathVariant): New function to perform mathvariant transforms.
        (WebCore::RenderMathMLToken::updateMathVariantGlyph): Use the mathVariant function to
        perform all transformations, not just the italic one.
        (WebCore::transformToItalic): Deleted. Replaced with the more general mathVariant function.

2016-07-11  Jeremy Jones  <jeremyj@apple.com>

        Pause small video elements when returning to inline.
        https://bugs.webkit.org/show_bug.cgi?id=159535

        Reviewed by Jer Noble.

        Will add a test in a later commit.

        When exiting fullscreen, don't allow playback to continue inline if video is too small.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::isVideoTooSmallForInlinePlayback): Added.
        (WebCore::HTMLMediaElement::exitFullscreen): Pause if video is too small.
        * html/HTMLMediaElement.h:

2016-07-11  Nael Ouedraogo  <nael.ouedraogo@crf.canon.fr>

        toNative functions in JSDOMBinding.h should take an ExecState reference instead of pointer
        https://bugs.webkit.org/show_bug.cgi?id=159298

        Reviewed by Youenn Fablet.

        Pass ExecState by reference instead of pointer.

        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::idbKeyPathFromValue):
        * bindings/js/JSBlobCustom.cpp:
        (WebCore::constructJSBlob):
        * bindings/js/JSDOMBinding.h: Pass ExecState by reference instead of pointer.
        (WebCore::toJSSequence):
        (WebCore::NativeValueTraits<String>::nativeValue):
        (WebCore::NativeValueTraits<unsigned>::nativeValue):
        (WebCore::NativeValueTraits<float>::nativeValue):
        (WebCore::NativeValueTraits<double>::nativeValue):
        (WebCore::toNativeArray):
        (WebCore::toNativeArguments):
        * bindings/js/JSDOMConvert.h:
        (WebCore::Converter<Vector<T>>::convert):
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        * bindings/js/JSFileCustom.cpp:
        (WebCore::constructJSFile):
        * bindings/js/JSMessagePortCustom.cpp:
        (WebCore::fillMessagePortArray):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck):
        (JSValueToNative):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalSequence):
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArray):
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArrayIsEmpty):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod7):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod9):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod10):
        (WebCore::jsTestObjPrototypeFunctionMethodWithUnsignedLongSequence):
        (WebCore::jsTestObjPrototypeFunctionStringArrayFunction):
        (WebCore::jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence):
        (WebCore::jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence2):
        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithSequence):
        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithArray):
        (WebCore::jsTestObjPrototypeFunctionVariadicStringMethod):
        (WebCore::jsTestObjPrototypeFunctionVariadicDoubleMethod):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::constructJSTestOverloadedConstructors5):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::jsTestTypedefsPrototypeFunctionFunc):
        (WebCore::jsTestTypedefsPrototypeFunctionNullableArrayArg):
        (WebCore::jsTestTypedefsPrototypeFunctionStringArrayFunction):
        (WebCore::jsTestTypedefsPrototypeFunctionStringArrayFunction2):

2016-07-08  Alex Christensen  <achristensen@webkit.org>

        Use refs for ResourceLoaders
        https://bugs.webkit.org/show_bug.cgi?id=159592

        Reviewed by Chris Dumez.

        No new tests.  No change in behavior except a fixed memory leak in WebKit1.

        * loader/LoaderStrategy.h:
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::finishNetworkLoad):
        (WebCore::ResourceLoader::setDefersLoading):
        (WebCore::ResourceLoader::frameLoader):
        (WebCore::ResourceLoader::willSwitchToSubstituteResource):
        (WebCore::ResourceLoader::willSendRequestInternal):

2016-07-11  Fujii Hironori  <Hironori.Fujii@sony.com>

        Using dpi unit in sizes attribute raises SIGSEGV
        https://bugs.webkit.org/show_bug.cgi?id=159412

        Reviewed by Darin Adler.

        CSSParser::sourceSize returns a invalid CSSParser::SourceSize
        whose length is a null value for a dpi unit value.  Because
        CSSParserValue::createCSSValue returns null for a dpi value.

        Tests:
            fast/dom/HTMLImageElement/sizes/image-sizes-invalids.html
            imported/w3c/web-platform-tests/html/semantics/embedded-content/the-img-element/sizes/parse-a-sizes-attribute.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::sourceSize): Create a CSSPrimitiveValue of
        CSS_UNKNOWN if CSSParserValue::createCSSValue returns null.

2016-07-11  Olivier Blin  <olivier.blin@softathome.com>

        Red and blue colors are swapped in video rendered through WebGL when GSTREAMER_GL is enabled
        https://bugs.webkit.org/show_bug.cgi?id=159621

        Reviewed by Philippe Normand.

        When a video is rendered through WebGL, and GSTREAMER_GL is enabled, red and blue colors are swapped.
        This occurs for example with the following videos:
        http://www.scirra.com/labs/bugs/webglvideo/
        http://www.dailymotion.com/embed/video/x4jiicp?autoplay=1

        This is because ImageGStreamerCairo expects video frames in either
        BGRA or ARGB, while when GSTREAMER_GL is enabled,
        createVideoSinkGL() forces a RGBA format.

        Without GSTREAMER_GL, the rendering is fine since
        VideoSinkGStreamer uses either BGRA or ARGB.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::createVideoSinkGL):

2016-07-11  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] remove WEBKIT_DEBUG support
        https://bugs.webkit.org/show_bug.cgi?id=159553

        Reviewed by Xabier Rodriguez-Calvar.

        Remove the *_MEDIA_MESSAGE macros specific to the GStreamer
        platform code and replace them with standard GST_DEBUG macros. In
        Debug builds the WEBKIT_DEBUG=Media logs now only contain logs
        related with the cross-platform Media element code. If GStreamer
        logs are needed, the GST_DEBUG=webkit*:5 environment variable can
        be used.

        * platform/graphics/gstreamer/GStreamerUtilities.h:
        * platform/graphics/gstreamer/InbandTextTrackPrivateGStreamer.cpp:
        (WebCore::InbandTextTrackPrivateGStreamer::notifyTrackOfSample):
        (WebCore::InbandTextTrackPrivateGStreamer::notifyTrackOfStreamChanged):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::setAudioStreamProperties):
        (WebCore::MediaPlayerPrivateGStreamer::load):
        (WebCore::MediaPlayerPrivateGStreamer::commitLoad):
        (WebCore::MediaPlayerPrivateGStreamer::playbackPosition):
        (WebCore::MediaPlayerPrivateGStreamer::changePipelineState):
        (WebCore::MediaPlayerPrivateGStreamer::play):
        (WebCore::MediaPlayerPrivateGStreamer::pause):
        (WebCore::MediaPlayerPrivateGStreamer::duration):
        (WebCore::MediaPlayerPrivateGStreamer::seek):
        (WebCore::MediaPlayerPrivateGStreamer::updatePlaybackRate):
        (WebCore::MediaPlayerPrivateGStreamer::paused):
        (WebCore::MediaPlayerPrivateGStreamer::newTextSample):
        (WebCore::MediaPlayerPrivateGStreamer::handleMessage):
        (WebCore::MediaPlayerPrivateGStreamer::processBufferingStats):
        (WebCore::MediaPlayerPrivateGStreamer::fillTimerFired):
        (WebCore::MediaPlayerPrivateGStreamer::maxTimeSeekable):
        (WebCore::MediaPlayerPrivateGStreamer::maxTimeLoaded):
        (WebCore::MediaPlayerPrivateGStreamer::didLoadingProgress):
        (WebCore::MediaPlayerPrivateGStreamer::totalBytes):
        (WebCore::MediaPlayerPrivateGStreamer::asyncStateChangeDone):
        (WebCore::MediaPlayerPrivateGStreamer::updateStates):
        (WebCore::MediaPlayerPrivateGStreamer::loadNextLocation):
        (WebCore::MediaPlayerPrivateGStreamer::setDownloadBuffering):
        (WebCore::MediaPlayerPrivateGStreamer::createAudioSink):
        (WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::naturalSize):
        (WebCore::MediaPlayerPrivateGStreamerBase::setVolume):
        (WebCore::MediaPlayerPrivateGStreamerBase::volumeChangedCallback):
        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
        (WebCore::MediaPlayerPrivateGStreamerBase::createVideoSinkGL):
        (WebCore::MediaPlayerPrivateGStreamerBase::setStreamVolumeElement):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.cpp:
        (WebCore::MediaPlayerPrivateGStreamerOwr::~MediaPlayerPrivateGStreamerOwr):
        (WebCore::MediaPlayerPrivateGStreamerOwr::play):
        (WebCore::MediaPlayerPrivateGStreamerOwr::pause):
        (WebCore::MediaPlayerPrivateGStreamerOwr::currentTime):
        (WebCore::MediaPlayerPrivateGStreamerOwr::load):
        (WebCore::MediaPlayerPrivateGStreamerOwr::internalLoad):
        (WebCore::MediaPlayerPrivateGStreamerOwr::stop):
        (WebCore::MediaPlayerPrivateGStreamerOwr::createGSTAudioSinkBin):
        (WebCore::MediaPlayerPrivateGStreamerOwr::trackEnded):
        (WebCore::MediaPlayerPrivateGStreamerOwr::trackMutedChanged):
        (WebCore::MediaPlayerPrivateGStreamerOwr::trackSettingsChanged):
        (WebCore::MediaPlayerPrivateGStreamerOwr::trackEnabledChanged):
        * platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:
        (WebCore::TrackPrivateBaseGStreamer::getLanguageCode):
        (WebCore::TrackPrivateBaseGStreamer::getTag):

2016-07-11  Eric Carlson  <eric.carlson@apple.com>

        Add a test for media control dropoff
        https://bugs.webkit.org/show_bug.cgi?id=151287
        <rdar://problem/23544666>

        Reviewed by Antoine Quint.

        Test: media/controls/inline-elements-dropoff-order.html

        * Modules/mediacontrols/mediaControlsApple.js: Expose more state to testing.
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setAllowsAirPlayForMediaPlayback): Renamed from setWirelessPlaybackDisabled.
        (WebCore::InternalSettings::setWirelessPlaybackDisabled): Deleted.
        * testing/InternalSettings.h:
        * testing/InternalSettings.idl:


2016-07-11  Philippe Normand  <pnormand@igalia.com>

        [GStreamer][GL] crash within triggerRepaint
        https://bugs.webkit.org/show_bug.cgi?id=159552

        Reviewed by Xabier Rodriguez-Calvar.

        Ensure the sizeChanged notification is emitted from the main
        thread. When GStreamer-GL rendering is enabled the appsink draw
        callbacks are fired in a non-main thread.

        The WeakPtr support was moved to the player base class so that it
        can be used there as well as in the MediaPlayerPrivateGStreamer
        sub-class.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):
        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer): Deleted.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        (WebCore::MediaPlayerPrivateGStreamer::createWeakPtr): Deleted.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
        (WebCore::MediaPlayerPrivateGStreamerBase::createWeakPtr):

2016-07-10  Chris Dumez  <cdumez@apple.com>

        Setting document.title reuses <title>'s textnode child
        https://bugs.webkit.org/show_bug.cgi?id=28864
        <rdar://problem/7186473>

        Reviewed by Benjamin Poulain.

        Setting document.title should be equivalent to setting the 'textContent'
        IDL attribute of the <title> element:
        - https://html.spec.whatwg.org/multipage/dom.html#document.title

        In particular, this means we should always create a new Text node and
        replace all the <title>'s children with this new Node, as per:
        - https://dom.spec.whatwg.org/#dom-node-textcontent

        Previously, WebKit would in some cases reuse the existing <title>'s
        Text node and merely update its data.

        Firefox and Chrome behave as per the specification so this aligns our
        behavior with other major browsers as well.

        Test: fast/dom/title-setter-new-text-node.html

        * dom/Document.cpp:
        (WebCore::Document::setTitle):
        - Call Node::setTextContent() instead of HTMLTitleElement::setText(),
          as per the specification.
        - Take an ExceptionCode parameter and pass it to Node::setTextContent()
          as it may throw.

        * dom/Document.h:
        * dom/Document.idl:

        * html/HTMLTitleElement.cpp:
        (WebCore::HTMLTitleElement::setText):
        Update implementation of HTMLTitleElement::setText() to call
        setTextContent() as per the specification:
        - https://html.spec.whatwg.org/multipage/semantics.html#dom-title-text

        * html/HTMLTitleElement.h:
        * html/HTMLTitleElement.idl:

        * html/ImageDocument.cpp:
        (WebCore::ImageDocument::finishedParsing):

        * svg/SVGTitleElement.cpp:
        * svg/SVGTitleElement.h:
        Drop setText() setter which was duplicated from HTMLTitleElement::setText()
        now that Document::setTitle() calls SVGTitleElement::setTextContent()
        instead.

2016-07-10  Zalan Bujtas  <zalan@apple.com>

        Fix LogicalSelectionOffsetCaches to work with detached render tree.
        https://bugs.webkit.org/show_bug.cgi?id=159605
        <rdar://problem/27248845>

        Reviewed by Brent Fulgham.

        When the renderer that is being destroyed is on a selection boundary,
        we need to ensure that all its cached pointers across the selection code (e.g. SelectionSubtreeData)
        are getting reset. In order to do that, we call clearSelection() on the RenderView.
        One of the last steps of clearing selection is to collect the selection gaps. Selection gaps uses this
        LogicalSelectionOffsetCaches helper class to collect selection information across blocks.
        LogicalSelectionOffsetCaches normally operates on rooted renderers. However we need to ensure sure that
        it can also handle renderers that are no longer part of the render tree.

        Test: fast/text/selection-on-a-detached-tree.html

        * rendering/LogicalSelectionOffsetCaches.h:
        (WebCore::LogicalSelectionOffsetCaches::ContainingBlockInfo::setBlock):
        (WebCore::LogicalSelectionOffsetCaches::ContainingBlockInfo::logicalLeftSelectionOffset):
        (WebCore::LogicalSelectionOffsetCaches::ContainingBlockInfo::logicalRightSelectionOffset):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::logicalLeftSelectionOffset):
        (WebCore::RenderBlock::logicalRightSelectionOffset):

2016-07-10  Chris Dumez  <cdumez@apple.com>

        adoptNode() changes css class to lowercase for document loaded with XHR responseType = "document"
        https://bugs.webkit.org/show_bug.cgi?id=159555
        <rdar://problem/27252541>

        Reviewed by Benjamin Poulain.

        Follow-up on r203018 which was incomplete. We need to update ElementData's
        m_classNames / m_idForStyleResolution when the source document is in strict
        mode and the destination document is in quirks mode as well.

        Test: fast/dom/Document/adoptNode-quirks-mismatch2.html

        * dom/Element.cpp:
        (WebCore::Element::didMoveToNewDocument):

2016-07-10  Sam Weinig  <sam@webkit.org>

        Rename isEmojiModifier to isEmojiFitzpatrickModifier to better capture its function
        https://bugs.webkit.org/show_bug.cgi?id=159610

        Reviewed by Dan Bernstein.

        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::characterRangeCodePath):
        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::advanceByCombiningCharacterSequence):
        Update for rename.

        * platform/text/CharacterProperties.h:
        (WebCore::isEmojiGroupCandidate):
        (WebCore::isEmojiFitzpatrickModifier):
        (WebCore::isVariationSelector):
        Rename isEmojiModifier -> isEmojiFitzpatrickModifier. Also add some comments
        explaining what the characters these predicate act on to demystify them a bit.

        * rendering/RenderText.cpp:
        (WebCore::RenderText::previousOffsetForBackwardDeletion):
        Update for rename and rename a related variable.

2016-07-10  Alex Christensen  <achristensen@webkit.org>

        Fix client certificate authentication after r200463
        https://bugs.webkit.org/show_bug.cgi?id=159574
        <rdar://problem/26931006>

        Reviewed by Sam Weinig.

        No new tests.  We really need a test for this

        * platform/network/cf/CertificateInfo.h:
        (WebCore::CertificateInfo::CertificateInfo):
        (WebCore::CertificateInfo::trust):
        Make sure we only get the trust for Trust type CertificateInfos.  
        If we mix up our types, we get unexpected nullptrs, which will cause authentication to fail.

2016-07-10  Myles C. Maxfield  <mmaxfield@apple.com>

        Fix Windows build after r203038

        Unreviewed.

        * platform/text/TextAllInOne.cpp:

2016-07-10  Myles C. Maxfield  <mmaxfield@apple.com>

        Move breaking iterator code to WTF
        https://bugs.webkit.org/show_bug.cgi?id=159594

        Reviewed by Alex Christensen.

        This is in preparation for giving StringView a GraphemeClusters iterator.
        Such an interator needs to be implemented on top of our breaking iterator
        code.

        No new tests because there is no behavior change.

        * CMakeLists.txt:
        * PlatformEfl.cmake:
        * PlatformGTK.cmake:
        * PlatformMac.cmake:
        * PlatformWin.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/CharacterData.cpp:
        * editing/TextCheckingHelper.cpp:
        * editing/TextIterator.cpp:
        * editing/VisibleUnits.cpp:
        * html/HTMLInputElement.cpp:
        * html/HTMLTextAreaElement.cpp:
        * html/InputType.cpp:
        * html/TextFieldInputType.cpp:
        * html/TextInputType.cpp:
        * platform/LocalizedStrings.cpp:
        * platform/graphics/StringTruncator.cpp:
        * platform/graphics/cg/ColorCG.cpp:
        (WTF::RetainPtr<CGColorRef>>::createValueForKey):
        (WebCore::RetainPtr<CGColorRef>>::createValueForKey): Deleted.
        * platform/graphics/mac/ComplexTextController.cpp:
        * platform/text/LineBreakIteratorPoolICU.h:
        (WebCore::LineBreakIteratorPool::LineBreakIteratorPool): Deleted.
        (WebCore::LineBreakIteratorPool::sharedPool): Deleted.
        (WebCore::LineBreakIteratorPool::makeLocaleWithBreakKeyword): Deleted.
        (WebCore::LineBreakIteratorPool::take): Deleted.
        (WebCore::LineBreakIteratorPool::put): Deleted.
        * platform/text/TextBoundaries.cpp:
        * platform/text/TextBreakIterator.cpp:
        (WebCore::initializeIterator): Deleted.
        (WebCore::initializeIteratorWithRules): Deleted.
        (WebCore::setTextForIterator): Deleted.
        (WebCore::setContextAwareTextForIterator): Deleted.
        (WebCore::wordBreakIterator): Deleted.
        (WebCore::sentenceBreakIterator): Deleted.
        (WebCore::cursorMovementIterator): Deleted.
        (WebCore::acquireLineBreakIterator): Deleted.
        (WebCore::releaseLineBreakIterator): Deleted.
        (WebCore::mapLineIteratorModeToRules): Deleted.
        (WebCore::isCJKLocale): Deleted.
        (WebCore::openLineBreakIterator): Deleted.
        (WebCore::closeLineBreakIterator): Deleted.
        (WebCore::compareAndSwapNonSharedCharacterBreakIterator): Deleted.
        (WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator): Deleted.
        (WebCore::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator): Deleted.
        (WebCore::textBreakFirst): Deleted.
        (WebCore::textBreakLast): Deleted.
        (WebCore::textBreakNext): Deleted.
        (WebCore::textBreakPrevious): Deleted.
        (WebCore::textBreakPreceding): Deleted.
        (WebCore::textBreakFollowing): Deleted.
        (WebCore::textBreakCurrent): Deleted.
        (WebCore::isTextBreak): Deleted.
        (WebCore::isWordTextBreak): Deleted.
        (WebCore::numGraphemeClusters): Deleted.
        (WebCore::numCharactersInGraphemeClusters): Deleted.
        * platform/text/TextBreakIterator.h:
        (WebCore::LazyLineBreakIterator::LazyLineBreakIterator): Deleted.
        (WebCore::LazyLineBreakIterator::~LazyLineBreakIterator): Deleted.
        (WebCore::LazyLineBreakIterator::string): Deleted.
        (WebCore::LazyLineBreakIterator::isLooseCJKMode): Deleted.
        (WebCore::LazyLineBreakIterator::lastCharacter): Deleted.
        (WebCore::LazyLineBreakIterator::secondToLastCharacter): Deleted.
        (WebCore::LazyLineBreakIterator::setPriorContext): Deleted.
        (WebCore::LazyLineBreakIterator::updatePriorContext): Deleted.
        (WebCore::LazyLineBreakIterator::resetPriorContext): Deleted.
        (WebCore::LazyLineBreakIterator::priorContextLength): Deleted.
        (WebCore::LazyLineBreakIterator::get): Deleted.
        (WebCore::LazyLineBreakIterator::resetStringAndReleaseIterator): Deleted.
        (WebCore::NonSharedCharacterBreakIterator::operator TextBreakIterator*): Deleted.
        * platform/text/cf/HyphenationCF.cpp:
        * platform/text/efl/TextBreakIteratorInternalICUEfl.cpp:
        (WebCore::currentSearchLocaleID): Deleted.
        (WebCore::currentTextBreakLocaleID): Deleted.
        * platform/text/enchant/TextCheckerEnchant.cpp:
        * platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp:
        (WebCore::currentSearchLocaleID): Deleted.
        (WebCore::currentTextBreakLocaleID): Deleted.
        * platform/text/icu/UTextProvider.cpp:
        (WebCore::fixPointer): Deleted.
        (WebCore::uTextCloneImpl): Deleted.
        * platform/text/icu/UTextProvider.h:
        (WebCore::uTextProviderContext): Deleted.
        (WebCore::initializeContextAwareUTextProvider): Deleted.
        (WebCore::uTextAccessPinIndex): Deleted.
        (WebCore::uTextAccessInChunkOrOutOfRange): Deleted.
        * platform/text/icu/UTextProviderLatin1.cpp:
        (WebCore::uTextLatin1Clone): Deleted.
        (WebCore::uTextLatin1NativeLength): Deleted.
        (WebCore::uTextLatin1Access): Deleted.
        (WebCore::uTextLatin1Extract): Deleted.
        (WebCore::uTextLatin1MapOffsetToNative): Deleted.
        (WebCore::uTextLatin1MapNativeIndexToUTF16): Deleted.
        (WebCore::uTextLatin1Close): Deleted.
        (WebCore::openLatin1UTextProvider): Deleted.
        (WebCore::textLatin1ContextAwareGetCurrentContext): Deleted.
        (WebCore::textLatin1ContextAwareMoveInPrimaryContext): Deleted.
        (WebCore::textLatin1ContextAwareSwitchToPrimaryContext): Deleted.
        (WebCore::textLatin1ContextAwareMoveInPriorContext): Deleted.
        (WebCore::textLatin1ContextAwareSwitchToPriorContext): Deleted.
        (WebCore::uTextLatin1ContextAwareClone): Deleted.
        (WebCore::uTextLatin1ContextAwareNativeLength): Deleted.
        (WebCore::uTextLatin1ContextAwareAccess): Deleted.
        (WebCore::uTextLatin1ContextAwareExtract): Deleted.
        (WebCore::uTextLatin1ContextAwareClose): Deleted.
        (WebCore::openLatin1ContextAwareUTextProvider): Deleted.
        * platform/text/icu/UTextProviderUTF16.cpp:
        (WebCore::textUTF16ContextAwareGetCurrentContext): Deleted.
        (WebCore::textUTF16ContextAwareMoveInPrimaryContext): Deleted.
        (WebCore::textUTF16ContextAwareSwitchToPrimaryContext): Deleted.
        (WebCore::textUTF16ContextAwareMoveInPriorContext): Deleted.
        (WebCore::textUTF16ContextAwareSwitchToPriorContext): Deleted.
        (WebCore::uTextUTF16ContextAwareClone): Deleted.
        (WebCore::uTextUTF16ContextAwareNativeLength): Deleted.
        (WebCore::uTextUTF16ContextAwareAccess): Deleted.
        (WebCore::uTextUTF16ContextAwareExtract): Deleted.
        (WebCore::uTextUTF16ContextAwareClose): Deleted.
        (WebCore::openUTF16ContextAwareUTextProvider): Deleted.
        * platform/text/mac/TextBoundaries.mm:
        * platform/text/mac/TextBreakIteratorInternalICUMac.mm:
        (WebCore::textBreakLocalePreference): Deleted.
        (WebCore::topLanguagePreference): Deleted.
        (WebCore::getLocale): Deleted.
        (WebCore::getSearchLocale): Deleted.
        (WebCore::currentSearchLocaleID): Deleted.
        (WebCore::getTextBreakLocale): Deleted.
        (WebCore::currentTextBreakLocaleID): Deleted.
        * platform/text/win/TextBreakIteratorInternalICUWin.cpp:
        (WebCore::currentSearchLocaleID): Deleted.
        (WebCore::currentTextBreakLocaleID): Deleted.
        * rendering/RenderBlock.cpp:
        * rendering/RenderText.cpp:
        * rendering/RenderText.h:
        * rendering/SimpleLineLayoutTextFragmentIterator.h:
        * rendering/break_lines.cpp:
        * rendering/break_lines.h:
        * rendering/line/LineBreaker.h:

2016-07-10  Yusuke Suzuki  <utatane.tea@gmail.com>

        [GTK] Crash on https://diafygi.github.io/webcrypto-examples with ENABLE_SUBTLE_CRYPTO
        https://bugs.webkit.org/show_bug.cgi?id=159189

        Reviewed by Michael Catanzaro.

        Currently, we explicitly release the pointers of std::unique_ptr<CryptoAlgorithm> and std::unique_ptr<CryptoAlgorithmParameters>,
        and delete them in the asynchronously called lambdas. In GnuTLS version, callback function is accidentally called twice,
        and it incurs the double free problem.
        In SubtleCrypto code, we have the rule that we must not call failureCallback when the error code is filled in synchronous execution.
        So we drop the failureCallback calling code in GnuTLS subtle crypto code.

        But, rather than carefully handling un-smart-pointer-managed raw pointer's life time, we should use ref counted pointer for that.
        Using the raw delete is error-prone.

        This patch also changes CryptoAlgorithm and CryptoAlgorithmParameters to RefCounted. And use Ref and RefPtr instead.
        The change eliminates the ad-hoc delete code. And now, the lambdas can be called multiple times since once the result of the promise
        is resolved or rejected, subsequent resolve / reject calls are ignored.

        And this patch also fixes the incorrect call to the lambda that is already WTFMoved.

        While we can see several `return WTFMove(...)`, they are necessary since it uses implicit type conversions, like,
        `Ref<A>` => `RefPtr<A>`, and `Ref<Derived>` => `Ref<Base>`.

        * bindings/js/JSCryptoAlgorithmDictionary.cpp:
        (WebCore::createAesCbcParams):
        (WebCore::createAesKeyGenParams):
        (WebCore::createHmacParams):
        (WebCore::createHmacKeyParams):
        (WebCore::createRsaKeyGenParams):
        (WebCore::createRsaKeyParamsWithHash):
        (WebCore::createRsaOaepParams):
        (WebCore::createRsaSsaParams):
        (WebCore::JSCryptoAlgorithmDictionary::createParametersForEncrypt):
        (WebCore::JSCryptoAlgorithmDictionary::createParametersForDecrypt):
        (WebCore::JSCryptoAlgorithmDictionary::createParametersForSign):
        (WebCore::JSCryptoAlgorithmDictionary::createParametersForVerify):
        (WebCore::JSCryptoAlgorithmDictionary::createParametersForDigest):
        (WebCore::JSCryptoAlgorithmDictionary::createParametersForGenerateKey):
        (WebCore::JSCryptoAlgorithmDictionary::createParametersForDeriveKey):
        (WebCore::JSCryptoAlgorithmDictionary::createParametersForDeriveBits):
        (WebCore::JSCryptoAlgorithmDictionary::createParametersForImportKey):
        (WebCore::JSCryptoAlgorithmDictionary::createParametersForExportKey):
        * bindings/js/JSCryptoAlgorithmDictionary.h:
        * bindings/js/JSCryptoKeySerializationJWK.cpp:
        (WebCore::createHMACParameters):
        (WebCore::createRSAKeyParametersWithHash):
        (WebCore::JSCryptoKeySerializationJWK::reconcileAlgorithm):
        * bindings/js/JSCryptoKeySerializationJWK.h:
        * bindings/js/JSSubtleCryptoCustom.cpp:
        (WebCore::createAlgorithmFromJSValue):
        (WebCore::importKey):
        (WebCore::JSSubtleCrypto::importKey):
        (WebCore::JSSubtleCrypto::wrapKey):
        (WebCore::JSSubtleCrypto::unwrapKey):
        * crypto/CryptoAlgorithm.h:
        * crypto/CryptoAlgorithmParameters.h:
        * crypto/CryptoAlgorithmRegistry.cpp:
        (WebCore::CryptoAlgorithmRegistry::create):
        * crypto/CryptoAlgorithmRegistry.h:
        * crypto/CryptoKeySerialization.h:
        * crypto/algorithms/CryptoAlgorithmAES_CBC.cpp:
        (WebCore::CryptoAlgorithmAES_CBC::create):
        * crypto/algorithms/CryptoAlgorithmAES_CBC.h:
        * crypto/algorithms/CryptoAlgorithmAES_KW.cpp:
        (WebCore::CryptoAlgorithmAES_KW::create):
        * crypto/algorithms/CryptoAlgorithmAES_KW.h:
        * crypto/algorithms/CryptoAlgorithmHMAC.cpp:
        (WebCore::CryptoAlgorithmHMAC::create):
        * crypto/algorithms/CryptoAlgorithmHMAC.h:
        * crypto/algorithms/CryptoAlgorithmRSAES_PKCS1_v1_5.cpp:
        (WebCore::CryptoAlgorithmRSAES_PKCS1_v1_5::create):
        * crypto/algorithms/CryptoAlgorithmRSAES_PKCS1_v1_5.h:
        * crypto/algorithms/CryptoAlgorithmRSASSA_PKCS1_v1_5.cpp:
        (WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::create):
        * crypto/algorithms/CryptoAlgorithmRSASSA_PKCS1_v1_5.h:
        * crypto/algorithms/CryptoAlgorithmRSA_OAEP.cpp:
        (WebCore::CryptoAlgorithmRSA_OAEP::create):
        * crypto/algorithms/CryptoAlgorithmRSA_OAEP.h:
        * crypto/algorithms/CryptoAlgorithmSHA1.cpp:
        (WebCore::CryptoAlgorithmSHA1::create):
        * crypto/algorithms/CryptoAlgorithmSHA1.h:
        * crypto/algorithms/CryptoAlgorithmSHA224.cpp:
        (WebCore::CryptoAlgorithmSHA224::create):
        * crypto/algorithms/CryptoAlgorithmSHA224.h:
        * crypto/algorithms/CryptoAlgorithmSHA256.cpp:
        (WebCore::CryptoAlgorithmSHA256::create):
        * crypto/algorithms/CryptoAlgorithmSHA256.h:
        * crypto/algorithms/CryptoAlgorithmSHA384.cpp:
        (WebCore::CryptoAlgorithmSHA384::create):
        * crypto/algorithms/CryptoAlgorithmSHA384.h:
        * crypto/algorithms/CryptoAlgorithmSHA512.cpp:
        (WebCore::CryptoAlgorithmSHA512::create):
        * crypto/algorithms/CryptoAlgorithmSHA512.h:
        * crypto/gnutls/CryptoAlgorithmAES_CBCGnuTLS.cpp:
        (WebCore::CryptoAlgorithmAES_CBC::platformEncrypt):
        (WebCore::CryptoAlgorithmAES_CBC::platformDecrypt):
        * crypto/gnutls/CryptoAlgorithmAES_KWGnuTLS.cpp:
        (WebCore::CryptoAlgorithmAES_KW::platformEncrypt):
        (WebCore::CryptoAlgorithmAES_KW::platformDecrypt):
        * crypto/gnutls/CryptoAlgorithmHMACGnuTLS.cpp:
        (WebCore::CryptoAlgorithmHMAC::platformSign):
        (WebCore::CryptoAlgorithmHMAC::platformVerify):
        * crypto/gnutls/CryptoAlgorithmRSAES_PKCS1_v1_5GnuTLS.cpp:
        (WebCore::CryptoAlgorithmRSAES_PKCS1_v1_5::platformEncrypt):
        (WebCore::CryptoAlgorithmRSAES_PKCS1_v1_5::platformDecrypt):
        * crypto/gnutls/CryptoAlgorithmRSASSA_PKCS1_v1_5GnuTLS.cpp:
        (WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::platformSign):
        (WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::platformVerify):
        * crypto/gnutls/CryptoAlgorithmRSA_OAEPGnuTLS.cpp:
        (WebCore::CryptoAlgorithmRSA_OAEP::platformEncrypt):
        (WebCore::CryptoAlgorithmRSA_OAEP::platformDecrypt):
        * crypto/keys/CryptoKeySerializationRaw.cpp:
        (WebCore::CryptoKeySerializationRaw::reconcileAlgorithm):
        * crypto/keys/CryptoKeySerializationRaw.h:

2016-07-09  Antti Koivisto  <antti@apple.com>

        REGRESSION (r202931): breaks release builds with ASSERT_WITH_SECURITY_IMPLICATION for fuzzing
        https://bugs.webkit.org/show_bug.cgi?id=159599
        rdar://problem/27248835

        Reviewed by Chris Dumez.

        Make RenderStyle::deletionHasBegun() available with ENABLE(SECURITY_ASSERTIONS)

        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::~RenderStyle):
        * rendering/style/RenderStyle.h:
        (WebCore::RenderStyle::deletionHasBegun):

2016-07-09  Youenn Fablet  <youenn@apple.com>

        Make use of PrivateIdentifier to simplify Fetch Headers built-in checks
        https://bugs.webkit.org/show_bug.cgi?id=159554

        Reviewed by Alex Christensen.

        Test: fetch/header-constructor-overriden.html
        Patch does not change visible behavior.

        * Modules/fetch/FetchHeaders.idl: Adding PrivateIdentifier to the Headers constructor.
        * Modules/fetch/FetchHeaders.js:
        (initializeFetchHeaders): Checking directly with @Headers for improved clarity.
        * Modules/fetch/FetchResponse.js: Using @Headers to check whether creating a Headers object or not before
        passsing it to C++ FetchResponse initialize method.
        (initializeFetchResponse):
        * bindings/js/WebCoreBuiltinNames.h: Adding Headers private name.

2016-07-08  Chris Dumez  <cdumez@apple.com>

        adoptNode() changes css class to lowercase for document loaded with XHR responseType = "document"
        https://bugs.webkit.org/show_bug.cgi?id=159555
        <rdar://problem/27252541>

        Reviewed by Ryosuke Niwa.

        When adopting an Element from another document which has a different quirks mode,
        case-sensitivity for id and class attributes differs and we need to correctly
        update members such as ElementData::m_classNames or ElementData::m_idForStyleResolution.

        To address the issue, have Element override didMoveToNewDocument() and call
        attributeChanged() for id and class attributes.

        Test: fast/dom/Document/adoptNode-quirks-mismatch.html

        * dom/Element.cpp:
        (WebCore::Element::didMoveToNewDocument):
        * dom/Element.h:

2016-07-08  Daniel Bates  <dabates@apple.com>

        Cleanup: Remove use of PassRefPtr from class HTMLTableElement
        https://bugs.webkit.org/show_bug.cgi?id=159587

        Reviewed by Chris Dumez.

        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::setCaption): Take a rvalue reference to a RefPtr instead of a PassRefPtr.
        (WebCore::HTMLTableElement::setTHead): Take a rvalue reference to a RefPtr instead of a PassRefPtr. Also
        fix a style nit; add curly braces around the for-loop body since its body is more than a single line.
        (WebCore::HTMLTableElement::createTHead): Use Ref::copyRef() instead of Ref::ptr() to pass the instantiated
        table section to better convey that we are passing a copy of the table section.
        (WebCore::HTMLTableElement::createCaption): Ditto.
        * html/HTMLTableElement.h:

2016-07-08  Daniel Bates  <dabates@apple.com>

        Move shouldInheritSecurityOriginFromOwner() from URL to Document
        https://bugs.webkit.org/show_bug.cgi?id=158987

        Reviewed by Alex Christensen.

        The URL class should not have knowledge of the concept of an origin or the semantics of origin
        inheritance as these are higher level concepts. We should make URL::shouldInheritSecurityOriginFromOwner()
        a static non-member, non-friend function of Document because its implements the origin semantics
        for a Document object as described in section Origin of the HTML5 spec., <https://html.spec.whatwg.org/multipage/browsers.html#origin> (8 July 2016).
        These semantics only apply to Documents.

        No functionality changed. So, no new tests.

        * dom/Document.cpp:
        (WebCore::shouldInheritSecurityOriginFromOwner): Added.
        (WebCore::Document::initSecurityContext): Modified to call WebCore::shouldInheritSecurityOriginFromOwner().
        (WebCore::Document::initContentSecurityPolicy): Ditto.
        * platform/URL.cpp:
        (WebCore::URL::shouldInheritSecurityOriginFromOwner): Deleted.
        * platform/URL.h:

2016-07-08  Daniel Bates  <dabates@apple.com>

        Setting table.tFoot or calling table.createTFoot() should append HTML tfont element to the end of the table
        https://bugs.webkit.org/show_bug.cgi?id=159583
        <rdar://problem/27255292>

        In HTMLTableElement::createTFoot() I inadvertently made use of WTFMove() to move the instantiated
        HTMLTableSectionElement into the argument passed to setTFoot(). We should use Ref::copyRef() instead
        because we want this function to return the instantiated table section.

        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::createTFoot):

2016-07-08  Daniel Bates  <dabates@apple.com>

        Setting table.tFoot or calling table.createTFoot() should append HTML tfont element to the end of the table
        https://bugs.webkit.org/show_bug.cgi?id=159583
        <rdar://problem/27255292>

        Reviewed by Chris Dumez.

        he HTML standard has long since been revised to describe that assignment to property table.tFoot
        or invoking table.createTFoot() will append the HTML tfoot element to the end of the table. This
        behavior is defined in <https://html.spec.whatwg.org/multipage/tables.html#dom-table-tfoot> (8 July 2016)
        and <https://html.spec.whatwg.org/multipage/tables.html#dom-table-createtfoot> for the property
        table.tFoot and table.createTFoot(), respectively. This change makes our behavior match the
        behavior in Mozilla Firefox, Microsoft Edge, Microsoft Internet Explorer 8 and later.

        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::setTFoot): Append <tfoot> to the end of the table. Use RefPtr<>&& instead of PassRefPtr.
        (WebCore::HTMLTableElement::createTFoot): Use RefPtr<>&& instead of PassRefPtr.
        * html/HTMLTableElement.h:

2016-07-08  Jer Noble  <jer.noble@apple.com>

        Crash in layout test /media/video-buffered-range-contains-currentTime.html
        https://bugs.webkit.org/show_bug.cgi?id=159109
        <rdar://problem/26535750>

        Reviewed by Alex Christensen.

        Protect against _dataTasks being mutated and accessed on multiple simultaneous threads with a Lock.

        * platform/network/cocoa/WebCoreNSURLSession.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession dealloc]):
        (-[WebCoreNSURLSession taskCompleted:]):
        (-[WebCoreNSURLSession finishTasksAndInvalidate]):
        (-[WebCoreNSURLSession invalidateAndCancel]):
        (-[WebCoreNSURLSession getTasksWithCompletionHandler:]):
        (-[WebCoreNSURLSession getAllTasksWithCompletionHandler:]):
        (-[WebCoreNSURLSession dataTaskWithRequest:]):
        (-[WebCoreNSURLSession dataTaskWithURL:]):

2016-07-08  Jeremy Jones  <jeremyj@apple.com>

        Prevent fullscreen video dimension state from being reset after configuring.
        https://bugs.webkit.org/show_bug.cgi?id=159578

        Reviewed by Jer Noble.

        This change moves setVideoElement() to after setMediaElement(), since setMediaElement() resets the
        mediaState, undoing the configuration done by setVideoElement().

        This change is fragile, but minimal. The proper, more comprehinsive fix will come later from
        https://bugs.webkit.org/show_bug.cgi?id=159580.

        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        (WebVideoFullscreenControllerContext::setUpFullscreen):

2016-07-08  Andy Estes  <aestes@apple.com>

        [Content Filtering] Load blocked pages more like other error pages are loaded
        https://bugs.webkit.org/show_bug.cgi?id=159485
        <rdar://problem/26014076>

        Reviewed by Brady Eidson.

        Content filter blocked pages were being loaded by cancelling the provisional load of the
        page that was blocked and then scheduling a navigation to the content filter error page.
        Some clients would not expect a new, Web process-initiated provisional navigation to start
        after a cancellation, though, and this would put them in a bad state.
        
        This patch changes blocked page loading to behave more like loading other error pages.
        Specifically:
        1. didFailProvisionalLoad is dispatched with a new, non-cancellation error code.
        2. The blocked page is loaded immediately after dispatching didFailProvisionalLoad, which
           prevents FrameLoader from creating a new back-forward list item for the substitute data load.
        3. A substitute data load initiated by the client for the blocked URL is ignored if
           ContentFilter will display its own error page.
        4. A file: URL is used instead of a custom scheme for the base URL of the blocked page,
           since some clients expect this.

        Updated existing tests to capture frame load delegate callbacks and the back forward list.
        Added new API tests: ContentFiltering.LoadAlternate*.

        * English.lproj/Localizable.strings: Added a WebKitErrorFrameLoadBlockedByContentFilter description.
        * Resources/ContentFilterBlockedPage.html: Added.
        * WebCore.xcodeproj/project.pbxproj: Added ContentFilterBlockedPage.html as a frameowrk resource.
        * loader/ContentFilter.cpp:
        (WebCore::ContentFilter::continueAfterWillSendRequest): Protected m_documentLoader,
        since it might otherwise be deallocated inside ContentFilter::didDecide() if the load is blocked.
        (WebCore::ContentFilter::stopFilteringMainResource): Only set m_state to Stopped if not
        already Blocked, so that we don't forget this ContentFilter was blocked when calling
        cancelMailResourceLoad() in didDecide().
        (WebCore::ContentFilter::continueAfterResponseReceived): Protected m_documentLoader,
        since it might otherwise be deallocated inside ContentFilter::didDecide() if the load is blocked.
        (WebCore::ContentFilter::continueAfterDataReceived): Ditto.
        (WebCore::ContentFilter::continueAfterNotifyFinished): Ditto.
        (WebCore::ContentFilter::didDecide): Moved code from DocumentLoader::contentFilterDidBlock() to here.
        Created a blockedByContentFilterError() and called cancelMainResourceLoad().
        (WebCore::blockedPageURL): Returned a file: URL to ContentFilterBlockedPage.html in WebCore.framework.
        (WebCore::ContentFilter::continueAfterSubstituteDataRequest): If the substitute data load
        is for the same failingURL as the currently-displayed blocked page, ignore it.
        (WebCore::ContentFilter::handleProvisionalLoadFailure): Load the blocked page if m_state is Blocked
        and the ResourceError matches the error we used when previously calling cancelMainResourceLoad().
        (WebCore::ContentFilter::unblockHandler): Deleted.
        (WebCore::ContentFilter::replacementData): Deleted.
        (WebCore::ContentFilter::unblockRequestDeniedScript): Deleted.
        * loader/ContentFilter.h:
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::contentFilter): Returned m_contentFilter.
        (WebCore::DocumentLoader::installContentFilterUnblockHandler): Deleted.
        (WebCore::DocumentLoader::contentFilterDidBlock): Deleted.
        * loader/DocumentLoader.h:
        * loader/EmptyClients.h: Added a default implementation of blockedByContentFilterError().
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::load): If m_loadType was already RedirectWithLockedBackForwardList
        and we are loading subsitute data for a failing URL, continue to use RedirectWithLockedBackForwardList.
        This prevents a new back-forward list item from being created when loading a blocked page in a subframe.
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        Called ContentFilter::handleProvisionalLoadFailure() after dispatchDidFailProvisionalLoad().
        (WebCore::FrameLoader::blockedByContentFilterError): Called FrameLoaderClient::blockedByContentFilterError().
        * loader/FrameLoader.h:
        * loader/FrameLoaderClient.h:
        * loader/NavigationScheduler.cpp:
        (WebCore::ScheduledSubstituteDataLoad::ScheduledSubstituteDataLoad): Deleted.
        (WebCore::NavigationScheduler::scheduleSubstituteDataLoad): Deleted.
        * loader/NavigationScheduler.h:
        * loader/PolicyChecker.cpp:
        (WebCore::PolicyChecker::checkNavigationPolicy): Ignored a substitute data load for a
        failing URL if ContentFilter::continueAfterSubstituteDataRequest() returns false.

2016-07-08  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] The callback passed to document.fonts.ready should always be called
        https://bugs.webkit.org/show_bug.cgi?id=158884

        Reviewed by Dean Jackson.

        The boolean was simply not being reset when loads start.

        Test: fast/text/font-face-set-ready-fire.html

        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::startedLoading):
        * css/FontFaceSet.h:

2016-07-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202944.
        https://bugs.webkit.org/show_bug.cgi?id=159570

        caused some tests to crash under GuardMalloc (Requested by
        estes on #webkit).

        Reverted changeset:

        "[Content Filtering] Load blocked pages more like other error
        pages are loaded"
        https://bugs.webkit.org/show_bug.cgi?id=159485
        http://trac.webkit.org/changeset/202944

2016-07-08  Antti Koivisto  <antti@apple.com>

        Regression(r201805): Crash with <use> resource that has Vary header
        https://bugs.webkit.org/show_bug.cgi?id=159560
        <rdar://problem/27034208>

        Reviewed by Chris Dumez.

        In some situations (SVG <use> element for example) we may try to load resources from frameless documents.
        Such loads always fail. The new vary header verification code path tried to access the frame earlier without
        null check.

        Test: http/tests/cache/vary-frameless-document.html

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::failBeforeStarting):
        (WebCore::addAdditionalRequestHeadersToRequest):

            Null check frame.
            Also move the resource type check here so all callers get the same behavior.

        (WebCore::CachedResource::addAdditionalRequestHeaders):
        (WebCore::CachedResource::load):
        (WebCore::CachedResource::varyHeaderValuesMatch):

2016-07-08  Brady Eidson  <beidson@apple.com>

        Clearing LocalStorage doesn't also delete -wal and -shm files.
        <rdar://problem/27206772> and https://bugs.webkit.org/show_bug.cgi?id=159566

        Reviewed by Brent Fulgham.
        Also helpfully picked over by Andy "Never Forgets" Estes.

        Covered by new API test.

        * WebCore.xcodeproj/project.pbxproj:

        * platform/sql/SQLiteFileSystem.h:

2016-07-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202945.
        https://bugs.webkit.org/show_bug.cgi?id=159565

        The test for this change is failing on all platforms.
        (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "[Font Loading] The callback passed to document.fonts.ready
        should always be called"
        https://bugs.webkit.org/show_bug.cgi?id=158884
        http://trac.webkit.org/changeset/202945

2016-07-08  Nael Ouedraogo  <nael.ouedraogo@crf.canon.fr>

        ExecState should be passed by reference in JS bindings generator for custom constructors
        https://bugs.webkit.org/show_bug.cgi?id=159357

        Reviewed by Youenn Fablet.

        Pass ExecState as a reference instead of pointer in JS bindings
        code for custom constructors.

        * bindings/js/JSAudioContextCustom.cpp:
        (WebCore::constructJSAudioContext):
        * bindings/js/JSBlobCustom.cpp:
        (WebCore::constructJSBlob):
        * bindings/js/JSDOMFormDataCustom.cpp:
        (WebCore::constructJSDOMFormData):
        (WebCore::JSDOMFormData::append):
        * bindings/js/JSDataCueCustom.cpp:
        (WebCore::constructJSDataCue):
        * bindings/js/JSFileCustom.cpp:
        (WebCore::constructJSFile):
        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore::constructJSHTMLElement):
        * bindings/js/JSMediaSessionCustom.cpp:
        (WebCore::constructJSMediaSession):
        * bindings/js/JSMutationObserverCustom.cpp:
        (WebCore::constructJSMutationObserver):
        * bindings/js/JSReadableStreamPrivateConstructors.cpp:
        (WebCore::constructJSReadableStreamController):
        (WebCore::constructJSReadableStreamReader):
        * bindings/js/JSWebKitPointCustom.cpp:
        (WebCore::constructJSWebKitPoint):
        * bindings/js/JSWorkerCustom.cpp:
        (WebCore::constructJSWorker):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateConstructorDefinition):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::construct):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:

2016-07-08  Olivier Blin  <olivier.blin@softathome.com>

        Expose crossOrigin attribute as a static property in HTMLMediaElement
        https://bugs.webkit.org/show_bug.cgi?id=159459

        Reviewed by Chris Dumez.

        The crossOrigin attribute is already used for MediaResourceLoader
        (r119742 and r175050), but it was not exposed as a static property.

        This fixes VR360 support in Dailymotion, since it uses the "in"
        operator to detect if crossOrigin is supported by the
        HTMLVideoElement, in order to enable VR360.

        No new tests, rebaselined existing tests, 150 WPT tests are fixed.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setCrossOrigin):
        (WebCore::HTMLMediaElement::crossOrigin):
        * html/HTMLMediaElement.h:
        * html/HTMLMediaElement.idl:

2016-03-20  Frederic Wang  <fwang@igalia.com>

        Use Fraction* parameters from the OpenType MATH table
        https://bugs.webkit.org/show_bug.cgi?id=155639

        Reviewed by Brent Fulgham.

        We improve the RenderMathMLFraction so minimal vertical shifts and gaps
        from the MATH table (or arbitrary fallback) are used for fractions.
        We also change the interpretation of "thick" and "thin" linethickness values
        to match Gecko's behavior and the one suggested in the MathML in HTML5 implementation note.

        Test: imported/mathml-in-html5/mathml/presentation-markup/fractions/frac-parameters-1.html

        * rendering/mathml/MathMLStyle.cpp:
        (WebCore::MathMLStyle::updateStyleIfNeeded): set NeedsLayout after displaystyle change
        so that dynamic MathML tests still work.
        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::RenderMathMLFraction): Init LayoutUnit members to zero.
        (WebCore::RenderMathMLFraction::updateFromElement):
        Set new members for fraction gaps and shifts using Fraction* constants or some fallback
        values. Change the interpretation of "thick" and "thin".
        (WebCore::RenderMathMLFraction::layoutBlock): Use new constants affecting vertical
        positions of numerator and denominator.
        (WebCore::RenderMathMLFraction::paint): Use m_ascent to set the vertical position
        of the fraction bar.
        (WebCore::RenderMathMLFraction::firstLineBaseline): We just return m_ascent.
        * rendering/mathml/RenderMathMLFraction.h: Make updateFromElement public so that
        it can be used in MathMLStyle. Add LayoutUnit members for the ascent of the fraction
        and for minimal shifts/gaps values.

2016-07-08  Frederic Wang  <fwang@igalia.com>

        Use Radical* constants from the OpenType MATH table.
        https://bugs.webkit.org/show_bug.cgi?id=155638

        Reviewed by Brent Fulgham.

        Test: mathml/mathml-in-html5/root-parameters-1.html

        We make the radical vertical gap depends on displaystyle.
        This is the only remaining step to use all the Radical* constants from the MATH table.
        We also introduce a ruleThicknessFallback function for future use.

        * rendering/mathml/RenderMathMLBlock.h:
        (WebCore::RenderMathMLBlock::ruleThicknessFallback): Add this helper function since that
        calculation is used in several places.
        * rendering/mathml/RenderMathMLRoot.cpp:
        (WebCore::RenderMathMLRoot::updateStyle): Reorganize the way we set constant parameters,
        add more comments and take into account the displaystyle for the vertical gap.

2016-07-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202967.
        https://bugs.webkit.org/show_bug.cgi?id=159556

        This patch caused crashes in https tests on Windows (Requested
        by perarne on #webkit).

        Reverted changeset:

        "[Win] The test http/tests/security/contentSecurityPolicy
        /upgrade-insecure-requests/basic-upgrade.https.html is
        failing."
        https://bugs.webkit.org/show_bug.cgi?id=159510
        http://trac.webkit.org/changeset/202967

2016-07-08  Youenn Fablet  <youenn@apple.com>

        Generate WebCore builtin wrapper files
        https://bugs.webkit.org/show_bug.cgi?id=159461

        Reviewed by Brian Burg.

        No change of behavior.

        Updating build system to handle new built-in generators without modifying WebCoreJSBuiltins* files.
        The generator is now passed all built-ins at once so that wrapper files can be generated.
        Removing WebCoreJSBuiltins* checked-in wrapper files.

        * CMakeLists.txt:
        * DerivedSources.make:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::addBuiltinGlobals):
        * bindings/js/JSDOMGlobalObject.h:
        * bindings/js/WebCoreJSBuiltinInternals.cpp: Removed.
        * bindings/js/WebCoreJSBuiltinInternals.h: Removed.
        * bindings/js/WebCoreJSBuiltins.cpp: Removed.
        * bindings/js/WebCoreJSBuiltins.h: Removed.

2016-07-08  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Inline size is never indefinite during layout
        https://bugs.webkit.org/show_bug.cgi?id=159253

        Reviewed by Sergio Villar Senin.

        The issue is that the inline size of the grid container
        is only indefinite while we're computing the intrinsic sizes.
        During layout we should be able to resolve the percentage tracks
        against that size. This makes Grid Layout compatible with regular blocks
        regarding how inline percentages are resolved.

        The patch passes the SizingOperation enum to RenderGrid::gridTrackSize().
        That way we can know if we're computing the intrinsic sizes or not.

        Test: fast/css-grid-layout/grid-container-percentage-columns.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computeTrackSizesForDirection):
        (WebCore::RenderGrid::computeIntrinsicLogicalWidths):
        (WebCore::RenderGrid::computeIntrinsicLogicalHeight):
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
        (WebCore::RenderGrid::gridTrackSize):
        (WebCore::RenderGrid::minSizeForChild):
        (WebCore::RenderGrid::spanningItemCrossesFlexibleSizedTracks):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctions):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
        (WebCore::RenderGrid::tracksAreWiderThanMinTrackBreadth):
        (WebCore::RenderGrid::rawGridTrackSize): Deleted.
        * rendering/RenderGrid.h:

2016-07-08  Frederic Wang  <fwang@igalia.com>

        Use OpenType MATH constant AxisHeight.
        https://bugs.webkit.org/show_bug.cgi?id=133567

        Reviewed by Brent Fulgham.

        We make RenderMathMLOperator and RenderMathMLTable use the OpenType MATH constant AxisHeight.
        These are the only remaining cases to handle since RenderMathMLFraction already uses that constant.

        Tests: imported/mathml-in-html5/mathml/presentation-markup/operators/mo-axis-height-1.html
              imported/mathml-in-html5/mathml/presentation-markup/tables/table-axis-height.html

        * rendering/mathml/RenderMathMLBlock.cpp: Make RenderMathMLTable use the math axis
        for its vertical alignment and update a bit the comments.
        (WebCore::axisHeight): Move the code in a static function that can be called by
        RenderMathMLBlock and RenderMathMLTable.
        (WebCore::RenderMathMLBlock::mathAxisHeight): Use axisHeight.
        (WebCore::RenderMathMLTable::firstLineBaseline): Ditto.
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::stretchTo):

2016-07-08  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Disallow repeat() in grid-template shorthand
        https://bugs.webkit.org/show_bug.cgi?id=159200

        Reviewed by Sergio Villar Senin.

        As discussed on www-style, "repeat()" notation shouldn't be allowed
        in the ASCII branch of the grid-template shorthand.
        https://lists.w3.org/Archives/Public/www-style/2016May/0193.html

        The patch uses an enum to invalidate "repeat()" when parsing
        the grid-template shorthand.

        Test: fast/css-grid-layout/grid-template-shorthand-get-set.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateColumns): Add enum.
        (WebCore::CSSParser::parseGridTemplateRowsAndAreasAndColumns): Pass "DisallowRepeat"
        when calling parseGridTemplateColumns().
        (WebCore::CSSParser::parseGridTrackList): Use enum to allow/disallow repeat.
        * css/CSSParser.h: Define the new enum and modify method signatures to use it,
        setting it to "AllowRepeat" by default.

2016-07-08  Frederic Wang  <fwang@igalia.com>

        Add support for movablelimits.
        https://bugs.webkit.org/show_bug.cgi?id=155542

        Reviewed by Brent Fulgham.

        Tests: mathml/presentation/displaystyle-1.html
               mathml/presentation/displaystyle-2.html
               mathml/presentation/displaystyle-3.html
               mathml/presentation/mo-movablelimits-default.html
               mathml/presentation/mo-movablelimits-dynamic.html
               mathml/presentation/mo-movablelimits.html

        * mathml/MathMLTextElement.cpp:
        (WebCore::MathMLTextElement::parseAttribute): Take into account change of movablelimits.
        * rendering/mathml/MathMLOperatorDictionary.h: Remove FIXME comment.
        * rendering/mathml/MathMLStyle.cpp:
        (WebCore::MathMLStyle::updateStyleIfNeeded): Force relayout and width computation when a
        displaystyle value change.
        * rendering/mathml/RenderMathMLOperator.h:
        (WebCore::RenderMathMLOperator::shouldMoveLimits): Helper function to test if the operator
        should have his limits moved when used as a base of munder/mover/munderover.
        * rendering/mathml/RenderMathMLScripts.cpp: Allow munderover/munder/mover elements to use
        this class and take the same behavior as the corresponding msubsup/msub/sup except for
        the *scriptshift attributes.
        (WebCore::RenderMathMLScripts::RenderMathMLScripts):
        (WebCore::RenderMathMLScripts::getBaseAndScripts):
        (WebCore::RenderMathMLScripts::computePreferredLogicalWidths):
        (WebCore::RenderMathMLScripts::getScriptMetricsAndLayoutIfNeeded):
        (WebCore::RenderMathMLScripts::layoutBlock):
        * rendering/mathml/RenderMathMLScripts.h: Allow some members to be accessible/overridden
        by RenderMathMLUnderOver and add munderover/munder/mover in the kind.
        * rendering/mathml/RenderMathMLUnderOver.cpp:
        (WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver): We use the code from
        RenderMathMLScripts to initialize m_kind.
        (WebCore::RenderMathMLUnderOver::shouldMoveLimits): New function to determine if the base
        should move its limits.
        (WebCore::RenderMathMLUnderOver::computePreferredLogicalWidths): We use the code from
        RenderMathMLScripts when the base should move its limits.
        (WebCore::RenderMathMLUnderOver::layoutBlock): We use the code from RenderMathMLScripts when
        the base should move its limits. Also improve the early return for invalid markup.
        (WebCore::RenderMathMLUnderOver::unembellishedOperator): Deleted. We use the code from RenderMathMLScripts.
        (WebCore::RenderMathMLUnderOver::firstLineBaseline): Deleted. We use the code from RenderMathMLScripts.
        * rendering/mathml/RenderMathMLUnderOver.h: We now inherit from RenderMathMLScripts and can
        just remove members that exist in the parent. We define shouldMoveLimits() to determine
        when the layout should be done the same as RenderMathMLScripts. For now, we try and be
        safe with the rest of the code by continuing to claim that we are not a RenderMathMLScripts.

2016-07-07  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Clean up PassRefPtr in Modules/webaudio
        https://bugs.webkit.org/show_bug.cgi?id=159540

        Reviewed by Alex Christensen.

        Purge PassRefPtr in webaudio directory.

        No new tests, no behavior changes.

        * Modules/webaudio/AsyncAudioDecoder.h:
        * Modules/webaudio/AudioBasicProcessorNode.h:
        * Modules/webaudio/AudioBuffer.h:
        * Modules/webaudio/AudioBufferSourceNode.h:
        * Modules/webaudio/AudioListener.h:
        * Modules/webaudio/AudioParam.h:
        * Modules/webaudio/AudioParamTimeline.h:
        (WebCore::AudioParamTimeline::ParamEvent::ParamEvent):
        * Modules/webaudio/AudioProcessingEvent.cpp:
        (WebCore::AudioProcessingEvent::AudioProcessingEvent):
        * Modules/webaudio/AudioProcessingEvent.h:
        (WebCore::AudioProcessingEvent::create):
        * Modules/webaudio/ChannelMergerNode.h:
        * Modules/webaudio/ChannelSplitterNode.h:
        * Modules/webaudio/GainNode.h:
        * Modules/webaudio/MediaElementAudioSourceNode.h:
        * Modules/webaudio/MediaStreamAudioDestinationNode.h:
        * Modules/webaudio/MediaStreamAudioSource.cpp:
        (WebCore::MediaStreamAudioSource::addAudioConsumer):
        * Modules/webaudio/MediaStreamAudioSource.h:
        * Modules/webaudio/OfflineAudioCompletionEvent.cpp:
        (WebCore::OfflineAudioCompletionEvent::create):
        (WebCore::OfflineAudioCompletionEvent::OfflineAudioCompletionEvent):
        * Modules/webaudio/OfflineAudioCompletionEvent.h:
        * Modules/webaudio/OfflineAudioDestinationNode.h:
        * Modules/webaudio/OscillatorNode.h:
        * Modules/webaudio/PeriodicWave.h:
        * Modules/webaudio/ScriptProcessorNode.h:

2016-07-07  Per Arne Vollan  <pvollan@apple.com>

        [Win] The test http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/basic-upgrade.https.html is failing.
        https://bugs.webkit.org/show_bug.cgi?id=159510

        Reviewed by Brent Fulgham.

        On Windows, validate certificate chain even when any https certificate is allowed.

        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::ResourceHandle::createCFURLConnection):

2016-07-07  Frederic Wang  <fwang@igalia.com>

        Bug 155792 - Basic implementation of mpadded
        https://bugs.webkit.org/show_bug.cgi?id=155792

        Reviewed by Brent Fulgham.

        We implement a basic support for the mpadded element.
        We support most of the attribute values except pseudo-units or negative values.

        Tests: mathml/presentation/mpadded-1-2.html
               mathml/presentation/mpadded-1.html
               mathml/presentation/mpadded-2.html
               mathml/presentation/mpadded-3.html
               mathml/presentation/mpadded-unsupported-values.html
               mathml/presentation/mpadded-dynamic.html

        * CMakeLists.txt: Add RenderMathMLPadded to the build system.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * mathml/MathMLInlineContainerElement.cpp:
        (WebCore::MathMLInlineContainerElement::createElementRenderer): Create the renderer
        for mpadded.
        * mathml/mathattrs.in: Add voffset attribute.
        * mathml/mathtags.in: Make mpadded use MathMLInlineContainerElement.
        * rendering/RenderObject.h:
        (WebCore::RenderObject::isRenderMathMLPadded): Define isRenderMathMLPadded.
        * rendering/mathml/RenderMathMLPadded.cpp: Added.
        We do a simple implementation by overriding the behavior of RenderMathMLRow and forcing
        relayout after attribute or style change.
        (WebCore::RenderMathMLPadded::RenderMathMLPadded):
        (WebCore::RenderMathMLPadded::computePreferredLogicalWidths):
        (WebCore::RenderMathMLPadded::layoutBlock):
        (WebCore::RenderMathMLPadded::updateFromElement):
        (WebCore::RenderMathMLPadded::styleDidChange):
        (WebCore::RenderMathMLPadded::firstLineBaseline):
        * rendering/mathml/RenderMathMLPadded.h: Added.

2016-07-07  Frederic Wang  <fwang@igalia.com>

        Move MathML-specific code into a separate accessibility class
        https://bugs.webkit.org/show_bug.cgi?id=159213

        Reviewed by Chris Fleizach.

        Currently, MathML accessibility is completely handled in the generic AccessibilityRenderObject
        and it's sometimes messy and unconvenient. Hence we move most of the MathML-specific code
        into a separate AccessibilityMathMLElement class to facilitate future work and maintenance.

        No new tests, already covered by existing tests.

        * CMakeLists.txt: Add new AccessibilityMathMLElement module.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * accessibility/AccessibilityAllInOne.cpp: Ditto.
        * accessibility/AXObjectCache.cpp: Add MathML headers and create AccessibilityMathMLElement.
        (WebCore::createFromRenderer): Create AccessibilityMathMLElement for MathML elements and
        anonymous operators created by the mfenced element.
        * accessibility/AccessibilityMathMLElement.cpp: Added. This class handles all the MathML
        elements as well as the anonymous operators created by the mfenced element. A boolean is
        passed to the constructor to indicate whether we are in the latter case.
        (WebCore::AccessibilityMathMLElement::AccessibilityMathMLElement):
        (WebCore::AccessibilityMathMLElement::~AccessibilityMathMLElement):
        (WebCore::AccessibilityMathMLElement::create):
        (WebCore::AccessibilityMathMLElement::determineAccessibilityRole): Move handling of specific
        MathElementRole and DocumentMathRole here.
        (WebCore::AccessibilityMathMLElement::textUnderElement): Move retrieval of text from the
        anonymous operators here.
        (WebCore::AccessibilityMathMLElement::stringValue): Ditto.
        (WebCore::AccessibilityMathMLElement::isIgnoredElementWithinMathTree): Move the determination
        of ignored math elements here.
        (WebCore::AccessibilityMathMLElement::isMathFraction): Moved from AccessibilityRenderObject.
        (WebCore::AccessibilityMathMLElement::isMathFenced): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathSubscriptSuperscript): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathRow): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathUnderOver): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathSquareRoot): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathToken): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathRoot): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathOperator): Ditto.
        (WebCore::AccessibilityMathMLElement::isAnonymousMathOperator): Move the determination of
        anonymous operators here. We now just return the boolean passed at creation time.
        (WebCore::AccessibilityMathMLElement::isMathFenceOperator): Moved from
        AccessibilityRenderObject.
        (WebCore::AccessibilityMathMLElement::isMathSeparatorOperator): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathText): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathNumber): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathIdentifier): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathMultiscript): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathTable): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathTableRow): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathTableCell): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathScriptObject): Ditto.
        (WebCore::AccessibilityMathMLElement::isMathMultiscriptObject): Ditto.
        (WebCore::AccessibilityMathMLElement::mathRadicandObject): Ditto.
        (WebCore::AccessibilityMathMLElement::mathRootIndexObject): Ditto.
        (WebCore::AccessibilityMathMLElement::mathNumeratorObject): Ditto.
        (WebCore::AccessibilityMathMLElement::mathDenominatorObject): Ditto.
        (WebCore::AccessibilityMathMLElement::mathUnderObject): Ditto.
        (WebCore::AccessibilityMathMLElement::mathOverObject): Ditto.
        (WebCore::AccessibilityMathMLElement::mathBaseObject): Ditto.
        (WebCore::AccessibilityMathMLElement::mathSubscriptObject): Ditto.
        (WebCore::AccessibilityMathMLElement::mathSuperscriptObject): Ditto.
        (WebCore::AccessibilityMathMLElement::mathFencedOpenString): Ditto.
        (WebCore::AccessibilityMathMLElement::mathFencedCloseString): Ditto.
        (WebCore::AccessibilityMathMLElement::mathPrescripts): Ditto.
        (WebCore::AccessibilityMathMLElement::mathPostscripts): Ditto.
        (WebCore::AccessibilityMathMLElement::mathLineThickness): Ditto.
        * accessibility/AccessibilityMathMLElement.h: Added.
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::isIgnoredElementWithinMathTree): The cases of
        AccessibilityMathMLElement objects are now handled in the derived class. We remove the case
        of text node since the MathML code no longer creates anonymous text nodes after r202420.
        Anonymous block inserted into RenderMathMLBlocks to honor CSS rules are not AccessibilityMathMLElements
        and it does not seem safe to modify AXObjectCache::createFromRenderer to force that. Hence
        we still need to be handle them here.
        (WebCore::AccessibilityRenderObject::textUnderElement): This code is moved into AccessibilityMathMLElement.
        (WebCore::AccessibilityRenderObject::stringValue): Ditto.
        (WebCore::AccessibilityRenderObject::determineAccessibilityRole): Ditto.
        (WebCore::AccessibilityRenderObject::isMathElement): Deleted.
        (WebCore::AccessibilityRenderObject::isMathFraction): Deleted.
        (WebCore::AccessibilityRenderObject::isMathFenced): Deleted.
        (WebCore::AccessibilityRenderObject::isMathSubscriptSuperscript): Deleted.
        (WebCore::AccessibilityRenderObject::isMathRow): Deleted.
        (WebCore::AccessibilityRenderObject::isMathUnderOver): Deleted.
        (WebCore::AccessibilityRenderObject::isMathSquareRoot): Deleted.
        (WebCore::AccessibilityRenderObject::isMathToken): Deleted.
        (WebCore::AccessibilityRenderObject::isMathRoot): Deleted.
        (WebCore::AccessibilityRenderObject::isMathOperator): Deleted.
        (WebCore::AccessibilityRenderObject::isAnonymousMathOperator): Deleted.
        (WebCore::AccessibilityRenderObject::isMathFenceOperator): Deleted.
        (WebCore::AccessibilityRenderObject::isMathSeparatorOperator): Deleted.
        (WebCore::AccessibilityRenderObject::isMathText): Deleted.
        (WebCore::AccessibilityRenderObject::isMathNumber): Deleted.
        (WebCore::AccessibilityRenderObject::isMathIdentifier): Deleted.
        (WebCore::AccessibilityRenderObject::isMathMultiscript): Deleted.
        (WebCore::AccessibilityRenderObject::isMathTable): Deleted.
        (WebCore::AccessibilityRenderObject::isMathTableRow): Deleted.
        (WebCore::AccessibilityRenderObject::isMathTableCell): Deleted.
        (WebCore::AccessibilityRenderObject::isMathScriptObject): Deleted.
        (WebCore::AccessibilityRenderObject::isMathMultiscriptObject): Deleted.
        (WebCore::AccessibilityRenderObject::mathRadicandObject): Deleted.
        (WebCore::AccessibilityRenderObject::mathRootIndexObject): Deleted.
        (WebCore::AccessibilityRenderObject::mathNumeratorObject): Deleted.
        (WebCore::AccessibilityRenderObject::mathDenominatorObject): Deleted.
        (WebCore::AccessibilityRenderObject::mathUnderObject): Deleted.
        (WebCore::AccessibilityRenderObject::mathOverObject): Deleted.
        (WebCore::AccessibilityRenderObject::mathBaseObject): Deleted.
        (WebCore::AccessibilityRenderObject::mathSubscriptObject): Deleted.
        (WebCore::AccessibilityRenderObject::mathSuperscriptObject): Deleted.
        (WebCore::AccessibilityRenderObject::mathFencedOpenString): Deleted.
        (WebCore::AccessibilityRenderObject::mathFencedCloseString): Deleted.
        (WebCore::AccessibilityRenderObject::mathPrescripts): Deleted.
        (WebCore::AccessibilityRenderObject::mathPostscripts): Deleted.
        (WebCore::AccessibilityRenderObject::mathLineThickness): Deleted.
        * accessibility/AccessibilityRenderObject.h: Remove declarations of functions that are now
        overridden in AccessibilityMathMLElement. Make isIgnoredElementWithinMathTree virtual so that
        it can be reimplemented in AccessibilityMathMLElement.

2016-07-07  Frederic Wang  <fwang@igalia.com>

        Implement an internal style property for displaystyle.
        https://bugs.webkit.org/show_bug.cgi?id=133845

        Reviewed by Brent Fulgham.

        Tests: mathml/opentype/large-operators-displaystyle-dynamic.html
               mathml/opentype/large-operators-displaystyle.html

        This is based on a patch by Alejandro G. Castro <alex@igalia.com>

        * CMakeLists.txt: Add MathMLStyle to the build system.
        * WebCore.xcodeproj/project.pbxproj: ditto.
        * mathml/MathMLInlineContainerElement.cpp:
        (WebCore::MathMLInlineContainerElement::parseAttribute): Resolve the mathml style when the
        displaystyle attribute changes on the mtable or mstyle elements.
        * mathml/MathMLInlineContainerElement.h: Define parseAttribute.
        * mathml/MathMLMathElement.cpp:
        (WebCore::MathMLMathElement::MathMLMathElement): Indicate that we have custom style.
        (WebCore::MathMLMathElement::parseAttribute): Resolve the mathml style when the display or
        displaystyle attributes change on the math element.
        (WebCore::MathMLMathElement::didAttachRenderers): Resolve the mathml style when one
        renderer is attached.
        * mathml/MathMLMathElement.h: Declare parseAttribute and didAttachRenderers.
        * mathml/mathattrs.in: Declare the display and displaystyle attributes.
        * rendering/mathml/MathMLStyle.cpp: Added.
        (WebCore::MathMLStyle::MathMLStyle): New class to handle custom MathML style.
        (WebCore::MathMLStyle::create):
        (WebCore::MathMLStyle::setDisplayStyle): Helper function to take the displaystyle from
        the specified rendered.
        (WebCore::MathMLStyle::resolveMathMLStyleTree): Helper function to resolve the custom
        MathML style in renderer subtree.
        (WebCore::MathMLStyle::getMathMLParentNode): Helper function to get a MathML ancestor of
        the specified renderer.
        (WebCore::MathMLStyle::updateStyleIfNeeded): Helper function to update the style of the
        specified renderer if needed.
        (WebCore::MathMLStyle::resolveMathMLStyle): Resolve the MathML style of a given renderer.
        For displaystyle, we inherit the value of the parent except for the cases mentioned in the
        MathML recommendation.
        * rendering/mathml/MathMLStyle.h: New class header for custom MathML style.
        Only displaystyle is supported for now.
        * rendering/mathml/RenderMathMLBlock.cpp: Add a member and getter for custom MathML style.
        (WebCore::RenderMathMLBlock::RenderMathMLBlock):
        * rendering/mathml/RenderMathMLBlock.h: ditto.
        (WebCore::RenderMathMLBlock::mathMLStyle):
        * rendering/mathml/RenderMathMLMath.h: Add definition to use the syntax is<RenderMathMLMath>.
        * rendering/mathml/RenderMathMLOperator.h:
        (WebCore::RenderMathMLOperator::isLargeOperatorInDisplayStyle): Do not rerturn true when
        the operator is not in displaystyle.
        * rendering/mathml/RenderMathMLRoot.h: Make updateStyle public, so that it can be called
        by MathMLStyle::updateStyleIfNeeded.
        * rendering/mathml/RenderMathMLUnderOver.h: Add definition to use the syntax
        is<RenderMathMLUnderOver>.

2016-07-07  Ryosuke Niwa  <rniwa@webkit.org>

        Replace scoped flag in Event by composed flag
        https://bugs.webkit.org/show_bug.cgi?id=158415

        Reviewed by Chris Dumez.

        Replace `scoped` flag with `composed` flag and negate its meaning per the latest spec:
        https://dom.spec.whatwg.org/#dom-event-composed
        https://github.com/w3c/webcomponents/issues/513

        In the old spec, every event was assumed to be "composed" (crosses shadow boundaries)
        by default and there was `scoped` flag which prevented the event from crossing bondaries,
        and there was a handful of events for which `scoped` was set true when dispatched by UA.

        In the new spec, every event is assumed to be "scoped" and a handful of user-initiated
        events set `composed` flag to true, which is also exposed in EventInit dictionary.
        `relatedTargetScoped` flag has been removed. New behavior is identical to when this flag
        was set to true.

        No new tests since existing tests are updated to test the new flag and behavior.

        * dom/CompositionEvent.cpp:
        (WebCore::CompositionEvent::isCompositionEvent): Added.
        * dom/CompositionEvent.h:
        * dom/Event.cpp:
        (WebCore::Event::Event): Initialize m_composed. Also re-ordered m_type and m_isInitialized
        for better packing.
        (WebCore::Event::composed): Renamed from Event::composed. We return true whenever composed
        is set to true in EventInit, or the engine is dispatching an user-initiated event listed in:
        https://github.com/w3c/webcomponents/issues/513#issuecomment-224183937
        as well as keypress, cut, paste, and, copy as discussed in:
        https://github.com/w3c/webcomponents/issues/513#issuecomment-230988170
        (WebCore::Event::isCompositionEvent): Added.
        * dom/Event.h:
        (WebCore::Event::composed): Added.
        (WebCore::Event::scoped): Deleted.
        (WebCore::Event::relatedTargetScoped): Deleted.
        (WebCore::Event): Reordered m_type and m_isInitialized for better packing. Added m_composed
        and removed m_scoped and m_relatedTargetScoped.
        * dom/Event.idl:
        * dom/EventPath.cpp:
        (WebCore::shouldEventCrossShadowBoundary): Returns true if the event did not originate from
        a shadow tree (this event entered the current shadow tree via a slot so we need to proceed with
        the normal bubble path outside the shadow tree) or composed flag is set true.
        (WebCore::EventPath::EventPath): m_event no longer exists, which was only used to get the value
        of relatedTargetScoped which has been removed.
        (WebCore::EventPath::setRelatedTarget): Behave as if relatedTargetScoped is always set true
        since the flag has been removed.
        * dom/EventPath.h:
        * dom/FocusEvent.cpp:
        (WebCore::FocusEvent::relatedTargetScoped): Deleted.
        * dom/FocusEvent.h:
        * dom/MouseEvent.cpp:
        (WebCore::MouseEvent::relatedTargetScoped): Deleted.
        * dom/MouseEvent.h:

2016-07-07  Chris Dumez  <cdumez@apple.com>

        tdody.deleteRow(-1) and tr.deleteCell(-1) should not throw when there are no rows / cells
        https://bugs.webkit.org/show_bug.cgi?id=159527
        <rdar://problem/27232261>

        Reviewed by Alex Christensen.

        tdody.deleteRow(-1) and tr.deleteCell(-1) should not throw when there
        are no rows / cells:
        - https://html.spec.whatwg.org/multipage/tables.html#dom-tbody-deleterow
        - https://html.spec.whatwg.org/multipage/tables.html#dom-tr-deletecell

        Firefox and Chrome do not throw but WebKit was throwing.

        No new tests, rebaselined existing tests.

        * html/HTMLTableRowElement.cpp:
        (WebCore::HTMLTableRowElement::deleteCell):
        * html/HTMLTableSectionElement.cpp:
        (WebCore::HTMLTableSectionElement::deleteRow):

2016-07-07  Chris Dumez  <cdumez@apple.com>

        HTMLTitleElement.text should only account for direct children Text nodes
        https://bugs.webkit.org/show_bug.cgi?id=159536

        Reviewed by Ryosuke Niwa.

        HTMLTitleElement.text should only account for direct children Text nodes:
        - https://html.spec.whatwg.org/multipage/semantics.html#dom-title-text
        - https://html.spec.whatwg.org/multipage/infrastructure.html#child-text-content

        Firefox and Chrome match the specification. However, WebKit accounted for all
        Text nodes that are descendants, not just children. This patch aligns our
        behavior with the specification and other browsers.

        No new tests, rebaselined existing tests.

        * html/HTMLTitleElement.cpp:
        (WebCore::HTMLTitleElement::text):

2016-07-07  Dean Jackson  <dino@apple.com>

        REGRESSION(r200769): animations are no longer overridden
        https://bugs.webkit.org/show_bug.cgi?id=159450
        <rdar://problem/27120570>

        Reviewed by Zalan Bujtas.

        The change in r200769 removed a lot of the prefixing variant
        handling, but unfortunately we can't be completely rid
        of it until we alias the prefixed transitions and animations
        to the non-prefixed form. For example, setting the prefixed
        shorthand has to reset the non-prefixed longhands.

        The fix was to explicitly call the variant forms when
        parsing such longhands, and make sure that MutableStyleProperties
        removes all prefixed variants when removing shorthands.

        The existing test was amended to cover this case:
        fast/css/shorthand-omitted-initial-value-overrides-shorthand.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseAnimationShorthand):
        (WebCore::CSSParser::addPropertyWithPrefixingVariant):
        (WebCore::CSSParser::parseTransitionShorthand):
        * css/CSSParser.h:
        * css/StyleProperties.cpp:
        (WebCore::MutableStyleProperties::removeShorthandProperty):

2016-07-07  Alex Christensen  <achristensen@webkit.org>

        Fix CMake build.

        * PlatformMac.cmake:

2016-07-07  Alex Christensen  <achristensen@webkit.org>

        Fix CMake build.

        * PlatformMac.cmake:

2016-07-07  Myles C. Maxfield  <mmaxfield@apple.com> and Frédéric Wang  <fred.wang@free.fr>

        [Font Loading] The callback passed to document.fonts.ready should always be called
        https://bugs.webkit.org/show_bug.cgi?id=158884

        Reviewed by Dean Jackson.

        The boolean was simply not being reset when loads start.

        Test: fast/text/font-face-set-ready-fire.html

        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::startedLoading):
        * css/FontFaceSet.h:

2016-07-07  Andy Estes  <aestes@apple.com>

        [Content Filtering] Load blocked pages more like other error pages are loaded
        https://bugs.webkit.org/show_bug.cgi?id=159485
        <rdar://problem/26014076>

        Reviewed by Brady Eidson.

        Content filter blocked pages were being loaded by cancelling the provisional load of the
        page that was blocked and then scheduling a navigation to the content filter error page.
        Some clients would not expect a new, Web process-initiated provisional navigation to start
        after a cancellation, though, and this would put them in a bad state.
        
        This patch changes blocked page loading to behave more like loading other error pages.
        Specifically:
        1. didFailProvisionalLoad is dispatched with a new, non-cancellation error code.
        2. The blocked page is loaded immediately after dispatching didFailProvisionalLoad, which
           prevents FrameLoader from creating a new back-forward list item for the substitute data load.
        3. A substitute data load initiated by the client for the blocked URL is ignored if
           ContentFilter will display its own error page.
        4. A file: URL is used instead of a custom scheme for the base URL of the blocked page,
           since some clients expect this.

        Updated existing tests to capture frame load delegate callbacks and the back forward list.
        Added new API tests: ContentFiltering.LoadAlternate*.

        * English.lproj/Localizable.strings: Added a WebKitErrorFrameLoadBlockedByContentFilter description.
        * Resources/ContentFilterBlockedPage.html: Added.
        * WebCore.xcodeproj/project.pbxproj: Added ContentFilterBlockedPage.html as a frameowrk resource.
        * loader/ContentFilter.cpp:
        (WebCore::ContentFilter::stopFilteringMainResource): Only set m_state to Stopped if not
        already Blocked, so that we don't forget this ContentFilter was blocked when calling
        cancelMailResourceLoad() in didDecide().
        (WebCore::ContentFilter::didDecide): Moved code from DocumentLoader::contentFilterDidBlock() to here.
        Created a blockedByContentFilterError() and called cancelMainResourceLoad().
        (WebCore::blockedPageURL): Returned a file: URL to ContentFilterBlockedPage.html in WebCore.framework.
        (WebCore::ContentFilter::continueAfterSubstituteDataRequest): If the substitute data load
        is for the same failingURL as the currently-displayed blocked page, ignore it.
        (WebCore::ContentFilter::handleProvisionalLoadFailure): Load the blocked page if m_state is Blocked
        and the ResourceError matches the error we used when previously calling cancelMainResourceLoad().
        (WebCore::ContentFilter::unblockHandler): Deleted.
        (WebCore::ContentFilter::replacementData): Deleted.
        (WebCore::ContentFilter::unblockRequestDeniedScript): Deleted.
        * loader/ContentFilter.h:
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::contentFilter): Returned m_contentFilter.
        (WebCore::DocumentLoader::installContentFilterUnblockHandler): Deleted.
        (WebCore::DocumentLoader::contentFilterDidBlock): Deleted.
        * loader/DocumentLoader.h:
        * loader/EmptyClients.h: Added a default implementation of blockedByContentFilterError().
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::load): If m_loadType was already RedirectWithLockedBackForwardList
        and we are loading subsitute data for a failing URL, continue to use RedirectWithLockedBackForwardList.
        This prevents a new back-forward list item from being created when loading a blocked page in a subframe.
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        Called ContentFilter::handleProvisionalLoadFailure() after dispatchDidFailProvisionalLoad().
        (WebCore::FrameLoader::blockedByContentFilterError): Called FrameLoaderClient::blockedByContentFilterError().
        * loader/FrameLoader.h:
        * loader/FrameLoaderClient.h:
        * loader/NavigationScheduler.cpp:
        (WebCore::ScheduledSubstituteDataLoad::ScheduledSubstituteDataLoad): Deleted.
        (WebCore::NavigationScheduler::scheduleSubstituteDataLoad): Deleted.
        * loader/NavigationScheduler.h:
        * loader/PolicyChecker.cpp:
        (WebCore::PolicyChecker::checkNavigationPolicy): Ignored a substitute data load for a
        failing URL if ContentFilter::continueAfterSubstituteDataRequest() returns false.

2016-07-07  Chris Dumez  <cdumez@apple.com>

        td / th should be exposed as HTMLTableCellElement objects
        https://bugs.webkit.org/show_bug.cgi?id=159518
        <rdar://problem/27225436>

        Reviewed by Ryosuke Niwa.

        td / th should be exposed as HTMLTableCellElement objects:
        - https://html.spec.whatwg.org/multipage/tables.html#the-td-element
        - https://html.spec.whatwg.org/multipage/tables.html#the-th-element

        We were using HTMLTableDataCellElement / HTMLTableHeaderCellElement
        sub-types.

        Firefox and Chrome match the current specification.

        We actually introduced these types recently via Bug 148859 to align
        with an older version of the HTML specification. However, it seems the
        specification has been updated to match Firefox / Chrome in the mean
        time.

        Since we have not shipped those subtypes yet, the compatibility risk is
        low.

        No new tests, rebaselined existing tests.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLElementsAllInOne.cpp:
        * html/HTMLTableCellElement.cpp:
        (WebCore::HTMLTableCellElement::create):
        (WebCore::HTMLTableCellElement::scope):
        (WebCore::HTMLTableCellElement::setScope):
        (WebCore::HTMLTableCellElement::setRowSpanForBindings): Deleted.
        * html/HTMLTableCellElement.h:
        * html/HTMLTableCellElement.idl:
        * html/HTMLTableDataCellElement.h: Removed.
        * html/HTMLTableDataCellElement.idl: Removed.
        * html/HTMLTableHeaderCellElement.cpp: Removed.
        * html/HTMLTableHeaderCellElement.h: Removed.
        * html/HTMLTableHeaderCellElement.idl: Removed.
        * html/HTMLTableRowElement.cpp:
        (WebCore::HTMLTableRowElement::insertCell):
        * html/HTMLTagNames.in:

2016-07-07  Brady Eidson  <beidson@apple.com>

        Modern IDB: When IDBDatabase objects are garbage collected, they don't close their server connection.
        <rdar://problem/25910345> and https://bugs.webkit.org/show_bug.cgi?id=159523

        Reviewed by Alex Christensen.

        Tests: storage/indexeddb/modern/gc-closes-database-private.html
               storage/indexeddb/modern/gc-closes-database.html

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::IDBDatabase): New logging.
        (WebCore::IDBDatabase::~IDBDatabase): Close server connection.
        (WebCore::IDBDatabase::fireVersionChangeEvent): New logging.
        (WebCore::IDBDatabase::dispatchEvent): New logging.

        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::openDatabase): New logging.

2016-07-07  Frederic Wang  <fwang@igalia.com>

        Refactor layout functions to avoid using flexbox in MathML
        https://bugs.webkit.org/show_bug.cgi?id=153991

        Reviewed by Brent Fulgham.

        No new tests, already covered by existing tests.

        * css/mathml.css:
        (math): Change inline mathematical formulas from inline-flex to inline.
        (math[display="block"]): Change display mathematical formulas from flex to block and
        remove flexbox property justify-content.
        (ms, mspace, mtext, mi, mn, mo, mrow, mfenced, mfrac, msub, msup, msubsup, mmultiscripts,
         mprescripts, none, munder, mover, munderover, msqrt, mroot, merror, mphantom, mstyle)
         menclose, semantics, mpadded, maction): In order to render properly, all children of the
         classes derived from RenderMathMLBlock must now be block-level. So we add more elements in
         this list and update the display property.
        (mtd > *): However, we use inline-block for children of the cell so that the text-align
         property is taken into account.
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeLogicalWidthInRegion): Add a special case for RenderMathMLBlock
        to preserve the old behavior.
        (WebCore::RenderBox::sizesLogicalWidthToFitContent): Ditto.
        * rendering/RenderFlexibleBox.h: No need to override layoutBlock anymore.
        * rendering/mathml/RenderMathMLBlock.cpp: Include LayoutRepainter header for use in layoutBlock.
        (WebCore::RenderMathMLBlock::RenderMathMLBlock): Inherit from RenderBlock and ensure that
        our children are block-level.
        (WebCore::RenderMathMLBlock::~RenderMathMLBlock): Added.
        (WebCore::RenderMathMLBlock::baselinePosition): If the baselinefirstLineBaseline() is
        undefined, just returns 0.
        (WebCore::RenderMathMLBlock::paint): Call RenderBlock::paint.
        (WebCore::RenderMathMLBlock::layoutItems): Implement a simplified version of
        RenderFlexibleBox::layoutItems where we assume horizontal layout for all children.
        (WebCore::RenderMathMLBlock::layoutBlock): Add a basic implementation based on
        RenderFlexibleBox::layoutBlock.
        (WebCore::RenderMathMLBlock::renderName): Deleted. There is now a simple implementation in the header.
        * rendering/mathml/RenderMathMLBlock.h: Use RenderBlock instead of RenderFlexibleBox and
        define layout functions. Define avoidsFloats and canDropAnonymousBlockChild to preserve
        the old behavior and remove isFlexibleBoxImpl.
        * rendering/mathml/RenderMathMLFenced.cpp:
        (WebCore::RenderMathMLFenced::createMathMLOperator): Use block for anonymous RenderMathMLOperator.
        * rendering/mathml/RenderMathMLRow.cpp:
        (WebCore::RenderMathMLRow::layoutRowItems): No need to handle the flexbox case anymore.
        (WebCore::RenderMathMLRow::paintChildren): Deleted. We now just use RenderBlock::paintChildren.
        * rendering/mathml/RenderMathMLRow.h:
        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::paintChildren): Deleted. We now just use RenderBlock::paintChildren.
        * rendering/mathml/RenderMathMLFraction.h:
        * rendering/mathml/RenderMathMLRoot.cpp:
        (WebCore::RenderMathMLRoot::paintChildren): Deleted. We now just use RenderBlock::paintChildren.
        * rendering/mathml/RenderMathMLRoot.h:
        * rendering/mathml/RenderMathMLScripts.cpp:
        (WebCore::RenderMathMLScripts::paintChildren): Deleted. We now just use RenderBlock::paintChildren.
        * rendering/mathml/RenderMathMLScripts.h:
        * rendering/mathml/RenderMathMLUnderOver.cpp:
        (WebCore::RenderMathMLUnderOver::paintChildren): Deleted. We now just use RenderBlock::paintChildren.
        * rendering/mathml/RenderMathMLUnderOver.h:

2016-07-07  Antti Koivisto  <antti@apple.com>

        REGRESSION (r199054): CrashTracer: [USER] parseWebKit at WebCore: WebCore::RenderBlockFlow::checkFloatsInCleanLine + 107
        https://bugs.webkit.org/show_bug.cgi?id=159519

        Reviewed by Zalan Bujtas.

        Test: fast/inline/trailing-floats-inline-crash.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::checkFloatsInCleanLine):

            Use the existing deletionHasBegun bit in RenderStyle to assert against this reliably.

        * rendering/RenderLineBoxList.cpp:
        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):

            In some cases a special TrailingFloatsRootInlineBox may be added as the last root linebox of a flow.
            If it is combined with br the existing invalidation that invalidates the next and previous line may
            not be sufficient. Test for this case and invalidate the TrailingFloatsRootInlineBox too if it exists.

        * rendering/RootInlineBox.h:
        (WebCore::RootInlineBox::isTrailingFloatsRootInlineBox):
        * rendering/TrailingFloatsRootInlineBox.h:
        * rendering/style/RenderStyle.h:
        (WebCore::RenderStyle::deletionHasBegun):

            Expose the bit in debug.

2016-07-07  Alex Christensen  <achristensen@webkit.org>

        Use SocketProvider to create WebSocketChannels
        https://bugs.webkit.org/show_bug.cgi?id=158776

        Reviewed by Brent Fulgham.

        This patch should have no change in behavior except making an InvalidStateError in
        conditions where we should not be able to do networking, like in a detached frame.
        It just replaces ThreadableWebSocketChannel::create with SocketProvider::createWebSocketChannel
        which does the same thing as ThreadableWebSocketChannel::create for Mac and 
        Windows WebKit1.  The WebKit2 implementation is the same right now, but it will
        be replaced by a proxy that will do the WebSocket operations in the NetworkProcess.

        * Modules/websockets/ThreadableWebSocketChannel.cpp: Removed.
        * Modules/websockets/ThreadableWebSocketChannel.h:
        (WebCore::ThreadableWebSocketChannel::ThreadableWebSocketChannel):
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect):
        * Modules/websockets/WebSocketChannel.h:
        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Document.cpp:
        (WebCore::Document::idbConnectionProxy):
        (WebCore::Document::socketProvider):
        (WebCore::Document::canNavigate):
        * dom/Document.h:
        (WebCore::Document::notifyRemovePendingSheetIfNeeded):
        * dom/ScriptExecutionContext.h:
        * inspector/InspectorOverlay.cpp:
        (WebCore::InspectorOverlay::overlayPage):
        * loader/EmptyClients.cpp:
        (WebCore::EmptyEditorClient::registerRedoStep):
        (WebCore::EmptySocketProvider::createWebSocketChannel):
        * loader/EmptyClients.h:
        * page/Page.h:
        * page/PageConfiguration.cpp:
        (WebCore::PageConfiguration::PageConfiguration):
        * page/PageConfiguration.h:
        * page/SocketProvider.h:
        (WebCore::SocketProvider::~SocketProvider):
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::dataChanged):
        * workers/DedicatedWorkerGlobalScope.cpp:
        (WebCore::DedicatedWorkerGlobalScope::create):
        (WebCore::DedicatedWorkerGlobalScope::DedicatedWorkerGlobalScope):
        * workers/DedicatedWorkerGlobalScope.h:
        * workers/DedicatedWorkerThread.cpp:
        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
        (WebCore::DedicatedWorkerThread::createWorkerGlobalScope):
        (WebCore::DedicatedWorkerThread::runEventLoop):
        * workers/DedicatedWorkerThread.h:
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::WorkerGlobalScope):
        (WebCore::WorkerGlobalScope::disableEval):
        (WebCore::WorkerGlobalScope::socketProvider):
        (WebCore::WorkerGlobalScope::idbConnectionProxy):
        * workers/WorkerGlobalScope.h:
        (WebCore::WorkerGlobalScope::script):
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::startWorkerGlobalScope):
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
        (WebCore::WorkerThread::WorkerThread):
        (WebCore::WorkerThread::idbConnectionProxy):
        (WebCore::WorkerThread::socketProvider):
        * workers/WorkerThread.h:
        (WebCore::WorkerThread::workerGlobalScope):

2016-07-07  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202905 and r202911.
        https://bugs.webkit.org/show_bug.cgi?id=159522

        This test is fails on El Capitan and Sierra WK1 (Requested by
        ryanhaddad on #webkit).

        Reverted changesets:

        "Add a test for media control dropoff"
        https://bugs.webkit.org/show_bug.cgi?id=151287
        http://trac.webkit.org/changeset/202905

        "Add a test for media control dropoff"
        https://bugs.webkit.org/show_bug.cgi?id=151287
        http://trac.webkit.org/changeset/202911

2016-07-07  Antoine Quint  <graouts@apple.com>

        <img> with a wide gamut PDF does not display using a wide gamut color space
        https://bugs.webkit.org/show_bug.cgi?id=158983
        <rdar://problem/25720247>

        Reviewed by Dean Jackson.

        Calls to ImageBuffer::createCompatibleBuffer() that do not provide an explicit
        color space will now infer the color space from the provided graphics context
        on platforms using CG. The method signature that takes in a GraphicsContext
        without a color space is now split into a CG-specified implementation and a
        Cairo one to avoid having diverging platform code in ImageBuffer.cpp.

        Some call sites need to provide an explicit color space still, so we add a new
        ImageBuffer::createCompatibleBuffer() that allows for that while inferring
        sizing and scaling from a GraphicsContext.
        
        All signatures of ImageBuffer::createCompatibleBuffer() are losing the
        hasAlpha parameter which was always ignored. All call sites that were using
        hasAlpha have been updated.

        In addition, we make all the IOSurface and IOSurfacePool code, which is
        CG-specific, use the plaform-specific type CGColorSpaceRef instead of ColorSpace
        so that we may pick up on the color space copied over from the graphics context
        in the CG-specific implementation of ImageBuffer::createCompatibleBuffer().

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::drawTextInternal):
        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::drawPattern):
        * platform/graphics/GradientImage.cpp:
        (WebCore::GradientImage::drawPattern):
        * platform/graphics/ImageBuffer.cpp:
        (WebCore::ImageBuffer::createCompatibleBuffer):
        * platform/graphics/ImageBuffer.h:
        * platform/graphics/NamedImageGeneratedImage.cpp:
        (WebCore::NamedImageGeneratedImage::drawPattern):
        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBuffer::createCompatibleBuffer):
        * platform/graphics/cg/IOSurfacePool.cpp:
        (WebCore::surfaceMatchesParameters):
        (WebCore::IOSurfacePool::takeSurface):
        * platform/graphics/cg/IOSurfacePool.h:
        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::ImageBuffer::createCompatibleBuffer):
        (WebCore::ImageBuffer::ImageBuffer):
        * platform/graphics/cocoa/IOSurface.h:
        * platform/graphics/cocoa/IOSurface.mm:
        (WebCore::IOSurface::surfaceFromPool):
        (WebCore::IOSurface::create):
        (WebCore::IOSurface::createFromSendRight):
        (WebCore::IOSurface::createFromSurface):
        (WebCore::IOSurface::createFromImage):
        (WebCore::IOSurface::IOSurface):
        (WebCore::IOSurface::ensurePlatformContext):
        * platform/mac/ThemeMac.mm:
        (WebCore::ThemeMac::drawCellOrFocusRingWithViewIntoContext):
        * platform/spi/cg/CoreGraphicsSPI.h:
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintProgressBar):
        * rendering/svg/SVGRenderingContext.cpp:
        (WebCore::SVGRenderingContext::bufferForeground):
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::drawPatternForContainer):

2016-07-07  Beth Dakin  <bdakin@apple.com>

        All fullscreen videos should be able the control the controls manager
        https://bugs.webkit.org/show_bug.cgi?id=159496
        -and corresponding-
        rdar://problem/27009446

        Reviewed by Eric Carlson.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::fullscreenModeChanged):
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::canControlControlsManager):

2016-07-07  Jer Noble  <jer.noble@apple.com>

        Crash due to HTMLMediaElement at JavaScriptCore: JSC::JSLockHolder::JSLockHolder
        https://bugs.webkit.org/show_bug.cgi?id=159517
        <rdar://problem/27221109>

        Reviewed by Eric Carlson.

        When WebKit on iOS gets a notification that the UIProcess has been backgrounded, it sends an
        interruption event to the WebProcess to pause any playing HTMLMediaElements. When the
        elements which get this interruption have pending promises created during a previous call to
        play(), these promises get rejected.

        However, if the HTMLMediaElement's document has already been destroyed, the pending Promises
        are in an inconsistent state: their script execution context (the document) has been
        destroyed, leading to the crash in JSLockHolder.

        When HTMLMediaElement is notified that its ScriptExecutionContext has been destroyed, also
        clear the list of pending Promises.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::contextDestroyed):

2016-07-05  Jer Noble  <jer.noble@apple.com>

        Facebook videos without audio tracks will sometimes cause playback controls to appear.
        https://bugs.webkit.org/show_bug.cgi?id=159437

        Reviewed by Eric Carlson.

        Because updatePlaybackControlsManager() will cause the session manager to walk through all
        the outstanding sessions asking if it canControlControlsManager(), some sessions will say
        they can control the controls manager if we are currently processing a user gesture. This is
        obviously not intended (there may be a user gesture to un-mute video 1, but an unrelated
        video 2 should not be allowed to use that use gesture to fulfill its own requirements.)

        So in those situations where conditions may have changed and updatePlaybackControlsManager()
        needs to be called, instead schedule the update for the next run loop.
        
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setMuted):
        (WebCore::HTMLMediaElement::layoutSizeChanged):
        (WebCore::HTMLMediaElement::updatePlayState):
        (WebCore::HTMLMediaElement::createMediaPlayer):
        (WebCore::HTMLMediaElement::scheduleUpdatePlaybackControlsManager):
        * html/HTMLMediaElement.h:

2016-07-07  Jer Noble  <jer.noble@apple.com>

        Unreviewed build fix after r202908. Fix the webPlaybackSessionInterfaceMac @property.

        * platform/mac/WebPlaybackControlsManager.h:
        * platform/mac/WebPlaybackControlsManager.mm:

2016-07-07  Youenn Fablet  <youenn@apple.com>

        [Fetch API] Response constructor should throw in case of bad reason phrase
        https://bugs.webkit.org/show_bug.cgi?id=159508

        Reviewed by Alex Christensen.

        Covered by rebased test.

        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::initializeWith): Validating reason phrase with new routine.
        Throwing a TypeError in case of error.
        * platform/network/HTTPParsers.cpp:
        (WebCore::isValidReasonPhrase): Added to validate reason phrase according
        https://tools.ietf.org/html/rfc7230#section-3.1.2
        * platform/network/HTTPParsers.h:

2016-07-07  Youenn Fablet  <youenn@apple.com>

        [Fetch API] Response.redirect should throw a RangeError in case of bad status code
        https://bugs.webkit.org/show_bug.cgi?id=159507

        Reviewed by Alex Christensen.

        Covered by rebased test.

        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::redirect): Throw a RangeError in case of bad status.

2016-07-05  Jer Noble  <jer.noble@apple.com>

        Ownership between WebPlaybackSessionInterfaceMac and WebPlaybackControlsManager is backwards.
        https://bugs.webkit.org/show_bug.cgi?id=159441

        Reviewed by Eric Carlson.

        The WebPlaybackControlsManager should own the WebPlaybackSessionInterfaceMac, and not
        vice versa.

        * platform/mac/WebPlaybackControlsManager.h:
        * platform/mac/WebPlaybackControlsManager.mm:
        (-[WebPlaybackControlsManager webPlaybackSessionInterfaceMac]):
        (-[WebPlaybackControlsManager setWebPlaybackSessionInterfaceMac:]):
        * platform/mac/WebPlaybackSessionInterfaceMac.h:
        * platform/mac/WebPlaybackSessionInterfaceMac.mm:
        (WebCore::WebPlaybackSessionInterfaceMac::playBackControlsManager):

2016-07-07  Eric Carlson  <eric.carlson@apple.com>

        Add a test for media control dropoff
        https://bugs.webkit.org/show_bug.cgi?id=151287
        <rdar://problem/23544666>

        Reviewed by Antoine Quint.

        Test: media/controls/inline-elements-dropoff-order.html

        * Modules/mediacontrols/mediaControlsApple.js: Expose more state to testing.

2016-07-07  Miguel Gomez  <magomez@igalia.com>

        [GTK] Painting a video into a canvas doesn't work when accelerated compositing is enabled
        https://bugs.webkit.org/show_bug.cgi?id=159405

        Reviewed by Xabier Rodriguez-Calvar.

        Implement video frame painting to the canvas when accelerated compositing is enabled.

        Already covered by existent tests.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::handleMessage):
        Replace custom enumeration for the video rotation with the ImageOrientation class.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::naturalSize):
        Replace the orientation value comparison with ImageOrientation::usesWidthAsHeight().
        (WebCore::MediaPlayerPrivateGStreamerBase::paint):
        Perform the frame painting taking into account the video orientation tag.
        (WebCore::MediaPlayerPrivateGStreamerBase::nativeImageForCurrentTime):
        Rotate the native image before returning it.
        (WebCore::MediaPlayerPrivateGStreamerBase::setVideoSourceOrientation):
        Replace custom enumeration for the video rotation with the ImageOrientation class.
        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase): Deleted.
        Remove orientation initialization.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
        Remove custom enumeration for the video orientation.

2016-07-07  Philippe Normand  <pnormand@igalia.com>

        [GStreamer][GL] switch to appsink
        https://bugs.webkit.org/show_bug.cgi?id=159466

        Reviewed by Carlos Garcia Campos.

        Fakesink is mostly used for tests. Appsink provides the same
        functionality and is actually meant to be used on application
        side.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):
        (WebCore::newSampleCallback):
        (WebCore::newPrerollCallback):
        (WebCore::MediaPlayerPrivateGStreamerBase::createVideoSinkGL):
        (WebCore::MediaPlayerPrivateGStreamerBase::drawCallback): Deleted.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:

2016-07-06  Chris Dumez  <cdumez@apple.com>

        Document.title setter does not work for SVG documents
        https://bugs.webkit.org/show_bug.cgi?id=159503
        <rdar://problem/27212313>

        Reviewed by Ryosuke Niwa.

        Document.title setter should work for SVG documents:
        - https://html.spec.whatwg.org/multipage/dom.html#document.title

        This patch aligns our behavior with the specification
        and with Firefox / Chrome.

        No new tests, rebaselined existing test.

        * dom/Document.cpp:
        (WebCore::Document::setTitle):
        - Reverse the if conditions for clarity.
        - If the document element is an SVG svg element, create a
          SVGTitleElement and insert it as first child of the
          document element.
        - Call SVGTitleElement::setText() instead of
          HTMLTitleElement::setText() at the end of the method if
          m_titleElement is a SVGTitleElement.

        (WebCore::Document::updateTitleElement):
        - If document element is an SVG svg element, use the first
          child of the document element that is a SVGTitleElement.

        * svg/SVGTitleElement.cpp:
        (WebCore::SVGTitleElement::setText):
        * svg/SVGTitleElement.h:
        Add SVGTitleElement::setText() method that does the same
        thing as HTMLTitleElement::setText().

2016-07-06  Chris Dumez  <cdumez@apple.com>

        Align Document.body setter with the HTML specification
        https://bugs.webkit.org/show_bug.cgi?id=159490

        Reviewed by Alex Christensen.

        Align Document.body setter with the HTML specification:
        - https://html.spec.whatwg.org/multipage/dom.html#dom-document-body

        In particular, the following web-exposed changes were made:
        - It is now possible to set document.body to a frameset element.
        - We no longer call importNode() on the passed in body. Therefore,
          if the body comes from another document, its will be adopted /
          transferred rather than cloned.

        Both changes match the behavior of Firefox and Chrome.

        No new tests, updated / rebaselined existing tests.

        * dom/Document.cpp:
        (WebCore::Document::setBodyOrFrameset):

2016-07-06  Brady Eidson  <beidson@apple.com>

        Fix my bogus json I landed earlier today.

        * features.json:

2016-07-06  Benjamin Poulain  <bpoulain@apple.com>

        [JSC] Unify how we throw TypeError from C++
        https://bugs.webkit.org/show_bug.cgi?id=159500

        Reviewed by Saam Barati.

        * bindings/js/JSBiquadFilterNodeCustom.cpp:
        (WebCore::JSBiquadFilterNode::setType):
        * bindings/js/JSBlobCustom.cpp:
        (WebCore::constructJSBlob):
        * bindings/js/JSCryptoKeySerializationJWK.cpp:
        (WebCore::getBigIntegerVectorFromJSON):
        (WebCore::JSCryptoKeySerializationJWK::JSCryptoKeySerializationJWK):
        (WebCore::tryJWKKeyOpsValue):
        (WebCore::JSCryptoKeySerializationJWK::reconcileUsages):
        (WebCore::JSCryptoKeySerializationJWK::keyDataOctetSequence):
        (WebCore::JSCryptoKeySerializationJWK::keyDataRSAComponents):
        (WebCore::JSCryptoKeySerializationJWK::keyData):
        (WebCore::addJWKAlgorithmToJSON):
        (WebCore::JSCryptoKeySerializationJWK::serialize):
        * bindings/js/JSCryptoOperationData.cpp:
        (WebCore::cryptoOperationDataFromJSValue):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::enforceRange):
        (WebCore::throwTypeError):
        (WebCore::throwArgumentMustBeEnumError):
        (WebCore::throwArgumentMustBeFunctionError):
        (WebCore::throwArgumentTypeError):
        (WebCore::throwArrayElementTypeError):
        (WebCore::throwGetterTypeError):
        (WebCore::throwThisTypeError):
        * bindings/js/JSDataCueCustom.cpp:
        (WebCore::constructJSDataCue):
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::defineElement):
        * bindings/js/JSFileCustom.cpp:
        (WebCore::constructJSFile):
        * bindings/js/JSModuleLoader.cpp:
        (WebCore::JSModuleLoader::evaluate):
        * bindings/js/JSMutationObserverCustom.cpp:
        (WebCore::constructJSMutationObserver):
        * bindings/js/JSOscillatorNodeCustom.cpp:
        (WebCore::JSOscillatorNode::setType):
        * bindings/js/JSPannerNodeCustom.cpp:
        (WebCore::JSPannerNode::setPanningModel):
        (WebCore::JSPannerNode::setDistanceModel):
        * bindings/js/JSReadableStreamPrivateConstructors.cpp:
        (WebCore::constructJSReadableStreamController):
        (WebCore::constructJSReadableStreamReader):
        * bindings/js/JSSubtleCryptoCustom.cpp:
        (WebCore::cryptoKeyFormatFromJSValue):
        (WebCore::importKey):
        (WebCore::exportKey):
        * bindings/js/ReadableStreamController.cpp:
        (WebCore::ReadableStreamController::invoke):
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneDeserializer::throwValidationError):
        (WebCore::SerializedScriptValue::maybeThrowExceptionIfSerializationFailed):
        * bridge/c/c_instance.cpp:
        (JSC::Bindings::CInstance::invokeMethod):
        * bridge/objc/objc_instance.mm:
        (ObjcInstance::invokeMethod):
        * bridge/objc/objc_runtime.mm:
        (JSC::Bindings::ObjcArray::setValueAt):

2016-07-06  Tim Horton  <timothy_horton@apple.com>

        Email from June 1st containing text 'Today @ 7:10PM' is linkified, but shouldn't be
        https://bugs.webkit.org/show_bug.cgi?id=159498
        <rdar://problem/26719903>

        Reviewed by Sam Weinig.

        New API test: WebKit2.DataDetectionReferenceDate

        * editing/cocoa/DataDetection.h:
        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::detectContentInRange):
        Extract the reference date from the DataDetectors context dictionary if it exists,
        and pass it along to DataDetectors.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        * loader/FrameLoaderClient.h:
        Plumb the DataDetectors context dictionary through from WebPage.

2016-07-06  Chris Dumez  <cdumez@apple.com>

        [WK2][Cocoa] Disable ResourceResponse lazy initialization
        https://bugs.webkit.org/show_bug.cgi?id=159497
        <rdar://problem/27209066>

        Reviewed by Alex Christensen.

        Add method to Cocoa's ResponseResponse header to disable
        lazy initialization.

        * platform/network/cf/ResourceResponse.h:
        * platform/network/cocoa/ResourceResponseCocoa.mm:
        (WebCore::ResourceResponse::disableLazyInitialization):

2016-07-06  Brent Fulgham  <bfulgham@apple.com>

        Return values of JSArray::createUninitialized (and related) are not consistently checked for nullptr
        https://bugs.webkit.org/show_bug.cgi?id=159495
        <rdar://problem/26075433>

        Reviewed by Dean Jackson.

        Test: fast/canvas/canvas-getImageData-invalid-result-buffer-crash.html

        * html/ImageData.cpp:
        (WebCore::ImageData::ImageData): Assert at construction if we could not create a valid
        buffer.
        * platform/SharedBuffer.cpp:
        (WebCore::SharedBuffer::createArrayBuffer): Check for a null buffer before using it.
        * platform/graphics/cg/ImageBufferDataCG.cpp:
        (WebCore::ImageBufferData::getData): Ditto.
        * platform/graphics/filters/FEGaussianBlur.cpp:
        (WebCore::FEGaussianBlur::platformApplySoftware): Ditto.
        * platform/graphics/filters/FilterEffect.cpp:
        (WebCore::FilterEffect::copyImageBytes): Ditto.
        (WebCore::FilterEffect::copyUnmultipliedImage): Ditto.
        (WebCore::FilterEffect::copyPremultipliedImage): Ditto.

2016-07-06  Chris Dumez  <cdumez@apple.com>

        Document.body should return the first child of the html element that is either a body / frameset element
        https://bugs.webkit.org/show_bug.cgi?id=159488

        Reviewed by Ryosuke Niwa.

        Document.body should return the first child of the html element that is
        either a body / frameset element:
        - https://html.spec.whatwg.org/multipage/dom.html#dom-document-body
        - https://html.spec.whatwg.org/multipage/dom.html#the-body-element-2

        We used the first child of the *document* element that is either a
        body / frameset element, even if the document element is not an html
        element.

        Firefox and Chrome match the specification.

        Test: imported/w3c/web-platform-tests/html/dom/documents/dom-tree-accessors/Document.body.html

        * dom/Document.cpp:
        (WebCore::Document::bodyOrFrameset):

2016-07-06  Dean Jackson  <dino@apple.com>

        Adopt new PiP glyph
        https://bugs.webkit.org/show_bug.cgi?id=159494
        <rdar://problem/27061084>

        Reviewed by Ada Chan.

        We got new artwork for Picture-in-Picture on macOS from
        our designers.

        * Modules/mediacontrols/mediaControlsApple.css:
        (video::-webkit-media-controls-panel .picture-in-picture-button):
        (video::-webkit-media-controls-panel .picture-in-picture-button.return-from-picture-in-picture):

2016-07-06  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202867.
        https://bugs.webkit.org/show_bug.cgi?id=159491

        This change caused an existing LayoutTest to crash on ios-
        simulator (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "<img> with a wide gamut PDF does not display using a wide
        gamut color space"
        https://bugs.webkit.org/show_bug.cgi?id=158983
        http://trac.webkit.org/changeset/202867

2016-07-06  Chris Dumez  <cdumez@apple.com>

        [ShadowDOM] assignedSlot property should be on Text, not CharacterData
        https://bugs.webkit.org/show_bug.cgi?id=159482
        <rdar://problem/27201687>

        Reviewed by Ryosuke Niwa.

        assignedSlot property should be on Text, not CharacterData as per:
        - https://dom.spec.whatwg.org/#mixin-slotable

        Align with the latest specification.

        No new tests, rebaselined existing test.

        * CMakeLists.txt:
        * DerivedSources.make:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Element.idl:
        * dom/NonDocumentTypeChildNode.idl:
        * dom/Slotable.idl: Copied from Source/WebCore/dom/NonDocumentTypeChildNode.idl.
        * dom/Text.idl:

2016-07-06  Jeremy Jones  <jeremyj@apple.com>

        Do not animate video fullscreen exit when page has navigated away.
        https://bugs.webkit.org/show_bug.cgi?id=159479

        Reviewed by Eric Carlson.

        No new tests there is no effect on the DOM. The only effect is to video fullscreen window animation.

        When the page has been navigated away, the fullscreen or picture-in-picture window should
        not animate back inline in the page, since the page has already navigated to a new page.
        Instead exit the fullscreen mode without animating.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::exitFullscreen):

2016-07-06  Jeremy Jones  <jeremyj@apple.com>

        Signal that media element is prepared for inline when being stopped since script won't be able to.
        https://bugs.webkit.org/show_bug.cgi?id=159163
        rdar://problem/26844557

        Reviewed by Jer Noble.

        No new tests since this don't change behavior in the DOM. It prevents a race that could cause 
        fullscreen and picture in picture to fail to tear down completely.
  
        When an element exits a fullscreen mode and is immediately removed from the DOM by the page, 
        its JavaScript stops running. The fullscreen code is then blocked waiting for JS to signal 
        that it has updated its state in preparation for inline mode. This change explicitly signals
        this since JS wont be able to.

        Additionally, when going from PiP back to inline, don't go through fullscreen first, when the 
        request comes from the DOM. This was causing the presentation mode to become confused. The
        page requests inline. PiP would exit back to fullscreen and set the presentation mode to
        fullscreen. Then it would exit fullscreen back to inline, but the DOM still had the wrong
        presentation mode. Skipping this removes an unnecessary step in the animation and keeps the
        presentation mode state consistent.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::stopWithoutDestroyingMediaPlayer):
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm: Set prepared for inline.
        (WebVideoFullscreenInterfaceAVKit::exitFullscreen): Return directly to inlne.

2016-07-06  Chris Dumez  <cdumez@apple.com>

        Add support for Node.isConnected
        https://bugs.webkit.org/show_bug.cgi?id=159474
        <rdar://problem/27197947>

        Reviewed by Ryosuke Niwa.

        Add support for Node.isConnected as per:
        - https://dom.spec.whatwg.org/#dom-node-isconnected

        Chrome already supports this.

        Test: imported/w3c/web-platform-tests/dom/nodes/Node-isConnected.html

        * dom/Node.idl:

2016-07-06  Brady Eidson  <beidson@apple.com>

        Update IndexedDB's status on the feature page (How had we not done this already?)

        Rubberstamped by Sam Weinig.

        * features.json:

2016-07-06  Antoine Quint  <graouts@apple.com>

        <img> with a wide gamut PDF does not display using a wide gamut color space
        https://bugs.webkit.org/show_bug.cgi?id=158983
        <rdar://problem/25720247>

        Reviewed by Tim Horton.

        Calls to ImageBuffer::createCompatibleBuffer() that do not provide an explicit
        color space will now infer the color space from the provided graphics context
        on platforms using CG. The method signature that takes in a GraphicsContext
        without a color space is now split into a CG-specified implementation and a
        Cairo one to avoid having diverging platform code in ImageBuffer.cpp.

        Some call sites need to provide an explicit color space still, so we add a new
        ImageBuffer::createCompatibleBuffer() that allows for that while inferring
        sizing and scaling from a GraphicsContext.
        
        All signatures of ImageBuffer::createCompatibleBuffer() are losing the
        hasAlpha parameter which was always ignored. All call sites that were using
        hasAlpha have been updated.

        In addition, we make all the IOSurface and IOSurfacePool code, which is
        CG-specific, use the plaform-specific type CGColorSpaceRef instead of ColorSpace
        so that we may pick up on the color space copied over from the graphics context
        in the CG-specific implementation of ImageBuffer::createCompatibleBuffer().

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::drawTextInternal):
        * platform/graphics/GradientImage.cpp:
        (WebCore::GradientImage::drawPattern):
        * platform/graphics/ImageBuffer.cpp:
        (WebCore::ImageBuffer::createCompatibleBuffer):
        * platform/graphics/ImageBuffer.h:
        * platform/graphics/NamedImageGeneratedImage.cpp:
        (WebCore::NamedImageGeneratedImage::drawPattern):
        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBuffer::createCompatibleBuffer):
        * platform/graphics/cg/IOSurfacePool.cpp:
        (WebCore::surfaceMatchesParameters):
        (WebCore::IOSurfacePool::takeSurface):
        * platform/graphics/cg/IOSurfacePool.h:
        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::ImageBuffer::createCompatibleBuffer):
        (WebCore::ImageBuffer::ImageBuffer):
        * platform/graphics/cocoa/IOSurface.h:
        * platform/graphics/cocoa/IOSurface.mm:
        (WebCore::IOSurface::surfaceFromPool):
        (WebCore::IOSurface::create):
        (WebCore::IOSurface::createFromSendRight):
        (WebCore::IOSurface::createFromSurface):
        (WebCore::IOSurface::createFromImage):
        (WebCore::IOSurface::IOSurface):
        (WebCore::IOSurface::ensurePlatformContext):
        * platform/mac/ThemeMac.mm:
        (WebCore::ThemeMac::drawCellOrFocusRingWithViewIntoContext):
        * platform/spi/cg/CoreGraphicsSPI.h:
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintProgressBar):
        * rendering/svg/SVGRenderingContext.cpp:
        (WebCore::SVGRenderingContext::bufferForeground):
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::drawPatternForContainer):

2016-07-06  Tim Horton  <timothy_horton@apple.com>

        Long spin editing text at top of message containing Reader version of web page with many GIFs
        https://bugs.webkit.org/show_bug.cgi?id=159444
        <rdar://problem/26790386>

        Reviewed by Sam Weinig.

        * editing/cocoa/HTMLConverter.mm:
        (fileWrapperForElement):
        Instead of looking up the image's data in the cache by URL, just use the
        CachedImage on the HTMLImageElement. There are situations (which seem to involve
        cloning the DOM then having the cloned DOM get garbage collected) where the image
        can be removed from the cache, but still be live in the document.

2016-07-06  Brady Eidson  <beidson@apple.com>

        Hold RefPtr<>'s to UniqueIDBDatabases while performing user delete.
        https://bugs.webkit.org/show_bug.cgi?id=159471

        Reviewed by Brent Fulgham.

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::closeAndDeleteDatabasesModifiedSince):
        (WebCore::IDBServer::IDBServer::closeAndDeleteDatabasesForOrigins):

2016-07-06  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202725.
        https://bugs.webkit.org/show_bug.cgi?id=159473

        didn't reduce coreui memory usage (Requested by kling on
        #webkit).

        Reverted changeset:

        "[Mac] Get rid of the old timey rubber-banding linen pattern."
        https://bugs.webkit.org/show_bug.cgi?id=159329
        http://trac.webkit.org/changeset/202725

2016-07-06  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] duration query improvements
        https://bugs.webkit.org/show_bug.cgi?id=159458

        Reviewed by Carlos Garcia Campos.

        Currently the player caches the result of the duration query but
        this is overkill because it's cached by playbin already. The only
        time where the player needs to cache the duration is when EOS was
        reached because in that situation the query would fail.

        No new tests, existing media tests cover this patch.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer): Member variables update.
        (WebCore::MediaPlayerPrivateGStreamer::load): Stop the fill timer
        before loading a new URL, the same player can be used for
        different assets.
        (WebCore::MediaPlayerPrivateGStreamer::playbackPosition): Perform
        a duration query, the duration value is no longer locally cached.
        (WebCore::MediaPlayerPrivateGStreamer::duration): Return cached value only after EOS was reached.
        (WebCore::MediaPlayerPrivateGStreamer::fillTimerFired): Perform
        a duration query, the duration value is no longer locally cached.
        (WebCore::MediaPlayerPrivateGStreamer::maxTimeSeekable): Ditto.
        (WebCore::MediaPlayerPrivateGStreamer::maxTimeLoaded): Ditto.
        (WebCore::MediaPlayerPrivateGStreamer::didLoadingProgress): Ditto.
        (WebCore::MediaPlayerPrivateGStreamer::updateStates): Remove duration caching support.
        (WebCore::MediaPlayerPrivateGStreamer::didEnd): Ditto.
        (WebCore::MediaPlayerPrivateGStreamer::durationChanged): Ditto.
        (WebCore::MediaPlayerPrivateGStreamer::cacheDuration): Deleted.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:

2016-07-06  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Height percentages are not properly resolved for item's children
        https://bugs.webkit.org/show_bug.cgi?id=159258

        Reviewed by Sergio Villar Senin.

        When grid items are vertically stretched (default behavior)
        they store their height on RenderBox::overrideLogicalContentHeight().
        In order to resolve the percentage height on the grid item's children
        we need to use that size.

        Test: fast/css-grid-layout/percent-resolution-grid-item-children.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computePercentageLogicalHeight):

2016-07-06  Zan Dobersek  <zdobersek@igalia.com>

        [GTK] Better guard TextureMapper header and CMake includes
        https://bugs.webkit.org/show_bug.cgi?id=159415

        Reviewed by Carlos Garcia Campos.

        * PlatformGTK.cmake: Only include TextureMapper.cmake if USE_TEXTURE_MAPPER is enabled.
        * platform/graphics/GraphicsContext3DPrivate.h: Guard texmap header inclusions with USE(TEXTURE_MAPPER).
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h: Ditto, but wrap it around
        the existing USE(TEXTURE_MAPPER_GL) block.

2016-07-05  Olivier Blin  <olivier.blin@softathome.com>

        [GStreamer] Do not build MediaPlayerPrivateGStreamerOwr when VIDEO is disabled
        https://bugs.webkit.org/show_bug.cgi?id=159425

        Reviewed by Philippe Normand.

        MediaPlayer backends are useful and can be built only when VIDEO is enabled.

        No new tests, behavior is unchanged.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.cpp:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.h:

2016-07-05  Per Arne Vollan  <pvollan@apple.com>

        [Win] Layout Test http/tests/security/contentSecurityPolicy/source-list-parsing-10.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=147646

        Reviewed by Brent Fulgham.

        Fix build error when CSP_NEXT is disabled.

        * DerivedSources.cpp:

2016-07-05  David Kilzer  <ddkilzer@apple.com>

        Throw exceptions for invalid number of channels for ConvolverNode
        <https://webkit.org/b/159238>

        Reviewed by Brent Fulgham.

        Fix based on a Blink change (patch by <rtoy@chromium.org>):
        <https://chromium.googlesource.com/chromium/src.git/+/0cc26bbb7175aec77910d0b47faf9f8c8a640fe5>

        Also includes a related fix for ReverbConvolverStage (patch by <rtoy@chromium.org>):
        <https://src.chromium.org/viewvc/blink?revision=157832&view=revision>

        Test: webaudio/convolver-channels.html

        * Modules/webaudio/ConvolverNode.cpp:
        (WebCore::ConvolverNode::setBuffer): Throw an exception for
        anything but 1, 2 or 4 channels.
        * platform/audio/ReverbConvolverStage.cpp:
        (WebCore::ReverbConvolverStage::ReverbConvolverStage): Don't read past the end of
        the impulseResponse array.

2016-07-05  Johan K. Jensen  <jj@johanjensen.dk>

        Web Inspector: Sending XHR with UTF8 encoded data shows garbled data in Resource sidebar
        https://bugs.webkit.org/show_bug.cgi?id=159358

        Reviewed by Joseph Pecoraro.

        Test: http/tests/inspector/network/xhr-request-data-encoded-correctly.html

        * inspector/InspectorNetworkAgent.cpp:
        (WebCore::buildObjectForResourceRequest):
        * inspector/NetworkResourcesData.cpp:
        (WebCore::NetworkResourcesData::setResourceContent):

2016-07-05  Chris Fleizach  <cfleizach@apple.com>

        AX: Image attachment in email does not show up in AX tree
        https://bugs.webkit.org/show_bug.cgi?id=159422

        Reviewed by Joanmarie Diggs.

        When an image loads after the accessibility tree has already been created, the ignored status
        of that image does not get updated.

        Test: accessibility/image-load-on-delay.html

        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::imageChanged):

2016-07-05  Alex Christensen  <achristensen@webkit.org>

        Fix Windows build.
        https://bugs.webkit.org/show_bug.cgi?id=159103

        * Modules/indexeddb/IDBActiveDOMObject.h:
        (WebCore::IDBActiveDOMObject::callFunctionOnOriginThread):
        WTF.

2016-07-05  Enrica Casucci  <enrica@apple.com>

        HTMLAttachment elements don't receive clicks after the first on iOS.
        https://bugs.webkit.org/show_bug.cgi?id=159310
        rdar://problem/25776940

        Reviewed by Tim Horton.

        shouldSelectOnMouseDown() now returns false on iOS.

        * html/HTMLAttachmentElement.h:

2016-07-05  Brady Eidson  <beidson@apple.com>

        IDBDatabase can null deref its ScriptExecutionContext inside connectionToServerLost.
        <rdar://problem/27169924> and https://bugs.webkit.org/show_bug.cgi?id=159432

        Reviewed by Alex Christensen.

        No new tests (Targeted test not possible, covered peripherally by all IDB tests).

        * Modules/indexeddb/IDBActiveDOMObject.h:
        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::connectionToServerLost): Make sure there is still a script execution context.

2016-07-01  Jer Noble  <jer.noble@apple.com>

        REGRESSION (r202641): Netflix playback stalls after a few seconds
        https://bugs.webkit.org/show_bug.cgi?id=159365

        Reviewed by Eric Carlson.

        Test: LayoutTests/media/media-source/media-source-small-gap.html

        In r202641, we removed a "fudge factor" of 1 millisecond added onto the duration
        of every sample for the purposes of calculating a SourceBuffer's buffered ranges.
        Netflix (and likely other providers) have streams that have 1 "timeScale" gaps
        between segments (e.g., 1/9000s, 1/3003s, etc.). Fill those gaps by looking for
        the previous and next samples and extending the buffered range to cover the gaps
        if they're short enough. We have to ensure that we correctly remove those extended
        durations when we remove samples from the SourceBuffer as well.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::removeSamplesFromTrackBuffer):
        (WebCore::SourceBuffer::removeCodedFrames):
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):

2016-07-05  Brady Eidson  <beidson@apple.com>

        Database process crashes deleting a corrupt SQLite database file (null deref).
        https://bugs.webkit.org/show_bug.cgi?id=155506.

        Reviewed by Alex Christensen.

        Covered by new API test.

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteBackingStore): Null check.

2016-07-05  Brady Eidson  <beidson@apple.com>

        TransactionOperations can get destroyed on the wrong thread.
        https://bugs.webkit.org/show_bug.cgi?id=159103

        Reviewed by Alex Christensen.

        No new tests (Very racy, not feasible to write a dedicated test for, caught on bots occasionally as-is).

        * Modules/indexeddb/IDBActiveDOMObject.h:
        (WebCore::IDBActiveDOMObject::callFunctionOnOriginThread):
        
        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::completeOperation): Pass the last ref to the operation to its
          origin thread to be deleted there.
        
        * Modules/indexeddb/client/TransactionOperation.h:
        (WebCore::IDBClient::TransactionOperation::performCompleteOnOriginThread):

2016-07-05  Youenn Fablet  <youenn@apple.com>

        Remove CredentialRequest ResourceLoaderOptions
        https://bugs.webkit.org/show_bug.cgi?id=159404

        Reviewed by Sam Weinig.

        No observable change of behavior.
        Removing CredentialRequest from ResourceLoaderOptions and replacing it by FetchOptions::Credentials.
        As per https://fetch.spec.whatwg.org/#http-fetch, credentials flag is set according FetchOptions::Credentials.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource): Set credentials mode to Include.
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::redirectReceived): Disable credentials if credentials mode is SameOrigin
        (request being cross origin).
        * loader/MediaResourceLoader.cpp: Refqctoring to use CachedResourceReauest::setAsPotentiallyCrossOrigin.
        Removed unnecessary ResourceRequest copy by using the mutable request of CachedResourceRequest.
        (WebCore::MediaResourceLoader::requestResource):
        * loader/NetscapePlugInStreamLoader.cpp:
        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader): Set credential mode  to Include
        * loader/ResourceLoaderOptions.h: Removing CredentialRequest option.
        (WebCore::ResourceLoaderOptions::ResourceLoaderOptions):
        (WebCore::ResourceLoaderOptions::credentialRequest): Deleted.
        (WebCore::ResourceLoaderOptions::setCredentialRequest): Deleted.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet): Set credential mode to Include.
        (WebCore::CachedResourceLoader::defaultCachedResourceOptions): Ditto.
        * loader/cache/CachedResourceRequest.cpp:
        (WebCore::CachedResourceRequest::setAsPotentiallyCrossOrigin): Set credential mode according crossorigin
        atribute value.
        * loader/icon/IconLoader.cpp:
        (WebCore::IconLoader::startLoading): Set credential mode to Omit.
        * page/EventSource.cpp:
        (WebCore::EventSource::connect): Set credential mode according crossorigin atribute value.
        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
        (WebCore::WebCoreAVCFResourceLoader::startLoading): Set credential mode to Omit.
        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::startLoading): Ditto.
        * platform/network/ResourceHandleTypes.h: Removed definition of CredentialRequest.
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::createRequest): Set credential mode according crossorigin atribute value.

2016-07-04  Fujii Hironori  <Hironori.Fujii@sony.com>

        [GTK] Null Node dereference in FrameSelection::notifyAccessibilityForSelectionChange of FrameSelectionAtk.cpp
        https://bugs.webkit.org/show_bug.cgi?id=159411

        Reviewed by Carlos Garcia Campos.

        Tests:
            editing/selection/selection-in-iframe-removed-crash.html

        * editing/atk/FrameSelectionAtk.cpp:
        (WebCore::FrameSelection::notifyAccessibilityForSelectionChange):
        Added a null check for the return value of containerNode().

2016-07-04  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        [EFL] Remove mac configuration dependency in WebKit Version definition
        https://bugs.webkit.org/show_bug.cgi?id=159407

        Reviewed by Yusuke Suzuki.

        EFL port has been used Version.xconfig file in WebKit/mac/Configurations
        in order to generate WebKitVersion.h file. But it can be simply defined
        in cmake.

        * PlatformEfl.cmake: Remove WebKitVersion.h generation.
        * platform/efl/UserAgentEfl.cpp:
        (WebCore::versionForUAString): Use USER_AGENT_EFL_MAJOR_VERSION and USER_AGENT_EFL_MINOR_VERSION.

2016-07-04  Carlos Garcia Campos  <cgarcia@igalia.com>

        [Coordinated Graphics] Modernize and cleanup CompositingCoordinator
        https://bugs.webkit.org/show_bug.cgi?id=159212

        Reviewed by Žan Doberšek.

        Use references instead of pointers when possible.

        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
        (WebCore::CoordinatedGraphicsLayer::paintToSurface):
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:
        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.cpp:
        (WebCore::CoordinatedImageBacking::update):
        * platform/graphics/texmap/coordinated/CoordinatedImageBacking.h:
        * platform/graphics/texmap/coordinated/CoordinatedSurface.h:
        * platform/graphics/texmap/coordinated/Tile.cpp:
        (WebCore::Tile::updateBackBuffer):
        * platform/graphics/texmap/coordinated/TiledBackingStoreClient.h:

2016-07-04  Youenn Fablet  <youenn@apple.com>

        Remove RequestOriginPolicy from ResourceLoaderOptions
        https://bugs.webkit.org/show_bug.cgi?id=159406

        Reviewed by Sam Weinig.

        Using FetchOptions::mode in lieu of ResourceLoaderOptions::RequestOriginPolicy.
        The cors, no-cors and same-origin values match PotentiallyCrossOriginEnabled,
        UseDefaultOriginRestrictionsForType and RestrictToSameOrigin, default being
        cors/UseDefaultOriginRestrictionsForType as per fetch specification.

        No change of behavior.

        * css/CSSImageSetValue.cpp:
        (WebCore::CSSImageSetValue::cachedImageSet):
        * css/CSSImageValue.cpp:
        (WebCore::CSSImageValue::cachedImage):
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource):
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::requestResource):
        * loader/NetscapePlugInStreamLoader.cpp:
        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader):
        * loader/ResourceLoaderOptions.h:
        (WebCore::ResourceLoaderOptions::ResourceLoaderOptions):
        (WebCore::ResourceLoaderOptions::requestOriginPolicy): Deleted.
        (WebCore::ResourceLoaderOptions::setRequestOriginPolicy): Deleted.
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::init):
        (WebCore::SubresourceLoader::willSendRequestInternal):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet):
        (WebCore::CachedResourceLoader::canRequest):
        (WebCore::CachedResourceLoader::defaultCachedResourceOptions):
        * loader/cache/CachedResourceRequest.cpp:
        (WebCore::CachedResourceRequest::setAsPotentiallyCrossOrigin):
        * loader/icon/IconLoader.cpp:
        (WebCore::IconLoader::startLoading):
        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
        (WebCore::WebCoreAVCFResourceLoader::startLoading):
        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::startLoading):
        * style/StylePendingResources.cpp:
        (WebCore::Style::loadPendingImage):

2016-07-04  Youenn Fablet  <youenn@apple.com>

        Shield WebRTC JS built-ins from user scripts
        https://bugs.webkit.org/show_bug.cgi?id=155964

        Reviewed by Sam Weinig.

        Making use of Promise.prototype.@then instead of Promise.prototype.then.
        Covered by updated tests.

        * Modules/mediastream/RTCPeerConnection.js:
        (createOffer):
        (createAnswer):
        (setLocalDescription):
        (setRemoteDescription):
        (addIceCandidate):
        (getStats):
        * Modules/mediastream/RTCPeerConnectionInternals.js:
        (enqueueOperation):

2016-07-04  Brady Eidson  <beidson@apple.com>

        WebProcesses don't handle DatabaseProcess going away uncleanly..
        https://bugs.webkit.org/show_bug.cgi?id=159371

        Reviewed by Alex Christensen.

        Covered by new API test.

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::didCloseFromServer):
        (WebCore::IDBDatabase::connectionToServerLost):
        * Modules/indexeddb/IDBDatabase.h:
        
        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::connectionToServerLost): Notify all IDBDatabase
          connections, as well as all pending IDBOpenDBRequests, with the error about the
          server connection dropping.
        * Modules/indexeddb/client/IDBConnectionProxy.h:
        
        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::connectionToServerLost):
        * Modules/indexeddb/client/IDBConnectionToServer.h:
        
        * Modules/indexeddb/shared/IDBError.h:

2016-07-04  Philippe Normand  <pnormand@igalia.com>

        Release build with logging enabled fails
        https://bugs.webkit.org/show_bug.cgi?id=159403

        Reviewed by Žan Doberšek.

        Protect logging-related methods with !LOG_DISABLED.

        * Modules/indexeddb/IDBDatabaseIdentifier.cpp:
        * Modules/indexeddb/IDBDatabaseIdentifier.h:
        * Modules/indexeddb/IDBKey.cpp:
        * Modules/indexeddb/IDBKey.h:
        * Modules/indexeddb/IDBKeyData.cpp:
        * Modules/indexeddb/IDBKeyData.h:
        * Modules/indexeddb/IDBKeyPath.cpp:
        (WebCore::IDBKeyPath::IDBKeyPath):
        * Modules/indexeddb/IDBKeyRangeData.cpp:
        * Modules/indexeddb/IDBKeyRangeData.h:
        * Modules/indexeddb/server/IndexValueEntry.cpp:
        (WebCore::IDBServer::IndexValueEntry::Iterator::isValid):
        * Modules/indexeddb/server/IndexValueStore.cpp:
        * Modules/indexeddb/server/IndexValueStore.h:
        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::clearObjectStore):
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::isVersionChangeInProgress):
        * Modules/indexeddb/shared/IDBDatabaseInfo.cpp:
        * Modules/indexeddb/shared/IDBDatabaseInfo.h:
        * Modules/indexeddb/shared/IDBIndexInfo.cpp:
        * Modules/indexeddb/shared/IDBIndexInfo.h:
        * Modules/indexeddb/shared/IDBObjectStoreInfo.cpp:
        * Modules/indexeddb/shared/IDBObjectStoreInfo.h:
        * Modules/indexeddb/shared/IDBResourceIdentifier.cpp:
        * Modules/indexeddb/shared/IDBResourceIdentifier.h:
        * Modules/indexeddb/shared/IDBTransactionInfo.cpp:
        * Modules/indexeddb/shared/IDBTransactionInfo.h:
        * page/SecurityOriginData.cpp:
        * page/SecurityOriginData.h:

2016-07-04  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202556.
        https://bugs.webkit.org/show_bug.cgi?id=159399

        introduces deadlocks (Requested by philn on #webkit).

        Reverted changeset:

        "[GStreamer] improved duration query support in the HTTP
        source element"
        https://bugs.webkit.org/show_bug.cgi?id=159204
        http://trac.webkit.org/changeset/202556

2016-07-03  Carlos Garcia Campos  <cgarcia@igalia.com>

        [image-decoders] Make ImageDecoder::size() lazily decode the image if needed to return a valid size
        https://bugs.webkit.org/show_bug.cgi?id=159297

        Reviewed by Antonio Gomes.

        It's otherwise confusing leading to bugs like #159089.

        * platform/image-decoders/ImageDecoder.cpp:
        (WebCore::ImageDecoder::createFrameImageAtIndex): Check the size at the beginning and return early if it's
        empty. We no longer need to check the size after calling frameBufferAtIndex().
        * platform/image-decoders/ImageDecoder.h:
        (WebCore::ImageDecoder::size): Check first is size is available, which lazily decodes the image.
        (WebCore::ImageDecoder::scaledSize): Remove const.
        (WebCore::ImageDecoder::frameSizeAtIndex): Ditto.
        * platform/image-decoders/ico/ICOImageDecoder.cpp:
        (WebCore::ICOImageDecoder::size): Ditto.
        (WebCore::ICOImageDecoder::frameSizeAtIndex): Ditto.
        * platform/image-decoders/ico/ICOImageDecoder.h:

2016-07-02  Youenn Fablet  <youenn@apple.com>

        Synchronous preflight checker should set loading options to not use credentials
        https://bugs.webkit.org/show_bug.cgi?id=159351

        Reviewed by Alex Christensen.

        Like for asynchronous preflighting, synchronous preflighting loading options should disqble any credentials.

        No change of behavior as preflight request is expressly set to not use credentials in
        createAccessControlPreflightRequest.

        * loader/CrossOriginPreflightChecker.cpp:
        (WebCore::CrossOriginPreflightChecker::doPreflight):

2016-07-01  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202766.
        https://bugs.webkit.org/show_bug.cgi?id=159382

        The new test asserts every time (Requested by ap on #webkit).

        Reverted changeset:

        "Web Inspector: Sending XHR with UTF8 encoded data shows
        garbled data in Resource sidebar"
        https://bugs.webkit.org/show_bug.cgi?id=159358
        http://trac.webkit.org/changeset/202766

2016-07-01  Zalan Bujtas  <zalan@apple.com>

        prepareForDestruction() always needs to be called before destroying the Document object.
        https://bugs.webkit.org/show_bug.cgi?id=159372
        rdar://problem/26788150

        Reviewed by Antti Koivisto.

        We should never start destroying the Document object without calling prepareForDestruction() first.
        It ensures that render tree gets nuked before we start tearing down the node tree.

        Test: fast/history/page-cache-destroy-document.html

        * dom/Document.cpp:
        (WebCore::Document::removedLastRef):

2016-07-01  Johan K. Jensen  <jj@johanjensen.dk>

        Web Inspector: Sending XHR with UTF8 encoded data shows garbled data in Resource sidebar
        https://bugs.webkit.org/show_bug.cgi?id=159358

        Reviewed by Joseph Pecoraro.

        Test: http/tests/inspector/network/xhr-request-data-encoded-correctly.html

        * inspector/InspectorNetworkAgent.cpp:
        (WebCore::buildObjectForResourceRequest):

2016-07-01  Dean Jackson  <dino@apple.com>

        "image-src" support is missing. We only support "-webkit-image-src"
        https://bugs.webkit.org/show_bug.cgi?id=159373
        <rdar://problem/27140443>

        Patch by Brent Fulgham and Dean Jackson.
        Reviewed by Dean Jackson and Brent Fulgham.

        Support unprefixed image-set.

        Test: fast/css/image-set-unprefixed.html

        * css/CSSImageSetValue.cpp:
        (WebCore::CSSImageSetValue::customCSSText):
        * css/CSSParser.cpp:
        (WebCore::isImageSetFunctionValue): New helper function
        that checks prefixed and unprefixed form.
        (WebCore::CSSParser::parseValue): Use the helper.
        (WebCore::CSSParser::parseContent):
        (WebCore::CSSParser::parseFillImage):
        (WebCore::CSSParser::parseBorderImage):

2016-07-01  Chris Dumez  <cdumez@apple.com>

        Possible null Range dereference under AXObjectCache::visiblePositionFromCharacterOffset()
        https://bugs.webkit.org/show_bug.cgi?id=159330
        <rdar://problem/27123752>

        Reviewed by Benjamin Poulain.

        rangeForUnorderedCharacterOffsets() can return a null Range but we failed
        to do a null check before dereferencing it.

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::visiblePositionFromCharacterOffset):

2016-07-01  Chris Dumez  <cdumez@apple.com>

        Regression(r199087): window.focus() / window.close() can no longer be called by a Window's opener
        https://bugs.webkit.org/show_bug.cgi?id=159364
        <rdar://problem/27117169>

        Reviewed by Gavin Barraclough.

        window.focus() / window.close() could no longer be called by a Window's opener
        after r199087, which would break focusing of open iWork documents on icloud.com.

        Before r199087, we would construct a new function in the caller's context every
        time window.focus and window.close was accessed. r199087 fixed the issue so that
        we always call the same function. However, those functions are using
        [CallWith=Document] and they are were no longer passed the *caller*'s document
        as a result. This broke focus / close permission checking as the code needed the
        caller's document to do the check.

        This patch introduces [CallWith=CallerDocument] and [CallWith=CallerWindow] so
        that the implementation can now pass the caller's Document / Window to the
        implementation. The bindings rely on JSDOMWindow's callerDOMWindow() to get the
        caller DOMWindow / document. This new functionality is now used for window.close
        and window.focus to unbreak their permission checking.

        Test: fast/dom/Window/child-window-focus.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateCallWith):
        * bindings/scripts/IDLAttributes.txt:
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::focus):
        * page/DOMWindow.h:
        * page/DOMWindow.idl:

2016-07-01  Chris Dumez  <cdumez@apple.com>

        [iOS] Possible null Range dereference under computeAutocorrectionContext()
        https://bugs.webkit.org/show_bug.cgi?id=159328
        <rdar://problem/26766720>

        Reviewed by Benjamin Poulain.

        * editing/Editor.cpp:
        (WebCore::Editor::compositionRange):
        * editing/Editor.h:
        Update to return a RefPtr instead of a PassRefPtr and use nullptr
        instead of 0 in the implementation.

2016-07-01  Jon Davis  <jond@apple.com>

        Updated Picture element and WOFF 2 status
        https://bugs.webkit.org/show_bug.cgi?id=159356

        Reviewed by Timothy Hatcher.
        
        Status updates and clean-up to move Web Animations and Resource Timing entries from JSC to WebCore.

        * features.json:

2016-07-01  Andreas Kling  <akling@apple.com>

        Add early return when processing content extensions if there aren't any.
        <https://webkit.org/b/159363>

        Reviewed by Antti Koivisto.

        Short-circuit outta there if there aren't any extensions to query.

        * contentextensions/ContentExtensionsBackend.cpp:
        (WebCore::ContentExtensions::ContentExtensionsBackend::processContentExtensionRulesForLoad):

2016-07-01  Eric Carlson  <eric.carlson@apple.com>

        HTMLMediaElement::resume() may cause JavaScript execution
        https://bugs.webkit.org/show_bug.cgi?id=159327
        <rdar://problem/27131641>

        Reviewed by Jer Noble.

        HTMLMediaElement::updatePlayState can cause an element to begin playing and enter fullscreen,
        which can result in a call to the media controls and JavaScript execution. Javascript is not
        allowed allowed to run when a page resumes, so make the call to updatePlayState asynchronous.

        No new tests, I wasn't able to create a test that triggers the crash.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::scheduleDelayedAction): Support UpdatePlayState.
        (WebCore::HTMLMediaElement::pendingActionTimerFired): Ditto.
        (WebCore::HTMLMediaElement::setReadyState): UpdateMediaState -> UpdateState.
        (WebCore::HTMLMediaElement::playInternal): Don't call updateMediaController, it is called
          by updatePlayState.
        (WebCore::HTMLMediaElement::setMuted): UpdateMediaState -> UpdateState.
        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Ditto.
        (WebCore::HTMLMediaElement::mediaEngineWasUpdated): Update media state asynchronously.
        (WebCore::HTMLMediaElement::updatePlayState): Add parameter to allow update to happen
          asynchronously.
        (WebCore::HTMLMediaElement::setPlaying): UpdateMediaState -> UpdateState.
        (WebCore::HTMLMediaElement::setPausedInternal): Update media state asynchronously.
        (WebCore::HTMLMediaElement::mediaPlayerCurrentPlaybackTargetIsWirelessChanged):  
          UpdateMediaState -> UpdateState.
        (WebCore::HTMLMediaElement::removeEventListener): Ditto.
        (WebCore::HTMLMediaElement::enqueuePlaybackTargetAvailabilityChangedEvent): Ditto.
        (WebCore::HTMLMediaElement::updateMediaState): UpdateMediaState -> UpdateState
        * html/HTMLMediaElement.h:
        * html/HTMLMediaElementEnums.h: Add UpdatePlayState.

2016-07-01  Brady Eidson  <beidson@apple.com>

        Blob content type not preserved when retrieving blobs from IndexedDB.
        <rdar://problem/27057357> and https://bugs.webkit.org/show_bug.cgi?id=159360

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/blob-svg-image.html

        * fileapi/Blob.cpp:
        (WebCore::Blob::Blob):

        * fileapi/ThreadableBlobRegistry.cpp:
        (WebCore::postToMainThread):
        (WebCore::ThreadableBlobRegistry::registerBlobURLOptionallyFileBacked): Pass along the content type
          to the blob registry so that if the file-backed blob takes over, it has the content type.
        (WebCore::threadableQueue): Deleted.
        * fileapi/ThreadableBlobRegistry.h:

        * platform/network/BlobRegistry.h:

        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::registerBlobURL):
        (WebCore::BlobRegistryImpl::registerBlobURLOptionallyFileBacked):
        * platform/network/BlobRegistryImpl.h:

2016-07-01  Youenn Fablet  <youenn@apple.com>

        Make ResourceLoaderOptions derive from FetchOptions
        https://bugs.webkit.org/show_bug.cgi?id=159345

        Reviewed by Alex Christensen.

        No change of behavior.

        * Modules/fetch/FetchLoader.cpp:
        (WebCore::FetchLoader::start):
        * loader/CrossOriginPreflightChecker.cpp:
        (WebCore::CrossOriginPreflightChecker::startPreflight):
        * loader/ResourceLoaderOptions.h:
        (WebCore::ResourceLoaderOptions::fetchOptions): Deleted.
        (WebCore::ResourceLoaderOptions::setFetchOptions): Deleted.
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::willSendRequestInternal):
        * loader/ThreadableLoader.h: Removing securityOrigin field (left over from https://bugs.webkit.org/show_bug.cgi?id=159221)

2016-07-01  Per Arne Vollan  <pvollan@apple.com>

        [Win] Animations tests are crashing in debug mode.
        https://bugs.webkit.org/show_bug.cgi?id=159335

        Reviewed by Alex Christensen.

        A MSVC runtime check fails because an uninitialized variable is being used.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::keyframeStylesForAnimation):

2016-07-01  Youenn Fablet  <youennf@gmail.com>

        Add a runtime flag for DOM iterators
        https://bugs.webkit.org/show_bug.cgi?id=159300

        Reviewed by Alex Christensen.

        * Modules/fetch/FetchHeaders.idl: Making iterator runtime-enabled.
        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::setDOMIteratorEnabled):
        (WebCore::RuntimeEnabledFeatures::domIteratorEnabled):
        * bindings/scripts/CodeGeneratorJS.pm:
        (ToMethodName): Fixing dOM -> dom casing issue.
        (GenerateImplementation): Using addIterableProperties new method.
        (addIterableProperties): Activating property addition according runtime flag if iterator is rnutime flagged.
        * bindings/scripts/IDLParser.pm:
        (parseOptionalIterableInterface): Adding extendedAttributes to iterable.
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::JSTestNodePrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjPrototype::finishCreation):
        * bindings/scripts/test/TestNode.idl: Making iterator runtime-enabled.
        * bindings/scripts/test/TestObj.idl: Ditto.
        * css/FontFaceSet.idl: Ditto.
        * dom/NodeList.idl: Ditto.

2016-07-01  Frederic Wang  <fwang.igalia.com>

        Eliminate trailing whitespace in MathML code
        https://bugs.webkit.org/show_bug.cgi?id=159091

        Reviewed by Alex Christensen.

        No new tests, behavior is unchanged.

        * rendering/mathml/RenderMathMLBlock.cpp:
        (WebCore::RenderMathMLBlock::baselinePosition):
        (WebCore::RenderMathMLBlock::paint):
        (WebCore::parseMathMLNamedSpace):
        * rendering/mathml/RenderMathMLBlock.h:
        * rendering/mathml/RenderMathMLFenced.cpp:
        (WebCore::RenderMathMLFenced::updateFromElement):
        (WebCore::RenderMathMLFenced::addChild):
        * rendering/mathml/RenderMathMLFenced.h:
        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::styleDidChange):
        (WebCore::RenderMathMLFraction::paint):
        * rendering/mathml/RenderMathMLFraction.h:
        * rendering/mathml/RenderMathMLMath.h:
        * rendering/mathml/RenderMathMLMenclose.h:
        * rendering/mathml/RenderMathMLOperator.cpp:
        * rendering/mathml/RenderMathMLOperator.h:
        * rendering/mathml/RenderMathMLRoot.cpp:
        (WebCore::RenderMathMLRoot::paint):
        * rendering/mathml/RenderMathMLScripts.cpp:
        * rendering/mathml/RenderMathMLSpace.cpp:
        * rendering/mathml/RenderMathMLSpace.h:
        * rendering/mathml/RenderMathMLToken.h:
        * rendering/mathml/RenderMathMLUnderOver.cpp:
        * rendering/mathml/RenderMathMLUnderOver.h:

2016-07-01  Frederic Wang  <fwang@igalia.com>

        Small cleanup: Remove unused functions RenderObject::isRenderMathML*Wrapper
        https://bugs.webkit.org/show_bug.cgi?id=159333

        Reviewed by Alex Christensen.

        After the refactoring of RenderMathMLRoot and RenderMathMLScripts, the anonymous flexbox
        wrappers used in the old layout implementation have been removed. We thus remove the
        corresponding isRender* function from RenderObject.

        No new tests, behavior is unchanged.

        * rendering/RenderObject.h:
        (WebCore::RenderObject::isRenderMathMLRootWrapper): Deleted.
        (WebCore::RenderObject::isRenderMathMLScriptsWrapper): Deleted.

2016-07-01  Andreas Kling  <akling@apple.com>

        [Mac] Get rid of the old timey rubber-banding linen pattern.
        <https://webkit.org/b/159329>

        Reviewed by Benjamin Poulain.

        Remove the "ScrollingOverhang" custom GraphicsLayer appearance since that was only used to
        install the old timey linen pattern behind the web content.

        We now always just set the overhang area's background color to the document background color.

        This fixes an issue where we could end up loading the linen pattern and keeping it in memory
        despite never actually showing it on screen.

        * platform/ScrollbarTheme.h:
        (WebCore::ScrollbarTheme::setUpOverhangAreasLayerContents): Deleted.
        * platform/graphics/GraphicsLayer.cpp:
        * platform/graphics/GraphicsLayer.h:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (PlatformCALayerCocoa::updateCustomAppearance):
        * platform/mac/ScrollbarThemeMac.h:
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::linenBackgroundColor): Deleted.
        (WebCore::ScrollbarThemeMac::setUpOverhangAreaBackground): Deleted.
        (WebCore::ScrollbarThemeMac::removeOverhangAreaBackground): Deleted.
        (WebCore::ScrollbarThemeMac::setUpOverhangAreasLayerContents): Deleted.
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
        (WebCore::RenderLayerCompositor::setRootExtendedBackgroundColor):

2016-06-30  Jiewen Tan  <jiewen_tan@apple.com>

        Create a generic "linked-on-or-after" check for new CSP Rules
        https://bugs.webkit.org/show_bug.cgi?id=159322
        <rdar://problem/27117220>

        Reviewed by Brent Fulgham.

        Create a generic "linked-on-or-after" check for new CSP Rules and cleanup
        quirks for Ecobee, Quora and XtraMat.

        * platform/RuntimeApplicationChecks.h:
        * platform/RuntimeApplicationChecks.mm:
        (WebCore::IOSApplication::isEcobee): Deleted.
        (WebCore::IOSApplication::isQuora): Deleted.
        (WebCore::IOSApplication::isXtraMath): Deleted.

2016-06-30  Antti Koivisto  <antti@apple.com>

        WebContent crash due to RELEASE_ASSERT(!m_inLoadPendingImages) in StyleResolver::~StyleResolver()
        https://bugs.webkit.org/show_bug.cgi?id=159307
        <rdar://problem/26184868>

        Reviewed by Andreas Kling.

        Pseudo elements are resolved in RenderTreeUpdater (instead of Style::TreeResolver). Their resolution may trigger
        resource loads which can cause synchronous layout (when failing synchronously) and lead to destruction of the
        the style resolver in post layout task.

        No known reliable way to test this.

        * style/RenderTreeUpdater.cpp:
        (WebCore::RenderTreeUpdater::commit):

            Use PostResolutionCallbackDisabler in RenderTreeUpdater similarly to Style::TreeResolver. This prevents
            post layout tasks from running synchronously and closes this particular crash path.

2016-06-30  Antoine Quint  <graouts@apple.com>

        Drawing an SVG image into a <canvas> that is not in the DOM draws the wrong region
        https://bugs.webkit.org/show_bug.cgi?id=159276

        Reviewed by Dean Jackson.

        In the event where the <img> element that we are passing to CanvasRenderingContext2D.drawImage()
        points to an SVG resource, we ensure that the container for the SVG image is sized to match the
        HTML element. The necessity for setting this container size, explained in webkit.org/b/148845,
        is that we must ensure a cached image does not have an outdated container size.

        Tests: svg/as-image/img-with-svg-resource-in-dom-and-drawImage.html
               svg/as-image/img-with-svg-resource-in-dom-no-size-and-drawImage.html
               svg/as-image/img-with-svg-resource-not-in-dom-and-drawImage.html
               svg/as-image/img-with-svg-resource-not-in-dom-no-size-and-drawImage.html

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::drawImage):

2016-06-30  Eric Carlson  <eric.carlson@apple.com>

        getUserMedia() exposed, but not functional
        https://bugs.webkit.org/show_bug.cgi?id=158393
        <rdar://problem/26642259>

        Reviewed by Dean Jackson.
        
        Set default value of the Media Stream runtime flag to false on Mac OS X and iOS until the
        browser support is in place.

        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures): Disable media stream by default
        on Mac OS X and iOS.
        * bindings/generic/RuntimeEnabledFeatures.h:

2016-06-30  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202676.
        https://bugs.webkit.org/show_bug.cgi?id=159314

        This change caused storage/websql tests to crash on Mac and
        iOS WK1 (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "Purge PassRefPtr in Modules/webdatabase"
        https://bugs.webkit.org/show_bug.cgi?id=159255
        http://trac.webkit.org/changeset/202676

2016-06-30  Antoine Quint  <graouts@apple.com>

        [iOS] Media controls are too cramped with small video
        https://bugs.webkit.org/show_bug.cgi?id=158815
        <rdar://problem/26824238>

        Reviewed by Eric Carlson.

        In updateLayoutForDisplayedWidth(), we try to ensure a minimum width is guaranteed
        for the progress indicator. However, we were not accounting for the width used by
        the current and remaining time labels on either side of it, so we would incorrectly
        conclude that we were guaranteeing the minimum time and yield incorrect layouts since
        we were trying to fit more buttons than we had room for.

        In order to correctly compute the available width for the progress indicator, we now
        have clones of the current and remaining time labels, hidden from video and VoiceOver,
        that we update along with the originals. The same styles apply to both clones and
        originals, so we may measure the clones to determine the space used by the time labels.
        The reason we need to use clones is that if the time labels had previously been hidden
        from view, precisely because there was not enough space to display them along with the
        progress indicator, then trying to obtain metrics from them would yield 0 since they had
        "display: none" styles applied. In order to avoid extra layouts and possible flashing, we
        use the clones so that we never have to toggle the "display" property of the originals
        just to obtain their measurements.

        As a result of this change, we adjust the constant used to set the minimum required
        width available to display the progress indicator after all other essential controls
        and labels have been measured. That constant used to account for the width of the
        time labels, and this is no longer correct.

        Test: media/video-controls-drop-and-restore-timeline.html

        * Modules/mediacontrols/mediaControlsApple.css:
        (::-webkit-media-controls-time-remaining-display.clone):
        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller):
        (Controller.prototype.createTimeClones):
        (Controller.prototype.removeTimeClass):
        (Controller.prototype.addTimeClass):
        (Controller.prototype.updateDuration):
        (Controller.prototype.updateLayoutForDisplayedWidth):
        (Controller.prototype.updateTime):
        (Controller.prototype.updateControlsWhileScrubbing):
        * Modules/mediacontrols/mediaControlsiOS.css:
        (::-webkit-media-controls-time-remaining-display.clone):
        * Modules/mediacontrols/mediaControlsiOS.js:

2016-06-30  Brian Burg  <bburg@apple.com>

        Unreviewed, fix the macOS Sierra Release configuration after r202642.

        * platform/audio/mac/MediaSessionManagerMac.mm:
        (WebCore::MediaSessionManagerMac::updateNowPlayingInfo):
        Add missing UNUSED_PARAM for when logging is not enabled.

2016-06-30  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202679.
        https://bugs.webkit.org/show_bug.cgi?id=159302

        Still causing timeouts on media/controls-drag-timebar.html
        (Requested by ap on #webkit).

        Reverted changeset:

        "[iOS] Media controls are too cramped with small video"
        https://bugs.webkit.org/show_bug.cgi?id=158815
        http://trac.webkit.org/changeset/202679

2016-06-30  Antoine Quint  <graouts@apple.com>

        [iOS] Media controls are too cramped with small video
        https://bugs.webkit.org/show_bug.cgi?id=158815
        <rdar://problem/26824238>

        Reviewed by Eric Carlson.

        In updateLayoutForDisplayedWidth(), we try to ensure a minimum width is guaranteed
        for the progress indicator. However, we were not accounting for the width used by
        the current and remaining time labels on either side of it, so we would incorrectly
        conclude that we were guaranteeing the minimum time and yield incorrect layouts since
        we were trying to fit more buttons than we had room for.

        In order to correctly compute the available width for the progress indicator, we now
        have clones of the current and remaining time labels, hidden from video and VoiceOver,
        that we update along with the originals. The same styles apply to both clones and
        originals, so we may measure the clones to determine the space used by the time labels.
        The reason we need to use clones is that if the time labels had previously been hidden
        from view, precisely because there was not enough space to display them along with the
        progress indicator, then trying to obtain metrics from them would yield 0 since they had
        "display: none" styles applied. In order to avoid extra layouts and possible flashing, we
        use the clones so that we never have to toggle the "display" property of the originals
        just to obtain their measurements.

        As a result of this change, we adjust the constant used to set the minimum required
        width available to display the progress indicator after all other essential controls
        and labels have been measured. That constant used to account for the width of the
        time labels, and this is no longer correct.

        Test: media/video-controls-drop-and-restore-timeline.html

        * Modules/mediacontrols/mediaControlsApple.css:
        (::-webkit-media-controls-time-remaining-display.clone):
        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller):
        (Controller.prototype.createTimeClones):
        (Controller.prototype.removeTimeClass):
        (Controller.prototype.addTimeClass):
        (Controller.prototype.updateDuration):
        (Controller.prototype.updateLayoutForDisplayedWidth):
        (Controller.prototype.updateTime):
        (Controller.prototype.updateControlsWhileScrubbing):
        * Modules/mediacontrols/mediaControlsiOS.css:
        (::-webkit-media-controls-time-remaining-display.clone):
        * Modules/mediacontrols/mediaControlsiOS.js:

2016-06-30  Eric Carlson  <eric.carlson@apple.com>

        [Mac] Crash registering AVFoundation media engine
        https://bugs.webkit.org/show_bug.cgi?id=159269
        <rdar://problem/27017656>

        Reviewed by Brent Fulgham.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::mediaEngineVectorLock): New, return the static Lock.
        (WebCore::haveMediaEnginesVector): Wrap the naked bool.
        (WebCore::buildMediaEnginesVector): Assert that the lock is locked.
        (WebCore::installedMediaEngines): Hold the lock while checking/rebuilding the vector.
        (WebCore::MediaPlayer::resetMediaEngines): Hold the lock while clearing the vector.

        Use SOFT_LINK_CLASS_FOR_SOURCE instead of SOFT_LINK_CLASS because the former uses dispatch_once
        to ensure that class loading is thread safe.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::registerMediaEngine):
        (WebCore::assetCacheForPath):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::originsInMediaCache):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::clearMediaCache):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::clearMediaCacheForOrigins):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerItem):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoOutput):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createOpenGLVideoOutput):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::waitForVideoOutputMediaDataWillChange):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::outputMediaDataWillChange):
        (-[WebCoreAVFPullDelegate setCallback:]):
        (-[WebCoreAVFPullDelegate outputMediaDataWillChange:]):
        (-[WebCoreAVFPullDelegate outputSequenceWasFlushed:]):

2016-06-30  Carlos Garcia Campos  <cgarcia@igalia.com>

        [image-decoders] Use final and override in ImageDecoder subclasses
        https://bugs.webkit.org/show_bug.cgi?id=159291

        Reviewed by Antonio Gomes.

        * platform/image-decoders/bmp/BMPImageDecoder.h:
        * platform/image-decoders/gif/GIFImageDecoder.h:
        * platform/image-decoders/ico/ICOImageDecoder.cpp:
        (WebCore::ICOImageDecoder::frameSizeAtIndex):
        * platform/image-decoders/ico/ICOImageDecoder.h:
        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
        * platform/image-decoders/png/PNGImageDecoder.h:
        * platform/image-decoders/webp/WEBPImageDecoder.h:

2016-06-30  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Purge PassRefPtr in Modules/webdatabase
        https://bugs.webkit.org/show_bug.cgi?id=159255

        Reviewed by Benjamin Poulain.

        As a step to remove PassRefPtr use, this patch cleans it up in Modules/webdatabase.

        Additionally unnecessary spaces and tabs are removed too.

        * Modules/webdatabase/ChangeVersionWrapper.cpp:
        * Modules/webdatabase/DOMWindowWebDatabase.h:
        * Modules/webdatabase/Database.cpp:
        (WebCore::Database::Database):
        (WebCore::Database::~Database):
        (WebCore::Database::scheduleTransaction):
        (WebCore::Database::runTransaction):
        * Modules/webdatabase/Database.h:
        * Modules/webdatabase/DatabaseAuthorizer.cpp:
        (WebCore::DatabaseAuthorizer::allowRead):
        * Modules/webdatabase/DatabaseManager.cpp:
        (WebCore::DatabaseManager::openDatabase):
        (WebCore::DatabaseManager::fullPathForDatabase):
        (WebCore::DatabaseManager::detailsForNameAndOrigin):
        * Modules/webdatabase/DatabaseManager.h:
        * Modules/webdatabase/DatabaseTask.cpp:
        (WebCore::DatabaseTransactionTask::DatabaseTransactionTask):
        * Modules/webdatabase/DatabaseTask.h:
        * Modules/webdatabase/SQLCallbackWrapper.h:
        (WebCore::SQLCallbackWrapper::SQLCallbackWrapper):
        * Modules/webdatabase/SQLResultSetRowList.h:
        * Modules/webdatabase/SQLStatement.cpp:
        (WebCore::SQLStatement::SQLStatement):
        (WebCore::SQLStatement::sqlError):
        (WebCore::SQLStatement::sqlResultSet):
        * Modules/webdatabase/SQLStatement.h:
        * Modules/webdatabase/SQLTransaction.h:
        * Modules/webdatabase/SQLTransactionBackend.cpp:
        (WebCore::SQLTransactionBackend::create):
        (WebCore::SQLTransactionBackend::SQLTransactionBackend):
        (WebCore::SQLTransactionBackend::transactionError):
        * Modules/webdatabase/SQLTransactionBackend.h:

2016-06-30  Carlos Garcia Campos  <cgarcia@igalia.com>

        [Coordinated Graphics] Move CompositingCoordinator from platform to WebKit2 layer
        https://bugs.webkit.org/show_bug.cgi?id=159209

        Reviewed by Žan Doberšek.

        Remove CompositingCoordinator and its helper classes from the platform layer.

        * platform/TextureMapper.cmake:

2016-06-29  Youenn Fablet  <youenn@apple.com>

        Pass SecurityOrigin as references in CORS check code
        https://bugs.webkit.org/show_bug.cgi?id=159263

        Reviewed by Alex Christensen.

        No change of behavior.

        * css/CSSImageSetValue.cpp:
        (WebCore::CSSImageSetValue::cachedImageSet):
        * css/CSSImageValue.cpp:
        (WebCore::CSSImageValue::cachedImage):
        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::requestScript):
        * loader/CrossOriginAccessControl.cpp:
        (WebCore::updateRequestForAccessControl):
        (WebCore::createAccessControlPreflightRequest):
        (WebCore::passesAccessControlCheck):
        * loader/CrossOriginAccessControl.h:
        * loader/CrossOriginPreflightChecker.cpp:
        (WebCore::CrossOriginPreflightChecker::validatePreflightResponse):
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequest):
        (WebCore::DocumentThreadableLoader::preflightSuccess):
        (WebCore::DocumentThreadableLoader::isAllowedRedirect):
        (WebCore::DocumentThreadableLoader::securityOrigin):
        * loader/DocumentThreadableLoader.h:
        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::updateFromElement):
        * loader/LinkLoader.cpp:
        (WebCore::preloadIfNeeded):
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::requestResource):
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::checkCrossOriginAccessControl):
        * loader/TextTrackLoader.cpp:
        (WebCore::TextTrackLoader::load):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::passesAccessControlCheck):
        * loader/cache/CachedResourceRequest.cpp:
        (WebCore::CachedResourceRequest::setAsPotentiallyCrossOrigin):

2016-06-29  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Implement MediaEndpointPeerConnection::setConfiguration()
        https://bugs.webkit.org/show_bug.cgi?id=159254

        Reviewed by Eric Carlson.

        Implement MediaEndpointPeerConnection::setConfiguration() which is the
        MediaEndpointPeerConnection implementation of RTCPeerConnection.setConfiguration() [1].

        [1] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html#dom-rtcpeerconnection-setconfiguration

        Testing: Updated existing test.

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::setConfiguration):
        Implemented.
        * Modules/mediastream/RTCConfiguration.cpp:
        (WebCore::RTCConfiguration::initialize):
        * Modules/mediastream/RTCConfiguration.h:
        Use shared enums.
        * Modules/mediastream/RTCConfiguration.idl:
        Remove 'None'/'Public' IceTransportPolicy enum value (removed from WebRTC 1.0).
        * platform/mediastream/MediaEndpointConfiguration.cpp:
        (WebCore::MediaEndpointConfiguration::MediaEndpointConfiguration):
        * platform/mediastream/MediaEndpointConfiguration.h:
        Use shared enums.
        (WebCore::MediaEndpointConfiguration::create):
        * platform/mediastream/PeerConnectionStates.h: Renamed from Source/WebCore/Modules/mediastream/PeerConnectionStates.h.
        Make shared enums accessible to platform objects (currently MediaEndpointConfiguration).

2016-06-29  Hunseop Jeong  <hs85.jeong@samsung.com>

        Unreviewed, CMake build fix - 2.

        * PlatformMac.cmake:

2016-06-29  Hunseop Jeong  <hs85.jeong@samsung.com>

        Unreviewed, CMake build fix. 

        * PlatformMac.cmake:

2016-06-29  Jer Noble  <jer.noble@apple.com>

        Unprefix webkit-playsinline.
        https://bugs.webkit.org/show_bug.cgi?id=159283

        Reviewed by Eric Carlson.

        Tests: media/video-playsinline.html
               media/video-webkit-playsinline.html

        Unprefix the webkit-playsinline content attribute, as an unprefixed version
        was added to the HTML spec by <https://github.com/whatwg/html/pull/1444>.
        The new 'playsinline' content attribute reflects to a new DOM property of
        the same name.

        * html/HTMLAttributeNames.in:
        * html/HTMLVideoElement.idl:
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::requiresFullscreenForVideoPlayback):

2016-06-29  Alex Christensen  <achristensen@webkit.org>

        Fix null dereferencing after r201441
        https://bugs.webkit.org/show_bug.cgi?id=159282
        rdar://problem/27082559

        Reviewed by Andreas Kling.

        No new tests.  This is reproducible when dragging from regular to high-DPI displays, 
        and we don't have testing infrastructure for simulating that.

        * css/MediaQueryMatcher.cpp:
        (WebCore::MediaQueryMatcher::styleResolverChanged):
        MediaQueryListListener::queryChanged can mutate the Vector of listeners while we are iterating it.
        Copy the Vector of listeners and iterate the copy so we don't go out of bounds.

2016-06-29  Antti Koivisto  <antti@apple.com>

        Factor pending CSS resources into a struct
        https://bugs.webkit.org/show_bug.cgi?id=159268

        Reviewed by Andreas Kling.

        To fix resource loading related re-entrancy issues in StyleResolver we should move the triggering of
        resource loads outside the style resolver. The first step for that is to capture pending resources to a struct.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSCursorImageValue.cpp:
        (WebCore::CSSCursorImageValue::cachedImage):
        (WebCore::CSSCursorImageValue::cachedOrPendingImage):
        * css/CSSCursorImageValue.h:
        * css/CSSGradientValue.cpp:
        (WebCore::GradientStop::GradientStop):
        (WebCore::CSSGradientValue::gradientWithStylesResolved):
        * css/CSSGradientValue.h:
        (WebCore::CSSGradientValue::loadSubimages):
        (WebCore::CSSGradientValue::CSSGradientValue):
        * css/CSSImageSetValue.cpp:
        (WebCore::CSSImageSetValue::cachedImageSet):
        (WebCore::CSSImageSetValue::cachedOrPendingImageSet):
        * css/CSSImageSetValue.h:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::State::clear):
        (WebCore::StyleResolver::State::setParentStyle):
        (WebCore::StyleResolver::State::ensurePendingResources):
        (WebCore::isAtShadowBoundary):
        (WebCore::StyleResolver::cachedOrPendingFromValue):
        (WebCore::StyleResolver::generatedOrPendingFromValue):
        (WebCore::StyleResolver::setOrPendingFromValue):
        (WebCore::StyleResolver::cursorOrPendingFromValue):
        (WebCore::filterOperationForType):
        (WebCore::StyleResolver::createFilterOperations):
        (WebCore::StyleResolver::loadPendingResources):
        (WebCore::StyleResolver::MatchedProperties::MatchedProperties):
        (WebCore::StyleResolver::loadPendingSVGDocuments): Deleted.
        (WebCore::StyleResolver::loadPendingImage): Deleted.
        (WebCore::StyleResolver::loadPendingShapeImage): Deleted.
        (WebCore::StyleResolver::loadPendingImages): Deleted.
        * css/StyleResolver.h:
        (WebCore::StyleResolver::rootElementStyle):
        (WebCore::StyleResolver::element):
        (WebCore::StyleResolver::document):
        (WebCore::StyleResolver::documentSettings):
        (WebCore::StyleResolver::State::setApplyPropertyToVisitedLinkStyle):
        (WebCore::StyleResolver::State::applyPropertyToRegularStyle):
        (WebCore::StyleResolver::State::applyPropertyToVisitedLinkStyle):
        (WebCore::StyleResolver::State::setFontDirty):
        (WebCore::StyleResolver::State::fontDirty):
        (WebCore::StyleResolver::State::useSVGZoomRules):
        (WebCore::StyleResolver::State::takePendingResources):
        (WebCore::StyleResolver::State::cssToLengthConversionData):
        (WebCore::StyleResolver::State::cascadeLevel):
        (WebCore::StyleResolver::State::setCascadeLevel):
        (WebCore::StyleResolver::state):
        (WebCore::StyleResolver::State::pendingImageProperties): Deleted.
        (WebCore::StyleResolver::State::filtersWithPendingSVGDocuments): Deleted.
        * style/StylePendingResources.cpp: Added.
        (WebCore::Style::loadPendingImage):
        (WebCore::Style::loadPendingImages):
        (WebCore::Style::loadPendingSVGFilters):
        (WebCore::Style::loadPendingResources):

            Move the functions for triggering the resource loads from StyleResolver.

        * style/StylePendingResources.h: Added.

            Add struct for pending resources.

2016-06-29  Anders Carlsson  <andersca@apple.com>

        Add "type" and "paymentPass" properties in PaymentMethod
        https://bugs.webkit.org/show_bug.cgi?id=159278
        rdar://problem/26999112

        Reviewed by Dean Jackson.

        * Modules/applepay/cocoa/PaymentMethodCocoa.mm:
        (WebCore::toString):
        (WebCore::toDictionary):

2016-06-29  Nan Wang  <n_wang@apple.com>

        AX: Crash in WebCore::Document::focusNavigationStartingNode(WebCore::FocusDirection) const + 128
        https://bugs.webkit.org/show_bug.cgi?id=159240

        Reviewed by Ryosuke Niwa.

        This crash is caused by passing an empty node to ElementTraversal::previous(Node&). When the
        focusNavigationStartingNode has been removed and it has no next sibling, we should fallback
        to itself for calculating the next focused element.

        Test: fast/events/remove-focus-navigation-starting-point-crash.html

        * dom/Document.cpp:
        (WebCore::Document::focusNavigationStartingNode):

2016-06-29  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r202617.

        The LayoutTest from this change crashes under GuardMalloc

        Reverted changeset:

        "Throw exceptions for invalid number of channels for
        ConvolverNode"
        https://bugs.webkit.org/show_bug.cgi?id=159238
        http://trac.webkit.org/changeset/202617

2016-06-29  Anders Carlsson  <andersca@apple.com>

        Rename addressFields to contactFields
        https://bugs.webkit.org/show_bug.cgi?id=159271
        rdar://problem/27086955

        Reviewed by Beth Dakin.

        * Modules/applepay/ApplePaySession.cpp:
        (WebCore::createContactFields):
        (WebCore::isValidPaymentRequestPropertyName):
        (WebCore::createPaymentRequest):
        (WebCore::createAddressFields): Deleted.
        * Modules/applepay/PaymentRequest.h:
        (WebCore::PaymentRequest::requiredBillingContactFields):
        (WebCore::PaymentRequest::setRequiredBillingContactFields):
        (WebCore::PaymentRequest::requiredShippingContactFields):
        (WebCore::PaymentRequest::setRequiredShippingContactFields):
        (WebCore::PaymentRequest::requiredBillingAddressFields): Deleted.
        (WebCore::PaymentRequest::setRequiredBillingAddressFields): Deleted.
        (WebCore::PaymentRequest::requiredShippingAddressFields): Deleted.
        (WebCore::PaymentRequest::setRequiredShippingAddressFields): Deleted.

2016-06-29  Jiewen Tan  <jiewen_tan@apple.com>

        Unreviewed, third attempt to fix ASAN build for r202599

        * platform/text/TextCodecReplacement.cpp:
        (WebCore::TextCodecReplacement::decode):

2016-06-29  Jer Noble  <jer.noble@apple.com>

        Adopt MediaRemote.
        https://bugs.webkit.org/show_bug.cgi?id=159250

        Reviewed by Eric Carlson.

        Adopt MediaRemote and use the framework to implement MediaSessionManageMac
        and RemoteCommandListenerMac.

        * WebCore.xcodeproj/project.pbxproj:
        * platform/RemoteCommandListener.cpp:
        * platform/audio/PlatformMediaSessionManager.cpp:
        * platform/audio/cocoa/MediaSessionManagerCocoa.cpp: Renamed from Source/WebCore/platform/audio/mac/MediaSessionManagerMac.cpp.
        (PlatformMediaSessionManager::updateSessionState):
        * platform/audio/mac/MediaSessionManagerMac.h: Added.
        * platform/audio/mac/MediaSessionManagerMac.mm: Added.
        (WebCore::PlatformMediaSessionManager::sharedManager):
        (WebCore::PlatformMediaSessionManager::sharedManagerIfExists):
        (WebCore::MediaSessionManagerMac::MediaSessionManagerMac):
        (WebCore::MediaSessionManagerMac::~MediaSessionManagerMac):
        (WebCore::MediaSessionManagerMac::sessionWillBeginPlayback):
        (WebCore::MediaSessionManagerMac::removeSession):
        (WebCore::MediaSessionManagerMac::sessionWillEndPlayback):
        (WebCore::MediaSessionManagerMac::clientCharacteristicsChanged):
        (WebCore::MediaSessionManagerMac::nowPlayingEligibleSession):
        (WebCore::MediaSessionManagerMac::updateNowPlayingInfo):
        * platform/cocoa/SoftLinking.h:
        * platform/mac/MediaRemoteSoftLink.cpp: Added.
        * platform/mac/MediaRemoteSoftLink.h: Added.
        * platform/mac/RemoteCommandListenerMac.h: Added.
        (WebCore::RemoteCommandListenerMac::createWeakPtr):
        * platform/mac/RemoteCommandListenerMac.mm: Added.
        (WebCore::RemoteCommandListener::create):
        (WebCore::RemoteCommandListenerMac::RemoteCommandListenerMac):
        (WebCore::RemoteCommandListenerMac::~RemoteCommandListenerMac):
        * platform/spi/mac/MediaRemoteSPI.h: Added.

2016-06-29  Jer Noble  <jer.noble@apple.com>

        Cannot clear a MediaSource SourceBuffer in Safari 9 and WebKit nightly
        https://bugs.webkit.org/show_bug.cgi?id=159230

        Reviewed by Eric Carlson.

        Test: media/media-source/media-source-remove.html (modified)

        Move to using a MediaTime directly (rather than as a double) to add
        and removed buffered ranges. Also, drop the use of the "microsecond"
        fudge factor when adding buffered ranges.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::removeSamplesFromTrackBuffer):
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):

2016-06-29  Jiewen Tan  <jiewen_tan@apple.com>

        Unreviewed, second attempt to fix ASAN build for r202599

        * platform/text/TextCodecReplacement.cpp:

2016-06-29  Jiewen Tan  <jiewen_tan@apple.com>

        Unreviewed, first attempt to fix ASAN build for r202599

        * platform/text/TextCodecReplacement.cpp:

2016-06-29  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Show Shadow Root type in DOM Tree
        https://bugs.webkit.org/show_bug.cgi?id=159236
        <rdar://problem/27068521>

        Reviewed by Timothy Hatcher.

        Test: inspector/dom/shadowRootType.html

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::shadowRootType):
        (WebCore::InspectorDOMAgent::buildObjectForNode):
        Set the shadowRootType property when a node is a ShadowRoot.

2016-06-29  Jeremy Jones  <jeremyj@apple.com>

        Replace MPAudioVideoRoutingActionSheet with MPAVRoutingSheet.
        https://bugs.webkit.org/show_bug.cgi?id=159161
        <rdar://problem/26017691>

        Reviewed by Sam Weinig.

        Replace MPAudioVideoRoutingActionSheet SPI with MPAVRoutingSheet SPI.

        * platform/spi/ios/MediaPlayerSPI.h:

2016-06-29  Alejandro G. Castro  <alex@igalia.com>

        WebRTC: ice-char can not contain '=' characters for credentials
        https://bugs.webkit.org/show_bug.cgi?id=159207

        Reviewed by Eric Carlson.

        Avoid a general calculation to get a base64 without padding which
        was wrong in the randomString function. Because each parameter
        using the function requires a different setup depending of the
        specification and this is not a general API, it is a better
        solution to calculate and store the sizes we want to use, comment
        them and test them, considering we use base64 to generate the
        strings we just need to avoid padding.

        Existing test modified to match the correct behavior.

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::randomString): Now the size is the one passed.
        (WebCore::MediaEndpointPeerConnection::MediaEndpointPeerConnection):
        Used different valid values following the sdp parser in each case.

2016-06-29  David Kilzer  <ddkilzer@apple.com>

        Crash when 'input' event handler for input[type=color] changes the input type
        <https://webkit.org/b/159262>
        <rdar://problem/27020404>

        Reviewed by Daniel Bates.

        Fix based on a Blink change (patch by <tkent@chromium.org>):
        <https://chromium.googlesource.com/chromium/src.git/+/a17cb3ecef49a078657524cdeaba33ad2083646c>

        Test: fast/forms/color/color-type-change-on-input-crash.html

        * html/ColorInputType.cpp:
        (WebCore::ColorInputType::didChooseColor): Add EventQueueScope
        before setValueFromRenderer() to fix the bug.
        * html/HTMLInputElement.h:
        (WebCore::HTMLInputElement::setValueFromRenderer): Add comment
        about how to use this method.

2016-06-29  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Misc MediaStreamEvent fixes: Update build flag and remove PassRefPtr usage
        https://bugs.webkit.org/show_bug.cgi?id=159132

        Reviewed by Eric Carlson.

        Use the WEB_RTC build flag instead of MEDIA_STREAM since this event is related to
        RTCPeerConnection. Also remove PassRefPtr usage.

        Updated existing expected results.

        * Modules/mediastream/MediaStreamEvent.cpp:
        (WebCore::MediaStreamEvent::create):
        (WebCore::MediaStreamEvent::MediaStreamEvent):
        * Modules/mediastream/MediaStreamEvent.h:
        * Modules/mediastream/MediaStreamEvent.idl:
        * dom/EventNames.in:

2016-06-29  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        REGRESSION(r202337) [WebRTC] Crash when loading html5test.com
        https://bugs.webkit.org/show_bug.cgi?id=159145

        Reviewed by Eric Carlson.

        MediaEndpointPeerConnection uses an implementation of the MediaEndpoint interface to
        interact with the port's WebRTC backend. A mock (MockMediaEndpoint) is used for testing.
        This change adds an "empty" MediaEndpoint implementation that simplifies the case when a
        port builds and tests with MediaEndpointPeerConnection/MockMediaEndpoint, but doesn't have
        a "real" MediaEndpoint implementation yet (to use with MiniBrowser).

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::MediaEndpointPeerConnection):
        * platform/mediastream/MediaEndpoint.cpp:
        (WebCore::EmptyRealtimeMediaSource::create):
        (WebCore::EmptyRealtimeMediaSource::EmptyRealtimeMediaSource):
        (WebCore::EmptyMediaEndpoint::EmptyMediaEndpoint):
        (WebCore::createMediaEndpoint):

2016-06-29  Alejandro G. Castro  <alex@igalia.com>

        Fix assertion in debug build when creating the SocketStreamHandle object.

        We have to call relaxAdoptionRequirement to avoid the assertion
        when protecting the non-adopted SocketStreamHandle we are
        creating. Update to r202370.

        Rubber-stamped by Carlos Garcia Campos.

        * platform/network/soup/SocketStreamHandleSoup.cpp:
        (WebCore::SocketStreamHandle::SocketStreamHandle):

2016-06-29  David Kilzer  <ddkilzer@apple.com>

        Throw exceptions for invalid number of channels for ConvolverNode
        <https://webkit.org/b/159238>
        <rdar://problem/27020410>

        Reviewed by Brent Fulgham.

        Fix based on a Blink change (patch by <rtoy@chromium.org>):
        <https://chromium.googlesource.com/chromium/src.git/+/0cc26bbb7175aec77910d0b47faf9f8c8a640fe5>

        Test: webaudio/convolver-channels.html

        * Modules/webaudio/ConvolverNode.cpp:
        (WebCore::ConvolverNode::setBuffer): Throw an exception for
        anything but 1, 2 or 4 channels.

2016-06-29  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r198782, r201043): [image-decoders] Flickering with some animated gif
        https://bugs.webkit.org/show_bug.cgi?id=159089

        Reviewed by Antonio Gomes.

        There's some flickering when loading big enough animated gifs running the animation in a loop. The first time it
        loads everything is fine, but after the first loop iteration there are several flickering effects, once every
        time the animation finishes and some others happening in the middle of the animation loop. The flickering
        happens because we fail to render some of the frames, and it has two diferent causes:

         - In r198782, ImageDecoder::createFrameImageAtIndex(), was modified to check first if the image is empty to
        return early, and then try to get the frame image from the decoder. This is the aone causing the flickering
        always on the first frame after one iteration. It happens because ImageDecoder::size() is always empty at that
        point. The first time doesn't happen because the gif is loaded and BitmapImage calls isSizeAvailable() from
        BitmapImage::dataChanged(). The isSizeAvailable call makes the gif decoder calculate the size. But for the next
        iterations, frames are cached and BitmapImage already has the decoded data so isSizeAvailable is not called
        again. When createFrameImageAtIndex() is called again for the first frame, size is empty until the gif decoder
        creates the reader again, which happens when frameBufferAtIndex() is called, so after that the size is
        available. So, we could call isSizeAvailable before checking the size, or simply do the check after the
        frameBufferAtIndex() call as we used to do.

         - In r201043 BitmapImage::destroyDecodedDataIfNecessary() was fixed to use the actual bytes used by the frame
        in order to decide whether to destroy decoded data or not. This actually revealed a bug, it didn't happen before
        because we were never destroying frames before. The bug is in the gif decoder that doesn't correctly handle the
        case of destroying only some of the frames from the buffer cache. The gif decoder is designed to always process the
        frames in order, the reader keeps an index of the currently processed frame, so when some frames are read from the
        cache, and then we ask the decoder for a not cached frame, the currently processed frame is not in sync with the
        actual frame we are asking for, and we end do not processing any frame at all.

        * platform/image-decoders/ImageDecoder.cpp:
        (WebCore::ImageDecoder::createFrameImageAtIndex): Check the size after calling frameBufferAtIndex().
        * platform/image-decoders/gif/GIFImageDecoder.cpp:
        (WebCore::GIFImageDecoder::clearFrameBufferCache): Delete the reader when clearing the cache since it's out of sync.

2016-06-28  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GStreamer] Adaptive streaming issues
        https://bugs.webkit.org/show_bug.cgi?id=144040

        Reviewed by Philippe Normand.

        There are multiple deadlocks in the web process when HLS content is loaded by GStreamer. It happens because gst
        is using several threads to download manifest, fragments, monitor the downloads, etc. To download the fragments
        and manifest it always creates the source element in a separate thread, something that is not actually expected
        to happen in WebKit source element. Our source element is always scheduling tasks (start, stop, need-data,
        enough-data and seek) to the main thread, and those downloads that use the ResourceHandleStreamingClient
        (there's no player associated) also happen in the main thread, because libsoup calls all its async callbacks in
        the main thread. So, the result is that it can happen that we end up blocking the main thread in a lock until
        the download finishes, but the download never finishes because tasks are scheduled in the main thread that is
        blocked in a lock. This can be prevented by always using a secondary thread for downloads made by
        ResourceHandleStreamingClient, using its own run loop with a different GMainContext so that libsoup sends
        callbacks to the right thread. We also had to refactor the tasks a bit, leaving the thread safe parts to be run
        in the calling thread always, and only scheduling to the main thread in case of not using
        ResourceHandleStreamingClient and only for the non thread safe parts.
        This patch also includes r200455 that was rolled out, but it was a perfectly valid workaround for GST bug.

        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
        (WTF::ensureGRef): Consume the floating ref if needed.
        * platform/graphics/gstreamer/GRefPtrGStreamer.h:
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (webkit_web_src_init): Check if object is being created in the main thread.
        (webKitWebSrcStop): Stop the media resource loader in the main thread and the resource handle streaming in the
        current thread.
        (webKitWebSrcStart): Start the media resource loader in the main thread and the resource handle streaming in
        the current thread.
        (webKitWebSrcChangeState): Call webKitWebSrcStart and webKitWebSrcStop in the current thread.
        (webKitWebSrcNeedData): Update status in the current thread and notify the media resource loader in the main thread.
        (webKitWebSrcEnoughData): Ditto.
        (webKitWebSrcSeek): Ditto.
        (webKitWebSrcSetMediaPlayer): Add an assert to ensure that source elements used by WebKit are always created in
        the main thread.
        (ResourceHandleStreamingClient::ResourceHandleStreamingClient): Use a secondary thread to do the download.
        (ResourceHandleStreamingClient::~ResourceHandleStreamingClient): Stop the secondary thread.
        (ResourceHandleStreamingClient::setDefersLoading): Notify the secondary thread.

2016-06-28  Youenn Fablet  <youennf@gmail.com>

        Remove ThreadableLoaderOptions origin
        https://bugs.webkit.org/show_bug.cgi?id=159221

        Reviewed by Sam Weinig.

        No change of behavior.

        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Adding origing parameter.
        (WebCore::DocumentThreadableLoader::create): Ditto.
        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Ditto.
        (WebCore::DocumentThreadableLoader::redirectReceived): Setting m_origin.
        (WebCore::DocumentThreadableLoader::securityOrigin): Checking m_origin.
        * loader/DocumentThreadableLoader.h: Adding m_origin member.
        * loader/ThreadableLoader.cpp:
        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Removing origin.
        (WebCore::ThreadableLoaderOption::isolatedCopy): Deleted.
        * loader/ThreadableLoader.h: Removing origin parameter and isolatedCopy function.
        * loader/WorkerThreadableLoader.cpp:
        (WebCore::LoaderTaskOptions::LoaderTaskOptions): Structure to pass loader task options from one thread to another.
        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
        * page/EventSource.cpp:
        (WebCore::EventSource::connect): Removing setting of the origin.
        * workers/WorkerScriptLoader.cpp:
        (WebCore::WorkerScriptLoader::loadSynchronously): Ditto.
        (WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::createRequest): Ditto.

2016-06-28  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202580.
        https://bugs.webkit.org/show_bug.cgi?id=159245

        Caused all WKTR tests to fail on GuardMalloc and Production
        only for unknown reasons, investigating offline. (Requested by
        brrian on #webkit).

        Reverted changeset:

        "RunLoop::Timer should use constructor templates instead of
        class templates"
        https://bugs.webkit.org/show_bug.cgi?id=159153
        http://trac.webkit.org/changeset/202580

2016-06-28  Benjamin Poulain  <benjamin@webkit.org>

        Rename ChildrenAffectedByActive to StyleAffectedByActive
        https://bugs.webkit.org/show_bug.cgi?id=159187

        Reviewed by Antti Koivisto.

        Flags named "ChildrenAffectedBy" are used when the invalidation
        of children is so crazy that we invalidate the whole parent subtree instead.

        That's not the case for :active. It is a straightforward element invalidation.
        Consequently, the property is renamed to StyleAffectedByActive.

        * dom/Element.cpp:
        (WebCore::Element::setActive):
        (WebCore::Element::setStyleAffectedByActive):
        (WebCore::Element::hasFlagsSetDuringStylingOfChildren):
        (WebCore::Element::rareDataStyleAffectedByActive):
        (WebCore::Element::setChildrenAffectedByActive): Deleted.
        (WebCore::Element::rareDataChildrenAffectedByActive): Deleted.
        * dom/Element.h:
        (WebCore::Element::styleAffectedByActive):
        (WebCore::Element::childrenAffectedByActive): Deleted.
        * dom/ElementRareData.h:
        (WebCore::ElementRareData::styleAffectedByActive):
        (WebCore::ElementRareData::setStyleAffectedByActive):
        (WebCore::ElementRareData::ElementRareData):
        (WebCore::ElementRareData::resetDynamicRestyleObservations):
        (WebCore::ElementRareData::childrenAffectedByActive): Deleted.
        (WebCore::ElementRareData::setChildrenAffectedByActive): Deleted.
        * style/StyleRelations.cpp:
        (WebCore::Style::commitRelations):

2016-06-28  Jiewen Tan  <jiewen_tan@apple.com>

        Implement "replacement" codec
        https://bugs.webkit.org/show_bug.cgi?id=159180
        <rdar://problem/26015178>

        Reviewed by Brent Fulgham.

        Test: fast/encoding/charset-replacement.html

        Add support for "replacement" codec according to the spec:
        https://encoding.spec.whatwg.org/#replacement
        According to the spec, encoding labels {"csiso2022kr", "hz-gb-2312", "iso-2022-cn",
        "iso-2022-cn-ext", "iso-2022-kr"} are used to conduct certain attacks that abuse
        a mismatch between encodings supported on the server and the client. Therefore,
        they are grouped under the "replacement" codec, which does the following things
        to prevent those attacks.
        1) Decode: terminates with a single U+FFFD.
        2) Encode: treated as UTF-8.

        Furthermore, the "replacement" codec is a specification convenience to group those
        vulnerable encoding labels. Therefore, it should not be able to use directly.

        This change is based on the following Blink changes:
        https://codereview.chromium.org/265973003, and
        https://codereview.chromium.org/261013007.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/text/TextAllInOne.cpp:
        * platform/text/TextCodecReplacement.cpp: Added.
        (WebCore::TextCodecReplacement::create):
        (WebCore::TextCodecReplacement::TextCodecReplacement):
        (WebCore::TextCodecReplacement::registerEncodingNames):
        (WebCore::TextCodecReplacement::registerCodecs):
        (WebCore::TextCodecReplacement::decode):
        * platform/text/TextCodecReplacement.h: Added.
        * platform/text/TextEncoding.cpp:
        (WebCore::TextEncoding::TextEncoding):
        * platform/text/TextEncodingRegistry.cpp:
        (WebCore::isReplacementEncoding):
        (WebCore::extendTextCodecMaps):
        * platform/text/TextEncodingRegistry.h:

2016-06-28  Dean Jackson  <dino@apple.com>

        Remove incorrect comments in HTMLCanvasElement
        https://bugs.webkit.org/show_bug.cgi?id=159229

        Reviewed by Sam Weinig.

        These comments are wrong.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::probablySupportsContext):
        (WebCore::HTMLCanvasElement::getContext): Deleted.

2016-06-28  Geoffrey Garen  <ggaren@apple.com>

        CrashTracer beneath JSC::MarkedBlock::specializedSweep
        https://bugs.webkit.org/show_bug.cgi?id=159223

        Reviewed by Saam Barati.

        This crash is caused by a media element re-entering JS during the GC
        sweep phase.

        In theory, other CachedResourceClients in the DOM might also trigger
        similar bugs, but our data only implicates the media elements, so this
        fix targets them.

        * html/HTMLDocument.h: Document has no reason to inherit from
        CachedResourceClient. I found this becuase I had to search for all
        CachedResourceClients in researching this patch.

        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
        (WebCore::WebCoreAVCFResourceLoader::invalidate): Delay our call to
        stopLoading because it might re-enter JS, and we might have been called
        by the GC sweep phase destroying a media element.

        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::invalidate): Ditto.

2016-06-28  Saam Barati  <sbarati@apple.com>

        some Watchpoints' ::fireInternal method will call operations that might GC where the GC will cause the watchpoint itself to destruct
        https://bugs.webkit.org/show_bug.cgi?id=159198
        <rdar://problem/26302360>

        Reviewed by Filip Pizlo.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::fireFrameClearedWatchpointsForWindow):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        * bindings/scripts/test/JS/JSTestEventTarget.h:
        (WebCore::JSTestEventTarget::create):

2016-06-28  Anders Carlsson  <andersca@apple.com>

        Move the user gesture requirement to the ApplePaySession constructor
        https://bugs.webkit.org/show_bug.cgi?id=159225
        rdar://problem/26507267

        Reviewed by Tim Horton.

        By doing this, clients can do pre-validation before showing the sheet, while we still maintain the user gesture requirement.

        * Modules/applepay/ApplePaySession.cpp:
        (WebCore::ApplePaySession::create):
        (WebCore::ApplePaySession::begin): Deleted.

2016-06-28  Youenn Fablet  <youenn@apple.com>

        Iterable interfaces should have their related prototype @@iterator property writable
        https://bugs.webkit.org/show_bug.cgi?id=159211
        <rdar://problem/26950766>

        Reviewed by Chris Dumez.

        Updating @@iterator property according  http://heycam.github.io/webidl/#es-iterator.

        Covered by updated test.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation): Removing ReadOnly flag from @@iterator property of iterable interfaces.
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::JSTestNodePrototype::finishCreation): Rebasing expectation.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjPrototype::finishCreation): Ditto.

2016-06-28  Anders Carlsson  <andersca@apple.com>

        "Total amount is too big" error message is displaying on clicking Pay button
        https://bugs.webkit.org/show_bug.cgi?id=159219
        rdar://problem/26722110

        Reviewed by Tim Horton.

        Match the PassKit max amount.

        * Modules/applepay/PaymentRequestValidator.cpp:
        (WebCore::PaymentRequestValidator::validateTotal):

2016-06-28  Anders Carlsson  <andersca@apple.com>

        PaymentMerchantSession should wrap a PKPaymentMerchantSession
        https://bugs.webkit.org/show_bug.cgi?id=159218
        rdar://problem/26872118

        Reviewed by Tim Horton.

        * Modules/applepay/ApplePaySession.cpp:
        (WebCore::ApplePaySession::completeMerchantValidation):
        Use PaymentMerchantSession::fromJS.

        (WebCore::createMerchantSession): Deleted.

        * Modules/applepay/PaymentCoordinator.h:
        PaymentMerchantSession is now a class.

        * Modules/applepay/PaymentCoordinatorClient.h:
        PaymentMerchantSession is now a class.

        * Modules/applepay/PaymentMerchantSession.h:
        (WebCore::PaymentMerchantSession::PaymentMerchantSession):
        (WebCore::PaymentMerchantSession::~PaymentMerchantSession):
        (WebCore::PaymentMerchantSession::pkPaymentMerchantSession):
        Store a PKPaymentMerchantSession in a RetainPtr inside the PaymentMerchantSession object.

        * Modules/applepay/cocoa/PaymentMerchantSessionCocoa.mm:
        (WebCore::PaymentMerchantSession::fromJS):
        Convert the JS object to a PKPaymentMerchantSession and return a PaymentMerchantSession that wraps it.

        * WebCore.xcodeproj/project.pbxproj:
        Add new files.

        * bindings/js/Dictionary.h:
        (WebCore::Dictionary::initializerObject):
        Add new getter.

2016-06-28  Brian Burg  <bburg@apple.com>

        RunLoop::Timer should use constructor templates instead of class templates
        https://bugs.webkit.org/show_bug.cgi?id=159153

        Reviewed by Alex Christensen.

        Remove the RunLoop::Timer class template argument, and pass its constructor
        a reference to `this` instead of a pointer to `this`.

        * Modules/mediasession/WebMediaSessionManager.cpp:
        (WebCore::WebMediaSessionManager::WebMediaSessionManager):
        * Modules/mediasession/WebMediaSessionManager.h:
        * page/WheelEventTestTrigger.cpp:
        (WebCore::WheelEventTestTrigger::WheelEventTestTrigger):
        * page/WheelEventTestTrigger.h:
        * page/mac/TextIndicatorWindow.h:
        * page/mac/TextIndicatorWindow.mm:
        (WebCore::TextIndicatorWindow::TextIndicatorWindow):
        * platform/MainThreadSharedTimer.h:
        * platform/cocoa/ScrollController.h:
        * platform/cocoa/ScrollController.mm:
        (WebCore::ScrollController::ScrollController):
        * platform/glib/MainThreadSharedTimerGLib.cpp:
        (WebCore::MainThreadSharedTimer::MainThreadSharedTimer):
        * platform/graphics/MediaPlaybackTargetPicker.cpp:
        (WebCore::MediaPlaybackTargetPicker::MediaPlaybackTargetPicker):
        * platform/graphics/MediaPlaybackTargetPicker.h:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
        (VideoRenderRequestScheduler::VideoRenderRequestScheduler):
        * platform/graphics/texmap/TextureMapperPlatformLayerProxy.cpp:
        (WebCore::TextureMapperPlatformLayerProxy::TextureMapperPlatformLayerProxy):
        (WebCore::TextureMapperPlatformLayerProxy::activateOnCompositingThread):
        * platform/graphics/texmap/TextureMapperPlatformLayerProxy.h:
        * platform/mock/MediaPlaybackTargetPickerMock.cpp:
        (WebCore::MediaPlaybackTargetPickerMock::MediaPlaybackTargetPickerMock):
        * platform/mock/MediaPlaybackTargetPickerMock.h:
        * platform/mock/MockRealtimeVideoSource.cpp:
        (WebCore::MockRealtimeVideoSource::MockRealtimeVideoSource):
        * platform/mock/MockRealtimeVideoSource.h:
        * platform/network/ResourceHandleInternal.h:
        (WebCore::ResourceHandleInternal::ResourceHandleInternal):

2016-06-27  Jer Noble  <jer.noble@apple.com>

        Cross-domain video loads do not prompt for authorization.
        https://bugs.webkit.org/show_bug.cgi?id=159195
        <rdar://problem/26234612>

        Reviewed by Brent Fulgham.

        Test: http/tests/media/video-auth.html (modified)

        We should prompt for authorization when a cross-origin <video> is embedded
        in a web page.

        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::requestResource):

2016-06-28  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r201471): FormClient.textFieldDidEndEditing is no longer called when a text field is removed
        https://bugs.webkit.org/show_bug.cgi?id=159199
        <rdar://problem/26748189>

        Reviewed by Alexey Proskuryakov.

        The bug was caused by HTMLInputElement's endEditing no longer getting called due to the behavior change.
        Preserve the WebKit2 API semantics by manually calling HTMLInputElement::endEditing in setFocusedElement.

        Tests: WebKit2TextFieldDidBeginAndEndEditing

        * dom/Document.cpp:
        (WebCore::Document::setFocusedElement):

2016-06-28  Frederic Wang  <fwang@igalia.com>

        Phrasing content should be accepted in <mo> elements
        https://bugs.webkit.org/show_bug.cgi?id=130245

        Reviewed by Brent Fulgham.

        After r202420, the RenderMathMLOperator element no longer messes with anonymous block and
        text nodes. Hence it is now safe to allow foreign content inside <mo>.

        We extend foreign-element-in-token.html to cover the mo case.

        * mathml/MathMLTextElement.cpp:
        (WebCore::MathMLTextElement::childShouldCreateRenderer): Remove the early return for <mo> so
        that it accepts phrasing content children.

2016-06-27  Anders Carlsson  <andersca@apple.com>

        WebKit::WebPaymentCoordinator leak
        https://bugs.webkit.org/show_bug.cgi?id=159168
        rdar://problem/26929772

        Reviewed by Beth Dakin.

        * Modules/applepay/PaymentCoordinator.cpp:
        (WebCore::PaymentCoordinator::~PaymentCoordinator):
        Call paymentCoordinatorDestroyed().

        * Modules/applepay/PaymentCoordinatorClient.h:
        Rename mainFrameDestroyed to paymentCoordinatorDestroyed().

        * loader/EmptyClients.cpp:

2016-06-28  Frederic Wang  <fwang@igalia.com>

        Remove anonymous in renderName for all MathML renderers but RenderMathMLOperator
        https://bugs.webkit.org/show_bug.cgi?id=159114

        Reviewed by Martin Robinson.

        After r202420, the only anonymous MathML renderers are the RenderMathMLOperators created by
        the mfenced element. Hence we remove the special case for anonymous in the renderName
        implementation of most MathML renderers.

        No new tests, behavior unchanged.

        * rendering/mathml/RenderMathMLRow.h:
        * rendering/mathml/RenderMathMLSpace.h:
        * rendering/mathml/RenderMathMLToken.h:

2016-06-28  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Robustify 'this' type check in RTCPeerConnection JS built-ins
        https://bugs.webkit.org/show_bug.cgi?id=158831

        Reviewed by Youenn Fablet.

        Use @operations slot in RTCPeerConnection type check.

        Updated results of existing test.

        * Modules/mediastream/RTCPeerConnection.js:
        (initializeRTCPeerConnection):
        Initialize @operations slot in constructor.
        * Modules/mediastream/RTCPeerConnectionInternals.js:
        (isRTCPeerConnection):
        Use @operations slot in type check.

2016-06-28  Frederic Wang  <fwang@igalia.com>

        AX: Remove dead code in AccessibilityRenderObject::textUnderElement
        https://bugs.webkit.org/show_bug.cgi?id=159205

        Reviewed by Joanmarie Diggs.

        RenderMathMLOperator used to destroy its descendants and to replace them with an anonymous
        text node wrapped inside anonymous blocks. After r202420, it just behaves as any other token
        elements. Hence we remove the code in AccessibilityRenderObject::textUnderElement that was
        used to handle this specific render tree structure.

        No new tests, already covered by accessibility/math-text.html.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::textUnderElement): Remove dead code for RenderText and RenderMathMLOperator.

2016-06-28  Per Arne Vollan  <pvollan@apple.com>

        [Win] Custom elements tests are failing.
        https://bugs.webkit.org/show_bug.cgi?id=159139

        Reviewed by Alex Christensen.

        Fix compile errors after enabling custom element API.

        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore::constructJSHTMLElement):
        * dom/CustomElementDefinitions.cpp:
        (WebCore::CustomElementDefinitions::addElementDefinition):
        * dom/Document.cpp:
        (WebCore::createHTMLElementWithNameValidation):
        (WebCore::createFallbackHTMLElement):
        * dom/Element.cpp:
        (WebCore::Element::attributeChanged):
        * dom/LifecycleCallbackQueue.cpp:
        (WebCore::LifecycleQueueItem::LifecycleQueueItem):
        (WebCore::LifecycleCallbackQueue::enqueueElementUpgrade):
        (WebCore::LifecycleCallbackQueue::enqueueAttributeChangedCallback):
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::insertHTMLElementOrFindCustomElementInterface):
        (WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface):
        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::CustomElementConstructionData::CustomElementConstructionData):
        (WebCore::HTMLTreeBuilder::insertGenericHTMLElement):
        * html/parser/HTMLTreeBuilder.h:

2016-06-28  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] usec rounding is wrong during accurate seeking
        https://bugs.webkit.org/show_bug.cgi?id=90734

        Reviewed by Carlos Garcia Campos.

        Use floor() to round the microseconds value, this is more robust
        than roundf.

        * platform/graphics/gstreamer/GStreamerUtilities.cpp:
        (WebCore::toGstClockTime):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::playbackPosition):

2016-06-28  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] improved duration query support in the HTTP source element
        https://bugs.webkit.org/show_bug.cgi?id=159204

        Reviewed by Carlos Garcia Campos.

        When we have the Content-Length value it is possible to infer the TIME
        duration in most cases by performing a convert query in the downstream
        elements. This is especially useful when the duration query wasn't
        managed by the sinks and thus reached the source element.

        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (webKitWebSrcQueryWithParent):

2016-06-28  Youenn Fablet  <youenn@apple.com>

        Binding generator should generate accessors for constructors safely accessed from JS builtin
        https://bugs.webkit.org/show_bug.cgi?id=159087

        Reviewed by Alex Christensen.

        Removed constructor private slots direct additions in JSDOMGlobalObject.
        Added support for generating the code that will do that.
        Advantage of the implementation:
        - Private slots will expose constructors that are also publically visible (previously workers had some private slots filled with WebRTC constructors).
        - Private slots no longer require the creation of the constructors at window creation time.

        Although PublicIdentifier and PrivateIdentifier are both added where needed, the binding generator does not
        support the case of a constructor accessible only privately.

        Covered by existing test set and adding binding test.

        * Modules/mediastream/MediaStream.idl: Marked as PublicIdentifier/PrivateIdentifier.
        * Modules/mediastream/MediaStreamTrack.idl: Ditto.
        * Modules/mediastream/RTCIceCandidate.idl: Ditto.
        * Modules/mediastream/RTCSessionDescription.idl: Ditto.
        * Modules/streams/ReadableStream.idl: Ditto.
        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::addBuiltinGlobals): Removed unneeded additions.
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation): Added support for private slots for interface constructors marked as
        PrivateIdentifier.
        * bindings/scripts/preprocess-idls.pl:
        (GenerateConstructorAttribute): Make PublicIdentifier/PrivateIdentifier copied interface attributes.
        * bindings/scripts/test/GObject/WebKitDOMTestGlobalObject.cpp:
        (webkit_dom_test_global_object_set_property):
        (webkit_dom_test_global_object_get_property):
        (webkit_dom_test_global_object_class_init):
        (webkit_dom_test_global_object_get_public_and_private_attribute):
        (webkit_dom_test_global_object_set_public_and_private_attribute):
        * bindings/scripts/test/GObject/WebKitDOMTestGlobalObject.h:
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        (WebCore::JSTestGlobalObject::finishCreation):
        (WebCore::jsTestGlobalObjectPublicAndPrivateAttribute):
        (WebCore::setJSTestGlobalObjectPublicAndPrivateAttribute):
        * bindings/scripts/test/ObjC/DOMTestGlobalObject.h:
        * bindings/scripts/test/ObjC/DOMTestGlobalObject.mm:
        (-[DOMTestGlobalObject publicAndPrivateAttribute]):
        (-[DOMTestGlobalObject setPublicAndPrivateAttribute:]):
        * bindings/scripts/test/TestGlobalObject.idl:


2016-06-27  Jer Noble  <jer.noble@apple.com>

        REGRESSION?(r202466): http/tests/security/canvas-remote-read-remote-video-redirect.html failing on Sierra
        https://bugs.webkit.org/show_bug.cgi?id=159172
        <rdar://problem/27030025>

        Reviewed by Brent Fulgham.

        Add a hasSingleSecurityOrigin property to WebCoreNSURLSession that gets updated each time one of that
        sessions' tasks receieves a response or a redirect request. Check that property from the MediaPlayerPrivate.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::hasSingleSecurityOrigin):
        * platform/network/cocoa/WebCoreNSURLSession.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession updateHasSingleSecurityOrigin:]):
        (-[WebCoreNSURLSession dataTaskWithRequest:]):
        (-[WebCoreNSURLSession dataTaskWithURL:]):
        (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]):
        (-[WebCoreNSURLSessionDataTask resource:receivedRedirect:request:]):

2016-06-27  Alex Christensen  <achristensen@webkit.org>

        CMake build fix.

        * PlatformMac.cmake:

2016-06-27  Youenn Fablet  <youenn@apple.com>

        Remove didFailAccessControlCheck ThreadableLoaderClient callback
        https://bugs.webkit.org/show_bug.cgi?id=159149

        Reviewed by Daniel Bates.

        Adding an AccessControl ResourceError type.
        Replacing didFailAccessControlCheck callback by a direct call to didFail with an error of type AccessControl.

        Making CrossOriginPreflightChecker always return an AccessControl error. Previously some errors created below
        were passed directly to threadable loader clients.

        When doing preflight on unauthorized web sites, WTR/DRT will trigger a cancellation error which was translating into an abort event in XMLHttpRequest.
        This patch is changing the error type to AccessControl, which translates into an error event in XMLHttpReauest.

        This change of behavior is seen in imported/w3c/web-platform-tests/XMLHttpRequest/send-authentication-cors-setrequestheader-no-cred.htm.
        No other observable change of behavior should be expected.

        * inspector/InspectorNetworkAgent.cpp: Computing error message in didFail according the error type.
        * loader/CrossOriginPreflightChecker.cpp:
        (WebCore::CrossOriginPreflightChecker::validatePreflightResponse): Setting preflightFailure error type to AccessControl.
        (WebCore::CrossOriginPreflightChecker::notifyFinished): Ditto.
        (WebCore::CrossOriginPreflightChecker::doPreflight): Ditto.
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): Replacing didFailAccessControlCheck
        callback by a direct call to didFail with an error of type AccessControl.
        (WebCore::reportContentSecurityPolicyError): Ditto.
        (WebCore::reportCrossOriginResourceSharingError): Ditto.
        (WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
        (WebCore::DocumentThreadableLoader::preflightFailure): Calling didFail directly.
        * loader/ThreadableLoaderClient.h: Removing didFailAccessControlCheck.
        * loader/ThreadableLoaderClientWrapper.h: Ditto.
        * loader/WorkerThreadableLoader.cpp: Ditto.
        * loader/WorkerThreadableLoader.h: Ditto.
        * page/EventSource.cpp:
        (WebCore::EventSource::didFail): Removing didFailAccessControlCheck and putting handling code in didFail.
        * page/EventSource.h:
        * platform/network/ResourceErrorBase.cpp:
        (WebCore::ResourceErrorBase::setType): Softening the assertion to cover the case of migration to AccessControl.
        * platform/network/ResourceErrorBase.h: Adding AccessControl error type.
        (WebCore::ResourceErrorBase::isAccessControl):

2016-06-27  Chris Dumez  <cdumez@apple.com>

        HTMLElement / SVGElement should implement GlobalEventHandlers, not Element
        https://bugs.webkit.org/show_bug.cgi?id=159191
        <rdar://problem/27019299>

        Reviewed by Ryosuke Niwa.

        HTMLElement / SVGElement should implement GlobalEventHandlers, not Element:
        - https://html.spec.whatwg.org/multipage/dom.html#htmlelement
        - https://www.w3.org/TR/SVG2/types.html#InterfaceSVGElement

        Firefox and Chrome behave as per the specification.

        Fixing this also fixes rendering on http://survey123.arcgis.com/.

        No new tests, covered by existing tests that were rebaselined.

        * dom/Element.idl:
        * html/HTMLElement.idl:
        * svg/SVGElement.idl:

2016-06-27  Myles C. Maxfield  <mmaxfield@apple.com>

        [macOS] Test gardening: Generic font families should not map to fonts which aren't installed
        https://bugs.webkit.org/show_bug.cgi?id=159111
        <rdar://problem/25807529>

        Unreviewed.

        Osaka-Mono does not come preinstalled on macOS Sierra. However, many Japanese users
        will have the font installed. Before setting the generic font family, we should check
        to see if the font is present.

        * page/cocoa/SettingsCocoa.mm:
        (WebCore::osakaMonoIsInstalled):
        (WebCore::Settings::initializeDefaultFontFamilies):

2016-06-24  Ryosuke Niwa  <rniwa@webkit.org>

        Don't keep all newly created potential custom elements alive when the feature is disabled
        https://bugs.webkit.org/show_bug.cgi?id=159113

        Reviewed by Daniel Bates.

        Don't keep all HTML unknown elements which has a valid custom element alive when the feature is turned off.

        Ideally we want to conform to the behavior in the Custom Elements specification and only upgrade an element
        that is inserted into the document. We'll implement that later.

        * dom/Document.cpp:
        (WebCore::createHTMLElementWithNameValidation):

2016-06-27  Simon Fraser  <simon.fraser@apple.com>

        [iOS] -webkit-overflow-scrolling: touch prevents repaint with RTL
        https://bugs.webkit.org/show_bug.cgi?id=159186
        rdar://problem/26659341

        Reviewed by Zalan Bujtas.
        
        There were two issues with repaints in -webkit-overflow-scrolling:touch scrolling
        layers.

        First, if the scrolled contents were inline (e.g. a <span>), then repaints were
        broken because RenderInline didn't call shouldApplyClipAndScrollPositionForRepaint().
        Fix by making shouldApplyClipAndScrollPositionForRepaint() a member function of RenderBox
        and calling it from RenderBox::computeRectForRepaint() and RenderInline::clippedOverflowRectForRepaint().

        Second, repaints were broken in RTL because RenderLayerBacking::setContentsNeedDisplayInRect()
        confused scroll offset and scroll position; it needs to subtract scrollPosition.
        
        Finally renamed to applyCachedClipAndScrollOffsetForRepaint() to applyCachedClipAndScrollPositionForRepaint()
        to make it clear that it uses scrollPosition, not scrollOffset.

        Tests: compositing/scrolling/touch-scrolling-repaint-spans.html
               compositing/scrolling/touch-scrolling-repaint.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::applyCachedClipAndScrollPositionForRepaint):
        (WebCore::RenderBox::shouldApplyClipAndScrollPositionForRepaint):
        (WebCore::RenderBox::computeRectForRepaint):
        (WebCore::RenderBox::applyCachedClipAndScrollOffsetForRepaint): Deleted.
        (WebCore::shouldApplyContainersClipAndOffset): Deleted.
        * rendering/RenderBox.h:
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::clippedOverflowRectForRepaint):
        (WebCore::RenderInline::computeRectForRepaint):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::computeRectForRepaint):

2016-06-27  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202436.
        https://bugs.webkit.org/show_bug.cgi?id=159190

        We don't need to make this change. (Requested by thorton on
        #webkit).

        Reverted changeset:

        "Do not use iOS specific telephone detection on macOS."
        https://bugs.webkit.org/show_bug.cgi?id=159096
        http://trac.webkit.org/changeset/202436

2016-06-27  Benjamin Poulain  <benjamin@webkit.org>

        Adopt the iOS TouchEventHandler API for cases that must have synchronous dispatch
        https://bugs.webkit.org/show_bug.cgi?id=159179
        rdar://problem/27006387

        Reviewed by Simon Fraser.

        Tests: fast/events/touch/ios/block-without-overflow-scroll-and-passive-observer-on-block-scrolling-state.html
               fast/events/touch/ios/block-without-overflow-scroll-and-passive-observer-on-document-scrolling-state.html
               fast/events/touch/ios/block-without-overflow-scroll-scrolling-state.html
               fast/events/touch/ios/drag-block-without-overflow-scroll-and-passive-observer-on-block.html
               fast/events/touch/ios/drag-block-without-overflow-scroll-and-passive-observer-on-document.html
               fast/events/touch/ios/drag-block-without-overflow-scroll.html

        * dom/Document.cpp:
        (WebCore::Document::prepareForDestruction):
        (WebCore::Document::removeAllEventListeners):
        * dom/Node.cpp:
        (WebCore::Node::willBeDeletedFrom):
        (WebCore::tryAddEventListener):
        (WebCore::tryRemoveEventListener):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::registerForTouchEvents):
        (WebCore::SliderThumbElement::unregisterForTouchEvents):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::registerAsTouchEventListenerForScrolling):
        (WebCore::RenderLayer::unregisterAsTouchEventListenerForScrolling):

2016-06-27  Alex Christensen  <achristensen@webkit.org>

        Fix Windows build.

        * bindings/js/SerializedScriptValue.h:
        WTF

2016-06-27  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202520.
        https://bugs.webkit.org/show_bug.cgi?id=159185

        This change broke the 32-bit El Capitan build (Requested by
        ryanhaddad on #webkit).

        Reverted changeset:

        "REGRESSION?(r202466): http/tests/security/canvas-remote-read-
        remote-video-redirect.html failing on Sierra"
        https://bugs.webkit.org/show_bug.cgi?id=159172
        http://trac.webkit.org/changeset/202520

2016-06-27  Jer Noble  <jer.noble@apple.com>

        REGRESSION?(r202466): http/tests/security/canvas-remote-read-remote-video-redirect.html failing on Sierra
        https://bugs.webkit.org/show_bug.cgi?id=159172
        <rdar://problem/27030025>

        Reviewed by Brent Fulgham.

        Add a hasSingleSecurityOrigin property to WebCoreNSURLSession that gets updated each time one of that
        sessions' tasks receieves a response or a redirect request. Check that property from the MediaPlayerPrivate.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::hasSingleSecurityOrigin):
        * platform/network/cocoa/WebCoreNSURLSession.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession updateHasSingleSecurityOrigin:]):
        (-[WebCoreNSURLSession dataTaskWithRequest:]):
        (-[WebCoreNSURLSession dataTaskWithURL:]):
        (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]):
        (-[WebCoreNSURLSessionDataTask resource:receivedRedirect:request:]):

2016-06-27  Benjamin Poulain  <benjamin@webkit.org>

        Fix style invalidation for :active when the activated node has no renderer
        https://bugs.webkit.org/show_bug.cgi?id=159125

        Reviewed by Antti Koivisto.

        Same old bug: a style invalidation path was depending
        on the style.

        Here we really need both flags. An element can have
        childrenAffectedByActive() false and renderStyle->affectedByActive() true
        if it was subject to style sharing.

        The element state "childrenAffectedByActive" should be renamed
        "styleAffectedByActive" since it is not a parent invalidation flag.
        That will be done separately.

        Tests: fast/css/pseudo-active-on-labeled-control-without-renderer.html
               fast/css/pseudo-active-style-sharing-1.html
               fast/css/pseudo-active-style-sharing-2.html
               fast/css/pseudo-active-style-sharing-3.html
               fast/css/pseudo-active-style-sharing-4.html
               fast/css/pseudo-active-style-sharing-5.html
               fast/css/pseudo-active-style-sharing-6.html

        * dom/Element.cpp:
        (WebCore::Element::setActive):
        * style/StyleRelations.cpp:
        (WebCore::Style::commitRelationsToRenderStyle):

2016-06-27  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: REGRESSION (r202063): ARIA role attribute is being ignored for label element
        https://bugs.webkit.org/show_bug.cgi?id=159162

        Reviewed by Chris Fleizach.

        createFromRenderer() was creating an AccessibilityLabel for any HTMLLabelElement which
        lacked an explicitly-handled ARIA role. We should instead create an AccessibilityLabel
        when there is no ARIA role.

        Test: accessibility/aria-role-on-label.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::createFromRenderer):

2016-06-27  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202505.
        https://bugs.webkit.org/show_bug.cgi?id=159169

        The test added with this change is flaky and it caused an
        existing test to time out on El Capitan. (Requested by
        ryanhaddad on #webkit).

        Reverted changeset:

        "[iOS] Media controls are too cramped with small video"
        https://bugs.webkit.org/show_bug.cgi?id=158815
        http://trac.webkit.org/changeset/202505

2016-06-27  Benjamin Poulain  <bpoulain@apple.com>

        Add :focus-within to the status page

        * features.json:
        I forgot to update the json file when landing the feature.

2016-06-27  Eric Carlson  <eric.carlson@apple.com>

        [Mac] PiP placeholder should remain visible when 'controls' attribute is removed
        https://bugs.webkit.org/show_bug.cgi?id=159158
        <rdar://problem/26727435>

        Reviewed by Jer Noble.

        No new tests, existing test updated.

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.shouldHaveControls): Always return true when in PiP or AirPlay mode.

2016-06-27  Oliver Hunt  <oliver@apple.com>

        Update ATS WebContent exception for more robust framework information
        https://bugs.webkit.org/show_bug.cgi?id=159151

        Reviewed by Alex Christensen.

        We found some unexpected poor interaction with AVFoundation in the existing
        CFNetwork SPI. This new SPI is more solid and let's us provide more useful
        information while also being more future proof against new frameworks and
        ATS modes.

        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::createNSURLConnection):

2016-06-27  Antoine Quint  <graouts@apple.com>

        [iOS] Media controls are too cramped with small video
        https://bugs.webkit.org/show_bug.cgi?id=158815
        <rdar://problem/26824238>

        Reviewed by Dean Jackson.

        In updateLayoutForDisplayedWidth(), we try to ensure a minimum width is guaranteed
        for the progress indicator. However, we were not accounting for the width used by
        the current and remaining time labels on either side of it, so we would incorrectly
        conclude that we were guaranteeing the minimum time and yield incorrect layouts since
        we were trying to fit more buttons than we had room for.

        In order to correctly compute the available width for the progress indicator, we now
        have clones of the current and remaining time labels, hidden from video and VoiceOver,
        that we update along with the originals. The same styles apply to both clones and
        originals, so we may measure the clones to determine the space used by the time labels.
        The reason we need to use clones is that if the time labels had previously been hidden
        from view, precisely because there was not enough space to display them along with the
        progress indicator, then trying to obtain metrics from them would yield 0 since they had
        "display: none" styles applied. In order to avoid extra layouts and possible flashing, we
        use the clones so that we never have to toggle the "display" property of the originals
        just to obtain their measurements.

        As a result of this change, we adjust the constant used to set the minimum required
        width available to display the progress indicator after all other essential controls
        and labels have been measured. That constant used to account for the width of the
        time labels, and this is no longer correct.

        Test: media/video-controls-drop-and-restore-timeline.html

        * Modules/mediacontrols/mediaControlsApple.css:
        (::-webkit-media-controls-time-remaining-display.clone):
        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller):
        (Controller.prototype.createTimeClones):
        (Controller.prototype.removeTimeClass):
        (Controller.prototype.addTimeClass):
        (Controller.prototype.updateDuration):
        (Controller.prototype.updateLayoutForDisplayedWidth):
        (Controller.prototype.updateTime):
        (Controller.prototype.updateControlsWhileScrubbing):
        * Modules/mediacontrols/mediaControlsiOS.css:
        (::-webkit-media-controls-time-remaining-display.clone):
        * Modules/mediacontrols/mediaControlsiOS.js:

2016-06-27  Anders Carlsson  <andersca@apple.com>

        No error message when passing an invalid API version to ApplePaySession constructor
        https://bugs.webkit.org/show_bug.cgi?id=159154

        Reviewed by Tim Horton.

        Log an error message if the version is not supported. Also, check for version 0 since that is also not supported.

        * Modules/applepay/ApplePaySession.cpp:
        (WebCore::ApplePaySession::create):

2016-06-27  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: Anonymous RenderMathMLOperators are not exposed to the accessibility tree
        https://bugs.webkit.org/show_bug.cgi?id=139582
        <rdar://problem/26938849>

        Reviewed by Chris Fleizach.

        This is based on a patch by Frederic Wang <fwang@igalia.com>.

        WebCore assigns the generic MathElementRole AccessibilityRole to elements
        which are expected to be included in the accessibility tree. This assignment
        is based on the AccessibilityRenderObject's node being a MathMLElement. The
        anonymous RenderMathMLOperators fail that test.

        From the perspective of accessibility support, these operators function
        like MathMLElements. Furthermore, both WebCore and the platforms rely
        upon MathElementRole to identify accessible MathML objects. The simplest
        fix is to have AccessibilityRenderObject::isMathElement() treat anonymous
        MathML operators as if they were MathMLElements.

        Now that these operators are being exposed, we need to handle them in
        AccessibilityRenderObject::textUnderElement() which assumes that anonymous
        objects either have nodes or have children with nodes. And crashes when
        that fails to be the case. Making RenderMathMLOperator::textContent()
        public and then using it to get the text under anonymous operators solves
        this problem. We also assign StaticTextRole to these operators on the Mac
        because the default platform mapping of MathElementRole is GroupRole, which
        made sense when we had a child RenderText object holding the operator.

        Lastly, AccessibilityRenderObject::isIgnoredElementWithinMathTree() no
        longer needs to special-case anonymous operators because they now have
        MathElementRole.

        Tests: accessibility/math-fenced.html
               accessibility/math-foreign-content.html

        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::isAnonymousMathOperator):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::textUnderElement):
        (WebCore::AccessibilityRenderObject::stringValue):
        (WebCore::AccessibilityRenderObject::isMathElement):
        (WebCore::AccessibilityRenderObject::isAnonymousMathOperator):
        (WebCore::AccessibilityRenderObject::isIgnoredElementWithinMathTree):
        * accessibility/AccessibilityRenderObject.h:
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper role]):
        * rendering/mathml/RenderMathMLMath.h:
        * rendering/mathml/RenderMathMLOperator.h:
        (WebCore::RenderMathMLOperator::textContent):

2016-06-27  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Remove unused RTCOfferAnswerOptionsPrivate.h
        https://bugs.webkit.org/show_bug.cgi?id=159130

        Reviewed by Eric Carlson.

        Remove unused RTCOfferAnswerOptionsPrivate.h file.

        * platform/mediastream/RTCOfferAnswerOptionsPrivate.h: Removed.

2016-06-27  Jer Noble  <jer.noble@apple.com>

        Crash in layout test /media/video-buffered-range-contains-currentTime.html
        https://bugs.webkit.org/show_bug.cgi?id=159109
        <rdar://problem/26535750>

        Reviewed by Alex Christensen.

        Guard against a dealloc race condition by holding a retain on the session
        until the task's _resource:loadFinishedWithError: completes, including
        main thread callbacks.
        
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSessionDataTask _resource:loadFinishedWithError:]):

2016-06-27  Frederic Wang  <fwang@igalia.com>

        Set an upper limit for the size or number of pieces of stretchy operators
        https://bugs.webkit.org/show_bug.cgi?id=155434

        Reviewed by Brent Fulgham.

        Stretchy MathML operators can currently use an arbitrary number of extension glyphs to cover
        a target size. This may result in hangs if large stretch sizes are requested. This change
        only allow at most the 128 first extensions to be painted by the MathOperator class, which
        should really be enough for mathematical formulas used in practice.

        No new tests, already tested by very-large-stretchy-operators.

        * rendering/mathml/MathOperator.cpp: Add a new kMaximumExtensionCount constant.
        (WebCore::MathOperator::fillWithVerticalExtensionGlyph): Limit the number of step in this loop to kMaximumExtensionCount.
        (WebCore::MathOperator::fillWithHorizontalExtensionGlyph): Ditto.

2016-06-27  Frederic Wang  <fred.wang@free.fr>

        Small refactoring MathMLInlineContainerElement::createElementRenderer
        https://bugs.webkit.org/show_bug.cgi?id=159131

        Reviewed by Brent Fulgham.

        Many of the MathML renderer classes have been merged during the MathML refactoring. We
        simplify how instances are created in MathMLInlineContainerElement::createElementRenderer
        by removing duplicate createRenderer calls.

        No new tests, behavior unchanged.

        * mathml/MathMLInlineContainerElement.cpp:
        (WebCore::MathMLInlineContainerElement::createElementRenderer):

2016-06-27  Miguel Gomez  <magomez@igalia.com>

        [GTK][EFL] Build with threaded compositor enabled is broken
        https://bugs.webkit.org/show_bug.cgi?id=159138

        Reviewed by Carlos Garcia Campos.

        No need to set the device scale. The compositor buffer is only used for the accelerated
        canvas scenario, and the device scale is always 1 there.
        This change was introduced in r202421.

        Covered by existing tests.

        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBufferData::createCompositorBuffer):

2016-06-27  Philippe Normand  <philn@igalia.com>

        [GStreamer] top/bottom black bars added needlessly in fullscreen
        https://bugs.webkit.org/show_bug.cgi?id=158980

        Reviewed by Carlos Garcia Campos.

        The natural video size calculation depends on the validity of the
        current sample, so whenever the first sample reached the sink it's a
        good idea to reflect this on the player which will update its natural
        size accordingly.

        Fixes an issue where black borders were added on top and bottom of
        fullscreen video.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):

2016-06-27  Youenn Fablet  <youenn@apple.com>

        Remove didFailRedirectCheck ThreadableLoaderClient callback
        https://bugs.webkit.org/show_bug.cgi?id=159085

        Reviewed by Daniel Bates.

        Removing didFailRedirectCheck and using didFailAccessControlCheck instead.
        The change in behavior is that additional error messages are outputted in the console.
        These messages give additional debugging information.

        Covered by rebased tests.

        * Modules/fetch/FetchLoader.cpp: Removing didFailRedirectCheck.
        * Modules/fetch/FetchLoader.h: Ditto.
        * inspector/InspectorNetworkAgent.cpp: Ditto.
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::redirectReceived): Calling didFailAccessControlCheck with information on failing
        URL.
        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
        * loader/ThreadableLoaderClient.h: Removing didFailRedirectCheck.
        * loader/ThreadableLoaderClientWrapper.h: Ditto.
        * loader/WorkerThreadableLoader.cpp: Ditto.
        * loader/WorkerThreadableLoader.h: Ditto.
        * page/EventSource.cpp: Ditto.
        * page/EventSource.h: Ditto.
        * workers/WorkerScriptLoader.cpp: Ditto.
        * workers/WorkerScriptLoader.h: Ditto.
        * xml/XMLHttpRequest.cpp: Ditto.
        * xml/XMLHttpRequest.h: Ditto.

2016-06-26  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        [EFL] Fix build warning when using geoclue2
        https://bugs.webkit.org/show_bug.cgi?id=159128

        Reviewed by Antonio Gomes.

        EFL port has handled build warning as error. So EFL port
        hasn't been built when we use geoclue2 library because a generated geoclue2 file
        has unused-parameter build warning. To fix it this patch set to ignore the build warning
        in the generated geoclue2 file.

        * PlatformEfl.cmake:

2016-06-26  Chris Dumez  <cdumez@apple.com>

        Regression: HTMLOptionsCollection's named properties have precedence over indexed properties
        https://bugs.webkit.org/show_bug.cgi?id=159058
        <rdar://problem/26988542>

        Reviewed by Ryosuke Niwa.

        HTMLOptionsCollection's named properties had precedence over indexed properties,
        which is wrong as per:
        http://heycam.github.io/webidl/#getownproperty-guts

        The reason is that there was a named property getter defined on HTMLOptionsCollection
        but no indexed property getter. As a result, HTMLOptionsCollection would fall back to
        using HTMLCollection's indexed property getter but HTMLOptionsCollection's named getter
        would take precedence. This patch defines an indexed property getter on
        HTMLOptionsCollection to fix the problem.

        Ideally, HTMLOptionsCollection would have no indexed / named property getters and would
        entirely rely on the ones from HTMLCollection. However, our bindings generator currently
        has trouble with this and requires HTMLOptionsCollection to have a named getter.

        Test: fast/dom/HTMLSelectElement/options-indexed-getter-precedence.html

        * html/HTMLOptionsCollection.idl:

2016-06-26  Chris Dumez  <cdumez@apple.com>

        Regression(r202262): Infinite loop under searchForLinkRemovingExistingDDLinks()
        https://bugs.webkit.org/show_bug.cgi?id=159122
        <rdar://problem/27014649>

        Reviewed by Ryosuke Niwa.

        Infinite loop under searchForLinkRemovingExistingDDLinks() because the
        value returned by NodeTraversal::next() was ignored and the node iterator
        was never updated.

        * editing/cocoa/DataDetection.mm:
        (WebCore::searchForLinkRemovingExistingDDLinks):

2016-06-25  Benjamin Poulain  <bpoulain@apple.com>

        The active state of elements can break when focus changes
        https://bugs.webkit.org/show_bug.cgi?id=159112

        Reviewed by Antti Koivisto.

        The pseudo class :active was behaving weirdly when used
        with label elements with an associated form element.
        The form element would get the :active state on the first click
        then no longer get the state until the focus changes.

        What was happenning is setFocusedElement() was clearing active
        for some unknown reason. When you really do that on an active element,
        you end up in an inconsistent state where no invalidation works.

        The two tests illustrates 2 ways this breaks.

        The test "pseudo-active-on-labeled-element-not-canceled-by-focus" clicks
        several time on a lable element. The first time, the input element gets
        the focus. The second time, it already has the focus, setFocusedElement()
        clears :active before finding the focusable element and end up clearing
        the active state on a target in the active chain.

        The test "pseudo-active-with-programmatic-focus.html" shows how to invalidate
        arbitrary elements using JavaScript. This can cause severely broken active
        chains where invalidation never cleans some ancestors.

        Tests: fast/css/pseudo-active-on-labeled-element-not-canceled-by-focus.html
               fast/css/pseudo-active-with-programmatic-focus.html

        * dom/Document.cpp:
        (WebCore::Document::setFocusedElement): Deleted.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMouseDoubleClickEvent):
        This is WebKit1 specific. The double click event was dispatching
        the mouseUp and Click with after doing an Active hit test.
        This causes us to have :active state in and after mouseUp in WebKit1.

2016-06-24  Jer Noble  <jer.noble@apple.com>

        Consider exposing or hiding knowledge of a redirect from clients of WebCoreNSURLSession
        https://bugs.webkit.org/show_bug.cgi?id=156722
        <rdar://problem/25780035>

        Reviewed by Alex Christensen.

        Fixes tests: http/tests/security/contentSecurityPolicy/audio-redirect-allowed2.html
                     http/tests/security/contentSecurityPolicy/video-redirect-allowed2.html

        When receieving a NSURLResponse containing a redirected URL, AVFoundadtion will use the
        URL in the response for subsequent requests. This violates the HTTP specification if the
        redirect was temporary, and it also breaks two CSP tests by bypassing the redirect step
        for subsequent requests.

        Work around this behavior in AVFoundation by recreating the NSURLResponse with the original
        request URL in the case of a temporary redirect.

        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]):
        (-[WebCoreNSURLSessionDataTask resource:receivedRedirect:request:]):

2016-06-24  Jer Noble  <jer.noble@apple.com>

        MSE gets confused by in-band text tracks
        https://bugs.webkit.org/show_bug.cgi?id=159107
        <rdar://problem/26871330>

        Reviewed by Eric Carlson.

        We can't currently handle text track samples in SourceBufferPrivateAVFObjC,
        so don't pass them up to SourceBuffer.

        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
        (WebCore::SourceBufferPrivateAVFObjC::didParseStreamDataAsAsset):
        (WebCore::SourceBufferPrivateAVFObjC::processCodedFrame):

2016-06-24  Mark Lam  <mark.lam@apple.com>

        [JSC] Error prototypes are called on remote scripts.
        https://bugs.webkit.org/show_bug.cgi?id=52192

        Reviewed by Keith Miller.

        Test: http/tests/security/regress-52192.html

        Parsing errors are reported to the main script's window.onerror function.  AFAIK,
        both Chrome and Firefox have the error reporting mechanism use an internal
        sanitized version of Error.prototype.toString() that will not invoke any getters
        or proxies instead.

        This patch fixes this issue by matching Chrome and Firefox's behavior.

        Note: we did not choose to make error objects and prototypes read-only because
        that was observed to have broken the web.
        See https://bugs.chromium.org/p/chromium/issues/detail?id=69187#c73

        Credit for reporting this issue goes to Daniel Divricean (http://divricean.ro).

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::reportException):
        * ForwardingHeaders/runtime/ErrorInstance.h: Added.

2016-06-24  Jer Noble  <jer.noble@apple.com>

        Media elements should not lose playback controls when muted by a user gesture
        https://bugs.webkit.org/show_bug.cgi?id=159078
        <rdar://problem/26925904>

        Reviewed by Beth Dakin.

        Rearrange canControlControlsManager() so that the muted check only occurs if
        a user gesture is required.

        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::canControlControlsManager):

2016-06-24  Beth Dakin  <bdakin@apple.com>

        Include enclosingListType in EditorState
        https://bugs.webkit.org/show_bug.cgi?id=159102
        -and corresponding-
        rdar://problem/26932490

        Reviewed by Enrica Casucci.

        Make HTMLOListElement.h and HTMLUListElement.h Private instead of Project.
        * WebCore.xcodeproj/project.pbxproj:

        Export enclosingList(Node*)
        * editing/htmlediting.h:

2016-06-24  Anders Carlsson  <andersca@apple.com>

        Another Windows build fix.

        * platform/network/BlobRegistry.h:

2016-06-24  Anders Carlsson  <andersca@apple.com>

        Yet another Windows build fix.

        * dom/ActiveDOMCallbackMicrotask.h:

2016-06-24  Anders Carlsson  <andersca@apple.com>

        Another Windows build fix.

        * page/FrameView.h:

2016-06-24  Anders Carlsson  <andersca@apple.com>

        Inline more of the Apple Pay source code
        https://bugs.webkit.org/show_bug.cgi?id=159099

        Reviewed by Andreas Kling.

        * page/Settings.h:
        (WebCore::Settings::applePayEnabled):
        (WebCore::Settings::setApplePayEnabled):
        (WebCore::Settings::applePayCapabilityDisclosureAllowed):
        (WebCore::Settings::setApplePayCapabilityDisclosureAllowed):

2016-06-24  Anders Carlsson  <andersca@apple.com>

        Windows build fix.

        * platform/GenericTaskQueue.h:
        (WebCore::TaskDispatcher::postTask):

2016-06-24  Frederic Wang  <fwang@igalia.com>

        Use auto* for MathML elements and renderers when possible
        https://bugs.webkit.org/show_bug.cgi?id=159090

        Reviewed by Alex Christensen.

        No new tests, behavior is unchanged.

        * mathml/MathMLElement.cpp:
        (WebCore::MathMLElement::attributeChanged):
        * mathml/MathMLSelectElement.cpp:
        (WebCore::MathMLSelectElement::getSelectedActionChildAndIndex):
        (WebCore::MathMLSelectElement::getSelectedActionChild):
        (WebCore::MathMLSelectElement::getSelectedSemanticsChild):
        (WebCore::MathMLSelectElement::updateSelectedChild):
        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::isValid):
        * rendering/mathml/RenderMathMLMenclose.cpp:
        (WebCore::RenderMathMLMenclose::layoutBlock):
        * rendering/mathml/RenderMathMLRoot.cpp:
        (WebCore::RenderMathMLRoot::isValid):
        * rendering/mathml/RenderMathMLRow.cpp:
        (WebCore::RenderMathMLRow::firstLineBaseline):
        (WebCore::RenderMathMLRow::computeLineVerticalStretch):
        (WebCore::RenderMathMLRow::computePreferredLogicalWidths):
        (WebCore::RenderMathMLRow::layoutRowItems):
        * rendering/mathml/RenderMathMLScripts.cpp:
        (WebCore::RenderMathMLScripts::unembellishedOperator):
        (WebCore::RenderMathMLScripts::getBaseAndScripts):
        (WebCore::RenderMathMLScripts::computePreferredLogicalWidths):
        (WebCore::RenderMathMLScripts::getScriptMetricsAndLayoutIfNeeded):
        (WebCore::RenderMathMLScripts::layoutBlock):
        (WebCore::RenderMathMLScripts::firstLineBaseline):
        * rendering/mathml/RenderMathMLUnderOver.cpp:
        (WebCore::RenderMathMLUnderOver::firstLineBaseline):
        (WebCore::RenderMathMLUnderOver::isValid):
        (WebCore::RenderMathMLUnderOver::over):

2016-06-24  Joseph Pecoraro  <pecoraro@apple.com>

        Remove unused and static return value from InspectorStyle::populateAllProperties
        https://bugs.webkit.org/show_bug.cgi?id=159069

        Reviewed by Andreas Kling.

        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyle::populateAllProperties):
        * inspector/InspectorStyleSheet.h:

2016-06-21  Anders Carlsson  <andersca@apple.com>

        Rename NoncopyableFunction to Function
        https://bugs.webkit.org/show_bug.cgi?id=158354

        Reviewed by Chris Dumez.

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::runTask):
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/webaudio/AudioDestinationNode.h:
        (WebCore::AudioDestinationNode::resume):
        (WebCore::AudioDestinationNode::suspend):
        (WebCore::AudioDestinationNode::close):
        * Modules/webaudio/DefaultAudioDestinationNode.cpp:
        (WebCore::DefaultAudioDestinationNode::resume):
        (WebCore::DefaultAudioDestinationNode::suspend):
        (WebCore::DefaultAudioDestinationNode::close):
        * Modules/webaudio/DefaultAudioDestinationNode.h:
        * dom/ActiveDOMCallbackMicrotask.cpp:
        (WebCore::ActiveDOMCallbackMicrotask::ActiveDOMCallbackMicrotask):
        * dom/ActiveDOMCallbackMicrotask.h:
        * dom/ScriptExecutionContext.h:
        (WebCore::ScriptExecutionContext::Task::Task):
        * fileapi/AsyncFileStream.cpp:
        (WebCore::callOnFileThread):
        (WebCore::AsyncFileStream::perform):
        * fileapi/AsyncFileStream.h:
        * page/FrameView.cpp:
        (WebCore::FrameView::queuePostLayoutCallback):
        (WebCore::FrameView::flushPostLayoutTasksQueue):
        * page/FrameView.h:
        * page/scrolling/ScrollingThread.cpp:
        (WebCore::ScrollingThread::dispatch):
        (WebCore::ScrollingThread::dispatchBarrier):
        (WebCore::ScrollingThread::dispatchFunctionsFromScrollingThread):
        * page/scrolling/ScrollingThread.h:
        * platform/GenericTaskQueue.cpp:
        (WebCore::TaskDispatcher<Timer>::postTask):
        * platform/GenericTaskQueue.h:
        (WebCore::TaskDispatcher::postTask):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::scheduleDeferredTask):
        * platform/mediastream/MediaStreamPrivate.cpp:
        (WebCore::MediaStreamPrivate::scheduleDeferredTask):
        * platform/mediastream/MediaStreamPrivate.h:
        * platform/mediastream/mac/AVMediaCaptureSource.h:
        * platform/mediastream/mac/AVMediaCaptureSource.mm:
        (WebCore::AVMediaCaptureSource::scheduleDeferredTask):
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::postResolutionCallbackQueue):
        (WebCore::Style::queuePostResolutionCallback):
        * style/StyleTreeResolver.h:

2016-06-24  Amir Alavi  <aalavi@apple.com>

        Use _CFHTTPCookieStorageGetDefault directly instead of NSHTTPCookieStorage to get default cookie storage
        https://bugs.webkit.org/show_bug.cgi?id=159095
        rdar://problem/26630073

        Reviewed by Brent Fulgham.

        No new tests, it isn't possible to test this in a LayoutTest.

        * platform/network/mac/CookieJarMac.mm:
        (WebCore::httpCookiesForURL): Get a CFHTTPCookieStorageRef when no cookie storage is provided to match the case when cookie storage is provided.

2016-06-24  Enrica Casucci  <enrica@apple.com>

        Do not use iOS specific telephone detection on macOS.
        https://bugs.webkit.org/show_bug.cgi?id=159096
        rdar://problem/25870571

        Reviewed by Anders Carlsson.

        Adding platform guard.

        * platform/cocoa/TelephoneNumberDetectorCocoa.cpp:
        (WebCore::TelephoneNumberDetector::phoneNumbersScanner):

2016-06-24  Jer Noble  <jer.noble@apple.com>

        Unreviewed build fix after r202429; AVStreamDataParser does not exist on iOS.

        * platform/spi/mac/AVFoundationSPI.h:

2016-06-24  Jer Noble  <jer.noble@apple.com>

        Unreviewed build fix after r202429; Fix the type of the delegate property on AVStreamDataParser.

        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
        * platform/spi/mac/AVFoundationSPI.h:

2016-06-02  Jer Noble  <jer.noble@apple.com>

        [MSE] Adopt +[AVStreamDataParser outputMIMECodecParameterForInputMIMECodecParameter:]
        https://bugs.webkit.org/show_bug.cgi?id=158312

        Reviewed by Eric Carlson.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::supportsType):

        Move the declaration of AVStreamDataParser into AVFoundationSPI.h:

        * platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.mm:
        (WebCore::CDMSessionAVStreamSession::update):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
        (-[WebAVStreamDataParserListener streamDataParser:didProvideMediaData:forTrackID:mediaType:flags:]):
        * platform/spi/mac/AVFoundationSPI.h:

2016-06-24  Eric Carlson  <eric.carlson@apple.com>

        [iOS, Mac] Assume a media file has audio during AirPlay
        https://bugs.webkit.org/show_bug.cgi?id=159088
        <rdar://problem/24616592>

        Reviewed by Jer Noble.

        No new tests, it isn't possible to test this in a LayoutTest.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerCurrentPlaybackTargetIsWirelessChanged): Call 
          mediaSession->setCanProduceAudio(true) when AirPlay becomes active.

2016-06-24  Jer Noble  <jer.noble@apple.com>

        Playback controls refer to wrong element when playing multiple items in a page.
        https://bugs.webkit.org/show_bug.cgi?id=159076
        <rdar://problem/26953532>

        Reviewed by Beth Dakin.

        Use a new method PlatformMediaSessionManager::currentSessionMatching() to get
        the most recently active media element which qualifies for playback controls.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::updatePlaybackControlsManager): Get the most recently active session.
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::canControlControlsManager): Make virtual; no longer takes an element.
        * html/MediaElementSession.h:
        (isType): Allow downcasting from PlatformMediaSession -> MediaElementSession.
        * page/ChromeClient.h:
        * platform/audio/PlatformMediaSession.h:
        (WebCore::PlatformMediaSession::canControlControlsManager): Defaults to false;
        * platform/audio/PlatformMediaSessionManager.cpp:
        (WebCore::PlatformMediaSessionManager::currentSessionMatching): Added.
        * platform/audio/PlatformMediaSessionManager.h:

2016-06-24  Dan Bernstein  <mitz@apple.com>

        Fixed the macOS build.

        * platform/spi/cocoa/DataDetectorsCoreSPI.h:

2016-06-24  Dan Bernstein  <mitz@apple.com>

        [iOS] Inline DataDetectorsAdditions.h
        https://bugs.webkit.org/show_bug.cgi?id=159093

        Reviewed by Anders Carlsson.

        * editing/cocoa/DataDetection.mm:
        (WebCore::constructURLStringForResult): Use soft-linked constant directly.

        * platform/cocoa/DataDetectorsCoreSoftLink.h: Declare soft-linked constant.
        * platform/cocoa/DataDetectorsCoreSoftLink.mm: Define soft-linked constant.
        * platform/spi/cocoa/DataDetectorsCoreSPI.h: Declare constant.

2016-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>

        [GTK][EFL] ImageBufferCairo should accept resolution factor
        https://bugs.webkit.org/show_bug.cgi?id=157848

        Reviewed by Martin Robinson.

        ImageBufferCairo ignored the resolution factor passed in its constructor.
        This resolution factor is originally introduced for HiDPI Canvas,
        and since HiDPI canvas is not enabled in the ports using Cairo,
        the lack of this implementation does not cause any problems.
        And now, HiDPI Canvas is removed from the tree.

        However, WebKit CSS filter uses this path.
        The missing implementation is required under the HiDPI environment.

        Since Cairo surface can have the device scale factor transparently,
        the operations onto the surface is correctly done in the logical coordinate system.
        So all we need to handle carefully is the direct surface modification done
        in filter effects.

        In this patch, we extend the image buffer size according to the resolution factor,
        as the same to the CoreGraphics' implementation (ImageBufferCG). And by setting the
        device scale factor of the surface correctly, we ensure that the rest of the Cairo
        painting stack works with the existing logical coordinate system. And in ImageBufferCairo,
        we carefully handle the logical and backing store coordinate system.

        The attached test applies the CSS filter onto the svg image. And we resize the image size,
        and perform scrolling. It incurs the paint, and filter effect recalcuation.
        In that path, the filter effect side assumes that the image buffer size is scaled with the
        resolution factor. So without this patch, it incurs buffer overflow and leads WebProcess crash.

        * platform/graphics/IntPoint.h:
        (WebCore::IntPoint::scale):
        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBufferData::createCompositorBuffer):
        (WebCore::ImageBuffer::ImageBuffer):
        (WebCore::ImageBuffer::copyImage):
        (WebCore::ImageBuffer::platformTransformColorSpace):
        (WebCore::getImageData):
        (WebCore::logicalUnit):
        (WebCore::backingStoreUnit):
        (WebCore::ImageBuffer::getUnmultipliedImageData):
        (WebCore::ImageBuffer::getPremultipliedImageData):
        (WebCore::ImageBuffer::putByteArray):
        (WebCore::ImageBuffer::copyToPlatformTexture):

2016-06-24  Frederic Wang  <fwang@igalia.com>

        Refactor RenderMathMLOperator and RenderMathMLToken to avoid using anonymous renderers.
        https://bugs.webkit.org/show_bug.cgi?id=155018

        Reviewed by Martin Robinson.

        No new tests, already covered by existing tests.

        We use MathOperator for RenderMathMLOperator to avoid creating anonymous text nodes again
        and again. We reimplement implicit mathvariant="italic" on single-char mi in a way that does
        not rely on creating anonymous text nodes. Finally, we improve the determination/update of
        when mathvariant is italic to avoid breaking foreign-mi-dynamic test.
        The change in the render tree structure breaks mfenced accessibility support but that will
        be fixed in follow-up patches. The simplifications made here will also allow to simplify the
        accessibility code.

        * css/mathml.css:
        (mo): Deleted. This flexbox rule is no longer needed.
        * rendering/mathml/RenderMathMLBlock.cpp:
        (WebCore::RenderMathMLBlock::createAnonymousMathMLBlock): Deleted. We no longer need to
        create anonymous renderer with this function.
        * rendering/mathml/RenderMathMLBlock.h: Delete createAnonymousMathMLBlock.
        * rendering/mathml/RenderMathMLOperator.cpp: Implement layout functions without relying on
        flexbox or anonymous.
        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): Handle the case of !useMathOperator()
        for which we need to add extra operator spacing after the RenderMathMLToken layout.
        (WebCore::RenderMathMLOperator::layoutBlock): Ditto.
        (WebCore::RenderMathMLOperator::isChildAllowed): Deleted. We allow the non-anonymous text.
        (WebCore::RenderMathMLOperator::rebuildTokenContent): No longer destroy and rebuild
        anonymous wrapper. Remove updateStyle call.
        (WebCore::RenderMathMLOperator::updateStyle): Deleted. We no longer need anonymous style for the spacing.
        * rendering/mathml/RenderMathMLOperator.h: Remove updateStyle() and isChildAllowed().
        Make textContent() public so that it can be accessed from the accessibility code.
        * rendering/mathml/RenderMathMLToken.cpp: Reimplement implicit mathvariant="italic" by
        painting MATHEMATICAL ITALIC characters instead of styling an anonymous wrapper.
        (WebCore::RenderMathMLToken::RenderMathMLToken): Init m_mathVariantGlyph and m_mathVariantGlyphDirty
        (WebCore::RenderMathMLToken::updateTokenContent): Set mathvariant glyph dirty when the content changes.
        (WebCore::transformToItalic): Helper function to map latin and greek alphabets to their
        MATHEMATICAL ITALIC counterpart.
        (WebCore::RenderMathMLToken::computePreferredLogicalWidths): Implement this function to
        handle the case where the mathvariant glyph is used.
        (WebCore::RenderMathMLToken::updateMathVariantGlyph): Helper function to update the mathvariant glyph.
        For now, we try and keep with the old (and limited) implementation: a mathvariant glyph may
        only used for single-char <mi> without mathvariant attribute attached to it.
        (WebCore::RenderMathMLToken::styleDidChange): Set the mathvariant glyph dirty when the style
        changes.
        (WebCore::RenderMathMLToken::updateFromElement): Remove updateStyle call and set mathvariant
        glyph dirty.
        (WebCore::RenderMathMLToken::firstLineBaseline): Implement this function to handle the case
         where the mathvariant glyph is used.
        (WebCore::RenderMathMLToken::layoutBlock): Ditto.
        (WebCore::RenderMathMLToken::paint): Ditto.
        (WebCore::RenderMathMLToken::paintChildren): Ditto.
        (WebCore::RenderMathMLToken::addChild): Deleted. No need to bother with anonymous renderer
        or style.
        (WebCore::RenderMathMLToken::createWrapperIfNeeded): Deleted. Ditto.
        (WebCore::RenderMathMLToken::updateStyle): Deleted. Ditto.
        * rendering/mathml/RenderMathMLToken.h: Update declarations of functions.
        (WebCore::RenderMathMLToken::setMathVariantGlyphDirty): Helper function to indicate that the
        mathvariant glyph will need to be updated.

2016-06-24  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Unreviewed EFL build fix.

        There is forward declaration build error on EFL port.

        * platform/graphics/texmap/coordinated/CompositingCoordinator.cpp: Include DOMWindow.h and Document.h.

2016-06-23  Brady Eidson  <beidson@apple.com>

        Retrieving Blobs from IndexedDB using cursors fails in WK2 (Sandboxing)
        https://bugs.webkit.org/show_bug.cgi?id=158991

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/blob-cursor.html

        * platform/network/BlobDataFileReference.cpp:
        (WebCore::BlobDataFileReference::startTrackingModifications): Deleted.

2016-06-23  Alex Christensen  <achristensen@webkit.org>

        Remove unused didCancelAuthenticationChallenge
        https://bugs.webkit.org/show_bug.cgi?id=158819

        Reviewed by David Kilzer.

        No change in behavior.  This callback was deprecated in Yosemite.  It is never called.

        * loader/EmptyClients.h:
        * loader/FrameLoaderClient.h:
        * loader/ResourceLoadNotifier.cpp:
        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge): Deleted.
        * loader/ResourceLoadNotifier.h:
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::didCancelAuthenticationChallenge): Deleted.
        * loader/ResourceLoader.h:
        * platform/network/ResourceHandle.h:
        * platform/network/ResourceHandleClient.h:
        (WebCore::ResourceHandleClient::didCancelAuthenticationChallenge): Deleted.
        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::didCancelAuthenticationChallenge): Deleted.
        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
        (-[WebCoreResourceHandleAsDelegate connection:didCancelAuthenticationChallenge:]): Deleted.
        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didCancelAuthenticationChallenge:]): Deleted.
        * platform/spi/cocoa/NSURLDownloadSPI.h:

2016-06-23  Anders Carlsson  <andersca@apple.com>

        Add "shippingType" to the list of valid payment request properties
        https://bugs.webkit.org/show_bug.cgi?id=159079
        <rdar://problem/26988429>

        Reviewed by Dean Jackson.

        * Modules/applepay/ApplePaySession.cpp:
        (WebCore::isValidPaymentRequestPropertyName):

2016-06-23  Benjamin Poulain  <benjamin@webkit.org>

        Specialize synchronous event tracking per event type
        https://bugs.webkit.org/show_bug.cgi?id=158826

        Reviewed by Simon Fraser.

        First, kudos to Rick Byers for all his helps on passive event dispatch.
        The specs are pretty damn good and his help reviewing patches is very useful.

        This patch change synchronous event dispatch to happen per event
        instead of per sequence touchstart->touchend.

        The big advantage of this is we can dispatch more events asynchronously.
        For example, to handle a tap programmatically, you can limit the active listener
        to the touchend event. The touchstart and touchmove are now dispatched asynchronously.

        The implementation is a simple extension to EventTrackingRegions.
        Instead of a single synchronous region, we have one region per event type.
        When processing the events, we only need to send the events synchronously
        if that particular event type has a synchronous region.

        Note that EventDispatcher's touch event support already supports
        mixing synchronous and asynchronous events. The events are always processed
        in order even if asynchronous events are pending when a synchronous dispatch
        happens.

        Tests: fast/events/touch/ios/tap-with-active-listener-inside-document-with-passive-listener.html
               fast/events/touch/ios/tap-with-active-listener-inside-window-with-passive-listener.html
               fast/events/touch/ios/tap-with-active-touch-end-listener.html
               fast/events/touch/ios/tap-with-passive-listener-inside-active-listener.html
               fast/events/touch/ios/tap-with-passive-touch-end-listener.html
               fast/events/touch/ios/tap-with-passive-touch-start-active-touch-end-listeners-on-elements.html
               fast/events/touch/ios/tap-with-passive-touch-start-active-touch-move-listeners-on-elements.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/EventTarget.cpp:
        (WebCore::EventTarget::hasActiveTouchEventListeners): Deleted.
        * dom/EventTarget.h:
        * page/DebugPageOverlays.cpp:
        (WebCore::NonFastScrollableRegionOverlay::updateRegion):
        * page/Page.cpp:
        (WebCore::Page::nonFastScrollableRects):
        * page/scrolling/ScrollingCoordinator.cpp:
        (WebCore::ScrollingCoordinator::absoluteEventTrackingRegionsForFrame):
        * page/scrolling/ScrollingStateFrameScrollingNode.cpp:
        (WebCore::ScrollingStateFrameScrollingNode::dumpProperties):
        * page/scrolling/ScrollingTree.cpp:
        (WebCore::ScrollingTree::shouldHandleWheelEventSynchronously):
        (WebCore::ScrollingTree::eventTrackingTypeForPoint):
        * page/scrolling/ScrollingTree.h:
        * platform/EventTrackingRegions.cpp: Added.
        (WebCore::EventTrackingRegions::trackingTypeForPoint):
        (WebCore::EventTrackingRegions::isEmpty):
        (WebCore::EventTrackingRegions::translate):
        (WebCore::EventTrackingRegions::uniteSynchronousRegion):
        (WebCore::EventTrackingRegions::unite):
        (WebCore::operator==):
        * platform/EventTrackingRegions.h:
        (WebCore::EventTrackingRegions::isEmpty): Deleted.
        (WebCore::EventTrackingRegions::trackingTypeForPoint): Deleted.
        (WebCore::operator==): Deleted.

2016-06-23  Simon Fraser  <simon.fraser@apple.com>

        More attempting to fix external iOS builds.

        * platform/spi/cocoa/QuartzCoreSPI.h:

2016-06-23  Simon Fraser  <simon.fraser@apple.com>

        Try to fix the non-internal builds by defining CARenderServerBufferRef.

        * platform/spi/cocoa/QuartzCoreSPI.h:

2016-06-23  Simon Fraser  <simon.fraser@apple.com>

        [iOS] Make DumpRenderTree and WebKitTestRunner in the simulator use render server snapshotting
        https://bugs.webkit.org/show_bug.cgi?id=159077

        Reviewed by Tim Horton.

        Add CARenderServer SPIs.

        Test: fast/harness/snapshot-captures-compositing.html

        * platform/spi/cocoa/QuartzCoreSPI.h:

2016-06-23  Brian Burg  <bburg@apple.com>

        Web Inspector: add assertions to catch dangling frontends that persist between tests
        https://bugs.webkit.org/show_bug.cgi?id=159073

        Reviewed by Joseph Pecoraro.

        Based on the analysis in https://webkit.org/b/159070, we suspect that some test
        flakiness might be caused by dangling frontends from previous test cases. Add an
        assertion that should catch any frontends that are attached to the inspected page's
        backend. There should never be any frontends connected when a test first starts.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::setIsUnderTest):
        * inspector/InspectorController.h:

2016-06-23  Said Abou-Hallawa  <sabouhallawa@apple.com>

        requestFrameAnimation() callback timestamp should be very close to Performance.now() 
        https://bugs.webkit.org/show_bug.cgi?id=159038

        Reviewed by Simon Fraser.

        Pass the Performance.now() to requestFrameAnimation() callback. Do not add
        the timeUntilOutput which is the difference between outputTime and now since
        this addition makes us report a timestamp ahead in the future by almost 33ms.

        A new function named "nowTimestamp()" is added to the DOMWindow class. It
        calls Performance.now() if WEB_TIMING is enabled, otherwise it calls
        monotonicallyIncreasingTime(). The returned timestamp is seconds and it is
        relative to the document loading time.

        The timestamp passing will be removed all the down till the callers of
        ScriptedAnimationController::serviceScriptedAnimations(). The callers will
        getting the now timestamp by calling DOMWindow::nowTimestamp().

        Tests: animations/animation-callback-timestamp.html
               animations/animation-multiple-callbacks-timestamp.html

        * dom/Document.cpp:
        (WebCore::Document::monotonicTimestamp):
        (WebCore::Document::serviceScriptedAnimations):
        * dom/Document.h:
        * dom/ScriptedAnimationController.cpp:
        (WebCore::ScriptedAnimationController::serviceScriptedAnimations):
        (WebCore::ScriptedAnimationController::animationTimerFired):
        (WebCore::ScriptedAnimationController::displayRefreshFired):
        * dom/ScriptedAnimationController.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::getVideoPlaybackQuality):
        * loader/DocumentLoadTiming.h:
        (WebCore::DocumentLoadTiming::referenceWallTime):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::nowTimestamp):
        * page/DOMWindow.h:
        * page/FrameView.cpp:
        (WebCore::FrameView::serviceScriptedAnimations):
        * page/FrameView.h:
        * platform/graphics/DisplayRefreshMonitor.cpp:
        (WebCore::DisplayRefreshMonitor::DisplayRefreshMonitor):
        (WebCore::DisplayRefreshMonitor::displayDidRefresh):
        * platform/graphics/DisplayRefreshMonitor.h:
        (WebCore::DisplayRefreshMonitor::setMonotonicAnimationStartTime): Deleted.
        * platform/graphics/DisplayRefreshMonitorClient.cpp:
        (WebCore::DisplayRefreshMonitorClient::fireDisplayRefreshIfNeeded):
        * platform/graphics/DisplayRefreshMonitorClient.h:
        * platform/graphics/GraphicsLayerUpdater.cpp:
        (WebCore::GraphicsLayerUpdater::displayRefreshFired):
        * platform/graphics/GraphicsLayerUpdater.h:
        * platform/graphics/ios/DisplayRefreshMonitorIOS.h:
        * platform/graphics/ios/DisplayRefreshMonitorIOS.mm:
        (-[WebDisplayLinkHandler handleDisplayLink:]):
        (WebCore::DisplayRefreshMonitorIOS::displayLinkFired):
        (WebCore::mediaTimeToCurrentTime): Deleted.
        * platform/graphics/mac/DisplayRefreshMonitorMac.cpp:
        (WebCore::displayLinkCallback):
        (WebCore::DisplayRefreshMonitorMac::displayLinkFired):
        * platform/graphics/mac/DisplayRefreshMonitorMac.h:
        * platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:
        (WebCore::CompositingCoordinator::syncDisplayState):
        (WebCore::CompositingCoordinator::nextAnimationServiceTime):

2016-06-23  David Kilzer  <ddkilzer@apple.com>

        Remove unused HarfBuzzFaceCoreText.cpp
        <https://webkit.org/b/159065>

        Reviewed by Myles C. Maxfield.

        * platform/graphics/harfbuzz/HarfBuzzFaceCoreText.cpp: Removed.

2016-06-23  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Memory Timeline sometimes shows impossible value for bmalloc size (underflowed)
        https://bugs.webkit.org/show_bug.cgi?id=158110
        <rdar://problem/26498584>

        Reviewed by Andreas Kling.

        IOSurface memory backing Canvas element buffers should be classified as "GC Owned",
        but should not be considered a part of bmalloc. In fact, the actual memory cost is
        external to the Web Content Process. The majority of extra memory reporters tend
        to report extra memory that is also allocated in bmalloc. However, some report
        non-bmalloc memory, such as the IOSurfaces here.
        
        Continue to report the memory cost without changes to inform the Heap for garbage
        collection. However, also keep better accounting of GCOwned memory that is external
        to the process for better accounting for the Resource Usage overlay and Web Inspector
        Memory timeline.
        
        This is a bit of a game where we want to display the best possible number for
        "GCOwned memory" in the tools, but some of that memory shows up in the other
        regions (bmalloc, system malloc, etc). Already many sizes are estimates
        (ReportExtraMemory, reportExtraMemory ignores small allocations), so we just focus
        on getting the largest sources of allocations, such as Canvas IOSurfaces here,
        into the right bucket. ResourceUsageThreadCocoa continues to subtract the "extra"
        memory from bmalloc. So, we should address other large sources of "extra memory"
        not in bmalloc. A likely candidate is HTMLMediaElement which uses the deprecated
        reporting right now.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        Add a way to report External memory, dependent on reporting Extra memory.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::externalMemoryCost):
        * html/HTMLCanvasElement.h:
        * html/HTMLCanvasElement.idl:
        Report external memory cost just like extra memory.

        * page/ResourceUsageData.cpp:
        (WebCore::ResourceUsageData::ResourceUsageData):
        * page/ResourceUsageData.h:
        (WebCore::MemoryCategoryInfo::totalSize):
        * page/cocoa/ResourceUsageOverlayCocoa.mm:
        (WebCore::RingBuffer::at):
        (WebCore::appendDataToHistory):
        (WebCore::ResourceUsageOverlay::platformDraw):
        * page/cocoa/ResourceUsageThreadCocoa.mm:
        (WebCore::categoryForVMTag):
        (WebCore::ResourceUsageThread::platformThreadBody):
        Do not count the GCOwned External memory as dirty memory.
        Include External memory output in the overlay.

        * inspector/InspectorMemoryAgent.cpp:
        (WebCore::InspectorMemoryAgent::collectSample):
        When sizing the JavaScript portion, include both the GC Owned
        category's dirty and external memory. Ultimately we will
        want this everywhere in case things change.

        * platform/graphics/ImageBuffer.cpp:
        (WebCore::memoryCost):
        (WebCore::externalMemoryCost):
        * platform/graphics/ImageBuffer.h:
        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::ImageBuffer::memoryCost):
        (WebCore::ImageBuffer::externalMemoryCost):
        Report IOSurface total bytes as extra memory and external memory
        so that it can be tracked as GC Owned memory that is separate from
        regular (bmalloc/other) in process memory.

2016-06-23  Alexey Proskuryakov  <ap@apple.com>

        Handle (0, 0) ranges from Lookup
        https://bugs.webkit.org/show_bug.cgi?id=159062
        rdar://problem/26960385

        Reviewed by Tim Horton.

        * editing/mac/DictionaryLookup.mm: (WebCore::DictionaryLookup::rangeAtHitTestResult):
        Paper over <https://bugs.webkit.org/show_bug.cgi?id=159063>, which seems too involved
        to fix now.

2016-06-23  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: first heap snapshot taken when a page is reloaded happens before the reload navigation
        https://bugs.webkit.org/show_bug.cgi?id=158995
        <rdar://problem/26923778>

        Reviewed by Brian Burg.

        When the "Heap" instrument is included in the Timeline list
        of instruments, defer starting it in an auto-capture scenario
        until after the page does its first navigation.

        AutoCapture on the backend happens when it is enabled at
        the main resource starts loading. In that case it proceeds
        through the following phases:

            No Auto Capture:
                None

            Auto Capture:
                BeforeLoad -> FirstNavigation -> AfterFirstNavigation

        When toggling instruments for backend initiated capture
        most instruments do not care and will just start/stop.

        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
        Inform the TimelineAgent that the main frame navigated.
        Do this after informing the HeapAgent (so any potential
        snapshot does not get cleared) and PageAgent (so the
        frontend knows the page navigated before the agent starts).

        * inspector/InspectorTimelineAgent.h:
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::internalStop):
        (WebCore::InspectorTimelineAgent::mainFrameStartedLoading):
        (WebCore::InspectorTimelineAgent::mainFrameNavigated):
        Update the auto capture phase transitions.

        (WebCore::InspectorTimelineAgent::toggleHeapInstrument):
        Only start the heap agent during the None phase (console.profile)
        or with the first navigation (auto capture page navigation).

2016-06-23  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Snapshots should be cleared at some point
        https://bugs.webkit.org/show_bug.cgi?id=157907
        <rdar://problem/26373610>

        Reviewed by Timothy Hatcher.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * inspector/InspectorAllInOne.cpp:
        New specialized agent.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        Construct a specialized HeapAgent.

        * inspector/PageHeapAgent.h:
        * inspector/PageHeapAgent.cpp:
        (WebCore::PageHeapAgent::PageHeapAgent):
        (WebCore::PageHeapAgent::enable):
        (WebCore::PageHeapAgent::disable):
        (WebCore::PageHeapAgent::mainFrameNavigated):
        Clear backend snapshots on page navigations.
        Set the PageHeapAgent instrumenting agent on enable/disable.

        * inspector/InstrumentingAgents.cpp:
        (WebCore::InstrumentingAgents::reset):
        * inspector/InstrumentingAgents.h:
        (WebCore::InstrumentingAgents::pageHeapAgent):
        (WebCore::InstrumentingAgents::setPageHeapAgent):
        Active PageHeapAgent.

        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
        Inform the PageHeapAgent when the mainframe navigates.

2016-06-23  Joseph Pecoraro  <pecoraro@apple.com>

        CSSComputedStyleDeclaration::length should recalculate styles if needed to provide the correct value
        https://bugs.webkit.org/show_bug.cgi?id=159053
        <rdar://problem/26638119>

        Reviewed by Simon Fraser.

        Test: fast/css/variables/custom-property-computed-style-length-update.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::length):

2016-06-23  John Wilander  <wilander@apple.com>

        Enable window.open() for existing versions of Secret Society
        https://bugs.webkit.org/show_bug.cgi?id=159049
        <rdar://problem/26528349>

        Reviewed by Andy Estes.

        The Secret Society Hidden Mystery app has a broken version check treating iOS 10
        as iOS 1 on iPads. Therefore it believes it can use window.open() in a tap
        handler. We should allow the existing versions of the app to do this to not break
        them.

        No new tests. Tested manually in the app.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::allowPopUp):
            Now checks with Settings whether it should allow a popup even though it is
            not processing a user gesture.
        * page/Settings.in:
            Added setting allowWindowOpenWithoutUserGesture.
        * platform/RuntimeApplicationChecks.h:
        * platform/RuntimeApplicationChecks.mm:
        (WebCore::IOSApplication::isTheSecretSocietyHiddenMystery):
            Added.

2016-06-23  Chris Dumez  <cdumez@apple.com>

        Only call sqlite3_initialize() when a SQLite database is actually being opened
        https://bugs.webkit.org/show_bug.cgi?id=159033

        Reviewed by Brady Eidson.

        Only call sqlite3_initialize() when a SQLite database is actually being opened
        instead of doing it unconditionally. sqlite3_initialize() was previously called
        in the SQLiteDatabase constructor which gets called on WebContent process
        initialization because a DatabaseTracker is constructed on initialization and
        DatabaseTracker has a SQLiteDatabase data member.

        * platform/sql/SQLiteDatabase.cpp:
        (WebCore::initializeSQLiteIfNecessary):
        (WebCore::SQLiteDatabase::open):
        (WebCore::SQLiteDatabase::SQLiteDatabase): Deleted.
        * platform/sql/SQLiteDatabase.h:

2016-06-23  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Align 'update ICE connection/gathering state' steps with the WebRTC 1.0 specification
        https://bugs.webkit.org/show_bug.cgi?id=159054

        Reviewed by Eric Carlson.

        Add checks for same state and closed RTCPeerConnection in the 'update ICE connection state'
        and 'update ICE gathering state' routines as described in [1].

        [1] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html#update-ice-gathering-state

        No change in current behavior.

        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::updateIceGatheringState):
        (WebCore::RTCPeerConnection::updateIceConnectionState):

2016-06-23  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Add support for RTCPeerConnection legacy MediaStream-based API
        https://bugs.webkit.org/show_bug.cgi?id=158940

        Reviewed by Eric Carlson.

        Implement the legacy MediaStream-based RTCPeerConnection API as JS built-ins. The
        getRemoteStreams() function and the 'addstream' event are partly implemented with native
        code.

        Test: fast/mediastream/RTCPeerConnection-legacy-stream-based-api.html

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::setRemoteDescriptionTask):
        (WebCore::MediaEndpointPeerConnection::getRemoteStreams):
        The getRemoteStreams() function and the 'addstream' event is backed up by native code.
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/mediastream/MediaStream.idl:
        * Modules/mediastream/PeerConnectionBackend.h:
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/mediastream/RTCPeerConnection.js:
        (initializeRTCPeerConnection):
        (getLocalStreams):
        (getRemoteStreams):
        (getStreamById):
        (addStream):
        (removeStream):
        Legacy API implemented as JS built-ins.
        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::addBuiltinGlobals):
        * bindings/js/WebCoreBuiltinNames.h:

2016-06-23  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix the build with CSS Shapes disabled.

        * css/StyleBuilderConverter.h:

2016-06-23  Carlos Garcia Campos  <cgarcia@igalia.com>

        [Soup] Clean up SocketStreamHandle soup implementation
        https://bugs.webkit.org/show_bug.cgi?id=159024

        Reviewed by Žan Doberšek.

        Stop using a global HashMap to "acivate"/"deactivate" handles, and just take a reference of the handle and
        pass the ownership to the callbacks, using a GCancellable to cancel all async operations.

        * platform/network/soup/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::create):
        (WebCore::SocketStreamHandle::id): Deleted.
        * platform/network/soup/SocketStreamHandleSoup.cpp:
        (WebCore::SocketStreamHandle::SocketStreamHandle):
        (WebCore::SocketStreamHandle::connected):
        (WebCore::SocketStreamHandle::connectedCallback):
        (WebCore::SocketStreamHandle::readBytes):
        (WebCore::SocketStreamHandle::readReadyCallback):
        (WebCore::SocketStreamHandle::didFail):
        (WebCore::SocketStreamHandle::platformSend):
        (WebCore::SocketStreamHandle::platformClose):
        (WebCore::SocketStreamHandle::beginWaitingForSocketWritability):
        (WebCore::SocketStreamHandle::writeReadyCallback):
        (WebCore::getHandleFromId): Deleted.
        (WebCore::deactivateHandle): Deleted.
        (WebCore::activateHandle): Deleted.
        (WebCore::SocketStreamHandle::~SocketStreamHandle): Deleted.
        (WebCore::connectedCallback): Deleted.
        (WebCore::readReadyCallback): Deleted.
        (WebCore::writeReadyCallback): Deleted.

2016-06-22  Brady Eidson  <beidson@apple.com>

        DatabaseProcess doesn't handle WebProcesses going away uncleanly.
        https://bugs.webkit.org/show_bug.cgi?id=158894

        Reviewed by Alex Christensen.

        No new tests (Covered by additions to existing API test).

        * Modules/indexeddb/server/IDBConnectionToClient.cpp:
        (WebCore::IDBServer::IDBConnectionToClient::registerDatabaseConnection):
        (WebCore::IDBServer::IDBConnectionToClient::unregisterDatabaseConnection):
        (WebCore::IDBServer::IDBConnectionToClient::connectionToClientClosed):
        * Modules/indexeddb/server/IDBConnectionToClient.h:
        
        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::unregisterConnection): Call connectionToClientClosed() on
          the connection, which cleans up after it in the server.
        
        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::UniqueIDBDatabaseConnection):
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::~UniqueIDBDatabaseConnection):

2016-06-22  Benjamin Poulain  <bpoulain@apple.com>

        AX: Add support for CSS4 :focus-within pseudo
        https://bugs.webkit.org/show_bug.cgi?id=140144

        Reviewed by Antti Koivisto.

        Tests: fast/css/pseudo-focus-within-basics.html
               fast/css/pseudo-focus-within-inside-shadow-dom.html
               fast/css/pseudo-focus-within-style-sharing-1.html
               fast/css/pseudo-focus-within-style-sharing-2.html
               fast/selectors/focus-within-style-update.html

        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::selectorText):
        * css/CSSSelector.h:
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOne):
        * css/SelectorPseudoClassAndCompatibilityElementMap.in:
        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::addPseudoClassType):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementHasFocusWithin):
        * dom/ContainerNode.cpp:
        (WebCore::destroyRenderTreeIfNeeded):
        * dom/Element.cpp:
        (WebCore::Element::~Element):
        (WebCore::Element::setFocus):
        (WebCore::Element::unregisterNamedFlowContentElement):
        (WebCore::Element::setIsNamedFlowContentElement):
        (WebCore::Element::clearIsNamedFlowContentElement):
        (WebCore::Element::setStyleAffectedByFocusWithin):
        (WebCore::Element::rareDataStyleAffectedByFocusWithin):
        (WebCore::Element::rareDataIsNamedFlowContentElement):
        * dom/Element.h:
        (WebCore::Element::hasFocusWithin):
        (WebCore::Element::styleAffectedByFocusWithin):
        (WebCore::Element::isNamedFlowContentElement):
        (WebCore::Element::setHasFocusWithin):
        * dom/ElementRareData.h:
        (WebCore::ElementRareData::styleAffectedByFocusWithin):
        (WebCore::ElementRareData::setStyleAffectedByFocusWithin):
        (WebCore::ElementRareData::isNamedFlowContentElement):
        (WebCore::ElementRareData::setIsNamedFlowContentElement):
        (WebCore::ElementRareData::ElementRareData):
        (WebCore::ElementRareData::resetComputedStyle):
        * dom/Node.h:
        (WebCore::Node::flagHasFocusWithin):
        (WebCore::Node::isNamedFlowContentNode): Deleted.
        (WebCore::Node::setIsNamedFlowContentNode): Deleted.
        (WebCore::Node::clearIsNamedFlowContentNode): Deleted.
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::clearContentElements):
        (WebCore::RenderNamedFlowThread::registerNamedFlowContentElement):
        (WebCore::RenderNamedFlowThread::unregisterNamedFlowContentElement):
        (WebCore::nextNodeInsideContentElement):
        * style/RenderTreeUpdater.cpp:
        (WebCore::RenderTreeUpdater::updateElementRenderer):
        * style/StyleRelations.cpp:
        (WebCore::Style::commitRelationsToRenderStyle):
        (WebCore::Style::commitRelations):
        * style/StyleRelations.h:
        * style/StyleSharingResolver.cpp:
        (WebCore::Style::SharingResolver::canShareStyleWithElement):

2016-06-22  Oliver Hunt  <oliver@apple.com>

        Integrate WebKit's CFURLConnection with App Transport Security
        https://bugs.webkit.org/show_bug.cgi?id=159039
        <rdar://problem/26953685>

        Reviewed by Alex Christensen.

        Pass additional options to NSURLConnect initialiser to identify that
        this connection is for WebKit content loading.

        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::createNSURLConnection):

2016-06-20  Jeremy Jones  <jeremyj@apple.com>

        Adopt commitPriority to get rid of the 2 AVPL solution for PiP
        https://bugs.webkit.org/show_bug.cgi?id=158949
        rdar://problem/26867866

        Reviewed by Simon Fraser.

        No new tests because there is no behavior change. This reverts changes from 
        https://bugs.webkit.org/show_bug.cgi?id=158148 and instead uses -[CAContext commitPriority:]
        to prevent flicker when moving a layer between contexts. 
        commitPriority allows the layer to be added to the destination context before it is 
        removed from the source context.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h: remove m_secondaryVideoLayer.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm: ditto
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenGravity): ditto.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::syncTextTrackBounds): ditto.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer): ditto.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateVideoLayerGravity): ditto.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm: ditto
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::addDisplayLayer): ditto
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm: ditto
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::createPreviewLayers):ditto
        * platform/graphics/avfoundation/objc/VideoFullscreenLayerManager.h: ditto
        * platform/graphics/avfoundation/objc/VideoFullscreenLayerManager.mm: ditto
        (WebCore::VideoFullscreenLayerManager::setVideoLayer): ditto
        (WebCore::VideoFullscreenLayerManager::setVideoFullscreenLayer): ditto and adopt commitPriority.
        (WebCore::VideoFullscreenLayerManager::setVideoFullscreenFrame): ditto
        (WebCore::VideoFullscreenLayerManager::setVideoLayers): Deleted. 
        (WebCore::VideoFullscreenLayerManager::didDestroyVideoLayer): remove m_secondaryVideoLayer.
        * platform/spi/cocoa/QuartzCoreSPI.h: Add commitPriority.

2016-06-22  Simon Fraser  <simon.fraser@apple.com>

        REGRESSION (r201629): Weird button glitching on github.com
        https://bugs.webkit.org/show_bug.cgi?id=159031
        rdar://problem/26880332

        Reviewed by Tim Horton.

        r201629 changed the logic slightly when creating an image buffer for a scaled context;
        it set the buffer context's scale to the scale in the source context, but this failed
        to take into account the rounding up of the buffer size, which the old code did.

        Fix by reverting to the old behavior.

        Since buffer sizes can only be integral, changed compatibleBufferSize() to return
        an IntSize.

        Test: fast/backgrounds/scaled-gradient-background.html

        * platform/graphics/ImageBuffer.cpp:
        (WebCore::ImageBuffer::createCompatibleBuffer):
        (WebCore::ImageBuffer::compatibleBufferSize):
        * platform/graphics/ImageBuffer.h:
        * platform/graphics/IntRect.h:
        (WebCore::IntRect::area):
        * platform/graphics/IntSize.h:
        (WebCore::IntSize::area): Make this return an unsigned.

2016-06-22  Anders Carlsson  <andersca@apple.com>

        Inline the last of the Apple Pay WebCore code
        https://bugs.webkit.org/show_bug.cgi?id=159032

        Reviewed by Tim Horton.

        * loader/EmptyClients.cpp:
        (WebCore::fillWithEmptyClients):
        * page/MainFrame.cpp:
        (WebCore::MainFrame::MainFrame):
        * page/MainFrame.h:
        * page/PageConfiguration.h:
        * platform/cocoa/ThemeCocoa.mm:
        (WebCore::passKitBundle):
        (WebCore::loadPassKitPDFPage):
        (WebCore::applePayButtonLogoBlack):
        (WebCore::applePayButtonLogoWhite):
        (WebCore::drawApplePayButton):
        (WebCore::ThemeCocoa::drawNamedImage):

2016-06-22  Anders Carlsson  <andersca@apple.com>

        Exception is not thrown when shipping method is an invalid amount
        https://bugs.webkit.org/show_bug.cgi?id=159030
        rdar://problem/26700413

        Reviewed by Tim Horton.

        * Modules/applepay/ApplePaySession.cpp:
        (WebCore::createShippingMethods):
        Bail if createShippingMethod returns Nullopt.

        (WebCore::createPaymentRequest):
        Bail if createShippingMethods returns Nullopt.

2016-06-22  Anders Carlsson  <andersca@apple.com>

        Exception is not thrown when shipping method is an invalid amount
        https://bugs.webkit.org/show_bug.cgi?id=159029
        rdar://problem/26700413

        Reviewed by Tim Horton.

        * Modules/applepay/PaymentRequest.h:
        Change ShippingMethod::amount to be a signed 64-bit integer.

        * Modules/applepay/PaymentRequestValidator.cpp:
        (WebCore::PaymentRequestValidator::validate):
        Call validateShippingMethods.

        (WebCore::PaymentRequestValidator::validateShippingMethods):
        Validate all the shipping methods.

        (WebCore::PaymentRequestValidator::validateShippingMethod):
        Check that the amount is >= 0.

        * Modules/applepay/PaymentRequestValidator.h:
        Add new members.

2016-06-22  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Add support for the negotiationneeded event in MediaEndpointPeerConnection
        https://bugs.webkit.org/show_bug.cgi?id=158985

        Reviewed by Eric Carlson.

        Implement MediaEndpointPeerConnection's isNegotiationNeeded, markAsNeedingNegotiation and
        clearNegotiationNeededState functions. The calls to these functions are already up-to-date.

        Test: fast/mediastream/RTCPeerConnection-more-media-to-negotiate.html

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::markAsNeedingNegotiation):
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::scheduleNegotiationNeededEvent):

2016-06-22  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Replace RTCPeerConnection custom constructor with a JS built-in constructor
        https://bugs.webkit.org/show_bug.cgi?id=158832

        Reviewed by Eric Carlson and Youenn Fablet.

        Use a JS built-in constructor instead of a custom constructor. This makes it easier to
        initialize private fields for functions implemented as JS built-ins. The constructor
        behavior is in need of updating, but that is left to a follow-up change [1].

        [1] http://webkit.org/b/158936
        No change in behavior.

        * CMakeLists.txt:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::create):
        (WebCore::RTCPeerConnection::RTCPeerConnection):
        (WebCore::RTCPeerConnection::~RTCPeerConnection):
        (WebCore::RTCPeerConnection::initializeWith):
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/mediastream/RTCPeerConnection.js:
        (initializeRTCPeerConnection):
        Add JS built-in constructor function.
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSRTCPeerConnectionCustom.cpp: Removed.
        (WebCore::constructJSRTCPeerConnection): Deleted.

2016-06-22  Youenn Fablet  <youenn@apple.com>

        CrossOriginPreflightChecker should call DocumentThreadableLoader preflightFailure instead of didFailLoading
        https://bugs.webkit.org/show_bug.cgi?id=158984

        Reviewed by Darin Adler.

        No change of behavior.

        Calling DocumentThreadableLoader preflightFailure instead of didFailLoading for any preflight error case.

        * loader/CrossOriginPreflightChecker.cpp:
        (WebCore::CrossOriginPreflightChecker::notifyFinished): Directly calling preflightFailure callback.
        (WebCore::CrossOriginPreflightChecker::doPreflight): Ditto.
        (WebCore::CrossOriginPreflightChecker::handleLoadingFailure): Deleted.
        (WebCore::CrossOriginPreflightChecker::redirectReceived): Deleted (should have been removed as part of
        https://bugs.webkit.org/show_bug.cgi?id=111008).
        * loader/CrossOriginPreflightChecker.h:

2016-06-22  Youenn Fablet  <youennf@gmail.com>

        JSDOMIterator forEach should support second optional parameter
        https://bugs.webkit.org/show_bug.cgi?id=159020

        Reviewed by Chris Dumez.

        Covered by beefed up test.

        * bindings/js/JSDOMIterator.h:
        (WebCore::iteratorForEach): Setting callback thisValue to the second argument passed to forEach.

2016-06-22  Jer Noble  <jer.noble@apple.com>

        Media controls stop working after exiting PiP
        https://bugs.webkit.org/show_bug.cgi?id=159026
        <rdar://problem/26753579>

        Reviewed by Eric Carlson.

        Do not slave setting WebVideoFullscreenModelVideoElement::setVideoElement() to
        WebPlaybackSessionModelVideoElement::setMediaElement(). After all, someone else
        (i.e., the media controls) may still be using it.

        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
        (WebVideoFullscreenModelVideoElement::setVideoElement): Deleted.
        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        (WebVideoFullscreenControllerContext::didCleanupFullscreen):
        (WebVideoFullscreenControllerContext::setUpFullscreen):

2016-06-22  Jer Noble  <jer.noble@apple.com>

        Update document's isPlayingMedia() state whenever media element's media state changes
        https://bugs.webkit.org/show_bug.cgi?id=159018
        <rdar://problem/26586630>

        Reviewed by Beth Dakin.

        The Document can end up with a stale m_mediaState if its own value isn't updated when
        its constituent HTMLMediaElement's m_mediaStates change.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::updateMediaState):

2016-06-22  Simon Fraser  <simon.fraser@apple.com>

        Crash under GraphicsLayerCA::recursiveCommitChanges() with deep layer trees
        https://bugs.webkit.org/show_bug.cgi?id=159023
        rdar://problem/25377842

        Reviewed by Tim Horton.

        Having an on-stack DisplayList::Recorder increased the stack frame size significantly,
        causing stack exhaustion with deep layer trees, despite the existing depth check.

        Make the Recorder heap-allocated to fix this.

        Tested by LayoutTests/compositing//layer-creation/deep-tree.html.

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::recursiveCommitChanges):

2016-06-22  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Add support for variadic parameters to GObject DOM bindings
        https://bugs.webkit.org/show_bug.cgi?id=158942

        Reviewed by Michael Catanzaro.

        Generate code for functions having variadic parameters.

        * bindings/scripts/CodeGeneratorGObject.pm:
        (GenerateFunction):
        (SkipFunction):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_variadic_string_method):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:

2016-06-21  Benjamin Poulain  <bpoulain@apple.com>

        :hover CSS pseudo-class sometimes keeps matching ever after mouse has left the element
        https://bugs.webkit.org/show_bug.cgi?id=158340

        Reviewed by Simon Fraser.

        When removing a hovered subtree from the document, we were getting
        into an inconsistent state where m_hoveredElement is in the detached
        subtree and we have no way of clearing the existing IsHovered flags.

        What happens is:
        -The root "a" has an child "b" that is hovered.
        -"a" starts being removed from the tree, its renderer is destroyed.
        -RenderTreeUpdater::tearDownRenderers() pushes "a" on the teardownStack
         and calls hoveredElementDidDetach().
        -hoveredElementDidDetach() is called with "a". "a" is not the hovered
         element, the function does nothing.
        -RenderTreeUpdater::tearDownRenderers() pushes "b" on the teardownStack
         and calls hoveredElementDidDetach().
        -hoveredElementDidDetach() is called with "b". The next parent with a renderer
         is "a", m_hoveredElement is set to "a".
        -"a"'s parent is set to nullptr.

        -> We have a m_hoveredElement on the root of a detached tree, making
           it impossible to clear the real dirty tree.

        This patch changes the order in which we clear the flags.
        It is done in the order in which we clear the renderers to ensure
        the last element with a dead renderer is the last to update m_hoveredElement.

        Tests: fast/css/ancestor-of-hovered-element-detached.html
               fast/css/ancestor-of-hovered-element-removed.html

        * Source/WebCore/style/RenderTreeUpdater.cpp:

2016-06-21  Youenn Fablet  <youennf@gmail.com>

        [Fetch API] Rename 'origin-only' referrer policy to 'origin'
        https://bugs.webkit.org/show_bug.cgi?id=158982

        Reviewed by Alex Christensen.

        Covered by updated tests.

        * Modules/fetch/FetchRequest.cpp:
        (WebCore::setReferrerPolicy): Renaming origin-only to origin.
        * Modules/fetch/FetchRequest.idl: Ditto.
        * loader/FetchOptions.h: Ditto.

2016-06-21  Chris Dumez  <cdumez@apple.com>

        Let the compiler generate the move constructor and assignment operator for ScriptExecutionContext::Task
        https://bugs.webkit.org/show_bug.cgi?id=159013

        Reviewed by Brady Eidson.

        Let the compiler generate the move constructor and assignment operator for
        ScriptExecutionContext::Task. We previously manually defined the move
        constructor but there is no need as it doesn't do anything special.

        * dom/ScriptExecutionContext.h:

2016-06-21  Dean Jackson  <dino@apple.com>

        DumpRenderTree crashed in com.apple.WebCore: WebCore::HTMLSelectElement::updateSelectedState
        https://bugs.webkit.org/show_bug.cgi?id=159009
        <rdar://problem/23454623>

        Reviewed by Jon Lee.

        It seems we can get bogus indices from UIKit's implementation
        of UIWebSelectMultiplePicker. Guard against this situation.

        Covered by running the existing tests in WebKit1 with Guard Malloc,
        such as fast/spatial-navigation/snav-multiple-select-optgroup.html

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::updateSelectedState): Early return
        if we get an index out of range.

2016-06-21  Chris Dumez  <cdumez@apple.com>

        Pass ScriptExecutionContext::Task as rvalue reference
        https://bugs.webkit.org/show_bug.cgi?id=159007

        Reviewed by Anders Carlsson.

        Pass ScriptExecutionContext::Task as rvalue reference since its non-copyable
        and has to be moved in.

        * workers/WorkerLoaderProxy.h:
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::postTaskToLoader):
        (WebCore::WorkerMessagingProxy::postTaskForModeToWorkerGlobalScope):
        * workers/WorkerMessagingProxy.h:
        * workers/WorkerRunLoop.cpp:
        (WebCore::WorkerRunLoop::postTask):
        (WebCore::WorkerRunLoop::postTaskAndTerminate):
        (WebCore::WorkerRunLoop::postTaskForMode):
        (WebCore::WorkerRunLoop::Task::Task):
        * workers/WorkerRunLoop.h:

2016-06-21  Anders Carlsson  <andersca@apple.com>

        Include IdentifierInlines.h.

        * bindings/js/JSApplePayShippingMethodSelectedEventCustom.cpp:

2016-06-21  Anders Carlsson  <andersca@apple.com>

        Add PaymentHeaders.h file.

        * Modules/applepay/PaymentHeaders.h: Added.
        * WebCore.xcodeproj/project.pbxproj:

2016-06-21  Anders Carlsson  <andersca@apple.com>

        Make a bunch of Apple Pay headers private instead of project.

        * WebCore.xcodeproj/project.pbxproj:

2016-06-21  Anders Carlsson  <andersca@apple.com>

        Move the last Apple Pay WebCore files to the open source repository
        https://bugs.webkit.org/show_bug.cgi?id=159005

        Reviewed by Tim Horton.

        * DerivedSources.make:
        * Modules/applepay/ApplePayPaymentAuthorizedEvent.cpp: Added.
        * Modules/applepay/ApplePayPaymentAuthorizedEvent.h: Added.
        * Modules/applepay/ApplePayPaymentAuthorizedEvent.idl: Added.
        * Modules/applepay/ApplePayPaymentMethodSelectedEvent.cpp: Added.
        * Modules/applepay/ApplePayPaymentMethodSelectedEvent.h: Added.
        * Modules/applepay/ApplePayPaymentMethodSelectedEvent.idl: Added.
        * Modules/applepay/ApplePaySession.cpp: Added.
        * Modules/applepay/ApplePaySession.h: Added.
        * Modules/applepay/ApplePaySession.idl: Added.
        * Modules/applepay/ApplePayShippingContactSelectedEvent.cpp: Added.
        * Modules/applepay/ApplePayShippingContactSelectedEvent.h: Added.
        * Modules/applepay/ApplePayShippingContactSelectedEvent.idl: Added.
        * Modules/applepay/ApplePayShippingMethodSelectedEvent.cpp: Added.
        * Modules/applepay/ApplePayShippingMethodSelectedEvent.h: Added.
        * Modules/applepay/ApplePayShippingMethodSelectedEvent.idl: Added.
        * Modules/applepay/ApplePayValidateMerchantEvent.cpp: Added.
        * Modules/applepay/ApplePayValidateMerchantEvent.h: Added.
        * Modules/applepay/ApplePayValidateMerchantEvent.idl: Added.
        * Modules/applepay/Payment.h: Added.
        * Modules/applepay/PaymentAuthorizationStatus.h: Added.
        * Modules/applepay/PaymentContact.h: Added.
        * Modules/applepay/PaymentMerchantSession.h: Added.
        * Modules/applepay/PaymentMethod.h: Added.
        * Modules/applepay/PaymentRequestValidator.cpp: Added.
        * Modules/applepay/PaymentRequestValidator.h: Added.
        * Modules/applepay/cocoa/PaymentContactCocoa.mm: Added.
        * Modules/applepay/cocoa/PaymentMethodCocoa.mm: Added.
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSApplePayPaymentAuthorizedEventCustom.cpp: Added.
        * bindings/js/JSApplePayPaymentMethodSelectedEventCustom.cpp: Added.
        * bindings/js/JSApplePaySessionCustom.cpp: Added.
        * bindings/js/JSApplePayShippingContactSelectedEventCustom.cpp: Added.
        * bindings/js/JSApplePayShippingMethodSelectedEventCustom.cpp: Added.
        * dom/EventNames.in:
        * dom/EventTargetFactory.in:

2016-06-21  Anders Carlsson  <andersca@apple.com>

        Fix build.

        * Configurations/FeatureDefines.xcconfig:

2016-06-21  Jiewen Tan  <jiewen_tan@apple.com>

        Unreviewed, rolling out r202302, r202303, r202305, and
        r202306.

        Roll out the rollouts because of breaking the build.

        Reverted changesets:

        "Unreviewed, rolling out r200678."
        https://bugs.webkit.org/show_bug.cgi?id=157453
        http://trac.webkit.org/changeset/202302

        "Unreviewed, rolling out r200619."
        https://bugs.webkit.org/show_bug.cgi?id=131443
        http://trac.webkit.org/changeset/202303

        "Unreviewed, attempt to fix the build after r202303."
        http://trac.webkit.org/changeset/202305

        "Unreviewed, attempt to fix the build after r202303."
        http://trac.webkit.org/changeset/202306

2016-06-21  Chris Dumez  <cdumez@apple.com>

        Unreviewed, attempt to fix the build after r202303.

        * bindings/js/JSDOMIterator.h:
        (WebCore::IteratorInspector::decltype):
        (WebCore::IteratorInspector::test):

2016-06-21  Chris Dumez  <cdumez@apple.com>

        Unreviewed, attempt to fix the build after r202303.

        * bindings/js/JSDOMIterator.h:
        (WebCore::toJS):

2016-06-21  Jiewen Tan  <jiewen_tan@apple.com>

        Unreviewed, rolling out r200619.

        This incompleted feature broke http://m.yahoo.co.jp. Roll it
        out together with r200678.

        Reverted changeset:

        "NodeList should be iterable"
        https://bugs.webkit.org/show_bug.cgi?id=131443
        http://trac.webkit.org/changeset/200619

2016-06-21  Jiewen Tan  <jiewen_tan@apple.com>

        Unreviewed, rolling out r200678.

        This incompleted feature broke http://m.yahoo.co.jp. Roll it
        out together with r200619.

        Reverted changeset:

        "Ensure DOM iterators remain done"
        https://bugs.webkit.org/show_bug.cgi?id=157453
        http://trac.webkit.org/changeset/200678

2016-06-21  Anders Carlsson  <andersca@apple.com>

        Begin moving the Apple Pay code to the open source repository
        https://bugs.webkit.org/show_bug.cgi?id=158998

        Reviewed by Tim Horton.

        * Configurations/FeatureDefines.xcconfig:
        Add ENABLE_APPLE_PAY.

        * Modules/applepay/PaymentCoordinator.cpp: Added.
        * Modules/applepay/PaymentCoordinator.h: Added.
        * Modules/applepay/PaymentCoordinatorClient.h: Added.
        * Modules/applepay/PaymentRequest.cpp: Added.
        * Modules/applepay/PaymentRequest.h: Added.
        * Modules/applepay/cocoa/PaymentCocoa.mm: Added.
        * WebCore.xcodeproj/project.pbxproj:
        Add new files.

        * dom/EventNames.h:
        Add new event names.

        * page/MainFrame.h:
        Use a forward declaration.

2016-06-21  Said Abou-Hallawa  <sabouhallawa@apple,com>

        Add system tracing points for requestAnimationFrame() workflow
        https://bugs.webkit.org/show_bug.cgi?id=158723

        Reviewed by Simon Fraser.

        Add trace points for requestAnimationFrame().

        * dom/ScriptedAnimationController.cpp:
        (WebCore::ScriptedAnimationController::requestAnimationFrameEnabled):
        (WebCore::ScriptedAnimationController::serviceScriptedAnimations):
        (WebCore::ScriptedAnimationController::windowScreenDidChange):
        (WebCore::ScriptedAnimationController::scheduleAnimation):
        * dom/ScriptedAnimationController.h:
        * platform/graphics/ios/DisplayRefreshMonitorIOS.mm:
        (WebCore::DisplayRefreshMonitorIOS::requestRefreshCallback):
        (WebCore::DisplayRefreshMonitorIOS::displayLinkFired):

2016-06-20  Simon Fraser  <simon.fraser@apple.com>

        [iOS] Typing text into a text field or text area causes screen to scroll down (hiding text entry)
        https://bugs.webkit.org/show_bug.cgi?id=158970

        Reviewed by Ryosuke Niwa.

        insertTextWithoutSendingTextEvent() should only reveal the selection up to the main frame on iOS,
        since the UI process can zoom and scroll the view to the text input.

        Test: fast/forms/ios/typing-in-input-in-iframe.html

        * editing/Editor.cpp:
        (WebCore::Editor::insertTextWithoutSendingTextEvent):

2016-06-21  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Remove unused MediaEndpointClient::gotRemoteSource function
        https://bugs.webkit.org/show_bug.cgi?id=158986

        Reviewed by Eric Carlson.

        Remote sources are explicitly created with MediaEndpoint::createMutedRemoteSource so the
        MediaEndpointClient::gotRemoteSource can be removed.

        No change in behavior.

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::gotRemoteSource): Deleted.
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * platform/mediastream/MediaEndpoint.h:

2016-06-20  Simon Fraser  <simon.fraser@apple.com>

        Focus event dispatched in iframe causes parent document to scroll incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=158629
        rdar://problem/26521616

        Reviewed by Tim Horton.

        When focussing elements in iframes, the page could scroll to an incorrect location.
        This happened because code in Element::focus() tried to disable scrolling on focus,
        but did so only for the current frame, so ancestor frames got programmatically scrolled.
        On iOS we handle the scrolling in the UI process, so never want the web process to
        do programmatic scrolling.

        Fix by changing the focus and cache restore code to use SelectionRevealMode::DoNotReveal,
        rather than manually prohibiting frame scrolling. Pass SelectionRevealMode through various callers,
        and use RevealUpToMainFrame for iOS, allowing the UI process to do the zoomToRect: for the main frame.

        Tests: fast/forms/ios/focus-input-in-iframe.html
               fast/forms/ios/programmatic-focus-input-in-iframe.html

        * dom/Document.h:
        * dom/Element.cpp:
        (WebCore::Element::scrollIntoView):
        (WebCore::Element::scrollIntoViewIfNeeded):
        (WebCore::Element::scrollIntoViewIfNotVisible):
        (WebCore::Element::focus):
        (WebCore::Element::updateFocusAppearance):
        * dom/Element.h:
        * editing/Editor.cpp:
        (WebCore::Editor::insertTextWithoutSendingTextEvent):
        (WebCore::Editor::revealSelectionAfterEditingOperation):
        (WebCore::Editor::findStringAndScrollToVisible):
        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::updateAndRevealSelection):
        (WebCore::FrameSelection::revealSelection):
        (WebCore::FrameSelection::FrameSelection): Deleted.
        * editing/FrameSelection.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::updateFocusAppearance):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::updateFocusAppearance):
        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::contextMenuItemSelected):
        * page/FrameView.cpp:
        (WebCore::FrameView::scrollToAnchor):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollRectToVisible):
        (WebCore::RenderLayer::autoscroll):
        * rendering/RenderLayer.h:
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::scrollRectToVisible):
        * rendering/RenderObject.h:

2016-06-21  Frederic Wang  <fwang@igalia.com>

        Implement RenderMathMLOperator::layoutBlock
        https://bugs.webkit.org/show_bug.cgi?id=157521

        Reviewed by Brent Fulgham.

        No new tests, already covered by existing tests.

        Add an initial implementation of RenderMathMLOperator::layoutBlock, which will perform
        special layout when the MathOperator is used. We also improved how the logical height is
        calculated and avoid updating the style when stretchTo is called.

        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::stretchTo):
        (WebCore::RenderMathMLOperator::layoutBlock):
        (WebCore::RenderMathMLOperator::computeLogicalHeight): Deleted.
        * rendering/mathml/RenderMathMLOperator.h:

2016-06-21  Chris Dumez  <cdumez@apple.com>

        Unreviewed, roll out r202268 as it looks like it was a ~50% regression on Dromaeo DOM Core

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        (GeneratePrototypeDeclaration):
        * bindings/scripts/test/JS/JSInterfaceName.cpp:
        (WebCore::JSInterfaceNamePrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::JSTestActiveDOMObjectPrototype::finishCreation):
        (WebCore::JSTestActiveDOMObject::createPrototype): Deleted.
        (WebCore::JSTestActiveDOMObject::prototype): Deleted.
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::JSTestClassWithJSBuiltinConstructorPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::JSTestCustomNamedGetterPrototype::finishCreation):
        (WebCore::JSTestCustomNamedGetter::JSTestCustomNamedGetter): Deleted.
        (WebCore::JSTestCustomNamedGetter::createPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructorPrototype::finishCreation):
        (WebCore::JSTestEventConstructor::createPrototype): Deleted.
        (WebCore::JSTestEventConstructor::prototype): Deleted.
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::JSTestEventTargetPrototype::finishCreation):
        (WebCore::JSTestEventTarget::JSTestEventTarget): Deleted.
        (WebCore::JSTestEventTarget::createPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::JSTestExceptionPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::JSTestGenerateIsReachablePrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterfacePrototype::finishCreation):
        (WebCore::jsTestInterfaceImplementsStr2): Deleted.
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        (WebCore::JSTestJSBuiltinConstructorPrototype::finishCreation):
        (WebCore::JSTestJSBuiltinConstructor::JSTestJSBuiltinConstructor): Deleted.
        (WebCore::JSTestJSBuiltinConstructor::createPrototype): Deleted.
        (WebCore::JSTestJSBuiltinConstructor::destroy): Deleted.
        (WebCore::jsTestJSBuiltinConstructorTestAttributeCustom): Deleted.
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::JSTestMediaQueryListListenerPrototype::finishCreation):
        (WebCore::JSTestMediaQueryListListener::JSTestMediaQueryListListener): Deleted.
        (WebCore::JSTestMediaQueryListListener::createPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::JSTestNamedConstructorPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::JSTestNodePrototype::finishCreation):
        (WebCore::JSTestNode::JSTestNode): Deleted.
        (WebCore::JSTestNode::prototype): Deleted.
        (WebCore::jsTestNodeName): Deleted.
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::JSTestNondeterministicPrototype::finishCreation):
        (WebCore::JSTestNondeterministic::JSTestNondeterministic): Deleted.
        (WebCore::JSTestNondeterministic::prototype): Deleted.
        (WebCore::JSTestNondeterministic::destroy): Deleted.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjPrototype::finishCreation):
        (WebCore::JSTestObj::JSTestObj): Deleted.
        (WebCore::JSTestObj::createPrototype): Deleted.
        (WebCore::JSTestObj::prototype): Deleted.
        (WebCore::JSTestObj::destroy): Deleted.
        (WebCore::JSTestObj::getOwnPropertySlot): Deleted.
        (WebCore::JSTestObj::getOwnPropertySlotByIndex): Deleted.
        (WebCore::jsTestObjReadOnlyLongAttr): Deleted.
        (WebCore::jsTestObjReadOnlyStringAttr): Deleted.
        (WebCore::jsTestObjReadOnlyTestObjAttr): Deleted.
        (WebCore::jsTestObjConstructorStaticReadOnlyLongAttr): Deleted.
        (WebCore::jsTestObjConstructorStaticStringAttr): Deleted.
        (WebCore::jsTestObjConstructorTestSubObj): Deleted.
        (WebCore::jsTestObjTestSubObjEnabledBySettingConstructor): Deleted.
        (WebCore::jsTestObjEnumAttr): Deleted.
        (WebCore::jsTestObjByteAttr): Deleted.
        (WebCore::jsTestObjOctetAttr): Deleted.
        (WebCore::jsTestObjShortAttr): Deleted.
        (WebCore::jsTestObjClampedShortAttr): Deleted.
        (WebCore::jsTestObjEnforceRangeShortAttr): Deleted.
        (WebCore::jsTestObjUnsignedShortAttr): Deleted.
        (WebCore::jsTestObjLongAttr): Deleted.
        (WebCore::jsTestObjLongLongAttr): Deleted.
        (WebCore::jsTestObjReflectedCustomBooleanAttr): Deleted.
        (WebCore::jsTestObjReflectedCustomURLAttr): Deleted.
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::JSTestOverloadedConstructorsPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::JSTestOverrideBuiltinsPrototype::finishCreation):
        (WebCore::JSTestOverrideBuiltins::JSTestOverrideBuiltins): Deleted.
        (WebCore::JSTestOverrideBuiltins::createPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::JSTestSerializedScriptValueInterfacePrototype::finishCreation):
        (WebCore::JSTestSerializedScriptValueInterface::JSTestSerializedScriptValueInterface): Deleted.
        (WebCore::JSTestSerializedScriptValueInterface::prototype): Deleted.
        (WebCore::JSTestSerializedScriptValueInterface::destroy): Deleted.
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::JSTestTypedefsPrototype::finishCreation):
        (WebCore::JSTestTypedefs::JSTestTypedefs): Deleted.
        (WebCore::JSTestTypedefs::createPrototype): Deleted.
        (WebCore::JSTestTypedefs::prototype): Deleted.
        (WebCore::JSTestTypedefs::destroy): Deleted.
        (WebCore::jsTestTypedefsUnsignedLongLongAttr): Deleted.
        (WebCore::jsTestTypedefsImmutableSerializedScriptValue): Deleted.
        (WebCore::jsTestTypedefsAttrWithGetterException): Deleted.
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::JSattributePrototype::finishCreation):
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::JSreadonlyPrototype::finishCreation):

2016-06-21  Keith Miller  <keith_miller@apple.com>

        It should be easy to add a private global helper function for builtins
        https://bugs.webkit.org/show_bug.cgi?id=158893

        Reviewed by Mark Lam.

        Add JSCJSValueInlines.h to fix build issues.

        * platform/mock/mediasource/MockBox.cpp:

2016-06-21  Amir Alavi  <aalavi@apple.com>

        Upstream WKHTTPCookiesForURL from WebKitSystemInterface to OpenSource
        https://bugs.webkit.org/show_bug.cgi?id=158967

        Reviewed by Brent Fulgham.

        * platform/ios/WebCoreSystemInterfaceIOS.mm:
        * platform/mac/WebCoreSystemInterface.h:
        * platform/mac/WebCoreSystemInterface.mm:
        * platform/network/mac/CookieJarMac.mm:
        (WebCore::httpCookiesForURL): Upstreamed from WebKitSystemInterface.
        (WebCore::cookiesForURL): Changed to call httpCookiesForURL.
        (WebCore::deleteCookie): Ditto.
        * platform/spi/cf/CFNetworkSPI.h:

2016-06-21  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r202231.

        Seems to have regressed PLT on both iOS and Mac (very obvious
        on iOS Warm PLT)

        Reverted changeset:

        "When navigating, discard decoded image data that is only live
        due to page cache."
        https://bugs.webkit.org/show_bug.cgi?id=158941
        http://trac.webkit.org/changeset/202231

2016-06-21  Youenn Fablet  <youennf@gmail.com>

        Add bindings generator support to add a native JS function to both a 'name' and a private '@name' slot
        https://bugs.webkit.org/show_bug.cgi?id=158777

        Reviewed by Eric Carlson.

        Adding a new PublicIdentifier keyword to cover the case of the same function exposed publicly and privately.
        Renaming Private keyword to PrivateIdentifier.
        Functions exposed both publicly and privately should set both keywords.
        By default, functions are publically exposed.

        Updated binding generator to generate public exposure except if PrivateIdentifer is set and PublicIdentifier is
        not set.

        Keeping skipping of ObjC/GObject binding for PrivateIdentifier-only functions.

        Covered by rebased binding tests.

        * Modules/fetch/FetchHeaders.idl:
        * Modules/fetch/FetchResponse.idl:
        * Modules/mediastream/MediaDevices.idl:
        * Modules/mediastream/RTCPeerConnection.idl:
        * bindings/scripts/CodeGeneratorGObject.pm:
        (SkipFunction):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GeneratePropertiesHashTable):
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorObjC.pm:
        (SkipFunction):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_private_also_method):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjPrototype::finishCreation):
        (WebCore::jsTestObjPrototypeFunctionPrivateMethod):
        (WebCore::jsTestObjPrototypeFunctionPrivateAlsoMethod):
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj privateAlsoMethod:]):
        * bindings/scripts/test/TestObj.idl:

2016-06-21  Dan Bernstein  <mitz@apple.com>

        Inlined some picture-in-picture code.
        https://bugs.webkit.org/show_bug.cgi?id=158977

        Reviewed by Eric Carlsson.

        This code was written primarily by Ada Chan, and originally reviewed by Alex Christensen,
        Anders Carlsson, Conrad Shultz, Dan Bernstein, Eric Carlson, Jer Noble, Jeremy Jones,
        Jon Lee, Remy Demarest, and Zach Li.

        * English.lproj/Localizable.strings:
          Updated using update-webkit-localizable-strings.

        * Modules/mediacontrols/mediaControlsApple.css:
        (video:-webkit-full-screen::-webkit-media-controls-panel .picture-in-picture-button):

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.configureFullScreenControls):

        * WebCore.xcodeproj/project.pbxproj: Added PIPSPI.h.

        * html/HTMLMediaElement.cpp: Inlined code from HTMLMediaElementAdditions.cpp.

        * html/HTMLVideoElement.cpp: Inlined code from HTMLVideoElementSupportsFullscreenAdditions.cpp.

        * platform/LocalizedStrings.cpp:
        (WebCore::contextMenuItemTagEnterVideoEnhancedFullscreen): Brought in from ContextMenuLocalizedStringsAdditions.cpp.
        (WebCore::contextMenuItemTagExitVideoEnhancedFullscreen): Ditto.
        (WebCore::AXARIAContentGroupText): Made updates that should have been part of r198543.

        * platform/mac/WebVideoFullscreenInterfaceMac.h: Removed USE(APPLE_INTERNAL_SDK) guards.
        * platform/mac/WebVideoFullscreenInterfaceMac.mm: Inlined WebVideoFullscreenInterfaceMacAdditions.mm.

        * platform/spi/mac/PIPSPI.h: Added.

        * rendering/HitTestResult.cpp: Inlined HitTestResultAdditions.cpp.

        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::mediaControlsStyleSheet): Removed include of
          RenderThemeMacMediaControlsStyleSheetAdditions.mm now that the content is in
          mediaControlsApple.css.
        (WebCore::RenderThemeMac::mediaControlsScript): Removed include of
          RenderThemeMacMediaControlsScriptAdditions.mm now that the content is in mediaControlsApple.js.

2016-06-21  Miguel Gomez  <magomez@igalia.com>

        [GStreamer] video orientation support
        https://bugs.webkit.org/show_bug.cgi?id=148524

        Reviewed by Philippe Normand.

        Rotate video frames to follow the orientation metadata in the video file.
        When accelerated compositing is disabled, the rotation is performed by a videoflip element added
        to the playbin.
        When accelerated compositing is enabled, the rotation is peformed by the TextureMapper in response
        to a rotation flag set on the frame buffers.

        Test: media/video-orientation.html

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::handleMessage):
        Handle the GST_MESSAGE_TAG message from the bin.
        (WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):
        Add the videflip element to the bin when accelerated compositing is disabled.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::GstVideoFrameHolder::GstVideoFrameHolder):
        Receive and use extra flags for the TextureMapper.
        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
        (WebCore::MediaPlayerPrivateGStreamerBase::naturalSize):
        When using accelerated compositing, transpose the video size if the rotation is 90 or 270 degrees.
        (WebCore::MediaPlayerPrivateGStreamerBase::pushTextureToCompositor):
        Add rotation flag to frame holder and layer buffer.
        (WebCore::MediaPlayerPrivateGStreamerBase::paintToTextureMapper):
        Use rotation flag when requesting the TextureMapper to draw.
        (WebCore::MediaPlayerPrivateGStreamerBase::setVideoSourceRotation):
        Function to store the video rotation.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
        Add bits to store the video rotation.
        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::drawTexturedQuadWithProgram):
        Modify the patternTransform according to the rotation flag passed.
        * platform/graphics/texmap/TextureMapperGL.h:
        Add new flags to handle the video souce rotation.
        * platform/graphics/texmap/TextureMapperPlatformLayerBuffer.cpp:
        (WebCore::TextureMapperPlatformLayerBuffer::paintToTextureMapper):
        Change the drawTexture method used so custom flags can be passed.
        * platform/graphics/texmap/TextureMapperPlatformLayerBuffer.h:
        (WebCore::TextureMapperPlatformLayerBuffer::setExtraFlags):
        New method to set TextureMapper flags.

2016-06-20  Frederic Wang  <fwang@igalia.com>

        Use the MathOperator to handle some non-stretchy operators
        https://bugs.webkit.org/show_bug.cgi?id=157519

        Reviewed by Brent Fulgham.

        To prepare for the removal of anonymous text node from the render classes of token elements
        we use MathOperator to handle two cases where the actual text to display may not be
        available in the DOM: mfenced and minus operators. This change removes support for the
        case of mfenced operators with multiple characters since that it is not supported by
        MathOperator. It is a edge case that is not used in practice since fences and separators are
        only made of a single character. However, it would still be possible to duplicate some
        code/logic to add it back if that turns out to be necessary.

        No new tests, already covered by existing tests.

        * rendering/mathml/MathOperator.cpp:
        (WebCore::MathOperator::MathOperator): Rename UndefinedOperator.
        (WebCore::RenderMathMLOperator::firstLineBaseline): Improve rounding of ascent so that mfenced operators are correctly aligned.
        * rendering/mathml/MathOperator.h: Rename UndefinedOperator, since it can now be used to draw non-stretchy operators.
        (WebCore::MathOperator::isStretched): Deleted. This function is no longer used by RenderMathMLOperator.
        (WebCore::MathOperator::unstretch): Deleted. This function is no longer used by RenderMathMLOperator.
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): Use useMathOperator.
        (WebCore::RenderMathMLOperator::rebuildTokenContent): Set the MathOperator when useMathOperator() is true.
        When the operator is not likely to stretch we just leave its type as NormalOperator.
        (WebCore::RenderMathMLOperator::useMathOperator): Helper function to determine when MathOperator should be used.
        (WebCore::RenderMathMLOperator::firstLineBaseline): Use useMathOperator.
        (WebCore::RenderMathMLOperator::computeLogicalHeight): Ditto.
        (WebCore::RenderMathMLOperator::paint): Ditto.
        (WebCore::RenderMathMLOperator::paintChildren): Ditto.
        * rendering/mathml/RenderMathMLOperator.h: Declare useMathOperator.

2016-06-19  Gavin & Ellie Barraclough  <barraclough@apple.com>

        Don't eagerly reify DOM Prototype properties
        https://bugs.webkit.org/show_bug.cgi?id=158557

        Reviewed by Andreas Kling.

        We were eagerly reifying these properties to avoid virtualizing getOwnPropertySlot,
        but since bug #158059 this does not require a method table call in any case.
        Eagerly reifying these values likely has some CPU and memory cost on page load.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
            - should generate compressed index for hashtable,
              prototype object ClassInfo should contain static table,
              don't reifyStaticProperties for prototype objects.
        (GeneratePrototypeDeclaration):
            - Set HasStaticPropertyTable for DOM prototype objects.
        * bindings/scripts/test/JS/JSInterfaceName.cpp:
        (WebCore::JSInterfaceNamePrototype::JSInterfaceNamePrototype):
        (WebCore::JSInterfaceNamePrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::JSTestActiveDOMObjectPrototype::JSTestActiveDOMObjectPrototype):
        (WebCore::JSTestActiveDOMObjectPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::JSTestClassWithJSBuiltinConstructorPrototype::JSTestClassWithJSBuiltinConstructorPrototype):
        (WebCore::JSTestClassWithJSBuiltinConstructorPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectPrototype::JSTestCustomConstructorWithNoInterfaceObjectPrototype):
        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::JSTestCustomNamedGetterPrototype::JSTestCustomNamedGetterPrototype):
        (WebCore::JSTestCustomNamedGetterPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructorPrototype::JSTestEventConstructorPrototype):
        (WebCore::JSTestEventConstructorPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::JSTestEventTargetPrototype::JSTestEventTargetPrototype):
        (WebCore::JSTestEventTargetPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::JSTestExceptionPrototype::JSTestExceptionPrototype):
        (WebCore::JSTestExceptionPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::JSTestGenerateIsReachablePrototype::JSTestGenerateIsReachablePrototype):
        (WebCore::JSTestGenerateIsReachablePrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterfacePrototype::JSTestInterfacePrototype):
        (WebCore::JSTestInterfacePrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        (WebCore::JSTestJSBuiltinConstructorPrototype::JSTestJSBuiltinConstructorPrototype):
        (WebCore::JSTestJSBuiltinConstructorPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::JSTestMediaQueryListListenerPrototype::JSTestMediaQueryListListenerPrototype):
        (WebCore::JSTestMediaQueryListListenerPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::JSTestNamedConstructorPrototype::JSTestNamedConstructorPrototype):
        (WebCore::JSTestNamedConstructorPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::JSTestNodePrototype::JSTestNodePrototype):
        (WebCore::JSTestNodePrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::JSTestNondeterministicPrototype::JSTestNondeterministicPrototype):
        (WebCore::JSTestNondeterministicPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjPrototype::JSTestObjPrototype):
        (WebCore::JSTestObjPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::JSTestOverloadedConstructorsPrototype::JSTestOverloadedConstructorsPrototype):
        (WebCore::JSTestOverloadedConstructorsPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::JSTestOverrideBuiltinsPrototype::JSTestOverrideBuiltinsPrototype):
        (WebCore::JSTestOverrideBuiltinsPrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::JSTestSerializedScriptValueInterfacePrototype::JSTestSerializedScriptValueInterfacePrototype):
        (WebCore::JSTestSerializedScriptValueInterfacePrototype::finishCreation):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::JSTestTypedefsPrototype::JSTestTypedefsPrototype):
        (WebCore::JSTestTypedefsPrototype::finishCreation):
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::JSattributePrototype::JSattributePrototype):
        (WebCore::JSattributePrototype::finishCreation):
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::JSreadonlyPrototype::JSreadonlyPrototype):
        (WebCore::JSreadonlyPrototype::finishCreation):

2016-06-20  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: RTCIceCandidate init dictionary don't handle explicit null or undefined values correctly
        https://bugs.webkit.org/show_bug.cgi?id=158873

        Reviewed by Alejandro G. Castro.

        Prevent explicit null and undefined values from being converted to "null" and "undefined"
        strings.

        Test: Extended fast/mediastream/RTCIceCandidate.html

        * Modules/mediastream/RTCIceCandidate.cpp:
        (WebCore::RTCIceCandidate::create):

2016-06-20  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202252.
        https://bugs.webkit.org/show_bug.cgi?id=158974

        See rdar://problem/26867866 for details (Requested by ap on
        #webkit).

        Reverted changeset:

        "Adopt commitPriority to get rid of the 2 AVPL solution for
        PiP"
        https://bugs.webkit.org/show_bug.cgi?id=158949
        http://trac.webkit.org/changeset/202252

2016-06-20  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202243.
        https://bugs.webkit.org/show_bug.cgi?id=158972

        Broke Windows build and iOS tests (Requested by ap on
        #webkit).

        Reverted changeset:

        "Focus event dispatched in iframe causes parent document to
        scroll incorrectly"
        https://bugs.webkit.org/show_bug.cgi?id=158629
        http://trac.webkit.org/changeset/202243

2016-06-20  Chris Dumez  <cdumez@apple.com>

        Simplify / Optimize DataDetector's searchForLinkRemovingExistingDDLinks()
        https://bugs.webkit.org/show_bug.cgi?id=158968

        Reviewed by Ryosuke Niwa.

        Simplify / Optimize DataDetector's searchForLinkRemovingExistingDDLinks():
        - Use modern ancestorsOfType<HTMLAnchorElement>() to traverse anchor ancestors
          instead of traversing by hand.
        - Use NodeTraversal::next() to traverse the tree until we find endNode and
          use a for loop instead of a while loop. Previously, the logic the determine
          the next node was at the end of the loop and was identical behavior-wise
          to NodeTraversal::next(). However, the previous code for a lot less efficient
          because it was calling Node::childNodes() to get a NodeList of the children,
          then calling length() on it to check if we had children and finally use
          the first item in the list as next node. This was very inefficient because
          NodeList::length() would need to traverse all children to figure out the
          length and would cache all the children in a Vector in CollectionIndexCache.

        * dom/ElementAncestorIterator.h:
        (WebCore::ancestorsOfType):
        * dom/ElementIterator.h:
        (WebCore::findElementAncestorOfType):
        (WebCore::findElementAncestorOfType<Element>):
        Update ancestorsOfType() to take a Node instead of an Element. There are no
        performance benefits to taking an Element here and it is a valid use case to
        want an Element ancestor of a non-Element node.

        * editing/cocoa/DataDetection.mm:
        (WebCore::searchForLinkRemovingExistingDDLinks):
        (WebCore::dataDetectorTypeForCategory): Deleted.

2016-06-20  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202248.
        https://bugs.webkit.org/show_bug.cgi?id=158960

        breaks builds on the simulator (Requested by keith_mi_ on
        #webkit).

        Reverted changeset:

        "It should be easy to add a private global helper function for
        builtins"
        https://bugs.webkit.org/show_bug.cgi?id=158893
        http://trac.webkit.org/changeset/202248

2016-06-20  Jeremy Jones  <jeremyj@apple.com>

        Adopt commitPriority to get rid of the 2 AVPL solution for PiP
        https://bugs.webkit.org/show_bug.cgi?id=158949
        rdar://problem/26867866

        Reviewed by Simon Fraser.

        No new tests because there is no behavior change. This reverts changes from 
        https://bugs.webkit.org/show_bug.cgi?id=158148 and instead uses -[CAContext commitPriority:]
        to prevent flicker when moving a layer between contexts. 
        commitPriority allows the layer to be added to the destination context before it is 
        removed from the source context.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h: remove m_secondaryVideoLayer.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm: ditto
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenGravity): ditto.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::syncTextTrackBounds): ditto.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer): ditto.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateVideoLayerGravity): ditto.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm: ditto
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::addDisplayLayer): ditto
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm: ditto
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::createPreviewLayers):ditto
        * platform/graphics/avfoundation/objc/VideoFullscreenLayerManager.h: ditto
        * platform/graphics/avfoundation/objc/VideoFullscreenLayerManager.mm: ditto
        (WebCore::VideoFullscreenLayerManager::setVideoLayer): ditto
        (WebCore::VideoFullscreenLayerManager::setVideoFullscreenLayer): ditto and adopt commitPriority.
        (WebCore::VideoFullscreenLayerManager::setVideoFullscreenFrame): ditto
        (WebCore::VideoFullscreenLayerManager::setVideoLayers): Deleted. 
        (WebCore::VideoFullscreenLayerManager::didDestroyVideoLayer): remove m_secondaryVideoLayer.
        * platform/spi/cocoa/QuartzCoreSPI.h: Add commitPriority.

2016-06-20  Zalan Bujtas  <zalan@apple.com>

        Set the end position on the placeholder BidiRun properly.
        https://bugs.webkit.org/show_bug.cgi?id=158958

        Reviewed by Myles C. Maxfield.
        rdar://problem/26609266

        The second paramenter for BidiRun indicates the end position and not the length of the run.
        This was regressed at r102875 where only the start position was changed from 0 to pos.

        Test: fast/text/international/bidi-style-in-isolate-crash.html

        * rendering/InlineIterator.h:
        (WebCore::addPlaceholderRunForIsolatedInline):

2016-06-20  Fujii Hironori  <Hironori.Fujii@sony.com>

        A composition underline is placed to wrong position in RTL
        https://bugs.webkit.org/show_bug.cgi?id=158602

        Reviewed by Myles C. Maxfield.

        InlineTextBox::paintCompositionUnderline does not take RTL into
        account.  The position of composition underline should be
        mirrored in RTL.

        Test: editing/input/composition-underline-rtl.html

        * rendering/InlineTextBox.cpp:
        (WebCore::mirrorRTLSegment): New helper function to convert RTL start position to LTR.
        (WebCore::InlineTextBox::paintDecoration): Use mirrorRTLSegment.
        (WebCore::InlineTextBox::paintCompositionUnderline): Ditto.

2016-06-20  Keith Miller  <keith_miller@apple.com>

        It should be easy to add a private global helper function for builtins
        https://bugs.webkit.org/show_bug.cgi?id=158893

        Reviewed by Mark Lam.

        Add JSCJSValueInlines.h to fix build issues.

        * platform/mock/mediasource/MockBox.cpp:

2016-06-20  Benjamin Poulain  <benjamin@webkit.org>

        :default CSS pseudo-class should match checkboxes+radios with a `checked` attribute
        https://bugs.webkit.org/show_bug.cgi?id=156230

        Reviewed by Alex Christensen.

        This patch update the :default pseudo class matching to be closer to the spec:
        https://html.spec.whatwg.org/multipage/scripting.html#selector-default

        The main remaining difference with the spec is the definition of "default button".
        This is an unrelated problem that should be addressed separately.

        The implementation was missing support for:
        -input elements of type "checkbox" or "radio" with the "checked" attribute defined.
        -option elements with the "selected" attribute defined.

        The existing support for default button was pretty bad, I fixed that too.
        The owner form now has a resetDefaultButton() API. When a Form Associated Element
        becomes a submit button or loses that property, the element calls its form
        to update the style as needed.

        Whenever the submit button changes, 2 elements needs to have their style invalidated:
        -The former default button.
        -The new default button.
        To invalidate the former button, FormElement now caches the computed
        default button. When the default button changes, the cached value is invalidated
        in addition to the new value.

        Computing the new default button takes linear time in the number of form associated element.
        To mitigate that, resetDefaultButton() is only called when changes are related
        to submit buttons. Since those changes are rare, I don't expect the invalidation
        to be a problem.

        Tests: fast/css/pseudo-default-basics.html
               fast/selectors/default-style-update.html

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOne):
        * css/SelectorCheckerTestFunctions.h:
        (WebCore::matchesDefaultPseudoClass):
        (WebCore::isDefaultButtonForForm): Deleted.
        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::addPseudoClassType):
        * dom/Element.cpp:
        (WebCore::Element::matchesValidPseudoClass):
        (WebCore::Element::matchesInvalidPseudoClass):
        (WebCore::Element::matchesDefaultPseudoClass):
        * dom/Element.h:
        (WebCore::Element::matchesValidPseudoClass): Deleted.
        (WebCore::Element::matchesInvalidPseudoClass): Deleted.
        (WebCore::Element::isDefaultButtonForForm): Deleted.
        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::parseAttribute):
        (WebCore::HTMLButtonElement::matchesDefaultPseudoClass):
        * html/HTMLButtonElement.h:
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::isDefaultButtonForForm): Deleted.
        * html/HTMLFormControlElement.h:
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::~HTMLFormElement):
        (WebCore::HTMLFormElement::registerFormElement):
        (WebCore::HTMLFormElement::removeFormElement):
        (WebCore::HTMLFormElement::defaultButton):
        (WebCore::HTMLFormElement::resetDefaultButton):
        * html/HTMLFormElement.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::updateType):
        (WebCore::HTMLInputElement::parseAttribute):
        (WebCore::HTMLInputElement::matchesDefaultPseudoClass):
        * html/HTMLInputElement.h:
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::matchesDefaultPseudoClass):
        (WebCore::HTMLOptionElement::parseAttribute):
        * html/HTMLOptionElement.h:
        * style/StyleSharingResolver.cpp:
        (WebCore::Style::SharingResolver::canShareStyleWithElement):
        (WebCore::Style::canShareStyleWithControl): Deleted.

2016-06-20  Simon Fraser  <simon.fraser@apple.com>

        Focus event dispatched in iframe causes parent document to scroll incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=158629
        rdar://problem/26521616

        Reviewed by Tim Horton.

        When focussing elements in iframes, the page could scroll to an incorrect location.
        This happened because code in Element::focus() tried to disable scrolling on focus,
        but did so only for the current frame, so ancestor frames got programmatically scrolled.
        On iOS we handle the scrolling in the UI process, so never want the web process to
        do programmatic scrolling.

        Fix by changing the focus and cache restore code to use SelectionRevealMode::DoNotReveal,
        rather than manually prohibiting frame scrolling. Pass SelectionRevealMode through various callers,
        and use RevealUpToMainFrame for iOS, allowing the UI process to do the zoomToRect: for the main frame.

        Tests: fast/forms/ios/focus-input-in-iframe.html
               fast/forms/ios/programmatic-focus-input-in-iframe.html

        * dom/Document.h:
        * dom/Element.cpp:
        (WebCore::Element::scrollIntoView):
        (WebCore::Element::scrollIntoViewIfNeeded):
        (WebCore::Element::scrollIntoViewIfNotVisible):
        (WebCore::Element::focus):
        (WebCore::Element::updateFocusAppearance):
        * dom/Element.h:
        * editing/Editor.cpp:
        (WebCore::Editor::insertTextWithoutSendingTextEvent):
        (WebCore::Editor::revealSelectionAfterEditingOperation):
        (WebCore::Editor::findStringAndScrollToVisible):
        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::updateAndRevealSelection):
        (WebCore::FrameSelection::revealSelection):
        (WebCore::FrameSelection::FrameSelection): Deleted.
        * editing/FrameSelection.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::updateFocusAppearance):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::updateFocusAppearance):
        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::contextMenuItemSelected):
        * page/FrameView.cpp:
        (WebCore::FrameView::scrollToAnchor):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollRectToVisible):
        (WebCore::RenderLayer::autoscroll):
        * rendering/RenderLayer.h:
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::scrollRectToVisible):
        * rendering/RenderObject.h:

2016-06-20  Keith Rollin  <krollin@apple.com>

        Remove RefPtr::release() and change calls sites to use WTFMove()
        https://bugs.webkit.org/show_bug.cgi?id=158369

        Reviewed by Chris Dumez.

        RefPtr::release() releases its managed pointer awkwardly. It's more
        direct and clearer to use WTFMove to transfer ownership of the managed
        pointer.

        As part of this cleanup, also change a lot of explicit data types to
        'auto'.

        No new tests: there's no new functionality, just a refactoring of
        existing code.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::removeSamplesFromTrackBuffer):
        (WebCore::SourceBuffer::provideMediaData):
        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::start):
        * Modules/webdatabase/SQLCallbackWrapper.h:
        (WebCore::SQLCallbackWrapper::clear):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::handlePostMessage):
        * bindings/js/JSHistoryCustom.cpp:
        (WebCore::JSHistory::pushState):
        (WebCore::JSHistory::replaceState):
        * bindings/js/JSMessagePortCustom.h:
        (WebCore::handlePostMessage):
        * bindings/js/ScriptControllerMac.mm:
        (WebCore::ScriptController::createScriptInstanceForWidget):
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneDeserializer::readTerminal):
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::copyPropertiesInSet):
        * css/SVGCSSParser.cpp:
        (WebCore::CSSParser::parseSVGValue):
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertShapeValue):
        * css/StyleProperties.cpp:
        (WebCore::StyleProperties::copyPropertiesInSet):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::loadPendingImages):
        * dom/InlineStyleSheetOwner.cpp:
        (WebCore::InlineStyleSheetOwner::clearSheet):
        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::removeChildrenInRange):
        (WebCore::CompositeEditCommand::removeNodeAndPruneAncestors):
        (WebCore::CompositeEditCommand::prune):
        (WebCore::CompositeEditCommand::replaceSelectedTextInNode):
        (WebCore::CompositeEditCommand::rebalanceWhitespaceOnTextSubstring):
        * editing/CreateLinkCommand.cpp:
        (WebCore::CreateLinkCommand::doApply):
        * editing/EditingStyle.cpp:
        (WebCore::EditingStyle::mergeStyle):
        (WebCore::EditingStyle::mergeStyleFromRulesForSerialization):
        * editing/Editor.cpp:
        (WebCore::ClearTextCommand::CreateAndApply):
        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
        * editing/EditorCommand.cpp:
        (WebCore::executeInsertNode):
        * editing/InsertTextCommand.cpp:
        (WebCore::InsertTextCommand::performOverwrite):
        (WebCore::InsertTextCommand::insertTab):
        * editing/RemoveNodePreservingChildrenCommand.cpp:
        (WebCore::RemoveNodePreservingChildrenCommand::doApply):
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplacementFragment::removeNodePreservingChildren):
        (WebCore::ReplaceSelectionCommand::moveNodeOutOfAncestor):
        * html/FTPDirectoryDocument.cpp:
        (WebCore::FTPDirectoryDocumentParser::loadDocumentTemplate):
        * html/HTMLFontElement.cpp:
        (WebCore::HTMLFontElement::collectStyleForPresentationAttribute):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::prepareForSubmission):
        * html/HTMLTableElement.cpp:
        (WebCore::leakBorderStyle):
        (WebCore::leakGroupBorderStyle):
        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder):
        * html/track/InbandDataTextTrack.cpp:
        (WebCore::InbandDataTextTrack::addDataCue):
        * html/track/InbandGenericTextTrack.cpp:
        (WebCore::InbandGenericTextTrack::newCuesParsed):
        * html/track/InbandWebVTTTextTrack.cpp:
        (WebCore::InbandWebVTTTextTrack::newCuesParsed):
        * html/track/TextTrackCueList.cpp:
        (WebCore::TextTrackCueList::add):
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::getInlineStylesForNode):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
        * inspector/InspectorIndexedDBAgent.cpp:
        * inspector/InspectorNetworkAgent.cpp:
        (WebCore::InspectorNetworkAgent::loadResource):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyleSheet::buildObjectForSelectorList):
        * loader/FormSubmission.cpp:
        (WebCore::FormSubmission::create):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadURLIntoChildFrame):
        (WebCore::FrameLoader::loadURL):
        (WebCore::FrameLoader::loadPostRequest):
        * loader/ProgressTracker.cpp:
        (WebCore::ProgressTracker::finalProgressComplete):
        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::disassociateDocumentLoader):
        (WebCore::ApplicationCacheGroup::didFinishLoading):
        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
        * loader/appcache/ApplicationCacheStorage.cpp:
        (WebCore::ApplicationCacheStorage::loadCacheGroup):
        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
        (WebCore::ApplicationCacheStorage::loadCache):
        * loader/archive/ArchiveResourceCollection.cpp:
        (WebCore::ArchiveResourceCollection::popSubframeArchive):
        * loader/archive/cf/LegacyWebArchive.cpp:
        (WebCore::LegacyWebArchive::extract):
        (WebCore::LegacyWebArchive::create):
        (WebCore::LegacyWebArchive::createFromSelection):
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::createImage):
        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::setIconDataForIconURL):
        (WebCore::IconDatabase::getOrCreateIconRecord):
        (WebCore::IconDatabase::readFromDatabase):
        (WebCore::IconDatabase::getImageDataForIconURLFromSQLDatabase):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::sessionStorage):
        (WebCore::DOMWindow::localStorage):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::updateDragAndDrop):
        * page/animation/CompositeAnimation.cpp:
        (WebCore::CompositeAnimation::updateTransitions):
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportViolation):
        * page/mac/ServicesOverlayController.mm:
        (WebCore::ServicesOverlayController::createOverlayIfNeeded):
        (WebCore::ServicesOverlayController::determineActiveHighlight):
        * page/scrolling/AsyncScrollingCoordinator.h:
        (WebCore::AsyncScrollingCoordinator::releaseScrollingTree):
        * page/scrolling/ScrollingStateNode.cpp:
        (WebCore::ScrollingStateNode::cloneAndReset):
        * page/scrolling/ScrollingStateTree.cpp:
        (WebCore::ScrollingStateTree::attachNode):
        * platform/audio/HRTFElevation.cpp:
        (WebCore::getConcatenatedImpulseResponsesForSubject):
        * platform/graphics/DisplayRefreshMonitorManager.cpp:
        (WebCore::DisplayRefreshMonitorManager::createMonitorForClient):
        * platform/graphics/FontCascadeFonts.cpp:
        (WebCore::FontCascadeFonts::glyphDataForSystemFallback):
        * platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
        (WebCore::InbandTextTrackPrivateAVF::processAttributedStrings):
        * platform/graphics/avfoundation/MediaSelectionGroupAVFObjC.mm:
        (WebCore::MediaSelectionGroupAVFObjC::updateOptions):
        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
        (WebCore::SourceBufferPrivateAVFObjC::processCodedFrame):
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        * platform/graphics/ca/PlatformCALayer.cpp:
        (WebCore::PlatformCALayer::createCompatibleLayerOrTakeFromPool):
        * platform/graphics/cg/ImageBufferDataCG.cpp:
        (WebCore::ImageBufferData::getData):
        * platform/graphics/filters/FilterEffect.cpp:
        (WebCore::FilterEffect::asUnmultipliedImage):
        (WebCore::FilterEffect::asPremultipliedImage):
        * platform/graphics/mac/ImageMac.mm:
        (WebCore::Image::loadPlatformResource):
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore::GraphicsContext3D::createForCurrentGLContext):
        (WebCore::GraphicsContext3D::paintRenderingResultsToImageData):
        * platform/mediastream/mac/RealtimeMediaSourceCenterMac.cpp:
        (WebCore::RealtimeMediaSourceCenterMac::createMediaStream):
        * platform/mock/MockRealtimeMediaSourceCenter.cpp:
        (WebCore::MockRealtimeMediaSourceCenter::validateRequestConstraints):
        (WebCore::MockRealtimeMediaSourceCenter::createMediaStream):
        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::registerBlobURL):
        (WebCore::BlobRegistryImpl::registerBlobURLForSlice):
        * platform/network/ResourceHandle.cpp:
        (WebCore::ResourceHandle::create):
        * platform/network/cf/FormDataStreamCFNet.cpp:
        (WebCore::formCreate):
        * platform/text/BidiContext.cpp:
        (WebCore::BidiContext::copyStackRemovingUnicodeEmbeddingContexts):
        * rendering/FilterEffectRenderer.cpp:
        (WebCore::FilterEffectRenderer::build):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::createScrollbar):
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::createScrollbar):
        * rendering/RenderMenuList.cpp:
        (RenderMenuList::createScrollbar):
        * rendering/RenderSearchField.cpp:
        (WebCore::RenderSearchField::createScrollbar):
        * replay/ReplayController.cpp:
        (WebCore::ReplayController::unloadSegment):
        * svg/SVGFEDiffuseLightingElement.cpp:
        (WebCore::SVGFEDiffuseLightingElement::build):
        * svg/SVGFESpecularLightingElement.cpp:
        (WebCore::SVGFESpecularLightingElement::build):
        * svg/properties/SVGListProperty.h:
        (WebCore::SVGListProperty::getItemValuesAndWrappers):
        (WebCore::SVGListProperty::insertItemBeforeValuesAndWrappers):
        (WebCore::SVGListProperty::removeItemValuesAndWrappers):
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThread::workerThread):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::internalAbort):
        * xml/XPathStep.cpp:
        (WebCore::XPath::Step::nodesInAxis):

2016-06-20  Eric Carlson  <eric.carlson@apple.com>

        Crash in PlatformMediaSession::clientWillPausePlayback
        https://bugs.webkit.org/show_bug.cgi?id=158953
        <rdar://problem/26121125>

        Reviewed by Jer Noble.

        No new tests, I have not been able to reproduce this in a test.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::stop): Ref the element before calling stopWithoutDestroyingMediaPlayer
          because updatePlaybackControlsManager can release the last reference and cause the
          destructor to be called.
        (WebCore::HTMLMediaElement::suspend): Ditto.

2016-06-20  Alex Christensen  <achristensen@webkit.org>

        Clean up ResourceResponseBase after r201943
        https://bugs.webkit.org/show_bug.cgi?id=158706

        Reviewed by Michael Catanzaro.

        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::ResourceResponseBase):
        (WebCore::ResourceResponseBase::asResourceResponse): Deleted.
        * platform/network/ResourceResponseBase.h:
        (WebCore::ResourceResponseBase::platformCompare):

2016-06-20  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: console.profile should use the new Sampling Profiler
        https://bugs.webkit.org/show_bug.cgi?id=153499
        <rdar://problem/24352431>

        Reviewed by Timothy Hatcher.

        Test: inspector/timeline/setInstruments-programmatic-capture.html

        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::startFromConsole):
        (WebCore::InspectorTimelineAgent::stopFromConsole):
        (WebCore::InspectorTimelineAgent::mainFrameStartedLoading):
        (WebCore::InspectorTimelineAgent::startProgrammaticCapture):
        (WebCore::InspectorTimelineAgent::stopProgrammaticCapture):
        (WebCore::InspectorTimelineAgent::toggleInstruments):
        (WebCore::InspectorTimelineAgent::toggleScriptProfilerInstrument):
        (WebCore::InspectorTimelineAgent::toggleHeapInstrument):
        (WebCore::InspectorTimelineAgent::toggleMemoryInstrument):
        (WebCore::InspectorTimelineAgent::toggleTimelineInstrument):
        * inspector/InspectorTimelineAgent.h:
        Web implementation of console.profile/profileEnd.
        Make helpers for startings / stopping instruments.

2016-06-20  Andreas Kling  <akling@apple.com>

        When navigating, discard decoded image data that is only live due to page cache.
        <https://webkit.org/b/158941>

        Reviewed by Antti Koivisto.

        A resource is "live" if it's currently in use by a web page, and "dead" if it's
        only kept alive by the memory cache.

        This patch adds a mechanism that looks at CachedImage resources to see if all the
        clients that make them appear "live" are actually pages in the page cache.

        If so, we let the "jettison expensive objects on top-level navigation" mechanism
        discard the decoded data for such half-live images. This can reduce the peak
        memory usage during navigations quite a bit.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad): Move the call to MemoryPressureHandler
        before we add the outgoing page to the page cache. This allows the jettisoning code
        to make decisions based on which pages were cached *before* the navigation.

        * loader/cache/CachedImageClient.h:
        (WebCore::CachedImageClient::inPageCache):
        * loader/ImageLoader.h:
        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::inPageCache):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::inPageCache): Added a CachedImageClient::inPageCache() virtual
        to determine which clients are currently in page cache (answered by their Document.)

        * loader/cache/CachedImage.h:
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::areAllClientsInPageCache): Walks all CachedImageClient clients
        and returns true if all of them are inPageCache().

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::jettisonExpensiveObjectsOnTopLevelNavigation):
        Walk all the known CachedImages and nuke decoded data for those that have some but
        are only considered live due to clients in the page cache.

2016-06-20  Chris Dumez  <cdumez@apple.com>

        Unreviewed, fix post-landing review comment from Darin on r202188.

        * platform/network/CacheValidation.cpp:
        (WebCore::parseCacheHeader):

2016-06-19  Antti Koivisto  <antti@apple.com>

        Updating class name of a shadow host does not update the style applied by :host()
        https://bugs.webkit.org/show_bug.cgi?id=158900
        <rdar://problem/26883707>

        Reviewed by Simon Fraser.

        Test: fast/shadow-dom/shadow-host-style-update.html

        Teach style invalidation optimization code about :host.

        * style/AttributeChangeInvalidation.cpp:
        (WebCore::Style::mayBeAffectedByHostStyle):
        (WebCore::Style::AttributeChangeInvalidation::invalidateStyle):
        * style/ClassChangeInvalidation.cpp:
        (WebCore::Style::computeClassChange):
        (WebCore::Style::mayBeAffectedByHostStyle):
        (WebCore::Style::ClassChangeInvalidation::invalidateStyle):
        * style/IdChangeInvalidation.cpp:
        (WebCore::Style::mayBeAffectedByHostStyle):
        (WebCore::Style::IdChangeInvalidation::invalidateStyle):

2016-06-19  Gavin & Ellie Barraclough  <barraclough@apple.com>

        Remove hasStaticPropertyTable (part 5: done!)
        https://bugs.webkit.org/show_bug.cgi?id=158431

        Reviewed by Chris Dumez.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
            - remove hasStaticPropertyTable.
        * bindings/scripts/test/JS/JSInterfaceName.h:
        (WebCore::JSInterfaceName::create):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
        (WebCore::JSTestActiveDOMObject::create):
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:
        (WebCore::JSTestClassWithJSBuiltinConstructor::create):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::create):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
        (WebCore::JSTestCustomNamedGetter::create):
        * bindings/scripts/test/JS/JSTestEventConstructor.h:
        (WebCore::JSTestEventConstructor::create):
        * bindings/scripts/test/JS/JSTestEventTarget.h:
        (WebCore::JSTestEventTarget::create):
        * bindings/scripts/test/JS/JSTestException.h:
        (WebCore::JSTestException::create):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
        (WebCore::JSTestGenerateIsReachable::create):
        * bindings/scripts/test/JS/JSTestGlobalObject.h:
        * bindings/scripts/test/JS/JSTestInterface.h:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h:
        (WebCore::JSTestJSBuiltinConstructor::create):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
        (WebCore::JSTestMediaQueryListListener::create):
        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
        (WebCore::JSTestNamedConstructor::create):
        * bindings/scripts/test/JS/JSTestNode.h:
        * bindings/scripts/test/JS/JSTestNondeterministic.h:
        (WebCore::JSTestNondeterministic::create):
        * bindings/scripts/test/JS/JSTestObj.h:
        (WebCore::JSTestObj::create):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
        (WebCore::JSTestOverloadedConstructors::create):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
        (WebCore::JSTestOverrideBuiltins::create):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
        (WebCore::JSTestSerializedScriptValueInterface::create):
        * bindings/scripts/test/JS/JSTestTypedefs.h:
        (WebCore::JSTestTypedefs::create):
        * bindings/scripts/test/JS/JSattribute.h:
        (WebCore::JSattribute::create):
        * bindings/scripts/test/JS/JSreadonly.h:
        (WebCore::JSreadonly::create):

2016-06-19  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        The JSBuiltinConstructor feature can't handle a JS interface extending an other JS interface
        https://bugs.webkit.org/show_bug.cgi?id=158834

        Reviewed by Eric Carlson.

        No change of behavior.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader): Explicitly setting DOMWrapped type definition from
        JSXX class deriving from another JSYY class.
        * bindings/scripts/test/JS/JSTestEventTarget.h: Rebased.
        * bindings/scripts/test/JS/JSTestNode.h: Ditto.

2016-06-18  Antti Koivisto  <antti@apple.com>

        Use time literals in WebCore
        https://bugs.webkit.org/show_bug.cgi?id=158905

        Reviewed by Andreas Kling.

        std::chrono::milliseconds(1) -> 1ms etc.

        * dom/Document.cpp:
        (WebCore::Document::minimumLayoutDelay):
        (WebCore::Document::elapsedTime):
        * fileapi/FileReader.cpp:
        (WebCore::FileReader::create):
        * inspector/InspectorOverlay.cpp:
        (WebCore::InspectorOverlay::showPaintRect):
        * loader/CrossOriginPreflightResultCache.cpp:
        (WebCore::CrossOriginPreflightResultCache::CrossOriginPreflightResultCache):
        * loader/ProgressTracker.cpp:
        (WebCore::ProgressTracker::progressStarted):
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::freshnessLifetime):
        * page/ChromeClient.h:
        * page/DOMTimer.cpp:
        (WebCore::DOMTimer::intervalClampedToMinimum):
        (WebCore::DOMTimer::alignedFireTime):
        * page/DOMTimer.h:
        * page/FrameView.cpp:
        (WebCore::FrameView::scrollPositionChanged):
        * page/ResourceUsageThread.cpp:
        (WebCore::ResourceUsageThread::threadBody):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * page/mac/ServicesOverlayController.mm:
        (WebCore::ServicesOverlayController::remainingTimeUntilHighlightShouldBeShown):
        * platform/graphics/FontCache.cpp:
        (WebCore::FontCache::fontForFamily):
        * platform/network/CacheValidation.cpp:
        (WebCore::computeCurrentAge):
        (WebCore::computeFreshnessLifetimeForHTTPFamily):

2016-06-17  Benjamin Poulain  <benjamin@webkit.org>

        :indeterminate pseudo-class should match radios whose group has no checked radio
        https://bugs.webkit.org/show_bug.cgi?id=156270

        Reviewed by Simon Fraser.

        The pseudo-class ":indeterminate" is supposed to match radio buttons
        for which the entire group has no checked button.
        Spec: https://html.spec.whatwg.org/#pseudo-classes:selector-indeterminate

        The change is straightforward with one non-obvious choice:
        I added matchesIndeterminatePseudoClass() in addition to shouldAppearIndeterminate().

        The reason is shouldAppearIndeterminate() is used for styling and AX of elements
        with an indeterminate states (check boxes and progress element). There is no such
        UI for radio boxes.
        I could have extended shouldAppearIndeterminate() to radio box
        then filter out this case in RenderTheme. The problem is doing that would also requires
        changes to the repaint logic to match :indeterminate. It seemed overkill to me to
        change repaint() for a case that is never used in practice.

        Tests: fast/css/pseudo-indeterminate-radio-buttons-basics.html
               fast/css/pseudo-indeterminate-with-radio-buttons-style-invalidation.html
               fast/selectors/detached-radio-button-checked-and-indeterminate-states.html
               fast/selectors/pseudo-indeterminate-with-radio-buttons-style-update.html

        * css/SelectorCheckerTestFunctions.h:
        (WebCore::shouldAppearIndeterminate):
        * dom/Element.cpp:
        (WebCore::Element::matchesIndeterminatePseudoClass):
        * dom/Element.h:
        * dom/RadioButtonGroups.cpp:
        (WebCore::RadioButtonGroup::setCheckedButton):
        (WebCore::RadioButtonGroup::updateCheckedState):
        (WebCore::RadioButtonGroup::remove):
        (WebCore::RadioButtonGroup::setNeedsStyleRecalcForAllButtons):
        (WebCore::RadioButtonGroups::hasCheckedButton):
        * dom/RadioButtonGroups.h:
        * html/CheckboxInputType.cpp:
        (WebCore::CheckboxInputType::matchesIndeterminatePseudoClass):
        (WebCore::CheckboxInputType::shouldAppearIndeterminate):
        (WebCore::CheckboxInputType::supportsIndeterminateAppearance): Deleted.
        * html/CheckboxInputType.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setChecked):
        (WebCore::HTMLInputElement::matchesIndeterminatePseudoClass):
        (WebCore::HTMLInputElement::shouldAppearIndeterminate):
        (WebCore::HTMLInputElement::radioButtonGroups):
        * html/HTMLInputElement.h:
        * html/InputType.cpp:
        (WebCore::InputType::matchesIndeterminatePseudoClass):
        (WebCore::InputType::shouldAppearIndeterminate):
        (WebCore::InputType::supportsIndeterminateAppearance): Deleted.
        * html/InputType.h:
        * html/RadioInputType.cpp:
        (WebCore::RadioInputType::matchesIndeterminatePseudoClass):
        (WebCore::RadioInputType::willDispatchClick): Deleted.
        (WebCore::RadioInputType::didDispatchClick): Deleted.
        (WebCore::RadioInputType::supportsIndeterminateAppearance): Deleted.
        The iOS specific code is just plain wrong.
        It was changing the indeterminate state of the input element.
        The spec clearly says that state is only used by checkbox:
        https://html.spec.whatwg.org/#dom-input-indeterminate

        Moreover, the style update would not change the indeterminate state
        of other buttons in the Button Group, which is just bizarre.
        RenderThemeIOS does not make use of any of this with the current style.

        * html/RadioInputType.h:
        * style/StyleSharingResolver.cpp:
        (WebCore::Style::SharingResolver::canShareStyleWithElement):
        (WebCore::Style::canShareStyleWithControl): Deleted.
        (WebCore::Style::SharingResolver::sharingCandidateHasIdenticalStyleAffectingAttributes): Deleted.
        Style sharing is unified behind the selector matching which is neat.

2016-06-17  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202152.
        https://bugs.webkit.org/show_bug.cgi?id=158897

        The new test is very unstable, timing out frequently
        (Requested by ap on #webkit).

        Reverted changeset:

        "Web Inspector: console.profile should use the new Sampling
        Profiler"
        https://bugs.webkit.org/show_bug.cgi?id=153499
        http://trac.webkit.org/changeset/202152

2016-06-17  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202068, r202115, and r202128.
        https://bugs.webkit.org/show_bug.cgi?id=158896

        The new test is very unstable, timing out frequently
        (Requested by ap on #webkit).

        Reverted changesets:

        "decompose4 return value is unchecked, leading to potentially
        uninitialized data."
        https://bugs.webkit.org/show_bug.cgi?id=158761
        http://trac.webkit.org/changeset/202068

        "[mac] LayoutTest transforms/undecomposable.html is a flaky
        timeout"
        https://bugs.webkit.org/show_bug.cgi?id=158816
        http://trac.webkit.org/changeset/202115

        "[mac] LayoutTest transforms/undecomposable.html is a flaky
        timeout"
        https://bugs.webkit.org/show_bug.cgi?id=158816
        http://trac.webkit.org/changeset/202128

2016-06-17  Chris Fleizach  <cfleizach@apple.com>

        AX: HTML indeterminate IDL attribute not mapped to checkbox value=2 for native checkboxes
        https://bugs.webkit.org/show_bug.cgi?id=158876
        <rdar://problem/26842619>

        Reviewed by Joanmarie Diggs.

        The indeterminate state was not being reported for native checkboxes. 

        Also the isIndeterminate() method was relying on whether the appearance changed, which does not happen on Mac, so that
        was not being reported correctly. Changed that to check the actual attribute.

        Test: accessibility/checkbox-mixed-value.html

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::isIndeterminate):
        (WebCore::AccessibilityNodeObject::isPressed):
        (WebCore::AccessibilityNodeObject::checkboxOrRadioValue):
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::checkboxOrRadioValue):

2016-06-17  Dean Jackson  <dino@apple.com>

        REGRESSION (r199819): CrashTracer: [GraphicsContext3D::getInternalFramebufferSize
        https://bugs.webkit.org/show_bug.cgi?id=158895
        <rdar://problem/26423617>

        Reviewed by Zalan Bujtas.

        In r199819 we started resetting contexts if the page had too
        many. Unfortunately there were entry points in the WebGL context
        that didn't check for the validity of the object before trying
        to access the lower level objects.

        Test: webgl/many-contexts-access-after-loss.html

        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::drawingBufferWidth): Return 0 if we're lost.
        (WebCore::WebGLRenderingContextBase::drawingBufferHeight): Ditto.

2016-06-17  Daniel Bates  <dabates@apple.com>

        Unreviewed, rolling out r202186.

        Broke the Apple Windows, Apple Yosemite, GTK, and WinCairo
        builds.

        Reverted changeset:

        "File scheme should not allow access of a resource on a
        different volume."
        https://bugs.webkit.org/show_bug.cgi?id=158552
        http://trac.webkit.org/changeset/202186

2016-06-17  Daniel Bates  <dabates@apple.com>

        Unreviewed, rolling out r202187.

        202186

        Reverted changeset:

        "Unreviewed clean-up after r202186."
        http://trac.webkit.org/changeset/202187

2016-06-17  Chris Dumez  <cdumez@apple.com>

        Optimize parseCacheHeader() by using StringView
        https://bugs.webkit.org/show_bug.cgi?id=158891

        Reviewed by Darin Adler.

        Optimize parseCacheHeader() and avoid some temporary String allocations
        by using StringView. We now strip the whitespaces in the input string
        at the beginning of the function, at the same as as we strip the
        control characters. We are then able to leverage StringView in the
        rest of the function to get substrings without the need for extra
        String allocations.

        * platform/network/CacheValidation.cpp:
        (WebCore::isControlCharacterOrSpace):
        (WebCore::trimToNextSeparator):
        (WebCore::parseCacheHeader):

2016-06-17  Brent Fulgham  <bfulgham@apple.com>

        Unreviewed clean-up after r202186.

        * platform/FileSystem.cpp:
        (WebCore::filesHaveSameVolume): Don't use C-style formatting.

2016-06-17  Pranjal Jumde  <pjumde@apple.com>

        File scheme should not allow access of a resource on a different volume.
        https://bugs.webkit.org/show_bug.cgi?id=158552
        <rdar://problem/15307582>

        Reviewed by Brent Fulgham.

        Tests: Tools/TestWebKitAPI/Tests/mac/CrossPartitionFileSchemeAccess.mm

        * page/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::canDisplay):
        * platform/FileSystem.cpp:
        (WebCore::platformFileStat):
        (WebCore::filesHaveSameVolume):
        Returns true if the files are on the same volume
        * platform/FileSystem.h:

2016-06-17  Antoine Quint  <graouts@apple.com>

        Web video playback controls should have RTL volume slider
        https://bugs.webkit.org/show_bug.cgi?id=158856
        <rdar://problem/25971769>

        Reviewed by Tim Horton.

        We reproduce the system used to propagate the page scale factor from the WebPage to the media controls to
        propagate the user interface layout direction.

        The Page exposes a new setUserInterfaceLayoutDirection() method which is set by the WebPage. The Page
        then notifies the Document of a change, which propagates down to registered media elements, and finally sets
        the usesLTRUserInterfaceLayoutDirection property on the media controller object in the injected JavaScript.
        Based on the value of that property we toggle a new .uses-ltr-user-interface-layout-direction CSS class on the
        .volume-box which applies a translate to the right and flips the volume controls on the x axis.

        Since we're setting a new JS property from HTMLMediaController, we refactor much of the code out of the existing
        pageScaleFactorChanged() and setPageScaleFactorProperty() into the new setControllerJSProperty() method so that
        can easily set a named JS property with a given JSValue.

        For testing purposes, we expose the WebCore::Page::setUserInterfaceLayoutDirection() method through Internals.

        Test: fullscreen/video-controls-rtl.html

        * Modules/mediacontrols/mediaControlsApple.css:
        (video:-webkit-full-screen::-webkit-media-controls-panel .volume-box:not(.uses-ltr-user-interface-layout-direction)):
        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.set usesLTRUserInterfaceLayoutDirection):
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Document.cpp:
        (WebCore::Document::registerForUserInterfaceLayoutDirectionChangedCallbacks):
        (WebCore::Document::unregisterForUserInterfaceLayoutDirectionChangedCallbacks):
        (WebCore::Document::userInterfaceLayoutDirectionChanged):
        * dom/Document.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::registerWithDocument):
        (WebCore::HTMLMediaElement::unregisterWithDocument):
        (WebCore::HTMLMediaElement::updatePageScaleFactorJSProperty):
        (WebCore::HTMLMediaElement::updateUsesLTRUserInterfaceLayoutDirectionJSProperty):
        (WebCore::HTMLMediaElement::setControllerJSProperty):
        (WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
        (WebCore::HTMLMediaElement::pageScaleFactorChanged):
        (WebCore::HTMLMediaElement::userInterfaceLayoutDirectionChanged):
        (WebCore::setPageScaleFactorProperty): Deleted.
        * html/HTMLMediaElement.h:
        * page/Page.cpp:
        (WebCore::Page::setUserInterfaceLayoutDirection):
        * page/Page.h:
        (WebCore::Page::userInterfaceLayoutDirection):
        * platform/UserInterfaceLayoutDirection.h: Renamed from Source/WebKit2/UIProcess/UserInterfaceLayoutDirection.h.
        * testing/Internals.cpp:
        (WebCore::Internals::setUserInterfaceLayoutDirection):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-06-17  Chris Dumez  <cdumez@apple.com>

        TouchEvent should have a constructor
        https://bugs.webkit.org/show_bug.cgi?id=158883
        <rdar://problem/26063585>

        Reviewed by Benjamin Poulain.

        TouchEvent should have a constructor:
        - https://w3c.github.io/touch-events/#touchevent-interface

        Chrome already ships this:
        - https://bugs.chromium.org/p/chromium/issues/detail?id=508675

        Test: fast/events/touch/touch-event-constructor.html

        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        * bindings/js/JSDictionary.h:
        * dom/TouchEvent.cpp:
        (WebCore::TouchEvent::TouchEvent):
        * dom/TouchEvent.h:
        * dom/TouchEvent.idl:

2016-06-17  Zalan Bujtas  <zalan@apple.com>

        Potential null dereferencing on a detached positioned renderer.
        https://bugs.webkit.org/show_bug.cgi?id=158879

        Reviewed by Simon Fraser.

        This patch fixes the case when the while loop to search for the absolute positioned ancestor
        returns null (it happens when positioned renderer has been detached from the render tree).

        Speculative fix.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::markFixedPositionObjectForLayoutIfNeeded):
        * rendering/RenderBlock.h:

2016-06-17  Chris Dumez  <cdumez@apple.com>

        URL hash setter does not remove fragment identifier if argument is an empty string
        https://bugs.webkit.org/show_bug.cgi?id=158869
        <rdar://problem/26863430>

        Reviewed by Darin Adler.

        URL hash setter and URLUtils hash setter should remove the fragment identifier
        if set to "#" or "":
        - https://url.spec.whatwg.org/#dom-url-hash
        - https://html.spec.whatwg.org/multipage/semantics.html#dom-hyperlink-hash

        This patch aligns our behavior with the specification and with other browsers
        (tested Firefox and Chrome).

        This patch also updates HTMLAnchorElement to inherit URLUtils to avoid code
        duplication. HTMLAnchorElement already implements URLUtils in the IDL, as per
        the specification:
        - https://html.spec.whatwg.org/multipage/semantics.html#htmlanchorelement

        No new tests, rebaselined existing tests.

        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::origin): Deleted.
        (WebCore::HTMLAnchorElement::text): Deleted.
        (WebCore::HTMLAnchorElement::setText): Deleted.
        (WebCore::HTMLAnchorElement::toString): Deleted.
        (WebCore::HTMLAnchorElement::isLiveLink): Deleted.
        (WebCore::HTMLAnchorElement::sendPings): Deleted.
        (WebCore::HTMLAnchorElement::handleClick): Deleted.
        (WebCore::HTMLAnchorElement::eventType): Deleted.
        (WebCore::HTMLAnchorElement::treatLinkAsLiveForEventType): Deleted.
        (WebCore::isEnterKeyKeydownEvent): Deleted.
        (WebCore::shouldProhibitLinks): Deleted.
        (WebCore::HTMLAnchorElement::willRespondToMouseClickEvents): Deleted.
        (WebCore::rootEditableElementMap): Deleted.
        (WebCore::HTMLAnchorElement::rootEditableElementForSelectionOnMouseDown): Deleted.
        (WebCore::HTMLAnchorElement::clearRootEditableElementForSelectionOnMouseDown): Deleted.
        (WebCore::HTMLAnchorElement::setRootEditableElementForSelectionOnMouseDown): Deleted.
        * html/HTMLAnchorElement.h:
        (WebCore::HTMLAnchorElement::invalidateCachedVisitedLinkHash): Deleted.
        * html/URLUtils.h:
        (WebCore::URLUtils<T>::setHash):

2016-06-17  John Wilander  <wilander@apple.com>

        Ignore case in the check for security origin inheritance
        https://bugs.webkit.org/show_bug.cgi?id=158878

        Reviewed by Alex Christensen.

        Darin Adler commented in https://bugs.webkit.org/show_bug.cgi?id=158855:
        "Are these comparisons intentionally case sensitive? Shouldn’t they ignore ASCII 
        case? We could use equalIgnoringASCIICase and equalLettersIgnoringASCIICase for 
        those two lines instead of using ==. URL::parse normalizes letters in the scheme 
        and host by using toASCIILower, but does not normalize letters elsewhere in the 
        URL, such as in the "blank" or "srcdoc" in the above URLs."

        Test: http/tests/dom/window-open-about-uppercase-blank-and-access-document.html

        * platform/URL.cpp:
        (WebCore::URL::shouldInheritSecurityOriginFromOwner):

2016-06-17  Hyungwook Lee  <hyungwook.lee@navercorp.com>

        Fix compilation errors when we enable DUMP_NODE_STATISTICS in Node.h
        https://bugs.webkit.org/show_bug.cgi?id=158868

        Reviewed by Alex Christensen.

        Fix compilation errors in Node.cpp when we enable DUMP_NODE_STATISTICS

        * dom/Node.cpp:
        (WebCore::Node::dumpStatistics):

2016-06-17  Per Arne Vollan  <pvollan@apple.com>

        [Win] Scrolling in popup menu scrolls past last entry.
        https://bugs.webkit.org/show_bug.cgi?id=158870

        Reviewed by Brent Fulgham.

        When the popup has a scrollbar, the content size is not equal to the popup window size.
  
        * platform/win/PopupMenuWin.cpp:
        (WebCore::PopupMenuWin::contentsSize):

2016-06-17  Frederic Wang  <fwang@igalia.com>

        Refactor RenderMathMLRoot layout function to avoid using flexbox
        https://bugs.webkit.org/show_bug.cgi?id=153987

        Reviewed by Brent Fulgham.

        No new tests, already covered by existing tests.
        A case for RTL root has been added to roots.xhtml.

        We reimplement RenderMathMLRoot without any flexbox or anonymous.
        The anonymous RenderMathMLRadicalOperator used to draw the radical sign is replaced with
        the MathOperator class introduced in bug 152244.
        msqrt (row of children under a square root) is now implemented directly in RenderMathMLRoot,
        so RenderMathMLSquareRoot is removed and RenderMathMLRoot now inherits from RenderMathMLRow.

        * CMakeLists.txt: Remove files for RenderMathMLRadicalOperator and RenderMathMLSquareRoot.
        * WebCore.xcodeproj/project.pbxproj: ditto.
        * accessibility/AccessibilityRenderObject.cpp: Update code now that we do not use any
        radical wrappers.
        (WebCore::AccessibilityRenderObject::isMathRow): Now that RenderMathMLRoot inherits from
        RenderMathMLRow, we must exclude MathRoot or otherwise some accessibility code may treat
        roots as rows.
        (WebCore::AccessibilityRenderObject::mathRadicandObject): Return the first child for
        Root/SquareRoot or nullptr.
        (WebCore::AccessibilityRenderObject::mathRootIndexObject): Return the second child for
        Root and nullptr for SquareRoot.
        * mathml/MathMLInlineContainerElement.cpp:
        (WebCore::MathMLInlineContainerElement::childrenChanged): We no longer need a special case
        for msqrt, it is treated as a normal RenderMathMLRow.
        (WebCore::MathMLInlineContainerElement::createElementRenderer): Make msqrt create a
        RenderMathMLRoot object.
        * rendering/RenderObject.h:
        (WebCore::RenderObject::isRenderMathMLRadicalOperator): Deleted.
        * rendering/mathml/RenderMathMLBlock.cpp:
        (WebCore::RenderMathMLBlock::mirrorIfNeeded): New function to mirror a child horizontal
        offset according to the parent width.
        (WebCore::RenderMathMLBlock::renderName):
        * rendering/mathml/RenderMathMLBlock.h:
        (WebCore::RenderMathMLBlock::mirrorIfNeeded): Moved from RenderMathMLScripts, just forward
        call to the other mirrorIfNeeded function.
        * rendering/mathml/RenderMathMLOperator.cpp: We no longer need this trailingSpaceError hack.
        (WebCore::RenderMathMLOperator::trailingSpaceError): Deleted.
        * rendering/mathml/RenderMathMLOperator.h: ditto.
        * rendering/mathml/RenderMathMLRadicalOperator.cpp: Removed. The radical sign is now drawn
        with a MathOperator.
        * rendering/mathml/RenderMathMLRadicalOperator.h: Removed.
        * rendering/mathml/RenderMathMLRoot.cpp: Complete refactoring to avoid using flexbox and
        anonymous wrappers.
        (WebCore::RenderMathMLRoot::RenderMathMLRoot): Set m_kind parameters to distinguish between
        square root and general root and set the MathOperator member to draw the radical sign.
        (WebCore::RenderMathMLRoot::isValid): Helper function to verify whether the child list is valid.
        (WebCore::RenderMathMLRoot::getBase): Get the base of an mroot.
        (WebCore::RenderMathMLRoot::getIndex): Get the index of an mroot.
        (WebCore::RenderMathMLRoot::styleDidChange): Be sure to keep the style of the
        MathOperator in sync with ours ; no need to skip empty roots.
        (WebCore::RenderMathMLRoot::updateFromElement): Call the function from the new parent class ;
        no need to skip empty roots.
        (WebCore::RenderMathMLRoot::updateStyle): Remove the isEmpty ASSERT as it is valid to have
        empty square root. Set the m_kernBeforeDegree, m_kernBeforeDegree members.
        No need to set style for anonymous.
        (WebCore::RenderMathMLRoot::computePreferredLogicalWidths): Implement this function.
        (WebCore::RenderMathMLRoot::layoutBlock): Implement this function.
        (WebCore::RenderMathMLRoot::paintChildren): Implement this function.
        (WebCore::RenderMathMLRoot::paint): Remove the trailingSpaceError hack ;
        paint the radical sign via MathOperator::paint
        (WebCore::RenderMathMLRoot::baseWrapper): Deleted.
        (WebCore::RenderMathMLRoot::radicalWrapper): Deleted.
        (WebCore::RenderMathMLRoot::indexWrapper): Deleted.
        (WebCore::RenderMathMLRoot::radicalOperator): Deleted.
        (WebCore::RenderMathMLRoot::restructureWrappers): Deleted.
        (WebCore::RenderMathMLRoot::addChild): Deleted.
        (WebCore::RenderMathMLRoot::firstLineBaseline): Deleted.
        (WebCore::RenderMathMLRoot::layout): Deleted.
        (WebCore::RenderMathMLRootWrapper::createAnonymousWrapper): Deleted.
        (WebCore::RenderMathMLRootWrapper::removeChildWithoutRestructuring): Deleted.
        (WebCore::RenderMathMLRootWrapper::removeChild): Deleted.
        * rendering/mathml/RenderMathMLRoot.h: Make RenderMathMLRoot inherit from RenderMathMLRow.
        Make RenderMathMLRoot support <msqrt>.
        Remove all the anonymous wrapper stuff and instead use a MathOperator for the radical symbol.
        Update function declaration to implement layout without flexbox and add some helper functions.
        * rendering/mathml/RenderMathMLRow.cpp: Allow to get the exact metrics of the chid row,
        for use in RenderMathMLRoot.
        (WebCore::RenderMathMLRow::computeLineVerticalStretch): rename parameters.
        (WebCore::RenderMathMLRow::layoutRowItems): Set parameters to the final ascent, descent and
        logical width of the chid row. Set the temporary logical width for RenderMathRoot before
        laying the children out.
        (WebCore::RenderMathMLRow::layoutBlock): Rename parameters ; add a dummy logicalWidth
        parameter.
        * rendering/mathml/RenderMathMLRow.h: Make some functions accessible or overridable by
        RenderMathMLRoot. Make layoutRowItems return the final ascent, descent and logical width
        after the chid row is laid out.
        * rendering/mathml/RenderMathMLScripts.cpp: Move mirrorIfNeeded to RenderMathMLBlock.
        (WebCore::RenderMathMLScripts::mirrorIfNeeded): Deleted.
        * rendering/mathml/RenderMathMLScripts.h: Move mirrorIfNeeded to RenderMathMLBlock.
        * rendering/mathml/RenderMathMLSquareRoot.cpp: Removed.
        * rendering/mathml/RenderMathMLSquareRoot.h: Removed.
        * rendering/mathml/MathOperator.cpp:
        (WebCore::MathOperator::paint): Apply a mirroring scale transform to radical symbol
        in RTL direction.

2016-06-17  Chris Dumez  <cdumez@apple.com>

        Drop some unnecessary header includes
        https://bugs.webkit.org/show_bug.cgi?id=158864

        Reviewed by Alexey Proskuryakov.

        Drop some unnecessary header includes to try and reduce build times.

        * WebCore.xcodeproj/project.pbxproj:
        * accessibility/AccessibilityList.cpp:
        * css/CSSComputedStyleDeclaration.cpp:
        * css/MediaQueryMatcher.cpp:
        * css/StyleMedia.cpp:
        * css/TransformFunctions.cpp:
        * dom/NodeRenderStyle.h:
        * dom/PseudoElement.h:
        (isType): Deleted.
        * html/HTMLTitleElement.cpp:
        * html/shadow/MediaControlElementTypes.h:
        * html/shadow/MediaControls.cpp:
        * inspector/InspectorDOMAgent.h:
        * inspector/InspectorLayerTreeAgent.h:
        * inspector/InspectorPageAgent.cpp:
        * page/scrolling/AsyncScrollingCoordinator.cpp:
        * page/scrolling/ScrollingCoordinator.h:
        * rendering/BidiRun.h:
        * rendering/BorderEdge.h:
        * rendering/RenderElement.h:
        * rendering/RenderObject.h:
        (WebCore::AnnotatedRegionValue::operator==): Deleted.
        (WebCore::AnnotatedRegionValue::operator!=): Deleted.
        * rendering/RenderObjectEnums.h: Added.
        * rendering/RenderTheme.h:
        * rendering/SimpleLineLayoutFlowContents.h:
        * rendering/SimpleLineLayoutTextFragmentIterator.h:
        * rendering/TextPainter.h:
        * rendering/style/RenderStyle.h:
        (WebCore::pseudoElementRendererIsNeeded):
        * rendering/style/ShapeValue.cpp:
        * rendering/style/ShapeValue.h:
        * style/ClassChangeInvalidation.cpp:
        * style/ClassChangeInvalidation.h:
        * style/InlineTextBoxStyle.h:
        * style/StyleUpdate.cpp:

2016-06-17  Andreas Kling  <akling@apple.com>

        [iOS] Throw away linked code when navigating to a new page.
        <https://webkit.org/b/153851>

        Reviewed by Antti Koivisto.

        When navigating to a new page, tell JSC to throw out any linked code it has lying around.
        Linked code is tied to a specific global object, and as we're creating a new one for the
        new page, none of it is useful to us here.

        In the event that the user navigates back, the cost of relinking some code will be far
        lower than the memory cost of keeping all of it around.

        This was in-tree before but was rolled out due to regressing JSBench. It was a slowdown
        due to the benchmark harness using top-level navigations to drive the tests.
        This new version avoids that problem by only throwing out code if we haven't navigated
        in the last 2 seconds. This also prevents excessive work in response to redirects.

        I've also moved this into MemoryPressureHandler so we don't make a mess in FrameLoader.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):
        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::jettisonExpensiveObjectsOnTopLevelNavigation):
        * platform/MemoryPressureHandler.h:

2016-06-17  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        CORS preflight with a non-200 response should be a preflight failure
        https://bugs.webkit.org/show_bug.cgi?id=111008

        Reviewed by Darin Adler.

        Covered by rebased tests.

        * Modules/fetch/FetchResponse.h: Making use of ResourceResponse::isSuccessful.
        * loader/CrossOriginPreflightChecker.cpp:
        (WebCore::CrossOriginPreflightChecker::validatePreflightResponse): Checking that response status is code is
        successful. If not, calling preflight failure callback.
        (WebCore::CrossOriginPreflightChecker::startPreflight): Putting in manual redirection mode so that redirection
        responses are processed as other responses.
        * loader/ResourceLoaderOptions.h:
        (WebCore::ResourceLoaderOptions::fetchOptions): Adding a non-const getter and fixing const getter to return a
        const reference.
        (WebCore::ResourceLoaderOptions::setFetchOptions): Passing options by reference.
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::isSuccessful): Utility function.
        * platform/network/ResourceResponseBase.h:

2016-06-17  Frederic Wang  <fwang@igalia.com>

        MathOperator: Add fallback mechanisms for stretching and mirroring radical symbols
        https://bugs.webkit.org/show_bug.cgi?id=156836

        Reviewed by Sergio Villar Senin.

        Some platforms do not have OpenType MATH fonts pre-installed and thus can not draw stretchy
        operators using size variants or glyph assembly. This is especially problematic for the
        radical symbol which is used to write roots. Currently, we have some fallback code to draw
        that symbol using graphical primitives but it is a bit complex and makes the style of radical
        inconsistent with the font used. We solve these issues by just scaling the base glyph via a
        scale transform. Such scale transform is also used to mirror the radical symbol so that we
        have some support for right-to-left roots until we can do glyph-level mirroring
        via the OpenType rtlm feature.

        Test: mathml/radical-fallback.html

        * rendering/mathml/MathOperator.cpp: Add a constant for the code point U+221A of the radical.
        (WebCore::MathOperator::reset): In general, we don't need any vertical scaling for radical
        symbols so m_radicalVerticalScale is initialized to 1.
        (WebCore::MathOperator::calculateStretchyData): If we don't have a font with a MATH table and we
        try streching a radical, then we update the vertical metrics to match the target size and
        set m_radicalVerticalScale to the value necessary to make the base glyph scaled to that size.
        (WebCore::MathOperator::paint): For a radical operator, we may apply a scale transform of
        parameters (radicalHorizontalScale, m_radicalVerticalScale) in order to support RTL
        mirroring or vertical stretching.
        * rendering/mathml/MathOperator.h: We add a m_radicalVerticalScale member to indicate the
        scaling to apply to the base radical glyph when the stretchy fallback is necessary.
        (WebCore::MathOperator::isStretched): The operator is also considered stretched when the
        m_radicalVerticalScale is applied to the base size.
        * rendering/mathml/RenderMathMLRadicalOperator.cpp: Remove code specific to the old fallback mechanism.
        * rendering/mathml/RenderMathMLRadicalOperator.h: Ditto.

2016-06-16  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202147.
        https://bugs.webkit.org/show_bug.cgi?id=158867

        Broke scrolling tests on iOS Simulator (Requested by ap on
        #webkit).

        Reverted changeset:

        "Focus event dispatched in iframe causes parent document to
        scroll incorrectly"
        https://bugs.webkit.org/show_bug.cgi?id=158629
        http://trac.webkit.org/changeset/202147

2016-06-16  Benjamin Poulain  <bpoulain@apple.com>

        :in-range & :out-of-range CSS pseudo-classes shouldn't match disabled or readonly inputs
        https://bugs.webkit.org/show_bug.cgi?id=156530

        Reviewed by Simon Fraser.

        Elements should only match :in-range and :out-of-range
        when they are candidate for constraint validation.

        Tests: fast/css/pseudo-in-range-on-disabled-input-basics.html
               fast/css/pseudo-in-range-on-readonly-input-basics.html
               fast/css/pseudo-in-range-out-of-range-on-disabled-input-trivial.html
               fast/css/pseudo-out-of-range-on-disabled-input-basics.html
               fast/css/pseudo-out-of-range-on-readonly-input-basics.html
               fast/selectors/in-range-out-of-range-style-update.html

        * html/BaseDateAndTimeInputType.cpp:
        (WebCore::BaseDateAndTimeInputType::minOrMaxAttributeChanged):
        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::minOrMaxAttributeChanged):
        I forgot to handle style update in r202143.
        This is covered by the new style invalidation test.

        * html/BaseDateAndTimeInputType.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::isInRange):
        (WebCore::HTMLInputElement::isOutOfRange):

2016-06-16  Frederic Wang  <fwang@igalia.com>

        Add separate MathOperator for selection/measuring/drawing of stretchy operators
        https://bugs.webkit.org/show_bug.cgi?id=152244

        Reviewed by Brent Fulgham.

        We complete the class to select, measure and draw stretchy operators that is independent
        from RenderMathMLOperator. That way, we will be able use stretchy operator without having
        to introduce & manage anonymous RenderMathMLOperator's
        (e.g for <mroot>, <msqrt> and <mfenced>).

        No new tests, already covered by existing tests.

        * rendering/mathml/MathOperator.cpp:
        (WebCore::ascentForGlyph): Add this helper function to get glyph ascent.
        (WebCore::descentForGlyph): Add this helper function to get glyph descent.
        (WebCore::MathOperator::reset): Initialize all the data and calculate ascent/descent of the
        base glyph.
        (WebCore::MathOperator::setSizeVariant): Set the width/ascent/descent.
        (WebCore::MathOperator::setGlyphAssembly): Ditto.
        (WebCore::MathOperator::calculateDisplayStyleLargeOperator): Remove the STIX Word hack and
        change m_maxPreferredWidth to use the actual width instead.
        (WebCore::MathOperator::stretchTo): New functions to execute the actual operator streching.
        (WebCore::MathOperator::fillWithVerticalExtensionGlyph): Add a FIXME for bug 155434.
        (WebCore::MathOperator::fillWithHorizontalExtensionGlyph): Align all the glyph baselines on
        the same axis, given by m_ascent.
        Add a FIXME for bug 155434.
        (WebCore::MathOperator::paintHorizontalGlyphAssembly): Ditto.
        (WebCore::MathOperator::paint): Public function to do the painting.
        (WebCore::MathOperator::paintVerticalGlyphAssembly): Deleted.
        * rendering/mathml/MathOperator.h: Update declarations and make most of the members private.
        (WebCore::MathOperator::ascent): Function to expose m_ascent.
        (WebCore::MathOperator::descent): Function to expose m_descent.
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::stretchTo): Forward the stretching call to MathOperator.
        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): Unfold advanceForGlyph
        since we delete RenderMathMLOperator::advanceForGlyph. Just rely on
        MathOperator::maxPreferredWidth to determine the preferred width of stretchy operators.
        For horizontal operators, we just use the width of the base glyph.
        Finally, we remove the dirty flag on preferred logical width.
        (WebCore::RenderMathMLOperator::rebuildTokenContent): Reinit the MathOperator instance.
        (WebCore::RenderMathMLOperator::updateFromElement): Force more updates of
        RenderMathMLOperator to avoid test breakage.
        (WebCore::RenderMathMLOperator::styleDidChange): Call MathOperator::reset to take into
        account style change.
        (WebCore::RenderMathMLOperator::updateStyle): Remove unused code.
        (WebCore::RenderMathMLOperator::firstLineBaseline): Use MathOperator::ascent() function.
        (WebCore::RenderMathMLOperator::computeLogicalHeight): Use MathOperator::ascent() and
        MathOperator::descent() functions to calculate the height.
        (WebCore::RenderMathMLOperator::paint): Only stretched operators are treated specially.
        We center horizontal operator and forward the paint() call to MathOperator.
        (WebCore::RenderMathMLOperator::trailingSpaceError): The error is now just the difference
        between the values returned by MathOperator::maxPreferredWidth() and
        MathOperator::width().
        (WebCore::boundsForGlyph): Deleted.
        (WebCore::heightForGlyph): Deleted.
        (WebCore::advanceWidthForGlyph): Deleted.
        (WebCore::RenderMathMLOperator::updateStyle): Deleted.

2016-06-16  Jiewen Tan  <jiewen_tan@apple.com>

        CSP: Content Security Policy should allow '*' to match the originating page's scheme
        https://bugs.webkit.org/show_bug.cgi?id=158811
        <rdar://problem/26819568>

        Reviewed by Daniel Bates.

        Tests: security/contentSecurityPolicy/image-with-file-url-allowed-by-img-src-star.html
               security/contentSecurityPolicy/link-with-file-url-allowed-by-style-src-star.html
               security/contentSecurityPolicy/script-with-file-url-allowed-by-script-src-star.html
               security/contentSecurityPolicy/video-with-file-url-allowed-by-media-src-star.html

        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::isProtocolAllowedByStar):

2016-06-16  Chris Dumez  <cdumez@apple.com>

        Add HTTPHeaderMap::set() overload taking a NSString*
        https://bugs.webkit.org/show_bug.cgi?id=158857

        Reviewed by Darin Adler.

        Add HTTPHeaderMap::set() overloading taking a NSString* in addition to
        the one taking a CFStringRef. It is useful for the Cocoa implementation
        of ResourceRequest::doUpdateResourceRequest().

        * platform/network/HTTPHeaderMap.h:
        (WebCore::HTTPHeaderMap::set):

2016-06-16  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: console.profile should use the new Sampling Profiler
        https://bugs.webkit.org/show_bug.cgi?id=153499
        <rdar://problem/24352431>

        Reviewed by Timothy Hatcher.

        Test: inspector/timeline/setInstruments-programmatic-capture.html

        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::startFromConsole):
        (WebCore::InspectorTimelineAgent::stopFromConsole):
        (WebCore::InspectorTimelineAgent::mainFrameStartedLoading):
        (WebCore::InspectorTimelineAgent::startProgrammaticCapture):
        (WebCore::InspectorTimelineAgent::stopProgrammaticCapture):
        (WebCore::InspectorTimelineAgent::toggleInstruments):
        (WebCore::InspectorTimelineAgent::toggleScriptProfilerInstrument):
        (WebCore::InspectorTimelineAgent::toggleHeapInstrument):
        (WebCore::InspectorTimelineAgent::toggleMemoryInstrument):
        (WebCore::InspectorTimelineAgent::toggleTimelineInstrument):
        * inspector/InspectorTimelineAgent.h:
        Web implementation of console.profile/profileEnd.
        Make helpers for startings / stopping instruments.

2016-06-16  John Wilander  <wilander@apple.com>

        Restrict security origin inheritance to empty, about:blank, and about:srcdoc URLs
        https://bugs.webkit.org/show_bug.cgi?id=158855
        <rdar://problem/26142632>

        Reviewed by Alex Christensen.

        Tests: http/tests/dom/window-open-about-blank-and-access-document.html
               http/tests/dom/window-open-about-webkit-org-and-access-document.html

        Document.cpp previously checked whether a document should inherit its owner's 
        security origin by checking if the URL is either empty or blank. URL.cpp in 
        turn only checks if the protocol is "about:" in the isBlankURL() function. 
        Thus all about:* URLs inherited security origin. This patch restricts 
        security origin inheritance to empty, about:blank, and about:srcdoc URLs.

        Quotes and links from the WHATWG spec regarding about:srcdoc:

        7.1 Browsing contexts
        A browsing context can have a creator browsing context, the browsing context 
        that was responsible for its creation. If a browsing context has a parent 
        browsing context, then that is its creator browsing context. Otherwise, if the 
        browsing context has an opener browsing context, then that is its creator 
        browsing context. Otherwise, the browsing context has no creator browsing 
        context.
        https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc

        7.1.1 Nested browsing contexts
        Certain elements (for example, iframe elements) can instantiate further 
        browsing contexts. These are called nested browsing contexts. If a browsing 
        context P has a Document D with an element E that nests another browsing 
        context C inside it, then C is said to be nested through D, and E is said to 
        be the browsing context container of C. If the browsing context container 
        element E is in the Document D, then P is said to be the parent browsing 
        context of C and C is said to be a child browsing context of P. Otherwise, 
        the nested browsing context C has no parent browsing context.
        https://html.spec.whatwg.org/multipage/browsers.html#nested-browsing-context

        4.8.5 The iframe element
        The iframe element represents a nested browsing context.
        ...
        If the srcdoc attribute is specified
            Navigate the element's child browsing context to a new response whose 
            url list consists of about:srcdoc ...
        https://html.spec.whatwg.org/multipage/embedded-content.html#attr-iframe-srcdoc

        * dom/Document.cpp:
        (WebCore::Document::initSecurityContext):
            Now uses the URL::shouldInheritSecurityOriginFromOwner() function instead.
        (WebCore::Document::initContentSecurityPolicy):
            Now uses the URL::shouldInheritSecurityOriginFromOwner() function instead.
        (WebCore::shouldInheritSecurityOriginFromOwner): Deleted.
            Moved to URL::shouldInheritSecurityOriginFromOwner() and restricted the check.
        * platform/URL.cpp:
        (WebCore::URL::shouldInheritSecurityOriginFromOwner):
        * platform/URL.h:
            Moved the function from Document and restricted the check to only allow
            security origin inheritance for empty, about:blank, and about:srcdoc URLs.

2016-06-16  Simon Fraser  <simon.fraser@apple.com>

        [iOS] Focus event dispatched in iframe causes parent document to scroll incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=158629
        rdar://problem/26521616

        Reviewed by Enrica Casucci.

        When focussing elements in iframes, the page could scroll to an incorrect location.
        This happened because code in Element::focus() tried to disable scrolling on focus,
        but did so only for the current frame, so ancestor frames got programmatically scrolled.
        On iOS we handle the scrolling in the UI process, so never want the web process to
        do programmatic scrolling.

        Fix by changing the focus and cache restore code to use SelectionRevealMode::DoNotReveal,
        rather than manually prohibiting frame scrolling.

        Tests: fast/forms/ios/focus-input-in-iframe.html
               fast/forms/ios/programmatic-focus-input-in-iframe.html

        * dom/Element.cpp:
        (WebCore::Element::focus):
        * history/CachedPage.cpp:
        (WebCore::CachedPage::restore):

2016-06-16  Zalan Bujtas  <zalan@apple.com>

        [New Block-Inside-Inline Model] Do not attempt to re-run margin collapsing on the block sequence.
        https://bugs.webkit.org/show_bug.cgi?id=158854

        Reviewed by David Hyatt.

        Test: fast/block/inside-inlines/crash-on-first-line-change.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::marginCollapseLinesFromStart):

2016-06-16  Ting-Wei Lan  <lantw44@gmail.com>

        Include cstdlib before using std::atexit
        https://bugs.webkit.org/show_bug.cgi?id=158681

        Reviewed by Brent Fulgham.

        * platform/graphics/PlatformDisplay.cpp:

2016-06-16  Chris Dumez  <cdumez@apple.com>

        Use StringView::toAtomicString() in HTMLImageElement::setBestFitURLAndDPRFromImageCandidate()
        https://bugs.webkit.org/show_bug.cgi?id=158853

        Reviewed by Brent Fulgham.

        Use StringView::toAtomicString() in HTMLImageElement::setBestFitURLAndDPRFromImageCandidate()
        as m_bestFitImageURL data member is an AtomicString. This avoids constructing a String and
        then atomizing it.

        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::setBestFitURLAndDPRFromImageCandidate):

2016-06-16  Benjamin Poulain  <bpoulain@apple.com>

        :in-range & :out-of-range CSS pseudo-classes shouldn't match inputs without range limitations
        https://bugs.webkit.org/show_bug.cgi?id=156558

        Reviewed by Simon Fraser.

        The pseudo selectors :in-range and :out-of-range should only
        apply if:
        -minimum/maximum are defined for the input type
        -the input value is/is-not suffering from underflow/overflow.

        Only certain types have a valid minimum and maximum:
        -number
        -range
        -date
        -month
        -week
        -time
        -datetime-local

        Of those, only one has a default minimum and maximum: range.
        For all the others, the minimum or maximum is only defined
        if the min/max attribute is defined and valid.

        This patch addresses these constraints for number and range.
        The date types range validation is severely broken and is
        left untouched. It really needs a clean rewrite.

        Tests: fast/css/pseudo-in-range-basics.html
               fast/css/pseudo-in-range-out-of-range-trivial.html
               fast/css/pseudo-out-of-range-basics.html

        * html/DateInputType.cpp:
        (WebCore::DateInputType::createStepRange):
        * html/DateTimeInputType.cpp:
        (WebCore::DateTimeInputType::createStepRange):
        * html/DateTimeLocalInputType.cpp:
        (WebCore::DateTimeLocalInputType::createStepRange):
        * html/InputType.cpp:
        (WebCore::InputType::isInRange):
        (WebCore::InputType::isOutOfRange):
        Notice the isEmpty() shortcut.
        A value can only overflow/underflow if it is not empty.

        * html/MonthInputType.cpp:
        (WebCore::MonthInputType::createStepRange):
        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::createStepRange):
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::createStepRange):
        * html/StepRange.cpp:
        (WebCore::StepRange::StepRange):
        * html/StepRange.h:
        (WebCore::StepRange::hasRangeLimitations):
        * html/WeekInputType.cpp:
        (WebCore::WeekInputType::createStepRange):

2016-06-16  Anders Carlsson  <andersca@apple.com>

        Fix macOS Sierra build
        https://bugs.webkit.org/show_bug.cgi?id=158849

        Reviewed by Tim Horton.

        Add WebCore:: qualifiers for IOSurface, to avoid conflicts with the IOSurface Objective-C class.
        
        Also, add an asLayerContents() getter that will return an id that's suitable for setting 
        as the contents of a CALayer.

        * platform/graphics/cocoa/IOSurface.h:
        * platform/graphics/cocoa/IOSurface.mm:

2016-06-16  Andreas Kling  <akling@apple.com>

        REGRESSION(r196217): 3% JSBench regression on iPhone 5.
        <https://webkit.org/b/158848>
        <rdar://problem/26609622>

        Unreviewed rollout.

        Don't jettison linked code on every top-level navigation as that was hurting JSBench on iPhone 5.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):

2016-06-16  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Check type of this in RTCPeerConnection JS built-in functions
        https://bugs.webkit.org/show_bug.cgi?id=151303

        Reviewed by Youenn Fablet.

        Check type of 'this' in RTCPeerConnection JS built-in functions.

        Test: fast/mediastream/RTCPeerConnection-js-built-ins-check-this.html

        * Modules/mediastream/RTCPeerConnection.js:
        (createOffer):
        (createAnswer):
        (setLocalDescription):
        (setRemoteDescription):
        (addIceCandidate):
        (getStats):
        Reject if 'this' isn't of type RTCPeerConnection.
        * Modules/mediastream/RTCPeerConnectionInternals.js:
        (isRTCPeerConnection):
        Add helper function to perform type check. Needs further robustifying.

2016-06-16  Myles C. Maxfield  <mmaxfield@apple.com>

        Sporadic crash in HashTableAddResult following CSSValuePool::createFontFamilyValue
        https://bugs.webkit.org/show_bug.cgi?id=158297

        Reviewed by Darin Adler.

        In an effort to reduce the flash of unstyled content, we force all elements
        to have display: none during an external stylesheet load. We do this by
        ignoring the CSS cascade and forcing all elements to have a placeholder style
        which hardcodes display: none. (This is necessary to make elements created by
        script during the stylesheet load not flash.)

        This style is exposed to web content via getComputedStyle(), which means it
        needs to maintain the invariant that font-families can never be null strings.
        We enforce this by forcing the font-family to be the standard font name.

        Test: fast/text/placeholder-renderstyle-null-font.html

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::ensurePlaceholderStyle):

2016-06-16  Chris Dumez  <cdumez@apple.com>

        Avoid some temporary String allocations for common HTTP headers in ResourceResponse::platformLazyInit()
        https://bugs.webkit.org/show_bug.cgi?id=158827

        Reviewed by Darin Adler.

        Add a HTTPHeaderMap::set() overload taking in a CFStringRef. The
        implementation has a fast path which gets the internal characters
        of the CFStringRef when possible and constructs a StringView for
        it in order to call findHTTPHeaderName(). As a result, we avoid
        allocating a temporary String when findHTTPHeaderName() succeeds.

        This new HTTPHeaderMap::set() overload is called from both the
        CF and Cocoa implementations of ResourceResponse::platformLazyInit().

        I have confirmed locally on both Mac and iOS that the fast path
        is used ~93% of the time. CFStringGetCStringPtr() returns null in
        rare cases, causing the regular code path to be used.

        * platform/network/HTTPHeaderMap.cpp:
        (WebCore::HTTPHeaderMap::set):
        * platform/network/HTTPHeaderMap.h:

2016-06-15  Zalan Bujtas  <zalan@apple.com>

        Decouple the percent height and positioned descendants maps.
        https://bugs.webkit.org/show_bug.cgi?id=158773

        Reviewed by David Hyatt and Chris Dumez.

        We track renderers with percent height across multiple containers using
        HashMap<const RenderBox*, std::unique_ptr<HashSet<const RenderBlock*>>>.
        We also use the same data structure to track positioned descendants.
        However a positioned renderer can have only one containing block so tracking it
        with a 1:many type is defective.
        It allows multiple inserts for positioned descendants, which could lead to
        inconsistent layout state as the rendering logic expects these type of renderers
        with only one containing block.
        This patch decouples percent height and positioned tracking by introducing
        the PositionedDescendantsMap class. This class is responsible for tracking
        the positioned descendants inbetween layouts.

        No change in functionality.

        Tests: fast/block/positioning/change-containing-block-for-absolute-positioned.html
               fast/block/positioning/change-containing-block-for-fixed-positioned.html

        * rendering/RenderBlock.cpp:
        (WebCore::insertIntoTrackedRendererMaps):
        (WebCore::removeFromTrackedRendererMaps):
        (WebCore::PositionedDescendantsMap::addDescendant): Add more defensive ASSERT_NOT_REACHED
        to the double insert branch when webkit.org/b/158772 gets fixed.
        (WebCore::PositionedDescendantsMap::removeDescendant):
        (WebCore::PositionedDescendantsMap::removeContainingBlock):
        (WebCore::PositionedDescendantsMap::positionedRenderers):
        (WebCore::positionedDescendantsMap):
        (WebCore::removeBlockFromPercentageDescendantAndContainerMaps):
        (WebCore::RenderBlock::~RenderBlock):
        (WebCore::RenderBlock::positionedObjects):
        (WebCore::RenderBlock::insertPositionedObject):
        (WebCore::RenderBlock::removePositionedObject):
        (WebCore::RenderBlock::addPercentHeightDescendant):
        (WebCore::RenderBlock::removePercentHeightDescendant):
        (WebCore::RenderBlock::percentHeightDescendants):
        (WebCore::RenderBlock::checkPositionedObjectsNeedLayout):
        (WebCore::removeBlockFromDescendantAndContainerMaps): Deleted.
        * rendering/RenderBlock.h:

2016-06-15  David Kilzer  <ddkilzer@apple.com>

        Move SoftLinking.h to platform/cococa from platform/mac
        <https://webkit.org/b/158825>

        Reviewed by Andy Estes.

        * PlatformMac.cmake: Update for new directory.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * platform/cocoa/SoftLinking.h: Renamed from Source/WebCore/platform/mac/SoftLinking.h.

2016-06-15  Chris Dumez  <cdumez@apple.com>

        [Cocoa] Clean up / optimize ResourceResponse::platformLazyInit(InitLevel)
        https://bugs.webkit.org/show_bug.cgi?id=158809

        Reviewed by Darin Adler.

        Clean up / optimize ResourceResponse::platformLazyInit(InitLevel).

        * platform/network/HTTPParsers.cpp:
        (WebCore::extractReasonPhraseFromHTTPStatusLine):
        * platform/network/HTTPParsers.h:
        Have extractReasonPhraseFromHTTPStatusLine() return an AtomicString as the
        Reason is stored as an AtomicString on ResourceResponse. Have the
        implementation use StringView::subString()::toAtomicString().

        * platform/network/cocoa/ResourceResponseCocoa.mm:
        (WebCore::stripLeadingAndTrailingDoubleQuote):
        Move the stripLeadingAndTrailingDoubleQuote logic from platformLazyInit()
        to its own function. Have it use StringView::subString()::toAtomicString()
        to avoid unnecessarily atomizing the textEncodingName that has surrounding
        double-quotes.

        (WebCore::initializeHTTPHeaders):
        Move HTTP headers initialization to its own function for clarity.

        (WebCore::extractHTTPStatusText):
        Move HTTP status Text extraction to its own function for clarity.

        (WebCore::ResourceResponse::platformLazyInit):
        - The function is streamlined a bit because most of the logic was moved
          into separate functions.
        - Drop unnecessary (initLevel >= CommonFieldsOnly) check in the first
          if case and replace with an assertion. This function is always called
          with CommonFieldsOnly or above (AllFields).
        - Drop unnecessary (m_initLevel < AllFields) check in the second if
          case as this is always true. If not, we would have returned early
          at the beginning of the function when checking
          m_initLevel >= initLevel.
        - Use AutodrainedPool instead of NSAutoreleasePool for convenience and have
          only 1 pool instead of 2.
        - Drop unnecessary copyNSURLResponseStatusLine() function and call directly
          CFHTTPMessageCopyResponseStatusLine() since we already have a
          CFHTTPMessageRef at the call site.

2016-06-15  Tim Horton  <timothy_horton@apple.com>

        <attachment> elements jump around a lot around when subtitle text changes slightly
        https://bugs.webkit.org/show_bug.cgi?id=158818
        <rdar://problem/24450270>

        Reviewed by Simon Fraser.

        Test: fast/attachment/attachment-subtitle-resize.html

        * rendering/RenderAttachment.cpp:
        (WebCore::RenderAttachment::layout):
        * rendering/RenderAttachment.h:
        * rendering/RenderThemeMac.mm:
        (WebCore::AttachmentLayout::AttachmentLayout):
        (WebCore::RenderThemeMac::paintAttachment):
        In order to avoid changes to the centered subtitle text causing the whole
        attachment to bounce around a lot, make it so that attachment width can only
        increase, never decrease, and round the subtitle's width up to the nearest
        increment of 10px when determining its affect on the whole element's width.
        Also, center the attachment in its element, instead of left-aligning it,
        so that the extra width we may have is evenly distributed between the two sides.

2016-06-15  Ryan Haddad  <ryanhaddad@apple.com>

        Reset bindings test results after r202105

        Unreviewed test gardening.

        * bindings/scripts/test/JS/JSTestObj.cpp:

2016-06-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: (Refactor) Align the structure of RTCPeerConnection.idl with the header file
        https://bugs.webkit.org/show_bug.cgi?id=158779

        Reviewed by Eric Carlson.

        Restructure RTCPeerConnection.idl to make it easer to read and extend in the future.

        No change in behavior.

        * Modules/mediastream/RTCPeerConnection.idl:

2016-06-15  Chris Dumez  <cdumez@apple.com>

        Drop some unnecessary header includes
        https://bugs.webkit.org/show_bug.cgi?id=158788

        Reviewed by Alexey Proskuryakov.

        Drop some unnecessary header includes in headers to speed up build time.

        * Modules/encryptedmedia/MediaKeySession.cpp:
        * Modules/gamepad/GamepadManager.cpp:
        * Modules/indexeddb/IDBDatabase.cpp:
        * Modules/indexeddb/IDBOpenDBRequest.cpp:
        * Modules/indexeddb/IDBRequest.cpp:
        * Modules/indexeddb/IDBTransaction.cpp:
        * Modules/mediasource/MediaSource.cpp:
        * Modules/mediasource/SourceBuffer.cpp:
        * Modules/mediasource/SourceBufferList.cpp:
        * Modules/mediastream/MediaStream.cpp:
        * Modules/mediastream/MediaStreamTrack.cpp:
        * Modules/speech/SpeechSynthesis.cpp:
        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        * Modules/webaudio/ScriptProcessorNode.cpp:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * dom/CharacterData.cpp:
        * dom/ContainerNode.cpp:
        * dom/DOMNamedFlowCollection.cpp:
        * dom/DeviceMotionController.cpp:
        * dom/DeviceOrientationController.cpp:
        * dom/Document.cpp:
        * dom/Document.h:
        * dom/DocumentEventQueue.cpp:
        * dom/DocumentOrderedMap.h:
        * dom/Element.cpp:
        * dom/Event.cpp:
        * dom/EventDispatcher.cpp:
        * dom/EventTarget.cpp:
        * dom/EventTarget.h:
        * dom/KeyboardEvent.cpp:
        * dom/MessageEvent.cpp:
        * dom/MessagePort.cpp:
        * dom/ScriptElement.cpp:
        * dom/ScriptExecutionContext.cpp:
        * dom/ScriptExecutionContext.h:
        * dom/SecurityContext.h:
        * dom/SimulatedClick.cpp:
        * dom/TextEvent.cpp:
        * dom/WebKitNamedFlow.cpp:
        * editing/FrameSelection.cpp:
        * fileapi/FileReader.cpp:
        * html/HTMLLinkElement.cpp:
        * html/HTMLPlugInImageElement.cpp:
        * html/HTMLStyleElement.cpp:
        * html/HTMLSummaryElement.cpp:
        * html/HTMLTrackElement.cpp:
        * html/HTMLVideoElement.cpp:
        * html/InputType.cpp:
        * html/MediaController.cpp:
        * html/TextFieldInputType.cpp:
        * html/canvas/WebGLRenderingContextBase.cpp:
        * html/parser/HTMLScriptRunner.cpp:
        * html/shadow/MediaControlElementTypes.cpp:
        * html/shadow/MediaControls.cpp:
        * html/shadow/MediaControlsApple.cpp:
        * html/shadow/SliderThumbElement.cpp:
        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
        * inspector/InspectorIndexedDBAgent.cpp:
        * loader/DocumentLoader.cpp:
        * loader/ImageLoader.cpp:
        * loader/PolicyChecker.cpp:
        * mathml/MathMLSelectElement.cpp:
        * page/DOMWindow.h:
        * page/EventSource.cpp:
        * page/FrameView.cpp:
        * page/Performance.cpp:
        * page/csp/ContentSecurityPolicy.cpp:
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        * platform/network/HTTPHeaderMap.h:
        * platform/network/ResourceHandle.cpp:
        * rendering/RenderEmbeddedObject.cpp:
        * rendering/RenderSnapshottedPlugIn.cpp:
        * svg/SVGSVGElement.cpp:
        * svg/SVGUseElement.cpp:
        * svg/animation/SVGSMILElement.cpp:
        * workers/WorkerGlobalScope.h:
        * xml/XMLHttpRequest.cpp:
        * xml/XMLHttpRequestProgressEventThrottle.cpp:
        * xml/XMLHttpRequestUpload.cpp:

2016-06-15  Antti Koivisto  <antti@apple.com>

        GoogleMaps transit schedule explorer comes up blank initially
        https://bugs.webkit.org/show_bug.cgi?id=158803
        rdar://problem/25818080

        Reviewed by Andreas Kling.

        In case we had something like

        .foo bar { ... }

        and later a new stylesheet was added dynamically that contained

        .foo baz { ... }

        we would fail to add the new rules to the descendant invalidation rule sets for ".foo". This could
        cause some style invalidations to be missed.

        * css/DocumentRuleSets.cpp:
        (WebCore::DocumentRuleSets::collectFeatures):

        Reset the ancestorClassRules and ancestorAttributeRulesForHTML rule set caches when new style sheets
        are added (==collectFeatures is called).

2016-06-15  Javier Fernandez  <jfernandez@igalia.com>

        [css-sizing] Item borders are missing with 'min-width:-webkit-fill-available' and zero available width
        https://bugs.webkit.org/show_bug.cgi?id=158258

        Reviewed by Darin Adler.

        The "fill-available" size is defined as the containing block's size less
        the box's border and padding size. However, when used for min-width we
        should ensure we don't get negative values as result of logical width
        computation.

        http://www.w3.org/TR/css-sizing-3/#fill-available-sizing

        This patch ensure fill-available value computed value will be always
        greater than box's boder and padding width.

        Test: fast/css-intrinsic-dimensions/fill-available-with-zero-width.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeIntrinsicLogicalWidthUsing):

2016-06-15  Alex Christensen  <achristensen@webkit.org>

        Fix 2d canvas transform after r192900
        https://bugs.webkit.org/show_bug.cgi?id=158725
        rdar://problem/26774230

        Reviewed by Dean Jackson.

        Test: fast/canvas/canvas-transform-inverse.html

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::transform):
        r192900 was intended to have no change in behavior, but I made a typo.
        We need to apply the inverse of the original transform to the path to be correct.
        This affects transforms applied to the canvas during the creation of a path.

2016-06-15  Eric Carlson  <eric.carlson@apple.com>

        [iOS] Make HTMLMediaElement.muted mutable
        https://bugs.webkit.org/show_bug.cgi?id=158787
        <rdar://problem/24452567>

        Reviewed by Dean Jackson.

        Tests: media/audio-playback-restriction-removed-muted.html
               media/audio-playback-restriction-removed-track-enabled.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::audioTrackEnabledChanged): Remove most behavior restrictions if
          the track state was changed as a result of a user gesture.
        (WebCore::HTMLMediaElement::setMuted): Ditto.
        (WebCore::HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture): Add mask 
          parameter so caller can choose which restrictions are removed.
        * html/HTMLMediaElement.h:

        * html/MediaElementSession.cpp:
        (WebCore::restrictionName): Drive-by fix: remove duplicate label.
        * html/MediaElementSession.h:

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer): Set muted on AVPlayer if setMuted
          was called before the player was created.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVolume): Drive-by fix: return early if there
          is no AVPlayer, not if we won't have metadata yet.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setMuted): New.

2016-06-15  Romain Bellessort  <romain.bellessort@crf.canon.fr>

        Enabling Shadow DOM for all platforms
        https://bugs.webkit.org/show_bug.cgi?id=158738

        Reviewed by Ryosuke Niwa.

        No new tests (no new behavior to be tested).

        Removed Shadow DOM from options (enabled by default)
        (comprises removal of corresponding preprocessor directives)

        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.make:
        * bindings/generic/RuntimeEnabledFeatures.h:
        * bindings/js/JSDocumentFragmentCustom.cpp:
        * bindings/js/JSNodeCustom.cpp:
        * css/CSSGrammar.y.in:
        * css/CSSParser.cpp:
        * css/CSSParserValues.cpp:
        * css/CSSParserValues.h:
        * css/CSSSelector.cpp:
        * css/CSSSelector.h:
        * css/ElementRuleCollector.cpp:
        * css/ElementRuleCollector.h:
        * css/RuleSet.cpp:
        * css/RuleSet.h:
        * css/SelectorChecker.cpp:
        * css/SelectorChecker.h:
        * css/SelectorPseudoClassAndCompatibilityElementMap.in:
        * css/StyleResolver.cpp:
        * cssjit/SelectorCompiler.cpp:
        * dom/ComposedTreeAncestorIterator.h:
        * dom/ComposedTreeIterator.cpp:
        * dom/ComposedTreeIterator.h:
        * dom/ContainerNode.cpp:
        * dom/Document.cpp:
        * dom/Document.h:
        * dom/Element.cpp:
        * dom/Element.h:
        * dom/Element.idl:
        * dom/Event.idl:
        * dom/EventPath.cpp:
        * dom/Node.cpp:
        * dom/Node.h:
        * dom/NonDocumentTypeChildNode.idl:
        * dom/ShadowRoot.cpp:
        * dom/ShadowRoot.h:
        * dom/ShadowRoot.idl:
        * dom/SlotAssignment.cpp:
        * dom/SlotAssignment.h:
        * html/HTMLSlotElement.cpp:
        * html/HTMLSlotElement.h:
        * html/HTMLSlotElement.idl:
        * html/HTMLTagNames.in:
        * page/FocusController.cpp:
        * style/StyleSharingResolver.cpp:
        * style/StyleTreeResolver.cpp:

2016-06-15  Andreas Kling  <akling@apple.com>

        [Cocoa] Add two notify listeners for poking the garbage collector.
        <https://webkit.org/b/158783>

        Reviewed by Antti Koivisto.

        Add two new notify listeners:

        - com.apple.WebKit.fullGC

            Trigger a full garbage collection in the main WebCore VM immediately.

        - com.apple.WebKit.deleteAllCode

            Throw away all of JSC's linked and unlinked code, and do a full GC.

        These will make it easier to diagnose memory growth issues by having a lever that
        eliminates many of the large object graphs without going after behavior-changing things
        like the memory cache.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::platformInitialize):
        * platform/MemoryPressureHandler.h:
        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        (WebCore::MemoryPressureHandler::platformInitialize):

2016-06-15  Antti Koivisto  <antti@apple.com>

        Vary:Cookie validation doesn't work in private browsing
        https://bugs.webkit.org/show_bug.cgi?id=158616
        <rdar://problem/26755067>

        Reviewed by Andreas Kling.

        There wasn't a way to get cookie based on SessionID from WebCore.

        * platform/CookiesStrategy.h:

            Add a cookie retrival function that takes SessionID instead of NetworkStorageSession.

        * platform/network/CacheValidation.cpp:
        (WebCore::headerValueForVary):

            Use it.

        (WebCore::verifyVaryingRequestHeaders):

2016-06-15  Per Arne Vollan  <pvollan@apple.com>

        [Win] The test accessibility/selected-text-range-aria-elements.html is failing.
        https://bugs.webkit.org/show_bug.cgi?id=158732

        Reviewed by Brent Fulgham.

        Implement support for getting selected text range.

        * accessibility/win/AccessibilityObjectWrapperWin.cpp:
        (WebCore::AccessibilityObjectWrapper::accessibilityAttributeValue):

2016-06-14  Myles C. Maxfield  <mmaxfield@apple.com>

        Addressing post-review comments after r201971
        https://bugs.webkit.org/show_bug.cgi?id=158450

        Unreviewed.

        * css/CSSFontFaceSet.cpp:
        (WebCore::CSSFontFaceSet::add):
        (WebCore::CSSFontFaceSet::remove):

2016-06-14  Myles C. Maxfield  <mmaxfield@apple.com>

        Honor bidi unicode codepoints
        https://bugs.webkit.org/show_bug.cgi?id=149170
        <rdar://problem/26527378>

        Reviewed by Simon Fraser.

        BidiResolver doesn't have any concept of isolate Unicode code points, so produces
        unexpected output when they are present. Fix by considering such code points as
        whitespace in the bidi algorithm. This is a stop-gap measure until we can support
        the codepoints fully in our Bidi algorithm.

        Test: fast/text/isolate-ignore.html

        * platform/graphics/Font.cpp:
        (WebCore::createAndFillGlyphPage):
        * platform/text/BidiResolver.h:
        (WebCore::Subclass>::createBidiRunsForLine):

2016-06-14  Antoine Quint  <graouts@apple.com>

        [iOS] Play glyph is pixelated when the page zoom is large
        https://bugs.webkit.org/show_bug.cgi?id=158770
        <rdar://problem/26092124>

        Reviewed by Dean Jackson.

        Use the same technique that we use to scale the video controls by using a combination
        of CSS "zoom" and "transform" properties to have the video play glyph scaled at its
        native size regardless of page zoom.

        * Modules/mediacontrols/mediaControlsiOS.js:
        (ControllerIOS.prototype.set pageScaleFactor):

2016-06-14  Chris Dumez  <cdumez@apple.com>

        Regression(r201534): Compile time greatly regressed
        https://bugs.webkit.org/show_bug.cgi?id=158765
        <rdar://problem/26587342>

        Reviewed by Darin Adler.

        Compile time greatly regressed by r201534 due to Document.h now including
        TextAutoSizing.h. Move the TextAutoSizingTraits back to Document.h to
        restore pre-r201534 behavior.

        * WebCore.xcodeproj/project.pbxproj:
        * dom/Document.cpp:
        (WebCore::TextAutoSizingTraits::constructDeletedValue):
        (WebCore::TextAutoSizingTraits::isDeletedValue):
        * dom/Document.h:
        * rendering/TextAutoSizing.h:
        (WebCore::TextAutoSizingTraits::constructDeletedValue): Deleted.
        (WebCore::TextAutoSizingTraits::isDeletedValue): Deleted.

2016-06-14  Antoine Quint  <graouts@apple.com>

        Inline media controls cut off PiP and fullscreen buttons on cnn.com
        https://bugs.webkit.org/show_bug.cgi?id=158766
        <rdar://problem/24175161>

        Reviewed by Dean Jackson.

        The display of the picture-in-picture and fullscreen buttons are dependent on the availability
        of video tracks through a call to hasVideo(). We need to ensure that the display properties of
        both those buttons are updated when the number of video tracks has changed since the controls
        may be populated prior to the availability of video tracks.

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.updateHasVideo):

2016-06-14  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Rename Timeline.setAutoCaptureInstruments to Timeline.setInstruments
        https://bugs.webkit.org/show_bug.cgi?id=158762

        Reviewed by Timothy Hatcher.

        Test: inspector/timeline/setInstruments-errors.html

        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::willDestroyFrontendAndBackend):
        (WebCore::InspectorTimelineAgent::setInstruments):
        (WebCore::InspectorTimelineAgent::mainFrameStartedLoading):
        (WebCore::InspectorTimelineAgent::setAutoCaptureInstruments): Deleted.
        * inspector/InspectorTimelineAgent.h:

2016-06-14  Dean Jackson  <dino@apple.com>

        decompose4 return value is unchecked, leading to potentially uninitialized data.
        https://bugs.webkit.org/show_bug.cgi?id=158761
        <rdar://problem/17526268>

        Reviewed by Simon Fraser.

        WebCore::decompose4 could return early without initializing data.
        I now initialize it, but I also started checking the return
        value at all the call sites to make sure everything is sensible.

        Test: transforms/undecomposable.html

        * platform/graphics/transforms/PerspectiveTransformOperation.cpp:
        (WebCore::PerspectiveTransformOperation::blend):
        * platform/graphics/transforms/RotateTransformOperation.cpp:
        (WebCore::RotateTransformOperation::blend):
        * platform/graphics/transforms/TransformationMatrix.cpp:
        (WebCore::decompose4):
        (WebCore::TransformationMatrix::blend4):
        * platform/graphics/transforms/TransformationMatrix.h:

2016-06-14  Benjamin Poulain  <bpoulain@apple.com>

        Add the unprefixed version of the pseudo element ::placeholder
        https://bugs.webkit.org/show_bug.cgi?id=158653

        Reviewed by Dean Jackson.

        Test: fast/forms/placeholder-pseudo-element-with-webkit-prefix.html

        The pseudo element ::-webkit-input-placeholder is stupidly popular
        which forces other engines to support this exact name.

        The pseudo-element spec provides a new standard name we can adopt
        to drop the prefix: https://drafts.csswg.org/css-pseudo-4/#placeholder-pseudo

        This patch does just that, make ::placeholder the standard name to select
        the placeholder element in the shadow dom of input elements.

        Unlike pseudo classes, we did not have any support for prefixes and aliasing.
        I want to keep the absurdly efficient matching we currently use for styling
        because style updates are more common than stylesheet updates.
        With that constraint in mind, the value of CSSSelector has to be the unprefixed
        version for both forms of input.

        This leaves us with the problem of displaying the CSSSelector for CSSOM.
        To differentiate the legacy form from the standard form, I added
        a new type of PseudoElement: PseudoElementWebKitCustomLegacyPrefixed.
        When parsing, PseudoElementWebKitCustomLegacyPrefixed let us replace
        the original value "-webkit-input-placeholder" by the standard value.
        When creating the selectorText for CSSOM, PseudoElementWebKitCustomLegacyPrefixed
        let us replace the standard for by the legacy form.

        * css/CSSParserValues.cpp:
        (WebCore::CSSParserSelector::parsePseudoElementSelector):
        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::pseudoId):
        (WebCore::CSSSelector::selectorText):
        * css/CSSSelector.h:
        (WebCore::CSSSelector::isCustomPseudoElement):
        (WebCore::CSSSelector::isWebKitCustomPseudoElement):
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::matchRecursively):
        * css/SelectorPseudoElementTypeMap.in:
        * css/html.css:
        (::placeholder):
        (input::placeholder, isindex::placeholder):
        (textarea::placeholder):
        (::-webkit-input-placeholder): Deleted.
        (input::-webkit-input-placeholder, isindex::-webkit-input-placeholder): Deleted.
        (textarea::-webkit-input-placeholder): Deleted.
        * features.json:
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::TextControlPlaceholderElement::TextControlPlaceholderElement):

2016-06-14  Doug Russell  <d_russell@apple.com>

        AX: Form label text should be exposed as static text if it contains only static text
        https://bugs.webkit.org/show_bug.cgi?id=158634

        Reviewed by Chris Fleizach.

        Use AccessibilityLabel to represent HTMLLabelElement to assistive technology.
        AccessibilityLabel::containsOnlyStaticText() searches label subtree to evaluate 
        if all children are static text.
        AccessibilityLabel::stringValue() consults containsOnlyStaticText() and returns
        textUnderElement() if true.
        WebAccessibilityObjectWrapperMac consults containsOnlyStaticText() and substitutes
        StaticTextRole for LabelRole if true.
        Cache containsOnlyStaticText() in the common case when updating children.

        Tests: accessibility/mac/label-element-all-text-string-value.html
               accessibility/mac/label-element-with-link-string-value.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * accessibility/AXObjectCache.cpp:
        (WebCore::createFromRenderer):
        * accessibility/AccessibilityAllInOne.cpp:
        * accessibility/AccessibilityLabel.cpp: Added.
        (WebCore::AccessibilityLabel::AccessibilityLabel):
        (WebCore::AccessibilityLabel::~AccessibilityLabel):
        (WebCore::AccessibilityLabel::create):
        (WebCore::AccessibilityLabel::computeAccessibilityIsIgnored):
        (WebCore::AccessibilityLabel::stringValue):
        (WebCore::childrenContainOnlyStaticText):
        (WebCore::AccessibilityLabel::containsOnlyStaticText):
        (WebCore::AccessibilityLabel::updateChildrenIfNecessary):
        (WebCore::AccessibilityLabel::clearChildren):
        (WebCore::AccessibilityLabel::insertChild):
        * accessibility/AccessibilityLabel.h: Added.
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::isLabel):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper role]):

2016-06-14  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r202057.
        https://bugs.webkit.org/show_bug.cgi?id=158749

        This change broke the Windows build. (Requested by ryanhaddad
        on #webkit).

        Reverted changeset:

        "Honor bidi unicode codepoints"
        https://bugs.webkit.org/show_bug.cgi?id=149170
        http://trac.webkit.org/changeset/202057

2016-06-14  Myles C. Maxfield  <mmaxfield@apple.com>

        Honor bidi unicode codepoints
        https://bugs.webkit.org/show_bug.cgi?id=149170
        <rdar://problem/26527378>

        Reviewed by Simon Fraser.

        BidiResolver doesn't have any concept of isolate Unicode code points, so produces
        unexpected output when they are present. Fix by considering such code points as
        whitespace in the bidi algorithm. This is a stop-gap measure until we can support
        the codepoints fully in our Bidi algorithm.

        Test: fast/text/isolate-ignore.html

        * platform/graphics/Font.cpp:
        (WebCore::createAndFillGlyphPage):
        * platform/text/BidiResolver.h:
        (WebCore::Subclass>::createBidiRunsForLine):

2016-06-14  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r200455.
        https://bugs.webkit.org/show_bug.cgi?id=158740

        hangs twitter/facebook (Requested by mcatanzaro on #webkit).

        Reverted changeset:

        "[GStreamer] Adaptive streaming issues"
        https://bugs.webkit.org/show_bug.cgi?id=144040
        http://trac.webkit.org/changeset/200455

2016-06-14  Nael Ouedraogo  <nael.ouedraogo@crf.canon.fr>

        WebRTC: RTCPeerConnection::addTrack() should throw InvalidAccessError instead of InvalidModificationError.
        https://bugs.webkit.org/show_bug.cgi?id=158735

        Reviewed by Eric Carlson.

        Throw InvalidAccessError instead of InvalidModificationError when track already exists in connection's
        set of senders as per specification (https://w3c.github.io/webrtc-pc/#dom-rtcpeerconnection-addtrack).

        Updated existing test results: fast/mediastream/RTCPeerConnection-add-removeTrack-expected.txt

        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::addTrack):

2016-06-14  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Imlement MediaEndpointPeerConnection::addIceCandidate()
        https://bugs.webkit.org/show_bug.cgi?id=158690

        Reviewed by Eric Carlson.

        Implement MediaEndpointPeerConnection::addIceCandidate() that is the MediaEndpoint
        implementation of RTCPeerConnection.addIceCandidate() [1].

        [1] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html#dom-peerconnection-addicecandidate

        Test: fast/mediastream/RTCPeerConnection-addIceCandidate.html

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::addIceCandidate):
        (WebCore::MediaEndpointPeerConnection::addIceCandidateTask):
        Implemented.
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * platform/mediastream/MediaEndpoint.h:
        Use mid instead of mdescIndex to identify the target media description in the backend.
        * platform/mock/MockMediaEndpoint.cpp:
        Update mock method signature accordingly.
        (WebCore::MockMediaEndpoint::addRemoteCandidate):
        * platform/mock/MockMediaEndpoint.h:

2016-06-14  Zalan Bujtas  <zalan@apple.com>

        Make RenderBlock::insertInto/RemoveFromTrackedRendererMaps functions static.
        https://bugs.webkit.org/show_bug.cgi?id=158722

        Reviewed by Simon Fraser.

        These functions manipulate static tracker hashmaps. They don't need to be on RenderBlock.
        This is also in preparation for decoupling positioned descendant tracking from descendent percentage height handling.
        (gPositionedDescendantsMap and gPercentHeightDescendantsMap) 

        No change in functionality.

        * rendering/RenderBlock.cpp:
        (WebCore::insertIntoTrackedRendererMaps):
        (WebCore::removeFromTrackedRendererMaps):
        (WebCore::removeBlockFromDescendantAndContainerMaps):
        (WebCore::RenderBlock::insertPositionedObject):
        (WebCore::RenderBlock::addPercentHeightDescendant):
        (WebCore::RenderBlock::insertIntoTrackedRendererMaps): Deleted.
        (WebCore::RenderBlock::removeFromTrackedRendererMaps): Deleted.
        * rendering/RenderBlock.h:

2016-06-14  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Add media setup test where media is set up in one direction at a time
        https://bugs.webkit.org/show_bug.cgi?id=158691

        Reviewed by Eric Carlson.

        Add test for setting up media in one direction at a time. This requires a change in sdp.js
        to allow an SDP that doesn't contain a stream id or track id (representing
        a track being sent). In this test, the first answer doesn't contain any sending media.

        Test: fast/mediastream/RTCPeerConnection-media-setup-two-dialogs.html

        * Modules/mediastream/sdp.js:

2016-06-14  Chris Dumez  <cdumez@apple.com>

        [Cocoa] Avoid extra copy of headers dictionary in ResourceResponse::platformLazyInit()
        https://bugs.webkit.org/show_bug.cgi?id=158717

        Reviewed by Alex Christensen.

        Avoid extra copy of headers dictionary in ResourceResponse::platformLazyInit() by
        calling CFHTTPMessageCopyAllHeaderFields() instead of [NSURLResponse allHeaderFields].

        CFHTTPMessageCopyAllHeaderFields() creates only 1 copy while
        [NSURLResponse allHeaderFields] creates 2 (see <rdar://problem/26778863>).

        * platform/network/cocoa/ResourceResponseCocoa.mm:
        (WebCore::addToHTTPHeaderMap):
        (WebCore::ResourceResponse::platformLazyInit):

2016-06-14  David Kilzer  <ddkilzer@apple.com>

        REGRESSION (r151608): Leak of QTMovieLayer or AVPlayerLayer in -[WebVideoFullscreenController setVideoElement:]
        <https://webkit.org/b/158729>

        Reviewed by Eric Carlson.

        * platform/mac/WebVideoFullscreenController.mm:
        (-[WebVideoFullscreenController setVideoElement:]): Use
        RetainPtr<> to prevent leaks.
        * platform/mac/WebVideoFullscreenHUDWindowController.mm:
        Drive-by fix to remove unused <wtf/RetainPtr.h> import.

2016-06-14  Nael Ouedraogo  <nael.ouedraogo@crf.canon.fr>

        The vector of mediastreams should be passed via a reference to RTCPeerConnection::addTrack()
        https://bugs.webkit.org/show_bug.cgi?id=158701

        Pass vector of mediastreams by reference.

        Reviewed by Youenn Fablet.

        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::addTrack):
        * Modules/mediastream/RTCPeerConnection.h:

2016-06-14  Ryosuke Niwa  <rniwa@webkit.org>

        Crash inside firstPositionInNode in checkLoadCompleteForThisFrame
        https://bugs.webkit.org/show_bug.cgi?id=158724

        Reviewed by Alex Christensen.

        Added null checks for document and document element since they could be nullptr here.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):

2016-06-13  Gavin & Ellie Barraclough  <barraclough@apple.com>

        Remove hasStaticPropertyTable (part 3: JSLocation::putDelegate)
        https://bugs.webkit.org/show_bug.cgi?id=158431

        Unreviewed build fix.

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate):

2016-06-13  Gavin & Ellie Barraclough  <barraclough@apple.com>

        Remove hasStaticPropertyTable (part 4: JSHTMLDocument & JSStorage)
        https://bugs.webkit.org/show_bug.cgi?id=158431

        Reviewed by Chris Dumez.

        All uses of hasStaticPropertyTable flag generated by bindings are wrong.

        JSHTMLDocument & JSStorage contain a number of static_asserts claiming that
        various methods do not support static properties. These asserts were likely
        correct at the time they were added, as JSObject::getOwnPropertySlot and
        JSObject::deleteProperty did not support getting / deleting static value.
        This is no longer the case, and these asserts are now incorrect.

        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::getOwnPropertySlot):
        * bindings/js/JSStorageCustom.cpp:
        (WebCore::JSStorage::deleteProperty):
        (WebCore::JSStorage::deletePropertyByIndex):
        (WebCore::JSStorage::putDelegate):
            - remove incorrect static_asserts.

2016-06-13  Gavin & Ellie Barraclough  <barraclough@apple.com>

        Remove hasStaticPropertyTable (part 3: JSLocation::putDelegate)
        https://bugs.webkit.org/show_bug.cgi?id=158431

        Reviewed by Geoff Garen.

        All uses of hasStaticPropertyTable flag generated by bindings are wrong.

        JSLocation::putDelegate checks the static property table redundantly.

        In the case of same origin access, if the property is not in the static
        table the method will call JSObject::put and return true (indicating the
        delegate handled the put). If the property is in the static table, the
        method will return false (indicating the the delegate did not handle the
        access) - in which case the calling function will call JSObject::put.
        Checking for the property in the static table is redundant - same origin
        access does not require any special handling, and should just always
        return false & let the caller handle the put.

        In the case of cross origin access, if the property is not in the static
        table we return true (indicating the access was handled, and silently
        blocking it). If it is a static property, we check the name, and if the
        name is not 'href' we also return true, silently blocking. In the case
        that the name is 'href' we'll return false, indicating to the caller
        that the access was not handled by the delegate, resulting in it taking
        place. The additional check of the static table is redundant, since we
        only have special behaviour in the case of 'href'. (Moreover it is
        unnecesszarily fragile, since if we made a change such that 'href' was no
        longer implemented as a static property with would fail.)

        - for same origin, always return false.
        - for cross origin, return false for 'href', otherwise return true.

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate):
            - restructure & remove static table check.

2016-06-13  Gavin & Ellie Barraclough  <barraclough@apple.com>

        Remove hasStaticPropertyTable (part 2: JSPluginElement)
        https://bugs.webkit.org/show_bug.cgi?id=158431

        Reviewed by Chris Dumez.

        All uses of hasStaticPropertyTable flag generated by bindings are wrong.

        The check in pluginElementCustomGetOwnPropertySlot was somewhat dubious in the
        first place (for types with static properties it would give precedence to both
        static and also property storage properties; for types without static properties
        it would check neither - an odd asymetry in the case of values in the storage
        array, and was depending on an implementation detail that could change).

        This is all now redundant anyway. None of these types have static properties.
        All properties are now corretcly on the prototype (which is handled appropriately
        below). This is just dead code.

        * bindings/js/JSPluginElementFunctions.h:
        (WebCore::pluginElementCustomGetOwnPropertySlot):
            - remove dead code.

2016-06-13  Gavin & Ellie Barraclough  <barraclough@apple.com>

        Remove hasStaticPropertyTable (part 1: DOM bindings)
        https://bugs.webkit.org/show_bug.cgi?id=158431

        Reviewed by Chris Dumez.

        All uses of hasStaticPropertyTable flag generated by bindings are wrong.

        * bindings/js/JSDOMBinding.h:
        (WebCore::getStaticValueSlotEntryWithoutCaching): Deleted.
        (WebCore::getStaticValueSlotEntryWithoutCaching<JSDOMObject>): Deleted.
            - this method is not used anywhere.

2016-06-13  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Imlement MediaEndpointPeerConnection::replaceTrack()
        https://bugs.webkit.org/show_bug.cgi?id=158688

        Reviewed by Eric Carlson.

        Implement MediaEndpointPeerConnection::replaceTrack() that is the MediaEndpoint implementation
        of RTCRtpSender.replaceTrack() [1].

        [1] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html#dom-rtcrtpsender-replacetrack

        Updated fast/mediastream/RTCRtpSender-replaceTrack.html

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::replaceTrack):
        (WebCore::MediaEndpointPeerConnection::replaceTrackTask):
        Implemented.
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/mediastream/PeerConnectionBackend.h:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::replaceTrack):
        * Modules/mediastream/RTCPeerConnection.h:
        Move the MediaStreamTrack instance of sending a reference to it. This change is the main
        reason many files are touched by this change.
        * Modules/mediastream/RTCRtpSender.h:
        * Modules/mediastream/RTCRtpSender.idl:
        * platform/mediastream/MediaEndpoint.h:
        Use mid instead of mdescIndex to identify the media description in the backend.
        * platform/mock/MockMediaEndpoint.cpp:
        (WebCore::MockMediaEndpoint::replaceSendSource):
        * platform/mock/MockMediaEndpoint.h:

2016-06-13  Joseph Pecoraro  <pecoraro@apple.com>

        window.onerror should pass the ErrorEvent's 'error' property as the 5th argument to the event handler
        https://bugs.webkit.org/show_bug.cgi?id=55092
        <rdar://problem/25731279>

        Reviewed by Dean Jackson.

        This includes the actual Error in window.error / ErrorEvent:
        https://html.spec.whatwg.org/multipage/webappapis.html#the-errorevent-interface

        This is useful for scripts to be able to get an error stack
        from uncaught exceptions, by checking the error itself.

        Tests: fast/events/window-onerror17.html
               http/tests/security/cross-origin-script-error-event-redirected.html
               http/tests/security/cross-origin-script-error-event.html
               http/tests/security/script-crossorigin-error-event-information.html
               http/tests/security/script-no-crossorigin-error-event-should-be-sanitized.html
               userscripts/window-onerror-for-isolated-world-3.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        Add new custom error event file.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::reportException):
        Include the JSC::Exception when reporting exceptions, so the error value is available.
        
        * bindings/js/JSErrorEventCustom.cpp:
        (WebCore::JSErrorEvent::error):
        Sanitized access to the ErrorEvent's error property to prevent leaking objects
        across isolated world boundaries. This is like CustomEvent's data property.

        * bindings/js/JSErrorHandler.cpp:
        (WebCore::JSErrorHandler::handleEvent):
        * bindings/js/JSErrorHandler.h:
        Include the error object as the 4th argument to the window.onerror event handler.

        * dom/ScriptExecutionContext.cpp:
        (WebCore::ScriptExecutionContext::sanitizeScriptError):
        (WebCore::ScriptExecutionContext::reportException):
        (WebCore::ScriptExecutionContext::dispatchErrorEvent):
        * dom/ScriptExecutionContext.h:
        Include the error object in the ErrorEvent constructed when dispatching error events.

        * dom/ErrorEvent.cpp:
        (WebCore::ErrorEvent::ErrorEvent):
        (WebCore::ErrorEvent::sanitizedErrorValue):
        (WebCore::ErrorEvent::trySerializeError):
        * dom/ErrorEvent.h:
        * dom/ErrorEvent.idl:
        Include an any "error" property on the ErrorEvent, and allow it in initialization.

        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::evaluate):
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::postExceptionToWorkerObject):
        Within the Worker world, the error is included in the event.
        When re-dispatching the error on the world object in the world that spawned the
        Worker the event does not include an error object. This matches other browsers
        right now, but could be improved to have the same cross world serialization
        as isolated worlds have with the error data.

        * dom/CustomEvent.h:
        Remove unimplemented stale method.

2016-06-13  Dean Jackson  <dino@apple.com>

        SVG elements don't blend correctly into HTML
        https://bugs.webkit.org/show_bug.cgi?id=158718
        <rdar://problem/26782004>

        Reviewed by Antoine Quint.

        We were not creating any transparency layers for the root SVG nodes.
        This is ok if the SVG is the root document, because it is the backdrop.
        However, if it is inline SVG, it needs to apply the operation in
        order to composite into the document.

        Test: svg/css/mix-blend-mode-with-inline-svg.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::beginTransparencyLayers):

2016-06-13  Brady Eidson  <beidson@apple.com>

        storage/indexeddb/modern/leaks-1.html leaks the database connection handle.
        https://bugs.webkit.org/show_bug.cgi?id=158643

        Reviewed by Alex Christensen.

        Tested by changes to existing test.

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::hasPendingActivity):
        
        * dom/EventTarget.h:
        (WebCore::EventTarget::eventTargetData):
        (WebCore::EventTarget::hasEventListeners):


2016-06-13  Enrica Casucci  <enrica@apple.com>

        REGRESSION(r201956): Failure to initialize new internal settings produced random test failures in release.
        https://bugs.webkit.org/show_bug.cgi?id=158713
        rdar://26769957

        Reviewed by Simon Fraser.

        Failed to initialize the new member variable in both Settings and InternalSettings classes.

        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup):

2016-06-13  Chris Dumez  <cdumez@apple.com>

        Drop HipChat hack introduced in r197548
        https://bugs.webkit.org/show_bug.cgi?id=158711

        Reviewed by Geoffrey Garen.

        Drop HipChat hack introduced in r197548. This hack is no longer needed
        as the bug was fixed in HipChat since then:
        https://support.atlassian.com/servicedesk/customer/portal/32/HCP-7532

        I have confirmed locally that the latest version (4.0.12.665) is able
        to connect without the hack.

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate): Deleted.
        * platform/RuntimeApplicationChecks.h:
        * platform/RuntimeApplicationChecks.mm:
        (WebCore::MacApplication::isHipChat): Deleted.

2016-06-13  Chris Fleizach  <cfleizach@apple.com>

        AX: CrashTracer: com.apple.WebKit.WebContent at WebCore::AccessibilityRenderObject::remoteSVGRootElement const + 227
        https://bugs.webkit.org/show_bug.cgi?id=158685

        Reviewed by David Kilzer.

        Crash reports show a null access at a line that tries to dereference a pointer. 
        I still don't have a way to layout test this, as it seems tied to tear down of the main document.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::remoteSVGRootElement):

2016-06-13  Jeremy Jones  <jeremyj@apple.com>

        Use two video layer solution only on mac.
        https://bugs.webkit.org/show_bug.cgi?id=158705
        rdar://problem/26776360

        Reviewed by Jer Noble.

        Two video layer solution is only useful on the mac to prevent flicker, so don't do it elsewhere.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer):

2016-06-13  Jeremy Jones  <jeremyj@apple.com>

        Decrease PiP flicker by not removing window prematurely.
        https://bugs.webkit.org/show_bug.cgi?id=158436
        <rdar://problem/19052639>

        Reviewed by Darin Adler.

        UIWindow shouldn't be removed until cleanupFullscreen, so the video layer has a chance
        to be reparented in the DOM first.

        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (WebVideoFullscreenInterfaceAVKit::didStopPictureInPicture):

2016-06-13  Alex Christensen  <achristensen@webkit.org>

        Add WebSocketProvider stub
        https://bugs.webkit.org/show_bug.cgi?id=158702

        Reviewed by Brady Eidson.

        No new tests.  No change in behavior.

        * WebCore.xcodeproj/project.pbxproj:
        * dom/DocumentMarkerController.cpp:
        * dom/ScriptedAnimationController.cpp:
        * html/HTMLMediaElement.cpp:
        * html/MediaDocument.cpp:
        * html/shadow/MediaControlElements.cpp:
        * html/shadow/MediaControls.cpp:
        * html/shadow/MediaControls.h:
        * html/shadow/MediaControlsApple.cpp:
        * inspector/InspectorInstrumentation.cpp:
        * inspector/InspectorInstrumentation.h:
        * inspector/InspectorOverlay.cpp:
        (WebCore::InspectorOverlay::overlayPage):
        * loader/EmptyClients.h:
        * loader/FrameLoader.cpp:
        * loader/FrameLoader.h:
        * loader/appcache/ApplicationCacheHost.cpp:
        * loader/cache/CachedResource.cpp:
        * page/FrameView.cpp:
        * page/Page.cpp:
        (WebCore::Page::Page):
        * page/Page.h:
        (WebCore::Page::applicationCacheStorage):
        (WebCore::Page::databaseProvider):
        (WebCore::Page::socketProvider):
        (WebCore::Page::storageNamespaceProvider):
        * page/PageConfiguration.cpp:
        (WebCore::PageConfiguration::PageConfiguration):
        * page/PageConfiguration.h:
        * page/ResourceUsageOverlay.cpp:
        * page/SocketProvider.h: Added.
        (WebCore::SocketProvider::~SocketProvider):
        * page/cocoa/ResourceUsageOverlayCocoa.mm:
        * rendering/RenderElement.cpp:
        * rendering/RenderLayerBacking.cpp:
        * style/StyleResolveForDocument.cpp:
        * style/StyleTreeResolver.cpp:
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::dataChanged):
        * testing/MockPageOverlayClient.cpp:

2016-06-13  Brady Eidson  <beidson@apple.com>

        Crashes in WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTask.
        <rdar://problem/26768449> and https://bugs.webkit.org/show_bug.cgi?id=158696

        Reviewed by David Kilzer.

        No new tests (Covered by all existing tests in Gmalloc/ASAN configs).

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTask):
        (WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTaskReply):

2016-06-13  Brady Eidson  <beidson@apple.com>

        Modern IDB: IDBOpenDBRequest objects leak.
        https://bugs.webkit.org/show_bug.cgi?id=158694

        Reviewed by Alex Christensen.

        No new tests (Currently have no testing strategy for guaranteeing lifetime of WebCore DOM objects)

        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::completeOpenDBRequest): At this point we never need the
            request again, so remove it from the map.

2016-06-13  Chris Dumez  <cdumez@apple.com>

        Make sure HTTPHeaderMap gets a move constructor / assignment operator
        https://bugs.webkit.org/show_bug.cgi?id=158695
        <rdar://problem/26729511>

        Reviewed by Alex Christensen.

        Make sure HTTPHeaderMap gets a move constructor / assignment operator.
        It was not getting an implicit one because of its user-declared
        destructor. This patch drops the user-declared destructor so that
        HTTPHeaderMap now gets an implicit move constructor / assignment
        operator.

        Not having a move constructor / assignment operator is an issue because
        we rely on HTTPHeaderMap::isolatedCopy() / WTFMove() since r201623 to
        pass HTTPHeaderMap across thread.

        * platform/network/HTTPHeaderMap.cpp:
        (WebCore::HTTPHeaderMap::~HTTPHeaderMap): Deleted.
        * platform/network/HTTPHeaderMap.h:

2016-06-13  Nael Ouedraogo  <nael.ouedraogo@crf.canon.fr>

        Remove useless parameter from GenerateParametersCheck signature
        https://bugs.webkit.org/show_bug.cgi?id=158692

        Reviewed by Chris Dumez.

        Remove one parameter which is passed to GenerateParametersCheck
        but never used in the caller code.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        (GenerateParametersCheck):
        (GenerateConstructorDefinition):

2016-06-13  Nael Ouedraogo  <nael.ouedraogo@crf.canon.fr>

        Improve code generator for functions with variadic parameters
        https://bugs.webkit.org/show_bug.cgi?id=158529

        Reviewed by Darin Adler.

        JS bindings code of functions with variadic parameters is improved.

        Functions with variadic parameters are skipped for ObjC and GObject code generators.

        * bindings/scripts/CodeGeneratorGObject.pm:
        (SkipFunction): Skip functions with variadic parameters.
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck):
        * bindings/scripts/CodeGeneratorObjC.pm:
        (SkipFunction): Skip functions with variadic parameters.
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_any): Deleted.
        (webkit_dom_test_obj_attach_shadow_root): Deleted.
        (webkit_dom_test_obj_get_read_only_long_attr): Deleted.
        (webkit_dom_test_obj_get_read_only_string_attr): Deleted.
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod12):
        (WebCore::jsTestObjPrototypeFunctionVariadicStringMethod):
        (WebCore::jsTestObjPrototypeFunctionVariadicDoubleMethod):
        (WebCore::jsTestObjPrototypeFunctionVariadicNodeMethod):
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:

2016-06-12  Zalan Bujtas  <zalan@apple.com>

        Cleanup RenderBlock::removePositionedObjects
        https://bugs.webkit.org/show_bug.cgi?id=158670

        Reviewed by Simon Fraser.

        No change in functionality.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::insertPositionedObject):
        (WebCore::RenderBlock::removePositionedObject):
        (WebCore::RenderBlock::removePositionedObjects):
        * rendering/RenderBlock.h:

2016-06-12  Zalan Bujtas  <zalan@apple.com>

        Remove positioned descendants when RenderBlock is no longer a containing block.
        https://bugs.webkit.org/show_bug.cgi?id=158655
        <rdar://problem/26510032>

        Reviewed by Simon Fraser.

        Normally the RenderView is the containing block for fixed positioned renderers.
        However when a renderer acquires some transform related properties, it becomes the containing
        block for all the fixed positioned renderers in its descendant tree.
        When the last transform related property is removed, the renderer is no longer a containing block
        and we need to remove all these positioned renderers from the descendant tracker map (gPositionedDescendantsMap).
        They will be inserted back into the tracker map during the next layout (either under the RenderView or
        under the next transformed renderer in the ancestor chain).

        Test: fast/block/fixed-position-reparent-when-transition-is-removed.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removePositionedObjectsIfNeeded):

2016-06-11  Myles C. Maxfield  <mmaxfield@apple.com>

        Addressing post-review comments after r201978.
        https://bugs.webkit.org/show_bug.cgi?id=158649
        <rdar://problem/13258122>

        Unreviewed.

        * platform/graphics/FontCache.cpp:
        (WebCore::FontCache::alternateFamilyName):
        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::FontCache::platformAlternateFamilyName):

2016-06-11  Darin Adler  <darin@apple.com>

        Tighten code to build set of tag names
        https://bugs.webkit.org/show_bug.cgi?id=158662

        Reviewed by Alexey Proskuryakov.

        * dom/Element.cpp:
        (WebCore::canAttachAuthorShadowRoot): Use an array of pointers that the loader
        can initialize as part of loading the library, rather than an array that needs
        to be initialized with code at runtime.

2016-06-11  Myles C. Maxfield  <mmaxfield@apple.com>

        [Win] [EFL] Build fix after r201978.
        https://bugs.webkit.org/show_bug.cgi?id=158649
        <rdar://problem/13258122>

        Unreviewed

        * platform/graphics/freetype/FontCacheFreeType.cpp:
        (WebCore::FontCache::platformAlternateFamilyName):
        * platform/graphics/win/FontCacheWin.cpp:

2016-06-11  Myles C. Maxfield  <mmaxfield@apple.com>

        [Cocoa] Map commonly used Chinese Windows font names to names present on Cocoa operating systems
        https://bugs.webkit.org/show_bug.cgi?id=158649
        <rdar://problem/13258122>

        Reviewed by Darin Adler.

        There are many Chinese websites which hardcode Windows font names.
        We should map these to fonts which best match them on Cocoa operating
        systems. We can do this by using our existing fallback font name
        infrastructure.

        Tests: fast/text/chinese-font-name-aliases-2.html
               fast/text/chinese-font-name-aliases.html

        * platform/graphics/FontCache.cpp:
        (WebCore::FontCache::alternateFamilyName):
        (WebCore::alternateFamilyName): Deleted.
        * platform/graphics/FontCache.h:
        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::FontCache::platformAlternateFamilyName):
        * platform/graphics/freetype/FontCacheFreeType.cpp:
        (WebCore::FontCache::platformAlternateFamilyName):
        * platform/graphics/win/FontCacheWin.cpp:
        (WebCore::FontCache::platformAlternateFamilyName):

2016-06-11  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r201967, r201968, and r201972.
        https://bugs.webkit.org/show_bug.cgi?id=158665

        Caused flaky failures on IndexedDB tests (Requested by ap on
        #webkit).

        Reverted changesets:

        "Vary:Cookie validation doesn't work in private browsing"
        https://bugs.webkit.org/show_bug.cgi?id=158616
        http://trac.webkit.org/changeset/201967

        "Build fix."
        http://trac.webkit.org/changeset/201968

        "WinCairo build fix attempt."
        http://trac.webkit.org/changeset/201972

2016-06-11  Konstantin Tokarev  <annulen@yandex.ru>

        Fixed compilation of LocaleICU with ENABLE(DATE_AND_TIME_INPUT_TYPES)
        https://bugs.webkit.org/show_bug.cgi?id=158659

        Reviewed by Darin Adler.

        No new tests needed.

        * platform/text/LocaleICU.cpp:
        (WebCore::getFormatForSkeleton):
        (WebCore::LocaleICU::monthFormat):
        (WebCore::LocaleICU::shortMonthFormat):

2016-06-11  Antti Koivisto  <antti@apple.com>

        WinCairo build fix attempt.

        * platform/network/NetworkStorageSession.cpp:
        * platform/network/NetworkStorageSession.h:
        * platform/network/NetworkStorageSessionStub.cpp:
        (WebCore::NetworkStorageSession::NetworkStorageSession):
        (WebCore::NetworkStorageSession::context):
        (WebCore::NetworkStorageSession::createPrivateBrowsingSession):
        (WebCore::NetworkStorageSession::switchToNewTestingSession):
        (WebCore::NetworkStorageSession::~NetworkStorageSession): Deleted.
        (WebCore::defaultSession): Deleted.
        (WebCore::NetworkStorageSession::defaultStorageSession): Deleted.

2016-06-11  Myles C. Maxfield  <mmaxfield@apple.com>

        Deleting a CSSOM style rule invalidates any previously-added FontFaces
        https://bugs.webkit.org/show_bug.cgi?id=158450

        Reviewed by Darin Adler.

        This patch has two pieces: updating the CSSOM when the FontFace changes, and
        updating the FontFace when the CSSOM changes.

        1: Updating the CSSOM when the FontFace changes: CSSFontFaces already have a RefPtr
        to their StyleRuleFontFace which represents their CSS-connection. When changing a
        property of the CSSFontFace, we simply reach into the StyleRule and update it to
        match. Our existing infrastructure of invalidation due to the attribute changes
        makes sure that all the necessary updates occur.

        2. Updating the FontFace when the CSSOM changes: If the CSSOM changes in a trivial
        way (for example, a new @font-face is appended to the end of the last <style>
        element), we can handle it directly. However, when something more invasive occurs,
        we end up clearing the entire CSSFontSelector, and then adding all the style rules
        from scratch. This involves three steps:
            a) CSSFontSelector::buildStarted() is run, which means "we're about to start
               building up all the @font-face rules from scratch." We take this opportunity
               to purge as many fonts as possible. This is valuable because, for example,
               this function gets run when the page gets put into the page cache, so we
               want to destroy as much as possible. Not everything can be purged, however -
               only CSS-connected fonts which have never been inspected by script are
               purgeable. We don't allow fonts inspected by script to be purged because
               purging might result in a font appearing from JavaScript to transition from
               a success -> failure state, which we don't allow.
            b) Upon style recalc (possibly asynchronously) CSSFontSelector::addFontFaceRule()
               is called for each @font-face rule. We actually detect that we're in the
               middle of a style rebuild, and defer this step.
            c) When we're done adding all the font face rules, we call
               CSSFontSelector::buildCompleted(). This is where we compare the newly built-
               up list of font faces with what existed previously (as remembered in
               CSSFontSelector::buildStarted()) in order to detect font faces which were
               deleted from the document. Fonts which were newly added to the document
               are handled naturally.
               Fonts which have a property modified on them are created as if they were new.
               However, instead of simply adding the CSSFontFace, we search for the existing
               CSSFontFace (by CSS connection pointer) and tell the existing FontFace to
               adopt this new CSSFontFace. This means that the JavaScript object will just
               pick up any newly-written values in the CSSOM. It also means that the
               "status" attribute of the JavaScript object is reset, but this is expected
               and allowed by the spec. (For example, if you change the "src" attribute of
               an @font-face block via the CSSOM, all bets are off when you inspect the
               FontFace JS object representing that block.)

        Test: fast/text/font-face-set-cssom.html

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::CSSFontFace):
        (WebCore::CSSFontFace::setFamilies):
        (WebCore::CSSFontFace::setStyle):
        (WebCore::CSSFontFace::setWeight):
        (WebCore::CSSFontFace::setUnicodeRange):
        (WebCore::CSSFontFace::setVariantLigatures):
        (WebCore::CSSFontFace::setVariantPosition):
        (WebCore::CSSFontFace::setVariantCaps):
        (WebCore::CSSFontFace::setVariantNumeric):
        (WebCore::CSSFontFace::setVariantAlternates):
        (WebCore::CSSFontFace::setVariantEastAsian):
        (WebCore::CSSFontFace::setFeatureSettings):
        (WebCore::CSSFontFace::initializeWrapper):
        (WebCore::CSSFontFace::wrapper):
        (WebCore::CSSFontFace::setWrapper):
        (WebCore::CSSFontFace::purgeable):
        (WebCore::CSSFontFace::updateStyleIfNeeded):
        * css/CSSFontFace.h:
        * css/CSSFontFaceSet.cpp:
        (WebCore::CSSFontFaceSet::remove):
        (WebCore::CSSFontFaceSet::containsCSSConnection):
        (WebCore::CSSFontFaceSet::purge):
        * css/CSSFontFaceSet.h:
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::buildStarted):
        (WebCore::CSSFontSelector::buildCompleted):
        (WebCore::CSSFontSelector::addFontFaceRule):
        * css/CSSFontSelector.h:
        * css/FontFace.cpp:
        (WebCore::FontFace::family):
        (WebCore::FontFace::style):
        (WebCore::FontFace::weight):
        (WebCore::FontFace::unicodeRange):
        (WebCore::FontFace::variant):
        (WebCore::FontFace::featureSettings):
        (WebCore::FontFace::adopt):
        * css/FontFace.h:

2016-06-11  Chris Dumez  <cdumez@apple.com>

        WorkerNavigator is missing some attributes
        https://bugs.webkit.org/show_bug.cgi?id=158593
        <rdar://problem/26731334>

        Reviewed by Darin Adler.

        Add attributes that are missing on WorkerNavigator:
        - appCodeName
        - hardwareConcurrency
        - language
        - product
        - productSub
        - vendor
        - vendorSub

        Firefox and Chrome already expose those attributes.

        Relevant specification:
        https://html.spec.whatwg.org/multipage/workers.html#the-workernavigator-object

        This patch also refactors the IDL to match the specification more
        closely and promote sharing between Navigator and WorkerNavigator.

        No new tests, updated existing test.

        * CMakeLists.txt:
        * DerivedSources.make:
        Add new supplemental IDL files.

        * page/Navigator.cpp:
        * page/Navigator.h:
        Moved language() / hardwareConcurrency() from Navigator to NavigatorBase
        so that it can be used by NavigatorWorker as well.

        * page/NavigatorBase.h:
        * page/NavigatorBase.cpp:
        (WebCore::NavigatorBase::language):
        The implementation still calls defaultLanguage() but I updated it to be
        thread safe on all platforms.

        (WebCore::NavigatorBase::hardwareConcurrency):
        Use std::call_once() for thread safety.

        * page/Navigator.idl:
        * page/NavigatorConcurrentHardware.idl: Copied from Source/WebCore/page/WorkerNavigator.idl.
        * page/NavigatorID.idl: Copied from Source/WebCore/page/WorkerNavigator.idl.
        * page/NavigatorLanguage.idl: Copied from Source/WebCore/page/WorkerNavigator.idl.
        * page/NavigatorOnLine.idl: Copied from Source/WebCore/page/WorkerNavigator.idl.
        * page/WorkerNavigator.idl:
        Move several attributes to their own supplemental interfaces to match
        the specification and promote sharing with WorkerNavigator.

        * platform/Language.cpp:
        (WebCore::userPreferredLanguages):
        * platform/Language.h:
        Made thread-safe on all platforms.

2016-06-11  Antti Koivisto  <antti@apple.com>

        Build fix.

        * platform/network/cf/NetworkStorageSessionCFNet.cpp:
        (WebCore::NetworkStorageSession::switchToNewTestingSession):

2016-06-10  Antti Koivisto  <antti@apple.com>

        Vary:Cookie validation doesn't work in private browsing
        https://bugs.webkit.org/show_bug.cgi?id=158616
        rdar://problem/26755067

        Reviewed by Darin Adler.

        This wasn't implemented because there was no way to get NetworkStorageSession from
        a SessionID on WebCore side.

        The patch adds a simple WebCore level weak map that allows getting NetworkStorageSessions
        from SessionID. This seemed like the cleanest way to do this without a big refactoring
        around the currently WebKit2 level SessionTracker.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/network/CacheValidation.cpp:
        (WebCore::headerValueForVary):

            Get NetworkStorageSession from SessionID for cookies

        (WebCore::verifyVaryingRequestHeaders):
        * platform/network/NetworkStorageSession.cpp: Added.

            Add platform independent .cpp for NetworkStorageSession.
            Implement a weak map for SessionID -> NetworkStorageSession.

        (WebCore::sessionsMap):
        (WebCore::NetworkStorageSession::NetworkStorageSession):
        (WebCore::NetworkStorageSession::~NetworkStorageSession):
        (WebCore::NetworkStorageSession::forSessionID):

            Get NetworkStorageSession for sessionID.

        * platform/network/NetworkStorageSession.h:
        (WebCore::NetworkStorageSession::sessionID):
        (WebCore::NetworkStorageSession::credentialStorage):
        * platform/network/cf/NetworkStorageSessionCFNet.cpp:
        (WebCore::NetworkStorageSession::NetworkStorageSession):

            Call to common constructor.

        (WebCore::defaultNetworkStorageSession):
        * platform/network/soup/NetworkStorageSessionSoup.cpp:
        (WebCore::NetworkStorageSession::NetworkStorageSession):

            Call to common constructor.

        (WebCore::defaultSession):
        (WebCore::NetworkStorageSession::~NetworkStorageSession): Deleted.

2016-06-10  Ada Chan  <adachan@apple.com>

        Use the video element's video box when getting the inline video rect in WebVideoFullscreenManager
        https://bugs.webkit.org/show_bug.cgi?id=158351
        <rdar://problem/26567938>

        Reviewed by Darin Adler.

        * WebCore.xcodeproj/project.pbxproj:
        Change the visibility of RenderVideo.h and RenderMedia.h since we'll be importing RenderVideo.h from WebKit2.
        * rendering/RenderVideo.h:

2016-06-10  Benjamin Poulain  <bpoulain@apple.com>

        Add support for passive event listeners on touch events
        https://bugs.webkit.org/show_bug.cgi?id=158601

        Reviewed by Simon Fraser.

        This patch wires "passive" state of EventTarget to the delivery of touch
        events in WebKit2.

        Instead of having a NonFastScrollableRegion, we have a pair of regions
        in EventTrackingRegions.
        The "asynchronousDispatchRegion" tracks the area for which all event
        listeners are passive. For those, events should be dispatched asynchronously.
        The "synchronousDispatchRegion" tracks the area for which there is at
        least one active event listener. Events have to be dispatched synchronously
        for correctness.

        Tests: fast/events/touch/ios/tap-with-active-listener-on-elements.html
               fast/events/touch/ios/tap-with-active-listener-on-window.html
               fast/events/touch/ios/tap-with-passive-listener-on-elements.html
               fast/events/touch/ios/tap-with-passive-listener-on-window.html

        * WebCore.xcodeproj/project.pbxproj:
        * dom/Document.cpp:
        (WebCore::Document::wheelEventHandlersChanged):
        (WebCore::Document::Document): Deleted.
        * dom/Document.h:

        * dom/EventListenerMap.cpp:
        (WebCore::EventListenerMap::containsActive):
        If a Target has multiple listener for an event type, we want to know
        if any of them is active.

        * dom/EventListenerMap.h:
        * dom/EventTarget.cpp:
        (WebCore::EventTarget::hasActiveEventListeners):
        (WebCore::EventTarget::hasActiveTouchEventListeners):
        * dom/EventTarget.h:

        * page/DebugPageOverlays.cpp:
        (WebCore::NonFastScrollableRegionOverlay::updateRegion):
        I did not change the debug overlays.
        The NonFastScrollable area is the region for which events needs
        synchronous dispatch. Everything else should scroll without delay.

        * page/FrameView.cpp:
        (WebCore::FrameView::scrollableAreaSetChanged):
        * page/Page.cpp:
        (WebCore::Page::nonFastScrollableRects):
        * page/scrolling/AsyncScrollingCoordinator.cpp:
        (WebCore::AsyncScrollingCoordinator::setEventTrackingRegionsDirty):
        (WebCore::AsyncScrollingCoordinator::willCommitTree):
        (WebCore::AsyncScrollingCoordinator::updateEventTrackingRegions):
        (WebCore::AsyncScrollingCoordinator::frameViewLayoutUpdated):
        (WebCore::AsyncScrollingCoordinator::frameViewEventTrackingRegionsChanged):
        (WebCore::AsyncScrollingCoordinator::scrollingStateTreeAsText):
        (WebCore::AsyncScrollingCoordinator::setNonFastScrollableRegionDirty): Deleted.
        (WebCore::AsyncScrollingCoordinator::updateNonFastScrollableRegion): Deleted.
        (WebCore::AsyncScrollingCoordinator::frameViewNonFastScrollableRegionChanged): Deleted.
        * page/scrolling/AsyncScrollingCoordinator.h:
        (WebCore::AsyncScrollingCoordinator::eventTrackingRegionsDirty):
        (WebCore::AsyncScrollingCoordinator::nonFastScrollableRegionDirty): Deleted.

        * page/scrolling/ScrollingCoordinator.cpp:
        (WebCore::ScrollingCoordinator::absoluteEventTrackingRegionsForFrame):
        (WebCore::ScrollingCoordinator::absoluteEventTrackingRegions):
        (WebCore::ScrollingCoordinator::absoluteNonFastScrollableRegionForFrame): Deleted.
        (WebCore::ScrollingCoordinator::absoluteNonFastScrollableRegion): Deleted.
        I intentionally left the Wheel event with synchronous dispatch.
        This use case will need its own set of tests.

        * page/scrolling/ScrollingCoordinator.h:
        (WebCore::ScrollingCoordinator::frameViewEventTrackingRegionsChanged):
        (WebCore::ScrollingCoordinator::frameViewNonFastScrollableRegionChanged): Deleted.
        * page/scrolling/ScrollingStateFrameScrollingNode.cpp:
        (WebCore::ScrollingStateFrameScrollingNode::ScrollingStateFrameScrollingNode):
        (WebCore::ScrollingStateFrameScrollingNode::setEventTrackingRegions):
        (WebCore::ScrollingStateFrameScrollingNode::dumpProperties):
        (WebCore::ScrollingStateFrameScrollingNode::setNonFastScrollableRegion): Deleted.
        * page/scrolling/ScrollingStateFrameScrollingNode.h:
        * page/scrolling/ScrollingTree.cpp:
        (WebCore::ScrollingTree::shouldHandleWheelEventSynchronously):
        (WebCore::ScrollingTree::commitNewTreeState):
        (WebCore::ScrollingTree::eventTrackingTypeForPoint):
        (WebCore::ScrollingTree::isPointInNonFastScrollableRegion): Deleted.
        * page/scrolling/ScrollingTree.h:
        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
        (WebCore::ScrollingCoordinatorMac::scheduleTreeStateCommit):
        * platform/EventTrackingRegions.h: Added.
        (WebCore::EventTrackingRegions::isEmpty):
        (WebCore::EventTrackingRegions::trackingTypeForPoint):
        (WebCore::operator==):

2016-06-10  Enrica Casucci  <enrica@apple.com>

        REGRESSION(r198177): Cannot paste an image when the pasteboard format is mime type.
        https://bugs.webkit.org/show_bug.cgi?id=158590
        rdar://problem/25471371

        Reviewed by Darin Adler.

        When creating a fragment from an image resource, the resource needs to
        be added to the document loader before setting the src attribute to the
        image element, otherwise loading is triggered and the loading fails.
        In r198177 the order of the operations was changed causing the bug.
        This patch adds support to test the scenario where the image in the pasteboard
        is available only as mime type (not WebArchive or RTFD), a situation that occurs
        more frequently on iOS.

        Test: editing/pasteboard/image-in-iframe.html

        * editing/ios/EditorIOS.mm:
        (WebCore::Editor::createFragmentForImageResourceAndAddResource):
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::WebContentReader::readWebArchive):
        (WebCore::Editor::WebContentReader::readRTFD):
        (WebCore::Editor::WebContentReader::readRTF):
        (WebCore::Editor::createFragmentForImageResourceAndAddResource):
        * page/Settings.cpp:
        (WebCore::Settings::setImagesEnabled):
        (WebCore::Settings::setPreferMimeTypeForImages):
        (WebCore::Settings::setForcePendingWebGLPolicy):
        * page/Settings.h:
        (WebCore::Settings::areImagesEnabled):
        (WebCore::Settings::preferMimeTypeForImages):
        (WebCore::Settings::arePluginsEnabled):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::restoreTo):
        (WebCore::InternalSettings::setLangAttributeAwareFormControlUIEnabled):
        (WebCore::InternalSettings::setPreferMimeTypeForImages):
        (WebCore::InternalSettings::setImagesEnabled):
        * testing/InternalSettings.h:
        * testing/InternalSettings.idl:

2016-06-10  Alex Christensen  <achristensen@webkit.org>

        Fix WinCairo build after r201943

        * platform/network/curl/MultipartHandle.cpp:
        (WebCore::MultipartHandle::didReceiveResponse):
        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::handleLocalReceiveResponse):
        (WebCore::headerCallback):
        (WebCore::ResourceHandleManager::dispatchSynchronousJob):

2016-06-10  Alex Christensen  <achristensen@webkit.org>

        handleDataURL is only used by curl
        https://bugs.webkit.org/show_bug.cgi?id=158636

        Reviewed by Tim Horton.

        * CMakeLists.txt:
        * platform/network/DataURL.cpp: Removed.
        * platform/network/DataURL.h: Removed.
        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::ResourceHandleManager::startScheduledJobs):
        (WebCore::handleDataURL):
        (WebCore::ResourceHandleManager::dispatchSynchronousJob):

2016-06-10  Alex Christensen  <achristensen@webkit.org>

        Reduce ResourceResponse copying
        https://bugs.webkit.org/show_bug.cgi?id=158232

        Reviewed by Darin Adler.

        No new tests.  No change in behavior except removing an unnecessary copy on cocoa platforms.

        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::didSendData):
        (WebCore::ResourceLoader::didReceiveResponse):
        * loader/ResourceLoader.h:
        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::createResourceHandle):
        (WebCore::ApplicationCacheGroup::didReceiveResponse):
        * loader/appcache/ApplicationCacheGroup.h:
        * platform/graphics/PlatformMediaResourceLoader.h:
        (WebCore::PlatformMediaResourceClient::~PlatformMediaResourceClient):
        (WebCore::PlatformMediaResourceClient::responseReceived):
        (WebCore::PlatformMediaResourceClient::redirectReceived):
        (WebCore::PlatformMediaResourceClient::shouldCacheResponse):
        (WebCore::PlatformMediaResourceClient::dataSent):
        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.h:
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (ResourceHandleStreamingClient::willSendRequest):
        (ResourceHandleStreamingClient::didReceiveResponse):
        * platform/network/BlobResourceHandle.cpp:
        (WebCore::BlobResourceHandle::notifyResponseOnSuccess):
        (WebCore::BlobResourceHandle::notifyResponseOnError):
        (WebCore::BlobResourceHandle::notifyReceiveData):
        * platform/network/DataURL.cpp:
        (WebCore::handleDataURL):
        * platform/network/PingHandle.h:
        (WebCore::PingHandle::PingHandle):
        * platform/network/ResourceHandleClient.cpp:
        (WebCore::ResourceHandleClient::willSendRequestAsync):
        (WebCore::ResourceHandleClient::didReceiveResponseAsync):
        * platform/network/ResourceHandleClient.h:
        (WebCore::ResourceHandleClient::didSendData):
        (WebCore::ResourceHandleClient::didReceiveResponse):
        (WebCore::ResourceHandleClient::didReceiveData):
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::ResourceResponseBase):
        (WebCore::ResourceResponseBase::includeCertificateInfo):
        (WebCore::ResourceResponseBase::suggestedFilename):
        (WebCore::ResourceResponseBase::certificateInfo): Deleted.
        * platform/network/ResourceResponseBase.h:
        (WebCore::ResourceResponseBase::certificateInfo):
        (WebCore::ResourceResponseBase::encode):
        (WebCore::ResourceResponseBase::decode):
        (WebCore::ResourceResponseBase::containsCertificateInfo): Deleted.
        * platform/network/SynchronousLoaderClient.cpp:
        (WebCore::SynchronousLoaderClient::canAuthenticateAgainstProtectionSpace):
        (WebCore::SynchronousLoaderClient::didReceiveResponse):
        (WebCore::SynchronousLoaderClient::didReceiveData):
        * platform/network/SynchronousLoaderClient.h:
        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveResponse):
        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.cpp:
        (WebCore::SynchronousResourceHandleCFURLConnectionDelegate::didReceiveResponse):
        (WebCore::SynchronousResourceHandleCFURLConnectionDelegate::didReceiveData):
        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]):
        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::nextMultipartResponsePartCallback):
        (WebCore::sendRequestCallback):

2016-06-09  Ryosuke Niwa  <rniwa@webkit.org>

        Add SPI to disable spellchecking on auto-fillable text fields
        https://bugs.webkit.org/show_bug.cgi?id=158611

        Reviewed by Anders Carlsson.

        Added a boolean flag m_isSpellCheckingEnabled to HTMLInputElement. This flag defaults to true, and can be set
        to false by WebKit2 C API.

        * editing/Editor.cpp:
        (WebCore::Editor::isSpellCheckingEnabledFor): Fixed a bug that we were calling isSpellCheckingEnabled on
        the div inside an input element's shadow tree instead of the input element itself.
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::HTMLInputElement): Initialize m_spellcheckEnabled to true (it's a bit field).
        (WebCore::HTMLInputElement::isSpellCheckingEnabled): Added. Return false if m_spellcheckEnabled is false.
        * html/HTMLInputElement.h:
        (WebCore::HTMLInputElement::setSpellcheckEnabled): Added.

2016-06-10  Alex Christensen  <achristensen@webkit.org>

        Introduce WTF::UniqueRef
        https://bugs.webkit.org/show_bug.cgi?id=158596

        Reviewed by Brady Eidson.

        No new tests.  No change in behavior.

        * inspector/InspectorOverlay.cpp:
        (WebCore::InspectorOverlay::overlayPage):
        * loader/EmptyClients.cpp:
        (WebCore::fillWithEmptyClients):
        * page/Page.cpp:
        (WebCore::Page::Page):
        * page/Page.h:
        (WebCore::Page::canStartMedia):
        (WebCore::Page::editorClient):
        (WebCore::Page::plugInClient):
        (WebCore::Page::mainFrame):
        (WebCore::Page::groupPtr): Deleted.
        * page/PageConfiguration.cpp:
        (WebCore::PageConfiguration::PageConfiguration):
        * page/PageConfiguration.h:
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::dataChanged):

2016-06-10  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Cleanup InspectorIndexedDBAgent a bit
        https://bugs.webkit.org/show_bug.cgi?id=158598

        Reviewed by Darin Adler.

        * inspector/InspectorIndexedDBAgent.cpp:

2016-06-10  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Origin header is not included in CORS requests for preloaded cross-origin resources
        https://bugs.webkit.org/show_bug.cgi?id=155761
        <rdar://problem/25351850>

        Reviewed by Alex Christensen.

        Making HTML preloader fully aware of crossorigin attribute value.
        Introducing CachedResourceRequest::setAsPotentiallyCrossOrigin as a helper routine to activate CORS mode.
        Making HTMLLinkElement and HTMLResourcePreloader use that routine.
        Making TokenPreloadScanner store the crossorigin attribute value in preload requests.
        Making TokenPreloadScanner store the crossorigin attribute value for link elements.

        Test: http/tests/security/cross-origin-css-9.html

        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::process):
        * html/parser/HTMLPreloadScanner.cpp:
        (WebCore::TokenPreloadScanner::StartTagScanner::createPreloadRequest):
        (WebCore::TokenPreloadScanner::StartTagScanner::processAttribute):
        * html/parser/HTMLResourcePreloader.cpp:
        (WebCore::crossOriginModeAllowsCookies):
        (WebCore::PreloadRequest::resourceRequest):
        * html/parser/HTMLResourcePreloader.h:
        (WebCore::PreloadRequest::setCrossOriginMode):
        (WebCore::PreloadRequest::PreloadRequest): Deleted.
        (WebCore::PreloadRequest::resourceType): Deleted.
        * loader/cache/CachedResourceRequest.cpp:
        (WebCore::CachedResourceRequest::setAsPotentiallyCrossOrigin):
        * loader/cache/CachedResourceRequest.h:

2016-06-10  Chris Dumez  <cdumez@apple.com>

        ErrorEvent / ProgressEvent should be exposed to workers
        https://bugs.webkit.org/show_bug.cgi?id=158606

        Reviewed by Brady Eidson.

        ErrorEvent / ProgressEvent should be exposed to workers:
        - https://html.spec.whatwg.org/multipage/webappapis.html#errorevent
        - https://xhr.spec.whatwg.org/#interface-progressevent

        Firefox and Chrome both already expose those.

        No new tests, rebaselined existing test.

        * dom/ErrorEvent.idl:
        * dom/ProgressEvent.idl:

2016-06-10  Chris Dumez  <cdumez@apple.com>

        MessagePort should be exposed to workers
        https://bugs.webkit.org/show_bug.cgi?id=158607

        Reviewed by Brady Eidson.

        MessagePort should be exposed to workers:
        https://html.spec.whatwg.org/multipage/comms.html#messageport

        Firefox and Chrome both already expose it.

        No new tests, rebaselined existing test.

        * dom/MessagePort.idl:

2016-06-10  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Move preflight check code outside of DocumentThreadableLoader
        https://bugs.webkit.org/show_bug.cgi?id=158425

        Reviewed by Darin Adler.

        Moving preflight check code in its own class.
        This allows code to be easier to read, use/reuse and update.

        Behavior should be the same as before except in the case of a preflight response
        being a 3XX redirect response.
        Before this patch, the 3XX response was directly passed to the code processing regular responses.
        To keep compatibility with existing tests, a didFailRedirectCheck callback is called.
        This should be change to a preflight failure.

        Covered by existing tests.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * loader/CrossOriginPreflightChecker.cpp: Added.
        (WebCore::CrossOriginPreflightChecker::CrossOriginPreflightChecker):
        (WebCore::CrossOriginPreflightChecker::~CrossOriginPreflightChecker):
        (WebCore::CrossOriginPreflightChecker::handleLoadingFailure):
        (WebCore::CrossOriginPreflightChecker::validatePreflightResponse):
        (WebCore::CrossOriginPreflightChecker::notifyFinished):
        (WebCore::CrossOriginPreflightChecker::startPreflight):
        (WebCore::CrossOriginPreflightChecker::doPreflight):
        (WebCore::CrossOriginPreflightChecker::redirectReceived):
        (WebCore::CrossOriginPreflightChecker::setDefersLoading):
        (WebCore::CrossOriginPreflightChecker::isXMLHttpRequest):
        * loader/CrossOriginPreflightChecker.h: Added.
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::create):
        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequest):
        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
        (WebCore::DocumentThreadableLoader::setDefersLoading):
        (WebCore::DocumentThreadableLoader::clearResource):
        (WebCore::DocumentThreadableLoader::didReceiveResponse):
        (WebCore::DocumentThreadableLoader::didReceiveData):
        (WebCore::DocumentThreadableLoader::notifyFinished):
        (WebCore::DocumentThreadableLoader::didFinishLoading):
        (WebCore::DocumentThreadableLoader::didFail):
        (WebCore::DocumentThreadableLoader::preflightSuccess):
        (WebCore::DocumentThreadableLoader::preflightFailure):
        (WebCore::DocumentThreadableLoader::loadRequest):
        (WebCore::DocumentThreadableLoader::responseReceived): Deleted.
        (WebCore::DocumentThreadableLoader::dataReceived): Deleted.
        (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy): Deleted.
        * loader/DocumentThreadableLoader.h:
        (WebCore::DocumentThreadableLoader::options):
        (WebCore::DocumentThreadableLoader::isLoading):
        (WebCore::DocumentThreadableLoader::document):

2016-06-10  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Imlement MediaEndpointPeerConnection::createAnswer()
        https://bugs.webkit.org/show_bug.cgi?id=158566

        Reviewed by Eric Carlson.

        Add the MediaEndpointPeerConnection implementation of RTCPeerConnection.createAnswer [1].
        createAnswer() creates a 'reply' to an remote offer set with setRemoteDescription(),
        completes the offer/answer dialog and brings the RTCPeerConnection back to the 'stable'
        signaling state.

        [1] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html#dom-rtcpeerconnection-createanswer

        Test: fast/mediastream/RTCPeerConnection-inspect-answer.html

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::createOfferTask):
        Align creation of RTCSessionDescription with createAnswerTask.
        (WebCore::MediaEndpointPeerConnection::createAnswer):
        (WebCore::MediaEndpointPeerConnection::createAnswerTask):
        Add Implementation.
        * Modules/mediastream/MediaEndpointPeerConnection.h:

2016-06-08  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] CRASH when getting the computed style of a grid with only absolutely positioned children
        https://bugs.webkit.org/show_bug.cgi?id=158537

        Reviewed by Darin Adler.

        Absolute positioning occurs after layout of the grid and its in-flow contents, and does not
        contribute to the sizing of any grid tracks or affect the size/configuration of the grid in
        any way. This means that we should treat as empty any grid whose only children are
        absolutely positioned items.

        Since r201510 empty grids are no longer internally represented by a 1x1 matrix. As we were
        not considering grids-with-only-absolutely-positioned-children as empty, we were trying to
        access some invalid position in the internal representation of the grid triggering an ASSERT
        in debug builds and a crash in release.

        Test: fast/css-grid-layout/grid-only-abspos-item-computed-style-crash.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::valueForGridTrackList):

2016-06-10  Chris Dumez  <cdumez@apple.com>

        DOMException should be exposed to workers
        https://bugs.webkit.org/show_bug.cgi?id=158608

        Reviewed by Alex Christensen.

        DOMException should be exposed to workers:
        https://heycam.github.io/webidl/#es-DOMException-call

        Both Firefox and Chrome expose DOMException to workers already.

        No new tests, rebaselined existing test.

        * dom/DOMCoreException.idl:

2016-06-09  Alex Christensen  <achristensen@webkit.org>

        Fix CMake build.

        * PlatformMac.cmake:

2016-06-09  Alex Christensen  <achristensen@webkit.org>

        Fix AppleWin build after r201901.
        https://bugs.webkit.org/show_bug.cgi?id=119839

        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
        (PlatformCALayerWin::backingStoreAttached):
        (PlatformCALayerWin::userInteractionEnabled):
        (PlatformCALayerWin::setUserInteractionEnabled):
        (PlatformCALayerWin::geometryFlipped):
        * platform/graphics/ca/win/PlatformCALayerWin.h:

2016-06-09  Chris Fleizach  <cfleizach@apple.com>

        AX: VoiceOver Unable to View Download Progress or Completion Status for Mail Attachments
        https://bugs.webkit.org/show_bug.cgi?id=158581

        Reviewed by Darin Adler.

        Update attachment element accessibility so that:
           1) the action name comes first to match UI
           2) on iOS, it has the updates frequently trait

        Make sure this test now runs on iOS as well.

        Modified tests: accessibility/attachment-element.html

        * accessibility/AccessibilityAttachment.cpp:
        (WebCore::AccessibilityAttachment::accessibilityText):
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper accessibilityCanFuzzyHitTest]):
        (-[WebAccessibilityObjectWrapper accessibilityTraits]):
        (-[WebAccessibilityObjectWrapper accessibilityValue]):
        (-[WebAccessibilityObjectWrapper accessibilityIsAttachmentElement]):
        (-[WebAccessibilityObjectWrapper accessibilityIsComboBox]):

2016-06-09  Alex Christensen  <achristensen@webkit.org>

        Clean up WebCore.vcxproj after switching to CMake.

        * WebCore.vcxproj/QTMovieWin: Removed.
        * WebCore.vcxproj/QTMovieWin/QTMovieWinCairoDebug.props: Removed.
        * WebCore.vcxproj/QTMovieWin/QTMovieWinCairoRelease.props: Removed.
        * WebCore.vcxproj/QTMovieWin/QTMovieWinCommon.props: Removed.
        * WebCore.vcxproj/QTMovieWin/QTMovieWinDebug.props: Removed.
        * WebCore.vcxproj/QTMovieWin/QTMovieWinPostBuild.cmd: Removed.
        * WebCore.vcxproj/QTMovieWin/QTMovieWinPreBuild.cmd: Removed.
        * WebCore.vcxproj/QTMovieWin/QTMovieWinPreLink.cmd: Removed.
        * WebCore.vcxproj/QTMovieWin/QTMovieWinProduction.props: Removed.
        * WebCore.vcxproj/QTMovieWin/QTMovieWinRelease.props: Removed.
        * WebCore.vcxproj/xcopy.excludes: Removed.

2016-06-09  Zalan Bujtas  <zalan@apple.com>

        Hairline borders do not show up on 3x displays.
        https://bugs.webkit.org/show_bug.cgi?id=158604
        <rdar://problem/26511679>

        Reviewed by Simon Fraser.

        On a 3x display, when we convert a 1/3px hairline border from float
        to LayoutUnit and pixel floor the result, we end up with a 0px width border.
        It's because float to LayoutUnit is lossy and since the current kFixedPointDenominator % 3 != 0,
        flooring LayoutUnit(1/3px) ends up being 0px. (float: 1/3 -> LayoutUnit: (1/3 - 1/kFixedPointDenominator) -> floor: 0)
        This patch eliminates the (unnecessary) float -> LayoutUnit - float conversion on border width.   

        Test: fast/borders/hidpi-3x-input-hairline-border.html

        * rendering/BorderEdge.cpp:
        (WebCore::BorderEdge::BorderEdge):
        * rendering/BorderEdge.h:

2016-06-09  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r201887.
        https://bugs.webkit.org/show_bug.cgi?id=158610

        This change caused LayoutTest crashes under GuardMalloc and
        ASan (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "Deleting a CSSOM style rule invalidates any previously-added
        FontFaces"
        https://bugs.webkit.org/show_bug.cgi?id=158450
        http://trac.webkit.org/changeset/201887

2016-06-09  Chris Dumez  <cdumez@apple.com>

        Address Darin's review comment on r201898.
        https://bugs.webkit.org/show_bug.cgi?id=158576

        Reviewed by Darin Adler.

        * page/Base64Utilities.h:

2016-06-09  Antoine Quint  <graouts@apple.com>

        [iOS] -webkit-overflow-scrolling: touch; ignores pointer-events: none;
        https://bugs.webkit.org/show_bug.cgi?id=119839
        <rdar://problem/9671514>

        Reviewed by Simon Fraser.

        Propagate a "userInteractionEnabled" flag from the Web process which is used to turn off
        user interaction on a UIScrollView created for -webkit-overflow-scrolling: touch.

        Test: fast/scrolling/ios/touch-scroll-pointer-events-none.html

        * platform/graphics/GraphicsLayer.cpp:
        (WebCore::GraphicsLayer::GraphicsLayer):
        * platform/graphics/GraphicsLayer.h:
        (WebCore::GraphicsLayer::userInteractionEnabled):
        (WebCore::GraphicsLayer::setUserInteractionEnabled):
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::setUserInteractionEnabled):
        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
        (WebCore::GraphicsLayerCA::updateUserInteractionEnabled):
        * platform/graphics/ca/GraphicsLayerCA.h:
        * platform/graphics/ca/PlatformCALayer.h:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.h:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (PlatformCALayerCocoa::userInteractionEnabled):
        (PlatformCALayerCocoa::setUserInteractionEnabled):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateAfterDescendants):

2016-06-09  Chris Dumez  <cdumez@apple.com>

        WorkerNavigator property should exist on WorkerGlobalScope
        https://bugs.webkit.org/show_bug.cgi?id=158574
        <rdar://problem/26725108>

        Reviewed by Darin Adler.

        WorkerNavigator property should exist on WorkerGlobalScope:
        https://html.spec.whatwg.org/multipage/workers.html#the-workernavigator-object

        Fixing this gets the number of failures on http://w3c-test.org/workers/interfaces.worker
        from 34 to 23.

        No new tests, rebaselined existing test.

        * page/WorkerNavigator.idl:

2016-06-09  Chris Dumez  <cdumez@apple.com>

        atob() / btoa() API should be exposed to workers
        https://bugs.webkit.org/show_bug.cgi?id=158576
        <rdar://problem/26729340>

        Reviewed by Sam Weinig.

        Expose atob() / btoa() API to workers as per:
        https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope

        This aligns our behavior with Firefox and Chrome as well.

        Test: fast/workers/atob-btoa.html

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * PlatformMac.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * page/Base64Utilities.cpp: Added.
        (WebCore::Base64Utilities::btoa):
        (WebCore::Base64Utilities::atob):
        * page/Base64Utilities.h: Added.
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::find): Deleted.
        (WebCore::DOMWindow::offscreenBuffering): Deleted.
        (WebCore::DOMWindow::outerHeight): Deleted.
        (WebCore::DOMWindow::outerWidth): Deleted.
        * page/DOMWindow.h:
        * page/DOMWindow.idl:
        * page/WindowBase64.idl: Removed.
        * page/WindowOrWorkerGlobalScope.idl: Renamed from Source/WebCore/page/WindowTimers.idl.
        * workers/WorkerGlobalScope.h:
        * workers/WorkerGlobalScope.idl:

2016-06-09  John Wilander  <wilander@apple.com>

        Restrict HTTP/0.9 responses to default ports and cancel HTTP/0.9 resource loads if the document was loaded with another HTTP protocol
        https://bugs.webkit.org/show_bug.cgi?id=158589
        <rdar://problem/25757454>

        Reviewed by Brent Fulgham.

        No new tests. Our layout test environment does not allow for headerless responses
        nor does it allow you to set an explicit HTTP/0.9 status header in PHP. I have
        manually tested this change with a Python socket setup doing both headerless and
        HTTP/0.9 header tests for positive and negative cases.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::responseReceived):
            Cancel loads if the request was made to a non-default port.
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::didReceiveResponse):
            Cancel loads if the request was made to a non-default port or if the document
            was loaded with another protocol. Cancelation is handled as a fail so as to
            fire the onerror event and allow sites to handle it gracefully.

2016-06-09  Alex Christensen  <achristensen@webkit.org>

        Clean up EditorClient lifetime
        https://bugs.webkit.org/show_bug.cgi?id=158588

        Reviewed by Anders Carlsson.

        No new tests.  This patch does two things, all of which do not change behavior:
        1. Use a std::unique_ptr<EditorClient> owned by the Page instead of allocating
        with new in WebKit/WebKit2 and deleting in WebEditorClient::pageDestroyed.
        2. Give the Page a PageConfiguration&& instead of a PageConfiguration& in its constructor.

        * inspector/InspectorOverlay.cpp:
        (WebCore::InspectorOverlay::overlayPage):
        * loader/EmptyClients.cpp:
        (WebCore::fillWithEmptyClients):
        * loader/EmptyClients.h:
        (WebCore::EmptyEditorClient::EmptyEditorClient):
        (WebCore::EmptyEditorClient::~EmptyEditorClient):
        * page/EditorClient.h:
        (WebCore::EditorClient::~EditorClient):
        * page/Page.cpp:
        (WebCore::Page::Page):
        (WebCore::Page::~Page):
        (WebCore::Page::setViewMode):
        (WebCore::Page::clearUndoRedoOperations):
        (WebCore::Page::inLowQualityImageInterpolationMode):
        (WebCore::Page::invalidateStylesForAllLinks):
        (WebCore::Page::invalidateStylesForLink):
        (WebCore::Page::invalidateInjectedStyleSheetCacheInAllFrames):
        (WebCore::Page::setDebugger):
        (WebCore::Page::setIsVisibleInternal):
        (WebCore::Page::setAllowsMediaDocumentInlinePlayback):
        * page/Page.h:
        (WebCore::Page::canStartMedia):
        (WebCore::Page::editorClient):
        (WebCore::Page::plugInClient):
        (WebCore::Page::mainFrame):
        (WebCore::Page::group):
        * page/PageConfiguration.cpp:
        * page/PageConfiguration.h:
        * page/mac/PageMac.mm:
        (WebCore::Page::addSchedulePair):
        (WebCore::Page::removeSchedulePair):
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::dataChanged):

2016-06-09  Joseph Pecoraro  <pecoraro@apple.com>

        REGRESSION: Web Inspector: IndexedDB does not show ObjectStore data
        https://bugs.webkit.org/show_bug.cgi?id=158592
        <rdar://problem/26730696>

        Reviewed by Timothy Hatcher.

        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore::DataLoader::execute):
        Ensure the IDBTransaction is active when attempting to open a cursor.

        (WebCore::OpenCursorCallback::handleEvent):
        End, when the cursor result is empty, like we do for script results.

2016-06-09  Antoine Quint  <graouts@apple.com>

        Changing canvas height immediately after page load does not relayout canvas
        https://bugs.webkit.org/show_bug.cgi?id=156097

        Reviewed by Zalan Bujtas.

        Promote the logic use to identify whether we should perform a layout after a change of
        intrinsic size from RenderImage to RenderReplaced such that RenderCanvas may use it
        in canvasSizeChanged() and correctly update its layout in the case where the width
        or height attribute is updated and there are no explicit sizing performed with CSS.
        Additionally, this will also account for the object-fix property to only perform
        a layout if necessary.

        Test: fast/canvas/canvas-css-size-after-height-change-with-display-flex.html

        * rendering/RenderHTMLCanvas.cpp:
        (WebCore::RenderHTMLCanvas::canvasSizeChanged):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::repaintOrMarkForLayout):
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::setNeedsLayoutIfNeededAfterIntrinsicSizeChange):
        * rendering/RenderReplaced.h:

2016-06-09  Myles C. Maxfield  <mmaxfield@apple.com>

        Deleting a CSSOM style rule invalidates any previously-added FontFaces
        https://bugs.webkit.org/show_bug.cgi?id=158450

        Reviewed by Darin Adler.

        This patch has two pieces: updating the CSSOM when the FontFace changes, and
        updating the FontFace when the CSSOM changes.

        1: Updating the CSSOM when the FontFace changes: CSSFontFaces already have a RefPtr
        to their StyleRuleFontFace which represents their CSS-connection. When changing a
        property of the CSSFontFace, we simply reach into the StyleRule and update it to
        match. Our existing infrastructure of invalidation due to the attribute changes
        makes sure that all the necessary updates occur.

        2. Updating the FontFace when the CSSOM changes: If the CSSOM changes in a trivial
        way (for example, a new @font-face is appended to the end of the last <style>
        element), we can handle it directly. However, when something more invasive occurs,
        we end up clearing the entire CSSFontSelector, and then adding all the style rules
        from scratch. This involves three steps:
            a) CSSFontSelector::buildStarted() is run, which means "we're about to start
               building up all the @font-face rules from scratch." We take this opportunity
               to purge as many fonts as possible. This is valuable because, for example,
               this function gets run when the page gets put into the page cache, so we
               want to destroy as much as possible. Not everything can be purged, however -
               only CSS-connected fonts which have never been inspected by script are
               purgeable. We don't allow fonts inspected by script to be purged because
               purging might result in a font appearing from JavaScript to transition from
               a success -> failure state, which we don't allow.
            b) Upon style recalc (possibly asynchronously) CSSFontSelector::addFontFaceRule()
               is called for each @font-face rule. We actually detect that we're in the
               middle of a style rebuild, and defer this step.
            c) When we're done adding all the font face rules, we call
               CSSFontSelector::buildCompleted(). This is where we compare the newly built-
               up list of font faces with what existed previously (as remembered in
               CSSFontSelector::buildStarted()) in order to detect font faces which were
               deleted from the document. Fonts which were newly added to the document
               are handled naturally.
               Fonts which have a property modified on them are created as if they were new.
               However, instead of simply adding the CSSFontFace, we search for the existing
               CSSFontFace (by CSS connection pointer) and tell the existing FontFace to
               adopt this new CSSFontFace. This means that the JavaScript object will just
               pick up any newly-written values in the CSSOM. It also means that the
               "status" attribute of the JavaScript object is reset, but this is expected
               and allowed by the spec. (For example, if you change the "src" attribute of
               an @font-face block via the CSSOM, all bets are off when you inspect the
               FontFace JS object representing that block.)

        Test: fast/text/font-face-set-cssom.html

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::CSSFontFace):
        (WebCore::CSSFontFace::setFamilies):
        (WebCore::CSSFontFace::setStyle):
        (WebCore::CSSFontFace::setWeight):
        (WebCore::CSSFontFace::setUnicodeRange):
        (WebCore::CSSFontFace::setVariantLigatures):
        (WebCore::CSSFontFace::setVariantPosition):
        (WebCore::CSSFontFace::setVariantCaps):
        (WebCore::CSSFontFace::setVariantNumeric):
        (WebCore::CSSFontFace::setVariantAlternates):
        (WebCore::CSSFontFace::setVariantEastAsian):
        (WebCore::CSSFontFace::setFeatureSettings):
        (WebCore::CSSFontFace::initializeWrapper):
        (WebCore::CSSFontFace::wrapper):
        (WebCore::CSSFontFace::setWrapper):
        (WebCore::CSSFontFace::purgeable):
        (WebCore::CSSFontFace::updateStyleIfNeeded):
        * css/CSSFontFace.h:
        * css/CSSFontFaceSet.cpp:
        (WebCore::CSSFontFaceSet::remove):
        (WebCore::CSSFontFaceSet::containsCSSConnection):
        (WebCore::CSSFontFaceSet::purge):
        * css/CSSFontFaceSet.h:
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::buildStarted):
        (WebCore::CSSFontSelector::buildCompleted):
        (WebCore::CSSFontSelector::addFontFaceRule):
        * css/CSSFontSelector.h:
        * css/FontFace.cpp:
        (WebCore::FontFace::family):
        (WebCore::FontFace::style):
        (WebCore::FontFace::weight):
        (WebCore::FontFace::unicodeRange):
        (WebCore::FontFace::variant):
        (WebCore::FontFace::featureSettings):
        (WebCore::FontFace::adopt):
        * css/FontFace.h:

2016-06-09  Andy Estes  <aestes@apple.com>

        Define printing{Minimum,Maximum}ShrinkFactor in only one place
        https://bugs.webkit.org/show_bug.cgi?id=158580

        Reviewed by Tim Horton.

        * page/PrintContext.cpp: Removed printingMinimumShrinkFactor and printingMaximumShrinkFactor.
        (WebCore::PrintContext::begin): Used minimumShrinkFactor() and maximumShrinkFactor() instead
        of printingMinimumShrinkFactor and printingMaximumShrinkFactor.
        (WebCore::PrintContext::computeAutomaticScaleFactor): Ditto.
        * page/PrintContext.h:
        (WebCore::PrintContext::minimumShrinkFactor): Added to return the same value as
        printingMinimumShrinkFactor.
        (WebCore::PrintContext::maximumShrinkFactor): Added to return the same value as
        printingMaximumShrinkFactor.

2016-06-09  Eric Carlson  <eric.carlson@apple.com>

        Don't show the caption menu if a video has only forced tracks
        https://bugs.webkit.org/show_bug.cgi?id=158573
        <rdar://problem/24632384>

        Reviewed by Jer Noble.

        Test: media/controls/forced-tracks-only.html

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.updateCaptionButton): Don't show the button of there are no user-selectable
          text or audio tracks.

        * page/CaptionUserPreferencesMediaAF.cpp:
        (WebCore::CaptionUserPreferencesMediaAF::sortedTrackListForMenu): Return an empty Vector if
          there are no user-selectable tracks.

2016-06-09  Jer Noble  <jer.noble@apple.com>

        Pass through play state and toggle state to the WebPlaybackControlsManager
        https://bugs.webkit.org/show_bug.cgi?id=158578
        <rdar://problem/25045616>

        Reviewed by Beth Dakin.

        Pass through the isPlaying portion of setRate() and allow toggling when a model is present.

        * platform/mac/WebPlaybackControlsManager.h:
        * platform/mac/WebPlaybackControlsManager.mm:
        * platform/mac/WebPlaybackSessionInterfaceMac.mm:
        (WebCore::WebPlaybackSessionInterfaceMac::setRate):
        (WebCore::WebPlaybackSessionInterfaceMac::setPlayBackControlsManager):

2016-06-09  Frederic Wang  <fred.wang@free.fr>

        RenderMathOperator: Move calculation of preferred width into MathOperator
        https://bugs.webkit.org/show_bug.cgi?id=157071

        Reviewed by Brent Fulgham.

        No new tests, behavior is not change.

        * rendering/mathml/MathOperator.cpp:
        (WebCore::MathOperator::setOperator): Introduce a style parameter and call reset.
        (WebCore::MathOperator::reset): New helper function to reset the operator.
        For now we only set the width of the base glyph and the preferred max width.
        (WebCore::MathOperator::calculateDisplayStyleLargeOperator): Calculate the m_maxPreferredWidth.
        (WebCore::MathOperator::calculateStretchyData): Change the signature of the function and directly set m_maxPreferredWidth.
        * rendering/mathml/MathOperator.h: Add m_maxPreferredWidth member and update some declarations.
        (WebCore::MathOperator::width): New helper function.
        (WebCore::MathOperator::maxPreferredWidth): New helper function.
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): This function performs wrong
        operations that will be fixed in bug 152244 when we update the tests.
        For now, let's just use maxPreferredWidth() for non-horizontal operators.
        (WebCore::RenderMathMLOperator::updateStyle): Use the new signature of the functions.

2016-06-09  Alex Christensen  <achristensen@webkit.org>

        Clean up WebSocket code
        https://bugs.webkit.org/show_bug.cgi?id=158551

        Reviewed by Darin Adler.

        No new tests.  There is no change in behavior.
        There seems to be no reason why SocketStreamHandle should be an AuthenticationClient.

        * Modules/websockets/ThreadableWebSocketChannel.h:
        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
        (WebCore::ThreadableWebSocketChannelClientWrapper::setSendRequestResult):
        (WebCore::ThreadableWebSocketChannelClientWrapper::bufferedAmount):
        (WebCore::ThreadableWebSocketChannelClientWrapper::setBufferedAmount):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveBinaryData):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didUpdateBufferedAmount):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didStartClosingHandshake):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
        * Modules/websockets/WebSocket.cpp:
        (WebCore::joinStrings):
        (WebCore::saturateAdd):
        (WebCore::WebSocket::send):
        (WebCore::WebSocket::readyState):
        (WebCore::WebSocket::bufferedAmount):
        (WebCore::WebSocket::didReceiveBinaryData):
        (WebCore::WebSocket::didReceiveMessageError):
        (WebCore::WebSocket::didUpdateBufferedAmount):
        (WebCore::WebSocket::didStartClosingHandshake):
        (WebCore::WebSocket::didClose):
        * Modules/websockets/WebSocket.h:
        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::WebSocketChannel):
        (WebCore::WebSocketChannel::~WebSocketChannel):
        (WebCore::WebSocketChannel::send):
        (WebCore::WebSocketChannel::bufferedAmount):
        (WebCore::WebSocketChannel::resume):
        (WebCore::WebSocketChannel::willOpenSocketStream):
        (WebCore::WebSocketChannel::didOpenSocketStream):
        (WebCore::WebSocketChannel::didCloseSocketStream):
        (WebCore::WebSocketChannel::didReceiveSocketStreamData):
        (WebCore::WebSocketChannel::didUpdateBufferedAmount):
        (WebCore::WebSocketChannel::didFailSocketStream):
        (WebCore::WebSocketChannel::didStartLoading):
        (WebCore::WebSocketChannel::appendToBuffer):
        (WebCore::WebSocketChannel::processBuffer):
        (WebCore::WebSocketChannel::resumeTimerFired):
        (WebCore::WebSocketChannel::startClosingHandshake):
        (WebCore::WebSocketChannel::didReceiveAuthenticationChallenge): Deleted.
        (WebCore::WebSocketChannel::didCancelAuthenticationChallenge): Deleted.
        * Modules/websockets/WebSocketChannel.h:
        * Modules/websockets/WebSocketChannelClient.h:
        (WebCore::WebSocketChannelClient::~WebSocketChannelClient):
        (WebCore::WebSocketChannelClient::didConnect):
        (WebCore::WebSocketChannelClient::didReceiveMessage):
        (WebCore::WebSocketChannelClient::didReceiveBinaryData):
        (WebCore::WebSocketChannelClient::didReceiveMessageError):
        (WebCore::WebSocketChannelClient::didUpdateBufferedAmount):
        (WebCore::WebSocketChannelClient::didStartClosingHandshake):
        (WebCore::WebSocketChannelClient::didClose):
        (WebCore::WebSocketChannelClient::WebSocketChannelClient):
        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
        (WebCore::WorkerThreadableWebSocketChannel::send):
        (WebCore::WorkerThreadableWebSocketChannel::bufferedAmount):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::bufferedAmount):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveBinaryData):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didUpdateBufferedAmount):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didStartClosingHandshake):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::bufferedAmount):
        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
        * platform/network/BlobData.cpp:
        (WebCore::BlobData::appendData):
        (WebCore::BlobData::appendFile):
        * platform/network/BlobData.h:
        (WebCore::BlobDataItem::BlobDataItem):
        * platform/network/BlobRegistry.h:
        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::appendStorageItems):
        (WebCore::BlobRegistryImpl::registerFileBlobURL):
        (WebCore::BlobRegistryImpl::registerBlobURL):
        (WebCore::BlobRegistryImpl::registerBlobURLOptionallyFileBacked):
        (WebCore::BlobRegistryImpl::registerBlobURLForSlice):
        * platform/network/BlobRegistryImpl.h:
        * platform/network/SocketStreamHandleBase.cpp:
        (WebCore::SocketStreamHandleBase::send):
        (WebCore::SocketStreamHandleBase::disconnect):
        (WebCore::SocketStreamHandleBase::sendPendingData):
        * platform/network/SocketStreamHandleBase.h:
        * platform/network/SocketStreamHandleClient.h:
        (WebCore::SocketStreamHandleClient::~SocketStreamHandleClient):
        (WebCore::SocketStreamHandleClient::willOpenSocketStream):
        (WebCore::SocketStreamHandleClient::didOpenSocketStream):
        (WebCore::SocketStreamHandleClient::didCloseSocketStream):
        (WebCore::SocketStreamHandleClient::didReceiveSocketStreamData):
        (WebCore::SocketStreamHandleClient::didUpdateBufferedAmount):
        (WebCore::SocketStreamHandleClient::didFailSocketStream):
        (WebCore::SocketStreamHandleClient::didReceiveAuthenticationChallenge): Deleted.
        (WebCore::SocketStreamHandleClient::didCancelAuthenticationChallenge): Deleted.
        * platform/network/cf/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::create):
        (WebCore::SocketStreamHandle::refAuthenticationClient): Deleted.
        (WebCore::SocketStreamHandle::derefAuthenticationClient): Deleted.
        * platform/network/cf/SocketStreamHandleCFNet.cpp:
        (WebCore::SocketStreamHandle::SocketStreamHandle):
        (WebCore::SocketStreamHandle::addCONNECTCredentials):
        (WebCore::SocketStreamHandle::copyCFStreamDescription):
        (WebCore::SocketStreamHandle::readStreamCallback):
        (WebCore::SocketStreamHandle::writeStreamCallback):
        (WebCore::SocketStreamHandle::reportErrorToClient):
        (WebCore::SocketStreamHandle::~SocketStreamHandle):
        (WebCore::SocketStreamHandle::platformClose):
        (WebCore::SocketStreamHandle::port):
        (WebCore::SocketStreamHandle::receivedCredential): Deleted.
        (WebCore::SocketStreamHandle::receivedRequestToContinueWithoutCredential): Deleted.
        (WebCore::SocketStreamHandle::receivedCancellation): Deleted.
        (WebCore::SocketStreamHandle::receivedRequestToPerformDefaultHandling): Deleted.
        (WebCore::SocketStreamHandle::receivedChallengeRejection): Deleted.
        * platform/network/curl/ResourceHandleCurl.cpp:
        * platform/network/curl/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::SocketData::SocketData):
        * platform/network/curl/SocketStreamHandleCurl.cpp:
        (WebCore::SocketStreamHandle::platformClose):
        (WebCore::SocketStreamHandle::readData):
        (WebCore::SocketStreamHandle::didReceiveData):
        (WebCore::SocketStreamHandle::didOpenSocket):
        (WebCore::SocketStreamHandle::createCopy):
        (WebCore::SocketStreamHandle::didReceiveAuthenticationChallenge): Deleted.
        (WebCore::SocketStreamHandle::receivedCredential): Deleted.
        (WebCore::SocketStreamHandle::receivedRequestToContinueWithoutCredential): Deleted.
        (WebCore::SocketStreamHandle::receivedCancellation): Deleted.
        (WebCore::SocketStreamHandle::receivedRequestToPerformDefaultHandling): Deleted.
        (WebCore::SocketStreamHandle::receivedChallengeRejection): Deleted.
        * platform/network/soup/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::create):
        * platform/network/soup/SocketStreamHandleSoup.cpp:
        (WebCore::getHandleFromId):
        (WebCore::deactivateHandle):
        (WebCore::activateHandle):
        (WebCore::SocketStreamHandle::SocketStreamHandle):
        (WebCore::SocketStreamHandle::~SocketStreamHandle):
        (WebCore::SocketStreamHandle::connected):
        (WebCore::SocketStreamHandle::readBytes):
        (WebCore::SocketStreamHandle::platformSend):
        (WebCore::SocketStreamHandle::platformClose):
        (WebCore::SocketStreamHandle::beginWaitingForSocketWritability):
        (WebCore::SocketStreamHandle::didReceiveAuthenticationChallenge): Deleted.
        (WebCore::SocketStreamHandle::receivedCredential): Deleted.
        (WebCore::SocketStreamHandle::receivedRequestToContinueWithoutCredential): Deleted.
        (WebCore::SocketStreamHandle::receivedCancellation): Deleted.
        (WebCore::SocketStreamHandle::receivedRequestToPerformDefaultHandling): Deleted.
        (WebCore::SocketStreamHandle::receivedChallengeRejection): Deleted.

2016-06-09  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r201815.
        https://bugs.webkit.org/show_bug.cgi?id=158570

        This broke the cmake build. (Requested by lforschler on
        #webkit).

        Reverted changeset:

        "Teach cmake about libWebKitSystemInterfaceOSX10.12"
        http://trac.webkit.org/changeset/201815

2016-06-09  Chris Dumez  <cdumez@apple.com>

        WorkerGlobalScope attributes / operations should be on the prototype
        https://bugs.webkit.org/show_bug.cgi?id=158568
        <rdar://problem/26720079>

        Reviewed by Geoffrey Garen.

        WorkerGlobalScope attributes / operations should be on the prototype
        because WorkerGlobalScope is not marked as [Global] / [PrimaryGlobal]:
        - https://html.spec.whatwg.org/multipage/workers.html#the-workerglobalscope-common-interface
        - http://heycam.github.io/webidl/#es-attributes
        - http://heycam.github.io/webidl/#es-operations

        DedicatedWorkerGlobalScope is the interface that is marked as [Global]
        and whose attributes / operations should be on the instance.

        This brings the number of failures on http://w3c-test.org/workers/interfaces.worker
        from 65 to 34. It also aligns our behavior with Firefox and Chrome.

        Test: fast/workers/WorkerGlobalScope-properties-prototype.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (InterfaceRequiresAttributesOnInstance):
        (OperationShouldBeOnInstance):

2016-06-09  Tim Horton  <timothy_horton@apple.com>

        Writing-mode-dependent properties don't apply if their value is a variable
        https://bugs.webkit.org/show_bug.cgi?id=158449
        <rdar://problem/26662478>

        Reviewed by Simon Fraser.

        Test: fast/css/variables/direction-dependent-variable-properties.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseVariableDependentValue):
        * css/CSSParser.h:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::resolvedVariableValue):
        CSSVariableDependentValue stores the unresolved (direction-dependent) property ID,
        because the property that it resolves to cannot be determined until style resolution time.
        Plumb the requisite direction and writing mode information into parseVariableDependentValue
        at style resolution time so that the property can be resolved to the correct
        non-direction-dependent property for each use of the value.

2016-06-09  Ryan Haddad  <ryanhaddad@apple.com>

        Attempt to fix the iOS build.

        Unreviewed build fix.

        * platform/network/mac/ResourceErrorMac.mm:
        (WebCore::ResourceError::ResourceError):

2016-06-09  Simon Fraser  <simon.fraser@apple.com>

        border-radius with different width and height rendered wrong
        https://bugs.webkit.org/show_bug.cgi?id=158300
        <rdar://problem/26672922>

        Reviewed by Zalan Bujtas.

        Borders with border-radius close to 100% 100% got oddly clipped. This happened because
        of the clipping we do to achieve the diagonal corner joins; RenderBoxModelObject::clipBorderSidePolygon()
        created trapezoids for each side, but only extended them to the center of the inner border rect.
        This clipped out parts of these borders.

        Fix by computing the trapezoids by intersecting the corner diagonal line with a line that passes
        through the adjacent corners of the inner rect, whose intersection is always going to be inside the
        rounded border. Also fix the quads used to do the antialiased/non-antialiased clipping,
        by adding a point rather than moving a corner point to ensure we don't mistakenly clip out any
        parts of the border.
        
        Finally, improve the rendering of non-renderable cases by actually doing the diagonal
        corner joins rather than just giving up.

        Tests: fast/borders/border-non-renderable-radius-inner-clip.html
               fast/borders/border-radius-inner-clip-vertical.html
               fast/borders/border-radius-inner-clip.html

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::calculateAdjustedInnerBorder): Moved up.
        (WebCore::RenderBoxModelObject::paintOneBorderSide):
        (WebCore::RenderBoxModelObject::clipBorderSidePolygon):
        (WebCore::findInnerVertex): Deleted.
        (WebCore::calculateSideRectIncludingInner): Deleted.
        (WebCore::RenderBoxModelObject::clipBorderSideForComplexInnerPath): Deleted.
        * rendering/RenderBoxModelObject.h:

2016-06-09  Xabier Rodriguez Calvar  <calvaris@igalia.com>

        Unreviewed, fixing compilation issue with WebRTC

        The code dependencies of the SDP processor were not right.

        * PlatformGTK.cmake:

2016-06-09  Frederic Wang  <fwang@igalia.com>

        Introduce MathOperator::Type
        https://bugs.webkit.org/show_bug.cgi?id=156950

        Reviewed by Sergio Villar Senin.

        No new tests, behavior is not change.

        An enum Type is introduced in MathOperator in order to indicate
        which kind of stretching is requested. In follow-up work, this will
        allow to just call setOperator and stretchTo without having to
        explicitly call calculateDisplayStyleLargeOperator or calculateStretchyData.

        * rendering/mathml/MathOperator.cpp:
        (WebCore::MathOperator::setOperator): Use Type instead of a boolean.
        (WebCore::MathOperator::setGlyphAssembly): Add an assert to ensure that the function is correctly used.
        (WebCore::MathOperator::calculateDisplayStyleLargeOperator): Ditto, this makes the assert more accurate.
        (WebCore::MathOperator::calculateStretchyData): Ditto and replace m_isVertical with a local isVertical variable.
        (WebCore::MathOperator::fillWithVerticalExtensionGlyph): Ditto.
        (WebCore::MathOperator::fillWithHorizontalExtensionGlyph): Ditto.
        (WebCore::MathOperator::paintVerticalGlyphAssembly): Ditto.
        (WebCore::MathOperator::paintHorizontalGlyphAssembly): Ditto.
        * rendering/mathml/MathOperator.h: Add the Type enum.
        (WebCore::MathOperator::stretchSize): Use Type instead of a boolean and add an
        assert to ensure that the function is correctly used.
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): Call setOperator with the correct value.
        (WebCore::RenderMathMLOperator::updateStyle): Ditto.

2016-06-09  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r201810.
        https://bugs.webkit.org/show_bug.cgi?id=158563

        breaks build without ENABLE_WEB_ANIMATION (Requested by
        mcatanzaro on #webkit).

        Reverted changeset:

        "[web-animations] Add Animatable, AnimationEffect,
        KeyframeEffect and Animation interface"
        https://bugs.webkit.org/show_bug.cgi?id=156096
        http://trac.webkit.org/changeset/201810

2016-06-09  Ryosuke Niwa  <rniwa@webkit.org>

        slotchange event should be fired at the end of microtask
        https://bugs.webkit.org/show_bug.cgi?id=157374
        <rdar://problem/26154024>

        Reviewed by Antti Koivisto.

        Dispatch slotchange event at the end of every microtask after delivering records to mutation observers
        as specified in: https://dom.spec.whatwg.org/#notify-mutation-observers

        Test: fast/shadow-dom/slotchange-event.html

        * dom/Document.cpp:
        (WebCore::Document::enqueueSlotchangeEvent): Deleted.
        * dom/Document.h:
        * dom/MutationObserver.cpp:
        (WebCore::signalSlotList): Added.
        (WebCore::MutationObserverMicrotask::run): mutationObserverCompoundMicrotaskQueuedFlag is now unset in
        notifyMutationObservers to better match the concept to "notify mutation observers".
        (WebCore::MutationObserver::enqueueSlotChangeEvent): Added.
        (WebCore::MutationObserver::notifyMutationObservers): Renamed from deliverAllMutations. Added the code
        to dispatch slotchange events as spec'ed, and also added comments for each step.
        * dom/MutationObserver.h:
        * html/HTMLSlotElement.cpp:
        (WebCore::HTMLSlotElement::enqueueSlotChangeEvent): Use MutationObserver::enqueueSlotChangeEvent. Don't
        create an event here since that is only needed when dispatching the event, and to keep track of whether
        we've already scheduled an event or not. Use a boolean flag instead for the latter. 
        (WebCore::HTMLSlotElement::dispatchSlotChangeEvent): Added. Creates and dispatches an event.
        (WebCore::HTMLSlotElement::dispatchEvent): Deleted.
        * html/HTMLSlotElement.h:
        (WebCore::HTMLSlotElement::didRemoveFromSignalSlotList): Added.

2016-06-08  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Introduce ResourceErrorBase::type
        https://bugs.webkit.org/show_bug.cgi?id=158299

        Reviewed by Alex Christensen.

        Introducing an enum type for ResourceErrorBase.
        In most cases, the type is set at construction time.
        By default, constructor with no parameters will set type to Null.
        Constructor with parameters will set type to General.

        Removed boolean state error fields.

        Introduced a type setter. It should only be used to  make the type
        more precise (when type is Null or General).

        Updating related calling code.

        No change of behavior.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::stopLoadingForPolicyChange):
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::cancel):
        * loader/EmptyClients.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::cancelledError):
        (WebCore::FrameLoader::blockedError):
        * loader/WorkerThreadableLoader.cpp:
        (WebCore::WorkerThreadableLoader::MainThreadBridge::cancel):
        * platform/network/ResourceErrorBase.cpp:
        (WebCore::ResourceErrorBase::isolatedCopy):
        (WebCore::ResourceErrorBase::setType):
        (WebCore::ResourceErrorBase::compare):
        * platform/network/ResourceErrorBase.h:
        (WebCore::ResourceErrorBase::isNull):
        (WebCore::ResourceErrorBase::isCancellation):
        (WebCore::ResourceErrorBase::isTimeout):
        (WebCore::ResourceErrorBase::type):
        (WebCore::ResourceErrorBase::ResourceErrorBase):
        (WebCore::ResourceErrorBase::domain):
        * platform/network/cf/ResourceError.h:
        (WebCore::ResourceError::ResourceError):
        * platform/network/cf/ResourceErrorCF.cpp:
        (WebCore::ResourceError::ResourceError):
        (WebCore::ResourceError::cfError):
        * platform/network/curl/ResourceError.h:
        (WebCore::ResourceError::ResourceError):
        * platform/network/mac/ResourceErrorMac.mm:
        (WebCore::m_platformError):
        (WebCore::ResourceError::nsError):
        (WebCore::ResourceError::ResourceError):
        (WebCore::ResourceError::platformLazyInit):
        * platform/network/soup/ResourceError.h:
        (WebCore::ResourceError::ResourceError):
        * platform/network/soup/ResourceErrorSoup.cpp:
        (WebCore::ResourceError::timeoutError):

2016-06-08  Frederic Wang  <fwang@igalia.com>

        Move selection and drawing of stretchy operators into a separate MathOperator class
        https://bugs.webkit.org/show_bug.cgi?id=156921

        Reviewed by Martin Robinson.

        No new tests, behavior is not changed.

        * CMakeLists.txt: Add the MathOperator files.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * rendering/mathml/MathOperator.cpp: Added.
        (WebCore::boundsForGlyph): Moved from RenderMathMLOperator.
        (WebCore::heightForGlyph): Moved from RenderMathMLOperator.
        (WebCore::advanceWidthForGlyph): Moved from RenderMathMLOperator.
        (WebCore::MathOperator::MathOperator):
        (WebCore::MathOperator::setOperator):
        (WebCore::MathOperator::getBaseGlyph): Moved from RenderMathMLOperator.
        (WebCore::MathOperator::setSizeVariant): Moved from RenderMathMLOperator.
        (WebCore::MathOperator::setGlyphAssembly): Moved from RenderMathMLOperator.
        (WebCore::MathOperator::calculateDisplayStyleLargeOperator): Moved from RenderMathMLOperator with additional style parameter.
        (WebCore::MathOperator::calculateGlyphAssemblyFallBack): Ditto.
        (WebCore::MathOperator::calculateStretchyData): Ditto.
        (WebCore::MathOperator::paintGlyph): Ditto.
        (WebCore::MathOperator::fillWithVerticalExtensionGlyph): Ditto.
        (WebCore::MathOperator::fillWithHorizontalExtensionGlyph): Ditto.
        (WebCore::MathOperator::paintVerticalGlyphAssembly): Ditto.
        (WebCore::MathOperator::paintHorizontalGlyphAssembly): Ditto.
        * rendering/mathml/MathOperator.h: Added.
        (WebCore::MathOperator::italicCorrection):
        (WebCore::MathOperator::isStretched):
        (WebCore::MathOperator::unstretch):
        (WebCore::MathOperator::GlyphAssemblyData::GlyphAssemblyData): Moved from RenderMathMLOperator.
        (WebCore::MathOperator::stretchSize):
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): Updated to use MathOperator members.
        For now we call setOperator to transmit information to m_mathOperator.
        (WebCore::RenderMathMLOperator::updateStyle): Updated to use MathOperator members.
        For now we set some m_mathOperator members to transmit it some information.
        (WebCore::RenderMathMLOperator::firstLineBaseline): Updated to use MathOperator members.
        (WebCore::RenderMathMLOperator::computeLogicalHeight): Ditto.
        (WebCore::RenderMathMLOperator::paint): Ditto.
        For now we set some m_mathOperator members to transmit it some information.
        (WebCore::RenderMathMLOperator::paintChildren): Updated to use MathOperator members.
        (WebCore::RenderMathMLOperator::trailingSpaceError): Ditto.
        (WebCore::RenderMathMLOperator::getBaseGlyph): Deleted.
        (WebCore::RenderMathMLOperator::setSizeVariant): Deleted.
        (WebCore::RenderMathMLOperator::setGlyphAssembly): Deleted.
        (WebCore::RenderMathMLOperator::calculateGlyphAssemblyFallBack): Deleted.
        (WebCore::RenderMathMLOperator::calculateDisplayStyleLargeOperator): Deleted.
        (WebCore::RenderMathMLOperator::calculateStretchyData): Deleted.
        (WebCore::RenderMathMLOperator::paintGlyph): Deleted.
        (WebCore::RenderMathMLOperator::fillWithVerticalExtensionGlyph): Deleted.
        (WebCore::RenderMathMLOperator::fillWithHorizontalExtensionGlyph): Deleted.
        (WebCore::RenderMathMLOperator::paintVerticalGlyphAssembly): Deleted.
        (WebCore::RenderMathMLOperator::paintHorizontalGlyphAssembly): Deleted.
        * rendering/mathml/RenderMathMLOperator.h:
        (WebCore::RenderMathMLOperator::italicCorrection): Updated to use MathOperator members.
        (WebCore::RenderMathMLOperator::GlyphAssemblyData::GlyphAssemblyData): Deleted.

2016-06-08  Chris Dumez  <cdumez@apple.com>

        DedicatedWorkerGlobalScope prototype chain is incorrect
        https://bugs.webkit.org/show_bug.cgi?id=158544

        Reviewed by Brady Eidson.

        There were several issues with the prototype chain of DedicatedWorkerGlobalScope:
        1. Object.getPrototypeOf(DedicatedWorkerGlobalScope.prototype) was not
           WorkerGlobalScope.prototype.
        2. WorkerGlobalScope.prototype was a DedicatedWorkerGlobalScopePrototype
           object and was equal to DedicatedWorkerGlobalScope.prototype.
        3. Object.getPrototypeOf(WorkerGlobalScope.prototype) was not EventTarget.prototype.

        Those issues were identified by the following W3C web-platform-test:
        http://w3c-test.org/workers/interfaces.worker

        This patch fixes the issue so that the prototype chain is now as per the
        specification.

        Test: fast/workers/DedicatedWorkerGlobalScope-prototype-chain.html

        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::initScript):
        - Stop creating the WorkerGlobalScopePrototype and let JSWorkerGlobalScope
          create it.
        - Set DedicatedWorkerGlobalScopePrototype's prototype to JSWorkerGlobalScope's
          prototype after creating the JSDedicatedWorkerGlobalScope object.

        * bindings/scripts/CodeGeneratorJS.pm:
        (ShouldUseGlobalObjectPrototype):
        (GenerateHeader):
        (GenerateImplementation):
        (GenerateConstructorHelperMethods):
        - Do not use globalObject.getPrototypeDirect() as 'prototype' property for
          WorkerGlobalScope. The globalObject is a DedicatedWorkerGlobalScope, not
          a WorkerGlobalScope.
        - Generate the code to create / get a prototype object for WorkerGlobalScope.


2016-06-08  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Imlement MediaEndpointPeerConnection::setRemoteDescription()
        https://bugs.webkit.org/show_bug.cgi?id=158467

        Reviewed by Eric Carlson.

        Implement MediaEndpointPeerConnection::setRemoteDescription() which verifies a
        remote offer or answer, configures the WebRTC backend and dispatches the 'track' events
        that represent the incoming media [1].

        This change also updates the RTCTrackEvent [2] with a streams and a transceiver attribute.

        [1] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html#dom-rtcpeerconnection-setremotedescription
        [2] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html#rtctrackevent

        Tests: fast/mediastream/RTCPeerConnection-setRemoteDescription-offer.html
               fast/mediastream/RTCTrackEvent-constructor.html

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::createSourceMap):
        (WebCore::MediaEndpointPeerConnection::setLocalDescriptionTask):
        (WebCore::MediaEndpointPeerConnection::setRemoteDescription):
        (WebCore::MediaEndpointPeerConnection::setRemoteDescriptionTask):
        Implemented.
        (WebCore::MediaEndpointPeerConnection::remoteDescription):
        (WebCore::MediaEndpointPeerConnection::currentRemoteDescription):
        (WebCore::MediaEndpointPeerConnection::pendingRemoteDescription):
        (WebCore::MediaEndpointPeerConnection::remoteDescriptionTypeValidForState):
        (WebCore::MediaEndpointPeerConnection::internalRemoteDescription):
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/mediastream/PeerConnectionBackend.h:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::addTransceiver):
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/mediastream/RTCRtpReceiver.h:
        (WebCore::RTCRtpReceiver::isDispatched):
        (WebCore::RTCRtpReceiver::setDispatched):
        * Modules/mediastream/RTCTrackEvent.cpp:
        (WebCore::RTCTrackEvent::create):
        (WebCore::RTCTrackEvent::RTCTrackEvent):
        * Modules/mediastream/RTCTrackEvent.h:
        (WebCore::RTCTrackEvent::streams):
        (WebCore::RTCTrackEvent::transceiver):
        * Modules/mediastream/RTCTrackEvent.idl:
        Add streams and transceiver attributes.
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        * bindings/js/JSDictionary.h:
        * platform/mediastream/MediaEndpoint.h:
        * platform/mock/MockMediaEndpoint.cpp:
        (WebCore::MockMediaEndpoint::filterPayloads):
        (WebCore::MockMediaEndpoint::updateSendConfiguration):
        * platform/mock/MockMediaEndpoint.h:

2016-06-08  John Wilander  <wilander@apple.com>

        Perform IDNA encoding on parameters for setHostAndPort and setHost
        https://bugs.webkit.org/show_bug.cgi?id=158371
        <rdar://problem/16869342>

        Reviewed by Brent Fulgham.

        Tests: fast/dom/set-document-location-host-to-unaccepted-values.html
               fast/dom/set-document-location-hostname-to-unaccepted-values.html
               http/tests/dom/set-document-location-host-to-accepted-values.html
               http/tests/dom/set-document-location-hostname-to-accepted-values.html

        * platform/URL.cpp:
        (WebCore::containsOnlyASCII):
            Moved up to enable usage in URL::setHost and URL::setHostAndPort.
        (WebCore::appendEncodedHostname):
            Moved up to enable usage in URL::setHost and URL::setHostAndPort.
        (WebCore::URL::setHost):
            Now disallows the colon character, does IDNA encoding, and uses StringBuilder.
        (WebCore::URL::setHostAndPort):
            Now disallows multiple colons, disallows non-numeric ports, disallows the empty
            string, does IDNA encoding, and uses StringBuilder.

2016-06-08  Alex Christensen  <achristensen@webkit.org>

        Fix WinCairo build.

        * platform/network/curl/MultipartHandle.cpp:
        (WebCore::MultipartHandle::didReceiveResponse):

2016-06-08  Alex Christensen  <achristensen@webkit.org>

        Fix WinCairo build.

        * platform/network/curl/MultipartHandle.cpp:
        (WebCore::MultipartHandle::didReceiveResponse):

2016-06-08  Jer Noble  <jer.noble@apple.com>

        With audio user gesture restriction in place, video.src = 'file', video.play() succeeds where it should fail.
        https://bugs.webkit.org/show_bug.cgi?id=158546

        Reviewed by Eric Carlson.

        Test: media/video-playback-restriction-play-before-load.html

        Don't check that the media element isPlaying(); that will only return true if playback has begun.
        Instead, check !paused(), as that will be true as soon as the play() method returns.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerCharacteristicChanged):
        (WebCore::HTMLMediaElement::updateShouldPlay):
        * rendering/RenderLayer.h:

2016-06-08  Alex Christensen  <achristensen@webkit.org>

        Modernize WebSocket code
        https://bugs.webkit.org/show_bug.cgi?id=158539

        Reviewed by Brady Eidson.

        No new tests, no change in behavior.

        * Modules/websockets/ThreadableWebSocketChannel.cpp:
        (WebCore::ThreadableWebSocketChannel::create):
        * Modules/websockets/ThreadableWebSocketChannel.h:
        (WebCore::ThreadableWebSocketChannel::ThreadableWebSocketChannel):
        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
        (WebCore::ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper):
        (WebCore::ThreadableWebSocketChannelClientWrapper::create):
        (WebCore::ThreadableWebSocketChannelClientWrapper::processPendingTasks):
        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect):
        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::WebSocketChannel):
        * Modules/websockets/WebSocketChannel.h:
        (WebCore::WebSocketChannel::create):
        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
        (WebCore::WorkerThreadableWebSocketChannel::WorkerThreadableWebSocketChannel):
        (WebCore::WorkerThreadableWebSocketChannel::subprotocol):
        (WebCore::WorkerThreadableWebSocketChannel::extensions):
        (WebCore::WorkerThreadableWebSocketChannel::resume):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::Peer):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::send):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::bufferedAmount):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didConnect):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveMessage):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveBinaryData):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didUpdateBufferedAmount):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didStartClosingHandshake):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveMessageError):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::Bridge):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::~Bridge):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::initialize):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::connect):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::bufferedAmount):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::close):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::setMethodNotCompleted):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::waitForMethodCompletion):
        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
        (WebCore::WorkerThreadableWebSocketChannel::create):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::create):

2016-06-08  Chris Dumez  <cdumez@apple.com>

        First parameter to MessagePort / DedicatedWorkerGlobalScope.postMessage() should be mandatory
        https://bugs.webkit.org/show_bug.cgi?id=158540

        Reviewed by Geoffrey Garen.

        First parameter to MessagePort / DedicatedWorkerGlobalScope.postMessage() should be mandatory:
        - https://html.spec.whatwg.org/multipage/comms.html#messageport
        - https://html.spec.whatwg.org/multipage/workers.html#dedicated-workers-and-the-dedicatedworkerglobalscope-interface

        Previously, WebKit send a bogus MessageEvent whose data attribute is undefined. This would
        cause a testharness error when running the following W3C test:
        - http://w3c-test.org/workers/interfaces.worker

        Firefox and Chrome already correctly throw in this case. Our Window.postMessage() API is also
        already throwing in this case.

        Test: fast/workers/postMessage-missing-parameter.html

        * bindings/js/JSMessagePortCustom.h:
        (WebCore::handlePostMessage):

2016-06-08  Gavin Barraclough  <barraclough@apple.com>

        Remove removeDirect
        https://bugs.webkit.org/show_bug.cgi?id=158516

        Reviewed by Ryosuke Niwa.

        removeDirect is typically used as a subroutine of deleteProperty, but is also available to
        call directly. Having this functionality factored out to a separate routine is a bad idea
        on a couple of fronts:

        - for the main use within deleteProperty there is redundancy (presence of the property
          was being checked twice) and inconsistency (the two functions returned different results
          in the case of a nonexistent property; the result from removeDirect was never observed).

        - all uses of removeDirect are in practical terms incorrect. removeDirect had the
          advantage of ignoring the configurable (DontDelete) attributes, but this is achievable
          using the DeletePropertyMode setting - and the disadvantage of failing delete static
          table properties. Last uses were one that was removed in bug #158295 (where failure to
          delete static properties was a problem), and as addressed in this patch removeDirect is
          being used to implement runtime enabled features. This only works because we currently
          force reification of all properties on the DOM prototype objects, so in effect there are
          no static properties. In order to make the code robust such that runtime enabled
          features would still work even if we were not reifying static properties (a change we
          may want to make) we should be calling deleteProperty in this case too.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
            - changed to call deleteProperty instead of removeDirect.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjPrototype::finishCreation):
            - updated bindings test results.

2016-06-08  Nan Wang  <n_wang@apple.com>

        For keyboard users, activating a fragment URL should transfer focus and caret to the destination
        https://bugs.webkit.org/show_bug.cgi?id=116046

        Reviewed by Ryosuke Niwa.

        Added a sequential focus navigation starting node to document. When TAB or SHIFT-TAB is pressed
        and there is no focused element, we start searching for next focus candidates at the sequential
        focus navigation node.
        Spec: https://html.spec.whatwg.org/multipage/interaction.html#sequential-focus-navigation-starting-point

        Test: fast/events/sequential-focus-navigation-starting-point.html

        * dom/Document.cpp:
        (WebCore::Document::removedLastRef):
        (WebCore::Document::destroyRenderTree):
        (WebCore::Document::styleResolverChanged):
        (WebCore::isNodeInSubtree):
        (WebCore::Document::removeFocusedNodeOfSubtree):
        (WebCore::Document::hoveredElementDidDetach):
        (WebCore::Document::setFocusedElement):
        (WebCore::shouldResetFocusNavigationStartingNode):
        (WebCore::Document::setFocusNavigationStartingNode):
        (WebCore::Document::focusNavigationStartingNode):
        (WebCore::Document::setCSSTarget):
        (WebCore::Document::nodeChildrenWillBeRemoved):
        (WebCore::Document::nodeWillBeRemoved):
        (WebCore::fallbackFocusNavigationStartingNodeAfterRemoval):
        (WebCore::Document::removeFocusNavigationNodeOfSubtree):
        (WebCore::Document::textInserted):
        * dom/Document.h:
        (WebCore::Document::userActionElements):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMousePressEvent):
        * page/FocusController.cpp:
        (WebCore::FocusController::advanceFocusInDocumentOrder):
        * page/FrameView.cpp:
        (WebCore::FrameView::scrollToAnchor):

2016-06-08  Eric Carlson  <eric.carlson@apple.com>

        HTMLMediaElement.prototype.canPlayType accounting for 250-750ms first loading theverge.com
        https://bugs.webkit.org/show_bug.cgi?id=158335
        <rdar://problem/26615416>

        Reviewed by Brent Fulgham.

        * WebCore.xcodeproj/project.pbxproj: Add AVFoundationMIMETypeCache.

        * platform/graphics/avfoundation/objc/AVFoundationMIMETypeCache.h: Added.
        * platform/graphics/avfoundation/objc/AVFoundationMIMETypeCache.mm: Added.
        (WebCore::AVFoundationMIMETypeCache::AVFoundationMIMETypeCache):
        (WebCore::AVFoundationMIMETypeCache::loadTypes):
        (WebCore::AVFoundationMIMETypeCache::types):
        (WebCore::AVFoundationMIMETypeCache::singleton):

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::registerMediaEngine): Start MIME type loading.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::getSupportedTypes): Use AVFoundationMIMETypeCache.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::supportsType): Ditto.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::supportsKeySystem): Ditto.
        (WebCore::avfMIMETypes): Deleted.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::registerMediaEngine): Start MIME type loading.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::isAvailable): Use AVFoundationMIMETypeCache.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::getSupportedTypes): Ditto.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::supportsType): Ditto.
        (WebCore::mimeTypeCache): Deleted.

2016-06-07  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION (r201667): ASSERTION FAILED: !m_anchorNode || !editingIgnoresContent(*m_anchorNode)
        https://bugs.webkit.org/show_bug.cgi?id=158373
        <rdar://problem/26690795>

        Reviewed by Brent Fulgham.

        The bug was caused by VisibleSelection::toNormalizedRange calling parentAnchoredEquivalent on an orphaned Position.
        Fixed it by checking that condition and exiting early since we can't create a Range with a detached node anyway.

        Also renamed isNonOrphanedCaretOrRange to isNoneOrOrphaned after negating the semantics for clarity.

        Test: editing/selection/selection-in-iframe-removed-crash.html

        * editing/EditorCommand.cpp:
        (WebCore::valueFormatBlock):
        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance):
        * editing/InsertLineBreakCommand.cpp:
        (WebCore::InsertLineBreakCommand::doApply):
        * editing/InsertListCommand.cpp:
        (WebCore::InsertListCommand::doApply):
        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::doApply):
        * editing/InsertTextCommand.cpp:
        (WebCore::InsertTextCommand::doApply):
        * editing/RemoveFormatCommand.cpp:
        (WebCore::RemoveFormatCommand::doApply):
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::doApply):
        * editing/SetSelectionCommand.cpp:
        (WebCore::SetSelectionCommand::doApply):
        (WebCore::SetSelectionCommand::doUnapply):
        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::doApply):
        * editing/VisibleSelection.cpp:
        (WebCore::VisibleSelection::firstRange): Also added a check for isNoneOrOrphaned since this function can hit the same
        assertion when the selection end points are orphaned.
        (WebCore::VisibleSelection::toNormalizedRange): Fixed the bug.
        * editing/VisibleSelection.h:
        (WebCore::VisibleSelection::isNoneOrOrphaned): Renamed from isNonOrphanedCaretOrRange and negated the semantics.

2016-06-08  Dean Jackson  <dino@apple.com>

        Multiple selectors break keyframes animation
        https://bugs.webkit.org/show_bug.cgi?id=158199
        <rdar://problem/26652591>

        Reviewed by Simon Fraser.

        If we came across a duplicate key entry in a keyframe, we
        were replacing the existing entry, instead of merging.

        Test: animations/duplicate-keys.html

        * css/CSSKeyframeRule.h:
        (WebCore::StyleKeyframe::setKey): Add a way to set the key of a rule
        as a number, rather than going through a string and the CSS parser.
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::keyframeStylesForAnimation): Check if the rule
        has duplicates, and if it does, merge all the common entries.
        * rendering/style/KeyframeList.cpp:
        (WebCore::KeyframeList::insert): Now that we've removed duplicates at
        the processing time, we should never come across a duplicate while
        building this list.

2016-06-08  Ryan Haddad  <ryanhaddad@apple.com>

        Rebaseline bindings tests after r201808

        Unreviewed test gardening.

        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        (WebCore::JSTestGlobalObject::finishCreation):
        * bindings/scripts/test/JS/JSTestGlobalObject.h:

2016-06-08  Lucas Forschler  <lforschler@apple.com>

        Teach cmake about libWebKitSystemInterfaceOSX10.12
        
        Rubber-stamped by Matt Hanson and Alex Christensen.
        
        * PlatformMac.cmake:

2016-06-08  Rawinder Singh  <rawinder.singh-webkit@cisra.canon.com.au>

        [web-animations] Add Animatable, AnimationEffect, KeyframeEffect and Animation interface
        https://bugs.webkit.org/show_bug.cgi?id=156096

        Reviewed by Dean Jackson.

        Adds:
        - Animatable interface and implementation of getAnimations in Element
        - Interface and implementation for Document getAnimations method.
        - AnimationEffect interface and class stub.
        - KeyframeEffect interface and constructor implementation.
        - 'Animation' interface, constructor and query methods for effect and timeline.
        - Remove runtime condition on Web animation interfaces (compile time flag is specified).

        Test: webanimations/Document.html

        * CMakeLists.txt:
        * DerivedSources.make:
        * PlatformGTK.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * animation/Animatable.idl: Copied from Source/WebCore/animation/DocumentAnimation.idl.
        * animation/AnimationEffect.cpp: Copied from Source/WebCore/animation/AnimationTimeline.cpp.
        (WebCore::AnimationEffect::AnimationEffect):
        (WebCore::AnimationEffect::~AnimationEffect):
        (WebCore::AnimationEffect::setAnimation):
        (WebCore::AnimationEffect::isCurrent):
        (WebCore::AnimationEffect::isInEffect):
        * animation/AnimationEffect.h: Copied from Source/WebCore/animation/DocumentTimeline.cpp.
        * animation/AnimationEffect.idl: Copied from Source/WebCore/animation/AnimationTimeline.idl.
        * animation/AnimationTimeline.cpp:
        (WebCore::AnimationTimeline::destroy):
        (WebCore::AnimationTimeline::attachAnimation):
        (WebCore::AnimationTimeline::detachAnimation):
        * animation/AnimationTimeline.h:
        * animation/AnimationTimeline.idl:
        * animation/DocumentAnimation.cpp:
        (WebCore::DocumentAnimation::timeline):
        (WebCore::DocumentAnimation::getAnimations):
        (WebCore::DocumentAnimation::addAnimation):
        (WebCore::DocumentAnimation::removeAnimation):
        * animation/DocumentAnimation.h:
        (WebCore::DocumentAnimation::getAnimations):
        * animation/DocumentAnimation.idl:
        * animation/DocumentTimeline.cpp:
        (WebCore::DocumentTimeline::create):
        (WebCore::DocumentTimeline::DocumentTimeline):
        (WebCore::DocumentTimeline::attach):
        (WebCore::DocumentTimeline::detach):
        * animation/DocumentTimeline.h:
        * animation/DocumentTimeline.idl:
        * animation/KeyframeEffect.cpp: Copied from Source/WebCore/animation/DocumentTimeline.cpp.
        (WebCore::KeyframeEffect::create):
        (WebCore::KeyframeEffect::KeyframeEffect):
        (WebCore::KeyframeEffect::~KeyframeEffect):
        * animation/KeyframeEffect.h: Copied from Source/WebCore/animation/DocumentTimeline.h.
        * animation/KeyframeEffect.idl: Copied from Source/WebCore/animation/AnimationTimeline.idl.
        * animation/WebAnimation.cpp: Copied from Source/WebCore/animation/DocumentAnimation.cpp.
        (WebCore::WebAnimation::create):
        (WebCore::WebAnimation::WebAnimation):
        (WebCore::WebAnimation::~WebAnimation):
        * animation/WebAnimation.h: Copied from Source/WebCore/animation/DocumentAnimation.h.
        * animation/WebAnimation.idl: Copied from Source/WebCore/animation/DocumentTimeline.idl.
        * bindings/scripts/CodeGeneratorGObject.pm:
        * dom/Element.cpp:
        (WebCore::Element::getAnimations):
        * dom/Element.h:
        * dom/Element.idl:

2016-06-08  Chris Dumez  <cdumez@apple.com>

        self.hasOwnProperty() does not work inside Web workers
        https://bugs.webkit.org/show_bug.cgi?id=158446
        <rdar://problem/26638397>

        Reviewed by Geoffrey Garen.

        W3C tests for workers were severely broken on WebKit because
        self.hasOwnProperty() did not work inside workers. The reason is that
        hasOwnProperty() (and other methods like toString()) call toThis() in
        StrictMode on thisValue. However, in the case of 'self' in workers,
        self was a DedicatedWorkerGlobalScope, which is a JSGlobalObject.
        JSGlobalObject::toThis() returns jsUndefined() when called in strict
        mode. As a result, we would end up with exceptions such as "undefined
        is not an object" when calling self.hasOwnProperty() in workers.

        To address the problem, this patch introduces a JSProxy whose proxy
        type is PureForwardingProxyType and whose target is the
        WorkerGlobalScope. This JSProxy is what we expose to the JavaScript,
        instead of the JSWorkerGlobalScope itself. As a result, toThis() now
        behaves as expected and self.hasOwnProperty() works inside workers.

        This patch greatly improves our pass rate on several W3C tests:
        http://w3c-test.org/workers/interfaces.worker: 20 passes -> 50 passes (out of 128)
        http://w3c-test.org/IndexedDB/interfaces.worker 0 passes -> 145 passes (out of 156)

        Tests: fast/workers/self-hasOwnProperty.html
               fast/workers/self-toString.html

        * bindings/js/JSWorkerGlobalScopeBase.cpp:
        (WebCore::JSWorkerGlobalScopeBase::finishCreation):
        (WebCore::JSWorkerGlobalScopeBase::visitChildren):
        (WebCore::toJS):
        * bindings/js/JSWorkerGlobalScopeBase.h:
        (WebCore::JSWorkerGlobalScopeBase::proxy):
        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::initScript):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):

2016-06-08  Antti Koivisto  <antti@apple.com>

        WebKit memory cache doesn't respect Vary header
        https://bugs.webkit.org/show_bug.cgi?id=71509
        <rdar://problem/26651033>

        Reviewed by Sam Weinig.

        Implement Vary header support in WebCore memory cache.

        The patch moves Vary header code from WebKit2 Network Cache to WebCore and uses it to
        verify the headers for CachedResources.

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::failBeforeStarting):
        (WebCore::addAdditionalRequestHeadersToRequest):

            Factor into standalone function so we can use it from varyHeaderValuesMatch.

        (WebCore::CachedResource::addAdditionalRequestHeaders):
        (WebCore::CachedResource::load):
        (WebCore::CachedResource::setResponse):

            Collect the Vary header values when we receive a response.

        (WebCore::CachedResource::responseReceived):
        (WebCore::CachedResource::redirectChainAllowsReuse):
        (WebCore::CachedResource::varyHeaderValuesMatch):

            Test for Vary match.

        (WebCore::CachedResource::overheadSize):
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::isCacheValidator):
        (WebCore::CachedResource::resourceToRevalidate):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::determineRevalidationPolicy):

            Reload on Vary mismatch.

        * platform/network/CacheValidation.cpp:
        (WebCore::parseCacheControlDirectives):
        (WebCore::headerValueForVary):
        (WebCore::collectVaryingRequestHeaders):
        (WebCore::verifyVaryingRequestHeaders):

            Vary header collection and validation code moves here.

        * platform/network/CacheValidation.h:

2016-06-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r201800.
        https://bugs.webkit.org/show_bug.cgi?id=158518

        Missing WebKit2 pieces (Requested by anttik on #webkit).

        Reverted changeset:

        "WebKit memory cache doesn't respect Vary header"
        https://bugs.webkit.org/show_bug.cgi?id=71509
        http://trac.webkit.org/changeset/201800

2016-06-06  Antti Koivisto  <antti@apple.com>

        WebKit memory cache doesn't respect Vary header
        https://bugs.webkit.org/show_bug.cgi?id=71509
        <rdar://problem/26651033>

        Reviewed by Sam Weinig.

        Implement Vary header support in WebCore memory cache.

        The patch moves Vary header code from WebKit2 Network Cache to WebCore and uses it to
        verify the headers for CachedResources.

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::failBeforeStarting):
        (WebCore::addAdditionalRequestHeadersToRequest):

            Factor into standalone function so we can use it from varyHeaderValuesMatch.

        (WebCore::CachedResource::addAdditionalRequestHeaders):
        (WebCore::CachedResource::load):
        (WebCore::CachedResource::setResponse):

            Collect the Vary header values when we receive a response.

        (WebCore::CachedResource::responseReceived):
        (WebCore::CachedResource::redirectChainAllowsReuse):
        (WebCore::CachedResource::varyHeaderValuesMatch):

            Test for Vary match.

        (WebCore::CachedResource::overheadSize):
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::isCacheValidator):
        (WebCore::CachedResource::resourceToRevalidate):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::determineRevalidationPolicy):

            Reload on Vary mismatch.

        * platform/network/CacheValidation.cpp:
        (WebCore::parseCacheControlDirectives):
        (WebCore::headerValueForVary):
        (WebCore::collectVaryingRequestHeaders):
        (WebCore::verifyVaryingRequestHeaders):

            Vary header collection and validation code moves here.

        * platform/network/CacheValidation.h:

2016-06-08  Myles C. Maxfield  <mmaxfield@apple.com>

        Extend CSSFontSelector's lifetime to be longer than the Document's lifetime
        https://bugs.webkit.org/show_bug.cgi?id=154101

        Reviewed by Darin Adler.

        Rather than destroying the Document's CSSFontSelector, instead, the object should
        live for the lifetime of the document, and it should instead be asked to clear its
        contents.

        This is important for the CSS Font Loading API, where the identity of objects the
        CSSFontSelector references needs to persist throughout the lifetime of the
        Document. This patch represents the first step to implementing this correctly.
        The second step is for the CSSFontSelector to perform a diff instead of a
        wholesale clear of its contents. Once this is done, font loading objects can
        survive through a call to Document::clearStyleResolver().

        This patch gives the CSSFontSelector two states: building underway and building not
        underway. The state is building underway in between calls to clearStyleResolver()
        and when the style resolver gets built back up. Otherwise, the state is building
        not underway. Because of this new design, creation of all FontFace objects can be
        postponed until a state transition from building underway to building not underway.
        A subsequent patch will perform the diff at this point. An ASSERT() makes sure that
        we never service a font lookup request while Building.

        No new tests because there is no behavior change.

        * css/CSSFontFaceSet.cpp:
        (WebCore::CSSFontFaceSet::clear):
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::buildStarted):
        (WebCore::CSSFontSelector::buildCompleted):
        (WebCore::CSSFontSelector::addFontFaceRule):
        (WebCore::CSSFontSelector::fontRangesForFamily):
        (WebCore::CSSFontSelector::CSSFontSelector): Deleted.
        (WebCore::CSSFontSelector::clearDocument): Deleted.
        * css/CSSFontSelector.h:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::appendAuthorStyleSheets):
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::~Document):
        (WebCore::Document::clearStyleResolver):
        (WebCore::Document::fontSelector): Deleted.
        * dom/Document.h:
        (WebCore::Document::fontSelector):

2016-06-08  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Imlement MediaEndpointPeerConnection::setLocalDescription()
        https://bugs.webkit.org/show_bug.cgi?id=158190

        Reviewed by Eric Carlson.

        Add implementation for MediaEndpointPeerConnection::setLocalDescription. This function
        parses the input SDP, configures the media backend and updates the
        RTCPeerConnection state.

        This change adds MediaEndpointSessionDescription which is an object representation
        of an RTCSessionDescription (which contains an SDP string).

        Test: fast/mediastream/RTCPeerConnection-setLocalDescription-offer.html

        * CMakeLists.txt:
        Add MediaEndpointSessionDescription.
        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::hasUnassociatedTransceivers):
        (WebCore::MediaEndpointPeerConnection::createOfferTask):
        (WebCore::MediaEndpointPeerConnection::setLocalDescription):
        (WebCore::MediaEndpointPeerConnection::setLocalDescriptionTask):
        Add implementation.
        (WebCore::MediaEndpointPeerConnection::localDescription):
        (WebCore::MediaEndpointPeerConnection::currentLocalDescription):
        (WebCore::MediaEndpointPeerConnection::pendingLocalDescription):
        (WebCore::MediaEndpointPeerConnection::localDescriptionTypeValidForState):
        (WebCore::MediaEndpointPeerConnection::internalLocalDescription):
        (WebCore::MediaEndpointPeerConnection::createRTCSessionDescription):
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/mediastream/MediaEndpointSessionDescription.cpp: Added.
        (WebCore::MediaEndpointSessionDescription::create):
        (WebCore::MediaEndpointSessionDescription::toRTCSessionDescription):
        (WebCore::MediaEndpointSessionDescription::typeString):
        (WebCore::MediaEndpointSessionDescription::isLaterThan):
        * Modules/mediastream/MediaEndpointSessionDescription.h: Added.
        (WebCore::MediaEndpointSessionDescription::~MediaEndpointSessionDescription):
        (WebCore::MediaEndpointSessionDescription::type):
        (WebCore::MediaEndpointSessionDescription::configuration):
        (WebCore::MediaEndpointSessionDescription::MediaEndpointSessionDescription):
        * WebCore.xcodeproj/project.pbxproj:
        Add MediaEndpointSessionDescription.

2016-06-07  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GLIB] Implement hardLinkOrCopyFile() in FileSystemGlib
        https://bugs.webkit.org/show_bug.cgi?id=158473

        Reviewed by Michael Catanzaro.

        It was added in r199230 to be used by IndexedDB blob support, but never implemented for GLib.

        * platform/glib/FileSystemGlib.cpp:
        (WebCore::hardLinkOrCopyFile):

2016-06-07  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Refactor: Use captures with initializers in MediaEndpointPeerConnection::createOffer()
        https://bugs.webkit.org/show_bug.cgi?id=158486

        Reviewed by Eric Carlson.

        Use initializers for the capture list when scheduling the "create offer task".

        No change in behavior.

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::createOffer):
        (WebCore::WrappedSessionDescriptionPromise::create): Deleted.
        (WebCore::WrappedSessionDescriptionPromise::promise): Deleted.
        (WebCore::WrappedSessionDescriptionPromise::WrappedSessionDescriptionPromise): Deleted.
        Not needed anymore.

2016-06-07  Nael Ouedraogo  <nael.ouedraogo@crf.canon.fr>

        TouchList::append() should take a Ref instead of RefPtr
        https://bugs.webkit.org/show_bug.cgi?id=158469

        Reviewed by Chris Dumez.

        RefPtr<Touch> items handled in TouchList cannot be null. Thus
        RefPtr<Touch> is replaced by Ref<Touch> objects.

        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::createTouchList):
        * dom/TouchList.cpp:
        (WebCore::TouchList::item):
        * dom/TouchList.h:
        (WebCore::TouchList::append):

2016-06-07  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        EFL build has been broken since r201761
        https://bugs.webkit.org/show_bug.cgi?id=158512

        Unreviewed build fix.

        * platform/posix/SharedBufferPOSIX.cpp: 
        (WebCore::SharedBuffer::createFromReadingFile):
        Do not use ? operand in return line. Additionally return nullptr instead of 0.

2016-06-07  Chris Dumez  <cdumez@apple.com>

        Expose Event / EventTarget properties on WorkerGlobalScope
        https://bugs.webkit.org/show_bug.cgi?id=158511

        Reviewed by Sam Weinig.

        Expose Event / EventTarget properties on WorkerGlobalScope, as per the
        latest DOM specification:
        - https://dom.spec.whatwg.org/#interface-event
        - https://dom.spec.whatwg.org/#interface-eventtarget

        No new tests, rebaselined existing test.

        * dom/Event.idl:
        * dom/EventTarget.idl:

2016-06-07  Joonghun Park  <jh718.park@samsung.com>

        [EFL] Build fix related with SharedBuffer::createFromReadingFile in SharedBufferPosix.cpp
        https://bugs.webkit.org/show_bug.cgi?id=158515

        * platform/posix/SharedBufferPOSIX.cpp:
        (WebCore::SharedBuffer::createFromReadingFile):

2016-06-07  Mark Lam  <mark.lam@apple.com>

        Need an exception check after constructEmptyArray().
        https://bugs.webkit.org/show_bug.cgi?id=158411

        Reviewed by Saam Barati.

        A stress test for this was added in JavaScriptCore.

        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::toJS):
        * bindings/js/JSCommandLineAPIHostCustom.cpp:
        (WebCore::getJSListenerFunctions):
        * bindings/js/JSCryptoKeySerializationJWK.cpp:
        (WebCore::buildJSONForRSAComponents):
        (WebCore::addBoolToJSON):
        (WebCore::addUsagesToJSON):
        (WebCore::JSCryptoKeySerializationJWK::serialize):
        * bindings/js/JSDOMBinding.h:
        (WebCore::toJS):
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneDeserializer::deserialize):

2016-06-07  Antoine Quint  <graouts@apple.com>

        The backdrop-filter property does not respect border-radius
        https://bugs.webkit.org/show_bug.cgi?id=158483
        <rdar://problem/24210257>

        Reviewed by Simon Fraser.

        In order to correctly support border-radius and backdrop-filter together, we change
        the value set as the m_backdropFiltersRect from a FloatRect to FloatRoundedRect so
        that it accounts for values set by the border-radius property. Then we add a new
        m_backdropClippingLayer PlatformCALayer member to clip the backdrop layer in the
        event that the border-radius is non-zero in updateBackdropFiltersRect(). Finally,
        we follow the same pattern used for other PlatformCALayers owned by a GraphicsLayerCA
        to support cloning of the new m_backdropClippingLayer.

        Tests: css3/filters/backdrop/backdrop-filter-with-border-radius-and-reflection-add.html
               css3/filters/backdrop/backdrop-filter-with-border-radius-and-reflection-remove.html
               css3/filters/backdrop/backdrop-filter-with-border-radius-and-reflection.html
               css3/filters/backdrop/backdrop-filter-with-border-radius-value-change.html
               css3/filters/backdrop/backdrop-filter-with-border-radius-value-remove.html
               css3/filters/backdrop/backdrop-filter-with-border-radius.html

        * platform/graphics/GraphicsLayer.h:
        (WebCore::GraphicsLayer::setBackdropFiltersRect):
        (WebCore::GraphicsLayer::backdropFiltersRect):
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::willBeDestroyed):
        (WebCore::GraphicsLayerCA::setBackdropFiltersRect):
        (WebCore::GraphicsLayerCA::updateBackdropFiltersRect):
        (WebCore::GraphicsLayerCA::dumpAdditionalProperties):
        * platform/graphics/ca/GraphicsLayerCA.h:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateBackdropFiltersGeometry):
        Use a rounded rect if there is no clip and we have non-zero border-radius set on the renderer.

2016-06-07  Andreas Kling  <akling@apple.com>

        CachedScript should avoid recomputing its hash multiple times.
        <https://webkit.org/b/158506>

        Reviewed by Saam Barati.

        JSBench was hitting CachedScript::script() hard and spending lots of time hashing scripts.
        Since we're already caching the hash in a member variable, don't bother rehashing if we've
        already done it before.

        This takes total time spent in StringImpl::hashSlowCase() from 1600ms to 77ms on my MBP.

        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::script):

2016-06-07  Keith Rollin  <krollin@apple.com>

        Remove all uses of PassRefPtr in WTF
        https://bugs.webkit.org/show_bug.cgi?id=157596
        <rdar://problem/26234391>

        Reviewed by Chris Dumez.

        Update calls to interfaces that no longer take or return PassRefPtrs.

        No new tests: no new functionality so changes are covered by existing
        tests.

        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::formatNumberValue):
        * dom/Document.cpp:
        (WebCore::Document::displayStringModifiedByEncoding):
        * xml/XPathGrammar.y:

2016-06-07  Myles C. Maxfield  <mmaxfield@apple.com>

        Text-decoration-style: dashed / dotted rendered as solid
        https://bugs.webkit.org/show_bug.cgi?id=134336

        Reviewed by Dean Jackson.

        We already had most of the infrastructure for dotted / dashed underlines.
        Previously, we were setting the stroke style for the underlines, but then
        filling the underlines (which means the stroke styles is irrelevant).
        Instead, we should just compute the individual dots / dashes to fill.

        The implementation of this is done inside GraphicsContext because
        GraphicsContext is already responsible for handling the single / double
        underline distinction. Extending it to be responsible for dotted / dashed
        is the natural thing to do.

        Tests: fast/css3-text/css3-text-decoration/text-decoration-dashed.html
               fast/css3-text/css3-text-decoration/text-decoration-dotted-dashed.html
               fast/css3-text/css3-text-decoration/text-decoration-dotted.html

        * platform/graphics/GraphicsContext.h:
        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::drawLineForText):
        (WebCore::GraphicsContext::drawLinesForText):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::drawLineForText):
        (WebCore::GraphicsContext::drawLinesForText):
        * rendering/TextDecorationPainter.cpp:
        (WebCore::drawSkipInkUnderline):
        (WebCore::TextDecorationPainter::paintTextDecoration):

2016-06-07  Chris Fleizach  <cfleizach@apple.com>

        AX: iOS: Need to expose whether object is a dialog element
        https://bugs.webkit.org/show_bug.cgi?id=158487
        <rdar://problem/26678218>

        Reviewed by Joanmarie Diggs.

        Expose whether an object is a dialog type. This will allow decisions higher up the stack to be made in regards to where to move VoiceOver focus.

        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper accessibilityIsDialog]):

2016-06-07  Alex Christensen  <achristensen@webkit.org>

        Fix Yosemite build.
        https://bugs.webkit.org/show_bug.cgi?id=158403

        * platform/spi/cocoa/QuartzCoreSPI.h:

2016-06-07  Alex Christensen  <achristensen@webkit.org>

        Fix WinCairo build.

        * platform/network/curl/MultipartHandle.cpp:
        (WebCore::MultipartHandle::didReceiveResponse):

2016-06-07  Alex Christensen  <achristensen@webkit.org>

        Build fix non-cocoa platforms.
        https://bugs.webkit.org/show_bug.cgi?id=158332

        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::createCustomFontData):
        * platform/network/ResourceHandle.cpp:
        (WebCore::ResourceHandle::continueWillSendRequest):
        * platform/network/curl/MultipartHandle.cpp:
        (WebCore::MultipartHandle::didReceiveResponse):
        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::headerCallback):

2016-06-07  Sam Weinig  <sam@webkit.org>

        Try to fix the 10.10 build.

        * platform/spi/cocoa/QuartzCoreSPI.h:

2016-06-06  Alex Christensen  <achristensen@webkit.org>

        Modernize loading code
        https://bugs.webkit.org/show_bug.cgi?id=158332

        Reviewed by Darin Adler.

        No new tests, no change in behavior.

        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::cachedResourceContent):
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::continueAfterContentPolicy):
        * loader/FrameLoader.h:
        * loader/NetscapePlugInStreamLoader.cpp:
        (WebCore::NetscapePlugInStreamLoader::didReceiveData):
        (WebCore::NetscapePlugInStreamLoader::didReceiveBuffer):
        (WebCore::NetscapePlugInStreamLoader::didReceiveDataOrBuffer):
        (WebCore::NetscapePlugInStreamLoader::didFinishLoading):
        * loader/NetscapePlugInStreamLoader.h:
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::deliverResponseAndData):
        (WebCore::ResourceLoader::loadDataURL):
        (WebCore::ResourceLoader::addDataOrBuffer):
        (WebCore::ResourceLoader::clearResourceData):
        (WebCore::ResourceLoader::didReceiveData):
        (WebCore::ResourceLoader::didReceiveBuffer):
        (WebCore::ResourceLoader::didReceiveDataOrBuffer):
        (WebCore::ResourceLoader::didFinishLoading):
        * loader/ResourceLoader.h:
        (WebCore::ResourceLoader::wasCancelled):
        (WebCore::ResourceLoader::options):
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::didReceiveData):
        (WebCore::SubresourceLoader::didReceiveBuffer):
        (WebCore::SubresourceLoader::didReceiveDataOrBuffer):
        * loader/SubresourceLoader.h:
        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::abort):
        (WebCore::ApplicationCacheGroup::createResourceHandle):
        * loader/appcache/ApplicationCacheGroup.h:
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::addData):
        * loader/cache/CachedRawResourceClient.h:
        * platform/SharedBuffer.cpp:
        (WebCore::SharedBuffer::SharedBuffer):
        (WebCore::SharedBuffer::createWithContentsOfFile):
        (WebCore::SharedBuffer::adoptVector):
        (WebCore::SharedBuffer::duplicateDataBufferIfNecessary):
        (WebCore::SharedBuffer::appendToDataBuffer):
        (WebCore::SharedBuffer::clearDataBuffer):
        * platform/SharedBuffer.h:
        (WebCore::SharedBuffer::create):
        * platform/cf/SharedBufferCF.cpp:
        (WebCore::SharedBuffer::SharedBuffer):
        (WebCore::SharedBuffer::maybeAppendPlatformData):
        (WebCore::SharedBuffer::wrapCFDataArray):
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (ResourceHandleStreamingClient::didReceiveData):
        (ResourceHandleStreamingClient::didReceiveBuffer):
        * platform/mac/SharedBufferMac.mm:
        (WebCore::SharedBuffer::createCFData):
        (WebCore::SharedBuffer::createFromReadingFile):
        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::~BlobRegistryImpl):
        (WebCore::createBlobResourceHandle):
        (WebCore::loadBlobResourceSynchronously):
        (WebCore::registerBlobResourceHandleConstructor):
        (WebCore::BlobRegistryImpl::createResourceHandle):
        (WebCore::BlobRegistryImpl::appendStorageItems):
        (WebCore::createResourceHandle): Deleted.
        (WebCore::loadResourceSynchronously): Deleted.
        * platform/network/BlobRegistryImpl.h:
        * platform/network/BlobResourceHandle.cpp:
        (WebCore::BlobResourceHandle::createAsync):
        (WebCore::BlobResourceHandle::loadResourceSynchronously):
        Removed the overridden didReceiveData and didFinishLoading, 
        which did nothing and were identical to the function they overwrote.
        * platform/network/BlobResourceHandle.h:
        * platform/network/PingHandle.h:
        * platform/network/ResourceHandle.cpp:
        (WebCore::ResourceHandle::ResourceHandle):
        (WebCore::ResourceHandle::create):
        (WebCore::ResourceHandle::scheduleFailure):
        * platform/network/ResourceHandle.h:
        * platform/network/ResourceHandleClient.cpp:
        (WebCore::ResourceHandleClient::willCacheResponseAsync):
        (WebCore::ResourceHandleClient::didReceiveBuffer):
        * platform/network/ResourceHandleClient.h:
        (WebCore::ResourceHandleClient::didReceiveResponse):
        (WebCore::ResourceHandleClient::didReceiveData):
        (WebCore::ResourceHandleClient::didFinishLoading):
        (WebCore::ResourceHandleClient::didFail):
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSessionDataTask resource:receivedData:length:]):
        This data must be copied in order to put it in a refcounted NSData because it comes
        from IPC from the Network Process and is an IPC::DataReference which will be deallocated
        when the message handling is done.
        * platform/soup/SharedBufferSoup.cpp:
        (WebCore::SharedBuffer::SharedBuffer):
        * testing/MockContentFilter.cpp:
        (WebCore::MockContentFilter::replacementData):
        (WebCore::MockContentFilter::unblockHandler):

2016-06-06  Sam Weinig  <sam@webkit.org>

        Add experimental support for spring based CSS animations
        https://bugs.webkit.org/show_bug.cgi?id=158403

        Reviewed by Dean Jackson.

        Adds experimental support for a new CSS animation timing function that uses
        spring to model the time function. To use it you replace your normal timing
        function, be it cubic-bezier or steps, with a new function called spring().
        For instance, for a transition you would write:

            transition-timing-function: spring(1 100 10 0);
        
        The parameters are, in order:
            - Mass
            - Stiffness
            - Damping
            - Initial Velocity

        Tests: animations/spring-computed-style.html
               animations/spring-function.html
               animations/spring-parsing.html

        * WebCore.xcodeproj/project.pbxproj:
        Add new file.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::createTimingFunctionValue):
        Modernize and add support for the spring function.

        * css/CSSParser.cpp:
        (WebCore::CSSParserContext::CSSParserContext):
        (WebCore::operator==):
        (WebCore::CSSParser::CSSParser):
        (WebCore::CSSParser::parseTransformOriginShorthand):
        (WebCore::CSSParser::isSpringTimingFunctionEnabled):
        (WebCore::CSSParser::parseCubicBezierTimingFunctionValue):
        (WebCore::CSSParser::parseSpringTimingFunctionValue):
        (WebCore::CSSParser::parseAnimationTimingFunction):
        * css/CSSParser.h:
        * css/CSSParserMode.h:
        Add parsing support for the spring() function.

        * css/CSSTimingFunctionValue.cpp:
        (WebCore::CSSCubicBezierTimingFunctionValue::customCSSText):
        (WebCore::CSSCubicBezierTimingFunctionValue::equals):
        (WebCore::CSSStepsTimingFunctionValue::customCSSText):
        (WebCore::CSSStepsTimingFunctionValue::equals):
        (WebCore::CSSSpringTimingFunctionValue::customCSSText):
        (WebCore::CSSSpringTimingFunctionValue::equals):
        * css/CSSTimingFunctionValue.h:
        (WebCore::CSSSpringTimingFunctionValue::create):
        (WebCore::CSSSpringTimingFunctionValue::mass):
        (WebCore::CSSSpringTimingFunctionValue::stiffness):
        (WebCore::CSSSpringTimingFunctionValue::damping):
        (WebCore::CSSSpringTimingFunctionValue::initialVelocity):
        (WebCore::CSSSpringTimingFunctionValue::CSSSpringTimingFunctionValue):
        Modernize and add support for the spring function.

        * css/CSSToStyleMap.cpp:
        (WebCore::CSSToStyleMap::mapAnimationTimingFunction):
        Pipe the spring function into the animation.

        * css/CSSValue.cpp:
        (WebCore::CSSValue::equals):
        (WebCore::CSSValue::cssText):
        (WebCore::CSSValue::destroy):
        * css/CSSValue.h:
        (WebCore::CSSValue::isSpringTimingFunctionValue):
        Add support for the spring function.
        
        * page/Settings.in:
        Add a setting to control if the spring function is enabled.

        * page/animation/AnimationBase.cpp:
        (WebCore::solveSpringFunction):
        (WebCore::AnimationBase::progress):
        Add support for solving the spring function. Since the spring requires time to be absolute,
        get the real time by multiplying the ratio t, to the total duration.

        * platform/animation/TimingFunction.cpp:
        (WebCore::operator<<):
        * platform/animation/TimingFunction.h:
        (WebCore::TimingFunction::~TimingFunction):
        (WebCore::TimingFunction::isSpringTimingFunction):
        Add support for the spring timing function.

        * platform/graphics/SpringSolver.h: Added.
        (WebCore::SpringSolver::SpringSolver):
        (WebCore::SpringSolver::solve):
        Add a Spring solver that matches the one in CoreAnimation.

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::createAnimationFromKeyframes):
        (WebCore::GraphicsLayerCA::appendToUncommittedAnimations):
        (WebCore::GraphicsLayerCA::createBasicAnimation):
        (WebCore::GraphicsLayerCA::createSpringAnimation):
        (WebCore::GraphicsLayerCA::setupAnimation):
        * platform/graphics/ca/GraphicsLayerCA.h:
        Map animations with spring timing functions to CASpringAnimations.

        * platform/graphics/ca/PlatformCAAnimation.cpp:
        (WebCore::operator<<):
        (WebCore::PlatformCAAnimation::isBasicAnimation):
        * platform/graphics/ca/PlatformCAAnimation.h:
        (WebCore::PlatformCAAnimation::setActualStartTimeIfNeeded):
        (WebCore::PlatformCAAnimation::PlatformCAAnimation):
        * platform/graphics/ca/cocoa/PlatformCAAnimationCocoa.mm:
        (WebCore::toCAMediaTimingFunction):
        (PlatformCAAnimationCocoa::PlatformCAAnimationCocoa):
        (PlatformCAAnimationCocoa::setTimingFunction):
        (PlatformCAAnimationCocoa::copyTimingFunctionFrom):
        (PlatformCAAnimationCocoa::setFromValue):
        (PlatformCAAnimationCocoa::copyFromValueFrom):
        (PlatformCAAnimationCocoa::setToValue):
        (PlatformCAAnimationCocoa::copyToValueFrom):
        Add a new type of PlatformCAAnimation, Spring, which is a sub-type of Basic.

2016-06-05  Sam Weinig  <sam@webkit.org>

        Add experimental support for spring based CSS animations
        https://bugs.webkit.org/show_bug.cgi?id=158403

        Reviewed by Dean Jackson.

        Adds experimental support for a new CSS animation timing function that uses
        spring to model the time function. To use it you replace your normal timing
        function, be it cubic-bezier or steps, with a new function called spring().
        For instance, for a transition you would write:

            transition-timing-function: spring(1 100 10 0);
        
        The parameters are, in order:
            - Mass
            - Stiffness
            - Damping
            - Initial Velocity

        Tests: animations/spring-computed-style.html
               animations/spring-function.html
               animations/spring-parsing.html

        * WebCore.xcodeproj/project.pbxproj:
        Add new file.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::createTimingFunctionValue):
        Modernize and add support for the spring function.

        * css/CSSParser.cpp:
        (WebCore::CSSParserContext::CSSParserContext):
        (WebCore::operator==):
        (WebCore::CSSParser::CSSParser):
        (WebCore::CSSParser::parseTransformOriginShorthand):
        (WebCore::CSSParser::isSpringTimingFunctionEnabled):
        (WebCore::CSSParser::parseCubicBezierTimingFunctionValue):
        (WebCore::CSSParser::parseSpringTimingFunctionValue):
        (WebCore::CSSParser::parseAnimationTimingFunction):
        * css/CSSParser.h:
        * css/CSSParserMode.h:
        Add parsing support for the spring() function.

        * css/CSSTimingFunctionValue.cpp:
        (WebCore::CSSCubicBezierTimingFunctionValue::customCSSText):
        (WebCore::CSSCubicBezierTimingFunctionValue::equals):
        (WebCore::CSSStepsTimingFunctionValue::customCSSText):
        (WebCore::CSSStepsTimingFunctionValue::equals):
        (WebCore::CSSSpringTimingFunctionValue::customCSSText):
        (WebCore::CSSSpringTimingFunctionValue::equals):
        * css/CSSTimingFunctionValue.h:
        (WebCore::CSSSpringTimingFunctionValue::create):
        (WebCore::CSSSpringTimingFunctionValue::mass):
        (WebCore::CSSSpringTimingFunctionValue::stiffness):
        (WebCore::CSSSpringTimingFunctionValue::damping):
        (WebCore::CSSSpringTimingFunctionValue::initialVelocity):
        (WebCore::CSSSpringTimingFunctionValue::CSSSpringTimingFunctionValue):
        Modernize and add support for the spring function.

        * css/CSSToStyleMap.cpp:
        (WebCore::CSSToStyleMap::mapAnimationTimingFunction):
        Pipe the spring function into the animation.

        * css/CSSValue.cpp:
        (WebCore::CSSValue::equals):
        (WebCore::CSSValue::cssText):
        (WebCore::CSSValue::destroy):
        * css/CSSValue.h:
        (WebCore::CSSValue::isSpringTimingFunctionValue):
        Add support for the spring function.
        
        * page/Settings.in:
        Add a setting to control if the spring function is enabled.

        * page/animation/AnimationBase.cpp:
        (WebCore::solveSpringFunction):
        (WebCore::AnimationBase::progress):
        Add support for solving the spring function. Since the spring requires time to be absolute,
        get the real time by multiplying the ratio t, to the total duration.

        * platform/animation/TimingFunction.cpp:
        (WebCore::operator<<):
        * platform/animation/TimingFunction.h:
        (WebCore::TimingFunction::~TimingFunction):
        (WebCore::TimingFunction::isSpringTimingFunction):
        Add support for the spring timing function.

        * platform/graphics/SpringSolver.h: Added.
        (WebCore::SpringSolver::SpringSolver):
        (WebCore::SpringSolver::solve):
        Add a Spring solver that matches the one in CoreAnimation.

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::createAnimationFromKeyframes):
        (WebCore::GraphicsLayerCA::appendToUncommittedAnimations):
        (WebCore::GraphicsLayerCA::createBasicAnimation):
        (WebCore::GraphicsLayerCA::createSpringAnimation):
        (WebCore::GraphicsLayerCA::setupAnimation):
        * platform/graphics/ca/GraphicsLayerCA.h:
        Map animations with spring timing functions to CASpringAnimations.

        * platform/graphics/ca/PlatformCAAnimation.cpp:
        (WebCore::operator<<):
        (WebCore::PlatformCAAnimation::isBasicAnimation):
        * platform/graphics/ca/PlatformCAAnimation.h:
        (WebCore::PlatformCAAnimation::setActualStartTimeIfNeeded):
        (WebCore::PlatformCAAnimation::PlatformCAAnimation):
        * platform/graphics/ca/cocoa/PlatformCAAnimationCocoa.mm:
        (WebCore::toCAMediaTimingFunction):
        (PlatformCAAnimationCocoa::PlatformCAAnimationCocoa):
        (PlatformCAAnimationCocoa::setTimingFunction):
        (PlatformCAAnimationCocoa::copyTimingFunctionFrom):
        (PlatformCAAnimationCocoa::setFromValue):
        (PlatformCAAnimationCocoa::copyFromValueFrom):
        (PlatformCAAnimationCocoa::setToValue):
        (PlatformCAAnimationCocoa::copyToValueFrom):
        Add a new type of PlatformCAAnimation, Spring, which is a sub-type of Basic.

2016-06-07  Chris Dumez  <cdumez@apple.com>

        Implement EventListenerOptions argument to addEventListener
        https://bugs.webkit.org/show_bug.cgi?id=149466
        <rdar://problem/22802031>

        Reviewed by Dean Jackson.

        Implement AddEventListenerOptions dictionary argument to addEventListener()
        and EventListenerOptions dictionary argument to removeEventListener(), as
        per the latest DOM specification:
        - https://dom.spec.whatwg.org/#interface-eventtarget

        Firefox and Chrome already support this.

        Support for AddEventListenerOptions in this patch is as follows:
        - 'capture': fully supported.
        - 'once': fully supported.
        - 'passive': supported in the sense that preventDefault() will be ignored
                     for passive event listeners. There are however currently no
                     performance benefits from passing this flag. Those optimizations
                     will be implemented in follow-up patches (in particular for
                     Touch and Scroll events).

        Tests: fast/events/AddEventListenerOptions-once-recursive.html
               fast/events/AddEventListenerOptions-once.html
               fast/events/AddEventListenerOptions-passive.html
               fast/events/removeEventListener-EventListenerOptions-capture.html
               imported/w3c/web-platform-tests/dom/events/EventListenerOptions-capture.html

        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        (WebCore::AudioScheduledSourceNode::addEventListener):
        (WebCore::AudioScheduledSourceNode::removeEventListener):
        * Modules/webaudio/AudioScheduledSourceNode.h:
        * Modules/webaudio/ScriptProcessorNode.cpp:
        (WebCore::ScriptProcessorNode::addEventListener):
        (WebCore::ScriptProcessorNode::removeEventListener):
        * Modules/webaudio/ScriptProcessorNode.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheckExpression):
        * dom/Event.h:
        (WebCore::Event::preventDefault):
        (WebCore::Event::setInPassiveListener):
        * dom/EventListenerMap.cpp:
        (WebCore::addListenerToVector):
        (WebCore::EventListenerMap::add):
        * dom/EventListenerMap.h:
        * dom/EventTarget.cpp:
        (WebCore::EventTarget::addEventListener):
        (WebCore::EventTarget::addEventListenerForBindings):
        (WebCore::EventTarget::removeEventListenerForBindings):
        (WebCore::EventTarget::removeEventListener):
        (WebCore::EventTarget::setAttributeEventListener):
        (WebCore::EventTarget::fireEventListeners):
        * dom/EventTarget.h:
        (WebCore::EventTarget::ListenerOptions::ListenerOptions):
        (WebCore::EventTarget::AddEventListenerOptions::AddEventListenerOptions):
        (WebCore::EventTarget::addEventListener):
        (WebCore::EventTarget::addEventListenerForBindings):
        (WebCore::EventTarget::removeEventListenerForBindings):
        * dom/EventTarget.idl:
        * dom/MessagePort.cpp:
        (WebCore::MessagePort::addEventListener):
        * dom/MessagePort.h:
        * dom/Node.cpp:
        (WebCore::tryAddEventListener):
        (WebCore::Node::addEventListener):
        (WebCore::tryRemoveEventListener):
        (WebCore::Node::removeEventListener):
        * dom/Node.h:
        * dom/RegisteredEventListener.h:
        (WebCore::RegisteredEventListener::Options::Options):
        (WebCore::RegisteredEventListener::RegisteredEventListener):
        (WebCore::operator==):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::addEventListener):
        (WebCore::HTMLMediaElement::removeEventListener):
        * html/HTMLMediaElement.h:
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::addEventListener):
        (WebCore::DOMWindow::removeEventListener):
        * page/DOMWindow.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::addEventListener):
        (WebCore::SVGElement::removeEventListener):
        * svg/SVGElement.h:

2016-06-07  Brent Fulgham  <bfulgham@apple.com>

        CSP: Content Security Policy directive, upgrade-insecure-requests (UIR)
        https://bugs.webkit.org/show_bug.cgi?id=143653
        <rdar://problem/23032067>

        Reviewed by Andy Estes.

        Modify our loading logic so that we recognize and upgrade insecure requests to secure
        requests if the Content Security Policy directive 'upgrade-insecure-requests' is
        present.
        
        Add a static helper function to ContentSecurityPolicy to upgrade insecure URLs so
        that we don't have to sprinkle the same code all over the loader system.

        Tests: http/tests/security/contentSecurityPolicy/report-only-upgrade-insecure.php
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/basic-upgrade-cors.https.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/basic-upgrade.https.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/form-upgrade.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/https-header-auxiliary.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/https-header-nested.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/https-header-subresource.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/https-header-top-level.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/iframe-upgrade.https.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/proper-nested-upgrades.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/proper-open-window-upgrades.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-insecure-audio-video-in-main-frame.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-insecure-css-in-iframe.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-insecure-image-in-main-frame.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-simple-ws.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-insecure-xhr-in-main-frame.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-redirect-http-to-https-script-in-iframe.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-redirect-https-to-http-script-in-iframe.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrades-mixed-content.html
               http/tests/ssl/iframe-upgrade.https.html
               http/tests/ssl/upgrade-origin-usage.html
               http/tests/websocket/tests/hybi/upgrade-simple-ws.html

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect): Upgrade insecure requests if the CSP
        indicates we should.
        * dom/Document.cpp:
        (WebCore::Document::initSecurityContext): Populate new document CSP with sets of upgrade host and port combinations.
        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::requestScript): Upgrade insecure requests if
        the CSP indicates we should.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadResource): Ditto.
        * loader/DocumentWriter.cpp:
        (WebCore::DocumentWriter::begin): Ditto.
        * loader/FormSubmission.cpp:
        (WebCore::FormSubmission::create): Ditto.
        (WebCore::FormSubmission::populateFrameLoadRequest): Add "Upgrade-Insecure-Requests"
        header to frame load requests.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::addExtraFieldsToMainResourceRequest): Add the
        'Update-Insecure-Requests' header field if necessary.
        (WebCore::FrameLoader::addHTTPUpgradeInsecureRequestsIfNeeded): Added helper function.
        (WebCore::FrameLoader::loadPostRequest): Upgrade insecure requests if the CSP
        indicates we should.
        (WebCore::FrameLoader::loadResourceSynchronously): Ditto.
        (WebCore::FrameLoader::loadDifferentDocumentItem): If loading a form, add the
        'Update-Insecure-Requests' header field if necessary.
        (WebCore::createWindow): Upgrade insecure requests if the CSP
        indicates we should.
        * loader/FrameLoader.h:
        * loader/PingLoader.cpp:
        (WebCore::PingLoader::loadImage): Upgrade insecure requests if the CSP
        indicates we should.
        (WebCore::PingLoader::sendPing): Ditto.
        (WebCore::PingLoader::sendViolationReport): Ditto.
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::willSendRequestInternal): Ditto.
        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::requestFrame): Ditto.
        (WebCore::SubframeLoader::requestObject): Ditto.
        * loader/appcache/ApplicationCacheHost.cpp:
        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache): Ditto.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestImage): Ditto.
        (WebCore::CachedResourceLoader::requestResource): Ditto.
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::createWindow): Add the 'Update-Insecure-Requests' header
        field if necessary.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::copyStateFrom): Populate upgraded resource set
        from other context.
        (WebCore::ContentSecurityPolicy::upgradeInsecureRequestIfNeeded): Added helper function
        to upgrade requests when the upgrade-insecure-requests CSP policy is present, or if
        the host and port combination have previously been upgraded.
        (WebCore::ContentSecurityPolicy::upgradeInsecureNavigationRequestIfNeeded): Added
        helper function to upgrade requests that have been previously upgraded. Cross-site
        navigations only get upgraded when they have been previously upgraded.
        (WebCore::ContentSecurityPolicy::addInsecureNavigationRequestsToUpgrade): Added.
        (WebCore::ContentSecurityPolicy::populateInsecureNavigationRequestsToUpgradeFromOther): Added.
        * page/csp/ContentSecurityPolicy.h:
        (WebCore::ContentSecurityPolicy::setUpgradeInsecureRequests): Added.
        (WebCore::ContentSecurityPolicy::upgradeInsecureRequests): Added.
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::ContentSecurityPolicyDirectiveList): Use
        more C++11 initializations.
        (WebCore::ContentSecurityPolicyDirectiveList::setUpgradeInsecureRequests): Added.
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Teach this function to
        recognize the new directive.
        * page/csp/ContentSecurityPolicyDirectiveList.h:
        * page/csp/ContentSecurityPolicyDirectiveNames.cpp:
        * page/csp/ContentSecurityPolicyDirectiveNames.h:
        * platform/network/HTTPHeaderNames.in: Add new 'Upgrade-Insecure-Requests' header field.
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::open): Upgrade insecure requests if the CSP if needed.

2016-06-07  Fujii Hironori  <Hironori.Fujii@sony.com>

        Video elements are painted twice, in PaintPhaseForeground and PaintPhaseSelfOutline
        https://bugs.webkit.org/show_bug.cgi?id=158247

        Reviewed by Simon Fraser.

        Test: fast/replaced/outline-replaced-elements-offset.html

        In <http://trac.webkit.org/changeset/105247>,
        RenderReplaced::paint was changed to call
        RenderReplaced::paintReplaced in PaintPhaseOutline and
        PaintPhaseSelfOutline to paint outline of SVG.

        As the result, RenderVideo::paintReplaced paints twice,
        in forground and outline phase.

        It was changed to paint outline of SVG in PaintPhaseForeground
        since <http://trac.webkit.org/changeset/168645>.  No need to call
        RenderReplaced::paintReplaced in outline phases anymore.

        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::paint): Return early if
        PaintPhaseOutline or PaintPhaseSelfOutline.
        Return early unless PaintPhaseForeground nor PaintPhaseSelection,
        even if canHaveChildren().

2016-06-07  Nael Ouedraogo  <nael.ouedraogo@crf.canon.fr>

        Creating a TouchList with non Touch items should throw an exception
        https://bugs.webkit.org/show_bug.cgi?id=158302

        Reviewed by Youenn Fablet.

        Only Touch items should be passed to CreateTouchList function as per specification
        (https://w3c.github.io/touch-events/#extensions-to-the-document-interface).
        CreateTouchList function behavior is modified. An exception is thrown when non Touch items
        are passed as parameters instead of adding null items in the TouchList.

        Tests have been modified to check whether behavior of CreateTouchList is correct.

        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::createTouchList):
        * dom/Document.idl:

2016-06-06  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r201735.
        https://bugs.webkit.org/show_bug.cgi?id=158465

        fast/events/AddEventListenerOptions-once-recursive.html fails
        on all bots (Requested by ap on #webkit).

        Reverted changeset:

        "Implement EventListenerOptions argument to addEventListener"
        https://bugs.webkit.org/show_bug.cgi?id=149466
        http://trac.webkit.org/changeset/201735

2016-06-06  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r201679.
        https://bugs.webkit.org/show_bug.cgi?id=158464

        http/tests/websocket/tests/hybi/upgrade-simple-ws.html is
        flaky (Requested by ap on #webkit).

        Reverted changeset:

        "CSP: Content Security Policy directive, upgrade-insecure-
        requests (UIR)"
        https://bugs.webkit.org/show_bug.cgi?id=143653
        http://trac.webkit.org/changeset/201679

2016-06-06  Jiewen Tan  <jiewen_tan@apple.com>

        URLs containing tabs or newlines are parsed incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=143381
        <rdar://problem/26567214>

        Reviewed by Brent Fulgham.

        1. Strip any tabs and newlines in the URL input.
        2. Replace the original stripping URL leading and trailing white spaces logic with WTFString's
        builtin, and move this logic to the very begining of the URL parser.
        3. Enhance the protocolIs method to ignore any leading whitespace/control characters, and
        tabs/newlines of the examining url.

        Test: fast/url/tab-and-newline-stripping.html

        * platform/URL.cpp:
        (WebCore::isTabNewline):
        (WebCore::shouldTrimFromURL):
        (WebCore::URL::init):
        (WebCore::protocolIs):

2016-06-02  Ryosuke Niwa  <rniwa@webkit.org>

        Update the list of elements attachShadow is allowed
        https://bugs.webkit.org/show_bug.cgi?id=157706

        Reviewed by Darin Adler.

        Update the list of elements on which attachShadow is allowed per the latest shadow DOM spec:
        http://www.w3.org/TR/shadow-dom/#widl-Element-attachShadow-ShadowRoot-ShadowRootInit-shadowRootInitDict
        which now only allows attachShadow on the following elements and custom elements:
        button, details, input, marquee, meter, progress, select, textarea, keygen

        In order to check that a given HTML element's local name is a valid custom element name,
        this patch moves CustomElementDefinitions::checkName to Document::validateCustomElementName so that
        it could be used when either SHADOW_DOM or CUSTOM_ELEMENTS build flag is turned on.

        Also removed Element::canHaveUserAgentShadowRoot since it was only used in Element::attachShadow.

        Test: fast/shadow-dom/Element-interface-attachShadow.html

        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::defineElement):
        * dom/CustomElementDefinitions.cpp:
        (WebCore::CustomElementDefinitions::checkName): Moved to Document::validateCustomElementName.
        * dom/CustomElementDefinitions.h:
        * dom/Document.cpp:
        (WebCore::createHTMLElementWithNameValidation):
        (WebCore::createFallbackHTMLElement):
        (WebCore::Document::validateCustomElementName): Moved from CustomElementDefinitions::checkName.
        * dom/Document.h:
        * dom/Element.cpp:
        (WebCore::canAttachAuthorShadowRoot): Added.
        (WebCore::Element::attachShadow):
        * dom/Element.h:
        * html/HTMLButtonElement.h:
        * html/HTMLDetailsElement.h:
        * html/HTMLInputElement.h:
        * html/HTMLKeygenElement.h:
        * html/HTMLMarqueeElement.h:
        * html/HTMLMediaElement.h:
        * html/HTMLMeterElement.h:
        * html/HTMLPlugInElement.h:
        * html/HTMLProgressElement.h:
        * html/HTMLQuoteElement.h:
        * html/HTMLSelectElement.h:
        * html/HTMLSummaryElement.h:
        * html/HTMLTagNames.in:
        * html/HTMLTextAreaElement.h:
        * html/HTMLUnknownElement.h:
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface):

2016-06-03  Ryosuke Niwa  <rniwa@webkit.org>

        Crash inside moveOutOfAllShadowRoots
        https://bugs.webkit.org/show_bug.cgi?id=158378

        Reviewed by Antti Koivisto.

        The bug was caused by InShadowTreeFlag not being cleared when a shadow host or its ancestor was removed
        due to addChildNodesToDeletionQueue not invoking notifyChildNodeRemoved when a node was in a shadow tree
        but not in a document.

        Fixed the bug by invoking notifyChildNodeRemoved when the removed node is either in a shadow tree
        or it's in a shadow tree. Also fixed a bug in VTTCue::~VTTCue that it was trying to remove the display
        tree even when the owner document was being destroyed. This results in various assertions to be hit.

        Test: fast/shadow-dom/shadow-host-removal-crash.html

        * dom/ContainerNodeAlgorithms.cpp:
        (WebCore::addChildNodesToDeletionQueue):
        * html/track/VTTCue.cpp:
        (WebCore::VTTCue::~VTTCue):

2016-06-06  Chris Dumez  <cdumez@apple.com>

        Implement EventListenerOptions argument to addEventListener
        https://bugs.webkit.org/show_bug.cgi?id=149466
        <rdar://problem/22802031>

        Reviewed by Dean Jackson.

        Implement AddEventListenerOptions dictionary argument to addEventListener()
        and EventListenerOptions dictionary argument to removeEventListener(), as
        per the latest DOM specification:
        - https://dom.spec.whatwg.org/#interface-eventtarget

        Firefox and Chrome already support this.

        Support for AddEventListenerOptions in this patch is as follows:
        - 'capture': fully supported.
        - 'once': fully supported.
        - 'passive': supported in the sense that preventDefault() will be ignored
                     for passive event listeners. There are however currently no
                     performance benefits from passing this flag. Those optimizations
                     will be implemented in follow-up patches (in particular for
                     Touch and Scroll events).

        Tests: fast/events/AddEventListenerOptions-once-recursive.html
               fast/events/AddEventListenerOptions-once.html
               fast/events/AddEventListenerOptions-passive.html
               fast/events/removeEventListener-EventListenerOptions-capture.html
               imported/w3c/web-platform-tests/dom/events/EventListenerOptions-capture.html

        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        (WebCore::AudioScheduledSourceNode::addEventListener):
        (WebCore::AudioScheduledSourceNode::removeEventListener):
        * Modules/webaudio/AudioScheduledSourceNode.h:
        * Modules/webaudio/ScriptProcessorNode.cpp:
        (WebCore::ScriptProcessorNode::addEventListener):
        (WebCore::ScriptProcessorNode::removeEventListener):
        * Modules/webaudio/ScriptProcessorNode.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheckExpression):
        * dom/Event.h:
        (WebCore::Event::preventDefault):
        (WebCore::Event::setInPassiveListener):
        * dom/EventListenerMap.cpp:
        (WebCore::addListenerToVector):
        (WebCore::EventListenerMap::add):
        * dom/EventListenerMap.h:
        * dom/EventTarget.cpp:
        (WebCore::EventTarget::addEventListener):
        (WebCore::EventTarget::addEventListenerForBindings):
        (WebCore::EventTarget::removeEventListenerForBindings):
        (WebCore::EventTarget::removeEventListener):
        (WebCore::EventTarget::setAttributeEventListener):
        (WebCore::EventTarget::fireEventListeners):
        * dom/EventTarget.h:
        (WebCore::EventTarget::ListenerOptions::ListenerOptions):
        (WebCore::EventTarget::AddEventListenerOptions::AddEventListenerOptions):
        (WebCore::EventTarget::addEventListener):
        (WebCore::EventTarget::addEventListenerForBindings):
        (WebCore::EventTarget::removeEventListenerForBindings):
        * dom/EventTarget.idl:
        * dom/MessagePort.cpp:
        (WebCore::MessagePort::addEventListener):
        * dom/MessagePort.h:
        * dom/Node.cpp:
        (WebCore::tryAddEventListener):
        (WebCore::Node::addEventListener):
        (WebCore::tryRemoveEventListener):
        (WebCore::Node::removeEventListener):
        * dom/Node.h:
        * dom/RegisteredEventListener.h:
        (WebCore::RegisteredEventListener::Options::Options):
        (WebCore::RegisteredEventListener::RegisteredEventListener):
        (WebCore::operator==):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::addEventListener):
        (WebCore::HTMLMediaElement::removeEventListener):
        * html/HTMLMediaElement.h:
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::addEventListener):
        (WebCore::DOMWindow::removeEventListener):
        * page/DOMWindow.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::addEventListener):
        (WebCore::SVGElement::removeEventListener):
        * svg/SVGElement.h:

2016-06-06  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r201730.
        https://bugs.webkit.org/show_bug.cgi?id=158453

        This change caused existing LayoutTests to crash (Requested by
        ryanhaddad on #webkit).

        Reverted changeset:

        "Implement EventListenerOptions argument to addEventListener"
        https://bugs.webkit.org/show_bug.cgi?id=149466
        http://trac.webkit.org/changeset/201730

2016-06-06  Chris Dumez  <cdumez@apple.com>

        Implement EventListenerOptions argument to addEventListener
        https://bugs.webkit.org/show_bug.cgi?id=149466
        <rdar://problem/22802031>

        Reviewed by Dean Jackson.

        Implement AddEventListenerOptions dictionary argument to addEventListener()
        and EventListenerOptions dictionary argument to removeEventListener(), as
        per the latest DOM specification:
        - https://dom.spec.whatwg.org/#interface-eventtarget

        Firefox and Chrome already support this.

        Support for AddEventListenerOptions in this patch is as follows:
        - 'capture': fully supported.
        - 'once': fully supported.
        - 'passive': supported in the sense that preventDefault() will be ignored
                     for passive event listeners. There are however currently no
                     performance benefits from passing this flag. Those optimizations
                     will be implemented in follow-up patches (in particular for
                     Touch and Scroll events).

        Tests: fast/events/AddEventListenerOptions-once-recursive.html
               fast/events/AddEventListenerOptions-once.html
               fast/events/AddEventListenerOptions-passive.html
               fast/events/removeEventListener-EventListenerOptions-capture.html
               imported/w3c/web-platform-tests/dom/events/EventListenerOptions-capture.html

        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        (WebCore::AudioScheduledSourceNode::addEventListener):
        (WebCore::AudioScheduledSourceNode::removeEventListener):
        * Modules/webaudio/AudioScheduledSourceNode.h:
        * Modules/webaudio/ScriptProcessorNode.cpp:
        (WebCore::ScriptProcessorNode::addEventListener):
        (WebCore::ScriptProcessorNode::removeEventListener):
        * Modules/webaudio/ScriptProcessorNode.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheckExpression):
        * dom/Event.h:
        (WebCore::Event::preventDefault):
        (WebCore::Event::setInPassiveListener):
        * dom/EventListenerMap.cpp:
        (WebCore::addListenerToVector):
        (WebCore::EventListenerMap::add):
        * dom/EventListenerMap.h:
        * dom/EventTarget.cpp:
        (WebCore::EventTarget::addEventListener):
        (WebCore::EventTarget::addEventListenerForBindings):
        (WebCore::EventTarget::removeEventListenerForBindings):
        (WebCore::EventTarget::removeEventListener):
        (WebCore::EventTarget::setAttributeEventListener):
        (WebCore::EventTarget::fireEventListeners):
        * dom/EventTarget.h:
        (WebCore::EventTarget::ListenerOptions::ListenerOptions):
        (WebCore::EventTarget::AddEventListenerOptions::AddEventListenerOptions):
        (WebCore::EventTarget::addEventListener):
        (WebCore::EventTarget::addEventListenerForBindings):
        (WebCore::EventTarget::removeEventListenerForBindings):
        * dom/EventTarget.idl:
        * dom/MessagePort.cpp:
        (WebCore::MessagePort::addEventListener):
        * dom/MessagePort.h:
        * dom/Node.cpp:
        (WebCore::tryAddEventListener):
        (WebCore::Node::addEventListener):
        (WebCore::tryRemoveEventListener):
        (WebCore::Node::removeEventListener):
        * dom/Node.h:
        * dom/RegisteredEventListener.h:
        (WebCore::RegisteredEventListener::Options::Options):
        (WebCore::RegisteredEventListener::RegisteredEventListener):
        (WebCore::operator==):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::addEventListener):
        (WebCore::HTMLMediaElement::removeEventListener):
        * html/HTMLMediaElement.h:
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::addEventListener):
        (WebCore::DOMWindow::removeEventListener):
        * page/DOMWindow.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::addEventListener):
        (WebCore::SVGElement::removeEventListener):
        * svg/SVGElement.h:

2016-06-06  Jer Noble  <jer.noble@apple.com>

        Media elements should only be allowed to control controls manager during a user gesture.
        https://bugs.webkit.org/show_bug.cgi?id=158432

        Reviewed by Eric Carlson.

        Add a new MediaElementSession behavior restriction for the controls manager
        which is cleared on the first user gesture. Since canControlControlsManager()
        may be called before the first layout, call updatePlaybackControlsManager()
        since the main content check requires the laid-out size of the media element.

        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::layoutSizeChanged):
        (WebCore::HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture):
        * html/HTMLMediaElement.h:
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::canControlControlsManager):
        * html/MediaElementSession.h:

2016-06-06  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Update MediaEndpointPeerConnection::createOffer() to use the transceiver set
        https://bugs.webkit.org/show_bug.cgi?id=158203

        Reviewed by Eric Carlson.

        Create an SDP offer based on the RTCPeerConnection object's set of RTCRtpTransceiver objects
        (instead of RTCRtpSender objects).

        Updated existing test: fast/mediastream/RTCPeerConnection-inspect-offer.html

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::matchTransceiver):
        (WebCore::matchTransceiverByMid):
        (WebCore::MediaEndpointPeerConnection::createOfferTask):
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/mediastream/PeerConnectionBackend.h:
        Remove getSenders() which is replaced by getTransceivers().
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/mediastream/SDPProcessor.cpp:
        (WebCore::configurationFromJSON):
        (WebCore::configurationToJSON):
        * Modules/mediastream/sdp.js:
        (SDP.parse):
        (SDP.generate):
        Add support for mid attribute.
        * platform/mediastream/PeerMediaDescription.h:
        (WebCore::PeerMediaDescription::mid):
        (WebCore::PeerMediaDescription::setMid):
        (WebCore::PeerMediaDescription::clone):

2016-06-06  George Ruan  <gruan@apple.com>

        Support createPattern(HTMLVideoElement, const String& repetitionType)
        https://bugs.webkit.org/show_bug.cgi?id=149984
        <rdar://problem/23058823>

        Reviewed by Dean Jackson.

        Support functionality for HTMLVideoElement argument for
        CanvasRenderingContext2D::createPattern*()

        Tests: fast/canvas/canvas-createPattern-video-invalid.html
               fast/canvas/canvas-createPattern-video-loading.html
               fast/canvas/canvas-createPattern-video-modify.html
               http/tests/security/canvas-remote-read-remote-video-allowed-anonymous.html
               http/tests/security/canvas-remote-read-remote-video-allowed-with-credentials.html
               http/tests/security/canvas-remote-read-remote-video-blocked-no-crossorigin.html
               http/tests/security/canvas-remote-read-remote-video-localhost.html
               http/tests/security/canvas-remote-read-remote-video-redirect.html
               media/video-canvas-createPattern.html

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::createPattern): Implement
        functionality of description
        * html/canvas/CanvasRenderingContext2D.h:
        * html/canvas/CanvasRenderingContext2D.idl:

2016-06-06  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !ENABLE(SHADOW_DOM) && !ENABLE(DETAILS_ELEMENT) build
        https://bugs.webkit.org/show_bug.cgi?id=158347

        Reviewed by Chris Dumez.

        * dom/ContainerNode.cpp:
        (WebCore::destroyRenderTreeIfNeeded):

2016-06-06  Alex Christensen  <achristensen@webkit.org>

        Remove unused ResourceResponse::platformResponseIsUpToDate
        https://bugs.webkit.org/show_bug.cgi?id=158424

        Reviewed by Brady Eidson.

        No change in behavior, just removing unused code that was introduced in r145007.

        * platform/network/cf/ResourceResponse.h:
        (WebCore::ResourceResponse::ResourceResponse):
        (WebCore::ResourceResponse::platformResponseIsUpToDate): Deleted.
        * platform/network/cocoa/ResourceResponseCocoa.mm:
        (WebCore::ResourceResponse::ResourceResponse):
        * platform/network/curl/ResourceResponse.h:
        (WebCore::ResourceResponse::cfURLResponse):
        (WebCore::ResourceResponse::platformResponseIsUpToDate): Deleted.
        * platform/network/soup/ResourceResponse.h:
        (WebCore::ResourceResponse::soupMessageTLSErrors):
        (WebCore::ResourceResponse::setSoupMessageTLSErrors):
        (WebCore::ResourceResponse::decode):
        (WebCore::ResourceResponse::platformResponseIsUpToDate): Deleted.

2016-06-05  Gavin & Ellie Barraclough  <barraclough@apple.com>

        Deprecate remaining uses of Lookup getStatic*, use HasStaticPropertyTable instead.
        https://bugs.webkit.org/show_bug.cgi?id=158178

        Reviewed by Darin Adler.

        As of bug #158059 most JSC static table property access no longer requires getOwnPropertySlot to be
        overridden. Port remaining calls to the getStatic* functions in Lookup.h over to the new mechanism.

        Switch WebCore DOM instance bindings to use HasStaticPropertyTable.

        * bindings/js/JSPluginElementFunctions.h:
        (WebCore::pluginElementCustomGetOwnPropertySlot):
            - Switch call from getStaticValueSlot to Type::getOwnPropertySlot.
              For any element where Type::hasStaticPropertyTable is true the HasStaticPropertyTable
              structure flag will also be set, so Type::getOwnPropertySlot will do the same thing.
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateGetOwnPropertySlotBody):
            - If we override getOwnPropertySlot, Base::getOwnPropertySlot will handle property storage & static property lookup.
        (InstanceOverridesGetOwnPropertySlot):
            - Instances only override getOwnPropertySlot if the really need to, not just for static property lookup.
        (GenerateHeader):
            - Set HasStaticPropertyTable in instance structureFlags, where appropriate.
        (GenerateImplementation):
            - GenerateGetOwnPropertySlotBody no longer needs to know if there are static properties.
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
        * bindings/scripts/test/JS/JSTestException.cpp:
        * bindings/scripts/test/JS/JSTestException.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.h:
        * bindings/scripts/test/JS/JSattribute.cpp:
        * bindings/scripts/test/JS/JSattribute.h:
            - Updating bindings test results.

2016-06-06  Brady Eidson  <beidson@apple.com>

        Modern IDB: Crash seen in IDBConnectionProxy::putOrAdd on GuardMalloc bot
        https://bugs.webkit.org/show_bug.cgi?id=158124

        Reviewed by Darin Adler.

        No new tests (Covered by existing test configurations).

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::putOrAddOnServer):
        
        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::putOrAdd):
        
        * Modules/indexeddb/client/IDBConnectionProxy.h:
        (WebCore::IDBClient::IDBConnectionProxy::callConnectionOnMainThread):
        
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::writeBlobsToDiskForIndexedDB):
        * bindings/js/SerializedScriptValue.h:
        
        * platform/network/BlobRegistry.h:
        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::writeBlobsToTemporaryFiles):
        * platform/network/BlobRegistryImpl.h:

2016-06-06  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r201706.
        https://bugs.webkit.org/show_bug.cgi?id=158427

        This change broke the Yosemite build and its LayoutTest is
        failing on Mac and iOS testers (Requested by ryanhaddad on
        #webkit).

        Reverted changeset:

        "Add experimental support for spring based CSS animations"
        https://bugs.webkit.org/show_bug.cgi?id=158403
        http://trac.webkit.org/changeset/201706

2016-06-06  Javier Fernandez  <jfernandez@igalia.com>

        [css-grid] Horizontal scroll must account for grid container's height
        https://bugs.webkit.org/show_bug.cgi?id=157971

        Reviewed by Darin Adler.

        We don't consider the scrollbar when computing the grid container's
        logical height at the beginning of the 'layoutBlock' logic. We must
        do it because otherwise, contentLogicalHeight may return a negative
        value.

        Test: fast/css-grid-layout/grid-container-scroll-accounts-for-sizing.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::layoutBlock):

2016-06-06  Alex Christensen  <achristensen@webkit.org>

        Reduce ResourceRequest copying in loading code
        https://bugs.webkit.org/show_bug.cgi?id=158251

        Reviewed by Darin Adler.

        No new tests. There should be no change in behavior except fewer unnecessary copies.
        Before, we would pass a const ResourceRequest& around, and if we needed to modify it
        we would copy the whole thing, modify the copy, and pass the copy along.  This can be
        accomplished with move semantics without the now-unnecessary copy.
        
        The biggest conceptual change is that the synchronous ResourceHandleClient::willSendRequest
        used to take a non-const ResourceRequest& and modify it, but now it returns a modified
        ResourceRequest instead.

        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::cannotShowURLError):
        (WebCore::ResourceLoader::willSendRequest):
        (WebCore::ResourceLoader::didSendData):
        * loader/ResourceLoader.h:
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (ResourceHandleStreamingClient::getOrCreateReadBuffer):
        (ResourceHandleStreamingClient::willSendRequest):
        (ResourceHandleStreamingClient::didReceiveResponse):
        * platform/network/ResourceHandle.h:
        * platform/network/ResourceHandleClient.cpp:
        (WebCore::ResourceHandleClient::~ResourceHandleClient):
        (WebCore::ResourceHandleClient::willSendRequest):
        (WebCore::ResourceHandleClient::willSendRequestAsync):
        (WebCore::ResourceHandleClient::didReceiveResponseAsync):
        * platform/network/ResourceHandleClient.h:
        (WebCore::ResourceHandleClient::didSendData):
        (WebCore::ResourceHandleClient::didReceiveResponse):
        (WebCore::ResourceHandleClient::loadingSynchronousXHR):
        (WebCore::ResourceHandleClient::willSendRequest): Deleted.
        * platform/network/SynchronousLoaderClient.cpp:
        (WebCore::SynchronousLoaderClient::~SynchronousLoaderClient):
        (WebCore::SynchronousLoaderClient::willSendRequest):
        (WebCore::SynchronousLoaderClient::shouldUseCredentialStorage):
        * platform/network/SynchronousLoaderClient.h:
        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::ResourceHandle::cancel):
        (WebCore::ResourceHandle::willSendRequest):
        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::willSendRequest):
        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.cpp:
        (WebCore::SynchronousResourceHandleCFURLConnectionDelegate::willSendRequest):
        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::platformLoadResourceSynchronously):
        (WebCore::ResourceHandle::willSendRequest):
        (WebCore::ResourceHandle::continueWillSendRequest):
        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
        (-[WebCoreResourceHandleAsDelegate connectionShouldUseCredentialStorage:]):
        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:willSendRequest:redirectResponse:]):
        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::shouldRedirectAsGET):
        (WebCore::continueAfterWillSendRequest):
        (WebCore::readCallback):
        (WebCore::ResourceHandle::continueWillSendRequest):
        (WebCore::ResourceHandle::continueDidReceiveResponse):

2016-06-05  Sam Weinig  <sam@webkit.org>

        Add experimental support for spring based CSS animations
        https://bugs.webkit.org/show_bug.cgi?id=158403

        Reviewed by Dean Jackson.

        Adds experimental support for a new CSS animation timing function that uses
        spring to model the time function. To use it you replace your normal timing
        function, be it cubic-bezier or steps, with a new function called spring().
        For instance, for a transition you would write:

            transition-timing-function: spring(1 100 10 0);
        
        The parameters are, in order:
            - Mass
            - Stiffness
            - Damping
            - Initial Velocity

        Tests: animations/spring-computed-style.html
               animations/spring-function.html
               animations/spring-parsing.html

        * WebCore.xcodeproj/project.pbxproj:
        Add new file.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::createTimingFunctionValue):
        Modernize and add support for the spring function.

        * css/CSSParser.cpp:
        (WebCore::CSSParserContext::CSSParserContext):
        (WebCore::operator==):
        (WebCore::CSSParser::CSSParser):
        (WebCore::CSSParser::parseTransformOriginShorthand):
        (WebCore::CSSParser::isSpringTimingFunctionEnabled):
        (WebCore::CSSParser::parseCubicBezierTimingFunctionValue):
        (WebCore::CSSParser::parseSpringTimingFunctionValue):
        (WebCore::CSSParser::parseAnimationTimingFunction):
        * css/CSSParser.h:
        * css/CSSParserMode.h:
        Add parsing support for the spring() function.

        * css/CSSTimingFunctionValue.cpp:
        (WebCore::CSSCubicBezierTimingFunctionValue::customCSSText):
        (WebCore::CSSCubicBezierTimingFunctionValue::equals):
        (WebCore::CSSStepsTimingFunctionValue::customCSSText):
        (WebCore::CSSStepsTimingFunctionValue::equals):
        (WebCore::CSSSpringTimingFunctionValue::customCSSText):
        (WebCore::CSSSpringTimingFunctionValue::equals):
        * css/CSSTimingFunctionValue.h:
        (WebCore::CSSSpringTimingFunctionValue::create):
        (WebCore::CSSSpringTimingFunctionValue::mass):
        (WebCore::CSSSpringTimingFunctionValue::stiffness):
        (WebCore::CSSSpringTimingFunctionValue::damping):
        (WebCore::CSSSpringTimingFunctionValue::initialVelocity):
        (WebCore::CSSSpringTimingFunctionValue::CSSSpringTimingFunctionValue):
        Modernize and add support for the spring function.

        * css/CSSToStyleMap.cpp:
        (WebCore::CSSToStyleMap::mapAnimationTimingFunction):
        Pipe the spring function into the animation.

        * css/CSSValue.cpp:
        (WebCore::CSSValue::equals):
        (WebCore::CSSValue::cssText):
        (WebCore::CSSValue::destroy):
        * css/CSSValue.h:
        (WebCore::CSSValue::isSpringTimingFunctionValue):
        Add support for the spring function.
        
        * page/Settings.in:
        Add a setting to control if the spring function is enabled.

        * page/animation/AnimationBase.cpp:
        (WebCore::solveSpringFunction):
        (WebCore::AnimationBase::progress):
        Add support for solving the spring function. Since the spring requires time to be absolute,
        get the real time by multiplying the ratio t, to the total duration.

        * platform/animation/TimingFunction.cpp:
        (WebCore::operator<<):
        * platform/animation/TimingFunction.h:
        (WebCore::TimingFunction::~TimingFunction):
        (WebCore::TimingFunction::isSpringTimingFunction):
        Add support for the spring timing function.

        * platform/graphics/SpringSolver.h: Added.
        (WebCore::SpringSolver::SpringSolver):
        (WebCore::SpringSolver::solve):
        Add a Spring solver that matches the one in CoreAnimation.

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::createAnimationFromKeyframes):
        (WebCore::GraphicsLayerCA::appendToUncommittedAnimations):
        (WebCore::GraphicsLayerCA::createBasicAnimation):
        (WebCore::GraphicsLayerCA::createSpringAnimation):
        (WebCore::GraphicsLayerCA::setupAnimation):
        * platform/graphics/ca/GraphicsLayerCA.h:
        Map animations with spring timing functions to CASpringAnimations.

        * platform/graphics/ca/PlatformCAAnimation.cpp:
        (WebCore::operator<<):
        (WebCore::PlatformCAAnimation::isBasicAnimation):
        * platform/graphics/ca/PlatformCAAnimation.h:
        (WebCore::PlatformCAAnimation::setActualStartTimeIfNeeded):
        (WebCore::PlatformCAAnimation::PlatformCAAnimation):
        * platform/graphics/ca/cocoa/PlatformCAAnimationCocoa.mm:
        (WebCore::toCAMediaTimingFunction):
        (PlatformCAAnimationCocoa::PlatformCAAnimationCocoa):
        (PlatformCAAnimationCocoa::setTimingFunction):
        (PlatformCAAnimationCocoa::copyTimingFunctionFrom):
        (PlatformCAAnimationCocoa::setFromValue):
        (PlatformCAAnimationCocoa::copyFromValueFrom):
        (PlatformCAAnimationCocoa::setToValue):
        (PlatformCAAnimationCocoa::copyToValueFrom):
        Add a new type of PlatformCAAnimation, Spring, which is a sub-type of Basic.

2016-06-05  Zalan Bujtas  <zalan@apple.com>

        Addressing post-review comments on r201635.

        Reviewed by Chris Dumez.

        * rendering/RenderInline.h:
        (WebCore::RenderInline::computeRectForRepaint):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::RepaintContext::RepaintContext):
        (WebCore::RenderObject::computeRectForRepaint):
        * rendering/RenderTableCell.h:
        * rendering/RenderView.h:
        * rendering/svg/RenderSVGForeignObject.h:
        * rendering/svg/RenderSVGText.h:

2016-06-05  Yusuke Suzuki  <utatane.tea@gmail.com>

        Change ProxyObject.[[Get]] not to use custom accessor
        https://bugs.webkit.org/show_bug.cgi?id=157080

        Reviewed by Darin Adler.

        * bindings/js/JSCryptoAlgorithmDictionary.cpp:
        (WebCore::getProperty):
        * bindings/js/JSDOMBinding.h:
        (WebCore::nonCachingStaticFunctionGetter):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowWebKit):
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::tryGetProperty):
        * bindings/js/JSPluginElementFunctions.cpp:
        (WebCore::pluginElementPropertyGetter):
        * bindings/js/JSPluginElementFunctions.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSInterfaceName.cpp:
        (WebCore::jsInterfaceNameConstructor):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::jsTestActiveDOMObjectExcitingAttr):
        (WebCore::jsTestActiveDOMObjectConstructor):
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::jsTestClassWithJSBuiltinConstructorConstructor):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::jsTestCustomConstructorWithNoInterfaceObjectConstructor):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::jsTestCustomNamedGetterConstructor):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::jsTestEventConstructorAttr1):
        (WebCore::jsTestEventConstructorAttr2):
        (WebCore::jsTestEventConstructorAttr3):
        (WebCore::jsTestEventConstructorConstructor):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::jsTestEventTargetConstructor):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::jsTestExceptionName):
        (WebCore::jsTestExceptionConstructor):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::jsTestGenerateIsReachableConstructor):
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        (WebCore::jsTestGlobalObjectRegularAttribute):
        (WebCore::jsTestGlobalObjectEnabledAtRuntimeAttribute):
        (WebCore::jsTestGlobalObjectConstructor):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::jsTestInterfaceConstructorImplementsStaticReadOnlyAttr):
        (WebCore::jsTestInterfaceConstructorImplementsStaticAttr):
        (WebCore::jsTestInterfaceImplementsStr1):
        (WebCore::jsTestInterfaceImplementsStr2):
        (WebCore::jsTestInterfaceImplementsStr3):
        (WebCore::jsTestInterfaceImplementsNode):
        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
        (WebCore::jsTestInterfaceSupplementalStr1):
        (WebCore::jsTestInterfaceSupplementalStr2):
        (WebCore::jsTestInterfaceSupplementalStr3):
        (WebCore::jsTestInterfaceSupplementalNode):
        (WebCore::jsTestInterfaceConstructor):
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        (WebCore::jsTestJSBuiltinConstructorTestAttributeCustom):
        (WebCore::jsTestJSBuiltinConstructorTestAttributeRWCustom):
        (WebCore::jsTestJSBuiltinConstructorConstructor):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::jsTestMediaQueryListListenerConstructor):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::jsTestNamedConstructorConstructor):
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::jsTestNodeName):
        (WebCore::jsTestNodeConstructor):
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::jsTestNondeterministicNondeterministicReadonlyAttr):
        (WebCore::jsTestNondeterministicNondeterministicWriteableAttr):
        (WebCore::jsTestNondeterministicNondeterministicExceptionAttr):
        (WebCore::jsTestNondeterministicNondeterministicGetterExceptionAttr):
        (WebCore::jsTestNondeterministicNondeterministicSetterExceptionAttr):
        (WebCore::jsTestNondeterministicConstructor):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjReadOnlyLongAttr):
        (WebCore::jsTestObjReadOnlyStringAttr):
        (WebCore::jsTestObjReadOnlyTestObjAttr):
        (WebCore::jsTestObjConstructorStaticReadOnlyLongAttr):
        (WebCore::jsTestObjConstructorStaticStringAttr):
        (WebCore::jsTestObjConstructorTestSubObj):
        (WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
        (WebCore::jsTestObjEnumAttr):
        (WebCore::jsTestObjByteAttr):
        (WebCore::jsTestObjOctetAttr):
        (WebCore::jsTestObjShortAttr):
        (WebCore::jsTestObjClampedShortAttr):
        (WebCore::jsTestObjEnforceRangeShortAttr):
        (WebCore::jsTestObjUnsignedShortAttr):
        (WebCore::jsTestObjLongAttr):
        (WebCore::jsTestObjLongLongAttr):
        (WebCore::jsTestObjUnsignedLongLongAttr):
        (WebCore::jsTestObjStringAttr):
        (WebCore::jsTestObjTestObjAttr):
        (WebCore::jsTestObjTestNullableObjAttr):
        (WebCore::jsTestObjLenientTestObjAttr):
        (WebCore::jsTestObjUnforgeableAttr):
        (WebCore::jsTestObjStringAttrTreatingNullAsEmptyString):
        (WebCore::jsTestObjXMLObjAttr):
        (WebCore::jsTestObjCreate):
        (WebCore::jsTestObjReflectedStringAttr):
        (WebCore::jsTestObjReflectedIntegralAttr):
        (WebCore::jsTestObjReflectedUnsignedIntegralAttr):
        (WebCore::jsTestObjReflectedBooleanAttr):
        (WebCore::jsTestObjReflectedURLAttr):
        (WebCore::jsTestObjReflectedCustomIntegralAttr):
        (WebCore::jsTestObjReflectedCustomBooleanAttr):
        (WebCore::jsTestObjReflectedCustomURLAttr):
        (WebCore::jsTestObjEnabledAtRuntimeAttribute):
        (WebCore::jsTestObjTypedArrayAttr):
        (WebCore::jsTestObjAttrWithGetterException):
        (WebCore::jsTestObjAttrWithGetterExceptionWithMessage):
        (WebCore::jsTestObjAttrWithSetterException):
        (WebCore::jsTestObjAttrWithSetterExceptionWithMessage):
        (WebCore::jsTestObjStringAttrWithGetterException):
        (WebCore::jsTestObjStringAttrWithSetterException):
        (WebCore::jsTestObjStrictTypeCheckingAttribute):
        (WebCore::jsTestObjCustomAttr):
        (WebCore::jsTestObjOnfoo):
        (WebCore::jsTestObjOnwebkitfoo):
        (WebCore::jsTestObjWithScriptStateAttribute):
        (WebCore::jsTestObjWithCallWithAndSetterCallWithAttribute):
        (WebCore::jsTestObjWithScriptExecutionContextAttribute):
        (WebCore::jsTestObjWithScriptStateAttributeRaises):
        (WebCore::jsTestObjWithScriptExecutionContextAttributeRaises):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttribute):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
        (WebCore::jsTestObjWithScriptArgumentsAndCallStackAttribute):
        (WebCore::jsTestObjConditionalAttr1):
        (WebCore::jsTestObjConditionalAttr2):
        (WebCore::jsTestObjConditionalAttr3):
        (WebCore::jsTestObjConditionalAttr4Constructor):
        (WebCore::jsTestObjConditionalAttr5Constructor):
        (WebCore::jsTestObjConditionalAttr6Constructor):
        (WebCore::jsTestObjCachedAttribute1):
        (WebCore::jsTestObjCachedAttribute2):
        (WebCore::jsTestObjAnyAttribute):
        (WebCore::jsTestObjContentDocument):
        (WebCore::jsTestObjMutablePoint):
        (WebCore::jsTestObjImmutablePoint):
        (WebCore::jsTestObjStrawberry):
        (WebCore::jsTestObjStrictFloat):
        (WebCore::jsTestObjDescription):
        (WebCore::jsTestObjId):
        (WebCore::jsTestObjHash):
        (WebCore::jsTestObjReplaceableAttribute):
        (WebCore::jsTestObjNullableDoubleAttribute):
        (WebCore::jsTestObjNullableLongAttribute):
        (WebCore::jsTestObjNullableBooleanAttribute):
        (WebCore::jsTestObjNullableStringAttribute):
        (WebCore::jsTestObjNullableLongSettableAttribute):
        (WebCore::jsTestObjNullableStringSettableAttribute):
        (WebCore::jsTestObjNullableStringValue):
        (WebCore::jsTestObjAttribute):
        (WebCore::jsTestObjAttributeWithReservedEnumType):
        (WebCore::jsTestObjPutForwardsAttribute):
        (WebCore::jsTestObjPutForwardsNullableAttribute):
        (WebCore::jsTestObjConstructor):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::jsTestOverloadedConstructorsConstructor):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::jsTestOverrideBuiltinsConstructor):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::jsTestSerializedScriptValueInterfaceValue):
        (WebCore::jsTestSerializedScriptValueInterfaceReadonlyValue):
        (WebCore::jsTestSerializedScriptValueInterfaceCachedValue):
        (WebCore::jsTestSerializedScriptValueInterfacePorts):
        (WebCore::jsTestSerializedScriptValueInterfaceCachedReadonlyValue):
        (WebCore::jsTestSerializedScriptValueInterfaceConstructor):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::jsTestTypedefsUnsignedLongLongAttr):
        (WebCore::jsTestTypedefsImmutableSerializedScriptValue):
        (WebCore::jsTestTypedefsConstructorTestSubObj):
        (WebCore::jsTestTypedefsAttrWithGetterException):
        (WebCore::jsTestTypedefsAttrWithSetterException):
        (WebCore::jsTestTypedefsStringAttrWithGetterException):
        (WebCore::jsTestTypedefsStringAttrWithSetterException):
        (WebCore::jsTestTypedefsConstructor):
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::jsattributeReadonly):
        (WebCore::jsattributeConstructor):
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::jsreadonlyConstructor):
        * bridge/runtime_array.cpp:
        (JSC::RuntimeArray::lengthGetter):
        * bridge/runtime_array.h:
        * bridge/runtime_method.cpp:
        (JSC::RuntimeMethod::lengthGetter):
        * bridge/runtime_method.h:
        * bridge/runtime_object.cpp:
        (JSC::Bindings::RuntimeObject::fallbackObjectGetter):
        (JSC::Bindings::RuntimeObject::fieldGetter):
        (JSC::Bindings::RuntimeObject::methodGetter):
        * bridge/runtime_object.h:

2016-06-03  Gavin & Ellie Barraclough  <barraclough@apple.com>

        Deprecate remaining uses of Lookup getStatic*, use HasStaticPropertyTable instead.
        https://bugs.webkit.org/show_bug.cgi?id=158178

        Reviewed by Darin Adler.

        As of bug #158059 most JSC static table property access no longer requires getOwnPropertySlot to be
        overridden. Port remaining calls to the getStatic* functions in Lookup.h over to the new mechanism.

        Part 1: Switch JSGlobalObject & JSDOMWindow to use HasStaticPropertyTable.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::getOwnPropertySlot):
            - getStaticPropertySlot -> Base::getOwnPropertySlot.
        * bindings/js/JSPluginElementFunctions.h:
        (WebCore::pluginElementCustomGetOwnPropertySlot):
            - Switch call from getStaticValueSlot to Type::getOwnPropertySlot.
              For any element where Type::hasStaticPropertyTable is true the HasStaticPropertyTable
              structure flag will also be set, so Type::getOwnPropertySlot will do the same thing.
        * bindings/scripts/CodeGeneratorJS.pm:
        (PrototypeHasStaticPropertyTable):
            - Was PrototypeOverridesGetOwnPropertySlot; prototypes now never need override getOwnPropertySlot so renaming accordingly.
        (GenerateImplementation):
            - Removed generation of getOwnPropertySlot body for DOMGlobalObjects.
        (GeneratePrototypeDeclaration):
            - For DOMGlobalObjects, set HasStaticPropertyTable instead of OverridesGetOwnPropertySlot & removed getOwnPropertySlot declaration.
        (PrototypeOverridesGetOwnPropertySlot): Deleted.
            Renamed to PrototypeHasStaticPropertyTable.
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        * bindings/scripts/test/JS/JSTestGlobalObject.h:
            - Updating bindings test results.

2016-06-05  Antti Koivisto  <antti@apple.com>

        Find on page finds too many matches
        https://bugs.webkit.org/show_bug.cgi?id=158395
        rdar://problem/7440637

        Reviewed by Dan Bernstein and Darin Adler.

        There is a long standing bug where in some cases WebKit may find non-visible text matches when doing find on page.
        For example searching patch review view in bugs.webkit.org returns twice as many matches as there actually are
        on the page. This happens because the text content is replicated in an invisible subframe.

        Fix by making TextIterator ignore content in non-visible subframes in findPlainText.

        Test: editing/text-iterator/count-matches-in-frames.html

        * editing/TextIterator.cpp:
        (WebCore::nextInPreOrderCrossingShadowBoundaries):

            Remove support for an uninteresting assertion.

        (WebCore::fullyClipsContents):

            Elements without renderer clip their content (except for display:contents).
            Test the content rect instead of the size rect for emptiness.

        (WebCore::ignoresContainerClip):
        (WebCore::pushFullyClippedState):
        (WebCore::setUpFullyClippedStack):
        (WebCore::isClippedByFrameAncestor):

            Test if the frame owner element is clipped in any of the parent frames.

        (WebCore::TextIterator::TextIterator):

            If the frame is clipped by its ancestors the iterator is initialized to end state.
            Clipped frame never renders anything so there is no need to maintain clip stack and traverse.

        (WebCore::findPlainText):

            Use TextIteratorClipsToFrameAncestors behavior. There might be other places where
            this behavior should be used (or perhaps it should be used always?) but limit this to
            text search for now.

        (WebCore::depthCrossingShadowBoundaries): Deleted.
        * editing/TextIterator.h:
        * editing/TextIteratorBehavior.h:

            Add TextIteratorClipsToFrameAncestors behavior.

        * testing/Internals.cpp:
        (WebCore::Internals::countMatchesForText):
        (WebCore::Internals::countFindMatches):
        (WebCore::Internals::numberOfLiveNodes):
        * testing/Internals.h:
        * testing/Internals.idl:

            Testing support

2016-06-05  Konstantin Tokarev  <annulen@yandex.ru>

        Do not construct temporary copy of String from AtomicString.
        https://bugs.webkit.org/show_bug.cgi?id=158400

        Reviewed by Darin Adler.

        No new tests needed.

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::ariaReadOnlyValue):

2016-06-05  Andreas Kling  <akling@apple.com>

        Give RuleFeatures::classesMatchingAncestors some inline capacity.
        <https://webkit.org/b/158356>

        Reviewed by Darin Adler.

        Avoid 362'000 heap allocations on PLUM (1.3% of all transient fastMallocs) by giving
        RuleFeatures::classesMatchingAncestors some inline capacity (32).
        This class is only ever allocated on the stack anyway.

        * css/RuleFeature.h:

2016-06-05  Brady Eidson  <beidson@apple.com>

        Unreviewed, rolling out r201693.

        Can't fix right now

        Reverted changeset:

        "Modern IDB: Crash seen in IDBConnectionProxy::putOrAdd on
        GuardMalloc bot"
        https://bugs.webkit.org/show_bug.cgi?id=158124
        http://trac.webkit.org/changeset/201693

2016-06-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: Crash seen in IDBConnectionProxy::putOrAdd on GuardMalloc bot
        https://bugs.webkit.org/show_bug.cgi?id=158124

        Reviewed by Darin Adler.

        No new tests (Covered by existing test configurations).

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::putOrAddOnServer):
        
        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::putOrAdd):
        
        * Modules/indexeddb/client/IDBConnectionProxy.h:
        (WebCore::IDBClient::IDBConnectionProxy::callConnectionOnMainThread):
        
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::writeBlobsToDiskForIndexedDB):
        * bindings/js/SerializedScriptValue.h:
        
        * platform/network/BlobRegistry.h:
        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::writeBlobsToTemporaryFiles):
        * platform/network/BlobRegistryImpl.h:

2016-06-03  Ada Chan  <adachan@apple.com>

        REGRESSION (r201474): Should set overflow: hidden on -webkit-media-controls when placeholder is showing
        https://bugs.webkit.org/show_bug.cgi?id=158377

        Reviewed by Darin Adler.

        In r201474, we defer removing the hidden class from inlinePlaybackPlaceholder until
        showInlinePlaybackPlaceholderWhenSafe(). We also need to move the code that adds the
        placeholder-showing class to -webkit-media-controls to that method.

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.showInlinePlaybackPlaceholderWhenSafe):
        Add the "placeholder-showing" class to -webkit-media-controls when we show the placeholder.
        (Controller.prototype.handlePresentationModeChange):
        Remove the "placeholder-showing" class from -webkit-media-controls when we hide the
        placeholder. Remove the old code that adds and removes that class.

2016-06-04  Darin Adler  <darin@apple.com>

        leaks seen in fast/css/variables tests
        https://bugs.webkit.org/show_bug.cgi?id=150728

        Reviewed by Anders Carlsson.

        Fixes leaks seen running fast/css/variables tests with leak checking turned on.

        * css/CSSPrimitiveValue.cpp:
        (WebCore::isStringType): Added. For debugging purposes so we catch cases where we
        are not treating strings consistently between construction and destruction.
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Assert isStringType returns true.
        (WebCore::CSSPrimitiveValue::cleanup): Added CSS_DIMENSION and CSS_PARSER_IDENTIFIER
        to the list of types that have to decrement the reference count of the string we own.
        Both types are passed to the string constructor above.

        * css/CSSValueList.cpp:
        (WebCore::CSSValueList::buildParserValueListSubstitutingVariables): Restructured the
        code so we destroy any CSSParserValue that we don't use. This is needed because of the
        peculiar requirements of CSSParserValue: it has a be a struct without a destructor so
        it can be used in the CSS grammar, so we have to destroy it explicitly. Ideally we would
        minimize any use of it outside the CSSParser itself, but as long as we are using it, we
        need to do this explicit destruction.

2016-06-04  Anders Carlsson  <andersca@apple.com>

        32-bit build fix
        https://bugs.webkit.org/show_bug.cgi?id=158383
        rdar://problem/26628125

        Reviewed by Dan Bernstein.

        Synthesize the webPlaybackSessionInterfaceMac property.

        * platform/mac/WebPlaybackControlsManager.mm:

2016-06-04  Chris Dumez  <cdumez@apple.com>

        Avoid redundant isUndefined() check for parameters that are both optional and nullable in overloads
        https://bugs.webkit.org/show_bug.cgi?id=158380

        Reviewed by Brady Eidson.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheckExpression):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter):

2016-06-04  Brent Fulgham  <bfulgham@apple.com>

        CSP: Content Security Policy directive, upgrade-insecure-requests (UIR)
        https://bugs.webkit.org/show_bug.cgi?id=143653
        <rdar://problem/23032067>

        Reviewed by Andy Estes.

        Modify our loading logic so that we recognize and upgrade insecure requests to secure
        requests if the Content Security Policy directive 'upgrade-insecure-requests' is
        present.
        
        Add a static helper function to ContentSecurityPolicy to upgrade insecure URLs so
        that we don't have to sprinkle the same code all over the loader system.

        Tests: http/tests/security/contentSecurityPolicy/report-only-upgrade-insecure.php
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/basic-upgrade-cors.https.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/basic-upgrade.https.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/form-upgrade.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/https-header-auxiliary.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/https-header-nested.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/https-header-subresource.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/https-header-top-level.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/iframe-upgrade.https.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/proper-nested-upgrades.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/proper-open-window-upgrades.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-insecure-audio-video-in-main-frame.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-insecure-css-in-iframe.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-insecure-image-in-main-frame.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-simple-ws.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-insecure-xhr-in-main-frame.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-redirect-http-to-https-script-in-iframe.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrade-redirect-https-to-http-script-in-iframe.html
               http/tests/security/contentSecurityPolicy/upgrade-insecure-requests/upgrades-mixed-content.html
               http/tests/ssl/iframe-upgrade.https.html
               http/tests/ssl/upgrade-origin-usage.html
               http/tests/websocket/tests/hybi/upgrade-simple-ws.html

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect): Upgrade insecure requests if the CSP
        indicates we should.
        * dom/Document.cpp:
        (WebCore::Document::initSecurityContext): Populate new document CSP with sets of upgrade host and port combinations.
        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::requestScript): Upgrade insecure requests if
        the CSP indicates we should.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadResource): Ditto.
        * loader/DocumentWriter.cpp:
        (WebCore::DocumentWriter::begin): Ditto.
        * loader/FormSubmission.cpp:
        (WebCore::FormSubmission::create): Ditto.
        (WebCore::FormSubmission::populateFrameLoadRequest): Add "Upgrade-Insecure-Requests"
        header to frame load requests.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::addExtraFieldsToMainResourceRequest): Add the
        'Update-Insecure-Requests' header field if necessary.
        (WebCore::FrameLoader::addHTTPUpgradeInsecureRequestsIfNeeded): Added helper function.
        (WebCore::FrameLoader::loadPostRequest): Upgrade insecure requests if the CSP
        indicates we should.
        (WebCore::FrameLoader::loadResourceSynchronously): Ditto.
        (WebCore::FrameLoader::loadDifferentDocumentItem): If loading a form, add the
        'Update-Insecure-Requests' header field if necessary.
        (WebCore::createWindow): Upgrade insecure requests if the CSP
        indicates we should.
        * loader/FrameLoader.h:
        * loader/PingLoader.cpp:
        (WebCore::PingLoader::loadImage): Upgrade insecure requests if the CSP
        indicates we should.
        (WebCore::PingLoader::sendPing): Ditto.
        (WebCore::PingLoader::sendViolationReport): Ditto.
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::willSendRequestInternal): Ditto.
        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::requestFrame): Ditto.
        (WebCore::SubframeLoader::requestObject): Ditto.
        * loader/appcache/ApplicationCacheHost.cpp:
        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache): Ditto.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestImage): Ditto.
        (WebCore::CachedResourceLoader::requestResource): Ditto.
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::createWindow): Add the 'Update-Insecure-Requests' header
        field if necessary.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::copyStateFrom): Populate upgraded resource set
        from other context.
        (WebCore::ContentSecurityPolicy::upgradeInsecureRequestIfNeeded): Added helper function
        to upgrade requests when the upgrade-insecure-requests CSP policy is present, or if
        the host and port combination have previously been upgraded.
        (WebCore::ContentSecurityPolicy::upgradeInsecureNavigationRequestIfNeeded): Added
        helper function to upgrade requests that have been previously upgraded. Cross-site
        navigations only get upgraded when they have been previously upgraded.
        (WebCore::ContentSecurityPolicy::addInsecureNavigationRequestsToUpgrade): Added.
        (WebCore::ContentSecurityPolicy::populateInsecureNavigationRequestsToUpgradeFromOther): Added.
        * page/csp/ContentSecurityPolicy.h:
        (WebCore::ContentSecurityPolicy::setUpgradeInsecureRequests): Added.
        (WebCore::ContentSecurityPolicy::upgradeInsecureRequests): Added.
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::ContentSecurityPolicyDirectiveList): Use
        more C++11 initializations.
        (WebCore::ContentSecurityPolicyDirectiveList::setUpgradeInsecureRequests): Added.
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Teach this function to
        recognize the new directive.
        * page/csp/ContentSecurityPolicyDirectiveList.h:
        * page/csp/ContentSecurityPolicyDirectiveNames.cpp:
        * page/csp/ContentSecurityPolicyDirectiveNames.h:
        * platform/network/HTTPHeaderNames.in: Add new 'Upgrade-Insecure-Requests' header field.
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::open): Upgrade insecure requests if the CSP if needed.

2016-06-03  Myles C. Maxfield  <mmaxfield@apple.com>

        Bopomofo ruby in Dictionary.app is written horizontally (when it should be written vertically)
        https://bugs.webkit.org/show_bug.cgi?id=158245
        <rdar://problem/25675318>

        Reviewed by Darin Adler.

        With orthogonal flows, the inner element gets a logical width that is computed from two values:
        - The containing block's available logical height
        - The FrameView's visibleHeight

        In Dictionary.app, the FrameView's height changes, but this element doesn't get relaid out.
        This is because of our optimization where normal-flow elements don't get relaid out if their
        parent's width doesn't change (which is the case here).

        Therefore, this orthogonal writing mode element should be relaid out when the FrameView changes
        size. Luckily, we already have machinery for doing this: percentage heights. In quirks mode, a
        div with a percentage height may walk arbitrarily far up the DOM tree in order to determine which
        element the percentage should be resolved against. Therefore, we have a map of percentage-sizing-
        ancestors to percentage-sizing-descendants which speeds up this search. If a percentage-sizing-
        ancestor gets relaid out, all the relevant percentage-sizing-descendants get relaid out too.

        Therefore, we can simply mark the FrameView as a percentage-sizing-ancestor and the orthogonal
        flow element as a percentage-sizing-descendant. The lifetime of this relationship is already
        managed correctly - it gets reset when style changes and when the renderer is destroyed, and
        is created during layout.

        Unfortunately, this same treatment should also be done to the element which dictates the
        containing block's logical height (which caused https://bugs.webkit.org/show_bug.cgi?id=158286).
        Implementing this would require giving RenderBox::availableLogicalHeight() a second result
        of the necessary element which dictates the return. In an effort to keep this patch small and
        focused, I'll do this secondary (much larger) work in a patch on that bug. This patch,
        therefore, is kept small and focused.

        Test: fast/text/orthogonal-writing-mode-containing-block-frameView-resize-relayout.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::perpendicularContainingBlockLogicalHeight):

2016-06-03  Myles C. Maxfield  <mmaxfield@apple.com>

        Text not visible while external font downloading
        https://bugs.webkit.org/show_bug.cgi?id=25207
        <rdar://problem/15167413>

        Reviewed by Dean Jackson.

        I already laid the groundwork for this when implementing the CSS Font Loading API.
        We only have to create a timer and correctly respond to it timing out (by setting
        state).

        This patch also adds a new internal setting which puts us in a mode where font
        loads never complete and the timeout occurs immediately. This is so we can test
        the fallback behavior.

        Test: fast/text/web-font-load-fallback-during-loading.html

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::CSSFontFace):
        (WebCore::CSSFontFace::fontLoadEventOccurred):
        (WebCore::CSSFontFace::timeoutFired):
        (WebCore::CSSFontFace::setStatus):
        (WebCore::CSSFontFace::fontLoaded):
        (WebCore::CSSFontFace::webFontsShouldAlwaysFallBack):
        (WebCore::CSSFontFace::pump):
        (WebCore::CSSFontFace::font):
        * css/CSSFontFace.h:
        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::fontLoaded):
        * css/FontFace.cpp:
        (WebCore::FontFace::fontStateChanged):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        (WebCore::Settings::setWebFontsAlwaysFallBack):
        * page/Settings.h:
        (WebCore::Settings::webFontsAlwaysFallBack):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup):
        (WebCore::InternalSettings::Backup::restoreTo):
        (WebCore::InternalSettings::setWebFontsAlwaysFallBack):
        * testing/InternalSettings.h:
        * testing/InternalSettings.idl:

2016-06-03  Chris Dumez  <cdumez@apple.com>

        Modernize a few more lambda captures
        https://bugs.webkit.org/show_bug.cgi?id=158370

        Reviewed by Brady Eidson.

        * workers/DedicatedWorkerGlobalScope.cpp:
        (WebCore::DedicatedWorkerGlobalScope::postMessage):
        * workers/DedicatedWorkerGlobalScope.h:
        * workers/Worker.cpp:
        (WebCore::Worker::postMessage):
        * workers/Worker.h:
        * workers/WorkerEventQueue.cpp:
        (WebCore::WorkerEventQueue::enqueueEvent):
        * workers/WorkerGlobalScopeProxy.h:
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
        (WebCore::WorkerMessagingProxy::postMessageToWorkerGlobalScope):
        * workers/WorkerMessagingProxy.h:
        * workers/WorkerObjectProxy.h:

2016-06-03  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r201663.
        https://bugs.webkit.org/show_bug.cgi?id=158374

        Broke the Windows build (Requested by andersca on #webkit).

        Reverted changeset:

        "Rename NoncopyableFunction to Function"
        https://bugs.webkit.org/show_bug.cgi?id=158354
        http://trac.webkit.org/changeset/201663

2016-06-03  Ryosuke Niwa  <rniwa@webkit.org>

        Crash under VisibleSelection::firstRange()
        https://bugs.webkit.org/show_bug.cgi?id=158241

        Reviewed by Enrica Casucci.

        The crash was commonly caused by parentAnchoredEquivalent returning null when the anchored node was a shadow root.
        Fixed it by returning a shadow root in parentAnchoredEquivalent.

        Also guard against other kinds of crashes by adding a null check in VisibleSelection::firstRange() since we've seen
        a crash in the same code path outside of a shadow tree.

        This patch also fixes other Position methods to stop using nonShadowBoundaryParentNode in place of parentNode as
        that would cause a similar crash and/or a bug elsewhere.

        Test: fast/shadow-dom/selection-at-shadow-root-crash.html

        * accessibility/AXObjectCache.cpp:
        (AXObjectCache::startCharacterOffsetOfParagraph): Fixed a bug uncovered by the assertion fix in Position::Position.
        This code was sometimes creating a position inside a BR, which is wrong.
        (AXObjectCache::endCharacterOffsetOfParagraph): Ditto.
        * dom/Position.cpp:
        (WebCore::Position::Position): Fixed an assertion which was checking that this constructor wasn't being called
        with m_anchorNode set to an element editing ignores content of. ||ing it with isShadowRoot() made this assertion
        useless because it's true whenever m_anchorNode is not a shadow root.
        (WebCore::Position::containerNode): Use parentNode() instead of findParent() which calls nonShadowBoundaryParentNode
        since Position should
        (WebCore::Position::parentAnchoredEquivalent): Fixed the bug by letting this function return a shadow root.
        (WebCore::Position::previous): Use parentNode() instead of findParent().
        (WebCore::Position::next): Ditto.
        (WebCore::Position::atStartOfTree): Ditto.
        (WebCore::Position::atEndOfTree): Ditto.
        (WebCore::Position::findParent): Deleted.
        * dom/Position.h:
        * editing/VisibleSelection.cpp:
        (VisibleSelection::firstRange): Added a null check. 

2016-06-03  Zalan Bujtas  <zalan@apple.com>

        Incorrect rendering on boostmobile FAQ page
        https://bugs.webkit.org/show_bug.cgi?id=158303
        <rdar://problem/26603462>

        Reviewed by Chris Dumez.

        Initial value for background-color is 'transparent'. see https://drafts.csswg.org/css-backgrounds-3/#background-color

        Test: fast/selectors/non-visited-link-backround-color.html

        * css/CSSPropertyNames.in:

2016-06-03  Brady Eidson  <beidson@apple.com>

        More miscellaneous IDBBindingUtilities cleanup.
        https://bugs.webkit.org/show_bug.cgi?id=158359

        Reviewed by Tim Horton.

        No new tests (Straight refactor, yo).

        Replace more ScriptExecutionContext&s with ExecState&s.
        Combine more unnecessarily separate functions.
        Remove some cruft.
        
        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::setGetResult):
        
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::setResult):
        (WebCore::IDBRequest::setResultToStructuredClone):
        
        * Modules/indexeddb/server/MemoryObjectStore.cpp:
        (WebCore::IDBServer::MemoryObjectStore::updateIndexesForPutRecord):
        (WebCore::IDBServer::MemoryObjectStore::populateIndexWithExistingRecords):
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateOneIndexForAddRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateAllIndexesForAddRecord):
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd):
        
        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::deserializeIDBValueToJSValue):
        (WebCore::idbKeyDataToScriptValue):
        (WebCore::deserializeIDBValueDataToJSValue): Deleted.
        * bindings/js/IDBBindingUtilities.h:

2016-06-03  Chris Dumez  <cdumez@apple.com>

        CanvasRenderingContext2D.createPattern() / putImageData() throw wrong exception type
        https://bugs.webkit.org/show_bug.cgi?id=158322

        Reviewed by Ryosuke Niwa.

        CanvasRenderingContext2D.createPattern() / putImageData() were throwing the wrong
        exception type when the first parameter was null. It should throw a TypeError
        but it was throwing a legacy TYPE_MISMATCH_ERR:
        - http://www.w3.org/TR/2dcontext/#canvasrenderingcontext2d
        - http://www.w3.org/TR/2dcontext/#canvasimagesource

        This patch aligns our behavior with the specification.

        No new tests, covered by existing tests.

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::createPattern):
        (WebCore::CanvasRenderingContext2D::putImageData):
        (WebCore::CanvasRenderingContext2D::webkitPutImageDataHD):
        (WebCore::CanvasRenderingContext2D::didDraw): Deleted.
        (WebCore::CanvasRenderingContext2D::drawFocusIfNeeded): Deleted.
        (WebCore::CanvasRenderingContext2D::drawFocusIfNeededInternal): Deleted.
        (WebCore::CanvasRenderingContext2D::font): Deleted.
        * html/canvas/CanvasRenderingContext2D.h:
        * html/canvas/CanvasRenderingContext2D.idl:

2016-06-03  Anders Carlsson  <andersca@apple.com>

        Rename NoncopyableFunction to Function
        https://bugs.webkit.org/show_bug.cgi?id=158354

        Reviewed by Chris Dumez.

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::runTask):
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/webaudio/AudioDestinationNode.h:
        (WebCore::AudioDestinationNode::resume):
        (WebCore::AudioDestinationNode::suspend):
        (WebCore::AudioDestinationNode::close):
        * Modules/webaudio/DefaultAudioDestinationNode.cpp:
        (WebCore::DefaultAudioDestinationNode::resume):
        (WebCore::DefaultAudioDestinationNode::suspend):
        (WebCore::DefaultAudioDestinationNode::close):
        * Modules/webaudio/DefaultAudioDestinationNode.h:
        * dom/ActiveDOMCallbackMicrotask.cpp:
        (WebCore::ActiveDOMCallbackMicrotask::ActiveDOMCallbackMicrotask):
        * dom/ActiveDOMCallbackMicrotask.h:
        * dom/ScriptExecutionContext.h:
        (WebCore::ScriptExecutionContext::Task::Task):
        * fileapi/AsyncFileStream.cpp:
        (WebCore::callOnFileThread):
        (WebCore::AsyncFileStream::perform):
        * fileapi/AsyncFileStream.h:
        * page/FrameView.cpp:
        (WebCore::FrameView::queuePostLayoutCallback):
        (WebCore::FrameView::flushPostLayoutTasksQueue):
        * page/FrameView.h:
        * page/scrolling/ScrollingThread.cpp:
        (WebCore::ScrollingThread::dispatch):
        (WebCore::ScrollingThread::dispatchBarrier):
        (WebCore::ScrollingThread::dispatchFunctionsFromScrollingThread):
        * page/scrolling/ScrollingThread.h:
        * platform/GenericTaskQueue.cpp:
        (WebCore::TaskDispatcher<Timer>::postTask):
        * platform/GenericTaskQueue.h:
        (WebCore::TaskDispatcher::postTask):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::scheduleDeferredTask):
        * platform/mediastream/MediaStreamPrivate.cpp:
        (WebCore::MediaStreamPrivate::scheduleDeferredTask):
        * platform/mediastream/MediaStreamPrivate.h:
        * platform/mediastream/mac/AVMediaCaptureSource.h:
        * platform/mediastream/mac/AVMediaCaptureSource.mm:
        (WebCore::AVMediaCaptureSource::scheduleDeferredTask):
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::postResolutionCallbackQueue):
        (WebCore::Style::queuePostResolutionCallback):
        * style/StyleTreeResolver.h:

2016-06-03  Ada Chan  <adachan@apple.com>

        REGRESSION(r201474): Subtitles are not resizing in other fullscreen modes
        https://bugs.webkit.org/show_bug.cgi?id=158355

        Reviewed by Eric Carlson.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::syncTextTrackBounds):
        Set the text track representation layer's frame based on the active video layer.

2016-06-03  Brady Eidson  <beidson@apple.com>

        Miscellaneous IDBBindingUtilities cleanup.
        https://bugs.webkit.org/show_bug.cgi?id=158353

        Reviewed by Tim Horton.

        No new tests (Straight refactor, yo).

        Starting with removing a single form of scriptValueToIDBKey(), and making the return value be
        Ref<IDBKey> instead of RefPtr<IDBKey>, update a whole bunch of code to understand that the ExecState
        is non-null and the resulting key is non-null.
        
        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::continueFunction):
        
        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::cmp):
        
        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::count):
        (WebCore::IDBIndex::get):
        (WebCore::IDBIndex::getKey):
        
        * Modules/indexeddb/IDBKey.cpp:
        (WebCore::IDBKey::compare):
        (WebCore::IDBKey::isLessThan):
        (WebCore::IDBKey::isEqual):
        * Modules/indexeddb/IDBKey.h:
        (WebCore::IDBKey::createMultiEntryArray):
        
        * Modules/indexeddb/IDBKeyRange.cpp:
        (WebCore::IDBKeyRange::only):
        (WebCore::IDBKeyRange::lowerBound):
        (WebCore::IDBKeyRange::upperBound):
        (WebCore::IDBKeyRange::bound):
        (WebCore::IDBKeyRange::isOnlyKey):
        
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::get):
        (WebCore::IDBObjectStore::modernDelete):
        (WebCore::IDBObjectStore::count):
        
        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::get):
        (WebCore::set):
        (WebCore::createIDBKeyFromValue):
        (WebCore::getNthValueOnKeyPath):
        (WebCore::internalCreateIDBKeyFromScriptValueAndKeyPath):
        (WebCore::ensureNthValueOnKeyPath):
        (WebCore::canInjectNthValueOnKeyPath):
        (WebCore::injectIDBKeyIntoScriptValue):
        (WebCore::maybeCreateIDBKeyFromScriptValueAndKeyPath):
        (WebCore::canInjectIDBKeyIntoScriptValue):
        (WebCore::deserializeIDBValueToJSValue):
        (WebCore::scriptValueToIDBKey):
        (WebCore::createKeyPathArray):
        * bindings/js/IDBBindingUtilities.h:

2016-06-03  Benjamin Poulain  <benjamin@webkit.org>

        Rename CheckedRadioButtons into RadioButtonGroups
        https://bugs.webkit.org/show_bug.cgi?id=158326

        Reviewed by Alex Christensen.

        CheckedRadioButtons handles the set of all the Radio Button Groups
        for a particular form or document.
        The name is wrong and apparently comes from former uses of this class
        (see the comment above the class declaration).

        This patch renames "CheckedRadioButtons" to "RadioButtonGroups" to reflect that it handles
        all the Radio Button Group from a given context (form or document).
        Internally it has a set of RadioButtonGroup but that is never explicitely
        exposed.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/CheckedRadioButtons.cpp:
        (WebCore::RadioButtonGroup::isEmpty): Deleted.
        (WebCore::RadioButtonGroup::isRequired): Deleted.
        (WebCore::RadioButtonGroup::checkedButton): Deleted.
        (WebCore::RadioButtonGroup::RadioButtonGroup): Deleted.
        (WebCore::RadioButtonGroup::isValid): Deleted.
        (WebCore::RadioButtonGroup::members): Deleted.
        (WebCore::RadioButtonGroup::setCheckedButton): Deleted.
        (WebCore::RadioButtonGroup::add): Deleted.
        (WebCore::RadioButtonGroup::updateCheckedState): Deleted.
        (WebCore::RadioButtonGroup::requiredAttributeChanged): Deleted.
        (WebCore::RadioButtonGroup::remove): Deleted.
        (WebCore::RadioButtonGroup::updateValidityForAllButtons): Deleted.
        (WebCore::RadioButtonGroup::contains): Deleted.
        (WebCore::CheckedRadioButtons::CheckedRadioButtons): Deleted.
        (WebCore::CheckedRadioButtons::~CheckedRadioButtons): Deleted.
        (WebCore::CheckedRadioButtons::addButton): Deleted.
        (WebCore::CheckedRadioButtons::groupMembers): Deleted.
        (WebCore::CheckedRadioButtons::updateCheckedState): Deleted.
        (WebCore::CheckedRadioButtons::requiredAttributeChanged): Deleted.
        (WebCore::CheckedRadioButtons::checkedButtonForGroup): Deleted.
        (WebCore::CheckedRadioButtons::isInRequiredGroup): Deleted.
        (WebCore::CheckedRadioButtons::removeButton): Deleted.
        * dom/RadioButtonGroups.cpp: Renamed from Source/WebCore/dom/CheckedRadioButtons.cpp.
        (WebCore::RadioButtonGroup::isEmpty):
        (WebCore::RadioButtonGroup::isRequired):
        (WebCore::RadioButtonGroup::checkedButton):
        (WebCore::RadioButtonGroup::RadioButtonGroup):
        (WebCore::RadioButtonGroup::isValid):
        (WebCore::RadioButtonGroup::members):
        (WebCore::RadioButtonGroup::setCheckedButton):
        (WebCore::RadioButtonGroup::add):
        (WebCore::RadioButtonGroup::updateCheckedState):
        (WebCore::RadioButtonGroup::requiredAttributeChanged):
        (WebCore::RadioButtonGroup::remove):
        (WebCore::RadioButtonGroup::updateValidityForAllButtons):
        (WebCore::RadioButtonGroup::contains):
        (WebCore::RadioButtonGroups::RadioButtonGroups):
        (WebCore::RadioButtonGroups::~RadioButtonGroups):
        (WebCore::RadioButtonGroups::addButton):
        (WebCore::RadioButtonGroups::groupMembers):
        (WebCore::RadioButtonGroups::updateCheckedState):
        (WebCore::RadioButtonGroups::requiredAttributeChanged):
        (WebCore::RadioButtonGroups::checkedButtonForGroup):
        (WebCore::RadioButtonGroups::isInRequiredGroup):
        (WebCore::RadioButtonGroups::removeButton):
        * dom/RadioButtonGroups.h: Renamed from Source/WebCore/dom/CheckedRadioButtons.h.
        * html/FormController.h:
        (WebCore::FormController::radioButtonGroups):
        (WebCore::FormController::checkedRadioButtons): Deleted.
        * html/HTMLFormElement.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::~HTMLInputElement):
        (WebCore::HTMLInputElement::setChecked):
        (WebCore::HTMLInputElement::didMoveToNewDocument):
        (WebCore::HTMLInputElement::requiredAttributeChanged):
        (WebCore::HTMLInputElement::isInRequiredRadioButtonGroup):
        (WebCore::HTMLInputElement::radioButtonGroup):
        (WebCore::HTMLInputElement::checkedRadioButtonForGroup):
        (WebCore::HTMLInputElement::radioButtonGroups):
        (WebCore::HTMLInputElement::addToRadioButtonGroup):
        (WebCore::HTMLInputElement::removeFromRadioButtonGroup):
        (WebCore::HTMLInputElement::checkedRadioButtons): Deleted.
        * html/HTMLInputElement.h:

2016-06-03  Chris Dumez  <cdumez@apple.com>

        Unreviewed, roll out r196633 as it broke PageCache on iOS for WebKit.org
        <rdar://problem/26521101>

        * dom/Document.cpp:
        (WebCore::Document::setInPageCache): Deleted.
        * history/CachedPage.cpp:
        (WebCore::CachedPage::restore):
        (WebCore::CachedPage::clear):
        * history/CachedPage.h:
        (WebCore::CachedPage::markForVisitedLinkStyleRecalc):
        (WebCore::CachedPage::markForFullStyleRecalc):
        * history/PageCache.cpp:
        (WebCore::PageCache::markPagesForVisitedLinkStyleRecalc):
        (WebCore::PageCache::markPagesForFullStyleRecalc):
        * history/PageCache.h:
        * page/Frame.cpp:
        (WebCore::Frame::setPageAndTextZoomFactors):
        * page/Page.cpp:
        (WebCore::Page::setViewScaleFactor):
        (WebCore::Page::setDeviceScaleFactor):
        (WebCore::Page::setPagination):
        (WebCore::Page::setPaginationLineGridEnabled):
        (WebCore::Page::setVisitedLinkStore):

2016-06-03  Antoine Quint  <graouts@apple.com>

        Reflection of element does not respect backdrop-filter property
        https://bugs.webkit.org/show_bug.cgi?id=158201

        Reviewed by Dean Jackson.

        We weren't cloning the PlatformCALayer for the backdrop so reflections would simply
        not show their backdrops. We now follow the same pattern as other PlatformCALayers
        owned by a GraphicsLayerCA and keep a list of backdrop layer clones that we add
        to the structural layer when cloning to match the layer order of the original
        and update the backdrop layer clone properties to match the original when the
        backdrop filters or rectangle changes.

        Tests: css3/filters/backdrop/backdrop-filter-with-reflection-add-backdrop.html
               css3/filters/backdrop/backdrop-filter-with-reflection-remove-backdrop.html
               css3/filters/backdrop/backdrop-filter-with-reflection-value-change.html
               css3/filters/backdrop/backdrop-filter-with-reflection.html

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::updateBackdropFilters):
        (WebCore::GraphicsLayerCA::updateBackdropFiltersRect):
        Update backdrop layer clones to match new values set when the backdrop filter
        configuration changes.

        (WebCore::GraphicsLayerCA::ensureCloneLayers):
        Create the backdrop layer clones map if needed and clone the existing backdrop layer.

        (WebCore::GraphicsLayerCA::clearClones):
        Clear the backdrop layer clones map.

        (WebCore::GraphicsLayerCA::fetchCloneLayers):
        Obtain a clone for the backdrop layer, and if we have a valid clone, add it to the
        structural layer clone as its first child to match the operation in updateSublayerList().

        * platform/graphics/ca/GraphicsLayerCA.h:
        Modify the signature for ensureCloneLayers() to account for the new backdrop layer clone and
        declare the backdrop layer clone map.

        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (PlatformCALayerCocoa::clone):
        Reflect the backdrop layer type when cloning a PlatformCALayer.

2016-06-03  Brady Eidson  <beidson@apple.com>

        ResourceResponseBase cleanup.
        https://bugs.webkit.org/show_bug.cgi?id=158348

        Reviewed by Chris Dumez.

        No new tests (Refactor, no behavior change).

        CrossThreadData can be noncopyable and WTFMove()'ed around, instead of 
        being in a unique_ptr.
        
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::crossThreadData):
        (WebCore::ResourceResponseBase::fromCrossThreadData):
        * platform/network/ResourceResponseBase.h:

2016-06-03  Antoine Quint  <graouts@apple.com>

        REGRESSION: WebGL doesn't show up in CSS reflections
        https://bugs.webkit.org/show_bug.cgi?id=76489

        Reviewed by Dean Jackson.

        The WebGLLayer needs to notify its owning GraphicsLayer that it was displayed
        such that its clones, in GraphicsLayerCA::layerDidDisplay, may have their contents
        updated to match that layer's contents. The test at compositing/webgl/webgl-reflection.html
        already covers this test and its expectation on Mac has been updated.

        * platform/graphics/mac/WebGLLayer.mm:
        (-[WebGLLayer display]):

2016-06-02  Gavin Barraclough  <barraclough@apple.com>

        Refactor showModalDialog handling in JSDOMWindowCustom
        https://bugs.webkit.org/show_bug.cgi?id=158294

        Reviewed by Ryosuke Niwa.

        The showModalDialog property is currently implemented in a way that  effectively
        results in duplication of the tail of the function, but modified to call
        Base::getOwnPropertySlot instead of getStaticPropertySlot. It does so based on the
        assumption that Base::getOwnPropertySlot is not going to search the static tables
        (containing the property we wish to omit).

        However as a part of bug #158178 I plan to change it such that Base::getOwnPropertySlot
        does also search the static tables. So, refactoring this code to no longer depend on
        using a function that bypasses the static tables. Always perform a lookup that will
        check both property storage & static tables. If the object does contain the property,
        then check explicitly for the value we're intending to suppress.

        Covered by exsiting tests.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::getOwnPropertySlot):
            - Check result of getStaticPropertySlot for showModalDialog function.

2016-06-02  Brady Eidson  <beidson@apple.com>

        Fix AtomicString regression caused by r201603.
        https://bugs.webkit.org/show_bug.cgi?id=158338

        Reviewed by Chris Dumez.

        No new tests (Refactor, plus already caught by existing test configs).

        * loader/WorkerThreadableLoader.cpp:
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveResponse):
        
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::crossThreadData): Re-introduce the cross thread data concept,
          but more modern and clean this time.
        (WebCore::ResourceResponseBase::fromCrossThreadData):
        (WebCore::ResourceResponseBase::isolatedCopy): Deleted.
        * platform/network/ResourceResponseBase.h:

2016-06-02  Chris Dumez  <cdumez@apple.com>

        Drop BlobRegistryContext class as it is no longer needed
        https://bugs.webkit.org/show_bug.cgi?id=158328

        Reviewed by Brady Eidson.

        Drop BlobRegistryContext class as it is no longer needed. We can now
        call isolatedCopy() as we capture in the lambda.

        * fileapi/ThreadableBlobRegistry.cpp:
        (WebCore::ThreadableBlobRegistry::registerFileBlobURL):
        (WebCore::ThreadableBlobRegistry::registerBlobURL):
        (WebCore::ThreadableBlobRegistry::registerBlobURLForSlice):
        (WebCore::ThreadableBlobRegistry::blobSize):
        (WebCore::ThreadableBlobRegistry::unregisterBlobURL):
        (WebCore::BlobRegistryContext::BlobRegistryContext): Deleted.

2016-06-02  Zalan Bujtas  <zalan@apple.com>

        Repaint issue with vertical text in an out of flow container.
        https://bugs.webkit.org/show_bug.cgi?id=102665
        <rdar://problem/26605298>

        Reviewed by David Hyatt.

        Since the renderer’s offset for positioned objects is always physical, we only
        need to flip the repaint rect(always logical) for writing root, when we see the first positioned object.
        All subsequent writing root changes for positioned objects are okay and they don't need flipping.

        Test: fast/repaint/vertical-text-repaint.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeRectForRepaint):
        * rendering/RenderBox.h:
        (WebCore::RenderBox::computeRectForRepaint):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::computeRectForRepaint):
        * rendering/RenderInline.h:
        (WebCore::RenderInline::computeRectForRepaint):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::computeRectForRepaint):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::computeAbsoluteRepaintRect):
        (WebCore::RenderObject::computeRectForRepaint):
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::computeRectForRepaint):
        * rendering/RenderTableCell.h:
        * rendering/RenderView.cpp:
        (WebCore::RenderView::computeRectForRepaint):
        * rendering/RenderView.h:
        * rendering/svg/RenderSVGForeignObject.cpp:
        (WebCore::RenderSVGForeignObject::computeRectForRepaint):
        * rendering/svg/RenderSVGForeignObject.h:
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::computeFloatRectForRepaint):
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::computeRectForRepaint):
        * rendering/svg/RenderSVGText.h:

2016-06-02  Anders Carlsson  <andersca@apple.com>

        Fix build
        https://bugs.webkit.org/show_bug.cgi?id=158337
        rdar://problem/26429419

        Reviewed by Dan Bernstein.

        * WebCore.xcodeproj/project.pbxproj:
        Add QTKitSPI.h header.

        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        * platform/graphics/mac/MediaTimeQTKit.h:
        * platform/graphics/mac/MediaTimeQTKit.mm:
        * platform/mac/WebVideoFullscreenController.mm:
        Include QTKitSPI.h.

        * platform/spi/cocoa/QuartzCoreSPI.h:
        * platform/spi/mac/AVFoundationSPI.h:
        Use MAX_ALLOWED instead of MIN_REQUIRED.

        * platform/spi/mac/QTKitSPI.h:
        Add new QTKit header.

2016-06-02  Said Abou-Hallawa  <sabouhallawa@apple,com>

        [iOS] PDFDocumentImage should not create a cached image larger than 4M pixels
        https://bugs.webkit.org/show_bug.cgi?id=157857

        Reviewed by Darin Adler.

        On iOS, if the scaled size of the PDFDocumentImage cached image will exceed
        the 4M pixels limit and the system physical memory is 1GB or less, do not
        create it. PDFDocumentImage::draw() falls back peacefully if the cached image
        couldn't be created for any reason. The PDF will be drawn directly to the
        GraphicsContext without having to go through the cached image. This means
        the whole PDF will be drawn multiple times; one time for each tile. I think
        this is okay for zooming a large PDFDocumentImage on a low end device.
        
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::drawTextInternal): Call the static function
        ImageBuffer::createCompatibleBuffer() without having to go through the GraphicsContext.
        
        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::drawPattern): Ditto.
        
        * platform/graphics/FloatSize.h:
        (WebCore::FloatSize::area): A helper function similar to IntSize::area().
        (WebCore::operator*): Scale a FloatSize by another FloatSize and return the result.
        
        * platform/graphics/GradientImage.cpp:
        (WebCore::GradientImage::drawPattern): Call ImageBuffer::createCompatibleBuffer().
        
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::scaleFactor):: Return the scaling part of the current CTM.
        (WebCore::scalesMatch): Deleted.
        (WebCore::GraphicsContext::createCompatibleBuffer): Deleted.
        (WebCore::GraphicsContext::isCompatibleWithBuffer): Deleted.
        * platform/graphics/GraphicsContext.h:
        Move these image buffer functions to ImageBuffer.
        
        * platform/graphics/ImageBuffer.cpp:
        (WebCore::ImageBuffer::createCompatibleBuffer): Make createCompatibleBuffer
        a static function of the ImageBuffer. There is no need to go through the
        GraphicsContext just to get the GraphicsContext scaleFactor.
        
        (WebCore::ImageBuffer::compatibleBufferSize):  Scale the size of the cachedImage
        by the scaleFactor of the context.
        
        (WebCore::ImageBuffer::isCompatibleWithContext): Returns true if the drawing
        context and the ImageBuffer context have the same scaleFactor.
        
        * platform/graphics/ImageBuffer.h:
        
        * platform/graphics/NamedImageGeneratedImage.cpp:
        (WebCore::NamedImageGeneratedImage::drawPattern): Call ImageBuffer::createCompatibleBuffer().
        
        * platform/graphics/cg/PDFDocumentImage.cpp:
        (WebCore::PDFDocumentImage::updateCachedImageIfNeeded): On iOS, if the
        physical memory is less than 1GB, do not allocate more than 16MB for the
        PDF cachedImage.
        
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Call ImageBuffer::createCompatibleBuffer().
        * rendering/svg/SVGRenderingContext.cpp:
        (WebCore::SVGRenderingContext::bufferForeground): Ditto.

2016-06-02  Chris Dumez  <cdumez@apple.com>

        [WebIDL] 'undefined' should be an acceptable value for nullable parameters
        https://bugs.webkit.org/show_bug.cgi?id=158321

        Reviewed by Ryosuke Niwa.

        'undefined' should be an acceptable value for nullable parameters (and
        should be converted to null):
        - https://heycam.github.io/webidl/#es-nullable-type

        Our bindings got most of the cases right but there was a bug in our
        overload resolution code. This patch fixes it.

        No new tests, already covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheckExpression):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter):

2016-06-02  Brady Eidson  <beidson@apple.com>

        Modernize how many platform/network classes do isolatedCopy().
        https://bugs.webkit.org/show_bug.cgi?id=158313

        Reviewed by Alex Christensen.

        No new tests (Refactor, no behavior change).

        * loader/WorkerThreadableLoader.h:
        
        * platform/network/FormData.cpp:
        (WebCore::FormData::isolatedCopy):
        (WebCore::FormDataElement::isolatedCopy):
        (WebCore::FormData::FormData): Deleted.
        (WebCore::FormData::deepCopy): Deleted.
        * platform/network/FormData.h:
        
        * platform/network/HTTPHeaderMap.cpp:
        (WebCore::HTTPHeaderMap::isolatedCopy):
        (WebCore::HTTPHeaderMap::copyData): Deleted.
        (WebCore::HTTPHeaderMap::adopt): Deleted.
        * platform/network/HTTPHeaderMap.h:
        
        * platform/network/ResourceErrorBase.cpp:
        (WebCore::ResourceErrorBase::asResourceError):
        (WebCore::ResourceErrorBase::isolatedCopy):
        * platform/network/ResourceErrorBase.h:
        (WebCore::ResourceErrorBase::platformCopy): Deleted.

        * platform/network/ResourceLoadTiming.h:
        (WebCore::ResourceLoadTiming::isolatedCopy): Not strictly needed for now, but makes it obvious
          that changes will be needed if new members are added later.

        * platform/network/ResourceRequestBase.cpp:
        (WebCore::ResourceRequestBase::isolatedCopy):
        (WebCore::ResourceRequestBase::setAsIsolatedCopy):
        (WebCore::ResourceRequestBase::copyData): Deleted.
        * platform/network/ResourceRequestBase.h:
        
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::isolatedCopy):
        (WebCore::ResourceResponseBase::copyData): Deleted.
        * platform/network/ResourceResponseBase.h:
        (WebCore::CrossThreadResourceResponseDataBase::CrossThreadResourceResponseDataBase): Deleted.
        
        * platform/network/cf/ResourceError.h:
        * platform/network/cf/ResourceErrorCF.cpp:
        (WebCore::ResourceError::doPlatformIsolatedCopy):
        (WebCore::ResourceError::platformCopy): Deleted.
        
        * platform/network/cf/ResourceRequest.h:
        * platform/network/cf/ResourceRequestCFNet.cpp:
        (WebCore::ResourceRequest::doPlatformSetAsIsolatedCopy):
        (WebCore::ResourceRequest::doPlatformCopyData): Deleted.
        (WebCore::ResourceRequest::doPlatformAdopt): Deleted.
        
        * platform/network/cf/ResourceResponse.h:
        (WebCore::ResourceResponse::doPlatformCopyData): Deleted.
        (WebCore::ResourceResponse::doPlatformAdopt): Deleted.
        
        * platform/network/curl/ResourceError.h:
        (WebCore::ResourceError::doPlatformIsolatedCopy):
        
        * platform/network/curl/ResourceRequest.h:
        (WebCore::ResourceRequest::doPlatformSetAsIsolatedCopy):
        (WebCore::ResourceRequest::doPlatformCopyData): Deleted.
        (WebCore::ResourceRequest::doPlatformAdopt): Deleted.
        
        * platform/network/curl/ResourceResponse.h:
        (WebCore::ResourceResponse::doPlatformCopyData): Deleted.
        (WebCore::ResourceResponse::doPlatformAdopt): Deleted.
        
        * platform/network/mac/ResourceErrorMac.mm:
        (WebCore::ResourceError::doPlatformIsolatedCopy):
        
        * platform/network/soup/ResourceError.h:
        * platform/network/soup/ResourceErrorSoup.cpp:
        (WebCore::ResourceError::doPlatformIsolatedCopy):
        (WebCore::ResourceError::platformCopy): Deleted.
        
        * platform/network/soup/ResourceRequest.h:
        (WebCore::ResourceRequest::doPlatformSetAsIsolatedCopy):
        (WebCore::ResourceRequest::doPlatformCopyData): Deleted.
        (WebCore::ResourceRequest::doPlatformAdopt): Deleted.
        
        * platform/network/soup/ResourceResponse.h:
        (WebCore::ResourceResponse::doPlatformCopyData): Deleted.
        (WebCore::ResourceResponse::doPlatformAdopt): Deleted.

2016-06-02  Chris Dumez  <cdumez@apple.com>

        Crash under CachedResource::addClientToSet()
        https://bugs.webkit.org/show_bug.cgi?id=158310
        <rdar://problem/23643359>

        Reviewed by Eric Carlson.

        Only call CachedResource::addClient() on the resource returned
        by CachedResourceLoader::requestMedia() if the resource is
        non-null. CachedResourceLoader::requestMedia() can return null
        in some cases so we need to handle this properly.

        No new tests, no known reproduction case.

        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::startLoading):

2016-06-02  Chris Dumez  <cdumez@apple.com>

        ScriptExecutionContext::Task constructor should take a NoncopyableFunction<void ()> as parameter
        https://bugs.webkit.org/show_bug.cgi?id=158309

        Reviewed by Brady Eidson.

        ScriptExecutionContext::Task constructor should take a NoncopyableFunction<void ()>
        as parameter for consistency with the other constructor and because this can be
        called cross-thread.

        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::suspend):
        (WebCore::AudioContext::resume):
        (WebCore::AudioContext::close):
        (WebCore::AudioContext::suspendPlayback):
        (WebCore::AudioContext::mayResumePlayback):
        * Modules/webaudio/AudioDestinationNode.h:
        (WebCore::AudioDestinationNode::resume):
        (WebCore::AudioDestinationNode::suspend):
        (WebCore::AudioDestinationNode::close):
        * Modules/webaudio/DefaultAudioDestinationNode.cpp:
        (WebCore::DefaultAudioDestinationNode::resume):
        (WebCore::DefaultAudioDestinationNode::suspend):
        (WebCore::DefaultAudioDestinationNode::close):
        * Modules/webaudio/DefaultAudioDestinationNode.h:
        * dom/ScriptExecutionContext.h:
        (WebCore::ScriptExecutionContext::Task::Task):

2016-06-02  Darin Adler  <darin@apple.com>

        Fix a couple of mistakes in CSSParserValue memory management
        https://bugs.webkit.org/show_bug.cgi?id=158307
        <rdar://problem/26127225>

        Reviewed by Daniel Bates.

        * css/CSSGrammar.y.in: Added a destructor for calc_func_term. This presumably
        fixes some memory leaks in error cases. Removed an assertion about not needing
        a call to destroy that was far too limited. Tweaked formatting of the percentage
        ase in the key production. Indented calc_func_term to make it consistent with
        other productions nearby.

        * css/CSSParserValues.cpp:
        (WebCore::CSSParserValueList::~CSSParserValueList): Use a modern for loop.
        (WebCore::CSSParserValueList::deleteValueAt): Deleted. Unused function, and also
        would have resulted in a memory leak unless the code already extracted the value
        from the list.
        (WebCore::CSSParserValueList::extend): Properly transfer ownership from one value
        list to the other by setting the unit to 0 in the donor.

        * css/CSSParserValues.h: Removed unused deleteValueAt function.

2016-06-02  Said Abou-Hallawa  <sabouhallawa@apple.com>

        SVG content renders in incorrect vertical position when padding-left is not specified
        https://bugs.webkit.org/show_bug.cgi?id=158234

        Reviewed by Darin Adler.

        Fix the optimization in RenderSVGRoot::buildLocalToBorderBoxTransform().
        Use LayoutSize::isZero() instead of LayoutSize::isEmpty() to decide whether
        there is borderAndPadding applied or not.

        Test: svg/custom/svg-root-padding-individual.html

        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::buildLocalToBorderBoxTransform):

2016-06-02  Brady Eidson  <beidson@apple.com>

        Overhaul cross-thread use of ResourceRequest, ResourceResponse, and ResourceError.
        https://bugs.webkit.org/show_bug.cgi?id=158293

        Reviewed by Darin Adler.

        No new tests (Refactor, no behavior change).

        * loader/WorkerThreadableLoader.cpp:
        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveResponse):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFail):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFailAccessControlCheck):

        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::removeRequestFromSessionCaches):

        * platform/network/ResourceErrorBase.cpp:
        (WebCore::ResourceErrorBase::isolatedCopy):
        (WebCore::ResourceErrorBase::copy): Deleted.
        * platform/network/ResourceErrorBase.h:

        * platform/network/ResourceRequestBase.cpp:
        (WebCore::ResourceRequestBase::isolatedCopy):
        (WebCore::ResourceRequestBase::setAsIsolatedCopy):
        (WebCore::ResourceRequestBase::adopt): Deleted.
        
        Made copyData private, and made "adopt" be "isolatedCopy".
        Rest of the changes are all re-indenting the file.
        * platform/network/ResourceRequestBase.h:
        (WebCore::ResourceRequestBase::responseContentDispositionEncodingFallbackArray):
        (WebCore::ResourceRequestBase::reportUploadProgress):
        (WebCore::ResourceRequestBase::setReportUploadProgress):
        (WebCore::ResourceRequestBase::reportLoadTiming):
        (WebCore::ResourceRequestBase::setReportLoadTiming):
        (WebCore::ResourceRequestBase::reportRawHeaders):
        (WebCore::ResourceRequestBase::setReportRawHeaders):
        (WebCore::ResourceRequestBase::hiddenFromInspector):
        (WebCore::ResourceRequestBase::setHiddenFromInspector):
        (WebCore::ResourceRequestBase::requester):
        (WebCore::ResourceRequestBase::setRequester):
        (WebCore::ResourceRequestBase::encodingRequiresPlatformData):
        (WebCore::ResourceRequestBase::ResourceRequestBase):
        (WebCore::ResourceRequestBase::platformCompare):
        (WebCore::operator==):
        (WebCore::operator!=):

        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::isolatedCopy):
        (WebCore::ResourceResponseBase::adopt): Deleted.
        * platform/network/ResourceResponseBase.h:

        * platform/network/cf/ResourceError.h:
        (WebCore::ResourceError::isolatedCopy): Deleted.

        Removed platform-specific isolatedCopy, and re-indented the header:
        * platform/network/cf/ResourceRequest.h:
        (WebCore::ResourceRequest::ResourceRequest):
        (WebCore::ResourceRequest::encodingRequiresPlatformData):
        (WebCore::ResourceRequest::cachePartition):
        (WebCore::ResourceRequest::setCachePartition):
        (WebCore::ResourceRequest::setDomainForCachePartition):
        (WebCore::ResourceRequest::resourcePrioritiesEnabled):
        (WebCore::ResourceRequest::isolatedCopy): Deleted.

        * platform/network/cf/ResourceResponse.h:
        (WebCore::ResourceResponse::isolatedCopy): Deleted.

2016-06-02  Chris Dumez  <cdumez@apple.com>

        Modernize various lambda captures
        https://bugs.webkit.org/show_bug.cgi?id=158292

        Reviewed by Brady Eidson.

        Modernize various lambda captures, especially the ones unnecessarily
        allocating objects on the heap and destroying them in the lambda.

        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
        (WebCore::ThreadableWebSocketChannelClientWrapper::didConnect):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessage):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveBinaryData):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didUpdateBufferedAmount):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didStartClosingHandshake):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didClose):
        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveMessageError):
        (WebCore::ThreadableWebSocketChannelClientWrapper::processPendingTasks):
        (WebCore::ThreadableWebSocketChannelClientWrapper::resume): Deleted.
        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::disconnect):
        * bindings/js/JSCallbackData.h:
        (WebCore::DeleteCallbackDataTask::DeleteCallbackDataTask):
        * loader/WorkerThreadableLoader.cpp:
        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::destroy):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didSendData):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveResponse):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveData):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFinishLoading):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFail):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFailAccessControlCheck):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::cancel): Deleted.

2016-06-02  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Update RTCPeerConnection.addTrack() to create (or reuse) an RTCRtpTransceiver
        https://bugs.webkit.org/show_bug.cgi?id=158191

        Reviewed by Eric Carlson.

        Update RTCPeerConnection.addTrack to create an RTCRtpTranscevier, or reuse an existing
        transceiver that has not been used to send [1].

        A new RtpTransceiverSet type is added that wraps a vector of RTCRtpTransceiver objects
        and internally maintains two lists for efficient access to RTCRtpSender and RTCRtpReceiver
        objects.

        [1] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html#dom-rtcpeerconnection-addtrack

        Updated existing test: fast/mediastream/RTCPeerConnection-add-removeTrack.html

        * Modules/mediastream/PeerConnectionBackend.h:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::addTrack):
        (WebCore::RTCPeerConnection::removeTrack):
        (WebCore::RTCPeerConnection::completeAddTransceiver):
        (WebCore::RTCPeerConnection::close):
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/mediastream/RTCRtpTransceiver.cpp:
        (WebCore::RtpTransceiverSet::append):
        * Modules/mediastream/RTCRtpTransceiver.h:
        (WebCore::RtpTransceiverSet::list):
        (WebCore::RtpTransceiverSet::getSenders):
        (WebCore::RtpTransceiverSet::getReceivers):

2016-06-02  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Use more references in ResourceLoader related code
        https://bugs.webkit.org/show_bug.cgi?id=158222

        Reviewed by Darin Adler.

        No change of behavior.

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::load):
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::clearDocument):
        (WebCore::CSSFontSelector::beginLoadingFontSoon):
        (WebCore::CSSFontSelector::beginLoadTimerFired):
        * css/CSSFontSelector.h:
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::scheduleArchiveLoad):
        * loader/DocumentLoader.h:
        * loader/LoaderStrategy.h:
        * loader/NetscapePlugInStreamLoader.cpp:
        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader):
        (WebCore::NetscapePlugInStreamLoader::create):
        * loader/NetscapePlugInStreamLoader.h:
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::ResourceLoader):
        (WebCore::ResourceLoader::start):
        * loader/ResourceLoader.h:
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::RequestCountTracker::RequestCountTracker):
        (WebCore::SubresourceLoader::SubresourceLoader):
        (WebCore::SubresourceLoader::create):
        (WebCore::SubresourceLoader::didReceiveResponse):
        (WebCore::SubresourceLoader::notifyDone):
        * loader/SubresourceLoader.h:
        * loader/appcache/ApplicationCacheHost.cpp:
        (WebCore::ApplicationCacheHost::maybeLoadResource):
        * loader/appcache/ApplicationCacheHost.h:
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::load):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::incrementRequestCount):
        (WebCore::CachedResourceLoader::decrementRequestCount):
        * loader/cache/CachedResourceLoader.h:

2016-06-02  Carlos Garcia Campos  <cgarcia@igalia.com>

        [Wayland] PlatformDisplayWayland destructor is super crashy
        https://bugs.webkit.org/show_bug.cgi?id=157973

        Reviewed by Michael Catanzaro.

        EGL registers two at exist callbacks one to finish the display and another one to unload drivers, the one to
        finish the display happens first. When our destructor is called the _eglFiniDisplay callback has already been
        called, so we have a valid pointer for an already finished display. Then eglTerminate tries to find the display
        in the global display list, but fails and for some reason it crashes when trying to return an error.
        If atexit is called after the global PlatformDisplay constructor, the atexit handler is called before the
        destructor. The atexit callbacks are called in reverse order, so if we register an atexit handler after the
        global instace has been created and after EGL has been initialized, we could terminate the EGL display before
        the EGL atexit handlers and the global PlatformDisplay destructor.

        * platform/graphics/PlatformDisplay.cpp:
        (WebCore::PlatformDisplay::initializeEGLDisplay):

2016-06-01  Brady Eidson  <beidson@apple.com>

        Get rid of StringCapture.
        https://bugs.webkit.org/show_bug.cgi?id=158285

        Reviewed by Chris Dumez.

        No new tests (Refactor, no behavior change).

        * dom/Document.cpp:
        (WebCore::Document::addConsoleMessage):
        (WebCore::Document::addMessage):
        
        * dom/ScriptExecutionContext.h:
        (WebCore::ScriptExecutionContext::AddConsoleMessageTask::AddConsoleMessageTask):
        
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::installContentFilterUnblockHandler):
        
        * loader/WorkerThreadableLoader.cpp:
        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
        
        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        (WebVideoFullscreenControllerContext::setExternalPlayback):
        
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::addConsoleMessage):
        (WebCore::WorkerGlobalScope::addMessage):
        
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::postExceptionToWorkerObject):
        (WebCore::WorkerMessagingProxy::postConsoleMessageToWorkerObject):

2016-05-31  Darin Adler  <darin@apple.com>

        Audit RenderObject casts and fix problems and style issues found
        https://bugs.webkit.org/show_bug.cgi?id=158221

        Reviewed by Chris Dumez.

        * bindings/objc/DOM.mm:
        (-[DOMElement image]): Use auto to get more specific types in code getting
        the renderer for an element instead of dumbing down the type to RenderObject.

        * dom/Element.cpp:
        (WebCore::Element::scrollByUnits): Call renderer only once. The comment in
        Node advises we should do this since it has a branch in it.
        (WebCore::Element::absoluteEventBounds): Call renderer only once. Also use
        auto for a rect type to clarify that we are not changing the type of the
        rect returned by the fucntion.
        (WebCore::Element::webkitGetRegionFlowRanges): Call renderer only once.

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::addBlockPlaceholderIfNeeded): Use auto
        to get a mroe specific renderer type.

        * editing/SimplifyMarkupCommand.cpp:
        (WebCore::SimplifyMarkupCommand::doApply): Call renderer only once.

        * editing/cocoa/HTMLConverter.mm:
        (HTMLConverter::_addAttachmentForElement): Add an obviously missing
        null check for something that is null checked elsewhere.
        (fileWrapperForURL): Ditto.
        (fileWrapperForElement): Changed argument type to HTMLImageElement& since
        the call site already checks the type of the object. Use HTMLImageElement::src
        instead of repeating the code here. Check the type of the renderer instead of
        assuming it's a RenderImage.
        (WebCore::editingAttributedStringFromRange): Pass a reference, not a pointer.

        * html/HTMLAnchorElement.cpp:
        (WebCore::appendServerMapMousePosition): Take a reference to an event rather
        than a "known to be non-null" pointer. Call renderer only once. Round the
        floating point values rather than truncating them.
        (WebCore::HTMLAnchorElement::handleClick): Pass a reference.

        * html/HTMLAttachmentElement.cpp:
        (WebCore::HTMLAttachmentElement::setFile): Removed the now-unneeded cast since
        the renderer function returns a pointer of a more specific type now.
        (WebCore::HTMLAttachmentElement::parseAttribute): Ditto.
        (WebCore::HTMLAttachmentElement::attachmentTitle): Use auto& to avoid a bit of
        reference count churn.

        * html/HTMLAttachmentElement.h: Override renderer to return a more specific type.
        This follows the pattern that ContainerNode::renderer uses.

        * html/HTMLButtonElement.h: Ditto.

        * html/HTMLCanvasElement.cpp: Gave the constants at the top of the file more
        normal names. Removed unneeded "static" from them. Moved the
        defaultInterpolationQuality constant here from the header because it doesn't
        need to be there.
        (WebCore::HTMLCanvasElement::HTMLCanvasElement): Updated for name changes.
        (WebCore::HTMLCanvasElement::createElementRenderer): Removed unneeded code to
        set m_rendererIsCanvas to record renderer type; we can just check the type.
        (WebCore::HTMLCanvasElement::setHeight): Updated for name changes.
        (WebCore::HTMLCanvasElement::setWidth): Ditto.
        (WebCore::HTMLCanvasElement::reset): Check the type of the renderer directly
        instead of calling m_rendererIsCanvas. This helped make it clear we were
        do extra unneeded checks since a renderer can't both be a RenderCanvas and
        not be a RenderBox.
        (WebCore::HTMLCanvasElement::createImageBuffer): Updated for name changes.

        * html/HTMLCanvasElement.h: Moved DefaultInterpolationQuality into the cpp file.
        Use nullptr instead of 0. Removed m_rendererIsCanvas.

        * html/HTMLFieldSetElement.cpp:
        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement): Initialize m_documentVersion
        in the class definition.
        (WebCore::HTMLFieldSetElement::~HTMLFieldSetElement): Use m_hasDisabledAttribute.
        (WebCore::updateFromControlElementsAncestorDisabledStateUnder): Fixed typo.
        (WebCore::HTMLFieldSetElement::disabledAttributeChanged): Fixed mistake in this
        function that would cause the number of disabled fieldset elements to be too high
        if the disabled attribute's value was changed from one value to another. Use a
        boolean to track the old value; can't think of a solution that works without that.
        (WebCore::HTMLFieldSetElement::childrenChanged): Fixed typo.
        (WebCore::HTMLFieldSetElement::didMoveToNewDocument): Use m_hasDisabledAttribute.
        (WebCore::HTMLFieldSetElement::updateAssociatedElements): Changed name to make it
        clearer what this function does. Tweaked a bit without changing behavior.
        (WebCore::HTMLFieldSetElement::associatedElements): Updated for name change.
        (WebCore::HTMLFieldSetElement::length): Changed to call associatedElements instead of
        repeating that it does.

        * html/HTMLFieldSetElement.h: Override renderer to return a more specific type.
        Also updated for other changes mentioned above.

        * html/HTMLFrameElement.cpp:
        (WebCore::HTMLFrameElement::HTMLFrameElement): Initialize booleans in the class
        definition rather than doing it here.
        (WebCore::HTMLFrameElement::parseAttribute): Call renderer only once.

        * html/HTMLFrameElement.h: Override renderer to return a more specific type.
        Also initialize some booleans in the class definition.

        * html/HTMLIFrameElement.h: Override renderer to return a more specific type.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::updateRenderer): Added. Helper for a common idiom.
        (WebCore::HTMLMediaElement::didAttachRenderers): Use auto to get a more specific
        type for the renderer.
        (WebCore::HTMLMediaElement::willDetachRenderers): Call renderer only once.
        (WebCore::HTMLMediaElement::didRecalcStyle): Use updateRenderer to call renderer
        only once.
        (WebCore::HTMLMediaElement::loadResource): Ditto.
        (WebCore::HTMLMediaElement::waitForSourceChange): Ditto.
        (WebCore::HTMLMediaElement::noneSupported): Ditto.
        (WebCore::HTMLMediaElement::setReadyState): Ditto.
        (WebCore::HTMLMediaElement::progressEventTimerFired): Ditto.
        (WebCore::HTMLMediaElement::selectNextSourceChild): Renamed goto label to use a style
        that fits WebKit coding style. Call renderer only once in MediaQuery code.
        (WebCore::HTMLMediaElement::mediaPlayerRepaint): Call renderer only once.
        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged): Use updateRenderer to call
        renderer only once.
        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated): Call renderer
        only once.
        (WebCore::HTMLMediaElement::mediaPlayerGraphicsDeviceAdapter): Call page only once.
        (WebCore::HTMLMediaElement::mediaEngineWasUpdated): Use updateRenderer to call
        renderer only once.
        (WebCore::HTMLMediaElement::mediaPlayerCharacteristicChanged): Ditto.
        (WebCore::HTMLMediaElement::updatePlayState): Ditto.
        (WebCore::HTMLMediaElement::stopWithoutDestroyingMediaPlayer): Ditto.
        (WebCore::HTMLMediaElement::resume): Ditto.
        (WebCore::HTMLMediaElement::mediaPlayerContentBoxRect): Call renderer only once.
        (WebCore::mediaElementIsAllowedToAutoplay): Use auto to get a more specific type.

        * html/HTMLMediaElement.h: Removed conditionals around forward declarations.
        Tweaked formatting a bit. Added the updateRender function. Override renderer to
        return a more specific type.

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::optionElementChildrenChanged): Don't use the renderer
        just to get to the document for the AXObjectCache.
        (WebCore::HTMLSelectElement::setLength): Use auto for the list items vector.
        (WebCore::HTMLSelectElement::nextValidIndex): Ditto.
        (WebCore::HTMLSelectElement::firstSelectableListIndex): Ditto.
        (WebCore::HTMLSelectElement::nextSelectableListIndexPageAway): Ditto. Also add a
        null check for the renderer.
        (WebCore::HTMLSelectElement::updateListBoxSelection): Split an assertion with &&
        in it into two separate assertions. Use auto for the list items vector and use
        a reference for the list items.
        (WebCore::HTMLSelectElement::listBoxOnChange): Use auto for the list items vector
        and use a reference for the list items.
        (WebCore::HTMLSelectElement::setRecalcListItems): Don't use the renderer
        just to get to the document for the AXObjectCache.
        (WebCore::HTMLSelectElement::selectOption): Use auto for the list items vector.
        (WebCore::HTMLSelectElement::optionToListIndex): Ditto.
        (WebCore::HTMLSelectElement::listToOptionIndex): Ditto.
        (WebCore::HTMLSelectElement::searchOptionsForValue): Ditto.
        (WebCore::HTMLSelectElement::restoreFormControlState): Ditto.
        (WebCore::HTMLSelectElement::platformHandleKeydownEvent): Call renderer only once.
        (WebCore::HTMLSelectElement::menuListDefaultEventHandler): Split an assertion with
        && in it into two separate assertions. Use auto for the list items vector. Call
        renderer only once.
        (WebCore::HTMLSelectElement::updateSelectedState): Use a reference for the list
        item.
        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler): Use auto for the list
        items vvector. Call renderer less often; could not quite get it down to once.
        (WebCore::HTMLSelectElement::defaultEventHandler): Call renderer only once.
        (WebCore::HTMLSelectElement::lastSelectedListIndex): Use auto for the list items
        vector and use a reference for the list items.
        (WebCore::HTMLSelectElement::optionAtIndex): Use a reference for the list item.
        (WebCore::HTMLSelectElement::accessKeySetSelectedIndex): Use auto for the list
        items vector and use a reference for the list items.
        (WebCore::HTMLSelectElement::length): Use auto for the list items vector.

        * html/HTMLTextAreaElement.h: Override renderer to return a more specific type.

        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::didAttachRenderers): Call renderer only once and
        don't downcast it. There was no obvious type check because the renderer has a
        guaranteed type, but this is now clearer because it's the renderer function
        that returns a more specific type.
        (WebCore::HTMLVideoElement::parseAttribute): Ditto.
        (WebCore::HTMLVideoElement::setDisplayMode): Ditto.

        * html/HTMLVideoElement.h: Override renderer to return a more specific type.
        * html/HTMLWBRElement.h: Ditto.

        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::canControlControlsManager): Removed
        unneeded typecast in code that null checks a renderer.
        (WebCore::isMainContent): Remove now-unneeded downcast of a renderer
        obtained from an HTMLMediaElement. Fixed awkward formatting by splitting
        an if statement into two.
        (WebCore::isElementLargeEnoughForMainContent): Remove now unneeded downcast
        of a renderer obtained from an HTMLMediaElement.

        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::forwardEvent): Call renderer only once.
        Also use auto more in the code rather than writing out types.

        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::setPositionFromPoint): Used the renderBox
        function more consistently for all the renderers used here; before,
        some had null checks and others did not.

        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler): Use auto
        a bit more.

        * page/EventHandler.cpp:
        (WebCore::enclosingScrollableArea): Removed a redundant null check and
        stopped using the name "element" for a local variable that was not
        always an element.

        * page/PrintContext.cpp:
        (WebCore::enclosingBoxModelObject): Rewrote loop to be simpler and tighter.
        Also marked this inline since it's used only one place.
        (WebCore::PrintContext::pageNumberForElement): Use auto for the return
        value rather than writing out the type.

        * page/SpatialNavigation.cpp:
        (WebCore::isScrollableNode): Tighten the code and use auto a bit.

        * platform/ios/WebVideoFullscreenControllerAVKit.mm: Add an include of
        RenderVideo.h since this gets at the renderer for a video.

        * rendering/RenderAttachment.h:
        (WebCore::HTMLAttachmentElement::renderer): Added. Function is here because
        it can only be called by code that includes this header. This matches the
        pattern of RenderElement.h and ContainerNode::renderer.

        * rendering/RenderFrame.cpp: Added now-needed include.

        * rendering/RenderFrame.h:
        (WebCore::HTMLFrameElement::renderer): Added. Same logic as above.

        * rendering/RenderLayerFilterInfo.cpp:
        (WebCore::RenderLayer::FilterInfo::updateReferenceFilterClients): Use auto
        a bit and call rendeer only once.

        * rendering/RenderMedia.h:
        (WebCore::HTMLMediaElement::renderer): Added. Same logic as above.
        * rendering/RenderTextControlMultiLine.h:
        (WebCore::HTMLTextAreaElement::renderer): Ditto.

        * rendering/RenderVideo.cpp:
        (WebCore::placeholder): Renamed. Tightened up argument type to match what
        is passed at all the call sites. Use auto instead of RenderObject.
        (WebCore::RenderVideo::offsetLeft): Use auto and the renamed function above.
        (WebCore::RenderVideo::offsetTop): Ditto.
        (WebCore::RenderVideo::offsetWidth): Ditto.
        (WebCore::RenderVideo::offsetHeight): Ditto.

        * rendering/RenderVideo.h:
        (WebCore::HTMLVideoElement::renderer): Added. Same logic as above.

        * svg/SVGGElement.cpp:
        (WebCore::SVGGElement::createElementRenderer): Fixed typo.

        * svg/SVGGraphicsElement.cpp:
        (WebCore::SVGGraphicsElement::createElementRenderer): Removed
        non-helpful oblique comment.
        * svg/SVGPathElement.cpp:
        (WebCore::SVGPathElement::createElementRenderer): Ditto.

2016-06-01  Chris Fleizach  <cfleizach@apple.com>

        LayoutTest accessibility/ios-simulator/attributed-string-for-range.html failing on ios-simulator debug
        https://bugs.webkit.org/show_bug.cgi?id=158279

        Reviewed by Alexey Proskuryakov.

        Just use the same description for debug and release. We're not getting any benefit from having two.

        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper description]):

2016-06-01  Chris Dumez  <cdumez@apple.com>

        Use HashMap::ensure() in DocumentOrderedMap::add()
        https://bugs.webkit.org/show_bug.cgi?id=158283

        Reviewed by Ryosuke Niwa.

        Use HashMap::ensure() in DocumentOrderedMap::add() to avoid constructing
        a MapEntry if the key is already present in the HashMap.

        * dom/DocumentOrderedMap.cpp:
        (WebCore::DocumentOrderedMap::add):

2016-06-01  Alexey Proskuryakov  <ap@apple.com>

        Update QuartzCoreSPI.h for <rdar://problem/26584828>.

        * platform/spi/cocoa/QuartzCoreSPI.h:

2016-06-01  Brady Eidson  <beidson@apple.com>

        Modernize lambda usage for all callers of RunLoop::dispatch().
        https://bugs.webkit.org/show_bug.cgi?id=158265

        Reviewed by Chris Dumez.

        No new tests (Refactor, no behavior change).

        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::deleteDatabase):
        (WebCore::InProcessIDBServer::didDeleteDatabase):
        (WebCore::InProcessIDBServer::openDatabase):
        (WebCore::InProcessIDBServer::didOpenDatabase):
        (WebCore::InProcessIDBServer::didAbortTransaction):
        (WebCore::InProcessIDBServer::didCommitTransaction):
        (WebCore::InProcessIDBServer::didCreateObjectStore):
        (WebCore::InProcessIDBServer::didDeleteObjectStore):
        (WebCore::InProcessIDBServer::didClearObjectStore):
        (WebCore::InProcessIDBServer::didCreateIndex):
        (WebCore::InProcessIDBServer::didDeleteIndex):
        (WebCore::InProcessIDBServer::didPutOrAdd):
        (WebCore::InProcessIDBServer::didGetRecord):
        (WebCore::InProcessIDBServer::didGetCount):
        (WebCore::InProcessIDBServer::didDeleteRecord):
        (WebCore::InProcessIDBServer::didOpenCursor):
        (WebCore::InProcessIDBServer::didIterateCursor):
        (WebCore::InProcessIDBServer::abortTransaction):
        (WebCore::InProcessIDBServer::commitTransaction):
        (WebCore::InProcessIDBServer::didFinishHandlingVersionChangeTransaction):
        (WebCore::InProcessIDBServer::createObjectStore):
        (WebCore::InProcessIDBServer::deleteObjectStore):
        (WebCore::InProcessIDBServer::clearObjectStore):
        (WebCore::InProcessIDBServer::createIndex):
        (WebCore::InProcessIDBServer::deleteIndex):
        (WebCore::InProcessIDBServer::putOrAdd):
        (WebCore::InProcessIDBServer::getRecord):
        (WebCore::InProcessIDBServer::getCount):
        (WebCore::InProcessIDBServer::deleteRecord):
        (WebCore::InProcessIDBServer::openCursor):
        (WebCore::InProcessIDBServer::iterateCursor):
        (WebCore::InProcessIDBServer::establishTransaction):
        (WebCore::InProcessIDBServer::fireVersionChangeEvent):
        (WebCore::InProcessIDBServer::didStartTransaction):
        (WebCore::InProcessIDBServer::didCloseFromServer):
        (WebCore::InProcessIDBServer::notifyOpenDBRequestBlocked):
        (WebCore::InProcessIDBServer::databaseConnectionClosed):
        (WebCore::InProcessIDBServer::abortOpenAndUpgradeNeeded):
        (WebCore::InProcessIDBServer::didFireVersionChangeEvent):
        (WebCore::InProcessIDBServer::openDBRequestCancelled):
        (WebCore::InProcessIDBServer::confirmDidCloseFromServer):
        (WebCore::InProcessIDBServer::getAllDatabaseNames):
        (WebCore::InProcessIDBServer::didGetAllDatabaseNames):
        
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect):
        
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::writeBlobsToDiskForIndexedDBSynchronously):
        
        * page/scrolling/ThreadedScrollingTree.cpp:
        (WebCore::ThreadedScrollingTree::invalidate):
        (WebCore::ThreadedScrollingTree::scrollingTreeNodeDidScroll):
        (WebCore::ThreadedScrollingTree::currentSnapPointIndicesDidChange):
        (WebCore::ThreadedScrollingTree::handleWheelEventPhase):
        (WebCore::ThreadedScrollingTree::setActiveScrollSnapIndices):
        (WebCore::ThreadedScrollingTree::deferTestsForReason):
        (WebCore::ThreadedScrollingTree::removeTestDeferralForReason):
        
        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::FontCache::platformPrecache):
        
        * platform/graphics/mac/DisplayRefreshMonitorMac.cpp:
        (WebCore::DisplayRefreshMonitorMac::displayLinkFired):
        
        * platform/network/DataURLDecoder.cpp:
        (WebCore::DataURLDecoder::createDecodeTask):
        (WebCore::DataURLDecoder::decode):

2016-06-01  Eric Carlson  <eric.carlson@apple.com>

        REGRESSION(r201385) ASSERT in WebCore::HTMLMediaElement::updateActiveTextTrackCues + 5688
        https://bugs.webkit.org/show_bug.cgi?id=158164
        <rdar://problem/26498634>

        Reviewed by Jer Noble.

        No new tests, this prevents an assert in existing tests.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::~HTMLMediaElement): Call beginIgnoringTrackDisplayUpdateRequests
          so we avoid doing unnecessary work triggered by destruction.

2016-06-01  Dean Jackson  <dino@apple.com>

        Fix iOS build.

        * platform/spi/cg/CoreGraphicsSPI.h: No ColorSync on iOS.

2016-06-01  Chris Dumez  <cdumez@apple.com>

        Crash under eventTargetRespectingTargetRules()
        https://bugs.webkit.org/show_bug.cgi?id=158273
        <rdar://problem/26343998>

        Reviewed by Alex Christensen.

        The code would call nodeOrHostIfPseudoElement(), which can return null
        and then dereference it in eventTargetRespectingTargetRules() without
        null check. This patch adds a null check. When the node is null, the
        while loop after will do nothing and thus the target will not be used.

        No new tests, we do not have a good reproduction case.

        * dom/EventPath.cpp:
        (WebCore::EventPath::EventPath):

2016-06-01  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r201551 and r201552.
        https://bugs.webkit.org/show_bug.cgi?id=158275

        This change caused 3 API tests to crash on ios-simulator
        (Requested by ryanhaddad on #webkit).

        Reverted changesets:

        "Precache primary font in a secondary thread"
        https://bugs.webkit.org/show_bug.cgi?id=158243
        http://trac.webkit.org/changeset/201551

        "Remove accidental fprintf."
        http://trac.webkit.org/changeset/201552

2016-06-01  Chris Fleizach  <cfleizach@apple.com>

        AX: iOS: VoiceOver can't access attachments in mail messages
        https://bugs.webkit.org/show_bug.cgi?id=158198

        Reviewed by Joanmarie Diggs.

        Replaced elements, like attachemnts, were not being exposed in the attributed string returned to VoiceOver.
        Make sure they are exposed with the attachment character, pointing to the actual element.

        Test: accessibility/ios-simulator/attributed-string-for-range.html

        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (AccessibilityUnignoredAncestor):
        (-[WebAccessibilityObjectWrapper _stringForRange:attributed:]):

2016-06-01  Jer Noble  <jer.noble@apple.com>

        setVideoFullscreenGravity() has no effect on the fullscreen video layer
        https://bugs.webkit.org/show_bug.cgi?id=158267

        Reviewed by Eric Carlson.

        When we moved to a 2-AVPlayerLayer solution, we didn't update setVideoFullscreenGravity()
        to change the correct layer's videoGravity property.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenGravity):

2016-06-01  Alex Christensen  <achristensen@webkit.org>

        Fix null dereferencing in ResourceTimingInformation::addResourceTiming
        https://bugs.webkit.org/show_bug.cgi?id=158266
        rdar://problem/26528466

        Reviewed by Chris Dumez.

        This would crash sometimes in http/tests/security/cross-frame-access-custom.html

        * loader/ResourceTimingInformation.cpp:
        (WebCore::ResourceTimingInformation::addResourceTiming):
        * loader/ResourceTimingInformation.h:
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestResource):
        (WebCore::CachedResourceLoader::loadDone):
        We would dereference a null pointer on the first instruction when calling 
        Document::parentDocument from ResourceTimingInformation::addResourceTiming, 
        which means the document was null.  CachedResourceLoader::document even has
        a comment saying it can be null, so we should check it before using it.

2016-06-01  Said Abou-Hallawa  <sabouhallawa@apple.com>

        SVGImage should report its memory cost to JS garbage collector
        https://bugs.webkit.org/show_bug.cgi?id=158139

        Reviewed by Geoffrey Garen.

        Like what we do in HTMLImageLoader::notifyFinished() by reporting the memory
        cost of the BitmapImage, we need to do something similar for the SVGImage. In
        SVGImage::dataChange() and when allDataReceived is true, we can calculate
        the size of all DOM nodes and their renderers. The size of the encoded data
        has to be added as well to the total memory cost. An approximation for the
        memory cost has to be used since it is costly to get an accurate number.

        * bindings/js/JSDocumentCustom.cpp: 
        (WebCore::reportMemoryForDocumentIfFrameless): Use Node::approximateMemoryCost()
        instead of sizeof(Node). A Node's descendant can override this function and
        return a more accurate memory cost.
        
        * dom/Node.h:
        (WebCore::Node::approximateMemoryCost): Define this new virtual function in the
        Node class. Its default value is sizeof(Node) but any descendant can return a
        more accurate number.
        
        * platform/graphics/Image.h:
        (WebCore::Image::data): Define a const version of data() so it can be called
        the const function SVGImage::reportApproximateMemoryCost().
        
        * svg/SVGGraphicsElement.h: Override approximateMemoryCost() to return 
        sizeof(SVGGraphicsElement).
        
        * svg/SVGPathElement.cpp:
        (WebCore::SVGPathElement::approximateMemoryCost): Override this function to return
        the memory cost of the points and the m_path of the renderer.
        * svg/SVGPathElement.h:
        
        * svg/SVGPolyElement.cpp:
        (WebCore::SVGPolyElement::approximateMemoryCost): Override this function to return
        the memory cost of the points and the m_path of the renderer.
        * svg/SVGPolyElement.h:
        
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::reportApproximateMemoryCost): Calculate the memory cost of the 
        nodes in the SVGDocument of an SVGImage. Then report this number to the JS garbage 
        collector.
        
        (WebCore::SVGImage::dataChanged): After loading all the SVG encoded data and building
        its DOM tree and the render tree, report the total memory cost to the JS garbage collector.
        * svg/graphics/SVGImage.h:

2016-06-01  Andreas Kling  <akling@apple.com>

        Use inline capacity for StylePropertyShorthand Vectors.
        <https://webkit.org/b/158260>

        Reviewed by Antti Koivisto.

        Vector<StylePropertyShorthand> was a huge source of heap allocations,
        just over 0.5% of all fastMalloc() bytes on PLUM. Giving it an inline capacity
        of 4 turns all of it into stack allocations.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::addProperty):
        * css/CSSProperty.cpp:
        (WebCore::StylePropertyMetadata::shorthandID):
        * css/StylePropertyShorthand.cpp:
        (WebCore::indexOfShorthandForLonghand):
        * css/StylePropertyShorthand.h:
        * css/makeprop.pl:
        (constructShorthandsVector):

2016-06-01  Nael Ouedraogo  <nael.ouedraogo@crf.canon.fr>

        POST request on a blob resource should return a "network error" instead of HTTP 500 response
        https://bugs.webkit.org/show_bug.cgi?id=158022

        Reviewed by Alex Christensen.

        Not allowed HTTP method is notified as failed in BlobResourceHandle as per Fetch
        specification (5.2 Basic fetch). This behavior is observable in fetch WPT tests.

        The behavior of XHR is slightly changed for asynchronous request on a blob resource with not
        allowed or invalid HTTP methods. The onError callback is called instead of throwing an
        exception as per XHR specification (https://xhr.spec.whatwg.org/#request-error-steps).

        WPT tests expected results have been updated for fetch tests on blob resources which are
        now correct.

        Test: fast/files/xhr-blob-request.html ensures XHR response to requests on a blob resource is
        correct.

        * platform/network/BlobResourceHandle.cpp:
        (WebCore::BlobResourceHandle::doStart):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::createRequest):

2016-06-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove allocation of SubresourceLoader::m_requestCountTracker
        https://bugs.webkit.org/show_bug.cgi?id=158255

        Reviewed by Chris Dumez.

        No change of behavior.

        Making m_requestCountTracker an Optional in lieu of a unique_ptr.
        This requires constructing m_requestCountTracker in place so that constructor and destructor are called only once.

        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::SubresourceLoader):
        (WebCore::SubresourceLoader::didReceiveResponse):
        (WebCore::SubresourceLoader::notifyDone):
        * loader/SubresourceLoader.h:

2016-06-01  Antti Koivisto  <antti@apple.com>

        Remove accidental fprintf.

        * platform/graphics/FontCache.cpp:
        (WebCore::FontCache::precache):

2016-05-31  Antti Koivisto  <antti@apple.com>

        Precache primary font in a secondary thread
        https://bugs.webkit.org/show_bug.cgi?id=158243

        Reviewed by Andreas Kling.

        We know the font families and descriptions to use on style resolution. The actual fonts are only needed for
        layout. There is often time to load and cache fonts asynchronously before they are accessed. This can substantially
        reduce font related workload in the main thread.

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::font):
        (WebCore::CSSFontFace::resolveFamilies):
        (WebCore::CSSFontFace::hasSVGFontFaceSource):
        * css/CSSFontFace.h:
        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):
        (WebCore::CSSFontFaceSource::url):
        (WebCore::CSSFontFaceSource::isSVGFontFaceSource):
        * css/CSSFontFaceSource.h:
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::fallbackFontAt):
        (WebCore::CSSFontSelector::resolveFamilies):

            Add a function for resolving font families of a cascade to their final values.

        * css/CSSFontSelector.h:
        * css/CSSSegmentedFontFace.cpp:
        (WebCore::CSSSegmentedFontFace::fontRanges):
        (WebCore::CSSSegmentedFontFace::resolveFamilies):
        * css/CSSSegmentedFontFace.h:
        * platform/graphics/FontCache.cpp:
        (WebCore::fontPlatformDataCache):
        (WebCore::precacheTasksInProgress):
        (WebCore::alternateFamilyName):
        (WebCore::FontCache::getCachedFontPlatformData):
        (WebCore::FontCache::invalidate):
        (WebCore::FontCache::precache):

            Precache fonts by trying to load them asyncronously one by one. On success the font is cached into font platform data cache.

        (WebCore::FontCache::similarFont):
        * platform/graphics/FontCache.h:
        * platform/graphics/FontCascade.cpp:
        (WebCore::pruneSystemFallbackFonts):
        (WebCore::precachePrimaryFamily):

            When initializing a new font cascade resolve any platform fonts to their actual names using FontSelector,
            then precache the primary font for the cascade.

            Web fonts are ignored for now.

        (WebCore::retrieveOrAddCachedFonts):
        * platform/graphics/FontSelector.h:
        (WebCore::FontSelector::~FontSelector):
        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::FontCache::setFontWhitelist):
        (WebCore::fontWithFamily):
        (WebCore::autoActivateFont):
        (WebCore::createFontPlatformDataThreadSafe):

            Factor thread safe part of createFontPlatformData to a function.

        (WebCore::FontCache::createFontPlatformData):

            Do the main thread only hash lookups here then call to createFontPlatformDataThreadSafe.

        (WebCore::fallbackDedupSet):
        (WebCore::FontCache::systemFallbackForCharacters):
        (WebCore::FontCache::platformPrecache):

            Try to initialize font asynchronously in a dispatch queue, call completion handler on success or failure.

        (WebCore::FontCache::platformCancelPrecache):

            Cancel ongoing precache operation.

        (WebCore::platformFontLookupWithFamily): Deleted.

            This was inlined to the only client, fontWithFamily.

2016-06-01  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Add RTCRtpTransceiver interface and RTCPeerConnection.addTransceiver()
        https://bugs.webkit.org/show_bug.cgi?id=158189

        Reviewed by Darin Adler.

        The RTCRtpTransceiver interface represents a combination of an RTCRtpSender and an
        RTCRtpReceiver that share a common mid [1].

        RTCPeerConnection.addTransceiver() [2] creates an RTCRtpTransceiver object, either directly
        from a MediaStreamTrack [3], or with a specific media type (kind).

        This change introduces the RTCRtpTransceiver object, follow-up patches will integrate it
        into the offer/answer machinery.

        [1] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html#rtcrtptransceiver-interface
        [2] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html#dom-rtcpeerconnection-addtransceiver
        [3] http://w3c.github.io/mediacapture-main/archives/20160513/getusermedia.html#mediastreamtrack

        Test: fast/mediastream/RTCPeerConnection-addTransceiver.html

        * CMakeLists.txt:
        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::createOfferTask):
        (WebCore::MediaEndpointPeerConnection::createReceiver):
        An RTCTransceiver always has a receiver (RTCRtpReceiver) with a track (MediaStreamTrack) that
        can be rendered. Before that remote track is receiving data from the remote peer, it's muted.
        createReceiver() uses MediaEndponit::createMutedRemoteSource() to create a source to represent
        future incoming media.
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/mediastream/PeerConnectionBackend.h:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::addTransceiver):
        (WebCore::RTCPeerConnection::completeAddTransceiver):
        (WebCore::RTCPeerConnection::addReceiver): Deleted.
        We now create the receiver explicitly with createReceiver.
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/mediastream/RTCRtpSender.cpp:
        (WebCore::RTCRtpSender::create):
        (WebCore::RTCRtpSender::RTCRtpSender):
        (WebCore::RTCRtpSender::setTrack):
        (WebCore::RTCRtpSender::replaceTrack):
        * Modules/mediastream/RTCRtpSender.h:
        (WebCore::RTCRtpSender::trackId):
        (WebCore::RTCRtpSender::trackKind):
        (WebCore::RTCRtpSender::setMediaStreamIds):
        (WebCore::RTCRtpSender::isStopped):
        (WebCore::RTCRtpSender::create): Deleted.
        * Modules/mediastream/RTCRtpSenderReceiverBase.h:
        (WebCore::RTCRtpSenderReceiverBase::track):
        (WebCore::RTCRtpSenderReceiverBase::RTCRtpSenderReceiverBase):
        * Modules/mediastream/RTCRtpTransceiver.cpp: Added.
        (WebCore::RTCRtpTransceiver::create):
        (WebCore::RTCRtpTransceiver::getNextMid):
        (WebCore::RTCRtpTransceiver::RTCRtpTransceiver):
        (WebCore::RTCRtpTransceiver::directionString):
        (WebCore::RTCRtpTransceiver::hasSendingDirection):
        (WebCore::RTCRtpTransceiver::enableSendingDirection):
        (WebCore::RTCRtpTransceiver::disableSendingDirection):
        * Modules/mediastream/RTCRtpTransceiver.h: Added.
        (WebCore::RTCRtpTransceiver::~RTCRtpTransceiver):
        (WebCore::RTCRtpTransceiver::direction):
        (WebCore::RTCRtpTransceiver::setDirection):
        (WebCore::RTCRtpTransceiver::provisionalMid):
        (WebCore::RTCRtpTransceiver::setProvisionalMid):
        (WebCore::RTCRtpTransceiver::mid):
        (WebCore::RTCRtpTransceiver::setMid):
        (WebCore::RTCRtpTransceiver::sender):
        (WebCore::RTCRtpTransceiver::receiver):
        (WebCore::RTCRtpTransceiver::stopped):
        (WebCore::RTCRtpTransceiver::stop):
        * Modules/mediastream/RTCRtpTransceiver.idl: Added.
        * WebCore.xcodeproj/project.pbxproj:
        * platform/mediastream/MediaEndpoint.h:
        Added createMutedRemoteSource() that creates a muted remote source that will become unmuted
        when media arrives from the remote peer.
        * platform/mediastream/RealtimeMediaSource.cpp:
        (WebCore::RealtimeMediaSource::RealtimeMediaSource): Deleted.
        * platform/mediastream/RealtimeMediaSource.h:
        * platform/mediastream/mac/MockRealtimeVideoSourceMac.mm:
        (WebCore::MockRealtimeVideoSource::create):
        Use Ref instead of RefPtr.
        * platform/mock/MockMediaEndpoint.cpp:
        (WebCore::MockMediaEndpoint::createMutedRemoteSource):
        * platform/mock/MockMediaEndpoint.h:
        * platform/mock/MockRealtimeAudioSource.cpp:
        (WebCore::MockRealtimeAudioSource::create):
        (WebCore::MockRealtimeAudioSource::createMuted):
        (WebCore::MockRealtimeAudioSource::MockRealtimeAudioSource):
        * platform/mock/MockRealtimeAudioSource.h:
        * platform/mock/MockRealtimeVideoSource.cpp:
        (WebCore::MockRealtimeVideoSource::create):
        (WebCore::MockRealtimeVideoSource::createMuted):
        (WebCore::MockRealtimeVideoSource::MockRealtimeVideoSource):
        * platform/mock/MockRealtimeVideoSource.h:

2016-06-01  Per Arne Vollan  <pvollan@apple.com>

        [Win][IndexedDB] Crash when running blob test.
        https://bugs.webkit.org/show_bug.cgi?id=158224

        Reviewed by Brady Eidson.

        Avoid calling WTFMove(x) before calling x->method().

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::putOrAddOnServer):

2016-06-01  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Positioned items can be placed on the implicit grid
        https://bugs.webkit.org/show_bug.cgi?id=158197

        Reviewed by Sergio Villar Senin.

        The old code wrongly assumed that positioned items couldn't be placed
        on the implicit grid. However, the spec doesn't mention anything about this.

        The patch fixes this issue, so now positioned items can be actually
        placed on the implicit tracks.

        Test: fast/css-grid-layout/grid-positioned-items-within-grid-implicit-track.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild): Use the lines
        of the implicit grid instead of the explicit one.

2016-05-31  Chris Dumez  <cdumez@apple.com>

        Modernize lambda captures in WorkerThreadableWebSocketChannel
        https://bugs.webkit.org/show_bug.cgi?id=158246

        Reviewed by Brady Eidson.

        Modernize lambda captures in WorkerThreadableWebSocketChannel and drop
        legacy URLCapture as it is no longer needed / used.

        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
        (WebCore::WorkerThreadableWebSocketChannel::Peer::send):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::bufferedAmount):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didConnect):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveMessage):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveBinaryData):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didUpdateBufferedAmount):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didStartClosingHandshake):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveMessageError):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::initialize):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::connect):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::bufferedAmount):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::close):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::fail):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::disconnect):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::suspend):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::resume):
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::setMethodNotCompleted): Deleted.
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::waitForMethodCompletion): Deleted.
        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
        * platform/URL.h:
        (WebCore::operator==): Deleted.

2016-05-31  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: ReportExtraMemoryCost IDL attribute should also be used to generate estimatedSize method
        https://bugs.webkit.org/show_bug.cgi?id=158144

        Reviewed by Darin Adler.

        * bindings/scripts/CodeGeneratorJS.pm:
        (InstanceNeedsEstimatedSize):
        (GenerateHeader):
        (GenerateImplementation):
        When an interface includes ReportExtraMemoryCost, generate an estimatedSize
        method which includes the Base::estimatedSize and the memoryCost().

        * bindings/scripts/test/GObject/WebKitDOMInterfaceName.cpp: Added.
        (WebKit::kit):
        (WebKit::core):
        (WebKit::wrapInterfaceName):
        (webkit_dom_interface_name_finalize):
        (webkit_dom_interface_name_constructor):
        (webkit_dom_interface_name_class_init):
        (webkit_dom_interface_name_init):
        * bindings/scripts/test/GObject/WebKitDOMInterfaceName.h: Added.
        * bindings/scripts/test/GObject/WebKitDOMInterfaceNamePrivate.h: Added.
        * bindings/scripts/test/JS/JSInterfaceName.cpp: Added.
        (WebCore::JSInterfaceNamePrototype::create):
        (WebCore::JSInterfaceNamePrototype::createStructure):
        (WebCore::JSInterfaceNamePrototype::JSInterfaceNamePrototype):
        (WebCore::JSInterfaceNameConstructor::prototypeForStructure):
        (WebCore::JSInterfaceNameConstructor::initializeProperties):
        (WebCore::JSInterfaceNamePrototype::finishCreation):
        (WebCore::JSInterfaceName::JSInterfaceName):
        (WebCore::JSInterfaceName::createPrototype):
        (WebCore::JSInterfaceName::prototype):
        (WebCore::JSInterfaceName::destroy):
        (WebCore::jsInterfaceNameConstructor):
        (WebCore::setJSInterfaceNameConstructor):
        (WebCore::JSInterfaceName::getConstructor):
        (WebCore::JSInterfaceName::visitChildren):
        (WebCore::JSInterfaceName::estimatedSize):
        (WebCore::JSInterfaceNameOwner::isReachableFromOpaqueRoots):
        (WebCore::JSInterfaceNameOwner::finalize):
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSInterfaceName::toWrapped):
        * bindings/scripts/test/JS/JSInterfaceName.h: Added.
        (WebCore::JSInterfaceName::create):
        (WebCore::JSInterfaceName::createStructure):
        (WebCore::JSInterfaceName::finishCreation):
        (WebCore::wrapperOwner):
        (WebCore::wrapperKey):
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/ObjC/DOMInterfaceName.h: Added.
        * bindings/scripts/test/ObjC/DOMInterfaceName.mm: Added.
        (-[DOMInterfaceName dealloc]):
        (core):
        (kit):
        * bindings/scripts/test/ObjC/DOMInterfaceNameInternal.h: Added.
        * bindings/scripts/test/TestReportExtraMemoryCost.idl: Added.
        Include a test for the ReportExtraMemoryCost attribute.

2016-05-31  Alex Christensen  <achristensen@webkit.org>

        Fix assertion after r201447
        https://bugs.webkit.org/show_bug.cgi?id=158244

        Reviewed by Jer Noble.

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::loadResource):
        If we are loading media using WebCoreNSURLSession, we could be making a request for a
        resource we already have in the memory cache because we are ignoring all caches.

2016-05-31  Chris Dumez  <cdumez@apple.com>

        Clean up / modernize iOS text autosizing code
        https://bugs.webkit.org/show_bug.cgi?id=158217

        Reviewed by Darin Adler.

        Clean up / modernize iOS text autosizing code.

        I think iOS text autosizing code is too intrusive inside the RenderStyle
        class but I have not updated this part of the code yet to limit patch
        size. This patch focuses on the TextAutoSizing.* and text autosizing
        code in the Document class.

        * WebCore.xcodeproj/project.pbxproj:
        * dom/Document.cpp:
        (WebCore::TextAutoSizingTraits::constructDeletedValue): Deleted.
        (WebCore::TextAutoSizingTraits::isDeletedValue): Deleted.
        Move TextAutoSizingTraits to the TextAutoSizing header to
        promote reuse and make the text autosizing code a little less
        intrusive.

        (WebCore::Document::addAutoSizingNode):
        - Drop local 'key' variable as it is only used once.
        - Use std::make_unique<> to construct the TextAutoSizingValue
          as it is no longer ref-counted.

        (WebCore::Document::validateAutoSizingNodes):
        Iterate over the textAutosizedNodes HashMap only once instead
        of twice. TextAutoSizingValue::adjustTextNodeSizes() was updated
        to return an enum class so we know from that value if we can
        remove the value from the HashSet or not, without having to rely
        on TextAutoSizingValue::numNodes(), which I removed in this
        patch.

        (WebCore::Document::clearAutoSizingNodes):
        Updated the TextAutoSizingValue destructor to call reset() so
        we don't have to explicitly call reset() on each value before
        clearing the textAutosizedNodes HashMap.

        * dom/Document.h:
        - Move TextAutoSizingTraits to the TextAutosizing header.
        - Rename resetAutosizingNodes() to clearAutoSizingNodes() as
          the method now only clears the textAutosizedNodes HashMap
          and reset() is now an implementation detail for
          TextAutoSizingValue.

        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::resetTextAutosizing):
        Call clearAutoSizingNodes() as it was renamed.

        * rendering/TextAutoSizing.cpp:
        (WebCore::TextAutoSizingKey::TextAutoSizingKey):
        - Use value of -1 for std::unique_ptr m_style member for distinguishing
        a HashTable deleted value, instead of having an extra m_isDeleted
        data member for this purpose.
        - Take RenderStyle parameter by reference and drop the null check as the
          call site can never pass nullptr.

        (WebCore::TextAutoSizingValue::addTextNode):
        - Rename addNode() to addTextNode() for clarity.

        (WebCore::TextAutoSizingValue::~TextAutoSizingValue):
        Update destructor to call reset() so that the Document does not have to
        call it explicitly and can instead just clear the HashMap, which will
        destroy the TextAutoSizingValue objects.

        (WebCore::TextAutoSizingValue::reset):
        Rename text to renderer for clarity.

        * rendering/TextAutoSizing.h:
        - Make TextAutoSizingValue as fast allocated.
        - Update TextAutoSizingValue to no longer be refcounted as ownership is never
          shared. The Document owns those.
        - Drop the factory function for TextAutoSizingValue and make the constructor
          public now that the class is no longer refcounted.
        - Make reset() method private now that it is called from the destructor and
          the Document is no longer expected to explicitly call it.
        - Update adjustTextNodeSizes() to return a StillHasNodes enum class and the
          Document can rely on the determine if it can drop the TextAutoSizingValue
          from its HashMap (and therefore destroy the object).
        - Drop numNodes() method as it is no longer needed.


2016-05-31  Dave Hyatt  <hyatt@apple.com>

        REGRESSION(r201040): Repainting of moving overflow:hidden objects is broken.
        https://bugs.webkit.org/show_bug.cgi?id=158079

        Reviewed by Zalan Bujtas.

        Added new test fast/repaint/overflow-hidden-movement.html

        Change checkForRepaintDuringLayout() to only be true for self-painting layers
        and not for all layers.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::hasSelfPaintingLayer):
        (WebCore::RenderObject::checkForRepaintDuringLayout):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::hasSelfPaintingLayer):

2016-05-31  Zalan Bujtas  <zalan@apple.com>

        ShowRenderTree: Print location information for relative/sticky inlines.
        https://bugs.webkit.org/show_bug.cgi?id=158235

        Reviewed by David Hyatt.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::showRenderObject):

2016-05-31  Jer Noble  <jer.noble@apple.com>

        Unreviewed build fix; use ASSERT_UNUSED rather than ASSERT to fix release builds.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::removeSession):

2016-05-31  Jer Noble  <jer.noble@apple.com>

        [EME] Sound continues playing when video's src is changed
        https://bugs.webkit.org/show_bug.cgi?id=158233

        Reviewed by Eric Carlson.

        When CDMSessionAVFoundation began listening for outputObscuredDueToInsufficientExternalProtection
        KVO notifications, it retained the AVPlayer owned by MediaPlayerPrivateAVFoundationObjC, which
        caused the AVPlayer to outlive its original owner, and to continue playing even after the
        MediaPlayerPrivateAVFoundationObjC had been destroyed.

        Rather than observe for outputObscuredDueToInsufficientExternalProtection changes in
        CDMSessionAVFoundation, add a backreference from the media player to the session, listen for changes
        in the player, and have the player notify the session when the value of that property changes.

        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.h:
        (WebCore::CDMSessionAVFoundationObjC::createWeakPtr):
        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm:
        (WebCore::CDMSessionAVFoundationObjC::CDMSessionAVFoundationObjC):
        (-[WebCDMSessionAVFoundationObjCListener initWithParent:player:]): Deleted.
        (-[WebCDMSessionAVFoundationObjCListener invalidate]): Deleted.
        (-[WebCDMSessionAVFoundationObjCListener observeValueForKeyPath:ofObject:change:context:]): Deleted.
        (WebCore::CDMSessionAVFoundationObjC::~CDMSessionAVFoundationObjC): Deleted.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::removeSession):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createSession):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::outputObscuredDueToInsufficientExternalProtectionChanged):
        (WebCore::playerKVOProperties):
        (-[WebCoreAVFMovieObserver observeValueForKeyPath:ofObject:change:context:]):

2016-05-31  Eric Carlson  <eric.carlson@apple.com>

        [Mac] AirPlay route is sometimes reset when changing video.src
        https://bugs.webkit.org/show_bug.cgi?id=158226
        <rdar://problem/24197592>

        Reviewed by Jer Noble.

        Test: media/airplay-autoplay.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::webkitShowPlaybackTargetPicker): Remove the gesture requirement
          if currently processing a user gesture.
        (WebCore::HTMLMediaElement::dispatchEvent): Set m_failedToPlayToWirelessTarget to false when
          dispatching webkitcurrentplaybacktargetiswirelesschanged so an element can succeed after failing.

2016-05-31  Chris Dumez  <cdumez@apple.com>

        Regression(r201482): Crash under dispatch_semaphore_wait
        https://bugs.webkit.org/show_bug.cgi?id=158230
        <rdar://problem/26534698>

        Reviewed by Eric Carlson.

        Stop moving hasSessionSemaphore in the lambda capture since it is used in
        dispatch_semaphore_wait() call after the callOnMainThread() call.

        No new tests, already covered by tests that are crashing on the bots.

        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
        (-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]):

2016-05-31  Brady Eidson  <beidson@apple.com>

        Make createCrossThreadTask() functions return on the stack instead of the heap.
        https://bugs.webkit.org/show_bug.cgi?id=158215

        Reviewed by Darin Adler.

        No new tests (Refactor, no change in behavior).

        * Modules/indexeddb/client/IDBConnectionProxy.h:
        
        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::postDatabaseTask):
        (WebCore::IDBServer::IDBServer::postDatabaseTaskReply):
        (WebCore::IDBServer::IDBServer::databaseRunLoop):
        * Modules/indexeddb/server/IDBServer.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::postDatabaseTask):
        (WebCore::IDBServer::UniqueIDBDatabase::postDatabaseTaskReply):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        
        * dom/ScriptExecutionContext.h:
        (WebCore::ScriptExecutionContext::postCrossThreadTask):
        
        * fileapi/ThreadableBlobRegistry.cpp:
        (WebCore::threadableQueue):

2016-05-31  Dave Hyatt  <hyatt@apple.com>

        REGRESSION (r189567): Elements with aspect ratios not handled correctly inside flexbox.
        https://bugs.webkit.org/show_bug.cgi?id=158040

        Reviewed by Zalan Bujtas.

        Added new tests in fast/flexbox.

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::clientLogicalBottomAfterRepositioning):
        (WebCore::RenderFlexibleBox::hasOrthogonalFlow):
        (WebCore::RenderFlexibleBox::mainAxisContentExtent):
        (WebCore::RenderFlexibleBox::computeMainAxisExtentForChild):
        (WebCore::RenderFlexibleBox::mainAxisBorderAndPaddingExtentForChild):
        (WebCore::RenderFlexibleBox::mainAxisLengthIsDefinite):
        (WebCore::RenderFlexibleBox::mainAxisScrollbarExtentForChild):
        (WebCore::RenderFlexibleBox::prepareOrderIteratorAndMargins):
        (WebCore::RenderFlexibleBox::crossAxisLengthIsDefinite):
        (WebCore::RenderFlexibleBox::computeMainSizeFromAspectRatioUsing):
        (WebCore::RenderFlexibleBox::adjustChildSizeForAspectRatioCrossAxisMinAndMax):
        (WebCore::RenderFlexibleBox::useChildAspectRatio):
        (WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):
        (WebCore::RenderFlexibleBox::resetAutoMarginsAndLogicalTopInCrossAxis):
        (WebCore::RenderFlexibleBox::mainAxisOverflowForChild):
        (WebCore::RenderFlexibleBox::mainAxisExtentIsDefinite): Deleted.
        (WebCore::RenderFlexibleBox::mainAxisLengthIsIndefinite): Deleted.
        * rendering/RenderFlexibleBox.h:
        (WebCore::RenderFlexibleBox::isFlexibleBoxImpl):

2016-05-31  Alex Christensen  <achristensen@webkit.org>

        Build fix after r201482.

        * platform/network/curl/CurlDownload.cpp:
        (WebCore::CurlDownload::didReceiveHeader):
        header used to be capturedHeader, which was a StringCapture, which needed .string() to get the String.
        Now it's a WTF::String, so we already have the String.  Hooray for c++14!

2016-05-31  Sergio Villar Senin  <svillar@igalia.com>

        Unreviewed build fix.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctions):

2016-05-25  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Empty grid without explicit tracks shouldn't have any size
        https://bugs.webkit.org/show_bug.cgi?id=155197

        Reviewed by Darin Adler.

        The internal representation of the grid is a Vector of Vector representing rows and
        columns. Because of that it was not possible to have columns without having at least one
        row. That forced us to have a 1x1 internal representation of the grid even if it was
        actually empty. That works for most of the cases except when the grid is actually empty.

        By changing the way we compute the sizes we can overcome that implementation
        restriction. This allowed us also to thighten the conditions under we could use the
        GridIterator. From now on it won't be possible to use it on empty grids so callers should
        enforce that restriction.

        A new bool was added to verify that placeItemsOnGrid() has been already called. The previous
        code was relying on the fact that there were items in the internal representation, which is
        wrong, as there might be no items in the grid.

        Test: fast/css-grid-layout/empty-grid.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::GridIterator::GridIterator): Added ASSERTs.
        (WebCore::RenderGrid::GridIterator::nextGridItem): Ditto.
        (WebCore::RenderGrid::GridIterator::isEmptyAreaEnough): Ditto.
        (WebCore::RenderGrid::GridIterator::nextEmptyGridArea): Ditto.
        (WebCore::RenderGrid::gridColumnCount): Use the style to resolve the number of columns if
        the internal representation is empty.
        (WebCore::RenderGrid::gridRowCount):
        (WebCore::RenderGrid::guttersSize): Allow to pass 0 as span, this permits using the return
        value of gridColumnCount|gridRowCount directly to call this method.
        (WebCore::RenderGrid::computeIntrinsicLogicalWidths): Use m_gridIsDirty.
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks): Do not examine the contents of grid
        tracks if there are no items in the grid.
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctions): Ditto.
        (WebCore::RenderGrid::placeItemsOnGrid): Set m_gridIsDirty to false.
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::clearGrid):
        (WebCore::RenderGrid::populateGridPositionsForDirection):
        * rendering/RenderGrid.h: Moved gridColumnCount/gridRowCount to cpp file.

2016-05-30  Brady Eidson  <beidson@apple.com>

        Move CrossThreadCopier/CrossThreadTask to WTF.
        https://bugs.webkit.org/show_bug.cgi?id=158207

        Reviewed by Alex Christensen.

        No new tests (Refactor, no behavior change).

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        * Modules/indexeddb/IDBActiveDOMObject.h:
        * Modules/indexeddb/IDBValue.cpp:
        * Modules/indexeddb/client/IDBConnectionProxy.h:
        * Modules/indexeddb/server/IDBServer.cpp:
        * Modules/indexeddb/server/IDBServer.h:
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        * dom/ScriptExecutionContext.h:
        * fileapi/ThreadableBlobRegistry.cpp:
        
        * platform/WebCoreCrossThreadCopier.cpp: Added.
        (WTF::WebCore::SessionID>::copy):
        (WTF::WebCore::ThreadSafeDataBuffer>::copy):
        * platform/WebCoreCrossThreadCopier.h: Added.
        
        * platform/network/cf/ResourceError.h:
        (WebCore::ResourceError::isolatedCopy):
        
        * platform/network/cf/ResourceRequest.h:
        (WebCore::ResourceRequest::isolatedCopy):
        
        * platform/network/cf/ResourceResponse.h:
        (WebCore::ResourceResponse::isolatedCopy):

2016-05-30  Per Arne Vollan  <pvollan@apple.com>

        http/tests/websocket/tests/hybi/stop-on-resume-in-error-handler.html crashes on Windows almost all the time
        https://bugs.webkit.org/show_bug.cgi?id=144057

        Reviewed by Brent Fulgham.

        Protect SocketStreamHandle object before trying to access it on the main thread, and make sure
        CFWriteStreamRef parameter is valid before calling CFWriteStreamCanAcceptBytes. 

        * platform/network/cf/SocketStreamHandleCFNet.cpp:
        (WebCore::SocketStreamHandle::readStreamCallback):
        (WebCore::SocketStreamHandle::writeStreamCallback):

2016-05-30  Javier Fernandez  <jfernandez@igalia.com>

        [CSS Box Alignment] New CSS Value 'normal' for Self Alignment
        https://bugs.webkit.org/show_bug.cgi?id=156254

        Reviewed by Darin Adler.

        The Box Alignment specification defines a new value 'normal' to be used
        as default for the different layout models, which will define the
        specific behavior for each case. This patch adds a new CSS value in the
        parsing logic and adapts the Self Alignment properties to the new
        value.

        The 'auto' value is no longer valid for the 'align-items' property and
        the Computed Value will be always the specified value. Hence, I removed
        the StyleResolver logic because is not required now; the specific
        behavior of the 'normal' value will be resolved at layout time.

        Additionally, this patch updates the layout logic as well, for both
        Flexbox and Grid layout models.

        Test: css3/parse-alignment-of-root-elements.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::resolveLegacyJustifyItems): Added.
        (WebCore::resolveJustifyItemsAuto): Added.
        (WebCore::resolveJustifySelfAuto): Added.
        (WebCore::resolveAlignSelfAuto): Added.
        (WebCore::valueForItemPositionWithOverflowAlignment): Using a StyleSelfAlignmentData argument.
        (WebCore::ComputedStyleExtractor::propertyValue): Using the new resolving functions.
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseItemPositionOverflowPosition): A new value 'normal' is now valid.
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Mappings for the new value 'normal'.
        (WebCore::CSSPrimitiveValue::operator ItemPosition): Mappings for the new value 'normal'.
        * css/CSSPropertyNames.in:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::adjustRenderStyle): We don't need to resolve 'legacy" keyword.
        * rendering/RenderBox.cpp:
        (WebCore::flexItemHasStretchAlignment):
        (WebCore::RenderBox::hasStretchedLogicalWidth):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::styleDidChange):
        (WebCore::RenderFlexibleBox::alignmentForChild):
        (WebCore::contentAlignmentNormalBehaviorFlexibleBox):
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
        (WebCore::RenderFlexibleBox::layoutColumnReverse):
        (WebCore::RenderFlexibleBox::alignFlexLines):
        (WebCore::RenderFlexibleBox::alignChildren):
        * rendering/RenderGrid.cpp:
        (WebCore::defaultAlignmentChangedToStretchInRowAxis):
        (WebCore::defaultAlignmentChangedFromStretchInRowAxis):
        (WebCore::defaultAlignmentChangedFromStretchInColumnAxis):
        (WebCore::selfAlignmentChangedToStretchInRowAxis):
        (WebCore::selfAlignmentChangedFromStretchInRowAxis):
        (WebCore::selfAlignmentChangedFromStretchInColumnAxis):
        (WebCore::contentAlignmentNormalBehaviorGrid):
        (WebCore::RenderGrid::applyStretchAlignmentToTracksIfNeeded):
        (WebCore::RenderGrid::needToStretchChildLogicalHeight):
        (WebCore::RenderGrid::applyStretchAlignmentToChildIfNeeded):
        (WebCore::RenderGrid::columnAxisPositionForChild):
        (WebCore::RenderGrid::rowAxisPositionForChild):
        (WebCore::RenderGrid::columnAxisOffsetForChild):
        (WebCore::RenderGrid::rowAxisOffsetForChild):
        (WebCore::RenderGrid::computeContentPositionAndDistributionOffset):
        * rendering/style/RenderStyle.cpp:
        (WebCore::resolvedSelfAlignment):
        (WebCore::RenderStyle::resolvedAlignItems):
        (WebCore::RenderStyle::resolvedAlignSelf):
        (WebCore::RenderStyle::resolvedJustifyItems):
        (WebCore::RenderStyle::resolvedJustifySelf):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData): align-items uses now a different initial function.

2016-05-29  Brady Eidson  <beidson@apple.com>

        Transition various Task/Function queues from std::function to NoncopyableFunction.
        https://bugs.webkit.org/show_bug.cgi?id=158196

        Reviewed by Chris Dumez.

        No new tests (Refactor, no behavior change).

        * dom/ActiveDOMCallbackMicrotask.cpp:
        (WebCore::ActiveDOMCallbackMicrotask::ActiveDOMCallbackMicrotask):
        * dom/ActiveDOMCallbackMicrotask.h:

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::layoutSizeChanged):

        * page/FrameView.cpp:
        (WebCore::FrameView::queuePostLayoutCallback):
        (WebCore::FrameView::flushPostLayoutTasksQueue):
        * page/FrameView.h:

        * platform/GenericTaskQueue.cpp:
        (WebCore::TaskDispatcher<Timer>::postTask):
        (WebCore::TaskDispatcher<Timer>::dispatchOneTask):
        * platform/GenericTaskQueue.h:
        (WebCore::TaskDispatcher::postTask):
        (WebCore::GenericTaskQueue::enqueueTask):

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::postResolutionCallbackQueue):
        (WebCore::Style::queuePostResolutionCallback):
        (WebCore::Style::suspendMemoryCacheClientCalls):
        * style/StyleTreeResolver.h:

2016-05-29  Brady Eidson  <beidson@apple.com>

        Make ScriptExecutionContext::Task work in terms of wtf::NoncopyableFunction instead of std::function.
        https://bugs.webkit.org/show_bug.cgi?id=158187

        Reviewed by Chris Dumez.

        No new tests (Refactor, no behavior change).

        Also make postTask take an rvalue reference.

        * bindings/js/JSDOMGlobalObjectTask.cpp:
        (WebCore::JSGlobalObjectTask::JSGlobalObjectTask):
        
        * dom/Document.cpp:
        (WebCore::Document::postTask):
        * dom/Document.h:
        
        * dom/ScriptExecutionContext.h:
        (WebCore::ScriptExecutionContext::Task::Task):
        
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::postTask):
        * workers/WorkerGlobalScope.h:

2016-05-28  Chris Dumez  <cdumez@apple.com>

        Templatize NoncopyableFunction class similarly to std::function
        https://bugs.webkit.org/show_bug.cgi?id=158185

        Reviewed by Darin Adler.

        Templatize NoncopyableFunction class similarly to std::function, so
        that it can be used as a std::function replacement in more places.

        Previously, NoncopyableFunction could only support "void()" lambdas.

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::runTask):
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * fileapi/AsyncFileStream.cpp:
        (WebCore::callOnFileThread):
        (WebCore::AsyncFileStream::perform):
        (WebCore::AsyncFileStream::getSize):
        (WebCore::AsyncFileStream::openForRead):
        (WebCore::AsyncFileStream::openForWrite):
        (WebCore::AsyncFileStream::write):
        * fileapi/AsyncFileStream.h:
        * page/scrolling/ScrollingThread.cpp:
        (WebCore::ScrollingThread::dispatch):
        (WebCore::ScrollingThread::dispatchBarrier):
        (WebCore::ScrollingThread::dispatchFunctionsFromScrollingThread):
        * page/scrolling/ScrollingThread.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::scheduleDeferredTask):
        * platform/mediastream/MediaStreamPrivate.cpp:
        (WebCore::MediaStreamPrivate::scheduleDeferredTask):
        * platform/mediastream/MediaStreamPrivate.h:
        * platform/mediastream/mac/AVMediaCaptureSource.h:
        * platform/mediastream/mac/AVMediaCaptureSource.mm:
        (WebCore::AVMediaCaptureSource::scheduleDeferredTask):

2016-05-28  Alexey Proskuryakov  <ap@apple.com>

        Fix the build with newer clang and other custom configuration options
        https://bugs.webkit.org/show_bug.cgi?id=158161

        Reviewed by Dan Bernstein.

        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::rateChanged): Added UNUSED_PARAMs for the
        case where this function is unimplemented.
        (WebCore::WebVideoFullscreenInterfaceMac::setExternalPlayback): Added a non-additions
        version of this function.
        * platform/spi/cf/CFNetworkSPI.h: Silence nullability-completeness (and other) warnings.
        I doubt that it's practical to get these right for every SDK version at this time. Added
        functions for overriding HTTPS certicate behavior that we used to declare in .m files.
        * platform/spi/mac/AVFoundationSPI.h: Define AVAssetCache conditionally.

2016-05-28  Ryosuke Niwa  <rniwa@webkit.org>

        Autocorrection makes it hard to type "doesn't" and to type @ in email addresses
        https://bugs.webkit.org/show_bug.cgi?id=158177
        <rdar://problem/20490862>
        <rdar://problem/24707954>

        Reviewed by Darin Adler.

        When the user had typed "doesn'", some unified spellchecker may try to autocorrect it to "doesn't" or "does"
        but we should ignore this for a moment until the next character is typed by the user. The code to deal with
        this situation which checks the existence of an "ambiguous boundary character" was not robust when the
        replacement text was longer than the corrected text.

        Fixed this bug by fixing the logic to detect this case. Also added '@' as an ambiguous boundary character
        since autocorrecting letters that appear right before '@' would not be useful in many cases.

        Tests: ManualTests/autocorrection/autocorrection-at-mark.html
               ManualTests/autocorrection/autocorrection-contraction-2.html

        * editing/AlternativeTextController.cpp:
        (WebCore::AlternativeTextController::timerFired): Fixed a bug that we can show an empty reversion panel.
        * editing/Editor.cpp:
        (WebCore::Editor::markAndReplaceFor): When the user had typed "doesn'" and our autocorrection result is
        "doesn't", resultEndLocation (the end of "doesn't") is larger than selectionOffset (the end of "doesn'").
        When the correction is "does", resultEndLocation (the end of "does") is one less than selectionOffset.
        Updated the condition to deal with both of these conditions as well as cases where the correction result
        contains more than one letter after '.
        * editing/htmlediting.cpp:
        (WebCore::isAmbiguousBoundaryCharacter): Moved from the header file since this is not a hot function and
        doesn't need to be inlined everywhere. Added '@' as an ambiguous boundary character.
        * editing/htmlediting.h:
        (WebCore::isAmbiguousBoundaryCharacter): Moved to the cpp file.

2016-05-28  Konstantin Tokarev  <annulen@yandex.ru>

        FileSystem: use OS(WINDOWS) instead of PLATFORM(WIN).
        https://bugs.webkit.org/show_bug.cgi?id=158168

        Reviewed by Darin Adler.

        No new tests needed.

        * platform/FileSystem.cpp:
        (WebCore::lastComponentOfPathIgnoringTrailingSlash):
        (WebCore::MappedFileData::~MappedFileData):
        (WebCore::MappedFileData::MappedFileData):
        * platform/FileSystem.h: Removed unused PlatformFilePathSeparator
        constant.

2016-05-28  Konstantin Tokarev  <annulen@yandex.ru>

        Use COMPILER(MSVC) instead of PLATFORM(WIN) for MSVC-specific workaround
        https://bugs.webkit.org/show_bug.cgi?id=158169

        Reviewed by Darin Adler.

        No new tests needed.

        * platform/PlatformMouseEvent.h:
        * platform/win/PlatformMouseEventWin.cpp: Moved operators'
        implementations to PlatformMouseEvent.h

2016-05-27  Chris Dumez  <cdumez@apple.com>

        callOnMainThread() should not copy captured lambda variables
        https://bugs.webkit.org/show_bug.cgi?id=158166

        Reviewed by Brady Eidson.

        callOnMainThread() should not copy captured lambda variables. This 
        function is usually called cross-thread with a lambda and copying
        the lambda (and its captured variables) can lead to thread-safety
        issues.

        This patch updates callOnMainThread() to take a NoncopyableFunction&&
        in parameter instead of a std::function. The call sites of
        callOnMainThread() have also been updated to use C++14's lambda
        capture with initializer.

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::putOrAddOnServer):
        * Modules/mediastream/MediaDevicesRequest.cpp:
        (WebCore::MediaDevicesRequest::didCompletePermissionCheck):
        (WebCore::MediaDevicesRequest::didCompleteTrackSourceInfoRequest):
        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::runTask):
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::constraintsValidated):
        (WebCore::UserMediaRequest::userMediaAccessGranted):
        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::scheduleNodeDeletion):
        (WebCore::AudioContext::isPlayingAudioDidChange):
        * dom/Document.cpp:
        (WebCore::Document::postTask):
        (WebCore::Document::pendingTasksTimerFired): Deleted.
        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::requestScript):
        * fileapi/AsyncFileStream.cpp:
        (WebCore::callOnFileThread):
        (WebCore::AsyncFileStream::~AsyncFileStream):
        (WebCore::AsyncFileStream::perform):
        * fileapi/AsyncFileStream.h:
        * fileapi/ThreadableBlobRegistry.cpp:
        (WebCore::ThreadableBlobRegistry::registerFileBlobURL):
        (WebCore::ThreadableBlobRegistry::registerBlobURL):
        (WebCore::ThreadableBlobRegistry::registerBlobURLForSlice):
        (WebCore::ThreadableBlobRegistry::blobSize):
        (WebCore::ThreadableBlobRegistry::unregisterBlobURL):
        (WebCore::ThreadableBlobRegistry::registerBlobURLOptionallyFileBacked): Deleted.
        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::dispatchDidImportIconURLForPageURLOnMainThread):
        (WebCore::IconDatabase::dispatchDidImportIconDataForPageURLOnMainThread):
        * page/ResourceUsageThread.cpp:
        (WebCore::ResourceUsageThread::notifyObservers):
        (WebCore::ResourceUsageThread::threadBody):
        * page/ResourceUsageThread.h:
        * page/scrolling/ScrollingThread.cpp:
        (WebCore::ScrollingThread::dispatch):
        (WebCore::ScrollingThread::dispatchBarrier):
        (WebCore::ScrollingThread::dispatchFunctionsFromScrollingThread):
        * page/scrolling/ScrollingThread.h:
        * page/scrolling/ios/ScrollingTreeIOS.cpp:
        (WebCore::ScrollingTreeIOS::invalidate):
        (WebCore::ScrollingTreeIOS::scrollingTreeNodeDidScroll):
        (WebCore::ScrollingTreeIOS::currentSnapPointIndicesDidChange):
        (WebCore::ScrollingTreeIOS::createScrollingTreeNode): Deleted.
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeMac::releaseReferencesToScrollerImpsOnTheMainThread):
        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::releaseMemory):
        * platform/audio/ios/MediaSessionManagerIOS.mm:
        (-[WebMediaSessionHelper dealloc]):
        (-[WebMediaSessionHelper startMonitoringAirPlayRoutes]):
        (-[WebMediaSessionHelper stopMonitoringAirPlayRoutes]):
        * platform/graphics/avfoundation/AudioSourceProviderAVFObjC.mm:
        (WebCore::AudioSourceProviderAVFObjC::prepare):
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification):
        (WebCore::MediaPlayerPrivateAVFoundation::dispatchNotification):
        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm:
        (-[WebCDMSessionAVFoundationObjCListener observeValueForKeyPath:ofObject:change:context:]):
        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
        (-[WebAVOutputDeviceMenuControllerHelper observeValueForKeyPath:ofObject:change:context:]):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer):
        (-[WebCoreAVFMovieObserver legibleOutput:didOutputAttributedStrings:nativeSampleBuffers:forItemTime:]):
        (-[WebCoreAVFMovieObserver outputSequenceWasFlushed:]):
        (-[WebCoreAVFLoaderDelegate resourceLoader:shouldWaitForLoadingOfRequestedResource:]):
        (-[WebCoreAVFLoaderDelegate resourceLoader:shouldWaitForResponseToAuthenticationChallenge:]):
        (-[WebCoreAVFLoaderDelegate resourceLoader:didCancelLoadingRequest:]):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::CMTimebaseEffectiveRateChangedCallback):
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::play):
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::pause):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::scheduleDeferredTask):
        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:]):
        (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:withDiscontinuity:]):
        (-[WebAVStreamDataParserListener streamDataParser:didFailToParseStreamDataWithError:]):
        (-[WebAVStreamDataParserListener streamDataParser:didProvideMediaData:forTrackID:mediaType:flags:]):
        (-[WebAVStreamDataParserListener streamDataParser:didReachEndOfTrackWithTrackID:mediaType:]):
        (-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]):
        (-[WebAVSampleBufferErrorListener observeValueForKeyPath:ofObject:change:context:]):
        (-[WebAVSampleBufferErrorListener layerFailedToDecode:]):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::patternReleaseCallback):
        * platform/graphics/cg/PatternCG.cpp:
        (WebCore::patternReleaseCallback):
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::endCreatedMediaSource):
        (WebCore::MediaPlayerPrivateMediaFoundation::endGetEvent):
        (WebCore::MediaPlayerPrivateMediaFoundation::CustomVideoPresenter::processInputNotify):
        * platform/mediastream/MediaStreamPrivate.cpp:
        (WebCore::MediaStreamPrivate::scheduleDeferredTask):
        * platform/mediastream/MediaStreamPrivate.h:
        * platform/mediastream/mac/AVMediaCaptureSource.h:
        * platform/mediastream/mac/AVMediaCaptureSource.mm:
        (WebCore::AVMediaCaptureSource::scheduleDeferredTask):
        * platform/mediastream/mac/RealtimeMediaSourceCenterMac.cpp:
        (WebCore::RealtimeMediaSourceCenterMac::getMediaStreamTrackSources):
        * platform/mediastream/mac/WebAudioSourceProviderAVFObjC.mm:
        (WebCore::WebAudioSourceProviderAVFObjC::prepare):
        * platform/mock/MockRealtimeMediaSourceCenter.cpp:
        (WebCore::MockRealtimeMediaSourceCenter::getMediaStreamTrackSources):
        * platform/network/BlobResourceHandle.cpp:
        (WebCore::BlobResourceHandle::start):
        (WebCore::BlobResourceHandle::notifyFinish):
        * platform/network/DataURLDecoder.cpp:
        (WebCore::DataURLDecoder::decode):
        * platform/network/DataURLDecoder.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession dealloc]):
        (-[WebCoreNSURLSessionDataTask cancel]):
        (-[WebCoreNSURLSessionDataTask suspend]):
        (-[WebCoreNSURLSessionDataTask resume]):
        * platform/network/curl/CurlDownload.cpp:
        (WebCore::CurlDownload::didReceiveHeader):
        (WebCore::CurlDownload::didReceiveData): Deleted.

2016-05-27  Tim Horton  <timothy_horton@apple.com>

        REGRESSION (r190574): Swipe snapshots are always black on iPhone 5
        https://bugs.webkit.org/show_bug.cgi?id=158171
        <rdar://problem/24639709>

        Reviewed by Beth Dakin.

        * platform/graphics/cocoa/IOSurface.mm:
        (optionsForBiplanarSurface):
        (optionsFor32BitSurface):
        (IOSurface::IOSurface):
        (IOSurface::format):
        We are supposed to be using bi-planar 422f, not yuvf. They're the same
        size, but different formats, and 422f is supported in more places.

        Clean up the IOSurface constructor so we don't have a switch inside an if
        with random ASSERT_NOT_REACHED, making helper functions to build the
        options dictionary for arbitrary-size biplanar and 32-bit single-planar
        surfaces.

        I don't know how to write a test because IOSurface is not supported
        in the simulator.

2016-05-27  Zalan Bujtas  <zalan@apple.com>

        EventHandler finds incorrect scrollable container.
        https://bugs.webkit.org/show_bug.cgi?id=158132
        <rdar://problem/26423126>

        Reviewed by Brent Fulgham.

        Fix the logic that checks whether we are at the beginning or at the end of the container (horizontally).
        While scrolling to the right, deltaX has negative values. So in case of deltaX < 0, we need to check if
        the container is not scrolled all the way to the right.

        Test: fast/scrolling/scroll-container-horizontally.html

        * page/mac/EventHandlerMac.mm:
        (WebCore::findEnclosingScrollableContainer):

2016-05-27  Jeremy Jones  <jeremyj@apple.com>

        Decrease flicker when changing video presentation mode.
        https://bugs.webkit.org/show_bug.cgi?id=158148
        rdar://problem/24476949

        Reviewed by Jer Noble.

        No new tests because there is no behavior change. This change is about the timing of
        moving AVPlayerLayers between layers to prevent flicker.

        1) Moving an AVPlayerLayer between CAContexts can flicker. So always keep two
        AVPlayerLayers around and add and remove them from the inline and fullscreen contexts.
        2) Wait to show the inline placeholder until the fullscreen video layer has been installed.
        3) Wait to remove the fullscreen video layer until the placeholder has been removed.

        * Modules/mediacontrols/MediaControlsHost.cpp:
        (WebCore::MediaControlsHost::isVideoLayerInline): Expose isVideoLayerInline to the shadow DOM.
        (WebCore::MediaControlsHost::setPreparedForInline): Expose setPreparedForInline to the shadow DOM.
        * Modules/mediacontrols/MediaControlsHost.h: Add setPreparedForInline and isVideoLayerInline
        * Modules/mediacontrols/MediaControlsHost.idl: Add setPreparedForInline and isVideoLayerInline
        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.showInlinePlaybackPlaceholderWhenSafe): Wait to show placeholder when entering fullscreen.
        (Controller.prototype.handlePresentationModeChange): Wait to show placeholder, and notify when placeholder is removed.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setPreparedForInline):
        (WebCore::HTMLMediaElement::waitForPreparedForInlineThen): Used to delay fullscreen cleanup until placeholder is removed.
        (WebCore::HTMLMediaElement::setVideoFullscreenLayer): Add a callback so we can wait until this completes before continuing.
        * html/HTMLMediaElement.h:
        (WebCore::HTMLMediaElement::isVideoLayerInline):
        (WebCore::HTMLMediaElement::waitForPreparedForInlineThen):
        (WebCore::HTMLMediaElement::setVideoFullscreenLayer): Add completionHandler.
        * platform/cocoa/WebVideoFullscreenModelVideoElement.h:
        (WebCore::WebVideoFullscreenModelVideoElement::setVideoFullscreenLayer): Add completionHandler.
        (WebCore::WebVideoFullscreenModelVideoElement::waitForPreparedForInlineThen): Added.
        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
        (WebVideoFullscreenModelVideoElement::setVideoFullscreenLayer): Add completionHandler.
        (WebVideoFullscreenModelVideoElement::waitForPreparedForInlineThen):
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::setVideoFullscreenLayer): Add completionHandler.
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayer::setVideoFullscreenLayer): Add completionHandler.
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::setVideoFullscreenLayer): Add completionHandler.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer): Create two video layers.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer): Allow two video layers.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenLayer): Add completionHandler.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateVideoLayerGravity): Allow two video layers.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::addDisplayLayer): Allow two video layers.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setVideoFullscreenLayer): Add completionHandler.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::createPreviewLayers): Allow two video layers.
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::setVideoFullscreenLayer): Add completionHandler.
        * platform/graphics/avfoundation/objc/VideoFullscreenLayerManager.h:
        * platform/graphics/avfoundation/objc/VideoFullscreenLayerManager.mm:
        (WebCore::VideoFullscreenLayerManager::setVideoLayers): Allow two video layers.
        (WebCore::VideoFullscreenLayerManager::setVideoFullscreenLayer): Add completionHandler.
        (WebCore::VideoFullscreenLayerManager::setVideoFullscreenFrame): Allow two video layers.
        (WebCore::VideoFullscreenLayerManager::didDestroyVideoLayer): Allow two video layers.
        (WebCore::VideoFullscreenLayerManager::setVideoLayer): Deleted.
        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        (WebVideoFullscreenControllerContext::didSetupFullscreen): Use completionHandler. 
        (WebVideoFullscreenControllerContext::didExitFullscreen): Use completionHandler.

2016-05-26  Ryosuke Niwa  <rniwa@webkit.org>

        Crash in TreeScope::focusedElement
        https://bugs.webkit.org/show_bug.cgi?id=158108

        Reviewed by Enrica Casucci.

        The bug was caused by a flawed sequence of steps we took to remove an element. When an element is removed,
        willRemoveChild and willRemoveChildren fire blur events on removed focused element and its ancestors and
        unload event on any removed iframes. However, it was possible to focus an element on which we had fired blur
        during an unload event, leaving m_focusedElement point to an element that's not in the document anymore.

        Changing the order doesn't help because that would make it possible to insert the removed iframes back into
        the document inside a event listener of the blur event, which was specifically fixed by r127534 four years ago.

        Instead, fix the bug by not firing blur and change events on removed nodes. New behavior matches Firefox and HTML5
        specification: https://html.spec.whatwg.org/multipage/interaction.html#focus-fixup-rule-one

        Test: fast/shadow-dom/shadow-root-active-element-crash.html

        * dom/ContainerNode.cpp:
        (WebCore::willRemoveChild): Made this function static local since it didn't need to have access to any private
        member variables. Call Document::nodeWillBeRemoved after disconnecting iframes since unload event handler could
        allocate new Ranges just like mutation events.
        (WebCore::willRemoveChildren): Ditto.
        (WebCore::ContainerNode::removeChild): Removed the calls to removeFullScreenElementOfSubtree and
        removeFocusedNodeOfSubtree as they're now called in Document::nodeWillBeRemoved.
        (WebCore::ContainerNode::removeChildren): Ditto.
        * dom/ContainerNode.h:
        * dom/Document.cpp:
        (WebCore::Document::removeFocusedNodeOfSubtree): Don't dispatch blur and change events when a node is removed.
        (WebCore::Document::setFocusedElement): Added FocusRemovalEventsMode as the third argument. Avoid dispatching blur
        and change events when FocusRemovalEventsMode::Dispatch is set.
        (WebCore::Document::nodeChildrenWillBeRemoved): Added calls to removeFullScreenElementOfSubtree and
        removeFocusedNodeOfSubtree. Also assert that no events are fired within this function. If we ever fire an event here,
        "unloaded" iframes can be inserted back into a document before ContainerNode::removeChild actually removes them.
        (WebCore::Document::nodeWillBeRemoved): Ditto.
        * dom/Document.h:
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::focusedElement): Added a release assertion to make sure the focused element is in the document
        of the tree scope, and added an explicit type check just in case.

2016-05-27  Brent Fulgham  <bfulgham@apple.com>

        CSP: Fire 'load' events even when blocking loads via 'frame-src'.
        https://bugs.webkit.org/show_bug.cgi?id=153150
        <rdar://problem/24383162>

        Reviewed by Daniel Bates.

        Always fire a load event, even when the load is blocked by CSP rules, so that
        attackers cannot gain knowledge about the URL in the frame by blocking the
        load and waiting long enough to be sure that a 'load' event would have
        fired if the load wasn't blocked.

        Inspired by Blink patch:
        <https://src.chromium.org/viewvc/blink?view=rev&revision=165743>

        Tests: http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load.html

        * loader/PolicyChecker.cpp:
        (WebCore::PolicyChecker::checkNavigationPolicy):

2016-05-27  Andreas Kling  <akling@apple.com>

        Document abandons its EventTargetData.
        <https://webkit.org/b/158158>

        Reviewed by Darin Adler.

        Node::willBeDeletedFrom() is called when destroying all Node types *except* Document.
        If a Document had an associated EventTargetData, it would not get cleaned up.

        This patch moves the EventTargetData cleanup to ~Node() where it's guaranteed to run.

        * dom/Node.cpp:
        (WebCore::Node::~Node):
        (WebCore::Node::willBeDeletedFrom):

2016-05-27  Ryan Haddad  <ryanhaddad@apple.com>

        Attempt to fix the iOS build.

        Unreviewed build fix.

        * platform/graphics/cocoa/TextTrackRepresentationCocoa.mm:
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (-[WebAVPlayerLayer layoutSublayers]):

2016-05-27  Brady Eidson  <beidson@apple.com>

        Modern IDB: After closing a Netflix video, trying to watch it again fails.
        <rdar://problem/25092473> and https://bugs.webkit.org/show_bug.cgi?id=158160

        Reviewed by Alex Christensen.

        New APITest: IndexedDB.WebProcessKillIDBCleanup

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::stop):
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::connectionClosedFromClient): All active transactions need to be aborted
          (without callback, since there's no connection to callback to).
        (WebCore::IDBServer::UniqueIDBDatabase::takeNextRunnableTransaction):

2016-05-27  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Update RTCPeerConnection overloaded legacy operations to return a Promise
        https://bugs.webkit.org/show_bug.cgi?id=158114

        Reviewed by Eric Carlson.

        Update overloaded operations so that the legacy callback versions also return a promise
        and never throw [1].

        [1] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html#legacy-interface-extensions

        Updated existing tests.
        - fast/mediastream/RTCPeerConnection-overloaded-operations-params.html
        - fast/mediastream/RTCPeerConnection-overloaded-operations.html

        * Modules/mediastream/RTCPeerConnection.idl:
        Updated legacy signatures (just for documentation purposes)
        * Modules/mediastream/RTCPeerConnection.js:
        Implements the promise overload and the legacy callbacks overload (using the promise version)
        as specified in [1] (above).
        (createOffer):
        (createAnswer):
        (setLocalDescription):
        (setRemoteDescription):
        (addIceCandidate):
        (getStats):
        * Modules/mediastream/RTCPeerConnectionInternals.js:
        Added helper functions objectAndCallbacksOverload and callbacksAndDictionaryOverload that
        process an argument list and determine which overloaded version to use.
        (callbacksAndDictionaryOverload):
        (setLocalOrRemoteDescription): Deleted.
        (extractCallbackArg): Deleted.

2016-05-27  Antoine Quint  <graouts@apple.com>

        Video play glyph not visible if initially invisible when contained in a "-webkit-overflow-scrolling: touch" container
        https://bugs.webkit.org/show_bug.cgi?id=158146
        <rdar://problem/25816307>

        Reviewed by Dean Jackson.

        We now force the <video> controls play glyph into being composited due to webkit.org/b/158147. In most scenarios,
        this element gets composited anyway, this is just to ensure that this happens in all cases until we get the
        general fix for webkit.org/b/158147.

        Test: platform/ios-simulator/media/video-play-glyph-composited-outside-overflow-scrolling-touch-container.html

        * Modules/mediacontrols/mediaControlsiOS.css:
        (video::-webkit-media-controls-start-playback-button .webkit-media-controls-start-playback-glyph):

2016-05-26  Yoav Weiss  <yoav@yoav.ws>

        Preload single download tests.
        https://bugs.webkit.org/show_bug.cgi?id=157988

        Reviewed by Alex Christensen.

        ResourceTiming entries for some subresource weren't registered as resource->response().isHTTP() was false, since
        resource->response().url() was empty. I switched the check to use resource->resourceRequest().url() directly instead.

        Test: http/tests/preload/single_download_preload_runner.html

        * loader/ResourceTimingInformation.cpp:
        (WebCore::ResourceTimingInformation::addResourceTiming):

2016-05-26  Nan Wang  <n_wang@apple.com>

        AX: Wrong CharacterOffset from VisiblePosition with composed characters
        https://bugs.webkit.org/show_bug.cgi?id=158138

        Reviewed by Chris Fleizach.

        The conversion logic is not correct when the text node contains composed characters. 
        We should use VisiblePosition's offset directly for text nodes so we won't mess things up.

        Test: accessibility/mac/character-offset-visible-position-conversion-with-emoji.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::visiblePositionFromCharacterOffset):
        (WebCore::AXObjectCache::characterOffsetFromVisiblePosition):

2016-05-26  Darin Adler  <darin@apple.com>

        Media queries and platform screen modernization and streamlining
        https://bugs.webkit.org/show_bug.cgi?id=158067

        Reviewed by Alex Christensen.

        * bindings/objc/DOM.mm:
        (-[DOMHTMLLinkElement _mediaQueryMatches]): Use references, use fastGetAttribute,
        pass a document instead of a frame to the media query evaluator and a reference instead
        of a pointer.

        * css/CSSGrammar.y.in: Use "expression" instead of "exp" for media query expressions.
        Update vectors and arguments to move media query expressions instead of using unique_ptr.

        * css/CSSImportRule.h: Use pragma once. Removed unneeded forward declarations.
        Made more overrides private and marked them final.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::SourceSize::SourceSize): Added missing WTFMove to avoid reference
        count churn. Changed type of expression to no longer use unique_ptr.
        (WebCore::CSSParser::sourceSize): Ditto.

        * css/CSSParser.h: Changed SourceSize::expression to no longer use unique_ptr.
        Also changed SourceSize::length to be Ref instead of RefPtr.

        * css/DocumentRuleSets.cpp:
        (WebCore::DocumentRuleSets::appendAuthorStyleSheets): Updated for changes to
        MediaQueryEvaluator.

        * css/MediaFeatureNames.cpp:
        (WebCore::MediaFeatureNames::init): Streamlined a bit. Removed "MediaFeature" suffix from
        names of media feature strings.

        * css/MediaFeatureNames.h: Use pragma once. Changed media feature name globals
        to use normal WebKit naming style instead of all lowercase with underscores.
        Sorted alphabetically. Removed "MediaFeature" suffix from names of media feature strings.

        * css/MediaList.cpp:
        (WebCore::MediaQuerySet::MediaQuerySet): Simplified copy constructor since the queries
        vector can now be copied normally.
        (WebCore::parseMediaDescriptor): Normalized types and changed to use isASCIIAlphanumeric.
        The old code was not handling '0' the way the comment said it did.
        (WebCore::MediaQuerySet::internalParse): Added. Helper function to cut down on redundant
        code in functions below.
        (WebCore::MediaQuerySet::parse): Use stripLeadingAndTrailingHTMLSpaces instead of
        stripWhiteSpace. Streamlined logic using helper function. Updated to use a vector of
        queries instead of a vector of unique_ptr.
        (WebCore::MediaQuerySet::add): Use internalParse.
        (WebCore::MediaQuerySet::remove): Ditto.
        (WebCore::MediaQuerySet::addMediaQuery): Changed argument type to not be unique_ptr.
        (WebCore::MediaQuerySet::mediaText): Use modern for loop.
        (WebCore::MediaList::MediaList): Initialize pointers to null in the class definition
        rather than in these constructors.
        (WebCore::MediaList::setMediaText): Removed unhelpful local variable.
        (WebCore::MediaList::item): Updated since queries no longer use unique_ptr.
        (WebCore::addResolutionWarningMessageToConsole): Changed argument types to references
        instead of pointers with assertions.
        (WebCore::reportMediaQueryWarningIfNeeded): Updated to modernize.

        * css/MediaList.h: Use pragma once. Removed unneeded includes and forward declarations.
        Changed vector to contain media queries instead of unique_ptr. Use nullptr instead of 0.
        Initialize pointers to null here.

        * css/MediaQuery.cpp: Deleted now-unneeded copy constructor and destructor. Both are
        correctly generated without us writing them explicitly.
        (WebCore::MediaQuery::serialize): Rewrote to streamline.
        (WebCore::MediaQuery::MediaQuery): Updates since expressions are no longer unique_ptr.
        (WebCore::MediaQuery::cssText): Changed return type to reference.

        * css/MediaQuery.h: Use pragma once. Added include since this now includes media query
        expressions, not just unique_ptr. Deleted the unneeded copy function.

        * css/MediaQueryEvaluator.cpp:
        (WebCore::isViewportDependent): Moved this here. It used to be a member function of
        MediaQueryExp, but this file has a lot more functions about specific features and how
        they are evaluated, so it really belongs here.
        (WebCore::MediaQueryEvaluator::MediaQueryEvaluator): Changed constructor to take a
        document instead of a frame. Initialize the fallback result in the class definition.
        (WebCore::MediaQueryEvaluator::evaluate): Changed the argument type to a reference.
        (WebCore::compareValue): Made both of the arguments separate template types. This
        helps us compare an integer to a double without lots of type casts.
        (WebCore::compareAspectRatioValue): Changed to use early return style and got rid of
        the casts to int so we will do the work in double instead.
        (WebCore::doubleValue): Replaced the old numberValue function with this. Since values
        are stored as doubles, it's much better to use double rather than float.
        (WebCore::zeroEvaluate): Added. Helpful for the many functions that just need to
        evaluate as 0.
        (WebCore::oneEvaluate): Ditto.
        (WebCore::colorEvaluate): Renamed this and all the functions below. Simplified the logic
        to use the new doubleValue function.
        (WebCore::colorIndexEvaluate): Use zeroEvaluate.
        (WebCore::colorGamutEvaluate): No longer use page just to get from the frame to the
        main frame.
        (WebCore::monochromeEvaluate): Simplify logic using zeroEvaluate.
        (WebCore::invertedColorsEvaluate): Use auto for the keyword; easier to read.
        (WebCore::orientationEvaluate): Use early return style.
        (WebCore::aspectRatioEvaluate): Ditto.
        (WebCore::deviceAspectRatioEvaluate): Simplified logic and removed type casts.
        (WebCore::evaluateResolution): Added a couple null checks.
        (WebCore::devicePixelRatioEvaluate): Renamed. Added missing type check.
        (WebCore::resolutionEvaluate): Ditto.
        (WebCore::gridEvaluate): Use zeroEvaluate.
        (WebCore::computeLength): Added a null check.
        (WebCore::deviceHeightEvaluate): Use early return.
        (WebCore::deviceWidthEvaluate): Ditto.
        (WebCore::heightEvaluate): Ditto.
        (WebCore::widthEvaluate): Ditto.
        (WebCore::minColorEvaluate): Updated name only.
        (WebCore::maxColorEvaluate): Ditto.
        (WebCore::minColorIndexEvaluate): Ditto.
        (WebCore::maxColorIndexEvaluate): Ditto.
        (WebCore::minMonochromeEvaluate): Ditto.
        (WebCore::maxMonochromeEvaluate): Ditto.
        (WebCore::minAspectRatioEvaluate): Ditto.
        (WebCore::maxAspectRatioEvaluate): Ditto.
        (WebCore::minDeviceAspectRatioEvaluate): Ditto.
        (WebCore::maxDeviceAspectRatioEvaluate): Ditto.
        (WebCore::minDevicePixelRatioEvaluate): Ditto.
        (WebCore::maxDevicePixelRatioEvaluate): Ditto.
        (WebCore::minHeightEvaluate): Ditto.
        (WebCore::maxHeightEvaluate): Ditto.
        (WebCore::minWidthEvaluate): Ditto.
        (WebCore::maxWidthEvaluate): Ditto.
        (WebCore::minDeviceHeightEvaluate): Ditto.
        (WebCore::maxDeviceHeightEvaluate): Ditto.
        (WebCore::minDeviceWidthEvaluate): Ditto.
        (WebCore::maxDeviceWidthEvaluate): Ditto.
        (WebCore::minResolutionEvaluate): Ditto.
        (WebCore::maxResolutionEvaluate): Ditto.
        (WebCore::animationEvaluate): Use oneEvaluate.
        (WebCore::transitionEvaluate): Ditto.
        (WebCore::transform2dEvaluate): Ditto.
        (WebCore::transform3dEvaluate): Simplify using zeroEvaluate and oneEvaluate.
        (WebCore::viewModeEvaluate): Simplified logic with fewer local variables and the name "keyword".
        (WebCore::videoPlayableInlineEvaluate): Use reference.
        (WebCore::hoverEvaluate): Simplify using keyword.
        (WebCore::anyHoverEvaluate): Just updated name.
        (WebCore::pointerEvaluate): Simplify using keyword.
        (WebCore::anyPointerEvaluate): Just updated name.
        (WebCore::add): Added. Helper for building up the media query function map.
        (WebCore::MediaQueryEvaluator::evaluate): Moved code to build the function map in here in
        a lambda, rather than having it in a separate global function.

        * css/MediaQueryEvaluator.h: Use pragma once. Removed uneeded includes. Simplified comments and
        modernized their style.

        * css/MediaQueryExp.cpp:
        (WebCore::isFeatureValidWithIdentifier): Renamed to make it clearer what this does. Updated
        to take a reference and use te new feature names.
        (WebCore::isFeatureValidWithNonNegativeLengthOrNumber): Ditto.
        (WebCore::isFeatureValidWithDensity): Ditto.
        (WebCore::isFeatureValidWithNonNegativeInteger): Ditto.
        (WebCore::isFeatureValidWithNonNegativeNumber): Ditto.
        (WebCore::isFeatureValidWithZeroOrOne): Ditto.
        (WebCore::isAspectRatioFeature): Ditto.
        (WebCore::isFeatureValidWithoutValue): Ditto.
        (WebCore::isFeatureValidWithNumberWithUnit): Added. Helper that calls multiple functions above.
        (WebCore::isFeatureValidWithNumber): Ditto.
        (WebCore::isSlash): Added. Helper to make aspect ratio code below easier to read.
        (WebCore::isPositiveIntegerValue): Ditto.
        (WebCore::MediaQueryExpression::MediaQueryExpression): Rearranged code to be much less wordy and
        to not use current/next.

        * css/MediaQueryExp.h: Use pragma once. Renamed class to MediaQueryExpression. Removed
        the isViewportDependent function, now part of MediaQueryEvaluator. Removed unneeded includes.

        * css/MediaQueryList.cpp:
        (WebCore::MediaQueryList::MediaQueryList): Marked this inline. Use a reference and a Ref&&
        instead of PassRefPtr.
        (WebCore::MediaQueryList::create): Updated argument types.
        (WebCore::MediaQueryList::addListener): Updated argument type and use releaseNonNull.
        (WebCore::MediaQueryList::removeListener): Updated argument types.
        (WebCore::MediaQueryList::evaluate): Ditto.
        (WebCore::MediaQueryList::matches): More of the same.

        * css/MediaQueryList.h: Use pragma once. Changed types to use references, RefPtr&& and Ref&&.

        * css/MediaQueryMatcher.cpp:
        (WebCore::MediaQueryMatcher::MediaQueryMatcher): Take a reference.
        (WebCore::MediaQueryMatcher::documentDestroyed): Use nullptr.
        (WebCore::MediaQueryMatcher::documentElementUserAgentStyle): Use auto.
        (WebCore::MediaQueryMatcher::evaluate): Take a reference. Updated for changes to MediaQueryEvaluator.
        (WebCore::MediaQueryMatcher::matchMedia): Updated for above changes.
        (WebCore::MediaQueryMatcher::addListener): Use Ref&& and reference for arguments. Simplify code.
        (WebCore::MediaQueryMatcher::removeListener): Ditto.
        (WebCore::MediaQueryMatcher::styleResolverChanged): Moved the logic for evaluating each query here.
        Updated for changes to MediaQueryEvaluator.

        * css/MediaQueryMatcher.h: Use pragma once. Changed create to take a reference. Tightened argument
        types for addListener and removeListener. Made the private Listener a simple struct rather than a
        class. Initialized m_evaluationRound.

        * css/RuleSet.cpp:
        (WebCore::RuleSet::addChildRules): Updated for changes to MediaQueryEvaluator.
        (WebCore::RuleSet::addRulesFromSheet): Ditto.

        * css/SourceSizeList.cpp:
        (WebCore::match): Updated to use MediaQueryEvaluator in a simpler way.
        (WebCore::defaultLength): Use a reference and simpler syntax.
        (WebCore::computeLength): Ditto.
        (WebCore::parseSizesAttribute): Changed arguments to take a Document instead of both a
        RenderView and a Frame.

        * css/SourceSizeList.h: Use #pragma once. Change parseSizesAttribute to take a Document.

        * css/StyleMedia.cpp:
        (WebCore::StyleMedia::matchMedium): Update for changes to MediaQueryEvaluator.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::StyleResolver): Use a MediaQueryEvaluator instead of a unique_ptr
        to one.
        (WebCore::StyleResolver::appendAuthorStyleSheets): Ditto.
        (WebCore::StyleResolver::styleForElement): Ditto.
        (WebCore::StyleResolver::pseudoStyleForElement): Ditto.
        (WebCore::StyleResolver::pseudoStyleRulesForElement): Ditto.
        (WebCore::StyleResolver::addViewportDependentMediaQueryResult): Use references instead of
        ponters, and use a vector of MediaQueryResult instead of unique_ptr.
        (WebCore::StyleResolver::hasMediaQueriesAffectedByViewportChange): Use a modern for loop.

        * css/StyleResolver.h: Use a MediaQueryEvaluator instead of a unique_ptr to one.
        Use a vector of MediaQueryResult instead of a vector of unique_ptr.

        * dom/Document.cpp:
        (WebCore::Document::mediaQueryMatcher): Pass a reference instead of a pointer.

        * dom/InlineStyleSheetOwner.cpp:
        (WebCore::InlineStyleSheetOwner::createSheet): Updated for changes to MediaQueryEvaluator.

        * editing/TextIterator.cpp:
        (WebCore::SimplifiedBackwardsTextIterator::advance): Removed a stray space (unrelated to
        the rest of the patch).

        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::bestFitSourceFromPictureElement): Updated for changes to the
        MediaQueryEvaluator class. Also use auto a bit more and eliminated a double hash table
        lookup in code that used hasAttribute followed by fastGetAttribute.
        (WebCore::HTMLImageElement::selectImageSource): Updated for changes to parseSizesAttribute.

        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::process): Updated for changes to MediaQueryEvaluator.
        (WebCore::HTMLLinkElement::setCSSStyleSheet): Use auto.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::selectNextSourceChild): Updated for changes to MediaQueryEvaluator.

        * html/HTMLPictureElement.cpp:
        (WebCore::HTMLPictureElement::viewportChangeAffectedPicture): Updated for changes to
        MediaQueryEvaluator.

        * html/HTMLPictureElement.h: Use #pragma once. Changed viewport dependent media query results
        vector to be a vector of results, not of unique_ptr.

        * html/parser/HTMLPreloadScanner.cpp:
        (WebCore::TokenPreloadScanner::StartTagScanner::processAttributes): Updated for changes to
        parseSizesAttribute.
        (WebCore::TokenPreloadScanner::StartTagScanner::processAttribute): Updated for changes to
        MediaQueryEvaluator.

        * html/parser/HTMLResourcePreloader.cpp:
        (WebCore::mediaAttributeMatches): Updated for changes to MediaQueryEvaluator.
        (WebCore::HTMLResourcePreloader::preload): Ditto.

        * page/DOMWindow.cpp: Removed unneeded include of PlatformScreen.h.

        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::effectiveMousePositionForSelectionAutoscroll): Simplified code and
        updated for changes to PlatformScreenMac functions.

        * platform/PlatformScreen.h: Use #pragma once. Use using instad of typedef. Put the typedef
        for PlatformDisplayID inside the WebCore namespace. Removed the typedef for ColorProfile.
        Renamed the functions that find a screen to just "screen".

        * platform/graphics/DisplayRefreshMonitorClient.cpp:
        (WebCore::DisplayRefreshMonitorClient::DisplayRefreshMonitorClient): Moved initialization
        of booleans to the class definition.

        * platform/graphics/DisplayRefreshMonitorClient.h: Use pragma once. Removed unneeded
        forward declarations. Changed display ID data member to be an Optional instead of a boolean
        paired with another data member.

        * platform/graphics/GraphicsLayerUpdater.h: Use pragma once. Removed unneeded include of
        PlatformScreen.h.

        * platform/image-decoders/ImageDecoder.h: Use pragma once. Moved ColorProfile here from
        PlatformScreen.h, since it's not used there. and is used here.

        * platform/mac/PlatformEventFactoryMac.h: Use parma once. Changed reutrn type of the
        globalPoint function to NSPoint. Tweaked comments and formatting a bit.

        * platform/mac/PlatformEventFactoryMac.mm:
        (WebCore::globalPoint): Changed return type to NSPoint and so removed the explicit
        conversion to IntPoint.
        (WebCore::globalPointForEvent): Changed return type to NSPoint.
        (WebCore::PlatformMouseEventBuilder::PlatformMouseEventBuilder): Moved conversion to
        IntPoint in here. Also got rid of special indenting style and just indented normally.
        (WebCore::PlatformWheelEventBuilder::PlatformWheelEventBuilder): Ditto.
        (WebCore::PlatformKeyboardEventBuilder::PlatformKeyboardEventBuilder): Ditto.

        * platform/mac/PlatformScreenMac.mm:
        (WebCore::displayID): Renamed from displayIDFromScreen and displayFromWidget since this
        is C++ and we have overloading to determine the types of arguments. Added a null check
        of the how dinwo pointer.
        (WebCore::firstScreen): Added. Helper used below.
        (WebCore::window): Added. Helper used below.
        (WebCore::screen): Renamed from screenForWidget and screenFromWindow and removed the
        unneeded window argument from the widget version.
        (WebCore::screenDepth): Simplified, using new helpers.
        (WebCore::screenDepthPerComponent): Ditto.
        (WebCore::screenIsMonochrome): Tweaked comment.
        (WebCore::screenHasInvertedColors): Ditto.
        (WebCore::screenRect): Simplified using new elpers.
        (WebCore::screenAvailableRect): Ditto.
        (WebCore::screenSupportsExtendedColor): Streamlined using fewer local variables and
        using auto for types of the results of adoptCF.
        (WebCore::toUserSpace): Updated for function name changes.
        (WebCore::toDeviceSpace): Ditto.

2016-05-26  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Purge PassRefPtr in Modules/battery
        https://bugs.webkit.org/show_bug.cgi?id=157062

        Reviewed by Darin Adler.

        Use RefPtr<>& to reduce uses of PassRefPtr in WebKit.

        * Modules/battery/BatteryClient.h:
        * Modules/battery/BatteryController.cpp:
        (WebCore::BatteryController::BatteryController):
        (WebCore::BatteryController::~BatteryController):
        (WebCore::BatteryController::addListener):
        (WebCore::BatteryController::removeListener):
        (WebCore::BatteryController::updateBatteryStatus):
        (WebCore::BatteryController::didChangeBatteryStatus):
        (WebCore::provideBatteryTo):
        * Modules/battery/BatteryController.h:
        * Modules/battery/BatteryManager.cpp:
        (WebCore::BatteryManager::didChangeBatteryStatus):
        (WebCore::BatteryManager::updateBatteryStatus):
        * Modules/battery/BatteryManager.h:
        * Modules/battery/BatteryStatus.h:
        * testing/Internals.cpp:
        (WebCore::Internals::setBatteryStatus):

2016-05-25  Ada Chan  <adachan@apple.com>

        Add WebKitAdditions extension point in HTMLMediaElement.
        https://bugs.webkit.org/show_bug.cgi?id=158097

        Reviewed by Eric Carlson.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::shouldOverrideBackgroundLoadingRestriction):
        We need to load data in the background if playing to wireless playback target.
        (WebCore::HTMLMediaElement::fullscreenModeChanged):
        Moved from header file.
        * html/HTMLMediaElement.h:

        * platform/audio/PlatformMediaSession.cpp:
        (WebCore::PlatformMediaSession::clientWillPausePlayback):
        The code to start m_clientDataBufferingTimer is also in visibilityChanged().
        Moved that code to PlatformMediaSession::scheduleClientDataBufferingCheck() and call
        that method here.
        (WebCore::PlatformMediaSession::visibilityChanged):
        Call PlatformMediaSession::scheduleClientDataBufferingCheck().
        (WebCore::PlatformMediaSession::scheduleClientDataBufferingCheck):
        Start m_clientDataBufferingTimer if it's not already active.
        (WebCore::PlatformMediaSession::shouldOverrideBackgroundLoadingRestriction):
        Call the client.

        * platform/audio/PlatformMediaSession.h:
        (WebCore::PlatformMediaSessionClient::shouldOverrideBackgroundLoadingRestriction):

        * platform/audio/PlatformMediaSessionManager.cpp:
        (WebCore::PlatformMediaSessionManager::sessionCanLoadMedia):
        Call the new PlatformMediaSession::shouldOverrideBackgroundLoadingRestriction().

2016-05-26  Jer Noble  <jer.noble@apple.com>

        Use std::atomic<> rather than OSAtomicIncrement in CARingBuffer.cpp
        https://bugs.webkit.org/show_bug.cgi?id=158129

        Reviewed by Eric Carlson.

        std::atomic is a more portable atomic primitive than OSAtomicIncrement.

        * platform/audio/mac/CARingBuffer.cpp:
        (WebCore::CARingBuffer::setCurrentFrameBounds):
        (WebCore::CARingBuffer::getCurrentFrameBounds):
        (WebCore::CARingBuffer::currentStartFrame):
        (WebCore::CARingBuffer::currentEndFrame):
        * platform/audio/mac/CARingBuffer.h:

2016-05-26  Ryan Haddad  <ryanhaddad@apple.com>

        Rebaseline bindings tests after r201428

        Unreviewed test gardening.

        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjReplaceableAttribute):

2016-05-25  Geoffrey Garen  <ggaren@apple.com>

        replaceable own properties seem to ignore replacement after property caching
        https://bugs.webkit.org/show_bug.cgi?id=158091

        Reviewed by Darin Adler.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation): Use our new replacement helper if we're replacing
        an own static property with an own direct property. Because we advertise
        that our own static properties are cacheable, we need to do a structure
        transition to indicate when they change. (Only own properties need this 
        special treatment because JSC considers it normal to shadow a prototype
        property with an own property.)

2016-05-26  Said Abou-Hallawa  <sabouhallawa@apple,com>

        BitmapImage::checkForSolidColor() cleanup
        https://bugs.webkit.org/show_bug.cgi?id=157750

        Reviewed by Darin Adler.

        Have a single implementation for BitmapImage::checkForSolidColor(). Create
        a new function named NativeImage::solidColor() and call it from the former
        one. The goal is to have the platform files contain only the platform dependent
        code rather than repeating the platform independent code multiple times.

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::destroyMetadataAndNotify): Invalidate m_solidColor.
        (WebCore::BitmapImage::singlePixelSolidColor): Combine mayFillWithSolidColor(),
        checkForSolidColor() and solidColor() in one function to guarantee the validity
        of the returned value. Before, if solidColor() is called without calling
        mayFillWithSolidColor() or checkForSolidColor(), the returned value would be
        incorrect.
        
        (WebCore::BitmapImage::dump): Use the m_solidColor Optional and Color states.
        (WebCore::BitmapImage::mayFillWithSolidColor): Deleted.
        (WebCore::BitmapImage::solidColor): Deleted.
        
        * platform/graphics/BitmapImage.h: Delete m_checkedForSolidColor and
        m_isSolidColor and change m_solidColor to be Optional<Color>.
        
        * platform/graphics/Image.cpp:
        (WebCore::Image::drawTiled): Use singlePixelSolidColor() and check the returned
        value to know whether the singe pixel solid color optimization applies or not.
        
        * platform/graphics/Image.h:
        (WebCore::Image::singlePixelSolidColor):
        (WebCore::Image::mayFillWithSolidColor): Deleted.
        (WebCore::Image::solidColor): Deleted.
        Replace mayFillWithSolidColor() and solidColor() with a single function named
        singlePixelSolidColor(). isValid() of the returned Color can be used to tell
        whether the singe pixel solid color optimization applies or not.
        
        * platform/graphics/cairo/BitmapImageCairo.cpp:
        (WebCore::NativeImage::singlePixelSolidColor):
        (WebCore::BitmapImage::draw):
        (WebCore::BitmapImage::checkForSolidColor): Deleted.
        Delete the platform dependent BitmapImage::checkForSolidColor() and add
        the new platform dependent function NativeImage::singlePixelSolidColor() and
        use to know whether the singe pixel solid color optimization applies or not.
        
        * platform/graphics/cg/BitmapImageCG.cpp:
        (WebCore::NativeImage::singlePixelSolidColor):
        (WebCore::BitmapImage::draw):
        (WebCore::BitmapImage::checkForSolidColor): Deleted.
        Ditto.

2016-05-26  Pranjal Jumde  <pjumde@apple.com>

        Sites served over insecure connections should not be allowed to use geolocation.
        https://bugs.webkit.org/show_bug.cgi?id=157423
        <rdar://problem/23751632>

        Reviewed by Brent Fulgham.

        Tests: http/tests/security/insecure-geolocation.html
               http/tests/security/mixedcontent-geolocation-block-insecure-content.html
               http/tests/security/mixedcontent-geolocation.html

        * Modules/geolocation/Geolocation.cpp:
        (WebCore::logError):
        Logs an error to the console if geolocation is blocked.
        (WebCore::Geolocation::startRequest):
        Access to Geolocation will be blocked if site is not secure. An error will be logged when access to Geolocation is blocked.
        (WebCore::Geolocation::shouldBlockGeolocationRequests)
        Returns true if the access to geolocation should be blocked.
        * Modules/geolocation/Geolocation.h:
        * dom/SecurityContext.h:
        (WebCore::SecurityContext::foundMixedContent):
        Returns true if insecure content was accessed over secure connection.
        (WebCore::SecurityContext::setFoundMixedContent):
        Sets m_foundMixedContent to true if insecure content is accessed over secure connection.
        (WebCore::SecurityContext::geolocationAccessed):
        Returns true if geolocation was accessed
        (WebCore::SecurityContext::setGeolocationAccessed):
        Sets m_geolocationAccessed to true if geolocation was accessed.
        * loader/MixedContentChecker.cpp:
        (WebCore::MixedContentChecker::canDisplayInsecureContent):
        Insecure content will be blocked if geolocation was accessed by the page. Updates document to keep track of mixed content.
        (WebCore::MixedContentChecker::canRunInsecureContent):
        Insecure content will be blocked if geolocation was accessed by the page. Updates document to keep track of mixed content.

2016-05-26  Brady Eidson  <beidson@apple.com>

        Implement internals.observeGC to get called back when a Javascript object is GC'ed.
        https://bugs.webkit.org/show_bug.cgi?id=158093

        Reviewed by Geoffrey Garen.

        Test: js/test-observegc.html

        * CMakeLists.txt:
        * DerivedSources.make:
        * WebCore.xcodeproj/project.pbxproj:

        * testing/GCObservation.cpp: Added.
        (WebCore::GCObservation::GCObservation):
        * testing/GCObservation.h: Added.
        * testing/GCObservation.idl: Added.

        * testing/Internals.cpp:
        (WebCore::Internals::observeGC):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-05-26  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] Allow empty strings in FontFace constructor
        https://bugs.webkit.org/show_bug.cgi?id=158112

        Reviewed by Darin Adler.

        Other browsers accept empty strings and parse them as if they are omitted.
        We should do the same. However, this is only true for the constructor. Setting
        an attribute to an empty string should still throw an exception.

        Test: fast/text/font-face-empty-string.html

        * css/FontFace.cpp:
        (WebCore::FontFace::create):
        (WebCore::FontFace::setFamily):
        (WebCore::FontFace::setStyle):
        (WebCore::FontFace::setWeight):
        (WebCore::FontFace::setUnicodeRange):
        (WebCore::FontFace::setVariant):
        (WebCore::FontFace::setFeatureSettings):

2016-05-26  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: RTCSessionDescription: Make attributes readonly (and remove custom binding)
        https://bugs.webkit.org/show_bug.cgi?id=157858

        Reviewed by Eric Carlson.

        Align RTCSessionDescription type with WebRTC 1.0 specification [1].
        - Make constructor dictionary member mandatory
        - Align constructor dictionary argument (RTCSessionDescriptionInit) with [1]
        - Use RTCSdpType enum for the type attribute
        - Remove custom binding

        [1] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html

        Updated existing test.

        * CMakeLists.txt:
        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::createOfferTask):
        * Modules/mediastream/RTCSessionDescription.cpp:
        (WebCore::parseTypeString):
        (WebCore::RTCSessionDescription::create):
        (WebCore::RTCSessionDescription::RTCSessionDescription):
        (WebCore::verifyType): Deleted.
        (WebCore::RTCSessionDescription::setType): Deleted.
        * Modules/mediastream/RTCSessionDescription.h:
        (WebCore::RTCSessionDescription::type):
        * Modules/mediastream/RTCSessionDescription.idl:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSRTCSessionDescriptionCustom.cpp: Removed.
        (WebCore::constructJSRTCSessionDescription): Deleted.

2016-05-26  Alejandro G. Castro  <alex@igalia.com>

        NativeToJSValue is harcoding the $thisValue in some strings
        https://bugs.webkit.org/show_bug.cgi?id=158113

        Reviewed by Darin Adler.

        Replaced the string with the variable value.

        Updated the tests results in the bindings.

        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): Replaced the hardcoded string with the variable
        value.
        * bindings/scripts/test/JS/JSTestCallback.cpp:
        (WebCore::JSTestCallback::callbackWithSerializedScriptValueParam):
        * bindings/scripts/test/JS/JSTestCallbackFunction.cpp:
        (WebCore::JSTestCallbackFunction::callbackWithSerializedScriptValueParam):

2016-05-26  Frederic Wang  <fwang@igalia.com>

        Small improvements to RenderBox/LayoutUnit casting in MathML
        https://bugs.webkit.org/show_bug.cgi?id=157943

        Reviewed by Darin Adler.

        This is a small follow-up of the RenderMathMLRow/RenderMathMLUnderOver/RenderMathMLFraction
        refactoring. Since these MathML renderers can only contain other MathML renderers, we can
        just considerer RenderBox children and avoid unnecessary casts. Similarly, when the two
        arguments of std::max are LayoutUnit's, we do not need to specialize to std::max<LayoutUnit>.

        No new tests, behavior is not changed.

        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::layoutBlock): Do not to specialize to std::max<LayoutUnit>.
        * rendering/mathml/RenderMathMLRow.cpp:
        (WebCore::RenderMathMLRow::updateOperatorProperties): Browse the list of RenderBox children
        and use auto*.
        (WebCore::RenderMathMLRow::computeLineVerticalStretch): Do not to specialize to std::max<LayoutUnit>.
        * rendering/mathml/RenderMathMLUnderOver.cpp:
        (WebCore::RenderMathMLUnderOver::unembellishedOperator): Get the RenderBox child and use auto*.
        (WebCore::RenderMathMLUnderOver::computeOperatorsHorizontalStretch): Browse the list of
        RenderBox children, use auto* and remove unnecessary casts. Do not to specialize to
        std::max<LayoutUnit>.

2016-05-26  Chris Fleizach  <cfleizach@apple.com>

        AX: crash at AccessibilityRenderObject::remoteSVGRootElement const
        https://bugs.webkit.org/show_bug.cgi?id=158098

        Reviewed by Joanmarie Diggs.

        What looks like happens here is that when a document is torn down and we try to detach, we end up creating an accessibility element during detachment phase.
        So instead of just clearing the callback pointer on an existing AXObject, we make a new object and access properties of an object being deallocated.

        I tried very hard to make a test but it looks like this can really only be triggered during document tear down which also tears down the AXObjectCache. I didn't
        have luck reproducing because of that.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::remoteSVGElementHitTest):
        (WebCore::AccessibilityRenderObject::isSVGImage):
        (WebCore::AccessibilityRenderObject::detachRemoteSVGRoot):
        (WebCore::AccessibilityRenderObject::remoteSVGRootElement):
        (WebCore::AccessibilityRenderObject::addRemoteSVGChildren):
        * accessibility/AccessibilityRenderObject.h:

2016-05-25  Antti Koivisto  <antti@apple.com>

        Invalidate style for newly added nodes in Node::insertedInto
        https://bugs.webkit.org/show_bug.cgi?id=158088

        Reviewed by Darin Adler.

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::parserInsertBefore):
        (WebCore::ContainerNode::replaceChild):
        (WebCore::ContainerNode::parserAppendChild):
        (WebCore::ContainerNode::childrenChanged):
        (WebCore::ContainerNode::updateTreeAfterInsertion):
        * dom/Node.cpp:
        (WebCore::Node::insertedInto):

        Consolidate setNeedsStyleRecalc(ReconstructRenderTree) here.

        This also now happens earliest possible time, right after inserting the node and can avoid
        some unneeded style invalidation work in subclass insertion handlers.

2016-05-25  Yoav Weiss  <yoav@yoav.ws>

        Fix ResourceTiming multiple entries per resource and test initiator
        https://bugs.webkit.org/show_bug.cgi?id=158094

        Reviewed by Alex Christensen.

        Make sure that CachedResource that was needed by two different elements only adds one entry, with the right (first) initiatorType.

        Tests: http/tests/performance/performance-resource-timing-initiator-css.html
               http/tests/performance/performance-resource-timing-initiator-no-override.html

        * loader/ResourceTimingInformation.cpp:
        (WebCore::ResourceTimingInformation::addResourceTiming): Don't remove CachedResource when entry is added, but
        mark it as added. Only add new entries for non-added resources.
        (WebCore::ResourceTimingInformation::storeResourceTimingInitiatorInformation): Initialize initiator info as NotYetAdded.
        * loader/ResourceTimingInformation.h:

2016-05-25  Yoav Weiss  <yoav@yoav.ws>

        Fix ResourceTiming XHR flakiness
        https://bugs.webkit.org/show_bug.cgi?id=158019

        Reviewed by Alex Christensen.

        Remove XHR specific ResourceTiming information store and addition as it is not needed.

        Test: http/tests/performance/performance-resource-timing-xhr-single-entry.html

        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::loadRequest): Removed XHR-specific initiator info storage.
        (WebCore::DocumentThreadableLoader::didFinishLoading): Removed XHR-specific RT entry addition.
        * loader/DocumentThreadableLoader.h:

2016-05-25  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Deduplicate make-js-file-arrays usage and make it work on Windows.
        https://bugs.webkit.org/show_bug.cgi?id=157997

        Reviewed by Alex Christensen.

        No new tests needed.

        * CMakeLists.txt: Use new MAKE_JS_FILE_ARRAYS macro.

2016-05-25  Chris Dumez  <cdumez@apple.com>

        Use HashMap::add() instead of HashMap::set() in Node::ensureEventTargetData()
        https://bugs.webkit.org/show_bug.cgi?id=158092

        Reviewed by Ryosuke Niwa.

        Use HashMap::add() instead of HashMap::set() in Node::ensureEventTargetData()
        as we already checked that the key is not present in the HashMap.

        * dom/Node.cpp:
        (WebCore::Node::ensureEventTargetData):

2016-05-25  Joseph Pecoraro  <pecoraro@apple.com>

        REGRESSION (r191531): Web Inspector: WebSQL databases are no longer shown when first opening Web Inspector
        https://bugs.webkit.org/show_bug.cgi?id=158096
        <rdar://problem/26454671>

        Reviewed by Brian Burg.

        * inspector/InspectorInstrumentation.h:
        (WebCore::InspectorInstrumentation::didOpenDatabase):
        Remove the fast return errantly added in r191531. InspectorDatabaseAgent
        wants to track databases, even before a frontend may be open, so that
        on first open it can inform the frontend about open databases.

2016-05-25  Zalan Bujtas  <zalan@apple.com>

        Setting overflow:hidden does not always repaint clipped content.
        https://bugs.webkit.org/show_bug.cgi?id=116994
        rdar://problem/26476697

        Issue repaint for both layout and visual overflow rects when the container starts
        clipping overflow content.

        Reviewed by David Hyatt.

        Test: fast/repaint/overflow-hidden-repaint.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::updateFromStyle):

2016-05-25  Anders Carlsson  <andersca@apple.com>

        Get rid of WTF/Functional.h
        https://bugs.webkit.org/show_bug.cgi?id=158081

        Reviewed by Chris Dumez.

        * Modules/mediastream/MediaStreamTrack.cpp:

2016-05-25  Brent Fulgham  <bfulgham@apple.com>

        [WebSockets] No infrastructure for testing secure web sockets (wss)
        https://bugs.webkit.org/show_bug.cgi?id=157884
        <rdar://problem/26477197>

        Reviewed by Andy Estes.

        Add a new test-only flag used to tell CFNetwork that we do not wish to
        validate the SLL certificate chain. This allows us to use self-signed
        certificates in test cases.

        Tests: http/tests/websocket/tests/hybi/simple-wss.html

        * page/Settings.cpp:
        (WebCore::Settings::setAllowsAnySSLCertificate): Added.
        (WebCore::Settings::allowsAnySSLCertificate): Added. This defaults
        to False.
        * page/Settings.h:
        * platform/network/cf/SocketStreamHandleCFNet.cpp:
        (WebCore::SocketStreamHandle::createStreams): When running under our
        testing infrastructure, do not require full certificate validation.
        * testing/js/WebCoreTestSupport.cpp:
        (WebCoreTestSupport::setAllowsAnySSLCertificate): Added.
        * testing/js/WebCoreTestSupport.h:
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setAllowsAnySSLCertificate): Added.
        * testing/InternalSettings.h:

2016-05-25  Jer Noble  <jer.noble@apple.com>

        CRASH at WebCore::WebPlaybackSessionModelMediaElement::selectAudioMediaOption() + 104
        https://bugs.webkit.org/show_bug.cgi?id=158090
        <rdar://problem/26388936>

        Reviewed by Eric Carlson.

        Null-check m_mediaElement before using.

        * platform/cocoa/WebPlaybackSessionModelMediaElement.mm:
        (WebPlaybackSessionModelMediaElement::selectAudioMediaOption):
        (WebPlaybackSessionModelMediaElement::selectLegibleMediaOption):

2016-05-25  Brady Eidson  <beidson@apple.com>

        Race condition calling back to an IDBOpenDBRequest during WorkerThread shutdown.
        https://bugs.webkit.org/show_bug.cgi?id=158089

        Reviewed by Alex Christensen.

        No new tests (Only seen randomly under GuardMalloc).

        Crash was seen once running under GuardMalloc. The error is obvious.

        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::completeOpenDBRequest): Don't get a raw pointer out of the map.
          Instead store off as a RefPtr, as the map might be cleared out from the worker thread.

2016-05-25  Chris Dumez  <cdumez@apple.com>

        Simplify and inline minimumValueForLength()
        https://bugs.webkit.org/show_bug.cgi?id=158084

        Reviewed by Zalan Bujtas.

        Simplify and inline minimumValueForLength(). Based on iOS PLT profiles,
        we spend up to 0.7% of CPU time during page loads in this function.

        The roundPercentages parameter has been dropped because it was false
        for all call sites.

        * css/LengthFunctions.cpp:
        (WebCore::minimumIntValueForLength): Deleted.
        (WebCore::minimumValueForLength): Deleted.
        * css/LengthFunctions.h:
        (WebCore::minimumValueForLength):
        (WebCore::minimumIntValueForLength):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::resolveEdgeRelativeLength):
        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
        * rendering/RenderElement.h:
        (WebCore::RenderElement::minimumValueForLength):

2016-05-25  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Update <fixed-size> syntax
        https://bugs.webkit.org/show_bug.cgi?id=158063

        Reviewed by Darin Adler.

        The syntax for <fixed-size> has been updated on the spec:
        https://drafts.csswg.org/css-grid/#typedef-fixed-size

        New syntax is:
          <fixed-size> =
            <fixed-breadth> |
            minmax( <fixed-breadth> , <track-breadth> ) |
            minmax( <inflexible-breadth> , <fixed-breadth> )

        This means that it's enough to have one <fixed-breadth>,
        it doesn't matter if it's as minimum or maximum.
        Before it was required that the minimum was fixed.

        * css/CSSParser.cpp:
        (WebCore::isGridTrackFixedSized):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computeAutoRepeatTracksCount):

2016-05-25  Alex Christensen  <achristensen@webkit.org>

        Fix CMake build.

        * PlatformMac.cmake:
        c++14 is needed since r201255.
        ColorSync (in ApplicationServices) is needed since r201065.

2016-05-25  Zalan Bujtas  <zalan@apple.com>

        Swap search field's cancel and result button for RTL content.
        https://bugs.webkit.org/show_bug.cgi?id=158007

        Reviewed by Dean Jackson.

        Test: fast/forms/search-input-rtl.html

        * css/html.css:
        (input[type="search"]::-webkit-textfield-decoration-container): Deleted.
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):

2016-05-25  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] ASSERT if calling FontFace.loaded twice with a garbage collection between them
        https://bugs.webkit.org/show_bug.cgi?id=158015

        Reviewed by Darin Adler.

        The following scenario may occur:

        1. We create a FontFace object
        2. We create an associated JSFontFace object
        3. We start loading the FontFace, which causes an extra ref to hang around until loading finishes
        4. Javascript calls the "loaded" attribute on the FontFace, which saves a promise inside the FontFace
        5. The FontFace goes out of scope in Javascript
        6. A garbage collection occurs, causing us to delete the JSFontFace object
        7. Javascript then encounters the FontFace object without first going through a reference to a JSFontFace.
        It can do this via iterating through a FontFaceSet. We respond to this situation by creating a new
        JSFontFace object and associating it with the existing FontFace.
        8. Javascript calls the "loaded" attribute

        In this situation, the newer JSFontFace object is out of sync with the older FontFace object. In
        particular, the FontFace has a saved promise, but the JSFontFace doesn't know about it. Therefore,
        the JSFontFace should be flexible to the presence of this member.

        Test: fast/text/font-face-crash-2.html

        * bindings/js/JSDOMPromise.h:
        (WebCore::DOMPromise::deferredWrapper):
        * bindings/js/JSFontFaceCustom.cpp:
        (WebCore::JSFontFace::loaded):
        * css/FontFace.h:

2016-05-25  Antti Koivisto  <antti@apple.com>

        Shadow DOM: RenderTreePosition miscomputed when display:contents value changes
        https://bugs.webkit.org/show_bug.cgi?id=158072
        rdar://problem/25766333

        Reviewed by Darin Adler.

        Test: fast/shadow-dom/slot-crash.html

        * style/RenderTreePosition.h:
        (WebCore::RenderTreePosition::invalidateNextSibling):

            Add unconditional invalidation function.

        * style/RenderTreeUpdater.cpp:
        (WebCore::RenderTreeUpdater::updateElementRenderer):

            With display:contents rendering siblings may be found from the subtree and the existing cached
            position may become invalid.
            If the display:contents value changes invalidate the current render tree position.

2016-05-25  Brady Eidson  <beidson@apple.com>

        Modern IDB: IDB objects from a worker thread might be destroyed on the main thread.
        https://bugs.webkit.org/show_bug.cgi?id=158004

        Reviewed by Alex Christensen.

        No new tests (Spuriously reproduces on the bots, but I've been unable to construct a reliable test).

        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::completeOpenDBRequest):
        (WebCore::IDBClient::IDBConnectionProxy::notifyOpenDBRequestBlocked):
        (WebCore::IDBClient::IDBConnectionProxy::didCommitTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::didAbortTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::unregisterDatabaseConnection):
        (WebCore::IDBClient::removeItemsMatchingCurrentThread):
        (WebCore::IDBClient::IDBConnectionProxy::forgetActivityForCurrentThread): Clear out all objects that originated on this thread.
        (WebCore::IDBClient::IDBConnectionProxy::takeIDBOpenDBRequest): Deleted.
        * Modules/indexeddb/client/IDBConnectionProxy.h:

        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::stopIndexedDatabase):
        * workers/WorkerGlobalScope.h:

        * workers/WorkerThread.cpp:
        (WebCore::WorkerThread::stop):

2016-05-25  Nael Ouedraogo  <nael.ouedraogo@crf.canon.fr>

        Remove unused slotBase parameter in bindings generator
        https://bugs.webkit.org/show_bug.cgi?id=158068

        Reviewed by Darin Adler.

        Remove unused slotBase parameter from attribute Getter functions.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        * bindings/scripts/test/JS/JSTestException.cpp:
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        * bindings/scripts/test/JS/JSTestNode.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/JS/JSattribute.cpp:

2016-05-25  Alex Christensen  <achristensen@webkit.org>

        Include fewer headers from headers
        https://bugs.webkit.org/show_bug.cgi?id=158043

        Reviewed by Brady Eidson.

        * platform/graphics/GraphicsContext.h:
        * rendering/svg/RenderSVGResourceClipper.h:
        (isType):
        * rendering/svg/RenderSVGResourceMasker.h:

2016-05-25  Eric Carlson  <eric.carlson@apple.com>

        ASSERT in WebCore::TextTrackList::remove when running media/track/track-remove-track.html
        https://bugs.webkit.org/show_bug.cgi?id=158071
        <rdar://problem/26432041>

        Reviewed by Chris Dumez.

        No new tests, this prevents media/track/track-remove-track.html from crashing.

        * html/track/TextTrackList.cpp:
        (TextTrackList::remove): Don't assert when the media element has  been set to null.

2016-05-25  Zalan Bujtas  <zalan@apple.com>

        Addressing post-review comments on r200971.

        Reviewed by Darin Adler.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::hitTestResultAtPoint):

2016-05-25  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Simplify grid track sizes parsing
        https://bugs.webkit.org/show_bug.cgi?id=158021

        Reviewed by Sergio Villar Senin.

        Previously once we saw an auto-repeat function,
        we passed the "FixedSizeOnly" restriction to the rest of methods.
        That way we were sure that all the tracks after the auto-repeat
        had fixed sizes.
        But we needed to call allTracksAreFixedSized() to be sure that
        the tracks before the auto-repeat had fixed sizes too.

        Now we're introducing a new boolean |allTracksAreFixedSized|,
        to check in advance if the declaration contains any track not fixed.
        If that's the case and we found an auto-repeat method,
        we consider it invalid.
        With this approach we avoid the loop to verify
        that all the tracks (before and after the auto-repeat) are fixed.
        It also allows us to simplify the code and avoid passing
        the restriction to all the methods parsing the track size.

        No new tests, no change of behavior.

        * css/CSSParser.cpp:
        (WebCore::isGridTrackFixedSized): New method to check if a grid track
        size is fixed or not (based on old allTracksAreFixedSized()).
        (WebCore::CSSParser::parseGridTrackList): Add new boolean to detect
        if any track has not a fixed size.
        (WebCore::CSSParser::parseGridTrackRepeatFunction): Ditto.
        (WebCore::CSSParser::parseGridTrackSize): Remove usage of
        TrackSizeRestriction enum.
        Check here if |minTrackBreadth| is a flexible size.
        (WebCore::CSSParser::parseGridBreadth): Remove usage of
        TrackSizeRestriction enum.
        (WebCore::allTracksAreFixedSized): Deleted.
        * css/CSSParser.h: Remove TrackSizeRestriction enum and update headers.

2016-05-25  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Refactor populateGridPositions()
        https://bugs.webkit.org/show_bug.cgi?id=158065

        Reviewed by Carlos Garcia Campos.

        RenderGrid::populateGridPositions() was doing exactly the same thing for columns and rows
        but using different data structures. That lead to a lot of duplicated code. It's easy to
        refactor it in a new function that properly select the data structures to operate on based
        on the direction.

        No new tests as there is no change in behaviour.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::layoutGridItems):
        (WebCore::RenderGrid::populateGridPositionsForDirection): Refactored from
        populateGridPositions().
        (WebCore::RenderGrid::populateGridPositions): Deleted.
        * rendering/RenderGrid.h:

2016-05-25  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r201373.
        https://bugs.webkit.org/show_bug.cgi?id=158064

        Several tests are hitting the ASSERT (Requested by rego on
        #webkit).

        Reverted changeset:

        "[css-grid] Simplify grid track sizes parsing"
        https://bugs.webkit.org/show_bug.cgi?id=158021
        http://trac.webkit.org/changeset/201373

2016-05-25  Nael Ouedraogo  <nael.ouedraogo@crf.canon.fr>

        Purge PassRefPtr from TouchList
        https://bugs.webkit.org/show_bug.cgi?id=157985

        Reviewed by Darin Adler.

        Use RefPtr&& argument instead of PassRefPtr in append()

        * dom/TouchList.h:
        (WebCore::TouchList::append):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleTouchEvent):

2016-05-25  Antoine Quint  <graouts@apple.com>

        Elements with backdrop-filter cannot be clipped with clip-path or mask
        https://bugs.webkit.org/show_bug.cgi?id=142662
        <rdar://problem/20150192>

        Reviewed by Dean Jackson.

        We used to only apply the mask to the layer contents but did not account
        for the fact that a layer backdrop may exist. We now correctly mask the
        backdrop layer as well as the layer contents.

        Test: css3/filters/backdrop/backdrop-filter-with-clip-path.html

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::updateShape):
        Ensure clones of a layer use the same shape path.

        (WebCore::GraphicsLayerCA::updateMaskLayer):
        If we have a backdrop layer, ensure that we apply a clone of the mask layer applied to
        the layer contents.

2016-05-25  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Simplify grid track sizes parsing
        https://bugs.webkit.org/show_bug.cgi?id=158021

        Reviewed by Sergio Villar Senin.

        Previously once we saw an auto-repeat function,
        we passed the "FixedSizeOnly" restriction to the rest of methods.
        That way we were sure that all the tracks after the auto-repeat
        had fixed sizes.
        But we needed to call allTracksAreFixedSized() to be sure that
        the tracks before the auto-repeat had fixed sizes too.

        Now we're introducing a new boolean |allTracksAreFixedSized|,
        to check in advance if the declaration contains any track not fixed.
        If that's the case and we found an auto-repeat method,
        we consider it invalid.
        With this approach we avoid the loop to verify
        that all the tracks (before and after the auto-repeat) are fixed.
        It also allows us to simplify the code and avoid passing
        the restriction to all the methods parsing the track size.

        No new tests, no change of behavior.

        * css/CSSParser.cpp:
        (WebCore::isGridTrackFixedSized): New method to check if a grid track
        size is fixed or not (based on old allTracksAreFixedSized()).
        (WebCore::CSSParser::parseGridTrackList): Add new boolean to detect
        if any track has not a fixed size.
        (WebCore::CSSParser::parseGridTrackRepeatFunction): Ditto.
        (WebCore::CSSParser::parseGridTrackSize): Remove usage of
        TrackSizeRestriction enum.
        Check here if |minTrackBreadth| is a flexible size.
        (WebCore::CSSParser::parseGridBreadth): Remove usage of
        TrackSizeRestriction enum.
        (WebCore::allTracksAreFixedSized): Deleted.
        * css/CSSParser.h: Remove TrackSizeRestriction enum and update headers.

2016-05-24  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] Crash during font download failure after garbage collection
        https://bugs.webkit.org/show_bug.cgi?id=158013
        <rdar://problem/25148032>

        Reviewed by Darin Adler.

        Usually, ownership during font loading is top-down - JavaScript owns a JSFontFace,
        which owns a FontFace, which owns a CSSFontFace. However, when we receive the
        asynchronous callback that a font finished loading, the call comes in from the
        bottom - it is delivered from the CSSFontFaceSource to the CSSFontFace, and then
        to the FontFace. If a garbage collection had previously run, we might remove
        the last reference to ourself during this asynchronous callback. A simple guard
        makes sure this doesn't happen.

        Test: fast/text/font-face-crash.html

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::fontLoaded):

2016-05-24  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r201349.

        This change caused compositing tests to assert on iOS
        simulator

        Reverted changeset:

        "Elements with backdrop-filter cannot be clipped with clip-
        path or mask"
        https://bugs.webkit.org/show_bug.cgi?id=142662
        http://trac.webkit.org/changeset/201349

2016-05-24  Brady Eidson  <beidson@apple.com>

        Modern IDB: (Workers) Eliminate race in getting the ScriptExecutionContext and using it.
        https://bugs.webkit.org/show_bug.cgi?id=158038

        Reviewed by Alex Christensen.

        No new tests (Resolves potential flakes in existing tests).
        
        When the main thread is trying to post a task to a worker thread's ScriptExecutionContext, there is a race
        between checking that the context still exists and actually using it.
        
        The solution is to add a new class - IDBActiveDOMObject - which does a few things things:
        1 - Remembers its origin thread.
        2 - Guards clearing its ScriptExecutionContext with a Lock.
        3 - Adds a templated "performCallbackOnOriginThread" that uses the same Lock to make sure posting the task to
            the ScriptExecutionContext's RunLoop is safe.

        Also, tons of ASSERTions are updated because each object with an originThread no longer keeps its idea in an
        accessible member variable.
        
        * Modules/indexeddb/IDBActiveDOMObject.h:
        (WebCore::IDBActiveDOMObject::originThreadID):
        (WebCore::IDBActiveDOMObject::performCallbackOnOriginThread):
        (WebCore::IDBActiveDOMObject::IDBActiveDOMObject):
        
        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::IDBDatabase):
        (WebCore::IDBDatabase::~IDBDatabase):
        (WebCore::IDBDatabase::hasPendingActivity):
        (WebCore::IDBDatabase::name):
        (WebCore::IDBDatabase::version):
        (WebCore::IDBDatabase::objectStoreNames):
        (WebCore::IDBDatabase::createObjectStore):
        (WebCore::IDBDatabase::transaction):
        (WebCore::IDBDatabase::deleteObjectStore):
        (WebCore::IDBDatabase::close):
        (WebCore::IDBDatabase::didCloseFromServer):
        (WebCore::IDBDatabase::maybeCloseInServer):
        (WebCore::IDBDatabase::activeDOMObjectName):
        (WebCore::IDBDatabase::canSuspendForDocumentSuspension):
        (WebCore::IDBDatabase::stop):
        (WebCore::IDBDatabase::startVersionChangeTransaction):
        (WebCore::IDBDatabase::didStartTransaction):
        (WebCore::IDBDatabase::willCommitTransaction):
        (WebCore::IDBDatabase::didCommitTransaction):
        (WebCore::IDBDatabase::willAbortTransaction):
        (WebCore::IDBDatabase::didAbortTransaction):
        (WebCore::IDBDatabase::didCommitOrAbortTransaction):
        (WebCore::IDBDatabase::fireVersionChangeEvent):
        (WebCore::IDBDatabase::dispatchEvent):
        (WebCore::IDBDatabase::didCreateIndexInfo):
        (WebCore::IDBDatabase::didDeleteIndexInfo):
        * Modules/indexeddb/IDBDatabase.h:
        (WebCore::IDBDatabase::originThreadID): Deleted.
        
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::IDBRequest):
        (WebCore::IDBRequest::~IDBRequest):
        (WebCore::IDBRequest::errorCode):
        (WebCore::IDBRequest::error):
        (WebCore::IDBRequest::setSource):
        (WebCore::IDBRequest::setVersionChangeTransaction):
        (WebCore::IDBRequest::transaction):
        (WebCore::IDBRequest::readyState):
        (WebCore::IDBRequest::sourceObjectStoreIdentifier):
        (WebCore::IDBRequest::sourceIndexIdentifier):
        (WebCore::IDBRequest::requestedIndexRecordType):
        (WebCore::IDBRequest::eventTargetInterface):
        (WebCore::IDBRequest::activeDOMObjectName):
        (WebCore::IDBRequest::canSuspendForDocumentSuspension):
        (WebCore::IDBRequest::hasPendingActivity):
        (WebCore::IDBRequest::stop):
        (WebCore::IDBRequest::enqueueEvent):
        (WebCore::IDBRequest::dispatchEvent):
        (WebCore::IDBRequest::uncaughtExceptionInEventHandler):
        (WebCore::IDBRequest::setResult):
        (WebCore::IDBRequest::setResultToStructuredClone):
        (WebCore::IDBRequest::clearResult):
        (WebCore::IDBRequest::setResultToUndefined):
        (WebCore::IDBRequest::resultCursor):
        (WebCore::IDBRequest::willIterateCursor):
        (WebCore::IDBRequest::didOpenOrIterateCursor):
        (WebCore::IDBRequest::requestCompleted):
        (WebCore::IDBRequest::onError):
        (WebCore::IDBRequest::onSuccess):
        * Modules/indexeddb/IDBRequest.h:
        (WebCore::IDBRequest::originThreadID): Deleted.
        
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::IDBTransaction):
        (WebCore::IDBTransaction::originThreadID): Deleted.
        * Modules/indexeddb/IDBTransaction.h:
        
        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::completeOpenDBRequest):
        (WebCore::IDBClient::IDBConnectionProxy::completeOperation):
        (WebCore::IDBClient::IDBConnectionProxy::fireVersionChangeEvent):
        (WebCore::IDBClient::IDBConnectionProxy::notifyOpenDBRequestBlocked):
        (WebCore::IDBClient::IDBConnectionProxy::didStartTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::didCommitTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::didAbortTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::didCloseFromServer):
        (WebCore::IDBClient::performCallbackOnCorrectThread): Deleted.
        
        * Modules/indexeddb/client/TransactionOperation.cpp:
        (WebCore::IDBClient::TransactionOperation::scriptExecutionContext): Deleted.
        * Modules/indexeddb/client/TransactionOperation.h:
        (WebCore::IDBClient::TransactionOperation::performCompleteOnOriginThread):
        
        * WebCore.xcodeproj/project.pbxproj:

2016-05-23  Ada Chan  <adachan@apple.com>

        Only set overflow:hidden on -webkit-media-controls when the placeholder is showing.
        https://bugs.webkit.org/show_bug.cgi?id=157975

        Reviewed by Eric Carlson.

        Test: media/mac/controls-panel-not-clipped-out.html

        overflow:hidden was added to clip out content contained in -webkit-media-controls
        that sticks out of the bounds of that container when the inlinePlaybackPlaceholder
        is showing. However, that style also clips out things that we want to show when the
        inlinePlaybackPlaceholder is not showing. For example, the volume slider or the
        controls panel when the video element's height is too short.

        To fix that, we only set overflow:hidden on -webkit-media-controls when the
        inlinePlaybackPlaceholder is visible.

        * Modules/mediacontrols/mediaControlsApple.css:
        (::-webkit-media-controls):
        (::-webkit-media-controls.placeholder-showing):
        Set overflow:hidden only when the placeholder is showing.

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.handlePresentationModeChange):
        Add the placeholderShowing class to -webkit-media-controls only when the
        inlinePlaybackPlaceholder is not hidden.

2016-05-24  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r201341.

        This change may have caused LayoutTests to crash on Mac and
        iOS

        Reverted changeset:

        "Use lambda capture with initializer instead of StringCapture"
        https://bugs.webkit.org/show_bug.cgi?id=158010
        http://trac.webkit.org/changeset/201341

2016-05-24  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: RTCIceCandidate: Make attributes readonly (and update constructor arg)
        https://bugs.webkit.org/show_bug.cgi?id=157859

        Reviewed by Eric Carlson.

        Make the RTCIceCandidate constructor argument mandatory and the attributes
        read-only (in accordance with the WebRTC 1.0 specification [1]).

        [1] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html#rtcicecandidate-interface

        Updated existing test.

        * Modules/mediastream/RTCIceCandidate.h:
        (WebCore::RTCIceCandidate::setCandidate): Deleted.
        (WebCore::RTCIceCandidate::setSdpMid): Deleted.
        (WebCore::RTCIceCandidate::setSdpMLineIndex): Deleted.
        * Modules/mediastream/RTCIceCandidate.idl:

2016-05-24  Antoine Quint  <graouts@apple.com>

        Elements with backdrop-filter cannot be clipped with clip-path or mask
        https://bugs.webkit.org/show_bug.cgi?id=142662
        <rdar://problem/20150192>

        Reviewed by Dean Jackson.

        We used to only apply the mask to the layer contents but did not account
        for the fact that a layer backdrop may exist. We now correctly mask the
        backdrop layer as well as the layer contents.

        Test: css3/filters/backdrop/backdrop-filter-with-clip-path.html

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::updateShape):
        Ensure clones of a layer use the same shape path.

        (WebCore::GraphicsLayerCA::updateMaskLayer):
        If we have a backdrop layer, ensure that we apply a clone of the mask layer applied to
        the layer contents.

2016-05-24  Zalan Bujtas  <zalan@apple.com>

        fast/table/neighboring-cells-when-collapsed-border-changes.html is flaky.
        https://bugs.webkit.org/show_bug.cgi?id=158009

        Reviewed by David Hyatt.

        RenderTable::invalidateCollapsedBorders() early returns on m_collapsedEmptyBorderIsPresent
        which prevents us from marking neighboring cells dirty when style changes.
        Decouple the "invalidate the collapsed borders" and the "mark the neighboring cells dirty" logic.

        Covered by existing tests. (and now we agree with FF on cached-change-cell-border-width.html)

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::invalidateCollapsedBorders):
        (WebCore::markCellDirtyWhenCollapsedBorderChanges): Deleted.
        * rendering/RenderTableCell.cpp:
        (WebCore::markCellDirtyWhenCollapsedBorderChanges):
        (WebCore::RenderTableCell::styleDidChange):

2016-05-24  Alex Christensen  <achristensen@webkit.org>

        Fix use-after-free after r201318
        https://bugs.webkit.org/show_bug.cgi?id=158037
        rdar://problem/26446729

        Reviewed by Brady Eidson.

        This fixes a crash when running fast/dom/navigation-with-sideeffects.html with GuardMalloc.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjPutForwardsNullableAttribute):
        Changing RefPtr<${type}> to auto caused the type to sometimes be a raw pointer, which does not keep the object alive.
        In the case of JSDocument.cpp, forwardedImpl was what Document::location returned, which is a Location* and not a RefPtr<Location>.

2016-05-24  Chris Dumez  <cdumez@apple.com>

        Use lambda capture with initializer instead of StringCapture
        https://bugs.webkit.org/show_bug.cgi?id=158010

        Reviewed by Antti Koivisto.

        Use lambda capture with initializer instead of StringCapture now that
        we support C++14.

        * fileapi/AsyncFileStream.cpp:
        (WebCore::AsyncFileStream::getSize):
        (WebCore::AsyncFileStream::openForRead):
        (WebCore::AsyncFileStream::openForWrite):
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::installContentFilterUnblockHandler):
        * loader/WorkerThreadableLoader.cpp:
        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        (WebVideoFullscreenControllerContext::setExternalPlayback):
        * platform/network/curl/CurlDownload.cpp:
        (WebCore::CurlDownload::didReceiveHeader):
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::postExceptionToWorkerObject):
        (WebCore::WorkerMessagingProxy::postConsoleMessageToWorkerObject):

2016-05-24  Said Abou-Hallawa  <sabouhallawa@apple.com>

        In accelerated drawing mode, ImageBuffer::putByteArray() should copy the bytes directly to the IOSurface backing store
        https://bugs.webkit.org/show_bug.cgi?id=157966

        Reviewed by Dean Jackson.
        
        Roll out the the change of r106836 in ImageBuffer::putByteArray(). r106836
        was using CG to draw the image data as a native image in the accelerated
        drawing mode just to force invalidating the IOSurface cached image. Instead
        of doing that, we can use a light-weight fix, for now, to force recreating
        the IOSurface image if it is requested through CGIOSurfaceContextCreateImage().

        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::ImageBuffer::putByteArray):

2016-05-24  Chris Dumez  <cdumez@apple.com>

        Use auto for some of our lambda function parameters
        https://bugs.webkit.org/show_bug.cgi?id=158001

        Reviewed by Darin Adler.

        Use auto for some of our lambda function parameters now that we build with c++14.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::buffered):
        (WebCore::MediaSource::monitorSourceBuffers):
        (WebCore::MediaSource::endOfStream):
        * Modules/mediasource/SampleMap.cpp:
        (WebCore::PresentationOrderSampleMap::findSamplesWithinPresentationRangeFromEnd):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::ariaSelectedRows):
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::writeBlobsToDiskForIndexedDB):
        * css/CSSValueList.cpp:
        (WebCore::CSSValueList::removeAll):
        * css/MediaList.cpp:
        (WebCore::MediaQuerySet::remove):
        * css/MediaQuery.cpp:
        (WebCore::MediaQuery::MediaQuery):
        * css/MediaQueryMatcher.cpp:
        (WebCore::MediaQueryMatcher::removeListener):
        * dom/Document.cpp:
        (WebCore::Document::validateAutoSizingNodes):
        * dom/Element.cpp:
        (WebCore::Element::detachAttrNodeFromElementWithValue):
        * dom/MutationObserver.cpp:
        (WebCore::MutationObserver::deliverAllMutations):
        * dom/Node.cpp:
        (WebCore::Node::unregisterMutationObserver):
        * html/LinkIconCollector.cpp:
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore::InspectorIndexedDBAgent::requestDatabaseNames):
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::loadDataURL):
        * page/CaptionUserPreferences.cpp:
        (WebCore::CaptionUserPreferences::sortedTrackListForMenu):
        * page/CaptionUserPreferencesMediaAF.cpp:
        (WebCore::CaptionUserPreferencesMediaAF::sortedTrackListForMenu):
        * page/animation/AnimationController.cpp:
        (WebCore::AnimationControllerPrivate::clear):
        * platform/graphics/FontCascade.cpp:
        (WebCore::pruneUnreferencedEntriesFromFontCascadeCache):
        * platform/graphics/FontCascadeFonts.cpp:
        (WebCore::FontCascadeFonts::pruneSystemFallbacks):
        * platform/graphics/PathUtilities.cpp:
        (WebCore::addIntersectionPoints):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::updateTracks):
        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGLData::SharedGLData::~SharedGLData):
        * platform/mac/HIDGamepad.cpp:
        (WebCore::HIDGamepad::initElements):
        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::appendLigatureSubtable):
        (WebCore::SVGToOTFFontConverter::finishAppendingKERNSubtable):

2016-05-24  Antti Koivisto  <antti@apple.com>

        REGRESSION (r196629): Safari can get into a state where switching Reader theme doesn't apply to the webpage
        https://bugs.webkit.org/show_bug.cgi?id=158018
        <rdar://problem/24732776>

        Reviewed by Darin Adler.

        When a tab goes to background we clear the style resolver. It is recreated lazily when the tab is again active.
        However style invalidation code tests if the style resolver exists and skips the invalidation if it doesn't.
        With sufficiently simple document (like in Reader) we may never create one for other reasons and so style
        invalidation doesn't work.

        No test, don't know how to make one.

        * dom/Element.cpp:
        (WebCore::Element::needsStyleInvalidation):

            Remove styleResolverIfExists() check and do the invalidation normally.
            Instead check for forced style recalc. If there is one pending we don't need to bother with invalidation.

2016-05-24  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, updating binding test results
        https://bugs.webkit.org/show_bug.cgi?id=157080

        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::jsTestActiveDOMObjectExcitingAttr):
        (WebCore::jsTestActiveDOMObjectConstructor):
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::jsTestClassWithJSBuiltinConstructorConstructor):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::jsTestCustomConstructorWithNoInterfaceObjectConstructor):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::jsTestCustomNamedGetterConstructor):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::jsTestEventConstructorAttr1):
        (WebCore::jsTestEventConstructorAttr2):
        (WebCore::jsTestEventConstructorAttr3):
        (WebCore::jsTestEventConstructorConstructor):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::jsTestEventTargetConstructor):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::jsTestExceptionName):
        (WebCore::jsTestExceptionConstructor):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::jsTestGenerateIsReachableConstructor):
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        (WebCore::jsTestGlobalObjectRegularAttribute):
        (WebCore::jsTestGlobalObjectEnabledAtRuntimeAttribute):
        (WebCore::jsTestGlobalObjectConstructor):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::jsTestInterfaceConstructorImplementsStaticReadOnlyAttr):
        (WebCore::jsTestInterfaceConstructorImplementsStaticAttr):
        (WebCore::jsTestInterfaceImplementsStr1):
        (WebCore::jsTestInterfaceImplementsStr2):
        (WebCore::jsTestInterfaceImplementsStr3):
        (WebCore::jsTestInterfaceImplementsNode):
        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
        (WebCore::jsTestInterfaceSupplementalStr1):
        (WebCore::jsTestInterfaceSupplementalStr2):
        (WebCore::jsTestInterfaceSupplementalStr3):
        (WebCore::jsTestInterfaceSupplementalNode):
        (WebCore::jsTestInterfaceConstructor):
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        (WebCore::jsTestJSBuiltinConstructorTestAttributeCustom):
        (WebCore::jsTestJSBuiltinConstructorTestAttributeRWCustom):
        (WebCore::jsTestJSBuiltinConstructorConstructor):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::jsTestMediaQueryListListenerConstructor):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::jsTestNamedConstructorConstructor):
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::jsTestNodeName):
        (WebCore::jsTestNodeConstructor):
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::jsTestNondeterministicNondeterministicReadonlyAttr):
        (WebCore::jsTestNondeterministicNondeterministicWriteableAttr):
        (WebCore::jsTestNondeterministicNondeterministicExceptionAttr):
        (WebCore::jsTestNondeterministicNondeterministicGetterExceptionAttr):
        (WebCore::jsTestNondeterministicNondeterministicSetterExceptionAttr):
        (WebCore::jsTestNondeterministicConstructor):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjReadOnlyLongAttr):
        (WebCore::jsTestObjReadOnlyStringAttr):
        (WebCore::jsTestObjReadOnlyTestObjAttr):
        (WebCore::jsTestObjConstructorStaticReadOnlyLongAttr):
        (WebCore::jsTestObjConstructorStaticStringAttr):
        (WebCore::jsTestObjConstructorTestSubObj):
        (WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
        (WebCore::jsTestObjEnumAttr):
        (WebCore::jsTestObjByteAttr):
        (WebCore::jsTestObjOctetAttr):
        (WebCore::jsTestObjShortAttr):
        (WebCore::jsTestObjClampedShortAttr):
        (WebCore::jsTestObjEnforceRangeShortAttr):
        (WebCore::jsTestObjUnsignedShortAttr):
        (WebCore::jsTestObjLongAttr):
        (WebCore::jsTestObjLongLongAttr):
        (WebCore::jsTestObjUnsignedLongLongAttr):
        (WebCore::jsTestObjStringAttr):
        (WebCore::jsTestObjTestObjAttr):
        (WebCore::jsTestObjTestNullableObjAttr):
        (WebCore::jsTestObjLenientTestObjAttr):
        (WebCore::jsTestObjUnforgeableAttr):
        (WebCore::jsTestObjStringAttrTreatingNullAsEmptyString):
        (WebCore::jsTestObjXMLObjAttr):
        (WebCore::jsTestObjCreate):
        (WebCore::jsTestObjReflectedStringAttr):
        (WebCore::jsTestObjReflectedIntegralAttr):
        (WebCore::jsTestObjReflectedUnsignedIntegralAttr):
        (WebCore::jsTestObjReflectedBooleanAttr):
        (WebCore::jsTestObjReflectedURLAttr):
        (WebCore::jsTestObjReflectedCustomIntegralAttr):
        (WebCore::jsTestObjReflectedCustomBooleanAttr):
        (WebCore::jsTestObjReflectedCustomURLAttr):
        (WebCore::jsTestObjEnabledAtRuntimeAttribute):
        (WebCore::jsTestObjTypedArrayAttr):
        (WebCore::jsTestObjAttrWithGetterException):
        (WebCore::jsTestObjAttrWithGetterExceptionWithMessage):
        (WebCore::jsTestObjAttrWithSetterException):
        (WebCore::jsTestObjAttrWithSetterExceptionWithMessage):
        (WebCore::jsTestObjStringAttrWithGetterException):
        (WebCore::jsTestObjStringAttrWithSetterException):
        (WebCore::jsTestObjStrictTypeCheckingAttribute):
        (WebCore::jsTestObjCustomAttr):
        (WebCore::jsTestObjOnfoo):
        (WebCore::jsTestObjOnwebkitfoo):
        (WebCore::jsTestObjWithScriptStateAttribute):
        (WebCore::jsTestObjWithCallWithAndSetterCallWithAttribute):
        (WebCore::jsTestObjWithScriptExecutionContextAttribute):
        (WebCore::jsTestObjWithScriptStateAttributeRaises):
        (WebCore::jsTestObjWithScriptExecutionContextAttributeRaises):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttribute):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
        (WebCore::jsTestObjWithScriptArgumentsAndCallStackAttribute):
        (WebCore::jsTestObjConditionalAttr1):
        (WebCore::jsTestObjConditionalAttr2):
        (WebCore::jsTestObjConditionalAttr3):
        (WebCore::jsTestObjConditionalAttr4Constructor):
        (WebCore::jsTestObjConditionalAttr5Constructor):
        (WebCore::jsTestObjConditionalAttr6Constructor):
        (WebCore::jsTestObjCachedAttribute1):
        (WebCore::jsTestObjCachedAttribute2):
        (WebCore::jsTestObjAnyAttribute):
        (WebCore::jsTestObjContentDocument):
        (WebCore::jsTestObjMutablePoint):
        (WebCore::jsTestObjImmutablePoint):
        (WebCore::jsTestObjStrawberry):
        (WebCore::jsTestObjStrictFloat):
        (WebCore::jsTestObjDescription):
        (WebCore::jsTestObjId):
        (WebCore::jsTestObjHash):
        (WebCore::jsTestObjReplaceableAttribute):
        (WebCore::jsTestObjNullableDoubleAttribute):
        (WebCore::jsTestObjNullableLongAttribute):
        (WebCore::jsTestObjNullableBooleanAttribute):
        (WebCore::jsTestObjNullableStringAttribute):
        (WebCore::jsTestObjNullableLongSettableAttribute):
        (WebCore::jsTestObjNullableStringSettableAttribute):
        (WebCore::jsTestObjNullableStringValue):
        (WebCore::jsTestObjAttribute):
        (WebCore::jsTestObjAttributeWithReservedEnumType):
        (WebCore::jsTestObjPutForwardsAttribute):
        (WebCore::jsTestObjPutForwardsNullableAttribute):
        (WebCore::jsTestObjConstructor):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::jsTestOverloadedConstructorsConstructor):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::jsTestOverrideBuiltinsConstructor):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::jsTestSerializedScriptValueInterfaceValue):
        (WebCore::jsTestSerializedScriptValueInterfaceReadonlyValue):
        (WebCore::jsTestSerializedScriptValueInterfaceCachedValue):
        (WebCore::jsTestSerializedScriptValueInterfacePorts):
        (WebCore::jsTestSerializedScriptValueInterfaceCachedReadonlyValue):
        (WebCore::jsTestSerializedScriptValueInterfaceConstructor):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::jsTestTypedefsUnsignedLongLongAttr):
        (WebCore::jsTestTypedefsImmutableSerializedScriptValue):
        (WebCore::jsTestTypedefsConstructorTestSubObj):
        (WebCore::jsTestTypedefsAttrWithGetterException):
        (WebCore::jsTestTypedefsAttrWithSetterException):
        (WebCore::jsTestTypedefsStringAttrWithGetterException):
        (WebCore::jsTestTypedefsStringAttrWithSetterException):
        (WebCore::jsTestTypedefsConstructor):
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::jsattributeReadonly):
        (WebCore::jsattributeConstructor):
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::jsreadonlyConstructor):

2016-05-24  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Fix behavior of flexible track breadths
        https://bugs.webkit.org/show_bug.cgi?id=157834

        Reviewed by Sergio Villar Senin.

        This patch is fixing 2 issues that are interrelated:

        1) Flex sizes are invalid as min track sizing function.

          The syntax has been recently updated on the spec:
            <track-size> =
              <track-breadth> |
              minmax( <inflexible-breadth> , <track-breadth> )

        2) Flex sizes outside minmax() behave as auto minimum.

          Flex sizes outside minmax() were previously behaving like
          minimum and maximum (e.g. 1fr => minmax(1fr, 1fr)).
          However the spec changed and now this would be invalid,
          so they should behave like auto minimum (e.g. minmax(auto, 1fr)).

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTrackSize): Call parseGridBreadth()
        for min sizing function using "InflexibleSizeOnly" restriction
        when needed.
        (WebCore::CSSParser::parseGridBreadth): Add check for
        "InflexibleSizeOnly" resctriction.
        * css/CSSParser.h: Add new type of restriction "InflexibleSizeOnly".
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::gridTrackSize): Add new condition to make
        |minTrackBreadth| auto if it was a flex size.

2016-05-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Implement Fetch redirect mode
        https://bugs.webkit.org/show_bug.cgi?id=157837

        Reviewed by Alex Christensen.

        Implementing step 5 of https://fetch.spec.whatwg.org/#http-fetch.
        Making ResourceLoaderOptions include FetchOptions.
        This allows SubresourceLoader to follow or not redirections based on that option.
        CachedResource is made responsible to handle the type of the response (opaqueredirect, opaque, cors, basic...).
        If redirection is not to be followed, either an error is returned or an empty response is returned.

        Moved Response type and redirected flag from FetchResponse to ResourceResponse.
        This allows CachedResource to easily communicate that information to FetchResponse.

        Made some clean-up refactoring in ThreadableLoaderOptions.

        http/tests/fetch/caching-with-different-options.html ensures that
        caching at CachedResourceLoader will not have bad effects on fetch.
        Covered by updated and rebased tests.

        * Modules/fetch/FetchLoader.cpp:
        (WebCore::FetchLoader::start):
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::error):
        (WebCore::FetchResponse::redirect):
        (WebCore::FetchResponse::FetchResponse):
        (WebCore::FetchResponse::clone):
        (WebCore::FetchResponse::startFetching):
        * Modules/fetch/FetchResponse.h:
        * WebCore.xcodeproj/project.pbxproj:
        * loader/FetchOptions.h: Moved from Source/WebCore/Modules/fetch/FetchOptions.h.
        * loader/ResourceLoaderOptions.h:
        (WebCore::ResourceLoaderOptions::fetchOptions):
        (WebCore::ResourceLoaderOptions::setFetchOptions):
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::willSendRequestInternal):
        * loader/ThreadableLoader.cpp:
        * loader/ThreadableLoader.h:
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::setResponse):
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::setOpaqueRedirect):
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::adopt):
        (WebCore::ResourceResponseBase::copyData):
        * platform/network/ResourceResponseBase.h:
        (WebCore::ResourceResponseBase::type):
        (WebCore::ResourceResponseBase::setType):
        (WebCore::ResourceResponseBase::encode):
        (WebCore::ResourceResponseBase::decode):

2016-05-23  Yusuke Suzuki  <utatane.tea@gmail.com>

        Assertion failure for Reflect.get with Proxy and primitive value as explicit receiver
        https://bugs.webkit.org/show_bug.cgi?id=157080

        Reviewed by Saam Barati.

        * bindings/js/JSDOMBinding.h:
        (WebCore::nonCachingStaticFunctionGetter):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowWebKit):
        * bindings/js/JSPluginElementFunctions.cpp:
        (WebCore::pluginElementPropertyGetter):
        * bindings/js/JSPluginElementFunctions.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        * bridge/runtime_array.cpp:
        (JSC::RuntimeArray::lengthGetter):
        * bridge/runtime_array.h:
        * bridge/runtime_method.cpp:
        (JSC::RuntimeMethod::lengthGetter):
        * bridge/runtime_method.h:
        * bridge/runtime_object.cpp:
        (JSC::Bindings::RuntimeObject::fallbackObjectGetter):
        (JSC::Bindings::RuntimeObject::fieldGetter):
        (JSC::Bindings::RuntimeObject::methodGetter):
        * bridge/runtime_object.h:

2016-05-23  Alex Christensen  <achristensen@webkit.org>

        Modernize CSS code
        https://bugs.webkit.org/show_bug.cgi?id=157875

        Reviewed by Chris Dumez.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        (GenerateParametersCheck):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::jsTestMediaQueryListListenerPrototypeFunctionMethod):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjConstructor::construct):
        (WebCore::setJSTestObjPutForwardsNullableAttribute):
        (WebCore::jsTestObjPrototypeFunctionMethodWithCallbackArg):
        (WebCore::jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg):
        (WebCore::jsTestObjPrototypeFunctionMethodWithCallbackFunctionArg):
        (WebCore::jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackFunctionArg):
        (WebCore::jsTestObjConstructorFunctionStaticMethodWithCallbackArg):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod5):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::JSTestTypedefsConstructor::construct):
        * css/CSSBasicShapes.cpp:
        (WebCore::serializePositionOffset):
        (WebCore::buildSerializablePositionOffset):
        (WebCore::CSSBasicShapeCircle::cssText):
        (WebCore::CSSBasicShapeEllipse::cssText):
        * css/CSSCalculationValue.cpp:
        (WebCore::determineCategory):
        (WebCore::CSSCalcExpressionNodeParser::parseValue):
        * css/CSSMediaRule.cpp:
        (WebCore::CSSMediaRule::media):
        * css/CSSMediaRule.h:
        * css/CSSOMUtils.h:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::createImportRule):
        (WebCore::CSSParser::createMediaRule):
        * css/CSSReflectValue.h:
        * css/CSSStyleSheet.cpp:
        (WebCore::CSSStyleSheet::setDisabled):
        (WebCore::CSSStyleSheet::setMediaQueries):
        (WebCore::CSSStyleSheet::insertRule):
        (WebCore::CSSStyleSheet::deleteRule):
        (WebCore::CSSStyleSheet::isLoading):
        (WebCore::CSSStyleSheet::media):
        (WebCore::CSSStyleSheet::parentStyleSheet):
        (WebCore::CSSStyleSheet::ownerDocument):
        (WebCore::CSSStyleSheet::clearChildRuleCSSOMWrappers):
        (WebCore::CSSStyleSheet::RuleMutationScope::RuleMutationScope):
        * css/CSSStyleSheet.h:
        * css/PropertySetCSSStyleDeclaration.cpp:
        * css/StyleRule.cpp:
        (WebCore::StyleRuleBase::createCSSOMWrapper):
        (WebCore::StyleRuleBase::destroy):
        (WebCore::StyleRuleGroup::wrapperRemoveRule):
        (WebCore::StyleRuleMedia::StyleRuleMedia):
        * css/StyleRule.h:
        (WebCore::StyleRuleBase::deref):
        (WebCore::StyleRuleBase::StyleRuleBase):
        (WebCore::StyleRuleMedia::create):
        (WebCore::StyleRuleMedia::mediaQueries):
        (WebCore::StyleRuleMedia::copy):
        (isType):
        * css/StyleRuleImport.cpp:
        (WebCore::StyleRuleImport::create):
        (WebCore::StyleRuleImport::StyleRuleImport):
        * css/StyleRuleImport.h:
        * css/StyleSheetContents.cpp:
        (WebCore::StyleSheetContents::isCacheable):
        (WebCore::StyleSheetContents::parserAppendRule):
        (WebCore::StyleSheetContents::ruleAt):
        (WebCore::StyleSheetContents::parserSetEncodingFromCharsetRule):
        (WebCore::StyleSheetContents::wrapperInsertRule):
        * css/StyleSheetContents.h:
        (WebCore::StyleSheetContents::hasSyntacticallyValidCSSHeader):
        (WebCore::StyleSheetContents::parserSetUsesRemUnits):
        (WebCore::StyleSheetContents::parserSetUsesStyleBasedEditability):
        (WebCore::StyleSheetContents::copy):
        * dom/InlineStyleSheetOwner.cpp:
        (WebCore::InlineStyleSheetOwner::createSheet):
        * inspector/InspectorStyleSheet.cpp:

2016-05-23  Zalan Bujtas  <zalan@apple.com>

        Changing border color and size simultaneously fails to repaint.
        https://bugs.webkit.org/show_bug.cgi?id=157967
        <rdar://problem/26423918>

        Reviewed by David Hyatt.

        This patch ensures that the neighboring tables cells are dirtied when collapsed border change requires layout.

        Test: fast/table/neighboring-cells-when-collapsed-border-changes.html

        * rendering/RenderTable.cpp:
        (WebCore::markCellDirtyWhenCollapsedBorderChanges):
        (WebCore::RenderTable::invalidateCollapsedBorders):

2016-05-23  Chris Dumez  <cdumez@apple.com>

        Avoid unnecessary call to Document::completeURL() in HTMLLinkElement::process()
        https://bugs.webkit.org/show_bug.cgi?id=157993

        Reviewed by Ryosuke Niwa.

        Avoid unnecessary call to Document::completeURL() in HTMLLinkElement::process().
        The call to getNonEmptyURLAttribute() already calls Document::completeURL()
        internally so we can just reuse the returned URL.

        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::process):

2016-05-23  Jiewen Tan  <jiewen_tan@apple.com>

        Null popstate event fired when navigating back to a cached page with a stateless history entry
        https://bugs.webkit.org/show_bug.cgi?id=157963
        <rdar://problem/23414840>

        Popstate events are not fired when WebKit navigates back to a history entry that doesn't
        have a state object if the entry's page is not cached. However, we fire popstate events
        unconditionally if the page is cached. This results in inconsistent behavior between
        initial navigations and cached navigations. Align the behavior of initial and cached
        navigations so that we produce consistent events.

        Reviewed by Brent Fulgham.

        Tests: fast/loader/stateobjects/no-popstate-when-back-to-stateless-entry-with-page-cache.html
               fast/loader/stateobjects/no-popstate-when-back-to-stateless-entry.html

        * history/CachedFrame.cpp:
        (WebCore::CachedFrameBase::restore):

2016-05-23  Chris Dumez  <cdumez@apple.com>

        Generate bindings code for EventTarget.addEventListener() / removeEventListener()
        https://bugs.webkit.org/show_bug.cgi?id=157882

        Reviewed by Darin Adler.

        Generate bindings code for EventTarget.addEventListener() / removeEventListener()
        instead of hardcoding them in the bindings generator.

        No new tests, rebaselined existing test, no web-exposed behavior change.

        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        (WebCore::AudioScheduledSourceNode::addEventListener):
        (WebCore::AudioScheduledSourceNode::removeEventListener):
        * Modules/webaudio/AudioScheduledSourceNode.h:
        * Modules/webaudio/ScriptProcessorNode.cpp:
        (WebCore::ScriptProcessorNode::addEventListener):
        (WebCore::ScriptProcessorNode::removeEventListener):
        * Modules/webaudio/ScriptProcessorNode.h:
        * bindings/gobject/GObjectEventListener.cpp:
        (WebCore::GObjectEventListener::operator==):
        * bindings/gobject/GObjectEventListener.h:
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::operator==):
        (WebCore::eventHandlerAttribute): Deleted.
        * bindings/js/JSEventListener.h:
        (WebCore::JSEventListener::create):
        (WebCore::JSEventListener::cast): Deleted.
        (WebCore::JSEventListener::jsFunction): Deleted.
        * bindings/objc/ObjCEventListener.h:
        * bindings/objc/ObjCEventListener.mm:
        (WebCore::ObjCEventListener::operator==):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        (JSValueToNative):
        (GetParentClassName): Deleted.
        (GetCallbackClassName): Deleted.
        (GetJSCallbackDataType): Deleted.
        * dom/EventListener.h:
        * dom/EventListenerMap.cpp:
        (WebCore::addListenerToVector):
        (WebCore::EventListenerMap::add):
        (WebCore::removeListenerFromVector):
        (WebCore::EventListenerMap::remove):
        (WebCore::copyListenersNotCreatedFromMarkupToTarget):
        * dom/EventListenerMap.h:
        * dom/EventTarget.cpp:
        (WebCore::EventTarget::addEventListener):
        (WebCore::EventTarget::addEventListenerForBindings):
        (WebCore::EventTarget::removeEventListenerForBindings):
        (WebCore::EventTarget::removeEventListener):
        (WebCore::EventTarget::setAttributeEventListener):
        (WebCore::EventTarget::clearAttributeEventListener):
        * dom/EventTarget.h:
        * dom/EventTarget.idl:
        * dom/MessagePort.cpp:
        (WebCore::MessagePort::addEventListener):
        * dom/MessagePort.h:
        * dom/Node.cpp:
        (WebCore::tryAddEventListener):
        (WebCore::Node::addEventListener):
        (WebCore::tryRemoveEventListener):
        (WebCore::Node::removeEventListener):
        * dom/Node.h:
        * dom/RegisteredEventListener.h:
        (WebCore::RegisteredEventListener::RegisteredEventListener):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::addEventListener):
        (WebCore::HTMLMediaElement::removeEventListener):
        * html/HTMLMediaElement.h:
        * html/ImageDocument.cpp:
        (WebCore::ImageDocument::createDocumentStructure):
        (WebCore::ImageEventListener::operator==):
        * html/shadow/MediaControlsApple.cpp:
        (WebCore::MediaControlsApple::showClosedCaptionTrackList):
        (WebCore::MediaControlsApple::hideClosedCaptionTrackList):
        (WebCore::MediaControlsAppleEventListener::operator==):
        * html/shadow/MediaControlsApple.h:
        * inspector/InspectorIndexedDBAgent.cpp:
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::addEventListener):
        (WebCore::DOMWindow::removeEventListener):
        * page/DOMWindow.h:
        * platform/cocoa/WebPlaybackSessionModelMediaElement.h:
        * platform/cocoa/WebVideoFullscreenModelVideoElement.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::addEventListener):
        (WebCore::SVGElement::removeEventListener):
        * svg/SVGElement.h:
        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefTargetEventListener::attach):
        (WebCore::SVGTRefTargetEventListener::detach):
        (WebCore::SVGTRefTargetEventListener::operator==):
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::ConditionEventListener::operator==):
        (WebCore::SVGSMILElement::connectConditions):
        (WebCore::SVGSMILElement::disconnectConditions):

2016-05-23  Chris Dumez  <cdumez@apple.com>

        Fix undefined behavior introduced in r201290.
        https://bugs.webkit.org/show_bug.cgi?id=157961

        Reviewed by Alex Christensen.

        The evaluation order of function arguments is undefined so it is unsafe to
        copyRef() and WTFMove() the same parameter in a function call.

        * css/CSSBasicShapes.h:

2016-05-23  Brady Eidson  <beidson@apple.com>

        Speculative fix for:
        Modern IDB: Some blob tests ASSERT sometimes on the bots.
        https://bugs.webkit.org/show_bug.cgi?id=157525

        Reviewed by Alex Christensen.

        No new tests (Should fix existing flakiness, not reproducibly testable).

        For all of the lambdas involved in this operation, explicitly WTFMove all of the arguments around.
        
        Critically, this includes the RefPtr<TransactionOperation> protector as well as the 
        std::function<void ()> completionHandler(s).
        
        By doing so, this removes the possibility of a race between the background thread and the main thread
        tearing down the TransactionOperation, guaranteeing that it is torn down on its original thread.
        
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::putOrAddOnServer):
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::writeBlobsToDiskForIndexedDB):
        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::writeBlobsToTemporaryFiles):

2016-05-23  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r201296.
        https://bugs.webkit.org/show_bug.cgi?id=158002

        The LayoutTest added with this change is failing on mac-wk1
        (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "Changing border color and size simultaneously fails to
        repaint."
        https://bugs.webkit.org/show_bug.cgi?id=157967
        http://trac.webkit.org/changeset/201296

2016-05-23  Dean Jackson  <dino@apple.com>

        Missing/Incomplete timestamp for inline Audio player in ePub book
        https://bugs.webkit.org/show_bug.cgi?id=157998
        <rdar://problem/25858437>

        Reviewed by Jon Lee and Tim Horton.

        On iOS it is rare to apply a text-zoom (Safari does not provide
        UI for it). However, iBooks uses text-zoom to increase the font
        size. This causes the time displays in the media controls to
        overflow their containers and be clipped.

        The solution is to simply reset the text zoom for the media controls,
        which means the time displays will always be a constant size.

        * Modules/mediacontrols/mediaControlsiOS.css:
        (audio::-webkit-media-controls-time-remaining-display):

2016-05-23  Zalan Bujtas  <zalan@apple.com>

        Changing border color and size simultaneously fails to repaint.
        https://bugs.webkit.org/show_bug.cgi?id=157967
        <rdar://problem/26423918>

        Reviewed by David Hyatt.

        This patch ensures that the neighboring tables cells are dirtied when collapsed border change requires layout.

        Test: fast/table/neighboring-cells-when-collapsed-border-changes.html

        * rendering/RenderTable.cpp:
        (WebCore::markCellDirtyWhenCollapsedBorderChanges):
        (WebCore::RenderTable::invalidateCollapsedBorders):

2016-05-23  Chris Fleizach  <cfleizach@apple.com>

        AX: iOS: when bringing focus to a text field we may zoom the page even if author wanted max scale = 1
        https://bugs.webkit.org/show_bug.cgi?id=157771

        Reviewed by Tim Horton.

        If the author requests scaling not to be enabled, we should not scale in when keyboard focus moves to a text field.
        Scaling should only happen when the user performs a gesture to do so in this case.

        Tests: fast/viewport/ios/user-scalable-does-not-scale-for-keyboard-focus-with-author-defined-scale.html
               fast/viewport/ios/user-scalable-scales-for-keyboard-focus-with-no-author-defined-scale.html

        * page/ViewportConfiguration.h:
        (WebCore::ViewportConfiguration::maximumScale):

2016-05-23  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r200414.

        This change appears to have broken the 'write a reply' field
        on Nextdoor.com

        Reverted changeset:

        "Clicks inside button elements are sometimes discarded when
        the mouse moves"
        https://bugs.webkit.org/show_bug.cgi?id=39620
        http://trac.webkit.org/changeset/200414

2016-05-23  Chris Dumez  <cdumez@apple.com>

        Clean up / Modernize the CSS Parser
        https://bugs.webkit.org/show_bug.cgi?id=157961

        Reviewed by Alex Christensen.

        Clean up / Modernize the CSS Parser.

        * WebCore.xcodeproj/project.pbxproj:
        * css/BasicShapeFunctions.cpp:
        (WebCore::valueForBasicShape):
        (WebCore::convertToLength):
        (WebCore::convertToLengthSize):
        (WebCore::basicShapeForValue):
        * css/BasicShapeFunctions.h:
        * css/CSSBasicShapes.cpp:
        (WebCore::CSSBasicShapePolygon::cssText):
        (WebCore::CSSBasicShapePolygon::equals):
        * css/CSSBasicShapes.h:
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::valueForReflection):
        (WebCore::ComputedStyleExtractor::valueForShadow):
        (WebCore::specifiedValueForGridTrackSize):
        * css/CSSCrossfadeValue.cpp:
        (WebCore::subimageKnownToBeOpaque):
        (WebCore::CSSCrossfadeValue::fixedSize):
        (WebCore::CSSCrossfadeValue::isPending):
        (WebCore::CSSCrossfadeValue::knownToBeOpaque):
        (WebCore::CSSCrossfadeValue::loadSubimages):
        (WebCore::CSSCrossfadeValue::image):
        (WebCore::CSSCrossfadeValue::blend):
        (WebCore::CSSCrossfadeValue::equals):
        (WebCore::CSSCrossfadeValue::equalInputImages):
        * css/CSSCrossfadeValue.h:
        (WebCore::CSSCrossfadeValue::create):
        (WebCore::CSSCrossfadeValue::CSSCrossfadeValue):
        * css/CSSCustomPropertyValue.h:
        (WebCore::CSSCustomPropertyValue::create):
        (WebCore::CSSCustomPropertyValue::CSSCustomPropertyValue):
        * css/CSSFilterImageValue.cpp:
        (WebCore::CSSFilterImageValue::fixedSize):
        (WebCore::CSSFilterImageValue::isPending):
        (WebCore::CSSFilterImageValue::loadSubimages):
        (WebCore::CSSFilterImageValue::image):
        (WebCore::CSSFilterImageValue::createFilterOperations):
        (WebCore::CSSFilterImageValue::equals):
        (WebCore::CSSFilterImageValue::equalInputImages):
        * css/CSSFilterImageValue.h:
        (WebCore::CSSFilterImageValue::CSSFilterImageValue):
        * css/CSSFontFaceSet.cpp:
        (WebCore::CSSFontFaceSet::matchingFaces):
        * css/CSSFunctionValue.cpp:
        (WebCore::CSSFunctionValue::CSSFunctionValue):
        * css/CSSFunctionValue.h:
        (WebCore::CSSFunctionValue::create):
        * css/CSSGradientValue.h:
        (WebCore::CSSLinearGradientValue::setAngle):
        * css/CSSGrammar.y.in:
        * css/CSSImageGeneratorValue.cpp:
        (WebCore::CSSImageGeneratorValue::subimageIsPending):
        (WebCore::CSSImageGeneratorValue::cachedImageForCSSValue):
        * css/CSSImageGeneratorValue.h:
        * css/CSSImageValue.cpp:
        (WebCore::CSSImageValue::cachedOrPendingImage):
        * css/CSSImageValue.h:
        * css/CSSKeyframesRule.cpp:
        (WebCore::StyleRuleKeyframes::StyleRuleKeyframes):
        (WebCore::StyleRuleKeyframes::parserAppendKeyframe):
        (WebCore::StyleRuleKeyframes::wrapperAppendKeyframe):
        (WebCore::CSSKeyframesRule::appendRule):
        (WebCore::CSSKeyframesRule::findRule):
        (WebCore::CSSKeyframesRule::item):
        (WebCore::StyleRuleKeyframes::~StyleRuleKeyframes): Deleted.
        * css/CSSKeyframesRule.h:
        (WebCore::StyleRuleKeyframes::keyframes):
        * css/CSSParser.cpp:
        (WebCore::parseColorValue):
        (WebCore::parseSimpleLengthValue):
        (WebCore::parseKeywordValue):
        (WebCore::parseTranslateTransformValue):
        (WebCore::CSSParser::parseFontFaceValue):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseCustomPropertyValue):
        (WebCore::CSSParser::parseDeclaration):
        (WebCore::CSSParser::SourceSize::SourceSize):
        (WebCore::filterProperties):
        (WebCore::CSSParser::clearProperties):
        (WebCore::CSSParser::addExpandedPropertyForValue):
        (WebCore::CSSParser::parseVariableDependentValue):
        (WebCore::CSSParser::parseContentDistributionOverflowPosition):
        (WebCore::CSSParser::parseItemPositionOverflowPosition):
        (WebCore::CSSParser::parseNonElementSnapPoints):
        (WebCore::CSSParser::parseScrollSnapDestination):
        (WebCore::CSSParser::parseScrollSnapCoordinate):
        (WebCore::CSSParser::parseFillShorthand):
        (WebCore::CSSParser::addAnimationValue):
        (WebCore::CSSParser::parseAnimationShorthand):
        (WebCore::CSSParser::parseColumnWidth):
        (WebCore::CSSParser::parseColumnCount):
        (WebCore::CSSParser::parseColumnsShorthand):
        (WebCore::CSSParser::parseTransitionShorthand):
        (WebCore::CSSParser::parseSize):
        (WebCore::CSSParser::parseQuotes):
        (WebCore::CSSParser::parseAlt):
        (WebCore::CSSParser::parseCustomPropertyDeclaration):
        (WebCore::CSSParser::parseContent):
        (WebCore::CSSParser::parseAttr):
        (WebCore::CSSParser::parseBackgroundColor):
        (WebCore::CSSParser::parseFillPositionComponent):
        (WebCore::CSSParser::parse4ValuesFillPosition):
        (WebCore::CSSParser::parse3ValuesFillPosition):
        (WebCore::CSSParser::parseFillPosition):
        (WebCore::CSSParser::parseFillSize):
        (WebCore::CSSParser::parseFillProperty):
        (WebCore::CSSParser::parseAnimationDelay):
        (WebCore::CSSParser::parseAnimationDirection):
        (WebCore::CSSParser::parseAnimationDuration):
        (WebCore::CSSParser::parseAnimationFillMode):
        (WebCore::CSSParser::parseAnimationIterationCount):
        (WebCore::CSSParser::parseAnimationName):
        (WebCore::CSSParser::parseAnimationPlayState):
        (WebCore::CSSParser::parseAnimationTrigger):
        (WebCore::CSSParser::parseAnimationProperty):
        (WebCore::CSSParser::parseKeyframeSelector):
        (WebCore::CSSParser::parseGridPosition):
        (WebCore::gridMissingGridPositionValue):
        (WebCore::CSSParser::parseGridItemPositionShorthand):
        (WebCore::CSSParser::parseGridGapShorthand):
        (WebCore::CSSParser::parseGridTemplateRowsAndAreasAndColumns):
        (WebCore::CSSParser::parseGridTemplateShorthand):
        (WebCore::CSSParser::parseGridShorthand):
        (WebCore::CSSParser::parseGridAreaShorthand):
        (WebCore::CSSParser::parseGridLineNames):
        (WebCore::CSSParser::parseGridTrackList):
        (WebCore::CSSParser::parseGridTrackRepeatFunction):
        (WebCore::CSSParser::parseGridTrackSize):
        (WebCore::CSSParser::parseGridAutoFlow):
        (WebCore::skipCommaInDashboardRegion):
        (WebCore::CSSParser::parseDashboardRegions):
        (WebCore::parseGridTemplateAreasColumnNames):
        (WebCore::CSSParser::parseCounterContent):
        (WebCore::CSSParser::parseClipShape):
        (WebCore::CSSParser::parseInsetRoundedCorners):
        (WebCore::CSSParser::parseBasicShapeInset):
        (WebCore::CSSParser::parseBasicShapeCircle):
        (WebCore::CSSParser::parseBasicShapeEllipse):
        (WebCore::CSSParser::parseBasicShapePolygon):
        (WebCore::CSSParser::parseBasicShapePath):
        (WebCore::CSSParser::parseBasicShapeAndOrBox):
        (WebCore::CSSParser::parseFont):
        (WebCore::CSSParser::parseFontFamily):
        (WebCore::CSSParser::parseFontSynthesis):
        (WebCore::CSSParser::parseFontFaceSrcURI):
        (WebCore::CSSParser::parseFontFaceSrc):
        (WebCore::CSSParser::parseFontFaceUnicodeRange):
        (WebCore::parseAlphaValue):
        (WebCore::ShadowParseContext::commitValue):
        (WebCore::CSSParser::parseShadow):
        (WebCore::CSSParser::parseReflect):
        (WebCore::CSSParser::parseFlex):
        (WebCore::BorderImageParseContext::commitImage):
        (WebCore::BorderImageParseContext::commitImageSlice):
        (WebCore::BorderImageParseContext::commitBorderWidth):
        (WebCore::BorderImageParseContext::commitBorderOutset):
        (WebCore::BorderImageParseContext::commitRepeat):
        (WebCore::BorderImageParseContext::commitWebKitBorderImage):
        (WebCore::BorderImageParseContext::commitBorderImageProperty):
        (WebCore::CSSParser::parseBorderImage):
        (WebCore::CSSParser::parseBorderImageRepeat):
        (WebCore::BorderImageQuadParseContext::setTop):
        (WebCore::CSSParser::parseCounter):
        (WebCore::CSSParser::parseDeprecatedGradient):
        (WebCore::CSSParser::parseDeprecatedLinearGradient):
        (WebCore::CSSParser::parseDeprecatedRadialGradient):
        (WebCore::CSSParser::parseLinearGradient):
        (WebCore::CSSParser::parseRadialGradient):
        (WebCore::CSSParser::parseFilterImage):
        (WebCore::CSSParser::parseCrossfade):
        (WebCore::CSSParser::parseImageResolution):
        (WebCore::CSSParser::parseImageSet):
        (WebCore::CSSParser::parseTransform):
        (WebCore::CSSParser::parseTransformValue):
        (WebCore::CSSParser::parseFilter):
        (WebCore::CSSParser::parseTextDecoration):
        (WebCore::CSSParser::parseTextEmphasisStyle):
        (WebCore::CSSParser::parseTextEmphasisPosition):
        (WebCore::CSSParser::parseTextIndent):
        (WebCore::CSSParser::parseHangingPunctuation):
        (WebCore::CSSParser::parseFontFeatureSettings):
        (WebCore::CSSParser::parseWillChange):
        (WebCore::CSSParser::createImportRule):
        (WebCore::CSSParser::createMediaRule):
        (WebCore::CSSParser::createEmptyMediaRule):
        (WebCore::CSSParser::createSupportsRule):
        (WebCore::CSSParser::markSupportsRuleHeaderStart):
        (WebCore::CSSParser::popSupportsRuleData):
        (WebCore::CSSParser::processAndAddNewRuleToSourceTreeIfNeeded):
        (WebCore::CSSParser::addNewRuleToSourceTree):
        (WebCore::CSSParser::popRuleData):
        (WebCore::CSSParser::createKeyframesRule):
        (WebCore::CSSParser::createStyleRule):
        (WebCore::CSSParser::createFontFaceRule):
        (WebCore::CSSParser::createPageRule):
        (WebCore::CSSParser::createRegionRule):
        (WebCore::CSSParser::endDeclarationsForMarginBox):
        (WebCore::CSSParser::createKeyframe):
        (WebCore::CSSParser::updateLastMediaLine):
        (WebCore::fixUnparsedProperties):
        (WebCore::CSSParser::fixUnparsedPropertyRanges):
        (WebCore::CSSParser::parseViewportProperty):
        (WebCore::cssPropertyNameIOSAliasing):
        (WebCore::isAppleLegacyCssValueKeyword):
        (WebCore::quoteCSSString):
        (WebCore::AnimationParseContext::commitFirstAnimation): Deleted.
        (WebCore::strictCSSParserContext): Deleted.
        (WebCore::CSSParser::~CSSParser): Deleted.
        (WebCore::convertToASCIILowercaseInPlace): Deleted.
        (WebCore::CSSParserString::convertToASCIILowercaseInPlace): Deleted.
        (WebCore::CSSParser::setupParser): Deleted.
        (WebCore::isSimpleLengthPropertyID): Deleted.
        (WebCore::isValidKeywordPropertyAndValue): Deleted.
        (WebCore::parseTransformTranslateArguments): Deleted.
        (WebCore::CSSParser::parseColor): Deleted.
        (WebCore::CSSParser::parseMediaQuery): Deleted.
        (WebCore::CSSParser::parseSizesAttribute): Deleted.
        (WebCore::CSSParser::addProperty): Deleted.
        (WebCore::CSSParser::validateCalculationUnit): Deleted.
        (WebCore::isItemPositionKeyword): Deleted.
        (WebCore::CSSParser::parseShorthand): Deleted.
        (WebCore::CSSParser::parseSizeParameter): Deleted.
        (WebCore::CSSParser::parseFillImage): Deleted.
        (WebCore::CSSParser::parsePositionY): Deleted.
        (WebCore::CSSParser::parse2ValuesFillPosition): Deleted.
        (WebCore::CSSParser::parseTransformOriginShorthand): Deleted.
        (WebCore::CSSParser::parseAnimationTimingFunction): Deleted.
        (WebCore::CSSParser::parseGridTemplateColumns): Deleted.
        (WebCore::CSSParser::parseSingleGridAreaLonghand): Deleted.
        (WebCore::allTracksAreFixedSized): Deleted.
        (WebCore::CSSParser::parseGridBreadth): Deleted.
        (WebCore::CSSParser::parseGridTemplateAreasRow): Deleted.
        (WebCore::completeBorderRadii): Deleted.
        (WebCore::CSSParser::parseShapeRadius): Deleted.
        (WebCore::isBoxValue): Deleted.
        (WebCore::CSSParser::parseShapeProperty): Deleted.
        (WebCore::CSSParser::parseClipPath): Deleted.
        (WebCore::CSSParser::parseBasicShape): Deleted.
        (WebCore::FontFamilyValueBuilder::commit): Deleted.
        (WebCore::CSSParser::parseFontWeight): Deleted.
        (WebCore::CSSParser::parseFontFaceSrcLocal): Deleted.
        (WebCore::parseDouble): Deleted.
        (WebCore::mightBeRGBA): Deleted.
        (WebCore::mightBeRGB): Deleted.
        (WebCore::ShadowParseContext::commitColor): Deleted.
        (WebCore::BorderImageParseContext::BorderImageParseContext): Deleted.
        (WebCore::BorderImageParseContext::commitForwardSlashOperator): Deleted.
        (WebCore::BorderImageParseContext::commitBorderImage): Deleted.
        (WebCore::isBorderImageRepeatKeyword): Deleted.
        (WebCore::BorderImageSliceParseContext::commitBorderImageSlice): Deleted.
        (WebCore::CSSParser::parseBorderImageQuad): Deleted.
        (WebCore::parseDeprecatedGradientColorStop): Deleted.
        (WebCore::valueFromSideKeyword): Deleted.
        (WebCore::CSSParser::isGeneratedImageValue): Deleted.
        (WebCore::CSSParser::parseCanvas): Deleted.
        (WebCore::CSSParser::parseNamedImage): Deleted.
        (WebCore::TransformOperationInfo::TransformOperationInfo): Deleted.
        (WebCore::CSSParser::isBlendMode): Deleted.
        (WebCore::filterInfoForName): Deleted.
        (WebCore::CSSParser::parseFlowThread): Deleted.
        (WebCore::CSSParser::parseRegionThread): Deleted.
        (WebCore::CSSParser::parseLineBoxContain): Deleted.
        (WebCore::CSSParser::parseFontFeatureTag): Deleted.
        (WebCore::CSSParser::parseFontVariantLigatures): Deleted.
        (WebCore::isCSSLetter): Deleted.
        (WebCore::CSSParser::markSupportsRuleHeaderEnd): Deleted.
        (WebCore::CSSParser::syntaxError): Deleted.
        (WebCore::CSSParser::logError): Deleted.
        (WebCore::CSSParser::rewriteSpecifiersWithElementName): Deleted.
        (WebCore::CSSParser::rewriteSpecifiers): Deleted.
        (WebCore::CSSParser::invalidBlockHit): Deleted.
        (WebCore::CSSParser::markRuleHeaderStart): Deleted.
        (WebCore::CSSParser::setRuleHeaderEnd): Deleted.
        (WebCore::CSSParser::markRuleHeaderEnd): Deleted.
        (WebCore::CSSParser::markRuleBodyStart): Deleted.
        (WebCore::cssPropertyID): Deleted.
        (WebCore::isCSSTokenizerIdentifier): Deleted.
        * css/CSSParser.h:
        (WebCore::CSSParser::ValueWithCalculation::setCalculation): Deleted.
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::cloneForCSSOM):
        * css/CSSPrimitiveValue.h:
        * css/CSSPropertySourceData.h:
        * css/CSSReflectValue.cpp:
        (WebCore::CSSReflectValue::equals):
        * css/CSSReflectValue.h:
        (WebCore::CSSReflectValue::create):
        (WebCore::CSSReflectValue::direction):
        (WebCore::CSSReflectValue::offset):
        (WebCore::CSSReflectValue::CSSReflectValue):
        * css/CSSShadowValue.cpp:
        (WebCore::CSSShadowValue::CSSShadowValue):
        (WebCore::CSSShadowValue::customCSSText): Deleted.
        * css/CSSShadowValue.h:
        (WebCore::CSSShadowValue::create):
        * css/CSSValue.h:
        (WebCore::compareCSSValueVector):
        * css/CSSVariableDependentValue.cpp:
        (WebCore::CSSVariableDependentValue::checkVariablesForCycles):
        * css/CSSVariableDependentValue.h:
        (WebCore::CSSVariableDependentValue::create):
        (WebCore::CSSVariableDependentValue::customCSSText):
        (WebCore::CSSVariableDependentValue::valueList):
        (WebCore::CSSVariableDependentValue::CSSVariableDependentValue):
        * css/CSSVariableValue.cpp:
        (WebCore::CSSVariableValue::buildParserValueListSubstitutingVariables):
        * css/Counter.h:
        (WebCore::Counter::create):
        (WebCore::Counter::identifier):
        (WebCore::Counter::listStyle):
        (WebCore::Counter::separator):
        (WebCore::Counter::listStyleIdent):
        (WebCore::Counter::setIdentifier):
        (WebCore::Counter::setListStyle):
        (WebCore::Counter::setSeparator):
        (WebCore::Counter::cloneForCSSOM):
        (WebCore::Counter::Counter):
        * css/DOMCSSNamespace.cpp:
        (WebCore::DOMCSSNamespace::supports):
        * css/FontFace.cpp:
        (WebCore::FontFace::parseString):
        (WebCore::FontFace::setVariant):
        * css/Rect.h:
        (WebCore::RectBase::RectBase):
        * css/SVGCSSParser.cpp:
        (WebCore::CSSParser::parseSVGStrokeDasharray):
        (WebCore::CSSParser::parseSVGPaint):
        (WebCore::CSSParser::parseSVGColor):
        (WebCore::CSSParser::parsePaintOrder):
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertReflection):
        * css/StyleProperties.cpp:
        (WebCore::MutableStyleProperties::setProperty):
        (WebCore::MutableStyleProperties::setCustomProperty):
        (WebCore::MutableStyleProperties::parseDeclaration):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::keyframeStylesForAnimation):
        (WebCore::StyleResolver::cachedOrPendingFromValue):
        * css/StyleResolver.h:
        * css/WebKitCSSMatrix.cpp:
        (WebCore::WebKitCSSMatrix::setMatrixValue):
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::setFont):
        * inspector/InspectorStyleSheet.cpp:
        (flattenSourceData):
        (ParsedStyleSheet::setSourceData):
        (ParsedStyleSheet::ruleSourceDataAt):
        (WebCore::InspectorStyleSheetForInlineStyle::getStyleAttributeRanges):
        * page/PageSerializer.cpp:
        (WebCore::PageSerializer::retrieveResourcesForProperties):
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::crossfadeBlend):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::checkVariablesInCustomProperties):

2016-05-22  Brady Eidson  <beidson@apple.com>

        Move to C++14.
        https://bugs.webkit.org/show_bug.cgi?id=157948

        Reviewed by Michael Catanzaro.

        No new tests (No change in behavior).

        * Configurations/Base.xcconfig:
        
        Replace time literal suffixes that have underscores to the forms without
        (e.g. 0_ms becomes 0ms):
        * page/mac/ServicesOverlayController.mm:
        (WebCore::ServicesOverlayController::remainingTimeUntilHighlightShouldBeShown):
        * platform/graphics/cg/IOSurfacePool.cpp:

2016-05-22  Chris Dumez  <cdumez@apple.com>

        Remove uses of PassRefPtr in JS bindings code
        https://bugs.webkit.org/show_bug.cgi?id=157949

        Reviewed by Andreas Kling.

        Remove uses of PassRefPtr in JS bindings code.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::jsArray):
        * bindings/js/JSDOMBinding.h:
        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
        * bindings/js/JSDOMGlobalObject.h:
        * bindings/js/JSDOMGlobalObjectTask.cpp:
        (WebCore::JSGlobalObjectTask::JSGlobalObjectTask):
        * bindings/js/JSDOMGlobalObjectTask.h:
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
        (WebCore::JSDOMWindowMicrotaskCallback::create):
        (WebCore::JSDOMWindowMicrotaskCallback::call):
        (WebCore::JSDOMWindowMicrotaskCallback::JSDOMWindowMicrotaskCallback):
        (WebCore::JSDOMWindowBase::queueTaskToEventLoop):
        * bindings/js/JSDOMWindowBase.h:
        * bindings/js/JSDOMWindowShell.cpp:
        (WebCore::JSDOMWindowShell::finishCreation):
        (WebCore::JSDOMWindowShell::setWindow):
        * bindings/js/JSDOMWindowShell.h:
        (WebCore::JSDOMWindowShell::create):
        * bindings/js/JSWorkerGlobalScopeBase.cpp:
        (WebCore::JSWorkerGlobalScopeBase::JSWorkerGlobalScopeBase):
        (WebCore::JSWorkerGlobalScopeBase::queueTaskToEventLoop):
        * bindings/js/JSWorkerGlobalScopeBase.h:
        * bindings/objc/DOMCustomXPathNSResolver.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GetNativeTypeForCallbacks):
        * bindings/scripts/test/JS/JSTestCallback.cpp:
        (WebCore::JSTestCallback::callbackWithSerializedScriptValueParam):
        (WebCore::JSTestCallback::callbackWithStringList):
        * bindings/scripts/test/JS/JSTestCallback.h:
        * bindings/scripts/test/JS/JSTestCallbackFunction.cpp:
        (WebCore::JSTestCallbackFunction::callbackWithSerializedScriptValueParam):
        (WebCore::JSTestCallbackFunction::callbackWithStringList):
        * bindings/scripts/test/JS/JSTestCallbackFunction.h:

2016-05-20  Dan Bernstein  <mitz@apple.com>

        Fixed USE(APPLE_INTERNAL_SDK) builds.

        * platform/cocoa/ThemeCocoa.mm:
        (WebCore::fitContextToBox):

2016-05-20  Joseph Pecoraro  <pecoraro@apple.com>

        Remove LegacyProfiler
        https://bugs.webkit.org/show_bug.cgi?id=153565

        Reviewed by Mark Lam.

        * ForwardingHeaders/profiler/Profile.h: Removed.
        * ForwardingHeaders/profiler/ProfileNode.h: Removed.
        * testing/js/WebCoreTestSupport.cpp:
        * xml/XSLStyleSheetLibxslt.cpp:
        * xml/XSLTProcessorLibxslt.cpp:

2016-05-20  Joseph Pecoraro  <pecoraro@apple.com>

        Remove LegacyProfiler
        https://bugs.webkit.org/show_bug.cgi?id=153565

        Reviewed by Saam Barati.

        JavaScriptCore now provides a sampling profiler and it is enabled
        by all ports. Web Inspector switched months ago to using the
        sampling profiler and displaying its data. Remove the legacy
        profiler, as it is no longer being used by anything other then
        console.profile and tests. We will update console.profile's
        behavior soon to have new behavior and use the sampling data.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * ForwardingHeaders/profiler/LegacyProfiler.h: Removed.
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSCustomXPathNSResolver.cpp:
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::supportsLegacyProfiling): Deleted.
        (WebCore::JSDOMWindowBase::supportsRichSourceInfo): Deleted.
        * bindings/js/JSDOMWindowBase.h:
        * bindings/js/JSWorkerGlobalScopeBase.cpp:
        (WebCore::JSWorkerGlobalScopeBase::supportsLegacyProfiling): Deleted.
        * bindings/js/JSWorkerGlobalScopeBase.h:
        * bindings/js/ScriptCachedFrameData.cpp:
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::clearWindowShell): Deleted.
        * bindings/js/ScriptProfile.h: Removed.
        * bindings/js/ScriptProfileNode.h: Removed.
        * bindings/scripts/CodeGeneratorJS.pm:
        (AddClassForwardIfNeeded): Deleted.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionMethodWithSequenceArg): Deleted.
        (WebCore::jsTestObjPrototypeFunctionMethodReturningSequence): Deleted.
        * bindings/scripts/test/TestObj.idl:
        * css/CSSParser.cpp:
        * dom/Document.cpp:
        * inspector/InspectorConsoleInstrumentation.h:
        (WebCore::InspectorInstrumentation::stopProfiling):
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::legacyProfilerEnabled): Deleted.
        (WebCore::InspectorController::setLegacyProfilerEnabled): Deleted.
        * inspector/InspectorController.h:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::stopProfilingImpl):
        * inspector/InspectorInstrumentation.h:
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::startFromConsole):
        (WebCore::InspectorTimelineAgent::stopFromConsole):
        * inspector/InspectorTimelineAgent.h:
        * inspector/PageDebuggerAgent.cpp:
        * inspector/PageRuntimeAgent.cpp:
        * inspector/ScriptProfile.idl: Removed.
        * inspector/ScriptProfileNode.idl: Removed.
        * inspector/TimelineRecordFactory.cpp:
        (WebCore::buildAggregateCallInfoInspectorObject): Deleted.
        (WebCore::buildInspectorObject): Deleted.
        (WebCore::buildProfileInspectorObject): Deleted.
        (WebCore::TimelineRecordFactory::appendProfile): Deleted.
        * inspector/TimelineRecordFactory.h:
        * page/DOMWindow.cpp:
        * page/Page.cpp:
        * page/PageConsoleClient.cpp:
        (WebCore::PageConsoleClient::profileEnd):
        (WebCore::PageConsoleClient::clearProfiles): Deleted.
        * page/PageConsoleClient.h:
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState): Deleted.
        (WebCore::Internals::consoleProfiles): Deleted.
        (WebCore::Internals::setLegacyJavaScriptProfilingEnabled): Deleted.
        * testing/Internals.h:
        * testing/Internals.idl:

2016-05-20  Zalan Bujtas  <zalan@apple.com>

        `width: 1%` on nested table cell causes its table to hog horizontal space
        https://bugs.webkit.org/show_bug.cgi?id=144696
        <rdar://problem/20839572>

        Reviewed by David Hyatt and Tim Horton.
        
        This patch is based on https://chromium.googlesource.com/chromium/src/+/9428cfb16993a2329e87c65da096ca295132ef0f

        Tests: fast/table/inner-percent-width-affects-outer-floated-div.html
               fast/table/inner-percent-width-doesnt-affect-ancestor-columns.html

        * rendering/AutoTableLayout.cpp:
        (WebCore::shouldScaleColumnsForParent):
        (WebCore::shouldScaleColumnsForSelf):
        (WebCore::AutoTableLayout::computeIntrinsicLogicalWidths):
        (WebCore::shouldScaleColumns): Deleted.
        * rendering/AutoTableLayout.h:
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::updateLogicalWidth):
        * rendering/TableLayout.h:
        (WebCore::TableLayout::scaledWidthFromPercentColumns):

2016-05-20  Jer Noble  <jer.noble@apple.com>

        Inconsistent state in playback controls
        https://bugs.webkit.org/show_bug.cgi?id=157962
        <rdar://problem/26397571>

        Reviewed by Beth Dakin.

        Do not use the playbackSessionManager() as the model, that's what the model is for.

        * platform/mac/WebPlaybackSessionInterfaceMac.mm:
        (WebCore::WebPlaybackSessionInterfaceMac::setClient):

2016-05-20  Brady Eidson  <beidson@apple.com>

        Modern IDB: Properly handle blobs in Workers.
        https://bugs.webkit.org/show_bug.cgi?id=157947

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/blob-simple-workers.html

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::putOrAddOnServer): Use writeBlobsToDiskForIndexedDBSynchronously from
          background threads instead of the asynchronous form.
        
        Add ability to set an existing empty IDBValue to be an isolated copy of a different IDBValue:
        * Modules/indexeddb/IDBValue.cpp:
        (WebCore::IDBValue::setAsIsolatedCopy):
        (WebCore::IDBValue::isolatedCopy):
        * Modules/indexeddb/IDBValue.h:
        
        Add a method - only to be called from a non-main thread - that synchronously writes blobs to disk:
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::writeBlobsToDiskForIndexedDBSynchronously):
        * bindings/js/SerializedScriptValue.h:
        
2016-05-20  Anders Carlsson  <andersca@apple.com>

        Allow named images on iOS
        https://bugs.webkit.org/show_bug.cgi?id=157960
        rdar://problem/26396532

        Reviewed by Dean Jackson.

        USE(NEW_THEME) is false on iOS so force named images to be drawn by checking PLATFORM(IOS) as well.

        * platform/graphics/NamedImageGeneratedImage.cpp:
        (WebCore::NamedImageGeneratedImage::draw):

2016-05-20  Myles C. Maxfield  <mmaxfield@apple.com>

        [Cocoa] REGRESSION(r184899): Ascent adjustments are applied to web fonts
        https://bugs.webkit.org/show_bug.cgi?id=157954
        <rdar://problem/24204349>

        Reviewed by Dean Jackson.

        There are a few specific fonts which exist on Windows and Cocoa OSes, and we will adjust
        the ascents of these fonts to better match their counterparts on Windows. However, in
        r184899, we started applying this adjustment to web fonts too.

        Test: fast/text/ascent-adjustment-webfont.html

        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::Font::platformInit):
        * svg/SVGToOTFFontConversion.cpp: We were reporting the length of font names wrong, so
        it made the test pass without this patch even when it shouldn't have. Previously, we
        were recording the number of characters in the font, not the number of bytes (each
        character is 2 bytes).

2016-05-20  John Wilander  <wilander@apple.com>

        Remove unnecessary PageOverlay client function pageOverlayDestroyed
        https://bugs.webkit.org/show_bug.cgi?id=157388
        <rdar://problem/25471523>

        Reviewed by Tim Horton.

        Remove dead PageOverlay code. Almost all of these overrides were empty and
        never called. In the case of WebPageOverlay it was never called but had a
        function body, causing confusion. There was a fear of dangling pointers in
        WebPageOverlay's static hash map between PageOverlays and WebPageOverlays.
        Only WebPageOverlay's constructor creates its PageOverlay object and adds it
        to the hash map. Its client object is kept in a unique pointer member which
        is automatically deleted when the WebPageOverlay object itself is deleted.
        This explains why PageOverlayClientImpl::pageOverlayDestroyed in
        WKBundlePageOverlay can safely be removed. Finally, WebPageOverlay's
        destructor clears the hash map entry for its PageOverlay object. Thus, there
        is no need to call WebPageOverlay::pageOverlayDestroyed nor a need for
        WebPageOverlay's destructor to call pageOverlayDestroyed on its client.

        No new tests. I tried to come up with a WebKit API test for this but I
        wasn't able to test presence/absence of WebPageOverlay's map entries since
        the map is not exposed.

        * page/DebugPageOverlays.cpp:
        (WebCore::RegionOverlay::pageOverlayDestroyed): Deleted.
        * page/PageOverlay.h:
        (WebCore::PageOverlay::Client::pageOverlayDestroyed): Deleted.
        * page/ResourceUsageOverlay.h:
        (WebCore::ResourceUsageOverlay::pageOverlayDestroyed): Deleted.
        * page/mac/ServicesOverlayController.h:
        * page/mac/ServicesOverlayController.mm:
        (WebCore::ServicesOverlayController::pageOverlayDestroyed): Deleted.
        * testing/MockPageOverlayClient.cpp:
        * testing/MockPageOverlayClient.h:
        (WebCore::MockPageOverlayClient::pageOverlayDestroyed): Deleted.

2016-05-20  Alex Christensen  <achristensen@webkit.org>

        Fix null dereferencing in CSSAnimationTriggerScrollValue::equals
        https://bugs.webkit.org/show_bug.cgi?id=157930

        Reviewed by Dean Jackson.

        Test: fast/css/compare-animation-trigger.html

        * css/CSSAnimationTriggerScrollValue.cpp:
        (WebCore::CSSAnimationTriggerScrollValue::equals):
        * css/CSSAnimationTriggerScrollValue.h:
        (WebCore::CSSAnimationTriggerScrollValue::create):
        (WebCore::CSSAnimationTriggerScrollValue::startValue):
        (WebCore::CSSAnimationTriggerScrollValue::endValue):
        (WebCore::CSSAnimationTriggerScrollValue::hasEndValue):
        (WebCore::CSSAnimationTriggerScrollValue::operator==):
        (WebCore::CSSAnimationTriggerScrollValue::CSSAnimationTriggerScrollValue):
        * css/CSSToStyleMap.cpp:
        (WebCore::CSSToStyleMap::mapAnimationTrigger):
        * css/CSSValue.h:
        (WebCore::CSSValue::operator==):

2016-05-20  Dave Hyatt  <hyatt@apple.com>

        Scrolling broken in iTunes connect pages
        https://bugs.webkit.org/show_bug.cgi?id=157678

        Reviewed by Zalan Bujtas.

        Added fast/flexbox/nested-columns-min-intrinsic-disabled.html

        Turn off minimum intrinsic size adjustment for flexboxes. This violates the spec,
        but until we can produce good results that is what we need to do. Blink has also
        turned off nested columns intrinsic sizing as well, so we match them with this
        change.

        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):

2016-05-20  Rawinder Singh  <rawinder.singh-webkit@cisra.canon.com.au>

        Implement operator== for WeakPtr
        https://bugs.webkit.org/show_bug.cgi?id=157883

        Reviewed by Chris Dumez.

        Implement operator== and operator!= for WeakPtr and update code to use the operators.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMousePressEvent):
        (WebCore::EventHandler::updateLastScrollbarUnderMouse):
        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::platformCompleteWheelEvent):

2016-05-19  Tim Horton  <timothy_horton@apple.com>

        REGRESSION (r200638): -[DOMHTMLVideoElement play] disappeared from ObjC bindings
        https://bugs.webkit.org/show_bug.cgi?id=157940
        <rdar://problem/26385907>

        Reviewed by Dan Bernstein.

        * html/HTMLMediaElement.idl:
        Drop the return value of play from the ObjC bindings, because the bindings
        generator doesn't seem to know what to do with a Promise.

2016-05-19  Chris Dumez  <cdumez@apple.com>

        Improve compile-time assertions in is<>() / downcast<>()
        https://bugs.webkit.org/show_bug.cgi?id=157817

        Reviewed by Darin Adler.

        Add missing includes and drop unnecessary is<WebVTTElement>() check
        in SharingResolver::canShareStyleWithElement() that was identified
        by the new assertions. WebVTTElement inherits Element but the check
        was done on a StyledElement.

        * accessibility/AccessibilityRenderObject.cpp:
        * accessibility/AccessibilitySVGElement.cpp:
        * css/CSSDefaultStyleSheets.cpp:
        * css/CSSParser.cpp:
        * css/CSSStyleSheet.cpp:
        * css/StyleResolver.cpp:
        * cssjit/SelectorCompiler.cpp:
        * dom/Document.cpp:
        * dom/Element.cpp:
        * dom/Node.cpp:
        * dom/Position.cpp:
        * editing/ApplyStyleCommand.cpp:
        * editing/FrameSelection.cpp:
        * editing/ReplaceSelectionCommand.cpp:
        * editing/TextIterator.cpp:
        * editing/VisiblePosition.cpp:
        * editing/VisibleUnits.cpp:
        * editing/cocoa/HTMLConverter.mm:
        * editing/htmlediting.cpp:
        * editing/markup.cpp:
        * html/GenericCachedHTMLCollection.cpp:
        * html/HTMLBodyElement.cpp:
        * html/HTMLFormElement.cpp:
        * html/HTMLLIElement.cpp:
        * html/HTMLNameCollection.cpp:
        * html/HTMLSelectElement.cpp:
        * html/parser/HTMLTreeBuilder.cpp:
        * inspector/InspectorDOMAgent.cpp:
        * inspector/InspectorStyleSheet.cpp:
        * loader/SubframeLoader.cpp:
        * loader/archive/cf/LegacyWebArchive.cpp:
        * mathml/MathMLElement.cpp:
        * page/EventHandler.cpp:
        * page/FrameView.cpp:
        * page/PageSerializer.cpp:
        * page/SpatialNavigation.cpp:
        * page/mac/EventHandlerMac.mm:
        * rendering/HitTestResult.cpp:
        * rendering/RenderBlockFlow.cpp:
        * rendering/RenderBox.cpp:
        * rendering/RenderBoxModelObject.cpp:
        * rendering/RenderElement.cpp:
        * rendering/RenderFieldset.cpp:
        * rendering/RenderLayer.cpp:
        * rendering/svg/RenderSVGTransformableContainer.cpp:
        * style/StyleSharingResolver.cpp:
        (WebCore::Style::SharingResolver::canShareStyleWithElement):
        * svg/SVGAnimationElement.cpp:
        * svg/SVGFELightElement.cpp:
        * svg/SVGTextPositioningElement.cpp:

2016-05-19  Zalan Bujtas  <zalan@apple.com>

        Cleanup RenderObject::container()
        https://bugs.webkit.org/show_bug.cgi?id=157914

        Reviewed by David Hyatt.

        1. Now we have a dedicated method for the optional, repaintContainerSkipped branch. The container finding
        logic is moved to a static inline function so the compiler can optimize out the repaintContainerSkipped branches, when
        container() is called instead of container(repaintContainer, isRepaintContainerSkipped).
        2. Use helper functions like canContainAbsolutelyPositionedObjects()
        3. Remove stale comments.

        No behaviour change.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::mapLocalToContainer):
        (WebCore::RenderBox::pushMappingToContainer):
        (WebCore::RenderBox::computeRectForRepaint):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::computeRectForRepaint):
        (WebCore::RenderInline::mapLocalToContainer):
        (WebCore::RenderInline::pushMappingToContainer):
        * rendering/RenderObject.cpp:
        (WebCore::containerForElement):
        (WebCore::RenderObject::container):
        * rendering/RenderObject.h:
        * rendering/RenderText.h:

2016-05-16  Enrica Casucci  <enrica@apple.com>

        No candidate punctuation when typing punctuation in WK2 text field.
        https://bugs.webkit.org/show_bug.cgi?id=157773
        rdar://problem/23084603

        Reviewed by Sam Weinig.

        We need to keep the inputManagerHint as part of the platform key event
        information. Adding a new initializer for the task and a property to retrieve
        the stored hint.

        * platform/ios/WebEvent.h:
        * platform/ios/WebEvent.mm:
        (-[WebEvent initWithKeyEventType:timeStamp:characters:charactersIgnoringModifiers:modifiers:isRepeating:withFlags:keyCode:isTabKey:characterSet:]):
        (-[WebEvent initWithKeyEventType:timeStamp:characters:charactersIgnoringModifiers:modifiers:isRepeating:withFlags:withInputManagerHint:keyCode:isTabKey:]):
        (-[WebEvent dealloc]):
        (-[WebEvent inputManagerHint]):

2016-05-19  Brady Eidson  <beidson@apple.com>

        Finishing off: Modern IDB: Website data store management.
        https://bugs.webkit.org/show_bug.cgi?id=157626

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/new-database-after-user-delete.html

        This patch does two primary things:
        1 - Implements the actual "delete files on disk" code for unopened databases,
            taken from existing WK2 code.

        2 - When a UniqueIBDDatabase is told to close immediately for user delete, it also
            queues up a "delete backing store unconditionally" operation in the database task queue.

            That way, all of the open databases are deleted before the primary "delete all files"
            pass, and they are also deleted before any future openDB requests are handled that might
            recreate the files.

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::getOrCreateUniqueIDBDatabase):
        (WebCore::IDBServer::IDBServer::deleteDatabase):
        (WebCore::IDBServer::IDBServer::closeUniqueIDBDatabase):
        (WebCore::IDBServer::IDBServer::openDBRequestCancelled):
        (WebCore::IDBServer::removeAllDatabasesForOriginPath):
        (WebCore::IDBServer::IDBServer::performCloseAndDeleteDatabasesModifiedSince):
        (WebCore::IDBServer::IDBServer::performCloseAndDeleteDatabasesForOrigins):

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performUnconditionalDeleteBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::doneWithHardClose):
        (WebCore::IDBServer::UniqueIDBDatabase::immediateCloseForUserDelete):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2016-05-19  Brady Eidson  <beidson@apple.com>

        REGRESSION(201098) GuardMalloc / ASan crashes in WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTaskReply
        https://bugs.webkit.org/show_bug.cgi?id=157917

        Reviewed by Alex Christensen.

        No new tests (Covered by all existing tests in Gmalloc/ASAN configs).

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::~UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTaskReply): Protect this from deletion before executing the task.

2016-05-19  Jer Noble  <jer.noble@apple.com>

        [IOS] Add setting to allow playback to continue inline after exiting fullscreen.
        https://bugs.webkit.org/show_bug.cgi?id=157912

        Reviewed by Eric Carlson.

        Test: media/media-fullscreen-return-to-inline.html

        Allow playback to continue when exiting fullscreen via settings.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::exitFullscreen):
        * page/Settings.in:

2016-05-19  Dave Hyatt  <hyatt@apple.com>

        Fix childrenInline() check in markAllDescendantsWithFloatsForLayout()
        https://bugs.webkit.org/show_bug.cgi?id=157866

        Reviewed by Zalan Bujtas.

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::markAllDescendantsWithFloatsForLayout):

2016-05-19  Chris Dumez  <cdumez@apple.com>

        Update RenderBlockFlow::adjustComputedFontSizes() to use RenderObjectTraversal
        https://bugs.webkit.org/show_bug.cgi?id=157784

        Reviewed by Zalan Bujtas.

        Update RenderBlockFlow::adjustComputedFontSizes() to use RenderObjectTraversal
        instead of having its own Renderer tree traversal API, specifically for iOS
        text autosizing.

        * rendering/RenderBlockFlow.cpp:
        (WebCore::isVisibleRenderText):
        (WebCore::resizeTextPermitted):
        (WebCore::isNonBlocksOrNonFixedHeightListItems):
        (WebCore::RenderBlockFlow::adjustComputedFontSizes):
        * rendering/RenderIterator.h:
        (WebCore::RenderObjectTraversal::nextSkippingChildren):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::traverseNext): Deleted.
        (WebCore::RenderObject::enclosingBox): Deleted.
        (WebCore::RenderObject::enclosingBoxModelObject): Deleted.
        (WebCore::RenderObject::fixedPositionedWithNamedFlowContainingBlock): Deleted.
        (WebCore::hasFixedPosInNamedFlowContainingBlock): Deleted.
        (WebCore::RenderObject::firstLineBlock): Deleted.
        (WebCore::objectIsRelayoutBoundary): Deleted.
        * rendering/RenderObject.h:

2016-05-19  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the build with GCC 4.9 in CSSParser.cpp
        https://bugs.webkit.org/show_bug.cgi?id=157887

        Reviewed by Chris Dumez.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::createViewportRule):
        * css/CSSParser.h:

2016-05-18  Brian Burg  <bburg@apple.com>

        Web Inspector: use a consistent prefix for injected scripts
        https://bugs.webkit.org/show_bug.cgi?id=157715
        <rdar://problem/26287188>

        Reviewed by Timothy Hatcher.

        * CMakeLists.txt:
        * DerivedSources.make:
        * inspector/CommandLineAPIModuleSource.js:

2016-05-18  Jer Noble  <jer.noble@apple.com>

        Playback controls should not be active for muted media elements.
        https://bugs.webkit.org/show_bug.cgi?id=157876
        <rdar://problem/26007525>

        Reviewed by Eric Carlson.

        Consolidate calls to setUpPlaybackControlsManager() and clearUpPlaybackControlsManager()
        into a new method, updatePlaybackControlsManager(), which checks with the MediaElementSession
        whether the media element can currently control the playback controls manager, and call
        one or the other method conditionally.

        That means more logic needs to be moved into MediaElementSession::canControlControlsManager(),
        such as whether the element is muted(), has ended(), or whether the element's document has
        been suspended.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::~HTMLMediaElement):
        (WebCore::HTMLMediaElement::setMuted):
        (WebCore::HTMLMediaElement::updatePlayState):
        (WebCore::HTMLMediaElement::clearMediaPlayer):
        (WebCore::HTMLMediaElement::stopWithoutDestroyingMediaPlayer):
        (WebCore::HTMLMediaElement::createMediaPlayer):
        (WebCore::HTMLMediaElement::updatePlaybackControlsManager):
        * html/HTMLMediaElement.h:
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::canControlControlsManager):

2016-05-19  Chris Dumez  <cdumez@apple.com>

        Kill JSDOMBindings' createNewWrapper()
        https://bugs.webkit.org/show_bug.cgi?id=157842

        Reviewed by Youenn Fablet.

        Kill JSDOMBindings' createNewWrapper() as it is identical to createWrapper().

        * bindings/js/JSDOMBinding.h:
        (WebCore::createNewWrapper): Deleted.
        * bindings/js/JSDocumentFragmentCustom.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/js/JSNodeListCustom.cpp:
        (WebCore::createWrapper):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::toJSNewlyCreated):

2016-05-18  Jer Noble  <jer.noble@apple.com>

        Playback controls still valid after navigating back after watching YouTube video.
        https://bugs.webkit.org/show_bug.cgi?id=157874
        <rdar://problem/25993063>

        Reviewed by Eric Carlson.

        YouTube uses window.onpopstate to "navigate" backwards from a video page to the main page
        (or other video page). This causes the playback controls to not be cleared (since no
        navigation actually occured). Instead, clear the playback controls when we clear our
        MediaPlayer due to load() being called, when the src= attribute is changed, or when a
        <source> element is added to the <video>.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::clearMediaPlayer):
        (WebCore::HTMLMediaElement::createMediaPlayer):

2016-05-19  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] unrelated codecs required to play videos
        https://bugs.webkit.org/show_bug.cgi?id=135972

        Reviewed by Michael Catanzaro.

        Instead of hard-coding the list of supported mime-types, check the
        decoder and demuxer GStreamer elements available and dynamically
        build the list of mime-types accordingly. This patch also removes
        support for under-used and exotic mime-types.

        Based on a patch by Mario Sanchez Prada.

        No new tests, existing media tests cover this change.

        * platform/graphics/gstreamer/GStreamerUtilities.cpp:
        (WebCore::gstRegistryHasElementForMediaType): New function
        checking the elements registered in the factories have a sink pad
        matching the caps specified as second argument of the function.
        * platform/graphics/gstreamer/GStreamerUtilities.h:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::mimeTypeSet): Hard-coded list of mime-types replaced by
        runtime-built list of mime-types that can be supported by the
        GStreamer decoders and demuxers available on the host machine.
        (WebCore::MediaPlayerPrivateGStreamer::getSupportedTypes):
        mimeTypeCache renamed to mimeTypeSet.
        (WebCore::MediaPlayerPrivateGStreamer::supportsType): Ditto.

2016-05-19  Csaba Osztrogonác  <ossy@webkit.org>

        [ARM] Fix Wformat warning in MemoryPressureHandler.cpp
        https://bugs.webkit.org/show_bug.cgi?id=157892

        Reviewed by Michael Saboff.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::ReliefLogger::logMemoryUsageChange):

2016-05-19  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove castDOMMobjectForWrapperCreation(T&)
        https://bugs.webkit.org/show_bug.cgi?id=157886

        Reviewed by Andreas Kling.

        No change of behavior.

        * bindings/js/JSDOMBinding.h:
        (WebCore::castDOMObjectForWrapperCreation): Deleted.

2016-05-18  Antti Koivisto  <antti@apple.com>

        Style resolution for explicitly inherited properties is inefficient
        https://bugs.webkit.org/show_bug.cgi?id=157860

        Reviewed by Andreas Kling.

        We mark the parent style with hasExplicitlyInheritedProperties bit rather than the style that is actually
        affected by inherited properties. This leads to various inefficiencies including unnecessarily wide style recalcs.

        * css/StyleResolver.cpp:
        (WebCore::isCacheableInMatchedPropertiesCache):

            Check the style itself rather than the parent. This allows more caching.

        (WebCore::StyleResolver::applyProperty):

            Mark the style rather than the parent.

        * style/StyleChange.cpp:
        (WebCore::Style::determineChange):

            Remove hasExplicitlyInheritedProperties test and just return NoInherit. Having explicitly inherited
            properties doesn't make the children inherit them automatically.

            This allows smaller style recalcs.

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::resolveElement):

            This patch exposed a bug with appearance property in meter and progress elements.
            They may construct different renderer based on appearance so we need to force
            render tree reconstruction when it changes.

        (WebCore::Style::TreeResolver::popParentsToDepth):
        (WebCore::Style::shouldResolvePseudoElement):

            Don't clear the style recalc bits here.

        (WebCore::Style::shouldResolveElement):

            Add a helper.
            If the parent had a NoInherit style change, test if the element has existing style with
            hasExplicitlyInheritedProperties bit. If so we need to re-resolve this element.

        (WebCore::Style::clearNeedsStyleResolution):

            Also clear pseudo elements.

        (WebCore::Style::TreeResolver::resolveComposedTree):

2016-05-19  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Refactor toJS functions to use toJSNewlyCreated
        https://bugs.webkit.org/show_bug.cgi?id=157835

        Reviewed by Chris Dumez.

        Moving checks generated by binding generator from toJS to toJSNewlyCreated.
        Changing wrap template function to use toJSNewlyCreated function.
        This allows DOMClass toJS() to be equivalent to wrap template function.

        Refactored custom binding code to take benefit of this.

        Covered by existing tests.

        * bindings/js/JSAnimationTimelineCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSBlobCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSCSSRuleCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSCSSValueCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSCanvasRenderingContextCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSDOMBinding.h:
        (WebCore::wrap):
        (WebCore::toJS):
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::toJS):
        (WebCore::cachedDocumentWrapper): Deleted.
        * bindings/js/JSDocumentFragmentCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSEventCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSHTMLCollectionCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSHTMLTemplateElementCustom.cpp:
        (WebCore::JSHTMLTemplateElement::content):
        * bindings/js/JSIDBCursorCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSImageDataCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSMediaStreamCapabilitiesCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSNodeListCustom.h:
        (WebCore::toJS):
        * bindings/js/JSPerformanceEntryCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSSVGPathSegCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSStyleSheetCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSTextCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSTextTrackCueCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSTrackCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSXMLDocumentCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        * bindings/scripts/test/JS/JSTestException.cpp:
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/JS/JSattribute.cpp:
        * bindings/scripts/test/JS/JSreadonly.cpp:

2016-05-19  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Make binding DOM constructor use toJSNewlyCreated instead of toJS
        https://bugs.webkit.org/show_bug.cgi?id=157832

        Reviewed by Chris Dumez.

        Using toJSNewlyCreated in generated constructors instead of toJS.
        Enabling generation of toJS and toJSNewlyCreated for constructable DOM objects.
        This ensures that toJSNewlyCreated call in constructor will compile properly.

        Updating some custom code to implement toJSNewlyCreated.

        Covered by existing tests.

        * bindings/js/JSImageDataCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSTextTrackCueCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/scripts/CodeGeneratorJS.pm:
        (ShouldGenerateToJSDeclaration):
        (GenerateConstructorDefinition):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterfaceConstructor::construct):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::JSTestNamedConstructorNamedConstructor::construct):
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::JSTestNodeConstructor::construct):
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/scripts/test/JS/JSTestNode.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjConstructor::construct):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::constructJSTestOverloadedConstructors1):
        (WebCore::constructJSTestOverloadedConstructors2):
        (WebCore::constructJSTestOverloadedConstructors3):
        (WebCore::constructJSTestOverloadedConstructors4):
        (WebCore::constructJSTestOverloadedConstructors5):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::JSTestTypedefsConstructor::construct):

2016-05-18  Zalan Bujtas  <zalan@apple.com>

        Make LayoutUnit::operator bool() explicit.
        https://bugs.webkit.org/show_bug.cgi?id=157871

        Reviewed by Simon Fraser.

        This is in preparation for getting LayoutUnit::operator int() removed.

        No behaviour change.

        * platform/LayoutUnit.h:
        (WebCore::LayoutUnit::operator bool):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::initializeLayoutState): Negative page height is invalid.

2016-05-18  Eric Carlson  <eric.carlson@apple.com>

        [iOS] Fullscreen video playback broken in WK1 apps
        https://bugs.webkit.org/show_bug.cgi?id=157847
        <rdar://problem/25879521>

        Reviewed by Jer Noble.

        * platform/cocoa/WebVideoFullscreenModelVideoElement.h:
        (WebCore::WebVideoFullscreenModelVideoElement::playbackSessionModel): New, model accessor.
        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
        (WebVideoFullscreenModelVideoElement::setWebVideoFullscreenInterface): Set model's playback interface.
        (WebVideoFullscreenModelVideoElement::setVideoElement): Set model's video element.

        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        (WebVideoFullscreenControllerContext::didCleanupFullscreen): Clear m_sessionModel.
        (WebVideoFullscreenControllerContext::setVideoDimensions): This is called from both the UI and
          Web threads, so dispatch to the UI thread when necessary.
        (WebVideoFullscreenControllerContext::play): Call the model's playback session on the Web thread.
        (WebVideoFullscreenControllerContext::pause): Ditto.
        (WebVideoFullscreenControllerContext::togglePlayState): Ditto.
        (WebVideoFullscreenControllerContext::beginScrubbing): Ditto.
        (WebVideoFullscreenControllerContext::endScrubbing): Ditto.
        (WebVideoFullscreenControllerContext::seekToTime): Ditto.
        (WebVideoFullscreenControllerContext::fastSeek): Ditto.
        (WebVideoFullscreenControllerContext::beginScanningForward): Ditto.
        (WebVideoFullscreenControllerContext::beginScanningBackward): Ditto.
        (WebVideoFullscreenControllerContext::endScanning): Ditto.
        (WebVideoFullscreenControllerContext::selectAudioMediaOption): Ditto.
        (WebVideoFullscreenControllerContext::selectLegibleMediaOption): Ditto.
        (WebVideoFullscreenControllerContext::setUpFullscreen): Create and configure a session model.
        (WebVideoFullscreenSessionModel::play): Pass call back to the controller.
        (WebVideoFullscreenSessionModel::pause): Ditto.
        (WebVideoFullscreenSessionModel::togglePlayState): Ditto.
        (WebVideoFullscreenSessionModel::beginScrubbing): Ditto.
        (WebVideoFullscreenSessionModel::endScrubbing): Ditto.
        (WebVideoFullscreenSessionModel::seekToTime): Ditto.
        (WebVideoFullscreenSessionModel::fastSeek): Ditto.
        (WebVideoFullscreenSessionModel::beginScanningForward): Ditto.
        (WebVideoFullscreenSessionModel::beginScanningBackward): Ditto.
        (WebVideoFullscreenSessionModel::endScanning): Ditto.
        (WebVideoFullscreenSessionModel::selectAudioMediaOption): Ditto.
        (WebVideoFullscreenSessionModel::selectLegibleMediaOption): Ditto.

2016-05-18  Zalan Bujtas  <zalan@apple.com>

        Remove LayoutUnit::operator unsigned().
        https://bugs.webkit.org/show_bug.cgi?id=157856

        Reviewed by Simon Fraser.

        Converting LayoutUnit values to unsigned is lossy. We should avoid
        such implicit conversions. 

        No behaviour change.

        * html/ImageInputType.cpp:
        (WebCore::ImageInputType::height):
        (WebCore::ImageInputType::width):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::hitTestResultAtPoint):
        * platform/LayoutUnit.h:
        (WebCore::LayoutUnit::operator unsigned): Deleted.
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::computeColumnCountAndWidth):

2016-05-18  Alex Christensen  <achristensen@webkit.org>

        Clean up CSS code
        https://bugs.webkit.org/show_bug.cgi?id=157808

        Reviewed by Chris Dumez.

        No new tests. Just cleaning up and modernizing code.

        * css/BasicShapeFunctions.cpp:
        (WebCore::convertToCenterCoordinate):
        (WebCore::cssValueToBasicShapeRadius):
        (WebCore::basicShapeForValue):
        * css/BasicShapeFunctions.h:
        * css/CSSAnimationTriggerScrollValue.h:
        (WebCore::CSSAnimationTriggerScrollValue::create):
        (WebCore::CSSAnimationTriggerScrollValue::startValue):
        (WebCore::CSSAnimationTriggerScrollValue::CSSAnimationTriggerScrollValue):
        * css/CSSAspectRatioValue.h:
        * css/CSSBasicShapes.h:
        * css/CSSBorderImage.cpp:
        (WebCore::createBorderImageValue):
        * css/CSSBorderImage.h:
        * css/CSSBorderImageSliceValue.h:
        (WebCore::CSSBorderImageSliceValue::create):
        * css/CSSCalculationValue.h:
        * css/CSSCanvasValue.h:
        (WebCore::CSSCanvasValue::CSSCanvasValue):
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::valueForNinePieceImageSlice):
        (WebCore::valueForNinePieceImageQuad):
        (WebCore::valueForNinePieceImage):
        (WebCore::zoomAdjustedPixelValue):
        * css/CSSComputedStyleDeclaration.h:
        * css/CSSFontFaceLoadEvent.cpp:
        (WebCore::CSSFontFaceLoadEvent::CSSFontFaceLoadEvent):
        * css/CSSFontFaceLoadEvent.h:
        * css/CSSFontValue.h:
        * css/CSSFunctionValue.h:
        * css/CSSGradientValue.h:
        (WebCore::CSSGradientValue::setFirstX):
        (WebCore::CSSGradientValue::setFirstY):
        (WebCore::CSSGradientValue::setSecondX):
        (WebCore::CSSGradientValue::setSecondY):
        (WebCore::CSSGradientValue::addStop):
        (WebCore::CSSLinearGradientValue::create):
        (WebCore::CSSLinearGradientValue::setAngle):
        (WebCore::CSSRadialGradientValue::setFirstRadius):
        (WebCore::CSSRadialGradientValue::setSecondRadius):
        (WebCore::CSSRadialGradientValue::setShape):
        (WebCore::CSSRadialGradientValue::setSizingBehavior):
        (WebCore::CSSRadialGradientValue::setEndHorizontalSize):
        (WebCore::CSSRadialGradientValue::setEndVerticalSize):
        * css/CSSGroupingRule.cpp:
        (WebCore::CSSGroupingRule::item):
        (WebCore::CSSGroupingRule::cssRules):
        * css/CSSKeyframesRule.cpp:
        (WebCore::CSSKeyframesRule::cssRules):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::addProperty):
        (WebCore::CSSParser::rollbackLastProperties):
        (WebCore::CSSParser::parseDashboardRegions):
        (WebCore::CSSParser::parseClipShape):
        (WebCore::CSSParser::parseBasicShapeCircle):
        (WebCore::BorderImageParseContext::commitWebKitBorderImage):
        (WebCore::BorderImageParseContext::commitBorderImage):
        (WebCore::BorderImageSliceParseContext::commitBorderImageSlice):
        (WebCore::BorderImageQuadParseContext::commitBorderImageQuad):
        (WebCore::CSSParser::parseDeprecatedRadialGradient):
        (WebCore::CSSParser::parseRadialGradient):
        * css/CSSParser.h:
        (WebCore::cssyylex):
        * css/CSSPrimitiveValue.h:
        * css/CSSProperty.cpp:
        * css/CSSProperty.h:
        (WebCore::CSSProperty::CSSProperty):
        * css/CSSRule.h:
        * css/CSSRuleList.h:
        * css/CSSSegmentedFontFace.h:
        * css/Counter.h:
        (WebCore::Counter::create):
        (WebCore::Counter::identifier):
        (WebCore::Counter::listStyleIdent):
        (WebCore::Counter::setIdentifier):
        (WebCore::Counter::setListStyle):
        (WebCore::Counter::setSeparator):
        (WebCore::Counter::equals):
        (WebCore::Counter::cloneForCSSOM):
        (WebCore::Counter::Counter):
        * css/Pair.h:
        * css/Rect.h:
        (WebCore::RectBase::bottom):
        (WebCore::RectBase::left):
        (WebCore::RectBase::setTop):
        (WebCore::RectBase::setRight):
        (WebCore::RectBase::setBottom):
        (WebCore::RectBase::setLeft):
        (WebCore::RectBase::equals):
        * css/SVGCSSComputedStyleDeclaration.cpp:
        (WebCore::strokeDashArrayToCSSValueList):
        (WebCore::ComputedStyleExtractor::adjustSVGPaintForCurrentColor):
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertClipPath):
        (WebCore::StyleBuilderConverter::convertShapeValue):
        * css/StyleProperties.cpp:
        (WebCore::StyleProperties::borderPropertyValue):
        (WebCore::StyleProperties::getPropertyCSSValue):
        (WebCore::StyleProperties::getPropertyCSSValueInternal):
        (WebCore::MutableStyleProperties::setCustomProperty):
        (WebCore::MutableStyleProperties::setProperty):
        * css/StyleProperties.h:
        (WebCore::StyleProperties::isEmpty):
        (isType):
        * css/StylePropertyShorthand.cpp:
        * css/StylePropertyShorthand.h:
        (WebCore::StylePropertyShorthand::StylePropertyShorthand):
        (WebCore::StylePropertyShorthand::id):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::appendAuthorStyleSheets):
        (WebCore::StyleResolver::addKeyframeStyle):
        (WebCore::StyleResolver::~StyleResolver):
        (WebCore::StyleResolver::resolvedVariableValue):
        (WebCore::StyleResolver::styleImage):
        (WebCore::StyleResolver::cachedOrPendingFromValue):
        (WebCore::StyleResolver::generatedOrPendingFromValue):
        (WebCore::StyleResolver::createFilterOperations):
        (WebCore::StyleResolver::loadPendingImage):
        * css/StyleResolver.h:
        (WebCore::StyleResolver::hasViewportDependentMediaQueries):
        (WebCore::StyleResolver::state):
        (WebCore::checkRegionSelector):
        * css/StyleSheetList.h:
        * css/WebKitCSSFilterValue.cpp:
        * css/WebKitCSSFilterValue.h:
        * css/WebKitCSSTransformValue.cpp:
        * css/WebKitCSSTransformValue.h:
        * rendering/shapes/Shape.cpp:

2016-05-18  Jer Noble  <jer.noble@apple.com>

        webkitEnterFullscreen() does not require a user gesture when RequireUserGestureForAudioRateChange is set.
        https://bugs.webkit.org/show_bug.cgi?id=157803

        Reviewed by Eric Carlson.

        Test: media/video-play-audio-require-user-gesture.html

        Refactor the setting of restrictions in the HTMLMediaElement constructor, and in so doing, only
        relax the RequireUserGestureForFullscreen restriction if both videoPlaybackRequiresUserGesture()
        and audioPlaybackRequiresUserGesture() settings are not set.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):

2016-05-18  Jer Noble  <jer.noble@apple.com>

        Playback session sends audio and text track lists when media does not have audio or text tracks.
        https://bugs.webkit.org/show_bug.cgi?id=157865
        <rdar://problem/25992750>

        Reviewed by Beth Dakin.

        Only send across the CaptionUserPreferences-generated list of audio and text tracks if those
        text tracks exist in the first place. This matches the behavior of the built-in controls.

        * platform/cocoa/WebPlaybackSessionModelMediaElement.mm:
        (WebPlaybackSessionModelMediaElement::updateLegibleOptions):

2016-05-18  Chris Dumez  <cdumez@apple.com>

        Clean up / Modernize TextAutoSizingValue::adjustNodeSizes()
        https://bugs.webkit.org/show_bug.cgi?id=157861

        Reviewed by Alex Christensen.

        Clean up / Modernize TextAutoSizingValue::adjustNodeSizes(), and
        use tighter typing for autosizing nodes.

        * dom/Document.cpp:
        (WebCore::Document::addAutoSizingNode):
        * dom/Document.h:
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::adjustComputedFontSizes):
        * rendering/TextAutoSizing.cpp:
        (WebCore::TextAutoSizingValue::addNode):
        (WebCore::TextAutoSizingValue::adjustNodeSizes):
        (WebCore::TextAutoSizingValue::reset):
        * rendering/TextAutoSizing.h:

2016-05-18  Simon Fraser  <simon.fraser@apple.com>

        Remove logging inadvertently committed in r201090.

        * css/CSSParser.cpp:
        (WebCore::CSSParserContext::CSSParserContext): Deleted.

2016-05-18  Brady Eidson  <beidson@apple.com>

        Modern IDB: Add support for server side closing of open database connections.
        https://bugs.webkit.org/show_bug.cgi?id=157843

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/handle-user-delete.html

        In order to support deleting IndexedDB databases, the IDB server needs the ability to 
        "immediately" close a currently open IDB connection.
        
        To do so cleanly, the server has to:
        - Error out all requests it knows about
        - Abort all transactions it knows about
        - Tell the connection that it is being closed
        - Wait for the connection to acknowledge that it was closed on the server
        
        And then the client has to:
        - Error out all requests it hasn't sent to the server
        - Abort all transactions that haven't already been aborted by the server
        - Send acknowledgement to the server that it has been closed.

        Finally, because the status of a given request might be "in flight" somewhere between the 
        server and the client, some design assumptions change. This requires reworking some ASSERTS,
        null checks, etc.

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::didCloseFromServer): Do the heavy lifting for the immediate close on
          the client side.
        * Modules/indexeddb/IDBDatabase.h:
        
        * Modules/indexeddb/IDBDatabaseIdentifier.h:
        (WebCore::IDBDatabaseIdentifier::isRelatedToOrigin):
        
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::connectionClosedFromServer): Error out all outstanding operations
          and fire the abort error on itself.
        * Modules/indexeddb/IDBTransaction.h:
        
        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::completeOperation):
        (WebCore::IDBClient::IDBConnectionProxy::didCloseFromServer):
        (WebCore::IDBClient::IDBConnectionProxy::confirmDidCloseFromServer):
        (WebCore::IDBClient::IDBConnectionProxy::forgetActiveOperations):
        * Modules/indexeddb/client/IDBConnectionProxy.h:
        
        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::didCloseFromServer):
        (WebCore::IDBClient::IDBConnectionToServer::confirmDidCloseFromServer):
        * Modules/indexeddb/client/IDBConnectionToServer.h:
        * Modules/indexeddb/client/IDBConnectionToServerDelegate.h:
        
        * Modules/indexeddb/server/IDBConnectionToClient.cpp:
        (WebCore::IDBServer::IDBConnectionToClient::didCloseFromServer):
        * Modules/indexeddb/server/IDBConnectionToClient.h:
        * Modules/indexeddb/server/IDBConnectionToClientDelegate.h:
        
        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::confirmDidCloseFromServer):
        (WebCore::IDBServer::generateDeleteCallbackID):
        (WebCore::IDBServer::IDBServer::closeAndDeleteDatabasesModifiedSince):
        (WebCore::IDBServer::IDBServer::closeAndDeleteDatabasesForOrigins):
        (WebCore::IDBServer::IDBServer::performCloseAndDeleteDatabasesModifiedSince):
        (WebCore::IDBServer::IDBServer::performCloseAndDeleteDatabasesForOrigins):
        (WebCore::IDBServer::IDBServer::didPerformCloseAndDeleteDatabases):
        * Modules/indexeddb/server/IDBServer.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::~UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::openDatabaseConnection):
        (WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::handleDatabaseOperations):
        (WebCore::IDBServer::UniqueIDBDatabase::handleCurrentOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::handleDelete):
        (WebCore::IDBServer::UniqueIDBDatabase::createObjectStore):
        (WebCore::IDBServer::UniqueIDBDatabase::deleteObjectStore):
        (WebCore::IDBServer::UniqueIDBDatabase::clearObjectStore):
        (WebCore::IDBServer::UniqueIDBDatabase::createIndex):
        (WebCore::IDBServer::UniqueIDBDatabase::deleteIndex):
        (WebCore::IDBServer::UniqueIDBDatabase::putOrAdd):
        (WebCore::IDBServer::UniqueIDBDatabase::getRecord):
        (WebCore::IDBServer::UniqueIDBDatabase::getCount):
        (WebCore::IDBServer::UniqueIDBDatabase::deleteRecord):
        (WebCore::IDBServer::UniqueIDBDatabase::openCursor):
        (WebCore::IDBServer::UniqueIDBDatabase::iterateCursor):
        (WebCore::IDBServer::UniqueIDBDatabase::commitTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::abortTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::connectionClosedFromClient):
        (WebCore::IDBServer::UniqueIDBDatabase::connectionClosedFromServer):
        (WebCore::IDBServer::UniqueIDBDatabase::confirmDidCloseFromServer):
        (WebCore::IDBServer::UniqueIDBDatabase::enqueueTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::isCurrentlyInUse):
        (WebCore::IDBServer::UniqueIDBDatabase::invokeOperationAndTransactionTimer):
        (WebCore::IDBServer::UniqueIDBDatabase::operationAndTransactionTimerFired):
        (WebCore::IDBServer::UniqueIDBDatabase::activateTransactionInBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::transactionCompleted):
        (WebCore::IDBServer::UniqueIDBDatabase::postDatabaseTask):
        (WebCore::IDBServer::UniqueIDBDatabase::postDatabaseTaskReply):
        (WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTask):
        (WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTaskReply):
        (WebCore::IDBServer::UniqueIDBDatabase::doneWithHardClose):
        (WebCore::IDBServer::errorOpenDBRequestForUserDelete):
        (WebCore::IDBServer::UniqueIDBDatabase::immediateCloseForUserDelete): Do the heavy lifting
          for the immediate close on the server side.
        (WebCore::IDBServer::UniqueIDBDatabase::performErrorCallback):
        (WebCore::IDBServer::UniqueIDBDatabase::performKeyDataCallback):
        (WebCore::IDBServer::UniqueIDBDatabase::performGetResultCallback):
        (WebCore::IDBServer::UniqueIDBDatabase::performCountCallback):
        (WebCore::IDBServer::UniqueIDBDatabase::storeCallback): Deleted.
        (WebCore::IDBServer::UniqueIDBDatabase::storeCallbackOrFireError): If the database has been
          hard stopped, immediately fire and error for the callback and return a 0-identifier to
          reflect this.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::confirmDidCloseFromServer):
        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.h:
        
        * Modules/indexeddb/shared/IDBError.cpp:
        (WebCore::IDBError::toDOMError):
        * Modules/indexeddb/shared/IDBError.h:
        (WebCore::IDBError::userDeleteError):
        
        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::didCloseFromServer):
        (WebCore::InProcessIDBServer::confirmDidCloseFromServer):
        * Modules/indexeddb/shared/InProcessIDBServer.h:
        
        * platform/CrossThreadCopier.cpp:
        (WebCore::std::chrono::system_clock::time_point>::copy):
        * platform/CrossThreadCopier.h:

2016-05-18  Simon Fraser  <simon.fraser@apple.com>

        REGRESSION (r200534) Command-+ no longer zooms pages 
        https://bugs.webkit.org/show_bug.cgi?id=157826
        rdar://problem/26334636

        Reviewed by Dean Jackson.

        When text autosizing was enabled on Mac, we started to parse and respect
        -webkit-text-size-adjust. Fix by cutting this off in CSSParser if the feature
        is disabled.

        Also fix InternalSettings to reset page and text zoom, since WebKit1 aliases
        the zoom levels causing DRT to fail to reset them between tests.

        Test: fast/text-autosizing/mac/text-size-adjust-text-zoom.html

        * css/CSSParser.cpp:
        (WebCore::CSSParserContext::CSSParserContext):
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::isTextAutosizingEnabled):
        * css/CSSParser.h:
        * css/CSSParserMode.h:
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::resetToConsistentState):

2016-05-18  Dave Hyatt  <hyatt@apple.com>

        markAllDescendantsWithFloatsForLayout should not drill into blocks with
        inline children. It was sufficient to mark ourselves as needing layout.

        https://bugs.webkit.org/show_bug.cgi?id=157845

        Reviewed by Simon Fraser.

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::markAllDescendantsWithFloatsForLayout):

2016-05-18  Joanmarie Diggs  <jdiggs@igalia.com>

        [GTK] accessibility/meter-element.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=115633

        Reviewed by Chris Fleizach.

        The meter's value description should be exposed in the same fashion
        as (we should have been exposing) aria-valuetext, namely through the
        "valuetext" AtkObject attribute. This exposure is now in place. Also
        implement AccessibilityProgressIndicator::valueDescription() so that
        the ports do not have to special-case meter in the platform wrappers.
        Map the meter element to the correct role (ATK_ROLE_LEVEL_BAR), and
        ignore a previously-included accessible object resulting from the
        use of the title attribute on a meter. Finally, do not expose the
        meter's title as the accessible name because the HTML spec suggests
        authors can supply the numeric unit as the value of title.

        No new test file as the failure was identified by meter-element.html.
        Seven new test cases were added for additional coverage. Also updated
        the ATK expectations for spinbutton-value.html to reflect that we are now
        exposing the value of aria-valuetext.

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::helpText):
        (WebCore::AccessibilityNodeObject::accessibilityDescriptionForChildren):
        (WebCore::AccessibilityNodeObject::visibleText):
        * accessibility/AccessibilityNodeObject.h:
        * accessibility/AccessibilityProgressIndicator.cpp:
        (WebCore::AccessibilityProgressIndicator::valueDescription):
        * accessibility/AccessibilityProgressIndicator.h:
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored):
        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (webkitAccessibleGetAttributes):
        (atkRole):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):

2016-05-18  Antti Koivisto  <antti@apple.com>

        Allow RenderStyles marked unique in matched properties cache
        https://bugs.webkit.org/show_bug.cgi?id=157844

        Reviewed by Andreas Kling.

        Depending on content this can improve matched properties cache hit rate quite a bit and so reduce
        time spent building styles.

        * css/StyleBuilderCustom.h:
        (WebCore::StyleBuilderCustom::applyValueContent):

            Set the attr bit on render style.

        * css/StyleResolver.cpp:
        (WebCore::isCacheableInMatchedPropertiesCache):

            Allow caching of styles marked "unique". It only means that they are not shareable by style
            sharing code because there were some complex selectors in the rules used for building them. It
            doesn't affect matched properties cache the cache how the properties were resolved.

            We still need to test against "content: attr()" as that makes the style depend on the element
            being matched. It now has a separate bit in RenderStyle.

        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::setHasAttrContent):

            Bit for "content: attr()". It also sets unique() to keep style sharing code happy.

        (WebCore::requireTransformOrigin):
        * rendering/style/RenderStyle.h:
        (WebCore::RenderStyle::hasAttrContent):
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:

2016-05-18  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the allinone-build on Linux in Source/WebCore/html/HTMLElementsAllInOne.cpp
        https://bugs.webkit.org/show_bug.cgi?id=157800

        Reviewed by Alex Christensen.

        * html/HTMLElementsAllInOne.cpp:

2016-05-18  Brady Eidson  <beidson@apple.com>

        Modern IDB: Make TestRunner.clearAllDatabases also delete IndexedDB databases (once doing so is supported).
        https://bugs.webkit.org/show_bug.cgi?id=157823

        Reviewed by Alex Christensen.

        No new tests (No current behavior change, will be tested with b/157626's resolution).

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::closeAndDeleteDatabasesModifiedSince): Stub this out for now.
        * Modules/indexeddb/server/IDBServer.h:
        * Modules/indexeddb/shared/InProcessIDBServer.h:

2016-05-18  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Sync DOM exception types with WebIDL and update promise rejections
        https://bugs.webkit.org/show_bug.cgi?id=157792

        Reviewed by Eric Carlson.

        Updating ExceptionCode with WebIDL latest exception types.
        Updating promise rejection code to use those types as per the latest specifications.

        Updating getUserMedia error handling by removing NavigatorUserMediaError which no long exists.

        Covered by rebased tests.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * Modules/mediastream/MediaDevices.h:
        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::createAnswer):
        (WebCore::MediaEndpointPeerConnection::setLocalDescription):
        (WebCore::MediaEndpointPeerConnection::setRemoteDescription):
        (WebCore::MediaEndpointPeerConnection::addIceCandidate):
        (WebCore::MediaEndpointPeerConnection::getStats):
        (WebCore::MediaEndpointPeerConnection::replaceTrack):
        * Modules/mediastream/NavigatorUserMediaError.cpp: Removed.
        * Modules/mediastream/NavigatorUserMediaError.h: Removed.
        * Modules/mediastream/NavigatorUserMediaError.idl: Removed.
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::queuedCreateOffer):
        (WebCore::RTCPeerConnection::queuedCreateAnswer):
        (WebCore::RTCPeerConnection::queuedSetLocalDescription):
        (WebCore::RTCPeerConnection::queuedSetRemoteDescription):
        (WebCore::RTCPeerConnection::queuedAddIceCandidate):
        * Modules/mediastream/RTCRtpSender.cpp:
        (WebCore::RTCRtpSender::replaceTrack):
        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::failedToCreateStreamWithConstraintsError):
        (WebCore::UserMediaRequest::failedToCreateStreamWithPermissionError):
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::createDOMException):
        * bindings/js/JSDOMBinding.h:
        * bindings/js/JSDOMPromise.cpp:
        (WebCore::DeferredWrapper::reject):
        * bindings/js/JSDOMPromise.h:
        (WebCore::DeferredWrapper::reject):
        (WebCore::DOMPromise::reject):
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::load):
        (WebCore::FontFaceSet::faceFinished):
        * dom/DOMCoreException.cpp:
        * dom/ExceptionCode.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::play):

2016-05-18  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] webaudio crash on ARM platforms
        https://bugs.webkit.org/show_bug.cgi?id=157838

        Reviewed by Michael Catanzaro.

        * platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
        (webKitWebAudioSrcConstructed): Explicitely cast the integer value
        of the max-bytes property to guint64 which is the expected type of
        this property. The compiler can't guess this on its own.

2016-05-18  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] webaudio playback improvements
        https://bugs.webkit.org/show_bug.cgi?id=155228

        Reviewed by Michael Catanzaro.

        * platform/audio/gstreamer/AudioDestinationGStreamer.cpp:
        (WebCore::autoAudioSinkChildAddedCallback): Fix sink buffer-time
        to 100ms to reduce playback latency.
        (WebCore::AudioDestinationGStreamer::AudioDestinationGStreamer):
        Connect to child-added signal of autoaudiosink to be notified when
        a real sink is added into the bin.
        * platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
        (webKitWebAudioSrcConstructed): Fine-tune blocksize of appsrc
        according to the buffer size already configured on the src element.

2016-05-18  Gwang Yoon Hwang  <yoon@igalia.com>

        [GStreamer] Use FakeSink to get a decoded texture from a pipeline
        https://bugs.webkit.org/show_bug.cgi?id=153641

        Reviewed by Philippe Normand.

        Relying on GstGLImageSink to use GStreamerGL brings a lot of overheads such as
        window handling, context switching and overlay handling which are not needed in
        our case.

        This patch replaces GstGLImageSink with a custom GstBin which has a
        GstGLUpload, GstGLColorConvert, and GstFakeSink.

        GstFakeSink sends decoded frames via handoff signal from the vqueue thread of
        GStreamer. Previously,  GstGLImageSink passes frames through GStreamer's GL
        thread, which adds additional overhead.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::GstVideoFrameHolder::~GstVideoFrameHolder): Modified to
        unmap GstVideoFrame without async call. GstGLMemory will unmap itself
        in gl-thread.
        (WebCore::MediaPlayerPrivateGStreamerBase::drawCallback):
        (WebCore::MediaPlayerPrivateGStreamerBase::createVideoSinkGL): Split
        out creating of the gst-gl video sink into the separte method.
        (WebCore::MediaPlayerPrivateGStreamerBase::paint): Remove assertion
        for the threaded compositor. It can be called by focusing event.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:

2016-05-18  Antti Koivisto  <antti@apple.com>

        Resolve !important properties from different shadow trees in a single pass.
        https://bugs.webkit.org/show_bug.cgi?id=157836

        Reviewed by Andreas Kling.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::CascadedProperties::addImportantMatches):

        Instead of doing multiple passes over increasing tree context ordinals collect matches with
        non-zero ordinals to a vector and sort it to ascending order.

2016-05-18  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the allinone-build after r198669
        https://bugs.webkit.org/show_bug.cgi?id=157798

        Reviewed by Michael Catanzaro.

        * CMakeLists.txt: Use DerivedSources.cpp only on Windows, it's broken everywhere else.

2016-05-17  Antti Koivisto  <antti@apple.com>

        Cascading order for !important properties in ::slotted and ::host rules is incorrect
        https://bugs.webkit.org/show_bug.cgi?id=157789
        <rdar://problem/26318781>

        Reviewed by Andreas Kling.

        https://drafts.csswg.org/css-scoping-1/#shadow-cascading

        "When comparing two declarations that have different tree contexts, then for normal rules the declaration earlier
        in the shadow-including tree order wins, and for important rules the declaration coming later in the shadow-including
        tree order wins."

        * css/ElementRuleCollector.cpp:
        (WebCore::MatchRequest::MatchRequest):
        (WebCore::ElementRuleCollector::ElementRuleCollector):
        (WebCore::ElementRuleCollector::matchedRuleList):
        (WebCore::ElementRuleCollector::addMatchedRule):
        (WebCore::ElementRuleCollector::clearMatchedRules):
        (WebCore::ElementRuleCollector::addElementStyleProperties):
        (WebCore::ElementRuleCollector::sortAndTransferMatchedRules):

            Pass the tree context ordinal onwards so we can implement the order reversal semantics for !important properties.

        (WebCore::ElementRuleCollector::matchAuthorRules):
        (WebCore::ElementRuleCollector::matchHostPseudoClassRules):
        (WebCore::ElementRuleCollector::matchSlottedPseudoElementRules):

            Don't flush the matched rules immediately to get the right ordering. Instead compute tree context ordinal
            that is then used as a sorting criteria.

        (WebCore::ElementRuleCollector::collectSlottedPseudoElementRulesForSlot):
        (WebCore::ElementRuleCollector::collectMatchingRulesForList):
        (WebCore::compareRules):

            Sort regular rules so that earlier shadow trees win.

        (WebCore::ElementRuleCollector::sortMatchedRules):
        * css/ElementRuleCollector.h:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::State::clear):
        (WebCore::StyleResolver::MatchResult::addMatchedProperties):
        (WebCore::StyleResolver::CascadedProperties::addMatch): Added.

            Add a helper.

        (WebCore::StyleResolver::CascadedProperties::addNormalMatches):

            Split normal and important to different functions for clarity.

        (WebCore::StyleResolver::CascadedProperties::addImportantMatches):

            For !important properties a later shadow tree wins. Do multiple passes to apply in correct order if needed.

        * css/StyleResolver.h:
        (WebCore::StyleResolver::MatchResult::matchedProperties):

2016-05-18  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: [ATK] Use WebCore Accessibility's AccessibilityText for AtkObject name and description
        https://bugs.webkit.org/show_bug.cgi?id=157822

        Reviewed by Chris Fleizach.

        Remove the old code which was overriding WebCore Accessibility and always use
        AccessibilityText.

        If the AccessibilityText's textSource is HelpText or SummaryText, it should be exposed
        as the AtkObject description. If the textSource is TitleTagText and there is no other
        text alternative, the value should also be exposed in this fashion. Note that AtkObject's
        description property is equivalent to AXAPI's AXHelp property.

        If the AccessibilityText's textSource is anything other than the above, the first
        non-empty value should be exposed as the AtkObject name. Depending on the source of
        the name content, AtkObject's name property can be the equivalent of AXAPI's AXTitle.
        However, most of the time, AtkObject's name property is equivalent to AXAPI's
        AXDescription property.

        By making these changes, what WebKit exposes for ATK is now extremely similar to what
        WebKit exposes on the Mac (modulo the property names) and also with what is defined in
        the HTML Accessibility and Accessible Name and Description Computation API mappings specs.

        Now that the exposure is correct, the Layout Tests needed to be adjusted accordingly because
        asking for the "AXDescription" gives you the AXDescription on the Mac and the AtkObject
        description in GNU/Linux. But as indicated above, what ATK calls a "description" is what
        the Mac calls "help."

        Ultimately our Layout Tests and/or our platform TestRunner API should be modified to deal
        with these differences more gracefully. (Bug https://bugs.webkit.org/show_bug.cgi?id=157187
        has been opened for that task.) In the meantime, the existing tests have been given platform
        checks to ask for the right property on each platform. This was done in such a way as to not
        require other (non-ATK) platforms change their current expectations files.

        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (webkitAccessibleGetName):
        (webkitAccessibleGetDescription):

2016-05-17  Zalan Bujtas  <zalan@apple.com>

        Add LayerListMutationDetector to hittesting.
        https://bugs.webkit.org/show_bug.cgi?id=157758

        Reviewed by Simon Fraser.

        Hittesting is supposed to be readonly.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::hitTestLayer):
        * rendering/RenderLayer.h:
        (WebCore::RenderLayer::clearZOrderLists):

2016-05-17  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove toJS template methods taking const Ref and const RefPtr
        https://bugs.webkit.org/show_bug.cgi?id=157791

        Reviewed by Chris Dumez.

        Updating toJS template method taking a const Ref<T>& to take a Ref<T>&&.
        Updating toJS template method taking a const RefPtr<T>& to take a RefPtr<T>&&.
        Updating binding generator to generate rvalue references.

        Covered by existing tests.

        * bindings/js/JSDOMBinding.h:
        (WebCore::toJS):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterfaceConstructor::construct):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::JSTestNamedConstructorNamedConstructor::construct):
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::JSTestNodeConstructor::construct):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjConstructor::construct):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::constructJSTestOverloadedConstructors1):
        (WebCore::constructJSTestOverloadedConstructors2):
        (WebCore::constructJSTestOverloadedConstructors3):
        (WebCore::constructJSTestOverloadedConstructors4):
        (WebCore::constructJSTestOverloadedConstructors5):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::JSTestTypedefsConstructor::construct):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):

2016-05-17  Nan Wang  <n_wang@apple.com>

        AX: Adding children incorrectly when there are nested inline continuations
        https://bugs.webkit.org/show_bug.cgi?id=157818

        Reviewed by Chris Fleizach.

        When getting the inline element continuation's next sibling, if we fall back on to the parent
        case, we might end up adding the same node repeatedly. Fixed it by skipping this case.

        Test: accessibility/mac/nested-inline-elements-children.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::nextSibling):

2016-05-17  Dean Jackson  <dino@apple.com>

        Add media query support for wide gamut displays on Mac
        https://bugs.webkit.org/show_bug.cgi?id=157824
        <rdar://problem/26333137>

        Reviewed by Simon Fraser.

        Implement the Mac version of the color-gamut media query
        by filling out the screenSupportsExtendedColor function.

        On Yosemite, we always return false. On El Capitan, we
        can check the ColorProfile via ColorSync to see if the
        screen is wide gamut.

        There is already a test in fast/media/mq-color-gamut.html

        * css/MediaQueryEvaluator.cpp:
        (WebCore::color_gamutMediaFeatureEval): Pass the mainFrame's view
        to screenSupportsExtendedColor, so that it can fetch the NSScreen.
        * platform/PlatformScreen.h: screenSupportsExtendedColor now takes
        an optional Widget parameter.
        * platform/ios/PlatformScreenIOS.mm:
        (WebCore::screenSupportsExtendedColor): Add empty parameter.
        * platform/mac/PlatformScreenMac.mm:
        (WebCore::screenSupportsExtendedColor): Get the NSWindow, then the
        NSScreen, then the ColorSpace, then the ColorSyncProfile, and
        check if it is a wide gamut profile.
        * platform/spi/cg/CoreGraphicsSPI.h: Add the SPI declarations.

2016-05-17  Chris Dumez  <cdumez@apple.com>

        Unreviewed, fix Darin's post-mortem review comments for r201052.

        * rendering/RenderFieldset.cpp:
        (WebCore::RenderFieldset::findLegend):
        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::layoutChildren):

2016-05-17  Beth Dakin  <bdakin@apple.com>

        Make handleAcceptedCandidate a public function
        https://bugs.webkit.org/show_bug.cgi?id=157763
        -and corresponding-
        rdar://problem/26206397

        Reviewed by Tim Horton.

        Define handleAcceptedCandidateWithSoftSpaces on EditorClient so that it can 
        be invoked on any EditorClient. 
        * loader/EmptyClients.h:
        * page/EditorClient.h:
        (WebCore::EditorClient::handleAcceptedCandidateWithSoftSpaces):

2016-05-17  Chris Dumez  <cdumez@apple.com>

        Unreviewed debug build fix after r201052.

        * rendering/svg/RenderSVGText.cpp:
        (WebCore::findPreviousAndNextAttributes): Deleted.

2016-05-17  Chris Dumez  <cdumez@apple.com>

        Use RenderChildIterator more for traversing a renderer's children
        https://bugs.webkit.org/show_bug.cgi?id=157811

        Reviewed by Antti Koivisto.

        Use RenderChildIterator more for traversing a renderer's children.

        * inspector/InspectorLayerTreeAgent.cpp:
        (WebCore::InspectorLayerTreeAgent::layersForNode):
        (WebCore::InspectorLayerTreeAgent::gatherLayersUsingRenderObjectHierarchy):
        * inspector/InspectorLayerTreeAgent.h:
        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::recalcColumn):
        * rendering/InlineIterator.h:
        (WebCore::isEmptyInline):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::addFocusRingRects):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::positionForPoint):
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::updateOutlineAutoAncestor):
        * rendering/RenderElement.h:
        * rendering/RenderFieldset.cpp:
        (WebCore::RenderFieldset::findLegend):
        * rendering/RenderFieldset.h:
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::generateCulledLineBoxRects):
        (WebCore::RenderInline::culledInlineFirstLineBox):
        (WebCore::RenderInline::culledInlineVisualOverflowBoundingBox):
        (WebCore::RenderInline::dirtyLineBoxes):
        * rendering/RenderListItem.cpp:
        (WebCore::getParentOfFirstLineBox):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::setFlowThreadStateIncludingDescendants):
        (WebCore::RenderObject::addAbsoluteRectForLayer):
        (WebCore::RenderObject::paintingRootRect):
        (WebCore::RenderObject::removeFromRenderFlowThreadIncludingDescendants):
        (WebCore::RenderObject::invalidateFlowThreadContainingBlockIncludingDescendants):
        (WebCore::RenderObject::updateDragState):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::firstColumn):
        * rendering/RenderTableCol.cpp:
        (WebCore::RenderTableCol::clearPreferredLogicalWidthsDirtyBits):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layoutRows):
        * rendering/RenderTreeAsText.cpp:
        (WebCore::write):
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::findPreviousAndNextAttributes):
        (WebCore::RenderSVGText::subtreeChildWasAdded):
        (WebCore::RenderSVGText::subtreeChildWillBeRemoved):
        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::updateObjectBoundingBox):
        (WebCore::SVGRenderSupport::computeContainerBoundingBoxes):
        (WebCore::SVGRenderSupport::layoutChildren):
        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp:
        (WebCore::SVGTextLayoutAttributesBuilder::collectTextPositioningElements):
        * rendering/svg/SVGTextMetricsBuilder.cpp:
        (WebCore::SVGTextMetricsBuilder::walkTree):

2016-05-17  Dean Jackson  <dino@apple.com>

        Remove ES6_GENERATORS flag
        https://bugs.webkit.org/show_bug.cgi?id=157815
        <rdar://problem/26332894>

        Reviewed by Geoffrey Garen.

        This flag isn't needed. Generators are enabled everywhere and
        part of a stable specification.

        * Configurations/FeatureDefines.xcconfig:

2016-05-16  Simon Fraser  <simon.fraser@apple.com>

        BitmapImage::destroyDecodedDataIfNecessary() should only count frames with image data
        https://bugs.webkit.org/show_bug.cgi?id=157779

        Reviewed by Tim Horton.

        BitmapImage::destroyDecodedDataIfNecessary() throws away all frames of an image if the
        decoded frame size exceeds a threshold. However, it counts all frames, whether or not
        they have an image (some frames may only have metadata, but m_frameBytes still returns
        height*width*4).

        Fix by only count m_frameBytes for frames that have an image.

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::destroyDecodedDataIfNecessary):
        * platform/graphics/BitmapImage.h:
        (WebCore::FrameData::FrameData):
        (WebCore::FrameData::usedFrameBytes):

2016-05-17  Dave Hyatt  <hyatt@apple.com>

        Optimize layer repaint rect computation and painting.
        https://bugs.webkit.org/show_bug.cgi?id=157631

        Reviewed by Zalan Bujtas.

        This patch changes the computation of repaint rects to be for self-painting layers
        only. In addition, hasBoxDecorations() has been changed to hasVisibleBoxDecorations(),
        and it will no longer be set for transparent borders.

        For scrolling layer position updating, visually empty layers have their repaint rects
        cleared, and we don't compute repaint rects during the scroll. We would like to do this
        all the time, but computeRepaintRects can be called at times when the visually empty
        state is stale/unknown. For now we limit it to scrolling, since we know that the layer's
        visually empty state is correct.

        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::paintBoxDecorations):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintObject):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::layoutRunsAndFloats):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::updateFromStyle):
        (WebCore::RenderBox::paintBoxDecorations):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::willBeDestroyed):
        (WebCore::RenderBoxModelObject::hasVisibleBoxDecorationStyle):
        (WebCore::RenderBoxModelObject::updateFromStyle):
        (WebCore::RenderBoxModelObject::hasBoxDecorationStyle): Deleted.
        * rendering/RenderBoxModelObject.h:
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::styleWillChange):
        (WebCore::mustRepaintBackgroundOrBorder):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::imageChanged):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::styleDidChange):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::RenderLayer):
        (WebCore::RenderLayer::updateLayerPositions):
        (WebCore::RenderLayer::repaintRectIncludingNonCompositingDescendants):
        (WebCore::RenderLayer::computeRepaintRects):
        (WebCore::RenderLayer::clearRepaintRects):
        (WebCore::RenderLayer::updateLayerPositionsAfterScroll):
        (WebCore::RenderLayer::scrollTo):
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/RenderLayer.h:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateDrawsContent):
        (WebCore::RenderLayerBacking::compositingOpacity):
        (WebCore::hasVisibleBoxDecorations):
        (WebCore::canCreateTiledImage):
        (WebCore::hasVisibleBoxDecorationsOrBackgroundImage):
        (WebCore::supportsDirectBoxDecorationsComposition):
        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
        (WebCore::RenderLayerBacking::containsPaintedContent):
        (WebCore::RenderLayerBacking::isDirectlyCompositedImage):
        (WebCore::hasBoxDecorations): Deleted.
        (WebCore::hasBoxDecorationsOrBackgroundImage): Deleted.
        * rendering/RenderLayerModelObject.cpp:
        (WebCore::RenderLayerModelObject::styleDidChange):
        * rendering/RenderNamedFlowFragment.cpp:
        (WebCore::RenderNamedFlowFragment::setObjectStyleInRegion):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::hasVisibleBoxDecorations):
        (WebCore::RenderObject::setFloating):
        (WebCore::RenderObject::setInline):
        (WebCore::RenderObject::computeBackgroundIsKnownToBeObscured):
        (WebCore::RenderObject::setSelectionStateIfNeeded):
        (WebCore::RenderObject::setHasVisibleBoxDecorations):
        (WebCore::RenderObject::invalidateBackgroundObscurationStatus):
        (WebCore::RenderObject::hasBoxDecorations): Deleted.
        (WebCore::RenderObject::setHasBoxDecorations): Deleted.
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::paint):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::paintObject):
        (WebCore::RenderTable::paintBoxDecorations):
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::styleDidChange):
        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::paint):
        * rendering/style/BorderData.h:
        (WebCore::BorderData::hasBorder):
        (WebCore::BorderData::hasVisibleBorder):
        (WebCore::BorderData::hasFill):
        (WebCore::BorderData::hasBorderRadius):
        * rendering/style/RenderStyle.h:
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::layout):
        (WebCore::RenderSVGRoot::styleDidChange):

2016-05-17  Filip Pizlo  <fpizlo@apple.com>

        WTF should know about Language
        https://bugs.webkit.org/show_bug.cgi?id=157756

        Reviewed by Geoffrey Garen.

        No new tests because this does not change behavior.

        This change is all about moving some language functionality to WTF. Quoting the WTF
        ChangeLog, this contains two changes:

        - Move everything that WebCore's logic for getting the platform user preferred language
          depended on into WTF. This means CFBundleSPI.h and BlockObjCExceptions.h|cpp.

        - Move WebCore::platformUserPreferredLanguages() to WTF::platformUserPreferredLanguages().
          This is needed by https://bugs.webkit.org/show_bug.cgi?id=157755, which will make JSC
          use this to detect the platform user preferred language when running standalone.

        The changes in WebCore are mostly about rewiring #includes and #imports and removing the
        code that we moved to WTF. But there is one logic change: previously,
        platformUserPreferredLanguages() would call WebCore::languageDidChange(). It can't do that
        directly anymore, but WTF gives WebCore some API for registering the callback. So in
        Language.cpp we now register languageDidChange anytime we do something that would
        necessitate it, like calling platformUserPreferredLanguages(). This also registers the
        callback inside addLanguageChangeObserver(), since it's possible for that to be called
        after JSC had called platformUserPreferredLanguages() but before WebCore does so.

        * PlatformEfl.cmake:
        * PlatformGTK.cmake:
        * PlatformMac.cmake:
        * PlatformWin.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/objc/DOMCustomXPathNSResolver.mm:
        * editing/ios/EditorIOS.mm:
        * editing/mac/DictionaryLookup.mm:
        * editing/mac/EditorMac.mm:
        * page/CaptionUserPreferencesMediaAF.cpp:
        * page/ios/EventHandlerIOS.mm:
        * page/ios/FrameIOS.mm:
        * page/mac/ChromeMac.mm:
        * page/mac/EventHandlerMac.mm:
        * platform/Language.cpp:
        (WebCore::registerLanguageDidChangeCallbackIfNecessary):
        (WebCore::observerMap):
        (WebCore::addLanguageChangeObserver):
        (WebCore::overrideUserPreferredLanguages):
        (WebCore::userPreferredLanguages):
        * platform/Language.h:
        * platform/cocoa/ContentFilterUnblockHandlerCocoa.mm:
        * platform/graphics/avfoundation/objc/InbandTextTrackPrivateAVFObjC.mm:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
        * platform/graphics/ca/cocoa/PlatformCAFiltersCocoa.mm:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        * platform/graphics/cocoa/FontCocoa.mm:
        * platform/graphics/mac/ColorMac.mm:
        * platform/graphics/mac/GraphicsContext3DMac.mm:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        * platform/ios/PlatformSpeechSynthesizerIOS.mm:
        * platform/ios/ScrollViewIOS.mm:
        * platform/ios/WidgetIOS.mm:
        * platform/mac/BlockExceptions.h: Removed.
        * platform/mac/BlockExceptions.mm: Removed.
        * platform/mac/CursorMac.mm:
        * platform/mac/Language.mm: Removed.
        * platform/mac/ScrollAnimatorMac.mm:
        * platform/mac/ScrollViewMac.mm:
        * platform/mac/ScrollbarThemeMac.mm:
        * platform/mac/ThemeMac.mm:
        * platform/mac/WidgetMac.mm:
        * platform/mediastream/mac/AVVideoCaptureSource.mm:
        * platform/network/mac/CookieJarMac.mm:
        * platform/network/mac/ResourceErrorMac.mm:
        * platform/network/mac/ResourceHandleMac.mm:
        * platform/spi/cf/CFBundleSPI.h: Removed.
        * platform/unix/LanguageUnix.cpp: Removed.
        * platform/win/LanguageWin.cpp: Removed.

2016-05-16  Dean Jackson  <dino@apple.com>

        Tidy unused parameters with build flags in isValidKeywordPropertyAndValue
        https://bugs.webkit.org/show_bug.cgi?id=157780
        <rdar://problem/26327312>

        Reviewed by Alex Christensen.

        CSS_COMPOSITING and CSS_REGIONS aren't runtime flags any more, so
        don't need a parser context. Meanwhile CSS_GRID_LAYOUT does, even
        though it wasn't in the condition for the UNUSED_PARAM.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):

2016-05-17  Chris Dumez  <cdumez@apple.com>

        Regression(r177786): GlyphMetricsMap<T>::locatePageSlowCase() fills existing pages with unknown metrics
        https://bugs.webkit.org/show_bug.cgi?id=157749

        Reviewed by Antti Koivisto.

        After r177786, GlyphMetricsMap<T>::locatePageSlowCase() would unconditionally fill
        pages with unknown metrics. This patch updates the code to do so only if the page
        is new, thus restoring the pre-r177786 behavior.

        * platform/graphics/GlyphMetricsMap.h:
        (WebCore::GlyphMetricsMap::metricsForGlyph):
        (WebCore::GlyphMetricsMap::setMetricsForGlyph):
        (WebCore::GlyphMetricsMap::GlyphMetricsPage::GlyphMetricsPage):
        (WebCore::GlyphMetricsMap::GlyphMetricsPage::fill):
        (WebCore::GlyphMetricsMap::locatePage):
        (WebCore::GlyphMetricsMap<T>::locatePageSlowCase):
        (WebCore::GlyphMetricsMap::GlyphMetricsPage::metricsForGlyph): Deleted.
        (WebCore::GlyphMetricsMap::GlyphMetricsPage::setMetricsForGlyph): Deleted.
        (WebCore::GlyphMetricsMap::GlyphMetricsPage::setMetricsForIndex): Deleted.
        (WebCore::GlyphMetricsMap<float>::unknownMetrics): Deleted.
        (WebCore::GlyphMetricsMap<FloatRect>::unknownMetrics): Deleted.

2016-05-17  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !ENABLE(WEB_TIMING) build after r200887
        https://bugs.webkit.org/show_bug.cgi?id=157796

        Reviewed by Chris Dumez.

        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::didFinishLoading):
        (WebCore::DocumentThreadableLoader::loadRequest):
        * loader/DocumentThreadableLoader.h:
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestResource):
        (WebCore::CachedResourceLoader::revalidateResource):
        (WebCore::CachedResourceLoader::loadResource):
        * loader/cache/CachedResourceLoader.h:

2016-05-17  Myles C. Maxfield  <mmaxfield@apple.com>

        REGRESSION(r54729): Line breaking in complex mixed-direction text is inconsistent across page refreshes
        https://bugs.webkit.org/show_bug.cgi?id=157783
        <rdar://problem/22908924>

        Reviewed by Zalan Bujtas.

        mappedIndices is uninitialized.

        Test: fast/text/complex-mixed-direction-line-breaking.html

        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::ComplexTextController::ComplexTextRun::setIsNonMonotonic):

2016-05-17  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        DOMPromise should only restrict the resolution type
        https://bugs.webkit.org/show_bug.cgi?id=157307

        Reviewed by Darin Adler.

        Removing from DOMPromise the rejection template parameter.
        Supported rejection types are integers (Exception codes) and DOM objects (DOMError typically).

        Updated DeferredWrapper to accept Ref<>&& and RefPtr<>&&.
        Relanding without touching JSDOMBinding.h as this seemed to be impacting performances.

        Changes also allow in most cases to remove the need for explictly declaring the
        rejection/resolution type.

        Minor refactoring of FontFaceSet promise handling to use DOMPromise in lieu of DeferredWrapper.

        Covered by existing tests.
        Changes should not be visible from user scripts.

        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::consume):
        (WebCore::FetchBody::consumeText):
        (WebCore::blobFromArrayBuffer):
        (WebCore::FetchBody::loadingFailed):
        * Modules/fetch/FetchBody.h:
        (WebCore::FetchBody::formData):
        * Modules/fetch/FetchBodyOwner.cpp:
        (WebCore::FetchBodyOwner::arrayBuffer):
        (WebCore::FetchBodyOwner::blob):
        (WebCore::FetchBodyOwner::formData):
        (WebCore::FetchBodyOwner::json):
        (WebCore::FetchBodyOwner::text):
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::BodyLoader::didReceiveResponse):
        * Modules/fetch/FetchResponse.h:
        * Modules/mediastream/MediaDevices.h:
        * Modules/mediastream/PeerConnectionBackend.h:
        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::didCreateStream):
        * Modules/streams/ReadableStreamSource.h:
        * Modules/webaudio/AudioContext.h:
        * bindings/js/JSDOMPromise.cpp:
        (WebCore::fulfillPromiseWithJSON):
        * bindings/js/JSDOMPromise.h:
        (WebCore::TypeInspector::decltype):
        (WebCore::TypeInspector::testIsVector):
        (WebCore::TypeInspector::testIsRefOrRefPtr):
        (WebCore::DeferredWrapper::resolve):
        (WebCore::DeferredWrapper::reject):
        (WebCore::DOMPromise::resolve):
        (WebCore::DOMPromise::reject):
        (WebCore::DeferredWrapper::resolveWithValue):
        (WebCore::DeferredWrapper::rejectWithValue):
        (WebCore::callPromiseFunction):
        * bindings/js/JSSubtleCryptoCustom.cpp:
        (WebCore::JSSubtleCrypto::importKey):
        (WebCore::JSSubtleCrypto::unwrapKey):
        * css/FontFace.h:
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::PendingPromise::PendingPromise):
        (WebCore::FontFaceSet::load):
        (WebCore::FontFaceSet::registerReady):
        * css/FontFaceSet.h:
        * html/HTMLMediaElement.h:

2016-05-16  Alex Christensen  <achristensen@webkit.org>

        Modernize CSS Parser
        https://bugs.webkit.org/show_bug.cgi?id=157772

        Reviewed by Brady Eidson.

        No new tests.  This patch just replaces PassRefPtr with RefPtr&&.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseDeclaration):
        (WebCore::CSSParser::SourceSize::SourceSize):
        (WebCore::CSSParser::createStyleProperties):
        (WebCore::CSSParser::addProperty):
        (WebCore::CSSParser::parseValidPrimitive):
        (WebCore::CSSParser::addExpandedPropertyForValue):
        (WebCore::CSSParser::parseVariableDependentValue):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseColumnsShorthand):
        (WebCore::CSSParser::parseGridItemPositionShorthand):
        (WebCore::CSSParser::parseGridAreaShorthand):
        (WebCore::CSSParser::parseInsetRoundedCorners):
        (WebCore::CSSParser::parseBasicShapeInset):
        (WebCore::ShadowParseContext::commitLength):
        (WebCore::ShadowParseContext::commitColor):
        (WebCore::BorderImageParseContext::requireWidth):
        (WebCore::BorderImageParseContext::requireOutset):
        (WebCore::BorderImageParseContext::commitImage):
        (WebCore::BorderImageParseContext::commitImageSlice):
        (WebCore::BorderImageParseContext::commitForwardSlashOperator):
        (WebCore::BorderImageParseContext::commitBorderWidth):
        (WebCore::BorderImageParseContext::commitBorderOutset):
        (WebCore::BorderImageParseContext::commitRepeat):
        (WebCore::BorderImageParseContext::commitWebKitBorderImage):
        (WebCore::BorderImageParseContext::commitBorderImage):
        (WebCore::BorderImageParseContext::commitBorderImageProperty):
        (WebCore::BorderImageSliceParseContext::commitFill):
        (WebCore::BorderImageSliceParseContext::commitBorderImageSlice):
        (WebCore::BorderImageQuadParseContext::commitNumber):
        (WebCore::BorderImageQuadParseContext::setAllowFinalCommit):
        (WebCore::BorderImageQuadParseContext::setTop):
        (WebCore::BorderImageQuadParseContext::commitBorderImageQuad):
        (WebCore::CSSParser::parseCounter):
        (WebCore::parseDeprecatedGradientPoint):
        (WebCore::CSSParser::parseDeprecatedGradient):
        (WebCore::valueFromSideKeyword):
        (WebCore::parseGradientColorOrKeyword):
        (WebCore::CSSParser::parsePerspectiveOrigin):
        (WebCore::CSSParser::addTextDecorationProperty):
        (WebCore::CSSParser::parseTextDecoration):
        (WebCore::CSSParser::realLex):
        (WebCore::CSSParser::createImportRule):
        (WebCore::CSSParser::createMediaRule):
        (WebCore::CSSParser::processAndAddNewRuleToSourceTreeIfNeeded):
        (WebCore::CSSParser::addNewRuleToSourceTree):
        * css/CSSParser.h:
        (WebCore::CSSParser::hasProperties):
        (WebCore::CSSParser::resetPropertyRange):
        (WebCore::CSSParser::isExtractingSourceData):

2016-05-16  Chris Dumez  <cdumez@apple.com>

        Add RenderDescendantIterator to traverse a RenderObject's descendants
        https://bugs.webkit.org/show_bug.cgi?id=157785

        Reviewed by Zalan Bujtas.

        Add RenderDescendantIterator to traverse a RenderObject's descendants. I
        am planning to use it in the iOS Text Autosizing code (See Bug 157784).

        * WebCore.xcodeproj/project.pbxproj:
        * rendering/RenderDescendantIterator.h: Added.
        (WebCore::RenderDescendantIterator<T>::RenderDescendantIterator):
        (WebCore::RenderDescendantIterator<T>::operator):
        (WebCore::RenderDescendantConstIterator<T>::RenderDescendantConstIterator):
        (WebCore::RenderDescendantConstIterator<T>::operator):
        (WebCore::RenderDescendantIteratorAdapter<T>::RenderDescendantIteratorAdapter):
        (WebCore::RenderDescendantIteratorAdapter<T>::begin):
        (WebCore::RenderDescendantIteratorAdapter<T>::end):
        (WebCore::RenderDescendantConstIteratorAdapter<T>::RenderDescendantConstIteratorAdapter):
        (WebCore::RenderDescendantConstIteratorAdapter<T>::begin):
        (WebCore::RenderDescendantConstIteratorAdapter<T>::end):
        (WebCore::descendantsOfType):
        * rendering/RenderIterator.h:
        (WebCore::RenderObjectTraversal::firstChild):
        (WebCore::RenderObjectTraversal::nextAncestorSibling):
        (WebCore::RenderObjectTraversal::next):
        (WebCore::RenderTraversal::firstChild):
        (WebCore::RenderTraversal::lastChild):
        (WebCore::RenderTraversal::nextSibling):
        (WebCore::RenderTraversal::previousSibling):
        (WebCore::RenderTraversal::findAncestorOfType):
        (WebCore::RenderTraversal::firstWithin):
        (WebCore::RenderTraversal::next):
        (WebCore::RenderIterator<T>::traverseNext):
        (WebCore::RenderConstIterator<T>::traverseNext):

2016-05-16  Alex Christensen  <achristensen@webkit.org>

        Remove YouTube site-specific hack
        https://bugs.webkit.org/show_bug.cgi?id=157776

        Reviewed by Eric Carlson.

        No new tests.  Youtube fullscreen seems to work without
        http://trac.webkit.org/changeset/173533 now.

        * dom/Document.cpp:
        (WebCore::unwrapFullScreenRenderer):
        (WebCore::Document::webkitWillEnterFullScreenForElement):
        (WebCore::Document::webkitDidEnterFullScreenForElement):
        (WebCore::Document::webkitWillExitFullScreenForElement):
        (WebCore::Document::webkitDidExitFullScreenForElement):
        (WebCore::Document::setFullScreenRenderer):
        (WebCore::hostIsYouTube): Deleted.

2016-05-16  Brent Fulgham  <bfulgham@apple.com>

        heap use-after-free at WebCore::TimerBase::heapPopMin()
        https://bugs.webkit.org/show_bug.cgi?id=157742
        <rdar://problem/26236778>

        Reviewed by David Kilzer.

        Tested by fast/frames/resources/crash-during-iframe-load-stop.html.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::stopForUserCancel): Protect m_frame from destruction while it is still
        being used by the current stack frame.
        (WebCore::FrameLoader::frameDetached): Ditto.
        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy): Ditto.

2016-05-16  Dean Jackson  <dino@apple.com>

        WebCoreJSBuiltinInternals won't compile if some build flags are off
        https://bugs.webkit.org/show_bug.cgi?id=157777
        <rdar://problem/26312967>

        Reviewed by Simon Fraser.

        Allow this file to compile when some build flags are disabled.

        * bindings/js/WebCoreJSBuiltinInternals.cpp:
        (WebCore::JSBuiltinInternalFunctions::JSBuiltinInternalFunctions):

2016-05-16  Brady Eidson  <beidson@apple.com>

        Modern IDB: Give each UniqueIDBDatabase its own task queues.
        https://bugs.webkit.org/show_bug.cgi?id=157757

        Reviewed by Alex Christensen.

        No new tests (Refactor, no behavior change).

        Each UniqueIDBDatabase now maintains its own databaseTask and databaseTaskReply queues.
        
        Instead of posting the specific task(reply) with the IDBServer, it merely posts a task(reply) that says
        "Handle your next task(reply)".

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::deleteBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::startVersionChangeTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::openBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::createObjectStore):
        (WebCore::IDBServer::UniqueIDBDatabase::performCreateObjectStore):
        (WebCore::IDBServer::UniqueIDBDatabase::deleteObjectStore):
        (WebCore::IDBServer::UniqueIDBDatabase::performDeleteObjectStore):
        (WebCore::IDBServer::UniqueIDBDatabase::clearObjectStore):
        (WebCore::IDBServer::UniqueIDBDatabase::performClearObjectStore):
        (WebCore::IDBServer::UniqueIDBDatabase::createIndex):
        (WebCore::IDBServer::UniqueIDBDatabase::performCreateIndex):
        (WebCore::IDBServer::UniqueIDBDatabase::deleteIndex):
        (WebCore::IDBServer::UniqueIDBDatabase::performDeleteIndex):
        (WebCore::IDBServer::UniqueIDBDatabase::putOrAdd):
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd):
        (WebCore::IDBServer::UniqueIDBDatabase::getRecord):
        (WebCore::IDBServer::UniqueIDBDatabase::performGetRecord):
        (WebCore::IDBServer::UniqueIDBDatabase::performGetIndexRecord):
        (WebCore::IDBServer::UniqueIDBDatabase::getCount):
        (WebCore::IDBServer::UniqueIDBDatabase::performGetCount):
        (WebCore::IDBServer::UniqueIDBDatabase::deleteRecord):
        (WebCore::IDBServer::UniqueIDBDatabase::performDeleteRecord):
        (WebCore::IDBServer::UniqueIDBDatabase::openCursor):
        (WebCore::IDBServer::UniqueIDBDatabase::performOpenCursor):
        (WebCore::IDBServer::UniqueIDBDatabase::iterateCursor):
        (WebCore::IDBServer::UniqueIDBDatabase::performIterateCursor):
        (WebCore::IDBServer::UniqueIDBDatabase::commitTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::performCommitTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::abortTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::performAbortTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::activateTransactionInBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::performActivateTransactionInBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::postDatabaseTask):
        (WebCore::IDBServer::UniqueIDBDatabase::postDatabaseTaskReply):
        (WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTask):
        (WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTaskReply):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2016-05-16  Saam barati  <sbarati@apple.com>

        Hook up ShadowChicken to the debugger to show tail deleted frames
        https://bugs.webkit.org/show_bug.cgi?id=156685
        <rdar://problem/25770521>

        Reviewed by Filip Pizlo and Mark Lam and Joseph Pecoraro.

        Tests: inspector/debugger/tail-deleted-frames-this-value.html
               inspector/debugger/tail-deleted-frames.html
               inspector/debugger/tail-recursion.html

        * ForwardingHeaders/interpreter/ShadowChicken.h: Added.

2016-05-16  Alex Christensen  <achristensen@webkit.org>

        Don't include CSSParser.h from other headers
        https://bugs.webkit.org/show_bug.cgi?id=157765

        Reviewed by Zalan Bujtas.

        No change in behavior.  This just makes it so touching CSSParser.h doesn't rebuild as many files.

        * css/CSSCalculationValue.cpp:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::sourceSize):
        (WebCore::filterProperties):
        * css/CSSParser.h:
        (WebCore::CSSParser::ValueWithCalculation::ValueWithCalculation):
        * css/CSSProperty.h:
        (WebCore::prefixingVariantForPropertyId):
        * css/FontFace.cpp:
        * css/StyleProperties.cpp:
        (WebCore::MutableStyleProperties::parseDeclaration):
        (WebCore::MutableStyleProperties::addParsedProperties):
        * css/StyleProperties.h:
        * css/StyleResolver.h:
        * rendering/style/RenderStyle.cpp:

2016-05-16  Aaron Chu  <aaron_chu@apple.com>

        REGRESSION (r200441): Yahoo sports, finance and news pages automatically scroll
        https://bugs.webkit.org/show_bug.cgi?id=157692
        <rdar://problem/26231897>

        Reviewed by Eric Carlson.

        Test: media/video-controls-to-not-scroll-page-on-load.html

        This bug was due to the fact that showControls button was shown and focused
        when the video controls are hidden. The showControls button is used by FKA or 
        screen readers to make the video controls reappear after they have faded out. 
        When the showControls button is shown, a focus() is called on it to ensure that
        the screen reader is focusing on the button instead of <body> or the video chrome.
        To fix this bug, I added the shouldHaveControls() check before calling focus() on
        the showControls button.

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.showShowControlsButton):

2016-05-16  Joseph Pecoraro  <pecoraro@apple.com>

        Unreviewed rollout r200924. Caused js/regress/string-replace-generic.html to fail.

        Tests: fast/profiler/*

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * ForwardingHeaders/profiler/LegacyProfiler.h: Added.
        * ForwardingHeaders/profiler/Profile.h: Added.
        * ForwardingHeaders/profiler/ProfileNode.h: Added.
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSCustomXPathNSResolver.cpp:
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::supportsLegacyProfiling):
        (WebCore::JSDOMWindowBase::supportsRichSourceInfo):
        * bindings/js/JSDOMWindowBase.h:
        * bindings/js/JSWorkerGlobalScopeBase.cpp:
        (WebCore::JSWorkerGlobalScopeBase::supportsLegacyProfiling):
        * bindings/js/JSWorkerGlobalScopeBase.h:
        * bindings/js/ScriptCachedFrameData.cpp:
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::clearWindowShell):
        * bindings/js/ScriptProfile.h: Copied from Source/JavaScriptCore/profiler/ProfilerJettisonReason.h.
        * bindings/js/ScriptProfileNode.h: Copied from Source/JavaScriptCore/profiler/ProfilerJettisonReason.h.
        * bindings/scripts/CodeGeneratorJS.pm:
        (AddClassForwardIfNeeded):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionMethodWithSequenceArg):
        (WebCore::jsTestObjPrototypeFunctionMethodReturningSequence):
        * bindings/scripts/test/TestObj.idl:
        * css/CSSParser.cpp:
        * dom/Document.cpp:
        * inspector/InspectorConsoleInstrumentation.h:
        (WebCore::InspectorInstrumentation::stopProfiling):
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::legacyProfilerEnabled):
        (WebCore::InspectorController::setLegacyProfilerEnabled):
        * inspector/InspectorController.h:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::stopProfilingImpl):
        * inspector/InspectorInstrumentation.h:
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::startFromConsole):
        (WebCore::InspectorTimelineAgent::stopFromConsole):
        * inspector/InspectorTimelineAgent.h:
        * inspector/PageDebuggerAgent.cpp:
        * inspector/PageRuntimeAgent.cpp:
        * inspector/ScriptProfile.idl: Copied from Source/JavaScriptCore/profiler/ProfilerJettisonReason.h.
        * inspector/ScriptProfileNode.idl: Copied from Source/JavaScriptCore/profiler/ProfilerJettisonReason.h.
        * inspector/TimelineRecordFactory.cpp:
        (WebCore::buildAggregateCallInfoInspectorObject):
        (WebCore::buildInspectorObject):
        (WebCore::buildProfileInspectorObject):
        (WebCore::TimelineRecordFactory::appendProfile):
        * inspector/TimelineRecordFactory.h:
        * page/DOMWindow.cpp:
        * page/Page.cpp:
        * page/PageConsoleClient.cpp:
        (WebCore::PageConsoleClient::profileEnd):
        (WebCore::PageConsoleClient::clearProfiles):
        * page/PageConsoleClient.h:
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::consoleProfiles):
        (WebCore::Internals::setLegacyJavaScriptProfilingEnabled):
        * testing/Internals.h:
        * testing/Internals.idl:
        * testing/js/WebCoreTestSupport.cpp:
        * xml/XSLStyleSheetLibxslt.cpp:
        * xml/XSLTProcessorLibxslt.cpp:

2016-05-16  Zalan Bujtas  <zalan@apple.com>

        RenderLayer::hitTestList could mutate the list of candidate layers.
        https://bugs.webkit.org/show_bug.cgi?id=157718
        <rdar://problem/22556046>

        Reviewed by Simon Fraser.

        This patch ensures that we always start hittesting a clean render tree at EventHandler::hitTestResultAtPoint.

        Speculative fix.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::hitTestResultAtPoint):

2016-05-13  Enrica Casucci  <enrica@apple.com>

        Remove unused initializer for WebEvent on iOS.
        https://bugs.webkit.org/show_bug.cgi?id=157689

        Reviewed by Anders Carlsson.

        This is no longer used and can be removed.
        The logic tied to isPopupVariant has been incorporated
        in keyboard flags. The characterSet property is no longer needed too.

        * platform/ios/WebEvent.h:
        * platform/ios/WebEvent.mm:
        (-[WebEvent initWithKeyEventType:timeStamp:characters:charactersIgnoringModifiers:modifiers:isRepeating:withFlags:keyCode:isTabKey:characterSet:]):
        (-[WebEvent initWithKeyEventType:timeStamp:characters:charactersIgnoringModifiers:modifiers:isRepeating:isPopupVariant:keyCode:isTabKey:characterSet:]): Deleted.
        (-[WebEvent _characterSetDescription]): Deleted.
        (-[WebEvent isPopupVariant]): Deleted.
        (-[WebEvent characterSet]): Deleted.

2016-05-16  Simon Fraser  <simon.fraser@apple.com>

        Add a WebCore logging channel for images
        https://bugs.webkit.org/show_bug.cgi?id=157752

        Reviewed by Zalan Bujtas.

        Create an Images log channel, and log various things related to decoding and drawing
        images.

        * platform/Logging.h:
        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::destroyDecodedDataIfNecessary):
        (WebCore::BitmapImage::cacheFrame):
        (WebCore::BitmapImage::startAnimation):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::drawNativeImage):
        * platform/graphics/cg/ImageDecoderCG.cpp:
        (WebCore::ImageDecoder::createFrameImageAtIndex):

2016-05-12  Ada Chan  <adachan@apple.com>

        Don't execute JavaScript within HTMLMediaElement::stop()
        https://bugs.webkit.org/show_bug.cgi?id=157655

        Reviewed by Chris Dumez.

        * dom/ScriptExecutionContext.cpp:
        (WebCore::ScriptExecutionContext::suspendActiveDOMObjects):
        Move the setting of m_activeDOMObjectsAreSuspended to true earlier so we won't execute
        any JS while suspending the objects.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::updateMediaControlsAfterPresentationModeChange):
        Bail early if the controls script hasn't been injected yet or the DOM object has been
        stopped or suspended.

2016-05-16  Ryosuke Niwa  <rniwa@webkit.org>

        Focus ordering should respect slot elements
        https://bugs.webkit.org/show_bug.cgi?id=151379

        Reviewed by Antti Koivisto.

        Implemented the sequential focus navigation ordering as discussed on
        https://github.com/w3c/webcomponents/issues/375

        New behavior treats each shadow root and slot as a "focus scope". The focus navigation ordering
        is defined within each "focus scope" using tabindex, treating any "focus scope owner"
        (e.g. shadow host or a slot) as if it was having tabindex=0 if it wasn't itself focusable.

        This patch modifies FocusNavigationScope to support a focus scope defined for a slot element in
        addition to the one defined for a shadow tree and a document as previously supported.

        Tests: fast/shadow-dom/focus-across-details-element.html
               fast/shadow-dom/focus-navigation-across-slots.html

        * dom/Node.cpp:
        (WebCore::parentShadowRoot): Extracted from assignedSlot.
        (WebCore::Node::assignedSlot):
        (WebCore::Node::assignedSlotForBindings): Added.
        * dom/Node.h:
        * dom/NonDocumentTypeChildNode.idl:
        * html/HTMLDetailsElement.h:
        (HTMLDetailsElement::hasCustomFocusLogic): Added. Don't treat details element as a "focus scope".
        * html/HTMLSummaryElement.h:
        (HTMLSummaryElement::hasCustomFocusLogic): Ditto for summary element.
        * page/FocusController.cpp:
        (WebCore::hasCustomFocusLogic): Moved.
        (WebCore::isFocusScopeOwner): Added. Returns true on a shadow host without a custom focus logic or
        on a slot inside a shadow tree whose shadow host doesn't have a custom focus logic.
        (WebCore::FocusNavigationScope::firstChildInScope): Now takes a reference. Call isFocusScopeOwner
        to check for both slots and shadow roots instead of just the latter. This fixes a subtle bug that
        focus may never get out of textarea in some cases due to its failure to check hasCustomFocusLogic.
        (WebCore::FocusNavigationScope::lastChildInScope): Ditto.
        (WebCore::FocusNavigationScope::parentInScope): Made this a member function since it needs to check
        against m_slotElement inside the focus scope of a slot.
        (WebCore::FocusNavigationScope::nextSiblingInScope): Added. Finds the next assigned node in a slot
        in the focus scope defined for a slot. Just calls nextSibling() in the focus scope for shadow tree
        and document.
        (WebCore::FocusNavigationScope::previousSiblingInScope): Ditto for finding the previous sibling.
        (WebCore::FocusNavigationScope::firstNodeInScope): Added. This function replaces rootNode() which
        doesn't exist for the focus scope of a slot element.
        (WebCore::FocusNavigationScope::lastNodeInScope): Ditto for the last node.
        (WebCore::FocusNavigationScope::nextInScope):
        (WebCore::FocusNavigationScope::previousInScope):
        (WebCore::FocusNavigationScope::FocusNavigationScope): Added a variant that takes HTMLSlotElement.
        (WebCore::FocusNavigationScope::owner): Added the support for slot elements.
        (WebCore::FocusNavigationScope::scopeOf): Ditto.
        (WebCore::FocusNavigationScope::scopeOwnedByScopeOwner): Ditto.
        (WebCore::isFocusableElementOrScopeOwner): Added the support for slot elements and renamed from
        isFocusableOrHasShadowTreeWithoutCustomFocusLogic.
        (WebCore::isNonFocusableScopeOwner): Ditto. Renamed from isNonFocusableShadowHost.
        (WebCore::isFocusableScopeOwner): Ditto. Renamed from isFocusableShadowHost.
        (WebCore::shadowAdjustedTabIndex): Added the support for slot elements.
        (WebCore::FocusController::findFocusableElementAcrossFocusScope):
        (WebCore::FocusController::nextFocusableElementWithinScope):
        (WebCore::FocusController::previousFocusableElementWithinScope):
        (WebCore::FocusController::findElementWithExactTabIndex):
        (WebCore::nextElementWithGreaterTabIndex): Call firstNodeInScope() instead of rootNode() here since
        there is no root node for the focus scope defined for a slot element.
        (WebCore::previousElementWithLowerTabIndex): Ditto for scope.lastNodeInScope().
        (WebCore::FocusController::nextFocusableElementOrScopeOwner):
        (WebCore::FocusController::previousFocusableElementOrScopeOwner):
        (WebCore::parentInScope): Deleted.
        (WebCore::FocusNavigationScope::rootNode): Deleted.
        (WebCore::FocusNavigationScope::scopeOwnedByShadowHost): Deleted.
        (WebCore::isNonFocusableShadowHost): Deleted.
        (WebCore::isFocusableShadowHost): Deleted.
        (WebCore::isFocusableOrHasShadowTreeWithoutCustomFocusLogic): Deleted.

2016-05-16  Chris Dumez  <cdumez@apple.com>

        Use WTF::Optional for ScrollView's m_deferredScrollDelta / m_deferredScrollOffsets
        https://bugs.webkit.org/show_bug.cgi?id=157747

        Reviewed by Zalan Bujtas.

        Use WTF::Optional for ScrollView's m_deferredScrollDelta / m_deferredScrollOffsets
        instead of std::unique_ptr as it is more suited for this purpose.

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::scrollOffsetChangedViaPlatformWidget):
        (WebCore::ScrollView::handleDeferredScrollUpdateAfterContentSizeChange):
        (WebCore::ScrollView::scrollTo):
        * platform/ScrollView.h:

2016-05-16  Zalan Bujtas  <zalan@apple.com>

        containingBlockFor*Position functions should take the renderer instead of the parent.
        https://bugs.webkit.org/show_bug.cgi?id=157659

        Reviewed by Simon Fraser.

        containingBlockForFixedPosition, containingBlockForAbsolutePosition and containingBlockForObjectInFlow functions
        expect the renderer's parent to be passed in (unless it is a RenderInline!). It is rather misleading and highly error-prone.
        We should call them with the renderer itself instead.

        * dom/Element.cpp:
        (WebCore::layoutOverflowRectContainsAllDescendants): This expects ancestor containing block.
        * rendering/LogicalSelectionOffsetCaches.h:
        (WebCore::LogicalSelectionOffsetCaches::LogicalSelectionOffsetCaches):
        * rendering/RenderElement.cpp:
        (WebCore::containingBlockForFixedPosition):
        (WebCore::containingBlockForAbsolutePosition):
        (WebCore::containingBlockForObjectInFlow):
        * rendering/RenderElement.h:
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::styleWillChange):
        * rendering/RenderLineBreak.cpp:
        (WebCore::RenderLineBreak::collectSelectionRects): Not a behaviour change.
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::containingBlock): RenderScrollbarPart renderer now returns
        the containing block based on its owning renderer's style.

2016-05-16  Brent Fulgham  <bfulgham@apple.com>

        REGRESSION (r192098): Content missing after copy and paste to Notes App on retina displays
        https://bugs.webkit.org/show_bug.cgi?id=157630
        <rdar://problem/25277577>

        Reviewed by Simon Fraser.

        Tested by http/tests/images/hidpi-srcset-copy.html

        The code to create a WebArchive (or other representation) of a webpage was using the 'src' attribute of
        the image element, which might be changed to reflect the optimal image dimensions for a specific
        display. Instead, we should use the 'imageSourceURL' method of the Element class so we get the correct
        'original' image URL in our cached resources.

        * editing/cocoa/HTMLConverter.mm:
        (HTMLConverter::_processElement): Use 'imageSourceURL', rather than getting the raw 'src' attribute.
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Ditto.

2016-05-16  Brady Eidson  <beidson@apple.com>

        Random CachedFont.cpp cleanup.
        https://bugs.webkit.org/show_bug.cgi?id=157740

        Reviewed by Myles C. Maxfield.

        No new tests (Refactor/cleanup, no behavior change)

        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::ensureCustomFontData): Remove unneeded local RefPtr<>
        (WebCore::CachedFont::createCustomFontData): Refactor to not require unnecessary Ref-churn in the common case.

2016-05-16  Chris Dumez  <cdumez@apple.com>

        Modernize Track classes' code
        https://bugs.webkit.org/show_bug.cgi?id=157735

        Reviewed by Eric Carlson.

        Modernize Track classes' code a bit.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::removeSourceBuffer):
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveInitializationSegment):
        * bindings/js/JSTrackCustom.cpp:
        (WebCore::toTrack):
        (WebCore::toJS):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::audioTrackEnabledChanged):
        (WebCore::HTMLMediaElement::textTrackModeChanged):
        (WebCore::HTMLMediaElement::videoTrackSelectedChanged):
        (WebCore::HTMLMediaElement::textTrackRemoveCues):
        (WebCore::HTMLMediaElement::mediaPlayerDidAddTextTrack):
        (WebCore::HTMLMediaElement::addAudioTrack):
        (WebCore::HTMLMediaElement::addTextTrack):
        (WebCore::HTMLMediaElement::addVideoTrack):
        (WebCore::HTMLMediaElement::removeAudioTrack):
        (WebCore::HTMLMediaElement::removeTextTrack):
        (WebCore::HTMLMediaElement::removeVideoTrack):
        (WebCore::HTMLMediaElement::forgetResourceSpecificTracks):
        (WebCore::HTMLMediaElement::audioTracks):
        (WebCore::HTMLMediaElement::textTracks):
        (WebCore::HTMLMediaElement::videoTracks):
        (WebCore::HTMLMediaElement::didAddTextTrack):
        (WebCore::HTMLMediaElement::didRemoveTextTrack):
        (WebCore::HTMLMediaElement::setSelectedTextTrack):
        (WebCore::HTMLMediaElement::textTrackAddCues): Deleted.
        (WebCore::HTMLMediaElement::closeCaptionTracksChanged): Deleted.
        * html/HTMLMediaElement.h:
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlClosedCaptionsTrackListElement::updateDisplay):
        (WebCore::MediaControlClosedCaptionsTrackListElement::rebuildTrackListMenu):
        * html/track/AudioTrack.cpp:
        (WebCore::AudioTrack::~AudioTrack):
        (WebCore::AudioTrack::setPrivate):
        (WebCore::AudioTrack::isValidKind):
        (WebCore::AudioTrack::willRemove):
        (WebCore::AudioTrack::setEnabled): Deleted.
        (WebCore::AudioTrack::updateKindFromPrivate): Deleted.
        * html/track/AudioTrack.h:
        (isType):
        * html/track/AudioTrackList.cpp:
        (AudioTrackList::append):
        (AudioTrackList::item):
        (AudioTrackList::getTrackById):
        (AudioTrackList::eventTargetInterface): Deleted.
        * html/track/AudioTrackList.h:
        * html/track/InbandTextTrack.cpp:
        (WebCore::InbandTextTrack::willRemove):
        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::setKind):
        (WebCore::TextTrack::trackIndex):
        (WebCore::TextTrack::trackIndexRelativeToRenderedTracks):
        (WebCore::TextTrack::setLanguage):
        * html/track/TextTrack.h:
        (isType):
        * html/track/TextTrackList.cpp:
        (TextTrackList::getTrackIndex):
        (TextTrackList::getTrackIndexRelativeToRenderedTracks):
        (TextTrackList::item):
        (TextTrackList::getTrackById):
        (TextTrackList::invalidateTrackIndexesAfterTrack):
        (TextTrackList::append):
        (TextTrackList::remove):
        (TextTrackList::contains):
        * html/track/TextTrackList.h:
        * html/track/TrackBase.h:
        * html/track/TrackEvent.cpp:
        (WebCore::TrackEvent::TrackEvent):
        * html/track/TrackEvent.h:
        * html/track/TrackListBase.cpp:
        (TrackListBase::remove):
        (TrackListBase::contains):
        (TrackListBase::scheduleTrackEvent):
        (TrackListBase::scheduleAddTrackEvent):
        (TrackListBase::scheduleRemoveTrackEvent):
        * html/track/TrackListBase.h:
        * html/track/VideoTrack.cpp:
        (WebCore::VideoTrack::willRemove):
        (WebCore::VideoTrack::setKind):
        (WebCore::VideoTrack::setLanguage):
        * html/track/VideoTrack.h:
        (isType):
        * html/track/VideoTrackList.cpp:
        (VideoTrackList::append):
        (VideoTrackList::item):
        (VideoTrackList::getTrackById):
        (VideoTrackList::selectedIndex):
        * html/track/VideoTrackList.h:

2016-05-16  Michael Catanzaro  <mcatanzaro@igalia.com>

        CSSParser.cpp triggers -Wunused-parameter
        https://bugs.webkit.org/show_bug.cgi?id=157734

        Reviewed by Csaba Osztrogonác.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):

2016-05-16  Zan Dobersek  <zdobersek@igalia.com>

        [Cairo] GraphicsContext3D::ImageExtractor should use the correct size for copying non-image surfaces
        https://bugs.webkit.org/show_bug.cgi?id=157580

        Reviewed by Darin Adler.

        GraphicsContext3D::ImageExtractor::extractImage() shouldn't use m_imageWidth
        and m_imageHeight members when copying the non-image-backed Cairo surface into
        the image-based replacement simply because these two are not initialized until
        later in this method.

        Instead, the size of the to-be-copied image should be queried via the
        cairoSurfaceSize() utility function which properly handles Cairo surfaces of
        different types.

        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
        (WebCore::GraphicsContext3D::ImageExtractor::extractImage):

2016-05-16  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION (r199821): Large animated GIFs with slow network do not animate till the last frame
        https://bugs.webkit.org/show_bug.cgi?id=157500

        Reviewed by Darin Adler.

        r199821 relies on the assumption that the image frameCount can be retrieved
        only once when the image size is available and it is not going to change. It
        turned out this assumption is wrong for some animated GIFs. The frameCount
        can change every time a new data block is decoded.

        The fix is to invalidate the image cached metadata every time a new data
        block is decoded.

        Test: http/tests/misc/slow-loading-animated-image.html

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::BitmapImage): Move the "fromImage" BitmapImage constructor
        to BitmapImage.cpp. The ImageSource needs to be initialized differently for
        this case from the decoder image case. Also get rid of the template constructor.
        Most of the flags of the BitmapImage will be deleted with the asynchronous image
        decoding work.
        
        (WebCore::BitmapImage::cacheFrame): Delete unused flag m_hasUniformFrameSize.
        It was added in r35761 and was mainly used by BitmapImage::currentFrameSize().
        But this function itself was deleted in r172348.
        
        (WebCore::BitmapImage::dataChanged): Invalidate the image metadata cache.
        
        * platform/graphics/BitmapImage.h:
        (WebCore::BitmapImage::BitmapImage): Deleted.
        Delete unused flag m_hasUniformFrameSize. Also define new static functions in
        FrameData to calculate platform dependent properties of an image.
        
        * platform/graphics/ImageSource.cpp:
        (WebCore::ImageSource::ImageSource): Add a new constructor for the "fromImage"
        BitmapImage case. The purpose of this constructor is to keep m_needsUpdateMetadata
        and m_maximumSubsamplingLevel be initialized as they are in the class definition.
        This constructor will be used with the asynchronous image decoding work where the
        ImageSource needs to cache the FrameData.
        
        (WebCore::ImageSource::updateMetadata): If needsUpdateMetaData() is true, cache new metadata.
        
        (WebCore::ImageSource::subsamplingLevelForScale): Call updateMetadata() with its new name.
        (WebCore::ImageSource::frameCount): Ditto
        (WebCore::ImageSource::cacheMetadata): Deleted.
        
        * platform/graphics/ImageSource.h:
        (WebCore::ImageSource::setNeedsUpdateMetadata): Invalidate the image cached metadata.
        
        * platform/graphics/cairo/BitmapImageCairo.cpp:
        (WebCore::NativeImage::size):
        (WebCore::NativeImage::hasAlpha):
        (WebCore::BitmapImage::BitmapImage): Deleted.
        Delete the "fromImage" BitmapImage constructor from this file since it is now platform
        independent and has been moved to BitmapImage.cpp. Also add the new NativeImage platform
        dependent functions which are used by the new "fromImage" BitmapImage constructor.
        
        * platform/graphics/cg/BitmapImageCG.cpp:
        (WebCore::NativeImage::size):
        (WebCore::NativeImage::hasAlpha):
        (WebCore::BitmapImage::BitmapImage): Deleted.
        Ditto.

2016-05-15  Frederic Wang  <fwang@igalia.com>

        Small removal of useless code for MathML token elements
        https://bugs.webkit.org/show_bug.cgi?id=157568

        Reviewed by Darin Adler.

        We remove two pieces of code for MathML token elements with unclear purposes and that do not
        have any effect on math rendering.

        No new tests, behavior is unchanged.

        * css/mathml.css:
        (mtext): Deleted. This was probably a hack that is no longer needed with the latest math font
        ascent/descent management.
        * mathml/MathMLTextElement.cpp:
        (WebCore::MathMLTextElement::createElementRenderer): Deleted. Removing this does not break
        the mentioned test.

2016-05-15  Chris Dumez  <cdumez@apple.com>

        Use more references in JS wrappers related code
        https://bugs.webkit.org/show_bug.cgi?id=157721

        Reviewed by Darin Adler.

        - Use more references in JS wrappers related code.
        - Avoid some refcounting churn when using toJSNewlyCreated() and in
          HTML/SVG elements factories by moving the Ref<> around.
        - Add toJS() / toJSNewlyCreated() implementations for Text, XMLDocument
          and HTMLDocument. Now that toJSNewlyCreated() takes a Ref<>&& /
          RefPtr<>&& in, the compiler is no longer able to implicitly use the
          toJSNewlyCreated() implementation of a parent class for a subclass
          type (complains about calls being ambiguous). I thought about updating
          the bindings generator to always generate a toJSNewlyCreated() for
          all wrapper types (that would call the one on the parent class if the
          subclass does not have a proper implementation). However this would
          add some complexity to the bindings generator and it did not seem
          worth it because [NewObject] and therefore toJSNewlyCreated() is only
          used for a very limited set of subtypes. I have therefore decided to
          add the toJS() / toJSNewlyCreated() implementations for the subtypes
          in question. This also has the benefit of avoiding calling the more
          complex implementations on Node / Document.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSAnimationTimelineCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSAudioContextCustom.cpp:
        (WebCore::constructJSAudioContext):
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSBlobCustom.cpp:
        (WebCore::constructJSBlob):
        * bindings/js/JSCSSRuleCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSCSSValueCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSDOMBinding.h:
        (WebCore::getCachedWrapper):
        (WebCore::createWrapper):
        (WebCore::wrap):
        (WebCore::getExistingWrapper):
        (WebCore::createNewWrapper):
        (WebCore::toJS):
        (WebCore::finiteInt32Value): Deleted.
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::createNewDocumentWrapper):
        (WebCore::toJS):
        (WebCore::cachedDocumentWrapper):
        (WebCore::reportMemoryForFramelessDocument):
        (WebCore::toJSNewlyCreated):
        * bindings/js/JSDocumentCustom.h:
        * bindings/js/JSDocumentFragmentCustom.cpp:
        (WebCore::createNewDocumentFragmentWrapper):
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSElementCustom.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/js/JSElementCustom.h:
        (WebCore::toJSNewlyCreated):
        * bindings/js/JSEventCustom.cpp:
        (WebCore::createNewEventWrapper):
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/js/JSFileCustom.cpp:
        (WebCore::constructJSFile):
        * bindings/js/JSHTMLCollectionCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::createNewHTMLDocumentWrapper):
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/js/JSHTMLTemplateElementCustom.cpp:
        (WebCore::JSHTMLTemplateElement::content):
        * bindings/js/JSImageDataCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSNodeCustom.cpp:
        (WebCore::createWrapperInline):
        (WebCore::createWrapper):
        (WebCore::toJSNewlyCreated):
        (WebCore::getOutOfLineCachedWrapper):
        * bindings/js/JSNodeCustom.h:
        (WebCore::toJS):
        * bindings/js/JSNodeListCustom.cpp:
        (WebCore::createWrapper):
        (WebCore::toJSNewlyCreated):
        * bindings/js/JSNodeListCustom.h:
        (WebCore::toJS):
        * bindings/js/JSRTCPeerConnectionCustom.cpp:
        (WebCore::constructJSRTCPeerConnection):
        * bindings/js/JSRTCSessionDescriptionCustom.cpp:
        (WebCore::constructJSRTCSessionDescription):
        * bindings/js/JSSVGPathSegCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSStyleSheetCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSTextCustom.cpp: Copied from Source/WebCore/dom/XMLDocument.idl.
        (WebCore::createNewTextWrapper):
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/js/JSTextTrackCueCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSTrackCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSXMLDocumentCustom.cpp: Copied from Source/WebCore/bindings/js/JSDocumentFragmentCustom.cpp.
        (WebCore::createNewXMLDocumentWrapper):
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        * bindings/scripts/test/JS/*: Rebaseline bindings tests.
        * dom/Element.cpp:
        (WebCore::Element::setInnerHTML):
        * dom/Text.idl:
        * dom/XMLDocument.idl:
        * dom/make_names.pl:
        (printWrapperFunctions):
        (printWrapperFactoryCppFile):
        (printWrapperFactoryHeaderFile):
        * editing/MarkupAccumulator.cpp:
        (WebCore::MarkupAccumulator::serializeNodesWithNamespaces):
        * html/HTMLDocument.idl:
        * html/HTMLTemplateElement.cpp:
        (WebCore::HTMLTemplateElement::content):
        (WebCore::HTMLTemplateElement::cloneNodeInternal):
        * html/HTMLTemplateElement.h:
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::insert):
        (WebCore::HTMLConstructionSite::insertTextNode):
        (WebCore::HTMLConstructionSite::ownerDocumentForCurrentNode):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::buildObjectForNode):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::XMLDocumentParser::startElementNs):

2016-05-15  Darin Adler  <darin@apple.com>

        Something tiny left out of the last patch.

        * WebCore.xcodeproj/project.pbxproj: Allow Xcode to update this file.
        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyInlineStyleChange): Removed unneeded null check; all
        code paths already have null checks.

2016-05-15  Darin Adler  <darin@apple.com>

        More CTTE and other cleanups for HTML editing header
        https://bugs.webkit.org/show_bug.cgi?id=157722

        Reviewed by Chris Dumez.

        These changes are mostly things Chris asked for in his review of my last patch
        or other related style and small efficiency improvements.

        - using nullptr instead of 0
        - using is<Text> instead of isTextNode and is<> instead of hasTagName
        - changing argument type of functions like editingIgnoresContent to a reference
        - using { } instead of constructor calls for classes like Position
        - using words like position intead of abbreviations like pos
        - using auto rather than explicit types
        - rename functions that return true for HTMLElement to express that in the function names

        * dom/Position.cpp:
        (WebCore::nextRenderedEditable): nullptr
        (WebCore::previousRenderedEditable): nullptr
        (WebCore::Position::Position): is<>, reference
        (WebCore::Position::moveToPosition): reference
        (WebCore::Position::offsetForPositionAfterAnchor): Added a null assertion and
        null check that replaces the one that used to be in lastOffsetForEditing.
        (WebCore::Position::parentAnchoredEquivalent): { }, reference
        (WebCore::Position::computeNodeBeforePosition): nullptr
        (WebCore::Position::computeNodeAfterPosition): nullptr
        (WebCore::Position::anchorTypeForLegacyEditingPosition): reference
        (WebCore::Position::previous): reference
        (WebCore::Position::next): reference
        (WebCore::Position::parentEditingBoundary): nullptr
        (WebCore::Position::previousCharacterPosition): { }, pos -> position
        (WebCore::Position::nextCharacterPosition): { }, pos -> position
        (WebCore::endsOfNodeAreVisuallyDistinctPositions): reference
        (WebCore::Position::upstream): { }, pos -> position
        (WebCore::Position::downstream): { }, pos -> position
        (WebCore::Position::rootUserSelectAllForNode): nullptr
        (WebCore::Position::isCandidate): auto, reference, is<>
        (WebCore::Position::rendersInDifferentPosition): pos -> position, auto, is<>
        (WebCore::Position::leadingWhitespacePosition): { }, is<>
        (WebCore::Position::trailingWhitespacePosition): { }
        (WebCore::Position::getInlineBoxAndOffset): reference
        (WebCore::Position::equals): reference, is<>

        * dom/PositionIterator.cpp:
        (WebCore::PositionIterator::operator Position): reference
        (WebCore::PositionIterator::isCandidate): reference

        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange): is<>
        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange): is<>, reference
        (WebCore::ApplyStyleCommand::removeConflictingInlineStyleFromRun): reference
        (WebCore::ApplyStyleCommand::removeInlineStyle): auto, is<>, reference
        (WebCore::ApplyStyleCommand::nodeFullySelected): is<>
        (WebCore::ApplyStyleCommand::nodeFullyUnselected): is<>
        (WebCore::ApplyStyleCommand::splitTextAtStart): is<>
        (WebCore::ApplyStyleCommand::splitTextElementAtStart): is<>
        (WebCore::ApplyStyleCommand::splitTextElementAtEnd): is<>
        (WebCore::ApplyStyleCommand::isValidCaretPositionInTextNode): is<>
        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement): Removed unneeded
        is<Element> calls before calling areIdenticalElements.
        (WebCore::ApplyStyleCommand::positionToComputeInlineStyleChange): Tightened
        up logic for the loop to avoid redundant checks.
        (WebCore::ApplyStyleCommand::applyInlineStyleChange): auto

        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::insertNodeAt): reference
        (WebCore::CompositeEditCommand::appendNode): reference
        (WebCore::CompositeEditCommand::moveParagraphs): isListHTMLElement

        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::handleGeneralDelete): reference

        * editing/FormatBlockCommand.cpp: Fixed order of includes.
        (WebCore::enclosingBlockToSplitTreeTo): isListHTMLElement

        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::doApply): reference

        * editing/ModifySelectionListLevel.cpp:
        (WebCore::getStartEndListChildren): isListHTMLElement
        (WebCore::IncreaseSelectionListLevelCommand::doApply):isListHTMLElement
        (WebCore::canDecreaseListLevel):isListHTMLElement

        * editing/RemoveNodeCommand.cpp: Removed unneeded include.

        * editing/ReplaceNodeWithSpanCommand.cpp:
        (WebCore::ReplaceNodeWithSpanCommand::doApply): Use HTMLSpanElement::create.

        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::isInterchangeNewlineNode): is<>, downcast<>
        (WebCore::isInterchangeConvertedSpaceSpan): is<>, downcast<>
        (WebCore::positionAvoidingPrecedingNodes): pos -> position, reference
        (WebCore::ReplaceSelectionCommand::doApply): isListHTMLElement
        (WebCore::ReplaceSelectionCommand::insertAsListItems): isListHTMLElement

        * editing/SpellChecker.cpp: Removed unneeded include.

        * editing/TextIterator.cpp:
        (WebCore::SimplifiedBackwardsTextIterator::advance): reference

        * editing/VisibleSelection.cpp:
        (WebCore::VisibleSelection::selectionFromContentsOfNode): reference

        * editing/VisibleUnits.cpp:
        (WebCore::previousLinePosition): reference
        (WebCore::nextLinePosition): reference
        (WebCore::findStartOfParagraph): reference
        (WebCore::findEndOfParagraph): reference

        * editing/htmlediting.cpp:
        (WebCore::canHaveChildrenForEditing): Moved here from header file so we don't
        have to include "Text.h". Not critical to inline this.
        (WebCore::isAtomicNode): reference
        (WebCore::lastOffsetForEditing): reference
        (WebCore::stringWithRebalancedWhitespace): Changed to use StringBuilder instead
        of Vector<UChar> so this won't turn 8-bit strings into 16-bit strings. Changed
        to not use the StringBuilder at all until we encounter a character that needs
        to be changed.
        (WebCore::isSpecialHTMLElement): Renamed to make it clear that it only can return
        true for a Node that is an HTMLElement.
        (WebCore::firstInSpecialElement): isSpecialHTMLElement
        (WebCore::lastInSpecialElement): isSpecialHTMLElement
        (WebCore::isListHTMLElement): Renamed to make it clear that it can only return
        true for a Node that is an HTMLElement.
        (WebCore::isListItem): isListHTMLElement, is<>
        (WebCore::enclosingNodeOfType): p -> position, nullptr
        (WebCore::highestEnclosingNodeOfType): p -> position
        (WebCore::enclosingListChild): isListHTMLElement, is<>
        (WebCore::embeddedSublist): isListHTMLElement
        (WebCore::appendedSublist):isListHTMLElement
        (WebCore::caretMaxOffset): is<>
        (WebCore::caretRendersInsideNode): changed to take a reference
        (WebCore::rendererForCaretPainting): reference

        * editing/htmlediting.h: Updated for name changes and type changes above.

        * editing/markup.cpp:
        (WebCore::StyledMarkupAccumulator::traverseNodesForSerialization): reference
        (WebCore::highestAncestorToWrapMarkup): auto, reference, isListHTMLElement

        * html/HTMLSpanElement.cpp:
        (WebCore::HTMLSpanElement::create): Added overload that does not require a tag name.
        * html/HTMLSpanElement.h: Ditto.

        * page/DOMSelection.cpp: Removed unneeded includes.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::localCaretRect): reference

2016-05-15  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r200925.
        https://bugs.webkit.org/show_bug.cgi?id=157725

        Does not build if MEDIA_SESSION is enabled (Requested by
        cdumez_ on #webkit).

        Reverted changeset:

        "Use new Web IDL dictionary support for
        MediaSession.setMetadata()"
        https://bugs.webkit.org/show_bug.cgi?id=157711
        http://trac.webkit.org/changeset/200925

2016-05-14  Chris Dumez  <cdumez@apple.com>

        Use new Web IDL dictionary support for MediaSession.setMetadata()
        https://bugs.webkit.org/show_bug.cgi?id=157711

        Reviewed by Eric Carlson.

        Use new Web IDL dictionary support for MediaSession.setMetadata().

        No new tests, no intended Web-exposed behavior change.

        * Modules/mediasession/MediaSession.cpp:
        (WebCore::MediaSession::setMetadata):
        (WebCore::MediaSession::deactivate): Deleted.
        * Modules/mediasession/MediaSession.h:
        * Modules/mediasession/MediaSession.idl:

2016-05-14  Joseph Pecoraro  <pecoraro@apple.com>

        Remove LegacyProfiler
        https://bugs.webkit.org/show_bug.cgi?id=153565

        Reviewed by Mark Lam.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * ForwardingHeaders/profiler/LegacyProfiler.h: Removed.
        * ForwardingHeaders/profiler/Profile.h: Removed.
        * ForwardingHeaders/profiler/ProfileNode.h: Removed.
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSCustomXPathNSResolver.cpp:
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::supportsLegacyProfiling): Deleted.
        (WebCore::JSDOMWindowBase::supportsRichSourceInfo): Deleted.
        * bindings/js/JSDOMWindowBase.h:
        * bindings/js/JSWorkerGlobalScopeBase.cpp:
        (WebCore::JSWorkerGlobalScopeBase::supportsLegacyProfiling): Deleted.
        * bindings/js/JSWorkerGlobalScopeBase.h:
        * bindings/js/ScriptCachedFrameData.cpp:
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::clearWindowShell): Deleted.
        * bindings/js/ScriptProfile.h: Removed.
        * bindings/js/ScriptProfileNode.h: Removed.
        * bindings/scripts/CodeGeneratorJS.pm:
        (AddClassForwardIfNeeded): Deleted.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/TestObj.idl:
        * css/CSSParser.cpp:
        * dom/Document.cpp:
        * inspector/InspectorConsoleInstrumentation.h:
        (WebCore::InspectorInstrumentation::stopProfiling):
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::legacyProfilerEnabled): Deleted.
        (WebCore::InspectorController::setLegacyProfilerEnabled): Deleted.
        * inspector/InspectorController.h:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::stopProfilingImpl):
        * inspector/InspectorInstrumentation.h:
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::startFromConsole):
        (WebCore::InspectorTimelineAgent::stopFromConsole):
        * inspector/InspectorTimelineAgent.h:
        * inspector/PageDebuggerAgent.cpp:
        * inspector/PageRuntimeAgent.cpp:
        * inspector/ScriptProfile.idl: Removed.
        * inspector/ScriptProfileNode.idl: Removed.
        * inspector/TimelineRecordFactory.cpp:
        (WebCore::buildAggregateCallInfoInspectorObject): Deleted.
        (WebCore::buildInspectorObject): Deleted.
        (WebCore::buildProfileInspectorObject): Deleted.
        (WebCore::TimelineRecordFactory::appendProfile): Deleted.
        * page/DOMWindow.cpp:
        * page/Page.cpp:
        * page/PageConsoleClient.cpp:
        (WebCore::PageConsoleClient::profileEnd):
        (WebCore::PageConsoleClient::clearProfiles): Deleted.
        * page/PageConsoleClient.h:
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState): Deleted.
        (WebCore::Internals::consoleProfiles): Deleted.
        (WebCore::Internals::setLegacyJavaScriptProfilingEnabled): Deleted.
        * testing/Internals.h:
        * testing/Internals.idl:
        * testing/js/WebCoreTestSupport.cpp:
        * xml/XSLStyleSheetLibxslt.cpp:
        * xml/XSLTProcessorLibxslt.cpp:

2016-05-13  Ryosuke Niwa  <rniwa@webkit.org>

        ToT WebKit doesn't show tooltip on perf dashboard's summary page
        https://bugs.webkit.org/show_bug.cgi?id=157705

        Reviewed by Darin Adler.

        The bug was caused by WebKit doesn't look for the title attribute across shadow boundaries.
        Fixed it by using a newly added Node::parentNodeInComposedTree in HitTestResult::title.

        Test: fast/shadow-dom/tooltip-on-composed-tree.html

        * dom/Node.cpp:
        (WebCore::Node::parentInComposedTree): Added.
        * dom/Node.h:
        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::title): Fixed the bug.
        (WebCore::HitTestResult::innerTextIfTruncated): Fixed a related bug when ShowsToolTipOverTruncatedText
        is enabled. Unfortunately, there is no machinery to test this feature yet.

2016-05-14  Darin Adler  <darin@apple.com>

        CTTE for the HTML editing header
        https://bugs.webkit.org/show_bug.cgi?id=157676

        Reviewed by Chris Dumez.

        * accessibility/AXObjectCache.cpp:
        (WebCore::AccessibilityReplacedText::postTextStateChangeNotification): Use auto so we have a
        change to compile more efficient code using the more specific types returned, rather than
        explicitly using a less specific type like Node.
        (WebCore::AXObjectCache::startCharacterOffsetOfParagraph): Ditto.
        * accessibility/atk/WebKitAccessibleInterfaceText.cpp: Update for deprecatedIsEditingWhitespace name.
        * dom/Position.cpp:
        (WebCore::Position::offsetForPositionAfterAnchor): Update to use a reference instead of a pointer.
        (WebCore::Position::next): Ditto.
        (WebCore::Position::atFirstEditingPositionForNode): Ditto.
        (WebCore::Position::atLastEditingPositionForNode): Ditto.
        (WebCore::Position::atStartOfTree): Ditto.
        (WebCore::Position::atEndOfTree): Ditto.
        (WebCore::Position::upstream): Ditto.
        (WebCore::Position::downstream): Ditto.
        (WebCore::Position::rendersInDifferentPosition): Ditto.
        * dom/PositionIterator.cpp:
        (WebCore::PositionIterator::increment): Ditto.
        (WebCore::PositionIterator::decrement): Ditto.
        (WebCore::PositionIterator::atEnd): Ditto.
        (WebCore::PositionIterator::atEndOfNode): Ditto.
        * editing/AlternativeTextController.cpp:
        (WebCore::AlternativeTextController::markPrecedingWhitespaceForDeletedAutocorrectionAfterCommand):
        Use new name, deprecatedIsEditingWhitespace.
        * editing/ApplyBlockElementCommand.cpp:
        (WebCore::ApplyBlockElementCommand::formatSelection): Use auto (see rationale above).
        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyBlockStyle): More of the same.
        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange): Ditto.
        (WebCore::ApplyStyleCommand::fixRangeAndApplyInlineStyle): Ditto.
        (WebCore::ApplyStyleCommand::isValidCaretPositionInTextNode): Ditto.
        (WebCore::ApplyStyleCommand::mergeStartWithPreviousIfIdentical): Ditto.
        (WebCore::ApplyStyleCommand::mergeEndWithNextIfIdentical): Ditto.
        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement): Ditto.
        * editing/BreakBlockquoteCommand.cpp:
        (WebCore::BreakBlockquoteCommand::doApply): Ditto.
        * editing/CompositeEditCommand.cpp:
        (WebCore::postTextStateChangeNotification): Ditto.
        (WebCore::CompositeEditCommand::insertNodeAt): Ditto.
        (WebCore::CompositeEditCommand::positionOutsideTabSpan): Ditto.
        (WebCore::containsOnlyDeprecatedEditingWhitespace): Ditto.
        (WebCore::CompositeEditCommand::shouldRebalanceLeadingWhitespaceFor): Ditto.
        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt): Ditto.
        (WebCore::CompositeEditCommand::rebalanceWhitespaceOnTextSubstring): Ditto.
        (WebCore::CompositeEditCommand::insertNewDefaultParagraphElementAt): Ditto.
        (WebCore::CompositeEditCommand::moveParagraphWithClones): Ditto.
        (WebCore::CompositeEditCommand::moveParagraphs): Ditto.
        * editing/DeleteSelectionCommand.cpp:
        (WebCore::DeleteSelectionCommand::initializeStartEnd): Ditto.
        (WebCore::DeleteSelectionCommand::handleGeneralDelete): Ditto.
        (WebCore::DeleteSelectionCommand::mergeParagraphs): Ditto.
        (WebCore::DeleteSelectionCommand::doApply): Ditto.
        * editing/EditCommand.cpp:
        (WebCore::EditCommand::postTextStateChangeNotification): Ditto.
        * editing/EditingStyle.cpp: Ditto.
        * editing/Editor.cpp:
        (WebCore::Editor::advanceToNextMisspelling): Ditto.
        * editing/FormatBlockCommand.cpp:
        (WebCore::FormatBlockCommand::formatRange): Ditto.
        * editing/IndentOutdentCommand.cpp:
        (WebCore::IndentOutdentCommand::outdentParagraph): Ditto.
        * editing/InsertLineBreakCommand.cpp:
        (WebCore::InsertLineBreakCommand::doApply): Ditto.
        * editing/InsertListCommand.cpp:
        (WebCore::InsertListCommand::fixOrphanedListChild): Ditto.
        (WebCore::InsertListCommand::doApplyForSingleParagraph): Ditto.
        (WebCore::InsertListCommand::unlistifyParagraph): Ditto.
        (WebCore::InsertListCommand::listifyParagraph): Ditto.
        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::doApply): Ditto.
        * editing/InsertTextCommand.cpp:
        (WebCore::InsertTextCommand::insertTab): Ditto.
        * editing/ModifySelectionListLevel.cpp:
        (WebCore::IncreaseSelectionListLevelCommand::doApply): Ditto.
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplacementFragment::removeUnrenderedNodes): Ditto.
        (WebCore::ReplaceSelectionCommand::shouldMerge): Ditto.
        (WebCore::ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline): Ditto.
        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Ditto.
        (WebCore::enclosingInline): Ditto.
        (WebCore::ReplaceSelectionCommand::doApply): Ditto.
        * editing/TextIterator.cpp:
        (WebCore::maxOffsetIncludingCollapsedSpaces): Ditto.
        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::forwardDeleteKeyPressed): Ditto.
        * editing/VisiblePosition.cpp:
        (WebCore::VisiblePosition::honorEditingBoundaryAtOrBefore): Ditto.
        (WebCore::VisiblePosition::honorEditingBoundaryAtOrAfter): Ditto.
        * editing/VisibleSelection.cpp:
        (WebCore::VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity): Ditto.
        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries): Ditto.
        * editing/VisibleUnits.cpp:
        (WebCore::previousRootInlineBoxCandidatePosition): Ditto.
        (WebCore::nextRootInlineBoxCandidatePosition): Ditto.
        (WebCore::startOfParagraph): Ditto.
        (WebCore::endOfParagraph): Ditto.
        (WebCore::startOfEditableContent): Ditto.
        (WebCore::endOfEditableContent): Ditto.

        * editing/htmlediting.cpp:
        (WebCore::highestEditableRoot): Changed return type to ContainerNode. Maybe later could
        change it to Element.
        (WebCore::lowestEditableAncestor): Changed return type to Element.
        (WebCore::isEditableToAccessibility): Use auto.
        (WebCore::isRichlyEditablePosition): Ditto.
        (WebCore::editableRootForPosition): Ditto.
        (WebCore::unsplittableElementForPosition):Ditto.
        (WebCore::nextCandidate): Streamline.
        (WebCore::nextVisuallyDistinctCandidate): Ditto.
        (WebCore::previousCandidate): Ditto.
        (WebCore::previousVisuallyDistinctCandidate): Ditto.
        (WebCore::firstEditablePositionAfterPositionInRoot): Changed arugment type to
        ContainerNode.
        (WebCore::lastEditablePositionBeforePositionInRoot): Ditto.
        (WebCore::lastOffsetForEditing): Changed argument type to reference.
        (WebCore::stringWithRebalancedWhitespace): Optimized the case where the function does
        not need to change the string, so it just returns the passed string rather than a copy.
        (WebCore::isTableStructureNode): Use auto.
        (WebCore::isSpecialElement): Made this function private to the file. Use auto.
        (WebCore::firstInSpecialElement): Return an HTMLElement.
        (WebCore::lastInSpecialElement): Ditto.
        (WebCore::isFirstVisiblePositionInSpecialElement): Made this function private to the file.
        (WebCore::positionBeforeContainingSpecialElement): Changed out argument to HTMLElement.
        (WebCore::isLastVisiblePositionInSpecialElement): Ditto.
        (WebCore::positionAfterContainingSpecialElement): Ditto.
        (WebCore::positionOutsideContainingSpecialElement): Ditto.
        (WebCore::isFirstPositionAfterTable): Changed return type to Element.
        (WebCore::isLastPositionBeforeTable): Ditto.
        (WebCore::visiblePositionBeforeNode): Changed argument type to reference.
        (WebCore::visiblePositionAfterNode): Ditto.
        (WebCore::enclosingElementWithTag): Use auto. Removed special case for null since the
        algorithm already handles null correctly.
        (WebCore::enclosingNodeOfType): Use auto.
        (WebCore::highestEnclosingNodeOfType): Ditto.
        (WebCore::highestNodeToRemoveInPruning): Ditto.
        (WebCore::enclosingTableCell): Changed return type to Element.
        (WebCore::enclosingAnchorElement): Removed special case for null since the algorithm
        already handles null correctly.
        (WebCore::enclosingList): Use auto.
        (WebCore::enclosingListChild): Use auto.
        (WebCore::enclosingEmptyListItem): Use auto.
        (WebCore::outermostEnclosingList): Use auto.
        (WebCore::canMergeLists): Use references and more specific type. Since both elements are
        known to be HTMLElement, compare local names instead of using hasTagName.
        (WebCore::isRenderedTable): Use auto.
        (WebCore::isTableCell): Ditto.
        (WebCore::isEmptyTableCell): Ditto.
        (WebCore::createBreakElement): Deleted. Callers can use HTMLBRElement directly.
        (WebCore::createOrderedListElement): Deleted. Callers can use HTMLOListElement directly.
        (WebCore::createUnorderedListElement): Deleted. Callers can use HTMLUListElement directly.
        (WebCore::createListItemElement): Deleted. Callers can use HTMLLIElement directly.
        (WebCore::isTabSpanNode): Remove redundant checks and did more specific typecast.
        (WebCore::isTabSpanTextNode): Removed redundant null checks.
        (WebCore::tabSpanNode): Changed return type to HTMLSpanElement.
        (WebCore::positionOutsideTabSpan): Deleted. Unused function.
        (WebCore::createTabSpanElement): Made one of the overloads private to this file. Use auto.
        Changed argument type since we don't need to support null. Moved createEditingTextNode code,
        specific to the version without a string into that function rather than the helper function.
        (WebCore::isNodeRendered): Changed argument type to a reference.
        (WebCore::numEnclosingMailBlockquotes): Streamlined.
        (WebCore::isMailBlockquote): Use downcast instead of static_cast.
        (WebCore::caretMinOffset): Take a reference instead of a pointer.
        (WebCore::caretMaxOffset): Ditto.
        (WebCore::selectionForParagraphIteration): Use auto.
        (WebCore::indexForVisiblePosition): Ditto.
        (WebCore::visiblePositionForIndex): Ditto.
        (WebCore::visiblePositionForIndexUsingCharacterIterator): Ditto.
        (WebCore::isVisiblyAdjacent): Made this private to this file.
        (WebCore::isNodeVisiblyContainedWithin): Changed argument type to a reference.
        (WebCore::areIdenticalElements): Changed argument types to references.
        (WebCore::adjustedSelectionStartForStyleComputation): Use auto.
        (WebCore::isBlockFlowElement): Changed argument type to a reference. Use auto.
        (WebCore::deprecatedEnclosingBlockFlowElement): Updated for reference changes.
        (WebCore::rendererForCaretPainting): Use auto.

        * editing/htmlediting.h: Use pragma once. Removed unneeded includes and forward declarations.
        Removed various non-helpful comments (the sections still don't make sense; not really good to
        group functions by their return types). Moved inline functoin bodies to the bottom of the file.
        Renamed isWhitespace to deprecatedIsEditingWhitespace.

        * editing/markup.cpp:
        (WebCore::createFragmentFromText): Use HTMLBRElement.
        * page/DOMSelection.cpp:
        (WebCore::DOMSelection::extend): Updated since caretMaxOffset takes a reference.

2016-05-14  Myles C. Maxfield  <mmaxfield@apple.com>

        Support ArrayBufferViews in the CSS Font Loading API
        https://bugs.webkit.org/show_bug.cgi?id=157694
        <rdar://problem/25554267>

        This patch adds a new mode to CSSFontFaceSource for immediate (ArrayBuffer) data.
        Then, FontFace can simply be hooked up to this new mode.

        Reviewed by Darin Adler.

        Test: fast/text/css-font-loading-arraybuffer.html

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::CSSFontFaceSource):
        (WebCore::CSSFontFaceSource::font):
        * css/CSSFontFaceSource.h:
        * css/FontFace.cpp:
        (WebCore::FontFace::create):
        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::ensureCustomFontData):
        (WebCore::CachedFont::createCustomFontData):
        (WebCore::CachedFont::createFont):
        (WebCore::CachedFont::platformDataFromCustomData):
        * loader/cache/CachedFont.h:

2016-05-14  Chris Dumez  <cdumez@apple.com>

        [WebIDL] Add support for dictionary members of integer types
        https://bugs.webkit.org/show_bug.cgi?id=157703

        Reviewed by Darin Adler.

        Add support for dictionary members of integer types, including support
        for the [Clamp] and [EnforceRange] IDL extended attributes on such
        members.

        * bindings/js/JSDOMConvert.h:
        (WebCore::convert):
        (WebCore::convertOptional):
        - Add the needed template specializations so we can use convertOptional()
          with integral types.
        - Use std::enable_if so the template specializations meants to be used
          for floating point types or integral types can only be instantiated
          for such types.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConversionRuleWithLeadingComma):
        (GetIntegerConversionConfiguration):
        (JSValueToNative):
        Generate the right IntegerConversionConfiguration parameter for convert()
        and convertOptional() when converting dictionary members of integral
        types

        * bindings/scripts/IDLParser.pm:
        (parseDictionaryMember):
        Fix bug in the IDL parser where we weren't initializing the extended
        attributes for dictionary members.

        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/TestObj.idl:
        Add bindings tests coverage.

2016-05-14  Chris Dumez  <cdumez@apple.com>

        Allocate MacGlyphToPathTranslator / CairoGlyphToPathTranslator on the stack
        https://bugs.webkit.org/show_bug.cgi?id=157690

        Reviewed by Myles C. Maxfield.

        Allocate MacGlyphToPathTranslator / CairoGlyphToPathTranslator on the
        stack. We also now use the subclass type for the local variable so it
        will bypass the vtable for various virtual function calls (if the compiler
        was not already smart enough to figure this out).

        * platform/graphics/cairo/FontCairo.cpp:
        (WebCore::FontCascade::dashesForIntersectionsWithRect):
        * platform/graphics/cocoa/FontCascadeCocoa.mm:
        (WebCore::FontCascade::dashesForIntersectionsWithRect):

2016-05-13  Chris Dumez  <cdumez@apple.com>

        Unreviewed attempt to fix the iOS build after the protector variables renaming.

        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::willSendRequest):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveResponse):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveData):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didFinishLoading):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didFail):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::willCacheResponse):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveChallenge):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didSendBodyData):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::canRespondToProtectionSpace):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveDataArray):

2016-05-13  Zalan Bujtas  <zalan@apple.com>

        All scrolling height/width values should be integral rounded.
        https://bugs.webkit.org/show_bug.cgi?id=157687

        Reviewed by Simon Fraser.

        Both clientHeight(Width) and scrollHeight(width) need to be explicitly integral
        rounded in order to ensure that scrollable content is computed properly.
        This will evolve into subpixel snapping once we apply subpixel arithmetics on scrolling.

        Not testable.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::scrollWidth):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollTo):
        (WebCore::RenderLayer::horizontalScrollbarStart):
        (WebCore::RenderLayer::scrollWidth):
        (WebCore::RenderLayer::scrollHeight):
        (WebCore::RenderLayer::computeScrollDimensions):
        (WebCore::RenderLayer::updateScrollbarsAfterLayout):
        * rendering/RenderLayer.h:

2016-05-13  Chris Dumez  <cdumez@apple.com>

        [NetworkCache] Avoid having to re-parse URLs after deserializing them
        https://bugs.webkit.org/show_bug.cgi?id=157660

        Reviewed by Darin Adler.

        Avoid having to re-parse URLs after deserializing them in the WebKit2
        network cache storage implementation.

        We previously serialized URLs as Strings, which meant that we had the
        re-parse them upon deserialization. We now serialize all of the URL
        data members to avoid having to parse the String again.

        * platform/URL.h:
        (WebCore::URL::encode):
        (WebCore::URL::decode):
        * platform/network/ResourceRequestBase.h:
        (WebCore::ResourceRequestBase::encodeWithoutPlatformData):
        (WebCore::ResourceRequestBase::decodeWithoutPlatformData):
        * platform/network/ResourceResponseBase.h:
        (WebCore::ResourceResponseBase::encode):
        (WebCore::ResourceResponseBase::decode):

2016-05-13  Sam Weinig  <sam@webkit.org>

        ScriptController::processingUserGesture should propagate across postMessage boundaries
        <rdar://problem/26273173>
        https://bugs.webkit.org/show_bug.cgi?id=157686

        Reviewed by Anders Carlsson.

        Test: fast/dom/Window/post-message-user-action.html

        * dom/UserGestureIndicator.h:
        Export processingUserGesture() for testing.

        * page/DOMWindow.cpp:
        (WebCore::PostMessageTimer::PostMessageTimer):
        (WebCore::PostMessageTimer::event):
        Maintain the processingUserGesture bit through postMessage.

        * testing/Internals.cpp:
        (WebCore::Internals::setResourceTimingSupport):
        (WebCore::Internals::isProcessingUserGesture):
        * testing/Internals.h:
        * testing/Internals.idl:
        Add new internals function to get the current state of the UseGestureIndicator for testing.

2016-05-13  Chris Dumez  <cdumez@apple.com>

        Align window.scroll() / scrollTo() / scrollBy() with the CSSOM specification
        https://bugs.webkit.org/show_bug.cgi?id=157666

        Reviewed by Darin Adler.

        Align window.scroll() / scrollTo() / scrollBy() with Firefox and the CSSOM
        specification:
        https://drafts.csswg.org/cssom-view/#extensions-to-the-window-interface

        In particular, the following changes were made:
        1. Make parameters to scroll() / scrollTo() / scrollBy() mandatory.
        2. Add overloads for scroll() / scrollTo() / scrollBy() that take an
           optional ScrollToOptions dictionary.
        3. Update API to use "unrestricted double" typing for x/y instead of
           "long". This matches the specification but it does not really change
           our behavior at this point because the values are still casted to
           int in our implementation.

        Web-Exposed behavior changes:
        1. JS can now pass a dictionary to scroll() / scrollTo() / scrollBy().
           This a new feature that Firefox already supports (Chrome does not).
        2. Passing only 1 parameter to scroll() / scrollTo() / scrollBy() that
           is not a dictionary will now throw a TypeError. The compatibility
           risky should be low because Firefox and Chrome already throw in this
           case (Chrome has been throwing for 2 years and a half).
        3. Calling scrollTo() / scroll() without any parameter no longer
           scrolls to 0. Instead we use the current viewport's x/y which means
           we don't scroll at all. The new behavior matches Firefox, Chrome and
           IE 11. This fixes scrolling on the following Website:
           https://members.chosun.com/cms_subscribe/application/index.jsp

        No new tests, extended existing testing.

        * bindings/js/JSDOMConvert.h:
        (WebCore::convert):
        (WebCore::convertOptional):
        * bindings/scripts/CodeGeneratorJS.pm:
        (ShouldAllowNonFiniteForFloatingPointType):
        (GenerateConversionRuleWithLeadingComma):
        (GenerateDictionaryImplementationContent):
        (JSValueToNative):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::convert<TestObj::Dictionary>):
        * bindings/scripts/test/TestObj.idl:
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::scrollBy):
        (WebCore::DOMWindow::scrollTo):
        * page/DOMWindow.h:
        * page/DOMWindow.idl:

2016-05-13  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r200894.
        https://bugs.webkit.org/show_bug.cgi?id=157695

        This change broke the iOS build (Requested by ryanhaddad on
        #webkit).

        Reverted changeset:

        "Remove unused initializer for WebEvent on iOS."
        https://bugs.webkit.org/show_bug.cgi?id=157689
        http://trac.webkit.org/changeset/200894

2016-05-13  Brady Eidson  <beidson@apple.com>

        Rename all protector variables that should be called `protectedThis`
        https://bugs.webkit.org/show_bug.cgi?id=157610

        Reviewed by Alex Christensen.

        No new tests (Renaming, no behavior change).
        
        WebCore has so many instances of these protectors as well as so much variance in naming them,
        that I think it deserved a new style pass.

        * Modules/fetch/FetchResponse.cpp:
        * Modules/geolocation/GeoNotifier.cpp:
        * Modules/geolocation/Geolocation.cpp:
        * Modules/indexeddb/IDBTransaction.cpp:
        * Modules/indexeddb/client/TransactionOperation.h:
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:
        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:
        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        * Modules/mediastream/UserMediaRequest.cpp:
        * Modules/notifications/NotificationCenter.cpp:
        * Modules/webaudio/AudioContext.cpp:
        * Modules/webdatabase/Database.cpp:
        * Modules/websockets/WebSocket.cpp:
        * Modules/websockets/WebSocketChannel.cpp:
        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
        * accessibility/AccessibilityObject.cpp:
        * accessibility/AccessibilityRenderObject.cpp:
        * bindings/gobject/GObjectEventListener.cpp:
        * bindings/js/JSCustomElementInterface.cpp:
        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
        * bindings/js/JSCustomXPathNSResolver.cpp:
        * bindings/js/JSDOMGlobalObjectTask.cpp:
        * bindings/js/JSDOMWindowBase.cpp:
        * bindings/js/JSErrorHandler.cpp:
        * bindings/js/JSEventListener.cpp:
        * bindings/js/JSMutationCallback.cpp:
        * bindings/js/JSNodeFilterCustom.cpp:
        * bindings/js/SerializedScriptValue.cpp:
        * bindings/scripts/CodeGeneratorJS.pm:
        * bindings/scripts/test/JS/JSTestCallback.cpp:
        * bindings/scripts/test/JS/JSTestCallbackFunction.cpp:
        * bridge/runtime_root.cpp:
        * css/CSSFontSelector.cpp:
        * css/StyleSheetContents.cpp:
        * dom/CharacterData.cpp:
        * dom/ContainerNode.cpp:
        * dom/Document.cpp:
        * dom/EventTarget.cpp:
        * dom/Node.cpp:
        * dom/ScriptExecutionContext.cpp:
        * dom/ScriptedAnimationController.cpp:
        * dom/StringCallback.cpp:
        * html/HTMLEmbedElement.cpp:
        * html/HTMLFormControlElement.cpp:
        * html/HTMLFormElement.cpp:
        * html/HTMLInputElement.cpp:
        * html/HTMLLinkElement.cpp:
        * html/HTMLMediaElement.cpp:
        * html/HTMLObjectElement.cpp:
        * html/HTMLOptionElement.cpp:
        * html/HTMLScriptElement.cpp:
        * html/HTMLTableElement.cpp:
        * html/HTMLTextAreaElement.cpp:
        * html/HTMLTitleElement.cpp:
        * html/parser/HTMLDocumentParser.cpp:
        * html/shadow/SliderThumbElement.cpp:
        * html/shadow/SpinButtonElement.cpp:
        * inspector/InspectorFrontendClientLocal.cpp:
        * loader/DocumentLoader.cpp:
        * loader/DocumentThreadableLoader.cpp:
        * loader/MediaResourceLoader.cpp:
        * loader/NetscapePlugInStreamLoader.cpp:
        * loader/ResourceLoader.cpp:
        * loader/SubresourceLoader.cpp:
        * loader/cache/CachedRawResource.cpp:
        * loader/cf/SubresourceLoaderCF.cpp:
        * loader/mac/ResourceLoaderMac.mm:
        * page/DOMWindow.cpp:
        * page/DOMWindowExtension.cpp:
        * page/FrameView.cpp:
        * page/animation/AnimationBase.cpp:
        * page/scrolling/ThreadedScrollingTree.cpp:
        * platform/ScrollView.cpp:
        * platform/graphics/DisplayRefreshMonitor.cpp:
        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
        * platform/graphics/gstreamer/InbandTextTrackPrivateGStreamer.cpp:
        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        * platform/mac/WidgetMac.mm:
        * platform/network/BlobResourceHandle.cpp:
        * platform/network/cf/ResourceHandleCFNet.cpp:
        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
        * platform/network/curl/CurlDownload.cpp:
        * platform/network/mac/ResourceHandleMac.mm:
        * platform/network/soup/SocketStreamHandleSoup.cpp:
        * platform/win/PopupMenuWin.cpp:
        * workers/WorkerScriptLoader.cpp:
        * xml/XMLHttpRequest.cpp:
        * xml/parser/XMLDocumentParser.cpp:
        * xml/parser/XMLDocumentParserLibxml2.cpp:

2016-05-13  Enrica Casucci  <enrica@apple.com>

        Remove unused initializer for WebEvent on iOS.
        https://bugs.webkit.org/show_bug.cgi?id=157689

        Reviewed by Anders Carlsson.

        This is no longer used and can be removed.
        The logic tied to isPopupVariant has been incorporated
        in keyboard flags. The characterSet property is no longer needed too.

        * platform/ios/WebEvent.h:
        * platform/ios/WebEvent.mm:
        (-[WebEvent initWithKeyEventType:timeStamp:characters:charactersIgnoringModifiers:modifiers:isRepeating:withFlags:keyCode:isTabKey:characterSet:]):
        (-[WebEvent initWithKeyEventType:timeStamp:characters:charactersIgnoringModifiers:modifiers:isRepeating:isPopupVariant:keyCode:isTabKey:characterSet:]): Deleted.
        (-[WebEvent _characterSetDescription]): Deleted.
        (-[WebEvent isPopupVariant]): Deleted.
        (-[WebEvent characterSet]): Deleted.

2016-05-13  Simon Fraser  <simon.fraser@apple.com>

        cross-fade() rendering doesn't match expectation
        https://bugs.webkit.org/show_bug.cgi?id=157665
        rdar://problem/17917708

        Reviewed by Dean Jackson.

        Cross-fading two opaque images would result in a non-opaque result in between the endpoints,
        probably because r157045 caused both images to be drawn with srcOver, since drawImage()
        clobbers the composite operation in the context.

        Fix by passing the composite operation to the drawImage() calls for the non-transparency layer
        code path.

        Converted css3/images/cross-fade-blending.html into a ref test to test this.

        * platform/graphics/CrossfadeGeneratedImage.cpp:
        (WebCore::drawCrossfadeSubimage):

2016-05-13  Simon Fraser  <simon.fraser@apple.com>

        Unprefix -webkit-cross-fade()
        https://bugs.webkit.org/show_bug.cgi?id=157632

        Reviewed by Darin Adler.

        Support unprefixed cross-fade() in addition to the prefixed value when parsing,
        and have computed style round-trip the correct one.

        If computed style is queried during an image transition, return an unprefixed
        cross-fade(). If blending cross-fade values, only return the prefixed function if
        both inputs are prefixed.

        Tested by modified and existing tests.

        * css/CSSCrossfadeValue.cpp:
        (WebCore::CSSCrossfadeValue::customCSSText):
        (WebCore::CSSCrossfadeValue::blend):
        * css/CSSCrossfadeValue.h:
        (WebCore::CSSCrossfadeValue::create):
        (WebCore::CSSCrossfadeValue::isPrefixed):
        (WebCore::CSSCrossfadeValue::CSSCrossfadeValue):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::isGeneratedImageValue):
        (WebCore::CSSParser::parseGeneratedImage):
        (WebCore::CSSParser::parseCrossfade):
        * css/CSSParser.h:

2016-05-13  Yoav Weiss  <yoav@yoav.ws>

        ResourceTiming entries for cached resources and XHR
        https://bugs.webkit.org/show_bug.cgi?id=157669

        Reviewed by Alex Christensen.

         - Moves the ResourceTiming storage and addition logic into its own class, so that it
           can be accessed by both CachedResourceLoader and DocumentThreadableLoader.
         - Using the above, adds ResourceTiming collection into DocumentThreadableLoader,
           in order to support ResourceTiming entries for XHR based requests.
         - Adds ResourceTiming entries for resources that are reused from the memory cache.

        Test: http/tests/performance/performance-resource-timing-cached-entries.html

        * CMakeLists.txt: Add ResourceTimingInformation.
        * WebCore.xcodeproj/project.pbxproj: Add ResourceTimingInformation.
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::didFinishLoading): Add a call to addResourceTiming.
        (WebCore::DocumentThreadableLoader::loadRequest): Store the initiator information.
        * loader/DocumentThreadableLoader.h:
        * loader/ResourceTimingInformation.cpp: Added.
        (WebCore::ResourceTimingInformation::addResourceTiming): Moved addResourceTiming logic from CachedResourceLoader.
        (WebCore::ResourceTimingInformation::storeResourceTimingInitiatorInformation): Moved addResourceTiming logic from
        CachedResourceLoader. Removed reliance on the committingFirstRealLoad bool when storing initiator info, as I don't
        see why it is required, and it made no sense in the context of DocumentThreadableLoader.
        * loader/ResourceTimingInformation.h: Added.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestResource): Add a ResourceTiming entry when a resource is reused from MemoryCache.
        (WebCore::CachedResourceLoader::revalidateResource): Use ResourceTimingInformation::storeResourceTimingInitiatorInformation.
        (WebCore::CachedResourceLoader::loadResource): Use ResourceTimingInformation::storeResourceTimingInitiatorInformation.
        (WebCore::CachedResourceLoader::loadDone): Use ResourceTimingInformation::addResourceTiming.
        (WebCore::CachedResourceLoader::storeResourceTimingInitiatorInformation): Deleted.
        * loader/cache/CachedResourceLoader.h:

2016-05-13  Doug Russell  <d_russell@apple.com>

        AX: Regressions in undo/redo accessibility from Bug 153361
        https://bugs.webkit.org/show_bug.cgi?id=157652

        Reviewed by Darin Adler.
        
        Use indexForVisiblePosition & visiblePositionForIndex to store selection data
        so that AccessibilityUndoReplacedText can build valid selection ranges and
        retrieve strings for AT notifications.

        Tests: accessibility/mac/value-change/value-change-user-info-contenteditable-expected.txt:
               accessibility/mac/value-change/value-change-user-info-contenteditable.html:
               accessibility/mac/value-change/value-change-user-info-textarea-expected.txt:
               accessibility/mac/value-change/value-change-user-info-textarea.html:
               accessibility/mac/value-change/value-change-user-info-textfield-expected.txt:
               accessibility/mac/value-change/value-change-user-info-textfield.html:

        * accessibility/AXObjectCache.cpp:
        (WebCore::AccessibilityReplacedText::AccessibilityReplacedText):
        (WebCore::AXObjectCache::postTextStateChangeNotification):
        (WebCore::AXObjectCache::postTextReplacementNotification):
        * editing/CompositeEditCommand.cpp:
        (WebCore::AccessibilityUndoReplacedText::configureRangeDeletedByReapplyWithEndingSelection):
        (WebCore::AccessibilityUndoReplacedText::configureRangeDeletedByReapplyWithStartingSelection):
        (WebCore::AccessibilityUndoReplacedText::setRangeDeletedByUnapply):
        (WebCore::AccessibilityUndoReplacedText::captureTextForUnapply):
        (WebCore::AccessibilityUndoReplacedText::captureTextForReapply):
        (WebCore::AccessibilityUndoReplacedText::textDeletedByUnapply):
        (WebCore::AccessibilityUndoReplacedText::textDeletedByReapply):
        (WebCore::AccessibilityUndoReplacedText::postTextStateChangeNotificationForUnapply):
        (WebCore::AccessibilityUndoReplacedText::postTextStateChangeNotificationForReapply):
        (WebCore::EditCommandComposition::EditCommandComposition):
        (WebCore::EditCommandComposition::unapply):
        (WebCore::EditCommandComposition::reapply):
        (WebCore::EditCommandComposition::setStartingSelection):
        (WebCore::EditCommandComposition::setEndingSelection):
        (WebCore::EditCommandComposition::setRangeDeletedByUnapply):
        (WebCore::AccessibilityUndoReplacedText::confgureTextToBeDeletedByUnapplyIndexesWithEditCommandEndingSelection): Deleted.
        (WebCore::AccessibilityUndoReplacedText::confgureTextToBeDeletedByUnapplyStartIndexWithEditCommandStartingSelection): Deleted.
        (WebCore::AccessibilityUndoReplacedText::setTextInsertedByUnapplyRange): Deleted.
        (WebCore::AccessibilityUndoReplacedText::captureTextToBeDeletedByUnapply): Deleted.
        (WebCore::AccessibilityUndoReplacedText::captureTextToBeDeletedByReapply): Deleted.
        (WebCore::AccessibilityUndoReplacedText::textInsertedByUnapply): Deleted.
        (WebCore::AccessibilityUndoReplacedText::textInsertedByReapply): Deleted.
        (WebCore::EditCommandComposition::setTextInsertedByUnapplyRange): Deleted.
        * editing/CompositeEditCommand.h:
        * editing/Editor.cpp:
        (WebCore::Editor::replaceSelectionWithFragment):
        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::postTextStateChangeNotificationForDeletion):
        (WebCore::TypingCommand::insertTextAndNotifyAccessibility):
        (WebCore::TypingCommand::insertLineBreakAndNotifyAccessibility):
        (WebCore::TypingCommand::insertParagraphSeparatorAndNotifyAccessibility):
        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContentAndNotifyAccessibility):

2016-05-13  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r200837.

        Seems to have regressed Speedometer and JetStream on iOS

        Reverted changeset:

        "DOMPromise should only restrict the resolution type"
        https://bugs.webkit.org/show_bug.cgi?id=157307
        http://trac.webkit.org/changeset/200837

2016-05-13  Sam Weinig  <sam@webkit.org>

        Rename WKDataDetectorTypeSpotlightSuggestion to WKDataDetectorTypeLookupSuggestion
        <rdar://problem/26269611>

        Reviewed by Dan Bernstein and Enrica Casucci. 

        * editing/cocoa/DataDetection.h:
        * editing/cocoa/DataDetection.mm:
        (WebCore::constructURLStringForResult):
        (WebCore::DataDetection::detectContentInRange):

2016-05-13  Nan Wang  <n_wang@apple.com>

        AX: Wrong CharacterOffset from an upstream VisiblePosition
        https://bugs.webkit.org/show_bug.cgi?id=157644

        Reviewed by Chris Fleizach.

        We should adjust the text marker's CharacterOffset if its corresponding
        VisiblePosition has upstream affinity.

        Test: accessibility/mac/character-offset-from-upstream-position.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::characterOffsetForTextMarkerData):
        (WebCore::AXObjectCache::traverseToOffsetInRange):
        (WebCore::AXObjectCache::localCaretRectForCharacterOffset):

2016-05-13  Beth Dakin  <bdakin@apple.com>

        Add dyldSPI.h for linked on or after checks, and add one for link preview
        https://bugs.webkit.org/show_bug.cgi?id=157401
        -and corresponding-
        rdar://problem/26253396

        Reviewed by Darin Adler.

        This patch removes DynamicLinkerSPI.h and replaces it with 
        wtf/spi/darwin/dyldSPI.h

        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLObjectElement.cpp:
        * platform/graphics/ios/FontServicesIOS.mm:
        * platform/spi/cocoa/DynamicLinkerSPI.h: Removed.

2016-05-13  Brady Eidson  <beidson@apple.com>

        Give CrossThreadCopier a default specialization for Vectors of objects.
        https://bugs.webkit.org/show_bug.cgi?id=157675

        Reviewed by Darin Adler.

        No new tests (Refactor, no change in behavior).

        * platform/CrossThreadCopier.cpp:
        (WebCore::Vector<String>>::copy): Deleted.
        * platform/CrossThreadCopier.h: Add a default specialization for Vector<T> where T is a type
          that is CrossThreadCopyable itself.

2016-05-13  Chris Dumez  <cdumez@apple.com>

        Have the WorkerGlobalScope API return more references
        https://bugs.webkit.org/show_bug.cgi?id=157663

        Reviewed by Alexey Proskuryakov.

        Have the WorkerGlobalScope API return more references instead of
        pointers.

        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::location):
        (WebCore::WorkerGlobalScope::navigator):
        * workers/WorkerGlobalScope.h:
        (WebCore::WorkerGlobalScope::self):

2016-05-13  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        DOMPromise should only restrict the resolution type
        https://bugs.webkit.org/show_bug.cgi?id=157307

        Reviewed by Darin Adler.

        Removing from DOMPromise the rejection template parameter.
        Supported rejection types are integers (Exception codes) and DOM objects (DOMError typically).

        Updated toJS and DeferredWrapper to accept Ref<>&& and RefPtr<>&&.
        Previously Ref<>&& were not accepted and only "const RefPtr<>&" was accepted.
        This in turn created an unecessary churn count when calling toJS.

        Changes also allow in most cases to remove the need for explictly declaring the
        rejection/resolution type.

        Minor refactoring of FontFaceSet promise handling to use DOMPromise in lieu of DeferredWrapper.

        Covered by existing tests.
        Changes should not be visible from user scripts.

        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::consume):
        (WebCore::FetchBody::consumeText):
        (WebCore::blobFromArrayBuffer):
        (WebCore::FetchBody::loadingFailed):
        * Modules/fetch/FetchBody.h:
        (WebCore::FetchBody::formData):
        * Modules/fetch/FetchBodyOwner.cpp:
        (WebCore::FetchBodyOwner::arrayBuffer):
        (WebCore::FetchBodyOwner::blob):
        (WebCore::FetchBodyOwner::formData):
        (WebCore::FetchBodyOwner::json):
        (WebCore::FetchBodyOwner::text):
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::BodyLoader::didReceiveResponse):
        * Modules/fetch/FetchResponse.h:
        * Modules/mediastream/MediaDevices.h:
        * Modules/mediastream/PeerConnectionBackend.h:
        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::didCreateStream):
        * Modules/streams/ReadableStreamSource.h:
        * Modules/webaudio/AudioContext.h:
        * bindings/js/JSDOMBinding.h:
        (WebCore::toJS):
        (WebCore::jsPair):
        * bindings/js/JSDOMPromise.cpp:
        (WebCore::fulfillPromiseWithJSON):
        * bindings/js/JSDOMPromise.h:
        (WebCore::TypeInspector::decltype):
        (WebCore::TypeInspector::testIsVector):
        (WebCore::TypeInspector::testIsRefOrRefPtr):
        (WebCore::DeferredWrapper::resolve):
        (WebCore::DeferredWrapper::reject):
        (WebCore::DOMPromise::resolve):
        (WebCore::DOMPromise::reject):
        (WebCore::DeferredWrapper::resolveWithValue):
        (WebCore::DeferredWrapper::rejectWithValue):
        (WebCore::callPromiseFunction):
        * bindings/js/JSSubtleCryptoCustom.cpp:
        (WebCore::JSSubtleCrypto::importKey):
        (WebCore::JSSubtleCrypto::unwrapKey):
        * css/FontFace.h:
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::PendingPromise::PendingPromise):
        (WebCore::FontFaceSet::load):
        (WebCore::FontFaceSet::registerReady):
        * css/FontFaceSet.h:
        * html/HTMLMediaElement.h:

2016-05-12  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Show auto-repeat line names in ComputedStyle
        https://bugs.webkit.org/show_bug.cgi?id=157622

        Reviewed by Darin Adler.

        Add the necessary machinery to show the named lines from auto-repeat tracks in
        getComputedStyle(). A new class OrderedNamedLinesCollector was added to abstract the
        retrieval of line names no matter where they come from (explicit or auto-repeat tracks).

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::OrderedNamedLinesCollector::OrderedNamedLinesCollector):
        (WebCore::OrderedNamedLinesCollector::isEmpty): TRUE if we don't have named lines neither on
        explicit nor auto-repeat tracks.
        (WebCore::OrderedNamedLinesCollector::appendLines): Add the named lines found for a given
        index to the CSSGridLineNamesValue.
        (WebCore::OrderedNamedLinesCollector::collectLineNamesForIndex): Collects named lines found
        for a given index.
        (WebCore::addValuesForNamedGridLinesAtIndex): Use the collector to gather named lines.
        (WebCore::valueForGridTrackList): Ditto.

2016-05-13  Tina Liu  <iting_liu@apple.com>

        Revert r199691.
        https://bugs.webkit.org/show_bug.cgi?id=157645
        <rdar://problem/26235373>

        Reviewed by Darin Adler.

        * plugins/PluginStrategy.h:

2016-05-12  Chris Dumez  <cdumez@apple.com>

        Drop WorkerGlobalScope's custom GetOwnPropertySlot() implementation
        https://bugs.webkit.org/show_bug.cgi?id=157662

        Reviewed by Darin Adler.

        Drop WorkerGlobalScope's custom GetOwnPropertySlot() implementation as
        it is no longer needed after <http://trac.webkit.org/changeset/196678>.

        JSC::getStaticPropertySlot() now properly checks for overrides *before*
        checking the static table.

        No new tests, no web-exposed behavior change.

        * bindings/js/JSWorkerGlobalScopeCustom.cpp:
        (WebCore::JSWorkerGlobalScope::getOwnPropertySlotDelegate): Deleted.
        * workers/WorkerGlobalScope.idl:

2016-05-12  Zan Dobersek  <zdobersek@igalia.com>

        CoordinatedGraphicsLayer::syncLayerState() should set the m_layerState.contentsOpaque flag
        https://bugs.webkit.org/show_bug.cgi?id=157575

        Reviewed by Darin Adler.

        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
        (WebCore::CoordinatedGraphicsLayer::syncLayerState): The contentsOpaque flag in the
        layer's CoordinatedGraphicsLayerState object should also be set to the current value
        of the layer. This is the only flag in the union of 9 members that's not being updated
        in this method.

2016-05-12  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] Handle TextureMapperShaderProgram objects through references
        https://bugs.webkit.org/show_bug.cgi?id=157619

        Reviewed by Antonio Gomes.

        TextureMapper code always expects valid TextureMapperShaderProgram
        objects to be created, so it doesn't make sense to access these
        objects through raw pointers or RefPtr<>s.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::drawBorder):
        (WebCore::prepareFilterProgram):
        (WebCore::TextureMapperGL::drawTexture):
        (WebCore::TextureMapperGL::drawSolidColor):
        (WebCore::TextureMapperGL::drawEdgeTriangles):
        (WebCore::TextureMapperGL::drawUnitRect):
        (WebCore::TextureMapperGL::draw):
        (WebCore::TextureMapperGL::drawTexturedQuadWithProgram):
        (WebCore::TextureMapperGL::drawFiltered):
        (WebCore::TextureMapperGL::beginClip):
        * platform/graphics/texmap/TextureMapperGL.h:

2016-05-12  Zan Dobersek  <zdobersek@igalia.com>

        VideoSinkGStreamer: plug a GstBuffer leak in webkitVideoSinkRequestRender()
        https://bugs.webkit.org/show_bug.cgi?id=157617

        Reviewed by Darin Adler.

        Unref the newly-created GstBuffer object after creating the new GstSample
        that's based on it. gst_sample_new() doesn't take the ownership of it.

        Also, don't unref the GstBuffer object that's passed in to the
        webkitVideoSinkRequestRender() function in case the allocation of the
        replacement buffer fails. We don't have any ownership over that buffer
        and it's not unreffed anywhere else in this function.

        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
        (webkitVideoSinkRequestRender):

2016-05-12  Myles C. Maxfield  <mmaxfield@apple.com>

        [Cocoa] Text shadow sometimes clipped unexpectedly
        https://bugs.webkit.org/show_bug.cgi?id=108929

        Reviewed by Dean Jackson.

        CoreGraphics can only draw one text shadow at a time. We work around that by drawing
        the text multiple times, one for each shadow. However, we want to make sure that the
        original text isn't also drawn multiple times, so we bump up the shadow offsets so
        the text and the shadow don't intersect, and then we clip out the original text (so
        only the shadow remains).

        Unfortunately, this clipping requires knowing where the visual extent of the text is,
        which WebKit currently has trouble with. In particular, we often use layout extents
        in lieu of visual extents, which is a problem when the glyphs draw outside of their
        layout boxes. In this case, it causes us to think the text shadow is much smaller
        than it really is, so our clipping operation clips to an area which is too small.

        A quick solution to this is to inflate the clip rect by an amount proportional to the
        font size, and offset the text shadow accordingly. If this amount is large enough,
        this bug will occur on few enough sites that it is reasonable to consider this bug
        fixed without the real solution of educating WebKit properly about the difference
        between text layout rects and text visual extent rects.

        Test: fast/text/multiple-text-shadow-overflow-layout-rect.html

        * rendering/TextPainter.cpp:
        (WebCore::ShadowApplier::ShadowApplier):

2016-05-12  Myles C. Maxfield  <mmaxfield@apple.com>

        REGRESSION(r200601): Crash when using local() and unicode-range in @font-face blocks
        https://bugs.webkit.org/show_bug.cgi?id=157646

        Reviewed by Geoffrey Garen.

        I simply forgot a null check.

        Test: fast/text/isLoading-crash-failed-font.html

        * css/CSSSegmentedFontFace.cpp:

2016-05-12  Jiewen Tan  <jiewen_tan@apple.com>

        REGRESSION (r199313): ICBC app: text field In the webview is not tappable
        https://bugs.webkit.org/show_bug.cgi?id=157396
        <rdar://problem/25931513>

        Reviewed by David Kilzer.

        Add a quirk for WebKit1 apps.

        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::requestFrame):
        Even though the HTML spec suggests that we should navigate to about:blank
        for subframes/iframes, of which the src cannot be resolved to an valid URL,
        many existing WebKit1 apps are relying on invalid URLs to bridge their WebView
        codes and their native Objective-C codes. Therefore, a quirk is added to
        escape the URL validation for existing WebKit1 apps.
        (WebCore::SubframeLoader::shouldConvertInvalidURLsToBlank):
        * loader/SubframeLoader.h:
        * page/Settings.in:

2016-05-12  Ada Chan  <adachan@apple.com>

        Prevent clicks in the placeholder from playing or pausing the video in a MediaDocument.
        https://bugs.webkit.org/show_bug.cgi?id=157625

        Reviewed by Jer Noble.

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.createControls):
        (Controller.prototype.handlePlaceholderClick):

2016-05-12  Chris Dumez  <cdumez@apple.com>

        Drop toJS() overload taking a PassRefPtr<> parameter
        https://bugs.webkit.org/show_bug.cgi?id=157627

        Reviewed by Alex Christensen.

        Update our implementation stop stop returning PassRefPtrs to the
        JS bindings and drop the toJS() overload taking a PassRefPtr<>
        parameter

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::buffered):
        * Modules/mediasource/SourceBuffer.h:
        * Modules/webaudio/AudioBuffer.cpp:
        (WebCore::AudioBuffer::getChannelData):
        * Modules/webaudio/AudioBuffer.h:
        * animation/DocumentTimeline.cpp:
        (WebCore::DocumentTimeline::create):
        * animation/DocumentTimeline.h:
        * bindings/js/JSDOMBinding.h:
        (WebCore::toJS): Deleted.
        (WebCore::toJSNewlyCreated): Deleted.
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::getRGBColorValue):
        * css/CSSPrimitiveValue.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::error):
        * html/HTMLMediaElement.h:
        * html/LabelableElement.cpp:
        (WebCore::LabelableElement::labels):
        * html/LabelableElement.h:
        * html/canvas/WebGLGetInfo.cpp:
        (WebCore::WebGLGetInfo::getWebGLBuffer):
        (WebCore::WebGLGetInfo::getWebGLFloatArray):
        (WebCore::WebGLGetInfo::getWebGLFramebuffer):
        (WebCore::WebGLGetInfo::getWebGLIntArray):
        (WebCore::WebGLGetInfo::getWebGLProgram):
        (WebCore::WebGLGetInfo::getWebGLRenderbuffer):
        (WebCore::WebGLGetInfo::getWebGLTexture):
        (WebCore::WebGLGetInfo::getWebGLUnsignedByteArray):
        (WebCore::WebGLGetInfo::getWebGLUnsignedIntArray):
        (WebCore::WebGLGetInfo::getWebGLVertexArrayObjectOES):
        (WebCore::WebGLGetInfo::getWebGLVertexArrayObject):
        * html/canvas/WebGLGetInfo.h:
        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::paintRenderingResultsToImageData):
        (WebCore::WebGLRenderingContextBase::createBuffer):
        (WebCore::WebGLRenderingContextBase::createFramebuffer):
        (WebCore::WebGLRenderingContextBase::createTexture):
        (WebCore::WebGLRenderingContextBase::createProgram):
        (WebCore::WebGLRenderingContextBase::createRenderbuffer):
        (WebCore::WebGLRenderingContextBase::createShader):
        (WebCore::WebGLRenderingContextBase::getActiveAttrib):
        (WebCore::WebGLRenderingContextBase::getActiveUniform):
        (WebCore::WebGLRenderingContextBase::getShaderPrecisionFormat):
        (WebCore::WebGLRenderingContextBase::getUniformLocation):
        (WebCore::WebGLRenderingContextBase::drawImageIntoBuffer):
        (WebCore::WebGLRenderingContextBase::videoFrameToImage):
        * html/canvas/WebGLRenderingContextBase.h:
        * html/track/TextTrackCue.cpp:
        (WebCore::TextTrackCue::create):
        * html/track/TextTrackCue.h:
        * html/track/VTTCue.cpp:
        (WebCore::VTTCueBox::create):
        * html/track/VTTCue.h:
        * page/DOMSelection.cpp:
        (WebCore::DOMSelection::getRangeAt):
        * page/DOMSelection.h:
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::matchMedia):
        (WebCore::DOMWindow::styleMedia):
        (WebCore::DOMWindow::getComputedStyle):
        (WebCore::DOMWindow::getMatchedCSSRules):
        (WebCore::DOMWindow::webkitConvertPointFromNodeToPage):
        (WebCore::DOMWindow::webkitConvertPointFromPageToNode):
        (WebCore::DOMWindow::open):
        * page/DOMWindow.h:
        * page/Location.cpp:
        (WebCore::Location::ancestorOrigins):
        * page/Location.h:

2016-05-12  Ryosuke Niwa  <rniwa@webkit.org>

        Touch.prototype is undefined on iOS
        https://bugs.webkit.org/show_bug.cgi?id=157560
        <rdar://problem/26143008>

        Reviewed by Chris Dumez.

        Remove Touch and TouchList attributes from DOMWindow.
        These attributes should be exposed via generated binding code (JSDOMWindow.cpp).

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::touch): Deleted.
        (WebCore::JSDOMWindow::touchList): Deleted.
        * bindings/js/ios/TouchConstructors.cpp:
        * page/DOMWindow.idl:

2016-05-12  Ryosuke Niwa  <rniwa@webkit.org>

        indexForVisiblePosition should use the root editable element as the scope
        https://bugs.webkit.org/show_bug.cgi?id=157611

        Reviewed by Darin Adler.

        Use the highest editing host instead of the document node as the scope in indexForVisiblePosition
        when it's called inside an editable region. This refactoring is necessary to unblock the work to support
        undo/redo in VoiceOver after r199030.

        We have to workaround a bug in indexForVisiblePosition that it could return a slightly higher index than
        the expected value because TextIterator emits an extra new line after a block element with a large margin
        at the bottom. Unfortunately, fixing this requires a lot of code changes since the rest of the editing
        code assumes this behavior and/or happens to cancel it out with some other quirks.

        * editing/ApplyBlockElementCommand.cpp:
        (WebCore::ApplyBlockElementCommand::doApply):
        * editing/htmlediting.cpp:
        (WebCore::indexForVisiblePosition):

2016-05-12  Zalan Bujtas  <zalan@apple.com>

        Cleanup RenderObject::containingBlock.
        https://bugs.webkit.org/show_bug.cgi?id=157628

        Reviewed by Chris Dumez.

        No change in functionality.

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::containingBlock):

2016-05-12  Eric Carlson  <eric.carlson@apple.com>

        Adjust "main content" video heuristic
        https://bugs.webkit.org/show_bug.cgi?id=157532
        <rdar://problem/25840861>

        Reviewed by Darin Adler.

        Test: media/video-main-content-autoplay.html, plus existing tests updated.

        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::canControlControlsManager): Use isElementLargeEnoughForMainContent.
        (WebCore::isMainContent): Ditto.
        (WebCore::isElementLargeEnoughForMainContent): Check video area and aspect ratio.
        (WebCore::MediaElementSession::mainContentCheckTimerFired): Call result.setToNonUserAgentShadowAncestor 
          so it doesn't hit test the video controls in the shadow DOM.

2016-05-12  Fujii Hironori  <Hironori.Fujii@sony.com>

        [curl] ASSERTION FAILED: isLocalFile() || url == m_string in fast/dom/34176.html
        https://bugs.webkit.org/show_bug.cgi?id=157059

        Reviewed by Darin Adler.

        Fix incorrect usage of URL constructor. CURLINFO_EFFECTIVE_URL
        does not conform to URL's ParsedURLString.  Created a new utility
        function to convert CURLINFO_EFFECTIVE_URL to a URL, and replaced
        all codes converting CURLINFO_EFFECTIVE_URL with it.

        Test: fast/dom/34176.html

        * platform/network/curl/CurlDownload.cpp:
        (WebCore::CurlDownload::didReceiveHeader): Use getCurlEffectiveURL
        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::getCurlEffectiveURL): Added.
        (WebCore::handleLocalReceiveResponse): Use getCurlEffectiveURL
        (WebCore::getProtectionSpace): Ditto.
        (WebCore::headerCallback): Ditto.
        (WebCore::ResourceHandleManager::downloadTimerCallback): Ditto.
        * platform/network/curl/ResourceHandleManager.h: Add a declaration
        of getCurlEffectiveURL.

2016-05-12  Chris Dumez  <cdumez@apple.com>

        Avoid unnecessary null checks in toJS() when the implementation returns a reference or Ref<>
        https://bugs.webkit.org/show_bug.cgi?id=157604

        Reviewed by Darin Adler.

        Avoid unnecessary null checks in toJS() when the implementation returns
        a C++ reference or Ref<>. To achieve this, the following changes were
        made:
        1. Have toJS() overload that takes a raw pointer call the one that
           takes in a C++ reference, instead of the other way around. This way,
           we only do the null check when passing a raw pointer in.
        2. Stop calling WTF::getPtr() on the value returned by the
           implementation because this causes us to call toJS() with a raw
           pointer every time.
        3. Add an toJS() overload in JSDOMBinding.h that takes a Ref<T> in and
           that calls toJS() with a C++ reference internally. This way, we
           bypass the null check if the implementation returns a Ref<T>.

        Further refactoring could be done but I try to keep the size of this
        patch as small as possible. toJS() should probably take the ExecState
        and the globalObject by reference, for e.g.

        * bindings/js/JSAnimationTimelineCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSBlobCustom.cpp:
        (WebCore::toJS):
        (WebCore::constructJSBlob): Deleted.
        * bindings/js/JSCSSRuleCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
        (WebCore::JSCSSStyleDeclaration::getPropertyCSSValue):
        * bindings/js/JSCSSValueCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSCanvasRenderingContextCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::attributeChanged):
        * bindings/js/JSDOMBinding.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/js/JSDOMFormDataCustom.cpp:
        (WebCore::constructJSDOMFormData):
        * bindings/js/JSDOMMimeTypeArrayCustom.cpp:
        (WebCore::JSDOMMimeTypeArray::nameGetter):
        * bindings/js/JSDOMNamedFlowCollectionCustom.cpp:
        (WebCore::JSDOMNamedFlowCollection::nameGetter):
        * bindings/js/JSDOMPluginArrayCustom.cpp:
        (WebCore::JSDOMPluginArray::nameGetter):
        * bindings/js/JSDOMPluginCustom.cpp:
        (WebCore::JSDOMPlugin::nameGetter):
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::toJS):
        * bindings/js/JSDOMWindowBase.h:
        (WebCore::toJS):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowGetOwnPropertySlotNamedItemGetter):
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        (WebCore::JSDocument::createTouchList):
        (WebCore::JSDocument::prepend): Deleted.
        * bindings/js/JSDocumentFragmentCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        * bindings/js/JSEventCustom.cpp:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/js/JSEventTargetCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSFileReaderCustom.cpp:
        (WebCore::JSFileReader::result):
        * bindings/js/JSHTMLAllCollectionCustom.cpp:
        (WebCore::namedItems):
        (WebCore::callHTMLAllCollection):
        * bindings/js/JSHTMLCanvasElementCustom.cpp:
        (WebCore::JSHTMLCanvasElement::getContext):
        * bindings/js/JSHTMLCollectionCustom.cpp:
        (WebCore::JSHTMLCollection::nameGetter):
        (WebCore::toJS):
        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::nameGetter):
        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore::constructJSHTMLElement):
        (WebCore::JSHTMLElement::pushEventHandlerScope):
        * bindings/js/JSHTMLFormControlsCollectionCustom.cpp:
        (WebCore::namedItems):
        * bindings/js/JSHTMLFormElementCustom.cpp:
        (WebCore::JSHTMLFormElement::nameGetter):
        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
        (WebCore::JSHTMLOptionsCollection::nameGetter):
        * bindings/js/JSIDBCursorCustom.cpp:
        (WebCore::JSIDBCursor::source):
        (WebCore::toJS):
        * bindings/js/JSIDBDatabaseCustom.cpp:
        (WebCore::JSIDBDatabase::createObjectStore):
        (WebCore::JSIDBDatabase::transaction):
        * bindings/js/JSIDBRequestCustom.cpp:
        (WebCore::JSIDBRequest::result):
        (WebCore::JSIDBRequest::source):
        * bindings/js/JSImageConstructor.cpp:
        (WebCore::JSImageConstructor::construct):
        * bindings/js/JSImageDataCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSLazyEventListener.cpp:
        (WebCore::JSLazyEventListener::initializeJSFunction):
        * bindings/js/JSMediaSessionCustom.cpp:
        (WebCore::constructJSMediaSession):
        * bindings/js/JSMediaStreamCapabilitiesCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSNamedNodeMapCustom.cpp:
        (WebCore::JSNamedNodeMap::nameGetter):
        * bindings/js/JSNodeCustom.cpp:
        (WebCore::createWrapperInline):
        (WebCore::toJSNewlyCreated):
        (WebCore::willCreatePossiblyOrphanedTreeByRemovalSlowCase):
        (WebCore::getOutOfLineCachedWrapper): Deleted.
        * bindings/js/JSNodeCustom.h:
        (WebCore::toJS):
        * bindings/js/JSNodeListCustom.cpp:
        (WebCore::toJSNewlyCreated):
        * bindings/js/JSNodeListCustom.h:
        (WebCore::toJS):
        * bindings/js/JSPerformanceEntryCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSPopStateEventCustom.cpp:
        (WebCore::JSPopStateEvent::state):
        * bindings/js/JSRTCStatsResponseCustom.cpp:
        (WebCore::JSRTCStatsResponse::nameGetter):
        * bindings/js/JSSVGPathSegCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSStyleSheetCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSTextTrackCueCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSTrackCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSTrackCustom.h:
        * bindings/js/JSTrackEventCustom.cpp:
        (WebCore::JSTrackEvent::track):
        * bindings/js/JSUserMessageHandlersNamespaceCustom.cpp:
        (WebCore::JSUserMessageHandlersNamespace::getOwnPropertySlotDelegate):
        * bindings/js/JSWorkerCustom.cpp:
        (WebCore::constructJSWorker):
        * bindings/js/ReadableStreamController.cpp:
        (WebCore::createReadableStream):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        (GenerateCallbackHeader):
        (GenerateCallbackImplementation):
        (NativeToJSValue):
        (GenerateConstructorDefinition):
        (ceilingToPowerOf2): Deleted.
        (ConstructorHasProperties): Deleted.
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestActiveDOMObject::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestCallback.cpp:
        (WebCore::JSTestCallback::callbackWithArrayParam):
        (WebCore::JSTestCallback::callbackWithStringList):
        (WebCore::JSTestCallback::callbackRequiresThisToPass):
        (WebCore::toJS):
        * bindings/scripts/test/JS/JSTestCallback.h:
        (WebCore::toJS):
        * bindings/scripts/test/JS/JSTestCallbackFunction.cpp:
        (WebCore::JSTestCallbackFunction::callbackWithArrayParam):
        (WebCore::JSTestCallbackFunction::callbackWithStringList):
        (WebCore::JSTestCallbackFunction::callbackRequiresThisToPass):
        (WebCore::toJS):
        * bindings/scripts/test/JS/JSTestCallbackFunction.h:
        (WebCore::toJS):
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestClassWithJSBuiltinConstructor::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestCustomNamedGetter::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructorConstructor::construct):
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestEventConstructor::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestEventConstructor.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::jsTestEventTargetPrototypeFunctionItem):
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestEventTarget::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestEventTarget.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestException::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestException.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestGenerateIsReachable::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestGlobalObject::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestGlobalObject.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterfaceConstructor::construct):
        (WebCore::jsTestInterfaceImplementsNode):
        (WebCore::jsTestInterfaceSupplementalNode):
        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod2):
        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestInterface::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestInterface.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestMediaQueryListListener::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::JSTestNamedConstructorNamedConstructor::construct):
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestNamedConstructor::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::JSTestNodeConstructor::construct):
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestNondeterministic::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestNondeterministic.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjConstructor::construct):
        (WebCore::jsTestObjReadOnlyTestObjAttr):
        (WebCore::jsTestObjTestObjAttr):
        (WebCore::jsTestObjTestNullableObjAttr):
        (WebCore::jsTestObjLenientTestObjAttr):
        (WebCore::jsTestObjXMLObjAttr):
        (WebCore::jsTestObjTypedArrayAttr):
        (WebCore::jsTestObjStrictTypeCheckingAttribute):
        (WebCore::jsTestObjWithScriptExecutionContextAttribute):
        (WebCore::jsTestObjWithScriptStateAttributeRaises):
        (WebCore::jsTestObjWithScriptExecutionContextAttributeRaises):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttribute):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
        (WebCore::jsTestObjWithScriptArgumentsAndCallStackAttribute):
        (WebCore::jsTestObjContentDocument):
        (WebCore::jsTestObjMutablePoint):
        (WebCore::jsTestObjImmutablePoint):
        (WebCore::jsTestObjPutForwardsAttribute):
        (WebCore::jsTestObjPutForwardsNullableAttribute):
        (WebCore::jsTestObjPrototypeFunctionObjMethod):
        (WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows):
        (WebCore::jsTestObjPrototypeFunctionWithScriptStateObj):
        (WebCore::jsTestObjPrototypeFunctionWithScriptStateObjException):
        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException):
        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
        (WebCore::jsTestObjPrototypeFunctionDomStringListFunction):
        (WebCore::jsTestObjPrototypeFunctionGetElementById):
        (WebCore::jsTestObjPrototypeFunctionGetSVGDocument):
        (WebCore::jsTestObjPrototypeFunctionMutablePointFunction):
        (WebCore::jsTestObjPrototypeFunctionImmutablePointFunction):
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestObj::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestObj.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::constructJSTestOverloadedConstructors1):
        (WebCore::constructJSTestOverloadedConstructors2):
        (WebCore::constructJSTestOverloadedConstructors3):
        (WebCore::constructJSTestOverloadedConstructors4):
        (WebCore::constructJSTestOverloadedConstructors5):
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestOverloadedConstructors::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::jsTestOverrideBuiltinsPrototypeFunctionNamedItem):
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestOverrideBuiltins::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestSerializedScriptValueInterface::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::JSTestTypedefsConstructor::construct):
        (WebCore::jsTestTypedefsPrototypeFunctionImmutablePointFunction):
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestTypedefs::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSTestTypedefs.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSattribute::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSattribute.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSreadonly::toWrapped): Deleted.
        * bindings/scripts/test/JS/JSreadonly.h:
        (WebCore::toJS):
        (WebCore::toJSNewlyCreated):
        * html/HTMLMediaElement.cpp:
        (WebCore::controllerJSValue):
        (WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):

2016-05-12  Konstantin Tokarev  <annulen@yandex.ru>

        Use reference instead of pointer in FrameLoaderClient::saveViewStateToItem.
        https://bugs.webkit.org/show_bug.cgi?id=157624

        Reviewed by Darin Adler.

        No new tests needed.

        * loader/EmptyClients.h:
        * loader/FrameLoaderClient.h:
        * loader/HistoryController.cpp:
        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):

2016-05-12  Antoine Quint  <graouts@apple.com>

        Correctly handle prefixed and unprefixed variants in CSSStyleDeclaration
        https://bugs.webkit.org/show_bug.cgi?id=157569
        <rdar://problem/26223115>

        Reviewed by Dean Jackson.

        Tests: fast/css/prefixed-unprefixed-variant-style-declaration.html
               fast/css/shorthand-omitted-initial-value-overrides-shorthand.html

        We essentially revert the code added with https://bugs.webkit.org/show_bug.cgi?id=110011
        which duplicated properties that had a prefixed or unprefixed variant. What we do now is
        to return the value of the prefixed or unprefixed variant through a CSSStyleDeclaration,
        but only return the properties specified by the author when reading from the `cssText` property.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseTransitionShorthand):
        (WebCore::CSSParser::addPropertyWithPrefixingVariant): Deleted.
        * css/CSSParser.h:
        Remove all code adding duplicated properties for the prefixed or unprefixed
        variant of properties that exist in both forms.

        * css/CSSPropertyNames.in:
        Treat transition properties as we do animation properties. 

        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
        Make these two methods call into the matching getXXXInternal() variant instead
        of going through the property set directly so that they would correctly pick up
        on the prefixed or unprefixed variant should there be one when the specified property
        is not specified directly.

        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
        We used to simply return the value for the given property from the property set, which
        we still do but now also check if there is prefixed or unprefixed variant for the provided
        property in case it was absent.

        * css/StyleProperties.cpp:
        (WebCore::MutableStyleProperties::removeShorthandProperty):
        Remove all code adding duplicated properties for the prefixed or unprefixed
        variant of properties that exist in both forms.

        (WebCore::StyleProperties::asText):
        Drive-by fix to also handle the animation-play-state and -webkit-animation-play-state properties
        when serializing to the shorthand.

        (WebCore::MutableStyleProperties::removeProperty): Deleted.
        (WebCore::MutableStyleProperties::removePrefixedOrUnprefixedProperty): Deleted.
        (WebCore::MutableStyleProperties::setProperty): Deleted.
        (WebCore::getIndexInShorthandVectorForPrefixingVariant): Deleted.
        (WebCore::MutableStyleProperties::appendPrefixingVariantProperty): Deleted.
        (WebCore::MutableStyleProperties::setPrefixingVariantProperty): Deleted.
        * css/StyleProperties.h:
        Remove all code adding duplicated properties for the prefixed or unprefixed
        variant of properties that exist in both forms.

2016-05-12  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r200766.
        https://bugs.webkit.org/show_bug.cgi?id=157623

        it is breaking yosemite builds (Requested by youenn on
        #webkit).

        Reverted changeset:

        "DOMPromise should only restrict the resolution type"
        https://bugs.webkit.org/show_bug.cgi?id=157307
        http://trac.webkit.org/changeset/200766

2016-05-12  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        DOMPromise should only restrict the resolution type
        https://bugs.webkit.org/show_bug.cgi?id=157307

        Reviewed by Darin Adler.

        Removing from DOMPromise the rejection template parameter.
        Supported rejection types are integers (Exception codes) and DOM objects (DOMError typically).

        Updated toJS and DeferredWrapper to accept Ref<>&& and RefPtr<>&&.
        Previously Ref<>&& were not accepted and only "const RefPtr<>&" was accepted.
        This in turn created an unecessary churn count when calling toJS.

        Changes also allow in most cases to remove the need for explictly declaring the
        rejection/resolution type.

        Minor refactoring of FontFaceSet promise handling to use DOMPromise in lieu of DeferredWrapper.

        Covered by existing tests.
        Changes should not be visible from user scripts.

        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::consume):
        (WebCore::FetchBody::consumeText):
        (WebCore::blobFromArrayBuffer):
        (WebCore::FetchBody::loadingFailed):
        * Modules/fetch/FetchBody.h:
        (WebCore::FetchBody::formData):
        * Modules/fetch/FetchBodyOwner.cpp:
        (WebCore::FetchBodyOwner::arrayBuffer):
        (WebCore::FetchBodyOwner::blob):
        (WebCore::FetchBodyOwner::formData):
        (WebCore::FetchBodyOwner::json):
        (WebCore::FetchBodyOwner::text):
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::BodyLoader::didReceiveResponse):
        * Modules/fetch/FetchResponse.h:
        * Modules/mediastream/MediaDevices.h:
        * Modules/mediastream/PeerConnectionBackend.h:
        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::didCreateStream):
        * Modules/streams/ReadableStreamSource.h:
        * Modules/webaudio/AudioContext.h:
        * bindings/js/JSDOMBinding.h:
        (WebCore::toJS):
        (WebCore::jsPair):
        * bindings/js/JSDOMPromise.cpp:
        (WebCore::fulfillPromiseWithJSON):
        * bindings/js/JSDOMPromise.h:
        (WebCore::TypeInspector::decltype):
        (WebCore::TypeInspector::testIsVector):
        (WebCore::TypeInspector::testIsRefOrRefPtr):
        (WebCore::DeferredWrapper::resolve):
        (WebCore::DeferredWrapper::reject):
        (WebCore::DOMPromise::resolve):
        (WebCore::DOMPromise::reject):
        (WebCore::DeferredWrapper::resolveWithValue):
        (WebCore::DeferredWrapper::rejectWithValue):
        (WebCore::callPromiseFunction):
        * bindings/js/JSSubtleCryptoCustom.cpp:
        (WebCore::JSSubtleCrypto::importKey):
        (WebCore::JSSubtleCrypto::unwrapKey):
        * css/FontFace.h:
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::PendingPromise::PendingPromise):
        (WebCore::FontFaceSet::load):
        (WebCore::FontFaceSet::registerReady):
        * css/FontFaceSet.h:
        * html/HTMLMediaElement.h:

2016-05-12  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Incorrect parsing when using just 'span" as grid-line value
        https://bugs.webkit.org/show_bug.cgi?id=157615

        Reviewed by Sergio Villar Senin.

        The spec is pretty clear about this:
        https://drafts.csswg.org/css-grid/#typedef-grid-row-start-grid-line

        The possible options when using "span" to reference a grid line are:
          [ span && [ <integer> || <custom-ident> ] ]

        Thus, "span" keyword alone produces an invalid declaration.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridPosition):

2016-05-12  Csaba Osztrogonác  <ossy@webkit.org>

        Remove ENABLE(ES6_ARROWFUNCTION_SYNTAX) guards
        https://bugs.webkit.org/show_bug.cgi?id=157564

        Reviewed by Darin Adler.

        * Configurations/FeatureDefines.xcconfig:

2016-05-11  Ryosuke Niwa  <rniwa@webkit.org>

        TextIteratorStopsOnFormControls is never used
        https://bugs.webkit.org/show_bug.cgi?id=157609

        Reviewed by Alex Christensen.

        Removed SurroundingText.cpp and TextIteratorStopsOnFormControls from TextIterator as they're no longer used.

        * editing/SurroundingText.cpp: Removed.
        * editing/TextIterator.cpp:
        (WebCore::TextIterator::advance):
        (WebCore::TextIterator::exitNode):
        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
        (WebCore::SimplifiedBackwardsTextIterator::advance):
        (WebCore::characterSubrange):
        (WebCore::BackwardsCharacterIterator::BackwardsCharacterIterator):
        * editing/TextIterator.h:
        (WebCore::SimplifiedBackwardsTextIterator::atEnd):
        * editing/TextIteratorBehavior.h:

2016-05-11  Chris Dumez  <cdumez@apple.com>

        Kill Node::ancestorElement()
        https://bugs.webkit.org/show_bug.cgi?id=157599

        Reviewed by Darin Adler.

        Kill Node::ancestorElement() and use Node::parentElement() instead. If
        our parent is not an Element then none of our ancestors will be.

        * dom/Node.cpp:
        (WebCore::Node::isDefaultNamespace):
        (WebCore::Node::lookupPrefix):
        (WebCore::Node::lookupNamespaceURI):
        (WebCore::Node::lookupNamespacePrefix):
        (WebCore::Node::convertToPage):
        (WebCore::Node::convertFromPage):
        (WebCore::Node::ancestorElement): Deleted.
        * dom/Node.h:

2016-05-11  Zalan Bujtas  <zalan@apple.com>

        Absolute positioned element is not placed properly when parent becomes the containing block.
        https://bugs.webkit.org/show_bug.cgi?id=157455
        <rdar://problem/26212568>

        Reviewed by Simon Fraser.

        When a container becomes a containing block, we need to check if there are any positioned boxes in its subtree
        in order to "re-parent" them. It basically means that we remove them from RenderBlock::positionedDescendants map
        and they'll get re-inserted during the next layout correctly.
        This patch fixes the case when a container becomes the containing block by setting the transform property and its positioned
        child gets misplaced.  

        Test: fast/block/containing-block-changes.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::removePositionedObjectsIfNeeded):
        (WebCore::RenderBlock::styleWillChange):
        * rendering/RenderBlock.h:

2016-05-11  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r200700, r200703, and r200713.
        https://bugs.webkit.org/show_bug.cgi?id=157601

        Broke iOS builds (Requested by rniwa on #webkit).

        Reverted changesets:

        "Touch.prototype is undefined on iOS"
        https://bugs.webkit.org/show_bug.cgi?id=157560
        http://trac.webkit.org/changeset/200700

        "iOS build fix attempt after r200700."
        http://trac.webkit.org/changeset/200703

        "iOS clean build fix after r200700."
        http://trac.webkit.org/changeset/200713

2016-05-11  Ryosuke Niwa  <rniwa@webkit.org>

        iOS clean build fix after r200700.

        * bindings/js/JSDOMWindowCustom.cpp:

2016-05-11  Ryosuke Niwa  <rniwa@webkit.org>

        Moving focus by tab could erroneously focus a non-focusable shadow host
        https://bugs.webkit.org/show_bug.cgi?id=157585

        Reviewed by Antti Koivisto.

        The bug was caused by findFocusableElementDescendingDownIntoFrameDocument erroneously returning a shadow host
        that contains a focusable element instead of traversing it through to find a focusable element within. Fixed
        the bug calling findFocusableElementWithinScope which traverses shadow trees to find a focusable element unlike
        findFocusableElementOrScopeOwner which returns a focusable element or a shadow host.

        Also done some refactoring for clarity.

        Test: fast/shadow-dom/focus-on-iframe.html

        * page/FocusController.cpp:
        (WebCore::FocusController::findFocusableElementDescendingDownIntoFrameDocument): See above.

        (WebCore::FocusController::findFocusableElementAcrossFocusScope): Declare outerScope as late as possible.
        (WebCore::nextElementWithGreaterTabIndex): Merged if conditions for clarity.
        (WebCore::previousElementWithLowerTabIndex): Removed the check for isNonFocusableShadowHost since
        isFocusableOrHasShadowTreeWithoutCustomFocusLogic returns true whenever isNonFocusableShadowHost returns true.

2016-05-11  Ryan Haddad  <ryanhaddad@apple.com>

        Updating bindings tests results after r200699

        Unreviewed test gardening.

        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):

2016-05-11  Chris Dumez  <cdumez@apple.com>

        Unreviewed attempt to fix the Windows build after r200699.

        * bindings/js/JSIDBObjectStoreCustom.cpp:

2016-05-11  Ryosuke Niwa  <rniwa@webkit.org>

        iOS build fix attempt after r200700.

        * bindings/js/ios/TouchConstructors.cpp:

2016-05-10  Ryosuke Niwa  <rniwa@webkit.org>

        Touch.prototype is undefined on iOS
        https://bugs.webkit.org/show_bug.cgi?id=157560
        <rdar://problem/26143008>

        Reviewed by Chris Dumez.

        Remove Touch and TouchList attributes from DOMWindow.
        These attributes should be exposed via generated binding code (JSDOMWindow.cpp).

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::touch): Deleted.
        (WebCore::JSDOMWindow::touchList): Deleted.
        * page/DOMWindow.idl:

2016-05-11  Darin Adler  <darin@apple.com>

        Change IDBObjectStore.createIndex to take an IDL dictionary
        https://bugs.webkit.org/show_bug.cgi?id=157520

        Reviewed by Chris Dumez.

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::createObjectStore): Use IDBKeyPath::Type instead of
        IndexedDB::KeyPathType.
        * Modules/indexeddb/IDBKeyPath.cpp:
        (WebCore::IDBKeyPath::IDBKeyPath): Ditto.
        (WebCore::IDBKeyPath::isValid): Ditto.
        (WebCore::IDBKeyPath::operator==): Ditto.
        (WebCore::IDBKeyPath::encode): Ditto.
        (WebCore::IDBKeyPath::decode): Ditto.

        * Modules/indexeddb/IDBKeyPath.h: Use pragma once. Make constructors non-explicit so
        we can just pass a string or vector and have it turn into an IDBKeyPath. Added an enum
        class named Type here and use it instead of IndexedDB::KeyPathType.

        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::openCursor): Remove unneeded local variable.
        (WebCore::IDBObjectStore::get): Ditto.
        (WebCore::IDBObjectStore::doDelete): Ditto.
        (WebCore::IDBObjectStore::createIndex): Changed argument type to take IndexParameters
        instead of two seaparate booleans. Also updated to use IDBKeyPath::Type.

        * Modules/indexeddb/IDBObjectStore.h: Removed include of IndexedDB, using a forward
        decalration instead. Marked the class final. Added an IndexParameters struct and used
        it for the argument to createIndex.

        * Modules/indexeddb/IDBObjectStore.idl: Stopped using Custom for put, add, and
        createIndex functions. Stopped using Dictionary for createIndex, using IDBIndexParameters
        instead as in the specification. Added IDBIndexParameters dictionary definition.

        * Modules/indexeddb/IndexedDB.h: Use pragma once. Removed KeyPathType.

        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::injectIDBKeyIntoScriptValue): Use IDBKeyPath::Type instead of
        IndexedDB::KeyPathType.
        (WebCore::maybeCreateIDBKeyFromScriptValueAndKeyPath): Ditto.
        (WebCore::canInjectIDBKeyIntoScriptValue): Ditto.
        (WebCore::createKeyPathArray): Ditto.
        (WebCore::toJS): Ditto.
        * bindings/js/JSIDBObjectStoreCustom.cpp:
        (WebCore::putOrAdd): Deleted.
        (WebCore::JSIDBObjectStore::putFunction): Deleted.
        (WebCore::JSIDBObjectStore::add): Deleted.
        (WebCore::JSIDBObjectStore::createIndex): Deleted.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheckExpression): Fixed code that generates a type check for
        wrappers to only check types is knows how to check: wrappers and arrays, including
        typed arrays. This prevents it from trying to check dictionaries.

        * inspector/InspectorIndexedDBAgent.cpp: Use IDBKeyPath::Type instead of
        IndexedDB::KeyPathType.

2016-05-11  Brady Eidson  <beidson@apple.com>

        Modern IDB: WebWorker support.
        https://bugs.webkit.org/show_bug.cgi?id=149953

        Reviewed by Alex Christensen.

        No new tests (Covered by changes to existing tests).

        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):

2016-05-11  Chris Dumez  <cdumez@apple.com>

        Update Node::appendChild() / replaceChild() / removeChild() / insertBefore() to take references instead of pointers
        https://bugs.webkit.org/show_bug.cgi?id=157556

        Reviewed by Darin Adler.

        Update Node::appendChild() / replaceChild() / removeChild() / insertBefore()
        to take references instead of pointers. Do the parameter null checks in the
        bindings instead of doing it in the implementation on Node.

        Also update the ContainerNode::appendChild() / replaceChild() /
        insertBefore() to take C++ references instead of Ref<>&& to avoid
        unnecessarily causing ref counting churns at some call sites (including
        in the bindings since they are a raw pointer to the nodes). The
        implementation on ContainerNode was not actually using WTFMove() on the
        Ref<>&& anyway.

        * Modules/plugins/YouTubePluginReplacement.cpp:
        (WebCore::YouTubePluginReplacement::installReplacement):
        * bindings/js/JSNodeCustom.cpp:
        (WebCore::JSNode::insertBefore):
        (WebCore::JSNode::replaceChild):
        (WebCore::JSNode::removeChild):
        (WebCore::JSNode::appendChild):
        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::insertBefore):
        (WebCore::ContainerNode::parserInsertBefore):
        (WebCore::ContainerNode::replaceChild):
        (WebCore::ContainerNode::appendChild):
        (WebCore::ContainerNode::parserAppendChild):
        (WebCore::ContainerNode::cloneChildNodes):
        (WebCore::ContainerNode::append):
        (WebCore::ContainerNode::prepend):
        * dom/ContainerNode.h:
        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createDocument):
        (WebCore::DOMImplementation::createHTMLDocument):
        * dom/Document.cpp:
        (WebCore::Document::setBodyOrFrameset):
        * dom/Element.cpp:
        (WebCore::Element::setOuterHTML):
        * dom/Node.cpp:
        (WebCore::Node::insertBefore):
        (WebCore::Node::replaceChild):
        (WebCore::Node::removeChild):
        (WebCore::Node::appendChild):
        (WebCore::Node::before):
        (WebCore::Node::after):
        (WebCore::Node::replaceWith):
        (WebCore::nodeSetPreTransformedFromNodeOrStringVector): Deleted.
        (WebCore::Node::normalize): Deleted.
        * dom/Node.h:
        * dom/Node.idl:
        * dom/NodeOrString.cpp:
        (WebCore::convertNodesOrStringsIntoNode):
        * dom/Range.cpp:
        (WebCore::Range::processContents):
        (WebCore::Range::processContentsBetweenOffsets):
        (WebCore::Range::processNodes):
        (WebCore::Range::processAncestorsAndTheirSiblings):
        (WebCore::Range::insertNode):
        (WebCore::Range::surroundContents):
        * dom/Range.h:
        * dom/Text.cpp:
        (WebCore::Text::splitText):
        * editing/AppendNodeCommand.cpp:
        (WebCore::AppendNodeCommand::doApply):
        * editing/Editor.cpp:
        (WebCore::Editor::setTextAsChildOfElement):
        * editing/EditorCommand.cpp:
        (WebCore::executeInsertNode):
        * editing/MergeIdenticalElementsCommand.cpp:
        (WebCore::MergeIdenticalElementsCommand::doApply):
        (WebCore::MergeIdenticalElementsCommand::doUnapply):
        * editing/RemoveNodeCommand.cpp:
        (WebCore::RemoveNodeCommand::doUnapply):
        * editing/ReplaceNodeWithSpanCommand.cpp:
        (WebCore::swapInNodePreservingAttributesAndChildren):
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplacementFragment::insertFragmentForTestRendering):
        * editing/SplitElementCommand.cpp:
        (WebCore::SplitElementCommand::executeApply):
        (WebCore::SplitElementCommand::doUnapply):
        * editing/WrapContentsInDummySpanCommand.cpp:
        (WebCore::WrapContentsInDummySpanCommand::executeApply):
        (WebCore::WrapContentsInDummySpanCommand::doUnapply):
        * editing/cocoa/EditorCocoa.mm:
        (WebCore::Editor::styleForSelectionStart):
        * editing/htmlediting.cpp:
        (WebCore::createTabSpanElement):
        * editing/ios/EditorIOS.mm:
        (WebCore::Editor::WebContentReader::readURL):
        (WebCore::Editor::createFragmentForImageResourceAndAddResource):
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::WebContentReader::readFilenames):
        (WebCore::Editor::WebContentReader::readURL):
        (WebCore::Editor::createFragmentForImageResourceAndAddResource):
        * editing/markup.cpp:
        (WebCore::fillContainerFromString):
        (WebCore::createFragmentFromText):
        (WebCore::replaceChildrenWithFragment):
        (WebCore::replaceChildrenWithText):
        * html/BaseChooserOnlyDateAndTimeInputType.cpp:
        (WebCore::BaseChooserOnlyDateAndTimeInputType::createShadowSubtree):
        * html/ColorInputType.cpp:
        (WebCore::ColorInputType::createShadowSubtree):
        * html/FTPDirectoryDocument.cpp:
        (WebCore::FTPDirectoryDocumentParser::appendEntry):
        (WebCore::FTPDirectoryDocumentParser::createTDForFilename):
        (WebCore::FTPDirectoryDocumentParser::createBasicDocument):
        * html/HTMLDetailsElement.cpp:
        (WebCore::HTMLDetailsElement::didAddUserAgentShadowRoot):
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::setOuterText):
        (WebCore::HTMLElement::insertAdjacent):
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::tryCreateImageControls):
        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
        * html/HTMLMeterElement.cpp:
        (WebCore::HTMLMeterElement::didAddUserAgentShadowRoot):
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::createForJSConstructor):
        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::didAddUserAgentShadowRoot):
        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::createTBody):
        (WebCore::HTMLTableElement::insertRow):
        * html/HTMLTableRowElement.cpp:
        (WebCore::HTMLTableRowElement::insertCell):
        * html/ImageDocument.cpp:
        (WebCore::ImageDocument::createDocumentStructure):
        * html/MediaDocument.cpp:
        (WebCore::MediaDocumentParser::createDocumentStructure):
        * html/PluginDocument.cpp:
        (WebCore::PluginDocumentParser::createDocumentStructure):
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::createShadowSubtree):
        * html/SearchInputType.cpp:
        (WebCore::SearchInputType::createShadowSubtree):
        * html/ValidationMessage.cpp:
        (WebCore::ValidationMessage::buildBubbleTree):
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlClosedCaptionsTrackListElement::rebuildTrackListMenu):
        * html/shadow/MediaControls.cpp:
        (WebCore::MediaControls::createTextTrackDisplay):
        * html/shadow/MediaControlsApple.cpp:
        (WebCore::MediaControlsApple::tryCreateControls):
        * html/shadow/mac/ImageControlsRootElementMac.cpp:
        (WebCore::ImageControlsRootElement::tryCreate):
        * html/track/VTTCue.cpp:
        (WebCore::VTTCue::updateDisplayTree):
        * html/track/WebVTTParser.cpp:
        (WebCore::WebVTTTreeBuilder::constructTreeFromToken):
        * inspector/DOMEditor.cpp:
        (WebCore::DOMEditor::RemoveChildAction::RemoveChildAction):
        (WebCore::DOMEditor::InsertBeforeAction::InsertBeforeAction):
        (WebCore::DOMEditor::ReplaceChildNodeAction::ReplaceChildNodeAction):
        (WebCore::DOMEditor::insertBefore):
        (WebCore::DOMEditor::removeChild):
        (WebCore::DOMEditor::replaceChild):
        * inspector/DOMEditor.h:
        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::patchNode):
        (WebCore::DOMPatchSupport::innerPatchNode):
        (WebCore::DOMPatchSupport::innerPatchChildren):
        (WebCore::DOMPatchSupport::insertBeforeAndMarkAsUsed):
        (WebCore::DOMPatchSupport::removeChildAndMoveToNew):
        * inspector/DOMPatchSupport.h:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::createInspectorStyleSheetForDocument):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::removeNode):
        (WebCore::InspectorDOMAgent::setNodeName):
        (WebCore::InspectorDOMAgent::moveTo):
        * page/DragController.cpp:
        (WebCore::documentFragmentFromDragData):
        * page/ios/FrameIOS.mm:
        (WebCore::Frame::initWithSimpleHTMLDocument):
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::cloneTarget):
        (WebCore::SVGUseElement::expandUseElementsInShadowTree):
        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree):
        * xml/XMLErrors.cpp:
        (WebCore::createXHTMLParserErrorHeader):
        (WebCore::XMLErrors::insertErrorMessageBlock):
        * xml/XMLTreeViewer.cpp:
        (WebCore::XMLTreeViewer::transformDocumentToTreeView):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::XMLDocumentParser::startElementNs):
        (WebCore::XMLDocumentParser::processingInstruction):
        (WebCore::XMLDocumentParser::cdataBlock):
        (WebCore::XMLDocumentParser::comment):

2016-05-11  Brady Eidson  <beidson@apple.com>

        Modern IDB: IDBOpenDBRequests that are stop()'ed don't notify the IDBServer of that fact.
        https://bugs.webkit.org/show_bug.cgi?id=157448

        Reviewed by Alex Christensen.

        No new tests (Previously skipped tests cover new behavior, and are now unskipped).

        There's two main parts to this patch:
        
        1 - When an IDBOpenDBRequest is stop()'ed due to page navigation or worker termination,
            we now notify the IDBServer of that.
        2 - Lot's of little tweaks to UniqueIDBDatabase to handle shutting down version change
            transactions and/or connections related to the cancelled openDB request.
            
        Fortunately the changes to UniqueIDBDatabase were all well covered by existing tests.
        
        * Modules/indexeddb/IDBOpenDBRequest.cpp:
        (WebCore::IDBOpenDBRequest::fireSuccessAfterVersionChangeCommit):
        (WebCore::IDBOpenDBRequest::fireErrorAfterVersionChangeCompletion):
        (WebCore::IDBOpenDBRequest::cancelForStop):
        (WebCore::IDBOpenDBRequest::dispatchEvent):
        * Modules/indexeddb/IDBOpenDBRequest.h:

        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::stop):
        (WebCore::IDBRequest::cancelForStop):
        * Modules/indexeddb/IDBRequest.h:

        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::openDBRequestCancelled):
        (WebCore::IDBClient::IDBConnectionProxy::didFinishHandlingVersionChangeTransaction):
        * Modules/indexeddb/client/IDBConnectionProxy.h:

        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::didFinishHandlingVersionChangeTransaction):
        (WebCore::IDBClient::IDBConnectionToServer::openDBRequestCancelled):
        * Modules/indexeddb/client/IDBConnectionToServer.h:

        * Modules/indexeddb/client/IDBConnectionToServerDelegate.h:

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::didFinishHandlingVersionChangeTransaction):
        (WebCore::IDBServer::IDBServer::databaseConnectionClosed):
        (WebCore::IDBServer::IDBServer::openDBRequestCancelled):
        * Modules/indexeddb/server/IDBServer.h:

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::handleCurrentOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::openDBRequestCancelled):
        (WebCore::IDBServer::UniqueIDBDatabase::commitTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::performCommitTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformCommitTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::abortTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::didFinishHandlingVersionChange):
        (WebCore::IDBServer::UniqueIDBDatabase::performAbortTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformAbortTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::connectionClosedFromClient):
        (WebCore::IDBServer::UniqueIDBDatabase::transactionCompleted):
        (WebCore::IDBServer::UniqueIDBDatabase::forgetErrorCallback):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::abortTransactionWithoutCallback):
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::didFinishHandlingVersionChange):
        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.h:

        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::didFinishHandlingVersionChange): Deleted.
        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.h:

        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::didFinishHandlingVersionChangeTransaction):
        (WebCore::InProcessIDBServer::openDBRequestCancelled):
        * Modules/indexeddb/shared/InProcessIDBServer.h:

2016-05-11  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r200686.

        Caused a lot of layout test failures

        Reverted changeset:

        "Sites served over insecure connections should not be allowed
        to use geolocation."
        https://bugs.webkit.org/show_bug.cgi?id=157423
        http://trac.webkit.org/changeset/200686

2016-05-11  Chris Dumez  <cdumez@apple.com>

        Optimize DataDetection's searchForLinkRemovingExistingDDLinks()
        https://bugs.webkit.org/show_bug.cgi?id=157561

        Reviewed by Ryosuke Niwa.

        Optimize DataDetection's searchForLinkRemovingExistingDDLinks():
        1. The first loop was using Node::childNodes() to iterate over the child
           elements. Because of the recursive call, we may end up prepending
           children as we iterate over them. This is an issue because the
           childCount was cached before the loop and vector it would blow away
           the cache inside the NodeList. Switch to using ElementTraversal which
           should be both safer and more efficient. I don't believe we can use
           our nice ElementChildIterator here unfortunately as we would hit
           assertions due the the DOM mutations while iterating.
        2. The second loop was using again Node::childNodes() and kept calling
           item(0) to get the first child and move it to make it the previous
           sibling of its old parent. Again, using childNodes() here is super
           inefficient because we keep modifying the children and childNodes()
           returns a live NodeList. The call to NodeList::length() would cache
           all the children in a Vector, only to blow that cache away after
          removing the first child. Switch to using ContainerNode::firstChild().
        3. Drop the parentElement parameter as we can just get it from the child.
        4. Use tighter typing so we don't end up calling the implementations of
           insertBefore() / removeChild() that are on Node, thus unnecessarily
           doing a is<ContainerNode>() check every time.
        5. Pass element by reference instead of pointer as it cannot be null.

        * editing/cocoa/DataDetection.mm:
        (WebCore::removeResultLinksFromAnchor):
        (WebCore::searchForLinkRemovingExistingDDLinks):

2016-05-11  Rawinder Singh  <rawinder.singh-webkit@cisra.canon.com.au>

        preprocess-idls.pl not ignoring comments during processing
        https://bugs.webkit.org/show_bug.cgi?id=157559

        Reviewed by Darin Adler.

        Remove comments from IDL file before processing.

        * bindings/scripts/preprocess-idls.pl:
        (getInterfaceExtendedAttributesFromIDL):

2016-05-11  Jer Noble  <jer.noble@apple.com>

        Videos allowed to play through the Main Content restriction should not pause when scrolled off-screen.
        https://bugs.webkit.org/show_bug.cgi?id=157555

        Reviewed by Eric Carlson.

        Test: media/video-main-content-allow-then-scroll.html

        * html/MediaElementSession.cpp:
        (WebCore::isMainContent):

2016-05-11  Fujii Hironori  <Hironori.Fujii@sony.com>

        [curl] curl_easy_setopt(CURLOPT_CONNECT_ONLY) should take a long parameter
        https://bugs.webkit.org/show_bug.cgi?id=157562

        Reviewed by Darin Adler.

        The third argument of a calling curl_easy_setopt is missing.

        * platform/network/curl/SocketStreamHandleCurl.cpp:
        (WebCore::SocketStreamHandle::startThread): Give the third
        argument of curl_easy_setopt.

2016-05-11  Pranjal Jumde  <pjumde@apple.com>

        Sites served over insecure connections should not be allowed to use geolocation.
        https://bugs.webkit.org/show_bug.cgi?id=157423
        <rdar://problem/23751632>

        Reviewed by Brent Fulgham.

        Tests: http/tests/security/insecure-geolocation.html
               http/tests/security/mixedcontent-geolocation-block-insecure-content.html
               http/tests/security/mixedcontent-geolocation.html

        * Modules/geolocation/Geolocation.cpp:
        (WebCore::Geolocation::logError):
        (WebCore::Geolocation::startRequest):
        Access to Geolocation will be blocked if site is not secure. An error will be logged when access to Geolocation is blocked.
        (WebCore::Geolocation::shouldBlockGeolocationRequests)
        Returns true if the access to the geolocation should be blocked.
        * Modules/geolocation/Geolocation.h:
        * dom/SecurityContext.h:
        (WebCore::SecurityContext::foundMixedContent):
        Returns true if insecure content was accessed over secure connection.
        (WebCore::SecurityContext::setFoundMixedContent):
        Sets m_foundMixedContent to true if insecure content is accessed over secure connection.
        (WebCore::SecurityContext::geolocationAccessed):
        Returns true if geolocation was accessed
        (WebCore::SecurityContext::setGeolocationAccessed):
        Sets m_geolocationAccessed to true if geolocation was accessed.
        * loader/MixedContentChecker.cpp:
        (WebCore::MixedContentChecker::canDisplayInsecureContent):
        Insecure content will be blocked if geolocation was accessed by the page. Updates document to keep track of mixed content.
        (WebCore::MixedContentChecker::canRunInsecureContent):
        Insecure content will be blocked if geolocation was accessed by the page. Updates document to keep track of mixed content.

2016-05-11  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Ensure DOM iterators remain done
        https://bugs.webkit.org/show_bug.cgi?id=157453

        Reviewed by Darin Adler.

        Covered by updated test.

        Making DOMWrapped::Iterator an Optional.
        Setting it to Nullopt on the first time Iterator is returning null.

        For set iterators, incrementing a counter which value is used in forEach callbacks and entries iterators.

        * bindings/js/JSDOMIterator.h:
        (WebCore::JSDOMIterator<JSWrapper>::asJS):
        (WebCore::appendForEachArguments):
        (WebCore::iteratorForEach):
        (WebCore::JSDOMIterator<JSWrapper>::next):

2016-05-11  Joanmarie Diggs  <jdiggs@igalia.com>

        [GTK] accessibility/aria-readonly.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=98357

        Reviewed by Chris Fleizach.

        Add support for ATK_STATE_READ_ONLY and expose the value of aria-readonly
        as an AtkObject attribute. In order to eliminate duplicate checks, remove
        isReadOnly() and just use canSetAttributeValue(), moving all the logic into
        AccessibilityNodeObject. Add AccessibilityObject::supportsARIAReadOnly() so
        that we can explicitly expose the implicit value for aria-readonly on roles
        which support this property. Also add support for ATK_STATE_CHECKABLE, both
        because this state was missing and because it serves a similar function to
        ATK_STATE_EDITABLE for the purpose of verifying exposure of toggle-able
        elements that are not read-only.

        Test: accessibility/form-control-value-settable.html

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::canSetValueAttribute):
        (WebCore::AccessibilityNodeObject::isRequired): Deleted.
        (WebCore::AccessibilityNodeObject::supportsRequiredAttribute): Deleted.
        * accessibility/AccessibilityNodeObject.h:
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::supportsARIAReadOnly):
        (WebCore::AccessibilityObject::ariaReadOnlyValue):
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::isUnvisited): Deleted.
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::clickPoint):
        (WebCore::AccessibilityRenderObject::isOffScreen): Deleted.
        (WebCore::AccessibilityRenderObject::anchorElement): Deleted.
        (WebCore::AccessibilityRenderObject::internalLinkElement): Deleted.
        (WebCore::AccessibilityRenderObject::textChanged): Deleted.
        (WebCore::AccessibilityRenderObject::clearChildren): Deleted.
        (WebCore::AccessibilityRenderObject::addImageMapChildren): Deleted.
        * accessibility/AccessibilityRenderObject.h:
        * accessibility/atk/WebKitAccessibleInterfaceText.cpp:
        (getAttributeSetForAccessibilityObject):
        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (webkitAccessibleGetAttributes):
        (setAtkStateSetFromCoreObject):
        (getInterfaceMaskFromObject):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):

2016-05-10  Jeremy Jones  <jeremyj@apple.com>

        Don't update media duration at playback end while seeking.
        https://bugs.webkit.org/show_bug.cgi?id=157557

        Reviewed by Jer Noble.

        If JavaScript initiates a media element seek just as the media playback ends, don't update duration
        to the current time as the current time is now the new seek time, not the time when playback ended.

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::didEnd):

2016-05-10  Joseph Pecoraro  <pecoraro@apple.com>

        Fix typo CaptionUserPreferences::updateCaptionStyleSheetOveride
        https://bugs.webkit.org/show_bug.cgi?id=157544

        Reviewed by Darin Adler.

        * page/CaptionUserPreferences.cpp:
        (WebCore::CaptionUserPreferences::setCaptionsStyleSheetOverride):
        (WebCore::CaptionUserPreferences::updateCaptionStyleSheetOverride):
        (WebCore::CaptionUserPreferences::updateCaptionStyleSheetOveride): Deleted.
        * page/CaptionUserPreferences.h:
        * page/CaptionUserPreferencesMediaAF.cpp:
        (WebCore::CaptionUserPreferencesMediaAF::updateTimerFired):
        (WebCore::CaptionUserPreferencesMediaAF::captionPreferencesChanged):

2016-05-10  Simon Fraser  <simon.fraser@apple.com>

        Remove scrolledContentOffset() from rendering code
        https://bugs.webkit.org/show_bug.cgi?id=157552

        Reviewed by Zalan Bujtas.

        scrolledContentOffset() is misleading because it returns a scrollPosition().
        Just use the name scrollPosition(), returning a ScrollPosition (IntPoint),
        and fix callers that need to convert to layout size.

        * editing/VisibleUnits.cpp:
        (WebCore::absoluteLineDirectionPointToLocalPointInBlock):
        * rendering/LayoutState.cpp:
        (WebCore::LayoutState::LayoutState):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintObject):
        (WebCore::RenderBlock::selectionGapRectsForRepaint):
        (WebCore::RenderBlock::paintSelection):
        (WebCore::RenderBlock::nodeAtPoint):
        (WebCore::RenderBlock::offsetForContents):
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::layoutBlock):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::scrollPosition):
        (WebCore::RenderBox::applyCachedClipAndScrollOffsetForRepaint):
        (WebCore::isCandidateForOpaquenessTest):
        (WebCore::RenderBox::offsetFromContainer):
        (WebCore::RenderBox::layoutOverflowRectForPropagation):
        (WebCore::RenderBox::scrolledContentOffset): Deleted.
        * rendering/RenderBox.h:
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::offsetFromContainer):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::updateLayerPosition):
        (WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/RenderLayer.h:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateGeometry):
        * rendering/RenderMultiColumnFlowThread.cpp:
        (WebCore::RenderMultiColumnFlowThread::offsetFromContainer):
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::decorationsClipRectForBoxInNamedFlowFragment):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::mapLocalToContainer):
        (WebCore::RenderObject::pushMappingToContainer):
        (WebCore::RenderObject::mapAbsoluteToLocalPoint):
        (WebCore::RenderObject::offsetFromContainer):
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::hitInnerTextElement):

2016-05-10  Simon Fraser  <simon.fraser@apple.com>

        Horizontally-scrollable items with a 3d transform are rendered incorrectly in RTL when container has -webkit-overflow-scroll: touch
        https://bugs.webkit.org/show_bug.cgi?id=157482
        rdar://problem/26204794

        Reviewed by Zalan Bujtas.

        The compositing code was confused about scroll offsets vs. scroll positions, because
        of the badly named scrolledContentOffset(); we used that in one place, and scrollOffset()
        lower down. Change both to use scrollOffset().

        Test: compositing/rtl/rtl-with-transformed-descendants.html

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateGeometry):

2016-05-10  Enrica Casucci  <enrica@apple.com>

        Numerous block selection issues on iOS.
        https://bugs.webkit.org/show_bug.cgi?id=157490
        rdar://problem/25717977
        rdar://problem/23042215

        Reviewed by Tim Horton.

        * rendering/style/RenderStyle.h:
        Exporting method.

2016-05-10  Sam Weinig  <sam@webkit.org>

        Tweak underline style for data detected links
        https://bugs.webkit.org/show_bug.cgi?id=157546

        Reviewed by Tim Horton.

        Added API Tests in Color.cpp.

        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::detectContentInRange):
        Tweak the underline's opacity based on the text color. White-ish text gets
        46% opacity, everything else gets 26% opacity.

        * platform/graphics/Color.cpp:
        (WebCore::Color::getHSV):
        * platform/graphics/Color.h:
        Add support for getting the HSV (also know as HSB) computation of the color
        to help determine the "whiteness" of a color.

2016-05-10  Alex Christensen  <achristensen@webkit.org>

        Handle _schemeUpgraded delegate callbacks in NSURLSessionDataDelegate
        https://bugs.webkit.org/show_bug.cgi?id=157354
        rdar://problem/25842107

        Reviewed by Darin Adler.

        No new tests.  This cannot be tested with a self-signed certificate.
        This needs to be tested once we use real ssl certificates for testing.

        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:willSendRequest:redirectResponse:]):
        * platform/network/mac/WebCoreURLResponse.h:
        * platform/network/mac/WebCoreURLResponse.mm:
        (WebCore::synthesizeRedirectResponseIfNecessary):
        Take the NSURLRequest instead of the NSURLConnection as a parameter so we can share this code with the NSURLSession loader,
        which has an NSURLSessionDataTask.  Both have the currentRequest, which is all we need in this function anyway.

2016-05-10  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Backend should initiate timeline recordings on page navigations to ensure nothing is missed
        https://bugs.webkit.org/show_bug.cgi?id=157504
        <rdar://problem/26188642>

        Reviewed by Brian Burg.

        Test: inspector/timeline/setAutoCaptureInstruments-errors.html

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        Pass other agents into the TimelineAgent constructor.

        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::frameStartedLoadingImpl):
        Inform the TimelineAgent whenever the main frame starts a new load.

        * inspector/InspectorTimelineAgent.h:
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
        Initialize new members.

        (WebCore::InspectorTimelineAgent::willDestroyFrontendAndBackend):
        Cleanup auto capture state when tearing down.

        (WebCore::InspectorTimelineAgent::setAutoCaptureEnabled):
        (WebCore::InspectorTimelineAgent::setAutoCaptureInstruments):
        Set and validate new auto capture state from the frontend.

        (WebCore::InspectorTimelineAgent::mainFrameStartedLoading):
        When page navigates start an auto capture if needed.

2016-05-10  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !ENABLE(SHADOW_DOM) && !ENABLE(DETAILS_ELEMENT) build
        https://bugs.webkit.org/show_bug.cgi?id=157514

        Reviewed by Ryosuke Niwa.

        * dom/Element.cpp:
        (WebCore::Element::insertedInto):
        (WebCore::Element::removedFrom):

2016-05-10  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !ENABLE(WEB_TIMING) build
        https://bugs.webkit.org/show_bug.cgi?id=157515

        Reviewed by Alex Christensen.

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::loadDone):

2016-05-10  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !ENABLE(INDEXED_DATABASE) build
        https://bugs.webkit.org/show_bug.cgi?id=157517

        Reviewed by Alex Christensen.

        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::WorkerGlobalScope):
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThread::WorkerThread):

2016-05-05  Jer Noble  <jer.noble@apple.com>

        Return a Promise from HTMLMediaElement.play()
        https://bugs.webkit.org/show_bug.cgi?id=157400

        Reviewed by Eric Carlson.

        Tests: media/media-play-promise-reject-error-notsupported.html
               media/media-play-promise-reject-load-abort.html
               media/media-play-promise-reject-pause-abort.html
               media/media-play-promise-reject-play-notallowed.html
               media/media-play-promise-reject-play-notsupported.html
               media/media-play-promise-resolve-when-playing.html
               media/media-play-promise-resolve.html

        The HTML Living Standard Spec <https://html.spec.whatwg.org/multipage/embedded-content.html>
        (5 May 2016) adds support for a Promise to be returned by the play() method, to be resolved
        or rejected at defined points during loading and playback.

        Add utility methods which encapsulate the definitions of the equivalent algorithms from the
        HTML Spec.  Add a new, overloaded play() method on HTMLMediaElement which takes a DeferredWrapper
        reference.

        After the change to use scheduleNotifyAboutPlaying() instead of enqueueing the "playing" event
        directly, we must ensure that the notifyAboutPlaying() task does not get fired before the
        "play" event preceeding it does. So re-implement GenericEventQueue (which previously used
        a timer to dispatch events) to use a GenericTaskQueue instead. This ensures that all tasks and
        events are interleaved in the order in which they were enqueued.

        Additionally, the new pauseAfterDetachedTimerFired() event was firing out of microtask order, which
        broke some W3C tests after the changes to GenericEventQueue. Move GenericEventQueue and
        GenericTaskQueue to the same timing source (namely, a WebCore Timer) and interleave Events
        and Tasks by having GenericEventQueue use GenericTaskQueue to issue its Events. Because
        Document::postTask() cannot ensure ordering with Timer-based events, switch HTMLMediaElement
        over to Timer-backed GenericTaskQueues.

        Use a WeakPtr to track the destruction of TaskDispatcher<Timer> objects in pendingDispatchers().

        * dom/GenericEventQueue.cpp:
        (WebCore::GenericEventQueue::GenericEventQueue):
        (WebCore::GenericEventQueue::enqueueEvent):
        (WebCore::GenericEventQueue::close):
        (WebCore::GenericEventQueue::cancelAllEvents):
        (WebCore::GenericEventQueue::suspend):
        (WebCore::GenericEventQueue::resume):
        (WebCore::GenericEventQueue::sharedTimer): Deleted.
        (WebCore::GenericEventQueue::sharedTimerFired): Deleted.
        (WebCore::GenericEventQueue::pendingQueues): Deleted.
        * dom/GenericEventQueue.h:
        * platform/GenericTaskQueue.cpp: Added.
        (WebCore::TaskDispatcher<Timer>::~TaskDispatcher):
        (WebCore::TaskDispatcher<Timer>::postTask):
        (WebCore::TaskDispatcher<Timer>::sharedTimer):
        (WebCore::TaskDispatcher<Timer>::sharedTimerFired):
        (WebCore::TaskDispatcher<Timer>::pendingDispatchers):
        (WebCore::TaskDispatcher<Timer>::dispatchOneTask):
        * platform/GenericTaskQueue.h:
        (WebCore::TaskDispatcher<Timer>::TaskDispatcher): Deleted.
        (WebCore::TaskDispatcher<Timer>::postTask): Deleted.
        (WebCore::TaskDispatcher<Timer>::timerFired): Deleted.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::~HTMLMediaElement):
        (WebCore::HTMLMediaElement::scheduleResolvePendingPlayPromises):
        (WebCore::HTMLMediaElement::rejectPendingPlayPromises):
        (WebCore::HTMLMediaElement::resolvePendingPlayPromises):
        (WebCore::HTMLMediaElement::scheduleNotifyAboutPlaying):
        (WebCore::HTMLMediaElement::notifyAboutPlaying):
        (WebCore::HTMLMediaElement::noneSupported):
        (WebCore::HTMLMediaElement::cancelPendingEventsAndCallbacks):
        (WebCore::HTMLMediaElement::setReadyState):
        (WebCore::HTMLMediaElement::play):
        (WebCore::HTMLMediaElement::playInternal):
        (WebCore::HTMLMediaElement::pauseInternal):
        (WebCore::HTMLMediaElement::contextDestroyed):
        (WebCore::HTMLMediaElement::stop):
        (WebCore::HTMLMediaElement::pauseAfterDetachedTask): Renamed from pauseAfterDetachedTimerFired.
        (WebCore::HTMLMediaElement::removedFrom):
        (WebCore::HTMLMediaElement::contextDestroyed):
        * html/HTMLMediaElement.h:
        * html/HTMLMediaElement.idl:
        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

2016-05-10  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r200627.
        https://bugs.webkit.org/show_bug.cgi?id=157531

        This change has caused crashes in existing LayoutTests
        (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "Return a Promise from HTMLMediaElement.play()"
        https://bugs.webkit.org/show_bug.cgi?id=157400
        http://trac.webkit.org/changeset/200627

2016-05-10  Simon Fraser  <simon.fraser@apple.com>

        Fix scrolling tree dumping
        https://bugs.webkit.org/show_bug.cgi?id=157529

        Reviewed by Tim Horton.

        Scrolling tree dumps cannot contain layerIDs because they are not stable between
        runs. Fix by adding ScrollingStateTreeAsTextBehavior flags, and not dumping
        the layerID for tests.

        Sadly RemoteScrollingCoordinatorTransaction has a lot of duplicated code for dumping
        the scrolling state tree, which should be converted to dumpProperties() at some point.
        
        Fix the one test that suffered from this problem, and unskip it.

        Test: fast/scrolling/ios/remove-scrolling-role.html

        * page/scrolling/ScrollingStateFixedNode.cpp:
        (WebCore::ScrollingStateFixedNode::dumpProperties):
        * page/scrolling/ScrollingStateFixedNode.h:
        * page/scrolling/ScrollingStateFrameScrollingNode.cpp:
        (WebCore::ScrollingStateFrameScrollingNode::dumpProperties):
        * page/scrolling/ScrollingStateFrameScrollingNode.h:
        * page/scrolling/ScrollingStateNode.cpp:
        (WebCore::ScrollingStateNode::dump):
        (WebCore::ScrollingStateNode::scrollingStateTreeAsText):
        * page/scrolling/ScrollingStateNode.h:
        * page/scrolling/ScrollingStateOverflowScrollingNode.cpp:
        (WebCore::ScrollingStateOverflowScrollingNode::dumpProperties):
        * page/scrolling/ScrollingStateOverflowScrollingNode.h:
        * page/scrolling/ScrollingStateScrollingNode.cpp:
        (WebCore::ScrollingStateScrollingNode::dumpProperties):
        * page/scrolling/ScrollingStateScrollingNode.h:
        * page/scrolling/ScrollingStateStickyNode.cpp:
        (WebCore::ScrollingStateStickyNode::dumpProperties):
        * page/scrolling/ScrollingStateStickyNode.h:

2016-05-10  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !ENABLE(CSS_REGIONS) build after r198990
        https://bugs.webkit.org/show_bug.cgi?id=157516

        Reviewed by Ryosuke Niwa.

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::affectsRenderedSubtree):

2016-05-05  Jer Noble  <jer.noble@apple.com>

        Return a Promise from HTMLMediaElement.play()
        https://bugs.webkit.org/show_bug.cgi?id=157400

        Reviewed by Eric Carlson.

        Tests: media/media-play-promise-reject-error-notsupported.html
               media/media-play-promise-reject-load-abort.html
               media/media-play-promise-reject-pause-abort.html
               media/media-play-promise-reject-play-notallowed.html
               media/media-play-promise-reject-play-notsupported.html
               media/media-play-promise-resolve-when-playing.html
               media/media-play-promise-resolve.html

        The HTML Living Standard Spec <https://html.spec.whatwg.org/multipage/embedded-content.html>
        (5 May 2016) adds support for a Promise to be returned by the play() method, to be resolved
        or rejected at defined points during loading and playback.

        Add utility methods which encapsulate the definitions of the equivalent algorithms from the
        HTML Spec.  Add a new, overloaded play() method on HTMLMediaElement which takes a DeferredWrapper
        reference.

        After the change to use scheduleNotifyAboutPlaying() instead of enqueueing the "playing" event
        directly, we must ensure that the notifyAboutPlaying() task does not get fired before the
        "play" event preceeding it does. So re-implement GenericEventQueue (which previously used
        a timer to dispatch events) to use a GenericTaskQueue instead. This ensures that all tasks and
        events are interleaved in the order in which they were enqueued.

        Additionally, the new pauseAfterDetachedTimerFired() event was firing out of microtask order, which
        broke some W3C tests after the changes to GenericEventQueue. Move GenericEventQueue and
        GenericTaskQueue to the same timing source (namely, a WebCore Timer) and interleave Events
        and Tasks by having GenericEventQueue use GenericTaskQueue to issue its Events. Because
        Document::postTask() cannot ensure ordering with Timer-based events, switch HTMLMediaElement
        over to Timer-backed GenericTaskQueues.

        * dom/GenericEventQueue.cpp:
        (WebCore::GenericEventQueue::GenericEventQueue):
        (WebCore::GenericEventQueue::enqueueEvent):
        (WebCore::GenericEventQueue::close):
        (WebCore::GenericEventQueue::cancelAllEvents):
        (WebCore::GenericEventQueue::suspend):
        (WebCore::GenericEventQueue::resume):
        (WebCore::GenericEventQueue::sharedTimer): Deleted.
        (WebCore::GenericEventQueue::sharedTimerFired): Deleted.
        (WebCore::GenericEventQueue::pendingQueues): Deleted.
        * dom/GenericEventQueue.h:
        * platform/GenericTaskQueue.cpp: Added.
        (WebCore::TaskDispatcher<Timer>::~TaskDispatcher):
        (WebCore::TaskDispatcher<Timer>::postTask):
        (WebCore::TaskDispatcher<Timer>::sharedTimer):
        (WebCore::TaskDispatcher<Timer>::sharedTimerFired):
        (WebCore::TaskDispatcher<Timer>::pendingDispatchers):
        (WebCore::TaskDispatcher<Timer>::dispatchOneTask):
        * platform/GenericTaskQueue.h:
        (WebCore::TaskDispatcher<Timer>::TaskDispatcher): Deleted.
        (WebCore::TaskDispatcher<Timer>::postTask): Deleted.
        (WebCore::TaskDispatcher<Timer>::timerFired): Deleted.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::~HTMLMediaElement):
        (WebCore::HTMLMediaElement::scheduleResolvePendingPlayPromises):
        (WebCore::HTMLMediaElement::rejectPendingPlayPromises):
        (WebCore::HTMLMediaElement::resolvePendingPlayPromises):
        (WebCore::HTMLMediaElement::scheduleNotifyAboutPlaying):
        (WebCore::HTMLMediaElement::notifyAboutPlaying):
        (WebCore::HTMLMediaElement::noneSupported):
        (WebCore::HTMLMediaElement::cancelPendingEventsAndCallbacks):
        (WebCore::HTMLMediaElement::setReadyState):
        (WebCore::HTMLMediaElement::play):
        (WebCore::HTMLMediaElement::playInternal):
        (WebCore::HTMLMediaElement::pauseInternal):
        (WebCore::HTMLMediaElement::contextDestroyed):
        (WebCore::HTMLMediaElement::stop):
        (WebCore::HTMLMediaElement::pauseAfterDetachedTask): Renamed from pauseAfterDetachedTimerFired.
        (WebCore::HTMLMediaElement::removedFrom):
        (WebCore::HTMLMediaElement::contextDestroyed):
        * html/HTMLMediaElement.h:
        * html/HTMLMediaElement.idl:
        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

2016-05-10  Chris Dumez  <cdumez@apple.com>

        Get rid of a lot of calls to RefPtr::release()
        https://bugs.webkit.org/show_bug.cgi?id=157505

        Reviewed by Alex Christensen.

        Get rid of a lot of calls to RefPtr::release() and use WTFMove() instead.

        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::addKeyTimerFired):
        (WebCore::MediaKeySession::sendMessage):
        (WebCore::MediaKeySession::sendError):
        * Modules/geolocation/Geolocation.cpp:
        (WebCore::createGeoposition):
        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
        (WebCore::DOMWindowIndexedDatabase::disconnectFrameForDocumentSuspension):
        (WebCore::DOMWindowIndexedDatabase::reconnectFrameFromDocumentSuspension):
        * Modules/indexeddb/IDBKey.h:
        (WebCore::IDBKey::createMultiEntryArray):
        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::scheduleEvent):
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::scheduleEvent):
        * Modules/mediasource/SourceBufferList.cpp:
        (WebCore::SourceBufferList::scheduleEvent):
        * Modules/notifications/DOMWindowNotifications.cpp:
        (WebCore::DOMWindowNotifications::disconnectFrameForDocumentSuspension):
        (WebCore::DOMWindowNotifications::reconnectFrameFromDocumentSuspension):
        * Modules/webdatabase/DatabaseManager.cpp:
        (WebCore::DatabaseManager::openDatabaseBackend):
        * Modules/webdatabase/DatabaseManager.h:
        * Modules/webdatabase/SQLCallbackWrapper.h:
        (WebCore::SQLCallbackWrapper::unwrap):
        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::enqueueTextFrame):
        (WebCore::WebSocketChannel::enqueueRawFrame):
        (WebCore::WebSocketChannel::enqueueBlobFrame):
        (WebCore::WebSocketChannel::processOutgoingFrameQueue):
        * bindings/js/JSBlobCustom.cpp:
        (WebCore::constructJSBlob):
        * bindings/js/JSGeolocationCustom.cpp:
        (WebCore::createPositionOptions):
        (WebCore::JSGeolocation::getCurrentPosition):
        (WebCore::JSGeolocation::watchPosition):
        * bindings/js/JSMessagePortCustom.cpp:
        (WebCore::fillMessagePortArray):
        * bindings/js/JSSQLTransactionCustom.cpp:
        (WebCore::JSSQLTransaction::executeSql):
        * bindings/js/ScriptControllerMac.mm:
        (WebCore::ScriptController::createScriptInstanceForWidget):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateCallWith):
        * crypto/mac/CryptoKeyRSAMac.cpp:
        (WebCore::CryptoKeyRSA::generatePair):
        * css/CSSBasicShapes.cpp:
        (WebCore::buildSerializablePositionOffset):
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::valueForNinePieceImageRepeat):
        (WebCore::counterToCSSValue):
        (WebCore::ComputedStyleExtractor::propertyValue):
        * css/CSSContentDistributionValue.cpp:
        (WebCore::CSSContentDistributionValue::customCSSText):
        * css/CSSFilterImageValue.cpp:
        (WebCore::CSSFilterImageValue::image):
        * css/CSSFilterImageValue.h:
        * css/CSSGrammar.y.in:
        * css/CSSNamedImageValue.cpp:
        (WebCore::CSSNamedImageValue::image):
        * css/CSSNamedImageValue.h:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFillProperty):
        (WebCore::CSSParser::parseAnimationProperty):
        (WebCore::CSSParser::parseInsetRoundedCorners):
        (WebCore::ShadowParseContext::commitLength):
        (WebCore::CSSParser::parseShadow):
        (WebCore::BorderImageSliceParseContext::commitNumber):
        (WebCore::BorderImageQuadParseContext::commitNumber):
        (WebCore::CSSParser::parseBorderRadius):
        (WebCore::CSSParser::parseCounter):
        (WebCore::CSSParser::parseDeprecatedGradient):
        (WebCore::CSSParser::parseDeprecatedLinearGradient):
        (WebCore::CSSParser::parseDeprecatedRadialGradient):
        (WebCore::CSSParser::parseLinearGradient):
        (WebCore::CSSParser::parseRadialGradient):
        (WebCore::CSSParser::parseTransformValue):
        (WebCore::CSSParser::parseBuiltinFilterArguments):
        (WebCore::CSSParser::parseTextIndent):
        (WebCore::CSSParser::popRuleData):
        (WebCore::CSSParser::markRuleHeaderStart):
        (WebCore::CSSParser::createViewportRule):
        * css/CSSParser.h:
        * css/CSSParserValues.cpp:
        (WebCore::CSSParserValue::createCSSValue):
        * css/CSSParserValues.h:
        * css/CSSValueList.cpp:
        (WebCore::CSSValueList::copy):
        * css/CSSValueList.h:
        * css/SVGCSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::svgPropertyValue):
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertClipPath):
        (WebCore::StyleBuilderConverter::convertReflection):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::cachedOrPendingFromValue):
        (WebCore::StyleResolver::setOrPendingFromValue):
        (WebCore::StyleResolver::cursorOrPendingFromValue):
        * css/StyleResolver.h:
        * css/StyleRule.cpp:
        (WebCore::StyleRuleBase::createCSSOMWrapper):
        * css/StyleRule.h:
        * dom/Attr.cpp:
        (WebCore::Attr::create):
        * dom/Attr.h:
        * dom/ContainerNode.h:
        (WebCore::ChildNodesLazySnapshot::nextNode):
        * dom/Document.cpp:
        (WebCore::Document::setFocusedElement):
        (WebCore::Document::takeDOMWindowFrom):
        (WebCore::Document::updateHoverActiveState):
        * dom/Element.cpp:
        (WebCore::Element::detachAttribute):
        (WebCore::Element::setAttributeNodeNS):
        (WebCore::Element::ensureAttr):
        * dom/Element.h:
        * dom/MessagePort.cpp:
        (WebCore::MessagePort::dispatchMessages):
        (WebCore::MessagePort::entanglePorts):
        * dom/NodeIterator.cpp:
        (WebCore::NodeIterator::nextNode):
        (WebCore::NodeIterator::previousNode):
        * dom/Range.cpp:
        (WebCore::Range::processContentsBetweenOffsets):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::rebuildPresentationAttributeStyle):
        * editing/ApplyBlockElementCommand.cpp:
        (WebCore::ApplyBlockElementCommand::createBlockElement):
        * editing/ApplyBlockElementCommand.h:
        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::applyCommandToComposite):
        (WebCore::CompositeEditCommand::appendBlockPlaceholder):
        (WebCore::CompositeEditCommand::insertBlockPlaceholder):
        (WebCore::CompositeEditCommand::addBlockPlaceholderIfNeeded):
        (WebCore::CompositeEditCommand::insertNewDefaultParagraphElementAt):
        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary):
        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement):
        (WebCore::CompositeEditCommand::moveParagraphs):
        * editing/CompositeEditCommand.h:
        * editing/EditingStyle.cpp:
        (WebCore::EditingStyle::wrappingStyleForSerialization):
        (WebCore::styleFromMatchedRulesForElement):
        (WebCore::extractPropertiesNotIn):
        (WebCore::backgroundColorInEffect):
        * editing/EditingStyle.h:
        * editing/Editor.cpp:
        (WebCore::Editor::increaseSelectionListLevel):
        (WebCore::Editor::increaseSelectionListLevelOrdered):
        (WebCore::Editor::increaseSelectionListLevelUnordered):
        (WebCore::Editor::findStringAndScrollToVisible):
        (WebCore::Editor::rangeOfString):
        * editing/Editor.h:
        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock):
        * editing/InsertParagraphSeparatorCommand.h:
        * editing/MergeIdenticalElementsCommand.cpp:
        (WebCore::MergeIdenticalElementsCommand::doUnapply):
        * editing/ModifySelectionListLevel.cpp:
        (WebCore::IncreaseSelectionListLevelCommand::doApply):
        (WebCore::IncreaseSelectionListLevelCommand::increaseSelectionListLevel):
        * editing/ModifySelectionListLevel.h:
        * editing/RemoveNodeCommand.cpp:
        (WebCore::RemoveNodeCommand::doUnapply):
        * editing/RemoveNodePreservingChildrenCommand.cpp:
        (WebCore::RemoveNodePreservingChildrenCommand::doApply):
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplacementFragment::insertFragmentForTestRendering):
        * editing/SpellingCorrectionCommand.cpp:
        (WebCore::SpellingCorrectionCommand::doApply):
        * editing/mac/DictionaryLookup.h:
        * editing/mac/DictionaryLookup.mm:
        (WebCore::DictionaryLookup::rangeForSelection):
        (WebCore::DictionaryLookup::rangeAtHitTestResult):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::finishRequestAutocomplete):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::scheduleEvent):
        (WebCore::HTMLMediaElement::updateActiveTextTrackCues):
        (WebCore::HTMLMediaElement::mediaPlayerKeyNeeded):
        (WebCore::HTMLMediaElement::addTextTrack):
        (WebCore::HTMLMediaElement::enqueuePlaybackTargetAvailabilityChangedEvent):
        * html/HTMLMediaElement.h:
        * html/canvas/OESVertexArrayObject.cpp:
        (WebCore::OESVertexArrayObject::createVertexArrayOES):
        * html/canvas/OESVertexArrayObject.h:
        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::getContextAttributes):
        * html/canvas/WebGLRenderingContextBase.h:
        * html/track/VTTCue.cpp:
        (WebCore::VTTCue::getCueAsHTML):
        (WebCore::VTTCue::createCueRenderingTree):
        * html/track/VTTCue.h:
        * html/track/WebVTTElement.cpp:
        (WebCore::WebVTTElement::createEquivalentHTMLElement):
        * html/track/WebVTTElement.h:
        * html/track/WebVTTParser.cpp:
        (WebCore::WebVTTTreeBuilder::buildFromString):
        (WebCore::WebVTTParser::createDocumentFragmentFromCueText):
        * html/track/WebVTTParser.h:

2016-05-05  Gavin Barraclough  <barraclough@apple.com>

        Allow some leeway after page load before throttling, to allow post load events to complete.
        https://bugs.webkit.org/show_bug.cgi?id=157499

        Reviewed by Ryosuke Niwa

        * page/PageThrottler.cpp:
        (WebCore::PageThrottler::PageThrottler):
            - m_pageLoadActivityCounter now affects activity state indirecty, via m_pageLoadActivityHysteresis.
        (WebCore::PageThrottler::pageLoadActivityCounterChanged):
            - counter updates hysteresis object, which in turn will affect activity state.
        * page/PageThrottler.h:
            - added m_pageLoadActivityHysteresis, pageLoadActivityCounterChanged.

2016-05-10  Zalan Bujtas  <zalan@apple.com>

        REGRESSION (r193610): Drop down menu doesn’t expand at allofbach.com
        https://bugs.webkit.org/show_bug.cgi?id=157445

        Reviewed by Simon Fraser.

        When we don't run transitions (becasuse of to/from 'auto' values) we should also not
        report the 'from' value and behave as if we finished the transition already.

        Test: fast/animation/height-auto-transition-computed-value.html

        * page/animation/KeyframeAnimation.cpp:
        (WebCore::KeyframeAnimation::fetchIntervalEndpointsForProperty): This is a revert of
        looping the 'to' value back to the first keyframe when reverse animation is at the start value (last keyframe).

        * platform/Length.cpp:
        (WebCore::blend):

2016-05-09  Dean Jackson  <dino@apple.com>

        [iOS] <select> elements should render right-aligned when in RTL mode
        https://bugs.webkit.org/show_bug.cgi?id=157501
        <rdar://problem/26187870>

        Reviewed by Antoine Quint.

        This is the equivalent of http://webkit.org/b/157112 for iOS.
        Handle <select> elements when we're in RTL mode. This means
        drawing the button with the drop-down arrow on the left
        side, and the button text right-aligned.

        Test: fast/forms/select-non-native-rendering-direction.html
        plus a bunch of other ones that needed rebaselining.

        * rendering/RenderThemeIOS.mm: Rename MenuListButtonPaddingRight to MenuListButtonPaddingAfter.
        (WebCore::RenderThemeIOS::popupInternalPaddingBox): Handle both directions.
        (WebCore::adjustInputElementButtonStyle):
        (WebCore::RenderThemeIOS::paintMenuListButtonDecorations): Handle drawing in
        RTL mode.

2016-05-10  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        NodeList should be iterable
        https://bugs.webkit.org/show_bug.cgi?id=131443
        <rdar://problem/25731519>

        Reviewed by Darin Adler.

        Test: fast/dom/nodeListIterator.html

        Updating JSKeyValueIterator to support map and set iterators,
        depending on the signature of the result type of DOMClass::Iterator::next method.
        Symbol.iterator method is made the same as values method for set iterators.

        Adding support for NodeList.
        Updating FontFaceSet to take benefit of that. 

        * bindings/js/JSDOMBinding.h:
        (WebCore::jsPair):.
        * bindings/js/JSKeyValueIterator.h:
        (WebCore::IteratorInspector::decltype): IteratorInspector detects whether the iterator is a set or map iterator.
        (WebCore::IteratorInspector::test):
        (WebCore::fillForEachArgumentsWithIteratorValue): Specializing according set/map iterator.
        (WebCore::iteratorValueToJS): Ditto.
        (WebCore::keyValueIteratorForEach):
        (WebCore::JSKeyValueIterator<JSWrapper>::next):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementationIterableFunctions): Removed the line forbidding set iterators.
        Making Symbol.iterator function equal to values for set iterators.
        * bindings/scripts/test/JS/JSTestNode.cpp: Rebasing with set iterator functions.
        * bindings/scripts/test/JS/JSTestObj.cpp: Rebasing according updated function names.
        * bindings/scripts/test/TestNode.idl: Making TestNode set iterable.
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::Iterator::next): Refactoring to make it a set iterator.
        * css/FontFaceSet.h:
        * css/FontFaceSet.idl:
        * dom/NodeList.h: Making NodeList iterable.
        (WebCore::NodeList::Iterator::Iterator):
        (WebCore::NodeList::Iterator::next):
        (WebCore::NodeList::createIterator):
        * dom/NodeList.idl:

2016-05-09  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Implement auto-repeat computation
        https://bugs.webkit.org/show_bug.cgi?id=157473

        Reviewed by Darin Adler.

        We added support for parsing and style for the new auto-repeat syntax. This patch actually
        implements the feature by computing the number of auto-repeat tracks that will be part of
        the explicit grid depending on the available size on the corresponding axis.

        Note that we still do not drop the empty tracks, i.e., auto-fit will work exactly as
        auto-fill until the empty track removal is implemented.

        Some test results are not totally correct yet because we need to add the line names to the
        computed style. As that requires a rather large piece of code it will be done in a follow up
        patch. Track sizes are correct though.

        Tests: fast/css-grid-layout/grid-auto-fill-columns.html
               fast/css-grid-layout/grid-auto-fill-rows.html
               fast/css-grid-layout/grid-change-auto-repeat-tracks.html
               fast/css-grid-layout/mozilla/grid-repeat-auto-fill-fit-001.html
               fast/css-grid-layout/mozilla/grid-repeat-auto-fill-fit-002.html
               fast/css-grid-layout/mozilla/grid-repeat-auto-fill-fit-003.html
               fast/css-grid-layout/mozilla/grid-repeat-auto-fill-fit-004.html
               fast/css-grid-layout/mozilla/grid-repeat-auto-fill-fit-005.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTrackRepeatFunction): Add the CSSAutoRepeatValue directly
        instead of adding the track size.
        * css/StyleBuilderCustom.h: Store the insertion point in style.
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::guttersSize): Replaced size_t by unsigned.
        (WebCore::RenderGrid::rawGridTrackSize): New function which retrieves the track size from
        either explicit (including auto-repeat tracks) or implicit tracks.
        (WebCore::RenderGrid::gridTrackSize): Use rawGridTrackSize().
        (WebCore::RenderGrid::computeAutoRepeatTracksCount): This is the core of the patch. This
        method computes the number of auto-repeat tracks that fits on the available size for a given
        axis (or 1 if that's indefinite).
        * rendering/RenderGrid.h:

2016-05-09  Alex Christensen  <achristensen@webkit.org>

        Fix GTK build after r200607

        * Modules/notifications/Notification.h:
        dir and replaceId are used in WebNotificationManager with NOTIFICATIONS and with LEGACY_NOTIFICATIONS

2016-05-09  Simon Fraser  <simon.fraser@apple.com>

        Fix the Windows build after r200602, and do some minor tidyup.

        * platform/graphics/ca/PlatformCALayer.h:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (PlatformCALayerCocoa::contentsHidden):
        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
        (PlatformCALayerWin::contentsHidden):
        (PlatformCALayerWin::setContentsHidden):
        * platform/graphics/ca/win/PlatformCALayerWin.h:

2016-05-09  Darin Adler  <darin@apple.com>

        Change Notification constructor to take an IDL dictionary instead of a WebCore::Dictionary
        https://bugs.webkit.org/show_bug.cgi?id=157466

        Reviewed by Alex Christensen.

        * Modules/notifications/Notification.cpp: Got rid of unneeded includes.
        (WebCore::Notification::Notification): Deleted the unused default constructor. Changed
        NotificationCenter argument to be reference rather than PassRefPtr. Changed one of the
        ScriptExecutionContext arguments to be a Document since the code relies on that already.
        Used the lambda form of timer creation instead of the class member form. Added a FIXME
        about when m_notificationCenter can be null.
        (WebCore::Notification::create): Changed NotificationCenter argument to be reference
        rather than PassRefPtr. Changed options argument to be Options rather than Dictionary.
        (WebCore::directionString): Added. Helper because the class still wants to store the
        direction as a string, at least for now.
        (WebCore::Notification::show): Streamlined the code a bit.
        (WebCore::Notification::taskTimerFired): Deleted. Not needed now that we use a lambda
        inside the constructor.
        (WebCore::Notification::permission): Removed unneeded const from return type.
        (WebCore::Notification::permissionString): Ditto.

        * Modules/notifications/Notification.h: Used pragma once, updated for changes above.
        Removed a number of unused functions, including cancel, setIconURL, setLang,
        stopLoadingIcon, detachPresenter, setBody, startLoadingIcon, finishLoadingIcon, and
        taskTimerFired.

        * Modules/notifications/Notification.idl: Add NotificationOptions and pass it instead
        of Dictionary to the constructor. Note that this is only a subset of what is
        currently specified in the Notifications API document. The latest document specifies
        a much more complex feature with lots more options.

        * Modules/notifications/NotificationCenter.cpp:
        (WebCore::NotificationCenter::createNotification): Pass a reference rather than a
        pointer to this.
        * Modules/notifications/NotificationClient.h: Use pragma once. Removed unneeded
        includes and forward declarations. Fixed #if to be easier to read.

        * bindings/js/JSDOMConvert.h: Reworked the convert functions to use Converter and
        DefaultConverter structs so we can do partial specialization in the future and so
        we can get custom types for optional values. Used this to make an optional String
        just be a null String, so it won't try to use Optional<String> instead. Might get
        more complex latter when we add support for nullable.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateEnumerationImplementationContent): Generate a blank line to make the output
        slightly clearer. Tweaked a comment.
        (GenerateDefaultValue): Added. Converts the default syntax from IDL into the syntax
        needed in C++ code.
        (GenerateDefaultValueWithLeadingComma): Added. Helper for use below.
        (GenerateDictionaryImplementationContent): Use GenerateDefaultValue and
        GenerateDefaultValueWithLeadingComma to make default values.
        (GenerateParametersCheck): Use GenerateDefaultValue here in the enumeration code
        path. This is a step in the direction of being able to make the whole thing more
        generic in the future.

        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        Regenerated.

        * bindings/scripts/test/TestObj.idl: Simplified and extended some of the test cases
        to cover more combinations of the dictionary and enumeration support.

2016-05-09  Brady Eidson  <beidson@apple.com>

        Modern IDB: Have server database connections remember the OpenDB request that spawned them.
        https://bugs.webkit.org/show_bug.cgi?id=157498

        Reviewed by Tim Horton.

        No new tests (No testable change in behavior, debug only for now).

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation):
        
        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::create):
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::UniqueIDBDatabaseConnection):
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::connectionClosedFromClient):
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::didFireVersionChangeEvent):
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::createVersionChangeTransaction):
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::establishTransaction):
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::didAbortTransaction):
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::didCommitTransaction):
        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.h:
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::openRequestIdentifier):

2016-05-09  Simon Fraser  <simon.fraser@apple.com>

        [iOS] visibility:hidden -webkit-overflow-scrolling: touch divs can interfere with page scrolling
        https://bugs.webkit.org/show_bug.cgi?id=157496

        Reviewed by Tim Horton.

        UIScrollViews are constructed in the UI process for visibility:hidden scrollable elements
        with -webkit-overflow-scrolling: touch, and these intercept user events when they should not.

        Fix by propagating a "contentsHidden" flag from the web process which is used to turn off
        user interaction on these views.

        Test: fast/scrolling/ios/touch-scroll-visibility-hidden.html

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::updateContentsVisibility): We have to tell the scrolling layer
        if we have visibility:hidden.
        * platform/graphics/ca/PlatformCALayer.h:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.h:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (PlatformCALayerCocoa::contentsHidden):
        (PlatformCALayerCocoa::setContentsHidden):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateAfterDescendants):

2016-05-09  Myles C. Maxfield  <mmaxfield@apple.com>

        Web Font is downloaded even when all the characters in the document are outside its unicode-range
        https://bugs.webkit.org/show_bug.cgi?id=42154
        <rdar://problem/17779042>

        Reviewed by Darin Adler.

        Fonts are requested in two stages:
        - For a given font family, all the relevant @font-face rules are consulted. We build up a
        mapping of unicode-range -> Font object. This result is cached.
        - Then, when we have the mapping, we look up the character we are trying to render to
        find the appropriate Font object.

        However, we are not supposed to create any Font objects (because that causes a download to
        be triggered) until we consult with the character we're trying to render. Therefore, this
        patch swaps out the Font objects with a FontAccessor. This FontAccessor is essentially a
        lazily-created Font. When step 2 starts looking up the appropriate character, the
        FontAccessor will be asked to start the download.

        Test: fast/text/unicode-range-download.html

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::removeClient): 
        as a client from all its CSSFontFaces.
        * css/CSSFontFaceSet.cpp:
        (WebCore::CSSFontFaceSet::clear): Clearing the CSSFontFaceSet needs to remove itself as a
        client from all its CSSFontFaces.
        * css/CSSSegmentedFontFace.cpp:
        (WebCore::CSSFontAccessor::create): The lazy Font object.
        (WebCore::CSSFontAccessor::CSSFontAccessor): Ditto.
        (WebCore::appendFontWithInvalidUnicodeRangeIfLoading): Appends a FontAccessor.
        (WebCore::CSSSegmentedFontFace::fontRanges): Create the FontAccessor and use it instead.
        * platform/graphics/FontCascadeFonts.cpp:
        (WebCore::FontCascadeFonts::determinePitch): Use the fontForFirstRange() convenience
        function.
        (WebCore::glyphPageFromFontRanges): font() may now return nullptr. Update this function to
        handle that.
        * platform/graphics/FontRanges.cpp:
        (WebCore::FontRanges::Range::font): Trigger the lazy initialization.
        (WebCore::TrivialFontAccessor::create): Used in the case where there is only one font in
        the Ranges object and it has a full unicode-range.
        (WebCore::TrivialFontAccessor::TrivialFontAccessor):
        (WebCore::FontRanges::FontRanges): Use TrivialFontAccessor.
        (WebCore::FontRanges::glyphDataForCharacter): font() may now return nullptr. Update this
        function to handle that. This is where the magic happens: this is where we trigger
        downloads only if the character falls within the unicode-range.
        (WebCore::FontRanges::fontForFirstRange): Add ASSERT.
        (WebCore::FontRanges::isLoading): Update to use the new FontAccessor.
        * platform/graphics/FontRanges.h: Ditto.
        (WebCore::FontRanges::Range::Range):
        (WebCore::FontRanges::Range::fontAccessor):
        (WebCore::FontRanges::appendRange):
        (WebCore::FontRanges::Range::font): Deleted.
        * platform/graphics/FontSelector.h: The virtual base class of FontAccessor. This is
        necessary because it must be shared between platform code and non-platform code.
        (WebCore::FontAccessor::~FontAccessor):

2016-05-09  Brady Eidson  <beidson@apple.com>

        Modern IDB: Prevent the same transaction from being commited/aborted twice.
        https://bugs.webkit.org/show_bug.cgi?id=157494

        Reviewed by Tim Horton.

        When a page navigates or a worker terminates, in rare cases with specific unfortunate timing, the IDBServer
        might receive a request to commit/abort a transaction that is already in the process of committing/aborting.
        
        By moving transactions that are finishing into their own map we can at least detect this situation and
        return an error. This seems like an improvement over some mysterious ASSERTs/timeouts.

        No new tests:
        While apparent that this is at least partially to blame for some existing timeouts/ASSERTs, I could not nail 
        down a reliable way to reproduce this with a dedicated test.
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::~UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::prepareToFinishTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::commitTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformCommitTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::abortTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformAbortTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::hasUnfinishedTransactions):
        (WebCore::IDBServer::UniqueIDBDatabase::operationAndTransactionTimerFired):
        (WebCore::IDBServer::UniqueIDBDatabase::takeNextRunnableTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::transactionCompleted): Renamed from inProgressTransactionCompleted.
        (WebCore::IDBServer::UniqueIDBDatabase::inProgressTransactionCompleted): Deleted.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2016-05-09  Tim Horton  <timothy_horton@apple.com>

        Draw border and correct icon for placeholder attachments
        https://bugs.webkit.org/show_bug.cgi?id=157495
        rdar://problem/19982510

        Reviewed by Anders Carlsson.

        * Resources/AttachmentPlaceholder.png: Added.
        * Resources/AttachmentPlaceholder@2x.png: Added.
        * WebCore.xcodeproj/project.pbxproj:
        * rendering/RenderThemeMac.mm:
        (WebCore::attachmentPlaceholderBorderColor):
        (WebCore::paintAttachmentIconPlaceholder):
        (WebCore::paintAttachmentProgress):
        (WebCore::paintAttachmentPlaceholderBorder):
        (WebCore::RenderThemeMac::paintAttachment):
        If progress is set, but set to 0, draw a dashed border around the attachment
        and use the placeholder "download" artwork.

2016-05-09  Ada Chan  <adachan@apple.com>

        Introduce WebVideoFullscreenInterfaceMac::isPlayingVideoInEnhancedFullscreen() and use it in WebVideoFullscreenManagerProxy::isPlayingVideoInEnhancedFullscreen()
        https://bugs.webkit.org/show_bug.cgi?id=157493

        Reviewed by Dan Bernstein.

        * platform/mac/WebVideoFullscreenInterfaceMac.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::isPlayingVideoInEnhancedFullscreen):

2016-05-09  Simon Fraser  <simon.fraser@apple.com>

        Clean up iOS text autosizing code
        https://bugs.webkit.org/show_bug.cgi?id=157489

        Reviewed by Zalan Bujtas.

        Change the TraverseNextInclusionFunction and HeightTypeTraverseNextInclusionFunction
        to take references.
        
        Use downcast<> more.
        
        Whitespace cleanup.

        * rendering/RenderBlockFlow.cpp:
        (WebCore::isNonBlocksOrNonFixedHeightListItems):
        * rendering/RenderElement.cpp:
        (WebCore::includeNonFixedHeight):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::traverseNext):
        * rendering/RenderObject.h:
        * rendering/TextAutoSizing.cpp:
        (WebCore::TextAutoSizingValue::adjustNodeSizes):
        (WebCore::TextAutoSizingValue::reset):

2016-05-09  Anders Carlsson  <andersca@apple.com>

        Add injected bundle SPI for getting favicon and touch icon URLs
        https://bugs.webkit.org/show_bug.cgi?id=157435

        Reviewed by Darin Adler.

        * CMakeLists.txt:
        Add new files.

        * WebCore.xcodeproj/project.pbxproj:
        Add new files.

        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::iconType):
        * html/HTMLLinkElement.h:
        Rename LinkRelAttribute::IconType to LinkIconType.

        * html/LinkIconCollector.cpp: Added.
        (WebCore::iconSize):
        New helper function that returns the icon size for an icon.

        (WebCore::compareIcons):
        Icon comparison function, to be used by for sorting.

        (LinkIconCollector::iconsOfTypes):
        Gather the right icons, sort them (descending by size) and return them.

        * html/LinkIconCollector.h:
        Added.

        * html/LinkIconType.h:
        Move icon type declarations here and arrange them so we can use them in an OptionSet.

        * html/LinkRelAttribute.cpp:
        (WebCore::LinkRelAttribute::LinkRelAttribute):
        * html/LinkRelAttribute.h:
        * loader/icon/IconController.cpp:
        (WebCore::iconFromLinkElements):
        Rename IconType to LinkIconType.

2016-05-06  Simon Fraser  <simon.fraser@apple.com>

        [iOS WK2] Font size increases on some pages after navigating then going back
        https://bugs.webkit.org/show_bug.cgi?id=157441
        rdar://problem/22873240

        Reviewed by Darin Adler.

        Sometimes I want to dump ViewportConfigurations from WebKit2 so export dump().

        Test: fast/text-autosizing/ios/text-autosizing-after-back.html

        * page/ViewportConfiguration.h:

2016-05-09  Eric Carlson  <eric.carlson@apple.com>

        "Main content" restrictions should not apply to media documents
        https://bugs.webkit.org/show_bug.cgi?id=157479
        <rdar://problem/25840861>

        Reviewed by Jer Noble.

        No new tests, this change only applies to media documents in a top level document so it
        isn't possible to have a layout test.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement): Don't apply restrictions to a media document.

2016-05-09  Dean Jackson  <dino@apple.com>

        Update Picture-in-picture artwork
        https://bugs.webkit.org/show_bug.cgi?id=157484
        <rdar://problem/26177784>

        Reviewed by Eric Carlson.

        We have new artwork for the picture-in-picture presentation mode. I
        also converted it to use SVG (and moved the button style to a
        more consistent part of the file).

        * Modules/mediacontrols/mediaControlsApple.css:
        (video::-webkit-media-controls-panel .picture-in-picture-button):
        (video::-webkit-media-controls-panel .picture-in-picture-button.return-from-picture-in-picture):
        (video::-webkit-media-controls-panel .picture-in-picture-button:active):
        (video::-webkit-media-controls-panel .picture-in-picture-button.return-from-picture-in-picture:active):

2016-05-09  Chris Dumez  <cdumez@apple.com>

        Optimize [StrictTypeChecking] on IDL operations
        https://bugs.webkit.org/show_bug.cgi?id=157467

        Reviewed by Darin Adler.

        Optimize [StrictTypeChecking] on IDL operations so that:
        - Only generate extra code for nullable parameters because for non-nullable
          parameters, JSXXX::toWrapped() will return null in case of a bad input
          type. We will then throw a TypeError when null-checking it already.
        - After the JSValue::isNullOrUndefined() check, avoid calling
          JSXXX::toWrapped() and set nativeValue to nullptr directly.
        - Drop the check for JSValue::inherits(JSXXX::info()) and just do a null
          check on the value returned by JSXXX::toWrapped(). toWrapped() already
          does a JSValue::inherits(JSXXX::info() check. Since we only call
          toWrapped() if the JSValue is not null/undefined, a null return value
          always indicates a bad input type.

        Also update the TypeError message to be more useful when passing null
        for non-nullable parameters or assigning null to a non-nullable
        attribute. The message is now consistent with the one used for strict
        type checking.

        No new tests, rebaselined existing tests.

        * bindings/js/JSDOMBinding.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        (GenerateParametersCheck):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::setJSTestInterfaceImplementsNode):
        (WebCore::setJSTestInterfaceSupplementalNode):
        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod2):
        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjTestObjAttr):
        (WebCore::setJSTestObjLenientTestObjAttr):
        (WebCore::setJSTestObjXMLObjAttr):
        (WebCore::setJSTestObjTypedArrayAttr):
        (WebCore::setJSTestObjWithScriptExecutionContextAttribute):
        (WebCore::setJSTestObjWithScriptStateAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
        (WebCore::setJSTestObjWithScriptArgumentsAndCallStackAttribute):
        (WebCore::jsTestObjPrototypeFunctionVoidMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionByteMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionOctetMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionLongMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionMethodWithXPathNSResolverParameter):
        (WebCore::jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod8):
        (WebCore::jsTestObjPrototypeFunctionDomStringListFunction):
        (WebCore::jsTestObjPrototypeFunctionConvert1):
        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithSequence):
        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithArray):
        (WebCore::jsTestObjPrototypeFunctionVariadicNodeMethod):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2Promise):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::constructJSTestOverloadedConstructors1):
        (WebCore::constructJSTestOverloadedConstructors2):
        (WebCore::constructJSTestOverloadedConstructors3):
        * bindings/scripts/test/TestObj.idl:

2016-05-09  Tim Horton  <timothy_horton@apple.com>

        Download progress on attachment elements sometimes exceeds element bounds
        https://bugs.webkit.org/show_bug.cgi?id=157440
        <rdar://problem/25245440>

        Reviewed by Darin Adler.

        In the case of very large dynamic type sizes, we can overflow the
        bounds of the attachment. It turns out that we used to limit to one
        line in many cases anyway, so only wrap if we have only a title and/or icon.
        This looks better when you have many of the other elements even in
        non-large-type modes.

        * rendering/RenderThemeIOS.mm:
        (WebCore::AttachmentInfo::buildTitleLines):
        (WebCore::AttachmentInfo::AttachmentInfo):
        Limit the title to a single line if we have anything
        other than a title and icon.

        (WebCore::attachmentBorderPath):
        (WebCore::paintAttachmentBorder):
        (WebCore::RenderThemeIOS::paintAttachment):
        Clip to the border, so that even if somehow we paint outside of
        the bounds, we don't paint over other parts of the page.

2016-05-09  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION (198056): Unable to use edit buttons on WordPress
        https://bugs.webkit.org/show_bug.cgi?id=157475

        Reviewed by Antti Koivisto.

        Renamed Event.prototype.deepPath() to composedPath() per discussions on
        https://github.com/whatwg/dom/issues/242 as the old name was not Web compatible.

        Test: fast/shadow-dom/Extensions-to-Event-Interface.html

        * dom/Event.cpp:
        (WebCore::Event::composedPath): Renamed from deepPath.
        * dom/Event.h:
        * dom/Event.idl:

2016-05-09  Alex Christensen  <achristensen@webkit.org>

        Don't use DiskCache for media resource loads
        https://bugs.webkit.org/show_bug.cgi?id=157405

        Reviewed by Darin Adler.

        http/tests/security/video-cross-origin-caching.html was loading from the disk cache.
        This patch adds an assertion that fires in that test without this fix.

        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::requestResource):
        * platform/graphics/PlatformMediaResourceLoader.h:
        * platform/network/ResourceRequestBase.h:
        (WebCore::ResourceRequestBase::hiddenFromInspector):
        (WebCore::ResourceRequestBase::setHiddenFromInspector):
        (WebCore::ResourceRequestBase::requester):
        (WebCore::ResourceRequestBase::setRequester):
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSessionDataTask _restart]):
        (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]):

2016-05-09  Ryosuke Niwa  <rniwa@webkit.org>

        Refactor FocusController::findFocusableElementRecursively
        https://bugs.webkit.org/show_bug.cgi?id=157415

        Reviewed by Darin Adler.

        Refactor FocusController::findFocusableElementRecursively and related functions. Extracted two functions:
        nextFocusableElementWithinScope and previousFocusableElementWithinScope out of it since they didn't really share
        any code other than calling findFocusableElement at the beginning.

        Also renamed internal variant of nextFocusableElement and previousFocusableElement to nextFocusableElementOrScopeOwner
        and previousFocusableElementOrScopeOwner. It was confusing to have these internal functions in addition to public
        member functions that are used in Objective-C DOM API.

        No new tests are added since there should be no behavioral change.

        * page/FocusController.cpp:
        (WebCore::FocusController::findFocusableElementDescendingDownIntoFrameDocument): Added a FIXME.
        (WebCore::FocusController::advanceFocusInDocumentOrder): Use findFocusableElementAcrossFocusScope instead of manually
        calling findFocusableElementRecursively and findFocusableElementDescendingDownIntoFrameDocument separately.
        (WebCore::FocusController::findFocusableElementAcrossFocusScope): Now that findFocusableElementWithinScope calls
        findFocusableElementDescendingDownIntoFrameDocument internally, there is no need to keep around "found" local variable.
        Introduce a few early exists for a better clarity.
        (WebCore::FocusController::findFocusableElementWithinScope): Renamed from findFocusableElementRecursively. Also call
        findFocusableElementDescendingDownIntoFrameDocument here instead of findFocusableElementAcrossFocusScope.
        (WebCore::FocusController::nextFocusableElementWithinScope): Extracted from findFocusableElementRecursively.
        (WebCore::FocusController::previousFocusableElementWithinScope): Ditto.
        (WebCore::FocusController::findFocusableElement):
        (WebCore::FocusController::nextFocusableElement): Added a FIXME.
        (WebCore::FocusController::previousFocusableElement): Ditto.
        (WebCore::FocusController::findFocusableElementOrScopeOwner): Renamed from findFocusableElement for clarity.
        (WebCore::FocusController::nextFocusableElementOrScopeOwner): Ditto from nextFocusableElement.
        (WebCore::FocusController::previousFocusableElementOrScopeOwner): Ditto from nextFocusableElement.
        * page/FocusController.h:

2016-05-09  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Fix static position for positioned grid items
        https://bugs.webkit.org/show_bug.cgi?id=157417

        Reviewed by Darin Adler.

        The spec was updated to define properly the static position
        for positioned grid items, but we didn't update the implementation yet:
        https://drafts.csswg.org/css-grid-1/issues-wd-20150108#issue-1

        We were only setting the static position when the start line
        was not auto. Otherwise we were using the default one
        which includes the padding.
        With the spec change we need to set it always,
        even if the start line is auto.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::layoutPositionedObject):
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):

2016-05-08  Frederic Wang  <fwang@igalia.com>

        RenderMathMLOperator: refactor management of stretchy data and italic correction
        https://bugs.webkit.org/show_bug.cgi?id=156913

        Reviewed by Darin Adler.

        No new tests, behavior is not changed.

        The stretchy data uses a shared space to describe horizontal / vertical directions and
        unstretched / size variant / glyph assembly. We use a simple struct with some unions to
        represent it instead of the current implementation with a class.
        We also modify the signature of some functions to retrieve display operator and stretchy
        data to use that new structure and prepare the move to a separate MathOperator class.
        Finally, we introduce some helper functions to easily set the stretchy data.

        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): Use the new data members and
        function signatures.
        (WebCore::RenderMathMLOperator::setSizeVariant): New helper function to set a size variant.
        (WebCore::RenderMathMLOperator::setGlyphAssembly): New helper function to set a glyph
        assembly.
        (WebCore::RenderMathMLOperator::getGlyphAssemblyFallBack): We change the signature to use a
        GlyphAssemblyData.
        (WebCore::RenderMathMLOperator::findDisplayStyleLargeOperator): We rename the function and
        change its signature to remove the return value. We now also set the italic correction when
        a display operator is found.
        (WebCore::RenderMathMLOperator::findStretchyData): We change the signature to introduce a
        target size and remove the return value. This also does the early return when the base glyph
        is large enough.
        (WebCore::RenderMathMLOperator::updateStyle): We use the new data members and function
        signatures. The check for the base glyph size is now done in findStretchyData, so we just
        check whether m_stretchType is Unstretched to do an early return.
        (WebCore::RenderMathMLOperator::firstLineBaseline): We use m_stretchType.
        (WebCore::RenderMathMLOperator::computeLogicalHeight): Ditto.
        (WebCore::RenderMathMLOperator::fillWithVerticalExtensionGlyph): Use the new class members.
        (WebCore::RenderMathMLOperator::fillWithHorizontalExtensionGlyph): Ditto.
        (WebCore::RenderMathMLOperator::paint): Ditto.
        (WebCore::RenderMathMLOperator::paintVerticalGlyphAssembly): Ditto.
        (WebCore::RenderMathMLOperator::paintHorizontalGlyphAssembly): Ditto.
        (WebCore::RenderMathMLOperator::paintChildren): Ditto.
        (WebCore::RenderMathMLOperator::trailingSpaceError): Ditto.
        (WebCore::RenderMathMLOperator::italicCorrection): Moved to RenderMathMLOperator.h.
        (WebCore::RenderMathMLOperator::getDisplayStyleLargeOperator): Deleted.
        * rendering/mathml/RenderMathMLOperator.h:
        (WebCore::RenderMathMLOperator::italicCorrection): We just return m_italicCorrection.
        (WebCore::RenderMathMLOperator::GlyphAssemblyData::GlyphAssemblyData): New class to store an
        assembly of GlyphData.
        (WebCore::RenderMathMLOperator::StretchyData::mode): Deleted.
        (WebCore::RenderMathMLOperator::StretchyData::variant): Deleted.
        (WebCore::RenderMathMLOperator::StretchyData::top): Deleted.
        (WebCore::RenderMathMLOperator::StretchyData::extension): Deleted.
        (WebCore::RenderMathMLOperator::StretchyData::bottom): Deleted.
        (WebCore::RenderMathMLOperator::StretchyData::middle): Deleted.
        (WebCore::RenderMathMLOperator::StretchyData::left): Deleted.
        (WebCore::RenderMathMLOperator::StretchyData::right): Deleted.
        (WebCore::RenderMathMLOperator::StretchyData::setNormalMode): Deleted.
        (WebCore::RenderMathMLOperator::StretchyData::setSizeVariantMode): Deleted.
        (WebCore::RenderMathMLOperator::StretchyData::setGlyphAssemblyMode): Deleted.
        (WebCore::RenderMathMLOperator::StretchyData::StretchyData): Deleted.

2016-05-08  Zalan Bujtas  <zalan@apple.com>

        iOS selection: Use inflow containing block for positioned <br>.
        https://bugs.webkit.org/show_bug.cgi?id=157115
        <rdar://problem/25969295>

        Reviewed by Ryosuke Niwa.

        Similarly to RenderText, we should just use the inflow containing block for
        selected <br> even when it is positioned out of flow. This visually matches Mac OS X
        behaviour (selection painting does not get extended to the positioned <br>).

        Test: fast/text/fixed-positioned-br-crash.html

        * rendering/RenderLineBreak.cpp:
        (WebCore::RenderLineBreak::collectSelectionRects):

2016-05-08  Myles C. Maxfield  <mmaxfield@apple.com>

        [iOS] Build fix after r200563

        Unreviewed.

        * editing/cocoa/HTMLConverter.mm:
        (_font):

2016-05-08  Myles C. Maxfield  <mmaxfield@apple.com>

        [OS X] Migrate our Font classes entirely off of NSFont
        https://bugs.webkit.org/show_bug.cgi?id=157464

        Reviewed by Darin Adler.

        Because NSFont and CTFont are toll-free-bridged, we don't need NSFont at all anywhere.

        No new tests because there is no behavior change.

        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (accessibilitySearchCriteriaForSearchPredicateParameterizedAttribute):
        (textMarkerRangeFromRange):
        (visiblePositionForStartOfTextMarkerRange):
        (visiblePositionForEndOfTextMarkerRange):
        (AXAttributedStringRangeIsValid):
        (AXAttributeStringSetFont):
        (CreateCGColorIfDifferent):
        (AXAttributeStringSetStyle):
        (textMarkerRangeFromVisiblePositions):
        * bindings/objc/DOM.mm:
        (-[DOMElement _font]):
        * bindings/objc/DOMPrivate.h:
        * editing/cocoa/HTMLConverter.mm:
        (_font):
        (WebCore::editingAttributedStringFromRange):
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::fontAttributesForSelectionStart):
        * platform/graphics/Font.h:
        (WebCore::Font::getCTFont):
        (WebCore::Font::getNSFont): Deleted.
        * platform/graphics/FontPlatformData.h:
        (WebCore::FontPlatformData::nsFont): Deleted.
        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::Font::determinePitch):
        (WebCore::advanceForColorBitmapFont):
        (WebCore::Font::platformWidthForGlyph):
        (WebCore::renderingStyle): Deleted.
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:

2016-05-08  Chris Dumez  <cdumez@apple.com>

        [Bindings] Simplify [RequiresExistingAtomicString] IDL extended attribute handling
        https://bugs.webkit.org/show_bug.cgi?id=157465

        Reviewed by Darin Adler.

        Simplify [RequiresExistingAtomicString] IDL extended attribute handling
        in the bindings generator.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck):
        Drop code specific to [RequiresExistingAtomicString].

        (JSValueToNative):
        Deal with [RequiresExistingAtomicString] IDL extended attribute,
        similarly to [AtomicString] and [TreatNullAs].

        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/TestObj.idl:
        Add bindings test coverage.

        * dom/DocumentFragment.cpp:
        (WebCore::DocumentFragment::getElementById):
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::getElementById):
        Add null check for the id parameter. The generated bindings used to do
        this null check for us but it is no longer the case (to make the bindings
        generator a bit simpler). This extended attribute is not commonly used
        and is meant as a micro-optimization for getElementById().

2016-05-08  David Kilzer  <ddkilzer@apple.com>

        Roll out: ThreadSanitizer: Data race and thread leak in WebCore::ScrollingThread::createThreadIfNeeded
        <https://webkit.org/b/157462>

        This reverts commit r200554.

        This doesn't fix the data race, and the thread leak is a
        separate issue.

        * page/scrolling/ScrollingThread.cpp:
        (WebCore::ScrollingThread::createThreadIfNeeded): Roll out the
        change.

2016-05-08  Darin Adler  <darin@apple.com>

        Follow-up to that last patch (missed review comments).

        * page/EventSource.cpp:
        (WebCore::EventSource::parseEventStream): Pre-increment, not post-increment.
        (WebCore::EventSource::dispatchMessageEvent): More elegant form without explicit StringView.

2016-05-08  Darin Adler  <darin@apple.com>

        Change EventSource constructor to take an IDL dictionary instead of a WebCore::Dictionary
        https://bugs.webkit.org/show_bug.cgi?id=157459

        Reviewed by Chris Dumez.

        Patch also includes some updating of EventSource class to modern idioms.

        * page/EventSource.cpp:
        (WebCore::EventSource::EventSource): Initialize based on Init.
        (WebCore::EventSource::create): Take/pass Init instead of Dictionary.

        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneSerializer::serialize): Take a StringView instead of a string
        so callers don't have to allocate a String just to use this.
        (WebCore::SerializedScriptValue::create): Ditto.
        * bindings/js/SerializedScriptValue.h: Ditto.

        * page/EventSource.cpp: Changed defaultReconnectDelay to be a uint64_t
        instead of an unsigned long long.
        (WebCore::EventSource::EventSource): Changed constructor to take a struct
        instead of a Dictionary for eventSourceInit. Also moved initialization of
        data members to the header and used ASCIILiteral.
        (WebCore::EventSource::create): Changed type to Init and streamlined code
        a little bit using auto.
        (WebCore::EventSource::connect): Used a reference instead of a pointer.
        Also added a FIXME since I noticed that m_requestInFlight is probably not
        needed, since it's basically the same thing as "is m_loader null".
        (WebCore::EventSource::url): Moved to the header and made it inline.
        (WebCore::EventSource::networkRequestEnded): Removed unneeded check that
        is already done by all callers and turned it into an assertion.
        (WebCore::EventSource::withCredentials): Ditto.
        (WebCore::EventSource::readyState): Ditto.
        (WebCore::EventSource::responseIsValid): Added. Helper function to make
        the logic in didReceiveResponse easier to read. Fixed logic to compare
        MIME type ignoring ASCII case, since that's how MIME types work.
        (WebCore::EventSource::didReceiveResponse): Use the helper above, and also
        move the m_eventStreamOrigin set up code into the valid response case,
        since there is no point doing it if the response is not valid. Also use
        the early return idiom.
        (WebCore::EventSource::didReceiveData): Removed the unneeded explicit
        conversion to StringView here. Also removed a FIXME that I fixed.
        (WebCore::EventSource::didFinishLoading): Added code to flush the decoder
        as mentioned in didReceiveData. Added FIXME about peculiar clearing code
        that exists only here. Removed check for empty receive buffer and data
        that is not needed since parseEventStream does sufficient checking.
        (WebCore::EventSource::didFail): Added FIXME because of things that
        didFinishLoading does that seem equally valuable here.
        (WebCore::EventSource::parseEventStream): Tweaked types and names of local
        variables, and changed to use Optional instead of magic number -1. Also
        added a FIXME about how the buffer type is probably not right since we
        keep moving the characters in the buffer as we consume the start of it.
        (WebCore::EventSource::parseEventStreamLine): Refactor and reorganize so
        this doesn't do so much string allocation and is easier to read
        (WebCore::EventSource::canSuspendForDocumentSuspension): Tweaked comment.
        (WebCore::EventSource::dispatchMessageEvent): Renamed this from
        createMessageEvent, and moved more code in here. We now don't have to
        allocate a temporary string just to pass it to SerializedScriptValue.

        * page/EventSource.h: Updated for changes above. Use pragma once.
        Define and use EventSource::Init struct. Other small cleanup.

        * page/EventSource.idl: Define EventSourceInit dictionary and use it.
        Other small cleanup.

2016-05-07  Darin Adler  <darin@apple.com>

        Change HTMLSlotElement::assignedNodes to take a IDL dictionary instead of a WebCore::Dictionary
        https://bugs.webkit.org/show_bug.cgi?id=157457

        Reviewed by Chris Dumez.

        * html/HTMLSlotElement.cpp:
        (WebCore::HTMLSlotElement::removedFrom): Fixed typo in comment.
        (WebCore::HTMLSlotElement::assignedNodes): Renamed assignedNodesForBindings back to this
        and changed the argument type to Optional<AssignedNodesOptions> instead of Dictionary.
        Also streamlined the logic a bit.
        (WebCore::HTMLSlotElement::enqueueSlotChangeEvent): Changed to use a pointer to the
        enqueued event instead of a boolean. With only a boolean, we could end up clearing the
        flag in cases where we don't really want to.
        (WebCore::HTMLSlotElement::dispatchEvent): Ditto.
        (WebCore::HTMLSlotElement::assignedNodesForBindings): Deleted.
        * html/HTMLSlotElement.h: Use pragma once. Added AssignedNodeOptions. Changed for the
        above, including changing the data member.
        * html/HTMLSlotElement.idl: Removed use of ImplementedAs. Fixed the type of the options
        dictionary.

2016-05-08  Chris Dumez  <cdumez@apple.com>

        [Bindings] Add convert<>() template specializations for integer types
        https://bugs.webkit.org/show_bug.cgi?id=157458

        Reviewed by Darin Adler.

        Add convert<>() template specializations for integer types and use them
        in the JS bindings. Also, treat non-32bit types the same way as the
        32bit ones, allowing the compiler to optimize out branching based on
        the IntegerConversionConfiguration.

        * bindings/js/JSCryptoAlgorithmDictionary.cpp:

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::enforceRange):
        (WebCore::toSmallerInt):
        (WebCore::toSmallerUInt):
        (WebCore::toInt8EnforceRange):
        (WebCore::toUInt8EnforceRange):
        (WebCore::toInt8Clamp):
        (WebCore::toUInt8Clamp):
        (WebCore::toInt8):
        (WebCore::toUInt8):
        (WebCore::toInt16EnforceRange):
        (WebCore::toUInt16EnforceRange):
        (WebCore::toInt16Clamp):
        (WebCore::toUInt16Clamp):
        (WebCore::toInt16):
        (WebCore::toUInt16):
        (WebCore::toInt32EnforceRange):
        (WebCore::toInt32Clamp):
        (WebCore::toUInt32Clamp):
        (WebCore::toUInt32EnforceRange):
        (WebCore::toInt64EnforceRange):
        (WebCore::toUInt64EnforceRange):
        (WebCore::toInt64Clamp):
        (WebCore::toUInt64Clamp):
        (WebCore::toInt64):
        (WebCore::toUInt64):
        * bindings/js/JSDOMBinding.h:
        - Splt some integer conversion functions into 3 Normal / Clamp /
          Enforce versions, similarly to what was done for 32bit types already.
          This is so that these can be called from the inline functions in
          JSDOMConvert.h, allowing the compiler to optimize out the branches.
        - Get rid of some unnecessary state.hadException() checks.

        * bindings/js/JSDOMConvert.h:
        Add convert<> specializations for integer types.

        * bindings/js/JSNodeFilterCustom.cpp:
        (WebCore::JSNodeFilter::acceptNode):

        * bindings/scripts/CodeGenerator.pm:
        - Add utility function to distinguish integer types.
        - Have IsNumericType() using the integerType / floatingPointType
          hashes to avoid duplication.
        - Stop int / unsigned int from integer types as those are not
          in Web IDL and they are not used.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GetIntegerConversionType):
        (JSValueToNative):
        Use convert<>() for converting JSValue to integer types.

        * bindings/scripts/IDLParser.pm:
        Stop allowing int / unsigned int types as those are not in Web IDL.

        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        Rebaseline bindings tests.

2016-05-08  Darin Adler  <darin@apple.com>

        Correct dictionary bindings handling of optional, null, and undefined
        https://bugs.webkit.org/show_bug.cgi?id=157463

        Reviewed by Chris Dumez.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::propertyValue): Deleted.
        * bindings/js/JSDOMBinding.h: Deleted propertyValue, not all that helpful for now.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateDictionaryImplementationContent): Added a new early exit for convert to
        a dictionary type when the value is undefined or null and all members are either
        optional or have a default value. This returns the default values for everything
        without raising an exception. Added checking that requires that the dictionary
        argument is an object and not a regular expression, since that's also called for
        in the latest draft of the Web IDL specification. This ends up speeding up the
        code a bit since we now use JSObject::get for properties instead of JSValue::get.
        (GenerateParametersCheck): Renamed some local variables. Taught the code that
        optional dictionaries all have a default value; before it was doing that for the
        type "Dictionary" but not the real dictionary types (IsDictionaryType).

        * bindings/scripts/test/JS/JSTestObj.cpp: Regenerated.

        * css/FontFace.cpp:
        (WebCore::FontFace::create): Changed argument to be Descriptors instead of
        Optional<Descriptors>. It would have compiled the other way, but there is now
        no caller that will pass a null. Because the IDL dictionary support was new,
        this was the only place that was doing it wrong. Good that we "nipped it in the bud"
        before doing this in more places.
        * css/FontFace.h: Ditto.

2016-05-08  David Kilzer  <ddkilzer@apple.com>

        ThreadSanitizer: Data race and thread leak in WebCore::ScrollingThread::createThreadIfNeeded
        <https://webkit.org/b/157462>

        Reviewed by Darin Adler.

        Reproduced with multiple existing tests.

        * page/scrolling/ScrollingThread.cpp:
        (WebCore::ScrollingThread::createThreadIfNeeded): Use a
        std::once_flag to initialize Scrolling Thread since this may be
        called from background threads.

2016-05-08  Darin Adler  <darin@apple.com>

        Try to fix build without rolling out that last change.

        * bindings/js/JSDOMConvert.h:
        (WebCore::convert<Vector<String>>): Make this an inline. Just call toNativeArray.

2016-05-07  Darin Adler  <darin@apple.com>

        Change MutationObserver::observe to take an IDL dictionary, rather than WebCore::Dictionary
        https://bugs.webkit.org/show_bug.cgi?id=157456

        Reviewed by Chris Dumez.

        * bindings/js/JSDOMConvert.h:
        (WebCore::convertOptional): Use a specific Optional null rather than Nullopt so we
        can compile the ternary operator.
        (WebCore::convert<bool>): Added.
        (WebCore::convert<Vector<String>>): Added. Later we probably need to change convert to use
        a member function of a class template rather than a function template so we can make partial
        specialization work and do this just once for all Vector<T>.

        * bindings/js/JSMutationObserverCustom.cpp:
        (WebCore::JSMutationObserverOwner::isReachableFromOpaqueRoots): Streamlined code and removed
        some local variables. Changed to call the new observedNodes rather than getObservedNodes.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateDictionaryImplementationContent): Fixed bug where we tried to call the version of
        the convert function with a default value even when there was none.

        * bindings/scripts/test/TestObj.idl: Added a test case basically identical to what's needed
        in MutationObserver.idl.
        * bindings/scripts/test/JS/JSTestObj.cpp: Regenerated.

        * dom/MutationObserver.cpp:
        (WebCore::MutationObserver::observe): Chagned function to take a MutationObserver::Init
        instead of a Dictionary.
        (WebCore::MutationObserver::observationStarted): Changed argument type to a reference.
        (WebCore::MutationObserver::observationEnded): Ditto.
        (WebCore::MutationObserverMicrotask): Removed unneeded explicit constructor and destructor.
        (WebCore::queueMutationObserverCompoundMicrotask): Got rid of unnneeded local variable.
        (WebCore::MutationObserver::observedNodes): Renamed to remove the "get" prefix.

        * dom/MutationObserver.h: Reduced includes. Added MutationObserver::Init struct and
        used it for the type of the argument to the observe function. Changed a few argument
        types and removed unused forward declarations.

        * dom/MutationObserver.idl: Added MutationObserverInit and used it instead of Dictionary.

        * dom/MutationObserverRegistration.cpp:
        (WebCore::MutationObserverRegistration::MutationObserverRegistration): Pass a reference.
        (WebCore::MutationObserverRegistration::~MutationObserverRegistration): Ditto.

2016-05-07  Chris Dumez  <cdumez@apple.com>

        Reduce special handling of XPathNSResolver type in the bindings
        https://bugs.webkit.org/show_bug.cgi?id=157454

        Reviewed by Darin Adler.

        Reduce special handling of XPathNSResolver type in the bindings.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        Add new JSXPathNSResolverCustom.cpp file.

        * bindings/js/JSDOMStringListCustom.cpp:
        (WebCore::JSDOMStringList::toWrapped):
        Take the ExecState by reference instead of pointer.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::toWrapped):
        Update to take an ExecState& parameter. The bindings now pass
        an ExecState to all custom toWrapped() methods for consistency
        and flexibility.

        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        Pass an ExecState now that those toWrapped() methods expect
        it.

        * bindings/js/JSEventTargetCustom.cpp:
        (WebCore::JSEventTarget::toWrapped):
        Update to take an ExecState& parameter.

        * bindings/js/JSIDBDatabaseCustom.cpp:
        (WebCore::JSIDBDatabase::transaction):
        Pass ExecState by reference instead of pointer.

        * bindings/js/JSMessageEventCustom.cpp:
        (WebCore::handleInitMessageEvent):
        Pass ExecState to JSDOMWindow::toWrapped().

        * bindings/js/JSXPathNSResolverCustom.cpp: Added.
        (WebCore::JSXPathNSResolver::toWrapped):
        Provide a custom implementation of JSXPathNSResolver::toWrapped()
        instead of having the custom code in the bindings generator.

        * bindings/scripts/CodeGeneratorJS.pm:
        (AddIncludesForType):
        Drop special includes for XPathNSResolver as they are no longer needed.

        (GenerateHeader):
        Drop special casing of certain types for generating the toWrapped()
        declaration by:
        1. Relying on GetNativeType() for the return value as certain types
           return a RefPtr instead of a raw pointer.
        2. Adding an extra ExecState parameter when a custom implementation of
           toWrapped() is provided, given that some of them need it.

        (GenerateParametersCheck):
        Drop custom code for XPathNSResolver and use the normal code path for
        this type now. The custom code now resides in the custom implementation
        of JSXPathNSResolver::toWrapped(), in custom bindings.

        (JSValueToNative):
        - Drop NodeFilter from the nativeType hash map as it was updated to
          be a callback interface a while back.
        - Add XPathNSResolver to nativeType hash map so that we now to use
          a RefPtr<> instead of a raw pointer in the bindings. We should
          probably add an IDL extended attribute for this at some point.
        - Drop special casing for DOMStringList which was outdated since there
          is no toDOMStringList() function. DOMStringList has a custom
          toWrapped() function instead nowadays so we now call this one
          instead. We apparently do not have any DOMStringList parameters
          outside our bindings tests at the moment, which is why no one
          noticed.
        - Pass an ExecState to toWrapped() if the interface has the
          JSCustomToNativeObject IDL extended attribute.

        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        * bindings/scripts/test/TestObj.idl:
        Add bindings test coverage for having an operation with an
        XPathNSResolver parameter.

        * dom/Document.idl:
        * xml/XPathEvaluator.idl:
        Drop some unnecessary default parameter values.

        * xml/XPathNSResolver.idl:
        Add JSCustomToNativeObject IDL extended attribute so that we can
        provide our own custom implementation of JSXPathNSResolver::toWrapped(),
        instead of having the custom code in the bindings generator.

        * dom/Document.cpp:
        (WebCore::Document::createExpression):
        (WebCore::Document::evaluate):
        * dom/Document.h:
        * inspector/InspectorNodeFinder.cpp:
        * xml/XPathEvaluator.cpp:
        (WebCore::XPathEvaluator::createExpression):
        (WebCore::XPathEvaluator::evaluate):
        * xml/XPathEvaluator.h:
        * xml/XPathExpression.cpp:
        (WebCore::XPathExpression::createExpression):
        * xml/XPathExpression.h:
        * xml/XPathParser.cpp:
        (WebCore::XPath::Parser::Parser):
        (WebCore::XPath::Parser::parseStatement):
        * xml/XPathParser.h:
        Take XPathNSResolver parameter as a Ref<XPathNSResolver>&& as this is
        what the generated bindings now provide us, given that this sometimes
        have to create a wrapper around a JSObject.

2016-05-07  Darin Adler  <darin@apple.com>

        Fix crash introduced by the last patch.

        Fix suggested by Chris Dumez.

        * css/FontFace.cpp:
        (WebCore::FontFace::FontFace): Roll out incorrect change. Things were getting
        initialized in the wrong order in a change I had made to the FontFace constructor
        that takes a CSSFontSelector.

2016-05-07  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rebaseline bindings tests after r200547.

        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::convert<TestObj::FontFaceDescriptors>):

2016-05-07  Darin Adler  <darin@apple.com>

        Next step on dictionary bindings, along with other bindings refinements
        https://bugs.webkit.org/show_bug.cgi?id=157451

        Reviewed by Chris Dumez.

        Converted one dictionary, the one passed to the constructor in FontFace.

        * WebCore.xcodeproj/project.pbxproj: Updated for name change of JSDOMBuild.h to
        JSDOMConvert.h and also let Xcode update a file type.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::propertyValue): Added.
        * bindings/js/JSDOMBinding.h: Use pragma once. Remove unnecessary forward declaration.
        Move all declarations to the top of the file, separating them from definitions. This
        is a small step toward better overview of what's in this file and paves the way for
        future simplifications and improvements we can make after we observe patterns.
        Also removed a couple unused functions.

        * bindings/js/JSDOMConvert.h: Renamed from JSDOMBuild.h.
        Renamed function templates from build to convert. Added convertOptional.

        * bindings/js/ReadableStreamController.cpp:
        (WebCore::callFunction): Use auto and remove some unneeded namespacing.
        (WebCore::ReadableStreamController::invoke): Ditto. Also remove use of helper function
        getPropertyFromObject, since this was the only call site and it was not very helpful.
        (WebCore::ReadableStreamController::isControlledReadableStreamLocked): Ditto.
        (WebCore::createReadableStream): Ditto.
        (WebCore::getReadableStreamReader): Ditto.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateEnumerationImplementationContent): Updated for name change from build to
        convert and JSDOMBuild.h to JSDOMConvert.h.
        (GenerateDictionaryImplementationContent): Ditto. Also added code to handle optional
        and added explicit exception checking, using local variables. Not clear longer term
        if the local variable approach is OK since this will unnecessarily change types like
        const String& to String.
        (GenerateParametersCheck): Removed local variable $optional and use $parameter->isOptional
        directly consistently. This is slightly clearer because the old code used a mix of the
        two, and also is a better pattern for when we refactor this into smaller functions.
        Note that this function name is not good any more--this is a lot more then parameter checks.
        (GetNativeType): Return appropriate name for dictionary types.
        (JSValueToNative): Updated for name change from build to convert and JSDOMBuild.h to
        JSDOMConvert.h.

        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        Regenerated results.

        * bindings/scripts/test/TestObj.idl: Added another dictionary test case, just a copy
        of the current state of the one in FontFace.idl.

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::setUnicodeRange): Update for simplified UnicodeRange struct.
        (WebCore::CSSFontFace::setFeatureSettings): Fix to correctly handle being called
        with "normal". Also fix so it doesn't call fontPropertyChanged if nothing changed.
        Also got rid of return value, which had no real value: it was returning false for
        some bad inputs, but others would just lead to assertions, and the real reason this
        was OK is that this function is only passed known-valid values.

        * css/CSSFontFace.h: Used prama once. Tweaked formatting. Removed return value from
        the setFeatureSettings function. Changed UnicodeRange to be struct with public data
        members instead a struct with a constructor and getter functions.

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::addFontFaceRule): Updated since setFeatureSettings no
        longer has a boolean return value.

        * css/CSSSegmentedFontFace.cpp:
        (WebCore::appendFontWithInvalidUnicodeRangeIfLoading): Updated for simplified
        UnicodeRange struct.

        * css/FontFace.cpp:
        (WebCore::valueFromDictionary): Deleted.
        (WebCore::FontFace::create): Updated to take the descriptors as a struct instead of
        a WebCore::Dictionary. Also made that argument optional as specified in the current
        specification draft.
        (WebCore::FontFace::setFeatureSettings): Updated since setFeatureSettings no longer
        has a boolean return value.
        (WebCore::FontFace::unicodeRange): Updated for simplified UnicodeRange struct.

        * css/FontFace.h: Used pragma once. Removed unneeded includes and forward declarations.
        Derived privately from CSSFontFace::Client. Added a FontFace::Descriptors struct and
        used it as an argument to the create function as described above.

        * css/FontFace.idl: Added FontFaceDescriptors and changed the argument to the
        constructor to be an optional FontFaceDescriptors instead of a Dictionary.

2016-05-07  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Rework FontFace promise attribute handling
        https://bugs.webkit.org/show_bug.cgi?id=157310

        Reviewed by Myles C. Maxfield.

        Making promise attributes cached attributes, so that they are created only once.
        They are created in the custom binding code and passed to DOM class as needed.

        Removed usage of ExecState& from DOM iterators.

        No change should be visible from user scripts.

        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::FetchHeaders::Iterator::next): Removing ExecState parameter.
        * Modules/fetch/FetchHeaders.h:
        * bindings/js/JSDOMIterator.h:
        (WebCore::keyValueIteratorForEach):
        (WebCore::JSDOMIterator<JSWrapper>::next): Ditto.
        * bindings/js/JSDOMPromise.cpp:
        (WebCore::DeferredWrapper::promise): Removed deferred() and added access to promise directly.
        * bindings/js/JSDOMPromise.h:
        * bindings/js/JSFontFaceCustom.cpp:
        (WebCore::JSFontFace::loaded): Using cached attribute to call FontFace::loaded only once.
        * bindings/js/JSFontFaceSetCustom.cpp:
        (WebCore::JSFontFaceSet::ready): Using cached attribute to call FontFaceSet::ready only once.
        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::wrapper): Removing ExecState parameter.
        * css/CSSFontFace.h:
        * css/FontFace.cpp:
        (WebCore::FontFace::create): Ditto.
        (WebCore::FontFace::FontFace): Ditto.
        (WebCore::FontFace::fontStateChanged): Updating promise handling.
        (WebCore::FontFace::registerLoaded): Resolving/rejecting promise if backing CSSFontFace loading is ended.
        (WebCore::FontFace::load): Calling backing load.
        * css/FontFace.h:
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::Iterator::next): Removing ExecState parameter.
        (WebCore::FontFaceSet::load): Removing ExecState and ExceptionCode parameter.
        (WebCore::FontFaceSet::registerReady): Resolving promise if ready otherwise storing it for resolving it later.
        (WebCore::FontFaceSet::completedLoading): Resolving promise if any is stored.
        (WebCore::FontFaceSet::create): Deleted.
        * css/FontFaceSet.h:
        * css/FontFaceSet.idl:

2016-05-07  Jeremy Huddleston Sequoia  <jeremyhu@apple.com>

        Fix an incorrect usage of OS(DARWIN) with PLATFORM(COCOA)
        https://bugs.webkit.org/show_bug.cgi?id=157167

        Reviewed by Myles C. Maxfield.

        * platform/graphics/FontPlatformData.h:
        (WebCore::FontPlatformData::hash):

2016-05-07  Joanmarie Diggs  <jdiggs@igalia.com>

        REGRESSION(r196222): [AX][GTK] accessibility/gtk/caret-offsets.html failing
        https://bugs.webkit.org/show_bug.cgi?id=153956

        Reviewed by Chris Fleizach.

        The reason the test began failing is that it was checking the new caret offset
        synchronously. For most of the test cases, this was not a problem. But when the
        caret was moved out of a focused link, the focus change (and associated repainting)
        delayed the caret-moved event long enough to cause the associated test case to fail.
        The test now uses shouldBecomeEqualToString() instead of shouldBeEqualToString().

        The test also had a supposedly-correct expectation which was wrong: When moving the
        caret to a valid accessible offset, the caret-moved event should be for that offset.
        This was not the case for the list item test case because emitTextSelectionChange()
        was not adjusting the offset for the RenderListMarker, the text of which is exposed
        as part of the ATK_ROLE_LIST_ITEM object. This bug was also fixed and the test case
        updated accordingly.

        No new tests are needed. The previously-failing test is now passing.

        * editing/atk/FrameSelectionAtk.cpp:
        (WebCore::emitTextSelectionChange):

2016-05-06  Joseph Pecoraro  <pecoraro@apple.com>

        Rename HitTestRequest DisallowShadowContent to DisallowUserAgentShadowContent
        https://bugs.webkit.org/show_bug.cgi?id=157447

        Reviewed by Ryosuke Niwa.

        HitTesting is intended to reach nodes inside shadow content. This property
        on the HitTestRequest is intended to avoid hit testing in UserAgent shadow
        content. Rename the enum value, and cascading methods for clarity.

        * html/MediaElementSession.cpp:
        (WebCore::isMainContent):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::eventMayStartDrag):
        (WebCore::EventHandler::updateSelectionForMouseDrag):
        (WebCore::EventHandler::hitTestResultAtPoint):
        (WebCore::EventHandler::handleMousePressEvent):
        (WebCore::EventHandler::handleMouseDoubleClickEvent):
        (WebCore::EventHandler::mouseMoved):
        (WebCore::EventHandler::handleMouseMoveEvent):
        (WebCore::EventHandler::handleMouseReleaseEvent):
        (WebCore::EventHandler::handleMouseForceEvent):
        (WebCore::EventHandler::updateDragAndDrop):
        (WebCore::EventHandler::isInsideScrollbar):
        (WebCore::EventHandler::sendContextMenuEvent):
        (WebCore::EventHandler::sendContextMenuEventForKey):
        (WebCore::EventHandler::hoverTimerFired):
        (WebCore::EventHandler::dragSourceEndedAt):
        (WebCore::EventHandler::handleDrag):
        (WebCore::EventHandler::dispatchSyntheticTouchEventIfEnabled):
        * page/EventHandler.h:
        * page/FocusController.cpp:
        (WebCore::updateFocusCandidateIfNeeded):
        * rendering/HitTestRequest.h:
        (WebCore::HitTestRequest::HitTestRequest):
        (WebCore::HitTestRequest::disallowsUserAgentShadowContent):
        (WebCore::HitTestRequest::disallowsShadowContent): Deleted.
        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::setToNonUserAgentShadowAncestor):
        (WebCore::HitTestResult::addNodeToRectBasedTestResult):
        (WebCore::HitTestResult::setToNonShadowAncestor): Deleted.
        * rendering/HitTestResult.h:
        * rendering/RenderEmbeddedObject.cpp:
        (WebCore::RenderEmbeddedObject::isReplacementObscured):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/svg/RenderSVGResourceClipper.cpp:
        (WebCore::RenderSVGResourceClipper::hitTestClipContent):
        * testing/Internals.cpp:
        (WebCore::Internals::nodesFromRect):

2016-05-06  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Inspect Element and Element Selection searching should work with Shadow DOM Nodes
        https://bugs.webkit.org/show_bug.cgi?id=157446
        <rdar://problem/24688447>

        Reviewed by Ryosuke Niwa.

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::innerParentNode):
        The Inspector backend was informing the frontend that all ShadowRoots
        were floating and had no parent. Get the host element for ShadowRoots.

        * rendering/HitTestResult.cpp:
        (WebCore::moveOutOfUserAgentShadowTree):
        (WebCore::HitTestResult::setToNonShadowAncestor):
        EventHandler::mouseMoved is calling setToNonShadowAncestor before
        notifying Page::chrome / Inspector about the moused over element.
        This should be the deepest non-user-agent-shadow node.

2016-05-06  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Misc CommandLineAPI cleanup
        https://bugs.webkit.org/show_bug.cgi?id=157450

        Reviewed by Ryosuke Niwa.

        * inspector/CommandLineAPIModuleSource.js:
        (bind):

2016-05-06  Simon Fraser  <simon.fraser@apple.com>

        Enable IOS_TEXT_AUTOSIZING on Mac and make it testable
        https://bugs.webkit.org/show_bug.cgi?id=157432
        rdar://problem/16406720

        Reviewed by Dean Jackson.

        Enable IOS_TEXT_AUTOSIZING on Mac so it can be tested.

        Make the setTextAutosizingEnabled() Setting work, and plumb it through WK1 and WK2
        preferences for WTR and DRT. Make textAutosizingWindowSizeOverride() work, for layout tests.
        These two settings are shared with TEXT_AUTOSIZING.

        Add a TextAutosizing log channel, which is useful for generated -expected.html results.

        Move adjustComputedFontSizesOnBlocks() and related code from RenderObject to RenderElement
        without changes.

        An implication of this set of changes is that the way clients enable text autosizing
        has changed. Previously, they set the "MinimumZoomFontSize" preference to 0.
        Settings::defaultMinimumZoomFontSize() used to do this in order to enable text autosizing
        on iPhone only, not iPad.

        Now the preferred technique is to leave minimumZoomFontSize alone, and to use textAutosizingEnabled()
        instead. Settings::defaultTextAutosizingEnabled() now does the check for iPhone.

        UIWebView calls WebKitGetMinimumZoomFontSize() to setup the default minimum font zoom size,
        which will now always return 15, but had no other code that toggled this. So it's safe to just rely
        on Settings::defaultTextAutosizingEnabled() doing the right thing for iPhone/iPad.

        Test: fast/text-autosizing/ios/autosize-width.html

        * Configurations/FeatureDefines.xcconfig:
        * dom/Document.cpp:
        (WebCore::Document::addAutoSizingNode):
        * page/FrameView.cpp:
        (WebCore::FrameView::layout):
        * page/Settings.cpp:
        (WebCore::Settings::Settings): Deleted.
        (WebCore::Settings::setTextAutosizingEnabled): Deleted.
        (WebCore::Settings::setTextAutosizingWindowSizeOverride): Deleted.
        * page/Settings.h:
        (WebCore::Settings::textAutosizingEnabled): Deleted.
        (WebCore::Settings::textAutosizingWindowSizeOverride): Deleted.
        * page/Settings.in:
        * page/cocoa/SettingsCocoa.mm:
        (WebCore::Settings::defaultMinimumZoomFontSize):
        (WebCore::Settings::defaultTextAutosizingEnabled):
        * platform/Logging.h:
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::adjustComputedFontSizes):
        * rendering/RenderElement.cpp:
        (WebCore::includeNonFixedHeight):
        (WebCore::RenderElement::adjustComputedFontSizesOnBlocks):
        (WebCore::RenderElement::resetTextAutosizing):
        * rendering/RenderElement.h:
        * rendering/RenderObject.cpp:
        (WebCore::includeNonFixedHeight): Deleted.
        (WebCore::RenderObject::adjustComputedFontSizesOnBlocks): Deleted.
        (WebCore::RenderObject::resetTextAutosizing): Deleted.
        * rendering/RenderObject.h:
        * rendering/TextAutoSizing.cpp:
        (WebCore::TextAutoSizingValue::adjustNodeSizes):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup):
        (WebCore::InternalSettings::Backup::restoreTo):
        (WebCore::InternalSettings::setTextAutosizingEnabled):
        (WebCore::InternalSettings::setTextAutosizingWindowSizeOverride):
        * testing/InternalSettings.h:

2016-05-06  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Console: Variables defined with let/const aren't accessible outside of console's scope
        https://bugs.webkit.org/show_bug.cgi?id=150752
        <rdar://problem/23343385>

        Reviewed by Mark Lam.

        Test: inspector/runtime/evaluate-CommandLineAPI.html

        * inspector/CommandLineAPIModuleSource.js:
        (bind):
        (this.member.toString):
        (CommandLineAPI):
        (CommandLineAPIImpl.prototype):
        (slice): Deleted.
        (bound): Deleted.
        (bound.toString): Deleted.
        (inScopeVariables): Deleted.
        (customToStringMethod): Deleted.
        Simplify now that we don't need to do our own variable shadow checking.

2016-05-06  Tim Horton  <timothy_horton@apple.com>

        <attachment> element should understand UTIs
        https://bugs.webkit.org/show_bug.cgi?id=157425
        <rdar://problem/25585401>

        Reviewed by Anders Carlsson.

        UTIs are often much more specific than MIME types, so we should allow
        clients of <attachment> to use them to get more accurate icons.

        Test: fast/attachment/attachment-uti.html

        * platform/graphics/Icon.h:
        * platform/graphics/mac/IconMac.mm:
        (WebCore::Icon::createIconForMIMEType): Deleted.
        Remove the now-unused createIconForMIMEType.

        * platform/network/mac/UTIUtilities.h:
        * platform/network/mac/UTIUtilities.mm:
        (WebCore::isDeclaredUTI):
        Expose UTTypeIsDeclared as isDeclaredUTI.

        * rendering/RenderThemeIOS.mm:
        (WebCore::iconForAttachment):
        * rendering/RenderThemeMac.mm:
        (WebCore::iconForAttachment):
        If the attachment's type is a UTI, request the icon for it directly.
        If it's a MIME type, convert to a UTI before requesting.

2016-05-06  Chris Dumez  <cdumez@apple.com>

        Clean up converting from JSValue to float / double in the bindings generator
        https://bugs.webkit.org/show_bug.cgi?id=157407

        Reviewed by Darin Adler.

        Clean up converting from JSValue to float / double in the bindings generator:
        - Handle all aspects of converting to float / double inside JSValueToNative()
          instead of relying partly on the call sites.
        - Add a build<>() template function to JSDOMBuild.h that is now
          called from the bindings to convert to float / double and deal with
          non-finite values.
        - Provide a better message with the TypeError that is thrown for non-finite
          values.

        No new tests, rebaselined existing tests.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::throwSequenceTypeError):
        (WebCore::throwNonFiniteTypeError):
        * bindings/js/JSDOMBinding.h:
        * bindings/js/JSDOMBuild.h:
        (WebCore::build):
        * bindings/scripts/CodeGenerator.pm:
        (IsFloatingPointType):
        * bindings/scripts/CodeGeneratorJS.pm:
        (JSValueToNative):
        (GenerateImplementation): Deleted.
        (GenerateParametersCheck): Deleted.
        (GenerateReturnParameters): Deleted.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjStrictFloat):
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalDoubleIsNaN):
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalFloatIsNaN):
        (WebCore::jsTestObjPrototypeFunctionStrictFunction):
        (WebCore::jsTestObjPrototypeFunctionVariadicDoubleMethod):
        (WebCore::jsTestObjPrototypeFunctionAny):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithFloatArgumentPromise):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1Promise):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::jsTestTypedefsPrototypeFunctionSetShadow):

2016-05-06  Dean Jackson  <dino@apple.com>

        Regions, Shapes and Tracks don't need runtime features
        https://bugs.webkit.org/show_bug.cgi?id=157426
        <rdar://problem/26146262>

        Reviewed by Simon Fraser.

        The following RuntimeEnabledFeatures can be removed since
        we have no need to disable them (they are stable and have
        shipped for a while):
        - CSS Regions
        - CSS Shapes
        - Media tracks

        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures): Deleted.
        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::setCSSShapesEnabled): Deleted.
        (WebCore::RuntimeEnabledFeatures::cssShapesEnabled): Deleted.
        (WebCore::RuntimeEnabledFeatures::setCSSRegionsEnabled): Deleted.
        (WebCore::RuntimeEnabledFeatures::cssRegionsEnabled): Deleted.
        (WebCore::RuntimeEnabledFeatures::setCSSCompositingEnabled): Deleted.
        (WebCore::RuntimeEnabledFeatures::cssCompositingEnabled): Deleted.
        (WebCore::RuntimeEnabledFeatures::webkitVideoTrackEnabled): Deleted.
        (WebCore::RuntimeEnabledFeatures::setWebkitVideoTrackEnabled): Deleted.
        * css/CSSParser.cpp:
        (WebCore::isSimpleLengthPropertyID):
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseFillProperty):
        (WebCore::CSSParser::createRegionRule):
        (WebCore::CSSParserContext::CSSParserContext): Deleted.
        (WebCore::operator==): Deleted.
        (WebCore::CSSParser::parseShapeProperty): Deleted.
        (WebCore::CSSParser::cssRegionsEnabled): Deleted.
        (WebCore::CSSParser::cssCompositingEnabled): Deleted.
        (WebCore::CSSParser::parseFlowThread): Deleted.
        (WebCore::CSSParser::parseRegionThread): Deleted.
        * css/CSSParser.h:
        * css/CSSParserMode.h:
        * dom/Document.cpp:
        (WebCore::Document::webkitGetNamedFlows):
        (WebCore::Document::cssRegionsEnabled): Deleted.
        (WebCore::Document::cssCompositingEnabled): Deleted.
        * dom/Document.h:
        * dom/Element.cpp:
        (WebCore::Element::unregisterNamedFlowContentElement):
        (WebCore::Element::webkitRegionOverset):
        (WebCore::Element::webkitGetRegionFlowRanges): Deleted.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::scheduleDelayedAction):
        (WebCore::HTMLMediaElement::pendingActionTimerFired):
        (WebCore::HTMLMediaElement::prepareForLoad):
        (WebCore::HTMLMediaElement::loadInternal):
        (WebCore::HTMLMediaElement::setReadyState):
        (WebCore::HTMLMediaElement::playbackProgressTimerFired):
        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged):
        (WebCore::HTMLMediaElement::userCancelledLoad):
        (WebCore::HTMLMediaElement::setVideoFullscreenLayer):
        (WebCore::HTMLMediaElement::hasClosedCaptions):
        (WebCore::HTMLMediaElement::setClosedCaptionsVisible):
        (WebCore::HTMLMediaElement::configureTextTrackDisplay):
        (WebCore::HTMLMediaElement::finishParsingChildren): Deleted.
        (WebCore::HTMLMediaElement::audioTrackEnabledChanged): Deleted.
        (WebCore::HTMLMediaElement::videoTrackSelectedChanged): Deleted.
        (WebCore::HTMLMediaElement::mediaPlayerDidAddAudioTrack): Deleted.
        (WebCore::HTMLMediaElement::mediaPlayerDidAddTextTrack): Deleted.
        (WebCore::HTMLMediaElement::mediaPlayerDidAddVideoTrack): Deleted.
        (WebCore::HTMLMediaElement::addAudioTrack): Deleted.
        (WebCore::HTMLMediaElement::addTextTrack): Deleted.
        (WebCore::HTMLMediaElement::addVideoTrack): Deleted.
        (WebCore::HTMLMediaElement::removeAudioTrack): Deleted.
        (WebCore::HTMLMediaElement::removeTextTrack): Deleted.
        (WebCore::HTMLMediaElement::removeVideoTrack): Deleted.
        (WebCore::HTMLMediaElement::audioTracks): Deleted.
        (WebCore::HTMLMediaElement::textTracks): Deleted.
        (WebCore::HTMLMediaElement::videoTracks): Deleted.
        (WebCore::HTMLMediaElement::didAddTextTrack): Deleted.
        (WebCore::HTMLMediaElement::didRemoveTextTrack): Deleted.
        * html/HTMLTrackElement.cpp:
        (WebCore::HTMLTrackElement::parseAttribute):
        (WebCore::HTMLTrackElement::scheduleLoad): Deleted.
        (WebCore::HTMLTrackElement::canLoadURL): Deleted.
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup):
        (WebCore::InternalSettings::Backup::restoreTo): Deleted.
        (WebCore::InternalSettings::setCSSShapesEnabled): Deleted.
        * testing/InternalSettings.h:
        * testing/InternalSettings.idl:

2016-05-06  Brady Eidson  <beidson@apple.com>

        Modern IDB (Workers): Start running a lot of the workers tests.
        https://bugs.webkit.org/show_bug.cgi?id=157424

        Reviewed by Sam Weinig.

        No new tests (Covered by enabling a whole bunch of existing tests).

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::stop): Call removeAllEventListeners() to clean up the Worker VM
          before it shuts down.

        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::stop): Call removeAllEventListeners()

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::IDBTransaction): Initialize with the correct VM.
        (WebCore::IDBTransaction::stop): Call removeAllEventListeners()
        (WebCore::IDBTransaction::operationDidComplete):

        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::takeIDBOpenDBRequest):
        (WebCore::IDBClient::IDBConnectionProxy::completeOpenDBRequest): Don't take the request from
          the map, but rather let the request take itself from its appropriate thread.
        * Modules/indexeddb/client/IDBConnectionProxy.h:

        * Modules/indexeddb/client/TransactionOperation.h:
        (WebCore::IDBClient::TransactionOperation::completed): Rework clearing out the completion 
          handler, as the handler itself might hold the last reference to `this`.

        * page/SecurityOrigin.h:
        (WebCore::SecurityOrigin::hasUniversalAccess):

        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::WorkerGlobalScope): If the parent context's SecurityOrigin had
          universal access, grant it to this one.

2016-05-06  Ryosuke Niwa  <rniwa@webkit.org>

        FKA: No way to get focus from DOM to shadow DOM components (Was: HTML5 media controls not keyboard accessible)
        https://bugs.webkit.org/show_bug.cgi?id=117857

        Reviewed by Jer Noble.

        The bug was caused by hasCustomFocusLogic returning true on media elements.

        Fix the bug by removing this function so that FocusController will walk into the shadow tree of media elements
        to look for focusable elements. This will allow AT such as Voice Over to iterate through controls.

        We don't seem to draw focus rings inside the media elements but that could be tweaked in a separate patch.

        Test: media/tab-focus-inside-media-elements.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::hasCustomFocusLogic): Deleted.
        * html/HTMLMediaElement.h:

2016-05-06  Anders Carlsson  <andersca@apple.com>

        Tidy up the LinkRelAttribute code
        https://bugs.webkit.org/show_bug.cgi?id=157429

        Reviewed by Sam Weinig.

        Get rid of IconURL.h and move the IconType enumeration inside LinkRelAttribute.
        Remove the InvalidIcon enum declaration and use WTF::Optional instead.

        * WebCore.xcodeproj/project.pbxproj:
        * dom/IconURL.h: Removed.
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::iconType):
        (WebCore::HTMLLinkElement::addSubresourceAttributeURLs):
        * html/HTMLLinkElement.h:
        * html/LinkRelAttribute.cpp:
        (WebCore::LinkRelAttribute::LinkRelAttribute):
        * html/LinkRelAttribute.h:
        * html/parser/HTMLPreloadScanner.cpp:
        (WebCore::TokenPreloadScanner::StartTagScanner::relAttributeIsStyleSheet):
        * loader/FrameLoader.h:
        * loader/FrameLoaderClient.h:
        * loader/icon/IconController.cpp:
        (WebCore::iconFromLinkElements):

2016-05-06  Jer Noble  <jer.noble@apple.com>

        Muted media elements should be allowed to autoplay, even if RequireUserGestureForAudioRateChange is set.
        https://bugs.webkit.org/show_bug.cgi?id=157404
        <rdar://problem/26016802>

        Reviewed by Eric Carlson.

        Test: media/audio-playback-restriction-play-muted.html

        Add element.muted() as a critera of whether playback is permitted when
        RequireUserGestureForAudioRateChange is set. Also, make sure to re-evaluate whether the
        element should be playing when muted is changed without a user gesture.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setMuted):
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::playbackPermitted):

2016-05-06  Brent Fulgham  <bfulgham@apple.com>

        Don't use invalidated ResourceLoadStatistics iterators
        https://bugs.webkit.org/show_bug.cgi?id=157412
        <rdar://problem/26133153>

        Reviewed by Chris Dumez.

        ResourceLoadObserver::logFrameNavigation was using references bound to the 'value'
        member of iterators from the ResourceLoadStatistics HashMap. When new entries were
        added, these iterators were invalidated causing the references to refer to invalid
        memory.

        Renamed 'resourceStatisticsForPrimaryDomain' to 'ensureResourceStatisticsForPrimaryDomain'
        to clarify that it may mutate the underlying HashMap, thereby invalidating any
        existing iterators.

        * loader/ResourceLoadObserver.cpp:
        (WebCore::ResourceLoadObserver::logFrameNavigation): Protect against HashMap
        elements being copied/moved when new intries are added.
        * loader/ResourceLoadStatisticsStore.cpp:
        (WebCore::ResourceLoadStatisticsStore::setResourceStatisticsForPrimaryDomain): Added.
        * loader/ResourceLoadStatisticsStore.h:

2016-05-06  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Unprefix CSS Grid Layout properties
        https://bugs.webkit.org/show_bug.cgi?id=157137

        Reviewed by Simon Fraser.

        Remove "-webkit" prefix from all the grid layout properties,
        including the display value.
        Update the source code to remove the prefix where it was used too.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::isLayoutDependent):
        (WebCore::ComputedStyleExtractor::propertyValue):
        * css/CSSParser.cpp:
        (WebCore::isSimpleLengthPropertyID):
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseGridGapShorthand):
        (WebCore::CSSParser::parseGridTemplateRowsAndAreasAndColumns):
        (WebCore::CSSParser::parseGridTemplateShorthand):
        (WebCore::CSSParser::parseGridShorthand):
        (WebCore::CSSParser::parseGridAreaShorthand):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        * css/StyleBuilderCustom.h:
        (WebCore::StyleBuilderCustom::applyInitialGridTemplateAreas):
        (WebCore::StyleBuilderCustom::applyInheritGridTemplateAreas):
        (WebCore::StyleBuilderCustom::applyValueGridTemplateAreas):
        (WebCore::StyleBuilderCustom::applyInitialGridTemplateColumns):
        (WebCore::StyleBuilderCustom::applyInheritGridTemplateColumns):
        (WebCore::StyleBuilderCustom::applyValueGridTemplateColumns):
        (WebCore::StyleBuilderCustom::applyInitialGridTemplateRows):
        (WebCore::StyleBuilderCustom::applyInheritGridTemplateRows):
        (WebCore::StyleBuilderCustom::applyValueGridTemplateRows):
        * css/StyleProperties.cpp:
        (WebCore::StyleProperties::getPropertyValue):

2016-05-06  Nan Wang  <n_wang@apple.com>

        AX: <attachment> element should have a replacement character
        https://bugs.webkit.org/show_bug.cgi?id=157406

        Reviewed by Chris Fleizach.

        Make sure attachment element is considered as a replaced node.

        Test: accessibility/mac/attachment-element-replacement-character.html

        * editing/TextIterator.cpp:
        (WebCore::isRendererReplacedElement):

2016-05-06  Nan Wang  <n_wang@apple.com>

        AX: String for document range is empty if end visible position anchors to a ignored replaced node
        https://bugs.webkit.org/show_bug.cgi?id=157403

        Reviewed by Chris Fleizach.

        The CharacterOffset that is converted from VisiblePositon is wrong when the VisiblePostion anchors
        to an ignored replaced node. Fixed it by adjusting the offset of the CharacterOffset correctly in 
        such case.

        Test: accessibility/mac/text-marker-string-for-document-end-replaced-node.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::characterOffsetsInOrder):
        (WebCore::AXObjectCache::characterOffsetFromVisiblePosition):
        (WebCore::AXObjectCache::accessibilityObjectForTextMarkerData):

2016-05-05  David Kilzer  <ddkilzer@apple.com>

        [iOS] WebCore does not need to link to CoreAudio, GraphicsServices, SystemConfiguration frameworks
        <https://webkit.org/b/157413>
        <rdar://problem/26104189>

        Reviewed by Gavin Barraclough.

        * Configurations/WebCore.xcconfig:
        (OTHER_LDFLAGS_BASE_ios): Remove "-framework GraphicsServices".
        (OTHER_LDFLAGS_PLATFORM[sdk=macosx*]): Add "-framework CoreAudio"
        and "-framework SystemConfiguration".
        * WebCore.xcodeproj/project.pbxproj: Remove CoreAudio.framework
        and SystemConfiguration.framework from the project file.

2016-05-05  Brady Eidson  <beidson@apple.com>

        Modern IDB (Workers): Get everything to the right threads.
        https://bugs.webkit.org/show_bug.cgi?id=157398

        Reviewed by Alex Christensen.

        No new tests (No current change in behavior, will be tested as bug 149953 is resolved, enabling IDB in workers).

        * dom/ScriptExecutionContext.h:
        (WebCore::ScriptExecutionContext::postCrossThreadTask): Add a helper to post a CrossThreadTask to a context.
                
        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::performCallbackOnCorrectThread): Helper to perform an IDB callback on either the main thread
          or Worker thread as necessary.
        (WebCore::IDBClient::IDBConnectionProxy::openDatabase):
        (WebCore::IDBClient::IDBConnectionProxy::deleteDatabase):
        (WebCore::IDBClient::IDBConnectionProxy::completeOpenDBRequest):
        (WebCore::IDBClient::IDBConnectionProxy::createObjectStore):
        (WebCore::IDBClient::IDBConnectionProxy::deleteObjectStore):
        (WebCore::IDBClient::IDBConnectionProxy::clearObjectStore):
        (WebCore::IDBClient::IDBConnectionProxy::createIndex):
        (WebCore::IDBClient::IDBConnectionProxy::deleteIndex):
        (WebCore::IDBClient::IDBConnectionProxy::putOrAdd):
        (WebCore::IDBClient::IDBConnectionProxy::getRecord):
        (WebCore::IDBClient::IDBConnectionProxy::getCount):
        (WebCore::IDBClient::IDBConnectionProxy::deleteRecord):
        (WebCore::IDBClient::IDBConnectionProxy::openCursor):
        (WebCore::IDBClient::IDBConnectionProxy::iterateCursor):
        (WebCore::IDBClient::IDBConnectionProxy::completeOperation):
        (WebCore::IDBClient::IDBConnectionProxy::abortOpenAndUpgradeNeeded):
        (WebCore::IDBClient::IDBConnectionProxy::fireVersionChangeEvent):
        (WebCore::IDBClient::IDBConnectionProxy::didFireVersionChangeEvent):
        (WebCore::IDBClient::IDBConnectionProxy::notifyOpenDBRequestBlocked):
        (WebCore::IDBClient::IDBConnectionProxy::establishTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::didStartTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::commitTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::didCommitTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::abortTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::didAbortTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::didFinishHandlingVersionChangeTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::databaseConnectionClosed):
        (WebCore::IDBClient::IDBConnectionProxy::scheduleMainThreadTasks):
        (WebCore::IDBClient::IDBConnectionProxy::handleMainThreadTasks):
        * Modules/indexeddb/client/IDBConnectionProxy.h:
        (WebCore::IDBClient::IDBConnectionProxy::callConnectionOnMainThread): Helper to marshall IDB operations from the
          Worker thread to the main thread.
        (WebCore::IDBClient::IDBConnectionProxy::postMainThreadTask):

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::originThreadID):
        * Modules/indexeddb/IDBTransaction.h:
        
        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::putOrAdd):
        * Modules/indexeddb/client/IDBConnectionToServer.h:

        * Modules/indexeddb/client/IDBConnectionToServerDelegate.h:

        * Modules/indexeddb/client/TransactionOperation.cpp:
        (WebCore::IDBClient::TransactionOperation::scriptExecutionContext):
        * Modules/indexeddb/client/TransactionOperation.h:

        * Modules/indexeddb/shared/IDBResourceIdentifier.cpp:
        (WebCore::nextClientResourceNumber):

        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::putOrAdd):
        * Modules/indexeddb/shared/InProcessIDBServer.h:

2016-05-05  Dean Jackson  <dino@apple.com>

        4 and 8 digit color attributes should use the crazypants algorithm, not the CSS one.
        https://bugs.webkit.org/show_bug.cgi?id=157402
        <rdar://problem/26131142>

        Reviewed by Simon Fraser.

        Noel and Tab from Google alerted me to the fact I broke some legacy
        HTML color attributes when I added support for 4 and 8 digit hex colors
        in CSS. The fix is to favor the "crazy" parsing unless we know it is a 3 or 6
        digit hex value (in which case we try the CSS algorithm first).

        Covered by reverting an existing test.

        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::addHTMLColorToStyle):

2016-05-05  Brady Eidson  <beidson@apple.com>

        Modern IDB (Workers): Remove the need for IDBConnectionProxy to expose its IDBConnectionToServer.
        https://bugs.webkit.org/show_bug.cgi?id=157394

        Reviewed by Alex Christensen.

        No new tests (No current change in behavior, will be tested as bug 149953 makes progress).

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::transaction):
        (WebCore::IDBDatabase::fireVersionChangeEvent):
        (WebCore::IDBDatabase::dispatchEvent):
        * Modules/indexeddb/IDBDatabase.h:
        (WebCore::IDBDatabase::serverConnection): Deleted.

        * Modules/indexeddb/IDBOpenDBRequest.cpp:
        (WebCore::IDBOpenDBRequest::requestCompleted):

        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::IDBRequest):

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::connectionProxy):
        (WebCore::IDBTransaction::serverConnection): Deleted.
        * Modules/indexeddb/IDBTransaction.h:

        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::abortOpenAndUpgradeNeeded):
        (WebCore::IDBClient::IDBConnectionProxy::connectionToServer): Deleted.
        * Modules/indexeddb/client/IDBConnectionProxy.h:

        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::abortOpenAndUpgradeNeeded):

        * Modules/indexeddb/client/TransactionOperation.h:
        (WebCore::IDBClient::TransactionOperation::TransactionOperation):

        * Modules/indexeddb/shared/IDBCursorInfo.cpp:
        (WebCore::IDBCursorInfo::IDBCursorInfo):

        * Modules/indexeddb/shared/IDBRequestData.cpp:
        (WebCore::IDBRequestData::IDBRequestData):

        * Modules/indexeddb/shared/IDBResourceIdentifier.cpp:
        (WebCore::IDBResourceIdentifier::IDBResourceIdentifier):
        * Modules/indexeddb/shared/IDBResourceIdentifier.h:

        * Modules/indexeddb/shared/IDBTransactionInfo.cpp:
        (WebCore::IDBTransactionInfo::clientTransaction):
        * Modules/indexeddb/shared/IDBTransactionInfo.h:

2016-05-05  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r200479.
        https://bugs.webkit.org/show_bug.cgi?id=157397

        A LayoutTest added with this change is crashing on Mac WK1
        test runs. (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "For keyboard users, activating a fragment URL should transfer
        focus and caret to the destination"
        https://bugs.webkit.org/show_bug.cgi?id=116046
        http://trac.webkit.org/changeset/200479

2016-05-05  Chris Dumez  <cdumez@apple.com>

        CORS check is sometimes incorrectly failing for media loads
        https://bugs.webkit.org/show_bug.cgi?id=157370
        <rdar://problem/26071607>

        Reviewed by Alex Christensen.

        When the media library is issuing a conditional request for a media
        element that had the 'crossorigin' attribute, we would fail the CORS
        check and log an error if the server were to respond with a "304 Not
        Modified" response because the 304 response usually does not have
        the necessary "Access-Control-Allow-Origin: *" header (At least for
        Apache) and we cannot use the cached headers either since WebKit
        does not have them.

        To work around the problem in the short term, we now drop the
        conditional headers from the request that the media library is
        giving us when the media element has the 'crossorigin' attribute
        set. As a result, the server will never respond with a 304 and we
        will be able to do a CORS check on the full (e.g. 206) response.

        In the long term, we need to deal with this better as this means
        we may sometimes fail to reuse cached data. For now, this is only
        potentially inefficient in the cases that were broken (i.e. no
        video would play and we would log an error in the console).

        Test: http/tests/security/video-cross-origin-caching.html

        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::requestResource):
        Make the request unconditional if the media element has the
        'crossorigin' attribute set.

        * platform/network/ResourceRequestBase.cpp:
        (WebCore::ResourceRequestBase::isConditional):
        (WebCore::ResourceRequestBase::makeUnconditional):
        When fixing the bug above, I noticed that those method do not do
        the right thing if the m_httpHeaderFields data member has not
        been populated yet. m_httpHeaderFields is lazily initialized so
        we need to call updateResourceRequest() before using it.

2016-05-05  Zalan Bujtas  <zalan@apple.com>

        Stop traversing at the container block when computing RTL inline static distance.
        https://bugs.webkit.org/show_bug.cgi?id=157349
        <rdar://problem/25994087>

        Reviewed by David Hyatt.

        When computing the inline static distance for a child renderer, we start at its enclosing box
        and traverse up all the way to the container block.
        However when the enclosing box is the ancestor of the container block, we
        should just bail out right away since there's no container to use to adjust the position.

        Test: fast/multicol/positioned-rtl-column-crash.html

        * rendering/RenderBox.cpp:
        (WebCore::computeInlineStaticDistance):

2016-05-05  Ada Chan  <adachan@apple.com>

        Add WebKitAdditions extension points in media controls related code in RenderThemeMac
        https://bugs.webkit.org/show_bug.cgi?id=157390

        Reviewed by Anders Carlsson.

        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::mediaControlsStyleSheet):
        (WebCore::RenderThemeMac::mediaControlsScript):

2016-05-05  Jer Noble  <jer.noble@apple.com>

        [WK2] Media controls don't update if controller is created after the interface is created
        https://bugs.webkit.org/show_bug.cgi?id=157376

        Reviewed by Beth Dakin.

        Add getter methods to WebPlaybackSessionModel so that the model's values can be retrieved
        if those values were missed before the equivalent WebPlaybackSessionInterface methods were
        called. This necessatates a bunch of changes in HTMLMediaElement and related classes to
        change PassRefPtr<TimeRanges> types to Ref<TimeRanges> (and one change in TimeRanges itself).
        WebPlaybackSessionModelMediaElement can implement these new getter methods by querying the
        values from the HTMLMediaElement, something it was doing already, so most of those changes
        are simple refactoring.

        There's no reason any longer for WebVideoFullscreenModel to inherit from WebPlaybackSessionModel,
        so remove that superclass.

        In WebPlaybackSessionInterfaceMac, when a new WebPlaybackControlsManager is set, use the new
        getter methods on WebPlaybackSessionModel to update the values in the manager.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerCharacteristicChanged):
        (WebCore::HTMLMediaElement::maxBufferedTime):
        (WebCore::HTMLMediaElement::played):
        (WebCore::HTMLMediaElement::buffered): Deleted.
        (WebCore::HTMLMediaElement::seekable): Deleted.
        * html/HTMLMediaElement.h:
        * html/MediaController.cpp:
        (MediaController::buffered):
        (MediaController::seekable):
        (MediaController::played):
        * html/MediaController.h:
        * html/MediaControllerInterface.h:
        * html/TimeRanges.cpp:
        (WebCore::TimeRanges::copy):
        * html/TimeRanges.h:
        * platform/cocoa/WebPlaybackSessionModel.h:
        * platform/cocoa/WebPlaybackSessionModelMediaElement.h:
        * platform/cocoa/WebPlaybackSessionModelMediaElement.mm:
        (WebPlaybackSessionModelMediaElement::setWebPlaybackSessionInterface):
        (WebPlaybackSessionModelMediaElement::updateForEventName):
        (WebPlaybackSessionModelMediaElement::updateLegibleOptions):
        (WebPlaybackSessionModelMediaElement::observedEventNames):
        (WebPlaybackSessionModelMediaElement::eventNameAll):
        (WebPlaybackSessionModelMediaElement::duration):
        (WebPlaybackSessionModelMediaElement::currentTime):
        (WebPlaybackSessionModelMediaElement::bufferedTime):
        (WebPlaybackSessionModelMediaElement::isPlaying):
        (WebPlaybackSessionModelMediaElement::playbackRate):
        (WebPlaybackSessionModelMediaElement::seekableRanges):
        (WebPlaybackSessionModelMediaElement::canPlayFastReverse):
        (WebPlaybackSessionModelMediaElement::audioMediaSelectionOptions):
        (WebPlaybackSessionModelMediaElement::audioMediaSelectedIndex):
        (WebPlaybackSessionModelMediaElement::legibleMediaSelectionOptions):
        (WebPlaybackSessionModelMediaElement::legibleMediaSelectedIndex):
        (WebPlaybackSessionModelMediaElement::externalPlaybackEnabled):
        (WebPlaybackSessionModelMediaElement::wirelessVideoPlaybackDisabled):
        * platform/cocoa/WebVideoFullscreenModel.h:
        * platform/cocoa/WebVideoFullscreenModelVideoElement.h:
        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
        (WebVideoFullscreenModelVideoElement::requestFullscreenMode): Deleted.
        (WebVideoFullscreenModelVideoElement::setVideoLayerFrame): Deleted.
        (WebVideoFullscreenModelVideoElement::setVideoLayerGravity): Deleted.
        (WebVideoFullscreenModelVideoElement::observedEventNames): Deleted.
        (WebVideoFullscreenModelVideoElement::eventNameAll): Deleted.
        (WebVideoFullscreenModelVideoElement::fullscreenModeChanged): Deleted.
        * platform/ios/WebPlaybackSessionInterfaceAVKit.h:
        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        (WebVideoFullscreenControllerContext::play): Deleted.
        (WebVideoFullscreenControllerContext::pause): Deleted.
        (WebVideoFullscreenControllerContext::togglePlayState): Deleted.
        (WebVideoFullscreenControllerContext::beginScrubbing): Deleted.
        (WebVideoFullscreenControllerContext::endScrubbing): Deleted.
        (WebVideoFullscreenControllerContext::seekToTime): Deleted.
        (WebVideoFullscreenControllerContext::fastSeek): Deleted.
        (WebVideoFullscreenControllerContext::beginScanningForward): Deleted.
        (WebVideoFullscreenControllerContext::beginScanningBackward): Deleted.
        (WebVideoFullscreenControllerContext::endScanning): Deleted.
        (WebVideoFullscreenControllerContext::selectAudioMediaOption): Deleted.
        (WebVideoFullscreenControllerContext::selectLegibleMediaOption): Deleted.
        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (WebVideoFullscreenInterfaceAVKit::requestHideAndExitFullscreen):
        (WebVideoFullscreenInterfaceAVKit::shouldExitFullscreenWithReason):
        * platform/mac/WebPlaybackSessionInterfaceMac.mm:
        (WebCore::timeRangesToArray):
        (WebCore::WebPlaybackSessionInterfaceMac::setSeekableRanges):
        (WebCore::WebPlaybackSessionInterfaceMac::setPlayBackControlsManager):
        * platform/mac/WebVideoFullscreenInterfaceMac.h:

2016-05-05  Brady Eidson  <beidson@apple.com>

        Modern IDB (Workers): Move TransactionOperation management from IDBConnectionToServer to IDBConnectionProxy.
        https://bugs.webkit.org/show_bug.cgi?id=157392

        Reviewed by Alex Christensen.

        No new tests (No current change in behavior, will be tested as bug 149953 makes progress).

        Set up TransactionOperations on the IDBConnectionProxy instead of the IDBConnectionToServer:
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::createObjectStoreOnServer):
        (WebCore::IDBTransaction::createIndexOnServer):
        (WebCore::IDBTransaction::openCursorOnServer):
        (WebCore::IDBTransaction::iterateCursorOnServer):
        (WebCore::IDBTransaction::getRecordOnServer):
        (WebCore::IDBTransaction::getCountOnServer):
        (WebCore::IDBTransaction::deleteRecordOnServer):
        (WebCore::IDBTransaction::clearObjectStoreOnServer):
        (WebCore::IDBTransaction::putOrAddOnServer):
        (WebCore::IDBTransaction::deleteObjectStoreOnServer):
        (WebCore::IDBTransaction::deleteIndexOnServer):
        
        IDBConnectionProxy is now the owner of dispatched TransactionOperations:
        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::createObjectStore):
        (WebCore::IDBClient::IDBConnectionProxy::deleteObjectStore):
        (WebCore::IDBClient::IDBConnectionProxy::clearObjectStore):
        (WebCore::IDBClient::IDBConnectionProxy::createIndex):
        (WebCore::IDBClient::IDBConnectionProxy::deleteIndex):
        (WebCore::IDBClient::IDBConnectionProxy::putOrAdd):
        (WebCore::IDBClient::IDBConnectionProxy::getRecord):
        (WebCore::IDBClient::IDBConnectionProxy::getCount):
        (WebCore::IDBClient::IDBConnectionProxy::deleteRecord):
        (WebCore::IDBClient::IDBConnectionProxy::openCursor):
        (WebCore::IDBClient::IDBConnectionProxy::iterateCursor):
        (WebCore::IDBClient::IDBConnectionProxy::saveOperation):
        (WebCore::IDBClient::IDBConnectionProxy::completeOperation):
        * Modules/indexeddb/client/IDBConnectionProxy.h:
        
        Proxy this in-and-out calls to the ConnectionProxy:
        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::createObjectStore):
        (WebCore::IDBClient::IDBConnectionToServer::didCreateObjectStore):
        (WebCore::IDBClient::IDBConnectionToServer::deleteObjectStore):
        (WebCore::IDBClient::IDBConnectionToServer::didDeleteObjectStore):
        (WebCore::IDBClient::IDBConnectionToServer::clearObjectStore):
        (WebCore::IDBClient::IDBConnectionToServer::didClearObjectStore):
        (WebCore::IDBClient::IDBConnectionToServer::createIndex):
        (WebCore::IDBClient::IDBConnectionToServer::didCreateIndex):
        (WebCore::IDBClient::IDBConnectionToServer::deleteIndex):
        (WebCore::IDBClient::IDBConnectionToServer::didDeleteIndex):
        (WebCore::IDBClient::IDBConnectionToServer::putOrAdd):
        (WebCore::IDBClient::IDBConnectionToServer::didPutOrAdd):
        (WebCore::IDBClient::IDBConnectionToServer::getRecord):
        (WebCore::IDBClient::IDBConnectionToServer::didGetRecord):
        (WebCore::IDBClient::IDBConnectionToServer::getCount):
        (WebCore::IDBClient::IDBConnectionToServer::didGetCount):
        (WebCore::IDBClient::IDBConnectionToServer::deleteRecord):
        (WebCore::IDBClient::IDBConnectionToServer::didDeleteRecord):
        (WebCore::IDBClient::IDBConnectionToServer::openCursor):
        (WebCore::IDBClient::IDBConnectionToServer::didOpenCursor):
        (WebCore::IDBClient::IDBConnectionToServer::iterateCursor):
        (WebCore::IDBClient::IDBConnectionToServer::didIterateCursor):
        (WebCore::IDBClient::IDBConnectionToServer::saveOperation): Deleted.
        (WebCore::IDBClient::IDBConnectionToServer::completeOperation): Deleted.
        * Modules/indexeddb/client/IDBConnectionToServer.h:

        - Give TransactionOperation a ThreadIdentifier member
        - Privatize most public methods from TransactionOperation
        - Make IDBRequestData a friend so it can get at the private methods
        * Modules/indexeddb/client/TransactionOperation.h:
        (WebCore::IDBClient::TransactionOperation::~TransactionOperation):
        (WebCore::IDBClient::TransactionOperation::perform):
        (WebCore::IDBClient::TransactionOperation::completed):
        (WebCore::IDBClient::TransactionOperation::originThreadID):
        (WebCore::IDBClient::TransactionOperation::transactionIdentifier):
        (WebCore::IDBClient::TransactionOperation::objectStoreIdentifier):
        (WebCore::IDBClient::TransactionOperation::indexIdentifier):
        (WebCore::IDBClient::TransactionOperation::cursorIdentifier):
        (WebCore::IDBClient::TransactionOperation::transaction):
        (WebCore::IDBClient::TransactionOperation::indexRecordType):

2016-05-05  Zalan Bujtas  <zalan@apple.com>

        Do not attempt to compute min/max width.
        https://bugs.webkit.org/show_bug.cgi?id=157320

        Reviewed by David Hyatt.

        Replaced elements with no intrinsic size (only with ratio) should not call the containing
        block to compute the min/max width when the containing block's min/max width
        depends on the children's intrinsic size. It could lead to infinite recursion.

        Test: fast/replaced/before-content-intrinsic-crash.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeReplacedLogicalWidthRespectingMinMaxWidth): Unrelated code change.
        * rendering/RenderImage.cpp: Unrelated code change.
        (WebCore::RenderImage::RenderImage): Deleted.
        * rendering/RenderImage.h:
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::computeReplacedLogicalWidth):

2016-05-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: Move all IDB DOM object management from IDBConnectionToServer to IDBConnectionProxy.
        https://bugs.webkit.org/show_bug.cgi?id=157348

        Reviewed by Alex Christensen.

        No new tests (Refactor, no change in behavior yet).

        This is in-progress IDB-in-Workers code that is isolated enough to land right now.
        
        The goal is to have IDBConnectionToServer be a main-thread-only object, leaving IDBConnectionProxy
        as the threading bridge between the worker thread and the main thread.
        
        As such, IDBConnectionToServer no longer maintains maps of IDB DOM objects, but instead the proxy
        does and guards that access with locks.
        
        No threading changes takes place in this patch but it does scatter some isMainThread() checks and FIXMEs 
        accurately representing where threading changes will take place once I can return to this.
        
        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::IDBDatabase):
        (WebCore::IDBDatabase::~IDBDatabase):
        (WebCore::IDBDatabase::maybeCloseInServer):

        * Modules/indexeddb/IDBOpenDBRequest.cpp:
        (WebCore::IDBOpenDBRequest::dispatchEvent):

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::abortOnServerAndCancelRequests):
        (WebCore::IDBTransaction::commitOnServer):
        (WebCore::IDBTransaction::establishOnServer):

        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::openDatabase):
        (WebCore::IDBClient::IDBConnectionProxy::deleteDatabase):
        (WebCore::IDBClient::IDBConnectionProxy::didOpenDatabase):
        (WebCore::IDBClient::IDBConnectionProxy::didDeleteDatabase):
        (WebCore::IDBClient::IDBConnectionProxy::completeOpenDBRequest):
        (WebCore::IDBClient::IDBConnectionProxy::fireVersionChangeEvent):
        (WebCore::IDBClient::IDBConnectionProxy::didFireVersionChangeEvent):
        (WebCore::IDBClient::IDBConnectionProxy::notifyOpenDBRequestBlocked):
        (WebCore::IDBClient::IDBConnectionProxy::establishTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::didStartTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::commitTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::didCommitTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::abortTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::didAbortTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::hasRecordOfTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::didFinishHandlingVersionChangeTransaction):
        (WebCore::IDBClient::IDBConnectionProxy::databaseConnectionClosed):
        (WebCore::IDBClient::IDBConnectionProxy::registerDatabaseConnection):
        (WebCore::IDBClient::IDBConnectionProxy::unregisterDatabaseConnection):
        * Modules/indexeddb/client/IDBConnectionProxy.h:
        
        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::deleteDatabase):
        (WebCore::IDBClient::IDBConnectionToServer::didDeleteDatabase):
        (WebCore::IDBClient::IDBConnectionToServer::openDatabase):
        (WebCore::IDBClient::IDBConnectionToServer::didOpenDatabase):
        (WebCore::IDBClient::IDBConnectionToServer::establishTransaction):
        (WebCore::IDBClient::IDBConnectionToServer::commitTransaction):
        (WebCore::IDBClient::IDBConnectionToServer::didCommitTransaction):
        (WebCore::IDBClient::IDBConnectionToServer::didFinishHandlingVersionChangeTransaction):
        (WebCore::IDBClient::IDBConnectionToServer::abortTransaction):
        (WebCore::IDBClient::IDBConnectionToServer::didAbortTransaction):
        (WebCore::IDBClient::IDBConnectionToServer::fireVersionChangeEvent):
        (WebCore::IDBClient::IDBConnectionToServer::didFireVersionChangeEvent):
        (WebCore::IDBClient::IDBConnectionToServer::didStartTransaction):
        (WebCore::IDBClient::IDBConnectionToServer::notifyOpenDBRequestBlocked):
        (WebCore::IDBClient::IDBConnectionToServer::databaseConnectionClosed):
        (WebCore::IDBClient::IDBConnectionToServer::registerDatabaseConnection): Deleted.
        (WebCore::IDBClient::IDBConnectionToServer::unregisterDatabaseConnection): Deleted.
        (WebCore::IDBClient::IDBConnectionToServer::hasRecordOfTransaction): Deleted.
        * Modules/indexeddb/client/IDBConnectionToServer.h:
        
        * Modules/indexeddb/shared/IDBRequestData.cpp:
        (WebCore::IDBRequestData::IDBRequestData):
        * Modules/indexeddb/shared/IDBRequestData.h:
        
        * Modules/indexeddb/shared/IDBResourceIdentifier.cpp:
        (WebCore::IDBResourceIdentifier::IDBResourceIdentifier):
        * Modules/indexeddb/shared/IDBResourceIdentifier.h:

2016-05-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: Add isolatedCopy to a few more objects.
        https://bugs.webkit.org/show_bug.cgi?id=157330

        Reviewed by Alex Christensen.

        No new tests (No current change in behavior, will be tested as bug 149953 makes progress).

        * Modules/indexeddb/shared/IDBRequestData.cpp:
        (WebCore::IDBRequestData::IDBRequestData):
        (WebCore::IDBRequestData::isolatedCopy):
        * Modules/indexeddb/shared/IDBRequestData.h:

        * Modules/indexeddb/shared/IDBResultData.cpp:
        (WebCore::IDBResultData::IDBResultData):
        (WebCore::IDBResultData::isolatedCopy):
        * Modules/indexeddb/shared/IDBResultData.h:

2016-05-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: Add thread identifiers and assertions to IDB DOM objects.
        https://bugs.webkit.org/show_bug.cgi?id=157329

        Reviewed by Alex Christensen.

        No new tests (No current change in behavior, will be tested as bug 149953 makes progress).

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::IDBCursor):
        (WebCore::IDBCursor::~IDBCursor):
        (WebCore::IDBCursor::sourcesDeleted):
        (WebCore::IDBCursor::transaction):
        (WebCore::IDBCursor::direction):
        (WebCore::IDBCursor::update):
        (WebCore::IDBCursor::advance):
        (WebCore::IDBCursor::continueFunction):
        (WebCore::IDBCursor::uncheckedIterateCursor):
        (WebCore::IDBCursor::deleteFunction):
        (WebCore::IDBCursor::setGetResult):
        
        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::~IDBDatabase):
        (WebCore::IDBDatabase::hasPendingActivity):
        (WebCore::IDBDatabase::name):
        (WebCore::IDBDatabase::version):
        (WebCore::IDBDatabase::objectStoreNames):
        (WebCore::IDBDatabase::createObjectStore):
        (WebCore::IDBDatabase::transaction):
        (WebCore::IDBDatabase::deleteObjectStore):
        (WebCore::IDBDatabase::close):
        (WebCore::IDBDatabase::maybeCloseInServer):
        (WebCore::IDBDatabase::activeDOMObjectName):
        (WebCore::IDBDatabase::canSuspendForDocumentSuspension):
        (WebCore::IDBDatabase::stop):
        (WebCore::IDBDatabase::startVersionChangeTransaction):
        (WebCore::IDBDatabase::didStartTransaction):
        (WebCore::IDBDatabase::willCommitTransaction):
        (WebCore::IDBDatabase::didCommitTransaction):
        (WebCore::IDBDatabase::willAbortTransaction):
        (WebCore::IDBDatabase::didAbortTransaction):
        (WebCore::IDBDatabase::didCommitOrAbortTransaction):
        (WebCore::IDBDatabase::fireVersionChangeEvent):
        (WebCore::IDBDatabase::dispatchEvent):
        (WebCore::IDBDatabase::didCreateIndexInfo):
        (WebCore::IDBDatabase::didDeleteIndexInfo):
        * Modules/indexeddb/IDBDatabase.h:
        (WebCore::IDBDatabase::originThreadID):
        
        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::IDBIndex):
        (WebCore::IDBIndex::~IDBIndex):
        (WebCore::IDBIndex::name):
        (WebCore::IDBIndex::objectStore):
        (WebCore::IDBIndex::keyPath):
        (WebCore::IDBIndex::unique):
        (WebCore::IDBIndex::multiEntry):
        (WebCore::IDBIndex::openCursor):
        (WebCore::IDBIndex::doCount):
        (WebCore::IDBIndex::openKeyCursor):
        (WebCore::IDBIndex::doGet):
        (WebCore::IDBIndex::doGetKey):
        (WebCore::IDBIndex::markAsDeleted):
        
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::IDBObjectStore):
        (WebCore::IDBObjectStore::~IDBObjectStore):
        (WebCore::IDBObjectStore::name):
        (WebCore::IDBObjectStore::keyPath):
        (WebCore::IDBObjectStore::indexNames):
        (WebCore::IDBObjectStore::transaction):
        (WebCore::IDBObjectStore::autoIncrement):
        (WebCore::IDBObjectStore::openCursor):
        (WebCore::IDBObjectStore::get):
        (WebCore::IDBObjectStore::putOrAdd):
        (WebCore::IDBObjectStore::doDelete):
        (WebCore::IDBObjectStore::clear):
        (WebCore::IDBObjectStore::createIndex):
        (WebCore::IDBObjectStore::index):
        (WebCore::IDBObjectStore::deleteIndex):
        (WebCore::IDBObjectStore::doCount):
        (WebCore::IDBObjectStore::markAsDeleted):
        (WebCore::IDBObjectStore::rollbackInfoForVersionChangeAbort):
        
        * Modules/indexeddb/IDBOpenDBRequest.cpp:
        (WebCore::IDBOpenDBRequest::~IDBOpenDBRequest):
        (WebCore::IDBOpenDBRequest::onError):
        (WebCore::IDBOpenDBRequest::versionChangeTransactionDidFinish):
        (WebCore::IDBOpenDBRequest::fireSuccessAfterVersionChangeCommit):
        (WebCore::IDBOpenDBRequest::fireErrorAfterVersionChangeCompletion):
        (WebCore::IDBOpenDBRequest::dispatchEvent):
        (WebCore::IDBOpenDBRequest::onSuccess):
        (WebCore::IDBOpenDBRequest::onUpgradeNeeded):
        (WebCore::IDBOpenDBRequest::onDeleteDatabaseSuccess):
        (WebCore::IDBOpenDBRequest::requestCompleted):
        (WebCore::IDBOpenDBRequest::requestBlocked):
        
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::~IDBRequest):
        (WebCore::IDBRequest::errorCode):
        (WebCore::IDBRequest::error):
        (WebCore::IDBRequest::setSource):
        (WebCore::IDBRequest::setVersionChangeTransaction):
        (WebCore::IDBRequest::transaction):
        (WebCore::IDBRequest::readyState):
        (WebCore::IDBRequest::sourceObjectStoreIdentifier):
        (WebCore::IDBRequest::sourceIndexIdentifier):
        (WebCore::IDBRequest::requestedIndexRecordType):
        (WebCore::IDBRequest::eventTargetInterface):
        (WebCore::IDBRequest::activeDOMObjectName):
        (WebCore::IDBRequest::canSuspendForDocumentSuspension):
        (WebCore::IDBRequest::hasPendingActivity):
        (WebCore::IDBRequest::stop):
        (WebCore::IDBRequest::enqueueEvent):
        (WebCore::IDBRequest::dispatchEvent):
        (WebCore::IDBRequest::uncaughtExceptionInEventHandler):
        (WebCore::IDBRequest::setResult):
        (WebCore::IDBRequest::setResultToStructuredClone):
        (WebCore::IDBRequest::clearResult):
        (WebCore::IDBRequest::setResultToUndefined):
        (WebCore::IDBRequest::resultCursor):
        (WebCore::IDBRequest::willIterateCursor):
        (WebCore::IDBRequest::didOpenOrIterateCursor):
        (WebCore::IDBRequest::requestCompleted):
        (WebCore::IDBRequest::onError):
        (WebCore::IDBRequest::onSuccess):
        * Modules/indexeddb/IDBRequest.h:
        (WebCore::IDBRequest::originThreadID):
        
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::IDBTransaction):
        (WebCore::IDBTransaction::~IDBTransaction):
        (WebCore::IDBTransaction::mode):
        (WebCore::IDBTransaction::db):
        (WebCore::IDBTransaction::serverConnection):
        (WebCore::IDBTransaction::error):
        (WebCore::IDBTransaction::objectStore):
        (WebCore::IDBTransaction::abortDueToFailedRequest):
        (WebCore::IDBTransaction::transitionedToFinishing):
        (WebCore::IDBTransaction::abort):
        (WebCore::IDBTransaction::abortOnServerAndCancelRequests):
        (WebCore::IDBTransaction::activeDOMObjectName):
        (WebCore::IDBTransaction::canSuspendForDocumentSuspension):
        (WebCore::IDBTransaction::hasPendingActivity):
        (WebCore::IDBTransaction::stop):
        (WebCore::IDBTransaction::isActive):
        (WebCore::IDBTransaction::isFinishedOrFinishing):
        (WebCore::IDBTransaction::addRequest):
        (WebCore::IDBTransaction::removeRequest):
        (WebCore::IDBTransaction::scheduleOperation):
        (WebCore::IDBTransaction::scheduleOperationTimer):
        (WebCore::IDBTransaction::operationTimerFired):
        (WebCore::IDBTransaction::commit):
        (WebCore::IDBTransaction::commitOnServer):
        (WebCore::IDBTransaction::finishAbortOrCommit):
        (WebCore::IDBTransaction::didStart):
        (WebCore::IDBTransaction::notifyDidAbort):
        (WebCore::IDBTransaction::didAbort):
        (WebCore::IDBTransaction::didCommit):
        (WebCore::IDBTransaction::fireOnComplete):
        (WebCore::IDBTransaction::fireOnAbort):
        (WebCore::IDBTransaction::enqueueEvent):
        (WebCore::IDBTransaction::dispatchEvent):
        (WebCore::IDBTransaction::createObjectStore):
        (WebCore::IDBTransaction::createObjectStoreOnServer):
        (WebCore::IDBTransaction::didCreateObjectStoreOnServer):
        (WebCore::IDBTransaction::createIndex):
        (WebCore::IDBTransaction::createIndexOnServer):
        (WebCore::IDBTransaction::didCreateIndexOnServer):
        (WebCore::IDBTransaction::requestOpenCursor):
        (WebCore::IDBTransaction::doRequestOpenCursor):
        (WebCore::IDBTransaction::openCursorOnServer):
        (WebCore::IDBTransaction::didOpenCursorOnServer):
        (WebCore::IDBTransaction::iterateCursor):
        (WebCore::IDBTransaction::iterateCursorOnServer):
        (WebCore::IDBTransaction::didIterateCursorOnServer):
        (WebCore::IDBTransaction::requestGetRecord):
        (WebCore::IDBTransaction::requestGetValue):
        (WebCore::IDBTransaction::requestGetKey):
        (WebCore::IDBTransaction::requestIndexRecord):
        (WebCore::IDBTransaction::getRecordOnServer):
        (WebCore::IDBTransaction::didGetRecordOnServer):
        (WebCore::IDBTransaction::requestCount):
        (WebCore::IDBTransaction::getCountOnServer):
        (WebCore::IDBTransaction::didGetCountOnServer):
        (WebCore::IDBTransaction::requestDeleteRecord):
        (WebCore::IDBTransaction::deleteRecordOnServer):
        (WebCore::IDBTransaction::didDeleteRecordOnServer):
        (WebCore::IDBTransaction::requestClearObjectStore):
        (WebCore::IDBTransaction::clearObjectStoreOnServer):
        (WebCore::IDBTransaction::didClearObjectStoreOnServer):
        (WebCore::IDBTransaction::requestPutOrAdd):
        (WebCore::IDBTransaction::putOrAddOnServer):
        (WebCore::IDBTransaction::didPutOrAddOnServer):
        (WebCore::IDBTransaction::deleteObjectStore):
        (WebCore::IDBTransaction::deleteObjectStoreOnServer):
        (WebCore::IDBTransaction::didDeleteObjectStoreOnServer):
        (WebCore::IDBTransaction::deleteIndex):
        (WebCore::IDBTransaction::deleteIndexOnServer):
        (WebCore::IDBTransaction::didDeleteIndexOnServer):
        (WebCore::IDBTransaction::operationDidComplete):
        (WebCore::IDBTransaction::establishOnServer):
        (WebCore::IDBTransaction::activate):
        (WebCore::IDBTransaction::deactivate):

2016-05-05  Nan Wang  <n_wang@apple.com>

        For keyboard users, activating a fragment URL should transfer focus and caret to the destination
        https://bugs.webkit.org/show_bug.cgi?id=116046

        Reviewed by Ryosuke Niwa.

        Added a sequential focus navigation starting node to document. When TAB or SHIFT-TAB is pressed
        and there is no focused element, we start searching for next focus candidates at the sequential
        focus navigation node.

        Test: fast/events/sequential-focus-navigation-starting-point.html

        * dom/Document.cpp:
        (WebCore::Document::removedLastRef):
        (WebCore::Document::destroyRenderTree):
        (WebCore::Document::removeFocusedNodeOfSubtree):
        (WebCore::Document::hoveredElementDidDetach):
        (WebCore::Document::setFocusedElement):
        (WebCore::isNodeFrameOrDocument):
        (WebCore::Document::setFocusNavigationStartingNode):
        (WebCore::Document::focusNavigationStartingNode):
        (WebCore::Document::setCSSTarget):
        (WebCore::Document::nodeChildrenWillBeRemoved):
        (WebCore::Document::nodeWillBeRemoved):
        (WebCore::fallbackFocusNavigationStartingNodeAfterRemoval):
        (WebCore::Document::updateFocusNavigationStartingNodeWithNodeRemoval):
        (WebCore::Document::textInserted):
        * dom/Document.h:
        (WebCore::Document::userActionElements):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMousePressEvent):
        * page/FocusController.cpp:
        (WebCore::FocusController::advanceFocusInDocumentOrder):
        * page/FrameView.cpp:
        (WebCore::FrameView::scrollToAnchor):

2016-05-05  Ryosuke Niwa  <rniwa@webkit.org>

        Another iOS debug build fix after r200464.

        * dom/EventContext.h:
        (WebCore::EventContext::isUnreachableNode):

2016-05-05  Ryosuke Niwa  <rniwa@webkit.org>

        iOS debug build fix after r200464.

        * dom/EventContext.cpp:
        (WebCore::TouchEventContext::checkReachability):

2016-05-05  Simon Fraser  <simon.fraser@apple.com>

        Revert r200390, thus putting r199259 and r200161 and back.

        * loader/HistoryController.cpp:
        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
        * page/FrameView.cpp:
        (WebCore::FrameView::adjustTiledBackingScrollability):
        * page/Page.h:
        (WebCore::Page::obscuredInset):
        (WebCore::Page::setObscuredInset):
        (WebCore::Page::enclosedInScrollableAncestorView):
        (WebCore::Page::setEnclosedInScrollableAncestorView):
        * platform/ScrollView.h:
        (WebCore::ScrollView::platformObscuredInset): Deleted.
        (WebCore::ScrollView::platformSetObscuredInset): Deleted.

2016-05-05  Sam Weinig  <sam@webkit.org>

        Fix the build.

        * platform/network/cf/CertificateInfo.h:

2016-05-05  Eric Carlson  <eric.carlson@apple.com>

        [iOS] Media information is sometimes not shown in Control Center
        https://bugs.webkit.org/show_bug.cgi?id=157377

        Reviewed by Jer Noble.

        * platform/audio/ios/MediaSessionManagerIOS.h:
        * platform/audio/ios/MediaSessionManagerIOS.mm:
        (WebCore::MediaSessionManageriOS::updateNowPlayingInfo): Store values passed to MPNowPlayingInfoCenter
          individually instead of in a dictionary.

2016-05-04  Simon Fraser  <simon.fraser@apple.com>

        Comments on wired.com are blurry
        https://bugs.webkit.org/show_bug.cgi?id=148630
        rdar://problem/22499655

        Reviewed by Tim Horton.

        Make sure to set -rasterizationScale on TileGrid container layers to avoid blurry layers
        with some configurations of transforms, perspective and clipping.

        Test: compositing/contents-scale/rasterization-scale.html

        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::TileController): Initialize m_deviceScaleFactor before m_tileGrid,
        because TileGrid's constructor needs to read the device scale.
        * platform/graphics/ca/TileController.h:
        * platform/graphics/ca/TileGrid.cpp:
        (WebCore::TileGrid::TileGrid): Push a contentsScale (which also sets rasterizationScale) onto 
        the tile grid container layer on constructions, and in setScale().
        (WebCore::TileGrid::setScale):

2016-05-05  Ryosuke Niwa  <rniwa@webkit.org>

        event.target shouldn't be retargeted as the event bubbles into a slot
        https://bugs.webkit.org/show_bug.cgi?id=157369

        Reviewed by Antti Koivisto.

        When an event bubbles up from an assigned node to its assigned slot, we shouldn't be adjusting
        event.target to point to the slot. Since a shadow tree should have access to nodes outside
        the shadow tree, event.target is accessible inside the shadow tree of such a slot.

        New behavior matches the behavior of Google Chrome Canary as well as the shadow DOM specification:
        http://w3c.github.io/webcomponents/spec/shadow/#dfn-retargeting-algorithm

        Test: fast/shadow-dom/event-inside-slotted-node.html

        * dom/Event.cpp:
        (WebCore::Event::deepPath):
        * dom/EventContext.h:
        (WebCore::EventContext::isUnreachableNode): Use Node::isUnclosedNode instead of isReachable.
        (WebCore::EventContext::isReachable): Deleted.
        * dom/EventPath.cpp:
        (WebCore::EventPath::EventPath): Don't set the target to the slot when entering a slot. Also moved
        the code to adjust the target as we exit a shadow tree to the end of the outer loop for clarity.
        (WebCore::isUnclosedNodeOf): Deleted. Renamed to Node::isUnclosedNode.
        (WebCore::EventPath::setRelatedTarget):
        (WebCore::EventPath::computePathUnclosedToTarget): Renamed from computePathDisclosedToTarget.
        (WebCore::moveOutOfAllShadowRoots): Extracted from RelatedNodeRetargeter::RelatedNodeRetargeter.
        (WebCore::RelatedNodeRetargeter::RelatedNodeRetargeter): Fixed a bug that we were exiting early
        without setting m_hasDifferentTreeRoot true when target and relatedNode are disconnected from
        a document.
        (WebCore::RelatedNodeRetargeter::currentNode):
        (WebCore::RelatedNodeRetargeter::checkConsistency): Updated to match the spec with one exception.
        We don't use null as the adjusted related target when the (original) related target and the target
        are in two distinct disconnected trees since such a behavior is not Web compatible. This spec bug is
        tracked by https://github.com/w3c/webcomponents/issues/494
        * dom/EventPath.h:
        (WebCore::EventPath::eventTargetRespectingTargetRules): Returns Node* instead of EventTarget* since
        we need a Node in RelatedNodeRetargeter::checkConsistency.
        * dom/Node.cpp:
        (WebCore::Node::isUnclosedNode): Moved from RelatedNodeRetargeter.cpp
        * dom/Node.h:

2016-05-02  Sam Weinig  <sam@webkit.org>

        On platforms that support it, use a SecTrustRef as the basis of CertificateInfo instead of a chain of SecCertificateRefs.
        https://bugs.webkit.org/show_bug.cgi?id=157220

        Reviewed by Darin Adler.

        * platform/network/cf/CertificateInfo.h:
        (WebCore::CertificateInfo::CertificateInfo):
        (WebCore::CertificateInfo::trust):
        (WebCore::CertificateInfo::isEmpty):
        (WebCore::CertificateInfo::setCertificateChain): Deleted.
        (WebCore::CertificateInfo::certificateChain): Deleted.
        * platform/network/mac/CertificateInfoMac.mm:
        (WebCore::CertificateInfo::type):
        (WebCore::CertificateInfo::certificateChain):
        (WebCore::CertificateInfo::containsNonRootSHA1SignedCertificate):
        (WebCore::CertificateInfo::dump):
        When supported, allow CertificateInfo to contain a SecTrustRef instead of a certificate chain. We keep
        support for holding on to a certificate chain as well, since there is API that depends on this.

        * platform/network/cocoa/ResourceResponseCocoa.mm:
        (WebCore::ResourceResponse::platformCertificateInfo):
        When supported, use the SecTrustRef from the error instead of extracting it's certificate chain.

2016-05-04  Ada Chan  <adachan@apple.com>

        When exiting fullscreen, call a JS method immediately to implement the style changes for the presentation mode change right away
        https://bugs.webkit.org/show_bug.cgi?id=157359

        Reviewed by Eric Carlson.

        No new tests as this is done to just mitigate a visual glitch.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::exitFullscreen):
        (WebCore::HTMLMediaElement::updateMediaControlsAfterPresentationModeChange):
        * html/HTMLMediaElement.h:

2016-05-04  Alex Christensen  <achristensen@webkit.org>

        Blocked redirected main resource requests need descriptive errors
        https://bugs.webkit.org/show_bug.cgi?id=156828
        rdar://problem/25711316

        Reviewed by Daniel Bates.

        Test: http/tests/contentextensions/main-resource-redirect-error.html

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource):
        Call cancelMainResourceLoad() so that InjectedBundlePage::didFailProvisionalLoadWithErrorForFrame()
        is called to be consistent with blocked redirected main resource requests.
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::willSendRequestInternal):
        (WebCore::ResourceLoader::blockedError):
        (WebCore::ResourceLoader::blockedByContentBlockerError):
        (WebCore::ResourceLoader::cannotShowURLError):
        * loader/ResourceLoader.h:
        Use a blockedByContentBlockerError() instead of a cannotShowURLError() when we blocked the load.

2016-05-05  Zan Dobersek  <zdobersek@igalia.com>

        Fix assertions in debug builds for the GTK+ port.

        Rubber-stamped by Carlos Garcia Campos.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGLData::SharedGLData::currentSharedGLData):
        Switch back to the find() + add() combo for retrieving the pointer
        to the SharedGLData object stored for the specific GraphicsContext3D.
        add() + isNewEntry is causing assertions in debug builds when adding
        the first entry.

2016-05-05  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GStreamer] Adaptive streaming issues
        https://bugs.webkit.org/show_bug.cgi?id=144040

        Reviewed by Philippe Normand.

        In the case of adaptive streaming, the GST URI downloader object is creating the source object, in our case
        WebKitWebSrc, without taking its ownership. This is breaking the lifetime of the WebKitWebSrc element. We are
        using GRefPtr in WebKitWebSrc to ref/unref the object when sending notifications to the main thread, ensuring
        that the object is not destroyed before the main thread dispatches the message. But our smart pointers are so
        smart that in case of receiving a floating reference, it's converted to a full reference, so that the first time
        we try to take a ref of a WebKitWebSrc having a floating reference we are actually taking the ownership
        instead. When we try to release the reference, we are actuallty destroying the object, something that the actual
        owner is not expecting and causing runtime critical warnings and very often web process crashes.

            (WebKitWebProcess:6863): GStreamer-CRITICAL **:
            Trying to dispose element appsrc1, but it is in READY instead of the NULL state.
            You need to explicitly set elements to the NULL state before
            dropping the final reference, to allow them to clean up.
            This problem may also be caused by a refcounting bug in the
            application or some element.

            (WebKitWebProcess:6863): GStreamer-CRITICAL **: gst_uri_handler_get_uri: assertion 'GST_IS_URI_HANDLER(handler)' failed

            (WebKitWebProcess:6863): GStreamer-CRITICAL **: gst_uri_get_protocol: assertion 'uri != NULL' failed

        This should be fixed in GST, but we can workaround it in WebKit while it's fixed in GST or to prevent this from
        happening if other users make the same mistake. The idea is to add a ensureGRef() only available for GRefPtr
        when using WebKitWebSrc objects that consumes the floating reference if needed before taking the actual reference.

        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
        (WTF::ensureGRef): Consume the floating ref if needed.
        * platform/graphics/gstreamer/GRefPtrGStreamer.h:
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (webKitWebSrcChangeState): Use ensureGRef().

2016-05-05  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] Unreviewed speculative buildfix after r200433, just for fun.

        * PlatformMac.cmake:

2016-05-04  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] Clean up TextureMapperShaderProgram
        https://bugs.webkit.org/show_bug.cgi?id=157302

        Reviewed by Carlos Garcia Campos.

        Clean up the header and the implementation file of the
        TextureMapperShaderProgram class. Reference the GraphicsContext3D
        object through a Ref<>, and have the context() return a reference,
        not a pointer.

        Sort the parts of the implementation file into something more
        sensible. StringBuilder usage in create() is improved. getLocation()
        only needs to do one lookup in the m_variables map by using ensure().

        No new tests -- no change in behavior.

        * platform/graphics/surfaces/GLTransportSurface.cpp:
        (WebCore::GLTransportSurface::initializeShaderProgram):
        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGLData::SharedGLData::getShaderProgram):
        (WebCore::prepareFilterProgram):
        * platform/graphics/texmap/TextureMapperShaderProgram.cpp:
        (WebCore::TextureMapperShaderProgram::create):
        (WebCore::TextureMapperShaderProgram::TextureMapperShaderProgram):
        (WebCore::TextureMapperShaderProgram::~TextureMapperShaderProgram):
        (WebCore::TextureMapperShaderProgram::setMatrix):
        (WebCore::TextureMapperShaderProgram::getLocation):
        * platform/graphics/texmap/TextureMapperShaderProgram.h:
        (WebCore::TextureMapperShaderProgram::context):

2016-05-03  Darin Adler  <darin@apple.com>

        Start on dictionary support for IDL, getting enough to work for one dictionary
        https://bugs.webkit.org/show_bug.cgi?id=157336

        Reviewed by Alex Christensen.

        * bindings/js/JSDOMBinding.h: Return RefPtr instead of PassRefPtr for the return
        value of toArrayBufferView. Not only is this the correct modern idiom, it also
        works properly with auto, and PassRefPtr does not.

        * bindings/js/JSDOMBuild.h: Added. This has the build function template in it.
        It's used to build values like dictionaries. We specialize and call the tempate
        in generated code. This is only the initial simplistic version; will be refining
        for exception handling, optional handling, default value handling, and lots of
        other things not yet needed for this first dictionary.

        * bindings/scripts/CodeGenerator.pm:
        (ProcessDocument): Handle dictionaries much like how we handle enumerations.
        (SkipIncludeHeader): Moved small list of special types here from CodeGeneratorJS.
        (IsDictionaryType): Added.
        (IsRefPtrType): Make this return 0 for dictionary types.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateInterface): Added handling for dictionaries.
        (SkipIncludeHeader): Deleted.
        (AddIncludesForType): Call the the SkipIncludeHeader from CodeGenerator.pm directly.
        (GetNestedClassName): Factored out the work that was previously in
        GetEnumerationClassName so we could reuse it for dictionaries too.
        (GetEnumerationClassName): Changed to call GetNestedClassName.
        (GetEnumerationClassIdentifier): Deleted. Instead of using this, we now use templates
        so we can use the actual class name.
        (GenerateEnumerationImplementationContent): Changed parse and expectedEnumerationValues
        to use function template specialization instead of functions. This cleans up the code
        a bit and makes it eaiser to use from other templates. Later we may want to merge the
        parse function template build function template from JSDOMBuild.h. Added specialization
        of the build function template.
        (GetDictionaryClassName): Added. Calls GetNestedClassName.
        (GenerateDictionaryImplementationContent): Added. Generates the build function for each
        dictionary type. Initial simplistic version to be refined.
        (GenerateImplementation): Added dictionaries argument and called the
        GenerateDictionaryImplementationContent function. Also changed many functions to take
        interface arguments and also removed redundant interfaceName arguments from functions
        that formerly took both.
        (GenerateParametersCheck): Updated for changes above. That includes calling the new
        parse function template. Also changed to use auto and WTFMove, which makes the code
        both more generic and potentially more efficient and obviates the need for a special
        case for dictionary types.
        (GenerateCallbackHeader): Updated for changes above.
        (GenerateCallbackImplementation): Ditto.
        (GenerateImplementationFunctionCall): Ditto.
        (GetNativeTypeFromSignature): Ditto.
        (GetNativeType): Changed this function to take the interface because that's needed to
        get the type name right for enumeration types rather than returning "auto". Made that
        change as well. Moved one type, DOMStringList, into the nativeType hash instead of
        having explicit code here for it. Didn't add a dictionary type case here yet, but
        probably will need to do that in the next patch.
        (ShouldPassWrapperByReference): Pass interface in to GetNativeType.
        (GetNativeVectorInnerType): Removed unneeded special case for DOMString.
        (GetNativeTypeForCallbacks): Changed to take the interface.
        (GetNativeTypeForMemoization): Ditto.
        (JSValueToNative): Changed expression for Dictionary (the thing I am working to make
        obsolete) to name the type so it will work with auto. Added a case for dictionary
        types and updated the case for enumeration types.
        (NativeToJSValue): Updated to take an interface rather than an interface name, and to
        pass that along as needed.

        * bindings/scripts/IDLParser.pm:
        (Parse): Add dictionaries to a list.
        (parseDictionary): Put name, extended attributes, and members into the dictionary.
        (parseDictionaryMembers): Build up a members array.
        (parseDictionaryMember): Put isOptional, type, name, and default value into the
        dictionary member.

        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        * bindings/scripts/test/JS/JSTestNode.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        Regenerated.

        * bindings/scripts/test/TestObj.idl: Added some test cases that I was using to
        get the bindings script to work. Right now this is basically identical to the
        actual use of this in Element.idl, but over time I will modify it to cover more
        features of dictionaries. Also fixed some incorrect test cases trying to use
        the type "bool", which doesn't exist in IDL.

        * dom/Element.cpp:
        (WebCore::Element::canHaveUserAgentShadowRoot): Added. The existing code used a
        combination of a virtual function on HTMLElement and type checking. It's better
        to just use a virtual function on Element.
        (WebCore::Element::attachShadow): Updated to take a ShadowRootInit struct instead
        of a Dictionary. Also tweaked the code in a couple other minor ways.

        * dom/Element.h: Added the ShadowRootMode enum class and the ShadowRootInit struct,
        and changed attachShadow to take ShadowRootInit instead of Dictionary. Also added
        the private canHaveUserAgentShadowRoot virtual function.

        * dom/Element.idl: Added ShadowRootMode, ShadowRootInit, and used them in as the
        arguemnt type for attachShadow.

        * html/HTMLElement.h: Made canHaveUserAgentShadowRoot a private override instead
        of a public virtual function.

2016-05-04  Eric Carlson  <eric.carlson@apple.com>

        [iOS] Playback does not pause when locking screen after playing to AirPlay.
        https://bugs.webkit.org/show_bug.cgi?id=157366
        <rdar://problem/22100651>

        Reviewed by Dean Jackson.

        * platform/audio/PlatformMediaSession.cpp:
        (WebCore::PlatformMediaSession::isPlayingToWirelessPlaybackTargetChanged): Save and restore
          m_interruptionCount around calling sessionIsPlayingToWirelessPlaybackTargetChanged because
          it will call beginInterruption if we are already in the background and the counter will
          get out of sync.

2016-05-04  Daniel Bates  <dabates@apple.com>

        CSP: Perform case sensitive match against path portion of source expression URL that ends in '/'
        https://bugs.webkit.org/show_bug.cgi?id=157275

        Reviewed by Darin Adler.

        Merged from Blink:
        <https://chromium.googlesource.com/chromium/src/+/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb>

        Perform a case-sensitive prefix match of the path portion a source expression that ends in '/'
        against the path portion of a request URL as per step 8.5.4 of section Does url match expression
        in origin with redirect count of the Content Security Policy Level 3 spec., <https://w3c.github.io/webappsec-csp>
        (Editor's Draft, 27 April 2016).

        * page/csp/ContentSecurityPolicySource.cpp:
        (WebCore::ContentSecurityPolicySource::pathMatches):

2016-05-04  Aaron Chu  <aaron_chu@apple.com>

        AX: Nonfunctional controls appear before every HTML5 video when using VoiceOver
        https://bugs.webkit.org/show_bug.cgi?id=153089
        <rdar://problem/24050668>

        Reviewed by Dean Jackson.

        Test: media/video-controls-show-on-kb-or-ax-event.html

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller):
        (Controller.prototype.createControls):
        (Controller.prototype.updateControls):
        (Controller.prototype.handlePlayButtonClicked):
        (Controller.prototype.setPlaying):
        (Controller.prototype.showShowControlsButton):
        (Controller.prototype.showControls):
        (Controller.prototype.hideControls):
        * Modules/mediacontrols/mediaControlsiOS.js:
        (ControllerIOS.prototype.addStartPlaybackControls):
        (ControllerIOS.prototype.handleStartPlaybackButtonTouchEnd):
        (ControllerIOS.prototype.showControls):

        Fix to make sure the showControls button in a media player behaves correctly.

2016-05-04  Dean Jackson  <dino@apple.com>

        Disabling WebGL2 should mean no context is created
        https://bugs.webkit.org/show_bug.cgi?id=157352
        <rdar://problem/26096346>

        Reviewed by Eric Carlson.

        If WebGL2 is disabled by the runtime flag, we should
        not create a context.

        Test: fast/canvas/webgl/webgl2-runtime-flag.html

        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::create):
        * testing/Internals.cpp: Added some helpers to toggle the runtime setting.
        (WebCore::Internals::webGL2Enabled):
        (WebCore::Internals::setWebGL2Enabled):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-05-04  Anders Carlsson  <andersca@apple.com>

        Add an override point for drawing named images in ThemeCocoa
        https://bugs.webkit.org/show_bug.cgi?id=157357
        rdar://problem/25878445

        Reviewed by Dean Jackson.

        Rename ThemeCocoa.cpp to ThemeCocoa.mm and rearrange the code that draws the wireless-playback image
        so we can import ThemeCocoaDrawNamedImage.mm below.

        * WebCore.xcodeproj/project.pbxproj:
        * platform/cocoa/ThemeCocoa.cpp:
        (WebCore::fitContextToBox): Deleted.
        (WebCore::ThemeCocoa::drawNamedImage): Deleted.
        * platform/cocoa/ThemeCocoa.mm: Renamed from Source/WebCore/platform/cocoa/ThemeCocoa.cpp.
        (WebCore::fitContextToBox):
        (WebCore::ThemeCocoa::drawNamedImage):

2016-05-04  Jeremy Jones  <jeremyj@apple.com>

        Don't disconnect WebAVPlayerController from its delegate since there is no way to reconnect it.
        https://bugs.webkit.org/show_bug.cgi?id=157337

        Reviewed by Jer Noble.

        WebAVPlayerController used to be deleted and recreated each time we begin fullscreen video mode.
        Since it is now preserved, we shouldn't paritally tear it down in cleanupFullscreen by disconnecting it
        from its delegate, especially since we have no way to reconnect it.

        The side effect of leaving it connected is that it can continue to make callbacks during cleanup.
        Of importance is that it sets the audio and legible media selctions to nil. We don't want to change 
        the selection as a result of teardown. Nil selection is unsupported by WebVideoFullscreenModelVideoElement
        and causes an assert. This transition to nil selection is now ignored.

        * platform/ios/WebAVPlayerController.mm:
        (-[WebAVPlayerController setCurrentAudioMediaSelectionOption:]):
        (-[WebAVPlayerController setCurrentLegibleMediaSelectionOption:]):
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (WebVideoFullscreenInterfaceAVKit::cleanupFullscreen):

2016-05-04  Chris Dumez  <cdumez@apple.com>

        Media elements should not be paused right away when removed from the document
        https://bugs.webkit.org/show_bug.cgi?id=157347
        <rdar://problem/25888758>

        Reviewed by Alex Christensen.

        Media elements should not be paused right away when removed from the document.
        Instead we should allow the task that removed the media element from the
        document to finish because considering pausing.

        This avoid inadvertently pausing media elements when the JS merely moves them
        on the page (e.g. using Node.replaceChild()).

        Text from the HTML specification:
        """
        When a media element is removed from a Document, the user agent must run the
        following steps:
        1.  Await a stable state, allowing the task that removed the media element
            from the Document to continue. The synchronous section consists of all the
            remaining steps of this algorithm. (Steps in the synchronous section are
            marked with ⌛.)
        2. ⌛ If the media element is in a Document, abort these steps.
        3. ⌛ Run the internal pause steps for the media element.
        """

        c.f. https://html.spec.whatwg.org/multipage/embedded-content.html#htmlmediaelement

        Test: media/replaceChild-should-not-pause-video.html

        * dom/GenericEventQueue.cpp:
        (WebCore::GenericEventQueue::sharedTimerFired):
        Copy the queue of events before processing it so that we don't fire events that
        get scheduled by the event handlers as a result of us firing the pending events.
        Otherwise, we end up firing events synchronously right after they've been queued,
        which is wrong. This was causing several W3C tests to fail.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::pauseAfterDetachedTimerFired):
        (WebCore::HTMLMediaElement::removedFrom):
        * html/HTMLMediaElement.h:
        After the media element gets removed from the document, schedule a 0 timer before
        pausing the media element, to give the task that removed us a chance to finish.
        When the timer fires, we check if we were added back into an active document and
        avoid pausing in such case.

2016-05-04  Filip Pizlo  <fpizlo@apple.com>

        Speed up JSGlobalObject initialization by making some properties lazy
        https://bugs.webkit.org/show_bug.cgi?id=157045

        Reviewed by Keith Miller.

        No new tests because no change in behavior.
        
        This adapts JSHTMLElementCustom.cpp to the new JSWithScope API. Note that this revealed
        that this was using a curious choice of global object, which may not be right. I decided
        to do a very literal refactoring that exactly preserves what this code got before, but I
        added a FIXME to reconsider this later.

        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore::JSHTMLElement::pushEventHandlerScope):

2016-05-04  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Refactor information stored related to column positions
        https://bugs.webkit.org/show_bug.cgi?id=157342

        Reviewed by Darin Adler.

        In m_columnPositions we were storing position of each column
        including the alignment offset, always from the logical left,
        and the border and padding, depending on the direction.

        This was really confusing as in the case of RTL direction
        we were adding the offset from the left and
        the right border and padding.

        This patches changes it to store always the info from the left,
        so even in RTL direction we use the left border and padding.

        This allows us to simplify translateRTLCoordinate() as
        it doesn't need to care about border and padding anymore.
        And also to refactor offsetAndBreadthForPositionedChild()
        which became really complex after adding RTL support.

        No new tests, no change of behavior.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        (WebCore::RenderGrid::populateGridPositions):
        (WebCore::RenderGrid::translateRTLCoordinate):

2016-05-04  Mark Lam  <mark.lam@apple.com>

        ES6 Function.name inferred from property names of literal objects can break some websites.
        https://bugs.webkit.org/show_bug.cgi?id=157246

        Reviewed by Geoffrey Garen.

        Test: js/dom/regress-157246.html

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::finishCreation):
        - Set the needsSiteSpecificQuirks flag in the JSGlobalObject if needed.

2016-05-04  Konstantin Tokarev  <annulen@yandex.ru>

        Deduplicated initializer lists of BitmapImage constructors.
        https://bugs.webkit.org/show_bug.cgi?id=157249

        Reviewed by Darin Adler.

        No new tests needed.

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::BitmapImage): Added new private constructor of
        BitmapImage for delegation purpose only.
        * platform/graphics/BitmapImage.h: Use inline initialization for some
        BitmapImage fields.
        * platform/graphics/cairo/BitmapImageCairo.cpp:
        (WebCore::BitmapImage::BitmapImage): Delegate field initialization to
        new private constructor.
        * platform/graphics/cg/BitmapImageCG.cpp:
        (WebCore::BitmapImage::BitmapImage): Ditto.

2016-05-04  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r200383 and r200406.

        Seems to have caused crashes on iOS / ARMv7s

        Reverted changesets:

        "Speed up JSGlobalObject initialization by making some
        properties lazy"
        https://bugs.webkit.org/show_bug.cgi?id=157045
        http://trac.webkit.org/changeset/200383

        "REGRESSION(r200383): Setting lazily initialized properties
        across frame boundaries crashes"
        https://bugs.webkit.org/show_bug.cgi?id=157333
        http://trac.webkit.org/changeset/200406

2016-05-04  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: ARIA 'region' role is now a landmark; HTML 'section' element should be a landmark only if named
        https://bugs.webkit.org/show_bug.cgi?id=157331

        Reviewed by Chris Fleizach.

        The 'region' role is now mapped as a landmark: The WebCore DocumentRegionRole
        AccessibilityRole has been renamed to LandmarkRegionRole. The AXDocumentRegion
        subrole has been renamed to AXLandmarkRegion. A 'section' element is mapped to
        the LandmarkRegionRole if it has an author-provided accessible name via either
        the aria-label or aria-labelledby attribute. Otherwise, it is mapped as GroupRole
        with no subrole.

        Our existing test coverage for exposure of the 'region' role and the 'section'
        element is sufficient. These tests were updated to reflect the new behavior.
        Several new test cases were added to cover both sections with accessible names
        and those without.

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::accessibleNameDerivesFromContent):
        (WebCore::AccessibilityObject::isLandmark):
        (WebCore::initializeRoleMap):
        * accessibility/AccessibilityObject.h:
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored):
        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (atkRole):
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper _accessibilityIsLandmarkRole:]):
        (-[WebAccessibilityObjectWrapper determineIsAccessibilityElement]):
        * accessibility/mac/WebAccessibilityObjectWrapperBase.mm:
        (-[WebAccessibilityObjectWrapperBase ariaLandmarkRoleDescription]):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (createAccessibilityRoleMap):
        (-[WebAccessibilityObjectWrapper subrole]):
        * platform/LocalizedStrings.cpp:
        (WebCore::AXARIAContentGroupText):

2016-05-04  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Clicks inside button elements are sometimes discarded when the mouse moves
        https://bugs.webkit.org/show_bug.cgi?id=39620

        Reviewed by Darin Adler.

        Test: fast/events/click-over-descendant-elements.html

        * dom/Node.cpp:
        (WebCore::ancestor):
        (WebCore::commonAncestor): Method inspired from
        http://src.chromium.org/viewvc/blink?view=revision&revision=162081.
        (WebCore::commonAncestorCrossingShadowBoundary): Helper routine
        that handles the case of nodes into a shadow node.
        * dom/Node.h:
        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMouseReleaseEvent): Selecting click event
        target node according commonAncestorOverShadowBoundary method.
        (WebCore::EventHandler::targetNodeForClickEvent): Deleted.

2016-05-04  Zan Dobersek  <zdobersek@igalia.com>

        Unreviewed, fixing crashing GTK+ tests after r200407.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGLData::SharedGLData::~SharedGLData):
        Don't use RELEASE_ASSERT. Also fix the actual assertion,
        checking that any of the values in the map matches the object
        that's being destroyed, instead of checking the keys.

2016-05-04  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Add WKPreference for SelectionPaintingWithoutSelectionGaps
        https://bugs.webkit.org/show_bug.cgi?id=156900

        Reviewed by Michael Catanzaro.

        Unlike other browsers WebKit has been drawing selection gaps
        between render blocks during the text selection. This often
        cause text selection screen looks messy.

        This patch adds a setting method to disable the functionality,
        and EFL port disables it by default.

        * page/Settings.in:
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::shouldPaintSelectionGaps):

2016-05-04  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Rename JSKeyValueIterator as JSDOMIterator
        https://bugs.webkit.org/show_bug.cgi?id=157308

        Reviewed by Darin Adler.

        No change of behavior.

        * bindings/js/JSDOMIterator.h: Renamed from Source/WebCore/bindings/js/JSKeyValueIterator.h.
        (WebCore::JSDOMIteratorPrototype::create):
        (WebCore::JSDOMIteratorPrototype::createStructure):
        (WebCore::JSDOMIteratorPrototype::JSDOMIteratorPrototype):
        (WebCore::createKeyValueIterator):
        (WebCore::keyValueIteratorForEach):
        (WebCore::JSDOMIterator<JSWrapper>::destroy):
        (WebCore::JSDOMIterator<JSWrapper>::next):
        (WebCore::JSDOMIteratorPrototype<JSWrapper>::next):
        (WebCore::JSDOMIteratorPrototype<JSWrapper>::finishCreation):
        * bindings/js/JSFontFaceSetCustom.cpp:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementationIterableFunctions):
        * bindings/scripts/test/JS/JSTestObj.cpp:

2016-05-04  Jiewen Tan  <jiewen_tan@apple.com>

        CrashTracer: [USER] com.apple.WebKit.WebContent at …ple.WebCore: WebCore::EditCommandComposition::unapply + 105
        https://bugs.webkit.org/show_bug.cgi?id=157282
        <rdar://problem/25391441>

        Reviewed by Darin Adler.

        A frame could be destroyed in the middle of executing undo/redo command.
        Therefore, add an early return.

        * editing/CompositeEditCommand.cpp:
        (WebCore::EditCommandComposition::unapply):
        (WebCore::EditCommandComposition::reapply):

2016-05-04  Zan Dobersek  <zdobersek@igalia.com>

        [CoordGraphics] CompositingCoordinator should hande root compositing and view overlay layers separately
        https://bugs.webkit.org/show_bug.cgi?id=157305

        Reviewed by Carlos Garcia Campos.

        Split out handling of the root compositing and the view overlay layers
        into two separate methods. Both do nothing if the passed-in layer is
        the same as the current one. Otherwise, the current one is removed
        from the tree and the new one added to it.

        No change in behavior is expected.

        * platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:
        (WebCore::CompositingCoordinator::setRootCompositingLayer):
        (WebCore::CompositingCoordinator::setViewOverlayRootLayer):
        * platform/graphics/texmap/coordinated/CompositingCoordinator.h:

2016-05-04  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] Clean up TextureMapperGLData, TextureMapperGLData::SharedGLData
        https://bugs.webkit.org/show_bug.cgi?id=157303

        Reviewed by Carlos Garcia Campos.

        Torch the TextureMapperGLData and TextureMapperGLData::SharedGLData
        classes into a better form.

        SharedGLData is now private to the TextureMapperGLData class, but
        lists that class as a friend. This enables moving the getShaderProgram()
        method to TextureMapperGLData and removes the need to expose the
        SharedGLData publicly. SharedGLData also doesn't have to keep a
        reference to the GraphicsContext3D object.

        TextureMapperGLData now default-initializes the publicly accessible
        member variables while making some other members private, not exposing
        anything that isn't necessary.

        Usual whitespace cleanup included. More elegant HashMap::ensure()
        insertions are used where they don't obfuscate object creation.

        No new tests -- no change in behavior.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGLData::SharedGLData::currentSharedGLData):
        (WebCore::TextureMapperGLData::SharedGLData::~SharedGLData):
        (WebCore::TextureMapperGLData::SharedGLData::contextDataMap):
        (WebCore::TextureMapperGLData::SharedGLData::SharedGLData):
        (WebCore::TextureMapperGLData::TextureMapperGLData):
        (WebCore::TextureMapperGLData::~TextureMapperGLData):
        (WebCore::TextureMapperGLData::initializeStencil):
        (WebCore::TextureMapperGLData::getStaticVBO):
        (WebCore::TextureMapperGLData::getShaderProgram):
        (WebCore::TextureMapperGL::TextureMapperGL):
        (WebCore::TextureMapperGL::drawBorder):
        (WebCore::TextureMapperGL::drawTexture):
        (WebCore::TextureMapperGL::drawSolidColor):
        (WebCore::TextureMapperGL::drawFiltered):
        (WebCore::TextureMapperGL::beginClip):
        (WebCore::TextureMapperGLData::SharedGLData::glContextDataMap): Deleted.
        (WebCore::TextureMapperGLData::SharedGLData::getShaderProgram): Deleted.
        (WebCore::TextureMapperGLData::sharedGLData): Deleted.
        * platform/graphics/texmap/TextureMapperGL.h:

2016-05-03  Chris Dumez  <cdumez@apple.com>

        Optimize [StrictTypeChecking] on IDL attributes
        https://bugs.webkit.org/show_bug.cgi?id=157321

        Reviewed by Geoffrey Garen.

        Optimize [StrictTypeChecking] on IDL attributes:
        - Only generate extra code for nullable attributes because for non-nullable
          attributes, JSXXX::toWrapped() will return null in case of a bad input
          type. We will then throw a TypeError when null-checking it already.
        - After the JSValue::isNullOrUndefined() check, avoid calling
          JSXXX::toWrapped() and set nativeValue to nullptr directly.
        - Drop the check for JSValue::inherits(JSXXX::info()) and just do a null
          check on the value returned by JSXXX::toWrapped(). toWrapped() already
          does a JSValue::inherits(JSXXX::info() check. Since we only call
          toWrapped() if the JSValue is not null/undefined, a null return value
          always indicates a bad input type.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_set_strict_type_checking_attribute):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjStrictTypeCheckingAttribute):
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj setStrictTypeCheckingAttribute:]):
        * bindings/scripts/test/TestObj.idl:

2016-05-03  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r199259 and r200161.

        Seems to have caused a ~1.2% PLT regression on iOS

        Reverted changesets:

        "[iOS WK2] WKWebViews should consult ancestor UIScrollViews to
        determine tiling area"
        https://bugs.webkit.org/show_bug.cgi?id=156429
        http://trac.webkit.org/changeset/199259

        "[iOS WK2] When determining tile size, check whether ancestor
        UIScrollViews are actually scrollable"
        https://bugs.webkit.org/show_bug.cgi?id=157107
        http://trac.webkit.org/changeset/200161

2016-05-03  Filip Pizlo  <fpizlo@apple.com>

        Speed up JSGlobalObject initialization by making some properties lazy
        https://bugs.webkit.org/show_bug.cgi?id=157045

        Reviewed by Keith Miller.

        No new tests because no change in behavior.
        
        This adapts JSHTMLElementCustom.cpp to the new JSWithScope API. Note that this revealed
        that this was using a curious choice of global object, which may not be right. I decided
        to do a very literal refactoring that exactly preserves what this code got before, but I
        added a FIXME to reconsider this later.

        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore::JSHTMLElement::pushEventHandlerScope):

2016-05-03  Per Arne Vollan  <peavo@outlook.com>

        [Win] Remove Windows XP Compatibility Requirements
        https://bugs.webkit.org/show_bug.cgi?id=152899

        Reviewed by Brent Fulgham.

        Windows XP is not supported anymore, we can remove compatibility workarounds.

        * platform/text/win/LocaleWin.cpp:
        (WebCore::extractLanguageCode):
        (WebCore::LCIDFromLocaleInternal):
        (WebCore::LCIDFromLocale):
        (WebCore::removeLastComponent): Deleted.
        (WebCore::ensureNameToLCIDMap): Deleted.
        (WebCore::convertLocaleNameToLCID): Deleted.

2016-05-02  Antti Koivisto  <antti@apple.com>

        REGRESSION (r198943): Transitions don't work if they animate display property
        https://bugs.webkit.org/show_bug.cgi?id=157244
        <rdar://problem/26042189>

        Reviewed by Simon Fraser.

        Test: transitions/transition-display-property.html

        * style/RenderTreeUpdater.cpp:
        (WebCore::RenderTreeUpdater::updateBeforeOrAfterPseudoElement):

            Call the common function for ::before/::after updates.

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::resolveElement):
        (WebCore::Style::TreeResolver::createAnimatedElementUpdate):

            If animation forces render tree reconstruction use the original rather than animated style for update.
            Because animations are tied to renderers we start them during renderer construction in this case.

            Factor to a function.

        (WebCore::Style::elementImplicitVisibility):
        * style/StyleTreeResolver.h:

2016-05-03  Pranjal Jumde  <pjumde@apple.com>

        WorkerGlobalScope's self, location and navigator attributes should not be replaceable
        https://bugs.webkit.org/show_bug.cgi?id=157296
        <rdar://problem/25962738>

        Reviewed by Chris Dumez.

        Tests: http/tests/workers/location-readonly.html
               http/tests/workers/navigator-readonly.html
               http/tests/workers/self-readonly.html

        * workers/WorkerGlobalScope.idl:
        The 'self', 'location', and 'navigator' properties of the WorkerGlobalScope must be immutable.
        See: https://html.spec.whatwg.org/multipage/workers.html#the-workerglobalscope-common-interface

2016-05-03  Chris Dumez  <cdumez@apple.com>

        Drop some unnecessary exception checking in the generated bindings
        https://bugs.webkit.org/show_bug.cgi?id=157299

        Reviewed by Darin Adler.

        Drop some unnecessary exception checking in the generated bindings.
        Only do a check for state->hadException() after converting a JSValue
        to a native value when necessary. Update JSValueToNative() to
        indicate the caller if converting to the native value may throw an
        exception.

        This gets rid of a lot of unnecessary branching in the bindings.

        No new tests, no intended web-exposed behavior change.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        (GenerateParametersCheck):
        (JSValueToNative):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:

2016-05-03  Brady Eidson  <beidson@apple.com>

        Add/refactor isolatedCopy methods for 3 IDB classes.
        https://bugs.webkit.org/show_bug.cgi?id=157289

        Reviewed by Alex Christensen.

        No new tests (Refactor, no behavior change).

        In an upcoming, much larger patch, I'll need the ability to directly construct these three objects
        as isolated copies.
        
        This is a nice standalone refactor that enables that ability.

        * Modules/indexeddb/IDBGetResult.cpp:
        (WebCore::IDBGetResult::IDBGetResult):
        (WebCore::IDBGetResult::isolatedCopy):
        * Modules/indexeddb/IDBGetResult.h:
        
        * Modules/indexeddb/IDBKeyData.cpp:
        (WebCore::IDBKeyData::IDBKeyData):
        (WebCore::IDBKeyData::isolatedCopy):
        * Modules/indexeddb/IDBKeyData.h:

        * Modules/indexeddb/shared/IDBTransactionInfo.cpp:
        (WebCore::IDBTransactionInfo::IDBTransactionInfo):
        (WebCore::IDBTransactionInfo::isolatedCopy):
        * Modules/indexeddb/shared/IDBTransactionInfo.h:

2016-05-03  Joanmarie Diggs  <jdiggs@igalia.com>

        [ATK] accessibility/content-editable-as-textarea.html fails
        https://bugs.webkit.org/show_bug.cgi?id=155353

        Reviewed by Darin Adler.

        The test was timing out because it expected an AXValueChanged notification.
        In ATK, AXValueChanged notifications are made for widgets which implement
        the AtkValue interface (sliders, progress bars, etc.). We should be listening
        for AXTextChanged instead.

        In addition, for contenteditable elements, we should emit the notification on
        the element itself. Because we were handling the notification in the same way
        as native text controls (where the notification we receive from WebCore is for
        StaticTextRole children), we were attempting to emit the notification from
        the parent of the contenteditable.

        Lastly, ATK's AccessibilityUIElement support had a number of unimplemented
        methods that are being used as part of the previously-failing test. Those
        methods are now implemented so that the ATK results are much more similar
        to those on the Mac.

        No new tests needed. The previously-failing test now passes.

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::childrenChanged):
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::isNonNativeTextControl):
        * accessibility/AccessibilityObject.h:
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::textChanged):
        * accessibility/atk/AXObjectCacheAtk.cpp:
        (WebCore::AXObjectCache::nodeTextChangePlatformNotification):

2016-05-02  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Add support for position resolution with auto-repeat tracks
        https://bugs.webkit.org/show_bug.cgi?id=157260

        Reviewed by Darin Adler.

        This is a generalization of our position resolution code so it now supports every possible
        type of resolution (definite position, position spans, automatic resolution, named lines
        resolution, grid areas...) under the presence of auto-repeat tracks, i.e., tracks that are
        dynamically created by the LayoutGrid depending on the available space and that cannot be
        directly inferred from the CSS declarations.

        This means that we need two extra things to resolve positions:
        - the LayoutGrid needs to provide the number of auto-repeat tracks per axis
        - a wrapper is needed to hide the eventual presence of auto-repeat tracks (with their line
        names) from the rest of the resolution code which should remain mostly unchanged.

        The former is trivial (requires passing a new argument to some functions at the most) but
        the latter requires a new class called NamedLineCollection. This class allow us to locate
        and resolve named lines without having to insert the auto-repeat named lines in the already
        existing data structures. It does it in a very compact representation as it does not
        duplicate the names for every single repetition.

        No new tests required as there is no change in behavior because the auto-repeat tracks
        computation is not implemented yet. Current tests already test this code extensively, and
        the auto-repeat code paths will be tested later once
        RenderGrid::computeAutoRepeatTracksCount() is implemented.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computeAutoRepeatTracksCount): New method with empty implementation.
        (WebCore::RenderGrid::placeItemsOnGrid): Initialize the auto repeat tracks count.
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        * rendering/RenderGrid.h:
        * rendering/style/GridPositionsResolver.cpp:
        (WebCore::directionFromSide):
        (WebCore::NamedLineCollection::NamedLineCollection): New class which is able to resolve the
        positions of a given named line in the presence of auto-repeat and "normal" tracks.
        (WebCore::NamedLineCollection::isValidNamedLineOrArea): Checks whether the given named line
        is a valid line name or area.
        (WebCore::NamedLineCollection::hasNamedLines): Checks whether the named line exists in the
        given axis (either specified by auto-repeat or "normal" tracks).
        (WebCore::NamedLineCollection::find): Looks for a line number whithin the line numbers where
        the given named line was found.
        (WebCore::NamedLineCollection::contains):
        (WebCore::NamedLineCollection::firstPosition): Returns the first line where the given named
        line is located.
        (WebCore::adjustGridPositionsFromStyle): Use NamedLineCollection.
        (WebCore::GridPositionsResolver::explicitGridColumnCount): Include auto repeat tracks.
        (WebCore::GridPositionsResolver::explicitGridRowCount): Ditto.
        (WebCore::explicitGridSizeForSide): Ditto.
        (WebCore::lookAheadForNamedGridLine): Use NamedLineCollection.
        (WebCore::lookBackForNamedGridLine): Ditto.
        (WebCore::resolveNamedGridLinePositionFromStyle):
        (WebCore::definiteGridSpanWithNamedLineSpanAgainstOpposite):
        (WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveGridPositionAgainstOppositePosition):
        (WebCore::resolveGridPositionFromStyle):
        (WebCore::GridPositionsResolver::resolveGridPositionsFromStyle):
        (WebCore::gridLinesForSide): Deleted.
        (WebCore::GridPositionsResolver::isNonExistentNamedLineOrArea): Deleted.
        * rendering/style/GridPositionsResolver.h:

2016-05-03  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GObject DOM bindings API break after r200316.

        webkit_dom_tree_walker_set_current_node no longer raises exceptions after r200316, so mark it accordingly.

        * bindings/scripts/CodeGeneratorGObject.pm:
        (FunctionUsedToRaiseException):

2016-05-03  Carlos Garcia Campos  <cgarcia@igalia.com>

        [OpenType] OpenTypeVerticalData object should not be created if the font is not OpenType
        https://bugs.webkit.org/show_bug.cgi?id=157172

        Reviewed by Michael Catanzaro.

        It's a bit weird that the object is always created and has an isOpenType() method to check whether it's an
        OpenType or not. The caller is always deleting the object when it's not an OpenType, so it would be better if
        the create method returned nullptr instead of creating the object when the font is not OpenType.

        * platform/graphics/FontCache.cpp:
        (WebCore::FontCache::verticalData): Do not use isOpenType(), we can now simply use the return value of OpenTypeVerticalData::create().
        * platform/graphics/opentype/OpenTypeVerticalData.cpp:
        (WebCore::loadHmtxTable): Moved to a helper funtion that returns false if the font is not OpenType.
        (WebCore::OpenTypeVerticalData::create): Try to load the Hmtx table, and create the object if succeeded or
        return nullptr otherwise.
        (WebCore::OpenTypeVerticalData::OpenTypeVerticalData): Receive the advanceWidths as constructor parameter.
        (WebCore::OpenTypeVerticalData::loadMetrics): Load all other tables.
        * platform/graphics/opentype/OpenTypeVerticalData.h:
        (WebCore::OpenTypeVerticalData::isOpenType): Deleted.

2016-05-02  Darin Adler  <darin@apple.com>

        Change IDL enumerations to be nested in their C++ class instead of at WebCore namespace level
        https://bugs.webkit.org/show_bug.cgi?id=157257

        Reviewed by Chris Dumez.

        Chris and Alex requested this alternate style, where the enum class for each enumeration
        goes inside the class for the interface the enumeration is used in. Also made a rule that
        keeps the names short and not redundant with the class name they are nested in.

        * Modules/fetch/FetchOptions.h: Moved all the enum class types into the struct.

        * Modules/fetch/FetchRequest.cpp:
        (WebCore::setReferrerPolicy): Updated.
        (WebCore::setMode): Ditto.
        (WebCore::setCredentials): Ditto.
        (WebCore::setCache): Ditto.
        (WebCore::setRedirect): Ditto.
        (WebCore::buildOptions): Ditto.
        (WebCore::buildHeaders): Ditto.
        (WebCore::FetchRequest::create): Ditto.
        * Modules/fetch/FetchRequest.h: Used "using" to repeat the types from FetchOptions
        here in FetchRequest. That way the generated bindings can find the types, and we don't
        need to do any trick like [ImplementedAs] in thd IDL to make it work.

        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::error): Updated.
        (WebCore::FetchResponse::redirect): Ditto.
        (WebCore::FetchResponse::FetchResponse): Ditto.
        (WebCore::FetchResponse::startFetching): Ditto.
        * Modules/fetch/FetchResponse.h: Moved enum class into the class.

        * Modules/mediacontrols/MediaControlsHost.cpp:
        (WebCore::MediaControlsHost::externalDeviceType): Updated.
        * Modules/mediacontrols/MediaControlsHost.h: Moved enum classs into the class.

        * Modules/mediasession/MediaSession.cpp:
        (WebCore::MediaSession::MediaSession): Updated.
        * Modules/mediasession/MediaSession.h: Moved enum classs into the class.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::addSourceBuffer): Updated.
        (WebCore::MediaSource::removeSourceBuffer): Ditto.

        * Modules/mediasource/MediaSource.h: Moved enum class into the class.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveRenderingError): Updated.
        (WebCore::SourceBuffer::appendError): Ditto.
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample): Ditto.
        (WebCore::SourceBuffer::textTrackModeChanged): Ditto.

        * Modules/mediasource/SourceBuffer.h: Removed incorrect forward declaration
        of EndOfStreamError that also now seems to be unneeded. Moved enum class into
        the class.

        * Modules/mediastream/MediaDeviceInfo.cpp:
        (WebCore::MediaDeviceInfo::MediaDeviceInfo): Updated.
        (WebCore::MediaDeviceInfo::create): Ditto.
        * Modules/mediastream/MediaDeviceInfo.h: Moved enum class into the class.

        * Modules/mediastream/MediaDevicesRequest.cpp:
        (WebCore::MediaDevicesRequest::didCompleteTrackSourceInfoRequest): Updated.
        * Modules/mediastream/MediaStreamTrack.cpp:
        (WebCore::MediaStreamTrack::readyState): Updated.

        * Modules/mediastream/MediaStreamTrack.h: Moved enum class into the class.

        * Modules/mediastream/RTCConfiguration.h: Moved enum classes into the class.

        * Modules/webaudio/AudioContext.h: Moved enum class into the class.

        * Modules/webaudio/WaveShaperNode.cpp:
        (WebCore::processorType): Updated.
        (WebCore::WaveShaperNode::oversample): Ditto.
        * Modules/webaudio/WaveShaperNode.h: Moved enum class into the class.

        * bindings/js/JSXMLHttpRequestCustom.cpp:
        (WebCore::JSXMLHttpRequest::response): Updated.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateGetOwnPropertySlotBody): Removed unneeded $interfaceName argument.
        (GetAttributeGetterName): Ditto.
        (GetAttributeSetterName): Ditto.
        (GetFunctionName): Tweaked style.
        (AttributeShouldBeOnInstanceForCompatibility): Deleted. Was a function that
        always returned 0.
        (AttributeShouldBeOnInstance): Removed the call to the function above.
        (IsClassNameWordBoundary): Added. Helper for function below.
        (IsPrefixRemovable): Ditto.
        (GetEnumerationClassName): Added an $interface argument and changed this
        so it creates a nested name inside the class rather than a top level name
        for use at the WebCore namespace level.
        (GetEnumerationClassIdentifier): Added. Calls GetEnumerationClassName and
        makes a flattened name without "::" that can be used in an identifier.
        (GenerateEnumerationImplementationContent): Renamed from GetXXX. Added an
        $interface argument, so it can pass that along to the functions above.
        (GenerateHeader): Updated to not pass $interfaceName.
        (GeneratePropertiesHashTable): Ditto.
        (GenerateOverloadedFunction): Removed unneeded $interfaceName argument.
        (GenerateImplementation): Updated for changes above. Tweaked formatting.
        (GenerateFunctionCastedThis): Removed unneeded $interfaceName argument.
        (GenerateParametersCheck): Ditto. Also streamlined implementation a bit
        and made the IsEnumType section call the new functions.
        (GenerateCallbackImplementation): Ditto.
        (JSValueToNative): Added an $interface argument and pass it along when
        dealing with enumerations.
        (GeneratePrototypeDeclaration): Removed unneeded $interfaceName argument.
        (GenerateConstructorDeclaration): Ditto.
        (GenerateConstructorDefinitions): Ditto.
        (GenerateConstructorDefinition): Ditto.
        (GenerateConstructorHelperMethods): Ditto.

        * bindings/scripts/test/JS/JSTestObj.cpp: Regenerated.

        * bindings/scripts/test/TestObj.idl: Added some new enums that test some
        of the logic above.

        * crypto/CryptoKey.cpp:
        (WebCore::CryptoKey::CryptoKey): Updated.
        (WebCore::CryptoKey::usages): Ditto.
        * crypto/CryptoKey.h: Moved enum class types inside the CryptoKey class.
        Added comments about the two similar but distinct types named
        CryptoKeyUsage and CryptoKey::Usage.

        * css/FontFace.cpp:
        (WebCore::FontFace::status): Updated.
        * css/FontFace.h: Moved enum class into the class.

        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::status): Updated.
        * css/FontFaceSet.h: Moved enum class into the class.

        * dom/Document.cpp:
        (WebCore::Document::Document): Updated for the name change back from
        ReferrerHeaderPolicy to ReferrerPolicy.
        (WebCore::Document::processReferrerPolicy): Ditto.
        (WebCore::Document::applyContentDispositionAttachmentSandbox): Ditto.
        * dom/Document.h: More of the same.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadInternal): Updated.
        (WebCore::HTMLMediaElement::textTrackModeChanged): Ditto.
        (WebCore::HTMLMediaElement::textTrackKindChanged): Ditto.
        (WebCore::HTMLMediaElement::textTrackAddCues): Ditto.
        (WebCore::HTMLMediaElement::textTrackAddCue): Ditto.
        (WebCore::HTMLMediaElement::addTextTrack): Ditto.
        (WebCore::HTMLMediaElement::configureTextTrackGroup): Ditto.
        (WebCore::HTMLMediaElement::setSelectedTextTrack): Ditto.
        (WebCore::HTMLMediaElement::configureTextTracks): Ditto.
        (WebCore::HTMLMediaElement::hasClosedCaptions): Ditto.
        (WebCore::HTMLMediaElement::configureTextTrackDisplay): Ditto.
        (WebCore::HTMLMediaElement::markCaptionAndSubtitleTracksAsUnconfigured): Ditto.
        (WebCore::toPlatform): Ditto.
        (WebCore::HTMLMediaElement::outOfBandTrackSources): Ditto.
        * html/HTMLTrackElement.cpp:
        (WebCore::HTMLTrackElement::scheduleLoad): Ditto.

        * html/HTMLVideoElement.h: Moved enum class into class.

        * html/HTMLVideoElement.idl: Added the missing conditional on
        VideoPresentationMode, and also moved it to the bottom of the file
        to work around what is apparently a bug in the IDL parser.

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::toWindRule): Updated.
        (WebCore::CanvasRenderingContext2D::fill): Ditto.
        (WebCore::CanvasRenderingContext2D::clip): Ditto.
        (WebCore::CanvasRenderingContext2D::fillInternal): Ditto.
        (WebCore::CanvasRenderingContext2D::clipInternal): Ditto.
        (WebCore::CanvasRenderingContext2D::isPointInPath): Ditto.
        (WebCore::CanvasRenderingContext2D::isPointInPathInternal): Ditto.
        (WebCore::smoothingToInterpolationQuality): Ditto.

        * html/canvas/CanvasRenderingContext2D.h: Moved enum class types into the class.

        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlClosedCaptionsTrackListElement::updateDisplay): Updated.
        (WebCore::MediaControlTextTrackContainerElement::updateDisplay): Ditto.

        * html/track/InbandTextTrack.cpp:
        (WebCore::InbandTextTrack::setMode): Updated.
        (WebCore::toPrivate): Ditto.
        (WebCore::InbandTextTrack::setModeInternal): Ditto.
        (WebCore::InbandTextTrack::updateKindFromPrivate): Ditto.
        * html/track/InbandTextTrack.h: Ditto.
        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::TextTrack): Ditto.
        (WebCore::TextTrack::enabled): Ditto.
        (WebCore::TextTrack::kindKeyword): Ditto.
        (WebCore::TextTrack::setKind): Ditto.
        (WebCore::TextTrack::setKindKeywordIgnoringASCIICase): Ditto.
        (WebCore::TextTrack::setMode): Ditto.
        (WebCore::TextTrack::cues): Ditto.
        (WebCore::TextTrack::activeCues): Ditto.
        (WebCore::TextTrack::addCue): Ditto.
        (WebCore::TextTrack::regions): Ditto.
        (WebCore::TextTrack::isRendered): Ditto.
        (WebCore::TextTrack::isMainProgramContent): Ditto.
        (WebCore::TextTrack::containsOnlyForcedSubtitles): Ditto.

        * html/track/TextTrack.h: Moved enum class types into the class.

        * html/track/TextTrackCue.cpp:
        (WebCore::TextTrackCue::dispatchEvent): Updated.
        (WebCore::TextTrackCue::isActive): Ditto.
        * loader/FrameNetworkingContext.h: Ditto.
        * page/CaptionUserPreferences.cpp:
        (WebCore::CaptionUserPreferences::sortedTrackListForMenu): Ditto.
        (WebCore::CaptionUserPreferences::textTrackSelectionScore): Ditto.
        * page/CaptionUserPreferencesMediaAF.cpp:
        (WebCore::CaptionUserPreferencesMediaAF::textTrackSelectionScore): Ditto.
        (WebCore::CaptionUserPreferencesMediaAF::sortedTrackListForMenu): Ditto.

        * page/SecurityPolicy.cpp:
        (WebCore::SecurityPolicy::generateReferrerHeader): Updated since we
        changed ReferrerHeaderPolicy back to ReferrerPolicy.
        * page/SecurityPolicy.h: Ditto.

        * platform/ReferrerPolicy.h: Changed ReferrerHeaderPolicy name back
        to ReferrerPolicy now that nesting inside a class eliminated the conflict;
        still should merge them and that FIXME remains.

        * platform/cocoa/WebPlaybackSessionModelMediaElement.mm:
        (WebPlaybackSessionModelMediaElement::updateForEventName): Updated.
        (WebPlaybackSessionModelMediaElement::updateLegibleOptions): Ditto.

        * testing/Internals.cpp:
        (WebCore::toResourceRequestCachePolicy): Updated.
        (WebCore::Internals::setOverrideCachePolicy): Ditto.
        (WebCore::toResourceLoadPriority): Ditto.
        (WebCore::Internals::setOverrideResourceLoadPriority): Ditto.
        (WebCore::toAutoFillButtonType): Ditto.
        (WebCore::Internals::setShowAutoFillButton): Ditto.

        * testing/Internals.h: Moved enum class types into class.

        * testing/Internals.idl: Removed the "Internals" prefixes we added
        to resolve ambiguity before. Nesting these in the class now takes care
        of the ambiguity instead.

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::responseText): Updated.
        (WebCore::XMLHttpRequest::didCacheResponseJSON): Ditto.
        (WebCore::XMLHttpRequest::responseXML): Ditto.
        (WebCore::XMLHttpRequest::responseBlob): Ditto.
        (WebCore::XMLHttpRequest::responseArrayBuffer): Ditto.
        (WebCore::XMLHttpRequest::setResponseType): Ditto.
        (WebCore::XMLHttpRequest::open): Ditto.
        (WebCore::shouldDecodeResponse): Ditto.

        * xml/XMLHttpRequest.h: Moved the enum class into the class.

2016-05-02  Simon Fraser  <simon.fraser@apple.com>

        Don't run transitions to/from 'auto' values
        https://bugs.webkit.org/show_bug.cgi?id=38243
        rdar://problem/20904225

        Reviewed by Dean Jackson.
        
        The specified behavior of transitions and animations is to not animate when either endpoint is 'auto'.
        Previously, we were treating 'auto' as zero and interpolating, which caused unwanted animations
        on fandango.com, airbnb.com and others.
        
        Fix by having blend() return the from value if progress is 0, otherwise the to value. The
        isZero() check can be removed, since this was effectively picking up auto value for one endpoint.

        Tests: transitions/lengthsize-transition-to-from-auto.html
               transitions/transition-to-from-auto.html

        * platform/Length.cpp:
        (WebCore::blend):

2016-05-02  Chris Dumez  <cdumez@apple.com>

        Indexing CSSStyleDeclaration object with out-of-range index should return undefined
        https://bugs.webkit.org/show_bug.cgi?id=157283

        Reviewed by Darin Adler.

        Indexing CSSStyleDeclaration object with out-of-range index should return undefined,
        as per:
        - http://heycam.github.io/webidl/#idl-indexed-properties
        - http://heycam.github.io/webidl/#getownproperty-guts

        WebKit was incorrectly returning the empty string in this case. We however, still
        return the empty string if calling the indexed property getter via item(), as is
        expected.

        The new behavior matches Firefox and the Web IDL specification. Chrome returns the
        empty string in this case though.

        Test: fast/dom/indexed-getters-returning-string.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::CSSComputedStyleDeclaration::item):
        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::item):

2016-05-02  Antoine Quint  <graouts@apple.com>

        Specifying a longhand property should not serialize to a shorthand property
        https://bugs.webkit.org/show_bug.cgi?id=157180

        Reviewed by Dean Jackson.

        Ensure that we don't serialize to a shorthand property when the required longhand components
        are not specified, per http://www.w3.org/TR/cssom-1/#serialize-a-css-declaration-block.

        Test: fast/css/no-shorthand-with-incomplete-longhands.html

        * css/StyleProperties.cpp:
        (WebCore::StyleProperties::getLayeredShorthandValue):
        Returning an empty string here means that calling getPropertyValue() with
        the shorthand property matching the currently processed longhand property
        in asText() will return an empty string as well and the shorthand property
        will be disregarded.

2016-05-02  Dean Jackson  <dino@apple.com>

        REGRESSION: Page layout of Manga/Picture books and all Fixed Layout ePubs corrupted
        https://bugs.webkit.org/show_bug.cgi?id=157292
        <rdar://problem/25750144>

        Reviewed by Tim Horton.

        The scroll state restoration fixes caused a regression in UIWebViews.
        Code in UIKit checks for a non-zero page scale in a history item, and
        r199233 changed the initialization from 0 to 1.

        * history/HistoryItem.h: Use 0 instead of 1 as the initial m_scale.

2016-05-02  Eric Carlson  <eric.carlson@apple.com>

        [Mac] AirPlay fails if target is set before AVPlayer has been created
        https://bugs.webkit.org/show_bug.cgi?id=157147
        <rdar://problem/24197592>

        Reviewed by Dean Jackson.

        No new tests, it won't be possible to test this until 
        https://bugs.webkit.org/show_bug.cgi?id=157290 has been fixed.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer):

2016-05-02  Brady Eidson  <beidson@apple.com>

        Const-ify some IDB code.
        https://bugs.webkit.org/show_bug.cgi?id=157287

        Reviewed by Alex Christensen.

        No new tests (Refactor only).

        * Modules/indexeddb/client/IDBConnectionToServerDelegate.h:
        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::deleteDatabase):
        (WebCore::InProcessIDBServer::openDatabase):
        (WebCore::InProcessIDBServer::abortTransaction):
        (WebCore::InProcessIDBServer::commitTransaction):
        (WebCore::InProcessIDBServer::didFinishHandlingVersionChangeTransaction):
        * Modules/indexeddb/shared/InProcessIDBServer.h:

2016-05-02  Antti Koivisto  <antti@apple.com>

        REGRESSION(r199964): Animation on pseudo elements doesn't trigger if first frame matches the current style
        https://bugs.webkit.org/show_bug.cgi?id=157284

        Reviewed by Simon Fraser.

        r199964 accidentally changed the logic for computing style change for animations.

        Test: fast/css/animation-pseudo-style-change.html

        * style/RenderTreeUpdater.cpp:
        (WebCore::RenderTreeUpdater::updateBeforeOrAfterPseudoElement):

            If there is an animated style determine the style change using it rather than the originally resolved style.

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::resolveElement):

            Here too.

2016-05-02  Brady Eidson  <beidson@apple.com>

        Add the ability to accumulate logs for specific logging channels to help diagnose test timeouts.
        https://bugs.webkit.org/show_bug.cgi?id=157274

        Reviewed by Alex Christensen.

        * platform/Logging.cpp:
        (WebCore::setLogChannelToAccumulate): Set the given log channel to accumulate logging,
          and dirty the initializeLoggingChannelsIfNecessary flag.
        (WebCore::initializeLoggingChannelsIfNecessary): Change from being a one-time-only call to a 
          one-time-for-each-time-somebody-calls-setLogChannelToAccumulate call.
        * platform/Logging.h:

        * testing/js/WebCoreTestSupport.cpp:
        (WebCoreTestSupport::setLogChannelToAccumulate):
        (WebCoreTestSupport::initializeLoggingChannelsIfNecessary):
        * testing/js/WebCoreTestSupport.h:

2016-05-02  Simon Fraser  <simon.fraser@apple.com>

        Sort the project file.

        * WebCore.xcodeproj/project.pbxproj:

2016-05-02  Simon Fraser  <simon.fraser@apple.com>

        Make Length, LengthSize and LengthPoint blending not use member functions
        https://bugs.webkit.org/show_bug.cgi?id=157281

        Reviewed by Zalan Bujtas.

        Having blend() be a member function is ambiguous because it's hard to tell which are
        the 'from' and 'to' values. Fix Length, LengthSize and LengthPoint accordingly.

        No behavior change.

        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::blendFunc):
        * platform/Length.cpp:
        (WebCore::blendMixedTypes):
        (WebCore::blend):
        (WebCore::Length::blendMixedTypes): Deleted.
        * platform/Length.h:
        (WebCore::Length::blend): Deleted.
        * platform/LengthPoint.h:
        (WebCore::blend):
        (WebCore::LengthPoint::blend): Deleted.
        * platform/LengthSize.h:
        (WebCore::blend):
        (WebCore::LengthSize::blend): Deleted.
        * platform/graphics/filters/FilterOperation.cpp:
        (WebCore::BlurFilterOperation::blend):
        * platform/graphics/transforms/TranslateTransformOperation.cpp:
        (WebCore::TranslateTransformOperation::blend):
        * rendering/style/BasicShapes.cpp:
        (WebCore::BasicShapePolygon::blend):
        (WebCore::BasicShapeInset::blend):
        * rendering/style/BasicShapes.h:
        (WebCore::BasicShapeCenterCoordinate::blend):
        (WebCore::BasicShapeRadius::blend):

2016-05-02  Simon Fraser  <simon.fraser@apple.com>

        Fix shouldUpdateScrollLayerPositionSynchronously() for non-main frames. Remove updatesScrollLayerPositionOnMainThread()
        https://bugs.webkit.org/show_bug.cgi?id=157277

        Reviewed by Dean Jackson, Tim Horton.

        shouldUpdateScrollLayerPositionSynchronously() gave an answer for the main frame even if
        called for a subframe. This could have caused scroll snapping, and isRubberBandInProgress()
        to give wrong answers sometimes. Fix by passing in the FrameView.

        I was unable to easily come up with a testcase to detect the incorrect behavior.

        Remove updatesScrollLayerPositionOnMainThread() which is unused by all ports.

        * page/FrameView.cpp:
        (WebCore::FrameView::isScrollSnapInProgress):
        (WebCore::FrameView::shouldUpdateCompositingLayersAfterScrolling):
        (WebCore::FrameView::isRubberBandInProgress):
        (WebCore::FrameView::updatesScrollLayerPositionOnMainThread): Deleted.
        * page/FrameView.h:
        * page/scrolling/ScrollingCoordinator.cpp:
        (WebCore::ScrollingCoordinator::updateSynchronousScrollingReasons):
        (WebCore::ScrollingCoordinator::shouldUpdateScrollLayerPositionSynchronously):
        * page/scrolling/ScrollingCoordinator.h:
        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
        (WebCore::ScrollingCoordinatorMac::updateTiledScrollingIndicator):
        * platform/ScrollableArea.h:
        * platform/win/PopupMenuWin.h:
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::setupFontSubpixelQuantization):
        * rendering/RenderLayer.h:
        * rendering/RenderListBox.h:

2016-05-02  Simon Fraser  <simon.fraser@apple.com>

        Add to the Animations log channel output about which properties are being blended
        https://bugs.webkit.org/show_bug.cgi?id=157271

        Reviewed by Dean Jackson.

        Make the Animations log channel dump information as CSS properties are being blended.
        Sample output:

          blending left from 0px to 400px at 0.57 -> 227.76px
          blending transform from translate(0px, 0px, 0px) to translate(400px, 0px, 0px) at 0.74 -> translate(294.97px, 0px, 0px)

        This makes it easier to see, for example, transitions to or from "auto" values.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::PropertyWrapperGetter::value):
        (WebCore::PropertyWrapperMaybeInvalidColor::value):
        (WebCore::CSSPropertyAnimationWrapperMap::wrapperForProperty):
        (WebCore::CSSPropertyAnimation::blendProperties):
        * platform/Length.cpp:
        (WebCore::operator<<):
        * platform/LengthBox.h:
        * platform/graphics/transforms/IdentityTransformOperation.h:
        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
        (WebCore::Matrix3DTransformOperation::dump):
        * platform/graphics/transforms/Matrix3DTransformOperation.h:
        * platform/graphics/transforms/MatrixTransformOperation.cpp:
        (WebCore::MatrixTransformOperation::dump):
        * platform/graphics/transforms/MatrixTransformOperation.h:
        * platform/graphics/transforms/PerspectiveTransformOperation.cpp:
        (WebCore::PerspectiveTransformOperation::dump):
        * platform/graphics/transforms/PerspectiveTransformOperation.h:
        * platform/graphics/transforms/RotateTransformOperation.cpp:
        (WebCore::RotateTransformOperation::dump):
        * platform/graphics/transforms/RotateTransformOperation.h:
        * platform/graphics/transforms/ScaleTransformOperation.cpp:
        (WebCore::ScaleTransformOperation::dump):
        * platform/graphics/transforms/ScaleTransformOperation.h:
        * platform/graphics/transforms/SkewTransformOperation.cpp:
        (WebCore::SkewTransformOperation::dump):
        * platform/graphics/transforms/SkewTransformOperation.h:
        * platform/graphics/transforms/TransformOperation.h:
        * platform/graphics/transforms/TransformOperations.cpp:
        (WebCore::operator<<):
        * platform/graphics/transforms/TransformOperations.h:
        * platform/graphics/transforms/TranslateTransformOperation.cpp:
        (WebCore::TranslateTransformOperation::dump):
        * platform/graphics/transforms/TranslateTransformOperation.h:
        * rendering/style/NinePieceImage.cpp:
        (WebCore::operator<<):
        * rendering/style/NinePieceImage.h:
        * svg/SVGLength.cpp:
        (WebCore::operator<<):
        * svg/SVGLength.h:

2016-05-02  Chris Dumez  <cdumez@apple.com>

        Modernize HTMLConstructionSite
        https://bugs.webkit.org/show_bug.cgi?id=157279

        Reviewed by Alex Christensen.

        Modernize HTMLConstructionSite: Use less raw pointers, more auto, more
        range loops and more nullptr.

        * dom/ScriptElement.h:
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::setAttributes):
        (WebCore::shouldUseLengthLimit):
        (WebCore::executeReparentTask):
        (WebCore::HTMLConstructionSite::attachLater):
        (WebCore::HTMLConstructionSite::executeQueuedTasks):
        (WebCore::HTMLConstructionSite::HTMLConstructionSite):
        (WebCore::HTMLConstructionSite::takeForm):
        (WebCore::HTMLConstructionSite::dispatchDocumentElementAvailableIfNeeded):
        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML):
        (WebCore::HTMLConstructionSite::mergeAttributesFromTokenIntoElement):
        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagInBody):
        (WebCore::HTMLConstructionSite::insertHTMLBodyStartTagInBody):
        (WebCore::HTMLConstructionSite::setDefaultCompatibilityMode):
        (WebCore::HTMLConstructionSite::setCompatibilityMode):
        (WebCore::HTMLConstructionSite::finishedParsing):
        (WebCore::HTMLConstructionSite::insertDoctype):
        (WebCore::HTMLConstructionSite::insertComment):
        (WebCore::HTMLConstructionSite::insertCommentOnDocument):
        (WebCore::HTMLConstructionSite::insertCommentOnHTMLHtmlElement):
        (WebCore::HTMLConstructionSite::insertHTMLHeadElement):
        (WebCore::HTMLConstructionSite::insertHTMLBodyElement):
        (WebCore::HTMLConstructionSite::insertHTMLFormElement):
        (WebCore::HTMLConstructionSite::insertHTMLElement):
        (WebCore::HTMLConstructionSite::insertHTMLElementOrFindCustomElementInterface):
        (WebCore::HTMLConstructionSite::insertCustomElement):
        (WebCore::HTMLConstructionSite::insertSelfClosingHTMLElement):
        (WebCore::HTMLConstructionSite::insertFormattingElement):
        (WebCore::HTMLConstructionSite::insertScriptElement):
        (WebCore::HTMLConstructionSite::insertForeignElement):
        (WebCore::HTMLConstructionSite::insertTextNode):
        (WebCore::HTMLConstructionSite::reparent):
        (WebCore::HTMLConstructionSite::insertAlreadyParsedChild):
        (WebCore::HTMLConstructionSite::takeAllChildren):
        (WebCore::HTMLConstructionSite::createElement):
        (WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface):
        (WebCore::HTMLConstructionSite::createHTMLElement):
        (WebCore::HTMLConstructionSite::createElementFromSavedToken):
        (WebCore::HTMLConstructionSite::indexOfFirstUnopenFormattingElement):
        (WebCore::HTMLConstructionSite::reconstructTheActiveFormattingElements):
        (WebCore::HTMLConstructionSite::findFosterSite):
        (WebCore::HTMLConstructionSite::shouldFosterParent):
        (WebCore::HTMLConstructionSite::fosterParent):
        (WebCore::HTMLConstructionSite::~HTMLConstructionSite): Deleted.
        (WebCore::HTMLConstructionSite::setForm): Deleted.
        (WebCore::HTMLConstructionSite::setCompatibilityModeFromDoctype): Deleted.
        (WebCore::HTMLConstructionSite::ownerDocumentForCurrentNode): Deleted.
        (WebCore::HTMLConstructionSite::generateImpliedEndTagsWithExclusion): Deleted.
        * html/parser/HTMLConstructionSite.h:
        (WebCore::HTMLConstructionSite::inQuirksMode):
        (WebCore::HTMLConstructionSite::isTelephoneNumberParsingEnabled):
        (WebCore::HTMLConstructionSite::RedirectToFosterParentGuard::RedirectToFosterParentGuard):
        * html/parser/HTMLElementStack.cpp:
        (WebCore::HTMLNames::isRootNode):
        (WebCore::HTMLElementStack::ElementRecord::ElementRecord):
        (WebCore::HTMLElementStack::ElementRecord::replaceElement):
        (WebCore::HTMLElementStack::ElementRecord::isAbove):
        (WebCore::HTMLElementStack::popAll):
        (WebCore::HTMLElementStack::popUntil):
        (WebCore::HTMLElementStack::popUntilPopped):
        (WebCore::HTMLElementStack::pushRootNode):
        (WebCore::HTMLElementStack::pushHTMLHtmlElement):
        (WebCore::HTMLElementStack::pushRootNodeCommon):
        (WebCore::HTMLElementStack::pushHTMLHeadElement):
        (WebCore::HTMLElementStack::pushHTMLBodyElement):
        (WebCore::HTMLElementStack::push):
        (WebCore::HTMLElementStack::insertAbove):
        (WebCore::HTMLElementStack::removeHTMLHeadElement):
        (WebCore::HTMLElementStack::remove):
        (WebCore::HTMLElementStack::contains):
        (WebCore::inScopeCommon):
        (WebCore::HTMLElementStack::hasNumberedHeaderElementInScope):
        (WebCore::HTMLElementStack::inScope):
        (WebCore::HTMLElementStack::pushCommon):
        (WebCore::HTMLElementStack::popCommon):
        (WebCore::HTMLElementStack::removeNonTopCommon):
        (WebCore::HTMLElementStack::show):
        (WebCore::HTMLElementStack::hasOnlyOneElement): Deleted.
        (WebCore::HTMLElementStack::secondElementIsHTMLBodyElement): Deleted.
        (WebCore::HTMLElementStack::pop): Deleted.
        (WebCore::HTMLElementStack::popUntilTableScopeMarker): Deleted.
        (WebCore::HTMLElementStack::oneBelowTop): Deleted.
        * html/parser/HTMLElementStack.h:
        (WebCore::HTMLElementStack::ElementRecord::stackItem):
        (WebCore::HTMLElementStack::ElementRecord::setNext): Deleted.
        (WebCore::HTMLElementStack::popUntilPopped): Deleted.
        * html/parser/HTMLFormattingElementList.cpp:
        (WebCore::HTMLFormattingElementList::contains):
        (WebCore::HTMLFormattingElementList::swapTo):
        (WebCore::HTMLFormattingElementList::append):
        (WebCore::HTMLFormattingElementList::remove):
        (WebCore::HTMLFormattingElementList::tryToEnsureNoahsArkConditionQuickly):
        (WebCore::HTMLFormattingElementList::ensureNoahsArkCondition):
        * html/parser/HTMLFormattingElementList.h:
        (WebCore::HTMLFormattingElementList::Entry::Entry):
        (WebCore::HTMLFormattingElementList::Entry::replaceElement):
        (WebCore::HTMLFormattingElementList::Bookmark::Bookmark):
        (WebCore::HTMLFormattingElementList::Bookmark::moveToAfter):
        (WebCore::HTMLFormattingElementList::Bookmark::mark):
        (WebCore::HTMLFormattingElementList::first):
        (WebCore::HTMLFormattingElementList::Entry::isMarker): Deleted.
        (WebCore::HTMLFormattingElementList::Entry::stackItem): Deleted.
        (WebCore::HTMLFormattingElementList::Entry::operator!=): Deleted.
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processDoctypeToken):
        (WebCore::HTMLTreeBuilder::processCloseWhenNestedTag):
        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
        (WebCore::HTMLTreeBuilder::insertGenericHTMLElement):
        (WebCore::HTMLTreeBuilder::processTemplateStartTag):
        (WebCore::HTMLTreeBuilder::processStartTagForInTable):
        (WebCore::HTMLTreeBuilder::processStartTag):
        (WebCore::HTMLTreeBuilder::processHtmlStartTagForInBody):
        (WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):
        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
        (WebCore::HTMLTreeBuilder::processEndTagForInBody):
        (WebCore::HTMLTreeBuilder::processComment):
        (WebCore::HTMLTreeBuilder::defaultForBeforeHTML):
        (WebCore::HTMLTreeBuilder::processStartTagForInHead):
        (WebCore::HTMLTreeBuilder::processGenericRCDATAStartTag):
        (WebCore::HTMLTreeBuilder::processGenericRawTextStartTag):
        (WebCore::HTMLTreeBuilder::processScriptStartTag):
        (WebCore::HTMLTreeBuilder::processTokenInForeignContent):

2016-05-02  Per Arne Vollan  <peavo@outlook.com>

        Remove unneeded casts once we upgrade to a version of Visual Studio that is not broken
        https://bugs.webkit.org/show_bug.cgi?id=121235

        Reviewed by Darin Adler.

        * css/MediaQueryEvaluator.cpp:
        (WebCore::createFunctionMap):
        * dom/make_names.pl:
        (printWrapperFactoryCppFile):
        * loader/archive/ArchiveFactory.cpp:
        (WebCore::archiveMIMETypes):
        * rendering/svg/SVGPathData.cpp:
        (WebCore::updatePathFromGraphicsElement):

2016-05-02  Anders Carlsson  <andersca@apple.com>

        Fix build.

        * platform/mac/WebPlaybackControlsManager.h:

2016-05-02  Sam Weinig  <sam@webkit.org>

        DataDetector underline color should be based on the text color
        https://bugs.webkit.org/show_bug.cgi?id=157272

        Fixes:
            <rdar://problem/25663930> DataDetectors links should use the default text color for their parent nodes
            <rdar://problem/25663983> DataDetectors links underline color update

        Reviewed by Tim Horton.

        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::detectContentInRange):
        When using light links, use the color of the parent element as the text color, and that same color with
        20% alpha as the underline color.

2016-05-01  Ryosuke Niwa  <rniwa@webkit.org>

        document.currentScript must be null when we're executing a script inside a shadow tree
        https://bugs.webkit.org/show_bug.cgi?id=157245

        Reviewed by Darin Adler.

        Fix the bug by not setting currentScript as spec'ed in HTML5 specification:
        https://html.spec.whatwg.org/multipage/dom.html#dom-document-currentscript
        https://html.spec.whatwg.org/multipage/scripting.html#execute-the-script-block
        as of 3dc763829ca1598427b588cf08830c1e2af5a05c

        New behavior matches that of Google Chrome Canary.

        Test: fast/shadow-dom/Document-prototype-currentScript.html

        * dom/CurrentScriptIncrementer.h:
        (WebCore::CurrentScriptIncrementer::CurrentScriptIncrementer):
        (WebCore::CurrentScriptIncrementer::~CurrentScriptIncrementer):
        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::executeScript):

2016-04-29  Alex Christensen  <achristensen@webkit.org>

        Do not reuse cache entries with conditional headers
        https://bugs.webkit.org/show_bug.cgi?id=157205
        rdar://problem/25856933

        Reviewed by Chris Dumez.

        Test: http/tests/xmlhttprequest/if-modified-since-0.html

        * loader/cache/CachedRawResource.cpp:
        (WebCore::CachedRawResource::canReuse):
        CachedResourceLoader::determineRevalidationPolicy asserts that the request is not conditional,
        which means that it does not have any headers like If-Modified-Since.  They are usually different,
        because we put the timestamp in the If-Modified-Since header, so it fails the canReuse test because
        time has passed since the last If-Modified-Since header was sent.  When a user sets the If-Modified-Since
        manually to something that is constant, we reuse cache entries when we should not.
        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
        Set the source so we can use it in Internals.

2016-05-02  Yoav Weiss  <yoav@yoav.ws>

        Speculatively fix the cmake build
        https://bugs.webkit.org/show_bug.cgi?id=157262

        Reviewed by Darin Adler.

        This patch adds WEB_TIMING build flag guards around calls to DOMWindow()->performance(),
        in order to make sure builds that have WEB_TIMING disabled (e.g. cmake on Mac) continue
        to build.

        No new tests as there's no functional change.

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::loadDone):

2016-05-02  Daniel Bates  <dabates@apple.com>

        CSP: Add workaround for XtraMath
        https://bugs.webkit.org/show_bug.cgi?id=157252

        Reviewed by Andy Estes.

        * platform/RuntimeApplicationChecks.h:
        * platform/RuntimeApplicationChecks.mm:
        (WebCore::IOSApplication::isXtraMath): Added.

2016-05-02  Daniel Bates  <dabates@apple.com>

        DatabaseTracker::closeAllDatabases calls Database::close from the wrong thread
        https://bugs.webkit.org/show_bug.cgi?id=147672
        <rdar://problem/22357464>

        Reviewed by Brady Eidson.

        Schedule a DatabaseCloseTask when Database::close() is called from a thread other than the
        database thread as the database thread is responsible for interacting with the database.

        Currently -[WebDatabaseManager startBackgroundTask] and WebProcess::processWillSuspendImminently()
        call DatabaseTracker::closeAllDatabases() indirectly and directly, respectively, from a
        thread other than the database thread. In a debug build, this causes an assertion failure
        in Database::close(). In a release/production build, this starts a race between the calling
        thread and the database thread that can lead to a crash. It is the responsibility of the
        database thread to manage the database. We should ensure that calling Database::close()
        delegates the responsibility of actually closing the database to the database thread to
        avoid interfering with the database thread or the need to synchronize access to data
        structures used by the database thread.

        * Modules/webdatabase/Database.cpp:
        (WebCore::Database::interrupt): Added. Turns around and calls SQLiteDatabase::interrupt().
        (WebCore::Database::close): Added. Schedules a DatabaseCloseTask to close the database and
        wait for it to complete if we have not already scheduled closing the database.
        (WebCore::Database::performClose): Renamed; formerly named close.
        (WebCore::Database::markAsDeletedAndClose): Extracted logic to schedule a DatabaseCloseTask
        from here to Database::close() and modified this function to call Database::close().
        * Modules/webdatabase/Database.h:
        * Modules/webdatabase/DatabaseTask.cpp:
        (WebCore::DatabaseCloseTask::doPerformTask): Call Database::performClose() instead of Database::close()
        as the latter has been repurposed to schedule closing the database.
        * Modules/webdatabase/DatabaseThread.cpp:
        (WebCore::DatabaseThread::databaseThread): Ditto.
        * Modules/webdatabase/DatabaseTracker.cpp:
        (WebCore::DatabaseTracker::closeAllDatabases): Added argument currentQueryBehavior (defaults
        to CurrentQueryBehavior::RunToCompletion - close every database after completion of the
        current database query, if any).
        * Modules/webdatabase/DatabaseTracker.h:
        * platform/sql/SQLiteDatabase.cpp:
        (WebCore::SQLiteDatabase::interrupt): Added. This is safe to call regardless of the state
        of the database and thread safe by <https://www.sqlite.org/c3ref/interrupt.html>.
        * platform/sql/SQLiteDatabase.h:

2016-05-02  Yoav Weiss  <yoav@yoav.ws>

        Move ResourceTiming behind a runtime flag
        https://bugs.webkit.org/show_bug.cgi?id=157133

        Reviewed by Alex Christensen.

        Move the ResourceTiming API from being behind a build time flag to be behind an
        off-by-default runtime flag, that can be turned on using internals.

        Tests: fast/dom/Window/window-properties-performance-resource-timing.html
               http/tests/performance/performance-resource-timing-entries.html

        * DerivedSources.make: Added idl files for PerformanceEntry, PerformanceEntryList and PerformanceResourceTiming.
        * WebCore.xcodeproj/project.pbxproj: Added the various Performance* files to the project.
        * bindings/generic/RuntimeEnabledFeatures.cpp: Added ResourceTiming as a runtime flag.
        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
        * bindings/generic/RuntimeEnabledFeatures.h: Added ResourceTiming as a runtime flag.
        (WebCore::RuntimeEnabledFeatures::setResourceTimingEnabled):
        (WebCore::RuntimeEnabledFeatures::resourceTimingEnabled):
        * bindings/js/JSPerformanceEntryCustom.cpp: Removed #if for ResourceTiming, and replaced PERFORMANCE_TIMELINE for WEB_TIMING.
        Added build flag around UserTiming related h files.
        (WebCore::toJS): Deleted.
        * dom/EventNames.h: Renamed webkitresourcetimingbufferfull to resourcetimingbufferfull.
        * loader/DocumentThreadableLoader.cpp: Replace #if for ResourceTiming with runtime flag.
        (WebCore::DocumentThreadableLoader::loadRequest):
        * loader/ResourceLoadNotifier.cpp: Replace #if for ResourceTiming with runtime flag.
        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
        * loader/cache/CachedResourceLoader.cpp: Replace #if for ResourceTiming with runtime flag.
        (WebCore::CachedResourceLoader::revalidateResource):
        (WebCore::CachedResourceLoader::loadResource):
        (WebCore::CachedResourceLoader::storeResourceTimingInitiatorInformation):
        (WebCore::CachedResourceLoader::loadDone):
        * loader/cache/CachedResourceLoader.h: Remove #if for ResourceTiming.
        * page/Performance.cpp: Remove #if for ResourceTiming.
        (WebCore::Performance::Performance): Removed #if for ResourceTiming related initialization.
        (WebCore::Performance::webkitGetEntries): Renamed to getEntries.
        (WebCore::Performance::webkitGetEntriesByType): Renamed to getEntriesByType.
        (WebCore::Performance::webkitGetEntriesByName): Renamed to getEntriesByName.
        * page/Performance.h: Remove #if for ResourceTiming.
        * page/Performance.idl: Replace #if for ResourceTiming with runtime flag.
        * page/PerformanceEntry.cpp: Remove the PERFORMANCE_TIMELINE build flag.
        * page/PerformanceEntry.h: Remove the PERFORMANCE_TIMELINE build flag.
        * page/PerformanceEntry.idl: Replace the PERFORMANCE_TIMELINE build flag with runtime flag.
        * page/PerformanceEntryList.cpp: Remove the PERFORMANCE_TIMELINE build flag.
        * page/PerformanceEntryList.h: Remove the PERFORMANCE_TIMELINE build flag.
        * page/PerformanceEntryList.idl: Replace the PERFORMANCE_TIMELINE build flag with runtime flag.
        * page/PerformanceResourceTiming.cpp: Remove the RESOURCE_TIMING build flag.
        * page/PerformanceResourceTiming.h: Remove the RESOURCE_TIMING build flag.
        * page/PerformanceResourceTiming.idl: Replace the RESOURCE_TIMING build flag with runtime flag.
        * testing/Internals.cpp: Add a method that enables ResourceTiming.
        (WebCore::Internals::setResourceTimingSupport):
        * testing/Internals.h: Add a method that enables ResourceTiming.
        * testing/Internals.idl: Add a method that enables ResourceTiming.

2016-05-01  Nan Wang  <n_wang@apple.com>

        AX: Crash at  WebCore::AccessibilityObject::getAttribute const + 9
        https://bugs.webkit.org/show_bug.cgi?id=157256

        Reviewed by Chris Fleizach.

        When the <label> for the input element has no renderer, it will cause
        crash when we ask for the title element text. Fixed it by getting the 
        aria-label attribute directly from the <label> element instead of its 
        accessibility object. 

        Test case covered in accessibility/mac/aria-label-on-label-element.html.

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::titleElementText):

2016-05-01  Darin Adler  <darin@apple.com>

        Stop using string-based enumerations in TextTrack, and eliminate support for string-based enumerations
        https://bugs.webkit.org/show_bug.cgi?id=157253

        Reviewed by Chris Dumez.

        This was the most difficult case to convert from the old style of enumeration to enum class.
        Afterward there is a bit of messy duplication, but it still seems like an improvement overall.

        After this patch, I plan to change the rule for the name of the enumeration; instead of
        living at the top level of the WebCore namespace, we will look for them inside the class for the
        first interface defined in the same file along with the enumeration, and remove the name prefix,
        if the interfaces's name is a prefix of the enumerations's name.

        Once that's done, next step is to do something in the bindings for dictionaries. And adopt both the
        enumeration and dictionary mechanisms more widely, and remove the old use of "dictionary" as a type name.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::removeSourceBuffer): Use enum values instead of keywords.
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::textTrackModeChanged): Ditto.

        * bindings/js/JSTextTrackCustom.cpp:
        (WebCore::JSTextTrack::setKind): Deleted.

        * bindings/scripts/CodeGenerator.pm:
        (IsStringBasedEnumType): Deleted.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GetEnumerationImplementationContent): Removed IsStringBasedEnumType check.
        (GenerateParametersCheck): Ditto.
        (GenerateImplementation): Ditto.
        (GetNativeType): Ditto.
        (JSValueToNative): Ditto.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadInternal): Use enum values instead of keywords.
        (WebCore::HTMLMediaElement::textTrackModeChanged): Ditto.
        (WebCore::HTMLMediaElement::textTrackKindChanged): Ditto.
        (WebCore::HTMLMediaElement::textTrackAddCues): Ditto.
        (WebCore::HTMLMediaElement::textTrackAddCue): Ditto.
        (WebCore::HTMLMediaElement::addTextTrack): Ditto.
        (WebCore::HTMLMediaElement::configureTextTrackGroup): Ditto.
        (WebCore::HTMLMediaElement::setSelectedTextTrack): Ditto.
        (WebCore::HTMLMediaElement::configureTextTracks): Ditto.
        (WebCore::HTMLMediaElement::hasClosedCaptions): Ditto.
        (WebCore::HTMLMediaElement::configureTextTrackDisplay): Ditto.
        (WebCore::HTMLMediaElement::markCaptionAndSubtitleTracksAsUnconfigured): Ditto.
        (WebCore::toPlatform): Added helpers for the outOfBandTrackSources function.
        (WebCore::HTMLMediaElement::outOfBandTrackSources): Removed unneeded fastHasAttribute
        check since getNonEmptyURLAttribute already returns an empty URL when the attribute is
        not present. Changed to use enum values instead of keywords.

        * html/HTMLTrackElement.cpp:
        (WebCore::HTMLTrackElement::parseAttribute): Use new setKindKeywordIgnoringASCIICase
        function rather than calling setKind and convertToASCIILowercase. Also use ensureTrack
        instead of track since the latter is a cover that calls it and dumbs down the return type.
        (WebCore::HTMLTrackElement::kind): Changed return type to const AtomicString& since
        that's what we will have for kind keywords and because it matches what we normally have
        for attribute getting fuctions. Also use ensureTrack.
        (WebCore::HTMLTrackElement::setKind): Changed argument to AtomicString so we don't waste
        time making a string and then destroying it before turning it into an AtomicString so it
        can be an attribute value.
        (WebCore::HTMLTrackElement::srclang): Changed return type to const AtomicString& as is
        customary and efficient for attribute value convenience functions. Also use fastGetAttribute.
        (WebCore::HTMLTrackElement::setSrclang): Deleted.
        (WebCore::HTMLTrackElement::label): Ditto.
        (WebCore::HTMLTrackElement::setLabel): Deleted.
        (WebCore::HTMLTrackElement::setIsDefault): Deleted.
        (WebCore::HTMLTrackElement::scheduleLoad): Use enum values instead of keywords.

        * html/HTMLTrackElement.h: Use pragma once. Update for changes mentioned above.
        Also mark things final instead of override as per our recent style discussion.

        * html/HTMLTrackElement.idl: Use [Reflect] for srclang and label.

        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlClosedCaptionsTrackListElement::updateDisplay): Use enum value
        instead of keyword.
        (WebCore::MediaControlTextTrackContainerElement::updateDisplay): Ditto.

        * html/track/AudioTrack.cpp:
        (WebCore::AudioTrack::AudioTrack): Use new base class MediaTrackBase.

        * html/track/AudioTrack.h: Use pragma once. Make base class be MediaTrackBase instead
        of TrackBase.

        * html/track/InbandTextTrack.cpp:
        (WebCore::InbandTextTrack::setMode): Change argument type to enum instead of string.
        (WebCore::toPrivate): Added. Helper for setModeInternal.
        (WebCore::InbandTextTrack::setModeInternal): Change argument type to enum instead of string.
        (WebCore::InbandTextTrack::updateKindFromPrivate): Use enum instead of string to call setKind.

        * html/track/InbandTextTrack.h: Use pragma once. Use TextTrackMode for argument types.

        * html/track/TextTrack.cpp:
        (WebCore::captionsKeyword): Converted this to a non-member function since it is now
        private to this file.
        (WebCore::descriptionsKeyword): Ditto.
        (WebCore::chaptersKeyword): Ditto.
        (WebCore::metadataKeyword): Ditto.
        (WebCore::forcedKeyword): Ditto.
        (WebCore::TextTrack::disabledKeyword): Deleted.
        (WebCore::TextTrack::hiddenKeyword): Deleted.
        (WebCore::TextTrack::showingKeyword): Deleted.
        (WebCore::TextTrack::TextTrack): Moved some initialization to be done in the header where
        the data members are defined. Put the code that is the equivalent to setKindInternal here,
        because it turns out it's not needed anywhere else. Over time we might change the types
        involved and there's no need to have that be across multiple functions.
        (WebCore::TextTrack::~TextTrack): Removed unneeded call to clearClient, right when the
        object is about to be destroyed. Perhaps there was an illusion that the old call might
        be a virtual function call that invokes the clearClient from a derived class, but that
        doesn't work in a destructor, so this code was only clearing out the data member and
        that does not need to be done.
        (WebCore::TextTrack::isValidKind): Deleted.
        (WebCore::TextTrack::enabled): Use enum value instead of keyword.
        (WebCore::TextTrack::kindKeyword): Added. Function for callers who need a string, not the
        enum value.
        (WebCore::TextTrack::setKind): Take enum value instead of keyword. Also changed since
        we store the kind in a data member in this class, not inherited.
        (WebCore::TextTrack::setKindKeywordIgnoringASCIICase): Added. For HTMLTrackElement to use
        when setting the kind attribute.
        (WebCore::TextTrack::setMode): Take enum value instread of keyword. Also removed assertion
        since the enum already makes it intrinsically clear what values are valid, unlike a string.
        (WebCore::TextTrack::cues): Use enum value instead of keyword.
        (WebCore::TextTrack::activeCues): Ditto.
        (WebCore::TextTrack::addCue): Ditto.
        (WebCore::TextTrack::ensureVTTRegionList): Changed return type to reference.
        (WebCore::TextTrack::regions): Use enum value instead of keyword.
        (WebCore::TextTrack::addRegion): Use reference.
        (WebCore::TextTrack::cueDidChange): Ditto.
        (WebCore::TextTrack::isRendered): Use enum values instead of keywords. Also write to be
        a boolean expression instead of a couple different if statements.
        (WebCore::TextTrack::ensureTextTrackCueList): Changed return type to reference.
        (WebCore::TextTrack::isMainProgramContent): Use enum value instead of keyword.
        (WebCore::TextTrack::containsOnlyForcedSubtitles): Ditto.

        * html/track/TextTrack.h: Use pragma once. Removed unneeded include. Added enums for
        TextTrackKind and TextTrackMode. Updated for changes to functions listed above.
        Added m_mode and m_kind and initialized those data members and some others.

        * html/track/TextTrack.idl: Tweaked formatting. Used ImplementedAs for the kind
        attribute rather than using a CustomSetter. This preserves the strange behavior
        where setting kind does nothing when !ENABLE(MEDIA_SOURCE). If we discover we don't
        need that, then we won't need ImplementedAs any more either.

        * html/track/TextTrackCue.cpp:
        (WebCore::TextTrackCue::dispatchEvent): Use enum instad of keyword.
        (WebCore::TextTrackCue::isActive): Ditto.

        * html/track/TrackBase.cpp:
        (WebCore::TrackBase::TrackBase): Removed unneeded initialization that is handled in
        the data member definition in the header now.
        (WebCore::MediaTrackBase::MediaTrackBase): Added. Calls through to TrackBase.
        (WebCore::MediaTrackBase::setKind): Moved to MediaTrackBase from TrackBase, because
        this isn't needed for text tracks.
        (WebCore::MediaTrackBase::setKindInternal): Ditto.

        * html/track/TrackBase.h: Use pragma once. Move kind, setKind, isValidKind, defaultKindKeyword,
        setKindInternal, and m_kind all to a derived class, MediaTrackBase, since TextTrack doesn't need
        any of those any more. Later we might adopt enumerations more and it's possible the need for
        MediaTrackBase will go away.

        * html/track/VideoTrack.cpp:
        (WebCore::VideoTrack::VideoTrack): Updated to use MediaTrackBase.
        (WebCore::VideoTrack::setLanguage): Ditto.

        * html/track/VideoTrack.h: Use pragma once. Removed unneeded header include.
        Derive from MediaTrackBase instead of TrackBase.

        * page/CaptionUserPreferences.cpp:
        (WebCore::CaptionUserPreferences::sortedTrackListForMenu): Use enum values instead
        of keywords.
        (WebCore::CaptionUserPreferences::textTrackSelectionScore): Ditto.
        * page/CaptionUserPreferencesMediaAF.cpp:
        (WebCore::CaptionUserPreferencesMediaAF::textTrackSelectionScore): Ditto.
        (WebCore::CaptionUserPreferencesMediaAF::sortedTrackListForMenu): Ditto. Also used
        kindKeyword since we want a string for logging.
        * platform/cocoa/WebPlaybackSessionModelMediaElement.mm:
        (WebPlaybackSessionModelMediaElement::updateLegibleOptions): Ditto.

2016-05-01  Chris Dumez  <cdumez@apple.com>

        Pass reference instead of pointer to IDL attribute setters if not nullable
        https://bugs.webkit.org/show_bug.cgi?id=157250

        Reviewed by Darin Adler.

        Update the bindings generator so that we pass wrapper types by reference
        to attribute setters instead of by raw pointer when the attribute is not
        marked as nullable in the IDL.

        There is no intended Web-exposed behavior change.

        * Modules/speech/SpeechSynthesisUtterance.idl:
        * Modules/webaudio/ConvolverNode.idl:
        * bindings/js/JSDataCueCustom.cpp:
        (WebCore::constructJSDataCue):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/CodeGeneratorObjC.pm:
        (GenerateImplementation):

        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/ObjC/DOMTestInterface.mm:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        Rebaseline bindings tests.

        * dom/Document.cpp:
        (WebCore::Document::moveNodeIteratorsToNewDocument):
        * dom/NodeIterator.cpp:
        (WebCore::NodeIterator::NodePointer::NodePointer):
        (WebCore::NodeIterator::NodePointer::moveToNext):
        (WebCore::NodeIterator::NodePointer::moveToPrevious):
        (WebCore::NodeIterator::NodeIterator):
        (WebCore::NodeIterator::~NodeIterator):
        (WebCore::NodeIterator::updateForNodeRemoval):
        (WebCore::NodeIterator::NodePointer::clear): Deleted.
        (WebCore::NodeIterator::nextNode): Deleted.
        * dom/NodeIterator.h:
        * dom/Traversal.cpp:
        (WebCore::NodeIteratorBase::NodeIteratorBase):
        * dom/Traversal.h:
        (WebCore::NodeIteratorBase::root):
        * dom/TreeWalker.cpp:
        (WebCore::TreeWalker::setCurrentNode):
        (WebCore::TreeWalker::setCurrent):
        (WebCore::TreeWalker::parentNode):
        (WebCore::TreeWalker::firstChild):
        (WebCore::TreeWalker::lastChild):
        (WebCore::TreeWalker::traverseSiblings):
        (WebCore::TreeWalker::previousNode):
        (WebCore::TreeWalker::nextNode):
        * dom/TreeWalker.h:
        (WebCore::TreeWalker::currentNode):
        * dom/TreeWalker.idl:
        * html/HTMLAttachmentElement.idl:
        * html/HTMLInputElement.idl:
        * html/HTMLTableElement.idl:
        * html/track/DataCue.cpp:
        (WebCore::DataCue::DataCue):
        (WebCore::DataCue::setData):
        (WebCore::toDataCue): Deleted.
        * html/track/DataCue.h:
        * html/track/DataCue.idl:

2016-05-01  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r200264 and r200266.
        https://bugs.webkit.org/show_bug.cgi?id=157251

        This change caused existing LayoutTest media/media-source
        /media-source-stalled-holds-sleep-assertion.html to time out
        on Mac on every run. (Requested by ryanhaddad on #webkit).

        Reverted changesets:

        "[Mac] AirPlay fails if target is set before AVPlayer has been
        created"
        https://bugs.webkit.org/show_bug.cgi?id=157147
        http://trac.webkit.org/changeset/200264

        "[Mac] AirPlay fails if target is set before AVPlayer has been
        created"
        https://bugs.webkit.org/show_bug.cgi?id=157147
        http://trac.webkit.org/changeset/200266

2016-05-01  Chris Dumez  <cdumez@apple.com>

        Drop CanUseWTFOptionalForParameter() from bindings generator
        https://bugs.webkit.org/show_bug.cgi?id=157247

        Reviewed by Darin Adler.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck):
        (CanUseWTFOptionalForParameter): Deleted.

2016-05-01  Darin Adler  <darin@apple.com>

        Update Fetch to use enum class instead of string for enumerations
        https://bugs.webkit.org/show_bug.cgi?id=157241

        Reviewed by Chris Dumez.

        * Modules/fetch/FetchOptions.h: Changed this class into a struct,
        getting rid of all the getter and setter functions. Moved all the
        enumeration types out of this class to the WebCore namespace level
        and gave them all the names and values that match the ones from the
        IDL file.

        * Modules/fetch/FetchRequest.cpp:
        (WebCore::setReferrerPolicy): Updated for the changes to FetchOptions.
        The string matching here will likely go away when we change dictionary
        so it sets up a structure, which will parse the enumeration values, but
        that won't be for a while, so this stays for now.
        (WebCore::setMode): Ditto.
        (WebCore::setCredentials): Ditto.
        (WebCore::setCache): Ditto.
        (WebCore::setRedirect): Ditto.
        (WebCore::buildOptions): Updated for changes to FetchOptions.
        (WebCore::buildHeaders): Ditto.
        (WebCore::FetchRequest::create): Ditto.
        (WebCore::FetchRequest::type): Moved this to the header and changed its
        return type to the enum; it's not just a single return statement.
        (WebCore::FetchRequest::destination): Ditto.
        (WebCore::FetchRequest::referrerPolicy): Ditto.
        (WebCore::FetchRequest::mode): Ditto.
        (WebCore::FetchRequest::credentials): Ditto.
        (WebCore::FetchRequest::cache): Ditto.
        (WebCore::FetchRequest::redirect): Ditto.

        * Modules/fetch/FetchRequest.h: Changed all the getters that return
        enumerations to return the enum class values instead of strings.
        Put all the inline versions here in the header.

        * bindings/scripts/CodeGenerator.pm: Removed the seven enum types that
        are in FetchRequest.idl from the list of "string-based" enums.

        * dom/Document.cpp:
        (WebCore::Document::Document): Updated for the change where I
        renamed ReferrerPolicy to ReferrerHeaderPolicy, at least for now.
        (WebCore::Document::processReferrerPolicy): Ditto.
        (WebCore::Document::applyContentDispositionAttachmentSandbox): Ditto.
        * dom/Document.h: Ditto.
        * loader/FrameNetworkingContext.h: Ditto.
        * page/SecurityPolicy.cpp:
        (WebCore::SecurityPolicy::generateReferrerHeader): Ditto.
        * page/SecurityPolicy.h: Ditto.

        * platform/ReferrerPolicy.h: Renamed this enum from ReferrerPolicy to
        ReferrerHeaderPolicy, since the one specified in the Fetch API has the
        name ReferrerPolicy. I think the best way to resolve this longer term is
        to merge them since they really do represent the same concept, although
        the one from the Fetch API has a few more features.

2016-05-01  Chris Dumez  <cdumez@apple.com>

        Unreviewed attempt to fix Windows build after r200288.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck):

2016-05-01  Chris Dumez  <cdumez@apple.com>

        Unreviewed attempt to fix Windows build after r200288.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GetEnumerationImplementationContent):

2016-05-01  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rebaseline bindings tests after r200300.

        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsStringWithCache):

2016-05-01  Darin Adler  <darin@apple.com>

        Use enum class instead of string-based enums in RTC code
        https://bugs.webkit.org/show_bug.cgi?id=157242

        Reviewed by Alex Christensen.

        * Modules/mediastream/RTCConfiguration.cpp:
        (WebCore::RTCConfiguration::RTCConfiguration): Don't initialize members here,
        do it in the header instead.
        (WebCore::RTCConfiguration::initialize): Initialize data members to enum values,
        not strings.

        * Modules/mediastream/RTCConfiguration.h: Tried to keep this class compiling.
        Added the new enum class, and changed to use that instead of strings. But note,
        this should not even be a class. Needs to become a dictionary.

        * Modules/mediastream/RTCConfiguration.idl: Updated the names and values of the
        enums to match the current RTC specification. Again, as I said, this should be
        a dictionary, not an interface.

        * bindings/scripts/CodeGenerator.pm: Removed the RTC enumerations from the list
        of string-based enums.

2016-04-30  Antti Koivisto  <antti@apple.com>

        REGRESSION (r199640): position:absolute generated content inherits text-decoration from its element
        https://bugs.webkit.org/show_bug.cgi?id=157199
        <rdar://problem/26013111>

        Reviewed by Zalan Bujtas.

        Test: fast/css/text-decoration-inheritance-pseudo.html

        * css/StyleResolver.cpp:
        (WebCore::doesNotInheritTextDecoration):
        (WebCore::StyleResolver::adjustRenderStyle):

            There was an accidental logic change here. Even if element is null other conditions may make this test true.

2016-04-30  Zalan Bujtas  <zalan@apple.com>

        Some content causes deep recursion.
        https://bugs.webkit.org/show_bug.cgi?id=157230
        <rdar://problem/7694756>

        Reviewed by Antti Koivisto.

        This patch sets a limit(512) on content nesting for the render tree. Elements injected over the limit
        are still accessible through DOM APIs but
        1. we stop generating renderers for them -they behave like display: none. 
        2. their layout related computed style values are set to default (e.g. window.computedStyle(document.elementById("over512").width -> auto) 

        Test: fast/block/nested-renderers.html

        * page/Settings.h:
        * style/StyleTreeResolver.cpp: Skip renderer constructing and continue with the sibling node. 
        (WebCore::Style::TreeResolver::resolveComposedTree):

2016-04-30  Darin Adler  <darin@apple.com>

        Update XMLHttpRequest to use enum class instead of string for enumeration
        https://bugs.webkit.org/show_bug.cgi?id=157238

        Reviewed by Chris Dumez.

        * bindings/js/JSXMLHttpRequestCustom.cpp:
        (WebCore::JSXMLHttpRequest::response): Rewrite to use responseType function
        instead of responseTypeCode function.

        * bindings/scripts/CodeGenerator.pm: Removed XMLHttpRequestResponseType
        from the list of enumerations that use a string-based implementation.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GetEnumerationImplementationContent): Use emptyString instead of ASCIILiteral
        when the string constant is empty, to avoid the assertion.

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::XMLHttpRequest): Move simple scalar data member
        initialization to where the data members are defined in the header.
        (WebCore::XMLHttpRequest::responseText): Use m_responseType instead of
        m_responseTypeCode.
        (WebCore::XMLHttpRequest::didCacheResponseJSON): Ditto.
        (WebCore::XMLHttpRequest::responseXML): Ditto.
        (WebCore::XMLHttpRequest::responseBlob): Ditto.
        (WebCore::XMLHttpRequest::responseArrayBuffer): Ditto.
        (WebCore::XMLHttpRequest::setResponseType): Ditto.
        (WebCore::XMLHttpRequest::responseType): Moved to header now that it's a
        trivial function that should be inlined.
        (WebCore::XMLHttpRequest::open): Use m_responseType instead of
        m_responseTypeCode.
        (WebCore::XMLHttpRequest::responseMIMEType): Removed one redundant check.
        (WebCore::XMLHttpRequest::status): Ditto.
        (WebCore::XMLHttpRequest::statusText): Ditto.
        (WebCore::shouldDecodeResponse): Moved here from the header. This is now
        a non-member function that gets passed a response type. It uses a switch
        now instead of ordering the types so that the binary ones are all at the
        end of the list.
        (WebCore::XMLHttpRequest::didReceiveData): Use the new shouldDecodeResponse.
        Also removed an unnecessary check that non-decoded responses are of type
        "arraybuffer" or "blob"; that's the same check that shouldDecodeResponse does.

        * xml/XMLHttpRequest.h: Removed some unneeded includes and forward declarations.
        Removed a comment about the State values needing to be stable numbers; for one
        thing the bindings already check that these values have no changed. It's not a
        valuable comment. Removed ResponseTypeCode, responseTypeCode, and
        m_responseTypeCode. Changed the type of the result of responseType and the
        argument to setResponseType from a string to XMLHttpRequestResponseType.
        Removed shouldDecodeResponse. Added the initial values for lots of data members
        that are simple scalars, matching what was set in the constructor before.

2016-04-30  Darin Adler  <darin@apple.com>

        Streamline and remove unused bindings generation code
        https://bugs.webkit.org/show_bug.cgi?id=157237

        Reviewed by Chris Dumez.

        * Modules/notifications/NotificationCenter.idl: Replace non-standard "int"
        with standard "long", which means the same thing.

        * bindings/scripts/CodeGenerator.pm:
        (UpdateFile): Use a better perl idiom for open.
        (IsTypedArrayType): Use a hash instead of a list of checks in the code.
        (IsRefPtrType): Use GetArrayOrSequenceType. Add handling for "any", which
        is not a "RefPtr" type.
        (IsWrapperType): Build on top of IsRefPtr type so we don't have to repeat
        the list.
        (getInterfaceExtendedAttributesFromName): Added a FIXME about why this is no good.
        (ComputeIsCallbackInterface): Renamed.
        (IsCallbackInterface): Added a cache so we don't keep reading the same file
        over and over again. Added a FIXME about why this is no good.
        (ComputeIsFunctionOnlyCallbackInterface): Ditto.
        (IsFunctionOnlyCallbackInterface): Ditto.

        * bindings/scripts/CodeGeneratorJS.pm:
        (AddIncludesForType): Use GetArrayOrSequenceType.
        (IsScriptProfileType): Deleted.
        (AddTypedefForScriptProfileType): Deleted.
        (AddClassForwardIfNeeded): Streamlined the code and made the ScriptProfileNode
        special case easier to read.
        (GenerateParametersCheckExpression): Use GetArrayOrSequenceType.
        (GetFunctionLength): Tweaked formatting and argument names.
        (GenerateImplementation): Merged a couple checks into a single if statement.
        (WillConvertUndefinedToDefaultParameterValue): Streamlined the function by
        using a hash instead of a sequence of if statements for most cases.
        (GetNativeType): Use GetArrayOrSequenceType.
        (JSValueToNative): Do the integer conversion based on a hash rather than
        with lots of separate lines of code. Moved more of the simple names down to
        the bottom of the function and streamlined the logic. Removed unnecessary
        includes of the DOM headers directly, since our header file includes those.
        (NativeToJSValue): Factored out the global object handling so it works across
        more cases. Simplified the logic for dates. Use IsNumericType instead of
        IsPrimitiveType to guard code that is right only for the numeric types.
        Removed code to handle "Symbol" since we don't ever use that.

        * bindings/scripts/test/JS/JSTestCallback.cpp:
        * bindings/scripts/test/JS/JSTestCallbackFunction.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        Regenerated.

        * bindings/scripts/test/TestObj.idl: Removed test coverage for Symbol, which
        we never use anywhere.

        * html/canvas/EXTBlendMinMax.idl: Replace non-standard "int" with standard
        "long", which means the same thing.
        * html/canvas/EXTTextureFilterAnisotropic.idl: Ditto.
        * html/canvas/EXTsRGB.idl: Ditto.
        * html/canvas/OESStandardDerivatives.idl: Ditto.
        * html/canvas/OESVertexArrayObject.idl: Ditto.
        * html/canvas/WebGLCompressedTextureATC.idl: Ditto.
        * html/canvas/WebGLCompressedTexturePVRTC.idl: Ditto.
        * html/canvas/WebGLCompressedTextureS3TC.idl: Ditto.
        * html/canvas/WebGLDebugRendererInfo.idl: Ditto.
        * html/canvas/WebGLDepthTexture.idl: Ditto.

2016-04-30  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Pass even more types by reference
        https://bugs.webkit.org/show_bug.cgi?id=157231

        Reviewed by Darin Adler.

        Pass even more types by reference when the parameters are not marked as
        nullable in the IDL.

        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::generateKeyRequest):
        (WebCore::MediaKeySession::keyRequestTimerFired):
        (WebCore::MediaKeySession::update):
        (WebCore::MediaKeySession::addKeyTimerFired):
        * Modules/encryptedmedia/MediaKeySession.h:
        * Modules/encryptedmedia/MediaKeys.cpp:
        (WebCore::MediaKeys::createSession):
        * Modules/encryptedmedia/MediaKeys.h:
        * Modules/encryptedmedia/MediaKeys.idl:
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::appendBuffer):
        (WebCore::SourceBuffer::resetParserState): Deleted.
        * Modules/mediasource/SourceBuffer.h:
        * Modules/mediastream/RTCDataChannel.cpp:
        (WebCore::RTCDataChannel::send):
        * Modules/mediastream/RTCDataChannel.h:
        * Modules/webaudio/AnalyserNode.h:
        (WebCore::AnalyserNode::getFloatFrequencyData):
        (WebCore::AnalyserNode::getByteFrequencyData):
        (WebCore::AnalyserNode::getByteTimeDomainData):
        * Modules/webaudio/AnalyserNode.idl:
        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::createPeriodicWave):
        * Modules/webaudio/AudioContext.h:
        * Modules/webaudio/AudioParam.h:
        (WebCore::AudioParam::setValueCurveAtTime):
        * Modules/webaudio/AudioParam.idl:
        * Modules/webaudio/BiquadFilterNode.cpp:
        (WebCore::BiquadFilterNode::getFrequencyResponse):
        * Modules/webaudio/BiquadFilterNode.h:
        * Modules/webaudio/BiquadFilterNode.idl:
        * Modules/webaudio/PeriodicWave.cpp:
        (WebCore::PeriodicWave::create):
        (WebCore::PeriodicWave::createSine): Deleted.
        * Modules/webaudio/PeriodicWave.h:
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::send):
        * Modules/websockets/WebSocket.h:
        * bindings/js/JSWebGLRenderingContextBaseCustom.cpp:
        (WebCore::dataFunctionf):
        (WebCore::dataFunctioni):
        (WebCore::dataFunctionMatrix):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck):
        (ShouldPassWrapperByReference):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionDomStringListFunction):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::constructJSTestOverloadedConstructors2):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::webkitAddKey):
        (WebCore::HTMLMediaElement::webkitCancelKeyRequest): Deleted.
        * html/HTMLMediaElement.h:
        * html/HTMLMediaElement.idl:
        * html/ImageData.cpp:
        (WebCore::ImageData::create):
        (WebCore::ImageData::ImageData):
        * html/ImageData.h:
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::getImageData):
        * html/canvas/WebGL2RenderingContext.cpp:
        (WebCore::WebGL2RenderingContext::texImage3D):
        (WebCore::WebGL2RenderingContext::texSubImage3D):
        (WebCore::WebGL2RenderingContext::compressedTexImage3D):
        (WebCore::WebGL2RenderingContext::compressedTexSubImage3D):
        (WebCore::WebGL2RenderingContext::uniform1uiv):
        (WebCore::WebGL2RenderingContext::uniform2uiv):
        (WebCore::WebGL2RenderingContext::uniform3uiv):
        (WebCore::WebGL2RenderingContext::uniform4uiv):
        (WebCore::WebGL2RenderingContext::uniformMatrix2x3fv):
        (WebCore::WebGL2RenderingContext::uniformMatrix3x2fv):
        (WebCore::WebGL2RenderingContext::uniformMatrix2x4fv):
        (WebCore::WebGL2RenderingContext::uniformMatrix4x2fv):
        (WebCore::WebGL2RenderingContext::uniformMatrix3x4fv):
        (WebCore::WebGL2RenderingContext::uniformMatrix4x3fv):
        (WebCore::WebGL2RenderingContext::vertexAttribI4iv):
        (WebCore::WebGL2RenderingContext::vertexAttribI4uiv):
        (WebCore::WebGL2RenderingContext::clearBufferiv):
        (WebCore::WebGL2RenderingContext::clearBufferuiv):
        (WebCore::WebGL2RenderingContext::clearBufferfv):
        (WebCore::WebGL2RenderingContext::getActiveUniforms):
        (WebCore::WebGL2RenderingContext::texSubImage2D):
        * html/canvas/WebGL2RenderingContext.h:
        * html/canvas/WebGL2RenderingContext.idl:
        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore::WebGLRenderingContext::texSubImage2D):
        * html/canvas/WebGLRenderingContext.h:
        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::bufferData):
        (WebCore::WebGLRenderingContextBase::bufferSubData):
        (WebCore::WebGLRenderingContextBase::compressedTexImage2D):
        (WebCore::WebGLRenderingContextBase::compressedTexSubImage2D):
        (WebCore::WebGLRenderingContextBase::readPixels):
        (WebCore::WebGLRenderingContextBase::texImage2D):
        (WebCore::WebGLRenderingContextBase::uniform1fv):
        (WebCore::WebGLRenderingContextBase::uniform1iv):
        (WebCore::WebGLRenderingContextBase::uniform2fv):
        (WebCore::WebGLRenderingContextBase::uniform2iv):
        (WebCore::WebGLRenderingContextBase::uniform3fv):
        (WebCore::WebGLRenderingContextBase::uniform3iv):
        (WebCore::WebGLRenderingContextBase::uniform4fv):
        (WebCore::WebGLRenderingContextBase::uniform4iv):
        (WebCore::WebGLRenderingContextBase::uniformMatrix2fv):
        (WebCore::WebGLRenderingContextBase::uniformMatrix3fv):
        (WebCore::WebGLRenderingContextBase::uniformMatrix4fv):
        (WebCore::WebGLRenderingContextBase::vertexAttrib1fv):
        (WebCore::WebGLRenderingContextBase::vertexAttrib2fv):
        (WebCore::WebGLRenderingContextBase::vertexAttrib3fv):
        (WebCore::WebGLRenderingContextBase::vertexAttrib4fv):
        (WebCore::WebGLRenderingContextBase::validateCompressedTexFuncData):
        (WebCore::WebGLRenderingContextBase::validateUniformParameters):
        (WebCore::WebGLRenderingContextBase::validateUniformMatrixParameters):
        (WebCore::WebGLRenderingContextBase::vertexAttribfvImpl):
        (WebCore::WebGLRenderingContextBase::validateSettableTexFormat): Deleted.
        (WebCore::WebGLRenderingContextBase::uniform1i): Deleted.
        (WebCore::WebGLRenderingContextBase::uniform2i): Deleted.
        (WebCore::WebGLRenderingContextBase::uniform3f): Deleted.
        (WebCore::WebGLRenderingContextBase::uniform3i): Deleted.
        (WebCore::WebGLRenderingContextBase::uniform4f): Deleted.
        (WebCore::WebGLRenderingContextBase::uniform4i): Deleted.
        (WebCore::WebGLRenderingContextBase::useProgram): Deleted.
        (WebCore::WebGLRenderingContextBase::vertexAttribPointer): Deleted.
        (WebCore::WebGLRenderingContextBase::validateCompressedTexDimensions): Deleted.
        (WebCore::WebGLRenderingContextBase::validateBufferDataParameters): Deleted.
        * html/canvas/WebGLRenderingContextBase.h:
        * html/canvas/WebGLRenderingContextBase.idl:
        * testing/Internals.cpp:
        (WebCore::Internals::createTimeRanges):
        * testing/Internals.h:

2016-04-30  Ryosuke Niwa  <rniwa@webkit.org>

        Node.prototype.rootNode is not Web compatible
        https://bugs.webkit.org/show_bug.cgi?id=157233

        Reviewed by Chris Dumez.

        Turns out that the name rootNode is not Web compatible. Remove the method for now
        until we can come up with a better name in https://github.com/whatwg/dom/issues/241.

        No new tests since we're just removing a method.

        * dom/Node.idl:

2016-04-30  Darin Adler  <darin@apple.com>

        Try to fix GTK build.

        * testing/Internals.h: Added conditional around include of
        MediaSessionInterruptionProvider.h.

2016-04-30  Darin Adler  <darin@apple.com>

        Stop using old-style string-based enums in Internals.idl
        https://bugs.webkit.org/show_bug.cgi?id=157235

        Reviewed by Chris Dumez.

        * bindings/scripts/CodeGenerator.pm: Removed the six enumeration names
        that are used in Internals.idl.
        (GenerateCompileTimeCheckForEnumsIfNeeded): Unrelated cleanup. Tighten
        code and use static_assert instead of COMPILE_ASSERT.
        (IsStringType): Marked this function as deprecated. Calling a function
        just to check if something is specifically "DOMString" isn't a good pattern.
        Lots of call sites were checking "DOMString" directly and there is no
        reason to mix the two different idioms.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GetEnumerationImplementationContent): Use GenerateConditionalString.
        (GenerateImplementation): Use static_assert instead of COMPILE_ASSERT.
        (GenerateCallbackHeader): Tighten code. Remove peculiar code that was
        trying to emit COMPILE_ASSERT(false); not an important case to detect, and
        if we did want to detect it, then having the code generator report an error
        is better than COMPILE_ASSERT when compiling the output.
        (NativeToJSValue): Stop using IsStringType.

        * bindings/scripts/CodeGeneratorObjC.pm:
        (GetClassName): Stop using IsStringType.
        (GetPropertyAttributes): Ditto.
        (ConversionNeeded): Ditto.
        (GetObjCTypeGetter): Ditto.
        (AddIncludesForType): Ditto.
        (GenerateImplementation): Removed unused @needsAssert. It was a write-only
        variable.

        * bindings/scripts/IDLParser.pm:
        (parseEnum): Put the extended attributes into the enumeration object.

        * bindings/scripts/test/TestObj.idl: Added test cases for the Conditional
        extended attribute, used with enumerations.

        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestCallback.cpp:
        * bindings/scripts/test/JS/JSTestCallback.h:
        * bindings/scripts/test/JS/JSTestCallbackFunction.h:
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        * bindings/scripts/test/JS/JSTestException.cpp:
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/JS/JSattribute.cpp:
        * bindings/scripts/test/JS/JSreadonly.cpp:
        Regenerated.

        * testing/Internals.cpp:
        (WebCore::toResourceRequestCachePolicy): Take enum instead of string.
        (WebCore::Internals::setOverrideCachePolicy): Ditto.
        (WebCore::toResourceLoadPriority): Ditto.
        (WebCore::Internals::setOverrideResourceLoadPriority): Ditto.
        (WebCore::toAutoFillButtonType): Ditto.
        (WebCore::Internals::setShowAutoFillButton): Ditto.
        (WebCore::interruptingCategoryFromString): Deleted.
        (WebCore::Internals::sendMediaSessionStartOfInterruptionNotification): Ditto.
        (WebCore::Internals::sendMediaSessionEndOfInterruptionNotification): Ditto.
        (WebCore::Internals::sendMediaControlEvent): Ditto.
        (WebCore::Internals::installMockPageOverlay): Ditto.

        * testing/Internals.h: Added enum class and use those instead of strings for
        enumerations defined in the IDL.

        * testing/Internals.idl: Renamed enumerations that conflict with ones that already
        exist in WebCore; added Internals prefix. Made MediaSessionInterruptingCategory and
        MediaControlEvent conditional to match the functions they are used on. Added some
        FIXMEs about peculiarities of some of the enumerations.

2016-04-30  Darin Adler  <darin@apple.com>

        Fixed expected results from bindings tests.

        * bindings/scripts/test/JS/JSTestObj.cpp: Regenerated.

2016-04-30  Darin Adler  <darin@apple.com>

        Next batch of conversions to use C++ enum class instead of strings for enumerations
        https://bugs.webkit.org/show_bug.cgi?id=157232

        Reviewed by Chris Dumez.

        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::error): Use ResponseType.
        (WebCore::FetchResponse::redirect): Ditto.
        (WebCore::FetchResponse::FetchResponse): Ditto.
        (WebCore::FetchResponse::clone): Ditto.
        (WebCore::FetchResponse::type): Return ResponseType.
        (WebCore::FetchResponse::startFetching): Use auto.
        * Modules/fetch/FetchResponse.h: Added ResponseType and used it for the return value
        of the type function, and also to replace FetchResponse::Type.

        * Modules/mediacontrols/MediaControlsHost.cpp:
        (WebCore::MediaControlsHost::externalDeviceType): Return DeviceType.
        * Modules/mediacontrols/MediaControlsHost.h: Added DeviceType and use it for the
        return value for the externalDeviceType function.

        * Modules/mediasession/MediaSession.cpp:
        (WebCore::MediaSession::parseKind): Deleted.
        (WebCore::MediaSession::MediaSession): Use MediaSessionKind.
        (WebCore::MediaSession::kind): Deleted.
        * Modules/mediasession/MediaSession.h: Added MediaSessionKind and use it as the
        argument to MediaSession::create and the return type for the kind function.
        Probably didn't get this 100% right because this code does not seem to be compiled.
        * Modules/mediasession/MediaSession.idl: Added default value for kind, as specified
        in the current version of the specification for this class.
        * Modules/mediasession/MediaSessionManager.cpp:
        (WebCore::MediaSessionManager::didReceiveStartOfInterruptionNotification):
        Tried to update for changes above.
        (WebCore::MediaSessionManager::didReceiveEndOfInterruptionNotification): Ditto.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::endOfStream): Changed to take Optional<EndOfStreamError>
        instead of overloading and taking const AtomicString&.
        (WebCore::MediaSource::streamEndedWithError): Ditto. Also removed exception code.
        (WebCore::MediaSource::addSourceBuffer): Updated to use EndOfStreamError. Also
        used an if statement.
        (WebCore::MediaSource::sourceBufferDidChangeActiveState): Updated to take a reference
        instead of a pointer.
        * Modules/mediasource/MediaSource.h: Added EndOfStreamError and changed as above.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::segmentsKeyword): Deleted.
        (WebCore::SourceBuffer::sequenceKeyword): Deleted.
        (WebCore::SourceBuffer::TrackBuffer::TrackBuffer): Initialize booleans where they are
        defined rather than in this constructor.
        (WebCore::SourceBuffer::create): Use Ref instead of RefPtr.
        (WebCore::SourceBuffer::SourceBuffer): Initialize many data members where they are
        defined rather than in this constructor.
        (WebCore::SourceBuffer::setTimestampOffset): Use AppendMode.
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveRenderingError): Ditto.
        (WebCore::SourceBuffer::decodeError): Deleted.
        (WebCore::SourceBuffer::networkError): Deleted.
        (WebCore::SourceBuffer::setActive): Pass reference instead of pointer.
        (WebCore::SourceBuffer::sourceBufferPrivateDidEndStream): Deleted. No callers.
        (WebCore::SourceBuffer::appendError): Use AppendMode.
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample): Ditto.
        (WebCore::SourceBuffer::setMode): Take AppendMode.
        * Modules/mediasource/SourceBuffer.h: Added AppendMode, removed various string
        constant functions, initialize more data emebers in this header. Removed unused
        sourceBufferPrivateDidEndStream function.

        * Modules/mediastream/MediaDeviceInfo.cpp:
        (WebCore::MediaDeviceInfo::MediaDeviceInfo): Take MediaDeviceKind instead of string.
        (WebCore::MediaDeviceInfo::create): Ditto.
        (WebCore::MediaDeviceInfo::audioInputType): Deleted.
        (WebCore::MediaDeviceInfo::audioOutputType): Deleted.
        (WebCore::MediaDeviceInfo::videoInputType): Deleted.
        * Modules/mediastream/MediaDeviceInfo.h: Aedded MediaDeviceKind and used it.
        * Modules/mediastream/MediaDeviceInfo.idl: Changed type of the kind attribute
        to be MediaDeviceKind as in the specification.

        * Modules/mediastream/MediaDevicesRequest.cpp:
        (WebCore::MediaDevicesRequest::didCompleteTrackSourceInfoRequest): Fix loop to not
        churn the reference countds. Also updated to use String instead of AtomicString for
        label, and MediaDeviceKind instead of string for kind.

        * Modules/mediastream/MediaStreamTrack.cpp:
        (WebCore::MediaStreamTrack::readyState): Return MediaStreamTrackState.
        * Modules/mediastream/MediaStreamTrack.h: Added MediaStreamTrackState and used it
        for the return value from the readyState function.

        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::state): Return AudioContextState.
        * Modules/webaudio/AudioContext.h: Added AudioContextState and used it.

        * Modules/webaudio/WaveShaperNode.cpp:
        (WebCore::processorType): Added.
        (WebCore::WaveShaperNode::setOversample): Take OverSampletype instead of a string.
        (WebCore::WaveShaperNode::oversample): Return OverSampleType.
        * Modules/webaudio/WaveShaperNode.h: Added OverSampleType and used it.
        * Modules/webaudio/WaveShaperNode.idl: Removed unneeded [SetterRaisesException].

        * bindings/scripts/CodeGenerator.pm: Removed special cases for 18 enumerations that
        either don't exist or were converted to no longer pass strings in to the C++ DOM.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeaderContentHeader): Use #pragma once instead of header guards.
        (GetEnumerationValueName): Added logic to handle names with "-" and starting with
        a numeric digit.
        (GetEnumerationImplementationContent): Changed functions so they do more of the
        binding work. Added JSValueTraits specialization so we can generate bindings for
        a vector of any enumeration. Added special cases for null string. Removed special
        case to keep the style checker happy.
        (GenerateHeader): Removed the #endif that matched the header guards in
        GenerateHeaderContentHeader.
        (GenerateImplementation): Use the $type local variable rather than writing out
        $attribute->signature->type or $attributeType. Fixed code path that checks for
        valid enumeration values to work for non-string-based enumerations.
        (CanUseWTFOptionalForParameter): Turn this function off for the new enumerations.
        For now, leave it on for the old string-based enumerations.
        (GenerateParametersCheck): Added appropriate parameter checking for the new
        enumerations.
        (GenerateCallbackHeader): Removed the #endif that matched the header guards in
        GenerateHeaderContentHeader.
        (GetNativeType): Use "auto" instead of the enumeration name in generated code.
        (JSValueToNative): Updated since the name of enumerationValueMyEnum was changed
        to parseMyEnum.
        (NativeToJSValue): Took out call to stringValue, since we now overload the
        jsStringWithCache function instead.

        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
        * bindings/scripts/test/JS/JSTestCallback.h:
        * bindings/scripts/test/JS/JSTestCallbackFunction.h:
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
        * bindings/scripts/test/JS/JSTestEventConstructor.h:
        * bindings/scripts/test/JS/JSTestEventTarget.h:
        * bindings/scripts/test/JS/JSTestException.h:
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
        * bindings/scripts/test/JS/JSTestGlobalObject.h:
        * bindings/scripts/test/JS/JSTestInterface.h:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h:
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
        * bindings/scripts/test/JS/JSTestNode.h:
        * bindings/scripts/test/JS/JSTestNondeterministic.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
        * bindings/scripts/test/JS/JSTestTypedefs.h:
        * bindings/scripts/test/JS/JSattribute.h:
        * bindings/scripts/test/JS/JSreadonly.h:
        Regenerated.

        * crypto/CryptoKey.cpp:
        (WebCore::CryptoKey::type): Use CryptoKeyType.
        (WebCore::CryptoKey::usages): Use KeyUsage.
        * crypto/CryptoKey.h: Added KeyUsage and use CryptoKeyType.

        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::status): Use FontFaceSetLoadStatus.
        * css/FontFaceSet.h: Added FontFaceSetLoadStatus and used it.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::playInternal): Use kind instead of kindEnum.

        * html/HTMLVideoElement.cpp:
        (WebCore::presentationModeFullscreen): Deleted.
        (WebCore::presentationModePictureInPicture): Deleted.
        (WebCore::presentationModeInline): Deleted.
        (WebCore::HTMLVideoElement::webkitSupportsPresentationMode): Use VideoPresentationMode.
        (WebCore::toFullscreenMode): Ditto.
        (WebCore::HTMLVideoElement::webkitSetPresentationMode): Ditto.
        (WebCore::toPresentationMode): Ditto.
        (WebCore::HTMLVideoElement::webkitPresentationMode): Ditto.
        * html/HTMLVideoElement.h: Added VideoPresentationMode and used it.

        * html/canvas/CanvasRenderingContext2D.cpp: Tweaked formatting. Changed
        DefaultSmoothingQuality macro to a constant.
        (WebCore::toWindRule): Replaces parseWinding.
        (WebCore::CanvasRenderingContext2D::fill): Use CanvasWindingRule instead of string.
        (WebCore::CanvasRenderingContext2D::clip): Ditto.
        (WebCore::CanvasRenderingContext2D::fillInternal): Ditto.
        (WebCore::CanvasRenderingContext2D::clipInternal): Ditto.
        (WebCore::CanvasRenderingContext2D::isPointInPath): Ditto.
        (WebCore::CanvasRenderingContext2D::isPointInStroke): Ditto.
        (WebCore::CanvasRenderingContext2D::isPointInPathInternal): Ditto.
        (WebCore::smoothingToInterpolationQuality): Ditto.
        (WebCore::CanvasRenderingContext2D::imageSmoothingQuality): Ditto.
        (WebCore::CanvasRenderingContext2D::setImageSmoothingQuality): Ditto.
        * html/canvas/CanvasRenderingContext2D.h: Added CanvasWindingRule and
        ImageSmoothingQuality, and use them throughout the class.

        * platform/graphics/SourceBufferPrivateClient.h: Removed unused
        sourceBufferPrivateDidEndStream function.

2016-04-30  Nan Wang  <n_wang@apple.com>

        AX: @aria-label attribute should work on <label> element
        https://bugs.webkit.org/show_bug.cgi?id=157219

        Reviewed by Chris Fleizach.

        When there's aria-label on a <label> element, we shouldn't expose it
        as the titleUIElement. Instead, we return its aria-label as a title.

        Test: accessibility/mac/aria-label-on-label-element.html

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::titleElementText):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::exposesTitleUIElement):

        * platform/cocoa/WebPlaybackSessionModelMediaElement.mm:
        (WebCore::WebPlaybackSessionModelMediaElement::updateForEventName):
        Use DeviceType instead of String for externalDeviceType.

2016-04-29  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Specify default parameter values for callback parameters
        https://bugs.webkit.org/show_bug.cgi?id=157188

        Reviewed by Darin Adler.

        Specify default parameter values for callback parameters.

        * Modules/geolocation/Geolocation.idl:
        * Modules/notifications/Notification.cpp:
        (WebCore::Notification::requestPermission):
        * Modules/notifications/Notification.h:
        * Modules/notifications/Notification.idl:
        * Modules/notifications/NotificationCenter.idl:
        * Modules/quota/StorageInfo.cpp:
        (WebCore::StorageInfo::queryUsageAndQuota):
        (WebCore::StorageInfo::requestQuota):
        * Modules/quota/StorageInfo.h:
        * Modules/quota/StorageInfo.idl:
        * Modules/quota/StorageQuota.h:
        * Modules/quota/StorageQuota.idl:
        * Modules/webaudio/AudioContext.idl:
        * Modules/webdatabase/DOMWindowWebDatabase.cpp:
        (WebCore::DOMWindowWebDatabase::openDatabase):
        * Modules/webdatabase/DOMWindowWebDatabase.h:
        (WebCore::DOMWindowWebDatabase::DOMWindowWebDatabase):
        (WebCore::DOMWindowWebDatabase::~DOMWindowWebDatabase):
        * Modules/webdatabase/DOMWindowWebDatabase.idl:
        * Modules/webdatabase/Database.cpp:
        (WebCore::Database::runTransaction):
        (WebCore::Database::changeVersion):
        (WebCore::Database::transaction):
        (WebCore::Database::readTransaction):
        * Modules/webdatabase/Database.h:
        * Modules/webdatabase/Database.idl:
        * Modules/webdatabase/SQLTransaction.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck):
        (CanUseWTFOptionalForParameter): Deleted.
        * bindings/scripts/test/TestObj.idl:
        * dom/DataTransferItem.h:
        * dom/DataTransferItem.idl:

2016-04-28  Darin Adler  <darin@apple.com>

        First step in using "enum class" instead of "String" for enumerations in DOM
        https://bugs.webkit.org/show_bug.cgi?id=157163

        Reviewed by Chris Dumez.

        This patch adds the basic support for using "enum class" to implement enumerations
        in the C++ DOM. This is enough so we can use it for one case, but not enough for
        others. For example, it correctly generates code to get an attribute, but likely
        does not correctly generate code to set an attribute or call a function with an
        argument type that is the new style of enum.

        * bindings/scripts/CodeGenerator.pm: Cleaned up the formatting of the hashes
        at the start of this file. Added a new one named stringBasedEnumerationHash
        and a comment explaining that we need to eventually make it empty.
        (ProcessDocument): Pass the enumerations into the GenerateInterface function.
        (IsStringBasedEnumType): Added. Returns 1 for the old-style string-based enumerations,
        as opposed to enumerations we use "enum class" for.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateInterface): Take the enumerations argument and pass it along to the
        functions that generate headers and implementation files.
        (EnumerationClassName): Added. Maps from an enumeration type name as seen
        in the IDL file to the enumeration class name used in the C++ DOM implementation.
        (EnumerationValueName): Added. Maps from an anumeration string value as seen
        in the IDL file to an enumeration value name used in the C++ DOM implementatino.
        (EnumerationImplementationContent): Added. Generates a string with all the content
        needed in the implementation file to define the helper functions for enumerations.
        (GenerateHeader): Tweak.
        (GenerateImplementation): Added call to EnumerationImplementationContent.
        (GenerateParametersCheck): Use toWTFString instead of toString/value, which is a
        longer way of writing out the same thing.
        (GenerateCallbackHeader): Tweak.
        (GenerateCallbackImplementation): Added call to EnumerationImplementationContent.
        (GetNativeType): Continue to return String for string-based enum types, but for
        other enum types, return the result of EnumerationClassName instead.
        (JSValueToNative): Use toWTFString instead of toString/value (see above), convert
        to a string only for string-based enum types, and add a preliminary, probably not
        yet working, version of the code for non-string-based enum types. Will finish this
        in the next patch when we are trying to use one of the new enumerations for a setter
        or a function argument.
        (NativeToJSValue): Call the stringValue function to convert an enumeration value
        into a string when it's not a string-based enumeration.

        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        * bindings/scripts/test/JS/JSTestNode.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        Regenerated.

        * css/FontFace.cpp:
        (WebCore::FontFace::status): Updated to return enum values rather than strings.

        * css/FontFace.h: Removed unneeded forward declaration of Deprecated::ScriptValue.
        Added enum class for FontFaceLoadStatus, with names that match the names from the
        enumeration in the IDL, but with our standard enum capitalization style. Changed
        the return value of the status function to FontFaceLoadStatus.

2016-04-29  Chris Dumez  <cdumez@apple.com>

        Get rid of unnecessary null check in wrap(JSDOMGlobalObject*, DOMClass*)
        https://bugs.webkit.org/show_bug.cgi?id=157224

        Reviewed by Ryosuke Niwa.

        Get rid of unnecessary null check in wrap(JSDOMGlobalObject*, DOMClass*)
        since all the call sites already do a null check. Also update the function
        to take the implementation object by reference instead of pointer. Finally,
        use is<>() / downcast<>() more at the call sites.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::update):
        (WebCore::IDBCursor::deleteFunction):
        (WebCore::IDBCursor::setGetResult):
        * Modules/indexeddb/IDBCursor.h:
        (WebCore::IDBCursor::isKeyCursorWithValue):
        (WebCore::IDBCursor::isKeyCursor): Deleted.
        * Modules/indexeddb/IDBCursorWithValue.h:
        (isType):
        * bindings/js/JSBlobCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSCanvasRenderingContextCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSDOMBinding.h:
        (WebCore::wrap):
        * bindings/js/JSIDBCursorCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSMediaStreamCapabilitiesCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSPerformanceEntryCustom.cpp:
        (WebCore::toJS):
        * html/canvas/WebGL2RenderingContext.h:
        * html/canvas/WebGLRenderingContext.h:
        * page/PerformanceMark.h:
        (isType):
        (WebCore::PerformanceMark::isMark): Deleted.
        * page/PerformanceMeasure.h:
        (isType):
        (WebCore::PerformanceMeasure::isMeasure): Deleted.
        * page/PerformanceResourceTiming.h:
        (isType):
        (WebCore::PerformanceResourceTiming::isResource): Deleted.

2016-04-29  Chris Dumez  <cdumez@apple.com>

        Use LIKELY() / UNLIKELY() hints when suitable in the JavaScript bindings
        https://bugs.webkit.org/show_bug.cgi?id=157210

        Reviewed by Darin Adler.

        Use LIKELY() / UNLIKELY() hints when suitable in the JavaScript bindings.
        We already make use of them in the JS bindings but they are some cases
        where we don't and they may be useful.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateOverloadedFunction):
        (GenerateImplementation):
        (GenerateParametersCheck):
        (GenerateImplementationFunctionCall):
        (GenerateOverloadedConstructorDefinition):
        (GenerateConstructorDefinition):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::jsTestActiveDOMObjectConstructor):
        (WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::jsTestClassWithJSBuiltinConstructorConstructor):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::jsTestCustomConstructorWithNoInterfaceObjectConstructor):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::jsTestCustomNamedGetterConstructor):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::jsTestEventConstructorConstructor):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::JSTestEventTarget::getOwnPropertySlotByIndex):
        (WebCore::jsTestEventTargetConstructor):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::jsTestExceptionConstructor):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::jsTestGenerateIsReachableConstructor):
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
        (WebCore::jsTestGlobalObjectConstructor):
        (WebCore::jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterfaceConstructor::construct):
        (WebCore::jsTestInterfaceConstructor):
        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod2):
        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        (WebCore::jsTestJSBuiltinConstructorConstructor):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::jsTestMediaQueryListListenerConstructor):
        (WebCore::jsTestMediaQueryListListenerPrototypeFunctionMethod):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::JSTestNamedConstructorNamedConstructor::construct):
        (WebCore::jsTestNamedConstructorConstructor):
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::jsTestNodeConstructor):
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::jsTestNondeterministicConstructor):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjConstructor::construct):
        (WebCore::JSTestObj::getOwnPropertySlotByIndex):
        (WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
        (WebCore::jsTestObjConstructor):
        (WebCore::jsTestObjPrototypeFunctionEnabledAtRuntimeOperation):
        (WebCore::jsTestObjPrototypeFunctionVoidMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionByteMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionOctetMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionLongMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows):
        (WebCore::jsTestObjPrototypeFunctionMethodWithCallbackArg):
        (WebCore::jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg):
        (WebCore::jsTestObjPrototypeFunctionMethodWithCallbackFunctionArg):
        (WebCore::jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackFunctionArg):
        (WebCore::jsTestObjConstructorFunctionStaticMethodWithCallbackArg):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod5):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod8):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter):
        (WebCore::jsTestObjConstructorFunctionOverloadedMethod1):
        (WebCore::jsTestObjPrototypeFunctionConvert1):
        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithSequence):
        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithArray):
        (WebCore::jsTestObjPrototypeFunctionVariadicNodeMethod):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithFloatArgumentPromise):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1Promise):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2Promise):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::constructJSTestOverloadedConstructors1):
        (WebCore::constructJSTestOverloadedConstructors3):
        (WebCore::JSTestOverloadedConstructorsConstructor::construct):
        (WebCore::jsTestOverloadedConstructorsConstructor):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::jsTestOverrideBuiltinsConstructor):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::jsTestSerializedScriptValueInterfaceConstructor):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::JSTestTypedefsConstructor::construct):
        (WebCore::jsTestTypedefsConstructor):
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::jsattributeConstructor):
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::jsreadonlyConstructor):

2016-04-29  Ryosuke Niwa  <rniwa@webkit.org>

        Rename getAssignedNodes to assignedNodes and support flattened option
        https://bugs.webkit.org/show_bug.cgi?id=157225

        Reviewed by Antti Koivisto.

        Renamed getAssignedNodes and added the the support for {flattened: true/false} as spec'ed at
        http://w3c.github.io/webcomponents/spec/shadow/#widl-HTMLSlotElement-assignedNodes-sequence-Node--AssignedNodesOptions-options

        Test: fast/shadow-dom/HTMLSlotElement-interface.html

        * html/HTMLSlotElement.cpp:
        (WebCore::flattenAssignedNodes): Added.
        (WebCore::HTMLSlotElement::assignedNodesForBindings): Added.
        * html/HTMLSlotElement.h:
        * html/HTMLSlotElement.idl:

2016-04-29  Simon Fraser  <simon.fraser@apple.com>

        Make clipToRect() and restoreClip() have similar signatures
        https://bugs.webkit.org/show_bug.cgi?id=157229

        Reviewed by Zalan Bujtas.

        clipToRect() and restoreClip() are always called in pairs, but had different
        parameter order, and parameter types. So make them more similar.
        
        In future we could use them in a stack-based class.

        No behavior change.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::clipToRect):
        (WebCore::RenderLayer::restoreClip):
        (WebCore::RenderLayer::paintLayer):
        (WebCore::RenderLayer::applyFilters):
        (WebCore::RenderLayer::paintTransformedLayerIntoFragments):
        (WebCore::RenderLayer::paintBackgroundForFragments):
        (WebCore::RenderLayer::paintForegroundForFragments):
        (WebCore::RenderLayer::paintForegroundForFragmentsWithPhase):
        (WebCore::RenderLayer::paintOutlineForFragments):
        (WebCore::RenderLayer::paintMaskForFragments):
        (WebCore::RenderLayer::paintChildClippingMaskForFragments):
        (WebCore::RenderLayer::paintOverflowControlsForFragments):
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/RenderLayer.h:

2016-04-29  Simon Fraser  <simon.fraser@apple.com>

        Blur filter escapes an enclosing overflow:hidden
        https://bugs.webkit.org/show_bug.cgi?id=155029

        Reviewed by Zalan Bujtas.

        The clipping that was applied when drawing the results of filters was wrong for two reasons.

        First, it used localPaintingInfo which has already been contaminated when setting up the filters.
        When painting the result, we need to use the original paintingInfo, to get the right paintDirtyRect.

        Secondly, when setting up the clip to paint the filter result, it was relying on layerFragments[0].backgroundRect.
        However, that was also contaminated by filter setup, since calculateRects() intersects with paintDirtyRect to
        compute that backgroundRect, and that paintDirtyRect came from filterPainter->repaintRect().
        
        Fix this second issue by re-running collectFragments(), which computes a fragment backgroundRect using
        the original paintDirtyRect.

        Tests: css3/filters/blur-clipped-by-ancestor.html
               css3/filters/blur-clipped-with-overflow.html
               css3/filters/drop-shadow-with-overflow-hidden.html
               css3/filters/drop-shadow.html

        * platform/graphics/filters/FilterEffect.cpp:
        (WebCore::FilterEffect::clearResult): Unconditionally null these out.
        * rendering/FilterEffectRenderer.cpp:
        (WebCore::FilterEffectRendererHelper::beginFilterEffect): Typo fix.
        * rendering/FilterEffectRenderer.h:
        (WebCore::FilterEffectRendererHelper::FilterEffectRendererHelper): C++11 initialization.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::applyFilters):
        (WebCore::RenderLayer::paintLayerContents):
        * rendering/RenderLayer.h: const

2016-04-29  Myles C. Maxfield  <mmaxfield@apple.com>

        REGRESSION(194502): overflow: scroll; direction: rtl; divs jump horizontally when scrolled vertically
        https://bugs.webkit.org/show_bug.cgi?id=157201

        Reviewed by Simon Fraser.

        ScrollableArea::scrollToOffsetWithoutAnimation() was mistakenly conflating scroll offsets with
        scroll positions.

        Test: fast/scrolling/rtl-drag-vertical-scroller.html

        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::scrollToOffsetWithoutAnimation):

2016-04-29  Simon Fraser  <simon.fraser@apple.com>

        Clean up GraphicsContext use in RenderLayer::paintLayerContents()
        https://bugs.webkit.org/show_bug.cgi?id=157193

        Reviewed by Zalan Bujtas.

        Make the lifetime of the temporary GraphicsContext used to paint filters more explicit
        by putting it in an inner scope.
        
        Make currentContext a reference.
        
        transparencyLayerContext was a confusing name (it doens't mean we've started a
        transparency layer), so just use "context" to refer to the original context. When
        passed to other functions, this is called "contextForTransparencyLayer".
        
        No longer leaves "context" as a null pointer if filterPainter->filterContext() returns
        a null pointer. It's unclear if this ever happened.

        * rendering/FilterEffectRenderer.cpp:
        (WebCore::FilterEffectRendererHelper::filterContext):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::beginTransparencyLayers):
        (WebCore::RenderLayer::applyFilters):
        (WebCore::RenderLayer::paintLayerContents):
        (WebCore::RenderLayer::paintBackgroundForFragments):
        (WebCore::RenderLayer::paintForegroundForFragments):
        * rendering/RenderLayer.h:

2016-04-29  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Issues inspecting the inspector, pausing on breakpoints causes content to not load
        https://bugs.webkit.org/show_bug.cgi?id=157198
        <rdar://problem/26011049>

        Reviewed by Timothy Hatcher.

        No new tests. This only affects inspecting an inspector.

        * inspector/InspectorController.h:
        * inspector/InspectorFrontendClient.h:
        (WebCore::InspectorFrontendClient::pagePaused):
        (WebCore::InspectorFrontendClient::pageUnpaused):
        * inspector/PageScriptDebugServer.cpp:
        (WebCore::PageScriptDebugServer::setJavaScriptPaused):
        Inform a frontend client if the frontend page itself pauses/unpauses.

2016-04-29  Eric Carlson  <eric.carlson@apple.com>

        [iOS] do not exit AirPlay when the screen locks
        https://bugs.webkit.org/show_bug.cgi?id=156502
        <rdar://problem/24616592>

        Reviewed by Dean Jackson

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::pendingActionTimerFired): Use m_isPlayingToWirelessTarget.
        (WebCore::HTMLMediaElement::webkitCurrentPlaybackTargetIsWireless): Ditto.
        (WebCore::HTMLMediaElement::wirelessRoutesAvailableDidChange): Set m_isPlayingToWirelessTarget.
        (WebCore::HTMLMediaElement::mediaPlayerCurrentPlaybackTargetIsWirelessChanged): Use
          m_isPlayingToWirelessTarget.
        (WebCore::HTMLMediaElement::isPlayingToWirelessPlaybackTarget): Ditto.
        (WebCore::HTMLMediaElement::configureMediaControls): Ditto.
        (WebCore::HTMLMediaElement::shouldOverrideBackgroundPlaybackRestriction): Add logging.
        (WebCore::HTMLMediaElement::purgeBufferedDataIfPossible): Don't tell the media engine to purge 
          data if it is playing to a wireless target because that will drop the connection.
        * html/HTMLMediaElement.h:

        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::playbackPermitted): Add logging.
        (WebCore::MediaElementSession::canPlayToWirelessPlaybackTarget): Drive by fix: iOS doesn't 
          have an explicit playbackTarget, don't test for it.
        (WebCore::MediaElementSession::isPlayingToWirelessPlaybackTarget): Ditto.

2016-04-29  Chris Dumez  <cdumez@apple.com>

        Node.nodeName should not be nullable
        https://bugs.webkit.org/show_bug.cgi?id=157211

        Reviewed by Ryosuke Niwa.

        Node.nodeName should not be nullable as per the specification:
        https://dom.spec.whatwg.org/#interface-node

        Our implementation never returns null anyway. However, having
        it as nullable in the IDL means we use jsStringOrNull() instead
        of jsStringWithCache(), thus doing an unnecessary null check.

        This should not be observable by JS.

        * dom/Node.idl:

2016-04-29  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r200150 and r200256.
        https://bugs.webkit.org/show_bug.cgi?id=157216

        This change introduced flakiness in existing CJK LayoutTests.
        Also reverting the change that marked the tests as flaky.
        (Requested by ryanhaddad on #webkit).

        Reverted changesets:

        "Clean up Font::removeFromSystemFallbackCache()"
        https://bugs.webkit.org/show_bug.cgi?id=157093
        http://trac.webkit.org/changeset/200150

        "Marking fast/ruby/ruby-expansion-cjk.html and fast/ruby/ruby-
        expansion-cjk-4.html as flaky on Mac"
        https://bugs.webkit.org/show_bug.cgi?id=157197
        http://trac.webkit.org/changeset/200256

2016-04-29  Antonio Gomes  <tonikitoo@webkit.org>

        <select multiple> padding should react when scrolling

        https://bugs.webkit.org/show_bug.cgi?id=156590
        https://bugs.webkit.org/show_bug.cgi?id=156591

        Reviewed by Reviewed by Darin Adler.

        Tests: fast/forms/listbox-respects-padding-bottom.html
               fast/forms/listbox-top-padding-do-not-clip-items.html

        Non-dropdown listboxes have support to padding-{top,bottom} implemented similarly
        to the border model: the padding area does not move when the listbox' content gets scrolled,
        but instead it clips out its content.
        This is not consistent with other browsers and is not consistent with the CSS box model.

        This in practice, if a <select> has padding-top set, the padding-top area will clip out listbox'
        content as one scrolls upwards.
        It also means that if padding-bottom is set, when one scrolls all the way to the bottom
        of the listbox content, padding-bottom is not respected.

        In order to fix these two problems, and make WebKit match Blink with respect to the the way
        padding-{top,bottom} are handled, patch adds two class member variables that control the number
        of list items (i.e. <option>s) that can be painted over the current listbox' padding area.

        In short, depending on the scroll position and the amount of space available in the padding top/bottom
        areas, items are painted or not on top of it, mimic'ing the CSS box model behavior of other browsers.

        Note that this is specific solution is worth it to pursue on the short/mid term, but a long-term solution
        to this problem and many other listbox discrepancies on WebKit's implementation, would be to reimplement
        RenderListBox class in terms of RenderLayer. This will be a follow up work.

        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::updateFromElement):
        (WebCore::RenderListBox::numVisibleItems):
        (WebCore::RenderListBox::paintObject):
        (WebCore::RenderListBox::scrollToRevealElementAtListIndex):
        (WebCore::RenderListBox::listIndexIsVisible):
        (WebCore::RenderListBox::maximumNumberOfItemsThatFitInPaddingBottomArea):
        (WebCore::RenderListBox::numberOfVisibleItemsInPaddingTop):
        (WebCore::RenderListBox::numberOfVisibleItemsInPaddingBottom):
        (WebCore::RenderListBox::computeFirstIndexesVisibleInPaddingTopBottomAreas):
        (WebCore::RenderListBox::scrollTo):
        * rendering/RenderListBox.h:

2016-04-29  Eric Carlson  <eric.carlson@apple.com>

        [Mac] AirPlay fails if target is set before AVPlayer has been created
        https://bugs.webkit.org/show_bug.cgi?id=157147
        <rdar://problem/24197592>

        Reviewed by Jer Noble.

        Test: media/media-source/media-source-airplay.html

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer): Clear flag before calling
          setShouldPlayToPlaybackTarget so it does the necessary setup.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::isAvailable): Return false if the mock
          MSE source has been registered.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::supportsType): Return 'not supported' if
          isAvailable is false.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::load): Fail if isAvailable is false.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::isCurrentPlaybackTargetWireless): Cleanup.

        * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:
        (WebCore::registered): Global accessor.
        (WebCore::MockMediaPlayerMediaSource::isRegistered): 
        (WebCore::MockMediaPlayerMediaSource::registerMediaEngine): Set registered to true.
        (WebCore::MockMediaPlayerMediaSource::setWirelessPlaybackTarget): New, remember the target.
        (WebCore::MockMediaPlayerMediaSource::setShouldPlayToPlaybackTarget): New, remember the setting.
        (WebCore::MockMediaPlayerMediaSource::isCurrentPlaybackTargetWireless):
        * platform/mock/mediasource/MockMediaPlayerMediaSource.h:

        * testing/Internals.cpp:
        (WebCore::Internals::initializeMockMediaSource): Don't disable AVFoundation.

2016-04-29  Myles C. Maxfield  <mmaxfield@apple.com>

        [RTL Scrollbars] REGRESSION(r200116): Positioned contents can overlap RTL scrollbars
        https://bugs.webkit.org/show_bug.cgi?id=157164
        <rdar://problem/25993610>

        Reviewed by Darin Adler.

        There was some code left over from the old implementation of RTL_SCROLLBARS
        which had some faulty assumptions about the interaction between direction
        and scrollbar placement. In particular, once we began obeying the "dir"
        attribute in r200116, these assumptions were no longer valid.

        Test: fast/scrolling/rtl-scrollbars-positioned-intersect-scrollbars.html
              scrollbars/rtl/div-absolute.html
              scrollbars/rtl/div-horizontal.html

        * rendering/InlineFlowBox.h:
        (WebCore::InlineFlowBox::layoutOverflowRect):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeOverflow): Deleted.
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::layoutOverflowRectForPropagation):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::computeScrollDimensions):

2016-04-29  Nan Wang  <n_wang@apple.com>

        AX: CharacterOffset not working correctly with composed characters and collapsed white spaces
        https://bugs.webkit.org/show_bug.cgi?id=157190

        Reviewed by Chris Fleizach.

        When navigating emoji, next/previous text marker call is only moving by one character. Fixed it by
        using the helper function in Position to get the real character count for the composed character sequence.
        Also there's another issue with collapsed white spaces, TextIterator emits only one space. So we have to 
        use the actual space length to create the CharacterOffset in order to generate valid Range object from it.

        New test cases in accessibility/text-marker/text-marker-previous-next.html.

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::traverseToOffsetInRange):
        (WebCore::AXObjectCache::textMarkerDataForNextCharacterOffset):
        (WebCore::AXObjectCache::textMarkerDataForPreviousCharacterOffset):
        (WebCore::AXObjectCache::nextNode):
        (WebCore::AXObjectCache::characterOffsetFromVisiblePosition):
        (WebCore::AXObjectCache::nextCharacterOffset):
        (WebCore::AXObjectCache::previousCharacterOffset):
        (WebCore::AXObjectCache::startCharacterOffsetOfWord):

2016-04-28  Jer Noble  <jer.noble@apple.com>

        WebPlaybackControlsManager should not be owned by the WebPlaybackSessionInterfaceMac.
        https://bugs.webkit.org/show_bug.cgi?id=157155
        <rdar://problem/25991724>

        Reviewed by Beth Dakin.

        Move the WebPlaybackControlsManager class into its own header and implementation files.

        * WebCore.xcodeproj/project.pbxproj:
        * platform/mac/WebPlaybackControlsManager.h: Added.
        * platform/mac/WebPlaybackControlsManager.mm: Added.
        (-[WebPlaybackControlsManager timing]): Moved from WebPlaybackSessionInterfaceMac.
        (-[WebPlaybackControlsManager setTiming:]): Ditto.
        (-[WebPlaybackControlsManager seekableTimeRanges]): Ditto.
        (-[WebPlaybackControlsManager setSeekableTimeRanges:]): Ditto.
        (-[WebPlaybackControlsManager setAudioMediaSelectionOptions:withSelectedIndex:]): Ditto.
        (-[WebPlaybackControlsManager setLegibleMediaSelectionOptions:withSelectedIndex:]): Ditto.
        * platform/mac/WebPlaybackSessionInterfaceMac.h:
        * platform/mac/WebPlaybackSessionInterfaceMac.mm:
        (WebCore::WebPlaybackSessionInterfaceMac::setPlayBackControlsManager):
        (-[WebPlaybackControlsManager initWithWebPlaybackSessionInterfaceMac:]): Deleted.
        (-[WebPlaybackControlsManager timing]): Deleted.
        (-[WebPlaybackControlsManager setTiming:]): Deleted.
        (-[WebPlaybackControlsManager seekableTimeRanges]): Deleted.
        (-[WebPlaybackControlsManager setSeekableTimeRanges:]): Deleted.
        (-[WebPlaybackControlsManager setAudioMediaSelectionOptions:withSelectedIndex:]): Deleted.
        (-[WebPlaybackControlsManager setLegibleMediaSelectionOptions:withSelectedIndex:]): Deleted.
        (WebCore::WebPlaybackSessionInterfaceMac::playBackControlsManager): Deleted.

2016-04-29  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r200232.
        https://bugs.webkit.org/show_bug.cgi?id=157189

        This change broke the Mac CMake build and its LayoutTest is
        failing and/or flaky on all platforms (Requested by ryanhaddad
        on #webkit).

        Reverted changeset:

        "Move ResourceTiming behind a runtime flag"
        https://bugs.webkit.org/show_bug.cgi?id=157133
        http://trac.webkit.org/changeset/200232

2016-04-29  Jeremy Huddleston Sequoia  <jeremyhu@apple.com>

        [GTK] Fix build failure introduced by r199738
        https://bugs.webkit.org/show_bug.cgi?id=157182

        Reviewed by Alex Christensen.

        * CMakeLists.txt:

2016-04-29  Brady Eidson  <beidson@apple.com>

        Add a default ".isolatedCopy()" specialization to CrossThreadCopier, and other small cleanup.
        https://bugs.webkit.org/show_bug.cgi?id=157185

        Reviewed by Anders Carlsson.

        No new tests (Code cleanup, no change in behavior).

        * platform/CrossThreadCopier.cpp:
        (WebCore::IndexedDB::TransactionMode>::copy): Deleted.
        (WebCore::IndexedDB::CursorDirection>::copy): Deleted.
        (WebCore::IndexedDB::CursorType>::copy): Deleted.
        (WebCore::IDBGetResult>::copy): Deleted.
        (WebCore::IDBKeyData>::copy): Deleted.
        (WebCore::IDBKeyRangeData>::copy): Deleted.
        (WebCore::IDBDatabaseInfo>::copy): Deleted.
        (WebCore::IDBDatabaseIdentifier>::copy): Deleted.
        (WebCore::IDBTransactionInfo>::copy): Deleted.
        (WebCore::IDBResourceIdentifier>::copy): Deleted.
        (WebCore::IDBError>::copy): Deleted.
        (WebCore::IDBObjectStoreInfo>::copy): Deleted.
        (WebCore::IDBIndexInfo>::copy): Deleted.
        (WebCore::IDBCursorInfo>::copy): Deleted.
        (WebCore::IDBValue>::copy): Deleted.

        * platform/CrossThreadCopier.h:
        (WebCore::AllowCrossThreadAccessWrapper::AllowCrossThreadAccessWrapper): Deleted dead code.
        (WebCore::AllowCrossThreadAccessWrapper::value): Deleted dead code.
        (WebCore::AllowCrossThreadAccess): Deleted dead code.
        (WebCore::AllowAccessLaterWrapper::AllowAccessLaterWrapper): Deleted dead code.
        (WebCore::AllowAccessLaterWrapper::value): Deleted dead code.
        (WebCore::AllowAccessLater): Deleted dead code.

2016-04-29  Simon Fraser  <simon.fraser@apple.com>

        Wheel Event Not Fired For `body,html { height:100% }`
        https://bugs.webkit.org/show_bug.cgi?id=148450

        Reviewed by Brent Fulgham.
        
        EventHandler::handleWheelEvent() didn't pass the Active flag in the HitTestRequest,
        which causes code in RenderLayer::hitTest() to fail to fall back to returning the
        root layer if no other element is hit. "Active" is in the default flags,
        so just create the HitTestRequest with the default flags.

        Test: fast/events/wheel-event-outside-body.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleWheelEvent):

2016-04-29  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Specify default values for optional parameters of wrapper types
        https://bugs.webkit.org/show_bug.cgi?id=157161

        Reviewed by Darin Adler.

        Specify default values for optional parameters of wrapper types.

        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::count): Deleted.
        * Modules/indexeddb/IDBIndex.h:
        * Modules/indexeddb/IDBIndex.idl:
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::count): Deleted.
        * Modules/indexeddb/IDBObjectStore.h:
        * Modules/indexeddb/IDBObjectStore.idl:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::createDataChannel): Deleted.
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/mediastream/RTCPeerConnection.idl:

        * bindings/scripts/CodeGeneratorJS.pm:
        (WillConvertUndefinedToDefaultParameterValue):
        Optimization to avoid generating a ternary if the default
        value of a wrapper type parameter is null, since undefined
        will already convert to null for those.

        (GenerateParametersCheck):
        Use null as implicit default value for nullable parameters, given that Web IDL
        converts undefined to null for such parameters:
        http://heycam.github.io/webidl/#es-nullable-type

        (CanUseWTFOptionalForParameter):
        Drop the check for wrapper types.

        * bindings/scripts/test/*:
        Improve bindings tests coverage / rebaseline.

        * css/MediaQueryList.idl:
        * css/MediaQueryListListener.idl:
        * dom/Document.idl:

        * html/canvas/DOMPath.idl:
        The previous syntax was working because the bindings was generating an early
        return if addPath() was called with only one parameter, calling the
        implementation method with only 1 parameter. However, since we no longer
        generate early returns for optional parameters, we now have to use a slightly
        different syntax to maintain the previous behavior. This is only temporary,
        I just did not want to deal with SVG tear off types in this patch since they
        are very special in the bindings generator.

        * page/DOMSelection.idl:
        The node parameter to extend() was confusingly marked as optional. However,
        when omitted, it would get translated into null, which would throw an
        exception since the type is not nullable. Since the specification says 'node'
        should not be optional, and since there is no behavior change, I dropped
        the 'optional'. The only web-exposed difference is the message provided with
        the TypeError that is thrown when called without enough parameters. The new
        message is more accurate (see rebaselined layout test).

        * svg/SVGMarkerElement.idl:
        The parameter for setOrientToAngle() was confusingly marked as optional and
        having a default value of null. However, the bindings would throw a TypeError
        if called with no parameters or when calling it with null. This is because
        this is an SVG Tear off type and the bindings always throw when passing null
        for an SVG Tear off type. I therefore updated the IDL to reflect the actual
        behavior (no actual behavior change). The new IDL also now matches the spec:
        http://www.w3.org/TR/SVG2/painting.html#InterfaceSVGMarkerElement

        * svg/SVGSVGElement.idl:
        Same comments as for SVGMarkerElement. The new IDL matches the actual
        behavior and is closer to the specification. I added FIXME comments for when
        it does not match the specification:
        http://www.w3.org/TR/SVG2/struct.html#InterfaceSVGSVGElement
        I did not change web-exposed behavior in this patch.

        * svg/SVGTextContentElement.idl:
        Same as above. No actual behavior change.

        * testing/Internals.cpp:
        * testing/Internals.h:
        * testing/Internals.idl:
        * xml/XPathEvaluator.idl:

2016-04-29  Joanmarie Diggs  <jdiggs@igalia.com>

        [ATK] Expose the value of aria-roledescription via an AtkObject attribute
        https://bugs.webkit.org/show_bug.cgi?id=146719

        Reviewed by Chris Fleizach.

        The author-provided value is now exposed via an AtkObject attribute.

        Implementation is already covered by aria-roledescription.html. The ATK
        expectations are slightly different than those for AX API because falling
        back on the default role description is done by assistive technologies.
        That this fall back is needed is identified by the lack of an author-
        provided value. Thus we do not wish to expose the default role description
        in our implementation.

        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (webkitAccessibleGetAttributes):

2016-04-29  Joanmarie Diggs  <jdiggs@igalia.com>

        [ATK] accessibility/aria-current-global-attribute.html has been failed since r198303
        https://bugs.webkit.org/show_bug.cgi?id=155935

        Reviewed by Chris Fleizach.

        In ATK, the text of span elements is typically exposed through the parent
        element, unless the span has some attribute requiring inclusion in the
        accessibility tree. We were not checking for the presence of global ARIA
        attributes (including aria-current), other than describedby and role.
        The fix is to also check AccessibilityObject::supportsARIAAttributes().

        No new tests. This issue was caught as a result of a failing test.

        * accessibility/atk/AccessibilityObjectAtk.cpp:
        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):

2016-04-29  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Drop 'any' type handling from CanUseWTFOptionalForParameter()
        https://bugs.webkit.org/show_bug.cgi?id=157152

        Reviewed by Darin Adler.

        Drop 'any' type handling from CanUseWTFOptionalForParameter(). Always
        use undefined as default value for parameters of type 'any' unless
        specified otherwise.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::continueFunction): Deleted.
        * Modules/indexeddb/IDBCursor.h:
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::add): Deleted.
        (WebCore::IDBObjectStore::putOrAdd): Deleted.
        * Modules/indexeddb/IDBObjectStore.h:
        * bindings/scripts/CodeGeneratorJS.pm:

        (WillConvertUndefinedToDefaultParameterValue):
        Fix optimization for optional DOMString attributes whose default value
        is the string "undefined". I also added bindings test coverage for it.

        (GenerateParametersCheck):
        (CanUseWTFOptionalForParameter): Deleted.
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_method_with_optional_string_is_undefined):
        (webkit_dom_test_obj_method_with_optional_any):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefined):
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAny):
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj methodWithOptionalStringIsUndefined:]):
        (-[DOMTestObj methodWithOptionalAny:]):
        * bindings/scripts/test/TestObj.idl:
        * testing/Internals.h:

2016-04-29  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: [ATK] Expose elements with ARIA's "text" role
        https://bugs.webkit.org/show_bug.cgi?id=157160

        Reviewed by Chris Fleizach.

        WebCore Accessibility's StaticTextRole is used for exposed RenderText
        objects and for the ARIA "text" role. The former should be folded into
        the parent element; the latter should not be, but was. Now we check to
        see which type we have when building the accessibility tree. Also map
        the "text" role to ATK_ROLE_STATIC.

        We already have sufficient test coverage. Three previously-failing tests
        are now passing.

        * accessibility/atk/AccessibilityObjectAtk.cpp:
        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (atkRole):

2016-04-29  Carlos Garcia Campos  <cgarcia@igalia.com>

        [FreeType] ASSERTION FAILED: !lookupForWriting(Extractor::extract(entry)).second in FontCache::getVerticalData()
        https://bugs.webkit.org/show_bug.cgi?id=157132

        Reviewed by Darin Adler.

        I've noticed that some tests fail randomly in the GTK+ debug bot due to an assertion in HashMap when getting
        vertical data from the FontCache. I don't know exactly what's wrong, but looks like a problem with the
        FontVerticalDataCache hash traits implementation. Looking at the code, I've realized that we could simplify
        everything by reusing the FontDataCache hash and traits, since we are actually using the
        FontPlatformData::hash() in the end in both cases. Also, I don't see why we need to get the vertical data from
        the FontPlatformData while it's actually cached by the font cache. We could just use the FontCache directly
        passing only the FontPlatformData. These changes seem to fix the crashes and make the code a lot simpler.

        * platform/graphics/Font.cpp:
        (WebCore::Font::Font): Use FontCache::verticalData().
        * platform/graphics/FontCache.cpp:
        (WebCore::fontVerticalDataCache):
        (WebCore::FontCache::verticalData):
        (WebCore::FontCache::purgeInactiveFontData): Also remove the cached vertical data when removing a font.
        (WebCore::FontCache::invalidate): Clear also the vertical data.
        * platform/graphics/FontCache.h:
        * platform/graphics/FontPlatformData.h:
        * platform/graphics/freetype/FontPlatformDataFreeType.cpp:
        (WebCore::FontPlatformData::openTypeTable): Deleted.
        * platform/graphics/opentype/OpenTypeVerticalData.h: Remove the m_inFontCache member that is now unused.

2016-04-29  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove UsePointersEvenForNonNullableObjectArguments keyword
        https://bugs.webkit.org/show_bug.cgi?id=156844

        Reviewed by Darin Adler.

        No change of behavior.

        * bindings/scripts/CodeGenerator.pm:
        (ShouldPassWrapperByReference): Removed UsePointersEvenForNonNullableObjectArguments support.
        * bindings/scripts/IDLAttributes.txt: Removed UsePointersEvenForNonNullableObjectArguments.

2016-04-29  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        FetchResponse should return a ReadableStream even if disturbed
        https://bugs.webkit.org/show_bug.cgi?id=156911

        Reviewed by Darin Adler.

        Covered by rebased test.

        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::createReadableStreamSource): Asserting in case response is disturbed.
        * bindings/js/JSFetchResponseCustom.cpp:
        (WebCore::JSFetchResponse::body): Creating a locked empty readable stream if response is disturbed.
        * bindings/js/ReadableStreamController.cpp:
        (WebCore::createReadableStream): Constructing a readable stream even if source is null.
        (WebCore::getReadableStreamReader): Retrieving the reader from a readable stream. Stream must not be locked.
        * bindings/js/ReadableStreamController.h:

2016-04-29  Yoav Weiss  <yoav@yoav.ws>

        Move ResourceTiming behind a runtime flag
        https://bugs.webkit.org/show_bug.cgi?id=157133

        Reviewed by Alex Christensen.

        Move the ResourceTiming API from being behind a build time flag to be behind an
        off-by-default runtime flag, that can be turned on using internals.

        Tests: fast/dom/Window/window-properties-performance-resource-timing.html
               http/tests/performance/performance-resource-timing-entries.html

        * DerivedSources.make: Added idl files for PerformanceEntry, PerformanceEntryList and PerformanceResourceTiming.
        * WebCore.xcodeproj/project.pbxproj: Added the various Performance* files to the project.
        * bindings/generic/RuntimeEnabledFeatures.cpp: Added ResourceTiming as a runtime flag.
        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
        * bindings/generic/RuntimeEnabledFeatures.h: Added ResourceTiming as a runtime flag.
        (WebCore::RuntimeEnabledFeatures::setResourceTimingEnabled):
        (WebCore::RuntimeEnabledFeatures::resourceTimingEnabled):
        * bindings/js/JSPerformanceEntryCustom.cpp: Removed #if for ResourceTiming. Added build flag around UserTiming related h files.
        (WebCore::toJS): Deleted.
        * dom/EventNames.h: Renamed webkitresourcetimingbufferfull to resourcetimingbufferfull.
        * loader/DocumentThreadableLoader.cpp: Replace #if for ResourceTiming with runtime flag.
        (WebCore::DocumentThreadableLoader::loadRequest):
        * loader/ResourceLoadNotifier.cpp: Replace #if for ResourceTiming with runtime flag.
        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
        * loader/cache/CachedResourceLoader.cpp: Replace #if for ResourceTiming with runtime flag.
        (WebCore::CachedResourceLoader::revalidateResource):
        (WebCore::CachedResourceLoader::loadResource):
        (WebCore::CachedResourceLoader::storeResourceTimingInitiatorInformation):
        (WebCore::CachedResourceLoader::loadDone):
        * loader/cache/CachedResourceLoader.h: Remove #if for ResourceTiming.
        * page/Performance.cpp: Remove #if for ResourceTiming.
        (WebCore::Performance::Performance): Removed #if for ResourceTiming related initialization.
        (WebCore::Performance::webkitGetEntries): Renamed to getEntries.
        (WebCore::Performance::webkitGetEntriesByType): Renamed to getEntriesByType.
        (WebCore::Performance::webkitGetEntriesByName): Renamed to getEntriesByName.
        * page/Performance.h: Remove #if for ResourceTiming.
        * page/Performance.idl: Replace #if for ResourceTiming with runtime flag.
        * page/PerformanceEntry.cpp: Remove the PERFORMANCE_TIMELINE build flag.
        * page/PerformanceEntry.h: Remove the PERFORMANCE_TIMELINE build flag.
        * page/PerformanceEntry.idl: Replace the PERFORMANCE_TIMELINE build flag with runtime flag.
        * page/PerformanceEntryList.cpp: Remove the PERFORMANCE_TIMELINE build flag.
        * page/PerformanceEntryList.h: Remove the PERFORMANCE_TIMELINE build flag.
        * page/PerformanceEntryList.idl: Replace the PERFORMANCE_TIMELINE build flag with runtime flag.
        * page/PerformanceResourceTiming.cpp: Remove the RESOURCE_TIMING build flag.
        * page/PerformanceResourceTiming.h: Remove the RESOURCE_TIMING build flag.
        * page/PerformanceResourceTiming.idl: Replace the RESOURCE_TIMING build flag with runtime flag.
        * testing/Internals.cpp: Add a method that enables ResourceTiming.
        (WebCore::Internals::setResourceTimingSupport):
        * testing/Internals.h: Add a method that enables ResourceTiming.
        * testing/Internals.idl: Add a method that enables ResourceTiming.

2016-04-29  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Drop [UsePointersEvenForNonNullableObjectArguments] from MediaStream interfaces
        https://bugs.webkit.org/show_bug.cgi?id=156905

        Reviewed by Darin Adler.

        Removing UsePointersEvenForNonNullableObjectArguments from MediaStream, RTCPeerConnection and RTCRtpSender.
        Updating methods to take references and making some related refactoring.

        Test: fast/mediastream/MediaStream-add-remove-null-undefined-tracks.html
        Changes also covered by updated tests.

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::createOfferTask):
        * Modules/mediastream/MediaStream.cpp:
        (WebCore::MediaStream::create):
        (WebCore::MediaStream::addTrack):
        (WebCore::MediaStream::removeTrack):
        (WebCore::MediaStream::didAddTrack):
        (WebCore::MediaStream::didRemoveTrack):
        (WebCore::MediaStream::internalAddTrack):
        (WebCore::MediaStream::internalRemoveTrack):
        * Modules/mediastream/MediaStream.h:
        * Modules/mediastream/MediaStream.idl:
        * Modules/mediastream/RTCDataChannel.cpp:
        (WebCore::RTCDataChannel::send):
        * Modules/mediastream/RTCDataChannel.h:
        * Modules/mediastream/RTCDataChannel.idl:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::addTrack):
        (WebCore::RTCPeerConnection::removeTrack):
        (WebCore::RTCPeerConnection::queuedSetLocalDescription):
        (WebCore::RTCPeerConnection::queuedSetRemoteDescription):
        (WebCore::RTCPeerConnection::queuedAddIceCandidate):
        (WebCore::RTCPeerConnection::privateGetStats):
        (WebCore::RTCPeerConnection::queuedCreateOffer): Deleted.
        (WebCore::RTCPeerConnection::localDescription): Deleted.
        (WebCore::RTCPeerConnection::currentLocalDescription): Deleted.
        (WebCore::RTCPeerConnection::remoteDescription): Deleted.
        (WebCore::RTCPeerConnection::currentRemoteDescription): Deleted.
        (WebCore::RTCPeerConnection::signalingState): Deleted.
        (WebCore::RTCPeerConnection::createDataChannel): Deleted.
        (WebCore::RTCPeerConnection::close): Deleted.
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/mediastream/RTCRtpReceiver.cpp:
        (WebCore::RTCRtpReceiver::RTCRtpReceiver):
        * Modules/mediastream/RTCRtpReceiver.h:
        (WebCore::RTCRtpReceiver::create):
        * Modules/mediastream/RTCRtpSender.cpp:
        (WebCore::RTCRtpSender::RTCRtpSender):
        (WebCore::RTCRtpSender::replaceTrack):
        * Modules/mediastream/RTCRtpSender.h:
        (WebCore::RTCRtpSender::create):
        * Modules/mediastream/RTCRtpSender.idl:
        * Modules/mediastream/RTCRtpSenderReceiverBase.h:
        (WebCore::RTCRtpSenderReceiverBase::track):
        (WebCore::RTCRtpSenderReceiverBase::RTCRtpSenderReceiverBase):

2016-04-28  Daniel Bates  <dabates@apple.com>

        Remove extraneous space characters from parameter list for RenderListBox::paintItem()
        that were added in r200190 (https://bugs.webkit.org/show_bug.cgi?id=157117).

        * rendering/RenderListBox.h:

2016-04-28  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: [ATK] Expose subscript and superscript format style groups using ATK_ROLE_SUBSCRIPT and ATK_ROLE_SUPERSCRIPT
        https://bugs.webkit.org/show_bug.cgi?id=157158

        Reviewed by Chris Fleizach.

        r200214 caused the sup and sub elements to be exposed as ATK_ROLE_STATIC.
        While this exposure is much better than folding the text into the parent
        element, ATK has roles for subscript and superscript, so use them instead.

        The roles-exposed.html and roles-computedRoleString.html tests were updated
        to reflect the new behavior.

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::isSubscriptStyleGroup):
        (WebCore::AccessibilityObject::isSuperscriptStyleGroup):
        * accessibility/AccessibilityObject.h:
        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (atkRole):

2016-04-28  Zalan Bujtas  <zalan@apple.com>

        Content disappears on mouse over.
        https://bugs.webkit.org/show_bug.cgi?id=157073
        <rdar://problem/24389168>

        Reviewed by Simon Fraser.

        When a redundant inlinebox is found after constructing the line, we remove it from the tree.
        The remove operation marks the ancestor tree dirty (and this newly constructed line is supposed to be clean).
        This patch resets this dirty flag on the boxes all the way up to the rootlinebox.
        Previously we only cleared the rootinlinebox and we ended up with dirty inlineflowboxes.

        Test: fast/text/text-node-remains-dirty-after-calling-surroundContents.html

        * rendering/BidiRun.h:
        (WebCore::BidiRun::setBox):
        * rendering/RenderBlockFlow.h:
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::constructLine):
        (WebCore::RenderBlockFlow::removeLineBoxIfNeeded):
        (WebCore::RenderBlockFlow::computeBlockDirectionPositionsForLine):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::positionLineBox): Deleted.
        * rendering/RenderText.cpp:
        (WebCore::RenderText::setText):
        (WebCore::RenderText::positionLineBox): Deleted.

2016-04-28  John Wilander  <wilander@apple.com>

        Allow non-standard HTTP headers in WebSocket handshake
        https://bugs.webkit.org/show_bug.cgi?id=157157

        Reviewed by Brent Fulgham.

        No new tests since https://bugs.webkit.org/show_bug.cgi?id=157095
        tests that non-standard headers are allowed.

        * Modules/websockets/WebSocketHandshake.cpp:
        (WebCore::WebSocketHandshake::readHTTPHeaders):
            Changed from fail to allow for unrecognized headers.
            This was the behavior before https://bugs.webkit.org/show_bug.cgi?id=155602.
        * platform/network/HTTPHeaderNames.in:
            Removed whitelisted legacy headers since we now allow all non-standard headers.

2016-04-27  Brent Fulgham  <bfulgham@apple.com>

        Make sure we don't mishandle HTMLFrameOwnerElement lifecycle
        https://bugs.webkit.org/show_bug.cgi?id=157040

        Reviewed by Chris Dumez.

        Protect a couple of sites where event handling could result in the owning frame
        being destroyed during execution.

        Tested by fast/dom/HTMLAnchorElement/anchor-in-noscroll-iframe-crash.html.

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::didCommitLoad):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollRectToVisible):

2016-04-28  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Add CSS Grid Layout runtime flag
        https://bugs.webkit.org/show_bug.cgi?id=157134

        Reviewed by Simon Fraser.

        Add CSS Grid Layout runtime flag enabled by default.
        Disable parsing of CSS Grid Layout properties
        if the runtime flag is not enabled.
        Expose runtime flag through internals to verify that
        it's working as expected.

        Test: fast/css-grid-layout/grid-disable.html

        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::setCSSGridLayoutEnabled):
        (WebCore::RuntimeEnabledFeatures::isCSSGridLayoutEnabled):
        * css/CSSParser.cpp:
        (WebCore::CSSParserContext::CSSParserContext):
        (WebCore::operator==):
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseIntegerOrCustomIdentFromGridPosition):
        (WebCore::CSSParser::parseGridPosition):
        (WebCore::CSSParser::parseGridItemPositionShorthand):
        (WebCore::CSSParser::parseGridGapShorthand):
        (WebCore::CSSParser::parseGridTemplateColumns):
        (WebCore::CSSParser::parseGridTemplateRowsAndAreasAndColumns):
        (WebCore::CSSParser::parseGridTemplateShorthand):
        (WebCore::CSSParser::parseGridShorthand):
        (WebCore::CSSParser::parseGridAreaShorthand):
        (WebCore::CSSParser::parseSingleGridAreaLonghand):
        (WebCore::CSSParser::parseGridLineNames):
        (WebCore::CSSParser::parseGridTrackList):
        (WebCore::CSSParser::parseGridTrackRepeatFunction):
        (WebCore::CSSParser::parseGridTrackSize):
        (WebCore::CSSParser::parseGridBreadth):
        (WebCore::CSSParser::parseGridAutoFlow):
        (WebCore::CSSParser::parseGridTemplateAreasRow):
        (WebCore::CSSParser::parseGridTemplateAreas):
        (WebCore::CSSParser::iscSSGridLayoutEnabled):
        * css/CSSParser.h:
        * css/CSSParserMode.h:
        * dom/Document.cpp:
        (WebCore::Document::isCSSGridLayoutEnabled):
        * dom/Document.h:
        * testing/Internals.cpp:
        (WebCore::Internals::setCSSGridLayoutEnabled):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-04-28  Chris Fleizach  <cfleizach@apple.com>

        AX: superscript content exposed as plain text; VoiceOver does not speak or pause to make this understandable
        https://bugs.webkit.org/show_bug.cgi?id=157122
        <rdar://problem/21231487>

        Reviewed by Daniel Bates.

        Expose role types for subscript and superscript.

        Modified: accessibility/mac/subroles-for-formatted-groups.html

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::isStyleFormatGroup):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper subrole]):

2016-04-28  Brady Eidson  <beidson@apple.com>

        inspector/indexeddb/requestDatabaseNames.html is flaky on Mac.
        https://bugs.webkit.org/show_bug.cgi?id=157141

        Reviewed by Alex Christensen.

        Test: inspector/indexeddb/deleteDatabaseNamesWithSpace.html

        * platform/FileSystem.cpp:
        (WebCore::decodeFromFilename): Advance iterator after decoding.

2016-04-28  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/25986324> WebKit build broken with error: undeclared selector 'childViewControllerForWhitePointAdaptivityStyle'

        Fixed the build by removing use of API that no longer does anything.

        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (WebVideoFullscreenInterfaceAVKit::setupFullscreen): Revert to using a plain UIViewController.
        (createFullScreenVideoRootViewControllerClass): Deleted.
        (allocWebFullScreenVideoRootViewControllerInstance): Deleted.

2016-04-28  Brady Eidson  <beidson@apple.com>

        Modern IDB: Reimplement Web Inspector code that was tied to Legacy IDB.
        https://bugs.webkit.org/show_bug.cgi?id=154686

        Reviewed by Alex Christensen.

        No new tests (Inspector folks will have to write them if they're possible).

        * inspector/InspectorIndexedDBAgent.cpp: Reimplement missing functionality mostly with code that was 
          removed in http://trac.webkit.org/changeset/197131/trunk/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp

2016-04-28  Daniel Bates  <dabates@apple.com>

        Fix the Apple Internal OS X build

        * platform/graphics/mac/PDFDocumentImageMac.mm:
        (WebCore::PDFDocumentImage::drawPDFPage): Ignore deprecation warning for -[PDFPage drawWithBox:].

2016-04-28  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Drop [UsePointersEvenForNonNullableObjectArguments] from MediaSource interfaces
        https://bugs.webkit.org/show_bug.cgi?id=156904

        Reviewed by Darin Adler.

        MediaSource::addSourceBuffer will now throw a TypeError if a null parameter is passed.
        MediaSource::removeSourceBuffer will now throw a TypeError if a null parameter is passed.
        SourceBuffer::appendBuffer will now throw a TypeError if a null parameter is passed.

        Did some refactoring to use more references.

        Covered by updated test.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::endOfStream):
        (WebCore::MediaSource::addSourceBuffer):
        (WebCore::MediaSource::removeSourceBuffer):
        * Modules/mediasource/MediaSource.h:
        * Modules/mediasource/MediaSource.idl:
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::appendBuffer):
        * Modules/mediasource/SourceBuffer.h:
        * Modules/mediasource/SourceBuffer.idl:
        * Modules/mediasource/SourceBufferList.cpp:
        (WebCore::SourceBufferList::add):
        (WebCore::SourceBufferList::remove):
        * Modules/mediasource/SourceBufferList.h:

2016-04-28  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Drop [UsePointersEvenForNonNullableObjectArguments] from Node
        https://bugs.webkit.org/show_bug.cgi?id=156978

        Reviewed by Chris Dumez.

        No change of behavior.

        * dom/Node.idl: Marking some parameters nullable.

2016-04-27  Ada Chan  <adachan@apple.com>

        Set overflow: hidden on ::-webkit-media-controls in mediaControlsApple.css
        https://bugs.webkit.org/show_bug.cgi?id=157110

        Reviewed by Eric Carlson.

        Test: fast/regions/inline-block-inside-anonymous-overflow-with-covered-controls.html

        This matches what we do in mediaControlsiOS.css.

        * Modules/mediacontrols/mediaControlsApple.css:
        (::-webkit-media-controls):

2016-04-28  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Specify default values for optional parameters of type 'DOMString'
        https://bugs.webkit.org/show_bug.cgi?id=157116

        Reviewed by Darin Adler.

        Specify default values for optional parameters of type 'DOMString' so
        that this default value is used if the parameter is either omitted or
        undefined. For parameters of type DOMString and that are not nullable,
        the bindings generator now uses the null string as implicit default
        value (unless explicitely specified otherwise in the IDL). This
        simplifies the IDL a little and makes it a bit less confusing (it is
        a bit weird to see something like "optional DOMString param = null",
        considering the parameter is not nullable). I also think it makes
        more sense to use the null String() rather than Optional<String> in
        this case.

        No new tests, existing tests were rebaselined.

        * Modules/encryptedmedia/MediaKeys.idl:
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBIndex.h:
        * Modules/indexeddb/IDBIndex.idl:
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::openCursor): Deleted.
        * Modules/indexeddb/IDBObjectStore.h:
        * Modules/indexeddb/IDBObjectStore.idl:
        * Modules/speech/SpeechSynthesisUtterance.idl:
        * Modules/websockets/WebSocket.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck):
        (CanUseWTFOptionalForParameter): Deleted.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalString):
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAtomicString):
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringAndDefaultValue): Deleted.
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::jsTestTypedefsPrototypeFunctionSetShadow):
        * bindings/scripts/test/TestNamedConstructor.idl:
        * css/FontFaceSet.cpp:
        * css/FontFaceSet.h:
        * css/FontFaceSet.idl:
        * css/WebKitCSSMatrix.idl:
        * dom/Comment.idl:
        * dom/DOMImplementation.idl:
        * dom/DataTransfer.cpp:
        (WebCore::DataTransfer::clearData):
        (WebCore::DataTransfer::getData): Deleted.
        * dom/DataTransfer.h:
        * dom/Document.idl:
        * dom/Text.idl:
        * fileapi/FileReader.cpp:
        (WebCore::FileReader::readAsDataURL): Deleted.
        * fileapi/FileReader.h:
        * fileapi/FileReaderSync.h:
        * fileapi/FileReaderSync.idl:
        * html/HTMLAudioElement.idl:
        * html/HTMLInputElement.idl:

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::addTextTrack):
        Throw a TypeError if the 'kind' parameter is not a valid string in the
        TextTrackKind enum:
        https://html.spec.whatwg.org/multipage/embedded-content.html#htmlmediaelement

        We previously threw a SYNTAX_ERR instead of a TypeError in such case,
        which was not correct as per Web IDL specification.

        * html/HTMLMediaElement.h:
        * html/HTMLMediaElement.idl:
        * html/HTMLOptionElement.idl:
        * html/HTMLTextAreaElement.idl:
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::setShadow):
        * html/canvas/CanvasRenderingContext2D.h:
        * page/Performance.idl:

2016-04-28  Antonio Gomes  <tonikitoo@webkit.org>

        Factor out the "paint item" logic in RenderListBox into a helper
        https://bugs.webkit.org/show_bug.cgi?id=157117

        Reviewed by Daniel Bates.

        Patch factors out the duplicated painting logic in RenderListBox::paintObject()
        into a member function named paintItem.

        This is in preparation for bug 156590.
        No new tests, since there is no behavior change.

        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::paintItem):
        (WebCore::RenderListBox::paintObject):
        * rendering/RenderListBox.h:

2016-04-28  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: [ATK] We need to be smarter about flattening and the accessible text implementation
        https://bugs.webkit.org/show_bug.cgi?id=144639

        Reviewed by Chris Fleizach.

        Defer to WebCore Accessibility more regarding when to include anonymous blocks in the
        accessibility tree. Explicitly flatten menu items, headings, list items, and paragraphs
        in order to preserve the expected platform behavior for backwards compatibility. Also
        map anonymous table parts to DivRole rather than GroupRole for GTK and EFL because ATK
        has separate roles for generic text block elements and other generic containers.

        Tests: accessibility/gtk/nested-block-element-children.html
               accessibility/gtk/spans-paragraphs-and-divs-tree.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
        * accessibility/atk/AccessibilityObjectAtk.cpp:
        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):

2016-04-28  Frederic Wang  <fred.wang@free.fr>

        RenderMathMLOperator refactoring: introduce getBaseGlyph and remove parameter from getDisplayStyleLargeOperator
        https://bugs.webkit.org/show_bug.cgi?id=156910

        Reviewed by Alejandro G. Castro.

        No new tests, the behavior is not changed.

        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::italicCorrection): We do not need to pass m_textContent to
        getDisplayStyleLargeOperator.
        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): We use getBaseGlyph and do
        not pass m_textContent to getDisplayStyleLargeOperator or findStretchyData.
        (WebCore::RenderMathMLOperator::getBaseGlyph): Introduce a helper function to retrieve the
        base glyph and do some validity checks.
        (WebCore::RenderMathMLOperator::getDisplayStyleLargeOperator): We remove the character
        parameter as it is always m_textContent.
        We use getBaseGlyph and replace primaryFont with baseGlyph.font.
        (WebCore::RenderMathMLOperator::findStretchyData): Ditto.
        (WebCore::RenderMathMLOperator::updateStyle): We do not pass m_textContent to
        getDisplayStyleLargeOperator or findStretchyData.
        * rendering/mathml/RenderMathMLOperator.h: Declare getBaseGlyph and remove the parameter
        from getDisplayStyleLargeOperator and findStretchyData.

2016-04-28  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r200185.
        https://bugs.webkit.org/show_bug.cgi?id=157131

        Bad temporary file added unintentionally (Requested by fredw
        on #webkit).

        Reverted changeset:

        "RenderMathMLOperator refactoring: introduce getBaseGlyph and
        remove parameter from getDisplayStyleLargeOperator"
        https://bugs.webkit.org/show_bug.cgi?id=156910
        http://trac.webkit.org/changeset/200185

2016-04-28  Frederic Wang  <fred.wang@free.fr>

        RenderMathMLOperator refactoring: introduce getBaseGlyph and remove parameter from getDisplayStyleLargeOperator
        https://bugs.webkit.org/show_bug.cgi?id=156910

        Reviewed by Alejandro G. Castro.

        No new tests, the behavior is not changed.

        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::italicCorrection): We do not need to pass m_textContent
        to getDisplayStyleLargeOperator.
        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): We use getBaseGlyph and do
        not pass m_textContent to getDisplayStyleLargeOperator or findStretchyData.
        (WebCore::RenderMathMLOperator::getBaseGlyph): Introduce a helper function to retrieve the
        base glyph and do some validity checks.
        (WebCore::RenderMathMLOperator::getDisplayStyleLargeOperator): We remove the character
        parameter as it is always m_textContent.
        We use getBaseGlyph and replace primaryFont with baseGlyph.font.
        (WebCore::RenderMathMLOperator::findStretchyData): Ditto.
        (WebCore::RenderMathMLOperator::updateStyle): We do not pass m_textContent to
        getDisplayStyleLargeOperator or findStretchyData.
        * rendering/mathml/RenderMathMLOperator.h: Declare getBaseGlyph and remove the parameter
        from getDisplayStyleLargeOperator and findStretchyData.

2016-04-28  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r199659): Web Process crash when RenderTheme::adjustMenuListStyle is called with a null element
        https://bugs.webkit.org/show_bug.cgi?id=157127

        Reviewed by Sergio Villar Senin.

        This happens for example with tests fast/css/appearance-with-pseudo-elements-in-quirks-mode.html and
        fast/css/appearance-with-pseudo-elements.html.

        * rendering/RenderThemeGtk.cpp:
        (WebCore::RenderThemeGtk::adjustMenuListStyle): Do not change the style color if the given element is nullptr.

2016-04-28  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Store auto-repeat information in style
        https://bugs.webkit.org/show_bug.cgi?id=157097

        Reviewed by Darin Adler.

        This is the second step to implement auto-repeat. This patch provides the necessary
        machinery to store the auto-repeat data extracted by the parser in the RenderStyle class. We
        are not doing anything with that information yet, it will be used later to compute the
        number of auto-repeat tracks in a follow up patch.

        No new tests required as there is no change in behavior yet (we're just storing the info we
        already get from the parser).

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::valueForGridTrackList): Check also that the auto-repeat list of tracks is empty.
        * css/StyleBuilderConverter.h:
        (WebCore::createGridLineNamesList): Refactored from createGridTrackList.
        (WebCore::StyleBuilderConverter::createGridTrackList): Extract auto-repeat data from the
        parser. Also gathered all the out arguments in a single new struct called TracksData.
        * css/StyleBuilderCustom.h: Added new macro SET_TRACKS_DATA which properly sets the info
        from TracksData struct into style.
        (WebCore::StyleBuilderCustom::applyValueWebkitGridTemplateColumns): Store auto-repeat data
        in RenderStyle.
        (WebCore::StyleBuilderCustom::applyValueWebkitGridTemplateRows): Ditto.
        * rendering/style/RenderStyle.h: Add methods and attributes for auto-repeat data.
        * rendering/style/RenderStyleConstants.h: New AutoRepeatType enumerated type.
        * rendering/style/StyleGridData.cpp:
        (WebCore::StyleGridData::StyleGridData): Add auto-repeat data.
        * rendering/style/StyleGridData.h:
        (WebCore::StyleGridData::operator==): Check also auto-repeat data.

2016-04-28  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Fix alignment with content distribution
        https://bugs.webkit.org/show_bug.cgi?id=156623

        Reviewed by Sergio Villar Senin.

        We were only subtracting the distribution offset for items spanning
        several tracks, but not for items in a single cell.
        We should actually subtract the offset in that situation too,
        the same that we do for the grid gaps.

        Test: fast/css-grid-layout/grid-content-alignment-and-self-alignment-spanning.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::columnAxisOffsetForChild): Subtract distribution
        offset like we do for gaps.
        (WebCore::RenderGrid::rowAxisOffsetForChild): Ditto.

2016-04-27  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Overlay scrollbars with steppers enabled render incorrectly
        https://bugs.webkit.org/show_bug.cgi?id=156988

        Reviewed by Michael Catanzaro.

        Fix rendering of scrollbars when using GTK+ themes having stepper buttons.

        * platform/gtk/RenderThemeGadget.cpp:
        (WebCore::RenderThemeBoxGadget::RenderThemeBoxGadget): Receive the box orientation as constructor parameter.
        (WebCore::RenderThemeBoxGadget::preferredSize): Fix the preferred size calculation taking into account the box orientation.
        (WebCore::RenderThemeScrollbarGadget::renderStepper): New method to render scrollbar steppers.
        * platform/gtk/RenderThemeGadget.h:
        (WebCore::RenderThemeGadget::context): Make this public instead of protected.
        * platform/gtk/ScrollAnimatorGtk.cpp:
        (WebCore::ScrollAnimatorGtk::updateOverlayScrollbarsOpacity): Invalidate the whole scrollbars instead of just
        the thumb when opacity changes, because themes can actually render the trough or even stepper buttons when in
        indicator mode too.
        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::hasButtons): Properly implement this method instead of returning true unconditionally.
        (WebCore::contentsGadgetForLayout): Pass orientation to RenderThemeBoxGadget constructor.
        (WebCore::ScrollbarThemeGtk::trackRect): Fix the calculation of the track rect taking stepper buttons into account.
        (WebCore::ScrollbarThemeGtk::backButtonRect): Fix the calculation of the stepper button rectangle.
        (WebCore::ScrollbarThemeGtk::forwardButtonRect): Ditto.
        (WebCore::ScrollbarThemeGtk::paint): Use RenderThemeScrollbarGadget::renderStepper() to render the stepper
        buttons, and fix the calculation of the steppers button rectangle.
        (WebCore::ScrollbarThemeGtk::handleMousePressEvent): Handle clicks on stepper buttons.
        (WebCore::ScrollbarThemeGtk::scrollbarThickness): Fix the calculation of the scrollbar thickness.
        (WebCore::ScrollbarThemeGtk::minimumThumbLength): Pass orientation to RenderThemeBoxGadget constructor.
        * platform/gtk/ScrollbarThemeGtk.h:
        * rendering/RenderThemeGtk.cpp:
        (WebCore::menuListColor): Ditto.
        (WebCore::RenderThemeGtk::popupInternalPaddingBox): Ditto.
        (WebCore::RenderThemeGtk::paintMenuList): Ditto.

2016-04-27  Simon Fraser  <simon.fraser@apple.com>

        SVG SMIL animations run at less than 60fps
        https://bugs.webkit.org/show_bug.cgi?id=157119
        rdar://problem/25971304

        Reviewed by Tim Horton.
        
        If you re-fetch current time while doing animation computations you're gonna have
        a bad time.
        
        More specifically, SMILTimeContainer::startTimer() re-fetched elapsedTime() when
        computing the delay for the next timer fire, then clamped to 16.667ms, so the timer
        would actually be scheduled at intervals greater than desired, causing a ~54fps framerate.
        
        Fix by using the elapsedTime fetched at the start of animation processing.

        Tested by iOS content-animation performance tests.

        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::SVGSVGElement): Just cleanup.
        * svg/animation/SMILTimeContainer.cpp:
        (WebCore::SMILTimeContainer::notifyIntervalsChanged):
        (WebCore::SMILTimeContainer::resume):
        (WebCore::SMILTimeContainer::startTimer):
        (WebCore::SMILTimeContainer::updateAnimations):
        * svg/animation/SMILTimeContainer.h:

2016-04-27  Brady Eidson  <beidson@apple.com>

        Build fix followup to r200163
        
        Unreviewed.

        * platform/efl/FileSystemEfl.cpp:
        (WebCore::stringFromFileSystemRepresentation): At least stub this out for now until EFL folks can do better.

2016-04-27  Saam barati  <sbarati@apple.com>

        Move the implementation of Settings::globalConstRedeclarationShouldThrow into the cpp file
        https://bugs.webkit.org/show_bug.cgi?id=157109

        Rubber-stamped by Geoffrey Garen.

        * page/Settings.cpp:
        (WebCore::Settings::networkInterfaceName):
        (WebCore::Settings::globalConstRedeclarationShouldThrow):
        * page/Settings.h:
        (WebCore::Settings::shouldUseHighResolutionTimers):
        (WebCore::Settings::backgroundShouldExtendBeyondPage):
        (WebCore::Settings::globalConstRedeclarationShouldThrow): Deleted.

2016-04-27  Dean Jackson  <dino@apple.com>

        RTL non-native <select> buttons should have arrows on the left
        https://bugs.webkit.org/show_bug.cgi?id=157112
        <rdar://problem/25894441>

        Reviewed by Simon Fraser.

        The <select> elements that are completely rendered by WebCore
        (i.e. not the native controls) always assumed that they
        were left-to-right.

        This change allows the button to handle both directions,
        swapping the side the little arrows are rendered on, as
        well as the padding of the text label.

        Test: fast/forms/select-non-native-rendering-direction.html

        * rendering/RenderMenuList.cpp:
        (RenderMenuList::clientPaddingLeft): This must take into account
        the direction of the element.
        (RenderMenuList::clientPaddingRight): Ditto.
        * rendering/RenderThemeMac.mm: Change the left and right constants
        to use the terms before and after.
        (WebCore::RenderThemeMac::paintMenuListButtonDecorations): The left
        and right positions must take the direction into account, which
        means different calculations.
        (WebCore::RenderThemeMac::popupInternalPaddingBox): Similarly for
        the padding that is used to position the text label.

2016-04-27  Simon Fraser  <simon.fraser@apple.com>

        CSS and SVG animations should run at 60fps
        https://bugs.webkit.org/show_bug.cgi?id=157113
        rdar://problem/24337280
        rdar://problem/24337328

        Reviewed by Dean Jackson.

        For both CSS and SVG animations we used a 0.025s frame interval, which translates to
        40fps. That caused these animations to look extra janky compared with accelerated
        animations.

        So use a 16.667ms frame interval for both.

        Tested by content-animation benchmark tests.

        * page/animation/AnimationController.cpp:
        * svg/animation/SMILTime.h:
        * svg/animation/SMILTimeContainer.cpp:
        (WebCore::SMILTimeContainer::updateAnimations):
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::calculateNextProgressTime):

2016-04-27  Brady Eidson  <beidson@apple.com>

        Modern IDB: Implement native IDBFactory.getAllDatabaseNames for WebInspector.
        https://bugs.webkit.org/show_bug.cgi?id=157072

        Reviewed by Alex Christensen.

        No new tests (Covered by changes to existing test).

        Implement a new "getAllDatabaseNames" call on IDBFactory.
        
        It is not exposed to the DOM, and is meant solely for internal WebInspector use.

        * Modules/indexeddb/DOMWindowIndexedDatabase.h: Export some stuff to WebCoreTestSupport

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::createObjectStore):

        * Modules/indexeddb/IDBDatabaseIdentifier.cpp:
        (WebCore::IDBDatabaseIdentifier::databaseDirectoryRelativeToRoot):
        * Modules/indexeddb/IDBDatabaseIdentifier.h:

        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::getAllDatabaseNames):
        * Modules/indexeddb/IDBFactory.h:

        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::getAllDatabaseNames):
        * Modules/indexeddb/client/IDBConnectionProxy.h:

        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::getAllDatabaseNames):
        (WebCore::IDBClient::IDBConnectionToServer::didGetAllDatabaseNames):
        * Modules/indexeddb/client/IDBConnectionToServer.h:
        * Modules/indexeddb/client/IDBConnectionToServerDelegate.h:

        * Modules/indexeddb/server/IDBConnectionToClient.cpp:
        (WebCore::IDBServer::IDBConnectionToClient::didGetAllDatabaseNames):
        * Modules/indexeddb/server/IDBConnectionToClient.h:
        * Modules/indexeddb/server/IDBConnectionToClientDelegate.h:

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::getAllDatabaseNames):
        (WebCore::IDBServer::IDBServer::performGetAllDatabaseNames): Do the actual work of getting 
          the appropriate directory listing and converting the paths to database names.
        (WebCore::IDBServer::IDBServer::didGetAllDatabaseNames):
        * Modules/indexeddb/server/IDBServer.h:

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::databaseNameFromEncodedFilename): Helper for IDBServer.
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::getAllDatabaseNames):
        (WebCore::InProcessIDBServer::didGetAllDatabaseNames):
        * Modules/indexeddb/shared/InProcessIDBServer.h:

        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore::InspectorIndexedDBAgent::requestDatabaseNames): Use the new IDBFactory API to
          asynchronously get the list of database names.

        * platform/CrossThreadCopier.cpp:
        (WebCore::SecurityOriginData>::copy):
        (WebCore::Vector<String>>::copy):
        * platform/CrossThreadCopier.h:

        * platform/FileSystem.cpp:
        (WebCore::decodeFromFilename): Perform the reverse of encodeForFilename.
        * platform/FileSystem.h:

        * platform/cf/FileSystemCF.cpp:
        (WebCore::stringFromFileSystemRepresentation):

        * platform/glib/FileSystemGlib.cpp:
        (WebCore::stringFromFileSystemRepresentation):
        
        * platform/posix/FileSystemPOSIX.cpp:
        (WebCore::lastComponentOfPathIgnoringTrailingSlash): Utility for peeling off the last component
          of a multi-component path.
        (WebCore::listDirectory): This was broken when returning filenames with UTF in them. Fix it.
        
        * platform/mac/WebCoreNSURLExtras.mm: Move the static hex digit utility functions to WTF.
        (WebCore::userVisibleString):
        (WebCore::isUserVisibleURL):
        (WebCore::isHexDigit): Deleted.
        (WebCore::hexDigit): Deleted.
        (WebCore::hexDigitValue): Deleted.
    

2016-04-27  Enrica Casucci  <enrica@apple.com>

        Refactor findExplodedTextNodeAtPoint to move core functionality in RenderBlockFlow.
        https://bugs.webkit.org/show_bug.cgi?id=157076

        Reviewed by Simon Fraser.

        * bindings/objc/DOMUIKitExtensions.mm:
        (-[DOMNode findExplodedTextNodeAtPoint:]):
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::findClosestTextAtAbsolutePoint):
        * rendering/RenderBlockFlow.h:
        * rendering/RenderText.h:

2016-04-27  Simon Fraser  <simon.fraser@apple.com>

        [iOS WK2] When determining tile size, check whether ancestor UIScrollViews are actually scrollable
        https://bugs.webkit.org/show_bug.cgi?id=157107
        rdar://problem/25943577

        Reviewed by Tim Horton.

        Rename "enclosedInScrollView" to "enclosedInScrollableAncestorView" everywhere.

        * page/FrameView.cpp:
        (WebCore::FrameView::adjustTiledBackingScrollability):
        * page/Page.h:
        (WebCore::Page::enclosedInScrollableAncestorView):
        (WebCore::Page::setEnclosedInScrollableAncestorView):
        (WebCore::Page::enclosedInScrollView): Deleted.
        (WebCore::Page::setEnclosedInScrollView): Deleted.

2016-04-27  Michael Catanzaro  <mcatanzaro@igalia.com>

        [SOUP] Implement PlatformCookieJar::addCookie
        https://bugs.webkit.org/show_bug.cgi?id=156295

        Reviewed by Carlos Garcia Campos.

        * platform/network/soup/CookieJarSoup.cpp:
        (WebCore::msToSoupDate):
        (WebCore::toSoupCookie):
        (WebCore::addCookie):

2016-04-27  Chris Dumez  <cdumez@apple.com>

        Let the bindings generator use WTF::Optional for optional parameters using [Clamp]
        https://bugs.webkit.org/show_bug.cgi?id=157077

        Reviewed by Darin Adler.

        Let the bindings generator use WTF::Optional for optional parameters using [Clamp],
        if they do not have a default value.

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::close):
        * Modules/websockets/WebSocket.h:
        * Modules/websockets/WebSocket.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (CanUseWTFOptionalForParameter): Deleted.

2016-04-26  Ada Chan  <adachan@apple.com>

        Set WebVideoFullscreenInterfaceMac up as a client of WebPlaybackSessionInterfaceMac to listen for playback state changes
        https://bugs.webkit.org/show_bug.cgi?id=157008

        Reviewed by Jer Noble.

        For WebVideoFullscreenInterfaceMac to be notified when the playback rate changes in
        WebPlaybackSessionInterfaceMac, add a new WebPlaybackSessionInterfaceMacClient base
        class that WebVideoFullscreenInterfaceMac implements, similar to the WebPlaybackSessionInterfaceAVKitClient
        on iOS. WebVideoFullscreenInterfaceMac sets itself as a client of WebPlaybackSessionInterfaceMac
        so WebPlaybackSessionInterfaceMac can notify WebVideoFullscreenInterfaceMac whenever the
        playback rate changes.

        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
        (WebVideoFullscreenModelVideoElement::setWebVideoFullscreenInterface):
        We should not change the WebPlaybackSessionModelMediaElement's interface here since WebPlaybackSessionManager
        has already set that up when creating the context for this media element.
        (WebVideoFullscreenModelVideoElement::setVideoElement):
        We should not change the WebPlaybackSessionModelMediaElement's media element here because
        this will be called with NULL when the fullscreen context is cleaned up, but the
        WebPlaybackSessionModelMediaElement might still need to stay around. We'll make sure the
        WebPlaybackSessionModelMediaElement's media element is set when setting up the fullscreen
        context in WebVideoFullscreenManager::enterVideoFullscreenForVideoElement().

        * platform/mac/WebPlaybackSessionInterfaceMac.h:
        (WebCore::WebPlaybackSessionInterfaceMacClient::~WebPlaybackSessionInterfaceMacClient):

        * platform/mac/WebPlaybackSessionInterfaceMac.mm:
        (WebCore::WebPlaybackSessionInterfaceMac::setClient):
        Set the client. Notify the client about the current playback state.
        (WebCore::WebPlaybackSessionInterfaceMac::setRate):
        If a client is set, let that client know about the change in playback rate.

        * platform/mac/WebVideoFullscreenInterfaceMac.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::WebVideoFullscreenInterfaceMac):
        Set itself as a client of WebPlaybackSessionInterfaceMac.
        (WebCore::WebVideoFullscreenInterfaceMac::~WebVideoFullscreenInterfaceMac):
        Make sure WebPlaybackSessionInterfaceMac won't hold onto a stale pointer to itself.
        (WebCore::WebVideoFullscreenInterfaceMac::setRate):
        We don't have to update the WebVideoFullscreenInterfaceMac's rate here anymore. The change
        in playback rate in WebPlaybackSessionInterfaceMac should trigger
        WebVideoFullscreenInterfaceMac::rateChanged() to be called.
        (WebCore::WebVideoFullscreenInterfaceMac::rateChanged):
        Pass in both the isPlaying state and the playback rate to WebVideoFullscreenInterfaceMacObjC.

2016-04-27  Brady Eidson  <beidson@apple.com>

        Modernize platform/CrossThreadCopier.h style.
        https://bugs.webkit.org/show_bug.cgi?id=157106

        Reviewed by Alex Christensen.

        No new tests (No change in behavior).

        * platform/CrossThreadCopier.h:
        (WebCore::CrossThreadCopierPassThrough::copy):
        (WebCore::AllowCrossThreadAccessWrapper::AllowCrossThreadAccessWrapper):
        (WebCore::AllowCrossThreadAccessWrapper::value):
        (WebCore::AllowCrossThreadAccess):
        (WebCore::AllowAccessLaterWrapper::AllowAccessLaterWrapper):
        (WebCore::AllowAccessLaterWrapper::value):
        (WebCore::AllowAccessLater):

2016-04-27  Filip Pizlo  <fpizlo@apple.com>

        Speculative fix for null pointer dereference.
        rdar://problem/25964854

        Reviewed by Michael Saboff.

        * platform/mac/Language.mm:
        (WebCore::isValidICUCountryCode):

2016-04-27  Myles C. Maxfield  <mmaxfield@apple.com>

        Clean up Font::removeFromSystemFallbackCache()
        https://bugs.webkit.org/show_bug.cgi?id=157093

        Reviewed by Darin Adler.

        Fonts have a bit which represents whether or not the system fallback cache references them.
        This bit gets set to 1 when they are inserted into the system fallback cache, but was not
        being reset back to 0 when it was removed.

        This is benign, since the old codepath has no effect. However, we can speed up the function
        by properly updating this bit.

        No new tests because there is no behavior change.

        * platform/graphics/Font.cpp:
        (WebCore::Font::removeFromSystemFallbackCache):

2016-04-27  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: RTCIceCandidate don't need a custom bindings
        https://bugs.webkit.org/show_bug.cgi?id=157074

        Reviewed by Eric Carlson.

        Removed custom constructor and replaced custom attribute getters with
        nullable types. Removed custom binding from builds.

        Testing: Updated existing test.

        * CMakeLists.txt:
        * Modules/mediastream/RTCIceCandidate.idl:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSRTCIceCandidateCustom.cpp: Removed.
        (WebCore::constructJSRTCIceCandidate): Deleted.
        (WebCore::JSRTCIceCandidate::sdpMid): Deleted.
        (WebCore::JSRTCIceCandidate::sdpMLineIndex): Deleted.

2016-04-27  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r199383.

        Seems to have caused a 0.5% PLT regression on iOS

        Reverted changeset:

        "[iOS] do not exit AirPlay when the screen locks"
        https://bugs.webkit.org/show_bug.cgi?id=156502
        http://trac.webkit.org/changeset/199383

2016-04-27  Myles C. Maxfield  <mmaxfield@apple.com>

        Remove unnecessary HashMap from Font
        https://bugs.webkit.org/show_bug.cgi?id=157090

        Reviewed by Darin Adler.

        There were only ever a maximum of 2 keys in the hashmap.

        No new tests because there is no behavior change.

        * platform/graphics/Font.h:
        * platform/graphics/mac/SimpleFontDataCoreText.cpp:
        (WebCore::Font::getCFStringAttributes):

2016-04-27  Myles C. Maxfield  <mmaxfield@apple.com>

        Rename DerivedFontData to DerivedFonts
        https://bugs.webkit.org/show_bug.cgi?id=157092

        Reviewed by Darin Adler.

        This is a follow-up to r178510 where we named SimpleFontData to Font.
        This patch didn't include renaming DerivedFontData to DerivedFonts.

        No new tests because there is no behavior change.

        * platform/graphics/Font.cpp:
        (WebCore::Font::verticalRightOrientationFont):
        (WebCore::Font::uprightOrientationFont):
        (WebCore::Font::smallCapsFont):
        (WebCore::Font::noSynthesizableFeaturesFont):
        (WebCore::Font::emphasisMarkFont):
        (WebCore::Font::brokenIdeographFont):
        (WebCore::Font::nonSyntheticItalicFont):
        (WebCore::Font::DerivedFonts::~DerivedFonts):
        (WebCore::Font::DerivedFontData::~DerivedFontData): Deleted.
        * platform/graphics/Font.h:
        (WebCore::Font::DerivedFonts::DerivedFonts):
        (WebCore::Font::DerivedFontData::DerivedFontData): Deleted.

2016-04-27  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Clean up support for [Clamp] IDL extended attribute
        https://bugs.webkit.org/show_bug.cgi?id=157060

        Reviewed by Darin Adler.

        Clean up support for [Clamp] IDL extended attribute:
        1.  Move [Clamp] handling in the bindings generator from the parameter
            conversion to JSValueToNative(). This has the benefit of
            simplifying the parameter conversion code, adding support for [Clamp]
            on non-readonly attributes, and improving consistency by handling
            this in the same place as [EnforceRange].
        2.  Add 'Clamp' to the IntegerConversionConfiguration enumeration in
            JSDOMbindings.h and add support for it to the various toInt*() /
            toUInt*() functions, similary to [EnforceRange]. Call these from
            the generated bindings.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::toSmallerInt):
        (WebCore::toSmallerUInt):
        (WebCore::toInt32EnforceRange):
        (WebCore::toInt32Clamp):
        (WebCore::toUInt32Clamp):
        (WebCore::toUInt32EnforceRange):
        (WebCore::toInt64):
        (WebCore::toUInt64):
        (WebCore::toUInt8): Deleted.
        (WebCore::toUInt16): Deleted.
        * bindings/js/JSDOMBinding.h:
        (WebCore::toInt32):
        (WebCore::toUInt32):
        * bindings/scripts/CodeGeneratorJS.pm:
        (JSValueToNative):
        (GenerateParametersCheck): Deleted.
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_set_property):
        (webkit_dom_test_obj_get_property):
        (webkit_dom_test_obj_class_init):
        (webkit_dom_test_obj_class_method_with_enforce_range):
        (webkit_dom_test_obj_get_clamped_short_attr):
        (webkit_dom_test_obj_set_clamped_short_attr):
        (webkit_dom_test_obj_get_enforce_range_short_attr):
        (webkit_dom_test_obj_set_enforce_range_short_attr):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjClampedShortAttr):
        (WebCore::jsTestObjEnforceRangeShortAttr):
        (WebCore::setJSTestObjClampedShortAttr):
        (WebCore::setJSTestObjEnforceRangeShortAttr):
        (WebCore::jsTestObjPrototypeFunctionClassMethodWithClamp):
        (WebCore::jsTestObjPrototypeFunctionClassMethodWithEnforceRange):
        (WebCore::jsTestObjConstructorFunctionClassMethodWithOptional): Deleted.
        (WebCore::jsTestObjConstructorFunctionClassMethod2): Deleted.
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::jsTestTypedefsPrototypeFunctionFuncWithClamp):
        (WebCore::jsTestTypedefsPrototypeFunctionImmutablePointFunction): Deleted.
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj clampedShortAttr]):
        (-[DOMTestObj setClampedShortAttr:]):
        (-[DOMTestObj enforceRangeShortAttr]):
        (-[DOMTestObj setEnforceRangeShortAttr:]):
        (-[DOMTestObj classMethodWithEnforceRange:objArgsLong:]):
        * bindings/scripts/test/TestObj.idl:

2016-04-27  Daniel Bates  <dabates@apple.com>

        CSP: Add app-specific workaround for Ecobee and Quora
        https://bugs.webkit.org/show_bug.cgi?id=157005
        <rdar://problem/25560776>

        Reviewed by Brent Fulgham.

        * page/Settings.in: Add setting allowContentSecurityPolicySourceStarToMatchAnyProtocol (disabled by default).
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::allowContentSecurityPolicySourceStarToMatchAnyProtocol): Added.
        * page/csp/ContentSecurityPolicy.h:
        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::isProtocolAllowedByStar): Modified to return true
        if ContentSecurityPolicy::allowContentSecurityPolicySourceStarToMatchAnyProtocol() evaluates to true.
        * platform/RuntimeApplicationChecks.h:
        * platform/RuntimeApplicationChecks.mm:
        (WebCore::IOSApplication::isEcobee): Added.
        (WebCore::IOSApplication::isQuora): Added.

2016-04-27  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r200094): [FreeType] Vertical text is broken after r200094
        https://bugs.webkit.org/show_bug.cgi?id=157066

        Reviewed by Martin Robinson.

        The problem is that Freetype implementation needs to call buildScaledFont() when orientation, SyntheticOblique
        or size change, but the new static clone methods don't do that. I think it's the time to stop using our own
        header for FontPlatformData for the FreeType implementation to make cross-platform changes easier and prevent
        regressions like this in the future.

        * CMakeLists.txt: Compile FontPlatformData.cpp for all ports.
        * PlatformMac.cmake: Remove FontPlatformData.cpp.
        * PlatformWin.cmake: Ditto.
        * platform/graphics/FontPlatformData.cpp: We need our own clone methods in the FreeType backend.
        * platform/graphics/FontPlatformData.h: Move FreeType specific methods and members from the old header file.
        * platform/graphics/cairo/CairoUtilities.cpp:
        (WebCore::CairoFtFaceLocker::CairoFtFaceLocker): Move CairoFtFaceLocker implementation here from
        HarfBuzzFaceCairo.cpp to make it available to other classes, and make it handle the case of
        cairo_ft_scaled_font_lock_face() returning nullptr.
        (WebCore::CairoFtFaceLocker::~CairoFtFaceLocker):
        * platform/graphics/cairo/CairoUtilities.h:
        (WebCore::CairoFtFaceLocker::ftFace):
        * platform/graphics/freetype/FontCacheFreeType.cpp:
        (WebCore::findBestFontGivenFallbacks): Move the fallbacks implementation to FontPlatformData where it belongs
        and here simply use FontPlatformData::fallbacks().
        * platform/graphics/freetype/FontPlatformData.h: Removed.
        * platform/graphics/freetype/FontPlatformDataFreeType.cpp:
        (WebCore::FontPlatformData::FontPlatformData): Remove members already initialized in the header.
        (WebCore::FontPlatformData::operator=): Add missing members to be copied.
        (WebCore::FontPlatformData::~FontPlatformData): Do not free m_scaledFont manually since we are now using a smart pointer.
        (WebCore::FontPlatformData::cloneWithOrientation): Call buildScaledFont() like setOrientation() did.
        (WebCore::FontPlatformData::cloneWithSyntheticOblique): Call buildScaledFont() like setSyntheticOblique() did.
        (WebCore::FontPlatformData::cloneWithSize): Call buildScaledFont().
        (WebCore::FontPlatformData::fallbacks): Lazily initialize fallbacks if needed and return it.
        (WebCore::FontPlatformData::platformIsEqual): Only compare FreeType specific members.
        (WebCore::FontPlatformData::buildScaledFont): Use RefPtr for m_scaledFont.
        (WebCore::FontPlatformData::hasCompatibleCharmap): Use CairoFtFaceLocker.
        (WebCore::FontPlatformData::openTypeTable): Update to return RefPtr instead of PassRefPtr and use CairoFtFaceLocker.
        (WebCore::FontPlatformData::operator==): Deleted.
        (WebCore::FontPlatformData::setOrientation): Deleted.
        (WebCore::FontPlatformData::setSyntheticOblique): Deleted.
        * platform/graphics/freetype/GlyphPageTreeNodeFreeType.cpp:
        (WebCore::GlyphPage::fill): Use CairoFtFaceLocker.
        * platform/graphics/freetype/SimpleFontDataFreeType.cpp:
        (WebCore::Font::platformInit): Ditto.
        (WebCore::Font::canRenderCombiningCharacterSequence): Ditto.
        * platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp:
        (WebCore::harfBuzzCairoGetTable): Ditto.
        (WebCore::CairoFtFaceLocker::CairoFtFaceLocker): Deleted.
        (WebCore::CairoFtFaceLocker::lock): Deleted.
        (WebCore::CairoFtFaceLocker::~CairoFtFaceLocker): Deleted.

2016-04-27  Hunseop Jeong  <hs85.jeong@samsung.com>

        [EFL][GTK] Volume slider only changes volume when thumb is released, not while dragging
        https://bugs.webkit.org/show_bug.cgi?id=156970

        Reviewed by Xabier Rodriguez-Calvar.

        Volume slider have to change the volume while dragging the thumb. 

        Test: media/video-volume-slider-drag.html 

        * Modules/mediacontrols/mediaControlsBase.js:
        (Controller.prototype.createControls): Use the 'input' event instead of the 'change' to
        check the changed value correctly.
        (Controller.prototype.handleMaxButtonClicked):
        (Controller.prototype.handleVolumeSliderInput): Renamed from handleVolumeSliderChange.
        (Controller.prototype.handleVolumeSliderChange): Deleted. 

2016-04-27  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Remove FetchResponse::redirect overload
        https://bugs.webkit.org/show_bug.cgi?id=157034

        Reviewed by Darin Adler.

        No change of behavior.

        * Modules/fetch/FetchResponse.h:

2016-04-27  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] Unreviewed speculative buildfix after r200116, just for fun.

        * PlatformMac.cmake:

2016-04-27  Saam barati  <sbarati@apple.com>

        JSC should have an option to allow global const redeclarations
        https://bugs.webkit.org/show_bug.cgi?id=157006

        Reviewed by Geoffrey Garen.

        This patch makes the JS VM not throw global const redeclaration
        errors when the application is iBooks.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::commonVM):
        * page/Settings.h:
        (WebCore::Settings::shouldUseHighResolutionTimers):
        (WebCore::Settings::globalConstRedeclarationShouldThrow):
        (WebCore::Settings::backgroundShouldExtendBeyondPage):

2016-04-26  John Wilander  <wilander@apple.com>

        Support legacy HTTP headers in WebSockets
        https://bugs.webkit.org/show_bug.cgi?id=157057

        Reviewed by Brent Fulgham.

        No new tests since these headers are not officially supported and should not be used.

        * platform/network/HTTPHeaderNames.in:
            Added four legacy headers needed to support older WebSockets servers.
            Two of them are in the draft from August 2010: https://whatwg.org/specs/web-socket-protocol/

2016-04-26  Dean Jackson  <dino@apple.com>

        RTL native <select> buttons should have arrows on left
        https://bugs.webkit.org/show_bug.cgi?id=157055
        <rdar://problem/25894428>

        Reviewed by Myles Maxfield.

        If the text direction is right-to-left, the select popup
        buttons should have the arrows on the left side.

        Test: fast/forms/select-writing-direction-natural.html

        * rendering/RenderThemeMac.h:
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::popupButtonPadding): Takes a direction parameter.
        (WebCore::RenderThemeMac::popupInternalPaddingBox): Checks the direction for the padding.
        (WebCore::RenderThemeMac::setPopupButtonCellState): Tell the button to put the
        arrows on the correct side.
        (WebCore::RenderThemeMac::popupButton): Deleted an unnecessary comment.

2016-04-26  Myles C. Maxfield  <mmaxfield@apple.com>

        [WK2] [OS X] Create API for switching RTL scrollbar policy
        https://bugs.webkit.org/show_bug.cgi?id=156948
        <rdar://problem/25707757>

        Reviewed by Darin Adler.

        There are two schools of thought for where to put scrollbars in RTL environments.
        The first is that we should obey the content's "dir" attribute, specified on each
        element. The second is that we should be consistent with the platform (AppKit's)
        behavior.

        There are some situations where the placement should be done according to the
        content. For example, this policy would be used in web browsers.

        However, there are also places where web content is designed to fit seamlessly
        amongst native content. In this situation, the placement of the scrollbars should
        be done according to the view.

        Because WebKit doesn't know which of these situations it is operating within, this
        patch adds a new API property, userInterfaceDirectionPolicy, to
        WKWebViewConfigurationPolicy. This allows clients to instruct us which policy to
        abide by. It is plumbed to the web process inside the WebPreferencesStore and is
        ultimately held inside the Page's Settings object.

        This Setting is consulted by RenderLayerModelObject, which serves as a good
        centralized place for this policy implementation. This is the class which decides
        if we should be consulting its RenderStyle or the platform itself when we decide
        where to put the scrollbars.

        Putting this decision inside the renderer is important because ScrollableArea
        often needs to know if scrollbars should be put on the left, but ScrollableArea
        doesn't know anything about RenderStyles. Therefore, the renderer must be the
        intermediary between ScrollableArea and the RenderStyle. (ScrollableArea also
        doesn't directly know anything about renderers either; however, each of the
        subclasses knows about an appropriate renderer.) Therefore, ScrollableArea gets
        a new virtual method which is implemented by the RenderLayerModelObject.

        Tests: fast/scrolling/rtl-scrollbars*.html

        * WebCore.xcodeproj/project.pbxproj: ScrollableAreaMac.mm is no longer necessary.
        * page/FrameView.cpp:
        (WebCore::FrameView::shouldPlaceBlockDirectionScrollbarOnLeft): Overridden
        ScrollableArea function.
        * page/FrameView.h:
        * page/Settings.h:
        * page/Settings.in:
        * platform/ScrollView.cpp: Adding two new settings: One to know if we should
        consult with the RenderStyle or the platform, and the other is whether or not
        the platform considers itself to be RTL.
        (WebCore::ScrollView::documentScrollPositionRelativeToViewOrigin): Update to
        use new mechanism.
        (WebCore::ScrollView::updateScrollbars): Ditto.
        (WebCore::ScrollView::scrollCornerRect): Ditto.
        (WebCore::ScrollView::locationOfContents): Ditto.
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::verticalScrollbarIsOnLeft): Deleted. This was the old
        mechanism.
        (WebCore::ScrollableArea::systemLanguageIsRTL): Deleted. Ditto.
        * platform/ScrollableArea.h:
        * platform/mac/ScrollableAreaMac.mm: Removed.
        (WebCore::ScrollableArea::verticalScrollbarIsOnLeft): Deleted.
        (WebCore::ScrollableArea::systemLanguageIsRTL): Deleted.
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::ScrollbarThemeMac::didCreateScrollerImp): Update to use new
        mechanism.
        * platform/text/WritingMode.h: These enums should match what's in WebKit2.
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::logicalLeftOffsetForContent): Update to use new mechanism.
        (WebCore::RenderBlock::logicalRightOffsetForContent): Ditto.
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::determineLogicalLeftPositionForChild): Ditto.
        * rendering/RenderBox.cpp: Ditto.
        (WebCore::RenderBox::contentBoxRect):
        (WebCore::RenderBox::overflowClipRect):
        (WebCore::RenderBox::computePositionedLogicalWidth):
        (WebCore::RenderBox::layoutOverflowRectForPropagation):
        * rendering/RenderBoxModelObject.cpp: Ditto.
        (WebCore::RenderBoxModelObject::constrainingRectForStickyPosition):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::resize): Ditto.
        (WebCore::cornerStart): Migrate to use references.
        (WebCore::cornerRect): Ditto.
        (WebCore::RenderLayer::scrollCornerRect): Ditto.
        (WebCore::resizerCornerRect): Ditto.
        (WebCore::RenderLayer::scrollCornerAndResizerRect): Ditto.
        (WebCore::RenderLayer::verticalScrollbarStart): Update to use new mechanism.
        (WebCore::RenderLayer::horizontalScrollbarStart): Ditto.
        (WebCore::RenderLayer::offsetFromResizeCorner): Ditto.
        (WebCore::RenderLayer::positionOverflowControls): Migrate to use references.
        (WebCore::RenderLayer::computeScrollDimensions): Ditto.
        (WebCore::RenderLayer::overflowControlsIntersectRect): Ditto.
        (WebCore::RenderLayer::drawPlatformResizerImage): Update to use new mechanism.
        (WebCore::RenderLayer::paintResizer): Migrate to use references.
        (WebCore::RenderLayer::isPointInResizeControl): Ditto.
        (WebCore::RenderLayer::hitTestOverflowControls): Ditto.
        (WebCore::RenderLayer::hitTestResizerInFragments): Ditto.
        * rendering/RenderLayer.h: ScrollableArea override
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::positionForClipLayer): Update to use new
        mechanism.
        * rendering/RenderLayerModelObject.cpp:
        (WebCore::RenderLayerModelObject::shouldPlaceBlockDirectionScrollbarOnLeft):
        This is the meat of this patch. This is where we decide if we should be
        interrogating the RenderStyle or the underlying platform.
        * rendering/RenderLayerModelObject.h:
        * rendering/RenderListBox.cpp: Update to use new mechanism.
        (WebCore::RenderListBox::itemBoundingBoxRect):
        (WebCore::RenderListBox::paintScrollbar):
        (WebCore::RenderListBox::isPointInOverflowControl):
        (WebCore::RenderListBox::listIndexAtOffset):
        (WebCore::RenderListBox::controlClipRect):
        (WebCore::RenderListBox::invalidateScrollbarRect):
        (WebCore::RenderListBox::convertFromScrollbarToContainingView):
        (WebCore::RenderListBox::convertFromContainingViewToScrollbar):
        * rendering/RenderListBox.h:
        * rendering/RenderView.cpp: Ditto.
        (WebCore::RenderView::repaintViewRectangle):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::shouldPlaceBlockDirectionScrollbarOnLeft): This
        function is now much dumber. It just inspects its own style.
        * testing/InternalSettings.cpp: Allow mocking.
        (WebCore::InternalSettings::Backup::Backup):
        (WebCore::InternalSettings::Backup::restoreTo):
        (WebCore::InternalSettings::verticalScrollbarLocationPolicy):
        (WebCore::InternalSettings::setVerticalScrollbarLocationPolicy):
        (WebCore::InternalSettings::systemLayoutDirection):
        (WebCore::InternalSettings::setSystemLayoutDirection):
        * testing/InternalSettings.h:
        * testing/InternalSettings.idl:

2016-04-26  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Specify default values for optional parameters of type 'unsigned long'
        https://bugs.webkit.org/show_bug.cgi?id=157043

        Reviewed by Alex Christensen.

        Specify default values for optional parameters of type 'unsigned long' and let
        the bindings generator use WTF::Optional<> for the parameters that do not have
        such default value.

        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::createScriptProcessor): Deleted.
        (WebCore::AudioContext::createChannelSplitter): Deleted.
        (WebCore::AudioContext::createChannelMerger): Deleted.
        * Modules/webaudio/AudioContext.h:
        * Modules/webaudio/AudioContext.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (CanUseWTFOptionalForParameter): Deleted.
        * css/CSSStyleSheet.cpp:
        (WebCore::CSSStyleSheet::addRule):
        * css/CSSStyleSheet.h:
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyleSheet::addRule):

2016-04-26  Ryosuke Niwa  <rniwa@webkit.org>

        ASSERTION FAILED: m_templateInsertionModes.isEmpty() in WebCore::HTMLTreeBuilder::finished
        https://bugs.webkit.org/show_bug.cgi?id=143519

        Reviewed by Darin Adler.

        The assertion failure was caused by our parser inconsistently following the spec. Fixed it by making our HTML parser
        match the latest HTML5 specification. See inline comments below.

        Tests: fast/dom/HTMLTemplateElement/parsing-template-with-frameset.html
               html5lib/generated/run-template-data.html
               html5lib/generated/run-template-write.html
               imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant.html
               imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset.html
               imported/w3c/web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset.html

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processStartTagForInBody): When parsing a template element for 'in body' insertion mode,
        we process the token using the rules for 'in head' insertion mode, which sets the frameset-ok flag to "not ok".
        In addition, 'in template' insertion mode should not special case a start tag whose tag name is "frame". Instead,
        fallback to using 'in body' insertion mode.
        https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody
        (WebCore::HTMLTreeBuilder::processStartTag): 'in frameset' insertion mode should not special case a start tag whose
        tag name is "template": https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inframeset
        (WebCore::HTMLTreeBuilder::processEndTag): Ditto for an end tag whose name is "template".
        (WebCore::HTMLTreeBuilder::processStartTagForInHead): When parsing a template element in 'in head' inserting mode,
        we set the frameset-ok flag to "not ok": https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inhead

2016-04-26  Filip Pizlo  <fpizlo@apple.com>

        WebCore on Mac ignores the user's preferred region (country) while getting the language
        https://bugs.webkit.org/show_bug.cgi?id=156993

        Reviewed by Geoffrey Garen.

        This is tested by the NavigatorLanguage API test.
        
        WebCore was previously getting the list of preferred languages, and for each one, deducing
        the default region. That's wrong, since for example it doesn't respect the user's choice (in
        System Preferences) to display dates/calenders/etc according to a different region (like how
        I have my machine set to en-pl right now).
        
        It might be possible for the country code we get via kCFLocaleCountryCode to be something
        that our ICU doesn't handle. To defend against this, we search for the resulting country
        code in ICU's ISO countries list. If it doesn't appear in that list, we fall back on old
        behavior.

        * platform/mac/Language.mm:
        (WebCore::httpStyleLanguageCode):
        (WebCore::isValidICUCountryCode):
        (WebCore::platformUserPreferredLanguages):

2016-04-26  Myles C. Maxfield  <mmaxfield@apple.com>

        Use auto-generated operators in FontPlatformData
        https://bugs.webkit.org/show_bug.cgi?id=157037

        Reviewed by Geoffrey Garen.

        The only reason why they weren't used before is because Cairo was
        using a raw pointer. However, RefPtr supports Cairo types, so this
        patch migrates that pointer to a RefPtr. Therefore, we can remove
        our custom operators (because they work the same way as auto-
        generated ones do).

        No new tests because there is no behavior change.

        * platform/graphics/FontPlatformData.cpp:
        (WebCore::FontPlatformData::FontPlatformData): Deleted.
        (WebCore::FontPlatformData::operator=): Deleted.
        * platform/graphics/FontPlatformData.h:
        (WebCore::FontPlatformData::scaledFont):
        (WebCore::FontPlatformData::hash):
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore::FontPlatformData::~FontPlatformData): Deleted.
        (WebCore::FontPlatformData::platformDataInit): Deleted.
        (WebCore::FontPlatformData::platformDataAssign): Deleted.
        * platform/graphics/win/FontPlatformDataCGWin.cpp:
        (WebCore::FontPlatformData::~FontPlatformData): Deleted.
        (WebCore::FontPlatformData::platformDataInit): Deleted.
        (WebCore::FontPlatformData::platformDataAssign): Deleted.
        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
        (WebCore::FontPlatformData::platformDataInit):
        (WebCore::FontPlatformData::FontPlatformData):
        (WebCore::FontPlatformData::~FontPlatformData): Deleted.
        (WebCore::FontPlatformData::platformDataAssign): Deleted.
        * platform/graphics/win/FontPlatformDataWin.cpp:
        (WebCore::FontPlatformData::FontPlatformData): Deleted.

2016-04-26  Zalan Bujtas  <zalan@apple.com>

        Add renderer address and needslayout state to inlineboxtree dump.
        https://bugs.webkit.org/show_bug.cgi?id=157035

        Reviewed by Simon Fraser.

        * rendering/InlineBox.cpp:
        (WebCore::InlineBox::showLineBox):
        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::showLineBox):
        * rendering/SimpleLineLayoutFunctions.cpp:
        (WebCore::SimpleLineLayout::printPrefix):

2016-04-26  Fujii Hironori  <Hironori.Fujii@sony.com>

        [curl] Requests interrupted when using https via proxy
        https://bugs.webkit.org/show_bug.cgi?id=157028

        Reviewed by Alex Christensen.

        A proxy responds "200 Connection Established" to a CONNECT
        method.  This response doesn't have Content-Type, then the
        request is canceled due to a unsupported MIME type. This is not
        a real response from the recipient server. It should not be
        processed normally. Just ignore the response.

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::headerCallback):
        Do nothing if httpCode is 0. This is the case of "200 Connection Established".

2016-04-26  Chris Dumez  <cdumez@apple.com>

        Drop Dictionary from CanUseWTFOptionalForParameter()
        https://bugs.webkit.org/show_bug.cgi?id=157023

        Reviewed by Darin Adler.

        As per Web IDL, optional dictionary parameters are always considered to have
        a default value of an empty dictionary, unless otherwise specified. There is
        therefore never any need to use Optional<> for it. Just implement this
        behavior in the bindings generator and drop blacklisting of Dictionary from
        CanUseWTFOptionalForParameter().

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck):
        (CanUseWTFOptionalForParameter): Deleted.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionOptionsObject):

2016-04-26  Antti Koivisto  <antti@apple.com>

        RenderElement::style() should return const RenderStyle
        https://bugs.webkit.org/show_bug.cgi?id=157016

        Reviewed by Geoff Garen.

        Style should be changed via setStyle, not by mutating it directly.

        Pulling this string turns RenderStyle const in many places.

        * accessibility/AccessibilityObject.cpp:
        (WebCore::startOfStyleRange):
        * accessibility/atk/WebKitAccessibleInterfaceText.cpp:
        (getAttributeSetForAccessibilityObject):
        * bindings/objc/DOM.mm:
        (-[DOMNode innerFrameQuad]):
        (-[DOMNode computedFontSize]):
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::createPositionListForLayer):
        (WebCore::positionOffsetValue):
        (WebCore::ComputedStyleExtractor::currentColorOrValidColor):
        (WebCore::getTransitionPropertyValue):
        (WebCore::scrollSnapDestination):
        (WebCore::scrollSnapPoints):
        (WebCore::scrollSnapCoordinates):
        (WebCore::logUnimplementedPropertyID):
        (WebCore::fontFamilyFromStyle):
        (WebCore::lineHeightFromStyle):
        (WebCore::fontSizeFromStyle):
        (WebCore::fontStyleFromStyle):
        (WebCore::fontVariantFromStyle):
        (WebCore::fontWeightFromStyle):
        (WebCore::fontSynthesisFromStyle):
        (WebCore::zoomAdjustedPaddingOrMarginPixelValue):
        (WebCore::paddingOrMarginIsRendererDependent):
        (WebCore::convertToRegionBreak):
        (WebCore::isLayoutDependent):
        (WebCore::updateStyleIfNeededForNode):
        (WebCore::computeRenderStyleForProperty):
        (WebCore::ComputedStyleExtractor::propertyValue):
        (WebCore::CSSComputedStyleDeclaration::length):
        (WebCore::CSSComputedStyleDeclaration::item):
        (WebCore::ComputedStyleExtractor::propertyMatches):
        * css/CSSComputedStyleDeclaration.h:
        * css/CSSToLengthConversionData.cpp:
        (WebCore::CSSToLengthConversionData::viewportWidthFactor):
        (WebCore::CSSToLengthConversionData::viewportHeightFactor):
        (WebCore::CSSToLengthConversionData::viewportMinFactor):
        (WebCore::CSSToLengthConversionData::viewportMaxFactor):
        * css/CSSToLengthConversionData.h:
        (WebCore::CSSToLengthConversionData::CSSToLengthConversionData):
        (WebCore::CSSToLengthConversionData::style):
        (WebCore::CSSToLengthConversionData::rootStyle):
        (WebCore::CSSToLengthConversionData::computingFontSize):
        (WebCore::CSSToLengthConversionData::copyWithAdjustedZoom):
        * css/CSSToStyleMap.cpp:
        (WebCore::CSSToStyleMap::style):
        (WebCore::CSSToStyleMap::rootElementStyle):
        * css/CSSToStyleMap.h:
        * css/MediaQueryEvaluator.cpp:
        (WebCore::MediaQueryEvaluator::MediaQueryEvaluator):
        * css/MediaQueryEvaluator.h:
        * css/SVGCSSComputedStyleDeclaration.cpp:
        (WebCore::strokeDashArrayToCSSValueList):
        (WebCore::ComputedStyleExtractor::adjustSVGPaintForCurrentColor):
        (WebCore::ComputedStyleExtractor::svgPropertyValue):
        * css/SourceSizeList.cpp:
        (WebCore::match):
        (WebCore::defaultLength):
        (WebCore::computeLength):
        (WebCore::parseSizesAttribute):
        * css/StyleBuilderCustom.h:
        (WebCore::ApplyPropertyBorderImageModifier::applyValue):
        (WebCore::ApplyPropertyBorderImageModifier::getValue):
        (WebCore::StyleBuilderCustom::applyInheritClip):
        (WebCore::StyleBuilderCustom::applyInheritCounter):
        (WebCore::StyleBuilderCustom::applyValueContent):
        (WebCore::StyleBuilderCustom::applyValueAlt):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::sweepMatchedPropertiesCache):
        (WebCore::StyleResolver::State::State):
        (WebCore::isAtShadowBoundary):
        (WebCore::StyleResolver::styleForElement):
        (WebCore::StyleResolver::keyframeStylesForAnimation):
        (WebCore::StyleResolver::pseudoStyleForElement):
        (WebCore::StyleResolver::applyProperty):
        (WebCore::StyleResolver::checkForTextSizeAdjust):
        (WebCore::StyleResolver::checkForZoomChange):
        (WebCore::StyleResolver::checkForGenericFamilyChange):
        * css/StyleResolver.h:
        (WebCore::StyleResolver::style):
        (WebCore::StyleResolver::parentStyle):
        (WebCore::StyleResolver::rootElementStyle):
        (WebCore::StyleResolver::element):
        (WebCore::StyleResolver::document):
        (WebCore::StyleResolver::documentSettings):
        (WebCore::StyleResolver::State::State):
        (WebCore::StyleResolver::State::takeStyle):
        (WebCore::StyleResolver::State::parentStyle):
        (WebCore::StyleResolver::State::rootElementStyle):
        (WebCore::StyleResolver::State::regionForStyling):
        (WebCore::StyleResolver::State::elementLinkState):
        * dom/Document.cpp:
        (WebCore::Document::updateLayoutIgnorePendingStylesheets):
        (WebCore::Document::styleForElementIgnoringPendingStylesheets):
        (WebCore::Document::setVisuallyOrdered):
        (WebCore::Document::createParser):
        * dom/Document.h:
        * dom/Element.cpp:
        (WebCore::Element::styleResolver):
        (WebCore::Element::resolveStyle):
        (WebCore::checkForEmptyStyleChange):
        (WebCore::checkForSiblingStyleChanges):
        (WebCore::beforeOrAfterPseudoElement):
        (WebCore::Element::existingComputedStyle):
        (WebCore::Element::resolveComputedStyle):
        (WebCore::Element::computedStyle):
        (WebCore::Element::didDetachRenderers):
        (WebCore::Element::resolveCustomStyle):
        * dom/Element.h:
        * dom/Node.cpp:
        (WebCore::computeEditabilityFromComputedStyle):
        (WebCore::Node::pseudoAwareLastChild):
        (WebCore::Node::computedStyle):
        * dom/Node.h:
        * dom/NodeRenderStyle.h:
        (WebCore::Node::renderStyle):
        * dom/PseudoElement.cpp:
        (WebCore::PseudoElement::clearHostElement):
        (WebCore::PseudoElement::resolveCustomStyle):
        * dom/PseudoElement.h:
        * editing/ApplyBlockElementCommand.cpp:
        (WebCore::isNewLineAtPosition):
        (WebCore::ApplyBlockElementCommand::renderStyleOfEnclosingTextNode):
        (WebCore::ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded):
        (WebCore::ApplyBlockElementCommand::endOfNextParagraphSplittingTextNodesIfNeeded):
        * editing/ApplyBlockElementCommand.h:
        * editing/EditingStyle.cpp:
        (WebCore::EditingStyle::init):
        (WebCore::EditingStyle::removeTextFillAndStrokeColorsIfNeeded):
        * editing/EditingStyle.h:
        * editing/Editor.h:
        * editing/SimplifyMarkupCommand.cpp:
        (WebCore::SimplifyMarkupCommand::doApply):
        * editing/cocoa/EditorCocoa.mm:
        (WebCore::Editor::styleForSelectionStart):
        (WebCore::Editor::getTextDecorationAttributesRespectingTypingStyle):
        * editing/ios/EditorIOS.mm:
        (WebCore::Editor::fontForSelection):
        (WebCore::Editor::fontAttributesForSelectionStart):
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::fontForSelection):
        (WebCore::Editor::fontAttributesForSelectionStart):
        * html/HTMLTitleElement.cpp:
        (WebCore::HTMLTitleElement::computedTextWithDirection):
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::FontProxy::fontsNeedUpdate):
        (WebCore::CanvasRenderingContext2D::FontProxy::initialize):
        (WebCore::CanvasRenderingContext2D::setFont):
        (WebCore::CanvasRenderingContext2D::setTextBaseline):
        (WebCore::CanvasRenderingContext2D::toTextDirection):
        (WebCore::CanvasRenderingContext2D::drawTextInternal):
        * html/canvas/CanvasRenderingContext2D.h:
        * html/parser/HTMLResourcePreloader.cpp:
        (WebCore::HTMLResourcePreloader::preload):
        (WebCore::mediaAttributeMatches):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::RenderSliderThumb::RenderSliderThumb):
        (WebCore::RenderSliderThumb::updateAppearance):
        (WebCore::RenderSliderContainer::layout):
        (WebCore::SliderThumbElement::hostInput):
        (WebCore::SliderThumbElement::resolveCustomStyle):
        (WebCore::SliderContainerElement::createElementRenderer):
        (WebCore::SliderContainerElement::resolveCustomStyle):
        * html/shadow/SliderThumbElement.h:
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::TextControlInnerElement::create):
        (WebCore::TextControlInnerElement::resolveCustomStyle):
        (WebCore::TextControlInnerTextElement::renderer):
        (WebCore::TextControlInnerTextElement::resolveCustomStyle):
        (WebCore::TextControlPlaceholderElement::TextControlPlaceholderElement):
        (WebCore::TextControlPlaceholderElement::resolveCustomStyle):
        * html/shadow/TextControlInnerElements.h:
        * page/EventHandler.cpp:
        (WebCore::EventHandler::selectCursor):
        * page/animation/AnimationBase.cpp:
        (WebCore::solveStepsFunction):
        (WebCore::AnimationBase::AnimationBase):
        * page/animation/AnimationBase.h:
        (WebCore::AnimationBase::~AnimationBase):
        (WebCore::AnimationBase::renderer):
        (WebCore::AnimationBase::animation):
        (WebCore::AnimationBase::setAnimation):
        * page/animation/AnimationController.cpp:
        (WebCore::AnimationController::cancelAnimations):
        (WebCore::AnimationController::updateAnimations):
        * page/animation/AnimationController.h:
        * page/animation/CompositeAnimation.cpp:
        (WebCore::CompositeAnimation::clearRenderer):
        (WebCore::CompositeAnimation::updateTransitions):
        (WebCore::CompositeAnimation::updateKeyframeAnimations):
        (WebCore::CompositeAnimation::animate):
        * page/animation/CompositeAnimation.h:
        * page/animation/ImplicitAnimation.cpp:
        (WebCore::ImplicitAnimation::ImplicitAnimation):
        (WebCore::ImplicitAnimation::shouldSendEventForListener):
        (WebCore::ImplicitAnimation::animate):
        (WebCore::ImplicitAnimation::sendTransitionEvent):
        (WebCore::ImplicitAnimation::reset):
        * page/animation/ImplicitAnimation.h:
        (WebCore::ImplicitAnimation::create):
        * page/animation/KeyframeAnimation.cpp:
        (WebCore::KeyframeAnimation::KeyframeAnimation):
        (WebCore::KeyframeAnimation::fetchIntervalEndpointsForProperty):
        (WebCore::KeyframeAnimation::animate):
        * page/animation/KeyframeAnimation.h:
        * page/ios/FrameIOS.mm:
        (WebCore::ancestorRespondingToScrollWheelEvents):
        * rendering/FlowThreadController.cpp:
        (WebCore::FlowThreadController::styleDidChange):
        * rendering/InlineFlowBox.cpp:
        (WebCore::clipRectForNinePieceImageStrip):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::styleDidChange):
        (WebCore::RenderBlock::lineHeight):
        (WebCore::RenderBlock::firstLineBlock):
        (WebCore::styleForFirstLetter):
        (WebCore::RenderBlock::updateFirstLetterStyle):
        (WebCore::RenderBlock::createFirstLetterRenderer):
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::adjustBlockChildForPagination):
        (WebCore::calculateMinimumPageHeight):
        (WebCore::RenderBlockFlow::adjustComputedFontSizes):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::styleDidChange):
        (WebCore::RenderBox::borderRadii):
        (WebCore::RenderBox::enclosingFloatPaintingLayer):
        (WebCore::RenderBox::logicalVisualOverflowRectForPropagation):
        (WebCore::RenderBox::visualOverflowRectForPropagation):
        (WebCore::RenderBox::logicalLayoutOverflowRectForPropagation):
        (WebCore::RenderBox::layoutOverflowRectForPropagation):
        * rendering/RenderBox.h:
        (WebCore::RenderBox::applyTopLeftLocationOffset):
        (WebCore::RenderBox::hasRenderOverflow):
        (WebCore::RenderBox::hasVisualOverflow):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::backgroundRoundedRectAdjustedForBleedAvoidance):
        (WebCore::applyBoxShadowForBackground):
        * rendering/RenderButton.cpp:
        (WebCore::RenderButton::addChild):
        (WebCore::RenderButton::styleWillChange):
        (WebCore::RenderButton::styleDidChange):
        (WebCore::RenderButton::setupInnerStyle):
        (WebCore::RenderButton::layout):
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::styleWillChange):
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::createFor):
        (WebCore::RenderElement::uncachedFirstLineStyle):
        (WebCore::RenderElement::cachedFirstLineStyle):
        (WebCore::RenderElement::firstLineStyle):
        (WebCore::RenderElement::styleWillChange):
        (WebCore::RenderElement::addControlStatesForRenderer):
        (WebCore::RenderElement::getCachedPseudoStyle):
        (WebCore::RenderElement::getMutableCachedPseudoStyle):
        (WebCore::RenderElement::getUncachedPseudoStyle):
        (WebCore::RenderElement::paintOutline):
        * rendering/RenderElement.h:
        (WebCore::RenderElement::hasInitializedStyle):
        (WebCore::RenderElement::style):
        (WebCore::RenderElement::mutableStyle):
        (WebCore::RenderElement::element):
        (WebCore::RenderObject::isRenderInline):
        (WebCore::RenderObject::style):
        (WebCore::RenderObject::firstLineStyle):
        * rendering/RenderEmbeddedObject.cpp:
        (WebCore::RenderEmbeddedObject::layout):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::RenderFlowThread):
        (WebCore::RenderFlowThread::createFlowThreadStyle):
        * rendering/RenderFlowThread.h:
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::layoutShadowControls):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::styleDidChange):
        (WebCore::RenderInline::updateAlwaysCreateLineBoxes):
        (WebCore::RenderInline::paintOutline):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::setupClipPath):
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::paintScrollbar):
        (WebCore::itemOffsetForAlignment):
        (WebCore::RenderListBox::paintItemForeground):
        (WebCore::RenderListBox::paintItemBackground):
        * rendering/RenderListMarker.cpp:
        (WebCore::RenderListMarker::updateMargins):
        (WebCore::RenderListMarker::lineHeight):
        * rendering/RenderMarquee.cpp:
        (WebCore::RenderMarquee::computePosition):
        (WebCore::RenderMarquee::updateMarqueeStyle):
        * rendering/RenderMenuList.cpp:
        (WebCore::RenderMenuList::adjustInnerStyle):
        (RenderMenuList::updateOptionsWidth):
        (RenderMenuList::itemStyle):
        * rendering/RenderMultiColumnFlowThread.cpp:
        (WebCore::isValidColumnSpanner):
        * rendering/RenderMultiColumnSpannerPlaceholder.cpp:
        (WebCore::RenderMultiColumnSpannerPlaceholder::createAnonymous):
        * rendering/RenderMultiColumnSpannerPlaceholder.h:
        * rendering/RenderNamedFlowFragment.cpp:
        (WebCore::RenderNamedFlowFragment::checkRegionStyle):
        (WebCore::RenderNamedFlowFragment::computeStyleInRegion):
        * rendering/RenderNamedFlowFragment.h:
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::innerLineHeight):
        (WebCore::decorationColor):
        (WebCore::RenderObject::getTextDecorationColorsAndStyles):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::minPreferredLogicalWidth):
        (WebCore::RenderObject::maxPreferredLogicalWidth):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::computePreferredLogicalWidths):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::paintRowGroupBorderIfRequired):
        (WebCore::physicalBorderForDirection):
        * rendering/RenderText.h:
        (WebCore::RenderText::characterAt):
        (WebCore::RenderText::style):
        (WebCore::RenderText::firstLineStyle):
        (WebCore::RenderText::getCachedPseudoStyle):
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::styleDidChange):
        * rendering/RenderTextControlMultiLine.cpp:
        (WebCore::RenderTextControlMultiLine::layoutSpecialExcludedChild):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::layout):
        (WebCore::RenderTextControlSingleLine::styleDidChange):
        * rendering/RenderTextFragment.cpp:
        (WebCore::RenderTextFragment::styleDidChange):
        * rendering/RenderThemeGtk.cpp:
        (WebCore::RenderThemeGtk::paintMediaToggleClosedCaptionsButton):
        (WebCore::borderRadiiFromStyle):
        (WebCore::RenderThemeGtk::paintMediaSliderTrack):
        (WebCore::RenderThemeGtk::paintMediaSliderThumb):
        (WebCore::RenderThemeGtk::paintMediaVolumeSliderTrack):
        * rendering/SimpleLineLayoutFunctions.cpp:
        (WebCore::SimpleLineLayout::paintFlow):
        (WebCore::SimpleLineLayout::hitTestFlow):
        * rendering/TextAutoSizing.cpp:
        (WebCore::TextAutoSizingKey::TextAutoSizingKey):
        * rendering/TextAutoSizing.h:
        (WebCore::TextAutoSizingKey::style):
        (WebCore::TextAutoSizingKey::isDeleted):
        * rendering/TextPaintStyle.cpp:
        (WebCore::computeTextSelectionPaintStyle):
        * rendering/line/BreakingContext.h:
        * rendering/mathml/RenderMathMLRoot.cpp:
        (WebCore::RenderMathMLRoot::layout):
        * rendering/style/RenderStyle.h:
        (WebCore::RenderStyle::setColumnRuleWidth):
        (WebCore::RenderStyle::resetColumnRule):
        (WebCore::RenderStyle::setColumnSpan):
        (WebCore::RenderStyle::inheritColumnPropertiesFrom):
        (WebCore::RenderStyle::setTransform):
        (WebCore::RenderStyle::setTransformOriginX):
        (WebCore::RenderStyle::setTransformOriginY):
        * rendering/svg/SVGInlineTextBox.cpp:
        (WebCore::SVGInlineTextBox::positionForOffset):
        (WebCore::SVGInlineTextBox::selectionRectForTextFragment):
        (WebCore::SVGInlineTextBox::localSelectionRect):
        (WebCore::SVGInlineTextBox::paintSelectionBackground):
        (WebCore::SVGInlineTextBox::paint):
        (WebCore::SVGInlineTextBox::acquirePaintingResource):
        (WebCore::SVGInlineTextBox::releasePaintingResource):
        (WebCore::SVGInlineTextBox::prepareGraphicsContextForTextPainting):
        (WebCore::SVGInlineTextBox::restoreGraphicsContextAfterTextPainting):
        (WebCore::SVGInlineTextBox::constructTextRun):
        (WebCore::SVGInlineTextBox::paintDecorationWithStyle):
        (WebCore::SVGInlineTextBox::paintTextWithShadows):
        (WebCore::SVGInlineTextBox::paintText):
        * rendering/svg/SVGInlineTextBox.h:
        * rendering/svg/SVGPathData.cpp:
        (WebCore::updatePathFromCircleElement):
        (WebCore::updatePathFromEllipseElement):
        (WebCore::updatePathFromRectElement):
        * rendering/svg/SVGRenderingContext.cpp:
        (WebCore::SVGRenderingContext::prepareToRenderSVGContent):
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::Parent::Parent):
        (WebCore::Style::TreeResolver::popScope):
        (WebCore::Style::TreeResolver::styleForElement):
        (WebCore::Style::TreeResolver::pushParent):
        (WebCore::Style::TreeResolver::resolveComposedTree):
        * style/StyleTreeResolver.h:
        (WebCore::Style::TreeResolver::scope):
        * style/StyleUpdate.cpp:
        (WebCore::Style::Update::textUpdate):
        (WebCore::Style::Update::elementStyle):
        (WebCore::Style::Update::addElement):
        * style/StyleUpdate.h:
        (WebCore::Style::Update::document):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::synchronizeSystemLanguage):
        (WebCore::SVGElement::resolveCustomStyle):
        (WebCore::SVGElement::setUseOverrideComputedStyle):
        (WebCore::SVGElement::computedStyle):
        * svg/SVGElement.h:
        * svg/SVGElementRareData.h:
        (WebCore::SVGElementRareData::ensureAnimatedSMILStyleProperties):
        (WebCore::SVGElementRareData::overrideComputedStyle):
        * svg/SVGGraphicsElement.cpp:
        (WebCore::SVGGraphicsElement::animatedLocalTransform):
        * svg/SVGLengthContext.cpp:
        (WebCore::SVGLengthContext::convertValueFromPercentageToUserUnits):
        (WebCore::renderStyleForLengthResolving):
        (WebCore::SVGLengthContext::convertValueFromUserUnitsToEMS):
        (WebCore::SVGLengthContext::convertValueFromEMSToUserUnits):
        (WebCore::SVGLengthContext::convertValueFromUserUnitsToEXS):
        (WebCore::SVGLengthContext::convertValueFromEXSToUserUnits):
        * svg/SVGStopElement.cpp:
        (WebCore::SVGStopElement::stopColorIncludingOpacity):
        * svg/SVGTextElement.cpp:
        (WebCore::SVGTextElement::animatedLocalTransform):

2016-04-26  Myles C. Maxfield  <mmaxfield@apple.com>

        Make FontPlatformData immutable
        https://bugs.webkit.org/show_bug.cgi?id=157024

        Reviewed by Darin Adler.

        This patch deletes all functions which modify a FontPlatformData once
        it has been created. This makes for a cleaner design.

        No new tests because there is no behavior change.

        * platform/graphics/Font.cpp:
        (WebCore::Font::verticalRightOrientationFont):
        (WebCore::Font::nonSyntheticItalicFont):
        * platform/graphics/FontPlatformData.cpp:
        (WebCore::FontPlatformData::FontPlatformData):
        (WebCore::FontPlatformData::cloneWithOrientation):
        (WebCore::FontPlatformData::cloneWithSyntheticOblique):
        * platform/graphics/FontPlatformData.h:
        (WebCore::FontPlatformData::setIsSystemFont): Deleted.
        (WebCore::FontPlatformData::setSize): Deleted.
        (WebCore::FontPlatformData::setOrientation): Deleted.
        (WebCore::FontPlatformData::setSyntheticOblique): Deleted.
        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::FontCache::systemFallbackForCharacters):
        * platform/graphics/cocoa/FontCascadeCocoa.mm:
        (WebCore::FontCascade::drawGlyphs):
        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::Font::platformInit):
        (WebCore::Font::platformCharWidthInit):
        (WebCore::createDerivativeFont):
        (WebCore::Font::createFontWithoutSynthesizableFeatures):
        (WebCore::Font::platformCreateScaledFont):
        (WebCore::Font::platformWidthForGlyph):
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore::FontPlatformData::openTypeTable):
        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
        (WebCore::FontPlatformData::platformDataInit):

2016-04-26  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r200089.

        This change causes API test failures

        Reverted changeset:

        "WebCore on Mac ignores the user's preferred region (country)
        while getting the language"
        https://bugs.webkit.org/show_bug.cgi?id=156993
        http://trac.webkit.org/changeset/200089

2016-04-26  Brent Fulgham  <bfulgham@apple.com>

        GuardMalloc crash in WebCore::HTMLFrameElementBase::marginHeight() 
        https://bugs.webkit.org/show_bug.cgi?id=157020
        <rdar://problem/25148315>

        Reviewed by Darin Adler.

        Calls to setIntegralAttribute triggers event handling code, which can cause
        the underlying m_frameOwnerElement member to be deleted. We could clone this
        object, but since we only want the width and height we should just read them
        while we know the object is in a good state, then execute the potentially
        mutating methods.

        Tested by imported/blink/fast/dom/HTMLBodyElement/body-inserting-iframe-crash.html.

        * html/HTMLBodyElement.cpp:
        (WebCore::HTMLBodyElement::insertedInto): Read margin width and height before
        calling setIntegralAttribute.

2016-04-25  Filip Pizlo  <fpizlo@apple.com>

        WebCore on Mac ignores the user's preferred region (country) while getting the language
        https://bugs.webkit.org/show_bug.cgi?id=156993

        Reviewed by Geoffrey Garen.

        I don't know how to test this since this depends on user settings.
        
        WebCore was previously getting the list of preferred languages, and for each one, deducing
        the default region. That's wrong, since for example it doesn't respect the user's choice (in
        System Preferences) to display dates/calenders/etc according to a different region (like how
        I have my machine set to en-pl right now).
        
        It might be possible for the country code we get via kCFLocaleCountryCode to be something
        that our ICU doesn't handle. To defend against this, we search for the resulting country
        code in ICU's ISO countries list. If it doesn't appear in that list, we fall back on old
        behavior.

        * platform/mac/Language.mm:
        (WebCore::httpStyleLanguageCode):
        (WebCore::platformUserPreferredLanguages):

2016-04-26  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Specify default values for optional parameters of TypedArray types
        https://bugs.webkit.org/show_bug.cgi?id=157017

        Reviewed by Darin Adler.

        Specify default values for optional parameters of TypedArray types and let
        the bindings generator use WTF::Optional<> for the ones that do not have a
        default value.

        * bindings/scripts/CodeGeneratorJS.pm:
        (CanUseWTFOptionalForParameter): Deleted.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::webkitGenerateKeyRequest):
        (WebCore::HTMLMediaElement::webkitAddKey):
        (WebCore::HTMLMediaElement::webkitCancelKeyRequest): Deleted.
        * html/HTMLMediaElement.h:
        * html/HTMLMediaElement.idl:

2016-04-26  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Specify default values for optional parameters of type 'long' / 'unrestricted double'
        https://bugs.webkit.org/show_bug.cgi?id=157012

        Reviewed by Darin Adler.

        Specify default values for optional parameters of type 'long' / 'unrestricted double'
        and let the bindings generator use WTF::Optional<> for the ones that do not have a
        default value.

        * Modules/mediastream/RTCDTMFSender.cpp:
        (WebCore::RTCDTMFSender::insertDTMF):
        (WebCore::RTCDTMFSender::didPlayTone): Deleted.
        * Modules/mediastream/RTCDTMFSender.h:
        * Modules/webaudio/AudioBufferSourceNode.cpp:
        (WebCore::AudioBufferSourceNode::start):
        (WebCore::AudioBufferSourceNode::startPlaying): Deleted.
        * Modules/webaudio/AudioBufferSourceNode.h:
        * Modules/webaudio/AudioBufferSourceNode.idl:
        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::createDelay): Deleted.
        * Modules/webaudio/AudioContext.h:
        * Modules/webaudio/AudioContext.idl:
        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        (WebCore::AudioScheduledSourceNode::start): Deleted.
        (WebCore::AudioScheduledSourceNode::stop): Deleted.
        * Modules/webaudio/AudioScheduledSourceNode.h:
        * Modules/webaudio/OscillatorNode.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (CanUseWTFOptionalForParameter): Deleted.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArg):
        (WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg):
        (WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2):
        (WebCore::jsTestObjConstructorFunctionClassMethodWithOptional):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithOptionalIntArgumentPromise):
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArgAndDefaultValue): Deleted.
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalString): Deleted.
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod4): Deleted.
        (WebCore::jsTestObjConstructorFunctionClassMethod2): Deleted.
        (WebCore::jsTestObjConstructorFunctionOverloadedMethod1): Deleted.
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2Promise): Deleted.
        * html/HTMLInputElement.idl:
        * page/WindowTimers.idl:
        * testing/Internals.h:
        * testing/Internals.idl:

2016-04-26  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Drop [UsePointersEvenForNonNullableObjectArguments] from SpeechSynthesis
        https://bugs.webkit.org/show_bug.cgi?id=156901

        Reviewed by Darin Adler.

        SpeechSynthesis.speak will now throw in case of bad parameters instead of silently failing.
        Started refactoring to use more references where possible.

        Covered by updated test.

        * Modules/speech/SpeechSynthesis.cpp:
        (WebCore::SpeechSynthesis::startSpeakingImmediately): Refactored to get a reference.
        (WebCore::SpeechSynthesis::speak):
        (WebCore::SpeechSynthesis::fireEvent):
        (WebCore::SpeechSynthesis::handleSpeakingCompleted): Removing first item in utteranceQueue unconditionally,
        since that would crash in Debug mode otherwise.
        (WebCore::SpeechSynthesis::boundaryEventOccurred):
        (WebCore::SpeechSynthesis::didStartSpeaking):
        (WebCore::SpeechSynthesis::didPauseSpeaking):
        (WebCore::SpeechSynthesis::didResumeSpeaking):
        (WebCore::SpeechSynthesis::didFinishSpeaking):
        (WebCore::SpeechSynthesis::speakingErrorOccurred):
        * Modules/speech/SpeechSynthesis.h:
        * Modules/speech/SpeechSynthesis.idl:

2016-04-26  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Drop [UsePointersEvenForNonNullableObjectArguments] from WebKitNamedFlow
        https://bugs.webkit.org/show_bug.cgi?id=156979

        Reviewed by Chris Dumez.

        No change of behavior.

        * dom/WebKitNamedFlow.idl: Marking contentNode parameter as nullable.

2016-04-26  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Drop [UsePointersEvenForNonNullableObjectArguments] from EventTarget
        https://bugs.webkit.org/show_bug.cgi?id=156977

        Reviewed by Chris Dumez.

        No change of behavior.

        * dom/EventTarget.idl:

2016-04-25  Ryosuke Niwa  <rniwa@webkit.org>

        Remove the build flag for template elements
        https://bugs.webkit.org/show_bug.cgi?id=157022

        Reviewed by Daniel Bates.

        Removed the build flag.

        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.cpp:
        * bindings/js/JSHTMLTemplateElementCustom.cpp:
        (WebCore::JSHTMLTemplateElement::content):
        * css/html.css:
        (summary::-webkit-details-marker):
        (template):
        (bdi, output):
        * dom/ContainerNode.cpp:
        (WebCore::isInTemplateContent):
        (WebCore::containsConsideringHostElements):
        (WebCore::ContainerNode::parserInsertBefore):
        (WebCore::ContainerNode::parserAppendChild):
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::~Document):
        (WebCore::Document::getCachedLocale):
        (WebCore::Document::ensureTemplateDocument):
        (WebCore::Document::fonts):
        * dom/Document.h:
        (WebCore::Document::setTemplateDocumentHost):
        (WebCore::Document::templateDocumentHost):
        (WebCore::Document::hasDisabledFieldsetElement):
        (WebCore::Document::textEncoding):
        (WebCore::Document::templateDocument):
        * dom/Element.cpp:
        (WebCore::Element::setInnerHTML):
        * dom/Node.cpp:
        (WebCore::Node::containsIncludingHostElements):
        (WebCore::Node::pseudoAwarePreviousSibling):
        * dom/TemplateContentDocumentFragment.h:
        * editing/MarkupAccumulator.cpp:
        (WebCore::MarkupAccumulator::serializeNodesWithNamespaces):
        * editing/markup.cpp:
        (WebCore::createFragmentForInnerOuterHTML):
        * html/HTMLTagNames.in:
        * html/HTMLTemplateElement.cpp:
        (WebCore::HTMLTemplateElement::didMoveToNewDocument):
        * html/HTMLTemplateElement.h:
        * html/HTMLTemplateElement.idl:
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::insert):
        (WebCore::HTMLConstructionSite::insertTextNode):
        (WebCore::HTMLConstructionSite::ownerDocumentForCurrentNode):
        (WebCore::HTMLConstructionSite::findFosterSite):
        * html/parser/HTMLElementStack.cpp:
        (WebCore::HTMLNames::isScopeMarker):
        (WebCore::HTMLNames::isTableScopeMarker):
        (WebCore::HTMLNames::isTableBodyScopeMarker):
        (WebCore::HTMLNames::isTableRowScopeMarker):
        (WebCore::HTMLElementStack::inSelectScope):
        (WebCore::HTMLElementStack::hasTemplateInHTMLScope):
        (WebCore::HTMLElementStack::htmlElement):
        * html/parser/HTMLElementStack.h:
        * html/parser/HTMLPreloadScanner.cpp:
        (WebCore::TokenPreloadScanner::scan):
        * html/parser/HTMLPreloadScanner.h:
        * html/parser/HTMLStackItem.h:
        (WebCore::isSpecialNode):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::isParsingTemplateContents):
        (WebCore::HTMLTreeBuilder::isParsingFragmentOrTemplateContents):
        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
        (WebCore::HTMLTreeBuilder::didCreateCustomOrCallbackElement):
        (WebCore::HTMLTreeBuilder::processTemplateStartTag):
        (WebCore::HTMLTreeBuilder::processEndOfFileForInTemplateContents):
        (WebCore::HTMLTreeBuilder::processColgroupEndTagForInColumnGroup):
        (WebCore::HTMLTreeBuilder::processStartTagForInTable):
        (WebCore::HTMLTreeBuilder::processStartTag):
        (WebCore::HTMLTreeBuilder::processHtmlStartTagForInBody):
        (WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately):
        (WebCore::HTMLTreeBuilder::processEndTagForInCell):
        (WebCore::HTMLTreeBuilder::processEndTagForInBody):
        (WebCore::HTMLTreeBuilder::processEndTag):
        (WebCore::HTMLTreeBuilder::processCharacterBuffer):
        (WebCore::HTMLTreeBuilder::processEndOfFile):
        (WebCore::HTMLTreeBuilder::processStartTagForInHead):
        (WebCore::HTMLTreeBuilder::finished):
        * html/parser/HTMLTreeBuilder.h:
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::buildObjectForNode):
        * inspector/InspectorInstrumentation.h:
        (WebCore::InspectorInstrumentation::instrumentingAgentsForDocument):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::XMLDocumentParser::startElementNs):

2016-04-25  Jiewen Tan  <jiewen_tan@apple.com>

        [iOS] ftp links crash @ WebCore::FTPDirectoryDocumentParser::appendEntry
        https://bugs.webkit.org/show_bug.cgi?id=157019
        <rdar://problem/24292650>

        Reviewed by Chris Dumez.

        Create separate Ref<Element> object for every row element instead of reusing
        one because Ref<>'s operator=() does not allow assignment after a WTFMove().

        * html/FTPDirectoryDocument.cpp:
        (WebCore::FTPDirectoryDocumentParser::appendEntry):

2016-04-25  Myles C. Maxfield  <mmaxfield@apple.com>

        [Cocoa] Guarantee FontPlatformData's m_cgFont is never nullptr
        https://bugs.webkit.org/show_bug.cgi?id=156929

        Reviewed by Darin Adler.

        After some investigation, it turns out that there is no place where it is meaningful
        to pass us a null CoreText font. Therefore, the CoreGraphics font is also never null.

        We should simply check for these null values at the ingestion site in order to
        make the guarantee internally of having non-null values.

        * platform/graphics/FontPlatformData.cpp:
        (WebCore::FontPlatformData::FontPlatformData): Because the pointer is never null, we
        can delete the code which handles that case.
        * platform/graphics/FontPlatformData.h:
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm: Ditto.
        (WebCore::webFallbackFontFamily): Deleted.
        (WebCore::FontPlatformData::setFallbackCGFont): Deleted.
        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Asking the
        CTRun for its kCTFontAttributeName will always return non-null.
        * platform/graphics/mac/FontCustomPlatformData.cpp:
        (WebCore::FontCustomPlatformData::fontPlatformData): Once we have a font descriptor,
        CTFontCreateWithFontDescriptor() will always return non-null. We check if the font
        descriptor is null elsewhere.
        * platform/mac/DragImageMac.mm: The fonts in this file are gotten by asking for the
        system font, which will always return non-null.
        (WebCore::fontFromNSFont):
        (WebCore::widthWithFont):
        (WebCore::drawAtPoint):
        (WebCore::createDragImageForLink):

2016-04-25  Chris Dumez  <cdumez@apple.com>

        Crash under MemoryCache::remove()
        https://bugs.webkit.org/show_bug.cgi?id=157000
        <rdar://problem/23344660>

        Reviewed by Andreas Kling.

        MemoryCache::evictResources() was caching the number of resources ('size')
        in the cache for a particular sessionID, and then proceed to call
        MemoryCache::remove() 'size' times using the first item in the HashMap
        each time. This was unsafe because resources may be ref'ing each other
        and therefore removing one may cause other resources to get removed as
        well. In such case, we would call remove() too many times and crash because
        we dereferenced resources.begin()->value (with the HashMap being empty).

        This patch avoids the issue by copying the resources to a Vector and
        ref'ing them first, before going on to remove each one from the cache.

        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::forEachSessionResource):
        (WebCore::MemoryCache::evictResources):
        * loader/cache/MemoryCache.h:

2016-04-25  Chris Dumez  <cdumez@apple.com>

        Crash under WebCore::MutationObserver::deliverAllMutations()
        https://bugs.webkit.org/show_bug.cgi?id=156997
        <rdar://problem/16542323>

        Reviewed by Ryosuke Niwa.

        The crash traces indicate that we may derefence a null pointer when
        dereferencing MutationCallback::scriptExecutationContext() in
        MutationObserver::canDeliver(). This can happen when the script
        execution context gets destroyed as a JSMutationCallback is an
        ActiveDOMObject, which is a ContextDestructionObserver.

        This patch refactors the code so that MutationObserver::canDeliver()
        now simply asks JSMutationCallback if it can invoke its callback.
        JSMutationCallback makes this decision using
        ActiveDOMCallback::canInvokeCallback() which does a proper null
        check of the ScriptExecutationContext. This avoids some code
        duplication and fixes the crash.

        * bindings/js/JSMutationCallback.h:
        * dom/MutationCallback.h:
        * dom/MutationObserver.cpp:
        (WebCore::MutationObserver::canDeliver):

2016-04-25  Brady Eidson  <beidson@apple.com>

        Fix a flaky test after r200032

        * fileapi/File.cpp:
        (WebCore::File::lastModified): This used to return a date object which did a WTF::timeClip on the double,
          but now that we're returning a raw double we need to WTF::timeClip it ourselves.

2016-04-25  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Specify default values for optional parameters of type 'float' / 'unrestricted float'
        https://bugs.webkit.org/show_bug.cgi?id=156995

        Reviewed by Darin Adler.

        Specify default values for optional parameters of type 'float' / 'unrestricted float'
        and let the bindings generator use WTF::Optional<> for the ones that do not have a
        default value.

        * bindings/scripts/CodeGeneratorJS.pm:
        (CanUseWTFOptionalForParameter): Deleted.
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::jsTestTypedefsPrototypeFunctionSetShadow):
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::setStrokeColor):
        (WebCore::CanvasRenderingContext2D::setFillColor):
        (WebCore::CanvasRenderingContext2D::setShadow):
        (WebCore::CanvasRenderingContext2D::fillText):
        (WebCore::CanvasRenderingContext2D::strokeText):
        (WebCore::CanvasRenderingContext2D::drawTextInternal):
        (WebCore::CanvasRenderingContext2D::clearShadow): Deleted.
        (WebCore::normalizeSpaces): Deleted.
        (WebCore::CanvasRenderingContext2D::measureText): Deleted.
        * html/canvas/CanvasRenderingContext2D.h:
        * html/canvas/CanvasRenderingContext2D.idl:
        * testing/Internals.idl:

2016-04-25  Brent Fulgham  <bfulgham@apple.com>

        Add port 4190 (managesieve) to port blacklist
        https://bugs.webkit.org/show_bug.cgi?id=156986
        <rdar://problem/9119470>

        Reviewed by Daniel Bates.

        Tested by security/block-test.html.

        * platform/URL.cpp:
        (WebCore::portAllowed): Add 4190 to the port blacklist.

2016-04-25  Nan Wang  <n_wang@apple.com>

        AX: Crash at -[WebAccessibilityObjectWrapper accessibilityAttributeValue:] + 4391
        https://bugs.webkit.org/show_bug.cgi?id=156987

        Reviewed by Chris Fleizach.

        When we hit test on a slider indicator asking for the value when the parent slider's
        accessibility object is not created or the parent slider has been removed, it will cause
        crash. Fixed it by adding a check to see if the object is detached from the parent. 

        Test: accessibility/mac/slider-thumb-value-crash.html

        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):

2016-04-25  Jer Noble  <jer.noble@apple.com>

        WebKitPlaybackSessionModelMediaElement should initialize the interface added by setWebPlaybackSessionInterface() with initial data
        https://bugs.webkit.org/show_bug.cgi?id=156996

        Reviewed by Beth Dakin.

        Notify the interface of the current values in the media element when the model is given an interface.

        * platform/cocoa/WebPlaybackSessionModelMediaElement.mm:
        (WebPlaybackSessionModelMediaElement::setWebPlaybackSessionInterface):

2016-04-25  Simon Fraser  <simon.fraser@apple.com>

        Toggling animation-play-state can re-start a finished animation
        https://bugs.webkit.org/show_bug.cgi?id=156731

        Reviewed by Dean Jackson.

        After an animation completed, CompositeAnimation::updateKeyframeAnimations() cleared
        all state that the animation had run on the element, so changing the value of some
        animation property triggered the animation to run again. This is wrong, since animation-name
        still applied to the element.

        Fix by keeping state for keyframe animations in the Done state in the m_keyframeAnimations
        map. This allows for the removal of the index property on KeyframeAnimation.

        Tests: animations/change-completed-animation-transform.html
               animations/change-completed-animation.html

        * page/animation/AnimationBase.cpp:
        (WebCore::AnimationBase::timeToNextService):
        * page/animation/AnimationBase.h:
        (WebCore::AnimationBase::isAnimatingProperty):
        * page/animation/CompositeAnimation.cpp: Add animations that should stick around to AnimationNameMap,
        and swap with m_keyframeAnimations at the end.
        (WebCore::CompositeAnimation::updateKeyframeAnimations):
        * page/animation/KeyframeAnimation.cpp:
        (WebCore::KeyframeAnimation::KeyframeAnimation):
        (WebCore::KeyframeAnimation::getAnimatedStyle):
        * page/animation/KeyframeAnimation.h:

2016-04-25  Alberto Garcia  <berto@igalia.com>

        [GTK] Crashes if DISPLAY is unset
        https://bugs.webkit.org/show_bug.cgi?id=156972

        Reviewed by Carlos Garcia Campos.

        If DISPLAY is unset then m_display will be NULL, crashing WebKit
        when XCloseDisplay is called in the PlatformDisplayX11 destructor.

        * platform/graphics/x11/PlatformDisplayX11.cpp:
        (WebCore::PlatformDisplayX11::~PlatformDisplayX11):

2016-04-25  Ryan Haddad  <ryanhaddad@apple.com>

        Update JS bindings test results after r200037

        Unreviewed test gardening.

        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::jsTestTypedefsPrototypeFunctionFuncWithClamp):

2016-04-25  Simon Fraser  <simon.fraser@apple.com>

        play-state not parsed as part of animation shorthand
        https://bugs.webkit.org/show_bug.cgi?id=156959

        Reviewed by Darin Adler.

        We failed to parse animation-play-state as part of the animation shorthand, contrary
        to the spec and other browsers.

        Fix for both the prefixed and unprefixed properties. There is some compat risk here,
        but only changing unprefixed behavior will probably lead to more author confusion.

        Test: animations/play-state-in-shorthand.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseAnimationShorthand):
        * css/CSSPropertyNames.in:
        * css/StylePropertyShorthand.cpp:
        (WebCore::animationShorthandForParsing): Remove the long comment which is no longer relevant
        now that the behavior has been written into the spec.

2016-04-25  Simon Fraser  <simon.fraser@apple.com>

        Negative animation-delay is treated as 0s
        https://bugs.webkit.org/show_bug.cgi?id=141008

        Reviewed by Daniel Bates.
        
        Fix keyframe animations which start in the paused state.
        
        Explicitly move such animations from the new to the paused state, and
        set m_pauseTime to 0, rather than leaving it at -1. Fix getElapsedTime()
        to compute a correct time elapsed time for such animations, which takes
        negative delay into account correctly.
        
        Fix assertions which need to account for the new transition of New -> PlayStatePaused.

        Test: animations/play-state-start-paused.html

        * page/animation/AnimationBase.cpp:
        (WebCore::AnimationBase::updateStateMachine):
        (WebCore::AnimationBase::getElapsedTime):
        * page/animation/KeyframeAnimation.cpp:
        (WebCore::KeyframeAnimation::animate):

2016-04-25  Antti Koivisto  <antti@apple.com>

        Inline RenderStyle into RenderElement
        https://bugs.webkit.org/show_bug.cgi?id=156981

        Reviewed by Andreas Kling.

        We can save memory and reduce indirection of style access by inlining RenderStyle to RenderElement.

        This patch also makes RenderStyle moveable and switches from std::unique_ptr<RenderStyle> to RenderStyle&&
        in many places where ownership is passed.

        * Modules/plugins/PluginReplacement.h:
        (WebCore::PluginReplacement::scriptObject):
        (WebCore::PluginReplacement::willCreateRenderer):
        * Modules/plugins/QuickTimePluginReplacement.h:
        * Modules/plugins/QuickTimePluginReplacement.mm:
        (WebCore::QuickTimePluginReplacement::~QuickTimePluginReplacement):
        (WebCore::QuickTimePluginReplacement::createElementRenderer):
        * Modules/plugins/YouTubePluginReplacement.cpp:
        (WebCore::YouTubePluginReplacement::YouTubePluginReplacement):
        (WebCore::YouTubePluginReplacement::createElementRenderer):
        * Modules/plugins/YouTubePluginReplacement.h:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::styleForElement):
        (WebCore::StyleResolver::styleForKeyframe):
        (WebCore::StyleResolver::pseudoStyleForElement):
        (WebCore::StyleResolver::styleForPage):
        (WebCore::StyleResolver::defaultStyleForElement):
        (WebCore::StyleResolver::addToMatchedPropertiesCache):
        (WebCore::StyleResolver::applyPropertyToStyle):
        * dom/Document.cpp:
        (WebCore::Document::recalcStyle):
        (WebCore::Document::webkitWillEnterFullScreenForElement):
        (WebCore::Document::setFullScreenRenderer):
        * dom/Element.cpp:
        (WebCore::Element::rendererIsNeeded):
        (WebCore::Element::createElementRenderer):
        * dom/Element.h:
        (WebCore::Element::copyNonAttributePropertiesFromElement):
        * dom/PseudoElement.cpp:
        (WebCore::PseudoElement::resolveCustomStyle):
        (WebCore::PseudoElement::didAttachRenderers):
        (WebCore::PseudoElement::didRecalcStyle):
        * html/BaseButtonInputType.cpp:
        (WebCore::BaseButtonInputType::appendFormData):
        (WebCore::BaseButtonInputType::createInputRenderer):
        * html/BaseButtonInputType.h:
        * html/FileInputType.cpp:
        (WebCore::FileInputType::handleDOMActivateEvent):
        (WebCore::FileInputType::createInputRenderer):
        * html/FileInputType.h:
        * html/HTMLAppletElement.cpp:
        (WebCore::HTMLAppletElement::rendererIsNeeded):
        (WebCore::HTMLAppletElement::createElementRenderer):

        ...

2016-04-25  Eric Carlson  <eric.carlson@apple.com>

        Stop listening for "media can start" notifications when media player is cleared
        https://bugs.webkit.org/show_bug.cgi?id=156985
        <rdar://problem/23158505>

        Reviewed by Jer Noble.

        No new tests, I have not been able to create a test that reliably reproduces this.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadInternal): Add logging.
        (WebCore::HTMLMediaElement::selectMediaResource): Assert and return early if there is
          no media player.
        (WebCore::HTMLMediaElement::clearMediaPlayer): Stop listening for can start notifications.
        (WebCore::HTMLMediaElement::visibilityStateChanged): Add logging.
        (WebCore::HTMLMediaElement::mediaCanStart): Ditto.

2016-04-25  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Specify default values for parameters of type 'unsigned short'
        https://bugs.webkit.org/show_bug.cgi?id=156967

        Reviewed by Darin Adler.

        Specify default values for parameters of type 'unsigned short' and let
        the bindings generator use WTF::Optional<> for the ones without a
        default value.

        * bindings/scripts/CodeGeneratorJS.pm:
        (CanUseWTFOptionalForParameter):
        (GenerateParametersCheck):
        * testing/Internals.cpp:
        (WebCore::Internals::layerTreeAsText): Deleted.
        (WebCore::Internals::displayListForElement): Deleted.
        (WebCore::Internals::replayDisplayListForElement): Deleted.
        * testing/Internals.h:
        * testing/Internals.idl:

2016-04-25  Per Arne Vollan  <peavo@outlook.com>

        [Win][IndexedDB] Fix build errors.
        https://bugs.webkit.org/show_bug.cgi?id=156713

        Reviewed by Alex Christensen.

        Fix compile and link errors when building with IndexedDB enabled.

        * Modules/indexeddb/IDBCursor.h:
        * Modules/indexeddb/IDBTransaction.cpp:
        * Modules/indexeddb/server/MemoryBackingStoreTransaction.h:
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:
        * PlatformWin.cmake:
        * platform/win/FileSystemWin.cpp:
        (WebCore::hardLinkOrCopyFile):

2016-04-25  Brady Eidson  <beidson@apple.com>

        Implement latest File object spec (including its constructor).
        https://bugs.webkit.org/show_bug.cgi?id=156511

        Reviewed by Darin Adler.

        Test: fast/files/file-constructor.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        * bindings/js/JSDictionary.h:

        * bindings/js/JSFileCustom.cpp: Added.
        (WebCore::constructJSFile):

        * fileapi/File.cpp:
        (WebCore::File::File):
        (WebCore::File::lastModified):
        (WebCore::File::lastModifiedDate): Deleted.
        * fileapi/File.h:
        * fileapi/File.idl:



2016-04-25  Antti Koivisto  <antti@apple.com>

        REGRESSION(r156846): Crashes with guard malloc
        https://bugs.webkit.org/show_bug.cgi?id=156984

        Reviewed by Andreas Kling.

        RenderElement::cachedFirstLineStyle() returns pointer to local std::unique_ptr.

        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::uncachedFirstLineStyle):
        (WebCore::RenderElement::cachedFirstLineStyle):
        (WebCore::RenderElement::firstLineStyle):
        (WebCore::firstLineStyleForCachedUncachedType): Deleted.

            Don't try to use a single function for the cached and uncached cases. Separate the cases into the calling functions.

2016-04-25  Daniel Bates  <dabates@apple.com>

        REGRESSION (r196012): Subresource may be blocked by Content Security Policy if it only matches 'self'
        https://bugs.webkit.org/show_bug.cgi?id=156935
        <rdar://problem/25351286>

        Reviewed by Darin Adler.

        Fixes an issue where subresource load may be blocked by the Content Security Policy (CSP) if its URL only
        matched 'self'. In particular, the load would be blocked if initiated from a document that inherited the
        origin of its owner document (e.g. the document contained in <iframe src="about:blank"></iframe>).

        Following r196012 we compute and cache 'self' and its protocol on instantiation of a ContentSecurityPolicy
        object for use when matching a URL against it. These cached values become out-of-date if the document
        subsequently inherits the origin of its owner document. Therefore matches against 'self' will fail and
        CSP will block a load if its not otherwise allowed by the policy. Previously we would compute 'self' when
        parsing the definition of a source list and compute the protocol for 'self' each time we tried to match a
        URL against 'self'. So, 'self' would always be up-to-date with respect to the origin of the document.

        Tests: http/tests/security/contentSecurityPolicy/iframe-blank-url-programmatically-add-external-script.html
               http/tests/security/contentSecurityPolicy/iframe-srcdoc-external-script.html

        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy): Extract out logic for computing and caching
        'self' and its protocol into ContentSecurityPolicy::updateSourceSelf() and make use of this function.
        (WebCore::ContentSecurityPolicy::updateSourceSelf): Computes and caches 'self' and its protocol with
        respect to the specified SecurityOrigin.
        (WebCore::ContentSecurityPolicy::applyPolicyToScriptExecutionContext): Call ContentSecurityPolicy::updateSourceSelf()
        to ensure that we have an up-to-date representation for 'self' and the protocol of 'self' which can
        become out-of-date if the document inherited the origin of its owner document.
        * page/csp/ContentSecurityPolicy.h:

2016-04-25  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Drop [UsePointersEvenForNonNullableObjectArguments] from TextTrack
        https://bugs.webkit.org/show_bug.cgi?id=156899

        Reviewed by Chris Dumez.

        No behavior changes.

        * html/track/TextTrack.idl: Marking cue and region parameter as nullable.
        Also marking cues and activeCues as nullable attributes.

2016-04-25  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Drop [UsePointersEvenForNonNullableObjectArguments] from File API interfaces
        https://bugs.webkit.org/show_bug.cgi?id=156898

        Reviewed by Chris Dumez.

        Making FileReaderSync API API throwing a TypeError in case of null parameters, in lieu of a NOT_FOUND_ERR.
        Making FileReader API taking nullable parameters as a temporary fix.

        Test: fast/files/workers/worker-file-reader-sync-bad-parameter.html

        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::processOutgoingFrameQueue): Updated to cope with FileReaderLoader::start taking a Blob&.
        * fileapi/FileReader.cpp:
        (WebCore::FileReader::readAsArrayBuffer): Updated to cope with readInternal taking a Blob&.
        (WebCore::FileReader::readAsBinaryString): Ditto.
        (WebCore::FileReader::readAsText): Ditto.
        (WebCore::FileReader::readAsDataURL): Ditto.
        (WebCore::FileReader::readInternal):  Updated to cope with FileReaderLoader::start taking a Blob&.
        * fileapi/FileReader.h:
        * fileapi/FileReader.idl: Marking the readXX methods as taking a nullable blob parameter to keep compatibility, at least temporarily.
        * fileapi/FileReaderLoader.cpp:
        (WebCore::FileReaderLoader::start): It now takes a Blob& as input.
        * fileapi/FileReaderLoader.h:
        * fileapi/FileReaderSync.cpp:
        (WebCore::FileReaderSync::readAsArrayBuffer): Taking a Blob& as input.
        (WebCore::FileReaderSync::readAsBinaryString): Ditto.
        (WebCore::FileReaderSync::readAsText): Ditto.
        (WebCore::FileReaderSync::readAsDataURL): Ditto.
        (WebCore::FileReaderSync::startLoading) Ditto.
        * fileapi/FileReaderSync.h:
        (WebCore::FileReaderSync::readAsText): Ditto.
        * fileapi/FileReaderSync.idl:

2016-04-25  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Fix grid-template-columns|rows computed style with content alignment
        https://bugs.webkit.org/show_bug.cgi?id=156793

        Reviewed by Darin Adler.

        Computed style of grid-template-columns and grid-template-rows properties
        was including the distribution offset because of content alignment.
        We should subtract that offset, like we do for the case of gaps,
        when we're calculating the computed style.

        Test: fast/css-grid-layout/grid-template-columns-rows-computed-style-gaps-content-alignment.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::valueForGridTrackList):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::offsetBetweenTracks):
        (WebCore::RenderGrid::populateGridPositions): Deleted FIXME.
        * rendering/RenderGrid.h:

2016-04-25  Frederic Wang  <fwang@igalia.com>

        Refactor RenderMathMLMenclose.
        https://bugs.webkit.org/show_bug.cgi?id=155019

        Reviewed by Sergio Villar Senin.

        Tests: mathml/presentation/menclose-notation-equivalence.html
               mathml/presentation/menclose-notation-values.html

        We rewrite RenderMathMLMenclose so that layout functions correctly override the
        behavior of RenderMathMLRow. We try and rely on the draft  of the MathML in HTML5
        implementation note, to make easier to get consistency with other rendering engines
        in the future. All notations are now drawn with GraphicContext functions instead of
        mixing them with CSS style. To save memory space, the list of known notations are
        now saved on a short integer using bit masks instead of a vector of string names.
        Finally, we remove support for the radical notation so that we no longer need to
        create an anonymous RenderMathMLRoot.

        * mathml/MathMLMencloseElement.cpp: Remove code for some special notations and just
        reimplement parsing of the notation attribute.
        (WebCore::MathMLMencloseElement::MathMLMencloseElement): By default, the notation is longdiv.
        (WebCore::MathMLMencloseElement::parseAttribute): By default, the list of notation is empty.
        If there is no notation attribute, the default value longdiv is used.
        Otherwise, we parse the notation attribute and add each notation, using some equivalences
        for box, actuarial and madruwb.
        (WebCore::MathMLMencloseElement::isPresentationAttribute): Deleted. No need to define
        specific style for some notation.
        (WebCore::MathMLMencloseElement::finishParsingChildren): Deleted. No need to add an
        anonymous square root.
        (WebCore::MathMLMencloseElement::collectStyleForPresentationAttribute): Deleted. No need to
        define specific style for some notation.
        (WebCore::MathMLMencloseElement::longDivLeftPadding): Deleted. RenderMathMLMenclose uses an
        arbitrary size instead of measure a glyph.
        * mathml/MathMLMencloseElement.h: Define simple bit mask for each notation, add a short
        integer to store the list of notations together with helper functions. Remove old code.
        * rendering/mathml/RenderMathMLMenclose.cpp: Rewrite RenderMathMLMenclose so that layout
        functions correctly override the behavior of RenderMathMLRow.
        (WebCore::RenderMathMLMenclose::RenderMathMLMenclose): Init m_ascent to 0.
        (WebCore::RenderMathMLMenclose::ruleThickness): For now, we use the fallback value used by
        for other bars. We may refine that in the future.
        (WebCore::RenderMathMLMenclose::getSpaceAroundContent): Helper function to retrieve the
        space to add around the content, depending on the notations specified. Note that for
        notation circle, this spacing depends on the content size.
        (WebCore::RenderMathMLMenclose::computePreferredLogicalWidths): Reimplement this function.
        This is just adding left/right spacing around the content.
        (WebCore::RenderMathMLMenclose::layoutBlock): Reimplement this function. We do the normal
        RenderMathMLRow layout, adjust spacing and child position and
        calculate m_ascent and m_contentRect.
        (WebCore::RenderMathMLMenclose::firstLineBaseline): Implement this function.
        We just return m_ascent.
        (WebCore::drawLine): Helper function to draw a line using strokePath.
        (WebCore::RenderMathMLMenclose::paint): We reimplement this function to draw
        all notations using GraphicContext.
        (WebCore::RenderMathMLMenclose::addChild): Deleted. No need to manage anonymous renderers.
        (WebCore::RenderMathMLMenclose::updateLogicalHeight): Deleted. Height is now calculated
        in layoutBlock.
        (WebCore::RenderMathMLMenclose::checkNotationalValuesValidity): Deleted.
        * rendering/mathml/RenderMathMLMenclose.h: Update member definitions.
        * rendering/mathml/RenderMathMLRoot.cpp: We no longer need anonymous roots.
        (WebCore::RenderMathMLRoot::RenderMathMLRoot): Deleted.
        * rendering/mathml/RenderMathMLRoot.h: We no longer need anonymous roots.
        * rendering/mathml/RenderMathMLRow.cpp: Allow to get the exact metrics of the chid row,
        for use in RenderMathMLRoot.
        (WebCore::RenderMathMLRow::computeLineVerticalStretch): rename parameters.
        (WebCore::RenderMathMLRow::layoutRowItems): Set parameters to the final ascent, descent and
        logical width of the chid row. Set the temporary logical width for RenderMathMenclose before
        laying the children out.
        (WebCore::RenderMathMLRow::layoutBlock): Rename parameters ; add a dummy logicalWidth
        parameter.
        * rendering/mathml/RenderMathMLRow.h: Make some functions accessible or overridable by
        RenderMathMLRoot. Make layoutRowItems return the final ascent, descent and logical width
        after the chid row is laid out.
        * rendering/mathml/RenderMathMLSquareRoot.cpp: We no longer need anonymous roots.
        (WebCore::RenderMathMLSquareRoot::RenderMathMLSquareRoot): Deleted.
        (WebCore::RenderMathMLSquareRoot::createAnonymousWithParentRenderer): Deleted.
        * rendering/mathml/RenderMathMLSquareRoot.h: We no longer need anonymous roots.

2016-04-25  Frederic Wang  <fwang@igalia.com>

        Minor refactoring in RenderMathMLOperator
        https://bugs.webkit.org/show_bug.cgi?id=156906

        Reviewed by Martin Robinson.

        No new tests, this is only minor refactoring that does not change the behavior.

        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::getGlyphAssemblyFallBack):
        We rename the "state" integer to an "expected" enum indicating the next expected part.
        (WebCore::RenderMathMLOperator::paintGlyph): We add a missing dot at the end of a sequence.
        We also replace ceil(x+1) with ceil(x)+1 to get rid of the temporary variable.

2016-04-24  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Specify default values for boolean parameters
        https://bugs.webkit.org/show_bug.cgi?id=156964

        Reviewed by Darin Adler.

        Specify default values for boolean parameters in our IDL files and
        let the bindings generator use WTF::Optional<> for the ones without
        a default value.

        * CMakeLists.txt:
        * Modules/indexeddb/IDBKeyRange.cpp:
        * Modules/indexeddb/IDBKeyRange.h:
        * Modules/indexeddb/IDBKeyRange.idl:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:

        * bindings/js/JSDOMTokenListCustom.cpp: Removed.
        We no longer need these custom bindings as the bindings generator
        will now provide the implementation with an Optional<bool>, given
        that the parameter has no default value.

        * bindings/scripts/CodeGeneratorJS.pm:
        (CanUseWTFOptionalForParameterType): Deleted.
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_method_with_optional_boolean):
        (webkit_dom_test_obj_method_with_optional_boolean_is_false):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalBoolean):
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalBooleanIsFalse):
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj methodWithOptionalBoolean:]):
        (-[DOMTestObj methodWithOptionalBooleanIsFalse:]):
        * bindings/scripts/test/TestObj.idl:
        * dom/Document.h:
        * dom/Document.idl:
        * dom/Element.idl:
        * dom/EventTarget.idl:
        * html/DOMTokenList.idl:

2016-04-24  Chris Dumez  <cdumez@apple.com>

        Autogenerated IDBFactory.open() does the wrong thing if you pass an explicit 'undefined' as the second argument
        https://bugs.webkit.org/show_bug.cgi?id=156939

        Reviewed by Darin Adler.

        As per WebIDL, if undefined is passed by JS for an optional parameter then
        we should use its default value if it has one, or use the special value
        "missing":
        http://heycam.github.io/webidl/#es-overloads (step 10.4)

        Our bindings generator was already mapping undefined to the parameter's
        default value when present. However, it was missing the notion of
        "missing" value when there no default value. This patch adds supports
        for its by passing Optional<>(Nullopt) to the implementation in such
        case. This means that the implementation will need to use WTF::Optional<>
        type for parameters that do not have a default value. Thankfully though,
        in most cases, we will be able to specify a default value in the IDL
        so cases where we will need to use WTF::Optional<> will actually be
        rare.

        To avoid having to do too much refactoring in this patch, the support
        for WTF::Optional is currently blacklisted for most IDL types. I will
        gradually stop blacklisting each type in follow-up patches, as I either:
        - Add default parameter values in our IDL (preferred)
        - Use WTF::Optional<> in our implementation (when we cannot specify a
          default value).

        This patch fixes a bug with IDBFactory.open()'s second parameter (version)
        for which undefined should not throw and indicate that the version
        should not be changed. We now use WTF::Optional in the implementation to
        distinguish this case and not throw.

        No new tests, existing tests were updated / rebaselined.

        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::open):
        (WebCore::IDBFactory::openInternal): Deleted.
        * Modules/indexeddb/IDBFactory.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (ShouldUseWTFOptionalForParameterType):
        (GenerateParametersCheck):
        * fileapi/Blob.idl:
        * inspector/InspectorIndexedDBAgent.cpp:

2016-04-23  Chris Dumez  <cdumez@apple.com>

        [WebIDL] Drop [Default] WebKit-IDL extended attribute
        https://bugs.webkit.org/show_bug.cgi?id=156955

        Reviewed by Darin Adler.

        Drop [Default] WebKit-IDL extended attribute in favor of the standard
        WebIDL syntax for parameters' default value.

        Here is what it looks like:
        [Default=NullString] optional DOMString a -> optional DOMString a = null
        [Default=NullString] optional DOMString? a -> optional DOMString? a = null
        [Default=Undefined] optional DOMString a -> optional DOMString a = "undefined"
        [Default=Undefined] optional DOMString? a -> optional DOMString? a = null
        [Default=Undefined] optional long a -> optional long a = 0
        [Default=Undefined] optional bool a -> optional bool a = false
        [Default=Undefined] optional unrestricted double a -> optional unrestricted double a = NaN
        [Default=Undefined] optional unrestricted float a -> optional unrestricted float a = NaN
        [Default=Undefined] optional sequence<DOMString> a -> optional sequence<DOMString> a = []

        These do not cause any Web-Exposed behavior change. However, when getting
        rid of [Default] started passing more parameters by derefence instead of
        pointer (as is expected for parameters not marked as nullable). As a result,
        I had to mark a few parameters as nullable in the IDL to maintain the
        previous behavior. In some cases, the implementation was already throwing
        when passing null. In such cases, I have not marked the type as nullable
        so that the generated bindings now throw the exception instead of our
        implementation code. In some cases, the exception being thrown is now
        different. This is why some of the layout tests had to be rebaselined.

        No new tests, existing tests have been rebaselined. No significant Web
        exposed behavior change is expected from this patch, beside exceptions
        type sometimes being different.

        * Modules/encryptedmedia/MediaKeys.idl:
        * Modules/fetch/FetchRequest.idl:
        * Modules/gamepad/deprecated/GamepadList.idl:
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/mediastream/RTCStatsResponse.idl:
        * Modules/notifications/Notification.idl:
        * Modules/speech/SpeechSynthesisUtterance.idl:
        * Modules/webaudio/AudioNode.idl:
        * Modules/websockets/WebSocket.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/IDLParser.pm:
        (parseDefault):
        (parseDefaultValue):
        * bindings/scripts/test/TestInterface.idl:
        * bindings/scripts/test/TestNamedConstructor.idl:
        * bindings/scripts/test/TestObj.idl:
        * bindings/scripts/test/TestOverrideBuiltins.idl:
        * css/CSSKeyframesRule.idl:
        * css/CSSMediaRule.idl:
        * css/CSSPrimitiveValue.idl:
        * css/CSSRuleList.idl:
        * css/CSSStyleDeclaration.idl:
        * css/CSSStyleSheet.idl:
        * css/CSSSupportsRule.idl:
        * css/CSSValueList.idl:
        * css/MediaList.idl:
        * css/MediaQueryList.idl:
        * css/MediaQueryListListener.idl:
        * css/StyleMedia.idl:
        * css/StyleSheetList.idl:
        * css/WebKitCSSFilterValue.idl:
        * css/WebKitCSSMatrix.idl:
        * css/WebKitCSSTransformValue.idl:
        * dom/ClientRectList.idl:
        * dom/Comment.idl:
        * dom/CompositionEvent.idl:
        * dom/CustomEvent.h:
        * dom/CustomEvent.idl:
        * dom/DOMImplementation.idl:
        * dom/DOMStringList.idl:
        * dom/DataTransferItem.idl:
        * dom/DataTransferItemList.idl:
        * dom/DeviceMotionEvent.idl:
        * dom/DeviceOrientationEvent.idl:
        * dom/Document.cpp:
        (WebCore::Document::adoptNode):
        * dom/Document.idl:
        * dom/Element.cpp:
        (WebCore::Element::setAttributeNode):
        (WebCore::Element::setAttributeNodeNS):
        (WebCore::Element::removeAttributeNode):
        (WebCore::Element::parseAttributeName): Deleted.
        * dom/Element.h:
        * dom/Element.idl:
        * dom/Event.idl:
        * dom/HashChangeEvent.idl:
        * dom/KeyboardEvent.idl:
        * dom/MessageEvent.idl:
        * dom/MouseEvent.idl:
        * dom/MutationEvent.idl:
        * dom/NamedNodeMap.cpp:
        (WebCore::NamedNodeMap::setNamedItem):
        (WebCore::NamedNodeMap::setNamedItemNS):
        (WebCore::NamedNodeMap::item): Deleted.
        * dom/NamedNodeMap.h:
        * dom/NamedNodeMap.idl:
        * dom/Node.idl:
        * dom/NodeFilter.idl:
        * dom/NonElementParentNode.idl:
        * dom/OverflowEvent.idl:
        * dom/Range.idl:
        * dom/Text.idl:
        * dom/TextEvent.idl:
        * dom/TouchEvent.idl:
        * dom/UIEvent.idl:
        * dom/WheelEvent.idl:
        * html/DOMFormData.idl:
        * html/HTMLAllCollection.idl:
        * html/HTMLAudioElement.idl:
        * html/HTMLCanvasElement.idl:
        * html/HTMLCollection.idl:
        * html/HTMLDocument.idl:
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::insertAdjacentElement):
        (WebCore::contextElementForInsertion): Deleted.
        * html/HTMLElement.h:
        * html/HTMLElement.idl:
        * html/HTMLFormControlsCollection.idl:
        * html/HTMLInputElement.idl:
        * html/HTMLMediaElement.idl:
        * html/HTMLOptionElement.idl:
        * html/HTMLOptionsCollection.idl:
        * html/HTMLSelectElement.idl:
        * html/HTMLTableElement.idl:
        * html/HTMLTableRowElement.idl:
        * html/HTMLTableSectionElement.idl:
        * html/HTMLTextAreaElement.idl:
        * html/ImageData.idl:
        * html/canvas/CanvasGradient.idl:
        * html/canvas/CanvasRenderingContext2D.idl:
        * html/canvas/DOMPath.idl:
        * html/canvas/OESVertexArrayObject.idl:
        * page/DOMSelection.cpp:
        (WebCore::DOMSelection::extend):
        (WebCore::DOMSelection::getRangeAt): Deleted.
        * page/DOMSelection.h:
        * page/DOMSelection.idl:
        * page/DOMWindow.idl:
        * page/History.idl:
        * page/Performance.idl:
        * page/WindowTimers.idl:
        * plugins/DOMMimeTypeArray.idl:
        * plugins/DOMPlugin.idl:
        * plugins/DOMPluginArray.idl:
        * storage/StorageEvent.idl:
        * svg/SVGAnimationElement.idl:
        * svg/SVGDocument.idl:
        * svg/SVGElement.idl:
        * svg/SVGFEDropShadowElement.idl:
        * svg/SVGFEGaussianBlurElement.idl:
        * svg/SVGFEMorphologyElement.idl:
        * svg/SVGFilterElement.idl:
        * svg/SVGGraphicsElement.idl:
        * svg/SVGMarkerElement.idl:
        * svg/SVGPathElement.idl:
        * svg/SVGSVGElement.idl:
        * svg/SVGTests.idl:
        * svg/SVGTextContentElement.idl:
        * xml/DOMParser.idl:
        * xml/XMLSerializer.cpp:
        (WebCore::XMLSerializer::serializeToString):
        * xml/XMLSerializer.h:
        * xml/XMLSerializer.idl:
        * xml/XPathEvaluator.idl:
        * xml/XPathExpression.idl:
        * xml/XPathNSResolver.idl:
        * xml/XPathResult.idl:
        * xml/XSLTProcessor.idl:

2016-04-24  Antti Koivisto  <antti@apple.com>

        RenderStyle should not be reference counted
        https://bugs.webkit.org/show_bug.cgi?id=156846

        Reviewed by Andreas Kling.

        RenderStyle reference counts its substructures. We no longer share RenderStyle objects between normal renderers
        so there is no reason to refcount the RenderStyles themselves too. Making it a non-refcounted type clarifies
        ownership relations, reduces branchiness and saves some memory.

        This patches switches mostly mechanically from Ref/RefPtr<RenderStyle> to std::unique_ptr<RenderStyle>. In
        the future RenderStyle can be given regular value semantics.

        * Modules/plugins/PluginReplacement.h:
        (WebCore::PluginReplacement::scriptObject):
        (WebCore::PluginReplacement::willCreateRenderer):
        * Modules/plugins/QuickTimePluginReplacement.h:
        * Modules/plugins/QuickTimePluginReplacement.mm:
        (WebCore::QuickTimePluginReplacement::~QuickTimePluginReplacement):
        (WebCore::QuickTimePluginReplacement::createElementRenderer):
        * Modules/plugins/YouTubePluginReplacement.cpp:
        (WebCore::YouTubePluginReplacement::YouTubePluginReplacement):
        (WebCore::YouTubePluginReplacement::createElementRenderer):
        * Modules/plugins/YouTubePluginReplacement.h:
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::getFontSizeCSSValuePreferringKeyword):
        (WebCore::ComputedStyleExtractor::useFixedFontDefaultSize):
        (WebCore::updateStyleIfNeededForNode):
        (WebCore::computeRenderStyleForProperty):
        (WebCore::ComputedStyleExtractor::customPropertyValue):
        (WebCore::ComputedStyleExtractor::propertyValue):
        * css/MediaQueryEvaluator.cpp:
        (WebCore::MediaQueryEvaluator::MediaQueryEvaluator):
        (WebCore::MediaQueryEvaluator::eval):
        * css/MediaQueryEvaluator.h:

            Clarify in code that MediaQueryEvaluator does not own the style.

        * css/MediaQueryMatcher.cpp:
        (WebCore::MediaQueryMatcher::mediaType):
        (WebCore::MediaQueryMatcher::documentElementUserAgentStyle):
        (WebCore::MediaQueryMatcher::evaluate):
        (WebCore::MediaQueryMatcher::matchMedia):
        (WebCore::MediaQueryMatcher::styleResolverChanged):
        (WebCore::MediaQueryMatcher::prepareEvaluator): Deleted.
        * css/MediaQueryMatcher.h:
        * css/StyleMedia.cpp:
        (WebCore::StyleMedia::matchMedium):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::State::clear):
        (WebCore::StyleResolver::State::updateConversionData):
        (WebCore::StyleResolver::State::setStyle):
        (WebCore::StyleResolver::State::setParentStyle):

            State owns the style explicitly set by setParentStyle but not the one given via constructor.

        (WebCore::isAtShadowBoundary):
        (WebCore::StyleResolver::styleForElement):
        (WebCore::StyleResolver::styleForKeyframe):
        (WebCore::StyleResolver::keyframeStylesForAnimation):
        (WebCore::StyleResolver::pseudoStyleForElement):
        (WebCore::StyleResolver::styleForPage):
        (WebCore::StyleResolver::defaultStyleForElement):
        (WebCore::StyleResolver::applyMatchedProperties):
        (WebCore::StyleResolver::applyPropertyToStyle):
        * css/StyleResolver.h:
        (WebCore::ElementStyle::ElementStyle):
        (WebCore::StyleResolver::style):
        (WebCore::StyleResolver::parentStyle):
        (WebCore::StyleResolver::setOverrideDocumentElementStyle):
        (WebCore::StyleResolver::State::document):
        (WebCore::StyleResolver::State::element):
        (WebCore::StyleResolver::State::style):
        (WebCore::StyleResolver::State::takeStyle):
        (WebCore::StyleResolver::State::parentStyle):
        (WebCore::StyleResolver::State::rootElementStyle):
        (WebCore::StyleResolver::State::regionForStyling):
        (WebCore::StyleResolver::State::setParentStyle): Deleted.
        * dom/Document.cpp:
        (WebCore::Document::recalcStyle):
        (WebCore::Document::updateLayoutIgnorePendingStylesheets):
        (WebCore::Document::styleForElementIgnoringPendingStylesheets):
        (WebCore::Document::isPageBoxVisible):
        (WebCore::Document::pageSizeAndMarginsInPixels):
        (WebCore::Document::addAutoSizingNode):
        (WebCore::Document::validateAutoSizingNodes):
        (WebCore::Document::resetAutoSizingNodes):
        (WebCore::Document::setFullScreenRenderer):
        * dom/Document.h:
        * dom/Element.cpp:
        (WebCore::Element::rendererIsNeeded):
        (WebCore::Element::createElementRenderer):
        (WebCore::Element::resolveComputedStyle):
        * dom/Element.h:
        (WebCore::Element::copyNonAttributePropertiesFromElement):
        * dom/ElementRareData.h:

        ...

        * page/animation/AnimationBase.h:
        * page/animation/AnimationController.cpp:
        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
        (WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
        (WebCore::AnimationControllerPrivate::computeExtentOfAnimation):
        (WebCore::AnimationController::cancelAnimations):
        (WebCore::AnimationController::updateAnimations):

            std::unique_ptr<RenderStyle& animatedStyle argument is now expected no be initially null and
            is only set if a new style is created.

        (WebCore::AnimationController::getAnimatedStyleForRenderer):
        * page/animation/AnimationController.h:
        * page/animation/AnimationControllerPrivate.h:
        * page/animation/CompositeAnimation.cpp:
        (WebCore::CompositeAnimation::updateTransitions):
        (WebCore::CompositeAnimation::updateKeyframeAnimations):
        (WebCore::CompositeAnimation::animate):
        (WebCore::CompositeAnimation::getAnimatedStyle):
        * page/animation/CompositeAnimation.h:
        * page/animation/ImplicitAnimation.cpp:
        (WebCore::ImplicitAnimation::ImplicitAnimation):
        (WebCore::ImplicitAnimation::shouldSendEventForListener):
        (WebCore::ImplicitAnimation::animate):
        (WebCore::ImplicitAnimation::getAnimatedStyle):
        (WebCore::ImplicitAnimation::onAnimationEnd):
        (WebCore::ImplicitAnimation::reset):
        * page/animation/ImplicitAnimation.h:
        * page/animation/KeyframeAnimation.cpp:
        (WebCore::KeyframeAnimation::KeyframeAnimation):
        (WebCore::KeyframeAnimation::fetchIntervalEndpointsForProperty):
        (WebCore::KeyframeAnimation::animate):
        (WebCore::KeyframeAnimation::getAnimatedStyle):
        * page/animation/KeyframeAnimation.h:
        * rendering/RenderAttachment.cpp:
        (WebCore::RenderAttachment::RenderAttachment):
        * rendering/RenderAttachment.h:
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::RenderBlock):
        (WebCore::RenderBlock::styleDidChange):
        (WebCore::RenderBlock::clone):
        (WebCore::RenderBlock::updateFirstLetterStyle):
        (WebCore::RenderBlock::createFirstLetterRenderer):
        * rendering/RenderBlock.h:
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::MarginInfo::MarginInfo):
        (WebCore::RenderBlockFlow::RenderBlockFlow):
        * rendering/RenderBlockFlow.h:
        * rendering/RenderBox.cpp:
        (WebCore::skipBodyBackground):
        (WebCore::RenderBox::RenderBox):
        * rendering/RenderBox.h:
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::suspendAnimations):
        (WebCore::RenderBoxModelObject::RenderBoxModelObject):
        * rendering/RenderBoxModelObject.h:
        * rendering/RenderButton.cpp:
        (WebCore::RenderButton::RenderButton):
        (WebCore::RenderButton::setupInnerStyle):
        * rendering/RenderButton.h:
        * rendering/RenderCombineText.h:
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::RenderDeprecatedFlexibleBox):
        * rendering/RenderDeprecatedFlexibleBox.h:
        * rendering/RenderDetailsMarker.cpp:
        (WebCore::RenderDetailsMarker::RenderDetailsMarker):
        * rendering/RenderDetailsMarker.h:
        * rendering/RenderElement.cpp:
        (WebCore::controlStatesRendererMap):
        (WebCore::RenderElement::RenderElement):
        (WebCore::RenderElement::~RenderElement):
        (WebCore::RenderElement::createFor):
        (WebCore::firstLineStyleForCachedUncachedType):
        (WebCore::RenderElement::uncachedFirstLineStyle):
        (WebCore::RenderElement::cachedFirstLineStyle):
        (WebCore::RenderElement::initializeStyle):
        (WebCore::RenderElement::setStyle):
        (WebCore::RenderElement::propagateStyleToAnonymousChildren):
        (WebCore::RenderElement::styleDidChange):
        (WebCore::RenderElement::getCachedPseudoStyle):

            Return plain pointer as the cache owns the style.

        (WebCore::RenderElement::getUncachedPseudoStyle):

            return std::unique_ptr<RenderStyle>

        (WebCore::RenderElement::selectionColor):
        (WebCore::RenderElement::selectionPseudoStyle):
        (WebCore::RenderElement::selectionBackgroundColor):
        * rendering/RenderElement.h:
        (WebCore::RenderElement::hasInitializedStyle):
        (WebCore::RenderElement::style):
        (WebCore::RenderElement::element):
        (WebCore::RenderElement::setStyleInternal):
        * rendering/RenderEmbeddedObject.cpp:

        ...

        (WebCore::RenderImage::imageResource):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::RenderInline):
        (WebCore::updateStyleOfAnonymousBlockContinuations):
        (WebCore::RenderInline::styleDidChange):

            Continuations now get their own RenderStyles.

        (WebCore::RenderInline::addChildIgnoringContinuation):
        (WebCore::RenderInline::clone):
        * rendering/RenderInline.h:
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::currentTransform):
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/RenderLayer.h:

        ...

        * rendering/style/KeyframeList.cpp:
        (WebCore::KeyframeList::operator==):
        (WebCore::KeyframeList::insert):

            KeyframeValue is now movable but not copyable type. Adjust accordingly.

        * rendering/style/KeyframeList.h:
        (WebCore::KeyframeValue::KeyframeValue):
        (WebCore::KeyframeValue::setKey):
        (WebCore::KeyframeValue::style):
        (WebCore::KeyframeValue::setStyle):
        (WebCore::KeyframeList::animationName):
        (WebCore::KeyframeList::addProperty):
        (WebCore::KeyframeList::containsProperty):
        * rendering/style/RenderStyle.cpp:
        (WebCore::defaultStyle):
        (WebCore::RenderStyle::create):
        (WebCore::RenderStyle::createDefaultStyle):
        (WebCore::RenderStyle::createAnonymousStyleWithDisplay):
        (WebCore::RenderStyle::clone):
        (WebCore::RenderStyle::createStyleInheritingFromPseudoStyle):

            Return std::unique_ptr<RenderStyle> instead of Ref<RenderStyle>.

        (WebCore::RenderStyle::RenderStyle):
        (WebCore::RenderStyle::~RenderStyle):
        (WebCore::resolveAlignmentData):
        (WebCore::RenderStyle::operator==):
        (WebCore::RenderStyle::hasUniquePseudoStyle):
        (WebCore::RenderStyle::getCachedPseudoStyle):
        (WebCore::RenderStyle::addCachedPseudoStyle):
        (WebCore::RenderStyle::isStyleAvailable): Deleted.
        * rendering/style/RenderStyle.h:
        (WebCore::RenderStyle::setStyleType):
        (WebCore::RenderStyle::cachedPseudoStyles):
        (WebCore::RenderStyle::initialIsolation):
        (WebCore::RenderStyle::isPlaceholderStyle):
        (WebCore::RenderStyle::setIsPlaceholderStyle):

            Add placeholder style bit to rareNonInheritedData. We no longer rely on RenderStyle identity for this test.

        (WebCore::RenderStyle::noninheritedFlagsMemoryOffset):
        * rendering/style/SVGRenderStyle.cpp:
        (WebCore::defaultSVGStyle):
        (WebCore::SVGRenderStyle::createDefaultStyle):
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        (WebCore::StyleRareNonInheritedData::contentDataEquivalent):
        * rendering/style/StyleRareNonInheritedData.h:

        ...

        (WebCore::findRenderingRoot):
        (WebCore::findRenderingRoots):
        (WebCore::RenderTreeUpdater::commit):

            Style::Update is no longer const as we move the styles from it to the render tree.

        (WebCore::pseudoStyleCacheIsInvalid):
        (WebCore::RenderTreeUpdater::updateElementRenderer):
        (WebCore::moveToFlowThreadIfNeeded):
        (WebCore::RenderTreeUpdater::createRenderer):
        (WebCore::RenderTreeUpdater::updateBeforeOrAfterPseudoElement):
        * style/RenderTreeUpdater.h:
        * style/StyleResolveForDocument.cpp:
        (WebCore::Style::resolveForDocument):
        * style/StyleResolveForDocument.h:
        * style/StyleSharingResolver.cpp:
        (WebCore::Style::elementHasDirectionAuto):
        (WebCore::Style::SharingResolver::resolve):
        * style/StyleSharingResolver.h:
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::ensurePlaceholderStyle):

            Set the placeholder.

        (WebCore::Style::TreeResolver::Parent::Parent):
        (WebCore::Style::TreeResolver::pushScope):
        (WebCore::Style::TreeResolver::pushEnclosingScope):
        (WebCore::Style::TreeResolver::popScope):

            Set and clear StyleResolver overrideDocumentElementStyle as needed. It is owned by the TreeResolver.

        (WebCore::Style::TreeResolver::styleForElement):

            Clone the placeholder style.

        (WebCore::Style::TreeResolver::resolveElement):
        (WebCore::Style::TreeResolver::pushParent):
        (WebCore::Style::TreeResolver::resolveComposedTree):
        (WebCore::Style::TreeResolver::resolve):

            Adopt to the std::unique_ptr and ElementStyle move semantics.

        * style/StyleTreeResolver.h:
        (WebCore::Style::TreeResolver::scope):
        * style/StyleUpdate.cpp:
        (WebCore::Style::Update::elementUpdate):
        (WebCore::Style::Update::textUpdate):
        (WebCore::Style::Update::elementStyle):
        (WebCore::Style::Update::addElement):
        (WebCore::Style::Update::addText):
        * style/StyleUpdate.h:
        (WebCore::Style::Update::roots):
        (WebCore::Style::Update::document):
        * svg/SVGAElement.cpp:
        (WebCore::SVGAElement::svgAttributeChanged):
        (WebCore::SVGAElement::createElementRenderer):

        ...

2016-04-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Drop [UsePointersEvenForNonNullableObjectArguments] from MediaControlsHost
        https://bugs.webkit.org/show_bug.cgi?id=156903

        Reviewed by Chris Dumez.

        No change of behavior.

        * Modules/mediacontrols/MediaControlsHost.idl: Marking some parameters as nullable.

2016-04-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Drop [UsePointersEvenForNonNullableObjectArguments] from WebGLRenderingContext
        https://bugs.webkit.org/show_bug.cgi?id=156909

        Reviewed by Chris Dumez.

        No change of behavior.

        Marking a lot of method parameters as nullable.

        * html/canvas/WebGLRenderingContextBase.idl:

2016-04-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Drop [UsePointersEvenForNonNullableObjectArguments] from WebSocket
        https://bugs.webkit.org/show_bug.cgi?id=156897

        Reviewed by Chris Dumez.

        No change of behavior.

        Updating WebSocket::send methods to take references, except for ArrayBufferView, which is not yet supported by the binding generator.

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::send):
        * Modules/websockets/WebSocket.h:
        * Modules/websockets/WebSocket.idl:

2016-04-23  Andy Estes  <aestes@apple.com>

        Fix issues found by the clang static analyzer
        https://bugs.webkit.org/show_bug.cgi?id=156956

        Reviewed by Alexey Proskuryakov.

        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::detectContentInRange): Stored tz in a RetainPtr.
        * platform/cf/KeyedDecoderCF.cpp:
        (WebCore::KeyedDecoderCF::KeyedDecoderCF): If dynamic_cf_cast returned nullptr, the result of
        CFPropertyListCreateWithData would leak. Stored the CFPropertyListRef in a RetainPtr, then leaked/adopted it
        into m_rootDictionary (to avoid retain count churn) if it is a CFDictionary.
        * platform/ios/WebAVPlayerController.mm:
        (-[WebAVPlayerController dealloc]): Released _externalPlaybackAirPlayDeviceLocalizedName.
        (-[WebAVMediaSelectionOption dealloc]): Added to release _localizedDisplayName.
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (-[WebAVPlayerLayer dealloc]): Released _pixelBufferAttributes.
        * platform/network/cocoa/WebCoreNSURLSession.h: Removed the readwrite attributes from properties, since
        properties are readwrite by default.
        * platform/network/cocoa/WebCoreNSURLSession.mm: Removed @dynamic, which isn't necessary just for defining a custom getter.
        (-[WebCoreNSURLSessionDataTask dealloc]): Added to release copied ivars.

2016-04-23  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/25894586> A project has failed to build because WTF_MAKE_FAST_ALLOCATED was not defined

        Rubber-stamped by Chris Dumez.

        Reverted the IntSize part of r199735, to let IntSize.h keep being used in another project.

        * platform/graphics/IntSize.h:
        (WebCore::IntSize::IntSize):

2016-04-23  Chris Dumez  <cdumez@apple.com>

        Tie the DiagnosticLoggingClient's lifetime to the Page
        https://bugs.webkit.org/show_bug.cgi?id=156938
        <rdar://problem/25851499>

        Reviewed by Antti Koivisto.

        Tie the DiagnosticLoggingClient's lifetime to the Page rather than to the
        MainFrame. The diagnostic logging client in WebKit2 requires the WebPage
        to be alive in order to send IPC to the UIProcess. The WebPage owns the
        Page and Page is not refCounted so the lifetime of the
        DiagnosticLoggingClient should now be tied to the one of the WebPage as
        well.

        Previously, the DiagnosticLoggingClient would stay alive as long as the
        MainFrame and could apparently in rare cases outlive the WebPage, thus
        crashing when trying to send the IPC.

        * history/PageCache.cpp:
        (WebCore::logPageCacheFailureDiagnosticMessage):
        (WebCore::canCachePage):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadResource):
        (WebCore::logMediaLoadRequest):
        (WebCore::HTMLMediaElement::updatePlayState):
        (WebCore::HTMLMediaElement::mediaPlayerEngineFailedToLoad):
        * loader/EmptyClients.h:
        * loader/FrameLoader.cpp:
        (WebCore::logNavigation):
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
        * loader/ResourceLoader.cpp:
        (WebCore::logResourceResponseSource):
        * loader/SubframeLoader.cpp:
        (WebCore::logPluginRequest):
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::willSendRequestInternal):
        (WebCore::SubresourceLoader::didReceiveResponse):
        (WebCore::logResourceLoaded):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::logMemoryCacheResourceRequest):
        (WebCore::logResourceRevalidationDecision):
        * page/DiagnosticLoggingClient.h:
        * page/MainFrame.cpp:
        (WebCore::MainFrame::MainFrame): Deleted.
        (WebCore::MainFrame::~MainFrame): Deleted.
        (WebCore::MainFrame::diagnosticLoggingClient): Deleted.
        * page/MainFrame.h:
        * page/Page.cpp:
        (WebCore::Page::Page):
        (WebCore::Page::~Page):
        (WebCore::Page::diagnosticLoggingClient):
        * page/Page.h:

2016-04-22  Chris Dumez  <cdumez@apple.com>

        Cannot access the SQLTransaction.constructor.prototype
        https://bugs.webkit.org/show_bug.cgi?id=156613

        Reviewed by Darin Adler.

        Drop [NoInterfaceObject] from the following SQL interfaces:
        Database, SQLError, SQLResultSet, SQLResultSetRowList and SQLTransaction.

        This matches the specification:
        https://dev.w3.org/html5/webdatabase/

        This was causing the 'constructor' property to be wrong for these
        interfaces as it would be a generic Object.

        Test: storage/websql/transaction-prototype.html

        * Modules/webdatabase/Database.idl:
        * Modules/webdatabase/SQLError.idl:
        * Modules/webdatabase/SQLResultSet.idl:
        * Modules/webdatabase/SQLResultSetRowList.idl:
        * Modules/webdatabase/SQLTransaction.idl:

2016-04-22  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Include columnNumber in event listener locations
        https://bugs.webkit.org/show_bug.cgi?id=156927
        <rdar://problem/25884584>

        Reviewed by Brian Burg.

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
        Include the column number in the location as well.

2016-04-22  Brent Fulgham  <bfulgham@apple.com>

        [Win] Unreviewed build fix.

        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
        (PlatformCALayerWin::isHidden):

2016-04-22  Jer Noble  <jer.noble@apple.com>

        [iOS] Crash at -[WebAVPlayerLayer resolveBounds]
        https://bugs.webkit.org/show_bug.cgi?id=156931
        <rdar://problem/25865315> 

        Reviewed by Eric Carlson.

        When cloning the WebAVPlayerLayer, we must copy over the fullscreenInterface to the cloned layer.

        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (WebAVPlayerLayerView_startRoutingVideoToPictureInPicturePlayerLayerView):

2016-04-22  Chris Dumez  <cdumez@apple.com>

        Crash under WebCore::DataDetection::detectContentInRange()
        https://bugs.webkit.org/show_bug.cgi?id=156880
        <rdar://problem/25622631>

        Reviewed by Darin Adler.

        We would sometimes crash under WebCore::DataDetection::detectContentInRange()
        when dereferencing a null parentNode pointer. This patch adds a null check
        for parentNode in the for() loop. It also does some clean up and optimization
        since I was passing by.

        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::detectContentInRange):

2016-04-22  Keith Miller  <keith_miller@apple.com>

        buildObjectForEventListener should not call into JSC with a null ExecState
        https://bugs.webkit.org/show_bug.cgi?id=156923

        Reviewed by Joseph Pecoraro.

        If a user had disabled JavaScript on their page then the inspector tried to
        add an event listener we would fail to create an ExecState. Since we didn't
        check this ExecState was valid we would then attempt to stringify the value,
        which would cause JSC to crash.

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::buildObjectForEventListener):

2016-04-22  Dean Jackson  <dino@apple.com>

        Yet another attempt at fixing Windows.

        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
        (PlatformCALayerWin::isHidden):
        * platform/graphics/ca/win/PlatformCALayerWin.h:

2016-04-22  Ryan Haddad  <ryanhaddad@apple.com>

        Attempt to fix Windows build after r199862

        Unreviewed build fix.

        * platform/graphics/ca/win/PlatformCALayerWin.h:

2016-04-22  Brent Fulgham  <bfulgham@apple.com>

        Anchor element 'ping' property should only apply to http/https destinations
        https://bugs.webkit.org/show_bug.cgi?id=156801
        <rdar://problem/25834419>

        Reviewed by Chris Dumez.

        Take advantage of the hyperlink auditing language "UAs may either ignore the
        ping attribute altogether, or selectively ignore URLs in the list (e.g. ignoring
        any third-party URLs)" to restrict pings to http/https targets. For details, see
        <https://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing>.

        Tested by http/tests/navigation/ping-attribute tests.

        * loader/PingLoader.cpp:
        (WebCore::PingLoader::sendPing): Ignore requests to ping anything outside the
        family of HTTP protocols (http/https).

2016-04-22  Ryan Haddad  <ryanhaddad@apple.com>

        Fix builds that do not support AVKit

        Unreviewed build fix.

        * platform/ios/WebAVPlayerController.h:
        * platform/ios/WebAVPlayerController.mm:

2016-04-22  Dave Hyatt  <hyatt@apple.com>

        REGRESSION (r189567): The top of Facebook's messenger.com looks visually broken
        https://bugs.webkit.org/show_bug.cgi?id=156869
        <rdar://problem/23204668>

        Reviewed by Zalan Bujtas.

        Added fast/block/min-content-with-box-sizing.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeIntrinsicLogicalContentHeightUsing):

2016-04-22  Antti Koivisto  <antti@apple.com>

        TextAutoSizingKey should use normal refcounting
        https://bugs.webkit.org/show_bug.cgi?id=156893

        Reviewed by Andreas Kling.

        Get rid of special refcounting of style in favor of RefPtr. It also becomes a move-only type
        to support future switch to non-refcounted RenderStyle.

        Also general cleanups and modernization.

        * dom/Document.cpp:
        (WebCore::TextAutoSizingTraits::constructDeletedValue):
        (WebCore::TextAutoSizingTraits::isDeletedValue):
        (WebCore::Document::addAutoSizingNode):
        (WebCore::Document::validateAutoSizingNodes):
        (WebCore::Document::resetAutoSizingNodes):

            Adopt to being move-only.

        * rendering/TextAutoSizing.cpp:
        (WebCore::cloneRenderStyleWithState):
        (WebCore::TextAutoSizingKey::TextAutoSizingKey):

            Clone the style for safety against mutations. Cloning is cheap.

        (WebCore::TextAutoSizingValue::numNodes):
        (WebCore::TextAutoSizingValue::adjustNodeSizes):
        (WebCore::TextAutoSizingValue::reset):
        (WebCore::TextAutoSizingKey::~TextAutoSizingKey): Deleted.
        (WebCore::TextAutoSizingKey::operator=): Deleted.
        (WebCore::TextAutoSizingKey::ref): Deleted.
        (WebCore::TextAutoSizingKey::deref): Deleted.
        * rendering/TextAutoSizing.h:
        (WebCore::TextAutoSizingKey::TextAutoSizingKey):
        (WebCore::TextAutoSizingKey::style):
        (WebCore::TextAutoSizingKey::isDeleted):
        (WebCore::operator==):
        (WebCore::TextAutoSizingKey::doc): Deleted.
        (WebCore::TextAutoSizingKey::isValidDoc): Deleted.
        (WebCore::TextAutoSizingKey::isValidStyle): Deleted.
        (WebCore::TextAutoSizingKey::deletedKeyDoc): Deleted.
        (WebCore::TextAutoSizingKey::deletedKeyStyle): Deleted.

            m_doc member is not used for anything except deleted value comparisons. Replace it with a bit.

2016-04-22  Chris Dumez  <cdumez@apple.com>

        Crash under FontCache::purgeInactiveFontData()
        https://bugs.webkit.org/show_bug.cgi?id=156822
        <rdar://problem/25373970>

        Reviewed by Darin Adler.

        In some rare cases, the Font constructor would mutate the FontPlatformData
        that is being passed in. This is an issue because because our FontCache
        uses the FontPlatformData as key for the cached fonts. This could lead to
        crashes because the WTFMove() in FontCache::purgeInactiveFontData() would
        nullify values in our HashMap but we would then fail to remove them from
        the HashMap (because the key did not match). We would then reference the
        null font when looping again when doing font->hasOneRef().

        This patch marks Font::m_platformData member as const to avoid such issues
        in the future and moves the code altering the FontPlatformData from the
        Font constructor into the FontPlatformData constructor. The purpose of
        that code was to initialize FontPlatformData::m_cgFont in case the CGFont
        passed in the constructor was null.

        * platform/graphics/Font.h:
        * platform/graphics/FontCache.cpp:
        (WebCore::FontCache::fontForPlatformData):
        (WebCore::FontCache::purgeInactiveFontData):
        * platform/graphics/FontPlatformData.cpp:
        (WebCore::FontPlatformData::FontPlatformData):
        * platform/graphics/FontPlatformData.h:
        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::webFallbackFontFamily): Deleted.
        (WebCore::Font::platformInit): Deleted.
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore::webFallbackFontFamily):
        (WebCore::FontPlatformData::setFallbackCGFont):
        * platform/graphics/win/FontPlatformDataCGWin.cpp:
        (WebCore::FontPlatformData::setFallbackCGFont):

2016-04-22  Chris Dumez  <cdumez@apple.com>

        Support disabling at runtime IndexedDB constructors exposed to workers
        https://bugs.webkit.org/show_bug.cgi?id=156883

        Reviewed by Darin Adler.

        Support disabling at runtime IndexedDB constructors exposed to workers.
        Previously, constructors visibility to workers and window was constrolled
        by the same runtime flag.

        * Modules/indexeddb/IDBCursor.idl:
        * Modules/indexeddb/IDBCursorWithValue.idl:
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBFactory.idl:
        * Modules/indexeddb/IDBIndex.idl:
        * Modules/indexeddb/IDBKeyRange.idl:
        * Modules/indexeddb/IDBObjectStore.idl:
        * Modules/indexeddb/IDBOpenDBRequest.idl:
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.idl:
        * Modules/indexeddb/IDBVersionChangeEvent.idl:
        * workers/WorkerGlobalScope.idl:

2016-04-22  Dean Jackson  <dino@apple.com>

        Attempting to fix Windows build. Add isHidden implementation.

        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
        (PlatformCALayerWin::isHidden):

2016-04-22  Brady Eidson  <beidson@apple.com>

        Attempt at a Windows build fix.

        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::startWorkerGlobalScope):

2016-04-22  Dave Hyatt  <hyatt@apple.com>

         -webkit-image-set doesn't work inside CSS variables
        https://bugs.webkit.org/show_bug.cgi?id=156915
        <rdar://problem/25473972>

        Reviewed by Zalan Bujtas.

        Added new tests in fast/hidpi.

        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::equals):
        (WebCore::CSSPrimitiveValue::buildParserValue):

2016-04-22  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r199877.
        https://bugs.webkit.org/show_bug.cgi?id=156918

        The LayoutTest added with this change is failing on all
        platforms. (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "REGRESSION (r189567): The top of Facebook's messenger.com
        looks visually broken"
        https://bugs.webkit.org/show_bug.cgi?id=156869
        http://trac.webkit.org/changeset/199877

2016-04-22  Brady Eidson  <beidson@apple.com>

        Modern IDB: Rework the ownership/RefCounting model of IDBConnectionToServer and IDBConnectionProxy.
        https://bugs.webkit.org/show_bug.cgi?id=156916

        Reviewed by Tim Horton.

        No new tests (No behavior change).

        * Modules/indexeddb/IDBFactory.cpp: Remove unneeded include.
        
        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::ref): Ref the ConnectionToServer.
        (WebCore::IDBClient::IDBConnectionProxy::deref): Deref it.
        (WebCore::IDBClient::IDBConnectionProxy::connectionToServer):
        (WebCore::IDBClient::IDBConnectionProxy::openDatabase):
        (WebCore::IDBClient::IDBConnectionProxy::deleteDatabase):
        (WebCore::IDBClient::IDBConnectionProxy::create): Deleted.
        * Modules/indexeddb/client/IDBConnectionProxy.h:
        
        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::IDBConnectionToServer): Create a proxy owned by this.
        (WebCore::IDBClient::IDBConnectionToServer::proxy): Expose it.
        * Modules/indexeddb/client/IDBConnectionToServer.h:
        
        * dom/Document.cpp:
        (WebCore::Document::idbConnectionProxy):

        * WebCore.xcodeproj/project.pbxproj:

2016-04-22  Antti Koivisto  <antti@apple.com>

        REGRESSION (r194898): Multi download of external SVG defs file by <use> xlinks:href (caching)
        https://bugs.webkit.org/show_bug.cgi?id=156368
        <rdar://problem/25611746>

        Reviewed by Simon Fraser.

        We would load svg resources with fragment identifier again because the encoding never matched.

        Test: http/tests/svg/svg-use-external.html

        * loader/TextResourceDecoder.cpp:
        (WebCore::TextResourceDecoder::setEncoding):
        (WebCore::TextResourceDecoder::hasEqualEncodingForCharset):

            Encoding can depend on mime type. Add a comparison function that takes this into account.

        (WebCore::findXMLEncoding):
        * loader/TextResourceDecoder.h:
        (WebCore::TextResourceDecoder::encoding):
        * loader/cache/CachedCSSStyleSheet.h:
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::textResourceDecoder):

            Add a way to get the TextResourceDecoder from a cached resource.

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::determineRevalidationPolicy):

            Use the new comparison function.

        * loader/cache/CachedSVGDocument.h:
        * loader/cache/CachedScript.h:
        * loader/cache/CachedXSLStyleSheet.h:

2016-04-22  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Drop [UsePointersEvenForNonNullableObjectArguments] from InspectorFrontendHost
        https://bugs.webkit.org/show_bug.cgi?id=156908

        Reviewed by Timothy Hatcher.

        No change of behavior.

        * inspector/InspectorFrontendHost.idl: Marking event parameter as nullable to keep compatibility.

2016-04-22  Chris Dumez  <cdumez@apple.com>

        Drop [UsePointersEvenForNonNullableObjectArguments] from MutationObserver
        https://bugs.webkit.org/show_bug.cgi?id=156890

        Reviewed by Darin Adler.

        Drop [UsePointersEvenForNonNullableObjectArguments] from MutationObserver
        and clean up / modernize the code a bit. There is not significant Web-
        exposed behavior change except that MutationObserver.observe() now throws
        a different kind of exception (a TypeError as per Web IDL) when passed in
        a null Node.

        No new tests, rebaselined existing test.

        * bindings/js/JSMutationCallback.cpp:
        (WebCore::JSMutationCallback::call):
        * bindings/js/JSMutationCallback.h:
        * bindings/js/JSMutationObserverCustom.cpp:
        (WebCore::constructJSMutationObserver):
        * css/PropertySetCSSStyleDeclaration.cpp:
        * dom/ChildListMutationScope.cpp:
        (WebCore::ChildListMutationAccumulator::enqueueMutationRecord):
        * dom/MutationCallback.h:
        * dom/MutationObserver.cpp:
        (WebCore::MutationObserver::create):
        (WebCore::MutationObserver::MutationObserver):
        (WebCore::MutationObserver::observe):
        (WebCore::MutationObserver::takeRecords):
        (WebCore::MutationObserver::enqueueMutationRecord):
        (WebCore::MutationObserver::deliver):
        (WebCore::MutationObserver::disconnect): Deleted.
        * dom/MutationObserver.h:
        * dom/MutationObserver.idl:
        * dom/MutationObserverInterestGroup.cpp:
        (WebCore::MutationObserverInterestGroup::enqueueMutationRecord):
        * dom/MutationObserverInterestGroup.h:
        * dom/MutationRecord.cpp:
        (WebCore::MutationRecord::createChildList):
        * dom/MutationRecord.h:

2016-04-22  Dave Hyatt  <hyatt@apple.com>

        REGRESSION (r189567): The top of Facebook's messenger.com looks visually broken
        https://bugs.webkit.org/show_bug.cgi?id=156869
        <rdar://problem/23204668>

        Reviewed by Zalan Bujtas.

        Added fast/block/min-content-with-box-sizing.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeContentLogicalHeight):

2016-04-22  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Fix bug with positioned items in vertical writing mode
        https://bugs.webkit.org/show_bug.cgi?id=156870

        Reviewed by Darin Adler.

        In RenderGrid::offsetAndBreadthForPositionedChild() we were using
        directly borderLeft(), which is wrong in vertical writing modes.

        To fix it we just need to use borderLogicalLeft() which is aware of
        the current writing mode.

        Test: fast/css-grid-layout/grid-positioned-children-writing-modes.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):

2016-04-21  Zan Dobersek  <zdobersek@igalia.com>

        REGRESSION(r199738): The ANGLE update broke accelerated compositing in GTK+ port
        https://bugs.webkit.org/show_bug.cgi?id=156789

        Reviewed by Carlos Garcia Campos.

        After the update, the ANGLE library has to be built with
        ANGLE_ENABLE_ESSL and ANGLE_ENABLE_GLSL definitions in order
        to compile in the support for the two translators that Linux-based
        ports using OpenGL ES or OpenGL require. Missing files are also added.

        * CMakeLists.txt:

2016-04-21  Chris Dumez  <cdumez@apple.com>

        Drop [UsePointersEvenForNonNullableObjectArguments] from Document
        https://bugs.webkit.org/show_bug.cgi?id=156881

        Reviewed by Darin Adler.

        Drop [UsePointersEvenForNonNullableObjectArguments] from Document. There
        is no major Web-exposed behavior change but the type of the exception
        being thrown when passing null or not enough parameters has changed for
        some of the API (It is now always a TypeError as per the Web IDL
        specification).

        Tests: fast/dom/Document/adoptNode-null.html
               fast/dom/Document/importNode-null.html

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::takeAllChildrenFrom):
        (WebCore::ContainerNode::parserInsertBefore):
        (WebCore::ContainerNode::parserAppendChild):
        * dom/Document.cpp:
        (WebCore::Document::importNode):
        (WebCore::Document::adoptNode):
        (WebCore::Document::createNodeIterator):
        (WebCore::Document::createTreeWalker):
        (WebCore::Document::setBodyOrFrameset):
        (WebCore::Document::hasValidNamespaceForElements): Deleted.
        (WebCore::Document::scheduleForcedStyleRecalc): Deleted.
        (WebCore::Document::scheduleStyleRecalc): Deleted.
        (WebCore::Document::unscheduleStyleRecalc): Deleted.
        (WebCore::Document::hasPendingStyleRecalc): Deleted.
        (WebCore::Document::hasPendingForcedStyleRecalc): Deleted.
        (WebCore::Document::recalcStyle): Deleted.
        (WebCore::Document::explicitClose): Deleted.
        * dom/Document.h:
        (WebCore::Document::importNode):
        * dom/Document.idl:
        * dom/NodeIterator.cpp:
        (WebCore::NodeIterator::NodeIterator):
        * dom/NodeIterator.h:
        (WebCore::NodeIterator::create):

2016-04-21  Frederic Wang  <fwang@igalia.com>

        More improvements and explanations regarding resetting CSS properties on the <math> element
        https://bugs.webkit.org/show_bug.cgi?id=156840

        Reviewed by Darin Adler.

        We some follow-up improvements regarding CSS rules on the <math> element, after bug 133603:
        - We fix indenting to use 4 spaces.
        - We explain why we set -webkit-line-box-contain and add references to related bugs.
        - We explain why we reset some CSS spacing rules.
        - We explain why the direction is set to ltr.
        - We explain why font-family is set to a list of known math fonts and add reference
          to the wiki.
        - We mention the need to customize math fonts to get consistent style and add references to
          a bug report and to the wiki.
        - We described each of the math font listed and add some justification about their orders.
        - We better explain the section about fonts that do not satisfy the requirements for good
          mathematical rendering, reformulate why we still need them for iOS/Mac and we add some
          references to a bug report and to the wiki. Some fonts that not pre-installed were removed
          in r199773.
        - We add a FIXME comments for potential changes of CSS properties on the <math> tag.

        We make the following changes to the lists of font-family:
        - We move "TeX Gyre Termes Math" into the Times group.
        - We move "Asana Math" into the Palatino group.
        - We remove iOS conditionals on "Symbol" and "Times New Roman".

        No new tests, only order of math fonts that are not used by test framework is changed.

        * css/mathml.css:
        (math): We merge the two math selectors, reorder some font-families, remove iOS ifdef and
        add more description.

2016-04-21  Dean Jackson  <dino@apple.com>

        Backdrop Filter should not be visible if element has visibility:hidden
        https://bugs.webkit.org/show_bug.cgi?id=149318
        <rdar://problem/22749780>

        Reviewed by Simon Fraser.

        Make sure that backdrop filter layers take note of when
        the contents are visible or not.

        Tests: css3/filters/backdrop/backdrop-with-visibility-hidden-changing.html
               css3/filters/backdrop/backdrop-with-visibility-hidden.html
               css3/filters/backdrop/backdrop-with-visibility-hidden-2.html

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::updateContentsVisibility): Tell the backdrop layer about the
        change if there is one.
        (WebCore::GraphicsLayerCA::updateBackdropFilters): When we update filters, make
        sure to check the contents visibility.
        (WebCore::dumpInnerLayer): Output "hidden" if the layer is set as such.
        * platform/graphics/ca/PlatformCALayer.h: Add an isHidden method.
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.h:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (PlatformCALayerCocoa::isHidden): Call into CALayer isHidden.

2016-04-21  Zalan Bujtas  <zalan@apple.com>

        RenderVideo should always update the intrinsic size before layout.
        https://bugs.webkit.org/show_bug.cgi?id=156878

        Reviewed by Simon Fraser.

        In order to layout video element properly we need to know the correct intrinsic size.
        This patch also asserts if we end up updating the intrinsic size right after finishing video renderer layout.

        This issues was discovered as part of webkit.org/b/156245. (hence covered by existing tests)

        * rendering/RenderVideo.cpp:
        (WebCore::RenderVideo::updateIntrinsicSize):
        (WebCore::RenderVideo::layout):
        (WebCore::RenderVideo::updatePlayer):
        * rendering/RenderVideo.h:

2016-04-21  Brady Eidson  <beidson@apple.com>

        Modern IDB (Workers): Get the IDBConnectionProxy from the Document to the WorkerGlobalScope.
        https://bugs.webkit.org/show_bug.cgi?id=156877

        Reviewed by Tim Horton.

        No new tests (Covered by changes to existing tests).

        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::startWorkerGlobalScope): This is the point on the main thread
          where we can get the IDBConnectionProxy from the Document and pass it down through Worker
          machinery so it can end up at the WorkerGlobalScope.
        
        Everything else is this patch is just passing it along as needed.

        And cleaning up header style for neglected headers.

        * workers/DedicatedWorkerGlobalScope.cpp:
        (WebCore::DedicatedWorkerGlobalScope::create):
        (WebCore::DedicatedWorkerGlobalScope::DedicatedWorkerGlobalScope):
        * workers/DedicatedWorkerGlobalScope.h:

        * workers/DedicatedWorkerThread.cpp:
        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
        (WebCore::DedicatedWorkerThread::createWorkerGlobalScope):
        * workers/DedicatedWorkerThread.h:
        (WebCore::DedicatedWorkerThread::create):
        (WebCore::DedicatedWorkerThread::workerObjectProxy):

        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::WorkerGlobalScope):
        (WebCore::WorkerGlobalScope::idbConnectionProxy):
        * workers/WorkerGlobalScope.h:

        * workers/WorkerThread.cpp:
        (WebCore::WorkerThread::WorkerThread):
        (WebCore::WorkerThread::idbConnectionProxy):
        * workers/WorkerThread.h:
        (WebCore::WorkerThread::threadID):
        (WebCore::WorkerThread::runLoop):
        (WebCore::WorkerThread::workerLoaderProxy):
        (WebCore::WorkerThread::workerReportingProxy):
        (WebCore::WorkerThread::getNotificationClient):
        (WebCore::WorkerThread::setNotificationClient):
        (WebCore::WorkerThread::workerGlobalScope):

2016-04-21  Anders Carlsson  <andersca@apple.com>

        Fix crashes when loading SVG images.

        * loader/EmptyClients.cpp:
        (WebCore::fillWithEmptyClients):
        Give the SVG page its own application cache storage.

2016-04-21  Anders Carlsson  <andersca@apple.com>

        Get rid of ApplicationCacheStorage::singleton
        https://bugs.webkit.org/show_bug.cgi?id=156882

        Reviewed by Tim Horton.

        * loader/appcache/ApplicationCacheStorage.cpp:
        (WebCore::ApplicationCacheStorage::setCacheDirectory): Deleted.
        (WebCore::ApplicationCacheStorage::singleton): Deleted.
        * loader/appcache/ApplicationCacheStorage.h:
        * page/Page.cpp:
        (WebCore::Page::Page):

2016-04-21  Simon Fraser  <simon.fraser@apple.com>

        ASSERTION FAILED: accumulation == TransformState::FlattenTransform in WebCore::GraphicsLayerCA::computeVisibleAndCoverageRect
        https://bugs.webkit.org/show_bug.cgi?id=155362

        Reviewed by Zalan Bujtas.

        A particular configuration of composited RenderLayers with preserve-3d and clipping
        caused assertions because an ancestor clipping layer had masksToBounds() set, but
        a preserves3D() parent, triggering an assertion in GraphicsLayerCA::computeVisibleAndCoverageRect().
        Make two changes to address this:

        First, CSS clip: and clip-path: should force flattening and override preserve-3d in
        the RenderStyle.

        Second, don't accumulate transforms in GraphicsLayerCA through layers with masksToBounds().

        Tests: compositing/clipping/preserve3d-flatten-assertion-nested.html
               compositing/clipping/preserve3d-flatten-assertion.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::adjustRenderStyle):
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::accumulatesTransform):

2016-04-21  Chris Dumez  <cdumez@apple.com>

        Element::idForStyleResolution() is a foot-gun
        https://bugs.webkit.org/show_bug.cgi?id=156852

        Reviewed by Darin Adler.

        Element::idForStyleResolution() is a foot-gun. It requires the caller to check
        Element::hasID() first or it may end up crashing when dereferencing elementData()
        (e.g. see Bug 156806).

        This patch updates Element::idForStyleResolution() to return nullAtom is the
        Element does not have an ID. I did not see a performance impact on Speedometer,
        Dromaeo DOM Core, Dromaeo CSS Selectors and our local performanceTests/.

        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::collectMatchingRules):
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOne):
        * css/SelectorFilter.cpp:
        (WebCore::collectElementIdentifierHashes):
        * dom/Element.h:
        (WebCore::Element::idForStyleResolution):
        * rendering/RenderBlockFlow.cpp:
        (WebCore::needsAppleMailPaginationQuirk):
        * rendering/RenderTreeAsText.cpp:
        (WebCore::writeRenderRegionList):
        * style/StyleSharingResolver.cpp:
        (WebCore::Style::SharingResolver::canShareStyleWithElement):

2016-04-21  Brady Eidson  <beidson@apple.com>

        Modern IDB (Workers): Move IDBConnectionProxy into IDBRequest and IDBDatabase.
        https://bugs.webkit.org/show_bug.cgi?id=156868

        Reviewed by Tim Horton.

        No new tests (No behavior change).

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::create):
        (WebCore::IDBDatabase::IDBDatabase):
        (WebCore::IDBDatabase::~IDBDatabase):
        (WebCore::IDBDatabase::transaction):
        (WebCore::IDBDatabase::maybeCloseInServer):
        * Modules/indexeddb/IDBDatabase.h:
        (WebCore::IDBDatabase::connectionProxy):
        (WebCore::IDBDatabase::serverConnection):

        * Modules/indexeddb/IDBOpenDBRequest.cpp:
        (WebCore::IDBOpenDBRequest::createDeleteRequest):
        (WebCore::IDBOpenDBRequest::createOpenRequest):
        (WebCore::IDBOpenDBRequest::IDBOpenDBRequest):
        (WebCore::IDBOpenDBRequest::onSuccess):
        (WebCore::IDBOpenDBRequest::onUpgradeNeeded):
        (WebCore::IDBOpenDBRequest::requestCompleted):
        (WebCore::IDBOpenDBRequest::maybeCreateDeleteRequest): Deleted.
        (WebCore::IDBOpenDBRequest::maybeCreateOpenRequest): Deleted.
        * Modules/indexeddb/IDBOpenDBRequest.h:

        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::IDBRequest):
        (WebCore::IDBRequest::connectionToServer): Deleted.
        * Modules/indexeddb/IDBRequest.h:
        (WebCore::IDBRequest::connectionProxy):

        * Modules/indexeddb/IDBTransaction.h:

        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::openDatabase):
        (WebCore::IDBClient::IDBConnectionProxy::deleteDatabase):

2016-04-21  Jiewen Tan  <jiewen_tan@apple.com>

        [iOS] DumpRenderTree crashed in com.apple.WebCore: WebCore::ResourceLoadNotifier::didFailToLoad
        https://bugs.webkit.org/show_bug.cgi?id=156829
        <rdar://problem/23348217>

        Reviewed by Daniel Bates.

        Ensure that the frame associated with the ResourceLoadNotifier is kept alive when notifying the Web Inspector.

        Covered by existing tests.

        * loader/ResourceLoadNotifier.cpp:
        (WebCore::ResourceLoadNotifier::didFailToLoad):
        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
        (WebCore::ResourceLoadNotifier::dispatchDidReceiveData):
        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
        (WebCore::ResourceLoadNotifier::dispatchDidFailLoading):

2016-04-21  Brady Eidson  <beidson@apple.com>

        Modern IDB (Workers): More IDBConnectionProxy refactoring.
        https://bugs.webkit.org/show_bug.cgi?id=156855

        Reviewed by Darin Adler.

        No new tests (Covered by changes to existing tests).

        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
        (WebCore::DOMWindowIndexedDatabase::indexedDB):

        Hang on to the IDBConnectionProxy passed in at creation time, as it should never change:
        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::create):
        (WebCore::IDBFactory::IDBFactory):
        (WebCore::IDBFactory::openInternal):
        (WebCore::IDBFactory::deleteDatabase):
        * Modules/indexeddb/IDBFactory.h:

        Hang on to the IDBConnectionProxy passed in at creation time, as it should never change:
        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.cpp:
        (WebCore::WorkerGlobalScopeIndexedDatabase::WorkerGlobalScopeIndexedDatabase):
        (WebCore::WorkerGlobalScopeIndexedDatabase::from):
        (WebCore::WorkerGlobalScopeIndexedDatabase::indexedDB):
        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.h:

        Make IDBConnectionProxy ThreadSafeRefCounted:
        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::create):
        * Modules/indexeddb/client/IDBConnectionProxy.h:

        * dom/Document.cpp:
        (WebCore::Document::idbConnectionProxy):
        * dom/Document.h:

2016-04-21  Keith Miller  <keith_miller@apple.com>

        WebScriptObject description swizzler should work in a multi-threaded world
        https://bugs.webkit.org/show_bug.cgi?id=156808

        Reviewed by Geoffrey Garen.

        A WebKit legacy API user might be running Objective-C code on another thread.
        Since we don't want to corrupt other thread's NSObject description method
        we use TLS to record if we are in the stringValue function. As an attempt to
        preserve any user swizzling we update the non-stringValue NSObject description
        method on each call to stringValue if it has changed. Additionally, the TLS
        needs to be a int because the user might call into stringValue, back into JS,
        then back into stringValue. If the TLS was a boolean then it would be unset
        at that point so when we return into the first stringValue call we would call
        the original NSObject description method rather than our override.

        Test added to API tests: WebKit1.WebScriptObjectDescription

        * bridge/objc/objc_instance.mm:
        (-[NSObject _web_description]):
        (ObjcInstance::stringValue):
        (swizzleNSObjectDescription): Deleted.

2016-04-21  Beth Dakin  <bdakin@apple.com>

        Build fix.

        * platform/mac/WebPlaybackSessionInterfaceMac.mm:
        (WebCore::WebPlaybackSessionInterfaceMac::setAudioMediaSelectionOptions):
        (WebCore::WebPlaybackSessionInterfaceMac::setLegibleMediaSelectionOptions):
        (WebCore::WebPlaybackSessionInterfaceMac::invalidate):

2016-04-21  Beth Dakin  <bdakin@apple.com>

        32 bit build fix.

        * platform/mac/WebPlaybackSessionInterfaceMac.mm:

2016-04-21  Konstantin Tokarev  <annulen@yandex.ru>

        Fixed compilation with !ENABLE(SVG_FONTS).
        https://bugs.webkit.org/show_bug.cgi?id=156850

        Reviewed by Michael Catanzaro.

        No new tests needed.

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::CSSFontFaceSource):
        Added missing ENABLE(SVG_FONTS) guards.
        * css/CSSFontFaceSource.h: Ditto.
        * platform/graphics/FontCascade.cpp: Ditto.
        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::FontCascade::drawGlyphBuffer): Deleted extraneous
        !ENABLE(SVG_FONTS) guard.

2016-04-21  Beth Dakin  <bdakin@apple.com>

        Remove reliance on WebAVMediaSelectionOptionMac for the 
        WebPlaybackControlsManager
        https://bugs.webkit.org/show_bug.cgi?id=156811
        -and corresponding-
        rdar://problem/25760523

        Reviewed by Jer Noble.

        * platform/mac/WebPlaybackSessionInterfaceMac.mm:
        (-[WebPlaybackControlsManager setSeekableTimeRanges:]):
        (-[WebPlaybackControlsManager setAudioMediaSelectionOptions:withSelectedIndex:]):
        (-[WebPlaybackControlsManager setLegibleMediaSelectionOptions:withSelectedIndex:]):
        (WebCore::WebPlaybackSessionInterfaceMac::~WebPlaybackSessionInterfaceMac):
        (WebCore::WebPlaybackSessionInterfaceMac::setSeekableRanges):
        (WebCore::WebPlaybackSessionInterfaceMac::setAudioMediaSelectionOptions):
        (WebCore::WebPlaybackSessionInterfaceMac::setLegibleMediaSelectionOptions):
        (WebCore::WebPlaybackSessionInterfaceMac::invalidate):
        (-[WebAVMediaSelectionOptionMac localizedDisplayName]): Deleted.
        (-[WebAVMediaSelectionOptionMac setLocalizedDisplayName:]): Deleted.
        (-[WebPlaybackControlsManager isSeeking]): Deleted.
        (-[WebPlaybackControlsManager seekToTime:toleranceBefore:toleranceAfter:]): Deleted.
        (-[WebPlaybackControlsManager audioMediaSelectionOptions]): Deleted.
        (-[WebPlaybackControlsManager setAudioMediaSelectionOptions:]): Deleted.
        (-[WebPlaybackControlsManager currentAudioMediaSelectionOption]): Deleted.
        (-[WebPlaybackControlsManager setCurrentAudioMediaSelectionOption:]): Deleted.
        (-[WebPlaybackControlsManager legibleMediaSelectionOptions]): Deleted.
        (-[WebPlaybackControlsManager setLegibleMediaSelectionOptions:]): Deleted.
        (-[WebPlaybackControlsManager currentLegibleMediaSelectionOption]): Deleted.
        (-[WebPlaybackControlsManager setCurrentLegibleMediaSelectionOption:]): Deleted.
        (-[WebPlaybackControlsManager cancelThumbnailAndAudioAmplitudeSampleGeneration]): Deleted.
        (WebCore::mediaSelectionOptions): Deleted.

2016-04-21  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION(198782): ImageSource::subsamplingLevelForScale() does not cache the MaximumSubsamplingLevel for this ImageSource
        https://bugs.webkit.org/show_bug.cgi?id=156766

        Reviewed by Darin Adler.

        Ensure the MaximumSubsamplingLevel for the ImageSource is calculated
        only once and is cached for subsequent uses. 
        
        The image subsampling is on by default only for iOS. So the and this
        patch currently affects the iOS port.

        * platform/graphics/ImageSource.cpp:
        (WebCore::ImageSource::cacheMetadata): Cache m_maximumSubsamplingLevel.
        Use m_frameCount as a flag for having_the_cache_done.
        (WebCore::ImageSource::subsamplingLevelForScale): Call cacheMetadata()
        before using m_maximumSubsamplingLevel.
        (WebCore::ImageSource::frameCount): Call cacheMetadata() before returning
        m_frameCount.
        * platform/graphics/ImageSource.h:

2016-04-21  Antoine Quint  <graouts@apple.com>

        Creating a large number of WebGL contexts should recycle older contexts
        https://bugs.webkit.org/show_bug.cgi?id=156689
        <rdar://problem/19535330>

        Reviewed by Dean Jackson.

        We used to stop creating WebGL contexts once a maximum of 64 WebGL contexts had been
        created on a page. Other browsers have a limit of 16 concurrent active WebGL contexts
        and they lose older contexts when the developer creates a new context, logging a warning
        to the console. We now follow the same approach.

        Tests: webgl/max-active-contexts-console-warning.html
               webgl/max-active-contexts-gc.html
               webgl/max-active-contexts-oldest-context-lost.html
               webgl/max-active-contexts-webglcontextlost-prevent-default.html

        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::recycleContext):

        Prints a warning message to the console indicating that an older WebGL context
        will be lost to accomodate for the active contexts limit being reached and loses
        the provided context in a way that it may not be recovered by calling `event.preventDefault()`
        in the `webglcontextlost` event handler. Finally, we destroy the associated GraphicsContext3D
        since it will no longer be useful and it may hold large Open GL resources.

        * html/canvas/WebGLRenderingContextBase.h:
        * platform/graphics/GraphicsContext3D.h:

        Changed GraphicsContext3D::create to return RefPtr instead of PassRefPtr.

        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
        (WebCore::GraphicsContext3D::create):
        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
        (WebCore::GraphicsContext3D::create):
        * platform/graphics/mac/GraphicsContext3DMac.mm:
        (WebCore::activeContexts):
        (WebCore::GraphicsContext3D::create):

        Check if we are at the active contexts limit (16) and recycle the oldest context
        in our active contexts list. Calling recycleContext() on a context will call the
        GraphicsContext3D destructor and remove it from the active contexts list there.

        (WebCore::GraphicsContext3D::~GraphicsContext3D):

        Remove the deconstructed context from the active contexts list.

        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore::GraphicsContext3D::recycleContext):
        * platform/graphics/win/GraphicsContext3DWin.cpp:
        (WebCore::GraphicsContext3D::create):

2016-04-21  Dave Hyatt  <hyatt@apple.com>

        Don't hyphenate the last word in a paragraph of text.
        https://bugs.webkit.org/show_bug.cgi?id=156803

        Reviewed by Simon Fraser.

        Added fast/text/hyphenate-avoid-orphaned-word.html

        * rendering/RenderText.h:
        * rendering/line/BreakingContext.h:
        (WebCore::BreakingContext::handleText):

2016-04-21  Chris Dumez  <cdumez@apple.com>

        Drop [UsePointersEvenForNonNullableObjectArguments] from Range
        https://bugs.webkit.org/show_bug.cgi?id=156805

        Reviewed by Youenn Fablet.

        No new tests, no web-exposed behavior change.

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::rangeForNodeContents):
        (WebCore::characterOffsetsInOrder):
        (WebCore::setRangeStartOrEndWithCharacterOffset):
        (WebCore::AXObjectCache::startOrEndCharacterOffsetForRange):
        (WebCore::AXObjectCache::previousBoundary):
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::selectText):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::documentBasedSelectedTextRange):
        * dom/Node.cpp:
        (WebCore::Node::textRects):
        * dom/Range.cpp:
        (WebCore::Range::Range):
        (WebCore::Range::setDocument):
        (WebCore::Range::setStart):
        (WebCore::Range::setEnd):
        (WebCore::Range::isPointInRange):
        (WebCore::Range::comparePoint):
        (WebCore::Range::compareNode):
        (WebCore::Range::compareBoundaryPoints):
        (WebCore::Range::compareBoundaryPointsForBindings):
        (WebCore::Range::intersectsNode):
        (WebCore::Range::processContents):
        (WebCore::Range::insertNode):
        (WebCore::Range::checkNodeWOffset):
        (WebCore::Range::setStartAfter):
        (WebCore::Range::setEndBefore):
        (WebCore::Range::setEndAfter):
        (WebCore::Range::selectNode):
        (WebCore::Range::selectNodeContents):
        (WebCore::Range::surroundContents):
        (WebCore::Range::setStartBefore):
        (WebCore::Range::contains):
        (WebCore::rangesOverlap):
        (WebCore::rangeOfContents):
        (WebCore::boundaryNodeChildrenWillBeRemoved):
        (WebCore::boundaryTextNodesMerged):
        (WebCore::boundaryTextNodesSplit):
        (WebCore::Range::expand):
        (WebCore::checkForDifferentRootContainer): Deleted.
        (WebCore::highestAncestorUnderCommonRoot): Deleted.
        (WebCore::childOfCommonRootBeforeOffset): Deleted.
        (WebCore::deleteCharacterData): Deleted.
        (WebCore::Range::toString): Deleted.
        (WebCore::Range::toHTML): Deleted.
        (WebCore::Range::text): Deleted.
        (WebCore::Range::cloneRange): Deleted.
        (WebCore::Range::absoluteTextRects): Deleted.
        (WebCore::Range::absoluteTextQuads): Deleted.
        (WebCore::boundaryNodeChildrenChanged): Deleted.
        (WebCore::boundaryNodeWillBeRemoved): Deleted.
        (WebCore::Range::nodeWillBeRemoved): Deleted.
        (WebCore::boundaryTextRemoved): Deleted.
        (WebCore::Range::getBoundingClientRect): Deleted.
        (WebCore::Range::getBorderAndTextQuads): Deleted.
        * dom/Range.h:
        * dom/Range.idl:
        * dom/RangeBoundaryPoint.h:
        (WebCore::RangeBoundaryPoint::set):
        (WebCore::RangeBoundaryPoint::setToStartOfNode):
        (WebCore::RangeBoundaryPoint::setToEndOfNode):
        * editing/AlternativeTextController.cpp:
        (WebCore::AlternativeTextController::applyAlternativeTextToRange):
        * editing/ApplyStyleCommand.cpp:
        (WebCore::ApplyStyleCommand::fixRangeAndApplyInlineStyle):
        * editing/Editor.cpp:
        (WebCore::Editor::advanceToNextMisspelling):
        (WebCore::Editor::rangeOfString):
        (WebCore::isFrameInRange):
        (WebCore::Editor::countMatchesForText):
        * editing/EditorCommand.cpp:
        (WebCore::unionDOMRanges):
        (WebCore::executeDeleteToMark):
        (WebCore::executeSelectToMark):
        * editing/FormatBlockCommand.cpp:
        (WebCore::FormatBlockCommand::formatRange):
        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::respondToNodeModification):
        * editing/InsertListCommand.cpp:
        (WebCore::InsertListCommand::doApplyForSingleParagraph):
        * editing/TextCheckingHelper.cpp:
        (WebCore::TextCheckingParagraph::offsetTo):
        * editing/TextIterator.cpp:
        (WebCore::CharacterIterator::range):
        (WebCore::BackwardsCharacterIterator::range):
        (WebCore::TextIterator::rangeFromLocationAndLength):
        (WebCore::TextIterator::getLocationAndLengthFromRange):
        (WebCore::findPlainText):
        * editing/VisiblePosition.cpp:
        (WebCore::setStart):
        (WebCore::setEnd):
        * editing/VisibleSelection.cpp:
        (WebCore::makeSearchRange):
        * editing/VisibleUnits.cpp:
        (WebCore::previousBoundary):
        (WebCore::nextBoundary):
        * editing/htmlediting.cpp:
        (WebCore::visiblePositionForIndexUsingCharacterIterator):
        (WebCore::isNodeVisiblyContainedWithin):
        * editing/htmlediting.h:
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::adjustedSelectionRange):
        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::contextMenuItemSelected):
        * page/DOMSelection.cpp:
        (WebCore::DOMSelection::addRange):
        * page/DragController.cpp:
        (WebCore::selectElement):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::dispatchMouseEvent):
        * page/Page.cpp:
        (WebCore::Page::findStringMatchingRanges):
        * page/TextIndicator.cpp:
        (WebCore::hasNonInlineOrReplacedElements):
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::getRanges):

2016-04-21  Chris Dumez  <cdumez@apple.com>

        Drop [UsePointersEvenForNonNullableObjectArguments] from DOMURL
        https://bugs.webkit.org/show_bug.cgi?id=156797

        Reviewed by Youenn Fablet.

        * html/DOMURL.cpp:
        (WebCore::DOMURL::create):
        * html/DOMURL.h:
        * html/DOMURL.idl:

2016-04-21  Claudio Saavedra  <csaavedra@igalia.com>

        [GTK][EFL] Move non-glib/gtk platform implementations out of platform/gtk
        https://bugs.webkit.org/show_bug.cgi?id=156847

        Reviewed by Carlos Garcia Campos.

        The Language and Logging implementation don't really need glib, so
        rework them and move them to a new platform/unix directory so that
        they can be shared among Unix ports.

        * PlatformEfl.cmake: Use the unix version.
        * PlatformGTK.cmake: Same.
        * platform/efl/LanguageEfl.cpp: Removed.
        * platform/efl/LoggingEfl.cpp: Removed.
        * platform/unix/LanguageUnix.cpp: Renamed from Source/WebCore/platform/gtk/LanguageGtk.cpp.
        (WebCore::platformLanguage):
        (WebCore::platformUserPreferredLanguages):
        * platform/unix/LoggingUnix.cpp: Renamed from Source/WebCore/platform/gtk/LoggingGtk.cpp.
        (WebCore::logLevelString):

2016-04-21  Nan Wang  <n_wang@apple.com>

        AX: stringForTextMarkerRange returning empty string for document range
        https://bugs.webkit.org/show_bug.cgi?id=156819

        Reviewed by Chris Fleizach.

        Set text marker data with CharacterOffset when VisiblePosition is having PositionIsAfterAnchor
        or PositionIsAfterChildren anchor type, so that the character offset corresponds to the anchored
        node.

        Test: accessibility/mac/text-marker-string-for-document-range.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):

2016-04-20  Chris Dumez  <cdumez@apple.com>

        Crash under WebCore::TextIterator::subrange()
        https://bugs.webkit.org/show_bug.cgi?id=156809
        <rdar://problem/21102730>

        Reviewed by Ryosuke Niwa.

        TextIterator::rangeFromLocationAndLength() may return null. However, we
        failed to do a null check before calling TextIterator::subrange() with
        that range.

        No new tests, do not know how to reproduce.

        * editing/AlternativeTextController.cpp:
        (WebCore::AlternativeTextController::applyAlternativeTextToRange):

2016-04-20  Brady Eidson  <beidson@apple.com>

        Modern IDB (Workers): Remove IDBRequest/IDBOpenDBRequest's requirement to get an IDBServerConnection around.
        https://bugs.webkit.org/show_bug.cgi?id=156826

        Reviewed by Alex Christensen.

        No new tests (No behavior change, existing tests pass).

        This doesn't appear to do much but make things a little more complicated, but it's the first of a few 
        small pushes in the right direction.
        
        * Modules/indexeddb/IDBOpenDBRequest.cpp:
        (WebCore::IDBOpenDBRequest::maybeCreateDeleteRequest):
        (WebCore::IDBOpenDBRequest::maybeCreateOpenRequest):
        (WebCore::IDBOpenDBRequest::IDBOpenDBRequest):
        (WebCore::IDBOpenDBRequest::onSuccess):
        (WebCore::IDBOpenDBRequest::onUpgradeNeeded):
        (WebCore::IDBOpenDBRequest::requestCompleted):
        (WebCore::IDBOpenDBRequest::createDeleteRequest): Deleted.
        (WebCore::IDBOpenDBRequest::createOpenRequest): Deleted.
        * Modules/indexeddb/IDBOpenDBRequest.h:
        
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::IDBRequest):
        (WebCore::IDBRequest::connectionToServer):
        * Modules/indexeddb/IDBRequest.h:
        (WebCore::IDBRequest::connection): Deleted.
        
        * Modules/indexeddb/client/IDBConnectionProxy.cpp:
        (WebCore::IDBClient::IDBConnectionProxy::IDBConnectionProxy):
        (WebCore::IDBClient::IDBConnectionProxy::connectionToServer):
        (WebCore::IDBClient::IDBConnectionProxy::openDatabase):
        (WebCore::IDBClient::IDBConnectionProxy::deleteDatabase):
        * Modules/indexeddb/client/IDBConnectionProxy.h:
        (WebCore::IDBClient::IDBConnectionProxy::serverConnectionIdentifier):
        
        * Modules/indexeddb/shared/IDBResourceIdentifier.cpp:
        (WebCore::IDBResourceIdentifier::IDBResourceIdentifier):
        * Modules/indexeddb/shared/IDBResourceIdentifier.h:

2016-04-20  John Wilander  <wilander@apple.com>

        Add Subresource Integrity as "Under consideration".
        https://bugs.webkit.org/show_bug.cgi?id=156800

        Reviewed by Alexey Proskuryakov.

        No new tests needed.

        * features.json:
            Added an entry for Subresource Integrity.

2016-04-20  Anders Carlsson  <andersca@apple.com>

        Get rid of a couple of uses of ApplicationCacheStorage::singleton()
        https://bugs.webkit.org/show_bug.cgi?id=156818

        Reviewed by Geoffrey Garen.

        * loader/appcache/ApplicationCache.cpp:
        (WebCore::ApplicationCache::addResource):
        * loader/appcache/ApplicationCacheGroup.h:
        (WebCore::ApplicationCacheGroup::storage):
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::setApplicationCacheOriginQuota):

2016-04-20  Brady Eidson  <beidson@apple.com>

        Modern IDB (Workers): Introduce "IDBConnectionProxy" for future threading abstraction, and adopt it in IDBFactory.
        https://bugs.webkit.org/show_bug.cgi?id=156810

        Reviewed by Alex Christensen.

        No new tests (Covered by changes to existing tests).

        Add the IDBConnectionProxy object, including the ability to replicate IDBFactory functionality:
        * Modules/indexeddb/client/IDBConnectionProxy.cpp: Added.
        (WebCore::IDBClient::IDBConnectionProxy::IDBConnectionProxy):
        (WebCore::IDBClient::IDBConnectionProxy::openDatabase):
        (WebCore::IDBClient::IDBConnectionProxy::deleteDatabase):
        * Modules/indexeddb/client/IDBConnectionProxy.h: 
        
        Add pure virtual IDBConnectionProxy accessor:
        * dom/ScriptExecutionContext.h: 

        Implement it:
        * dom/Document.cpp:
        (WebCore::Document::idbConnectionProxy):
        * dom/Document.h:
        
        Implement it:
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::idbConnectionProxy):
        * workers/WorkerGlobalScope.h:
        
        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
        (WebCore::DOMWindowIndexedDatabase::indexedDB):


        Don't keep a reference to IDBConnectionToServer, but rather get at the context's IDBConnectionProxy:
        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::create):
        (WebCore::IDBFactory::IDBFactory):
        (WebCore::IDBFactory::open):
        (WebCore::IDBFactory::openInternal):
        (WebCore::IDBFactory::deleteDatabase):
        * Modules/indexeddb/IDBFactory.h:
        * Modules/indexeddb/IDBFactory.idl:

        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.cpp:
        (WebCore::WorkerGlobalScopeIndexedDatabase::indexedDB):

        * Modules/indexeddb/client/IDBConnectionToServer.h:

        * inspector/InspectorIndexedDBAgent.cpp:

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

2016-04-20  Chris Dumez  <cdumez@apple.com>

        Use Optional<size_t> for OrderIterator::m_orderIndex instead of int
        https://bugs.webkit.org/show_bug.cgi?id=156796

        Reviewed by Anders Carlsson.

        Use Optional<size_t> for OrderIterator::m_orderIndex instead of int
        (with invalid value of -1). m_orderIndex a vector index and therefore
        is in the range of an unsigned (type used internally by Vector, even
        though the index is exposed as size_t). Therefore, assigning it to an
        int is unsafe as it may overflow.

        This may fix <rdar://problem/23410338> which is a top crasher.

        * rendering/OrderIterator.cpp:
        (WebCore::OrderIterator::next):
        (WebCore::OrderIterator::reset):
        * rendering/OrderIterator.h:

2016-04-20  Chris Dumez  <cdumez@apple.com>

        Crash under needsAppleMailPaginationQuirk()
        https://bugs.webkit.org/show_bug.cgi?id=156806
        <rdar://problem/23323479>

        Reviewed by Simon Fraser.

        Add check for element()->hasID() before calling element()->idForStyleResolution()
        so that we don't dereference a potentially null element()->elementData().
        Also stop repeatedly atomizing "messageContentContainer" and leverage
        the operator==(const AtomicString&, const char*) instead for performance.

        * rendering/RenderBlockFlow.cpp:
        (WebCore::needsAppleMailPaginationQuirk):

2016-04-20  Brady Eidson  <beidson@apple.com>

        Attempt to fix non-INDEXED_DATABASE_IN_WORKERS builds after r199779

        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup):
        (WebCore::InternalSettings::Backup::restoreTo):
        (WebCore::InternalSettings::setIndexedDBWorkersEnabled):
        * testing/InternalSettings.h:

2016-04-20  Chris Dumez  <cdumez@apple.com>

        Potential overflow in RenderLayer::hitTestList()
        https://bugs.webkit.org/show_bug.cgi?id=156804

        Reviewed by Simon Fraser.

        Use size_t type instead of int to iterate over the Vector to make sure
        we don't overflow. This is a speculative fix for <rdar://problem/23249479>.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::hitTestList):

2016-04-20  Brady Eidson  <beidson@apple.com>

        Modern IDB (Workers): Enable INDEXED_DATABASE_IN_WORKERS compile time flag, but disabled in RuntimeEnabledFeatures.
        https://bugs.webkit.org/show_bug.cgi?id=156782

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/workers-disabled.html
              storage/indexeddb/modern/workers-enable.html

        * Configurations/FeatureDefines.xcconfig:

        ScriptExecutionContext shouldn't really be supplementable:
        * dom/ScriptExecutionContext.h:

        WorkerGlobalScope should be supplementable.
        Also modernize this archaic header (pragma once, and re-indent):
        * workers/WorkerGlobalScope.h:
        
        Update for WorkerGlobalScope now being directly supplementable:
        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.cpp:
        (WebCore::WorkerGlobalScopeIndexedDatabase::WorkerGlobalScopeIndexedDatabase):
        (WebCore::WorkerGlobalScopeIndexedDatabase::from):
        (WebCore::WorkerGlobalScopeIndexedDatabase::indexedDB):
        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.h:
        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.idl:
        * Modules/notifications/WorkerGlobalScopeNotifications.cpp:
        (WebCore::WorkerGlobalScopeNotifications::WorkerGlobalScopeNotifications):
        (WebCore::WorkerGlobalScopeNotifications::from):
        (WebCore::WorkerGlobalScopeNotifications::webkitNotifications):
        * Modules/notifications/WorkerGlobalScopeNotifications.h:
        
        Expose IndexedDBWorkers to RuntimeEnabledFeatures:
        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::setIndexedDBWorkersEnabled):
        (WebCore::RuntimeEnabledFeatures::indexedDBWorkersEnabled):

        Expose IndexedDBWorkers to InternalSettings:
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::Backup::Backup):
        (WebCore::InternalSettings::Backup::restoreTo):
        (WebCore::InternalSettings::setIndexedDBWorkersEnabled):
        * testing/InternalSettings.h:
        * testing/InternalSettings.idl:

2016-04-20  Dave Hyatt  <hyatt@apple.com>

        Hangable punctuation measurement using the wrong indices.
        https://bugs.webkit.org/show_bug.cgi?id=155899

        Reviewed by Simon Fraser.

        New tests in fast/text.

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::computeInlinePreferredLogicalWidths):
        * rendering/RenderText.cpp:
        (WebCore::RenderText::hangablePunctuationStartWidth):
        (WebCore::RenderText::hangablePunctuationEndWidth):
        (WebCore::RenderText::isHangableStopOrComma):

2016-04-20  Chris Dumez  <cdumez@apple.com>

        Drop [UsePointersEvenForNonNullableObjectArguments] from several Canvas interfaces
        https://bugs.webkit.org/show_bug.cgi?id=156781

        Reviewed by Darin Adler.

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::fill):
        (WebCore::CanvasRenderingContext2D::stroke):
        (WebCore::CanvasRenderingContext2D::clip):
        (WebCore::CanvasRenderingContext2D::isPointInPath):
        (WebCore::CanvasRenderingContext2D::isPointInStroke):
        (WebCore::size):
        (WebCore::CanvasRenderingContext2D::drawImage):
        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
        (WebCore::CanvasRenderingContext2D::drawFocusIfNeeded):
        * html/canvas/CanvasRenderingContext2D.h:
        * html/canvas/CanvasRenderingContext2D.idl:
        * html/canvas/DOMPath.h:
        * html/canvas/DOMPath.idl:
        * html/canvas/WebGLDebugShaders.cpp:
        (WebCore::WebGLDebugShaders::getTranslatedShaderSource):
        * html/canvas/WebGLDebugShaders.h:
        * html/canvas/WebGLDebugShaders.idl:

2016-04-20  Chris Dumez  <cdumez@apple.com>

        Drop [UsePointersEvenForNonNullableObjectArguments] from WebAudio
        https://bugs.webkit.org/show_bug.cgi?id=156777

        Reviewed by Darin Adler.

        Drop [UsePointersEvenForNonNullableObjectArguments] from WebAudio and
        modernize the interface a bit.

        There is no major Web-exposed behavioral change except for
        the exception type thrown when passing null (now always TypeError).
        Tests were updated to add coverage for this.

        * Modules/webaudio/AsyncAudioDecoder.cpp:
        (WebCore::AsyncAudioDecoder::decodeAsync):
        (WebCore::AsyncAudioDecoder::DecodingTask::DecodingTask):
        (WebCore::AsyncAudioDecoder::DecodingTask::decode): Deleted.
        * Modules/webaudio/AsyncAudioDecoder.h:
        (WebCore::AsyncAudioDecoder::DecodingTask::audioData):
        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::lazyInitialize):
        (WebCore::AudioContext::createBuffer):
        (WebCore::AudioContext::decodeAudioData):
        (WebCore::AudioContext::createBufferSource):
        (WebCore::AudioContext::createMediaElementSource):
        (WebCore::AudioContext::createMediaStreamSource):
        (WebCore::AudioContext::createMediaStreamDestination):
        (WebCore::AudioContext::createScriptProcessor):
        (WebCore::AudioContext::createBiquadFilter):
        (WebCore::AudioContext::createWaveShaper):
        (WebCore::AudioContext::createPanner):
        (WebCore::AudioContext::createConvolver):
        (WebCore::AudioContext::createDynamicsCompressor):
        (WebCore::AudioContext::createAnalyser):
        (WebCore::AudioContext::createGain):
        (WebCore::AudioContext::createDelay):
        (WebCore::AudioContext::createChannelSplitter):
        (WebCore::AudioContext::createChannelMerger):
        (WebCore::AudioContext::createOscillator):
        (WebCore::AudioContext::createPeriodicWave):
        (WebCore::AudioContext::derefFinishedSourceNodes):
        (WebCore::AudioContext::refNode):
        (WebCore::AudioContext::derefNode):
        (WebCore::AudioContext::notifyNodeFinishedProcessing): Deleted.
        (WebCore::AudioContext::derefUnfinishedSourceNodes): Deleted.
        (WebCore::AudioContext::lock): Deleted.
        * Modules/webaudio/AudioContext.h:
        * Modules/webaudio/AudioContext.idl:
        * Modules/webaudio/MediaElementAudioSourceNode.cpp:
        (WebCore::MediaElementAudioSourceNode::create):
        (WebCore::MediaElementAudioSourceNode::MediaElementAudioSourceNode):
        (WebCore::MediaElementAudioSourceNode::process):
        * Modules/webaudio/MediaElementAudioSourceNode.h:
        (WebCore::MediaElementAudioSourceNode::mediaElement):
        * Modules/webaudio/OscillatorNode.idl:

2016-04-20  Brady Eidson  <beidson@apple.com>

        Addressing additional review feedback for:
        Modern IDB: Lots of IDB bindings cleanup (including making IDBVersionChangeEvent constructible).
        https://bugs.webkit.org/show_bug.cgi?id=156760

        * Modules/indexeddb/IDBVersionChangeEvent.h:

2016-04-20  Frederic Wang  <fwang@igalia.com>

        Use OpenType MATH fonts by default
        https://bugs.webkit.org/show_bug.cgi?id=133603

        Reviewed by Alejandro G. Castro.

        No new tests. This is already tested by pixel tests like roots.xhtml.
        However, new math fonts are not used during test execution.

        * css/mathml.css:
        (math): We use only a list of known OpenType fonts with a MATH table but keep some pre-installed fallback fonts for OS X and iOS.

2016-04-20  Claudio Saavedra  <csaavedra@igalia.com>

        [GTK] Move GTK+-independent platform code to platform/glib
        https://bugs.webkit.org/show_bug.cgi?id=156787

        Reviewed by Carlos Garcia Campos.

        There is plenty of code in platform/gtk that is independent from the GTK+ library.
        Move those files to platform/glib so that they can be reused by other GLib-based ports.

        Also clean some style warnings in those files.

        * PlatformGTK.cmake: Move the files.
        * platform/glib/EventLoopGlib.cpp: Renamed from Source/WebCore/platform/gtk/EventLoopGtk.cpp.
        (WebCore::EventLoop::cycle):
        * platform/glib/FileSystemGlib.cpp: Renamed from Source/WebCore/platform/gtk/FileSystemGtk.cpp.
        (WebCore::filenameToString):
        (WebCore::unescapedFilename):
        (WebCore::fileSystemRepresentation):
        (WebCore::filenameForDisplay):
        (WebCore::fileExists):
        (WebCore::deleteFile):
        (WebCore::deleteEmptyDirectory):
        (WebCore::getFileStat):
        (WebCore::getFileSize):
        (WebCore::getFileCreationTime):
        (WebCore::getFileModificationTime):
        (WebCore::getFileMetadata):
        (WebCore::pathByAppendingComponent):
        (WebCore::makeAllDirectories):
        (WebCore::homeDirectoryPath):
        (WebCore::pathGetFileName):
        (WebCore::applicationDirectoryPath):
        (WebCore::sharedResourcesPath):
        (WebCore::getVolumeFreeSizeForPath):
        (WebCore::directoryName):
        (WebCore::listDirectory):
        (WebCore::openTemporaryFile):
        (WebCore::openFile):
        (WebCore::closeFile):
        (WebCore::seekFile):
        (WebCore::writeToFile):
        (WebCore::readFromFile):
        (WebCore::unloadModule):
        (WebCore::hardLinkOrCopyFile):
        * platform/glib/GamepadsGlib.cpp: Renamed from Source/WebCore/platform/gtk/GamepadsGtk.cpp.
        (WebCore::GamepadDeviceGlib::GamepadDeviceGlib):
        (WebCore::GamepadDeviceGlib::~GamepadDeviceGlib):
        (WebCore::GamepadDeviceGlib::readCallback):
        (WebCore::GamepadsGlib::GamepadsGlib):
        (WebCore::GamepadsGlib::~GamepadsGlib):
        (WebCore::GamepadsGlib::registerDevice):
        (WebCore::GamepadsGlib::unregisterDevice):
        (WebCore::GamepadsGlib::updateGamepadList):
        (WebCore::GamepadsGlib::onUEventCallback):
        (WebCore::GamepadsGlib::isGamepadDevice):
        (WebCore::sampleGamepads):
        * platform/glib/SharedBufferGlib.cpp: Renamed from Source/WebCore/platform/gtk/SharedBufferGtk.cpp.
        (WebCore::SharedBuffer::createFromReadingFile):

2016-04-20  Frederic Wang  <fwang@igalia.com>

        Refactor RenderMathMLSpace to avoid using flexbox
        https://bugs.webkit.org/show_bug.cgi?id=155168

        Reviewed by Martin Robinson.

        No new tests, already covered by existing tests. The behavior of mspace-prefered-width-expected is not specified by the MathML recommendation, we update that test to match our new behavior.

        * rendering/mathml/RenderMathMLSpace.cpp: Implement layout functions without passing by flebox.
        (WebCore::RenderMathMLSpace::computePreferredLogicalWidths): Implement this function.
        (WebCore::RenderMathMLSpace::layoutBlock): Implement this function.
        (WebCore::RenderMathMLSpace::computeIntrinsicLogicalWidths): Deleted.
        (WebCore::RenderMathMLSpace::updateLogicalWidth): Deleted.
        (WebCore::RenderMathMLSpace::updateLogicalHeight): Deleted.
        * rendering/mathml/RenderMathMLSpace.h: Update function declarations.

2016-04-20  Carlos Garcia Campos  <cgarcia@igalia.com>

        [Cairo] Crash in GraphicsContext::drawFocusRing when painting is disabled
        https://bugs.webkit.org/show_bug.cgi?id=156785

        Reviewed by Žan Doberšek.

        This happens for example when view state changes to focus and paint is called from
        FrameView::updateControlTints() with a graphics context that doesn't have a platform context. Layout test
        fast/images/image-map-outline-with-scale-transform.html sometimes crashes because of this.

        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::drawFocusRing): Return early if painting is disabled.

2016-04-19  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r198782): SHOULD NEVER BE REACHED failure in ImageSource::setData since r198782
        https://bugs.webkit.org/show_bug.cgi?id=156690

        Reviewed by Michael Catanzaro.

        The assertion is wrong, because it assumes that ImageDecoder::create() always returns a valid pointer, which is
        only true for the CG implementation. The non CG implementation can return nullptr if there isn't enough data to
        figure out the image format or if the image format is not supported. This is causing several crashes in the
        debug bots.

        * platform/graphics/ImageSource.cpp:
        (WebCore::ImageSource::setData): Remove the invalid ASSERT and return early if we fail to create the decoder.
        (WebCore::ImageSource::ensureDecoderIsCreated): Deleted.
        * platform/graphics/ImageSource.h:

2016-04-19  Brent Fulgham  <bfulgham@apple.com>

        Remove remaining bits of dynamic <link> rel='icon' loading
        https://bugs.webkit.org/show_bug.cgi?id=156727

        Reviewed by Darin Adler.

        Don't call 'shouldLoadLink' for 'icon' link types. It performs no
        useful checks for 'icon' types, and emits the non-standard
        'onbeforeload' event.

        This work finishes up https://webkit.org/b/153151, where we removed
        FrameLoaderClient::dispatchDidChangeIcons() and related code.

        Test: webarchive/test-link-rel-subresource-beforeload.html

        * loader/LinkLoader.cpp:
        (WebCore::LinkLoader::loadLink): Remove unneeded call to 'shouldLoadLink'.

2016-04-19  Chris Dumez  <cdumez@apple.com>

        AudioBufferSourceNode.buffer should be nullable
        https://bugs.webkit.org/show_bug.cgi?id=156769

        Reviewed by Darin Adler.

        AudioBufferSourceNode.buffer should be nullable as per the
        specification:
        https://webaudio.github.io/web-audio-api/#AudioBufferSourceNode

        Our implementation was initially returning null when getting
        AudioBufferSourceNode.buffer, which is correct. However, it would
        throw a TypeError when trying to set the attribute to null. Our
        implementation setter actually supported setting the buffer to
        null but the custom bindings for the setter would not.

        This patch does the following:
        - Get rid of the custom bindings for the AudioBufferSourceNode.buffer
          setter. We can have the bindings generator generate the same code
          by using [StrictTypeChecking]. The custom bindinds were also throwing
          a TypeError if the input AudioBuffer had too many channels but this
          does not seem to be possible.
        - Mark AudioBufferSourceNode.buffer as nullable in the IDL so that
          we no longer throw when the JS tries to assign null, but instead
          calls AudioBufferSourceNode::setBuffer(nullptr)

        No new test, updated webaudio/audiobuffersource-channels.html

        * CMakeLists.txt:
        * Modules/webaudio/AudioBufferSourceNode.cpp:
        (WebCore::AudioBufferSourceNode::setBuffer):
        * Modules/webaudio/AudioBufferSourceNode.h:
        * Modules/webaudio/AudioBufferSourceNode.idl:
        * Modules/webaudio/AudioContext.h:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSAudioBufferSourceNodeCustom.cpp: Removed.

2016-04-19  Brady Eidson  <beidson@apple.com>

        Modern IDB: Lots of IDB bindings cleanup (including making IDBVersionChangeEvent constructible).
        https://bugs.webkit.org/show_bug.cgi?id=156760

        Reviewed by Darin Adler (and looked over by Chris Dumez and Alex Christensen).

        Test: storage/indexeddb/modern/idbversionchangeevent-constructor.html

        Add WorkerGlobalScopeConstructors to the xcodeproj:
        * WebCore.xcodeproj/project.pbxproj:

        Remove the completely irrelevant webkit* prefixed constructors from DOMWindow:
        * page/DOMWindow.idl:

        Remove the poor way most objects were exposed on the WorkerGlobalScope:
        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.idl:

        Expose most of the objects on the WorkerGlobalScope the correct way:
        * Modules/indexeddb/IDBCursor.idl:
        * Modules/indexeddb/IDBCursorWithValue.idl:
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBFactory.idl:
        * Modules/indexeddb/IDBIndex.idl:
        * Modules/indexeddb/IDBKeyRange.idl:
        * Modules/indexeddb/IDBObjectStore.idl:
        * Modules/indexeddb/IDBOpenDBRequest.idl:
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.idl:

        Make IDBVersionChangeEvent constructible:        
        * Modules/indexeddb/IDBVersionChangeEvent.cpp:
        (WebCore::IDBVersionChangeEvent::IDBVersionChangeEvent):
        (WebCore::IDBVersionChangeEvent::newVersion): Deleted.
        * Modules/indexeddb/IDBVersionChangeEvent.h:
        * Modules/indexeddb/IDBVersionChangeEvent.idl:

        * bindings/js/JSDictionary.h:
        (WebCore::JSDictionary::convertValue): Add a templated form of convertValue that
          handles Optional<>s.

2016-04-19  Alex Christensen  <achristensen@webkit.org>

        Build fix after r199738

        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
        (WebCore::GraphicsContext3D::GraphicsContext3D):
        * platform/graphics/win/GraphicsContext3DWin.cpp:
        (WebCore::GraphicsContext3D::GraphicsContext3D):

2016-04-19  Keith Miller  <keith_miller@apple.com>

        ObjcInstance::stringValue should not call NSObject's description method
        https://bugs.webkit.org/show_bug.cgi?id=156758

        Reviewed by Geoffrey Garen.

        This patch makes it so that we no longer call NSObject's description method without first
        swizzling the implementation for WebScriptObjects. We restore the incomming NSObject's
        description method once we have finished generating the string.

        Test: platform/mac/fast/objc/webScriptObject-does-not-call-description-on-nsobject.html

        * bridge/objc/objc_instance.mm:
        (swizzleNSObjectDescription):
        (ObjcInstance::stringValue):

2016-04-19  Alex Christensen  <achristensen@webkit.org>

        Update ANGLE
        https://bugs.webkit.org/show_bug.cgi?id=156755

        Reviewed by Dean Jackson.

        * CMakeLists.txt:
        * platform/graphics/ANGLEWebKitBridge.h:
        (WebCore::ANGLEWebKitBridge::getResources):
        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
        (WebCore::GraphicsContext3D::GraphicsContext3D):
        Continue to compile successfully with new ANGLE.

2016-04-19  Chris Dumez  <cdumez@apple.com>

        Mark more classes as WTF_MAKE_FAST_ALLOCATED
        https://bugs.webkit.org/show_bug.cgi?id=156732

        Reviewed by Darin Adler.

        * css/CSSImageGeneratorValue.h:
        * css/DocumentRuleSets.h:
        * css/MediaQueryMatcher.h:
        * css/RuleFeature.h:
        * css/StyleResolver.h:
        * dom/ActiveDOMCallbackMicrotask.h:
        * dom/DocumentSharedObjectPool.h:
        * dom/MutationObserver.cpp:
        * dom/MutationObserverInterestGroup.h:
        * dom/MutationObserverRegistration.h:
        * dom/ScriptExecutionContext.cpp:
        * dom/SlotAssignment.h:
        * html/HTMLCollection.h:
        * html/canvas/CanvasRenderingContext2D.cpp:
        * html/parser/HTMLToken.h:
        * html/parser/XSSAuditorDelegate.h:
        * loader/FrameLoader.cpp:
        * loader/SubframeLoader.h:
        * page/AutoscrollController.h:
        * page/csp/ContentSecurityPolicySource.h:
        * platform/cf/RunLoopObserver.h:
        * platform/graphics/FloatQuad.h:
        * platform/graphics/FloatRoundedRect.h:
        * platform/graphics/IntSize.h:
        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
        * platform/graphics/cg/ImageDecoderCG.h:
        * platform/graphics/cocoa/IOSurface.h:
        * platform/graphics/displaylists/DisplayList.h:
        * platform/graphics/mac/ComplexTextController.h:
        * platform/graphics/mac/FontCustomPlatformData.h:
        * platform/mac/PowerObserverMac.h:
        * platform/network/DataURLDecoder.cpp:
        * platform/text/PlatformLocale.h:
        * rendering/TextAutosizer.h:
        * style/StyleUpdate.h:
        * xml/XMLHttpRequestUpload.h:

2016-04-18  Ada Chan  <adachan@apple.com>

        Context menu items related to fullscreen should be specific to standard fullscreen
        https://bugs.webkit.org/show_bug.cgi?id=156723
        <rdar://problem/25452632>

        Reviewed by Darin Adler.

        Introduce HTMLMediaElement::isStandardFullscreen() that the HitTestResult code can use
        when handling the validation and selection of fullscreen-related context menu items.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::isStandardFullscreen):
        (WebCore::HTMLMediaElement::toggleStandardFullscreenState):
        Renamed to make it clear that it's for toggling standard fullscreen. Call the new
        HTMLMediaElement::isStandardFullscreen().
        * html/HTMLMediaElement.h:
        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::mediaIsInFullscreen):
        Use HTMLMediaElement::isStandardFullscreen().
        (WebCore::HitTestResult::toggleMediaFullscreenState):
        Call the renamed HTMLMediaElement::toggleStandardFullscreenState().

2016-04-19  Brady Eidson  <beidson@apple.com>

        Modern IDB: ObjectStore Blob Support.
        https://bugs.webkit.org/show_bug.cgi?id=143193

        Reviewed by Alex Christensen.

        Tests: imported/blink/storage/indexeddb/blob-basics-metadata.html
               imported/blink/storage/indexeddb/blob-delete-objectstore-db.html
               imported/blink/storage/indexeddb/blob-valid-after-deletion.html
               imported/blink/storage/indexeddb/blob-valid-before-commit.html
               imported/blink/storage/indexeddb/empty-blob-file.html
               storage/indexeddb/modern/blob-simple.html

        Most of the work has been done already.
        
        Besides a handful of tweaks to that work, all this really does is remove the clause
        that prevents blob URLs from going into the database.

        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::putOrAdd): Only disallow blobs if private browsing is enabled
          (Making that work is already covered by another bug)
          
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::putOrAddOnServer):

        * Modules/indexeddb/IDBValue.cpp:
        (WebCore::IDBValue::IDBValue):

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteUnusedBlobFileRecords):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteBackingStore):

        * Modules/indexeddb/server/SQLiteIDBTransaction.cpp:
        (WebCore::IDBServer::SQLiteIDBTransaction::deleteBlobFilesIfNecessary):

        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::writeBlobsToTemporaryFiles):

        * platform/sql/SQLiteFileSystem.cpp:
        (WebCore::SQLiteFileSystem::deleteDatabaseFile): Delete all database-related files 
          now that we use WAL mode.

2016-04-19  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Use the margin box for non-auto minimum sizes
        https://bugs.webkit.org/show_bug.cgi?id=156711

        Reviewed by Darin Adler.

        When computing the min-size of items with non-auto minimum height/width we are incorrectly
        returning the size of the border box, and thus incorrectly ignoring the margins of the item.

        This is a follow up patch of r199153 were we added the missing border and paddings for
        heights. Contrary to that, we were not including margins for both axis.

        This CL requires 3 different interrelated changes:
        - Add the margins to the min-size returned by minSizeForChild (might require a layout).
        - Refactor and extract width computations from logicalHeightForChild(); not totally
        mandatory but pretty logical and helpful.
        - Use a new update function to isolate the computation of the override width.

        Test: fast/css-grid-layout/min-width-margin-box.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeInlineDirectionMargins): Added const to a parameter.
        * rendering/RenderBox.h:
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computeTrackSizesForDirection): Initialize the sizingOperation.
        (WebCore::RenderGrid::computeIntrinsicLogicalWidths): Ditto.
        (WebCore::RenderGrid::computeIntrinsicLogicalHeight): Ditto.
        (WebCore::RenderGrid::logicalHeightForChild): Renamed from logicalContentHeightForChild as
        it no longer returns the content size but the outer size.
        (WebCore::RenderGrid::minSizeForChild):
        (WebCore::RenderGrid::updateOverrideContainingBlockContentLogicalWidthForChild): Extracted
        from logicalHeightForChild().
        (WebCore::RenderGrid::minContentForChild): Update override width if needed.
        (WebCore::RenderGrid::maxContentForChild): Ditto.
        (WebCore::RenderGrid::computeMarginLogicalSizeForChild): Generalized from
        computeMarginLogicalHeightForChild(), it can now compute also margins for the inline
        direction.
        (WebCore::RenderGrid::availableAlignmentSpaceForChildBeforeStretching):
        (WebCore::RenderGrid::logicalContentHeightForChild): Deleted.
        (WebCore::RenderGrid::computeMarginLogicalHeightForChild): Deleted.
        * rendering/RenderGrid.h:

2016-04-19  Carlos Garcia Campos  <cgarcia@igalia.com>

        [Cairo] GraphicsContext::drawFocusRing methods are not consistent to each other
        https://bugs.webkit.org/show_bug.cgi?id=156742

        Reviewed by Martin Robinson.

        We are rendering the focus ring differently depending on whether a path is used or a vector of rectangles. This
        is causing that some reftests fail because they assume we always render the focus ring the same way. For example
        fast/images/image-map-outline-in-positioned-container.html, when rendering the test
        GraphicsContext::drawFocusRing is called with a path, and when rendering the reference it's called with a vector
        of rectangles, producing different results.

        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::drawFocusRing): When receiving a vector of rectangles, build a Path from the given
        rectangles and call drawFocusRing() with the built path to ensure consistency.

2016-04-19  Antti Koivisto  <antti@apple.com>

        Move FontSelectorClient to a file of its own
        https://bugs.webkit.org/show_bug.cgi?id=156738

        Reviewed by Carlos Garcia Campos.

        So modifying FontSelector does not trigger world rebuild via Document.h.

        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSFontSelector.cpp:
        * dom/Document.h:
        * html/canvas/CanvasRenderingContext2D.h:
        * platform/graphics/FontSelector.h:
        (WebCore::FontSelectorClient::~FontSelectorClient): Deleted.
        * platform/graphics/FontSelectorClient.h: Added.
        (WebCore::FontSelectorClient::~FontSelectorClient):

2016-04-19  Joanmarie Diggs  <jdiggs@igalia.com>

        [GTK] accessibility/gtk/entry-and-password.html is failing since r194847
        https://bugs.webkit.org/show_bug.cgi?id=153062

        Reviewed by Carlos Garcia Campos.

        The changes in r194847 include using WebCore's rendering for the CapsLock indicator.
        As a side effect, password inputs gained a TextControlInnerTextElement child from
        the Shadow DOM. If we include that child in the accessibility tree, the child will
        emit focus and text notifications that suggest the user is no longer in the control.
        This can be especially problematic for screen reader users with key echo enabled
        when typing in a password input. To fix this, prune TextControlInnerTextElement
        children from the accessibility tree for ATK.

        No new tests as existing coverage caught this regression. Also modified the
        auto-fill-crash.html test whose expectations include the children count for
        a text input.

        * accessibility/atk/AccessibilityObjectAtk.cpp:
        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):

2016-04-18  Brady Eidson  <beidson@apple.com>

        Modern IDB (Blob support): When reading Blobs from the database, grant the Networking process sandbox access to the files.
        https://bugs.webkit.org/show_bug.cgi?id=156640

        Reviewed by Alex Christensen.

        No new tests (No change in behavior, as blobs in IDB are not yet enabled,
                      but when they are enabled testing will cover this).

        * Modules/indexeddb/shared/IDBResultData.h: Export some stuff
        
        * fileapi/ThreadableBlobRegistry.cpp:
        (WebCore::ThreadableBlobRegistry::registerBlobURLOptionallyFileBacked): Account for 
          BlobRegistry change described below.
        
        * platform/network/BlobRegistry.h: Change registerBlobURLOptionallyFileBacked to take a 
          BlobDataFileReference instead of a raw path, to allow WK2 to include a sandbox extension.
        
        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::registerBlobURL): Account for BlobRegistry change described above.
        (WebCore::BlobRegistryImpl::registerBlobURLOptionallyFileBacked): Use the passed in 
          BlobDataFileHandle, and also register the BlobResourceHandle constructor.
        * platform/network/BlobRegistryImpl.h:

2016-04-18  Alex Christensen  <achristensen@webkit.org>

        Fix iOS build after r199701

        * platform/ios/WebAVPlayerController.mm:

2016-04-18  Darin Adler  <darin@apple.com>

        Updated binding test result to reflect the change to not use Deprecated::ScriptValue.

        * bindings/scripts/test/JS/JSTestObj.cpp: Regenerated with new script.

2016-04-18  Darin Adler  <darin@apple.com>

        Remove all use of Deprecated::ScriptValue in generated bindings
        https://bugs.webkit.org/show_bug.cgi?id=156706

        Reviewed by Brady Eidson.

        * Modules/indexeddb/IDBCursor.idl: Removed unneeded [ImplementationReturnType=JSValue].
        * Modules/indexeddb/IDBCursorWithValue.idl: Ditto.

        * Modules/indexeddb/IDBKeyRange.cpp:
        (WebCore::IDBKeyRange::lowerValue): Deleted.
        (WebCore::IDBKeyRange::upperValue): Deleted.
        (WebCore::IDBKeyRange::only): Changed to take ExecState since the old code just used
        the ScriptExecutionContext to get back to the (potentially wrong) ExecState. Also kept
        one overload that takes ScriptExecutionContext because I could not change all callers.
        (WebCore::IDBKeyRange::lowerBound): Ditto.
        (WebCore::IDBKeyRange::upperBound): Ditto.
        (WebCore::IDBKeyRange::bound): Ditto.

        * Modules/indexeddb/IDBKeyRange.h: Updated for above.

        * Modules/indexeddb/IDBKeyRange.idl: Use [ImplementationReturnType=IDBKey].
        Use ScriptState instead of ScriptExecutionContext.

        * Modules/streams/ReadableStreamSource.h: Take JSValue instead of Deprecated::ScriptValue
        for the ignored argument to the cancel function.

        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::toJS): Renamed idbKeyToJSValue to this, the traditional name used in the
        bindings generator for all these functions. Also changed to take references.
        (WebCore::injectIDBKeyIntoScriptValue): Updated to call with the new name and types.
        (WebCore::idbKeyDataToScriptValue): Ditto.

        * bindings/js/IDBBindingUtilities.h: Added declaration of toJS for IDBKey.

        * bindings/scripts/CodeGeneratorJS.pm: Use JSC::JSValue instead of Deprecated::ScriptValue
        for the "any" type.
        (JSValueToNative): Just return the value with no transformation when type is "any".
        (NativeToJSValue): Changed default behavior for "any" to just pass the value as is with
        no transfomration. Removed unused ImplementationReturnType case for inside Document.
        Removed JSValue case since it's the default now. Added IDBKey case that matches the
        IDBKeyPath case (still wondering if we can do those without an attribute). Removed bogus
        second check for type "any".

2016-04-18  Martin Robinson  <mrobinson@igalia.com>

        [GTK] Possible off-by-one in hyphenation code
        https://bugs.webkit.org/show_bug.cgi?id=156661

        Reviewed by Michael Catanzaro.

        No new tests. This is covered by older tests.

        * platform/text/hyphen/HyphenationLibHyphen.cpp:
        (WebCore::lastHyphenLocation): Fix an off by one error in hyphen location.

2016-04-18  Eric Carlson  <eric.carlson@apple.com>

        [OSX] AVKit is not available on all systems
        https://bugs.webkit.org/show_bug.cgi?id=156724
        <rdar://problem/25501587>

        Reviewed by Dean Jackson.

        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm: Add _OPTIONAL to all
          AVKit softlink macros.
        * platform/ios/WebAVPlayerController.mm: Ditto.
        * platform/ios/WebPlaybackSessionInterfaceAVKit.mm: Ditto.
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm: Ditto.
        * platform/mac/WebPlaybackSessionInterfaceMac.mm: Ditto.
        * platform/mac/WebVideoFullscreenInterfaceMac.mm: Ditto.

2016-04-18  Gavin Barraclough  <barraclough@apple.com>

        WebKit should adopt journal_mode=wal for all SQLite databases.
        https://bugs.webkit.org/show_bug.cgi?id=133496

        Reviewed by Brady Eidson.

        Enabling sqlite3 WAL mode on iOS causes a test failure, but appears just be something that should fail still failing, only in a different way.
        Enabling & marking test as failing for now. Tracking test failure here:
            https://bugs.webkit.org/show_bug.cgi?id=156718

        * platform/sql/SQLiteDatabase.cpp:
        (WebCore::SQLiteDatabase::open):
            - enable on iOS.

2016-04-18  Brent Fulgham  <bfulgham@apple.com>

        Remove support for X-Frame-Options in `<meta>`
        https://bugs.webkit.org/show_bug.cgi?id=156625
        <rdar://problem/25748714>

        Rubberstamped by Darin Adler.

        * dom/Document.cpp:
        (WebCore::Document::processHttpEquiv): Revise messaging based on Darin's comments.

2016-04-18  Chris Dumez  <cdumez@apple.com>

        Crash in ElementDescendantIterator::operator--() when calling m_ancestorSiblingStack.last()
        https://bugs.webkit.org/show_bug.cgi?id=156715
        <rdar://problem/25750864>

        Reviewed by Antti Koivisto.

        Fix correctness of ElementDescendantIterator::operator--(). The last element
        in the m_ancestorSiblingStack stack is nullptr. However, if our parent does
        not have a sibling, m_current->nextSibling() == m_ancestorSiblingStack.last()
        would be true and we would end up removing the nullptr element from
        m_ancestorSiblingStack. We would crash on a follow-up call to operator--()
        because m_ancestorSiblingStack.last() would do an out-of-bound access, given
        that m_ancestorSiblingStack is empty.

        Test: fast/dom/collection-backward-traversal-crash.html

        * dom/ElementDescendantIterator.h:
        (WebCore::ElementDescendantIterator::operator--):

2016-04-18  Anders Carlsson  <andersca@apple.com>

        Fix build with newer versions of clang.
        rdar://problem/25749769

        Forward declare performClose:.

        * platform/mac/WebCoreFullScreenWindow.mm:

2016-04-18  Tina Liu  <iting_liu@apple.com>

        Declare a virtual function in PluginStrategy to be implemented by subclasses.
        https://bugs.webkit.org/show_bug.cgi?id=156540

        Reviewed by Anders Carlsson.

        * plugins/PluginStrategy.h:

2016-04-18  Eric Carlson  <eric.carlson@apple.com>

        [iOS] don't toggle playback when media engine rate changes
        https://bugs.webkit.org/show_bug.cgi?id=156705
        <rdar://problem/25779175>

        Reviewed by Jer Noble.

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::rateChanged): Don't send the play/pause command
          unless the player item state is >= MediaPlayerAVPlayerItemStatusPlaybackBufferFull and
          the rate change is unexpected.

2016-04-18  Chris Dumez  <cdumez@apple.com>

        Unreviewed, fix iOS9 build after r199682.

        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.cpp:
        (WebCore::SynchronousResourceHandleCFURLConnectionDelegate::didReceiveResponse):

2016-04-18  Chris Dumez  <cdumez@apple.com>

        [WK2][iOS] Only adjust network responses' MIME type for QuickLook in the context of a main resource load
        https://bugs.webkit.org/show_bug.cgi?id=156639
        <rdar://problem/25765848>

        Reviewed by Alex Christensen.

        Only adjust network responses' MIME type for QuickLook in the context of a main
        resource load since we can only preview main resources with QuickLook. This
        avoids doing unnecessary work during page load. Also, this makes it a lot less
        likely to dlopen() the QuickLook library during page load since we now only
        adjust MIME type for QuickLook for main resources, and main resources usually
        have the well-known 'text/html' MIME type for which we know we will not use
        QuickLook.

        After this change, we no longer need to dlopen() the QuickLook library in the
        NetworkProcess in the context of the PLT. We would previously dlopen() the
        library during the first page load, thus significantly slowing it down. As a
        result, we see a ~22% speed up in the PLT's first page load and a 0.9-1% overall
        PLT progression.

        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveResponse):
        Pass flag to adjustMIMETypeIfNecessary() indicated if this is a main resource load.

        * platform/network/ios/WebCoreURLResponseIOS.mm:
        (WebCore::adjustMIMETypeIfNecessary):
        Only adjust the MIME type for QuickLook if the isMainResourceLoad parameter is true.

        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]):
        Only adjust the MIME type for QuickLook if the isMainResourceLoad parameter is true.

        * platform/network/mac/WebCoreURLResponse.h:
        * platform/network/mac/WebCoreURLResponse.mm:
        (WebCore::adjustMIMETypeIfNecessary):

2016-04-18  Brent Fulgham  <bfulgham@apple.com>

        CSP: Remove stubs for dynamically-added favicons (via link rel="icon")
        https://bugs.webkit.org/show_bug.cgi?id=153151
        <rdar://problem/24383176>

        Reviewed by Darin Adler.

        Remove the unused dynamic favicon code and tests.

        * loader/EmptyClients.h:
        * loader/FrameLoaderClient.h:
        * loader/LinkLoader.cpp:
        (WebCore::LinkLoader::loadLink):

2016-04-15  Jer Noble  <jer.noble@apple.com>

        [Mac][EME] Protected content over HLS is not notified when a HDCP violation occurs.
        https://bugs.webkit.org/show_bug.cgi?id=156633

        Reviewed by Eric Carlson.

        Pass through the existing "outputObscuredDueToInsufficientExternalProtection" status as an
        error, similarly to what we do for CDMSessionMediaSourceAVFObjC.

        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.h:
        (WebCore::CDMSessionAVFoundationObjC::~CDMSessionAVFoundationObjC): Deleted.
        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm:
        (SOFT_LINK_CLASS):
        (-[WebCDMSessionAVFoundationObjCListener initWithParent:player:]):
        (-[WebCDMSessionAVFoundationObjCListener invalidate]):
        (-[WebCDMSessionAVFoundationObjCListener observeValueForKeyPath:ofObject:change:context:]):
        (WebCore::CDMSessionAVFoundationObjC::CDMSessionAVFoundationObjC):
        (WebCore::CDMSessionAVFoundationObjC::~CDMSessionAVFoundationObjC):
        (WebCore::CDMSessionAVFoundationObjC::generateKeyRequest):
        (WebCore::CDMSessionAVFoundationObjC::playerDidReceiveError):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::avPlayer):

2016-04-18  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r199644.

        Seems to have caused a 1-2% regression on warm PLT

        Reverted changeset:

        "[WK2][iOS] Do not dlopen() QuickLook in the NetworkProcess"
        https://bugs.webkit.org/show_bug.cgi?id=156639
        http://trac.webkit.org/changeset/199644

2016-04-17  Darin Adler  <darin@apple.com>

        Get rid of IDBAny
        https://bugs.webkit.org/show_bug.cgi?id=156681

        Reviewed by Brady Eidson.

        IDBAny is not part of the public interface of Indexed Database.
        It was an implementation technique used to help create language bindings for
        functions that have to deal with types that aren't easly expressed with the
        normal IDL and C++ type system.

        What was particularly dangerous about IDBAny is that it can be used to store
        arbitrary JavaScript objects and it's not easy to handle garbage collection and
        reference cycles when they are hidden behind this class's abstraction. It's also
        a needless extra layer, a reference counted object just to carry the types from
        the bindings to the C++ DOM implementation.

        Ths patch also does many small style tweaks.

        * CMakeLists.txt: Removed IDBAny source files. Added JSIDBRequestCustom.cpp.
        * DerivedSources.cpp: Ditto.
        * DerivedSources.make: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.

        * Modules/indexeddb/IDBAny.cpp: Removed.
        * Modules/indexeddb/IDBAny.h: Removed.
        * Modules/indexeddb/IDBAny.idl: Removed.

        * Modules/indexeddb/IDBCursor.cpp: Added includes needed now that headers don't
        include as much.
        (WebCore::IDBCursor::stringToDirection): Removed unneeded IDBCursor namespacing.
        (WebCore::IDBCursor::directionToString): Ditto.
        (WebCore::IDBCursor::IDBCursor): Removed creation of IDBAny object.
        (WebCore::IDBCursor::direction): Removed unneeded IDBCursor namespacing.
        (WebCore::IDBCursor::key): Moved this function to the header.
        (WebCore::IDBCursor::primaryKey): Ditto.
        (WebCore::IDBCursor::value): Ditto.
        (WebCore::IDBCursor::source): Deleted this function; replaced with multiple
        type-specific functions; all but one will return null.
        (WebCore::IDBCursor::update): Take JSValue instead of Deprecated::ScriptValue.
        (WebCore::IDBCursor::advance): Take unsigned instead of unsigned long.
        Fell prey to the confusion because "unsigned long" in IDL means "unsigned" in C++.
        (WebCore::IDBCursor::continueFunction): Take JSValue instead of Deprecated::ScriptValue.
        (WebCore::IDBCursor::uncheckedIterateCursor): Take unsigned instead of unsigned long.
        (WebCore::IDBCursor::setGetResult): Rewrote to get the VM pointer from the
        ScriptExecutionContext here instead of inside the binding utilities functions.

        * Modules/indexeddb/IDBCursor.h: Removed many unneeded includes.
        Changed key, primaryKey, and value to no longer take an unneeded ExecState.
        Made more functions private.

        * Modules/indexeddb/IDBCursor.idl: Changed type of "source" to "any", which matches
        the IDB specification, rather than "IDBAny". Added [CustomGetter] so we can write the
        getter that understands the multiple possible values. Removed unneeded
        [CallWith=ScriptState] from key and primaryKey attributes.

        * Modules/indexeddb/IDBCursorWithValue.h: Marked the class final.
        * Modules/indexeddb/IDBCursorWithValue.idl: Removed unneeded [CallWith=ScriptState]
        from the value attribute.

        * Modules/indexeddb/IDBDatabase.cpp: Added now-needed include.
        * Modules/indexeddb/IDBDatabase.h: Removed this header's include of itself!

        * Modules/indexeddb/IDBFactory.cpp: Added some now-needed includes.
        (WebCore::IDBFactory::~IDBFactory): Moved this out of the header file.
        (WebCore::IDBFactory::getDatabaseNames): Removed function that always returns nullptr.
        (WebCore::IDBFactory::open): Removed unneeded release() calls when returning a RefPtr.
        (WebCore::IDBFactory::cmp): Take JSValue instead of Deprecated::ScriptValue.
        Also removed unneeded typecast.

        * Modules/indexeddb/IDBFactory.h: Removed many unneeded includes.
        Removed the getDatabaseNames function. We still need a solution here, but there is
        no reason to keep the placeholder function that returns nullptr here.

        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::keyPathAny): Removed.
        (WebCore::IDBIndex::openCursor): Take JSValue instead of Deprecated::ScriptValue.
        (WebCore::IDBIndex::count): Ditto.
        (WebCore::IDBIndex::openKeyCursor): Ditto.
        (WebCore::IDBIndex::get): Ditto.
        (WebCore::IDBIndex::getKey): Ditto.

        * Modules/indexeddb/IDBIndex.h: Removed many unneeded includes, including this file
        including itself. Marked class final. Updated for above changes.

        * Modules/indexeddb/IDBIndex.idl: Changed type of "keyPath" to "any", which matches
        the IDB specification, rather than "IDBAny". Specified [ImplementationReturnType=IDBKeyPath]
        so the code generator creates the appropriate code to convert from an IDBKeyPath.
        In the future, we may find a way to do this without an explicit attribute in the IDL
        file but this is fine for now.

        * Modules/indexeddb/IDBKeyRange.cpp:
        (WebCore::IDBKeyRange::create): Moved this here from the header. Use booleans instead
        of enums because all the call sites outside this class are using booleans.
        (WebCore::IDBKeyRange::IDBKeyRange): Updated to use booleans.
        (WebCore::IDBKeyRange::~IDBKeyRange): Moved here from the header.
        (WebCore::IDBKeyRange::lowerValue): Removed now-unneeded get().
        (WebCore::IDBKeyRange::upperValue): Ditto.
        (WebCore::IDBKeyRange::only): Take JSValue instead of Deprecated::ScriptValue.
        (WebCore::IDBKeyRange::lowerBound): Updated for above changes.
        (WebCore::IDBKeyRange::upperBound): Ditto.
        (WebCore::IDBKeyRange::bound): Ditto.
        (WebCore::IDBKeyRange::isOnlyKey): Removed assertions that lower and upper are not null;
        there is no real guarantee of this! Rewrote and streamlined and it handles the null case now.

        * Modules/indexeddb/IDBKeyRange.h: Removed unneeded includes. Changed class to use booleans
        instead of enums for m_isLowerOpen and m_isUpperOpen. Moved functions into the cpp file.

        * Modules/indexeddb/IDBKeyRangeData.cpp:
        (WebCore::IDBKeyRangeData::maybeCreateIDBKeyRange): Updated to use booleans instead of enums.

        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::name): Changed return type to const String& to cut down on
        reference count churn.
        (WebCore::IDBObjectStore::keyPathAny): Deleted.
        (WebCore::IDBObjectStore::keyPath): Changed return type to const IDBKeyPath& to cut down on
        unnecessary copies.
        (WebCore::IDBObjectStore::openCursor): Take JSValue instead of Deprecated::SCriptValue.
        (WebCore::IDBObjectStore::get): Ditto.
        (WebCore::IDBObjectStore::putOrAdd): Ditto. Removed peculiar adoptRef/leakRef that was not needed.
        (WebCore::IDBObjectStore::deleteFunction): Ditto.
        (WebCore::IDBObjectStore::modernDelete): Ditto. Use releaseNonNull for better efficiency.
        (WebCore::IDBObjectStore::count): Ditto.

        * Modules/indexeddb/IDBObjectStore.h: Removed unneeded includes and changed types as mentioned
        above in the cpp file function descriptions.

        * Modules/indexeddb/IDBObjectStore.idl: Changed type of "keyPath" to "any" and
        specified [ImplementationReturnType=IDBKeyPath] as above in IDBIndex.idl.

        * Modules/indexeddb/IDBOpenDBRequest.cpp: Added now-needed includes.
        (WebCore::IDBOpenDBRequest::fireSuccessAfterVersionChangeCommit): Removed unneeded assertions
        that depend on how m_result is implemented, which changed.
        (WebCore::IDBOpenDBRequest::fireErrorAfterVersionChangeCompletion): Call setResultToUndefined
        instead of setting m_result directly.
        (WebCore::IDBOpenDBRequest::onSuccess): Call setResult instead of setting m_result and
        m_readyState directly.
        (WebCore::IDBOpenDBRequest::onUpgradeNeeded):: Ditto. Also use WTFMove to set
        m_transaction instead of peculiar adoptRef/leakRef.
        (WebCore::IDBOpenDBRequest::onDeleteDatabaseSuccess): Call setResultToUndefined
        instead of setting m_result directly.

        * Modules/indexeddb/IDBOpenDBRequest.h: Marked the class final. Removed some unneeded headers
        and made more things private.

        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::IDBRequest): Don't initialize m_source any more. Instead initialize
        m_objectStoreSource and m_indexSource, preserving the old behavior and not setting m_cursorSource
        even when passed an IDBCursor.
        (WebCore::IDBRequest::~IDBRequest): Simplify the code that calls clearRequest on the result
        if it's a cursor. The logic is now simply a null check.
        (WebCore::IDBRequest::result): Deleted. The logic is now in a custom binding.
        (WebCore::IDBRequest::error): Updated to use m_isDone instead of m_readyState.
        (WebCore::IDBRequest::source): Deleted. The logic is now in a custom binding.
        (WebCore::IDBRequest::setSource): Set m_objectStoreSource, m_indexSource, and m_cursorSource
        instead of setting m_source.
        (WebCore::IDBRequest::readyState): Updated to use m_isDone instead of m_readyState.
        (WebCore::IDBRequest::sourceObjectStoreIdentifier): Use m_objectStoreSource and
        m_indexSource instead of using m_source. To preserve current behavior, this this does not
        use m_cursorSource since the old code did not handle IDBCursor.
        (WebCore::IDBRequest::sourceIndexIdentifier): Use m_indexSource instead of m_source, preserving
        current behavior.
        (WebCore::IDBRequest::requestedIndexRecordType): Ditto.
        (WebCore::IDBRequest::dispatchEvent): Updated to use m_isDone instead of m_readyState.
        (WebCore::IDBRequest::setResult): Rewrote to use the clearResult function so we don't
        have to repeat the code to clear result pointers. Also take a reference.
        (WebCore::IDBRequest::setResultToStructuredClone): Ditto.
        (WebCore::IDBRequest::clearResult): Clear out m_scriptResult, m_cursorResult, and m_databaseResult
        instead of m_result.
        (WebCore::IDBRequest::setResultToUndefined): Set m_scriptResult instead of m_result.
        (WebCore::IDBRequest::resultCursor): Use m_cursorResult instead of m_result.
        (WebCore::IDBRequest::willIterateCursor): Updated to use m_isDone instead of m_readyState.
        Also call setResultToUndefined instead of setting m_result.
        (WebCore::IDBRequest::didOpenOrIterateCursor): Call setResultToUndefined and set m_cursorResult
        instead of setting m_result.
        (WebCore::IDBRequest::requestCompleted): Updated to use m_isDone instead of m_readyState.
        (WebCore::IDBRequest::setResult): Added for use by the derived class; sets m_databaseResult.

        * Modules/indexeddb/IDBRequest.h: Removed unneeded includes. Removed unused IDBRequestReadyState,
        since that's now done with strings. Added cursorResult, databaseResult, scriptResult,
        objectStoreSource, indexSource, and cursorSource function members and corresponding data members.
        Later we might re-cast this as some sort of union, but for now these separate functions seem fine.
        Removed unused modernResult function. Made more things private.

        * Modules/indexeddb/IDBRequest.idl: Use "any" instead of "IDBAny" for "result" and "source".

        * Modules/indexeddb/IDBTransaction.cpp: Added now-needed includes.
        (WebCore::IDBTransaction::didGetRecordOnServer): Updated to call the version of setResult that takes
        a reference.
        (WebCore::IDBTransaction::didPutOrAddOnServer): Ditto.
        * Modules/indexeddb/IDBTransaction.h: Removed unneeded includes, derive privately from ActiveDOMObject.
        Removed some unneeded WebCore prefixes.

        * Modules/indexeddb/server/MemoryIndex.h: Added now-needed include.

        * Modules/indexeddb/server/MemoryObjectStore.cpp: Added now-needed includes.
        (WebCore::IDBServer::MemoryObjectStore::updateIndexesForPutRecord): Remove unneeded get() call.
        (WebCore::IDBServer::MemoryObjectStore::populateIndexWithExistingRecords): Ditto.

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp: Added now-needed includes.
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateOneIndexForAddRecord): Remove unneeded get() call.
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateAllIndexesForAddRecord): Ditto.

        * Modules/indexeddb/server/SQLiteIDBCursor.cpp: Added now-needed include.

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp: Added now-needed includes.
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd): Updated to use JSValue.

        * Modules/indexeddb/server/UniqueIDBDatabase.h: Added now-needed forward declaration of JSC::VM.

        * bindings/js/IDBBindingUtilities.cpp: Added now-needed includes.
        (WebCore::deserializeIDBValueToJSValue): Return JSValue instead of Strong<Unknown>.
        (WebCore::deserializeIDBValueDataToJSValue): Ditto.
        (WebCore::idbKeyDataToScriptValue): Ditto.
        (WebCore::toJS): Added an overload of toJS for IDBKeyPath here. Moved here from JSIDBAnyCustom.cpp.

        * bindings/js/IDBBindingUtilities.h: Removed unneeded include. Changed return types to JSValue.
        Added the toJS function for IDBKeyPath.

        * bindings/js/JSIDBAnyCustom.cpp: Removed.

        * bindings/js/JSIDBCursorCustom.cpp: Added some now-needed includes.
        (WebCore::JSIDBCursor::visitAdditionalChildren): Removed ann unneeded type cast.
        (WebCore::JSIDBCursor::source): Added. Converts either the index source or the object source into
        a JSValue.

        * bindings/js/JSIDBRequestCustom.cpp: Added.
        (WebCore::JSIDBRequest::result): Added. Throws an exception if isDone is false and then converts
        cursor result, database result, or script result into a JSValue.
        (WebCore::JSIDBRequest::source): Added. Converts the cursor source, index source, or object store
        source into a JSValue.

        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): Tweaked the code for array slightly. Added an ImplementationReturnType case
        for IDBKeyPath. The code that's generated is pretty generic, just a call to toJS with the conventional
        arguments, so at some point we may be able to do this with C++ overloading and not require a
        special case in the code generator.

        * inspector/InspectorIndexedDBAgent.cpp: Put #if 0 around the getDatabaseNames code, which was
        dormant and not working.
        (WebCore::OpenDatabaseCallback::handleEvent): Changed this to use IDBOpenDBRequest::databaseResult
        instead of calling the result function checking for an exception and then doing type checking.
        (WebCore::idbKeyRangeFromKeyRange): Updated to use booleans for key range bound open state.
        (WebCore::OpenCursorCallback::handleEvent): Same kind of change as for OpenDatabaseCallback above.
        Also use simpler interface to key, primaryKey, and value.
        (WebCore::InspectorIndexedDBAgent::requestDatabaseNames): Put #if 0 around the getDatabaseNames
        code, which was dormant and not working. Needs to be re-implemented.

2016-04-18  Eric Carlson  <eric.carlson@apple.com>

        Media element "user gesture for fullscreen" restriction is never lifted
        https://bugs.webkit.org/show_bug.cgi?id=156547
        <rdar://problem/25707814>

        Reviewed by Jer Noble.

        Test: media/video-fullscreen-restriction-removed.html

        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::playbackPermitted): Check fullscreenPermitted rather than
          checking for a user gesture because the restriction can be removed.

2016-04-18  Frederic Wang  <fwang@igalia.com>

        Refactor RenderMathMLScripts layout to avoid using flexbox
        https://bugs.webkit.org/show_bug.cgi?id=153917

        Reviewed by Martin Robinson.

        Tests: mathml/mathml-in-html5/subsup-parameters-1.html
               mathml/opentype/large-operators-italic-correction.html

        Reimplement RenderMathMLScripts without any flexbox or anonymous.
        We also rely on parameters from the MATH table to improve rendering.

        * css/mathml.css:
        (msub > * + * + *, msup > * + * + *, msubsup > * + * + * + *, msub > mprescripts, msup > mprescripts, msubsup > mprescripts, msub > none, msup > none, msubsup > none, mmultiscripts > mprescripts ~ mprescripts, mmultiscripts > mprescripts ~ mprescripts ~ *): Deleted.
        Invalid markup for scripts is now just hidden.
        * rendering/mathml/RenderMathMLOperator.h: ditto.
        * rendering/mathml/RenderMathMLScripts.cpp:
        (WebCore::RenderMathMLScripts::unembellishedOperator): Reimplemented.
        (WebCore::RenderMathMLScripts::getBaseAndScripts): Helper function to verify whether the
        child list is valid and retrieve pointers on important children.
        (WebCore::RenderMathMLScripts::spaceAfterScript): Helper function to get the
        space after a script.
        (WebCore::RenderMathMLScripts::italicCorrection): Helper function to read the
        italic correction of a largeop base.
        (WebCore::RenderMathMLScripts::computePreferredLogicalWidths): Implement this function.
        (WebCore::RenderMathMLScripts::getScriptMetricsAndLayoutIfNeeded): Helper function to get
        the maximum ascent/descent of all the scripts and determine the minimal
        sub/sup shifts to apply.
        (WebCore::RenderMathMLScripts::mirrorIfNeeded): Helper function to calculate the horizontal
        offset depending on the directionality.
        (WebCore::RenderMathMLScripts::layoutBlock): Implement this function.
        (WebCore::RenderMathMLScripts::firstLineBaseline): Implement this function.
        (WebCore::RenderMathMLScripts::paintChildren): Implement this function.
        (WebCore::RenderMathMLScripts::RenderMathMLScripts): Deleted.
        (WebCore::RenderMathMLScripts::base): Deleted.
        (WebCore::RenderMathMLScripts::fixAnonymousStyleForSubSupPair): Deleted.
        (WebCore::RenderMathMLScripts::fixAnonymousStyles): Deleted.
        (WebCore::RenderMathMLScripts::addChildInternal): Deleted.
        (WebCore::RenderMathMLScripts::removeChildInternal): Deleted.
        (WebCore::RenderMathMLScripts::addChild): Deleted.
        (WebCore::RenderMathMLScripts::removeChild): Deleted.
        (WebCore::RenderMathMLScripts::styleDidChange): Deleted.
        (WebCore::RenderMathMLScripts::layout): Deleted.
        (WebCore::RenderMathMLScriptsWrapper::createAnonymousWrapper): Deleted.
        (WebCore::RenderMathMLScriptsWrapper::addChildInternal): Deleted.
        (WebCore::RenderMathMLScriptsWrapper::addChild): Deleted.
        (WebCore::RenderMathMLScriptsWrapper::removeChildInternal): Deleted.
        (WebCore::RenderMathMLScriptsWrapper::removeChild): Deleted.
        * rendering/mathml/RenderMathMLScripts.h: Update definitions and remove classes
        for anonymous wrappers.

2016-04-18  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Use grid-template-areas to determine the explicit grid
        https://bugs.webkit.org/show_bug.cgi?id=156575

        Reviewed by Darin Adler.

        From the spec (https://drafts.csswg.org/css-grid/#grid-definition):
        "The size of the explicit grid is determined by the larger of the number
        of rows/columns defined by grid-template-areas and the number
        of rows/columns sized by grid-template-rows/grid-template-columns."

        So we need to take into account the rows/columns defined by
        grid-template-areas to determine the size of the explicit grid.

        Test: fast/css-grid-layout/explicit-grid-size.html

        * rendering/style/GridPositionsResolver.cpp:
        (WebCore::GridPositionsResolver::explicitGridColumnCount):
        (WebCore::GridPositionsResolver::explicitGridRowCount):

2016-04-18  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Menu list button doesn't use the text color from the theme
        https://bugs.webkit.org/show_bug.cgi?id=118234

        Reviewed by Darin Adler.

        Set the combo box color accroding to the theme when adjusting the menu list style like Mac port does.

        * rendering/RenderThemeGtk.cpp:
        (WebCore::menuListColor):
        (WebCore::RenderThemeGtk::adjustMenuListStyle):

2016-04-18  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Fix positioned items with content alignment
        https://bugs.webkit.org/show_bug.cgi?id=156597

        Reviewed by Darin Adler.

        Like for the case of gaps we need to take into account
        the content alignment in order to properly place and size
        the positioned items.

        Regarding content alignment we need to care about 2 values:
        the position offset and the distribution offset.
        The position offset can be extracted from m_column|rowPositions,
        but the distribution offset is stored in 2 new variables called
        m_offsetBetweenColumns|Rows.

        Tests: fast/css-grid-layout/grid-positioned-items-content-alignment.html
               fast/css-grid-layout/grid-positioned-items-content-alignment-rtl.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        (WebCore::RenderGrid::populateGridPositions):
        (WebCore::RenderGrid::columnAxisOffsetForChild):
        (WebCore::RenderGrid::rowAxisOffsetForChild):
        (WebCore::RenderGrid::rowAxisPositionForChild): Deleted.
        * rendering/RenderGrid.h:

2016-04-18  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Add method to translate RTL coordinates
        https://bugs.webkit.org/show_bug.cgi?id=156589

        Reviewed by Antonio Gomes.

        This is just a small refactoring adding a new function
        LayoutGrid::translateRTLCoordinate().
        This method translates to physical coordinates the information
        stored in m_columnPositions when you're using RTL direction.

        No new tests, no change of behavior.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild): Use the new
        method translateRTLCoordinate().
        (WebCore::RenderGrid::translateRTLCoordinate): New method that converts
        a coordinate from m_columnPositions in RTL into a physical coordinate.
        (WebCore::RenderGrid::findChildLogicalPosition): Use the new method
        translateRTLCoordinate().
        * rendering/RenderGrid.h: Add method signature.

2016-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>

        [Fetch] Use @isArray instead of `instanceof @Array`
        https://bugs.webkit.org/show_bug.cgi?id=156682

        Reviewed by Alex Christensen.

        Currently, we query whether the given value is Array by using `instanceof @Array`.
        But it is not enough; Array from the other realm should be accepted. And Array
        not inheriting @Array should be also accepted.

        Test: fetch/header-constructor-is-array.html

        * Modules/fetch/FetchHeaders.js:
        (initializeFetchHeaders):

2016-04-17  Yoav Weiss  <yoav@yoav.ws>

        Initial Link preload support
        https://bugs.webkit.org/show_bug.cgi?id=156334

        Added basic `<link rel=preload>` functionality that enables preloading
        of resources according to their type.

        Reviewed by Darin Adler.

        Tests: http/tests/preload/download_resources.html
               http/tests/preload/dynamic_adding_preload.html
               http/tests/preload/dynamic_remove_preload_href.html
               http/tests/preload/dynamic_removing_preload.html

        * bindings/generic/RuntimeEnabledFeatures.cpp: Added a runtime flag for the feature.
        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
        * bindings/generic/RuntimeEnabledFeatures.h: Added a runtime flag for the feature.
        (WebCore::RuntimeEnabledFeatures::setLinkPreloadEnabled):
        (WebCore::RuntimeEnabledFeatures::linkPreloadEnabled):
        * html/HTMLAttributeNames.in: Added an `as` attribute.
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::process): Added `as` and `crossorigin` attribute values to the loadLink() call.
        (WebCore::HTMLLinkElement::setCrossOrigin): Setter for crossOrigin.
        (WebCore::HTMLLinkElement::crossOrigin): Getter for crossOrigin.
        * html/HTMLLinkElement.idl: Added `as` and `crossorigin` to HTMLLinkElement.
        * html/HTMLLinkElement.h: Added getter and setter for crossorigin.
        * html/LinkRelAttribute.cpp:
        (WebCore::LinkRelAttribute::LinkRelAttribute): Added "preload" as a potential value.
        * html/LinkRelAttribute.h: Added isLinkPreload.
        * loader/LinkLoader.cpp:
        (WebCore::LinkLoader::resourceTypeFromAsAttribute): Translates an `as` value into a resource type.
        (WebCore::preloadIfNeeded): Triggers a resource preload when link element is a preload one.
        (WebCore::LinkLoader::loadLink): Added a call to preloadIfNeeded.
        * loader/LinkLoader.h: Added signatures.
        * loader/ResourceLoadInfo.cpp:
        (WebCore::toResourceType): Added LinkPreload as a possible CachedResource::type.
        * loader/SubresourceLoader.cpp:
        (WebCore::logResourceLoaded): Added LinkPreload as a possible CachedResource::type.
        * loader/cache/CachedResource.cpp: Turned defaultPriorityForResourceType into a static member, as it's now also called from LinkLoader.
        (WebCore::CachedResource::defaultPriorityForResourceType): Added LinkPreload as a possible CachedResource::type, giving it low priority.
        (WebCore::defaultPriorityForResourceType): Deleted.
        * loader/cache/CachedResource.h: Added LinkPreload as a possible CachedResource::type. Added defaultPriorityForResourceType as static.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::contentTypeFromResourceType): Added LinkPreload as a possible CachedResource::type.
        (WebCore::createResource): Added creation of a LinkPreload resource if needed.
        (WebCore::CachedResourceLoader::checkInsecureContent): Added LinkPreload as a possible CachedResource::type.
        (WebCore::CachedResourceLoader::canRequest): Added LinkPreload as a possible CachedResource::type.
        * testing/Internals.cpp: Added function to turn on the link preload feature.
        (WebCore::setLinkPreloadSupport):
        * testing/Internals.idl: Added function to turn on the link preload feature.
        * testing/Internals.h: Added function signature to turn on the link preload feature.

2016-04-17  Conrad Shultz  <conrad_shultz@apple.com>

        Try (again) to fix debug builds after r199643.

        Unreviewed.

        * dom/ScriptExecutionContext.cpp:
        Add another missing include.

2016-04-17  Conrad Shultz  <conrad_shultz@apple.com>

        Try to fix debug builds after r199643.

        Unreviewed.

        * Modules/indexeddb/IDBObjectStore.cpp:
        Add a missing include.

2016-04-17  Chris Dumez  <cdumez@apple.com>

        [WK2][iOS] Do not dlopen() QuickLook in the NetworkProcess
        https://bugs.webkit.org/show_bug.cgi?id=156639

        Reviewed by Darin Adler.

        Do not unnecessarily dlopen() QuickLook in the NetworkProcess on iOS, as
        we already dlopen() this library in the WebContent process. This patch
        moves the resource response MIME type adjusting code for QuickLook from
        adjustMIMETypeIfNecessary() to a new adjustMIMETypeForQuickLook() function.
        adjustMIMETypeIfNecessary() is called in didReceiveResponse() in the Network
        process side, for *every* resource response, even though QuickLook can only
        be used to preview main resources. The new adjustMIMETypeForQuickLook()
        function is called in the QuickLookHandle::createIfNecessary() factory
        function, right before checking the MIME type to determine if we need to
        use QuickLook, and after checking that the load is for a main resource.
        In the WebKit2 case, the factory function is called from
        WebResourceLoader::didReceiveResponse(), on the WebContent process side.

        This patch speeds up the first page load during PLT by ~22%, because the
        first load no longer triggers a dlopen() to QuickLook in the NetworkProcess.
        The overall PLT score seems to be progressed by 0.9-1% as well. The change
        should also be memory-positive as we no longer need to dlopen() the
        QuickLook library in the NetworkProcess at all (and we would already dlopen()
        it on the WebContent process side anyway). Sadly, PLUM benchmark does not
        show the memory benefit because it does not measure the memory used by the
        Network process.

        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.cpp:
        (WebCore::SynchronousResourceHandleCFURLConnectionDelegate::didReceiveResponse):
        Refactor the code a bit for clarity, so that we only
        ResourceHandle::setQuickLookHandle() when QuickLookHandle::createIfNecessary()
        returns a non-null pointer.

        * platform/network/ios/QuickLook.h:
        - Rename the factories from create() to createIfNecessary() given that they
          return nullptr when it is unnecessary to create such handle (i.e. this is not
          a main resource loader, or it is unecessary given the response's MIME type.
        - Make shouldCreateForMIMEType() private now that this is always called inside
          the factory functions.

        * platform/network/ios/QuickLook.mm:
        (adjustMIMETypeForQuickLook):
        Extracted code for adjusting the MIME type for QuickLook from the generic
        adjustMIMETypeIfNecessary() in WebCoreURLResponseIOS.mm to its own function
        here.

        (WebCore::QuickLookHandle::createIfNecessary):
        Call adjustMIMETypeForQuickLook() before checking the MIME type.

        * platform/network/ios/WebCoreURLResponseIOS.mm:
        (WebCore::adjustMIMETypeIfNecessary):
        Extracted QuickLook-specific code to QuickLook.mm.

        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
        Refactor the code a bit for clarity, so that we only
        ResourceHandle::setQuickLookHandle() when QuickLookHandle::createIfNecessary()
        returns a non-null pointer.

2016-04-17  Brady Eidson  <beidson@apple.com>

        Clean up IDBBindingUtilities.
        https://bugs.webkit.org/show_bug.cgi?id=156472

        Reviewed by Alex Christensen.

        No new tests (No change in behavior).

        - Get rid of a whole bunch of unused functions (since we got rid of Legacy IDB).
        - Make more functions deal in ExecState/ScriptExecutionContexts instead of DOMRequestState.
        - Make more functions deal in JSValue (as JSC::Strong<JSC::Unknown>) instead of Deprecated::ScriptValue.

        * bindings/scripts/IDLAttributes.txt: Add a new attribute to signify that an implementation returns
          JSValues instead of Deprecated::ScriptState
        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): Use that new attribute.
        
        * Modules/indexeddb/IDBAny.cpp:
        (WebCore::IDBAny::IDBAny):
        (WebCore::IDBAny::scriptValue):
        * Modules/indexeddb/IDBAny.h:
        (WebCore::IDBAny::create):
        
        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::key):
        (WebCore::IDBCursor::primaryKey):
        (WebCore::IDBCursor::value):
        (WebCore::IDBCursor::update):
        (WebCore::IDBCursor::continueFunction):
        (WebCore::IDBCursor::deleteFunction):
        (WebCore::IDBCursor::setGetResult):
        * Modules/indexeddb/IDBCursor.h:
        * Modules/indexeddb/IDBCursor.idl:
        * Modules/indexeddb/IDBCursorWithValue.idl:
        
        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::cmp):
        
        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::count):
        (WebCore::IDBIndex::get):
        (WebCore::IDBIndex::getKey):
        
        * Modules/indexeddb/IDBKeyRange.cpp:
        (WebCore::IDBKeyRange::lowerValue):
        (WebCore::IDBKeyRange::upperValue):
        (WebCore::IDBKeyRange::only):
        (WebCore::IDBKeyRange::lowerBound):
        (WebCore::IDBKeyRange::upperBound):
        (WebCore::IDBKeyRange::bound):
        * Modules/indexeddb/IDBKeyRange.h:
        * Modules/indexeddb/IDBKeyRange.idl:
        
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::get):
        (WebCore::IDBObjectStore::modernDelete):
        (WebCore::IDBObjectStore::count):
        
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::setResult):
        (WebCore::IDBRequest::setResultToStructuredClone):
        
        * Modules/indexeddb/server/MemoryObjectStore.cpp:
        (WebCore::IDBServer::MemoryObjectStore::updateIndexesForPutRecord):
        (WebCore::IDBServer::MemoryObjectStore::populateIndexWithExistingRecords):
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateOneIndexForAddRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateAllIndexesForAddRecord):
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd):
        
        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::idbKeyPathFromValue):
        (WebCore::internalCreateIDBKeyFromScriptValueAndKeyPath):
        (WebCore::injectIDBKeyIntoScriptValue):
        (WebCore::maybeCreateIDBKeyFromScriptValueAndKeyPath):
        (WebCore::canInjectIDBKeyIntoScriptValue):
        (WebCore::deserializeIDBValueToJSValue):
        (WebCore::deserializeIDBValueDataToJSValue):
        (WebCore::scriptValueToIDBKey):
        (WebCore::idbKeyDataToScriptValue):
        (WebCore::idbKeyDataToJSValue): Deleted.
        (WebCore::createIDBKeyFromScriptValueAndKeyPath): Deleted.
        (WebCore::deserializeIDBValue): Deleted.
        (WebCore::deserializeIDBValueData): Deleted.
        (WebCore::deserializeIDBValueBuffer): Deleted.
        (WebCore::idbValueDataToJSValue): Deleted.
        (WebCore::idbKeyToScriptValue): Deleted.
        * bindings/js/IDBBindingUtilities.h:

        * bindings/js/JSIDBAnyCustom.cpp:
        (WebCore::toJS):

        * bindings/js/JSIDBDatabaseCustom.cpp:
        (WebCore::JSIDBDatabase::createObjectStore):

        * bindings/js/JSIDBObjectStoreCustom.cpp:
        (WebCore::JSIDBObjectStore::createIndex):

        * dom/ScriptExecutionContext.cpp:
        (WebCore::ScriptExecutionContext::execState):
        * dom/ScriptExecutionContext.h:

        * inspector/InspectorIndexedDBAgent.cpp:

2016-04-17  Darin Adler  <darin@apple.com>

        Remove more uses of Deprecated::ScriptXXX
        https://bugs.webkit.org/show_bug.cgi?id=156660

        Reviewed by Antti Koivisto.

        * Modules/mediacontrols/MediaControlsHost.h: Removed unneeded include.

        * Modules/plugins/PluginReplacement.h: Removed unneeded include.
        Changed argument to installReplacement into a reference. Changed return
        value for creation function from PassRefPtr to Ref.

        * Modules/plugins/QuickTimePluginReplacement.h: Removed unneeded includes and
        forward declarations. Marked class final. Made almost everything private.

        * Modules/plugins/QuickTimePluginReplacement.mm:
        (WebCore::QuickTimePluginReplacement::create): Changed to return Ref.
        (WebCore::QuickTimePluginReplacement::installReplacement): Changed to take
        a reference.

        * Modules/plugins/YouTubePluginReplacement.cpp:
        (WebCore::YouTubePluginReplacement::create): Changed to return Ref.
        (WebCore::YouTubePluginReplacement::installReplacement): Changed to take
        a reference.

        * Modules/plugins/YouTubePluginReplacement.h: Removed unneeded includes and
        forward declarations. Marked class final. Changed return type of create.

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::didReceiveBinaryData): Removed local variable so the
        MessageEvent::create function gets a Ref&& instead of a RefPtr without having
        to add explicit WTFMove.

        * bindings/js/DOMRequestState.h: Removed code that set m_exec twice.

        * bindings/js/Dictionary.h: Reformatted function templates to use a single
        line so they are easier to look at.
        (WebCore::Dictionary::getEventListener): Rewrote this so it no longer uses
        a Deprecated::ScriptValue and also make it a little more compact and terse.

        * bindings/js/JSCommandLineAPIHostCustom.cpp:
        (WebCore::JSCommandLineAPIHost::inspect): Rewrote to use JSValue instead of
        Deprecated::ScriptValue. Considerably more efficient.

        * bindings/js/JSMessageEventCustom.cpp:
        (WebCore::JSMessageEvent::data): Streamlined to use Deprecated::ScriptValue
        a little bit less.

        * bindings/js/JSNodeCustom.cpp: Moved include here from header.
        * bindings/js/JSNodeCustom.h: Moved include from here to cpp file.

        * bindings/js/JSPopStateEventCustom.cpp:
        (WebCore::JSPopStateEvent::state): Updated for changes to return value of the
        state() and serializedState functions.

        * bindings/js/ScriptState.h: Removed the ScriptState typedef.

        * bindings/js/SerializedScriptValue.cpp: Moved include here from header.
        * bindings/js/SerializedScriptValue.h: Moved include from here to cpp file.

        * css/FontFace.cpp:
        (WebCore::FontFace::create): Changed argument to JSValue instead of ScriptValue.
        * css/FontFace.h: Ditto.

        * dom/MessageEvent.cpp: Moved create functions in here from header file.
        Removed some unused ones including one that took a Deprecated::ScriptValue.
        * dom/MessageEvent.h: Streamlined create functions, removing unused functions,
        unused arguments, and unused default values for arguments. Also moved them all
        into the cpp file instead of inlining them. Also changed the return type of
        dataAsScriptValue to JSValue.

        * dom/NodeFilterCondition.h: Removed unneeded include. Tweaked formatting.

        * dom/PopStateEvent.h: Changed return value of state to be a JSValue and of
        serializedState to be a raw pointer, not a PassRefPtr.

        * dom/Traversal.h: Removed unneeded include. Removed unnecessary use of
        unsigned long instead of unsigned. Fixed indentation.

        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::didAddUserAgentShadowRoot): Pass reference.

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::buildObjectForEventListener): Pass JSValue instead
        of constructing a Deprecated::ScriptValue.

        * inspector/InspectorFrontendHost.cpp:
        (WebCore::FrontendMenuProvider::disconnect): Initialize without explicitly
        mentioning the Deprecated::ScriptObject type.

        * inspector/InspectorIndexedDBAgent.cpp: Removed unneeded include.

        * inspector/InspectorInstrumentation.h: Removed unneeded include and also
        declaration of two non-existent functions.

        * page/DOMWindow.cpp:
        (WebCore::PostMessageTimer::PostMessageTimer): Tweaked types a little bit to
        match what is used in MessageEvent now.
        (WebCore::PostMessageTimer::event): Streamlined a bit and changed type to
        reference.
        (WebCore::DOMWindow::postMessage): Updated for changes above.
        (WebCore::DOMWindow::postMessageTimerFired): Ditto.

        * page/EventSource.cpp:
        (WebCore::EventSource::createMessageEvent): Removed now-unneeded
        "false, false" from MessageEvent::create function call.

        * page/csp/ContentSecurityPolicy.h: Removed unneeded include.

        * page/csp/ContentSecurityPolicyDirectiveList.h: Removed unneeded
        include and also unneeded non-copyable, since the class has a reference as
        a data member and so is automatically non-copyable.

        * testing/Internals.cpp:
        (WebCore::Internals::description): Changed to take JSValue.
        (WebCore::Internals::parserMetaData): Ditto.
        (WebCore::Internals::serializeObject): Removed unnecessary copying of vector.
        (WebCore::Internals::isFromCurrentWorld): Changed to take JSValue.
        (WebCore::Internals::isReadableStreamDisturbed): Changed to not rely on the
        ScriptState typedef and call it JSC::ExecState.

        * testing/Internals.h: Removed unneeded includes. Removed unneeded and
        inappropriate use of ASSERT_NO_EXCEPTION.

2016-04-17  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Consume HTTP data as a ReadableStream
        https://bugs.webkit.org/show_bug.cgi?id=138968

        Reviewed by Alex Christensen.

        This patch introduces ReadableStreamSource and ReadableStreamController which allow feeding a ReadableStream from DOM classes.
        ReadableStreamSource is a base class for all DOM ReadableStream sources.
        ReadableStreamController is a wrapper around JSReadableStreamController that can be invoked by DOM code to enqueue/close/error a ReadableStream.
        A createReadableStream function is introduced to allow DOM classes creating ReadableStream.

        Added support for a FetchResponse ReadableStream source.
        Both synthetic FetchResponse and loading FetchResponse are supported.
        A new "Stream" FetchLoader::Type is introduced to allow receiving data as chunks and feeding them to a ReadableStream through ReadableStreamSource.

        Currently, FetchResponse is consumed and marked as disturbed as soon as a ReadableStreamSource is created.
        This should be changed so that consumption happens on the first read call to the ReadableStreamReader, i.e. when stream gets disturbed.

        FetchResponseSource never fulfills the start promise, which allows to enqueue, error or close the stream at any time.
        FetchResponseSource must therefore always ensure to close or error the stream.
        Added support for locked check in FetchResponse.

        Tests: imported/w3c/web-platform-tests/fetch/api/response/response-cancel-stream.html
               imported/w3c/web-platform-tests/fetch/api/response/response-consume-stream.html
               imported/w3c/web-platform-tests/fetch/api/response/response-stream-disturbed-1.html
               imported/w3c/web-platform-tests/fetch/api/response/response-stream-disturbed-2.html
               imported/w3c/web-platform-tests/fetch/api/response/response-stream-disturbed-3.html
               imported/w3c/web-platform-tests/fetch/api/response/response-stream-disturbed-4.html
               imported/w3c/web-platform-tests/fetch/api/response/response-stream-disturbed-5.html
        Also covered by rebased tests.

        * CMakeLists.txt:
        * DerivedSources.make:
        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::consumeAsStream): Fill stream with body data.
        * Modules/fetch/FetchBody.h:
        (WebCore::FetchBody::type): Added accessor to body type, used for assertions.
        * Modules/fetch/FetchBodyOwner.cpp:
        (WebCore::FetchBodyOwner::isDisturbed): Adding stream isLocked check.
        (WebCore::FetchBodyOwner::blobLoadingSucceeded): Added assertion that body type is blob. Closing stream if created.
        (WebCore::FetchBodyOwner::blobLoadingFailed): Erroring the stream if created and not cancelled.
        (WebCore::FetchBodyOwner::blobChunk): Filling stream with chunk.
        (WebCore::FetchBodyOwner::stop): Rmoved call to finishBlobLoading as it should be called as part of FetchLoaderCLient::didFail callbacki.
        * Modules/fetch/FetchBodyOwner.h:
        * Modules/fetch/FetchLoader.cpp: Fixing the case of cancel being called when creating the ThreadableLoader by introducing FetchLoader::m_isStarted.
        (WebCore::FetchLoader::start): Setting m_isStarted at the end of the start method.
        (WebCore::FetchLoader::stop): Fixing the case that FetchLoader can be destroyed when cancelling its loader.
        (WebCore::FetchLoader::startStreaming): Introduced to switch the loading type from ArayBuffer to Stream. Already buffered data is returned.
        (WebCore::FetchLoader::didReceiveData): Handling of the new Stream type.
        (WebCore::FetchLoader::didFinishLoading):
        * Modules/fetch/FetchLoader.h:
        * Modules/fetch/FetchLoaderClient.h:
        (WebCore::FetchLoaderClient::didReceiveData): Callback to get data as chunks if loader is of type Stream.
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::clone): Removed m_isLocked as it is handled within isDisturbed().
        (WebCore::FetchResponse::isDisturbed): Checking whether related ReadableStream is locked.
        (WebCore::FetchResponse::BodyLoader::didSucceed): Introduced to handle ReadableStream case.
        (WebCore::FetchResponse::BodyLoader::didFail): Ditto.
        (WebCore::FetchResponse::BodyLoader::didReceiveData): Ditto.
        (WebCore::FetchResponse::BodyLoader::startStreaming): Ditto.
        (WebCore::FetchResponse::consumeBodyAsStream): Start filling the ReadableStream with data. Changing loader to Stream if there is one.
        (WebCore::FetchResponse::createReadableStreamSource): Called by custom binding to create the source.
        (WebCore::FetchResponse::stop): Fixing potential crash in case of cancelling the ibody stream.
        (WebCore::FetchResponse::startFetching):
        (WebCore::FetchResponse::BodyLoader::didFinishLoadingAsArrayBuffer):
        * Modules/fetch/FetchResponse.h:
        * Modules/fetch/FetchResponse.idl:
        * Modules/fetch/FetchResponseSource.cpp: Specialization of ReadableStreamSource for FetchResponse. It is a push source that never resolves the start promise.
        (WebCore::FetchResponseSource::FetchResponseSource):
        (WebCore::FetchResponseSource::isReadableStreamLocked):
        (WebCore::FetchResponseSource::setActive):
        (WebCore::FetchResponseSource::setInactive):
        (WebCore::FetchResponseSource::doStart):
        (WebCore::FetchResponseSource::doCancel):
        (WebCore::FetchResponseSource::close):
        (WebCore::FetchResponseSource::error):
        * Modules/fetch/FetchResponseSource.h: Added.
        * Modules/streams/ReadableStreamController.js:
        (error):
        * Modules/streams/ReadableStreamSource.h: Added (base class for ReadableStream DOM sources).
        (WebCore::ReadableStreamSource::~ReadableStreamSource):
        (WebCore::ReadableStreamSource::isStarting):
        (WebCore::ReadableStreamSource::isPulling):
        (WebCore::ReadableStreamSource::isCancelling):
        (WebCore::ReadableStreamSource::controller):
        (WebCore::ReadableStreamSource::doStart):
        (WebCore::ReadableStreamSource::doCancel):
        (WebCore::ReadableStreamSource::start):
        (WebCore::ReadableStreamSource::cancel):
        (WebCore::ReadableStreamSource::startFinished):
        (WebCore::ReadableStreamSource::clean):
        * Modules/streams/ReadableStreamSource.idl: Added.
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSDOMGlobalObject.h:
        * bindings/js/JSFetchResponseCustom.cpp: In case body is not created, call createReadableStreamSource.
        (WebCore::JSFetchResponse::body):
        * bindings/js/JSReadableStreamSourceCustom.cpp: Added.
        (WebCore::JSReadableStreamSource::start):
        (WebCore::JSReadableStreamSource::pull):
        (WebCore::JSReadableStreamSource::controller):
        * bindings/js/ReadableStreamController.cpp: Added.
        (WebCore::callFunction):
        (WebCore::ReadableStreamController::invoke):
        (WebCore::ReadableStreamController::isControlledReadableStreamLocked):
        (WebCore::createReadableStream):
        * bindings/js/ReadableStreamController.h: The DOM wrapper for JSReadableStreamController.
        (WebCore::ReadableStreamController::ReadableStreamController):
        (WebCore::ReadableStreamController::close):
        (WebCore::ReadableStreamController::error):
        (WebCore::ReadableStreamController::enqueue):
        (WebCore::ReadableStreamController::globalObject):
        (WebCore::ReadableStreamController::enqueue<RefPtr<JSC::ArrayBuffer>>):
        (WebCore::ReadableStreamController::error<String>):

2016-04-16  Antti Koivisto  <antti@apple.com>

        Element should be const in StyleResolver
        https://bugs.webkit.org/show_bug.cgi?id=156672

        Reviewed by Darin Adler.

        Resolving element style shouldn't mutate it.

        This patch just does Element* -> const Element*, all the groundwork has been done already.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::sweepMatchedPropertiesCache):
        (WebCore::StyleResolver::State::State):
        (WebCore::StyleResolver::State::setStyle):
        (WebCore::isAtShadowBoundary):
        (WebCore::StyleResolver::styleForElement):
        (WebCore::doesNotInheritTextDecoration):
        (WebCore::StyleResolver::adjustStyleForInterCharacterRuby):
        (WebCore::StyleResolver::adjustRenderStyle):
        (WebCore::StyleResolver::checkRegionStyle):
        (WebCore::StyleResolver::updateFont):
        (WebCore::StyleResolver::styleRulesForElement):
        (WebCore::StyleResolver::pseudoStyleRulesForElement):
        (WebCore::StyleResolver::applyMatchedProperties):
        * css/StyleResolver.h:
        (WebCore::StyleResolver::style):
        (WebCore::StyleResolver::parentStyle):
        (WebCore::StyleResolver::rootElementStyle):
        (WebCore::StyleResolver::element):
        (WebCore::StyleResolver::document):
        (WebCore::StyleResolver::documentSettings):
        (WebCore::StyleResolver::usesFirstLineRules):
        (WebCore::StyleResolver::usesFirstLetterRules):
        (WebCore::StyleResolver::State::State):
        (WebCore::StyleResolver::State::document):
        (WebCore::StyleResolver::State::element):
        (WebCore::StyleResolver::State::style):
        (WebCore::StyleResolver::hasSelectorForId):
        (WebCore::checkRegionSelector):
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::RenderTheme):
        (WebCore::RenderTheme::adjustStyle):
        (WebCore::RenderTheme::adjustCheckboxStyle):
        (WebCore::RenderTheme::adjustRadioStyle):
        (WebCore::RenderTheme::adjustButtonStyle):
        (WebCore::RenderTheme::adjustInnerSpinButtonStyle):
        (WebCore::RenderTheme::adjustTextFieldStyle):
        (WebCore::RenderTheme::adjustTextAreaStyle):
        (WebCore::RenderTheme::adjustMenuListStyle):
        (WebCore::RenderTheme::adjustMeterStyle):
        (WebCore::RenderTheme::paintMeter):
        (WebCore::RenderTheme::adjustCapsLockIndicatorStyle):
        (WebCore::RenderTheme::paintCapsLockIndicator):
        (WebCore::RenderTheme::adjustAttachmentStyle):
        (WebCore::RenderTheme::animationDurationForProgressBar):
        (WebCore::RenderTheme::adjustProgressBarStyle):
        (WebCore::RenderTheme::shouldHaveCapsLockIndicator):
        (WebCore::RenderTheme::adjustMenuListButtonStyle):
        (WebCore::RenderTheme::adjustMediaControlStyle):
        (WebCore::RenderTheme::adjustSliderTrackStyle):
        (WebCore::RenderTheme::adjustSliderThumbStyle):
        (WebCore::RenderTheme::adjustSliderThumbSize):
        (WebCore::RenderTheme::adjustSearchFieldStyle):
        (WebCore::RenderTheme::adjustSearchFieldCancelButtonStyle):
        (WebCore::RenderTheme::adjustSearchFieldDecorationPartStyle):
        (WebCore::RenderTheme::adjustSearchFieldResultsDecorationPartStyle):
        (WebCore::RenderTheme::adjustSearchFieldResultsButtonStyle):
        * rendering/RenderTheme.h:
        (WebCore::RenderTheme::minimumMenuListSize):
        (WebCore::RenderTheme::popupInternalPaddingBox):
        (WebCore::RenderTheme::popupOptionSupportsTextIndent):
        (WebCore::RenderTheme::paintRadioDecorations):
        (WebCore::RenderTheme::paintButtonDecorations):
        (WebCore::RenderTheme::paintTextField):
        (WebCore::RenderTheme::paintTextFieldDecorations):
        (WebCore::RenderTheme::paintTextArea):
        (WebCore::RenderTheme::paintTextAreaDecorations):
        (WebCore::RenderTheme::paintMenuList):
        (WebCore::RenderTheme::paintMenuListDecorations):
        (WebCore::RenderTheme::paintMenuListButtonDecorations):
        (WebCore::RenderTheme::paintPushButtonDecorations):
        (WebCore::RenderTheme::paintSquareButtonDecorations):
        (WebCore::RenderTheme::paintProgressBar):
        (WebCore::RenderTheme::paintSliderTrack):
        (WebCore::RenderTheme::paintSliderThumb):
        (WebCore::RenderTheme::paintSliderThumbDecorations):
        (WebCore::RenderTheme::paintSearchField):
        (WebCore::RenderTheme::paintSearchFieldDecorations):
        (WebCore::RenderTheme::paintSearchFieldCancelButton):
        (WebCore::RenderTheme::paintSearchFieldDecorationPart):
        (WebCore::RenderTheme::paintSearchFieldResultsDecorationPart):
        (WebCore::RenderTheme::paintSearchFieldResultsButton):
        (WebCore::RenderTheme::paintMediaFullscreenButton):
        (WebCore::RenderTheme::paintMediaPlayButton):
        (WebCore::RenderTheme::paintMediaOverlayPlayButton):
        * rendering/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::paintSliderTrack):
        (WebCore::RenderThemeEfl::adjustSliderTrackStyle):
        (WebCore::RenderThemeEfl::adjustSliderThumbStyle):
        (WebCore::RenderThemeEfl::adjustSliderThumbSize):
        (WebCore::RenderThemeEfl::paintSliderThumb):
        (WebCore::RenderThemeEfl::adjustCheckboxStyle):
        (WebCore::RenderThemeEfl::paintCheckbox):
        (WebCore::RenderThemeEfl::adjustRadioStyle):
        (WebCore::RenderThemeEfl::paintRadio):
        (WebCore::RenderThemeEfl::adjustButtonStyle):
        (WebCore::RenderThemeEfl::paintButton):
        (WebCore::RenderThemeEfl::adjustMenuListStyle):
        (WebCore::RenderThemeEfl::paintMenuList):
        (WebCore::RenderThemeEfl::adjustMenuListButtonStyle):
        (WebCore::RenderThemeEfl::paintMenuListButtonDecorations):
        (WebCore::RenderThemeEfl::adjustTextFieldStyle):
        (WebCore::RenderThemeEfl::paintTextField):
        (WebCore::RenderThemeEfl::adjustTextAreaStyle):
        (WebCore::RenderThemeEfl::paintTextArea):
        (WebCore::RenderThemeEfl::adjustSearchFieldResultsButtonStyle):
        (WebCore::RenderThemeEfl::paintSearchFieldResultsButton):
        (WebCore::RenderThemeEfl::adjustSearchFieldResultsDecorationPartStyle):
        (WebCore::RenderThemeEfl::paintSearchFieldResultsDecorationPart):
        (WebCore::RenderThemeEfl::adjustSearchFieldCancelButtonStyle):
        (WebCore::RenderThemeEfl::paintSearchFieldCancelButton):
        (WebCore::RenderThemeEfl::adjustSearchFieldStyle):
        (WebCore::RenderThemeEfl::paintSearchField):
        (WebCore::RenderThemeEfl::adjustInnerSpinButtonStyle):
        (WebCore::RenderThemeEfl::updateCachedSystemFontDescription):
        (WebCore::RenderThemeEfl::adjustProgressBarStyle):
        * rendering/RenderThemeEfl.h:
        * rendering/RenderThemeGtk.cpp:
        (WebCore::RenderThemeGtk::adjustRepaintRect):
        (WebCore::RenderThemeGtk::adjustButtonStyle):
        (WebCore::RenderThemeGtk::paintButton):
        (WebCore::RenderThemeGtk::adjustMenuListStyle):
        (WebCore::RenderThemeGtk::adjustMenuListButtonStyle):
        (WebCore::RenderThemeGtk::paintMenuListButtonDecorations):
        (WebCore::RenderThemeGtk::adjustTextFieldStyle):
        (WebCore::RenderThemeGtk::paintTextField):
        (WebCore::RenderThemeGtk::paintTextArea):
        (WebCore::RenderThemeGtk::adjustSearchFieldResultsButtonStyle):
        (WebCore::RenderThemeGtk::paintSearchFieldResultsButton):
        (WebCore::RenderThemeGtk::adjustSearchFieldResultsDecorationPartStyle):
        (WebCore::RenderThemeGtk::adjustSearchFieldCancelButtonStyle):
        (WebCore::RenderThemeGtk::paintSearchFieldCancelButton):
        (WebCore::RenderThemeGtk::adjustSearchFieldStyle):
        (WebCore::RenderThemeGtk::shouldHaveCapsLockIndicator):
        (WebCore::RenderThemeGtk::adjustSliderTrackStyle):
        (WebCore::RenderThemeGtk::adjustSliderThumbStyle):
        (WebCore::RenderThemeGtk::paintSliderTrack):
        (WebCore::RenderThemeGtk::adjustSliderThumbSize):
        (WebCore::RenderThemeGtk::innerSpinButtonLayout):
        (WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):
        (WebCore::spinButtonArrowSize):
        (WebCore::RenderThemeGtk::paintMediaCurrentTime):
        (WebCore::RenderThemeGtk::adjustProgressBarStyle):
        * rendering/RenderThemeGtk.h:
        * rendering/RenderThemeIOS.h:
        * rendering/RenderThemeIOS.mm:
        (WebCore::RenderThemeIOS::addRoundedBorderClip):
        (WebCore::RenderThemeIOS::adjustCheckboxStyle):
        (WebCore::RenderThemeIOS::isControlStyled):
        (WebCore::RenderThemeIOS::adjustRadioStyle):
        (WebCore::adjustInputElementButtonStyle):
        (WebCore::RenderThemeIOS::adjustMenuListButtonStyle):
        (WebCore::RenderThemeIOS::adjustSliderTrackStyle):
        (WebCore::RenderThemeIOS::paintSliderTrack):
        (WebCore::RenderThemeIOS::adjustSliderThumbSize):
        (WebCore::RenderThemeIOS::sliderTickOffsetFromTrackCenter):
        (WebCore::RenderThemeIOS::adjustSearchFieldStyle):
        (WebCore::RenderThemeIOS::paintSearchFieldDecorations):
        (WebCore::RenderThemeIOS::adjustButtonStyle):
        * rendering/RenderThemeMac.h:
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintTextField):
        (WebCore::RenderThemeMac::adjustTextFieldStyle):
        (WebCore::RenderThemeMac::paintTextArea):
        (WebCore::RenderThemeMac::adjustTextAreaStyle):
        (WebCore::RenderThemeMac::animationDurationForProgressBar):
        (WebCore::RenderThemeMac::adjustProgressBarStyle):
        (WebCore::menuListButtonSizes):
        (WebCore::RenderThemeMac::adjustMenuListStyle):
        (WebCore::RenderThemeMac::popupMenuSize):
        (WebCore::RenderThemeMac::adjustMenuListButtonStyle):
        (WebCore::RenderThemeMac::adjustSliderTrackStyle):
        (WebCore::RenderThemeMac::paintSliderTrack):
        (WebCore::RenderThemeMac::adjustSliderThumbStyle):
        (WebCore::RenderThemeMac::setSearchFieldSize):
        (WebCore::RenderThemeMac::adjustSearchFieldStyle):
        (WebCore::RenderThemeMac::cancelButtonSizes):
        (WebCore::RenderThemeMac::adjustSearchFieldCancelButtonStyle):
        (WebCore::RenderThemeMac::resultsButtonSizes):
        (WebCore::RenderThemeMac::adjustSearchFieldDecorationPartStyle):
        (WebCore::RenderThemeMac::paintSearchFieldDecorationPart):
        (WebCore::RenderThemeMac::adjustSearchFieldResultsDecorationPartStyle):
        (WebCore::RenderThemeMac::paintSearchFieldResultsDecorationPart):
        (WebCore::RenderThemeMac::adjustSearchFieldResultsButtonStyle):
        (WebCore::RenderThemeMac::adjustSliderThumbSize):
        * rendering/RenderThemeWin.cpp:
        (WebCore::RenderThemeWin::paintButton):
        (WebCore::RenderThemeWin::adjustInnerSpinButtonStyle):
        (WebCore::RenderThemeWin::paintMenuList):
        (WebCore::RenderThemeWin::adjustMenuListStyle):
        (WebCore::RenderThemeWin::adjustMenuListButtonStyle):
        (WebCore::RenderThemeWin::adjustSliderThumbSize):
        (WebCore::RenderThemeWin::paintSearchField):
        (WebCore::RenderThemeWin::adjustSearchFieldStyle):
        (WebCore::RenderThemeWin::paintSearchFieldCancelButton):
        (WebCore::RenderThemeWin::adjustSearchFieldCancelButtonStyle):
        (WebCore::RenderThemeWin::adjustSearchFieldDecorationPartStyle):
        (WebCore::RenderThemeWin::adjustSearchFieldResultsDecorationPartStyle):
        (WebCore::RenderThemeWin::paintSearchFieldResultsDecorationPart):
        (WebCore::RenderThemeWin::adjustSearchFieldResultsButtonStyle):
        (WebCore::RenderThemeWin::adjustMeterStyle):
        * rendering/RenderThemeWin.h:

2016-04-16  Antti Koivisto  <antti@apple.com>

        CSSCursorImageValue shouldn't mutate element during style resolution
        https://bugs.webkit.org/show_bug.cgi?id=156659

        Reviewed by Darin Adler.

        CSSCursorImageValue::updateIfSVGCursorIsUsed may mutate the argument element.

        This patch removes the code that caches cursor element and image to SVGElement rare data.
        The whole things is basically unused. CSSCursorImageValue now maintains a weak map to
        SVGCursorElements directly instead of indirectly via the using SVGElements.

        * css/CSSCursorImageValue.cpp:
        (WebCore::CSSCursorImageValue::CSSCursorImageValue):
        (WebCore::CSSCursorImageValue::~CSSCursorImageValue):
        (WebCore::CSSCursorImageValue::customCSSText):
        (WebCore::CSSCursorImageValue::updateCursorElement):

            We no longer rely on SVGElement rare data so no need to test for SVGElement.

        (WebCore::CSSCursorImageValue::cursorElementRemoved):
        (WebCore::CSSCursorImageValue::cursorElementChanged):

            Factor to a function.

        (WebCore::CSSCursorImageValue::cachedImage):
        (WebCore::CSSCursorImageValue::clearCachedImage):
        (WebCore::CSSCursorImageValue::equals):
        (WebCore::CSSCursorImageValue::removeReferencedElement): Deleted.

            Don't track client elements anymore. Just track referenced SVGCursorElements.

        * css/CSSCursorImageValue.h:
        * css/StyleBuilderCustom.h:
        (WebCore::StyleBuilderCustom::applyValueCursor):

            No need to make style unique. Initialization is now done in updateSVGCursorElement.

        * svg/SVGCursorElement.cpp:
        (WebCore::SVGCursorElement::~SVGCursorElement):
        (WebCore::SVGCursorElement::isSupportedAttribute):
        (WebCore::SVGCursorElement::parseAttribute):
        (WebCore::SVGCursorElement::addClient):
        (WebCore::SVGCursorElement::removeClient):

            Client is now an CSSCursorImageValue rather than SVGElement.

        (WebCore::SVGCursorElement::svgAttributeChanged):

            Instead of invalidating element style just invalidate the CSSCursorImageValue directly.

        (WebCore::SVGCursorElement::addSubresourceAttributeURLs):
        (WebCore::SVGCursorElement::removeReferencedElement): Deleted.
        * svg/SVGCursorElement.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::~SVGElement):
        (WebCore::SVGElement::getBoundingBox):
        (WebCore::SVGElement::correspondingElement):
        (WebCore::SVGElement::setCursorElement): Deleted.
        (WebCore::SVGElement::cursorElementRemoved): Deleted.
        (WebCore::SVGElement::setCursorImageValue): Deleted.
        (WebCore::SVGElement::cursorImageValueRemoved): Deleted.

            SVGElements no longer need to know about their cursors.

        * svg/SVGElement.h:
        * svg/SVGElementRareData.h:
        (WebCore::SVGElementRareData::instanceUpdatesBlocked):
        (WebCore::SVGElementRareData::setInstanceUpdatesBlocked):
        (WebCore::SVGElementRareData::correspondingElement):
        (WebCore::SVGElementRareData::setCorrespondingElement):
        (WebCore::SVGElementRareData::animatedSMILStyleProperties):
        (WebCore::SVGElementRareData::ensureAnimatedSMILStyleProperties):
        (WebCore::SVGElementRareData::cursorElement): Deleted.
        (WebCore::SVGElementRareData::setCursorElement): Deleted.
        (WebCore::SVGElementRareData::cursorImageValue): Deleted.
        (WebCore::SVGElementRareData::setCursorImageValue): Deleted.

2016-04-15  Darin Adler  <darin@apple.com>

        Reduce use of Deprecated::ScriptXXX classes
        https://bugs.webkit.org/show_bug.cgi?id=156632

        Reviewed by Alex Christensen.

        * Modules/mediastream/SDPProcessor.cpp: Removed unneeded include.

        * bindings/js/JSCommandLineAPIHostCustom.cpp:
        (WebCore::JSCommandLineAPIHost::inspectedObject): Use JSValue.
        * bindings/js/JSCustomEventCustom.cpp:
        (WebCore::JSCustomEvent::detail): Ditto.
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::evaluateInWorld): Ditto.
        (WebCore::ScriptController::evaluate): Ditto.
        (WebCore::ScriptController::executeScriptInWorld): Ditto.
        (WebCore::ScriptController::executeScript): Ditto.
        (WebCore::ScriptController::executeIfJavaScriptURL): Ditto.
        * bindings/js/ScriptController.h: Ditto.

        * bindings/js/ScriptGlobalObject.cpp: Removed unused overload of set,
        and unused remove and folded handleException function into its one call site.
        (WebCore::ScriptGlobalObject::set): Take references instead of pointers.
        (WebCore::ScriptGlobalObject::get): Use JSObject instead of Deprecated::ScriptObject.
        * bindings/js/ScriptGlobalObject.h: Updated for the above.

        * dom/CustomEvent.cpp:
        (WebCore::CustomEvent::initCustomEvent): Take JSValue and ExecState instead of
        Deprecated::ScriptValue.
        (WebCore::CustomEvent::trySerializeDetail): Take a reference instead of a pointer.
        Also removed an unneeded null check.
        * dom/CustomEvent.h: Use JSValue.
        * dom/CustomEvent.idl: Updated for the above.

        * html/HTMLMediaElement.cpp: Remove unneeded include.

        * inspector/CommandLineAPIHost.cpp:
        (WebCore::CommandLineAPIHost::InspectableObject::get): Take reference instead of
        pointer and return JSValue.
        * inspector/CommandLineAPIHost.h: Updated for the above.

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::setDocument): Use "document" instead of "doc".
        (WebCore::InspectorDOMAgent::setAttributesAsText): Omit redundant class name.
        (WebCore::InspectorDOMAgent::focusNode): Ditto. Pass reference instead of pointer.
        (WebCore::InspectorDOMAgent::undo): Ditto.
        (WebCore::InspectorDOMAgent::redo): Ditto.
        (WebCore::InspectorDOMAgent::nodeForObjectId): Stop using Deprecated::ScriptValue.
        (WebCore::InspectorDOMAgent::resolveNode): Ditto.
        (WebCore::InspectorDOMAgent::scriptValueAsNode): Removed unneeded isObject check,
        which is already done by JSNode::toWrapped. Use JSValue.
        (WebCore::InspectorDOMAgent::nodeAsScriptValue): Use JSValue.
        * inspector/InspectorDOMAgent.h: Updated for the above.

        * inspector/InspectorFrontendClientLocal.cpp:
        (WebCore::InspectorFrontendClientLocal::windowObjectCleared): Use references instead of
        pointers and removed unneeded local.
        (WebCore::InspectorFrontendClientLocal::evaluateAsBoolean): More of the same.
        * inspector/InspectorFrontendHost.cpp:
        (WebCore::InspectorFrontendHost::showContextMenu): Ditto.

        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::breakpointActionProbe): Updated to take
        reference instead of pointer and JSValue instead of ScriptValue.
        * inspector/InspectorTimelineAgent.h: Ditto.
        * inspector/PageConsoleAgent.cpp: Ditto.
        * inspector/PageDebuggerAgent.cpp:
        (WebCore::PageDebuggerAgent::breakpointActionLog): Ditto.
        * inspector/PageDebuggerAgent.h: Ditto.

2016-04-15  Daniel Bates  <dabates@apple.com>

        CSP: Ignore paths in CSP matching after redirects
        https://bugs.webkit.org/show_bug.cgi?id=153154
        <rdar://problem/24383215>

        Reviewed by Brent Fulgham.

        For sub-resources that redirect, match the URL that is the result of the redirect against
        the source expressions in Content Security Policy ignoring any paths in those source
        expressions as per section Paths and Redirects of the Content Security Policy Level 2 spec.,
        <https://w3c.github.io/webappsec-csp/2/> (Editor's Draft, 29 August 2015).

        Tests: http/tests/security/contentSecurityPolicy/audio-redirect-allowed2.html
               http/tests/security/contentSecurityPolicy/embed-redirect-allowed.html
               http/tests/security/contentSecurityPolicy/embed-redirect-allowed2.html
               http/tests/security/contentSecurityPolicy/embed-redirect-blocked.html
               http/tests/security/contentSecurityPolicy/embed-redirect-blocked2.html
               http/tests/security/contentSecurityPolicy/embed-redirect-blocked3.html
               http/tests/security/contentSecurityPolicy/font-redirect-allowed2.html
               http/tests/security/contentSecurityPolicy/form-action-src-redirect-allowed.html
               http/tests/security/contentSecurityPolicy/form-action-src-redirect-allowed2.html
               http/tests/security/contentSecurityPolicy/iframe-redirect-allowed-by-child-src.html
               http/tests/security/contentSecurityPolicy/iframe-redirect-allowed-by-child-src2.html
               http/tests/security/contentSecurityPolicy/iframe-redirect-allowed-by-frame-src.html
               http/tests/security/contentSecurityPolicy/iframe-redirect-allowed-by-frame-src2.html
               http/tests/security/contentSecurityPolicy/iframe-redirect-blocked-by-child-src.html
               http/tests/security/contentSecurityPolicy/iframe-redirect-blocked-by-frame-src.html
               http/tests/security/contentSecurityPolicy/image-redirect-allowed2.html
               http/tests/security/contentSecurityPolicy/object-redirect-allowed.html
               http/tests/security/contentSecurityPolicy/object-redirect-allowed2.html
               http/tests/security/contentSecurityPolicy/object-redirect-blocked.html
               http/tests/security/contentSecurityPolicy/object-redirect-blocked2.html
               http/tests/security/contentSecurityPolicy/object-redirect-blocked3.html
               http/tests/security/contentSecurityPolicy/script-redirect-allowed2.html
               http/tests/security/contentSecurityPolicy/stylesheet-redirect-allowed2.html
               http/tests/security/contentSecurityPolicy/svg-font-redirect-allowed2.html
               http/tests/security/contentSecurityPolicy/svg-image-redirect-allowed2.html
               http/tests/security/contentSecurityPolicy/track-redirect-allowed2.html
               http/tests/security/contentSecurityPolicy/video-redirect-allowed2.html
               http/tests/security/contentSecurityPolicy/xsl-redirect-allowed2.html

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::willSendRequest): Define a local variable didReceiveRedirectResponse as
        to whether this request follows from having received a redirect response from the server. Pass this
        information to FrameLoader::checkIfFormActionAllowedByCSP() and PolicyChecker::checkNavigationPolicy()
        for its consideration.
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::redirectReceived): Pass whether we have a non-null redirect
        response (i.e. received a redirect response from the server) to DocumentThreadableLoader::isAllowedByContentSecurityPolicy()
        for its consideration.
        (WebCore::DocumentThreadableLoader::loadRequest): Pass whether we performed a redirect to
        DocumentThreadableLoader::isAllowedByContentSecurityPolicy() for its consideration.
        (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy): Modified to take a boolean
        argument as to whether a redirect was performed. We pass this information to the appropriate
        ContentSecurityPolicy method.
        * loader/DocumentThreadableLoader.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkIfFormActionAllowedByCSP): Modified to take a boolean argument as to whether
        a redirect response was received and passes this information to ContentSecurityPolicy::allowFormAction()
        for its consideration.
        (WebCore::FrameLoader::loadURL): Modified to tell PolicyChecker::checkNavigationPolicy() that the navigation
        is not in response to having received a redirect response from the server.
        (WebCore::FrameLoader::loadWithDocumentLoader): Ditto.
        * loader/FrameLoader.h:
        * loader/PolicyChecker.cpp:
        (WebCore::isAllowedByContentSecurityPolicy): Modified to take a boolean argument as to whether
        a redirect response was received and passes this information to the appropriate ContentSecurityPolicy member
        function for consideration.
        (WebCore::PolicyChecker::checkNavigationPolicy): Modified to take a boolean argument as to whether a redirect
        response was received and passes this information through to WebCore::isAllowedByContentSecurityPolicy().
        * loader/PolicyChecker.h:
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::willSendRequestInternal): Modified to tell CachedResourceLoader::canRequest() that
        the request is in response to having received a redirect response from the server.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::canRequest): Modified to take a boolean argument as to whether a redirect
        response was received and passes this information through to the appropriate ContentSecurityPolicy member
        function for consideration.
        * loader/cache/CachedResourceLoader.h:
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::allowScriptFromSource): Modified to take an argument as to whether a
        redirect response was received and passes this information through to ContentSecurityPolicyDirectiveList.
        (WebCore::ContentSecurityPolicy::allowObjectFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowChildContextFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowImageFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowStyleFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowFontFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowMediaFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowConnectToSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowFormAction): Ditto.
        * page/csp/ContentSecurityPolicy.h:
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::checkSource):
        (WebCore::checkFrameAncestors):
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForChildContext): Modified to take an argument
        as to whether a redirect response was received and passes this information through to the CSP directive.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForConnectSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForFont): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForFormAction): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForFrame): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForImage): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForMedia): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForObjectSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForScript): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle): Ditto.
        * page/csp/ContentSecurityPolicyDirectiveList.h:
        * page/csp/ContentSecurityPolicySource.cpp:
        (WebCore::ContentSecurityPolicySource::matches): Modified to take an argument as to whether a redirect response
        was received. When the specified URL follows from having received a redirect response then ignore the path
        component of the source expression when checking for a match. Otherwise, consider the path component of the
        source expression when performing the match.
        * page/csp/ContentSecurityPolicySource.h:
        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::matches): Modified to take an argument as to whether a redirect
        response was received and pass this information through to ContentSecurityPolicySource::matches().
        * page/csp/ContentSecurityPolicySourceList.h:
        * page/csp/ContentSecurityPolicySourceListDirective.cpp:
        (WebCore::ContentSecurityPolicySourceListDirective::allows): Modified to take an argument as to whether a
        redirect response was received and pass this information through to ContentSecurityPolicySourceList::matches().
        * page/csp/ContentSecurityPolicySourceListDirective.h:

2016-04-15  Myles C. Maxfield  <mmaxfield@apple.com>

        [CSS Font Loading] FontFace's promise may never be resolved/rejected if Content Security Policy blocks all the URLs
        https://bugs.webkit.org/show_bug.cgi?id=156605

        Reviewed by Daniel Bates.

        If all the fonts are blocked, we will create a FontFace with no FontFaceSources.
        Loading such a FontFace should reject the promise.

        Test: fast/text/font-loading-csp-block-all.html

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::pump):

2016-04-15  Alex Christensen  <achristensen@webkit.org>

        [WinCairo] Another unreviewed build fix.

        * platform/network/curl/MultipartHandle.cpp:
        (WebCore::MultipartHandle::parseHeadersIfPossible):

2016-04-15  Brent Fulgham  <bfulgham@apple.com>

        [WinCairo] Unreviewed build fix.,

        * platform/network/curl/MultipartHandle.cpp:
        (WebCore::MultipartHandle::parseHeadersIfPossible): Correct for new method signature.

2016-04-15  Myles C. Maxfield  <mmaxfield@apple.com>

        ASSERT when loading github.com
        https://bugs.webkit.org/show_bug.cgi?id=156604
        <rdar://problem/19890634>

        Reviewed by Darin Adler.

        HTMLFormControlElement::m_isValid is a cache of the results of the valid() function.
        When cloning the node, we were preserving each individual item, but not the state
        of the cache. Therefore, the cache and the attributes didn't agree with each other.

        Test: fast/forms/checkValidity-cloneNode-crash.html

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::copyNonAttributePropertiesFromElement):

2016-04-15  Brent Fulgham  <bfulgham@apple.com>

        Remove support for X-Frame-Options in `<meta>`
        https://bugs.webkit.org/show_bug.cgi?id=156625
        <rdar://problem/25748714>

        Reviewed by Darin Adler.

        Follow RFC7034 (Section 4), which recommends that 'X-Frame-Options' be ignored when delivered as part of
        a '<meta http-equiv="...">' tag. This brings us in line with Firefox, Edge, and Blink.

        Tests: http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html
               http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow.html
               http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny.html
               http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html
               http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored.html

        * dom/Document.cpp:
        (WebCore::Document::processHttpEquiv): Log error message instead of blocking the load.

2016-04-15  Jer Noble  <jer.noble@apple.com>

        Audio elements should be able to have a controls manager.
        https://bugs.webkit.org/show_bug.cgi?id=156630

        Reviewed by Beth Dakin.

        Now that there is no longer a architectural restriction about what kind of media elements
        can be used with WebPlaybackSessionManager, allow audio elements to create a controls
        manager.

        Drive-by fix: clear the controls manager when destroying the media player due to entering
        the page cache, and when destroying the media element.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::~HTMLMediaElement):
        (WebCore::HTMLMediaElement::updatePlayState):
        (WebCore::HTMLMediaElement::stopWithoutDestroyingMediaPlayer):
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::canControlControlsManager):

2016-04-15  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Calling SVGAnimatedPropertyTearOff::animationEnded() will crash if the SVG property is not animating
        https://bugs.webkit.org/show_bug.cgi?id=156549

        Reviewed by Darin Adler.

        A speculative fix for a crash which may happen when calling animationEnded()
        of any SVGAnimatedProperty while it is not animating.

        * svg/SVGAnimatedTypeAnimator.h:
        (WebCore::SVGAnimatedTypeAnimator::executeAction):

2016-04-15  Jer Noble  <jer.noble@apple.com>

        Unreviewed build fix for iOS simulator. Assert the correct variable.

        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (-[WebAVPlayerLayer layoutSublayers]):
        (-[WebAVPlayerLayer resolveBounds]):
        (-[WebAVPlayerLayer setVideoGravity:]):

2016-04-14  Jer Noble  <jer.noble@apple.com>

        Allow WebVideoFullscreenManager and Proxy to be used by audio elements.
        https://bugs.webkit.org/show_bug.cgi?id=156564

        Reviewed by Beth Dakin.

        No new tests; this refactors existing functionality into new classes.

        Tease apart the various WebVideoFullscreen{Interface,Model}{AVKit,Mac,VideoElement} into new
        WebPlaybackSession… classes dealing exclusively with playback state and commands, leaving
        fullscreen state and commands in the WebVideoFullscreen… classes. Specifically, create the
        following new classes:

        - WebPlaybackSessionInterface (copied from WebVideoFullscreenInterface)
        - WebPlaybackSessionModelMediaElement (copied from WebVideoFullscreenModelMediaElement)
        - WebPlaybackSessionModel (copied from WebVideoFullscreenModel)
        - WebPlaybackSessionInterfaceAVKit (copied from WebVideoFullscreenInterfaceAVKit)
        - WebPlaybackSessionInterfaceMac (copied from WebVideoFullscreenInterfaceMac)

        WebVideoFullscreenInterface and WebVideoFullscreenModel now inherit from
        WebPlaybackSessionInterface and WebPlaybackSessionModel, respectively. The concrete
        WebVideoFullscreen… subclasses each take their respective WebPlaybackSession… subclasses and
        fulfill their WebPlaybackSession interfaces through composition.

        As part of this big tease-apart, the WebAVPlayerController class needs to be exposed in a
        header (as it's accessed by two different classes now), so that class is moved into its own
        implementation and header files.

        The one case where a change in a WebPlaybackSession… class needs to be reflected in a
        WebVideoFullscreen… class is in WebPlaybackSessionInterfaceAVKit, where
        WebVideoFullscreenInterfaceAVKit needs to be notified when external playback becomes dis/en-
        abled, so a new WebPlaybackSessionInterfaceAVKitClient interface has been added to allow the
        WebPlaybackSession… to notify the WebVideoFullscreen….

        The responsibility for the "controls manager" has moved from the WebVideoFullscreen… classes
        to the WebPlaybackSession… classes, so the ChromeClient interface for creating and destroying
        those controls is similarly renamed from setUpVideoControlsManager() to
        setUpPlaybackControlsManager().

        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::updatePlayState):
        * page/ChromeClient.h:
        * platform/cocoa/WebPlaybackSessionInterface.h: Copied from Source/WebCore/platform/cocoa/WebVideoFullscreenInterface.h.
        (WebCore::WebPlaybackSessionInterface::~WebPlaybackSessionInterface):
        * platform/cocoa/WebPlaybackSessionModel.h: Added.
        (WebCore::WebPlaybackSessionModel::~WebPlaybackSessionModel):
        * platform/cocoa/WebPlaybackSessionModelMediaElement.h: Added.
        (WebCore::WebPlaybackSessionModelMediaElement::create):
        (WebCore::WebPlaybackSessionModelMediaElement::mediaElement):
        * platform/cocoa/WebPlaybackSessionModelMediaElement.mm: Added.
        (WebPlaybackSessionModelMediaElement::WebPlaybackSessionModelMediaElement):
        (WebPlaybackSessionModelMediaElement::~WebPlaybackSessionModelMediaElement):
        (WebPlaybackSessionModelMediaElement::setWebPlaybackSessionInterface):
        (WebPlaybackSessionModelMediaElement::setMediaElement):
        (WebPlaybackSessionModelMediaElement::handleEvent):
        (WebPlaybackSessionModelMediaElement::updateForEventName):
        (WebPlaybackSessionModelMediaElement::play):
        (WebPlaybackSessionModelMediaElement::pause):
        (WebPlaybackSessionModelMediaElement::togglePlayState):
        (WebPlaybackSessionModelMediaElement::beginScrubbing):
        (WebPlaybackSessionModelMediaElement::endScrubbing):
        (WebPlaybackSessionModelMediaElement::seekToTime):
        (WebPlaybackSessionModelMediaElement::fastSeek):
        (WebPlaybackSessionModelMediaElement::beginScanningForward):
        (WebPlaybackSessionModelMediaElement::beginScanningBackward):
        (WebPlaybackSessionModelMediaElement::endScanning):
        (WebPlaybackSessionModelMediaElement::selectAudioMediaOption):
        (WebPlaybackSessionModelMediaElement::selectLegibleMediaOption):
        (WebPlaybackSessionModelMediaElement::updateLegibleOptions):
        (WebPlaybackSessionModelMediaElement::observedEventNames):
        (WebPlaybackSessionModelMediaElement::eventNameAll):
        * platform/cocoa/WebPlaybackSessionModelVideoElement.cpp: Copied from Source/WebCore/platform/cocoa/WebVideoFullscreenModelVideoElement.mm.
        (WebPlaybackSessionModelVideoElement::WebPlaybackSessionModelVideoElement):
        (WebPlaybackSessionModelVideoElement::~WebPlaybackSessionModelVideoElement):
        (WebPlaybackSessionModelVideoElement::setWebVideoFullscreenInterface):
        (WebPlaybackSessionModelVideoElement::setVideoElement):
        (WebPlaybackSessionModelVideoElement::handleEvent):
        (WebPlaybackSessionModelVideoElement::updateForEventName):
        (WebPlaybackSessionModelVideoElement::play):
        (WebPlaybackSessionModelVideoElement::pause):
        (WebPlaybackSessionModelVideoElement::togglePlayState):
        (WebPlaybackSessionModelVideoElement::beginScrubbing):
        (WebPlaybackSessionModelVideoElement::endScrubbing):
        (WebPlaybackSessionModelVideoElement::seekToTime):
        (WebPlaybackSessionModelVideoElement::fastSeek):
        (WebPlaybackSessionModelVideoElement::beginScanningForward):
        (WebPlaybackSessionModelVideoElement::beginScanningBackward):
        (WebPlaybackSessionModelVideoElement::endScanning):
        (WebPlaybackSessionModelVideoElement::selectAudioMediaOption):
        (WebPlaybackSessionModelVideoElement::selectLegibleMediaOption):
        (WebPlaybackSessionModelVideoElement::updateLegibleOptions):
        (WebPlaybackSessionModelVideoElement::observedEventNames):
        (WebPlaybackSessionModelVideoElement::eventNameAll):
        * platform/cocoa/WebVideoFullscreenInterface.h:
        * platform/cocoa/WebVideoFullscreenModel.h:
        (WebCore::WebVideoFullscreenModel::~WebVideoFullscreenModel): Deleted.
        * platform/cocoa/WebVideoFullscreenModelVideoElement.h:
        (WebCore::WebVideoFullscreenModelVideoElement::create):
        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
        (WebVideoFullscreenModelVideoElement::WebVideoFullscreenModelVideoElement):
        (WebVideoFullscreenModelVideoElement::setWebVideoFullscreenInterface):
        (WebVideoFullscreenModelVideoElement::setVideoElement):
        (WebVideoFullscreenModelVideoElement::play):
        (WebVideoFullscreenModelVideoElement::pause):
        (WebVideoFullscreenModelVideoElement::togglePlayState):
        (WebVideoFullscreenModelVideoElement::beginScrubbing):
        (WebVideoFullscreenModelVideoElement::endScrubbing):
        (WebVideoFullscreenModelVideoElement::seekToTime):
        (WebVideoFullscreenModelVideoElement::fastSeek):
        (WebVideoFullscreenModelVideoElement::beginScanningForward):
        (WebVideoFullscreenModelVideoElement::beginScanningBackward):
        (WebVideoFullscreenModelVideoElement::endScanning):
        (WebVideoFullscreenModelVideoElement::selectAudioMediaOption):
        (WebVideoFullscreenModelVideoElement::selectLegibleMediaOption):
        (WebVideoFullscreenModelVideoElement::handleEvent): Deleted.
        (WebVideoFullscreenModelVideoElement::setVideoFullscreenLayer): Deleted.
        (WebVideoFullscreenModelVideoElement::setVideoLayerFrame): Deleted.
        (WebVideoFullscreenModelVideoElement::setVideoLayerGravity): Deleted.
        (WebVideoFullscreenModelVideoElement::observedEventNames): Deleted.
        (WebVideoFullscreenModelVideoElement::eventNameAll): Deleted.
        (WebVideoFullscreenModelVideoElement::fullscreenModeChanged): Deleted.
        (WebVideoFullscreenModelVideoElement::isVisible): Deleted.
        * platform/ios/WebAVPlayerController.h: Added.
        * platform/ios/WebAVPlayerController.mm: Added.
        (-[WebAVPlayerController dealloc]):
        (-[WebAVPlayerController resetState]):
        (-[WebAVPlayerController player]):
        (-[WebAVPlayerController forwardingTargetForSelector:]):
        (-[WebAVPlayerController play:]):
        (-[WebAVPlayerController pause:]):
        (-[WebAVPlayerController togglePlayback:]):
        (-[WebAVPlayerController togglePlaybackEvenWhenInBackground:]):
        (-[WebAVPlayerController isPlaying]):
        (-[WebAVPlayerController setPlaying:]):
        (+[WebAVPlayerController keyPathsForValuesAffectingPlaying]):
        (-[WebAVPlayerController beginScrubbing:]):
        (-[WebAVPlayerController endScrubbing:]):
        (-[WebAVPlayerController seekToTime:]):
        (-[WebAVPlayerController currentTimeWithinEndTimes]):
        (-[WebAVPlayerController setCurrentTimeWithinEndTimes:]):
        (+[WebAVPlayerController keyPathsForValuesAffectingCurrentTimeWithinEndTimes]):
        (-[WebAVPlayerController hasLiveStreamingContent]):
        (+[WebAVPlayerController keyPathsForValuesAffectingHasLiveStreamingContent]):
        (-[WebAVPlayerController skipBackwardThirtySeconds:]):
        (-[WebAVPlayerController gotoEndOfSeekableRanges:]):
        (-[WebAVPlayerController canScanForward]):
        (+[WebAVPlayerController keyPathsForValuesAffectingCanScanForward]):
        (-[WebAVPlayerController beginScanningForward:]):
        (-[WebAVPlayerController endScanningForward:]):
        (-[WebAVPlayerController beginScanningBackward:]):
        (-[WebAVPlayerController endScanningBackward:]):
        (-[WebAVPlayerController canSeekToBeginning]):
        (+[WebAVPlayerController keyPathsForValuesAffectingCanSeekToBeginning]):
        (-[WebAVPlayerController seekToBeginning:]):
        (-[WebAVPlayerController seekChapterBackward:]):
        (-[WebAVPlayerController canSeekToEnd]):
        (+[WebAVPlayerController keyPathsForValuesAffectingCanSeekToEnd]):
        (-[WebAVPlayerController seekToEnd:]):
        (-[WebAVPlayerController seekChapterForward:]):
        (-[WebAVPlayerController hasMediaSelectionOptions]):
        (+[WebAVPlayerController keyPathsForValuesAffectingHasMediaSelectionOptions]):
        (-[WebAVPlayerController hasAudioMediaSelectionOptions]):
        (+[WebAVPlayerController keyPathsForValuesAffectingHasAudioMediaSelectionOptions]):
        (-[WebAVPlayerController hasLegibleMediaSelectionOptions]):
        (+[WebAVPlayerController keyPathsForValuesAffectingHasLegibleMediaSelectionOptions]):
        (-[WebAVPlayerController currentAudioMediaSelectionOption]):
        (-[WebAVPlayerController setCurrentAudioMediaSelectionOption:]):
        (-[WebAVPlayerController currentLegibleMediaSelectionOption]):
        (-[WebAVPlayerController setCurrentLegibleMediaSelectionOption:]):
        (-[WebAVPlayerController isPlayingOnExternalScreen]):
        (+[WebAVPlayerController keyPathsForValuesAffectingPlayingOnExternalScreen]):
        (-[WebAVPlayerController isPictureInPictureInterrupted]):
        (-[WebAVPlayerController setPictureInPictureInterrupted:]):
        * platform/ios/WebPlaybackSessionInterfaceAVKit.h: Added.
        (WebCore::WebPlaybackSessionInterfaceAVKitClient::~WebPlaybackSessionInterfaceAVKitClient):
        * platform/ios/WebPlaybackSessionInterfaceAVKit.mm: Added.
        (WebCore::WebPlaybackSessionInterfaceAVKit::WebPlaybackSessionInterfaceAVKit):
        (WebCore::WebPlaybackSessionInterfaceAVKit::~WebPlaybackSessionInterfaceAVKit):
        (WebCore::WebPlaybackSessionInterfaceAVKit::resetMediaState):
        (WebCore::WebPlaybackSessionInterfaceAVKit::setWebPlaybackSessionModel):
        (WebCore::WebPlaybackSessionInterfaceAVKit::setDuration):
        (WebCore::WebPlaybackSessionInterfaceAVKit::setCurrentTime):
        (WebCore::WebPlaybackSessionInterfaceAVKit::setBufferedTime):
        (WebCore::WebPlaybackSessionInterfaceAVKit::setRate):
        (WebCore::WebPlaybackSessionInterfaceAVKit::setSeekableRanges):
        (WebCore::WebPlaybackSessionInterfaceAVKit::setCanPlayFastReverse):
        (WebCore::mediaSelectionOptions):
        (WebCore::WebPlaybackSessionInterfaceAVKit::setAudioMediaSelectionOptions):
        (WebCore::WebPlaybackSessionInterfaceAVKit::setLegibleMediaSelectionOptions):
        (WebCore::WebPlaybackSessionInterfaceAVKit::setExternalPlayback):
        (WebCore::WebPlaybackSessionInterfaceAVKit::setWirelessVideoPlaybackDisabled):
        (WebCore::WebPlaybackSessionInterfaceAVKit::wirelessVideoPlaybackDisabled):
        (WebCore::WebPlaybackSessionInterfaceAVKit::invalidate):
        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        (WebVideoFullscreenControllerContext::setUpFullscreen):
        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (-[WebAVPlayerViewControllerDelegate fullscreenInterface]):
        (-[WebAVPlayerViewControllerDelegate setFullscreenInterface:]):
        (-[WebAVPlayerLayer fullscreenInterface]):
        (-[WebAVPlayerLayer setFullscreenInterface:]):
        (-[WebAVPlayerLayer layoutSublayers]):
        (-[WebAVPlayerLayer resolveBounds]):
        (-[WebAVPlayerLayer setVideoGravity:]):
        (WebVideoFullscreenInterfaceAVKit::create):
        (WebVideoFullscreenInterfaceAVKit::WebVideoFullscreenInterfaceAVKit):
        (WebVideoFullscreenInterfaceAVKit::~WebVideoFullscreenInterfaceAVKit):
        (WebVideoFullscreenInterfaceAVKit::playerController):
        (WebVideoFullscreenInterfaceAVKit::resetMediaState):
        (WebVideoFullscreenInterfaceAVKit::setDuration):
        (WebVideoFullscreenInterfaceAVKit::setCurrentTime):
        (WebVideoFullscreenInterfaceAVKit::setBufferedTime):
        (WebVideoFullscreenInterfaceAVKit::setRate):
        (WebVideoFullscreenInterfaceAVKit::setVideoDimensions):
        (WebVideoFullscreenInterfaceAVKit::setSeekableRanges):
        (WebVideoFullscreenInterfaceAVKit::setCanPlayFastReverse):
        (WebVideoFullscreenInterfaceAVKit::setAudioMediaSelectionOptions):
        (WebVideoFullscreenInterfaceAVKit::setLegibleMediaSelectionOptions):
        (WebVideoFullscreenInterfaceAVKit::setExternalPlayback):
        (WebVideoFullscreenInterfaceAVKit::externalPlaybackEnabledChanged):
        (WebVideoFullscreenInterfaceAVKit::setWirelessVideoPlaybackDisabled):
        (WebVideoFullscreenInterfaceAVKit::wirelessVideoPlaybackDisabled):
        (WebVideoFullscreenInterfaceAVKit::setupFullscreen):
        (WebVideoFullscreenInterfaceAVKit::cleanupFullscreen):
        (WebVideoFullscreenInterfaceAVKit::mayAutomaticallyShowVideoPictureInPicture):
        (-[WebAVPlayerViewControllerDelegate playerViewControllerWillStartPictureInPicture:]): Deleted.
        (-[WebAVPlayerViewControllerDelegate playerViewControllerDidStartPictureInPicture:]): Deleted.
        (-[WebAVPlayerViewControllerDelegate playerViewControllerFailedToStartPictureInPicture:withError:]): Deleted.
        (-[WebAVPlayerViewControllerDelegate playerViewControllerWillStopPictureInPicture:]): Deleted.
        (-[WebAVPlayerViewControllerDelegate playerViewControllerDidStopPictureInPicture:]): Deleted.
        (convertToExitFullScreenReason): Deleted.
        (-[WebAVPlayerViewControllerDelegate playerViewController:shouldExitFullScreenWithReason:]): Deleted.
        (-[WebAVPlayerViewControllerDelegate playerViewController:restoreUserInterfaceForPictureInPictureStopWithCompletionHandler:]): Deleted.
        (-[WebAVPlayerLayer init]): Deleted.
        (-[WebAVPlayerLayer dealloc]): Deleted.
        (-[WebAVPlayerLayer videoGravity]): Deleted.
        (-[WebAVPlayerLayer videoRect]): Deleted.
        (+[WebAVPlayerLayer keyPathsForValuesAffectingVideoRect]): Deleted.
        (WebAVPictureInPicturePlayerLayerView_layerClass): Deleted.
        (getWebAVPictureInPicturePlayerLayerViewClass): Deleted.
        (WebAVPlayerLayerView_layerClass): Deleted.
        (WebAVPlayerLayerView_playerController): Deleted.
        (WebAVPlayerLayerView_setPlayerController): Deleted.
        (WebAVPlayerLayerView_videoView): Deleted.
        (WebAVPlayerLayerView_setVideoView): Deleted.
        (WebAVPlayerLayerView_startRoutingVideoToPictureInPicturePlayerLayerView): Deleted.
        (WebAVPlayerLayerView_stopRoutingVideoToPictureInPicturePlayerLayerView): Deleted.
        (WebAVPlayerLayerView_pictureInPicturePlayerLayerView): Deleted.
        (WebAVPlayerLayerView_dealloc): Deleted.
        (getWebAVPlayerLayerViewClass): Deleted.
        (WebVideoFullscreenInterfaceAVKit::setWebVideoFullscreenModel): Deleted.
        (WebVideoFullscreenInterfaceAVKit::setWebVideoFullscreenChangeObserver): Deleted.
        (WebVideoFullscreenInterfaceAVKit::applicationDidBecomeActive): Deleted.
        (WebVideoFullscreenInterfaceAVKit::enterFullscreen): Deleted.
        (WebVideoFullscreenInterfaceAVKit::enterFullscreenStandard): Deleted.
        (WebVideoFullscreenInterfaceAVKit::exitFullscreen): Deleted.
        (WebVideoFullscreenInterfaceAVKit::didStartPictureInPicture): Deleted.
        (WebVideoFullscreenInterfaceAVKit::failedToStartPictureInPicture): Deleted.
        (WebVideoFullscreenInterfaceAVKit::willStopPictureInPicture): Deleted.
        (WebVideoFullscreenInterfaceAVKit::didStopPictureInPicture): Deleted.
        (WebVideoFullscreenInterfaceAVKit::prepareForPictureInPictureStopWithCompletionHandler): Deleted.
        (WebVideoFullscreenInterfaceAVKit::shouldExitFullscreenWithReason): Deleted.
        (WebVideoFullscreenInterfaceAVKit::watchdogTimerFired): Deleted.
        (WebVideoFullscreenInterfaceAVKit::setMode): Deleted.
        (WebVideoFullscreenInterfaceAVKit::clearMode): Deleted.
        (WebCore::supportsPictureInPicture): Deleted.
        * platform/mac/WebPlaybackSessionInterfaceMac.h: Added.
        * platform/mac/WebPlaybackSessionInterfaceMac.mm: Copied from Source/WebCore/platform/mac/WebVideoFullscreenInterfaceMac.mm.
        (-[WebAVMediaSelectionOptionMac localizedDisplayName]):
        (-[WebAVMediaSelectionOptionMac setLocalizedDisplayName:]):
        (-[WebPlaybackControlsManager initWithWebPlaybackSessionInterfaceMac:]):
        (-[WebPlaybackControlsManager timing]):
        (-[WebPlaybackControlsManager setTiming:]):
        (-[WebPlaybackControlsManager seekableTimeRanges]):
        (-[WebPlaybackControlsManager setSeekableTimeRanges:]):
        (-[WebPlaybackControlsManager isSeeking]):
        (-[WebPlaybackControlsManager seekToTime:toleranceBefore:toleranceAfter:]):
        (-[WebPlaybackControlsManager audioMediaSelectionOptions]):
        (-[WebPlaybackControlsManager setAudioMediaSelectionOptions:]):
        (-[WebPlaybackControlsManager currentAudioMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentAudioMediaSelectionOption:]):
        (-[WebPlaybackControlsManager legibleMediaSelectionOptions]):
        (-[WebPlaybackControlsManager setLegibleMediaSelectionOptions:]):
        (-[WebPlaybackControlsManager currentLegibleMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentLegibleMediaSelectionOption:]):
        (-[WebPlaybackControlsManager cancelThumbnailAndAudioAmplitudeSampleGeneration]):
        (WebCore::WebPlaybackSessionInterfaceMac::~WebPlaybackSessionInterfaceMac):
        (WebCore::WebPlaybackSessionInterfaceMac::setWebPlaybackSessionModel):
        (WebCore::WebPlaybackSessionInterfaceMac::setDuration):
        (WebCore::WebPlaybackSessionInterfaceMac::setCurrentTime):
        (WebCore::WebPlaybackSessionInterfaceMac::setRate):
        (WebCore::WebPlaybackSessionInterfaceMac::setSeekableRanges):
        (WebCore::mediaSelectionOptions):
        (WebCore::WebPlaybackSessionInterfaceMac::setAudioMediaSelectionOptions):
        (WebCore::WebPlaybackSessionInterfaceMac::setLegibleMediaSelectionOptions):
        (WebCore::WebPlaybackSessionInterfaceMac::invalidate):
        (WebCore::WebPlaybackSessionInterfaceMac::ensureControlsManager):
        (WebCore::WebPlaybackSessionInterfaceMac::playBackControlsManager):
        * platform/mac/WebVideoFullscreenInterfaceMac.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::WebVideoFullscreenInterfaceMac):
        (WebCore::WebVideoFullscreenInterfaceMac::setWebVideoFullscreenModel):
        (WebCore::WebVideoFullscreenInterfaceMac::setDuration):
        (WebCore::WebVideoFullscreenInterfaceMac::setCurrentTime):
        (WebCore::WebVideoFullscreenInterfaceMac::setRate):
        (WebCore::WebVideoFullscreenInterfaceMac::setSeekableRanges):
        (WebCore::WebVideoFullscreenInterfaceMac::setAudioMediaSelectionOptions):
        (WebCore::WebVideoFullscreenInterfaceMac::setLegibleMediaSelectionOptions):
        (WebCore::WebVideoFullscreenInterfaceMac::ensureControlsManager):
        (WebCore::WebVideoFullscreenInterfaceMac::~WebVideoFullscreenInterfaceMac): Deleted.
        (WebCore::WebVideoFullscreenInterfaceMac::setWebVideoFullscreenChangeObserver): Deleted.
        (WebCore::WebVideoFullscreenInterfaceMac::setMode): Deleted.
        (WebCore::WebVideoFullscreenInterfaceMac::clearMode): Deleted.
        (WebCore::WebVideoFullscreenInterfaceMac::setupFullscreen): Deleted.
        (WebCore::WebVideoFullscreenInterfaceMac::enterFullscreen): Deleted.
        (WebCore::WebVideoFullscreenInterfaceMac::exitFullscreen): Deleted.
        (WebCore::WebVideoFullscreenInterfaceMac::exitFullscreenWithoutAnimationToMode): Deleted.
        (WebCore::WebVideoFullscreenInterfaceMac::cleanupFullscreen): Deleted.
        (WebCore::WebVideoFullscreenInterfaceMac::invalidate): Deleted.
        (WebCore::WebVideoFullscreenInterfaceMac::preparedToReturnToInline): Deleted.
        (WebCore::WebVideoFullscreenInterfaceMac::setVideoDimensions): Deleted.
        (WebCore::supportsPictureInPicture): Deleted.

2016-04-15  Chris Dumez  <cdumez@apple.com>

        [COCOA] Do not unnecessarily initialize ResourceResponse::m_httpVersion as part of common fields
        https://bugs.webkit.org/show_bug.cgi?id=156606

        Reviewed by Darin Adler.

        Do not unnecessarily initialize ResourceResponse::m_httpVersion as part of common fields.

        We previously initialized m_httpVersion when calling platformLazyInit(CommonFieldsOnly),
        even though this is not a common field. The corresponding getter/setter in
        HTTPResponseBase call lazyInit(AllFields).

        * platform/network/cf/ResourceResponseCFNet.cpp:
        (WebCore::ResourceResponse::platformLazyInit):
        * platform/network/cocoa/ResourceResponseCocoa.mm:
        (WebCore::ResourceResponse::platformLazyInit):

2016-04-15  John Wilander  <wilander@apple.com>

        Refactor WebSockets handshake to use StringView instead of String for header validation.
        https://bugs.webkit.org/show_bug.cgi?id=155602

        Reviewed by Darin Adler.

        No new tests. Existing test have been augmented.

        * Modules/websockets/WebSocketHandshake.cpp:
        (WebCore::WebSocketHandshake::readServerHandshake):
            Made sure failure reason was set consistently with makeString().
        (WebCore::headerHasValidHTTPVersion):
            Now operates on the HTTP status line with StringView.
        (WebCore::WebSocketHandshake::readStatusLine):
            Now operates on the HTTP status line with StringView.
        (WebCore::WebSocketHandshake::readHTTPHeaders):
            Now operates on header names with StringView.
            Made sure failure reason was set consistently with makeString() and ASCIILiteral().
        (WebCore::WebSocketHandshake::checkResponseHeaders):
            Made sure failure reason was set consistently with ASCIILiteral().
        * platform/network/HTTPParsers.cpp:
        (WebCore::parseHTTPRequestLine):
            Made sure failure reason was set consistently with ASCIILiteral().
        (WebCore::isValidHeaderNameCharacter):
            Inlined function to check if a character is allowed in an HTTP header name according to RFC 7230.
            https://tools.ietf.org/html/rfc7230 (June 2014)
        (WebCore::parseHTTPHeader):
        * platform/network/HTTPParsers.h:
            Now receives the HTTP header name as a StringView.
            Checks that header names only contain valid characters according to RFC 7230 (see above).
        * platform/network/ResourceRequestBase.cpp:
        (WebCore::ResourceRequestBase::addHTTPHeaderField):
        * platform/network/ResourceRequestBase.h:
             Now has an overloaded function which receives the HTTP header name as an HTTPHeaderName enum value.
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::addHTTPHeaderField):
        * platform/network/ResourceResponseBase.h:
             Now has an overloaded function which receives the HTTP header name as an HTTPHeaderName enum value.

2016-04-15  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: Presentational role on SVG elements is trumped by child 'title' and 'desc' elements
        https://bugs.webkit.org/show_bug.cgi?id=156519

        Reviewed by Chris Fleizach.

        Override the presentational role on SVG elements which have a child 'title' or 'desc'
        element. As a result of this change, AccessibilitySVGRoot objects would be exposed
        with an AccessibilityRole of UnknownRole. Therefore map included AccessibilitySVGRoot
        objects to GroupRole as per the SVG Accessibility API Mapping specification.

        Also use indexOfBestMatchingLanguageInList() to identify which child 'title' or 'desc'
        element is the best match for the parent element.

        New Test: accessibility/w3c-svg-content-language-attribute.html

        Also: Update w3c-svg-presentational-role.html expectations because there are test cases
        in which elements are now being included in the accessibility tree as a result of this
        change. Also add new test cases which lack child 'title' and 'desc' elements.

        * accessibility/AccessibilityNodeObject.h:
        * accessibility/AccessibilitySVGElement.cpp:
        (WebCore::AccessibilitySVGElement::childElementWithMatchingLanguage):
        (WebCore::AccessibilitySVGElement::accessibilityDescription):
        (WebCore::AccessibilitySVGElement::helpText):
        (WebCore::AccessibilitySVGElement::computeAccessibilityIsIgnored):
        (WebCore::AccessibilitySVGElement::determineAriaRoleAttribute):
        * accessibility/AccessibilitySVGElement.h:
        * accessibility/AccessibilitySVGRoot.h:

2016-04-15  Chris Dumez  <cdumez@apple.com>

        Rename [GlobalContext] extended attribute to [Exposed] and align with WebIDL
        https://bugs.webkit.org/show_bug.cgi?id=156615

        Reviewed by Youenn Fablet.

        Rename [GlobalContext] extended attribute to [Exposed] and align with WebIDL:
        - http://heycam.github.io/webidl/#Exposed

        * bindings/scripts/IDLAttributes.txt:
        Stop recognizing [GlobalContext] and start recognizing [Exposed].

        * bindings/scripts/IDLParser.pm:
        (parseIdentifierList):
        (parseExtendedAttributeRest2):
        Add IDL parser support for having a list of identifiers as value
        for an IDL extended attribute, e.g. Exposed=(Window, Worker).

        * bindings/scripts/preprocess-idls.pl:
        Tweak existing support for [GlobalContext] to use [Exposed] instead
        and support the new syntax.

        (getInterfaceExtendedAttributesFromIDL):
        Do not split on commas that are within brackets.

        * Modules/fetch/FetchBody.idl:
        * Modules/fetch/FetchHeaders.idl:
        * Modules/fetch/FetchRequest.idl:
        * Modules/fetch/FetchResponse.idl:
        * Modules/streams/ByteLengthQueuingStrategy.idl:
        * Modules/streams/CountQueuingStrategy.idl:
        * Modules/streams/ReadableStream.idl:
        * Modules/streams/ReadableStreamController.idl:
        * Modules/streams/ReadableStreamReader.idl:
        * Modules/websockets/WebSocket.idl:
        * dom/MessageChannel.idl:
        * dom/MessageEvent.idl:
        * fileapi/Blob.idl:
        * fileapi/FileReader.idl:
        * fileapi/FileReaderSync.idl:
        * html/DOMURL.idl:
        * html/ImageData.idl:
        * page/EventSource.idl:
        * workers/DedicatedWorkerGlobalScope.idl:
        * workers/WorkerGlobalScope.idl:
        * workers/WorkerLocation.idl:
        * xml/XMLHttpRequest.idl:
        * xml/XMLHttpRequestEventTarget.idl:
        Use [Exposed] instead of [GlobalContext] to match their respective
        specifications.

2016-04-15  Carlos Garcia Campos  <cgarcia@igalia.com>

        Selection.deleteFromDocument should not leave a selection character
        https://bugs.webkit.org/show_bug.cgi?id=151442

        Reviewed by Michael Catanzaro.

        This is a merge of Blink r172511:
        https://codereview.chromium.org/255453003

        Let Selection.deleteFromDocument not delete a character when the
        selection is a caret.

        Selection.deleteFromDocument delete a character when the selection
        is a caret.
        However, current standard says that Selection.deleteFromDocument
        does nothing when the selection is a caret:
        https://dvcs.w3.org/hg/editing/raw-file/tip/editing.html#dom-selection-deletefromdocument
        Both IE10 and FireFox seem following the spec.

        Test: imported/blink/editing/selection/deleteFromDocument-undo-crash.html

        * page/DOMSelection.cpp:
        (WebCore::DOMSelection::deleteFromDocument): Deleted.

2016-04-15  Antti Koivisto  <antti@apple.com>

        Fix return value nullptr -> false.

        * style/StyleSharingResolver.cpp:
        (WebCore::Style::SharingResolver::canShareStyleWithElement):

2016-04-14  Antti Koivisto  <antti@apple.com>

        AffectsNextSibling style relation marking is inefficient
        https://bugs.webkit.org/show_bug.cgi?id=156593

        Reviewed by Benjamin Poulain.

        We currently add a Style::Relation entry for each sibling to mark. With long sibling lists this can be inefficient
        in terms of both memory and speed. Instead make a single entry that includes the sibling count to mark.

        * css/SelectorChecker.cpp:
        (WebCore::addStyleRelation):

            When adding AffectsNextSibling entry check if the last entry in the style relation vector has the
            same type and is part of the same sibling chain. If so just update the existing entry.

        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateAddStyleRelation):

            The same thing in hand-crafted macro assembler.

        * cssjit/SelectorCompiler.h:

            Stop lying about the constness of the CheckingContext.

        * style/StyleRelations.cpp:
        (WebCore::Style::commitRelations):

            Mark as many sibling elements as the value indicates.

        * style/StyleRelations.h:
        (WebCore::Style::Relation::Relation):

            Make element a pointer so we can udpate it.

2016-04-15  Brady Eidson  <beidson@apple.com>

        Add the message property to DOMError.
        https://bugs.webkit.org/show_bug.cgi?id=139173

        Reviewed by Alex Christensen.

        No new tests (Updated existing tests).
        
        Adding this property brings us up to date with other browsers, and will help
        test the few web features that still use DOMError.

        * Modules/indexeddb/IDBOpenDBRequest.cpp:
        (WebCore::IDBOpenDBRequest::onError):
        (WebCore::IDBOpenDBRequest::fireErrorAfterVersionChangeCompletion):

        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::uncaughtExceptionInEventHandler):
        (WebCore::IDBRequest::onError):

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::didCreateIndexOnServer):

        * Modules/mediastream/NavigatorUserMediaError.h:
        (WebCore::NavigatorUserMediaError::NavigatorUserMediaError):

        * dom/DOMError.cpp:
        (WebCore::DOMError::DOMError):

        * dom/DOMError.h:
        (WebCore::DOMError::create):
        (WebCore::DOMError::message):
        * dom/DOMError.idl:

2016-04-14  Brent Fulgham  <bfulgham@apple.com>

        Make <a download> a runtime enabled option
        https://bugs.webkit.org/show_bug.cgi?id=156583
        <rdar://problem/25733449>

        Reviewed by Alex Christensen.

        Mark the download attribute interface as EnabledAtRuntime=DownloadAttribute.
        Add DownloadAttribute runtime flag getter and setter.

        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::fetchAPIEnabled):
        (WebCore::RuntimeEnabledFeatures::setDownloadAttributeEnabled):
        (WebCore::RuntimeEnabledFeatures::downloadAttributeEnabled):
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::handleClick):
        * html/HTMLAnchorElement.idl:

2016-04-14  David Kilzer  <ddkilzer@apple.com>

        REGRESSION (r158956): Remove vestigial range code in FileReaderLoader class after removing ENABLE(STREAM)
        <http://webkit.org/b/156609>

        Reviewed by Brent Fulgham.

        This code was left behind when ENABLE(STREAM) was removed in
        November 2013.

        * fileapi/FileReaderLoader.cpp:
        (WebCore::FileReaderLoader::FileReaderLoader): Remove
        initializers.
        (WebCore::FileReaderLoader::start): Remove code that uses
        m_hasRange, which is always false.
        (WebCore::FileReaderLoader::didReceiveResponse): Ditto.
        * fileapi/FileReaderLoader.h:
        (WebCore::FileReaderLoader): Remove unused instance variables.

2016-04-14  Alex Christensen  <achristensen@webkit.org>

        Build fix after r199549.
        https://bugs.webkit.org/show_bug.cgi?id=156580

        * CMakeLists.txt:
        * PlatformEfl.cmake:
        * PlatformGTK.cmake:
        * PlatformWin.cmake:
        KillRingNone.cpp is indeed platform-specific. KillRingMac.mm is used instead only on Mac.

2016-04-14  Dean Jackson  <dino@apple.com>

        CrashTracer: com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::CachedResource::addClientToSet + 27
        https://bugs.webkit.org/show_bug.cgi?id=156602
        <rdar://problem/18921091>

        Reviewed by Simon Fraser.

        The CSS property list-style-image is inherited, so a transition on a parent
        might cause a transition on a child. On that child, the value might be between
        two generated crossfade images which haven't yet resolved, causing a crash.

        Test: transitions/crossfade-transition.html

        * css/CSSCrossfadeValue.cpp:
        (WebCore::CSSCrossfadeValue::blend): Return null if there are no cached images.
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::blendFunc): If we don't have an actual image to blend between, fall
        out to the default case.

2016-04-14  Antonio Gomes  <tonikitoo@webkit.org>

        Allow listbox content and scrollbar to intrude padding area.
        https://bugs.webkit.org/show_bug.cgi?id=128489

        Reviewed by Myles C. Maxfield.

        Originally when the RenderListBox::controlClipRect method was implemented (see [1]), it used
        to allow its content (<option>'s) to intrude padding to get rendered. Overlay scrollbars were also
        allowed to paint over the padding area, if necessary.

        [2] changed this behavior to restrict list-box'es content within the content box rect (excluding padding and border).

        This had two consequences:
        1) it made WebKit disallow list-box' content to intrude the padding area, diverging from other vendors.
        like Firefox and Chrome.
        2) Since overlay scrollbar might get painted over the padding area, if any, [2] could result
        in the scrollbar being clipped out if padding-right is set (or padding-left in case of RTL content).

        Patch changed WebKit back so that it allows list-box' content and overlay scrollbars to intrude the
        padding area, matching other browsers vendors

        [1] https://trac.webkit.org/changeset/18819/trunk/WebCore/rendering/RenderListBox.cpp
        [2] https://trac.webkit.org/changeset/19037/trunk/WebCore/rendering/RenderListBox.cpp

        Tests: fast/forms/listbox-selection-3.html
               fast/forms/listbox-padding-clip-selected.html
               fast/forms/listbox-padding-clip-expected-mismatch.html (renamed from listbox-padding-clip-overlay-expected.html)
               fast/forms/listbox-padding-clip-overlay-expected-mismatch.html (renamed from listbox-padding-clip-expected.html)

        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::numVisibleItems): changed to allow list-box items to get rendered on the padding-bottom area.
        This matches Firefox and Chrome.
        (WebCore::RenderListBox::listIndexAtOffset): relax the check for a given list-box item at a specific offset in the vertical axis.
        This means if an list-box item has its content painted into the padding-bottom area, it will be actionable by mouse clicking.
        This matches Firefox and Chrome.
        (WebCore::RenderListBox::controlClipRect): clips list-box content against the padding box rect rather than the content box rect,
        to allow its list-box items' content intrude the padding area.
        This matches Firefox and Chrome.

2016-04-14  Antti Koivisto  <antti@apple.com>

        Collapsed border cache invalidation can lead to O(n^2) during style resolve
        https://bugs.webkit.org/show_bug.cgi?id=156570

        Reviewed by Darin Adler.

        RenderTable::invalidateCollapsedBorders traverses all cells. It is called when table cell border changes.
        This can result in O(n^2) during style resolve.

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::layout):
        (WebCore::RenderTable::invalidateCollapsedBorders):

            For cell border style change invalidate the hasEmptyCollapsedBorder bits only for the neighbouring cells.
            They are the only ones that can be affected.

        * rendering/RenderTable.h:
        (WebCore::RenderTable::collapsedBordersAreValid):
        (WebCore::RenderTable::collapsedEmptyBorderIsPresent):
        (WebCore::RenderTable::currentBorderValue):
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::styleDidChange):

2016-04-14  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Implement CSSGridTemplateAreasValue::equals
        https://bugs.webkit.org/show_bug.cgi?id=156578

        Reviewed by Darin Adler.

        This was causing an infinite loop setting grid-template-areas
        from JavaScript.

        The reason was that CSSGridTemplateAreasValue needs
        an specific implementation of equals() method.

        Test: fast/css-grid-layout/grid-template-areas-infinite-loop.html

        * css/CSSGridTemplateAreasValue.cpp:
        (WebCore::CSSGridTemplateAreasValue::equals):
        * css/CSSGridTemplateAreasValue.h:

2016-04-14  Brent Fulgham  <bfulgham@apple.com>

        [CMake] Clean up CMake files
        https://bugs.webkit.org/show_bug.cgi?id=156580

        Reviewed by Alex Christensen.

        Revise the various CMake input files to reduce the amount of duplicated file references in
        the various ports.

        * CMakeLists.txt:
        * PlatformAppleWin.cmake:
        * PlatformEfl.cmake:
        * PlatformGTK.cmake:
        * PlatformWin.cmake:
        * PlatformWinCairo.cmake:

2016-04-14  Frederic Wang  <fred.wang@free.fr>

        RenderMathMLOperator: Add helper function to retrieve italic correction
        https://bugs.webkit.org/show_bug.cgi?id=156572

        Reviewed by Darin Adler.

        No new tests, the helper function will only be used in bug 153918.

        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::italicCorrection): Return the italic correction from the MATH table if it's a large operator.
        * rendering/mathml/RenderMathMLOperator.h: Declare italicCorrection.

2016-04-14  Frederic Wang  <fwang@igalia.com>

        RenderMathMLOperator: Move glyph measuring helper functions outside the class
        https://bugs.webkit.org/show_bug.cgi?id=156571

        Reviewed by Darin Adler.

        No new tests, this is just a simple refactoring to prepare the patch
        for bug 156542, without any behavior change.

        * rendering/mathml/RenderMathMLOperator.cpp: MATHML_OPDICT_SIZE was removed in bug 152242, so no need to undef it.
        (WebCore::boundsForGlyph): Static inline helper function moved from the RenderMathMLOperator class.
        (WebCore::heightForGlyph): Ditto.
        (WebCore::advanceWidthForGlyph): Ditto and renamed.
        (WebCore::RenderMathMLOperator::computePreferredLogicalWidths): Rename advanceForGlyph.
        (WebCore::RenderMathMLOperator::findStretchyData): Ditto.
        (WebCore::RenderMathMLOperator::updateStyle): Ditto.
        (WebCore::RenderMathMLOperator::paintGlyph): Ditto.
        (WebCore::RenderMathMLOperator::paint): Ditto.
        (WebCore::RenderMathMLOperator::trailingSpaceError): Ditto.
        (WebCore::RenderMathMLOperator::setOperatorProperties): Deleted.
        (WebCore::RenderMathMLOperator::boundsForGlyph): Deleted.
        (WebCore::RenderMathMLOperator::heightForGlyph): Deleted.
        (WebCore::RenderMathMLOperator::advanceForGlyph): Deleted.
        * rendering/mathml/RenderMathMLOperator.h:

2016-04-14  Frederic Wang  <fred.wang@free.fr>

        Set some RenderMathMLOperator members as final
        https://bugs.webkit.org/show_bug.cgi?id=156574

        Reviewed by Darin Adler.

        No new tests, this is only a simple refactoring without behavior change.

        * rendering/mathml/RenderMathMLOperator.h: Replace "override" with "final" for some members.

2016-04-14  Frederic Wang  <fwang@igalia.com>

        Ensure that RenderMathMLOperator::stretchTo functions are called with stretchy operators that have the correct direction
        https://bugs.webkit.org/show_bug.cgi?id=156542

        Reviewed by Darin Adler.

        In the RenderMathMLUnderOver refactoring (r199293), we avoided doing a
        horizontal stretchTo call for non-stretchy operators. Here we do the
        same for RenderMathMLRow and avoid doing a vertical stretchTo call for
        horizontal or non-stretchy operators. We also add appropriate ASSERT in
        the RenderMathMLOperator::stretchTo functions. To avoid failing tests
        with DOM/style update, we make our updates a bit stricter. Hopefully,
        we could manage such things better in the future (bug 156536).

        Tests: mathml/presentation/row-nonstretchy-or-horizontal.html
               mathml/presentation/underover-nonstretchy-or-vertical.html

        * mathml/MathMLTextElement.cpp:
        (WebCore::MathMLTextElement::parseAttribute): Replace setOperatorFlagAndScheduleLayoutIfNeeded with a stronger rendering update.
        Also ensure that this is done when the lspace/rspace attributes change.
        This avoids breaking mathml/presentation/mo-lspace-rspace-dynamic.html
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::stretchTo): Add ASSERT to ensure that it is only called with stretchy operators that have the correct direction.
        (WebCore::RenderMathMLOperator::styleDidChange): Do a stronger rendering update when the style changes.
        This avoids breaking mathml/presentation/style-changed.html
        (WebCore::RenderMathMLOperator::setOperatorFlagAndScheduleLayoutIfNeeded): Deleted.
        * rendering/mathml/RenderMathMLOperator.h: Make updateFromElement public so that it can be called from MathMLTextElement::parseAttribute
        Remove setOperatorFlagAndScheduleLayoutIfNeeded and declare styleDidChange.
        * rendering/mathml/RenderMathMLRow.cpp:
        (WebCore::RenderMathMLRow::layoutRowItems): Only call stretchTo for vertical stretchy operators.

2016-04-14  Anders Carlsson  <andersca@apple.com>

        When FileInputType::setFiles is called with an empty file list, the last set icon is not cleared
        https://bugs.webkit.org/show_bug.cgi?id=156582

        Reviewed by Beth Dakin.

        * html/FileInputType.cpp:
        (WebCore::FileInputType::requestIcon):

2016-04-14  Darin Adler  <darin@apple.com>

        Remove UsePointersEvenForNonNullableObjectArguments from Internals
        https://bugs.webkit.org/show_bug.cgi?id=156539

        Reviewed by Alex Christensen.

        * html/HTMLImageElement.idl: Exported this so it can be used as the type for
        a function argument in Internals.idl.
        * html/HTMLInputElement.idl: Ditto.
        * html/HTMLLinkElement.idl: Ditto.
        * html/HTMLSelectElement.idl: Ditto.

        * testing/Internals.cpp:
        (WebCore::InspectorStubFrontend::InspectorStubFrontend): Take a Page&.
        (WebCore::Internals::create): Take a Document&.
        (WebCore::Internals::resetToConsistentState): Take a Page&.
        (WebCore::Internals::Internals): Take a Document&.
        (WebCore::Internals::settings): Use nullptr instead of 0.
        (WebCore::Internals::address): Take a Node&.
        (WebCore::Internals::nodeNeedsStyleRecalc): Take a Node& and no ExceptionCode&.
        (WebCore::Internals::styleChangeType): Ditto.
        (WebCore::Internals::xhrResponseSource): Take an XMLHttpRequest&.
        (WebCore::Internals::isSharingStyleSheetContents): Take two
        HTMLLinkElement&.
        (WebCore::Internals::isStyleSheetLoadingSubresources): Take an HTMLLinkElement&.
        (WebCore::Internals::imageFrameIndex): Take an HTMLImageElement& and no
        ExceptionCode&. Also return an unsigned rather than size_t, since the IDL expects
        unsigned long, which means unsigned in C++ code.
        (WebCore::Internals::treeScopeRootNode): Take a Node& and no ExceptionCode&.
        (WebCore::Internals::parentTreeScope): Ditto.
        (WebCore::Internals::pauseAnimationAtTimeOnElement): Take an Element&.
        (WebCore::Internals::pauseAnimationAtTimeOnPseudoElement): Ditto.
        (WebCore::Internals::pauseTransitionAtTimeOnElement): Ditto.
        (WebCore::Internals::pauseTransitionAtTimeOnPseudoElement): Ditto.
        (WebCore::Internals::attached): Deleted.
        (WebCore::Internals::elementRenderTreeAsText): Take an Element&.
        (WebCore::Internals::hasPausedImageAnimations): Take an Element& and no
        ExceptionCode&.
        (WebCore::Internals::computedStyleIncludingVisitedInfo): Take a Node& and no
        ExceptionCode&.
        (WebCore::Internals::ensureShadowRoot): Take an Element&.
        (WebCore::Internals::ensureUserAgentShadowRoot): Take an Element& and no
        ExceptionCode&.
        (WebCore::Internals::createShadowRoot): Take an Element&.
        (WebCore::Internals::shadowRoot): Take an Element& and no ExceptionCode&.
        (WebCore::Internals::shadowRootType): Take a Node&.
        (WebCore::Internals::includerFor): Deleted.
        (WebCore::Internals::shadowPseudoId): Take an Element& and no ExceptionCode&.
        (WebCore::Internals::setShadowPseudoId): Ditto.
        (WebCore::Internals::visiblePlaceholder): Take an Element&.
        (WebCore::Internals::selectColorInColorChooser): Take an HTMLInputElement&.
        (WebCore::Internals::boundingBox): Take an Element& and no ExceptionCode&.
        (WebCore::Internals::markerCountForNode): Take a Node&.
        (WebCore::Internals::markerAt): Ditto.
        (WebCore::Internals::markerRangeForNode): Ditto.
        (WebCore::Internals::markerDescriptionForNode): Ditto.
        (WebCore::Internals::addTextMatchMarker): Take a const Range&.
        (WebCore::Internals::setScrollViewPosition): Take int instead of long; long in
        IDL means int in C++ code.
        (WebCore::Internals::wasLastChangeUserEdit): Take an Element&.
        (WebCore::Internals::elementShouldAutoComplete): Take an HTMLInputElement&.
        (WebCore::Internals::setEditingValue): Take an HTMLInputElement& and no
        ExceptionCode&.
        (WebCore::Internals::setAutofilled): Ditto.
        (WebCore::Internals::setShowAutoFillButton): Ditto.
        (WebCore::Internals::scrollElementToRect): Take an Element& and int instead of long.
        (WebCore::Internals::autofillFieldName): Take an Element&.
        (WebCore::Internals::rangeFromLocationAndLength): Take an Element& and no ExceptionCode&.
        (WebCore::Internals::locationFromRange): Ditto.
        (WebCore::Internals::lengthFromRange): Take an Element& and const Range& and no
        ExceptionCode&.
        (WebCore::Internals::rangeAsText): Take const Range& an no ExceptionCode&.
        (WebCore::Internals::subrange): Take Range& an no ExceptionCode&.
        (WebCore::Internals::nodesFromRect): Take a Document&.
        (WebCore::Internals::openDummyInspectorFrontend): Ditto.
        (WebCore::Internals::layerTreeAsText): Take an Element&.
        (WebCore::Internals::setElementUsesDisplayListDrawing): Ditto.
        (WebCore::Internals::setElementTracksDisplayListReplay): Ditto.
        (WebCore::Internals::displayListForElement): Ditto.
        (WebCore::Internals::replayDisplayListForElement): Ditto.
        (WebCore::Internals::counterValue): Ditto.
        (WebCore::Internals::pageNumber): Ditto.
        (WebCore::Internals::webkitWillEnterFullScreenForElement): Ditto.
        (WebCore::Internals::webkitDidEnterFullScreenForElement): Ditto.
        (WebCore::Internals::webkitWillExitFullScreenForElement): Ditto.
        (WebCore::Internals::webkitDidExitFullScreenForElement): Ditto.
        (WebCore::Internals::layerFlushCount): Return unsigned instead of unsigned long.
        IDL unsigned long means unsigned in C++ code.
        (WebCore::Internals::styleRecalcCount): Ditto.
        (WebCore::Internals::compositingUpdateCount): Ditto.
        (WebCore::Internals::deserializeBuffer): Take an ArrayBuffer&.
        (WebCore::Internals::markerTextForListItem): Take an Element& and no ExceptionCode&.
        (WebCore::Internals::toolTipFromElement): Ditto.
        (WebCore::Internals::getImageSourceURL): Ditto.
        (WebCore::Internals::simulateAudioInterruption): Take an HTMLMediaElement&.
        (WebCore::Internals::mediaElementHasCharacteristic): Ditto.
        (WebCore::Internals::isSelectPopupVisible): Take an HTMLSelectElement&.
        (WebCore::Internals::closestTimeToTimeRanges): Take a TimeRange&.
        (WebCore::Internals::isPluginUnavailabilityIndicatorObscured): Take an Element&.
        (WebCore::Internals::isPluginSnapshotted): Take an Element& and no ExceptionCode&.
        (WebCore::Internals::bufferedSamplesForTrackID): Take a SourceBuffer&.
        (WebCore::Internals::setShouldGenerateTimestamps): Ditto.
        (WebCore::Internals::setMediaElementRestrictions): Take an HTMLMediaElement&.
        (WebCore::Internals::elementIsBlockingDisplaySleep): Take an HTMLMediaElement&.
        (WebCore::Internals::setAudioContextRestrictions): Take an AudioContext&.
        (WebCore::Internals::scrollSnapOffsets): Take an Element&.
        (WebCore::Internals::getCurrentMediaControlsStatusForElement): Take an HTMLMediaElement&.
        (WebCore::Internals::userVisibleString): Take a const DOMURL&.
        (WebCore::Internals::composedTreeAsText): Take a Node&.

        * testing/Internals.h: Update for all the changes listed above.

        * testing/Internals.idl: Removed UsePointersEvenForNonNullableObjectArguments. Removed
        many unneeded [RaisesException]. Used more specific types for many arguments. Removed
        unused, and unimplemented, attached and includedFor functions. Made the node argument to
        updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks nullable as well as optional.

        * testing/Internals.mm:
        (WebCore::Internals::userVisibleString): Take a const DOMURL&.

        * testing/js/WebCoreTestSupport.cpp:
        (WebCoreTestSupport::injectInternalsObject): Pass a Document& rather than a Document*.
        (WebCoreTestSupport::resetInternalsObject): Pass a Page& rather than a Page*.

2016-04-14  Daniel Bates  <dabates@apple.com>

        CSP: Ignore report-only policy delivered via meta element
        https://bugs.webkit.org/show_bug.cgi?id=156565
        <rdar://problem/25718167>

        Reviewed by Brent Fulgham.

        Only honor a report-only policy delivered via the HTTP header Content-Security-Policy-Report-Only
        or X-WebKit-CSP-Report-Only as per section Content-Security-Policy-Report-Only Header Field of 
        the Content Security Policy Level 2 spec., <https://w3c.github.io/webappsec-csp/2/> (Editor's Draft, 29 August 2015).

        Currently we honor a report-only policy delivered via a meta element or an HTTP header. Instead
        we should only honor such a policy when delivered via an HTTP header.

        Tests: http/tests/security/contentSecurityPolicy/1.1/reportonly-in-meta-ignored2.html
               http/tests/security/contentSecurityPolicy/eval-allowed-in-report-only-mode-and-sends-report.php
               http/tests/security/contentSecurityPolicy/eval-allowed-in-report-only-mode.php
               http/tests/security/contentSecurityPolicy/report-multiple-violations-01.php
               http/tests/security/contentSecurityPolicy/report-multiple-violations-02.php
               http/tests/security/contentSecurityPolicy/report-only-report-uri-missing.php

        * dom/Document.cpp:
        (WebCore::Document::processHttpEquiv): Do not process policy for HTTP equivalent header
        Content-Security-Policy-Report-Only and X-WebKit-CSP-Report-Only.

2016-04-14  Antoine Quint  <graouts@apple.com>

        Dashboard is spelled as Dashbard in several source files
        https://bugs.webkit.org/show_bug.cgi?id=156577

        Reviewed by Eric Carlson.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::getContext):
        * html/canvas/CanvasGradient.cpp:
        (WebCore::CanvasGradient::CanvasGradient):
        (WebCore::CanvasGradient::addColorStop):
        * html/canvas/CanvasGradient.h:
        (WebCore::CanvasGradient::setDashboardCompatibilityMode):

2016-04-14  Antoine Quint  <graouts@apple.com>

        WebGL based canvases composite incorrectly after changing size
        https://bugs.webkit.org/show_bug.cgi?id=152556
        <rdar://problem/24012678>

        Reviewed by Dean Jackson.

        On iOS, we use the CAEAGLLayer's bounds to set the size of the backing store.
        However, that layer's bounds is also used to size the layer during layout. If
        the canvas backing store is resized after layout has been performed, the call
        to setBounds loses the layout value and the <canvas> element is incorrectly
        sized on screen.

        To address this, when updating the backing store, we keep track of the previous
        layer bounds so we can reset it after we sized the backing store.

        Test: webgl/webgl-backing-store-size-update.html

        * platform/graphics/GraphicsContext3D.h:
        * platform/graphics/mac/GraphicsContext3DMac.mm:
        (WebCore::GraphicsContext3D::setRenderbufferStorageFromDrawable):

2016-04-13  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GObject DOM bindings API break after r199392.

        Since r199392 webkit_dom_attr_set_value() no longer raises exceptions, but we need to keep the GError parameter
        to keep backwards compatibility.

        * bindings/scripts/CodeGeneratorGObject.pm:
        (FunctionUsedToRaiseException):

2016-04-13  Daniel Bates  <dabates@apple.com>

        CSP: Nested browsing context created for <object> or <embed> should respect object-src directive
        https://bugs.webkit.org/show_bug.cgi?id=156563
        <rdar://problem/25715713>

        Reviewed by Darin Adler.

        As per section object-src of the Content Security Policy Level 2 spec.,
        <https://w3c.github.io/webappsec-csp/2/> (Editor's Draft, 29 August 2015), a nested browsing
        context created for an HTML object or HTML embed element should respect the object-src directive.

        Currently a nested browsing context created for an HTML object or HTML embed element respects
        the child-src directive or frame-src directive (in that order). Instead such nested browsing
        contexts should respect the object-src directive.

        Tests: http/tests/security/contentSecurityPolicy/object-src-allows-embed-blocked-by-child-src.html
               http/tests/security/contentSecurityPolicy/object-src-allows-embed-blocked-by-frame-src.html
               http/tests/security/contentSecurityPolicy/object-src-allows-object-blocked-by-child-src.html
               http/tests/security/contentSecurityPolicy/object-src-allows-object-blocked-by-frame-src.html
               http/tests/security/contentSecurityPolicy/object-src-blocks-embed-allowed-by-child-src.html
               http/tests/security/contentSecurityPolicy/object-src-blocks-embed-allowed-by-frame-src.html
               http/tests/security/contentSecurityPolicy/object-src-blocks-object-allowed-by-child-src.html
               http/tests/security/contentSecurityPolicy/object-src-blocks-object-allowed-by-frame-src.html

        * loader/PolicyChecker.cpp:
        (WebCore::isAllowedByContentSecurityPolicy): Added. Checks whether the specified URL is allowed by the
        object-src or the child-src/frame-src directive for a plugin element and non-plugin element, respectively.
        (WebCore::PolicyChecker::checkNavigationPolicy): Modified to call isAllowedByContentSecurityPolicy().

2016-04-13  Daniel Bates  <dabates@apple.com>

        CSP: Remove experimental directive reflected-xss
        https://bugs.webkit.org/show_bug.cgi?id=156554

        Reviewed by Brent Fulgham.

        The Content Security Policy directive reflected-xss was removed from the Content Security
        Policy Level 2 spec., <https://w3c.github.io/webappsec-csp/2/> (Editor's Draft, 29 August 2015).
        This directive was considered experimental and was guarded by a run-time flag that was never
        enabled by default. We should remove support for this directive.

        * html/parser/XSSAuditor.cpp:
        (WebCore::XSSAuditor::XSSAuditor): Initialize m_xssProtection to XSSProtectionDisposition::Enabled.
        (WebCore::XSSAuditor::init): Write logic in terms of enum class XSSProtectionDisposition.
        (WebCore::XSSAuditor::filterToken): Ditto.
        (WebCore::combineXSSProtectionHeaderAndCSP): Deleted.
        * html/parser/XSSAuditor.h: Change data type of m_xssProtection from ContentSecurityPolicy::ReflectedXSSDisposition
        to XSSProtectionDisposition.
        * html/parser/XSSAuditorDelegate.cpp: Ditto.
        (WebCore::buildConsoleError): Remove logic to emit a remarks in the console error when a XSS is
        blocked because of the directive reflected-xss. Also substituted "because" for "as" in the remark
        added to the error message when the XSS Auditor is enabled because the server did not send HTTP
        header X-XSS-Protection.
        * html/parser/XSSAuditorDelegate.h:
        (WebCore::XSSInfo::XSSInfo): Removed argument didSendCSPHeader as we are removing support for the
        directive reflected-xss.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reflectedXSSDisposition): Deleted.
        (WebCore::ContentSecurityPolicy::reportInvalidReflectedXSS): Deleted.
        * page/csp/ContentSecurityPolicy.h:
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::ContentSecurityPolicyDirectiveList): Remove initialization
        of m_reflectedXSSDisposition as we are removing support for the directive reflected-xss.
        (WebCore::ContentSecurityPolicyDirectiveList::parseReflectedXSS): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Remove logic to parse directive reflected-xss.
        * page/csp/ContentSecurityPolicyDirectiveList.h:
        (WebCore::ContentSecurityPolicyDirectiveList::reflectedXSSDisposition): Deleted.
        * page/csp/ContentSecurityPolicyDirectiveNames.cpp:
        * page/csp/ContentSecurityPolicyDirectiveNames.h:
        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::isCSPDirectiveName):
        (WebCore::isExperimentalDirectiveName): Deleted.
        * platform/network/HTTPParsers.cpp:
        (WebCore::parseXSSProtectionHeader): Write it terms of enum class XSSProtectionDisposition.
        * platform/network/HTTPParsers.h: Define enum class XSSProtectionDisposition. Change return type
        of parseXSSProtectionHeader() from ContentSecurityPolicy::ReflectedXSSDisposition to XSSProtectionDisposition
        as we are removing the former.

2016-04-13  Brady Eidson  <beidson@apple.com>

        Modern IDB (Blob support): Support retrieving Blobs from IDB.
        https://bugs.webkit.org/show_bug.cgi?id=156367

        Reviewed by Alex Christensen.

        No new tests (No testable change in behavior yet, current tests pass).

        This patch does the following:
        - Pulls BlobURLs and stored filenames out of IDB whenever an IDB record is fetched.
        - Adds those URLs and filenames to IDBValue.
        - Uses IDBValue in more places instead of SharedBuffer/ThreadSafeBuffer.
        - Teaches SerializedScriptValue, Blob, and File how to read the URLs and filenames when they exist.
        - Teaches the Blob registry to register a new type of Blob that is not a "File" but is backed by one.

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::setGetResult):
        
        * Modules/indexeddb/IDBGetResult.h:
        (WebCore::IDBGetResult::IDBGetResult):
        
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::setResultToStructuredClone):
        * Modules/indexeddb/IDBRequest.h:
        
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::didGetRecordOnServer):
        
        * Modules/indexeddb/IDBValue.cpp:
        (WebCore::IDBValue::IDBValue):
        * Modules/indexeddb/IDBValue.h:
        
        * Modules/indexeddb/server/MemoryIndexCursor.cpp:
        (WebCore::IDBServer::MemoryIndexCursor::currentData):
        
        * Modules/indexeddb/server/MemoryObjectStoreCursor.cpp:
        (WebCore::IDBServer::MemoryObjectStoreCursor::currentData):
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getBlobRecordsForObjectStoreRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getIndexRecord):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
        
        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::currentData):
        (WebCore::IDBServer::SQLiteIDBCursor::internalAdvanceOnce):
        * Modules/indexeddb/server/SQLiteIDBCursor.h:
        (WebCore::IDBServer::SQLiteIDBCursor::currentValue):
        (WebCore::IDBServer::SQLiteIDBCursor::currentValueBuffer): Deleted.
        
        * Modules/indexeddb/server/SQLiteIDBTransaction.h:
        (WebCore::IDBServer::SQLiteIDBTransaction::backingStore):
        
        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
        
        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::deserializeIDBValueDataToJSValue):
        (WebCore::deserializeIDBValueData):
        (WebCore::deserializeIDBValue):
        * bindings/js/IDBBindingUtilities.h:
        
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneDeserializer::deserialize):
        (WebCore::CloneDeserializer::CloneDeserializer):
        (WebCore::CloneDeserializer::readFile):
        (WebCore::CloneDeserializer::readTerminal):
        (WebCore::CloneDeserializer::blobFilePathForBlobURL):
        (WebCore::SerializedScriptValue::deserialize):
        * bindings/js/SerializedScriptValue.h:

        * fileapi/Blob.cpp:
        (WebCore::Blob::Blob):
        * fileapi/Blob.h:
        (WebCore::Blob::deserialize):

        * fileapi/File.cpp:
        (WebCore::File::File):

        * fileapi/ThreadableBlobRegistry.cpp:
        (WebCore::threadableQueue):
        (WebCore::ThreadableBlobRegistry::registerBlobURLOptionallyFileBacked):
        * fileapi/ThreadableBlobRegistry.h:

        * platform/CrossThreadTask.h:
        (WebCore::createCrossThreadTask):

        * platform/network/BlobRegistry.h:

        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::registerBlobURL):
        (WebCore::BlobRegistryImpl::registerBlobURLOptionallyFileBacked):
        * platform/network/BlobRegistryImpl.h:

2016-04-13  Zalan Bujtas  <zalan@apple.com>

        Text on compositing layer with negative letter-spacing is truncated.
        https://bugs.webkit.org/show_bug.cgi?id=156550
        <rdar://problem/24212140>

        Reviewed by Antti Koivisto.

        Negative letter-spacing affects the right edge of content's visual overflow (for both RTL and LTR).
        This is similar to how normal line layout adjusts it at InlineFlowBox::addTextBoxVisualOverflow().

        Test: fast/text/negative-letter-spacing-visual-overflow.html

        * rendering/SimpleLineLayoutFunctions.cpp:
        (WebCore::SimpleLineLayout::computeOverflow):
        (WebCore::SimpleLineLayout::paintFlow):
        (WebCore::SimpleLineLayout::collectFlowOverflow):

2016-04-13  Eric Carlson  <eric.carlson@apple.com>

        [iOS] remote command should be considered user events
        https://bugs.webkit.org/show_bug.cgi?id=156546
        <rdar://problem/25560877>

        Reviewed by Jer Noble.

        Test: media/remote-control-command-is-user-gesture.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::didReceiveRemoteControlCommand): Increment/decrement 
          m_processingRemoteControlCommand around calling remote command method.
        (WebCore::HTMLMediaElement::processingUserGesture): Return true if called while handling
          a remote control command.
        * html/HTMLMediaElement.h:

2016-04-13  Antonio Gomes  <tonikitoo@webkit.org>

        Non-resizable text field looks resizable
        https://bugs.webkit.org/show_bug.cgi?id=152271

        Reviewed by Darin Adler.

        The 'resizability' of an HTML element is controlled by its 'resize' CSS property value.
        By default it is 'none', but certain HTML elements, including <textarea>, have it
        set to 'both' by default (defined in html.css). These values mean no resize at all, and
        resizable in both vertical and horizontal axis, respectively.
        Additionally, 'vertical' and 'horizontal' values are also valid.

        Problem here is that the way WebKit handles the 'resize' property on single line
        input elements (e.g. <input>) is different than other engines (read Gecko, Blink and Presto):

        - Match: WebKit, Firefox, Presto and Blink all force single line input elements to be non-resizable,
        regardless of either the 'resize' properly is set or not.

        - Mismatch: WebKit is the only engine that actually paints the resize control on single line
        input elements, even it having no effect.

        On WebKit, this happens because the 'resize' property is wrongly implemented as 'inheritable',
        differently from other engines. In the way WebKit contructs its RenderTree, 'resize' property
        ends up spilling out of <input> and entering its shadow representation, carrying the 'resize'
        property on.

        Patch fixes this by making the 'resize' properly be non-inherited, matching other vendors
        and the spec [1].

        [1] https://drafts.csswg.org/css-ui/#resize

        Tests: fast/css/resize-not-inherited.html
               fast/css/resize-single-line-input-no-paint.html

        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareInheritedData.cpp:
        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
        (WebCore::StyleRareInheritedData::operator==):
        * rendering/style/StyleRareInheritedData.h:
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:

2016-04-13  Darin Adler  <darin@apple.com>

        Remove UsePointersEvenForNonNullableObjectArguments from DataTransfer
        https://bugs.webkit.org/show_bug.cgi?id=156495

        Reviewed by Chris Dumez.

        * dom/DataTransfer.idl: Removed UsePointersEvenForNonNullableObjectArguments
        and marked the element argument to setDragImage as nullable.

2016-04-13  Brady Eidson  <beidson@apple.com>

        Modern IDB (Blob support): Support deleting stored blob files.
        https://bugs.webkit.org/show_bug.cgi?id=156523

        Reviewed by Alex Christensen.

        No new tests (No testable change in behavior yet, current tests pass).

        There's 3 points in time when we need to delete blob files (and records of them):
        1 - When deleting a specific object store record.
        2 - When deleting an entire object store.
        3 - When deleting a whole database.
        
        This patch does those three things.

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteUnusedBlobFileRecords):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteBackingStore):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

        * Modules/indexeddb/server/SQLiteIDBTransaction.cpp:
        (WebCore::IDBServer::SQLiteIDBTransaction::commit):
        (WebCore::IDBServer::SQLiteIDBTransaction::deleteBlobFilesIfNecessary):
        (WebCore::IDBServer::SQLiteIDBTransaction::addRemovedBlobFile):
        * Modules/indexeddb/server/SQLiteIDBTransaction.h:

2016-04-13  Frederic Wang  <fwang@igalia.com>

        Fix two coding mistakes in MathMLInlineContainerElement::childrenChanged
        https://bugs.webkit.org/show_bug.cgi?id=156538

        Reviewed by Darin Adler.

        We fix the call to updateOperatorProperties inside MathMLInlineContainerElement::childrenChanged
        for the <math> and <msqrt> tags.

        The <math> tag is already a RenderMathMLRow so the hasTagName(mathTag)
        conditional is never executed. The tag does not create any anonymous
        wrapper so we do not need a special case for it anyway.

        The <msqrt> tag is not a RenderMathMLRow (yet). However, the anonymous
        wrapper behaving as a RenderMathMLRow is actually the last child, not
        the first one.

        No new tests, this is already covered by mathml/presentation/mo-form-dynamic.html
        Note that for some reason the coding error for <msqrt> only shows up
        after the refactoring of bug 152244.

        * mathml/MathMLInlineContainerElement.cpp:
        (WebCore::MathMLInlineContainerElement::childrenChanged): Fix the two mistakes and add some FIXME comments.

2016-04-12  Chris Dumez  <cdumez@apple.com>

        Attr.value should not be nullable
        https://bugs.webkit.org/show_bug.cgi?id=156515

        Reviewed by Benjamin Poulain.

        Update Attr.value so that it is no longer nullable, as per:
        https://dom.spec.whatwg.org/#interface-attr

        This aligns our behavior with Firefox and Chrome as well.

        Test: fast/dom/Attr/value-not-nullable.html

        * dom/Attr.cpp:
        (WebCore::Attr::setValueForBindings):
        (WebCore::Attr::setNodeValue):
        (WebCore::Attr::setValue):
        * dom/Attr.h:
        * dom/Attr.idl:

2016-04-12  Konstantin Tokarev  <annulen@yandex.ru>

        Fixed uninitialization of Node::DataUnion with GCC 4.8.
        https://bugs.webkit.org/show_bug.cgi?id=156507

        Reviewed by Michael Catanzaro.

        This change fixes run time crashes caused by access to uninitialized
        memory in Node::renderer().

        No new tests needed.

        * dom/Node.h:

2016-04-12  Eric Carlson  <eric.carlson@apple.com>

        [iOS] do not exit AirPlay when the screen locks
        https://bugs.webkit.org/show_bug.cgi?id=156502
        <rdar://problem/24616592>

        Reviewed by Jer Noble.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::shouldOverrideBackgroundPlaybackRestriction): Add logging.
        (WebCore::HTMLMediaElement::purgeBufferedDataIfPossible): Don't tell the media engine to purge 
          data if it is playing to a wireless target because that will drop the connection.

        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::playbackPermitted): Add logging.
        (WebCore::MediaElementSession::canPlayToWirelessPlaybackTarget): Drive by fix: iOS doesn't 
          have an explicit playbackTarget, don't test for it.
        (WebCore::MediaElementSession::isPlayingToWirelessPlaybackTarget): Ditto.

2016-04-12  Gavin Barraclough  <barraclough@apple.com>

        WebKit should adopt journal_mode=wal for all SQLite databases.
        https://bugs.webkit.org/show_bug.cgi?id=133496

        Rubber stamped by Chris Dumez.

        Temporarily disable on iOS - this broke a test.
        (storage/websql/alter-to-info-table.html)

        * platform/sql/SQLiteDatabase.cpp:
        (WebCore::SQLiteDatabase::open):

2016-04-12  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Keyboard shortcut for "Inspect Element" only works when Web Inspector is open.
        https://bugs.webkit.org/show_bug.cgi?id=111193
        <rdar://problem/13325889>

        Reviewed by Timothy Hatcher.

        * inspector/InspectorClient.h:
        (WebCore::InspectorClient::elementSelectionChanged):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::setSearchingForNode):
        Inform the client when element selection changes.

2016-04-12  Chris Dumez  <cdumez@apple.com>

        Regression(r199360): assertion hit in Element::fastGetAttribute()
        https://bugs.webkit.org/show_bug.cgi?id=156509

        Reviewed by Ryosuke Niwa.

        Stop using fastGetAttribute() / setAttributeWithoutSynchronization()
        given that DOMTokenList is used for the class attribute and we need
        to synchronize in this case.

        No new tests, already covered by existing tests.

        * html/DOMTokenList.cpp:
        (WebCore::DOMTokenList::updateAssociatedAttributeFromTokens):
        (WebCore::DOMTokenList::tokens):

2016-04-12  Myles C. Maxfield  <mmaxfield@apple.com>

        [RTL Scrollbars] Overlay scrollbars push contents inwards
        https://bugs.webkit.org/show_bug.cgi?id=156225
        <rdar://problem/25137040>

        Reviewed by Darin Adler.

        The contents should be pushed in by the occupied width of the
        scrollbar, which is 0 for overlay scrollbars.

        Test: fast/scrolling/rtl-scrollbars-overlay-no-push-contents.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::computeScrollDimensions):

2016-04-12  Myles C. Maxfield  <mmaxfield@apple.com>

        [OS X] Flakey crash after ScrollAnimatorMac destruction
        https://bugs.webkit.org/show_bug.cgi?id=156372

        Reviewed by Darin Adler.

        Previously, we were disabling the mock scrollbars using JavaScript after
        the WebView was created. However, enabling these mock scrollbars can be
        triggered with a bit of state inside the WebPreferences object, which
        means WebKit clients can change it at any point. DumpRenderTree is doing
        this during the document's lifetime.

        This means that the creation of the Scrollbar objects saw a non-mock
        ScrollbarTheme, but the destruction of the Scrollbar objects saw a mock
        ScrollbarTheme. Therefore, the non-mock ScrollbarTheme doesn't get
        cleaned up correctly (ScrollAnimatorMac::willRemoveVerticalScrollbar()
        returns early because it sees that there is nothing to deregister
        due to the ScrollbarTheme being mocked).

        This cleanup is necessary because it sets the NSScrollerImp's delegate
        to nil before the NSScrollerImpDelegate gets destroyed. Because the
        cleanup wasn't happening, the delegate pointer wasn't getting set to
        nil, so the pointer was dangling, and AppKit was following it and
        crashing.

        Because the clients of this bit of state can change it at any time,
        it is incorrect to change it in JavaScript. Instead, the client must
        manage this bit of state (so the client and the web process are always
        in sync). Therefore, the correct way to set this bit of state must be
        done in the test runner rather than Javascript internals. The mechanism
        we have to do that is the <!-- webkit-test-runner --> comment at the
        beginning of the test. This patch migrates to this mechanism and removes
        the old internals method.

        Test: fast/scrolling/rtl-scrollbars-animation-property.html

        * page/Settings.cpp:
        * testing/Internals.cpp:
        (WebCore::Internals::setMockScrollbarsEnabled): Deleted.
        * testing/Internals.h:
        * testing/Internals.idl:

2016-04-12  Darin Adler  <darin@apple.com>

        Remove UsePointersEvenForNonNullableObjectArguments from SVG lists
        https://bugs.webkit.org/show_bug.cgi?id=156494

        Reviewed by Chris Dumez.

        * bindings/scripts/CodeGenerator.pm:
        (ShouldPassWrapperByReference): For now, don't do this for any tear-off classes.
        This includes the items stored in most SVG list classes.

        * svg/SVGLengthList.idl: Removed UsePointersEvenForNonNullableObjectArguments.
        * svg/SVGNumberList.idl: Ditto.
        * svg/SVGPointList.idl: Ditto.
        * svg/SVGTransformList.idl: Ditto.

        * svg/SVGPathSegList.idl: Removed UsePointersEvenForNonNullableObjectArguments.
        Marked the arguments nullable, and added FIXMEs about returning later since they
        don't really need to be nullable. But fixing this requires some reworking of the
        SVG list template and it's not urgent at this time. Preserves behavior where we
        get an exception when passing null, it's just an SVG exception instead of TypeError.

2016-04-12  Chris Dumez  <cdumez@apple.com>

        Lazily update tokens in DOMTokenList when the associated attribute value changes
        https://bugs.webkit.org/show_bug.cgi?id=156474

        Reviewed by Ryosuke Niwa.

        Lazily update tokens in DOMTokenList when the associated attribute value
        changes for performance. Constructing the sanitized vector of tokens
        every time the associated Element attribute changes is too expensive.
        Instead, we mark the vector as dirty whenever the attribute changes, and
        we only construct the sanitized vector when it is actually required.

        Also do some renaming for clarity.

        There is no web-exposed behavior change.

        * dom/Element.cpp:
        (WebCore::Element::classAttributeChanged):
        * html/DOMTokenList.cpp:
        (WebCore::DOMTokenList::contains):
        (WebCore::DOMTokenList::addInternal):
        (WebCore::DOMTokenList::removeInternal):
        (WebCore::DOMTokenList::toggle):
        (WebCore::DOMTokenList::value):
        (WebCore::DOMTokenList::setValue):
        (WebCore::DOMTokenList::updateTokensFromAttributeValue):
        (WebCore::DOMTokenList::associatedAttributeValueChanged):
        (WebCore::DOMTokenList::updateAssociatedAttributeFromTokens):
        (WebCore::DOMTokenList::tokens):
        (WebCore::DOMTokenList::DOMTokenList): Deleted.
        * html/DOMTokenList.h:
        (WebCore::DOMTokenList::tokens):
        (WebCore::DOMTokenList::length):
        (WebCore::DOMTokenList::item):
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::parseAttribute):
        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::parseAttribute):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::parseAttribute):
        * html/HTMLOutputElement.cpp:
        (WebCore::HTMLOutputElement::parseAttribute):

2016-04-12  Darin Adler  <darin@apple.com>

        Remove UsePointersEvenForNonNullableObjectArguments from HTMLMediaElement
        https://bugs.webkit.org/show_bug.cgi?id=156492

        Reviewed by Chris Dumez.

        * html/HTMLMediaElement.idl: Removed UsePointersEvenForNonNullableObjectArguments,
        sorted remaining class attributes, simplified #if around canPlayType a bit,
        removed comment that is not all that useful, made the argument to
        webkitSetMediaKeys nullable since the implementation supports that.

2016-04-12  Eric Carlson  <eric.carlson@apple.com>

        [iOS] media title sometimes remain in Control Center after tab is closed
        https://bugs.webkit.org/show_bug.cgi?id=156243
        <rdar://problem/20167445>

        Reviewed by Darin Adler.

        * Modules/webaudio/AudioContext.h: Implement characteristics.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaLoadingFailed): Call mediaSession->clientCharacteristicsChanged.
        (WebCore::HTMLMediaElement::setReadyState): Ditto.
        (WebCore::HTMLMediaElement::clearMediaPlayer): Ditto.
        (WebCore::HTMLMediaElement::stop): Call mediaSession->stopSession.
        (WebCore::HTMLMediaElement::characteristics): New, return current characteristics.
        * html/HTMLMediaElement.h:

        * platform/audio/PlatformMediaSession.cpp:
        (WebCore::PlatformMediaSession::stopSession): Suspend playback, and remove the session 
          from the manager, it will never play again.
        (WebCore::PlatformMediaSession::characteristics): Return client characteristics.
        (WebCore::PlatformMediaSession::clientCharacteristicsChanged):
        * platform/audio/PlatformMediaSession.h:

        * platform/audio/PlatformMediaSessionManager.cpp:
        (WebCore::PlatformMediaSessionManager::stopAllMediaPlaybackForProcess): Call stopSession 
          instead of pauseSession to signal that playback will never start again.
        * platform/audio/PlatformMediaSessionManager.h:

        * platform/audio/ios/MediaSessionManagerIOS.h:
        * platform/audio/ios/MediaSessionManagerIOS.mm:
        (WebCore::MediaSessionManageriOS::sessionWillBeginPlayback): Add logging.
        (WebCore::MediaSessionManageriOS::removeSession): Update NowPlaying.
        (WebCore::MediaSessionManageriOS::sessionWillEndPlayback): Add logging.
        (WebCore::MediaSessionManageriOS::clientCharacteristicsChanged): Update NowPlaying.
        (WebCore::MediaSessionManageriOS::nowPlayingEligibleSession): New, return the first session
          that is an audio or video element with playable audio. WebAudio is not currently controllable
          so it isn't appropriate to show it in the NowPlaying info center.
        (WebCore::MediaSessionManageriOS::updateNowPlayingInfo): Remember the last state passed to
          NowPlaying so we can call it only when something has changed.

2016-04-12  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Rework scrollbars theming code for GTK+ 3.20
        https://bugs.webkit.org/show_bug.cgi?id=156462

        Reviewed by Michael Catanzaro.

        In r199292, we reworked the theming code to ensure it works with the new GTK+ CSS theming system. The same is
        needed for scrollbars, this patch uses the RenderThemeGadget classes introduced in r199292 to render the native
        scrollbars. The code is now split in 3 parts: stub methods for GTK+2 (since this file is compiled for
        WebCoreGTK, but not used), the implementation for GTK+ < 3.20 and the implementation for GTK+ >= 3.20. This
        reduces the amount of ifdefed code, and ensures that changes in new code don't break the rendering with older
        versions of GTK+. I noticed that we were overriding both, the specific paint methods to render scrollbars
        parts and the global paint method that renders all the scrollbar parts. We don't really need the specific paint
        methods, so I've removed the implemention leaving only the paint method. This also allows us to get rid of the
        GtkStyleContext cache.

        * platform/gtk/RenderThemeGadget.cpp:
        (WebCore::RenderThemeGadget::create): Handle scrollbars gadgets.
        (WebCore::appendElementToPath): In case of scrollbar gadget, use the scrollbar GType when creating the path to
        be able to get non-CSS style properties.
        (WebCore::RenderThemeGadget::opacity): Add method to get the opacity CSS style property.
        (WebCore::RenderThemeScrollbarGadget::RenderThemeScrollbarGadget): Initialize m_steppers option set with the
        steppers used by the theme.
        * platform/gtk/RenderThemeGadget.h:
        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::themeChangedCallback):
        (WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk):
        (WebCore::createStyleContext):
        (WebCore::createChildStyleContext):
        (WebCore::ScrollbarThemeGtk::themeChanged):
        (WebCore::ScrollbarThemeGtk::updateThemeProperties):
        (WebCore::scrollbarPartStateFlags):
        (WebCore::scrollbarGadgetForLayout):
        (WebCore::contentsGadgetForLayout):
        (WebCore::ScrollbarThemeGtk::trackRect):
        (WebCore::ScrollbarThemeGtk::hasThumb):
        (WebCore::ScrollbarThemeGtk::backButtonRect):
        (WebCore::ScrollbarThemeGtk::forwardButtonRect):
        (WebCore::ScrollbarThemeGtk::paint):
        (WebCore::paintStepper):
        (WebCore::adjustRectAccordingToMargin):
        (WebCore::ScrollbarThemeGtk::scrollbarThickness):
        (WebCore::ScrollbarThemeGtk::minimumThumbLength):
        * platform/gtk/ScrollbarThemeGtk.h:

2016-03-17  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Add parsing support for <auto-repeat> syntax
        https://bugs.webkit.org/show_bug.cgi?id=155583

        Reviewed by Antti Koivisto.

        The repeat() notation allows now to specify auto-fill or auto-fit instead of
        a fixed number of repetitions meaning that it will be automatically computed
        depending on the available space.

        This patch just adds the parsing support, the expansion of the repeat notation
        will be implemented in a follow up patch because it cannot be done at
        parsing level (since it requires knowledge about the available space).

        Test: fast/css-grid-layout/grid-element-auto-repeat-get-set.html

        * CMakeLists.txt:
        * css/CSSGridAutoRepeatValue.cpp: Added.
        (WebCore::CSSGridAutoRepeatValue::customCSSText):
        * css/CSSGridAutoRepeatValue.h: Added.
        (WebCore::CSSGridAutoRepeatValue::create):
        (WebCore::CSSGridAutoRepeatValue::autoRepeatID):
        (WebCore::CSSGridAutoRepeatValue::CSSGridAutoRepeatValue):
        * css/CSSParser.cpp:
        (WebCore::allTracksAreFixedSized):
        (WebCore::CSSParser::parseGridTrackList):
        (WebCore::CSSParser::parseGridTrackRepeatFunction):
        (WebCore::CSSParser::parseGridTrackSize):
        (WebCore::CSSParser::parseGridBreadth):
        * css/CSSParser.h:
        * css/CSSValue.cpp:
        (WebCore::CSSValue::equals):
        (WebCore::CSSValue::cssText):
        (WebCore::CSSValue::destroy):
        * css/CSSValue.h:
        (WebCore::CSSValue::isGridAutoRepeatValue):
        * css/CSSValueKeywords.in:

2016-04-12  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] addStaticGlobals should emit SymbolTableEntry watchpoints to encourage constant folding in DFG
        https://bugs.webkit.org/show_bug.cgi?id=155110

        Reviewed by Saam Barati.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::updateDocument):

2016-04-12  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Pass GridSizingData instead of columnTracks to track sizing methods
        https://bugs.webkit.org/show_bug.cgi?id=156466

        Reviewed by Darin Adler.

        Several methods used to compute the items' size contribution to the tracks they span in, get
        as an argument a vector with the sizes of the column tracks.

        In order to support grids with orthogonal flows (among other things) it's much better to
        pass the GridSizingData struct and let those methods decide whether to use the columns or
        the rows.

        No new tests as this is just a minor refactoring with no change in behavior.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
        (WebCore::RenderGrid::logicalContentHeightForChild):
        (WebCore::RenderGrid::minSizeForChild):
        (WebCore::RenderGrid::minContentForChild):
        (WebCore::RenderGrid::maxContentForChild):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctions):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
        (WebCore::RenderGrid::currentItemSizeForTrackSizeComputationPhase):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForItems):
        * rendering/RenderGrid.h:

2016-04-11  Darin Adler  <darin@apple.com>

        Remove UsePointersEvenForNonNullableObjectArguments from HTMLOptionsCollection
        https://bugs.webkit.org/show_bug.cgi?id=156491

        Reviewed by Chris Dumez.

        * html/HTMLOptionsCollection.cpp:
        (WebCore::HTMLOptionsCollection::add): Take a reference instead of a pointer.
        * html/HTMLOptionsCollection.h: Removed unneeded forward declaration. Changed
        add to take a reference instead of a pointer for the element to add. Used
        final instead of override on virtual functions.
        * html/HTMLOptionsCollection.idl: Removed now-unneeded attribute
        UsePointersEvenForNonNullableObjectArguments; the only function affected was
        add, and the overloading code was already checking for null.

2016-04-11  Darin Adler  <darin@apple.com>

        Remove UsePointersEvenForNonNullableObjectArguments from HTMLSelectElement
        https://bugs.webkit.org/show_bug.cgi?id=156458

        Reviewed by Chris Dumez.

        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
        (WebCore::JSHTMLOptionsCollection::remove): Updated to call remove with a reference
        rather than a pointer.

        * bindings/js/JSHTMLSelectElementCustom.cpp:
        (WebCore::JSHTMLSelectElement::remove): Updated to call remove with a reference
        rather than a pointer.
        (WebCore::selectIndexSetter): Updated to call setOption with a reference rather
        than a pointer.

        * bindings/scripts/CodeGeneratorGObject.pm:
        (GenerateFunction): Added basic support for passing wrappers by reference.
        GObject bindings already check arguments for null, so didn't add any new checks.

        * bindings/scripts/test/GObject/WebKitDOMTestActiveDOMObject.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestCallbackFunction.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        Updated.

        * editing/FrameSelection.cpp: Updated includes.

        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::setSelected): Pass reference when calling
        HTMLSelectElement::optionSelectionStateChanged.
        (WebCore::HTMLOptionElement::insertedInto): Ditto.

        * html/HTMLOptionsCollection.cpp:
        (WebCore::HTMLOptionsCollection::add): Moved null checking behavior here.
        Preserves existing "silently do nothing if null".
        (WebCore::HTMLOptionsCollection::remove): Changed function to take a reference
        instead of a pointer.

        * html/HTMLOptionsCollection.h: Updated include. Changed remove to take a
        reference instead of a pointer.

        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::add): Changed to take a reference instead of
        a pointer. Also removed unneeded protect code, since insertBefore already
        protects itself, and unneeded call to updateValidity, since the
        HTMLSelectElement::childrenChanged function already calls updateValidity.
        (WebCore::HTMLSelectElement::remove): Changed to take a reference instead
        of a pointer.
        (WebCore::HTMLSelectElement::setOption): Changed to take a reference
        instead of a pointer.
        (WebCore::HTMLSelectElement::setLength): Renamed "newLen" to "newLength".
        Use Ref instead of RefPtr for result of createElement, which makes the
        argument passed to add be a reference rather than a pointer.
        (WebCore::HTMLSelectElement::willRespondToMouseClickEvents): Put the #if
        for this here instead of in the header.
        (WebCore::HTMLSelectElement::optionSelectionStateChanged): Changed to take
        a reference instead of a pointer for the option element.

        * html/HTMLSelectElement.h: Removed unneeded includes. Derive privately
        from TypeAheadDataSource instead of publicly. Make all overrides final
        except for the one that is actually overridden by a derived class.
        Changed the arguments of the add, remove, setOption, and
        optionSelectionStateChanged functions to be references instead of pointers.
        Tweaked formatting a bit and used nullptr instead of 0. Override
        willRespondToMouseClickEvents on all platforms, not just iOS.

        * html/HTMLSelectElement.idl: Removed UsePointersEvenForNonNullableObjectArguments.
        Removed a comment that is no longer needed. Made some types nullable to match
        the specification, in places that currently have no effect on code generation.
        Added a FIXME comment about the argument to setCustomValidity incorrectly being
        marked as nullable.

2016-04-11  Brent Fulgham  <bfulgham@apple.com>

        Use WeakPtrs to avoid using deallocated Widgets and ScrollableAreas
        https://bugs.webkit.org/show_bug.cgi?id=156420
        <rdar://problem/25637378>

        Reviewed by Darin Adler.

        Avoid the risk of using deallocated Widgets and ScrollableAreas by using WeakPtrs instead of
        bare pointers. This allows us to remove some explicit calls to get ScrollableArea and Widget
        members in the event handling logic. Instead, null checks are sufficient to ensure we never
        accidentally dereference a deleted element.

        1. Modify the ScrollableArea class to support vending WeakPtrs.
        2. Modify the Event Handling code to use WeakPtrs to hold ScrollableArea and RenderWidget
           objects, and to null-check these elements after event handling dispatching is finished
           to handle cases where these objects are destroyed.

        Test: fast/events/wheel-event-destroys-frame.html
              fast/events/wheel-event-destroys-overflow.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::platformPrepareForWheelEvents): Change signature for WeakPtr.
        (WebCore::EventHandler::platformCompleteWheelEvent): Ditto.
        (WebCore::EventHandler::platformNotifyIfEndGesture): Ditto.
        (WebCore::widgetForElement): Change to return a WeakPtr.
        (WebCore::EventHandler::handleWheelEvent): Use WeakPtrs to hold elements that might be destroyed
        during event handling.
        * page/EventHandler.h:
        * page/mac/EventHandlerEfl.cpp: Rename passWheelEventToWidget to widgetDidHandleWheelEvent.
        * page/mac/EventHandlerGtk.cpp: Ditto.
        * page/mac/EventHandlerIOS.mm: Ditto.
        * page/mac/EventHandlerMac.mm:
        (WebCore::scrollableAreaForEventTarget): Renamed from scrollViewForEventTarget. Return
        a WeakPtr rather than a bare pointer.
        (WebCore::scrollableAreaForContainerNode): Return WeakPtr rather than bare pointer.
        (WebCore::EventHandler::completeWidgetWheelEvent): Added.
        (WebCore::EventHandler::passWheelEventToWidget): Deleted.
        (WebCore::EventHandler::platformPrepareForWheelEvents): Convert to WeakPtrs.
        (WebCore::EventHandler::platformCompleteWheelEvent): Ditto.
        (WebCore::EventHandler::platformCompletePlatformWidgetWheelEvent): Ditto.
        (WebCore::EventHandler::platformNotifyIfEndGesture): Ditto.
        (WebCore::EventHandler::widgetDidHandleWheelEvent): Renamed from passWheelEventToWidget.
        (WebCore::EventHandler::widgetForEventTarget): Converted from static function to static
        method so it can be shared with EventHandlerMac.
        (WebCore::scrollViewForEventTarget): Deleted.
        * page/mac/EventHandlerWin.cpp: Rename passWheelEventToWidget to widgetDidHandleWheelEvent.
        * platform/ScrollableArea.cpp:
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::createWeakPtr): Added.
        * platform/Widget.h:
        (WebCore::ScrollableArea::createWeakPtr): Added.

2016-04-11  Dean Jackson  <dino@apple.com>

        putImageData needs to premultiply input
        https://bugs.webkit.org/show_bug.cgi?id=156488
        <rdar://problem/25672675>

        Reviewed by Zalan Bujtas.

        I made a mistake in r187534 as I was converting get and putImageData
        to use Accelerate. The incoming data is unmultiplied, and should
        be premultiplied before copying into the backing store. I was
        accidentally unmultiplying unmultiplied data, which caused
        some pretty psychedelic results.

        Test: fast/canvas/putImageData-unmultiplied.html

        * platform/graphics/cg/ImageBufferDataCG.cpp:
        (WebCore::ImageBufferData::putData): Call premultiply, not unpremultiply.

2016-04-11  Jeremy Jones  <jeremyj@apple.com>

        When clearing cache, also clear AVFoundation cache.
        https://bugs.webkit.org/show_bug.cgi?id=155783
        rdar://problem/25252541

        Reviewed by Darin Adler.

        Use AVAssetCache at a specified location on disk for all AVURLAssets. This AVAssetCache
        can then be used to manage the cache storage used by AVFoundation. It is used to query the
        contents of the cache in originsInMediaCache() and to clear the cache completely or partially in
        clearMediaCache() and clearMediaCacheForOrigins().

        Use SecurityOrigin instead of the less formal site String to represent origins in the cache.

        * html/HTMLMediaElement.cpp:
        (WebCore::sharedMediaCacheDirectory): Added.
        (WebCore::HTMLMediaElement::setMediaCacheDirectory): Added.
        (WebCore::HTMLMediaElement::mediaCacheDirectory): Added.
        (WebCore::HTMLMediaElement::originsInMediaCache): Added.
        (WebCore::HTMLMediaElement::clearMediaCache): Added parameter.
        (WebCore::HTMLMediaElement::clearMediaCacheForOrigins): Added.
        (WebCore::HTMLMediaElement::mediaPlayerMediaCacheDirectory): Added.
        (WebCore::HTMLMediaElement::getSitesInMediaCache): Deleted.
        (WebCore::HTMLMediaElement::clearMediaCacheForSite): Deleted.
        * html/HTMLMediaElement.h:
        (WebCore::HTMLMediaElement::clearMediaCache): Added parameter.
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::addMediaEngine): Add new cache methods.
        (WebCore::addToHash): Added.
        (WebCore::MediaPlayer::originsInMediaCache): Added.
        (WebCore::MediaPlayer::clearMediaCache): Added parameter.
        (WebCore::MediaPlayer::clearMediaCacheForOrigins): Added.
        (WebCore::MediaPlayer::getSitesInMediaCache): Deleted.
        (WebCore::MediaPlayer::clearMediaCacheForSite): Deleted.
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerMediaCacheDirectory): Added.
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::originsInMediaCache): Added.
        (WebCore::MediaPlayerPrivateInterface::clearMediaCache): Added parameter.
        (WebCore::MediaPlayerPrivateInterface::clearMediaCacheForOrigins): Added.
        (WebCore::MediaPlayerPrivateInterface::getSitesInMediaCache): Deleted.
        (WebCore::MediaPlayerPrivateInterface::clearMediaCacheForSite): Deleted.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::registerMediaEngine): Added cache methods.
        (WebCore::assetCacheForPath): Added.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::originsInMediaCache): Added.
        (WebCore::toSystemClockTime): Added.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::clearMediaCache): Added parameter.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::clearMediaCacheForOrigins): Added.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Added.
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::registerMediaEngine): Added cache methods.
        (WebCore::MediaPlayerPrivateQTKit::originsInMediaCache): Added.
        (WebCore::MediaPlayerPrivateQTKit::clearMediaCache): Added parameter.
        (WebCore::MediaPlayerPrivateQTKit::clearMediaCacheForOrigins): Added.
        (WebCore::MediaPlayerPrivateQTKit::getSitesInMediaCache): Deleted.
        (WebCore::MediaPlayerPrivateQTKit::clearMediaCacheForSite): Deleted.
        * platform/spi/mac/AVFoundationSPI.h:

2016-04-11  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r199310.
        https://bugs.webkit.org/show_bug.cgi?id=156483

        This change turns many indexeddb tests into crashes (Requested
        by jwtan on #webkit).

        Reverted changeset:

        "Clean up IDBBindingUtilities."
        https://bugs.webkit.org/show_bug.cgi?id=156472
        http://trac.webkit.org/changeset/199310

2016-04-11  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r199315.
        https://bugs.webkit.org/show_bug.cgi?id=156482

        This change broke the OS X Yosemite build. (Requested by jwtan
        on #webkit).

        Reverted changeset:

        "When clearing cache, also clear AVFoundation cache."
        https://bugs.webkit.org/show_bug.cgi?id=155783
        http://trac.webkit.org/changeset/199315

2016-04-11  Brian Burg  <bburg@apple.com>

        Web Inspector: get rid of InspectorBasicValue and InspectorString subclasses
        https://bugs.webkit.org/show_bug.cgi?id=156407
        <rdar://problem/25627659>

        Reviewed by Joseph Pecoraro.

        * inspector/InspectorDatabaseAgent.cpp: Don't use deleted subclasses.

2016-04-11  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r198909.
        https://bugs.webkit.org/show_bug.cgi?id=156479

        made double-click-and-drag on text drag instead of
        highlighting (Requested by alexchristensen_ on #webkit).

        Reverted changeset:

        "eventMayStartDrag() does not check for shiftKey or
        isOverLink"
        https://bugs.webkit.org/show_bug.cgi?id=155746
        http://trac.webkit.org/changeset/198909

2016-04-11  Chris Dumez  <cdumez@apple.com>

        [WebIDL] Add support for [ImplementedAs] for EventHandler attributes
        https://bugs.webkit.org/show_bug.cgi?id=156421

        Reviewed by Darin Adler.

        Add support for [ImplementedAs] for EventHandler attributes so we can
        get rid of some ugly name hard-coding in the bindings generator.

        * Modules/notifications/Notification.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (EventHandlerAttributeEventName):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjOnwebkitfoo):
        (WebCore::setJSTestObjOnwebkitfoo):
        * bindings/scripts/test/TestObj.idl:
        * dom/Element.idl:
        * page/DOMWindow.idl:

2016-04-11  Jeremy Jones  <jeremyj@apple.com>

        When clearing cache, also clear AVFoundation cache.
        https://bugs.webkit.org/show_bug.cgi?id=155783
        rdar://problem/25252541

        Reviewed by Darin Adler.

        Use AVAssetCache at a specified location on disk for all AVURLAssets. This AVAssetCache
        can then be used to manage the cache storage used by AVFoundation. It is used to query the
        contents of the cache in originsInMediaCache() and to clear the cache completely or partially in
        clearMediaCache() and clearMediaCacheForOrigins().

        Use SecurityOrigin instead of the less formal site String to represent origins in the cache.

        * html/HTMLMediaElement.cpp:
        (WebCore::sharedMediaCacheDirectory): Added.
        (WebCore::HTMLMediaElement::setMediaCacheDirectory): Added.
        (WebCore::HTMLMediaElement::mediaCacheDirectory): Added.
        (WebCore::HTMLMediaElement::originsInMediaCache): Added.
        (WebCore::HTMLMediaElement::clearMediaCache): Added parameter.
        (WebCore::HTMLMediaElement::clearMediaCacheForOrigins): Added.
        (WebCore::HTMLMediaElement::mediaPlayerMediaCacheDirectory): Added.
        (WebCore::HTMLMediaElement::getSitesInMediaCache): Deleted.
        (WebCore::HTMLMediaElement::clearMediaCacheForSite): Deleted.
        * html/HTMLMediaElement.h:
        (WebCore::HTMLMediaElement::clearMediaCache): Added parameter.
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::addMediaEngine): Add new cache methods.
        (WebCore::addToHash): Added.
        (WebCore::MediaPlayer::originsInMediaCache): Added.
        (WebCore::MediaPlayer::clearMediaCache): Added parameter.
        (WebCore::MediaPlayer::clearMediaCacheForOrigins): Added.
        (WebCore::MediaPlayer::getSitesInMediaCache): Deleted.
        (WebCore::MediaPlayer::clearMediaCacheForSite): Deleted.
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerMediaCacheDirectory): Added.
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::originsInMediaCache): Added.
        (WebCore::MediaPlayerPrivateInterface::clearMediaCache): Added parameter.
        (WebCore::MediaPlayerPrivateInterface::clearMediaCacheForOrigins): Added.
        (WebCore::MediaPlayerPrivateInterface::getSitesInMediaCache): Deleted.
        (WebCore::MediaPlayerPrivateInterface::clearMediaCacheForSite): Deleted.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::registerMediaEngine): Added cache methods.
        (WebCore::assetCacheForPath): Added.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::originsInMediaCache): Added.
        (WebCore::toSystemClockTime): Added.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::clearMediaCache): Added parameter.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::clearMediaCacheForOrigins): Added.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Added.
        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::registerMediaEngine): Added cache methods.
        (WebCore::MediaPlayerPrivateQTKit::originsInMediaCache): Added.
        (WebCore::MediaPlayerPrivateQTKit::clearMediaCache): Added parameter.
        (WebCore::MediaPlayerPrivateQTKit::clearMediaCacheForOrigins): Added.
        (WebCore::MediaPlayerPrivateQTKit::getSitesInMediaCache): Deleted.
        (WebCore::MediaPlayerPrivateQTKit::clearMediaCacheForSite): Deleted.
        * platform/spi/mac/AVFoundationSPI.h:

2016-04-11  Antoine Quint  <graouts@apple.com>

        [WebGL2] Use Open GL ES 3.0 to back WebGL2 contexts
        https://bugs.webkit.org/show_bug.cgi?id=141178

        Reviewed by Dean Jackson.

        We add a new `useGLES3` attribute when creating a GraphicsContext3D in the event that the
        context type is "webgl2". This attribute is then read by the GraphicsContext3D constructor
        to request an Open GL ES 3.0 backend when creating the EAGLContext on iOS.

        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::create):
        * platform/graphics/GraphicsContext3D.h:
        (WebCore::GraphicsContext3D::Attributes::Attributes):
        * platform/graphics/mac/GraphicsContext3DMac.mm:
        (WebCore::GraphicsContext3D::GraphicsContext3D):

2016-04-11  Jiewen Tan  <jiewen_tan@apple.com>

        fast/loader/opaque-base-url.html crashing during mac and ios debug tests
        https://bugs.webkit.org/show_bug.cgi?id=156179
        <rdar://problem/25507719>

        Reviewed by Ryosuke Niwa.

        Navigate to about:blank if the provided src of an iframe/frame cannot be
        resolved to a valid URL.

        Test: fast/loader/iframe-src-invalid-url.html

        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::requestFrame):

2016-04-11  Said Abou-Hallawa  <sabouhallawa@apple,com>

        Merge CG ImageSource and non CG ImageSource implementation in one file
        https://bugs.webkit.org/show_bug.cgi?id=155456

        Reviewed by Darin Adler.

        ImageSource for CG and CG code paths look very similar. All the platform
        specific code can be moved to ImageDecoder classes for CG and non CG. And
        we can have the ImageSource be platform independent and we get rid of
        ImageSourceCG.cpp.

        Test: fast/images/image-subsampling.html

        * CMakeLists.txt:
        * PlatformAppleWin.cmake:
        * PlatformMac.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        Delete ImageSourceCG.cpp form all make files and add ImageSource.cpp to
        CMakeLists.txt.
        
        * platform/Cursor.cpp:
        (WebCore::determineHotSpot):
        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::hotSpot):
        (WebCore::BitmapImage::getHotSpot): Deleted.
        * platform/graphics/BitmapImage.h:
        * platform/graphics/Image.h:
        (WebCore::Image::hotSpot):
        (WebCore::Image::getHotSpot): Deleted.
        Rename getHotSpot() to hotSpot() and change it to return Optional<IntPoint>.
        
        * platform/graphics/ImageSource.cpp:
        (WebCore::ImageSource::~ImageSource): Remove clear(true) call. It does nothing.
        (WebCore::ImageSource::clearFrameBufferCache): A wrapper which calls ImageDecoder::clearFrameBufferCache().
        (WebCore::ImageSource::clear): Calls clearFrameBufferCache() which will do nothing for CG.
        
        (WebCore::ImageSource::ensureDecoderIsCreated): Change SharedBuffer* to
        const SharedBuffer& and remove the call to ImageDecoder::setMaxNumPixels().
        The value of const static int CG ImageDecoder::m_maxNumPixels will be set
        based on IMAGE_DECODER_DOWN_SAMPLING.
        
        (WebCore::ImageSource::setData): Pass SharedBuffer& to the underlying functions.
        
        (WebCore::ImageSource::calculateMaximumSubsamplingLevel): Returns the maximum
        subsampling level allowed for an image.
        
        (WebCore::ImageSource::subsamplingLevelForScale): Converts from a scale to
        SubsamplingLevel taking into consideration the maximumSubsamplingLevel for
        a particular image.
        
        (WebCore::ImageSource::bytesDecodedToDetermineProperties): Returns the number
        of encoded bytes which can determine the image properties. For non CG it's
        zero. For CG it is a maximum value which can be corrected later.
        
        (WebCore::ImageSource::isSizeAvailable):
        (WebCore::ImageSource::sizeRespectingOrientation):
        (WebCore::ImageSource::frameCount):
        (WebCore::ImageSource::repetitionCount):
        (WebCore::ImageSource::filenameExtension):
        (WebCore::ImageSource::getHotSpot):
        (WebCore::ImageSource::frameIsCompleteAtIndex):
        (WebCore::ImageSource::frameHasAlphaAtIndex):
        (WebCore::ImageSource::allowSubsamplingOfFrameAtIndex):
        (WebCore::ImageSource::frameSizeAtIndex):
        (WebCore::ImageSource::frameBytesAtIndex):
        (WebCore::ImageSource::frameDurationAtIndex):
        (WebCore::ImageSource::orientationAtIndex):
        (WebCore::ImageSource::createFrameImageAtIndex):
        These are wrappers for the ImageDecoder APIs. The purpose of these functions
        is to ensure the ImageDecoder is created.
        
        (WebCore::ImageSource::dump): Called from BitmapImage::dump().
        
        (WebCore::ImageSource::getHotSpot): Deleted.
        
        * platform/graphics/ImageSource.h:
        (WebCore::ImageSource::setAllowSubsampling): Called from BitmapImage::setAllowSubsampling().
        
        (WebCore::ImageSource::maxPixelsPerDecodedImage): Deleted.
        (WebCore::ImageSource::setMaxPixelsPerDecodedImage): Deleted.
        Setting maxPixelsPerDecodedImage was moved to the non CG ImageDecoder.
        
        * platform/graphics/cg/ImageDecoderCG.cpp:
        (WebCore::ImageDecoder::setData): Change SharedBuffer* to SharedBuffer&.

        (WebCore::ImageDecoder::subsamplingLevelForScale): Deleted.
        The code was moved to ImageSource::subsamplingLevelForScale().
        
        * platform/graphics/cg/ImageDecoderCG.h:
        (WebCore::ImageDecoder::create): Make the prototype of this function
        suitable for CG and non CG cases.
        (WebCore::ImageDecoder::clearFrameBufferCache): Empty functions for CG.
        
        * platform/graphics/cg/ImageSourceCG.cpp: Removed.
        
        * platform/image-decoders/ImageDecoder.cpp:
        (WebCore::ImageDecoder::frameIsCompleteAtIndex): A mew function to return
        whether the frame decoding is complete or not.
        
        (WebCore::ImageDecoder::frameHasAlphaAtIndex): Simplify the logic.
        
        (WebCore::ImageDecoder::frameDurationAtIndex): The code was moved from
        ImageSource::frameDurationAtIndex() in ImageSource.cpp.
        
        (WebCore::ImageDecoder::createFrameImageAtIndex): The code was moved from
        ImageSource::createFrameImageAtIndex() in ImageSource.cpp.
        
        * platform/image-decoders/ImageDecoder.h:
        (WebCore::ImageDecoder::ImageDecoder): Initialize the members in class.
        (WebCore::ImageDecoder::~ImageDecoder): Fix the braces style.
        (WebCore::ImageDecoder::setData): Change the type of the argument from
        SharedBuffer* to SharedBuffer&.
        (WebCore::ImageDecoder::frameSizeAtIndex): Add the argument SubsamplingLevel
        so it can have the same prototype as CG.
        (WebCore::ImageDecoder::orientationAtIndex): Rename it to the same of CG.
        
        (WebCore::ImageDecoder::allowSubsamplingOfFrameAtIndex):
        (WebCore::ImageDecoder::bytesDecodedToDetermineProperties):
        (WebCore::ImageDecoder::subsamplingLevelForScale): Add these functions
        and return the default values so we do not have to add directive compiled
        non CG blocks in ImageSource.cpp.

        (WebCore::ImageDecoder::hotSpot): Return Optional<IntPoint>.
        
        (WebCore::ImageDecoder::orientation): Deleted.
        (WebCore::ImageDecoder::setMaxNumPixels): Deleted.
        
        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
        (WebCore::BMPImageDecoder::setData):
        * platform/image-decoders/bmp/BMPImageDecoder.h:
        * platform/image-decoders/gif/GIFImageDecoder.cpp:
        (WebCore::GIFImageDecoder::setData):
        (WebCore::GIFImageDecoder::decode):
        * platform/image-decoders/gif/GIFImageDecoder.h:
        * platform/image-decoders/gif/GIFImageReader.h:
        (GIFImageReader::setData):
        * platform/image-decoders/ico/ICOImageDecoder.cpp:
        (WebCore::ICOImageDecoder::setData):
        Use reference SharedBuffer instead of pointer SharedBuffer.
        
        (WebCore::ICOImageDecoder::hotSpot):
        (WebCore::ICOImageDecoder::hotSpotAtIndex):
        Change hotSpot() to return Optional<IntPoint>.
        * platform/image-decoders/ico/ICOImageDecoder.h:
                
        (WebCore::ICOImageDecoder::setDataForPNGDecoderAtIndex):
        Pass reference SharedBuffer instead of pointer SharedBuffer.

2016-04-08  Said Abou-Hallawa  <sabouhallawa@apple,com>

        Timing attack on SVG feComposite filter circumvents same-origin policy
        https://bugs.webkit.org/show_bug.cgi?id=154338

        Reviewed by Oliver Hunt.

        Ensure the FEComposite arithmetic filter is clamping the resulted color
        components in a constant time.

        * platform/graphics/filters/FEComposite.cpp:
        (WebCore::clampByte):
        (WebCore::computeArithmeticPixels):

2016-04-11  Brady Eidson  <beidson@apple.com>

        Clean up IDBBindingUtilities.
        https://bugs.webkit.org/show_bug.cgi?id=156472

        Reviewed by Alex Christensen.

        No new tests (No change in behavior).

        - Get rid of a whole bunch of unused functions (since we got rid of Legacy IDB).
        - Make more functions deal in ExecState/ScriptExecutionContexts instead of DOMRequestState.
        - Make more functions deal in JSValue instead of Deprecated::ScriptValue.

        * bindings/scripts/IDLAttributes.txt: Add a new attribute to signify that an implementation returns
          JSValues instead of Deprecated::ScriptState
        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): Use that new attribute.
        
        * Modules/indexeddb/IDBAny.cpp:
        (WebCore::IDBAny::IDBAny):
        (WebCore::IDBAny::scriptValue):
        * Modules/indexeddb/IDBAny.h:
        (WebCore::IDBAny::create):
        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::key):
        (WebCore::IDBCursor::primaryKey):
        (WebCore::IDBCursor::value):
        (WebCore::IDBCursor::update):
        (WebCore::IDBCursor::continueFunction):
        (WebCore::IDBCursor::deleteFunction):
        (WebCore::IDBCursor::setGetResult):
        * Modules/indexeddb/IDBCursor.h:
        * Modules/indexeddb/IDBCursor.idl:
        * Modules/indexeddb/IDBCursorWithValue.idl:
        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::IDBFactory::cmp):
        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::count):
        (WebCore::IDBIndex::get):
        (WebCore::IDBIndex::getKey):
        * Modules/indexeddb/IDBKeyRange.cpp:
        (WebCore::IDBKeyRange::lowerValue):
        (WebCore::IDBKeyRange::upperValue):
        (WebCore::IDBKeyRange::only):
        (WebCore::IDBKeyRange::lowerBound):
        (WebCore::IDBKeyRange::upperBound):
        (WebCore::IDBKeyRange::bound):
        * Modules/indexeddb/IDBKeyRange.h:
        * Modules/indexeddb/IDBKeyRange.idl:
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::get):
        (WebCore::IDBObjectStore::modernDelete):
        (WebCore::IDBObjectStore::count):
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::setResult):
        (WebCore::IDBRequest::setResultToStructuredClone):
        * Modules/indexeddb/server/MemoryObjectStore.cpp:
        (WebCore::IDBServer::MemoryObjectStore::updateIndexesForPutRecord):
        (WebCore::IDBServer::MemoryObjectStore::populateIndexWithExistingRecords):
        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::idbKeyPathFromValue):
        (WebCore::deserializeIDBValueDataToJSValue):
        (WebCore::scriptValueToIDBKey):
        (WebCore::idbKeyDataToScriptValue):
        (WebCore::idbKeyDataToJSValue): Deleted.
        (WebCore::injectIDBKeyIntoScriptValue): Deleted.
        (WebCore::createIDBKeyFromScriptValueAndKeyPath): Deleted.
        (WebCore::maybeCreateIDBKeyFromScriptValueAndKeyPath): Deleted.
        (WebCore::canInjectIDBKeyIntoScriptValue): Deleted.
        (WebCore::deserializeIDBValue): Deleted.
        (WebCore::deserializeIDBValueData): Deleted.
        (WebCore::deserializeIDBValueBuffer): Deleted.
        (WebCore::idbValueDataToJSValue): Deleted.
        (WebCore::idbKeyToScriptValue): Deleted.
        * bindings/js/IDBBindingUtilities.h:
        * bindings/js/JSIDBAnyCustom.cpp:
        (WebCore::toJS):
        * bindings/js/JSIDBDatabaseCustom.cpp:
        (WebCore::JSIDBDatabase::createObjectStore):
        * bindings/js/JSIDBObjectStoreCustom.cpp:
        (WebCore::JSIDBObjectStore::createIndex):
        * dom/ScriptExecutionContext.cpp:
        (WebCore::ScriptExecutionContext::execState):
        * dom/ScriptExecutionContext.h:
        * inspector/InspectorIndexedDBAgent.cpp:

2016-04-09  Gavin Barraclough  <barraclough@apple.com>

        WebKit should adopt journal_mode=wal for all SQLite databases.
        https://bugs.webkit.org/show_bug.cgi?id=133496

        Reviewed by Darin Adler.

        The statement intended to enable WAL mode is always failing because it is missing a
        prepare(). Fix this. We were also previously permitting SQLITE_OK results - this
        was in error (we were only getting these because stepping the unprepared statement
        returned SQLITE_OK). Also set the SQLITE_OPEN_AUTOPROXY flag when opening the
        database - this will improve perfomance when the database is accessed via an AFP
        mount.

        This exposed a bug, that deleteAllDatabases does not actually delete the databases on
        iOS, for testing to reset back to a known state between tests it should be doing so.

        * Modules/webdatabase/DatabaseTracker.cpp:
        (WebCore::DatabaseTracker::deleteAllDatabases):
            - force databases to actually be deleted on iOS.
              This method is only used from testing code (DumpRenderTree / WebKitTestRunner).
        (WebCore::DatabaseTracker::deleteOrigin):
            - added IOSDeletionMode.
        (WebCore::DatabaseTracker::deleteDatabaseFile):
            - added IOSDeletionMode, modified to actually delete if this is set.
        * Modules/webdatabase/DatabaseTracker.h:
            - added IOSDeletionMode.
        * platform/sql/SQLiteDatabase.cpp:
        (WebCore::SQLiteDatabase::open):
            - call prepareAndStep(), only check for SQLITE_ROW result.
        * platform/sql/SQLiteFileSystem.cpp:
        (WebCore::SQLiteFileSystem::openDatabase):
            - should set SQLITE_OPEN_AUTOPROXY flag when opening database.

2016-04-11  Zalan Bujtas  <zalan@apple.com>

        Simplify InlineTextBox::selectionStartEnd()
        https://bugs.webkit.org/show_bug.cgi?id=156459

        Reviewed by Darin Adler.

        No change in functionality.

        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::selectionState):
        (WebCore::InlineTextBox::paint):
        (WebCore::InlineTextBox::selectionStartEnd):
        (WebCore::InlineTextBox::paintSelection):
        (WebCore::InlineTextBox::paintCompositionBackground):
        * rendering/InlineTextBox.h:
        * rendering/svg/SVGInlineTextBox.cpp:
        (WebCore::SVGInlineTextBox::paintSelectionBackground):
        (WebCore::SVGInlineTextBox::paintText):

2016-04-11  Zalan Bujtas  <zalan@apple.com>

        REGRESSION (r193857): Text selection causes text to disappear.
        https://bugs.webkit.org/show_bug.cgi?id=156448
        rdar://problem/25578952

        Reviewed by Simon Fraser.

        Apparently when the end position of the selection range is smaller than the start position, we need
        to repaint the entire text as it indicates selection clearing.

        Test: fast/text/text-disappear-on-deselect.html

        * rendering/TextPainter.cpp:
        (WebCore::TextPainter::paintText):

2016-04-05  Oliver Hunt  <oliver@apple.com>

        Remove compile time define for SEPARATED_HEAP
        https://bugs.webkit.org/show_bug.cgi?id=155508

        Reviewed by Mark Lam.

        * Configurations/FeatureDefines.xcconfig:

2016-04-11  Chris Dumez  <cdumez@apple.com>

        Merge AttributedDOMTokenList into DOMTokenList
        https://bugs.webkit.org/show_bug.cgi?id=156468

        Reviewed by Ryosuke Niwa.

        Merge AttributedDOMTokenList into DOMTokenList to simplify the code.
        DOMTokenList is not constructible and AttributedDOMTokenList is its
        only constructible subclass after r196123.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Element.cpp:
        (WebCore::Element::classList):
        * dom/ElementRareData.h:
        (WebCore::ElementRareData::classList):
        (WebCore::ElementRareData::setClassList):
        * html/AttributeDOMTokenList.cpp: Removed.
        * html/AttributeDOMTokenList.h: Removed.
        * html/DOMTokenList.cpp:
        (WebCore::DOMTokenList::DOMTokenList):
        (WebCore::DOMTokenList::attributeValueChanged):
        (WebCore::DOMTokenList::updateAfterTokenChange):
        * html/DOMTokenList.h:
        (WebCore::DOMTokenList::ref):
        (WebCore::DOMTokenList::deref):
        (WebCore::DOMTokenList::element):
        (WebCore::DOMTokenList::~DOMTokenList): Deleted.
        (WebCore::DOMTokenList::updateAfterTokenChange): Deleted.
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::relList):
        * html/HTMLAnchorElement.h:
        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::sandbox):
        * html/HTMLIFrameElement.h:
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::sizes):
        (WebCore::HTMLLinkElement::relList):
        * html/HTMLLinkElement.h:
        * html/HTMLOutputElement.cpp:
        (WebCore::HTMLOutputElement::htmlFor):
        * html/HTMLOutputElement.h:

2016-04-11  Chris Dumez  <cdumez@apple.com>

        DOMTokenList.contains() should not throw
        https://bugs.webkit.org/show_bug.cgi?id=156453

        Reviewed by Ryosuke Niwa.

        DOMTokenList.contains() should not throw if the input token is invalid:
        https://github.com/whatwg/dom/commit/6d3076e3cbcba662489b272a718bc6b8c0082a74

        We now return false in such cases, instead of throwing, which should be
        safe with regards to backward compatibility.

        No new tests, already covered by existing tests.

        * html/DOMTokenList.cpp:
        (WebCore::DOMTokenList::contains):
        * html/DOMTokenList.h:
        * html/DOMTokenList.idl:

2016-04-11  Frederic Wang  <fwang@igalia.com>

        Refactor RenderMathMLFraction layout to avoid using flexbox
        https://bugs.webkit.org/show_bug.cgi?id=153917

        Reviewed by Sergio Villar Senin.

        Based on a patch by Alejandro G. Castro <alex@igalia.com>

        Implement the layoutBlock method to handle the layout calculations
        directly in the class. This also fixes parsing of absolute values for
        linethickness attribute (e.g. 10px) and adds support for the AxisHeight
        and FractionRuleThickness MATH parameters.

        Test: mathml/opentype/fraction-line.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::mathLineThickness): Use the thickness relative to the
        default line thickness since that's really what is expected by mathml-line-fraction.html
        * css/mathml.css: Remove flexbox properties for mfrac.
        (mfrac): Deleted.
        (mfrac > *): Deleted.
        (mfrac[numalign="left"] > :first-child): Deleted.
        (mfrac[numalign="right"] > :first-child): Deleted.
        (mfrac[denomalign="left"] > :last-child): Deleted.
        (mfrac[denomalign="right"] > :last-child): Deleted.
        (mfrac > :first-child): Deleted.
        (mfrac > :last-child): Deleted.
        (mfrac): Deleted.
        * rendering/mathml/RenderMathMLBlock.cpp: Introduce a helper function to retrieve the math
        axis height.
        (WebCore::RenderMathMLBlock::mathAxisHeight):
        * rendering/mathml/RenderMathMLBlock.h: Declare mathAxisHeight.
        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::RenderMathMLFraction):
        (WebCore::RenderMathMLFraction::parseAlignmentAttribute): Helper function to parse the align
        attribute.
        (WebCore::RenderMathMLFraction::isValid): Helper function to verify whether the child list
        is valid with respect to the MathML specificitation.
        (WebCore::RenderMathMLFraction::numerator): Helper function to retrieve the numerator.
        (WebCore::RenderMathMLFraction::denominator): Helper function to retrieve the denominator.
        (WebCore::RenderMathMLFraction::updateFromElement): Use the FractionRuleThickness parameter
        when avaiable to calculate the default linethickness.
        Fix computation of linethickness for absolute values (e.g. 10px), the default linethickness
        must not be involved for such values.
        We no longer need to manage style of anonymous wrappers.
        (WebCore::RenderMathMLFraction::unembellishedOperator): Use the helper function and we no
        longer care about anonymous wrappers.
        (WebCore::RenderMathMLFraction::computePreferredLogicalWidths): Implement this function
        without using flexbox.
        (WebCore::RenderMathMLFraction::horizontalOffset): Helper function to get the horizontal
        offsets of children depending of the alignment.
        (WebCore::RenderMathMLFraction::layoutBlock): Implement this function without using flexbox.
        (WebCore::RenderMathMLFraction::paint): Do not paint if the fraction is invalid. Use helper
        function. Use the width of the renderer (instead of the one of the denominator) as the
        length of the fraction bar.
        (WebCore::RenderMathMLFraction::firstLineBaseline): Use the helper functions to get children
        and axis height.
        (WebCore::RenderMathMLFraction::paintChildren): Temporary function to remove in a
        follow-up patch.
        (WebCore::RenderMathMLFraction::fixChildStyle): Deleted. We no longer need to manage style
        of anonymous wrappers.
        (WebCore::RenderMathMLFraction::addChild): Deleted. We no longer need to manage
        anonymous wrappers.
        (WebCore::RenderMathMLFraction::styleDidChange): We no longer need to manage style of
        anonymous wrappers.
        (WebCore::RenderMathMLFraction::layout): Deleted.
        * rendering/mathml/RenderMathMLFraction.h: Replace lineThickness with relativeLineThickness,
        as needed by the accessibility code. Update function and members declarations.

2016-04-11  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r199290.
        https://bugs.webkit.org/show_bug.cgi?id=156465

        broke 300 tests (Requested by mcatanzaro on #webkit).

        Reverted changeset:

        "Merge CG ImageSource and non CG ImageSource implementation in
        one file"
        https://bugs.webkit.org/show_bug.cgi?id=155456
        http://trac.webkit.org/changeset/199290

2016-04-11  Frederic Wang  <fwang@igalia.com>

        Refactor RenderMathMLUnderOver layout functions to avoid using flexbox
        https://bugs.webkit.org/show_bug.cgi?id=153742

        Reviewed by Sergio Villar Senin.

        Based on a patch by Javier Fernandez <jfernandez@igalia.com>

        Refactor the UnderOver renderer to use its own layoutBlock method that
        does all the layout calculations without considering the flexbox
        restrictions.

        * css/mathml.css:
        (mo, mfrac, munder, mover, munderover): Delete the underover elements from the line defining
        the column direction.
        (munder, mover, munderover): Deleted. This flexbox property is no longer needed.
        (mover > :last-child, munderover > :last-child): Deleted. This flexbox property is no longer
        needed.
        * rendering/mathml/RenderMathMLUnderOver.cpp:
        (WebCore::RenderMathMLUnderOver::firstLineBaseline): Use ascentForChild.
        (WebCore::RenderMathMLUnderOver::computeOperatorsHorizontalStretch): Avoid stretching
        operators that are not stretchy.
        (WebCore::RenderMathMLUnderOver::isValid): Helper function to ensure that the child list is
        valid with respect to the MathML specification.
        (WebCore::RenderMathMLUnderOver::base): Added. Helper function.
        (WebCore::RenderMathMLUnderOver::under): Added. Helper function.
        (WebCore::RenderMathMLUnderOver::over): Added. Helper function.
        (WebCore::RenderMathMLUnderOver::computePreferredLogicalWidths): Added.
        The preferred width is the maximum preferred width of the base, under and over scripts.
        (WebCore::RenderMathMLUnderOver::horizontalOffset): Added, helper to calculate the
        horizontal position of children (horizontally centered).
        (WebCore::RenderMathMLUnderOver::layoutBlock): Added, it lays out the base, underscript and
        overscript. It calculates the exact logical width, which may differ from the preferred width when
        one child contains stretchy operators. It later sets the locations of children accordingly
        and sets the heigth of the render element.
        (WebCore::RenderMathMLUnderOver::paintChildren): Added, we have to use the usual traverse
        instead of the one that comes from the flexbox. This will be removed in a follow-up patch.
        (WebCore::RenderMathMLUnderOver::layout): Deleted.
        * rendering/mathml/RenderMathMLUnderOver.h: Added new functions definitions.

2016-04-07  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Rework the theming code for GTK+ 3.20
        https://bugs.webkit.org/show_bug.cgi?id=156333

        Reviewed by Michael Catanzaro.

        During the 3.19 GTK+ release cycle, the GTK+ css system was reworked, making themes and programs rendering
        themed widgets, incompatible with the new system. We were trying to fix our rendering every time GTK+ broke
        something, but we were just changing whatever it was needed to make our rendering look like current GTK+ with
        the default theme Adwaita. This means that our rendering will be broken for other themes or that changes in
        Adwaita can break our rendering. This solution was good enough to ensure WebKitGTK+ 2.12 looked good with GTK+
        3.20, but it doesn't work in the long term. We need to ensure that our theming code honors the new GTK+ CSS
        properties (max-width, min-width, margin, padding, border, ...) in all the cases, not only the cases where
        Adwaita uses them like we currently do.
        This patch splits all rendering methods to keep the current code for previous GTK+ versions and adds new code
        for GTK+ >= 3.20 using the new RenderThemeGadget classes. This makes the code easier to read, since there aren't
        ifdef blocks in the functions, and we ensure we don't break previous rendering.

        * PlatformGTK.cmake: Add new files to compilation.
        * html/shadow/SpinButtonElement.cpp:
        (WebCore::SpinButtonElement::defaultEventHandler): Check the button layout used by the theme to decide the
        current buttons state.
        * platform/gtk/RenderThemeGadget.cpp: Added.
        (WebCore::RenderThemeGadget::create):
        (WebCore::createStyleContext):
        (WebCore::appendElementToPath):
        (WebCore::RenderThemeGadget::RenderThemeGadget):
        (WebCore::RenderThemeGadget::~RenderThemeGadget):
        (WebCore::RenderThemeGadget::marginBox):
        (WebCore::RenderThemeGadget::borderBox):
        (WebCore::RenderThemeGadget::paddingBox):
        (WebCore::RenderThemeGadget::contentsBox):
        (WebCore::RenderThemeGadget::color):
        (WebCore::RenderThemeGadget::backgroundColor):
        (WebCore::RenderThemeGadget::minimumSize):
        (WebCore::RenderThemeGadget::preferredSize):
        (WebCore::RenderThemeGadget::render):
        (WebCore::RenderThemeGadget::renderFocus):
        (WebCore::RenderThemeBoxGadget::RenderThemeBoxGadget):
        (WebCore::RenderThemeTextFieldGadget::RenderThemeTextFieldGadget):
        (WebCore::RenderThemeTextFieldGadget::minimumSize):
        (WebCore::RenderThemeToggleGadget::RenderThemeToggleGadget):
        (WebCore::RenderThemeToggleGadget::render):
        (WebCore::RenderThemeArrowGadget::RenderThemeArrowGadget):
        (WebCore::RenderThemeArrowGadget::render):
        (WebCore::RenderThemeIconGadget::RenderThemeIconGadget):
        (WebCore::RenderThemeIconGadget::gtkIconSizeForPixelSize):
        (WebCore::RenderThemeIconGadget::render):
        (WebCore::RenderThemeIconGadget::minimumSize):
        * platform/gtk/RenderThemeGadget.h: Added.
        (WebCore::RenderThemeGadget::context):
        * rendering/RenderTheme.h:
        (WebCore::RenderTheme::innerSpinButtonLayout): Added this method to allow themes use a different layout for the
        buttons.
        * rendering/RenderThemeGtk.cpp:
        (WebCore::themeChangedCallback): Just moved this code to a common place.
        (WebCore::RenderThemeGtk::RenderThemeGtk): Initialize the theme monitor in the constructor.
        (WebCore::createStyleContext): Remove the render parts that are specific to GTK+ 3.20.
        (WebCore::RenderThemeGtk::adjustRepaintRect): Moved inside a GTK+ < 3.20 ifdef block.
        (WebCore::themePartStateFlags): Helper function to get the GtkStateFlags of a theme part for a given RenderObject.
        (WebCore::shrinkToMinimumSizeAndCenterRectangle): Move this common code to a helper function.
        (WebCore::setToggleSize):
        (WebCore::paintToggle):
        (WebCore::RenderThemeGtk::paintButton):
        (WebCore::RenderThemeGtk::popupInternalPaddingBox):
        (WebCore::RenderThemeGtk::paintMenuList):
        (WebCore::RenderThemeGtk::adjustTextFieldStyle): For GTK+ 3.20 we need to ensure a minimum size for spin buttons,
        so if the text field is for a spin button, we adjust the desired size here.
        (WebCore::RenderThemeGtk::paintTextField): In GTK+ 3.20 the CSS gadgets used to render spin buttons are
        different, so we check here if this is the entry of a spin button to use the right gadgets.
        (WebCore::adjustSearchFieldIconStyle):
        (WebCore::RenderThemeGtk::paintTextArea):
        (WebCore::RenderThemeGtk::adjustSearchFieldResultsButtonStyle):
        (WebCore::RenderThemeGtk::paintSearchFieldResultsButton):
        (WebCore::RenderThemeGtk::adjustSearchFieldResultsDecorationPartStyle):
        (WebCore::RenderThemeGtk::adjustSearchFieldCancelButtonStyle):
        (WebCore::paintSearchFieldIcon):
        (WebCore::RenderThemeGtk::paintSearchFieldResultsDecorationPart):
        (WebCore::RenderThemeGtk::paintSearchFieldCancelButton):
        (WebCore::centerRectVerticallyInParentInputElement): Moved inside a GTK+ < 3.20 ifdef block.
        (WebCore::RenderThemeGtk::paintSliderTrack):
        (WebCore::RenderThemeGtk::adjustSliderThumbSize):
        (WebCore::RenderThemeGtk::paintSliderThumb):
        (WebCore::RenderThemeGtk::progressBarRectForBounds): Ensure a minimum size of progress bars in GTK+ 3.20.
        (WebCore::RenderThemeGtk::paintProgressBar):
        (WebCore::RenderThemeGtk::innerSpinButtonLayout): Use an horizontal layout for spin buttons.
        (WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):
        (WebCore::RenderThemeGtk::paintInnerSpinButton):
        (WebCore::styleColor):
        (WebCore::RenderThemeGtk::paintMediaButton):
        * rendering/RenderThemeGtk.h:

2016-04-11  Antti Koivisto  <antti@apple.com>

        Implement functional :host() pseudo class
        https://bugs.webkit.org/show_bug.cgi?id=156397
        <rdar://problem/25621445>

        Reviewed by Darin Adler.

        We already support :host. Add functional syntax too.

        * css/CSSGrammar.y.in:

            Parse functional :host().

        * css/CSSParser.cpp:
        (WebCore::CSSParser::detectFunctionTypeToken):
        * css/CSSParserValues.cpp:
        (WebCore::CSSParserSelector::parsePseudoClassHostFunctionSelector):
        * css/CSSParserValues.h:
        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::matchedRuleList):
        (WebCore::ElementRuleCollector::addMatchedRule):

            Factor some shared code here.

        (WebCore::ElementRuleCollector::matchHostPseudoClassRules):

            Instead of using the generic paths use a :host specific code path for matching.
            This makes it easier to avoid :host matching when it shouldn't.

        (WebCore::ElementRuleCollector::collectMatchingRulesForList):
        * css/ElementRuleCollector.h:
        * css/RuleSet.cpp:
        (WebCore::computeMatchBasedOnRuleHash):

            :host is always handled by the special matching path.

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::match):
        (WebCore::SelectorChecker::matchHostPseudoClass):

            Add a function specifically for checking :host. In always fails on the normal code paths.
            Check the argument selector if provided.

        (WebCore::hasScrollbarPseudoElement):
        * css/SelectorChecker.h:

2016-04-11  Said Abou-Hallawa  <sabouhallawa@apple,com>

        Merge CG ImageSource and non CG ImageSource implementation in one file
        https://bugs.webkit.org/show_bug.cgi?id=155456

        Reviewed by Darin Adler.

        ImageSource for CG and CG code paths look very similar. All the platform
        specific code can be moved to ImageDecoder classes for CG and non CG. And
        we can have the ImageSource be platform independent and we get rid of
        ImageSourceCG.cpp.

        Test: fast/images/image-subsampling.html

        * CMakeLists.txt:
        * PlatformAppleWin.cmake:
        * PlatformMac.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        Delete ImageSourceCG.cpp form all make files and add ImageSource.cpp to
        CMakeLists.txt.
        
        * platform/Cursor.cpp:
        (WebCore::determineHotSpot):
        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::hotSpot):
        (WebCore::BitmapImage::getHotSpot): Deleted.
        * platform/graphics/BitmapImage.h:
        * platform/graphics/Image.h:
        (WebCore::Image::hotSpot):
        (WebCore::Image::getHotSpot): Deleted.
        Rename getHotSpot() to hotSpot() and change it to return Optional<IntPoint>.
        
        * platform/graphics/ImageSource.cpp:
        (WebCore::ImageSource::~ImageSource): Remove clear(true) call. It does nothing.
        (WebCore::ImageSource::clearFrameBufferCache): A wrapper which calls ImageDecoder::clearFrameBufferCache().
        (WebCore::ImageSource::clear): Calls clearFrameBufferCache() which will do nothing for CG.
        
        (WebCore::ImageSource::ensureDecoderIsCreated): Change SharedBuffer* to
        const SharedBuffer& and remove the call to ImageDecoder::setMaxNumPixels().
        The value of const static int CG ImageDecoder::m_maxNumPixels will be set
        based on IMAGE_DECODER_DOWN_SAMPLING.
        
        (WebCore::ImageSource::setData): Pass SharedBuffer& to the underlying functions.
        
        (WebCore::ImageSource::calculateMaximumSubsamplingLevel): Returns the maximum
        subsampling level allowed for an image.
        
        (WebCore::ImageSource::subsamplingLevelForScale): Converts from a scale to
        SubsamplingLevel taking into consideration the maximumSubsamplingLevel for
        a particular image.
        
        (WebCore::ImageSource::bytesDecodedToDetermineProperties): Returns the number
        of encoded bytes which can determine the image properties. For non CG it's
        zero. For CG it is a maximum value which can be corrected later.
        
        (WebCore::ImageSource::isSizeAvailable):
        (WebCore::ImageSource::sizeRespectingOrientation):
        (WebCore::ImageSource::frameCount):
        (WebCore::ImageSource::repetitionCount):
        (WebCore::ImageSource::filenameExtension):
        (WebCore::ImageSource::getHotSpot):
        (WebCore::ImageSource::frameIsCompleteAtIndex):
        (WebCore::ImageSource::frameHasAlphaAtIndex):
        (WebCore::ImageSource::allowSubsamplingOfFrameAtIndex):
        (WebCore::ImageSource::frameSizeAtIndex):
        (WebCore::ImageSource::frameBytesAtIndex):
        (WebCore::ImageSource::frameDurationAtIndex):
        (WebCore::ImageSource::orientationAtIndex):
        (WebCore::ImageSource::createFrameImageAtIndex):
        These are wrappers for the ImageDecoder APIs. The purpose of these functions
        is to ensure the ImageDecoder is created.
        
        (WebCore::ImageSource::dump): Called from BitmapImage::dump().
        
        (WebCore::ImageSource::getHotSpot): Deleted.
        
        * platform/graphics/ImageSource.h:
        (WebCore::ImageSource::setAllowSubsampling): Called from BitmapImage::setAllowSubsampling().
        
        (WebCore::ImageSource::maxPixelsPerDecodedImage): Deleted.
        (WebCore::ImageSource::setMaxPixelsPerDecodedImage): Deleted.
        Setting maxPixelsPerDecodedImage was moved to the non CG ImageDecoder.
        
        * platform/graphics/cg/ImageDecoderCG.cpp:
        (WebCore::ImageDecoder::setData): Change SharedBuffer* to SharedBuffer&.

        (WebCore::ImageDecoder::subsamplingLevelForScale): Deleted.
        The code was moved to ImageSource::subsamplingLevelForScale().
        
        * platform/graphics/cg/ImageDecoderCG.h:
        (WebCore::ImageDecoder::create): Make the prototype of this function
        suitable for CG and non CG cases.
        (WebCore::ImageDecoder::clearFrameBufferCache): Empty functions for CG.
        
        * platform/graphics/cg/ImageSourceCG.cpp: Removed.
        
        * platform/image-decoders/ImageDecoder.cpp:
        (WebCore::ImageDecoder::frameIsCompleteAtIndex): A mew function to return
        whether the frame decoding is complete or not.
        
        (WebCore::ImageDecoder::frameHasAlphaAtIndex): Simplify the logic.
        
        (WebCore::ImageDecoder::frameDurationAtIndex): The code was moved from
        ImageSource::frameDurationAtIndex() in ImageSource.cpp.
        
        (WebCore::ImageDecoder::createFrameImageAtIndex): The code was moved from
        ImageSource::createFrameImageAtIndex() in ImageSource.cpp.
        
        * platform/image-decoders/ImageDecoder.h:
        (WebCore::ImageDecoder::ImageDecoder): Initialize the members in class.
        (WebCore::ImageDecoder::~ImageDecoder): Fix the braces style.
        (WebCore::ImageDecoder::setData): Change the type of the argument from
        SharedBuffer* to SharedBuffer&.
        (WebCore::ImageDecoder::frameSizeAtIndex): Add the argument SubsamplingLevel
        so it can have the same prototype as CG.
        (WebCore::ImageDecoder::orientationAtIndex): Rename it to the same of CG.
        
        (WebCore::ImageDecoder::allowSubsamplingOfFrameAtIndex):
        (WebCore::ImageDecoder::bytesDecodedToDetermineProperties):
        (WebCore::ImageDecoder::subsamplingLevelForScale): Add these functions
        and return the default values so we do not have to add directive compiled
        non CG blocks in ImageSource.cpp.

        (WebCore::ImageDecoder::hotSpot): Return Optional<IntPoint>.
        
        (WebCore::ImageDecoder::orientation): Deleted.
        (WebCore::ImageDecoder::setMaxNumPixels): Deleted.
        
        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
        (WebCore::BMPImageDecoder::setData):
        * platform/image-decoders/bmp/BMPImageDecoder.h:
        * platform/image-decoders/gif/GIFImageDecoder.cpp:
        (WebCore::GIFImageDecoder::setData):
        (WebCore::GIFImageDecoder::decode):
        * platform/image-decoders/gif/GIFImageDecoder.h:
        * platform/image-decoders/gif/GIFImageReader.h:
        (GIFImageReader::setData):
        * platform/image-decoders/ico/ICOImageDecoder.cpp:
        (WebCore::ICOImageDecoder::setData):
        Use reference SharedBuffer instead of pointer SharedBuffer.
        
        (WebCore::ICOImageDecoder::hotSpot):
        (WebCore::ICOImageDecoder::hotSpotAtIndex):
        Change hotSpot() to return Optional<IntPoint>.
        * platform/image-decoders/ico/ICOImageDecoder.h:
                
        (WebCore::ICOImageDecoder::setDataForPNGDecoderAtIndex):
        Pass reference SharedBuffer instead of pointer SharedBuffer.

2016-04-11  Fujii Hironori  <Hironori.Fujii@jp.sony.com>

        [CMake] Make FOLDER property INHERITED
        https://bugs.webkit.org/show_bug.cgi?id=156460

        Reviewed by Brent Fulgham.

        * CMakeLists.txt:
        Set FOLDER property as a directory property not a target property

2016-04-10  Sam Weinig  <sam@webkit.org>

        Fix the build.

        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
        (WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):

2016-04-08  Sam Weinig  <sam@webkit.org>

        Remove support for custom target picker actions
        <rdar://problem/24987783>
        https://bugs.webkit.org/show_bug.cgi?id=156434

        Reviewed by Eric Carlson.

        This mostly entailed rolling out r197429 and r197569.

        * Modules/mediasession/WebMediaSessionManager.cpp:
        (WebCore::WebMediaSessionManager::removeAllPlaybackTargetPickerClients):
        (WebCore::WebMediaSessionManager::showPlaybackTargetPicker):
        (WebCore::WebMediaSessionManager::clientStateDidChange):
        (WebCore::WebMediaSessionManager::externalOutputDeviceAvailableDidChange):
        (WebCore::WebMediaSessionManager::configureNewClients):
        (WebCore::WebMediaSessionManager::customPlaybackActionSelected): Deleted.
        * Modules/mediasession/WebMediaSessionManager.h:
        * Modules/mediasession/WebMediaSessionManagerClient.h:
        * dom/Document.cpp:
        (WebCore::Document::removePlaybackTargetPickerClient):
        (WebCore::Document::showPlaybackTargetPicker):
        (WebCore::Document::playbackTargetPickerClientStateDidChange):
        (WebCore::Document::setShouldPlayToPlaybackTarget):
        (WebCore::Document::customPlaybackActionSelected): Deleted.
        * dom/Document.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::enqueuePlaybackTargetAvailabilityChangedEvent):
        (WebCore::HTMLMediaElement::setShouldPlayToPlaybackTarget):
        (WebCore::HTMLMediaElement::webkitCurrentPlaybackTargetIsWireless):
        (WebCore::HTMLMediaElement::customPlaybackActionSelected): Deleted.
        (WebCore::HTMLMediaElement::playbackTargetPickerCustomActionName): Deleted.
        * html/HTMLMediaElement.h:
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::showPlaybackTargetPicker):
        (WebCore::MediaElementSession::hasWirelessPlaybackTargets):
        (WebCore::MediaElementSession::setShouldPlayToPlaybackTarget):
        (WebCore::MediaElementSession::mediaStateDidChange):
        (WebCore::MediaElementSession::customPlaybackActionSelected): Deleted.
        * html/MediaElementSession.h:
        * page/ChromeClient.h:
        * page/Page.cpp:
        (WebCore::Page::removePlaybackTargetPickerClient):
        (WebCore::Page::showPlaybackTargetPicker):
        (WebCore::Page::setShouldPlayToPlaybackTarget):
        (WebCore::Page::ensureTestTrigger):
        (WebCore::Page::customPlaybackActionSelected): Deleted.
        * page/Page.h:
        (WebCore::Page::testTrigger):
        * platform/audio/PlatformMediaSession.h:
        (WebCore::PlatformMediaSessionClient::canPlayToWirelessPlaybackTarget):
        (WebCore::PlatformMediaSessionClient::isPlayingToWirelessPlaybackTarget):
        (WebCore::PlatformMediaSessionClient::setShouldPlayToPlaybackTarget):
        (WebCore::PlatformMediaSessionClient::customPlaybackActionSelected): Deleted.
        * platform/graphics/MediaPlaybackTargetClient.h:
        * platform/graphics/MediaPlaybackTargetPicker.cpp:
        (WebCore::MediaPlaybackTargetPicker::pendingActionTimerFired):
        (WebCore::MediaPlaybackTargetPicker::addPendingAction):
        (WebCore::MediaPlaybackTargetPicker::showPlaybackTargetPicker):
        * platform/graphics/MediaPlaybackTargetPicker.h:
        (WebCore::MediaPlaybackTargetPicker::availableDevicesDidChange):
        (WebCore::MediaPlaybackTargetPicker::currentDeviceDidChange):
        (WebCore::MediaPlaybackTargetPicker::Client::customPlaybackActionSelected): Deleted.
        (WebCore::MediaPlaybackTargetPicker::customPlaybackActionSelected): Deleted.
        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.h:
        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
        (WebCore::MediaPlaybackTargetPickerMac::devicePicker):
        (WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):
        * platform/mac/WebVideoFullscreenInterfaceMac.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::preparedToReturnToInline):
        (WebCore::WebVideoFullscreenInterfaceMac::setVideoDimensions):
        (WebCore::WebVideoFullscreenInterfaceMac::setExternalPlayback): Deleted.
        * platform/mock/MediaPlaybackTargetPickerMock.cpp:
        (WebCore::MediaPlaybackTargetPickerMock::timerFired):
        (WebCore::MediaPlaybackTargetPickerMock::showPlaybackTargetPicker):
        * platform/mock/MediaPlaybackTargetPickerMock.h:
        * platform/spi/cocoa/AVKitSPI.h:

2016-04-09  Konstantin Tokarev  <annulen@yandex.ru>

        Fixed compilation of JPEGImageDecoder with libjpeg v9.
        https://bugs.webkit.org/show_bug.cgi?id=156445

        Reviewed by Michael Catanzaro.

        ICU defines TRUE and FALSE macros, breaking libjpeg v9 headers.

        No new tests needed.

        * platform/image-decoders/jpeg/JPEGImageDecoder.h:

2016-04-09  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r199242.
        https://bugs.webkit.org/show_bug.cgi?id=156442

        Caused many many leaks (Requested by ap on #webkit).

        Reverted changeset:

        "Web Inspector: get rid of InspectorBasicValue and
        InspectorString subclasses"
        https://bugs.webkit.org/show_bug.cgi?id=156407
        http://trac.webkit.org/changeset/199242

2016-04-09  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r199268.
        https://bugs.webkit.org/show_bug.cgi?id=156440

        Broke Windows build (Requested by ap on #webkit).

        Reverted changeset:

        "Implement functional :host() pseudo class"
        https://bugs.webkit.org/show_bug.cgi?id=156397
        http://trac.webkit.org/changeset/199268

2016-04-09  Antti Koivisto  <antti@apple.com>

        Implement functional :host() pseudo class
        https://bugs.webkit.org/show_bug.cgi?id=156397
        <rdar://problem/25621445>

        Reviewed by Darin Adler.

        We already support :host. Add functional syntax too.

        * css/CSSGrammar.y.in:

            Parse functional :host().

        * css/CSSParser.cpp:
        (WebCore::CSSParser::detectFunctionTypeToken):
        * css/CSSParserValues.cpp:
        (WebCore::CSSParserSelector::parsePseudoClassHostFunctionSelector):
        * css/CSSParserValues.h:
        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::matchedRuleList):
        (WebCore::ElementRuleCollector::addMatchedRule):

            Factor some shared code here.

        (WebCore::ElementRuleCollector::matchHostPseudoClassRules):

            Instead of using the generic paths use a :host specific code path for matching.
            This makes it easier to avoid :host matching when it shouldn't.

        (WebCore::ElementRuleCollector::collectMatchingRulesForList):
        * css/ElementRuleCollector.h:
        * css/RuleSet.cpp:
        (WebCore::computeMatchBasedOnRuleHash):

            :host is always handled by the special matching path.

        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::match):
        (WebCore::SelectorChecker::matchHostPseudoClass):

            Add a function specifically for checking :host. In always fails on the normal code paths.
            Check the argument selector if provided.

        (WebCore::hasScrollbarPseudoElement):
        * css/SelectorChecker.h:

2016-04-07  Darin Adler  <darin@apple.com>

        Improve IDL support for object arguments that are neither optional nor nullable
        https://bugs.webkit.org/show_bug.cgi?id=156149

        Reviewed by Chris Dumez.

        After this patch, we are almost ready to change some more DOM functions to
        use references instead of pointers. Remaining blocking issue is lack of support
        for ShouldPassWrapperByReference in the gobject bindings.

        * bindings/objc/ExceptionHandlers.h: Add NO_RETURN to raiseDOMException.
        Added a new raiseTypeErrorException. Re-indented header and removed unneeded
        include and forward declarations.

        * bindings/objc/ExceptionHandlers.mm:
        (WebCore::raiseDOMException): Added RELEASE_ASSERT_NOT_REACHED so the compiler
        will understand this is NO_RETURN. Also updated FIXME comment.
        (WebCore::raiseTypeErrorException): Added.

        * bindings/scripts/CodeGenerator.pm: Removed unneeded code that allows the type
        "AtomicString" in IDL files.
        (ShouldPassWrapperByReference): Added. Contains the logic from the function in
        the JavaScript code generator that was named IsPointerParameterPassedByReference,
        minus a couple checks that are unneeded. For use in other code generators so they
        are all consistent about how they call the DOM implementation.

        * bindings/scripts/CodeGeneratorGObject.pm:
        (SkipFunction): Removed support for unused CustomBinding extended attribute.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader): Removed support for unused CustomBinding extended attribute.
        (GenerateImplementation): Ditto. Also changed type checking code to throw a
        type error in a more efficient way, using throwVMTypeError directly.
        (GenerateParametersCheck): Rearranged code a bit so that arguments that need to
        be passed in unusual ways are handled all in one place. Use WTFMove for newly
        created NodeFilter objects. Simplified the reference logic so it doesn't need
        to do an additional check to see if a type is a callback. Also changed type
        checking code to throw a type error in a more efficient way, using throwVMTypeError
        directly. Also corrected mistake where null checking code was throwing
        TYPE_MISMATCH_ERR instead of a type error.
        (GetNativeType): Coding style tweak.
        (ShouldPassWrapperByReference): Renamed from IsPointerParameterPassedByReference.
        Changed to call underlying ShouldPassWrapperByReference function in the language-
        independent code generator.
        (GenerateConstructorDefinition): Updated for name change.

        * bindings/scripts/CodeGeneratorObjC.pm:
        (SkipFunction): Removed support for unused CustomBinding extended attribute.
        (GenerateImplementation): Added code to null check and pass a reference when
        ShouldPassWrapperByReference returns true.

        * bindings/scripts/IDLAttributes.txt: Sorted in the AppleCopyright and
        UsePointersEvenForNonNullableObjectArguments arguments. Removed the unused
        CPPPureInterface and CustomBinding attributes.

        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp: Regenerated test results.
        * bindings/scripts/test/JS/JSTestInterface.cpp: Ditto.
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp: Ditto.
        * bindings/scripts/test/JS/JSTestObj.cpp: Ditto.
        * bindings/scripts/test/JS/JSTestObj.h: Ditto.
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp: Ditto.
        * bindings/scripts/test/JS/JSTestTypedefs.cpp: Ditto.
        * bindings/scripts/test/ObjC/DOMTestActiveDOMObject.mm: Ditto.
        * bindings/scripts/test/ObjC/DOMTestCallback.mm: Ditto.
        * bindings/scripts/test/ObjC/DOMTestCallbackFunction.mm: Ditto.
        * bindings/scripts/test/ObjC/DOMTestInterface.mm: Ditto.
        * bindings/scripts/test/ObjC/DOMTestMediaQueryListListener.mm: Ditto.
        * bindings/scripts/test/ObjC/DOMTestObj.mm: Ditto.

        * bindings/scripts/test/TestObj.idl: Removed test for CustomBinding.

        * dom/DOMImplementation.idl: Fixed #if so that only the return type is different
        between JavaScript and the other bindings. Without this change, the different
        bindings got different results for ShouldPassWrapperByReference. Also formatted
        functions all on a single line.

        * dom/EventListener.idl: Removed CPPPureInterface, since it had no effect.
        * dom/EventTarget.idl: Ditto.

2016-04-08  Chris Dumez  <cdumez@apple.com>

        [WebIDL] Add support for [ExportMacro=XXX] IDL extended attribute
        https://bugs.webkit.org/show_bug.cgi?id=156428

        Reviewed by Ryosuke Niwa.

        Add support for [ExportMacro=XXX] IDL extended attribute (e.g. [ExportMacro=WEBCORE_EXPORT])
        so developers can indicate in the IDL which macro to use to export the generated JS bindings
        class.

        We previously supported this by hard-coding JS class names in the bindings generator which
        was ugly.

        * Modules/mediasession/MediaSession.idl:
        * Modules/mediasource/SourceBuffer.idl:
        * Modules/notifications/Notification.idl:
        * Modules/webaudio/AudioContext.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GetExportMacroForJSClass):
        (GenerateHeader):
        (AddIncludesForType): Deleted.
        (AddToImplIncludes): Deleted.
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/TestInterface.idl:
        * bindings/scripts/test/TestNode.idl:
        * css/CSSStyleDeclaration.idl:
        * dom/ClientRect.idl:
        * dom/ClientRectList.idl:
        * dom/Document.idl:
        * dom/Element.idl:
        * dom/Node.idl:
        * dom/Range.idl:
        * fileapi/File.idl:
        * html/DOMURL.idl:
        * html/HTMLElement.idl:
        * html/HTMLMediaElement.idl:
        * html/TimeRanges.idl:
        * html/canvas/DOMPath.idl:
        * inspector/ScriptProfile.idl:
        * inspector/ScriptProfileNode.idl:
        * page/DOMWindow.idl:
        * page/make_settings.pl:
        (generateInternalSettingsIdlFile):
        * testing/InternalSettings.idl:
        * testing/Internals.idl:
        * testing/MallocStatistics.idl:
        * testing/MemoryInfo.idl:
        * testing/TypeConversions.idl:
        * xml/XMLHttpRequest.idl:

2016-04-08  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: XHRs and Web Worker scripts are not searchable
        https://bugs.webkit.org/show_bug.cgi?id=154214
        <rdar://problem/24643587>

        Reviewed by Timothy Hatcher.

        Test: inspector/page/searchInResources.html

        * inspector/InspectorPageAgent.h:
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::searchInResource):
        (WebCore::InspectorPageAgent::searchInResources):
        Let the NetworkAgent handle individual search requests
        with a requestId. And provide global search results for
        "other" resources and will include requestId properties.

        * inspector/InspectorNetworkAgent.h:
        * inspector/InspectorNetworkAgent.cpp:
        (WebCore::InspectorNetworkAgent::didFinishXHRLoading):
        (WebCore::buildObjectForSearchResult):
        (WebCore::InspectorNetworkAgent::searchOtherRequests):
        (WebCore::InspectorNetworkAgent::searchInRequest):
        Search saved "other" resource data content.

        * inspector/NetworkResourcesData.h:
        * inspector/NetworkResourcesData.cpp:
        (WebCore::NetworkResourcesData::resources):
        Expose the resources for iteration by the NetworkAgent.

2016-04-08  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: "AXLandmarkApplication" is an inappropriate subrole for ARIA "application" since it's no longer a landmark
        https://bugs.webkit.org/show_bug.cgi?id=155403

        Reviewed by Chris Fleizach.

        The new subrole is AXWebApplication and the new role description is "web application".
        As part of the fix, the WebCore AccessibilityRole for ARIA's "application" role was
        renamed from LandmarkApplicationRole to WebApplicationRole.

        The roles-exposed.html and aria-grouping-roles.html test expectations were also updated.

        * English.lproj/Localizable.strings:
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::accessibleNameDerivesFromContent):
        (WebCore::AccessibilityObject::isLandmark):
        (WebCore::initializeRoleMap):
        * accessibility/AccessibilityObject.h:
        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (atkRole):
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper determineIsAccessibilityElement]):
        (-[WebAccessibilityObjectWrapper _accessibilityIsLandmarkRole:]):
        * accessibility/mac/WebAccessibilityObjectWrapperBase.mm:
        (-[WebAccessibilityObjectWrapperBase ariaLandmarkRoleDescription]):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (createAccessibilityRoleMap):
        (-[WebAccessibilityObjectWrapper subrole]):
        * platform/LocalizedStrings.cpp:
        (WebCore::AXARIAContentGroupText):

2016-04-08  Simon Fraser  <simon.fraser@apple.com>

        [iOS WK2] WKWebViews should consult ancestor UIScrollViews to determine tiling area
        https://bugs.webkit.org/show_bug.cgi?id=156429
        rdar://problem/25455111

        Reviewed by Tim Horton.

        When a WKWebView is expanded to full size, then embedded in UIScrollView, it would
        create huge tiles that cover the entire view area (since it considered itself non-scrollable).

        Fix to always use 512x512 tiles in this configuration, and to adjust the tile coverage
        for the area exposed through the enclosing UIScrollView.

        * loader/HistoryController.cpp:
        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem): setObscuredInset()
        moved from FrameView to Page.
        * page/FrameView.cpp:
        (WebCore::FrameView::adjustTiledBackingScrollability): If we're clipped by an ancestor scrollView,
        just assume we're scrollable on both axes.
        * page/Page.h:
        (WebCore::Page::obscuredInset):
        (WebCore::Page::setObscuredInset):
        (WebCore::Page::enclosedInScrollView):
        (WebCore::Page::setEnclosedInScrollView):
        * platform/ScrollView.h:
        (WebCore::ScrollView::platformObscuredInset): Deleted.
        (WebCore::ScrollView::platformSetObscuredInset): Deleted.

2016-04-08  Joseph Pecoraro  <pecoraro@apple.com>

        [iOS Simulator] Build failure (property 'contentsFormat' not found on object of type 'LegacyTileLayer *')
        https://bugs.webkit.org/show_bug.cgi?id=156415

        Reviewed by Simon Fraser.

        * platform/spi/cocoa/QuartzCoreSPI.h:
        Provide SPI forward declaration of the CALayer contentsFormat property.

2016-04-08  Alex Christensen  <achristensen@webkit.org>

        Progress towards running CMake WebKit2 on Mac
        https://bugs.webkit.org/show_bug.cgi?id=156426

        Reviewed by Tim Horton.

        * CMakeLists.txt:
        * PlatformGTK.cmake:
        * PlatformMac.cmake:
        * PlatformWin.cmake:
        On Mac, WTF is a static library that is linked only with JavaScriptCore.

2016-04-08  Jer Noble  <jer.noble@apple.com>

        Unreviewed 32-bit build fix; make type of std::min<> explicit.

        * platform/audio/ios/AudioDestinationIOS.cpp:
        (WebCore::AudioDestinationIOS::render):

2016-04-08  Jer Noble  <jer.noble@apple.com>

        CRASH in AudioDestinationNode::render()
        https://bugs.webkit.org/show_bug.cgi?id=156308

        Reviewed by Eric Carlson.

        Yet another math error in AudioDestinationIOS::render(). It is possible for the difference between
        m_startSpareFrame and m_endSpareFrame to be greater than the numberOfFrames to be rendered. Protect
        against this case by taking the min() of those two values and only advancing m_startSpareFrame by
        that amount.  This guarantees that framesThisTime will never underflow, and that data will not be
        written past the end of the ioData parameter.

        * platform/audio/ios/AudioDestinationIOS.cpp:
        (WebCore::AudioDestinationIOS::render):

2016-04-08  Brady Eidson  <beidson@apple.com>

        Modern IDB: Use more IDBValue and IDBGetResult in IDBBackingStore.
        https://bugs.webkit.org/show_bug.cgi?id=156418

        Reviewed by Alex Christensen.

        No new tests (Refactor, no change in behavior).

        * Modules/indexeddb/IDBValue.cpp:
        (WebCore::IDBValue::IDBValue):
        * Modules/indexeddb/IDBValue.h:
        
        * Modules/indexeddb/server/IDBBackingStore.h:
        
        * Modules/indexeddb/server/MemoryBackingStoreTransaction.cpp:
        (WebCore::IDBServer::MemoryBackingStoreTransaction::abort):
        
        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::addRecord):
        (WebCore::IDBServer::MemoryIDBBackingStore::getRecord):
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:
        
        * Modules/indexeddb/server/MemoryObjectStore.cpp:
        (WebCore::IDBServer::MemoryObjectStore::addRecord):
        * Modules/indexeddb/server/MemoryObjectStore.h:
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getRecord):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd):
        (WebCore::IDBServer::UniqueIDBDatabase::performGetRecord):

2016-04-08  Brady Eidson  <beidson@apple.com>

        Modern IDB: Make IDBGetResult contain an IDBValue instead of a buffer, and remove unused methods.
        https://bugs.webkit.org/show_bug.cgi?id=156416

        Reviewed by Alex Christensen.

        No new tests (Refactor, no change in behavior).

        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::setGetResult):
        
        * Modules/indexeddb/IDBGetResult.cpp:
        (WebCore::IDBGetResult::dataFromBuffer):
        (WebCore::IDBGetResult::isolatedCopy):
        * Modules/indexeddb/IDBGetResult.h:
        (WebCore::IDBGetResult::IDBGetResult):
        (WebCore::IDBGetResult::value):
        (WebCore::IDBGetResult::encode):
        (WebCore::IDBGetResult::decode):
        (WebCore::IDBGetResult::valueBuffer): Deleted.
        (WebCore::IDBGetResult::setValueBuffer): Deleted.
        (WebCore::IDBGetResult::setKeyData): Deleted.
        (WebCore::IDBGetResult::setPrimaryKeyData): Deleted.
        (WebCore::IDBGetResult::setKeyPath): Deleted.
        
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::didGetRecordOnServer):
        
        * Modules/indexeddb/IDBValue.cpp:
        (WebCore::IDBValue::IDBValue):
        * Modules/indexeddb/IDBValue.h:
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::getIndexRecord):

2016-04-08  Zalan Bujtas  <zalan@apple.com>

        Focus ring drawn at incorrect location on image map with CSS transform.
        https://bugs.webkit.org/show_bug.cgi?id=143527
        <rdar://problem/21908735>

        Reviewed by Simon Fraser.

        Implement pathForFocusRing for HTMLAreaElement. It follows the logic of RenderObject::addFocusRingRects().

        Tests: fast/images/image-map-outline-in-positioned-container.html
               fast/images/image-map-outline-with-paint-root-offset.html
               fast/images/image-map-outline-with-scale-transform.html
               fast/images/image-map-outline.html

        * html/HTMLAreaElement.cpp:
        (WebCore::HTMLAreaElement::pathForFocusRing):
        * html/HTMLAreaElement.h:
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::paintFocusRing): Move addFocusRingRects() out of focus ring painting.
        (WebCore::RenderElement::paintOutline):
        * rendering/RenderElement.h:
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::paint):
        (WebCore::RenderImage::paintAreaElementFocusRing):
        * rendering/RenderImage.h:
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::paintOutline):

2016-04-08  Brent Fulgham  <bfulgham@apple.com>

        [WK1] Wheel event callback removing the window causes crash in WebCore
        https://bugs.webkit.org/show_bug.cgi?id=156409
        <rdar://problem/25631267>

        Reviewed by Simon Fraser.

        Null check the Widget before using it, since the iframe may have been removed
        from its parent document inside the event handler.

        This is the WK1 fix for https://bugs.webkit.org/show_bug.cgi?id=150871.

        Tested by fast/events/wheel-event-destroys-frame.html

        * page/EventHandler.cpp:
        (WebCore::widgetForElement): Added.
        (WebCore::EventHandler::handleWheelEvent): Use new helper function to
        clean up the code, and allow us to check that the Widget has not been
        destroyed during the event handler.

2016-04-08  Said Abou-Hallawa  <sabouhallawa@apple,com>

        Timing attack on SVG feComposite filter circumvents same-origin policy
        https://bugs.webkit.org/show_bug.cgi?id=154338

        Reviewed by Oliver Hunt.

        Ensure the FEComposite arithmetic filter is clamping the resulted color
        components in a constant time.

        * platform/graphics/filters/FEComposite.cpp:
        (WebCore::clampByte):
        (WebCore::computeArithmeticPixels):

2016-04-08  Brian Burg  <bburg@apple.com>

        Web Inspector: get rid of InspectorBasicValue and InspectorString subclasses
        https://bugs.webkit.org/show_bug.cgi?id=156407
        <rdar://problem/25627659>

        Reviewed by Timothy Hatcher.

        * inspector/InspectorDatabaseAgent.cpp: Don't use deleted subclasses.

2016-04-08  Beth Dakin  <bdakin@apple.com>

        Fix leaks in WebAVMediaSelectionOptionMac and WebPlaybackControlsManager
        https://bugs.webkit.org/show_bug.cgi?id=156379

        Reviewed by Tim Horton.

        These classes should use RetainPtrs.
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (-[WebAVMediaSelectionOptionMac localizedDisplayName]):
        (-[WebAVMediaSelectionOptionMac setLocalizedDisplayName:]):
        (-[WebPlaybackControlsManager timing]):
        (-[WebPlaybackControlsManager setTiming:]):
        (-[WebPlaybackControlsManager seekableTimeRanges]):
        (-[WebPlaybackControlsManager setSeekableTimeRanges:]):
        (-[WebPlaybackControlsManager audioMediaSelectionOptions]):
        (-[WebPlaybackControlsManager setAudioMediaSelectionOptions:]):
        (-[WebPlaybackControlsManager currentAudioMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentAudioMediaSelectionOption:]):
        (-[WebPlaybackControlsManager legibleMediaSelectionOptions]):
        (-[WebPlaybackControlsManager setLegibleMediaSelectionOptions:]):
        (-[WebPlaybackControlsManager currentLegibleMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentLegibleMediaSelectionOption:]):

2016-04-08  Fujii Hironori  <Hironori.Fujii@jp.sony.com>

        Touching any IDL files rebuilds all bindings in CMake Ninja build
        https://bugs.webkit.org/show_bug.cgi?id=156400

        Reviewed by Brent Fulgham.

        * bindings/scripts/preprocess-idls.pl:
        (GenerateConstructorAttribute):
        WriteFileIfChanged does not work due to flaky results of 'keys'.
        Sort results of 'keys'.

2016-04-07  Simon Fraser  <simon.fraser@apple.com>

        [iOS WK2] Stop using exposedContentRect for history scroll state restoration
        https://bugs.webkit.org/show_bug.cgi?id=156392

        Reviewed by Tim Horton.

        A future commit will alter the meaning of exposedContentRect on iOS to take into
        account clipped out parts of the WKWebView. To achieve this, wean history restoration
        off of using exposedContentRect for scroll state restoration. It did this to restore
        the page to the same position relative to the view's top-left (to avoid jiggles caused
        by changing obscured insets).

        Do this by pushing the left/top obscured insets down with visible content rects updates,
        storing them on ScrollView, and adding them to HistoryItem. Those insets are then used
        for scroll state restoration in WKWebView.

        * history/HistoryItem.cpp:
        (WebCore::HistoryItem::HistoryItem):
        * history/HistoryItem.h:
        (WebCore::HistoryItem::obscuredInset):
        (WebCore::HistoryItem::setObscuredInset):
        * loader/HistoryController.cpp:
        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
        * platform/ScrollView.h:
        (WebCore::ScrollView::platformObscuredInset):
        (WebCore::ScrollView::platformSetObscuredInset):

2016-04-08  Brady Eidson  <beidson@apple.com>

        Build fix followup to http://trac.webkit.org/changeset/199230

        Unreviewed.

        * platform/posix/FileSystemPOSIX.cpp:
        (WebCore::hardLinkOrCopyFile): Stricter POSIX systems require a umask for O_CREAT opens,
          so let's provide one.

2016-04-08  Darin Adler  <darin@apple.com>

        Remove 14 more unnecessary uses of UsePointersEvenForNonNullableObjectArguments
        https://bugs.webkit.org/show_bug.cgi?id=156405

        Reviewed by Chris Dumez.

        * Modules/encryptedmedia/MediaKeySession.idl:
        * Modules/encryptedmedia/MediaKeys.idl:
        * dom/Element.idl:
        * dom/NamedNodeMap.idl:
        * html/HTMLElement.idl:
        * html/canvas/OESVertexArrayObject.idl:
        * html/canvas/WebGLRenderingContext.idl:
        * page/DOMSelection.idl:
        * storage/StorageEvent.idl:
        * svg/SVGSVGElement.idl:
        * xml/XMLSerializer.idl:
        * xml/XPathEvaluator.idl:
        * xml/XPathExpression.idl:
        * xml/XSLTProcessor.idl:
        Removed UsePointersEvenForNonNullableObjectArguments, which was having no effect
        in any of these classes. Also tweaked formatting of some of the IDL, merging things
        onto single lines, changing paragraphing and indenting a bit, and fixing some typos.

2016-04-08  Brady Eidson  <beidson@apple.com>

        Modern IDB (Blob support): Write blobs to temporary files and move them to the correct location when storing them.
        https://bugs.webkit.org/show_bug.cgi?id=156321

        Reviewed by Alex Christensen, Andy Estes, and Darin Adler.

        No new tests (No testable change in behavior yet, current tests pass).

        When asked to store a Blob (including Files) in IndexedDB, the Blob is written out to a temporary file.
        
        Then when the putOrAdd request is received by IDBServer it includes a list of blobURLs and their mappings
        to temporary files.
        
        Finally, as part of storing the Blob value in the database, those temporary files are moved in to place
        under the IndexedDB directory for storage and later retrieval.

        * Modules/indexeddb/IDBValue.cpp:
        (WebCore::IDBValue::IDBValue):

        * Modules/indexeddb/server/IDBBackingStore.h:
        (WebCore::IDBServer::IDBBackingStoreTemporaryFileHandler::~IDBBackingStoreTemporaryFileHandler):

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::create):
        (WebCore::IDBServer::IDBServer::IDBServer):
        (WebCore::IDBServer::IDBServer::createBackingStore):
        * Modules/indexeddb/server/IDBServer.h:

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::blobRecordsTableSchema):
        (WebCore::IDBServer::blobRecordsTableSchemaAlternate):
        (WebCore::IDBServer::blobFilesTableSchema):
        (WebCore::IDBServer::blobFilesTableSchemaAlternate):
        (WebCore::IDBServer::SQLiteIDBBackingStore::SQLiteIDBBackingStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::ensureValidBlobTables):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo):
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
        (WebCore::IDBServer::SQLiteIDBBackingStore::temporaryFileHandler):

        * Modules/indexeddb/server/SQLiteIDBTransaction.cpp:
        (WebCore::IDBServer::SQLiteIDBTransaction::commit):
        (WebCore::IDBServer::SQLiteIDBTransaction::moveBlobFilesIfNecessary):
        (WebCore::IDBServer::SQLiteIDBTransaction::abort):
        (WebCore::IDBServer::SQLiteIDBTransaction::reset):
        (WebCore::IDBServer::SQLiteIDBTransaction::addBlobFile):
        * Modules/indexeddb/server/SQLiteIDBTransaction.h:

        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::InProcessIDBServer):
        (WebCore::InProcessIDBServer::accessToTemporaryFileComplete):
        * Modules/indexeddb/shared/InProcessIDBServer.h:

        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::blobURLsIsolatedCopy):
        * bindings/js/SerializedScriptValue.h:

        * platform/FileSystem.h:
        * platform/gtk/FileSystemGtk.cpp:
        (WebCore::hardLinkOrCopyFile):
        * platform/posix/FileSystemPOSIX.cpp:
        (WebCore::hardLinkOrCopyFile):

2016-04-08  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: [ATK] Crash getting text under element in CSS table
        https://bugs.webkit.org/show_bug.cgi?id=156328

        Reviewed by Chris Fleizach.

        AccessibilityRenderObject::textUnderElement() assumes (and asserts) that
        the first and last child of an anonymous block will each have nodes with
        which to define positions. This is not the case for CSS Tables and their
        anonymous descendants. AccessibilityNodeObject:textUnderElement() is our
        fallback for the instances where a text range cannot be created based on
        positions, so let it handle anonymous RenderTable parts.

        Test: accessibility/generated-content-with-display-table-crash.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::textUnderElement):
        (WebCore::AccessibilityRenderObject::shouldGetTextFromNode):
        * accessibility/AccessibilityRenderObject.h:

2016-04-08  Darin Adler  <darin@apple.com>

        Remove unneeded UsePointersEvenForNonNullableObjectArguments from event classes
        https://bugs.webkit.org/show_bug.cgi?id=156396

        Reviewed by Youenn Fablet.

        * dom/CompositionEvent.idl:
        * dom/KeyboardEvent.idl:
        * dom/MouseEvent.idl:
        * dom/MutationEvent.idl:
        * dom/TextEvent.idl:
        * dom/TouchEvent.idl:
        * dom/UIEvent.idl:
        * dom/WheelEvent.idl:
        Removed UsePointersEvenForNonNullableObjectArguments, which was having no effect.

2016-04-08  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Fix positioned items with grid gaps
        https://bugs.webkit.org/show_bug.cgi?id=156288

        Reviewed by Darin Adler.

        When we place a positioned items in a grid with gaps,
        we were not taking into accounts the gutter size.
        We've to use that size to properly place and size the item.

        Tests: fast/css-grid-layout/grid-positioned-items-gaps-rtl.html
               fast/css-grid-layout/grid-positioned-items-gaps.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):

2016-04-08  Javier Fernandez  <jfernandez@igalia.com>

        [css-grid] Remove unnecessary iteration in populateGridPositions loop
        https://bugs.webkit.org/show_bug.cgi?id=156376

        Reviewed by Darin Adler.

        The populateGridPositions loop limit was set to 'lastLine'. However, the
        the position of last track's start line is updated after the loop, since
        it does not follow the same pattern; it does not have a content
        distribution offset.

        So, since we are essentially overwriting the value stored in the last
        iteration, we can just lower the loop limit.

        No new tests added, because there is no change in the functionality.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::populateGridPositions):

2016-04-08  John Wilander  <wilander@apple.com>

        CSP: Block XHR when calling XMLHttpRequest.send() and throw network error.
        https://bugs.webkit.org/show_bug.cgi?id=153598
        <rdar://problem/24391483>

        Reviewed by Darin Adler.

        No new tests. Changes to existing tests are sufficient.

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::open):
        (WebCore::XMLHttpRequest::initSend):
            Moved the CSP check from XMLHttpRequest::open() to XMLHttpRequest::initSend().
            Changed the thrown error type from Security to Network for synchronous requests.
            Changed from throwing an error to firing an error event for asynchronous requests.
            These changes are in conformance with connect-src of Content Security Policy Level 2.
            https://www.w3.org/TR/CSP2/#directive-connect-src (W3C Candidate Recommendation, 21 July 2015)

2016-04-07  Darin Adler  <darin@apple.com>

        FontFaceSet binding does not handle null correctly
        https://bugs.webkit.org/show_bug.cgi?id=156141

        Reviewed by Youenn Fablet.

        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::FontFaceSet): Pass a reference to add rather than a pointer.
        (WebCore::FontFaceSet::has): Take a reference rather than a pointer.
        (WebCore::FontFaceSet::add): Ditto.
        (WebCore::FontFaceSet::remove): Ditto.
        (WebCore::FontFaceSet::load): Initialize ec since we check it. Caller is not required
        to do this, nor is the matchingFaces function. Rearranged function to avoid needless
        creation/destruction of PendingPromise for the immediate failure case. Removed some
        unneeded type casts and local variables.
        (WebCore::FontFaceSet::status): Use ASCIILiteral instead of ConstructFromLiteral.
        No reason to use the more aggressive optimization.
        (WebCore::FontFaceSet::faceFinished): Factored out a common hasReachedTerminalState
        check to streamline the logic a bit.
        (WebCore::FontFaceSet::load): Moved overload without a string in here; not critical
        to inline it.
        (WebCore::FontFaceSet::check): Ditto.

        * css/FontFaceSet.h: Removed many unneeded includes and forward declarations.
        Changed functions to take FontFace& instead of RefPtr<FontFace>. Removed unneeded
        WebCore namespace prefixes. Use final instead of override for virtual functions.

        * css/FontFaceSet.idl: Removed UsePointersEvenForNonNullableObjectArguments, which
        was preserving incorrect behavior for null as demonstrated by the test cases.

2016-04-07  Joseph Pecoraro  <pecoraro@apple.com>

        Remove ENABLE(ENABLE_ES6_CLASS_SYNTAX) guards
        https://bugs.webkit.org/show_bug.cgi?id=156384

        Reviewed by Ryosuke Niwa.

        * Configurations/FeatureDefines.xcconfig:

2016-04-07  Dean Jackson  <dino@apple.com>

        [iOS] Media playback button should use appearance
        https://bugs.webkit.org/show_bug.cgi?id=156388
        <rdar://problem/25618352>

        Reviewed by Simon Fraser.

        With the recent change in backdrop appearance, we can
        now use the system style directly for the play button.

        While I was here I also updated the artwork to the
        latest style (slightly rounded corners on the triangle).

        Covered by the test in ManualTests/ios/start-playback-button-appearance.html.

        * Modules/mediacontrols/mediaControlsiOS.css: Move the clip onto the backdrop
        element. Use an appearance insted.
        * Modules/mediacontrols/mediaControlsiOS.js: Remove the tint element, and
        set the highlight on the glyph instead.

2016-04-07  Ada Chan  <adachan@apple.com>

        Roll out the css change in mediaControlsApple.css that has been causing assertions in layout for multiple tests
        https://bugs.webkit.org/show_bug.cgi?id=156381

        Rubber-stamped by Alexey Proskuryakov.

        * Modules/mediacontrols/mediaControlsApple.css:
        (::-webkit-media-controls):
        Remove overflow: hidden.

2016-04-07  Jiewen Tan  <jiewen_tan@apple.com>

        Unreviewed, rolling out r199199.

        Revision breaks layout tests

        Reverted changeset:

        "fast/loader/opaque-base-url.html crashing during mac and ios
        debug tests"
        https://bugs.webkit.org/show_bug.cgi?id=156179
        http://trac.webkit.org/changeset/199199

2016-04-07  Simon Fraser  <simon.fraser@apple.com>

        Make it possible to test effect of view exposed rect on tiled backing
        https://bugs.webkit.org/show_bug.cgi?id=156365

        Reviewed by Tim Horton.

        Implement Internals::setViewExposedRect().

        When the viewExposedRect is non-null, assume that we're scrollable on both axes
        to avoid creation of huge tiles in this scenario.

        We also need to call adjustTiledBackingScrollability() when setViewExposedRect()
        has been called.

        Tests: tiled-drawing/tile-coverage-view-exposed-rect.html
               tiled-drawing/tile-size-view-exposed-rect.html

        * page/FrameView.cpp:
        (WebCore::FrameView::adjustTiledBackingScrollability):
        (WebCore::FrameView::setViewExposedRect):
        * testing/Internals.cpp:
        (WebCore::Internals::setViewExposedRect):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-04-07  Jiewen Tan  <jiewen_tan@apple.com>

        fast/loader/opaque-base-url.html crashing during mac and ios debug tests
        https://bugs.webkit.org/show_bug.cgi?id=156179
        <rdar://problem/25507719>

        Reviewed by Andy Estes.

        A relative URL other than "#" with a non-hierarchical base is invalid, but prior to this
        change the URL's string would still contain the invalid relative URL. To avoid mistakes
        where we might later treat this URL string as a parsed URL string, set the string to
        "about:blank" instead.

        Test: fast/url/data-uri-based-urls.html

        * platform/URL.cpp:
        (WebCore::URL::init):

2016-04-07  Brian Burg  <bburg@apple.com>

        Web Automation: implement Automation.addSingleCookie
        https://bugs.webkit.org/show_bug.cgi?id=156319
        <rdar://problem/25589605>

        Reviewed by Timothy Hatcher.

        * platform/Cookie.h: Document the units used by the 'expires' field.

2016-04-07  Jon Davis  <jond@apple.com>

        Add ImageBitmap as under consideration on Feature Status page
        https://bugs.webkit.org/show_bug.cgi?id=156362

        Reviewed by Timothy Hatcher.

        * features.json:

2016-04-07  Jon Davis  <jond@apple.com>

        Include Conical Gradients on the Feature Status page.
        https://bugs.webkit.org/show_bug.cgi?id=156363

        Reviewed by Timothy Hatcher.

        * features.json:

2016-04-07  Beth Dakin  <bdakin@apple.com>

        Build fix.

        * platform/mac/WebVideoFullscreenInterfaceMac.mm:

2016-04-07  Jeremy Jones  <jeremyj@apple.com>

        In WK1 WebVideoFullscreen interface may be accessed from WK1 main thread instead of UI thread.
        https://bugs.webkit.org/show_bug.cgi?id=154252
        rdar://problem/22460539

        Reviewed by Eric Carlson.

        In WebKit1, Javascript can cause enter fullscreen to happen on the main thead, which is not
        necessarily the UI thread. This can cause autolayout errors. Move this code to the UI thread.

        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        (WebVideoFullscreenControllerContext::setUpFullscreen): Move setup to the UI thread.
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (-[WebAVPlayerLayer layoutSublayers]): Move call to resolveBounds to the UI thread.

2016-04-07  Beth Dakin  <bdakin@apple.com>

        Build fix.

        * platform/mac/WebVideoFullscreenInterfaceMac.mm:

2016-04-07  Chris Dumez  <cdumez@apple.com>

        [WebIDL] Add support for [EnabledAtRuntime] attributes on non-global objects
        https://bugs.webkit.org/show_bug.cgi?id=156346

        Reviewed by Ryosuke Niwa.

        Add support for [EnabledAtRuntime] attributes on non-global objects by
        using the same approach as for [EnabledAtRuntime] operations. This means
        we add these attributes to the static property table but they get removed
        at runtime in JS*Prototype::finishCreation(), if the feature is disabled,
        after the eager reification of the prototype.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GeneratePropertiesHashTable):
        (GenerateImplementation):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_set_property):
        (webkit_dom_test_obj_get_property):
        (webkit_dom_test_obj_class_init):
        (webkit_dom_test_obj_enabled_at_runtime_operation):
        (webkit_dom_test_obj_get_enabled_at_runtime_attribute):
        (webkit_dom_test_obj_set_enabled_at_runtime_attribute):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjPrototype::finishCreation):
        (WebCore::jsTestObjEnabledAtRuntimeAttribute):
        (WebCore::setJSTestObjEnabledAtRuntimeAttribute):
        (WebCore::jsTestObjPrototypeFunctionEnabledAtRuntimeOperation1):
        (WebCore::jsTestObjPrototypeFunctionEnabledAtRuntimeOperation2):
        (WebCore::jsTestObjPrototypeFunctionEnabledAtRuntimeOperation):
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj enabledAtRuntimeAttribute]):
        (-[DOMTestObj setEnabledAtRuntimeAttribute:]):
        (-[DOMTestObj enabledAtRuntimeOperation:]):
        * bindings/scripts/test/TestObj.idl:

2016-04-07  Beth Dakin  <bdakin@apple.com>

        Attempted build fix.

        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (-[WebPlaybackControlsManager seekToTime:toleranceBefore:toleranceAfter:]):
        (-[WebPlaybackControlsManager setCurrentAudioMediaSelectionOption:]):
        (-[WebPlaybackControlsManager setCurrentLegibleMediaSelectionOption:]):
        (-[WebPlaybackControlsManager currentAudioMediaSelectionOption]): Deleted.
        (-[WebPlaybackControlsManager currentLegibleMediaSelectionOption]): Deleted.

2016-04-07  Ada Chan  <adachan@apple.com>

        Add WebKitAdditions extension point in HTMLVideoElement::supportsFullscreen()
        https://bugs.webkit.org/show_bug.cgi?id=156366

        Reviewed by Alex Christensen.

        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::supportsFullscreen):

2016-04-07  Jon Davis  <jond@apple.com>

        Add WOFF2 to the Feature Status page
        https://bugs.webkit.org/show_bug.cgi?id=156361

        Reviewed by Timothy Hatcher.

        * features.json:

2016-04-07  Beth Dakin  <bdakin@apple.com>

        WebPlaybackControlsManager should support mediaSelectionOptions
        https://bugs.webkit.org/show_bug.cgi?id=156358
        -and corresponding-
        rdar://problem/25048743

        Reviewed by Jer Noble.

        This patch just implements 
        WebVideoFullscreenInterfaceMac::setAudioMediaSelectionOptions and 
        WebVideoFullscreenInterfaceMac::setLegibleMediaSelectionOptions and passes that 
        information on to WebPlaybackControlsManager. If selection options are set via 
        the WebPlaybackControlsManager, then it gets the webVideoFullscreenModel() to 
        set the new value.

        * platform/mac/WebVideoFullscreenInterfaceMac.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (-[WebPlaybackControlsManager currentAudioMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentAudioMediaSelectionOption:]):
        (-[WebPlaybackControlsManager currentLegibleMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentLegibleMediaSelectionOption:]):
        (WebCore::mediaSelectionOptions):
        (WebCore::WebVideoFullscreenInterfaceMac::setAudioMediaSelectionOptions):
        (WebCore::WebVideoFullscreenInterfaceMac::setLegibleMediaSelectionOptions):
        (-[WebPlaybackControlsManager audioMediaSelectionOptions]): Deleted.
        (-[WebPlaybackControlsManager legibleMediaSelectionOptions]): Deleted.

2016-04-07  Brent Fulgham  <bfulgham@apple.com>

        Wheel event callback removing the window causes crash in WebCore.
        https://bugs.webkit.org/show_bug.cgi?id=150871
        <rdar://problem/23418283>

        Reviewed by Simon Fraser.

        Null check the FrameView before using it, since the iframe may have been removed
        from its parent document inside the event handler.
        
        The new test triggered a cross-load side-effect, where wheel event filtering wasn't
        reset between page loads. Fix by calling clearLatchedState() in EventHandler::clear(),
        which resets the filtering.

        Since the Frame destructor invokes EventHandler::clear, which invokes MainFrame methods,
        we run the risk of attempting to dereference destroyed MainFrame elements of the current
        Frame object. Instead, clear the EventHandler in the MainFrame destructor.

        Finally, confirm that the mainFrame member is not being destroyed in the handful of
        places that might attempt to access the mainFrame during object destruction (essentially
        cleanup methods).

        Test: fast/events/wheel-event-destroys-frame.html

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::clear): Protect against accessing mainFrame content during destruction.
        * page/EventHandler.cpp:
        (WebCore::EventHandler::clear): Call 'clearLatchedState' instead of endFilteringDeltas.
        (WebCore::EventHandler::clearLatchedState): Null-check the filter before calling it.
        * page/Frame.cpp:
        (WebCore::Frame::~Frame): Do not call 'setView' in the destructor for a MainFrame.
        (WebCore::Frame::setView): Check for a null event handler before invoking it.
        (WebCore::Frame::setMainFrameWasDestroyed): Added. Mark that the MainFrame
        member of the Frame is being destroyed (if the current Frame is a MainFrame) and clear
        the EventHandler member so that it doesn't attempt to access mainFrame content.
        (WebCore::Frame::mainFrame): When accessing the mainFrame member, assert that the
        mainFrame is not being destroyed.
        * page/MainFrame.cpp:
        (WebCore::MainFrame::~MainFrame): Set the m_recentWheelEventDeltaFilter to nullptr to
        prevent attempts to access it during object destruction. Call the new 'setMainFrameWasDestroyed'
        method to reset eventHandler and mark the MainFrame as being in the process of destruction.
        * page/WheelEventDeltaFilter.cpp:
        (WebCore::WheelEventDeltaFilter::filteredDelta): Add logging.
        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::platformCompleteWheelEvent): Add null check.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollTo): Add logging.

2016-04-05  Ada Chan  <adachan@apple.com>

        Rename TextTrackRepresentationiOS to TextTrackRepresentationCocoa and enable on Mac
        https://bugs.webkit.org/show_bug.cgi?id=156245

        Reviewed by Eric Carlson.

        * Modules/mediacontrols/mediaControlsApple.css:
        (::-webkit-media-controls):
        Match iOS and specify overflow: hidden on the -webkit-media-controls container.
        (video::-webkit-media-text-track-container):
        Match iOS and specify z-index: 0 on the text track container.

        * WebCore.xcodeproj/project.pbxproj:
        TextTrackRepresentationiOS.h/mm have been renamed to TextTrackRepresentationCocoa.h/mm.

        * platform/graphics/TextTrackRepresentation.cpp:
        * platform/graphics/cocoa/TextTrackRepresentationCocoa.h: Renamed from Source/WebCore/platform/graphics/ios/TextTrackRepresentationIOS.h.
        * platform/graphics/cocoa/TextTrackRepresentationCocoa.mm: Renamed from Source/WebCore/platform/graphics/ios/TextTrackRepresentationIOS.mm.
        (-[WebCoreTextTrackRepresentationCocoaHelper initWithParent:]):
        (-[WebCoreTextTrackRepresentationCocoaHelper dealloc]):
        (-[WebCoreTextTrackRepresentationCocoaHelper setParent:]):
        (-[WebCoreTextTrackRepresentationCocoaHelper parent]):
        (-[WebCoreTextTrackRepresentationCocoaHelper observeValueForKeyPath:ofObject:change:context:]):
        (-[WebCoreTextTrackRepresentationCocoaHelper actionForLayer:forKey:]):
        (TextTrackRepresentation::create):
        (TextTrackRepresentationCocoa::TextTrackRepresentationCocoa):
        (TextTrackRepresentationCocoa::~TextTrackRepresentationCocoa):
        (TextTrackRepresentationCocoa::update):
        (TextTrackRepresentationCocoa::setContentScale):
        (TextTrackRepresentationCocoa::bounds):

2016-04-07  Brian Burg  <bburg@apple.com>

        CookieJar should support adding synthetic cookies for developer tools
        https://bugs.webkit.org/show_bug.cgi?id=156091
        <rdar://problem/25581340>

        Reviewed by Timothy Hatcher.

        This patch adds an API that can set an arbitrary cookie in cookie storage
        in order to support developer tools and automated testing. It delegates storing
        the cookie to a platform implementation.

        No new tests because the code isn't used by any clients yet.

        * loader/CookieJar.cpp:
        (WebCore::addCookie): Added.
        * loader/CookieJar.h:

        * platform/Cookie.h:
        Remove an outdated comment. This struct is used in many places.

        * platform/CookiesStrategy.h: Add new method.
        * platform/network/PlatformCookieJar.h: Add new method.
        * platform/network/cf/CookieJarCFNet.cpp:
        (WebCore::addCookie): Add a stub.
        * platform/network/curl/CookieJarCurl.cpp:
        (WebCore::addCookie): Add a stub.
        * platform/network/mac/CookieJarMac.mm:
        (WebCore::addCookie): Add an implementation that turns the WebCore::Cookie into
        an NSHTTPCookie and converts it again to CFHTTPCookie if necessary.

        * platform/network/soup/CookieJarSoup.cpp:
        (WebCore::addCookie): Add a stub.

        * platform/spi/cf/CFNetworkSPI.h:
        Add -[NSHTTPCookie _CFHTTPCookie] SPI.

2016-04-07  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r199128 and r199141.
        https://bugs.webkit.org/show_bug.cgi?id=156348

        Causes crashes on multiple webpages (Requested by keith_mi_ on
        #webkit).

        Reverted changesets:

        "[ES6] Add support for Symbol.isConcatSpreadable."
        https://bugs.webkit.org/show_bug.cgi?id=155351
        http://trac.webkit.org/changeset/199128

        "Unreviewed, uncomment accidentally commented line in test."
        http://trac.webkit.org/changeset/199141

2016-04-07  Daniel Bates  <dabates@apple.com>

        CSP: Should only honor CSP policy delivered in meta tag that is a descendent of <head>
        https://bugs.webkit.org/show_bug.cgi?id=59858
        <rdar://problem/25603538>

        Reviewed by Brent Fulgham.

        Ignore the Content Security Policy meta tag if it is not a descendent of <head> as per
        section HTML meta Element of the Content Security Policy Level 2 spec., <https://w3c.github.io/webappsec-csp/2/>
        (Editor's Draft, 29 August 2015).

        Tests: http/tests/security/contentSecurityPolicy/meta-tag-ignored-if-not-in-head.html
               http/tests/security/contentSecurityPolicy/meta-tag-ignored-if-not-in-head2.html
               http/tests/security/contentSecurityPolicy/report-only-meta-tag-ignored-if-not-in-head.html
               http/tests/security/contentSecurityPolicy/report-only-meta-tag-ignored-if-not-in-head2.html

        * dom/Document.cpp:
        (WebCore::Document::processHttpEquiv): Modified to take a boolean argument whether the http-equiv
        meta tag is a descendent of <head> and to parse the value of a Content Security Policy http-equiv
        only if the http-equiv meta tag is a descendent of <head>.
        * dom/Document.h: Add parameter isInDocument to processHttpEquiv(). Remove javadoc-style parameters
        from processHttpEquiv() comment as we do not document parameters for non-API functions using such style.
        Also write the comment for processHttpEquiv() using C++ style comments instead of a C-style comment.
        * html/HTMLMetaElement.cpp:
        (WebCore::HTMLMetaElement::process): Pass whether this element is a descendent of <head>. Additionally
        update stale comment and move it closer to the code it refers to.

2016-04-07  Brent Fulgham  <bfulgham@apple.com>

        [Win] Output WebCore.pdb to the same location as WebCore.lib
        https://bugs.webkit.org/show_bug.cgi?id=156256
        <rdar://problem/19416363>

        Reviewed by Alex Christensen.

        Add a rule to WebCore's CMake generator to tell Visual Studio to output
        the PDB file for the WebCore.lib in the same location as the resulting
        library, rather than in the build intermediary location).
        
        * CMakeLists.txt:

2016-04-06  Sam Weinig  <sam@webkit.org>

        window.Crypto is missing
        <rdar://problem/25584034>
        https://bugs.webkit.org/show_bug.cgi?id=156307

        Reviewed by Joseph Pecoraro.

        Expose the Crypto constructor on the window object.

        * page/Crypto.idl:

2016-04-07  Fujii Hironori  <Hironori.Fujii@jp.sony.com>

        [CMake][Win] WEBKIT_WRAP_SOURCELIST is not applied in WebCore project
        https://bugs.webkit.org/show_bug.cgi?id=156336

        Reviewed by Csaba Osztrogonác.

        * CMakeLists.txt: Do WEBKIT_WRAP_SOURCELIST for WebCore_SOURCES.

2016-04-07  Zalan Bujtas  <zalan@apple.com>

        REGRESSION (197987): Ingredient lists on smittenkitchen.com are full justified instead of left justified.
        https://bugs.webkit.org/show_bug.cgi?id=156326
        <rdar://problem/25519393>

        Reviewed by Antti Koivisto.

        According to the spec (https://drafts.csswg.org/css-text-3/#text-align-property) 
        unless otherwise specified by text-align-last, the last line before
        a forced break or the end of the block is start-aligned.

        In this patch we check if a forced break is present and we apply text alignment accordingly.

        Test: fast/css3-text/css3-text-justify/text-justify-last-line-simple-line-layout.html

        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::LineState::lastFragment): Make it optional so that we don't just check against a default fragment.
        (WebCore::SimpleLineLayout::createLineRuns):
        (WebCore::SimpleLineLayout::justifyRuns): Do not compute first run index on the current line twice.
        (WebCore::SimpleLineLayout::textAlignForLine):
        (WebCore::SimpleLineLayout::closeLineEndingAndAdjustRuns):

2016-04-07  Antti Koivisto  <antti@apple.com>

        FrameView::qualifiesAsVisuallyNonEmpty() returns false when loading a Google search results page before search results are loaded, even though the header is visible
        https://bugs.webkit.org/show_bug.cgi?id=156339
        <rdar://problem/24491381>

        Reviewed by Andreas Kling.

        Patch by Jeff Miller.

        Jeff's testing indicates lowering the document height threshold improves things visually during page loading.

        * page/FrameView.cpp:
        (WebCore::FrameView::qualifiesAsVisuallyNonEmpty):

            Lower document height threshold to from 200 to 48 pixels.

2016-04-07  Antti Koivisto  <antti@apple.com>

        Shadow DOM: Implement display: contents for slots
        https://bugs.webkit.org/show_bug.cgi?id=149439
        <rdar://problem/22731922>

        Reviewed by Ryosuke Niwa.

        This patch adds support for value 'contents' of the 'display' property for <slot> elements only. The value is ignored
        for other elements for now. With this display value the element does not generate a box for itself but its descendants
        generate them normally.

        Slots already have implicit "display: contents". With this patch the value comes from the user agent stylesheet and can
        be overriden by the author.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/CSSValueKeywords.in:

            Suport parsing display: contents.

        * css/StyleResolver.cpp:
        (WebCore::equivalentBlockDisplay):
        (WebCore::StyleResolver::adjustRenderStyle):

            Disallow for non-slots for now.

        * css/html.css:
        (slot):

            Add "slot { display: contents }" to the UA sheet.

        * dom/Element.cpp:
        (WebCore::Element::resolveStyle):
        (WebCore::Element::hasDisplayContents):
        (WebCore::Element::setHasDisplayContents):

            Add a rare data bit for elements with display:contents (as we don't save the RenderStyle for them).

        (WebCore::Element::rendererIsNeeded):

            Don't need renderer for display:contents.

        (WebCore::Element::createElementRenderer):
        * dom/Element.h:
        (WebCore::Element::isVisibleInViewportChanged):
        * dom/ElementAndTextDescendantIterator.h:
        (WebCore::ElementAndTextDescendantIterator::operator!):
        (WebCore::ElementAndTextDescendantIterator::operator bool):
        (WebCore::ElementAndTextDescendantIterator::ElementAndTextDescendantIterator):
        (WebCore::ElementAndTextDescendantIterator::operator==):
        (WebCore::ElementAndTextDescendantIterator::operator!=):

            Support initializing ElementAndTextDescendantIterator with root==current so that m_current is not nulled.
            This is needed for ComposedTreeIterator to be initialized correctly when root is a slot and the current node
            is a slotted node. The case happens in RenderTreePosition::previousSiblingRenderer when slot display is overriden
            to something else than 'contents'.

        * dom/ElementRareData.h:
        (WebCore::ElementRareData::hasDisplayContents):
        (WebCore::ElementRareData::setHasDisplayContents):
        (WebCore::ElementRareData::ElementRareData):
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::createFor):
        * rendering/style/RenderStyleConstants.h:
        * style/RenderTreePosition.cpp:
        (WebCore::RenderTreePosition::nextSiblingRenderer):

            Test for dynamic display:contents.

        * style/RenderTreeUpdater.cpp:
        (WebCore::findRenderingRoot):
        (WebCore::RenderTreeUpdater::updateRenderTree):
        (WebCore::RenderTreeUpdater::updateElementRenderer):

            Test for dynamic display:contents.

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::affectsRenderedSubtree):

            No need for special case.

        (WebCore::Style::TreeResolver::resolveComposedTree):

            Test for dynamic display:contents.

2016-04-07  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Content box incorrectly used as non-auto min-height
        https://bugs.webkit.org/show_bug.cgi?id=155946

        Reviewed by Antti Koivisto.

        When computing the minimum height value of grid items with
        non-auto min-height we used to return the size of the content
        box meaning that borders and paddings were incorrectly
        ignored.

        Note that we're also ignoring margins, but as that is a
        problem also for widths it'll be fixed in a follow up patch.

        Test: fast/css-grid-layout/min-height-border-box.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::minSizeForChild):

2016-04-07  Antti Koivisto  <antti@apple.com>

        Reverting previous due to bad LayoutTest ChangeLog.

2016-04-06  Antti Koivisto  <antti@apple.com>

        Shadow DOM: Implement display: contents for slots
        https://bugs.webkit.org/show_bug.cgi?id=149439
        <rdar://problem/22731922>

        Reviewed by Ryosuke Niwa.

        This patch adds support for value 'contents' of the 'display' property for <slot> elements only. The value is ignored
        for other elements for now. With this display value the element does not generate a box for itself but its descendants
        generate them normally.

        Slots already have implicit "display: contents". With this patch the value comes from the user agent stylesheet and can
        be overriden by the author.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/CSSValueKeywords.in:

            Suport parsing display: contents.

        * css/StyleResolver.cpp:
        (WebCore::equivalentBlockDisplay):
        (WebCore::StyleResolver::adjustRenderStyle):

            Disallow for non-slots for now.

        * css/html.css:
        (slot):

            Add "slot { display: contents }" to the UA sheet.

        * dom/Element.cpp:
        (WebCore::Element::resolveStyle):
        (WebCore::Element::hasDisplayContents):
        (WebCore::Element::setHasDisplayContents):

            Add a rare data bit for elements with display:contents (as we don't save the RenderStyle for them).

        (WebCore::Element::rendererIsNeeded):

            Don't need renderer for display:contents.

        (WebCore::Element::createElementRenderer):
        * dom/Element.h:
        (WebCore::Element::isVisibleInViewportChanged):
        * dom/ElementAndTextDescendantIterator.h:
        (WebCore::ElementAndTextDescendantIterator::operator!):
        (WebCore::ElementAndTextDescendantIterator::operator bool):
        (WebCore::ElementAndTextDescendantIterator::ElementAndTextDescendantIterator):
        (WebCore::ElementAndTextDescendantIterator::operator==):
        (WebCore::ElementAndTextDescendantIterator::operator!=):

            Support initializing ElementAndTextDescendantIterator with root==current so that m_current is not nulled.
            This is needed for ComposedTreeIterator to be initialized correctly when root is a slot and the current node
            is a slotted node. The case happens in RenderTreePosition::previousSiblingRenderer when slot display is overriden
            to something else than 'contents'.

        * dom/ElementRareData.h:
        (WebCore::ElementRareData::hasDisplayContents):
        (WebCore::ElementRareData::setHasDisplayContents):
        (WebCore::ElementRareData::ElementRareData):
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::createFor):
        * rendering/style/RenderStyleConstants.h:
        * style/RenderTreePosition.cpp:
        (WebCore::RenderTreePosition::nextSiblingRenderer):

            Test for dynamic display:contents.

        * style/RenderTreeUpdater.cpp:
        (WebCore::findRenderingRoot):
        (WebCore::RenderTreeUpdater::updateRenderTree):
        (WebCore::RenderTreeUpdater::updateElementRenderer):

            Test for dynamic display:contents.

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::affectsRenderedSubtree):

            No need for special case.

        (WebCore::Style::TreeResolver::resolveComposedTree):

            Test for dynamic display:contents.

2016-04-06  Myles C. Maxfield  <mmaxfield@apple.com>

        REGRESSION (r188591): thingiverse.com direct messaging UI is not rendered properly
        https://bugs.webkit.org/show_bug.cgi?id=156241
        <rdar://problem/25262213>

        Reviewed by Simon Fraser.

        When creating a CoreText font with a size of 0, the CoreText docs say that it will
        interpret this as a missing argument, and create a font of size 12 instead. However,
        this doesn't cause a problem (at least on this particular website) because we will
        use CGFontGetGlyphAdvancesForStyle(), which gets scaled by the supplied font 
        size (which is 0). However, if you turn on text-rendering: optimizeLegibility, we
        will use CTFontGetAdvancesForGlyphs() instead, which does not scale by the font size.
        The solution is to detect this case, and force the advance to 0.

        Test: fast/text/zero-sized-fonts.html

        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::Font::platformWidthForGlyph):

2016-04-06  Myles C. Maxfield  <mmaxfield@apple.com>

        Rename MidpointState to WhitespaceCollapsingState
        https://bugs.webkit.org/show_bug.cgi?id=156304

        Reviewed by David Hyatt.

        MidpointState has nothing to do with midpoints.

        An individual midpoint is now known as a "whitespace collapsing transition."

        No new tests because there is no behavior change.

        * platform/text/BidiResolver.h:
        (WebCore::WhitespaceCollapsingState::reset): (See addMidpoint() below.)
        Previously, we were using operator= to destroy old Iterators when their
        storage inside the Vector was reused. Now that we are elliminating
        m_numMidpoints, we can push destruction earlier to this reset() function.
        Because the same amount of destruction happens in both cases, this doesn't
        add additional work. (Vector can destroy its contents without shrinking
        its storage overcommitment.)
        (WebCore::WhitespaceCollapsingState::startIgnoringSpaces):
        (WebCore::WhitespaceCollapsingState::stopIgnoringSpaces):
        (WebCore::WhitespaceCollapsingState::ensureLineBoxInsideIgnoredSpaces):
        (WebCore::WhitespaceCollapsingState::decrementTransitionAt):
        (WebCore::WhitespaceCollapsingState::thresholds): Make the return value
        const. The only clients of this function which needed mutation were
        migrated to using decrementTransitionAt().
        (WebCore::WhitespaceCollapsingState::numTransitions):
        (WebCore::WhitespaceCollapsingState::currentTransition):
        (WebCore::WhitespaceCollapsingState::setCurrentTransition):
        (WebCore::WhitespaceCollapsingState::incrementCurrentTransition):
        (WebCore::WhitespaceCollapsingState::decrementNumTransitions):
        (WebCore::WhitespaceCollapsingState::betweenTransitions):
        (WebCore::BidiResolverBase::whitespaceCollapsingState):
        (WebCore::Subclass>::setWhitespaceCollapsingTransitionForIsolatedRun):
        (WebCore::Subclass>::whitespaceCollapsingTransitionForIsolatedRun):
        (WebCore::MidpointState::MidpointState): Deleted.
        (WebCore::MidpointState::reset): Deleted.
        (WebCore::MidpointState::startIgnoringSpaces): Deleted.
        (WebCore::MidpointState::stopIgnoringSpaces): Deleted.
        (WebCore::MidpointState::ensureLineBoxInsideIgnoredSpaces): Deleted.
        (WebCore::MidpointState::midpoints): Deleted.
        (WebCore::MidpointState::numMidpoints): Deleted.
        (WebCore::MidpointState::currentMidpoint): Deleted.
        (WebCore::MidpointState::setCurrentMidpoint): Deleted.
        (WebCore::MidpointState::incrementCurrentMidpoint): Deleted.
        (WebCore::MidpointState::decrementNumMidpoints): Deleted.
        (WebCore::MidpointState::betweenMidpoints): Deleted.
        (WebCore::MidpointState::addMidpoint): Deleted. This code has been around for 13
        years (since r3672) where it was using QMemArray. That class doesn't have an
        append() class, so it was implemented inside this function. Luckily, Vector
        already overcommits its allocation, so we can elliminate m_numMidpoints entirely.
        (WebCore::BidiResolverBase::midpointState): Deleted.
        (WebCore::Subclass>::setMidpointForIsolatedRun): Deleted.
        (WebCore::Subclass>::midpointForIsolatedRun): Deleted.
        * rendering/InlineIterator.h:
        (WebCore::addPlaceholderRunForIsolatedInline):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::appendRunsForObject):
        (WebCore::setUpResolverToResumeInIsolate):
        (WebCore::constructBidiRunsForSegment):
        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
        * rendering/line/BreakingContext.h:
        (WebCore::BreakingContext::BreakingContext):
        (WebCore::BreakingContext::handleBR):
        (WebCore::BreakingContext::handleOutOfFlowPositioned):
        (WebCore::shouldSkipWhitespaceAfterStartObject):
        (WebCore::BreakingContext::handleEmptyInline):
        (WebCore::BreakingContext::handleReplaced):
        (WebCore::ensureCharacterGetsLineBox):
        (WebCore::BreakingContext::handleText):
        (WebCore::checkWhitespaceCollapsingTransitions):
        (WebCore::BreakingContext::handleEndOfLine):
        (WebCore::checkMidpoints): Deleted.
        * rendering/line/TrailingObjects.cpp:
        (WebCore::TrailingObjects::updateWhitespaceCollapsingTransitionsForTrailingBoxes):
        (WebCore::TrailingObjects::updateMidpointsForTrailingBoxes): Deleted.
        * rendering/line/TrailingObjects.h:
        (WebCore::TrailingObjects::appendBoxIfNeeded):

2016-04-06  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Remove duplicated parsePortFromStringPosition()
        https://bugs.webkit.org/show_bug.cgi?id=156289

        Reviewed by Simon Fraser.

        Same parsePortFromStringPosition() functions have been defined in both URLUtils.h and HTMLAnchorElement.cpp.
        Remove duplicated one in HTMLAnchorElement.cpp.

        No new tests, no behavior change.

        * html/HTMLAnchorElement.cpp:
        (WebCore::parsePortFromStringPosition): Deleted.

2016-04-06  Simon Fraser  <simon.fraser@apple.com>

        Page tiles are missing when graphics acceleration is unavailable
        https://bugs.webkit.org/show_bug.cgi?id=156325
        rdar://problem/25587476

        Reviewed by Tim Horton.

        When graphics acceleration is unavailable on Mac (e.g. in a VM or when running from
        the recovery partition), page contents were missing. This is because
        IOSurfaceGetPropertyMaximum(kIOSurfaceWidth) and IOSurfaceGetPropertyMaximum(kIOSurfaceHeight)
        returned INT_MAX, causing us to compute a tile size of 0x0.

        Fix by changing IOSurface::maximumSize() to report a value between 1K x 1K and 32K x 32K.

        Rename kGiantTileSize to better describe its purpose.

        Add correct clamping in IOSurface::maximumSize().

        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::tileSize):
        * platform/graphics/ca/TileController.h:
        * platform/graphics/cocoa/IOSurface.mm:
        (IOSurface::maximumSize):

2016-03-29  Keith Miller  <keith_miller@apple.com>

        [ES6] Add support for Symbol.isConcatSpreadable.
        https://bugs.webkit.org/show_bug.cgi?id=155351

        Reviewed by Saam Barati.

        Makes runtime arrays have the new ArrayType

        * bridge/runtime_array.h:
        (JSC::RuntimeArray::createStructure):

2016-04-06  Eric Carlson  <eric.carlson@apple.com>

        [iOS Simulator WK1] Crash in MediaPlayer::setPrivateBrowsingMode()
        https://bugs.webkit.org/show_bug.cgi?id=155721
        <rdar://problem/18590481>

        Speculative fix for a crash that appears to happen when the media engine is destroyed
        during a callback.

        Reviewed by Dean Jackson.

        No new tests, this prevents existing tests from crashing.

        * html/HTMLMediaElement.cpp:
        (WebCore::actionName): Log MediaEngineUpdated.
        (WebCore::HTMLMediaElement::scheduleDelayedAction): Support MediaEngineUpdated.
        (WebCore::HTMLMediaElement::pendingActionTimerFired): Ditto. Clear m_pendingActionFlags.
        (WebCore::HTMLMediaElement::mediaEngineWasUpdated): New.
        (WebCore::HTMLMediaElement::mediaPlayerEngineUpdated): Move guts to mediaEngineWasUpdated and
          call it on a timer so we can't change the media engine in the middle of a callback from
          MediaPlayer or the media engine.
        * html/HTMLMediaElement.h:
        * html/HTMLMediaElementEnums.h:

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::~MediaPlayer): Assert if new flag m_initializingMediaEngine is set to
          catch HTMLMediaElement destroying the media engine during a callback.
        (WebCore::MediaPlayer::loadWithNextMediaEngine): Set/clear m_initializingMediaEngine.
        * platform/graphics/MediaPlayer.h:

2016-04-06  Brady Eidson  <beidson@apple.com>

        Modern IDB: Make sure SQLite backing store records have a INTEGER PRIMARY KEY column.
        https://bugs.webkit.org/show_bug.cgi?id=156264

        Reviewed by Alex Christensen.

        No new tests (No testable change in behavior yet, current tests pass).

        * Modules/indexeddb/IDBKeyData.cpp:
        (WebCore::IDBKeyData::encode): Fix the key name for backwards compatibility.
        (WebCore::IDBKeyData::decode): Ditto.

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::v3RecordsTableSchema): Added v3 Records schema that includes a primary key column.
        (WebCore::IDBServer::v3RecordsTableSchemaAlternate):
        (WebCore::IDBServer::createOrMigrateRecordsTableIfNecessary): Upgrade to v3 instead of v2.
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):

2016-04-06  Simon Fraser  <simon.fraser@apple.com>

        Avoid using an unengaged Optional<FloatRect> when positioning the tiled scrolling indicator
        https://bugs.webkit.org/show_bug.cgi?id=156313

        Reviewed by Tim Horton.

        Fixes an assertion seen when running the WebKit2.AutoLayoutIntegration API test.

        * page/FrameView.cpp:
        (WebCore::FrameView::setViewExposedRect):

2016-04-06  Sam Weinig  <sam@webkit.org>

        Fix windows build.

        * DerivedSources.cpp:
        * css/CSSAllInOne.cpp:

2016-04-06  Jer Noble  <jer.noble@apple.com>

        CRASH in AudioDestinationNode::render()
        https://bugs.webkit.org/show_bug.cgi?id=156308
        <rdar://problem/25468815>

        Reviewed by Eric Carlson.

        
        AudioDestinationNode::render() will crash when passed in a zero-length frame count. Rather than get into
        this bad state, ASSERT() and bail out early in this case.

        Also, address the situation in AudioDestinationIOS::render which can cause this 0-frame count to occur.

        * Modules/webaudio/AudioDestinationNode.cpp:
        (WebCore::AudioDestinationNode::render):
        * platform/audio/ios/AudioDestinationIOS.cpp:
        (WebCore::AudioDestinationIOS::render):

2016-04-06  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo][MediaFoundation] Videos are always autoplaying.
        https://bugs.webkit.org/show_bug.cgi?id=156284

        Reviewed by Alex Christensen.

        Videos are autoplaying because the MediaFoundation implementation always starts playback
        after the load method has been called. When the load method has been called, we should
        only start buffering data, not automatically start the playback. This has been fixed by
        implementing the prepareToPlay method, and calling this instead of the play method.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::MediaPlayerPrivateMediaFoundation):
        (WebCore::MediaPlayerPrivateMediaFoundation::load):
        (WebCore::MediaPlayerPrivateMediaFoundation::prepareToPlay):
        (WebCore::MediaPlayerPrivateMediaFoundation::play):
        (WebCore::MediaPlayerPrivateMediaFoundation::networkState):
        (WebCore::MediaPlayerPrivateMediaFoundation::startSession):
        (WebCore::MediaPlayerPrivateMediaFoundation::endGetEvent):
        (WebCore::MediaPlayerPrivateMediaFoundation::updateReadyState):
        (WebCore::MediaPlayerPrivateMediaFoundation::onTopologySet):
        (WebCore::MediaPlayerPrivateMediaFoundation::onBufferingStarted):
        (WebCore::MediaPlayerPrivateMediaFoundation::onBufferingStopped):
        (WebCore::MediaPlayerPrivateMediaFoundation::onSessionEnded):
        (WebCore::MediaPlayerPrivateMediaFoundation::Direct3DPresenter::updateDestRect):
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:

2016-04-06  Zalan Bujtas  <zalan@apple.com>

        Add ASSERT_WITH_SECURITY_IMPLICATION when a float box is referenced by multiple RootInlineBoxes.
        https://bugs.webkit.org/show_bug.cgi?id=156297
        <rdar://problem/25580844>

        Reviewed by Brent Fulgham.

        See http://trac.webkit.org/changeset/199101

        No change in functionality.

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::appendFloatingObjectToLastLine):
        (WebCore::RenderBlockFlow::reattachCleanLineFloats):
        (WebCore::RenderBlockFlow::determineStartPosition):

2016-04-06  Sam Weinig  <sam@webkit.org>

        window.CSS should be a constructor with static functions
        <rdar://problem/25580516>
        https://bugs.webkit.org/show_bug.cgi?id=156294

        Reviewed by Chris Dumez.

        Rename DOMWindowCSS to DOMCSSNamespace to avoid name collisions, DOMWindow prefixed
        classes cause collisions in JSDOMWindow.

        * CMakeLists.txt:
        * DerivedSources.make:
        * WebCore.xcodeproj/project.pbxproj:
        Update for renames.

        * css/DOMCSSNamespace.cpp: Copied from Source/WebCore/css/DOMWindowCSS.cpp.
        (WebCore::valueWithoutImportant):
        (WebCore::DOMCSSNamespace::supports):
        (WebCore::DOMWindowCSS::create): Deleted.
        (WebCore::DOMWindowCSS::supports): Deleted.
        * css/DOMCSSNamespace.h: Copied from Source/WebCore/css/DOMWindowCSS.h.
        (WebCore::DOMWindowCSS::DOMWindowCSS): Deleted.
        Rename DOMWindowCSS to DOMCSSNamespace and turn functions into static functions.

        * css/DOMCSSNamespace.idl: Copied from Source/WebCore/css/DOMWindowCSS.idl.
        Remove NoInterfaceObject, to inject a constructor, and turn functions into
        static functions matching spec.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::css): Deleted.
        * page/DOMWindow.h:
        * page/DOMWindow.idl:
        Remove CSS property. Constructor will be implicitly added.

2016-04-05  Simon Fraser  <simon.fraser@apple.com>

        Rename exposedRect to viewExposedRect and propagate it as Optional<> through WK2
        https://bugs.webkit.org/show_bug.cgi?id=156274

        Reviewed by Tim Horton.

        DrawingArea and FrameView have an "exposedRect" property that is used by applications
        on Mac, like Mail, that embed web views inside scroll views. However, this name is very
        similar to the "exposedContentRect" that is used on iOS to denote the part of the view
        whose pixels are visible, including through blurring overlaid UI.
        
        To disambiguate these two, rename the Mac "exposedRect" to "viewExposedRect" to
        emphasize that it's a rect that takes into account clipping in the native view
        hierarchy.
        
        Also make this rect Optional<> through the DrawingArea, removing comparisons against
        FloatRect::infiniteRect().
        
        Do some other minor renaming in VisibleContentRectUpdateInfo.

        * page/FrameView.cpp:
        (WebCore::FrameView::setViewExposedRect): This now takes an Optional<> because WebViewImpl::updateViewExposedRect()
        can clear it.
        * page/FrameView.h:
        * page/PageOverlayController.cpp:
        (WebCore::PageOverlayController::didChangeViewExposedRect):
        (WebCore::PageOverlayController::didChangeExposedRect): Deleted.
        * page/PageOverlayController.h:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::computeTileCoverage):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::flushPendingLayerChanges):

2016-04-06  Joanmarie Diggs  <jdiggs@igalia.com>

        REGRESSION(r195463): [GTK] accessibility/roles-computedRoleString.html and accessibility/roles-exposed.html failing
        https://bugs.webkit.org/show_bug.cgi?id=153696

        Reviewed by Chris Fleizach.

        The failures were due to always mapping style format groups to GroupRole, even for
        RenderInline objects. The fix is to expose inline style format groups as InlineRole,
        add handling of GroupRole style groups to the ATK code, and InlineRole style groups
        to the Mac code.

        No new tests because we have sufficient coverage. Updated roles-computedRoleString.html
        to reflect new exposure.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (atkRole):
        * accessibility/mac/AccessibilityObjectMac.mm:
        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (createAccessibilityRoleMap):
        (-[WebAccessibilityObjectWrapper subrole]):

2016-04-06  Jer Noble  <jer.noble@apple.com>

        CRASH in -[WebCoreNSURLSession taskCompleted:]
        https://bugs.webkit.org/show_bug.cgi?id=156290

        Reviewed by Eric Carlson.

        Fixes currently flakily crashing http/tests/media tests.

        Protect against -taskCompleted: being called multiple times by only calling
        -taskCompleted: if the task's state is not yet NSURLSessionTaskStateCompleted.
        Additionally, make sure to clear the task's session pointer when removing it
        from _dataTasks, as this ensures a task that outlives its session does not
        keep a pointer to a dealloc'd object.

        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession taskCompleted:]):
        (-[WebCoreNSURLSessionDataTask _resource:loadFinishedWithError:]):

2016-04-06  Chris Dumez  <cdumez@apple.com>

        [IDL] Extend support for [EnabledAtRuntime] attributes / operations to all global objects, not just Window
        https://bugs.webkit.org/show_bug.cgi?id=156291

        Reviewed by Alex Christensen.

        Extend support for [EnabledAtRuntime] attributes / operations to all
        global objects, not just Window. This is needed by the Fetch API which
        is enabled at runtime and exposed on both Window and WorkerGlobalScope.

        * bindings/scripts/CodeGeneratorJS.pm:
        (IsDOMGlobalObject):
        (OperationShouldBeOnInstance):
        (GenerateHeader):
        (GeneratePropertiesHashTable):
        (GenerateImplementation):
        * bindings/scripts/test/GObject/WebKitDOMTestGlobalObject.cpp: Added.
        (WebKit::kit):
        (WebKit::core):
        (WebKit::wrapTestGlobalObject):
        (webkit_dom_test_global_object_finalize):
        (webkit_dom_test_global_object_set_property):
        (webkit_dom_test_global_object_get_property):
        (webkit_dom_test_global_object_constructor):
        (webkit_dom_test_global_object_class_init):
        (webkit_dom_test_global_object_init):
        (webkit_dom_test_global_object_regular_operation):
        (webkit_dom_test_global_object_enabled_at_runtime_operation):
        (webkit_dom_test_global_object_get_regular_attribute):
        (webkit_dom_test_global_object_set_regular_attribute):
        (webkit_dom_test_global_object_get_enabled_at_runtime_attribute):
        (webkit_dom_test_global_object_set_enabled_at_runtime_attribute):
        * bindings/scripts/test/GObject/WebKitDOMTestGlobalObject.h: Added.
        * bindings/scripts/test/GObject/WebKitDOMTestGlobalObjectPrivate.h: Added.
        * bindings/scripts/test/JS/JSTestGlobalObject.cpp: Added.
        (WebCore::JSTestGlobalObjectConstructor::prototypeForStructure):
        (WebCore::JSTestGlobalObjectConstructor::initializeProperties):
        (WebCore::JSTestGlobalObjectPrototype::getOwnPropertySlot):
        (WebCore::JSTestGlobalObject::JSTestGlobalObject):
        (WebCore::JSTestGlobalObject::finishCreation):
        (WebCore::JSTestGlobalObject::destroy):
        (WebCore::JSTestGlobalObject::getOwnPropertySlot):
        (WebCore::jsTestGlobalObjectRegularAttribute):
        (WebCore::jsTestGlobalObjectEnabledAtRuntimeAttribute):
        (WebCore::jsTestGlobalObjectConstructor):
        (WebCore::setJSTestGlobalObjectConstructor):
        (WebCore::setJSTestGlobalObjectRegularAttribute):
        (WebCore::setJSTestGlobalObjectEnabledAtRuntimeAttribute):
        (WebCore::JSTestGlobalObject::getConstructor):
        (WebCore::jsTestGlobalObjectInstanceFunctionRegularOperation):
        (WebCore::jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation1):
        (WebCore::jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation2):
        (WebCore::jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation):
        (WebCore::JSTestGlobalObjectOwner::isReachableFromOpaqueRoots):
        (WebCore::JSTestGlobalObjectOwner::finalize):
        (WebCore::toJSNewlyCreated):
        (WebCore::toJS):
        (WebCore::JSTestGlobalObject::toWrapped):
        * bindings/scripts/test/JS/JSTestGlobalObject.h: Added.
        (WebCore::JSTestGlobalObject::create):
        (WebCore::JSTestGlobalObject::createStructure):
        (WebCore::JSTestGlobalObject::finishCreation):
        (WebCore::wrapperOwner):
        (WebCore::wrapperKey):
        (WebCore::toJS):
        (WebCore::JSTestGlobalObjectPrototype::create):
        (WebCore::JSTestGlobalObjectPrototype::createStructure):
        (WebCore::JSTestGlobalObjectPrototype::JSTestGlobalObjectPrototype):
        * bindings/scripts/test/ObjC/DOMTestGlobalObject.h: Added.
        * bindings/scripts/test/ObjC/DOMTestGlobalObject.mm: Added.
        (-[DOMTestGlobalObject dealloc]):
        (-[DOMTestGlobalObject regularAttribute]):
        (-[DOMTestGlobalObject setRegularAttribute:]):
        (-[DOMTestGlobalObject enabledAtRuntimeAttribute]):
        (-[DOMTestGlobalObject setEnabledAtRuntimeAttribute:]):
        (-[DOMTestGlobalObject regularOperation:]):
        (-[DOMTestGlobalObject enabledAtRuntimeOperation:]):
        (core):
        (kit):
        * bindings/scripts/test/ObjC/DOMTestGlobalObjectInternal.h: Added.
        * bindings/scripts/test/TestGlobalObject.idl: Added.

2016-04-06  Brady Eidson  <beidson@apple.com>

        Update IndexedDB feature status to the much more correct "In Development"

        Reviewed by Tim Hatcher.

        * features.json:

2016-04-06  Zalan Bujtas  <zalan@apple.com>

        ASSERTION FAILED: !floatingObject->originatingLine() in WebCore::RenderBlockFlow::linkToEndLineIfNeeded
        https://bugs.webkit.org/show_bug.cgi?id=153001

        Reviewed by Dan Bernstein.

        1. Float boxes are always attached to the line where we see them first.
        2. Float box can only be attached to one line.
        3. RenderBlockFlow can perform partial layout on dirty lines only.

        In certain cases, the last dirty line can "pull up" float boxes from the first clean line.
        It simply means that due to some layout changes on previous lines now we see those floats on this last dirty line first.
        If after placing the float we still find it on the same position, the line below is still considered clean.
 
        Remove the float box from its original line if the line above already placed it.

        Test: fast/block/float/float-moves-between-lines.html

        * rendering/RenderBlockFlow.h:
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::reattachCleanLineFloats):
        (WebCore::RenderBlockFlow::linkToEndLineIfNeeded):
        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange): Deleted.

2016-04-06  Antti Koivisto  <antti@apple.com>

        REGRESSION(r196629): Messages text size only changes for sending text, conversation text size does not change
        https://bugs.webkit.org/show_bug.cgi?id=156287
        <rdar://problem/24264756>

        Reviewed by Andreas Kling.

        * css/RuleFeature.cpp:
        (WebCore::RuleFeatureSet::recursivelyCollectFeaturesFromSelector):
        (WebCore::makeAttributeSelectorKey):

            Include attribute value to the key. Otherwise we may deduplicate selectors that are not indentical.

        (WebCore::RuleFeatureSet::collectFeatures):
        (WebCore::RuleFeatureSet::add):

            Use HashMap::ensure().

        * css/RuleFeature.h:

2016-04-06  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Fix positioned children in RTL
        https://bugs.webkit.org/show_bug.cgi?id=156162

        Reviewed by Sergio Villar Senin.

        This patch fixes a problem affecting the items without
        a static inline position (i.e. "left" and/or "right" properties
        are not "auto"). In this particular case we need to compute
        the "offset" from the left, so we need a specific condition
        and computation.

        Let's use an example to understand what it's fixing:
        <div style="display: grid; grid-template-columns: 100px 50px; width: 300px;
                    position: relative; direction: rtl;">
            <div style="position: absolute; left: 0; grid-column: 1 / 2;">item</div>
        </div>

        In this case the item has to be placed in the first column
        (the one on the right as we're in RTL).
        For this we need to calculate the offset from the left, which is 200px:
        150px (alignment offset) + 50px (offset from line 3 to 2).

        Test: fast/css-grid-layout/grid-positioned-items-background-rtl.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):

2016-04-06  Antti Koivisto  <antti@apple.com>

        ComposedTreeIterator may crash when first child of shadow root is a comment node
        https://bugs.webkit.org/show_bug.cgi?id=156281

        Reviewed by Andreas Kling.

        It should not use plain firstChild() and assume it is Element or Text.

        * dom/ComposedTreeIterator.cpp:
        (WebCore::ComposedTreeIterator::Context::Context):

            Add FirstChildTag to various iterator constructors to make clear that they search for the first child.

        (WebCore::ComposedTreeIterator::ComposedTreeIterator):
        (WebCore::ComposedTreeIterator::traverseShadowRoot):

            Fix by using ElementAndTextDescendantIterator to find the first child.

        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::operator*):
        (WebCore::ComposedTreeDescendantAdapter::ComposedTreeDescendantAdapter):
        (WebCore::ComposedTreeDescendantAdapter::begin):
        (WebCore::ComposedTreeDescendantAdapter::end):
        (WebCore::ComposedTreeDescendantAdapter::at):
        (WebCore::ComposedTreeChildAdapter::Iterator::Iterator):
        * dom/ElementAndTextDescendantIterator.h:
        (WebCore::ElementAndTextDescendantIterator::operator++):
        (WebCore::ElementAndTextDescendantIterator::ElementAndTextDescendantIterator):
        (WebCore::ElementAndTextDescendantIteratorAdapter::begin):
        (WebCore::ElementAndTextDescendantIteratorAdapter::end):

2016-04-05  Chris Dumez  <cdumez@apple.com>

        Add support for [EnabledAtRuntime] operations on DOMWindow
        https://bugs.webkit.org/show_bug.cgi?id=156272

        Reviewed by Alex Christensen.

        Add support for [EnabledAtRuntime] operations on DOMWindow by omitting
        such operations from the static table and add them at run-time in
        JSDOMWindow::finishCreation() if the corresponding feature is enabled.

        This was needed for window.fetch() for which a hack was temporarily
        landed in r199081. This patch drops this hack now that the generated
        bindings do the right thing.

        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::scriptExecutionContext):
        Drop hack landed in r199081.
        
        * bindings/scripts/CodeGeneratorJS.pm:
        (OperationShouldBeOnInstance):
        (GeneratePropertiesHashTable):
        (GenerateImplementation):
        Add support for [EnabledAtRuntime] operations on DOMWindow.

2016-04-05  Alex Christensen  <achristensen@webkit.org>

        Make CMake-generated binaries on Mac able to run
        https://bugs.webkit.org/show_bug.cgi?id=156268

        Reviewed by Daniel Bates.

        * CMakeLists.txt:
        * PlatformMac.cmake:

2016-04-05  Jon Davis  <jond@ingenesis.net>

        Fixed CSS Shapes entry on the WebKit Feature Status page.
        https://bugs.webkit.org/show_bug.cgi?id=156262

        Reviewed by Timothy Hatcher.

        * features.json:

2016-04-05  Chris Dumez  <cdumez@apple.com>

        MessageEvent.source window is incorrect once window has been reified
        https://bugs.webkit.org/show_bug.cgi?id=156227
        <rdar://problem/25545831>

        Reviewed by Mark Lam.

        MessageEvent.source window was incorrect once window had been reified.

        If the Window had not been reified, we kept constructing new
        postMessage() functions when calling window.postMessage(). We used to
        pass activeDOMWindow(execState) as source Window to
        DOMWindow::postMessage(). activeDOMWindow() uses
        exec->lexicalGlobalObject() which did the right thing because we
        used to construct a new postMessage() function in the caller's context.

        However, after reification, due to the way JSDOMWindow::getOwnPropertySlot()
        was implemented, we would stop constructing new postMessage() functions
        when calling window.postMessage(). As a result, the source window would
        become incorrect because exec->lexicalGlobalObject() would return the
        target Window instead.

        In this patch, the following is done:
        1. Stop constructing a new function every time in the same origin case
           for postMessage, blur, focus and close. This was inefficient and lead
           to incorrect behavior:
           - The behavior would differ depending if the Window is reified or not
           - It would be impossible to delete those operations, which is
             incompatible with the specification and other browsers (tested
             Firefox and Chrome).
        2. Use callerDOMWindow(execState) instead of activeDOMWindow(execState)
           as source Window in JSDOMWindow::handlePostMessage(). callerDOMWindow()
           is a new utility function that returns the caller's Window object.

        Tests: fast/dom/Window/delete-operations.html
               fast/dom/Window/messageevent-source-postmessage-reified.html
               fast/dom/Window/messageevent-source-postmessage.html
               fast/dom/Window/messageevent-source-postmessage2.html
               fast/dom/Window/window-postmessage-clone-frames.html
               fast/dom/Window/post-message-crash2.html

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::GetCallerCodeBlockFunctor::operator()):
        (WebCore::GetCallerCodeBlockFunctor::codeBlock):
        (WebCore::callerDOMWindow):
        * bindings/js/JSDOMBinding.h:
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::handlePostMessage):

2016-04-05  Beth Dakin  <bdakin@apple.com>

        Make requestCandidatesForSelection available on any EditorClient
        https://bugs.webkit.org/show_bug.cgi?id=156253
        -and corresponding-
        rdar://problem/24661147

        Reviewed by Dean Jackson.

        * loader/EmptyClients.h:
        * page/EditorClient.h:
        (WebCore::EditorClient::requestCandidatesForSelection):

2016-04-05  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Add a runtime flag to fetch API and related constructs
        https://bugs.webkit.org/show_bug.cgi?id=156113
 
        Reviewed by Alex Christensen.

        Marking all Fetch interfaces EnabledAtRuntime=FetchAPI.
        Adding FetchAPI runtime flag setter and getter.
        In case, fetch API is disabled, ensure Window.prototype.fetch returns undefined.
 
        * Modules/fetch/DOMWindowFetch.idl:
        * Modules/fetch/FetchBody.idl:
        * Modules/fetch/FetchHeaders.idl:
        * Modules/fetch/FetchRequest.idl:
        * Modules/fetch/FetchResponse.idl:
        * Modules/fetch/WorkerGlobalScopeFetch.idl:
        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::webGL2Enabled):
        (WebCore::RuntimeEnabledFeatures::setFetchAPIEnabled):
        (WebCore::RuntimeEnabledFeatures::fetchAPIEnabled):
        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::finishCreation):

2016-04-05  Brady Eidson  <beidson@apple.com>

        Modern IDB: Get blob URLs/files all the way to the IDB backing store.
        https://bugs.webkit.org/show_bug.cgi?id=156248

        Reviewed by Alex Christensen.

        No new tests (No change in behavior).

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::putOrAddOnServer):

        * Modules/indexeddb/IDBValue.cpp:
        (WebCore::IDBValue::IDBValue):
        (WebCore::IDBValue::isolatedCopy):
        * Modules/indexeddb/IDBValue.h:
        (WebCore::IDBValue::blobURLs):
        (WebCore::IDBValue::blobFilePaths):
        (WebCore::IDBValue::encode):
        (WebCore::IDBValue::decode):

        * Modules/indexeddb/server/IDBBackingStore.h:

        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::addRecord):
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd):

        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::writeBlobsToDiskForIndexedDB):

2016-03-19  Filip Pizlo  <fpizlo@apple.com>

        JSC should use a shadow stack version of CHICKEN so that debuggers have the option of retrieving tail-deleted frames
        https://bugs.webkit.org/show_bug.cgi?id=155598

        Reviewed by Saam Barati.

        Fixed some uses of the stack walking functor to obey the new lambda-friendly API, which
        requires that operator() is const.

        No new tests because no change in behavior.

        * bindings/js/JSXMLHttpRequestCustom.cpp:
        (WebCore::SendFunctor::column):
        (WebCore::SendFunctor::url):
        (WebCore::SendFunctor::operator()):
        (WebCore::JSXMLHttpRequest::send):
        * testing/Internals.cpp:
        (WebCore::GetCallerCodeBlockFunctor::GetCallerCodeBlockFunctor):
        (WebCore::GetCallerCodeBlockFunctor::operator()):
        (WebCore::GetCallerCodeBlockFunctor::codeBlock):
        (WebCore::Internals::parserMetaData):

2016-04-05  Brady Eidson  <beidson@apple.com>

        Modern IDB: Replace use of SerializedScriptValue with IDBValue.
        https://bugs.webkit.org/show_bug.cgi?id=156242

        Reviewed by Alex Christensen.

        No new tests (No change in behavior).

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::putOrAddOnServer):

        * Modules/indexeddb/IDBValue.cpp:
        (WebCore::IDBValue::IDBValue):
        (WebCore::IDBValue::isolatedCopy):
        * Modules/indexeddb/IDBValue.h:
        (WebCore::IDBValue::data):
        (WebCore::IDBValue::encode):
        (WebCore::IDBValue::decode):

        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::putOrAdd):
        * Modules/indexeddb/client/IDBConnectionToServer.h:
        * Modules/indexeddb/client/IDBConnectionToServerDelegate.h:

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::putOrAdd):
        * Modules/indexeddb/server/IDBServer.h:

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::putOrAdd):
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::putOrAdd):
        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.h:

        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::putOrAdd):
        * Modules/indexeddb/shared/InProcessIDBServer.h:

        * WebCore.xcodeproj/project.pbxproj:

        * platform/CrossThreadCopier.cpp:
        (WebCore::IDBValue>::copy):
        * platform/CrossThreadCopier.h:

        * platform/ThreadSafeDataBuffer.h:
        (WebCore::ThreadSafeDataBuffer::encode):
        (WebCore::ThreadSafeDataBuffer::decode):

2016-04-05  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Avoid context save/restore in GraphicsContext::drawNativeImage 
        https://bugs.webkit.org/show_bug.cgi?id=156173

        Reviewed by Simon Fraser.

        CG save/restore is a costly operation. Try to avoid it, if possible, in
        GraphicsContext::drawNativeImage. If no clipping is involved, don't save/
        save/restore the GraphicsContext.

        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::drawNativeImage):
        * platform/graphics/cg/GraphicsContextCG.h:
        (WebCore::CGContextStateSaver::didSave):
        * platform/spi/cg/CoreGraphicsSPI.h:

2016-04-05  Simon Fraser  <simon.fraser@apple.com>

        Add a "notifyutil" callback for dumping the RenderLayer tree, and move the registration to Page code
        https://bugs.webkit.org/show_bug.cgi?id=156224

        Reviewed by Zalan Bujtas.

        Make it possible to run:
            notifyutil -p com.apple.WebKit.showLayerTree
        on the command line and have it dump out layer trees for all live documents, in
        debug builds.
        
        Move callback registration from RenderObject's constructor to Page.

        * page/mac/PageMac.mm:
        (WebCore::Page::platformInitialize):
        * rendering/RenderObject.cpp:
        (WebCore::printLayerTreeForLiveDocuments):
        (WebCore::RenderObject::RenderObject): Deleted.
        * rendering/RenderObject.h:

2016-04-05  Antoine Quint  <graouts@apple.com>

        [WebGL2] Turn the ENABLE_WEBGL2 flag on
        https://bugs.webkit.org/show_bug.cgi?id=156061
        <rdar://problem/25463193>

        Reviewed by Alex Christensen.

        Conditionalize the definition of the WebGL2RenderingContext and WebGLVertexArrayObject globals
        based on the new WebGL2 runtime flag we introduced in https://webkit.org/b/156166.

        Turning the ENABLE_WEBGL2 flag on caused a host of build errors which we fix here. A non-obvious
        error was in code generated from the html/canvas/WebGL2RenderingContext.idl file which was solved
        by updating the getBufferSubData() method to the current signature as of the March 29 Editor's
        Draft of the WebGL 2 Specification (https://www.khronos.org/registry/webgl/specs/latest/2.0/).
        Missing JSC headers in WebGL2RenderingContext.cpp also caused some linking errors in Release builds.

        Tests: webgl/webgl-vertex-array-object-defined.html
               webgl/webgl2-rendering-context-defined.html
               webgl/webgl2-rendering-context-obtain.html

        * Configurations/FeatureDefines.xcconfig:
        * bindings/js/JSWebGL2RenderingContextCustom.cpp:
        (WebCore::JSWebGL2RenderingContext::getInternalformatParameter):
        (WebCore::JSWebGL2RenderingContext::getQueryParameter):
        (WebCore::JSWebGL2RenderingContext::getSamplerParameter):
        (WebCore::JSWebGL2RenderingContext::getSyncParameter):
        (WebCore::JSWebGL2RenderingContext::getIndexedParameter):
        (WebCore::JSWebGL2RenderingContext::getActiveUniformBlockParameter):
        (WebCore::JSWebGL2RenderingContext::getActiveUniformBlockName):
        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::is3dType):
        * html/canvas/WebGL2RenderingContext.cpp:
        (WebCore::WebGL2RenderingContext::getBufferSubData): Deleted.
        * html/canvas/WebGL2RenderingContext.idl:
        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::create):
        * html/canvas/WebGLVertexArrayObject.idl:

2016-04-05  Antti Koivisto  <antti@apple.com>

        Shadow DOM: :host() From The First Shadow Context Should Not Style All Shadow Context
        https://bugs.webkit.org/show_bug.cgi?id=156235
        <rdar://problem/24668206>

        Reviewed by Andreas Kling.

        Test: fast/shadow-dom/host-style-sharing.html

        * style/StyleSharingResolver.cpp:
        (WebCore::Style::SharingResolver::resolve):
        (WebCore::Style::SharingResolver::canShareStyleWithElement):

            Disallow style sharing for shadow hosts affected by :host pseudo class rules.

2016-04-05  Alex Christensen  <achristensen@webkit.org>

        Speculative build fix after r199043

        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::wireFormatVersion):
        (WebCore::SerializedScriptValue::writeBlobsToDiskForIndexedDB):
        * bindings/js/SerializedScriptValue.h:
        (WebCore::SerializedScriptValue::data):
        (WebCore::SerializedScriptValue::hasBlobURLs):
        (WebCore::SerializedScriptValue::createFromWireBytes):
        Initializer lists weren't the problem.  Missing precompiler macros was.

2016-04-05  Alex Christensen  <achristensen@webkit.org>

        Speculative build fix after r199043

        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::writeBlobsToDiskForIndexedDB):
        Explicitly call constructor instead of using an initializer list.

2016-04-05  Xabier Rodriguez Calvar  <calvaris@igalia.com>

        Unreviewed build fix with GSTREAMER_GL active.

        Caused by r198655.

        (WebCore::MediaPlayerPrivateGStreamerBase::nativeImageForCurrentTime):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp: Changed return type.

2016-04-05  Antti Koivisto  <antti@apple.com>

        Render tree teardown should be iterative
        https://bugs.webkit.org/show_bug.cgi?id=156233

        Reviewed by Andreas Kling.

        * dom/ContainerNode.cpp:
        (WebCore::destroyRenderTreeIfNeeded):
        (WebCore::ContainerNode::takeAllChildrenFrom):
        * dom/Document.cpp:
        (WebCore::Document::destroyRenderTree):
        * dom/Element.cpp:
        (WebCore::disconnectPseudoElement):
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::prepareForDocumentSuspension):
        * mathml/MathMLSelectElement.cpp:
        (WebCore::MathMLSelectElement::updateSelectedChild):
        * style/RenderTreeUpdater.cpp:
        (WebCore::RenderTreeUpdater::updateElementRenderer):
        (WebCore::RenderTreeUpdater::updateTextRenderer):
        (WebCore::RenderTreeUpdater::updateBeforeOrAfterPseudoElement):
        (WebCore::RenderTreeUpdater::tearDownRenderers):

            Tear down render tree using ComposedTreeIterator for traversal.

        (WebCore::RenderTreeUpdater::tearDownRenderer):

        * style/RenderTreeUpdater.h:
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::ensurePlaceholderStyle):
        (WebCore::Style::TreeResolver::styleForElement):
        (WebCore::Style::resetStyleForNonRenderedDescendants):
        (WebCore::Style::affectsRenderedSubtree):
        (WebCore::Style::SelectorFilterPusher::SelectorFilterPusher): Deleted.
        (WebCore::Style::SelectorFilterPusher::push): Deleted.
        (WebCore::Style::SelectorFilterPusher::~SelectorFilterPusher): Deleted.

            Unused class.

        (WebCore::Style::detachTextRenderer): Deleted.
        (WebCore::Style::detachChildren): Deleted.
        (WebCore::Style::detachShadowRoot): Deleted.
        (WebCore::Style::detachSlotAssignees): Deleted.
        (WebCore::Style::detachRenderTree): Deleted.

            Remove the old recursive code.

        * style/StyleTreeResolver.h:

2016-04-05  Antoine Quint  <graouts@apple.com>

        [WebGL2] Allow enabling WebGL2 with a runtime flag
        https://bugs.webkit.org/show_bug.cgi?id=156166
        <rdar://problem/25526929>

        Added new runtime flags for WebGL2.

        Reviewed by Dean Jackson.

        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::setWebGL2Enabled):
        (WebCore::RuntimeEnabledFeatures::webGL2Enabled):

2016-04-05  Antti Koivisto  <antti@apple.com>

        Use RenderTreeUpdater for text node mutations
        https://bugs.webkit.org/show_bug.cgi?id=156107

        Reviewed by Andreas Kling.

        Use the new mechanism for updating render tree after text node content changes.

        * dom/CharacterData.cpp:
        (WebCore::CharacterData::parserAppendData):
        (WebCore::CharacterData::setDataAndUpdate):
        * dom/Text.cpp:
        (WebCore::Text::createWithLengthLimit):
        (WebCore::Text::updateRendererAfterContentChange):

            Update using RenderTreeUpdater.

        (WebCore::Text::formatForDebugger):
        * dom/Text.h:
        (WebCore::Text::Text):
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::styleForElement):
        (WebCore::Style::resetStyleForNonRenderedDescendants):
        (WebCore::Style::TreeResolver::resolveElement):
        (WebCore::Style::elementImplicitVisibility):
        (WebCore::Style::invalidateWhitespaceOnlyTextSiblingsAfterAttachIfNeeded): Deleted.
        (WebCore::Style::textRendererIsNeeded): Deleted.
        (WebCore::Style::createTextRendererIfNeeded): Deleted.
        (WebCore::Style::attachTextRenderer): Deleted.
        (WebCore::Style::detachTextRenderer): Deleted.
        (WebCore::Style::updateTextRendererAfterContentChange): Deleted.
        (WebCore::Style::resolveTextNode): Deleted.

            Kill the old code paths.

        * style/StyleTreeResolver.h:

2016-04-05  Hunseop Jeong  <hs85.jeong@samsung.com>

        [Curl][Soup] Fix the build after r199039
        https://bugs.webkit.org/show_bug.cgi?id=156229 

        Reviewed by Žan Doberšek.

        * platform/network/curl/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::create):
        * platform/network/soup/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::create):

2016-04-04  Zan Dobersek  <zdobersek@igalia.com>

        Guard showGraphicsLayerTree() with ENABLE(TREE_DEBUGGING)
        https://bugs.webkit.org/show_bug.cgi?id=156157

        Reviewed by Simon Fraser.

        Mimic r181166 and guard the showGraphicsLayerTree() function with
        ENABLE(TREE_DEBUGGING) guards, instead of !defined(NDEBUG). This
        would enable invoking the function in release builds when the
        ENABLE_TREE_DEBUGGING option is enabled, not limiting the function
        to only debug builds.

        * platform/graphics/GraphicsLayer.cpp:
        * platform/graphics/GraphicsLayer.h:

2016-04-04  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] Improve viewport array access in TextureMapperGL::bindDefaultSurface()
        https://bugs.webkit.org/show_bug.cgi?id=156159

        Reviewed by Antonio Gomes.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::bindDefaultSurface): Create a reference to the
        viewport array in the TextureMapperGLData object. Inline the IntSize constructor
        for the object that's passed to createProjectionMatrix(), and use the reference
        to access all four elements of the array as necessary.

2016-04-04  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] resolveOverlaps() should be passed-in the first Region parameter via a reference
        https://bugs.webkit.org/show_bug.cgi?id=156158

        Reviewed by Antonio Gomes.

        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::resolveOverlaps): Don't copy the Region object that's passed through
        the first parameter by accepting a reference to the object instead. This does
        modify the passed-in object, but these modifications don't have any effect on
        any state via the call sites in TextureMapperLayer::computeOverlapRegions().

2016-04-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: Dump blobs to disk before storing them in an object store.
        https://bugs.webkit.org/show_bug.cgi?id=156068
        
        Reviewed by Alex Christensen.

        No new tests (Under development, no observable change in behavior yet).

        * WebCore.xcodeproj/project.pbxproj:
        * CMakeLists.txt:

        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::putOrAddOnServer):
        
        * Modules/indexeddb/IDBValue.cpp: Copied from Source/WebCore/platform/ScopeGuard.h.
        (WebCore::IDBValue::IDBValue):
        * Modules/indexeddb/IDBValue.h: Copied from Source/WebCore/platform/ScopeGuard.h.
        
        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::putOrAdd):
        * Modules/indexeddb/client/IDBConnectionToServer.h:
        
        * Modules/indexeddb/client/TransactionOperation.h:
        
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::SerializedScriptValue):
        (WebCore::SerializedScriptValue::writeBlobsToDiskForIndexedDB):
        (WebCore::SerializedScriptValue::addBlobURL): Deleted.
        * bindings/js/SerializedScriptValue.h:
        
        * platform/FileSystem.cpp:
        (WebCore::appendFileContentsToFileHandle):
        * platform/FileSystem.h:
        
        * platform/ScopeGuard.h:
        
        * platform/network/BlobRegistry.h:
        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::blobUtilityQueue):
        (WebCore::BlobRegistryImpl::writeBlobsToTemporaryFiles):
        * platform/network/BlobRegistryImpl.h:

2016-04-04  Jer Noble  <jer.noble@apple.com>

        [iOS] Crash when playing <video> after playing Web Audio
        https://bugs.webkit.org/show_bug.cgi?id=156185
        <rdar://problem/10177005>

        Reviewed by Eric Carlson.

        Off-by-one error in AudioDestinationIOS::render. The ivars m_firstSpareFrame and m_lastSpareFrame imply that
        the sample range is inclusive, i.e. [m_firstSpareFrame .. m_lastSpareFrame], but the length of the range was
        being calculated as if m_lastSpareFrame was exclusive; when the two were equal, the length was calculated as
        0, rather than 1. This was caught by an ASSERT (and would have been caught by a downstream ASSERT had that one
        not been present).

        Fix the off-by-one by treating them as inclusive/exclusive--similar to C++ iterators--and renaming them to reflect
        this: [m_startSpareFrame .. m_endSpareFrame). This corrects the "length" math which caused the crash.

        * platform/audio/ios/AudioDestinationIOS.cpp:
        (WebCore::AudioDestinationIOS::render):
        * platform/audio/ios/AudioDestinationIOS.h:

2016-04-04  John Wilander  <wilander@apple.com>

        Block plaintext WebSocket requests to domains under HSTS.
        https://bugs.webkit.org/show_bug.cgi?id=156049
        <rdar://problem/13820000>

        Reviewed by Brent Fulgham.

        No new tests because the way TLS is setup for layout tests doesn't allow the server to set HSTS for 127.0.0.1 nor localhost. This is tracked in <rdar://problem/25467825>.

        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::connect):
            - Now sends usesEphemeralSession to SocketStreamHandle::create.
        * platform/network/cf/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::create):
            - Added parameter usesEphemeralSession which it passes on to the SocketStreamHandle constructor.
        * platform/network/cf/SocketStreamHandleCFNet.cpp:
        (WebCore::SocketStreamHandle::SocketStreamHandle):
            - Now blocks plaintext WebSocket connections for domains under HSTS if not in an ephemeral session.

2016-04-04  Simon Fraser  <simon.fraser@apple.com>

        Make FrameView's exposedRect an Optional<>
        https://bugs.webkit.org/show_bug.cgi?id=156189

        Reviewed by Tim Horton.

        Instead of testing against isInfinite(), make FrameView::exposedRect() and the
        member variable an Optional<FloatRect>.

        * page/FrameView.cpp:
        (WebCore::FrameView::setExposedRect):
        * page/FrameView.h:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::computeTileCoverage):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::flushPendingLayerChanges):

2016-04-04  Simon Fraser  <simon.fraser@apple.com>

        Don't crash when rendering form controls with Display List Drawing enabled
        https://bugs.webkit.org/show_bug.cgi?id=156122

        Reviewed by Sam Weinig.
        
        Don't attempt to paint form controls if display-list drawing is enabled, since
        doing so attempts to get at a CGContextRef that doens't exist.

        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::paint):

2016-04-04  Zalan Bujtas  <zalan@apple.com>

        CSS Triangles Rendering Regression affecting CSS Ribbons.
        https://bugs.webkit.org/show_bug.cgi?id=156121

        Reviewed by Simon Fraser.

        We use floored border width values for painting (see BorderEdge).
        However border-box sizing is based on rounded border values. This mismatch could result in a 2 device pixel
        gap when both top and bottom (or left and right) borders are present.
        
        This patch applies flooring on the computed border width value.

        It matches FireFox (44.0.2) behaviour (both by inspecting box-sizing visually and through getComputedStyle() values on border-width).
    
        Covered by existing tests.

        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertLineWidth):

2016-04-04  Doug Russell  <d_russell@apple.com>

        AX: new lines in content editable elements don't notify accessibility
        https://bugs.webkit.org/show_bug.cgi?id=153361

        Reviewed by Ryosuke Niwa.

        Relocate accessibility edit notification logic into higher level logic.
        Typing notifications relocated into TypingCommand.
        Cut & Paste notifications relocated into Editor.
        Undo relocated into EditCommandComposition.

        Tests: accessibility/mac/value-change/value-change-user-info-contenteditable.html
               accessibility/mac/value-change/value-change-user-info-textarea.html
               accessibility/mac/value-change/value-change-user-info-textfield.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * accessibility/AXObjectCache.cpp:
        (WebCore::AccessibilityReplacedText::AccessibilityReplacedText):
        (WebCore::AccessibilityReplacedText::postTextStateChangeNotification):
        (WebCore::AXObjectCache::postTextStateChangeNotification):
        (WebCore::AXObjectCache::postTextReplacementNotification):
        * accessibility/AXObjectCache.h:
        (WebCore::VisiblePositionIndexRange::isNull):
        (WebCore::AccessibilityReplacedText::AccessibilityReplacedText):
        (WebCore::AccessibilityReplacedText::replacedRange):
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::listMarkerTextForNodeAndPosition):
        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
        * accessibility/AccessibilityObject.h:
        (WebCore::VisiblePositionRange::VisiblePositionRange):
        * accessibility/mac/AXObjectCacheMac.mm:
        (WebCore::AXObjectCache::postTextStateChangePlatformNotification):
        (WebCore::AXObjectCache::postTextReplacementPlatformNotification):
        * editing/AppendNodeCommand.cpp:
        (WebCore::AppendNodeCommand::doApply): Deleted.
        (WebCore::AppendNodeCommand::doUnapply): Deleted.
        * editing/CompositeEditCommand.cpp:
        (WebCore::AccessibilityUndoReplacedText::indexForVisiblePosition):
        (WebCore::AccessibilityUndoReplacedText::confgureTextToBeDeletedByUnapplyIndexesWithEditCommandEndingSelection):
        (WebCore::AccessibilityUndoReplacedText::confgureTextToBeDeletedByUnapplyStartIndexWithEditCommandStartingSelection):
        (WebCore::AccessibilityUndoReplacedText::setTextInsertedByUnapplyRange):
        (WebCore::AccessibilityUndoReplacedText::captureTextToBeDeletedByUnapply):
        (WebCore::AccessibilityUndoReplacedText::captureTextToBeDeletedByReapply):
        (WebCore::stringForVisiblePositionIndexRange):
        (WebCore::AccessibilityUndoReplacedText::textInsertedByUnapply):
        (WebCore::AccessibilityUndoReplacedText::textInsertedByReapply):
        (WebCore::postTextStateChangeNotification):
        (WebCore::AccessibilityUndoReplacedText::postTextStateChangeNotificationForUnapply):
        (WebCore::AccessibilityUndoReplacedText::postTextStateChangeNotificationForReapply):
        (WebCore::EditCommandComposition::EditCommandComposition):
        (WebCore::EditCommandComposition::unapply):
        (WebCore::EditCommandComposition::reapply):
        (WebCore::EditCommandComposition::setStartingSelection):
        (WebCore::EditCommandComposition::setEndingSelection):
        (WebCore::EditCommandComposition::setTextInsertedByUnapplyRange):
        (WebCore::CompositeEditCommand::removeNode):
        (WebCore::CompositeEditCommand::replaceTextInNode):
        (WebCore::deleteSelectionEditingActionForEditingAction):
        (WebCore::CompositeEditCommand::deleteSelection):
        (WebCore::CompositeEditCommand::applyStyle): Deleted.
        (WebCore::CompositeEditCommand::updatePositionForNodeRemovalPreservingChildren): Deleted.
        (WebCore::CompositeEditCommand::inputText): Deleted.
        * editing/CompositeEditCommand.h:
        (WebCore::AccessibilityUndoReplacedText::AccessibilityUndoReplacedText):
        * editing/DeleteFromTextNodeCommand.cpp:
        (WebCore::DeleteFromTextNodeCommand::doApply): Deleted.
        (WebCore::DeleteFromTextNodeCommand::getNodesInCommand): Deleted.
        * editing/DeleteFromTextNodeCommand.h:
        * editing/DictationCommand.cpp:
        (WebCore::DictationCommand::doApply):
        * editing/EditCommand.cpp:
        (WebCore::EditCommand::postTextStateChangeNotification):
        (WebCore::SimpleEditCommand::SimpleEditCommand): Deleted.
        (WebCore::SimpleEditCommand::doReapply): Deleted.
        (WebCore::SimpleEditCommand::addNodeAndDescendants): Deleted.
        * editing/EditCommand.h:
        * editing/EditingAllInOne.cpp:
        * editing/Editor.cpp:
        (WebCore::Editor::replaceSelectionWithFragment):
        (WebCore::Editor::appliedEditing):
        (WebCore::Editor::unappliedEditing):
        (WebCore::Editor::postTextStateChangeNotificationForCut):
        (WebCore::Editor::performCutOrCopy):
        (WebCore::Editor::changeSelectionAfterCommand):
        (WebCore::dispatchEditableContentChangedEvents): Deleted.
        (WebCore::Editor::addTextToKillRing): Deleted.
        * editing/Editor.h:
        * editing/InsertIntoTextNodeCommand.cpp:
        (WebCore::InsertIntoTextNodeCommand::doApply): Deleted.
        (WebCore::InsertIntoTextNodeCommand::getNodesInCommand): Deleted.
        * editing/InsertNodeBeforeCommand.cpp:
        (WebCore::InsertNodeBeforeCommand::doApply): Deleted.
        (WebCore::InsertNodeBeforeCommand::doUnapply): Deleted.
        (WebCore::InsertNodeBeforeCommand::getNodesInCommand): Deleted.
        * editing/RemoveNodeCommand.cpp:
        (WebCore::RemoveNodeCommand::RemoveNodeCommand):
        * editing/RemoveNodeCommand.h:
        (WebCore::RemoveNodeCommand::create):
        * editing/ReplaceDeleteFromTextNodeCommand.cpp: Removed.
        * editing/ReplaceDeleteFromTextNodeCommand.h: Removed.
        * editing/ReplaceInsertIntoTextNodeCommand.cpp: Removed.
        * editing/ReplaceInsertIntoTextNodeCommand.h: Removed.
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::doApply):
        (WebCore::ReplaceSelectionCommand::completeHTMLReplacement):
        (WebCore::ReplaceSelectionCommand::performTrivialReplace):
        * editing/ReplaceSelectionCommand.h:
        (WebCore::ReplaceSelectionCommand::visibleSelectionForInsertedText):
        * editing/TextInsertionBaseCommand.cpp:
        (WebCore::TextInsertionBaseCommand::TextInsertionBaseCommand):
        * editing/TextInsertionBaseCommand.h:
        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::TypingCommand):
        (WebCore::TypingCommand::insertText):
        (WebCore::TypingCommand::insertLineBreak):
        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
        (WebCore::TypingCommand::insertParagraphSeparator):
        (WebCore::TypingCommand::postTextStateChangeNotificationForDeletion):
        (WebCore::TypingCommand::doApply):
        (WebCore::TypingCommand::insertTextAndNotifyAccessibility):
        (WebCore::TypingCommand::insertLineBreakAndNotifyAccessibility):
        (WebCore::TypingCommand::insertParagraphSeparatorAndNotifyAccessibility):
        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContentAndNotifyAccessibility):
        (WebCore::TypingCommand::deleteKeyPressed):
        (WebCore::TypingCommand::forwardDeleteKeyPressed):
        * editing/TypingCommand.h:

2016-04-04  Dean Jackson  <dino@apple.com>

        Add color-gamut media query support
        https://bugs.webkit.org/show_bug.cgi?id=155994
        <rdar://problem/23282326>

        Reviewed by Darin Adler.

        Add the new CSS media query: color-gamut
        https://drafts.csswg.org/mediaqueries-4/#color-gamut

        This ultimately calls into screenSupportsExtendedColor,
        which has only been implemented on iOS at the moment.
        All displays will match the "srgb" keyword, but only
        iOS devices with an extended color screen will
        match against "p3" (e.g. the iPad Pro 9.7").
        Nothing will match against "rec2020".

        Test: fast/media/mq-color-gamut.html

        * css/CSSValueKeywords.in: Add "p3" and "rec2020".
        * css/MediaFeatureNames.h: Add "color-gamut"
        * css/MediaQueryEvaluator.cpp:
        (WebCore::color_gamutMediaFeatureEval): Call
        screenSupportsExtendedColor to see if we're srgb or p3.
        * css/MediaQueryExp.cpp:
        (WebCore::featureWithCSSValueID):
        * platform/efl/PlatformScreenEfl.cpp: Add empty implementation.
        (WebCore::screenSupportsExtendedColor):
        * platform/gtk/PlatformScreenGtk.cpp: Ditto.
        (WebCore::screenSupportsExtendedColor):
        * platform/win/PlatformScreenWin.cpp: Ditto.
        (WebCore::screenSupportsExtendedColor):

2016-04-04  Brent Fulgham  <bfulgham@apple.com>

        Update feature status on anchor download attribute.

        * features.json:

2016-04-04  Beth Dakin  <bdakin@apple.com>

        Add some logic to decide when a video can control the videoControlsManager
        https://bugs.webkit.org/show_bug.cgi?id=156089
        -and corresponding-
        rdar://problem/23833752

        Reviewed by Eric Carlson and Tim Horton.

        With this patch, a video can take over the videoControlsManager if all of 
        these conditions are met:
        -Playback is permitted
        -The video has a renderer
        -The video is 400x300 or larger
        AND
        -The video has both audio and video

        If those criteria are not met the video will still be allowed to take over 
        the videoControlsManager if:
        -Playback is permitted
        -The video has a renderer
        -The video started playing because of a user gesture.

        If multiple videos meet this criteria, then the video that most recently 
        started playing will take over the videoControlsManager.

        We might consider more restrictions in the future, but this seems like a good 
        place to start.

        Move all decisions about the videoControlsManager to updatePlayState() 
        instead of playInternal().
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::playInternal):

        If the video will play after updatePlayState, then invoke 
        setUpVideoControlsManager() if canControlControlsManager() is true. If the 
        video will not be playing after updatePlayState, then check to see if 
        endedPlayback() is true. If it is, then invoke clearVideoControlsManager().
        (WebCore::HTMLMediaElement::updatePlayState):

        The logic for the heuristic is here:
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::canControlControlsManager):
        * html/MediaElementSession.h:

        New ChromeClient function clearVideoControlsManager().
        * page/ChromeClient.h:

2016-04-03  Sam Weinig  <sam@webkit.org>

        Add SPI to allow install script message handlers in isolated worlds
        https://bugs.webkit.org/show_bug.cgi?id=156153

        Reviewed by Anders Carlsson.

        Added API Test: WKUserContentController.ScriptMessageHandlerBasicPostIsolatedWorld

        - Changes the signature of the method in UserContentProvider to get UserMessageHandlerDescriptors
          to match that of UserScripts and UserStyleSheets.
        - Removes the need for UserMessageHandlerDescriptor::Client by making UserMessageHandlerDescriptor
          directly subclassable.
        - Changes invalidation model of UserMessageHandlersNamespace to be more direct by allowing it to
          register for invalidation notifications, rather than always checking if handler has been removed
          on each invocation.

        * loader/EmptyClients.cpp:
        Update for new signature.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::shouldHaveWebKitNamespaceForWorld):
        Switch to using forEachUserMessageHandler.

        (WebCore::DOMWindow::webkitNamespace):
        Pass the UserContentProvider to the namespace on creation, so the UserMessageHandlersNamespace
        can use it to register to listen for UserMessageHandler changes.

        * page/UserContentController.h:
        * page/UserContentController.cpp:
        (WebCore::UserContentController::forEachUserStyleSheet):
        (WebCore::UserContentController::forEachUserMessageHandler):
        (WebCore::UserContentController::addUserScript):
        (WebCore::UserContentController::removeUserStyleSheets):
        (WebCore::UserContentController::removeAllUserContent):
        (WebCore::UserContentController::addUserMessageHandlerDescriptor): Deleted.
        (WebCore::UserContentController::removeUserMessageHandlerDescriptor): Deleted.
        (WebCore::UserContentController::addUserContentExtension): Deleted.
        (WebCore::UserContentController::removeUserContentExtension): Deleted.
        (WebCore::UserContentController::removeAllUserContentExtensions): Deleted.
        Removed unused functions, all the UserMessageHandler and UserContentExtension ones. UserContentController
        is only used for Legacy WebKit where those features are not exposed.

        * page/UserContentProvider.h:
        * page/UserContentProvider.cpp:
        (WebCore::UserContentProvider::registerForUserMessageHandlerInvalidation):
        (WebCore::UserContentProvider::unregisterForUserMessageHandlerInvalidation):
        (WebCore::UserContentProvider::invalidateAllRegisteredUserMessageHandlerInvalidationClients):
        (WebCore::UserContentProviderInvalidationClient::~UserContentProviderInvalidationClient):
        Update signature for UserMessageHandlerDescriptor access to match UserScript and UserStyleSheet.
        Adds explicit invalidation for UserMessageHandlers.

        * page/UserMessageHandler.cpp:
        (WebCore::UserMessageHandler::UserMessageHandler):
        (WebCore::UserMessageHandler::postMessage):
        (WebCore::UserMessageHandler::name): Deleted.
        (WebCore::UserMessageHandler::world): Deleted.
        * page/UserMessageHandler.h:
        (WebCore::UserMessageHandler::descriptor):
        (WebCore::UserMessageHandler::invalidateDescriptor):
        * page/UserMessageHandlerDescriptor.cpp:
        (WebCore::UserMessageHandlerDescriptor::UserMessageHandlerDescriptor):
        (WebCore::UserMessageHandlerDescriptor::~UserMessageHandlerDescriptor):
        (WebCore::UserMessageHandlerDescriptor::name):
        (WebCore::UserMessageHandlerDescriptor::world):
        * page/UserMessageHandlerDescriptor.h:
        (WebCore::UserMessageHandlerDescriptor::Client::~Client): Deleted.
        (WebCore::UserMessageHandlerDescriptor::create): Deleted.
        (WebCore::UserMessageHandlerDescriptor::client): Deleted.
        (WebCore::UserMessageHandlerDescriptor::invalidateClient): Deleted.
        Simplify by removing the Client. Now, when the UserMessageHandlerDescriptor is no longer
        active, it gets nulled out in the UserMessageHandler.

        * page/UserMessageHandlersNamespace.cpp:
        (WebCore::UserMessageHandlersNamespace::UserMessageHandlersNamespace):
        (WebCore::UserMessageHandlersNamespace::~UserMessageHandlersNamespace):
        (WebCore::UserMessageHandlersNamespace::didInvalidate):
        (WebCore::UserMessageHandlersNamespace::handler):
        * page/UserMessageHandlersNamespace.h:
        Change the logic to listen for invalidations of the UserMessageHandlerDescriptor map. When it
        is invalidated, re-build the map of cached UserMessageHandlers from the UserContentProvider,
        and invalidate any remaining UserMessageHandlers that no longer exist in the UserContentProvider.

        * page/WebKitNamespace.cpp:
        (WebCore::WebKitNamespace::WebKitNamespace):
        * page/WebKitNamespace.h:
        (WebCore::WebKitNamespace::create):
        Pass through the UserContentProvider.

2016-04-04  Chris Dumez  <cdumez@apple.com>

        Regression(r196145): Crash in getOwnPropertyDescriptor on http://www.history.com/shows/vikings
        https://bugs.webkit.org/show_bug.cgi?id=156136
        <rdar://problem/25410767>

        Reviewed by Ryosuke Niwa.

        The page was crashing when doing the following:
        Object.getOwnPropertyDescriptor(window, "indexedDB")

        getOwnPropertyDescriptor() expected getDirect() to return a CustomGetterSetter for
        CustomAccessors but it was not the case for window.indexedDB. The reason was that
        window.indexedDB was a special property, which is not part of the static table but
        returned by GetOwnPropertySlot() if IndexedDB feature is enabled. This weirdness
        was due to our bindings generator not having proper support for [EnabledAtRuntime]
        properties on Window.

        This patch adds support for [EnabledAtRuntime] properties on Window by omitting
        these properties from the static property table and then setting them at runtime
        in JSDOMWindow::finishCreation() if the corresponding feature is enabled.
        window.indexedDB now looks like a regular property when IndexedDB is enabled
        and getOwnPropertyDescriptor() works as expected for this property.

        Test: storage/indexeddb/indexeddb-getownpropertyDescriptor.html

        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
        (WebCore::DOMWindowIndexedDatabase::indexedDB):
        * Modules/indexeddb/DOMWindowIndexedDatabase.h:
        The generated bindings pass DOMWindow by reference instead of pointer so update
        the implementation accordingly.

        * Modules/indexeddb/DOMWindowIndexedDatabase.idl:
        Add 'indexedDB' and 'webkitIndexedDB' properties and mark them as
        [EnabledAtRuntime]. Now that the bindings generator correctly handles
        [EnabledAtRuntime] properties on the Window, there is no need to
        custom-handle them in JSDOMWindowCustom.

        * bindings/js/JSDOMWindowCustom.cpp:
        Drop custom handling for 'indexedDB' and 'webkitIndexedDB' properties
        in getOwnPropertySlot(). The generated bindings code now makes sure to
        only set those properties on the Window if IndexedDB is enabled so we
        can let the regular code path look up those properties.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GetJSCAttributesForAttribute):
        (GenerateHeader):
        (GeneratePropertiesHashTable):
        (GenerateImplementation):
        Add support for [EnabledAtRuntime] properties on DOMWindow. For such
        properties, we do the following:
        1. Omit them from the static property table
        2. In JSDOMWindow::finishCreation(), dynamically add those properties
           at runtime if the corresponding feature is enabled.

        Note that this works for constructors as well.

        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore::assertIDBFactory):
        Pass Window by reference instead of pointer.

2016-04-04  Myles C. Maxfield  <mmaxfield@apple.com>

        Addressing post-review feedback on r198970
        https://bugs.webkit.org/show_bug.cgi?id=156123

        Unreviewed.

        * platform/text/BidiResolver.h:
        (WebCore::BidiCharacterRun::~BidiCharacterRun):

2016-04-04  Myles C. Maxfield  <mmaxfield@apple.com>

        [SVG -> OTF Converter] Crash when trying to re-convert a previously-failed font conversion
        https://bugs.webkit.org/show_bug.cgi?id=156175
        <rdar://problem/25130547>

        Reviewed by David Kilzer.

        m_externalSVGFontElement points inside the document owned by m_externalSVGDocument.
        However, when the m_externalSVGDocument is destroyed (due to a failed conversion),
        we weren't resetting m_externalSVGFontElement. Then, when trying to re-convert, we
        were using the fact that m_externalSVGFontElement is non-null to mean it's valid.

        Test: fast/text/svg-font-invalid-glyph-path-failure.html (Under GuardMalloc)

        * loader/cache/CachedSVGFont.cpp:
        (WebCore::CachedSVGFont::ensureCustomFontData):

2016-04-04  Anders Carlsson  <andersca@apple.com>

        Properly generate static functions that return Promises
        https://bugs.webkit.org/show_bug.cgi?id=156169

        Reviewed by Sam Weinig.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateReturnParameters):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjConstructorFunctionTestStaticPromiseFunction):
        (WebCore::jsTestObjConstructorFunctionTestStaticPromiseFunctionPromise):
        (WebCore::jsTestObjConstructorFunctionTestStaticPromiseFunctionWithException):
        (WebCore::jsTestObjConstructorFunctionTestStaticPromiseFunctionWithExceptionPromise):
        * bindings/scripts/test/TestObj.idl:

2016-04-04  Joonghun Park  <jh718.park@samsung.com>

        [EFL] Fix build break since r198800
        https://bugs.webkit.org/show_bug.cgi?id=156011

        Reviewed by Alex Christensen.

        * PlatformEfl.cmake: Remove temorary statement which was applied to avoid build failure of Efl port.

2016-04-04  Antti Koivisto  <antti@apple.com>

        Re-disable event dispatch assertions in RenderTreeUpdater::updateRenderTree
        https://bugs.webkit.org/show_bug.cgi?id=156172

        Some ruby tests on iOS hit these.

        * style/RenderTreeUpdater.cpp:
        (WebCore::RenderTreeUpdater::updateRenderTree):

2016-04-04  Alejandro G. Castro  <alex@igalia.com>

        REGRESSION(r198492): [GTK] The WEB_RTC flag was not correctly added in some situations
        https://bugs.webkit.org/show_bug.cgi?id=156164

        Reviewed by Philippe Normand.

        Replace WEBRTC with WEB_RTC, in the idls add the new option
        UsePointersEvenForNonNullableObjectArguments to fix compilation.

        * Modules/mediastream/RTCDataChannel.idl:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/mediastream/RTCRtpReceiver.cpp:
        * Modules/mediastream/RTCRtpReceiver.h:
        * Modules/mediastream/RTCRtpSender.cpp:
        * Modules/mediastream/RTCRtpSender.h:
        * Modules/mediastream/RTCRtpSender.idl:
        * Modules/mediastream/RTCRtpSenderReceiverBase.h:
        * Modules/mediastream/RTCSessionDescription.cpp:
        * Modules/mediastream/RTCSessionDescription.h:
        * Modules/mediastream/RTCStatsReport.cpp:
        * Modules/mediastream/RTCStatsResponse.cpp:
        * Modules/mediastream/RTCTrackEvent.cpp:
        * Modules/mediastream/RTCTrackEvent.h:
        * Modules/mediastream/SDPProcessor.cpp:
        * Modules/mediastream/SDPProcessor.h:
        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
        * bindings/generic/RuntimeEnabledFeatures.h:
        * bindings/js/WebCoreJSBuiltinInternals.cpp:
        (WebCore::JSBuiltinInternalFunctions::JSBuiltinInternalFunctions):
        (WebCore::JSBuiltinInternalFunctions::visit):
        (WebCore::JSBuiltinInternalFunctions::initialize):
        * bindings/js/WebCoreJSBuiltinInternals.h:
        * bindings/js/WebCoreJSBuiltins.h:
        (WebCore::JSBuiltinFunctions::JSBuiltinFunctions):
        * platform/mediastream/RTCSessionDescriptionDescriptor.cpp:
        * platform/mediastream/RTCSessionDescriptionDescriptor.h:
        * platform/mediastream/RTCSessionDescriptionRequest.h:
        * platform/mediastream/RTCStatsRequest.h:
        * platform/mediastream/RTCStatsResponseBase.h:
        * platform/mediastream/RTCVoidRequest.h:
        * platform/mediastream/SDPProcessorScriptResource.cpp:
        * platform/mediastream/SDPProcessorScriptResource.h:
        * platform/mock/TimerEventBasedMock.h:

2016-04-04  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r198792): [GTK] Inspector crashes in Inspector::Protocol::getEnumConstantValue since r198792
        https://bugs.webkit.org/show_bug.cgi?id=155745
        <rdar://problem/25289456>

        Reviewed by Brian Burg.

        Use Inspector::Protocol::AutomationEnums namespace for getEnumConstantValue().

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::addRecordToTimeline):

2016-04-04  Antti Koivisto  <antti@apple.com>

        Avoid double traversal in RenderTreeUpdater for slot roots
        https://bugs.webkit.org/show_bug.cgi?id=156110

        Reviewed by Andreas Kling.

        * style/RenderTreeUpdater.cpp:
        (WebCore::hasDisplayContents):
        (WebCore::findRenderingRoot):
        (WebCore::findRenderingRoots):
        (WebCore::RenderTreeUpdater::commit):

            If there are multiple roots that are slots we may end up updating the same rendering root multiple times.
            Fix by deduplicating the roots.

        (WebCore::RenderTreeUpdater::updateRenderTree):

            Some cleanups.

2016-04-04  Antti Koivisto  <antti@apple.com>

        Enable assertions against DOM mutations in RenderTreeUpdater
        https://bugs.webkit.org/show_bug.cgi?id=156156

        Reviewed by Andreas Kling.

        Ensure we don't mutate DOM or dispatch events during render tree updates.

        * WebCore.xcodeproj/project.pbxproj:
        * dom/ContainerNode.cpp:
        * dom/ContainerNode.h:
        (WebCore::NoEventDispatchAssertion::NoEventDispatchAssertion): Deleted.
        (WebCore::NoEventDispatchAssertion::~NoEventDispatchAssertion): Deleted.
        (WebCore::NoEventDispatchAssertion::isEventDispatchForbidden): Deleted.

            Move NoEventDispatchAssertion to a header of its own.

        * dom/NoEventDispatchAssertion.h: Added.
        (WebCore::NoEventDispatchAssertion::NoEventDispatchAssertion):
        (WebCore::NoEventDispatchAssertion::~NoEventDispatchAssertion):
        (WebCore::NoEventDispatchAssertion::isEventDispatchForbidden):
        (WebCore::NoEventDispatchAssertion::dropTemporarily):
        (WebCore::NoEventDispatchAssertion::restoreDropped):

            Add a way to disable event assertions temporarily.

        * loader/cache/CachedSVGFont.cpp:
        (WebCore::CachedSVGFont::ensureCustomFontData):

            Temporary SVG font document may get constructed during render tree update. These can't run scripts or generally
            affect anything outside the font document as it does not have a frame. Disable event assertions temporarily.

            Tested by svg/W3C-SVG-1.1/fonts-elem-07-b.svg

        * style/RenderTreeUpdater.cpp:
        (WebCore::RenderTreeUpdater::updateRenderTree):

            Enable assertions.

2016-04-04  Emanuele Aina  <emanuele.aina@collabora.com>

        [TexMap] Trim redundant guards
        https://bugs.webkit.org/show_bug.cgi?id=155927

        Reviewed by Žan Doberšek.

        * platform/graphics/GraphicsContext3DPrivate.cpp: Drop some redundant
        checks in preprocessor guards.

2016-04-04  Emanuele Aina  <emanuele.aina@collabora.com>

        Rely on PlatformLayer to choose the TextureMapperPlatformLayer impl
        https://bugs.webkit.org/show_bug.cgi?id=155926

        Reviewed by Žan Doberšek.

        Use PlatformLayer to replace a bunch of subtly different #ifdef
        scattered over the codebase to choose between TextureMapperPlatformLayer
        and TextureMapperPlatformLayerProxyProvider.

        * platform/graphics/GraphicsContext3DPrivate.h:
        * platform/graphics/cairo/ImageBufferDataCairo.h:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h: Use
        PlatformLayer.h an inherit from PlatformLayer instead of choosing the
        right implementation every time.
        * platform/graphics/texmap/TextureMapperPlatformLayer.h: Add
        TEXTURE_MAPPER guards to make it unconditionally usable.
        * platform/graphics/texmap/TextureMapperPlatformLayerProxy.h: Add
        COORDINATED_GRAPHICS_THREADED guards to make it unconditionally
        usable.

2016-04-04  Frederic Wang  <fwang@igalia.com>

        Refactor RenderMathMLRow layout functions to avoid using flexbox
        https://bugs.webkit.org/show_bug.cgi?id=153208

        Reviewed by Martin Robinson.

        This is the first patch to rewrite MathML layout without relying on
        flexboxes or anonymous renderers.
        We have done some temporary changes to allow overriding of
        layoutBlock and to implement paintChildren, but this will be remove in a
        follow-up patch. We also implement firstLineBaseline,
        computePreferredLogicalWidths and layoutBlock of RenderMathMLRow without
        using any flexbox functions. We adjust a bit the MathML CSS to take into
        account these changes. Finally, we delete the unused helper function to
        create anonymous RenderMathMLRow.

        * css/mathml.css:
        (ms, mtext, mi, mn, mo, annotation, mtd): Prevent linebreaking inside token elements and table cells, otherwise this cause test failures with the new implementation of RenderMathMLRow.
        (math, mrow, mfenced, merror, mphantom, mstyle, menclose): Deleted. We no longer rely on flexbox for baseline alignment of RenderMathMLRow.
        * rendering/RenderFlexibleBox.h: Allow overrider of the LayoutBlock for the moment.
        * rendering/RenderObject.h:
        (WebCore::RenderObject::isRenderMathMLMenclose): Add helper function.
        * rendering/mathml/RenderMathMLMenclose.h: ditto.
        * rendering/mathml/RenderMathMLBlock.h:
        (WebCore::ascentForChild): Add helper function to easily compute the ascent of a child.
        * rendering/mathml/RenderMathMLRow.cpp: Reimplement the class without using the flexbox layout.
        (WebCore::RenderMathMLRow::firstLineBaseline): Implement the function to determine the baseline.
        (WebCore::RenderMathMLRow::computeLineVerticalStretch): Add a function that browses non-stretchy children to determine the desired vertical stretch metrics.
        (WebCore::RenderMathMLRow::computePreferredLogicalWidths): Implement the function to determine the preferred widths of the RenderMathMLRow.
        (WebCore::RenderMathMLRow::layoutRowItems): Helper function that layouts children (stretching vertical operators if needed), calculate the exact logical width and position children.
        (WebCore::RenderMathMLRow::layoutBlock): Implement the function to do the actual layout, which essentially calls layoutRowItems.
        (WebCore::RenderMathMLRow::paintChildren): Temporarily implement this function, which just calls paintChild on each child.
        (WebCore::RenderMathMLRow::createAnonymousWithParentRenderer): Deleted. We actually don't create anonymous RenderMathMLRow at the moment.
        (WebCore::RenderMathMLRow::layout): Deleted.
        * rendering/mathml/RenderMathMLRow.h: Update declarations of functions.

2016-04-04  Chris Fleizach  <cfleizach@apple.com>

        AX: Consolidate radio button group member code with that in HTMLElement derivatives
        https://bugs.webkit.org/show_bug.cgi?id=155696
        <rdar://problem/25260379>

        Reviewed by Darin Adler.

        Behavior covered by existing tests.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::addRadioButtonGroupMembers):
        * dom/CheckedRadioButtons.cpp:
        (WebCore::RadioButtonGroup::isValid):
        (WebCore::RadioButtonGroup::members):
        (WebCore::RadioButtonGroup::setCheckedButton):
        (WebCore::CheckedRadioButtons::addButton):
        (WebCore::CheckedRadioButtons::groupMembers):
        (WebCore::CheckedRadioButtons::updateCheckedState):
        * dom/CheckedRadioButtons.h:
        * dom/Range.h:
        (WebCore::documentOrderComparator):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::isInRequiredRadioButtonGroup):
        (WebCore::HTMLInputElement::radioButtonGroup):
        (WebCore::HTMLInputElement::checkedRadioButtonForGroup):
        * html/HTMLInputElement.h:

2016-04-03  Darin Adler  <darin@apple.com>

        Remove unneeded UsePointersEvenForNonNullableObjectArguments in WebKitCSSMatrix.idl
        https://bugs.webkit.org/show_bug.cgi?id=156142

        Reviewed by Sam Weinig.

        * css/WebKitCSSMatrix.idl: Removed UsePointersEvenForNonNullableObjectArguments.
        It was having no effect, I think because there were no non-nullable object arguments.

2016-04-03  Antti Koivisto  <antti@apple.com>

        Tighten ComposedTreeAncestorIterator to return Elements
        https://bugs.webkit.org/show_bug.cgi?id=150324

        Reviewed by Andreas Kling.

        Only other thing it could credibly return was Document. We can exclude it from the composed tree and avoid some casting.

        * dom/ComposedTreeAncestorIterator.h:
        (WebCore::ComposedTreeAncestorIterator::operator*):
        (WebCore::ComposedTreeAncestorIterator::operator->):
        (WebCore::ComposedTreeAncestorIterator::operator==):
        (WebCore::ComposedTreeAncestorIterator::operator!=):
        (WebCore::ComposedTreeAncestorIterator::operator++):
        (WebCore::ComposedTreeAncestorIterator::get):
        (WebCore::ComposedTreeAncestorIterator::ComposedTreeAncestorIterator):
        (WebCore::ComposedTreeAncestorIterator::traverseParent):
        (WebCore::ComposedTreeAncestorAdapter::begin):
        (WebCore::ComposedTreeAncestorAdapter::end):
        (WebCore::ComposedTreeAncestorAdapter::first):
        * dom/Element.cpp:
        (WebCore::Element::resolveComputedStyle):
        * dom/Node.cpp:
        (WebCore::Node::updateAncestorsForStyleRecalc):
        (WebCore::Node::setNeedsStyleRecalc):
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::isChildAllowed):
        (WebCore::RenderNamedFlowThread::dispatchRegionOversetChangeEventIfNeeded):
        * style/RenderTreeUpdater.cpp:
        (WebCore::findRenderingRoot):
        (WebCore::RenderTreeUpdater::commit):

2016-04-03  Antti Koivisto  <antti@apple.com>

        Shadow DOM: Slot style is not computed
        https://bugs.webkit.org/show_bug.cgi?id=156144

        Reviewed by Darin Adler.

        We don’t currently compute style for active slots. While slots have have implicit display:contents and don’t create
        boxes themselves the style should still inherit to slotted children.

        Basically

        <slot style=“color:red”></slot>

        should work as expected.

        The implementation falls out from the new style resolve architecture and this patch mostly just removes the special
        case code that prevented this from working.

        Test: fast/shadow-dom/css-scoping-shadow-slot-style.html

        * html/HTMLSlotElement.h:
        (WebCore::hasImplicitDisplayContents):

            Move to a shared location.

        * style/RenderTreeUpdater.cpp:
        (WebCore::RenderTreeUpdater::RenderTreeUpdater):
        (WebCore::findRenderingRoot):
        (WebCore::RenderTreeUpdater::updateRenderTree):

            Remove the special case code. What remains is a display:contents test for rendererless elements.

        (WebCore::RenderTreeUpdater::updateElementRenderer):

            Don't create renderers for (implicit) display:contents.

        (WebCore::hasDisplayContents): Deleted.
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::detachRenderTree):
        (WebCore::Style::affectsRenderedSubtree):

            Factor into a function.

        (WebCore::Style::TreeResolver::resolveElement):

            Remove the special case code.

        (WebCore::Style::TreeResolver::resolveComposedTree):

            Always resolve slots as we don't currently save their style.

2016-04-03  David Kilzer  <ddkilzer@apple.com>

        REGRESSION (r198653, r198864): http/tests/contentdispositionattachmentsandbox/referer-header-stripped*.html tests crashing due to unavailable SPI
        <http://webkit.org/b/156145>

        Reviewed by Tim Horton.

        Covered by existing tests under GuardMalloc:

            http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-always.html
            http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-default.html
            http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-never.html
            http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-no-referrer-when-downgrade.html
            http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-no-referrer.html
            http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-origin.html
            http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-unsafe-url.html
            http/tests/contentdispositionattachmentsandbox/referer-header-stripped.html

        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::isDataDetectorLink):
        (WebCore::DataDetection::shouldCancelDefaultAction):
        - Restore iOS 9.x code.
        (WebCore::DataDetection::detectContentInRange):
        - Guard new SPI with version macros.

        * platform/cocoa/DataDetectorsCoreSoftLink.h:
        * platform/cocoa/DataDetectorsCoreSoftLink.mm:
        - Guard new SPI with version macros.

2016-04-03  Carlos Garcia Campos  <cgarcia@igalia.com>

        Replace all RenderTheme::popupInternalPadding methods with a single one returning a LengthBox
        https://bugs.webkit.org/show_bug.cgi?id=156098

        Reviewed by Darin Adler.

        The caller always wants all padding sides, so we can simplify both the caller and the implementations by using a
        single method. It's also more efficient for the GTK+ port that creates and destroys the same style contexts on
        every call.

        * rendering/RenderMenuList.cpp:
        (WebCore::RenderMenuList::adjustInnerStyle):
        * rendering/RenderTheme.h:
        (WebCore::RenderTheme::popupInternalPaddingBox):
        (WebCore::RenderTheme::popupInternalPaddingLeft): Deleted.
        (WebCore::RenderTheme::popupInternalPaddingRight): Deleted.
        (WebCore::RenderTheme::popupInternalPaddingTop): Deleted.
        (WebCore::RenderTheme::popupInternalPaddingBottom): Deleted.
        * rendering/RenderThemeGtk.cpp:
        (WebCore::RenderThemeGtk::popupInternalPaddingBox):
        (WebCore::getComboBoxMetrics): Deleted.
        (WebCore::RenderThemeGtk::popupInternalPaddingLeft): Deleted.
        (WebCore::RenderThemeGtk::popupInternalPaddingRight): Deleted.
        (WebCore::RenderThemeGtk::popupInternalPaddingTop): Deleted.
        (WebCore::RenderThemeGtk::popupInternalPaddingBottom): Deleted.
        * rendering/RenderThemeGtk.h:
        * rendering/RenderThemeIOS.h:
        * rendering/RenderThemeIOS.mm:
        (WebCore::RenderThemeIOS::popupInternalPaddingBox):
        (WebCore::RenderThemeIOS::popupInternalPaddingRight): Deleted.
        * rendering/RenderThemeMac.h:
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::popupInternalPaddingBox):
        (WebCore::RenderThemeMac::popupInternalPaddingLeft): Deleted.
        (WebCore::RenderThemeMac::popupInternalPaddingRight): Deleted.
        (WebCore::RenderThemeMac::popupInternalPaddingTop): Deleted.
        (WebCore::RenderThemeMac::popupInternalPaddingBottom): Deleted.

2016-04-02  Sam Weinig  <sam@webkit.org>

        Cleanup DataDetection.mm a little bit
        https://bugs.webkit.org/show_bug.cgi?id=156128

        Reviewed by Dan Bernstein.

        * html/HTMLAttributeNames.in:
        Add x-apple-data-detectors, x-apple-data-detectors-type, x-apple-data-detectors-result

        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::requiresExtendedContext):
        (WebCore::DataDetection::dataDetectorIdentifier):
        (WebCore::DataDetection::shouldCancelDefaultAction):
        (WebCore::removeResultLinksFromAnchor):
        (WebCore::searchForLinkRemovingExistingDDLinks):
        Use new generated qualified name attributes, switch to using fastGetAttribute and 
        equalIgnoringASCIICase, and fix the position of some *s.

        (WebCore::dataDetectorStringForPath):
        Fix some *s and switch to using StringBuilder.

        (WebCore::buildQuery):
        Fix some *s.

        (WebCore::DataDetection::detectContentInRange):
        Use new generated qualified name attributes.

2016-04-01  Myles C. Maxfield  <mmaxfield@apple.com>

        Migrate BidiRunList and BidiRun to automatic memory management
        https://bugs.webkit.org/show_bug.cgi?id=156123

        Reviewed by Simon Fraser.

        BidiRunList, BidiRun, and BidiCharacterRun have all been doing manual
        "new"s and "delete"s for years. This patch migrates those classes to
        using std::unique_ptr.

        No new tests because there is no behavior change.

        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::drawBidiText):
        * platform/text/BidiResolver.h:
        (WebCore::BidiCharacterRun::BidiCharacterRun):
        (WebCore::BidiCharacterRun::next):
        (WebCore::BidiCharacterRun::takeNext):
        (WebCore::BidiCharacterRun::setNext):
        (WebCore::Subclass>::appendRunInternal):
        * platform/text/BidiRunList.h:
        (WebCore::BidiRunList::BidiRunList):
        (WebCore::BidiRunList::firstRun):
        (WebCore::BidiRunList<Run>::appendRun):
        (WebCore::BidiRunList<Run>::prependRun):
        (WebCore::BidiRunList<Run>::moveRunToEnd):
        (WebCore::BidiRunList<Run>::moveRunToBeginning):
        (WebCore::BidiRunList<Run>::replaceRunWithRuns):
        (WebCore::BidiRunList<Run>::clear):
        (WebCore::BidiRunList<Run>::reverseRuns):
        (WebCore::BidiRunList<Run>::clearWithoutDestroyingRuns): Deleted.
        (WebCore::BidiRunList<Run>::deleteRuns): Deleted.
        * rendering/BidiRun.cpp:
        (WebCore::BidiRun::takeNext):
        * rendering/BidiRun.h:
        (WebCore::BidiRun::next):
        (WebCore::BidiRun::takeNext):
        * rendering/InlineIterator.h:
        (WebCore::addPlaceholderRunForIsolatedInline):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::createRun):
        (WebCore::RenderBlockFlow::handleTrailingSpaces):
        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
        * rendering/line/LineBreaker.cpp:
        (WebCore::LineBreaker::skipLeadingWhitespace):

2016-04-01  Simon Fraser  <simon.fraser@apple.com>

        Backdrop Filter should repaint when changed via script
        https://bugs.webkit.org/show_bug.cgi?id=149319
        rdar://problem/22749892

        Reviewed by Tim Horton.

        When backdrop filters change, we need to trigger a recomposite, just as we do
        for filters. It's ok to re-use ContextSensitivePropertyFilter because
        adjustStyleDifference() does the right thing.

        Test: css3/filters/backdrop/dynamic-backdrop-filter-change.html

        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::changeRequiresLayerRepaint):

2016-03-31  Zalan Bujtas  <zalan@apple.com>

        putImageData leaves visible artifacts on retina display
        https://bugs.webkit.org/show_bug.cgi?id=156039
        <rdar://problem/25482243>

        Reviewed by Simon Fraser.

        Inflate the repaint rect to cover anti-aliasing bits.

        Test: fast/canvas/hidpi-repaint-on-retina-leaves-bits-behind.html

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::didDraw):

2016-04-01  Jiewen Tan  <jiewen_tan@apple.com>

        WebKit should dispatchDidFailProvisionalLoad while loading invalid URLs
        https://bugs.webkit.org/show_bug.cgi?id=155995
        <rdar://problem/14967004>

        Reviewed by Andy Estes.

        Added API Tests.

        If a loading request contains an invalid URL, DocumentLoader will now dispatch
        cannotShowURLError to the clients.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource):

2016-04-01  Frederic Wang  <fwang@igalia.com>

        Reset CSS spacing rules on the <math> element.
        https://bugs.webkit.org/show_bug.cgi?id=155433

        Reviewed by Brent Fulgham.

        Test: mathml/presentation/css-spacing.html

        When the authors has changed some CSS spacing rules on a page, they are currently inherited on MathML too, potentially causing broken math rendering.
        For example, this caused a bug in Firefox on Wikipedia in the past. Hence we align on Gecko and just reset the CSS spacing rules by default. We also import Mozilla's test.

        * css/mathml.css:
        (math): Set line-height, word-spacing and letter-spacing to normal.

2016-04-01  Daniel Bates  <dabates@apple.com>

        CSP: child-src violations reported as frame-src violation
        https://bugs.webkit.org/show_bug.cgi?id=156092
        <rdar://problem/25478509>

        Reviewed by Andy Estes.

        Tests: http/tests/security/contentSecurityPolicy/1.1/securityviolationpolicy-block-frame-using-child-src.html
               http/tests/security/contentSecurityPolicy/1.1/securityviolationpolicy-block-frame-using-default-src.html
               http/tests/security/contentSecurityPolicy/1.1/securityviolationpolicy-block-frame-using-frame-src.html

        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource): Determine the name of the effective violation
        directive from the name of the violated directive. If the name of the violated directive is "frame-src"
        then use that name for the name of the effective violated directive. Otherwise, use "child-src" for the
        name of the effective violated directive. A byproduct of this decision is that we report child-src as the
        effective violated directive when a frame load was blocked by the default-src directive. This seems reasonable
        because directive frame-src is deprecated in Content Security Policy Level 2. The child-src directive is
        its replacement.

2016-04-01  Alex Christensen  <achristensen@webkit.org>

        Compile DumpRenderTree with CMake on Mac
        https://bugs.webkit.org/show_bug.cgi?id=156088

        Reviewed by Brent Fulgham.

        * PlatformMac.cmake:
        * platform/mock/mediasource/MockBox.cpp:

2016-03-31  Antti Koivisto  <antti@apple.com>

        Separate render tree updating from style resolve
        https://bugs.webkit.org/show_bug.cgi?id=155298

        Reviewed by Andreas Kling.

        This patch splits computing document style and applying the results into two distinct steps:

        Style::TreeResolver::resolve()
                |
                | Style::Update
                V
        RenderTreeUpdater::commit()

        Style::TreeResolver::resolve() returns a Style::Update object that contains all the changes to be made
        for the whole composed tree. RenderTreeUpdater then applies the changes updating, building or tearing
        down portions of the render tree as needed.

        Style::Update consists of a map that contains new style for each newly resolved element along with some
        metadata. A separate map contains text nodes that require reconstruction. It also tracks change roots so
        RenderTreeUpdater needs to traverse the changed subtrees only.

        The patch eliminates the recursive render tree build code path replacing it with iterative functions.

        This will enable future optimizations. For example we won't need to commit to immediate rendering
        changes simply because some script or internal function requires up-to-date style.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::State::State):
        (WebCore::StyleResolver::styleForElement):
        * css/StyleResolver.h:
        (WebCore::StyleResolver::setOverrideDocumentElementStyle):
        (WebCore::StyleResolver::State::State):

            Root element style is needed for resolving other elements. Add a way to provide it without looking
            into active document style.

        * dom/Document.cpp:
        (WebCore::Document::recalcStyle):

            Resolve the document style and commit it immediately (for now).

        (WebCore::Document::styleForElementIgnoringPendingStylesheets):
        * dom/Document.h:
        (WebCore::Document::setNeedsNotifyRemoveAllPendingStylesheet):
        (WebCore::Document::inStyleRecalc):
        (WebCore::Document::inRenderTreeUpdate):
        * dom/Element.cpp:
        (WebCore::Element::setChildIndex):

            Setting the unique bit is now done by style relations update code.

        * dom/Node.cpp:
        (WebCore::Node::setNeedsStyleRecalc):

            Prevent spurious style invalidation during render tree updating.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::styleDidChange):

            Capturing body element color for color:-webkit-text is now done by TreeResolver.

        * rendering/RenderElement.h:
        (WebCore::RenderElement::setAnimatableStyle): Deleted.

            No longer used.

        * style/RenderTreePosition.cpp:
        (WebCore::RenderTreePosition::nextSiblingRenderer):

            Skip over non-rendered slot elements.

        * style/RenderTreeUpdater.cpp: Added.
        (WebCore::RenderTreeUpdater::Parent::Parent):
        (WebCore::RenderTreeUpdater::RenderTreeUpdater):
        (WebCore::hasDisplayContents):
        (WebCore::findRenderingRoot):
        (WebCore::RenderTreeUpdater::commit):

            Call updateRenderTree for each change root.

        (WebCore::shouldCreateRenderer):
        (WebCore::RenderTreeUpdater::updateRenderTree):

            Iteratively traverse the composed tree starting for a change root.
            Apply the changes calling updateElementRenderer and updateTextRenderer as needed.
            Enter subtrees that haves changes to apply.

        (WebCore::RenderTreeUpdater::renderTreePosition):

            We may not create renderers for all elements (<slot> or more generally display:contents) that
            have rendered descendants. Search the parent stack to find the valid position.

        (WebCore::RenderTreeUpdater::pushParent):
        (WebCore::RenderTreeUpdater::popParent):
        (WebCore::RenderTreeUpdater::popParentsToDepth):

            Maintain parent stack.

        (WebCore::pseudoStyleCacheIsInvalid):
        (WebCore::RenderTreeUpdater::updateElementRenderer):

            Create, delete or update the renderer.

        (WebCore::moveToFlowThreadIfNeeded):
        (WebCore::RenderTreeUpdater::createRenderer):
        (WebCore::textRendererIsNeeded):
        (WebCore::createTextRenderer):
        (WebCore::RenderTreeUpdater::updateTextRenderer):
        (WebCore::RenderTreeUpdater::invalidateWhitespaceOnlyTextSiblingsAfterAttachIfNeeded):

            This is moved from TreeResolver.

        (WebCore::needsPseudoElement):
        (WebCore::RenderTreeUpdater::updateBeforeOrAfterPseudoElement):

            Pseudo elements are handled entirely during render tree construction. Compute their style and
            create or delete them as needed.

        * style/RenderTreeUpdater.h: Added.
        (WebCore::RenderTreeUpdater::parent):
        * style/StyleRelations.cpp:
        (WebCore::Style::commitRelationsToRenderStyle):
        (WebCore::Style::commitRelations):

            Commit to Style::Update instead of the document if needed.

        (WebCore::Style::commitRelationsToDocument): Deleted.
        * style/StyleRelations.h:
        * style/StyleSharingResolver.cpp:
        (WebCore::Style::elementHasDirectionAuto):
        (WebCore::Style::SharingResolver::resolve):

            Fetch the shareable style from Style::Update instead of the active document style.

        (WebCore::Style::SharingResolver::findSibling):
        (WebCore::Style::SharingResolver::canShareStyleWithElement):
        * style/StyleSharingResolver.h:
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::Parent::Parent):

            No need for render tree position anymore.

        (WebCore::Style::TreeResolver::popScope):
        (WebCore::Style::TreeResolver::styleForElement):
        (WebCore::Style::invalidateWhitespaceOnlyTextSiblingsAfterAttachIfNeeded):
        (WebCore::Style::createTextRendererIfNeeded):
        (WebCore::Style::updateTextRendererAfterContentChange):
        (WebCore::Style::resetStyleForNonRenderedDescendants):
        (WebCore::Style::detachChildren):
        (WebCore::Style::detachSlotAssignees):
        (WebCore::Style::detachRenderTree):
        (WebCore::Style::TreeResolver::resolveElement):

            Just resolve the style and return it, no more applying or entering render tree construction code paths.

        (WebCore::Style::resolveTextNode):
        (WebCore::Style::elementImplicitVisibility):
        (WebCore::Style::TreeResolver::pushParent):
        (WebCore::Style::TreeResolver::popParent):
        (WebCore::Style::TreeResolver::popParentsToDepth):
        (WebCore::Style::shouldResolvePseudoElement):
        (WebCore::Style::TreeResolver::resolveComposedTree):

            Add style changes to Style::Update.

        (WebCore::Style::TreeResolver::resolve):

            Return Style::Update object if non-empty.

        (WebCore::Style::postResolutionCallbackQueue):
        (WebCore::Style::shouldCreateRenderer): Deleted.
        (WebCore::Style::moveToFlowThreadIfNeeded): Deleted.
        (WebCore::Style::TreeResolver::createRenderer): Deleted.
        (WebCore::Style::TreeResolver::createRenderTreeForChildren): Deleted.
        (WebCore::Style::TreeResolver::createRenderTreeForShadowRoot): Deleted.
        (WebCore::Style::beforeOrAfterPseudoElement): Deleted.
        (WebCore::Style::setBeforeOrAfterPseudoElement): Deleted.
        (WebCore::Style::clearBeforeOrAfterPseudoElement): Deleted.
        (WebCore::Style::needsPseudoElement): Deleted.
        (WebCore::Style::TreeResolver::createRenderTreeForBeforeOrAfterPseudoElement): Deleted.
        (WebCore::Style::TreeResolver::createRenderTreeForSlotAssignees): Deleted.
        (WebCore::Style::TreeResolver::createRenderTreeRecursively): Deleted.
        (WebCore::Style::pseudoStyleCacheIsInvalid): Deleted.
        (WebCore::Style::TreeResolver::resolveBeforeOrAfterPseudoElement): Deleted.

            Remove the recursive render tree building code path.

        * style/StyleTreeResolver.h:
        (WebCore::Style::TreeResolver::scope):
        * style/StyleUpdate.cpp: Added.
        (WebCore::Style::Update::Update):
        (WebCore::Style::Update::elementUpdate):
        (WebCore::Style::Update::textUpdate):
        (WebCore::Style::Update::elementStyle):
        (WebCore::Style::Update::addElement):
        (WebCore::Style::Update::addText):
        (WebCore::Style::Update::addPossibleRoot):
        * style/StyleUpdate.h: Added.
        (WebCore::Style::Update::roots):
        (WebCore::Style::Update::document):
        * svg/SVGElement.h:
        (WebCore::SVGElement::updateRelativeLengthsInformation):
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::svgAttributeChanged):
        (WebCore::SVGUseElement::willRecalcStyle):
        (WebCore::SVGUseElement::willAttachRenderers): Deleted.

            Switvh willAttachRenderers to willRecalcStyle as the former is now called too late.

        * svg/SVGUseElement.h:

2016-03-31  Chris Fleizach  <cfleizach@apple.com>

        AX: <attachment> element not accessible
        https://bugs.webkit.org/show_bug.cgi?id=156045

        Reviewed by Joanmarie Diggs.

        Make this element accessible by exposing title, subtitle, action, progress to accessibility.

        Test: accessibility/attachment-element.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::createFromRenderer):
        * accessibility/AccessibilityAttachment.cpp: Added.
        (WebCore::AccessibilityAttachment::AccessibilityAttachment):
        (WebCore::AccessibilityAttachment::create):
        (WebCore::AccessibilityAttachment::hasProgress):
        (WebCore::AccessibilityAttachment::valueForRange):
        (WebCore::AccessibilityAttachment::attachmentElement):
        (WebCore::AccessibilityAttachment::roleDescription):
        (WebCore::AccessibilityAttachment::computeAccessibilityIsIgnored):
        (WebCore::AccessibilityAttachment::accessibilityText):
        (WebCore::AccessibilityAttachment::accessibilityDescription):
        * accessibility/AccessibilityAttachment.h: Added.
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::hasHighlighting):
        (WebCore::AccessibilityObject::roleDescription):
        (WebCore::AccessibilityObject::supportsRangeValue):
        (WebCore::AccessibilityObject::supportsARIASetSize):
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::isAttachmentElement):
        (WebCore::AccessibilityObject::isHeading):
        (WebCore::AccessibilityObject::isLink):
        (WebCore::AccessibilityObject::isImage):
        (WebCore::AccessibilityObject::isRadioButton):
        (WebCore::AccessibilityObject::isListBox):
        (WebCore::AccessibilityObject::isListBoxOption):
        (WebCore::AccessibilityObject::isAttachment):
        (WebCore::AccessibilityObject::isMediaTimeline):
        (WebCore::AccessibilityObject::isMenuRelated):
        (WebCore::AccessibilityObject::isMenu):
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper accessibilityValue]):

2016-03-31  Nan Wang  <n_wang@apple.com>

        AX: AX hit-testing does not work on WebKit video playback buttons
        https://bugs.webkit.org/show_bug.cgi?id=156084

        Reviewed by Darin Adler.

        Use the element at point instead of the shadow host for hit testing on video tags.

        Test: accessibility/mac/video-tag-hit-test.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::elementAccessibilityHitTest):
        (WebCore::shouldUseShadowHostForHitTesting):
        (WebCore::AccessibilityRenderObject::accessibilityHitTest):

2016-03-31  Alexey Proskuryakov  <ap@apple.com>

        Page overlay tests sometimes crash under MockPageOverlayClient::uninstallAllOverlays()
        https://bugs.webkit.org/show_bug.cgi?id=156080
        rdar://problem/24922183

        Reviewed by Alex Christensen.

        Make MockPageOverlayClient::m_overlays reference the overlays. There is no reference
        cycle because they are all removed between test page loads.

        * testing/MockPageOverlayClient.cpp:
        (WebCore::MockPageOverlayClient::uninstallAllOverlays):
        (WebCore::MockPageOverlayClient::pageOverlayDestroyed):
        * testing/MockPageOverlayClient.h:

2016-03-31  Daniel Bates  <dabates@apple.com>

        REGRESSION (r196012): <object>/<embed> with no URL does not match source *
        https://bugs.webkit.org/show_bug.cgi?id=156079
        <rdar://problem/25470805>

        Reviewed by Brent Fulgham.

        Fixes an issue where HTML object and embed elements that are not associated with a URL are
        allowed to load when object-src/default-src contains source *. More generally, we allow
        such elements to load so long as object-src/default-src is not 'none' per section object-src
        of the Content Security Policy Level 3 spec., <http://w3c.github.io/webappsec-csp> (Editor's Draft, 29 February 2016).

        Tests: http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-default-src-star.html
               http/tests/security/contentSecurityPolicy/embed-with-no-url-allowed-by-star.html
               http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-default-src-star.html
               http/tests/security/contentSecurityPolicy/object-with-no-url-allowed-by-star.html

        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::allowObjectFromSource): Modified to call violatedDirectiveInAnyPolicy() passing
        ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone::Yes.
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::checkSource): Modified to take argument of type ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone (defaults to false)
        and pass it through to ContentSecurityPolicySourceListDirective.
        (WebCore::checkFrameAncestors): Explicitly pass ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone::No
        to avoid URL from having the compiler implicitly convert it to a String and selecting override ContentSecurityPolicySourceListDirective::allows(const String&),
        which will lead to incorrect results. We will look to make this code less error prone in <https://bugs.webkit.org/show_bug.cgi?id=156086>.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForObjectSource): Modified to take argument of type
        ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone and pass it through.
        * page/csp/ContentSecurityPolicyDirectiveList.h:
        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::parse): Set instance variable m_isNone to true so that we can differentiate
        a source list with value 'none' from a source list that lists one or more sources or non-none keywords.
        * page/csp/ContentSecurityPolicySourceList.h:
        (WebCore::ContentSecurityPolicySourceList::isNone): Added.
        * page/csp/ContentSecurityPolicySourceListDirective.cpp:
        (WebCore::ContentSecurityPolicySourceListDirective::allows): Modified to take argument of type ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone
        and updated code to return true for an empty URL only if this argument is ContentSecurityPolicySourceListDirective::ShouldAllowEmptyURLIfSourceListIsNotNone::Yes and
        the source list does not have value 'none'.
        * page/csp/ContentSecurityPolicySourceListDirective.h:

2016-03-31  Saam barati  <sbarati@apple.com>

        Revert rewrite const as var workaround
        https://bugs.webkit.org/show_bug.cgi?id=155393

        Reviewed by Mark Lam.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::commonVM):
        * page/Settings.cpp:
        * page/Settings.h:
        (WebCore::Settings::shouldUseHighResolutionTimers):
        (WebCore::Settings::backgroundShouldExtendBeyondPage):
        (WebCore::Settings::shouldRewriteConstAsVar): Deleted.
        (WebCore::Settings::setShouldRewriteConstAsVar): Deleted.

2016-03-31  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r196854.

        We do not need those assertions anymore as it seems
        <rdar://problem/24457478> is fixed

        Reverted changeset:

        "Land release assertions to help track down a possible
        HTMLCollection lifetime bug"
        https://bugs.webkit.org/show_bug.cgi?id=154490
        http://trac.webkit.org/changeset/196854

2016-03-31  Chris Dumez  <cdumez@apple.com>

        [iOS] Both WebPage's volatility timer and WebProcess's processSuspensionCleanupTimer are trying to make surfaces volatile with very short interval
        https://bugs.webkit.org/show_bug.cgi?id=156065
        <rdar://problem/25452004>

        Reviewed by Simon Fraser.

        Export a symbol so it can be used from WebKit2.

        * page/Page.h:

2016-03-31  Daniel Bates  <dabates@apple.com>

        REGRESSION (r195605): ASSERTION FAILED: !NoEventDispatchAssertion::isEventDispatchForbidden()
        when pressing the back button on a page with a focused subframe
        https://bugs.webkit.org/show_bug.cgi?id=156033
        <rdar://problem/25446561>

        Reviewed by Chris Dumez.

        Fixes an assertion failure when navigating back, by pressing the browser back button, to
        the previous page from a page with a focused subframe.

        Following r195605 (https://bugs.webkit.org/show_bug.cgi?id=153449), the responsibility for
        dispatching a DOM pagehide event moved from CachedFrame to PageCache and we now instantiate
        a NoEventDispatchAssertion object to enforce the invariant that no additional DOM events are
        dispatched as part of adding a page to the page cache. When adding a page with a focused
        subframe to the page cache we focus its main frame, which implicitly defocuses the subframe
        and dispatches a DOM blur event at it. Therefore an assertion failure occurs when dispatching
        this DOM blur event (because a NoEventDispatchAssertion object was allocated on the stack).

        Test: fast/history/back-from-page-with-focused-iframe.html

        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::CachedFrame): Move logic to focus the main frame from here...
        * history/PageCache.cpp:
        (WebCore::PageCache::addIfCacheable): to here such that any DOM blur and focus events
        are dispatched before instantiate the NoEventDispatchAssertion object and enter the page
        cache.

2016-03-31  Chris Dumez  <cdumez@apple.com>

        REGRESSION (r191180): Safari does not send Referer Header to iframe src in certain situations
        https://bugs.webkit.org/show_bug.cgi?id=155754
        <rdar://problem/25296445>

        Unreviewed, roll out r191180 as it breaks sites and needs to be reworked.

        * html/parser/HTMLPreloadScanner.cpp:
        (WebCore::TokenPreloadScanner::tagIdFor): Deleted.
        (WebCore::TokenPreloadScanner::initiatorFor): Deleted.
        (WebCore::TokenPreloadScanner::StartTagScanner::processAttribute): Deleted.
        (WebCore::TokenPreloadScanner::StartTagScanner::resourceType): Deleted.
        * html/parser/HTMLPreloadScanner.h:

2016-03-31  Jiewen Tan  <jiewen_tan@apple.com>

        WebKit should set Original URL of a download request correctly
        https://bugs.webkit.org/show_bug.cgi?id=155914
        <rdar://problem/10473811>

        Reviewed by Anders Carlsson.

        Added API tests.

        Replace the old logic for identifying the Original URL of a download request
        with a new method based on the logic from Document::firstPartyForCookies, which
        does a much better job determining the URL a user actually visited.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::setOriginalURLForDownloadRequest):
        (WebCore::originatingURLFromBackForwardList): Deleted.

2016-03-31  Antonio Gomes  <tonikitoo@webkit.org>

        eventMayStartDrag() does not check for shiftKey or isOverLink
        https://bugs.webkit.org/show_bug.cgi?id=155746

        Reviewed by Darin Adler.

        There is currently a mismatch between the logic that checks whether
        an event can start a dragging action in EventHandler::handleMousePressEvent
        and in EventHandler::eventMayStartDrag
        Basically the former checks for event's count, type, button, target and modifier.
        The later, on the other hand, only checks for event's button and count.

        In order to sync them up again, as per the comment in the code,
        patch factors out the logic in ::handleMousePressEvent into a helper function,
        and ultimately reuses it in ::eventMayStartDrag.

        No new tests for two reasons:

        1) ::handleMousePressEvent will not have any behavior change. Code is factored out
        into a helper.

        2) The callees of ::eventMayStartDrag are currently WebPage::shouldDelayWindowOrderingEvent
        and ::acceptsFirstMouse. Based on my understanding of [1], these methods
        are called when there is a (say) browser window in background with some text selected,
        and user starts to drag the selected content. Dragging happens without bringing the window
        foreground. This is called "non-activating click".
        Such behavior will not change with the patch.

        [1] https://bugs.webkit.org/show_bug.cgi?id=55053 - "Implement non-activating clicks to allow dragging out of a background window"

        * page/EventHandler.cpp:
        (WebCore::isSingleMouseDownOnLinkOrImage):
        (WebCore::canMouseEventStartDragInternal):
        (WebCore::EventHandler::handleMousePressEvent):
        (WebCore::documentPointForWindowPoint): Moved up in the file to be used elsewhere.
        (WebCore::EventHandler::eventMayStartDrag):

2016-03-31  Antonio Gomes  <tonikitoo@webkit.org>

        SelectionController::positionForPlatform should ask EditingBehavior for platform specific behavior
        https://bugs.webkit.org/show_bug.cgi?id=41976

        Reviewed by Darin Adler.

        SSIA.

        No new tests needed.

        * editing/EditingBehavior.h:
        (WebCore::EditingBehavior::shouldAlwaysExtendSelectionFromExtentEndpoint):
        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::positionForPlatform):

2016-03-31  Jeremy Jones  <jeremyj@apple.com>

        mediaShouldUsePersistentCache() is redundant. Use Page::usesEphemeralSession() instead.
        https://bugs.webkit.org/show_bug.cgi?id=155924

        Reviewed by Simon Fraser.

        No new tests because there is no behavior change.

        Remove machinery for mediaShouldUsePersistentCache() adopt usesEphemeralSession().

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerShouldUsePersistentCache):
        * page/ChromeClient.h: remove mediaShouldUsePersistentCache()

2016-03-30  Ada Chan  <adachan@apple.com>

        Add the new "toggle enhanced fullscreen" context menu item to the video context menu on supporting platforms.
        https://bugs.webkit.org/show_bug.cgi?id=156031

        Reviewed by Eric Carlson.

        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::contextMenuItemSelected):
        Handle the selection of the context menu item.
        (WebCore::ContextMenuController::populate):
        Add this menu item on Mac.
        (WebCore::ContextMenuController::checkOrEnableIfNeeded):
        Set the menu item's title depending on the current enhanced fullscreen state
        and enable this menu item if supported.

        * platform/ContextMenuItem.h:
        Define the new tag for this menu item.

        * platform/LocalizedStrings.cpp:
        (WebCore::contextMenuItemTagEnterVideoEnhancedFullscreen):
        (WebCore::contextMenuItemTagExitVideoEnhancedFullscreen):
        * platform/LocalizedStrings.h:

        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::mediaSupportsEnhancedFullscreen):
        (WebCore::HitTestResult::mediaIsInEnhancedFullscreen):
        (WebCore::HitTestResult::toggleEnhancedFullscreenForVideo):
        * rendering/HitTestResult.h:

2016-03-31  Nan Wang  <n_wang@apple.com>

        AX: aria-hidden=false causes video fallback content to be exposed to AX API
        https://bugs.webkit.org/show_bug.cgi?id=149278

        Reviewed by Chris Fleizach.

        The comment says when aria-hidden="false" and object is not rendered, we should
        check each parent's aria-hidden status until we encounter a rendered object. So 
        added a check for the rendered parent in order to break out of the loop earlier.

        Test case covered in modified accessibility/aria-hidden-negates-no-visibility.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::isNodeAriaVisible):

2016-03-31  Brent Fulgham  <bfulgham@apple.com>

        [WK2] Support download attribute feature
        https://bugs.webkit.org/show_bug.cgi?id=102914
        <rdar://problem/13177492>

        Reviewed by Darin Adler.

        Tested by imported/w3c/web-platform-tests/html/dom/interfaces.html
                  imported/w3c/web-platform-tests/html/dom/reflection-text.html

        A first draft implementation of this feature.

        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::handleClick): If the anchor has the 'download'
        attribute, pass along the information to the rest of the load system.
        * loader/FrameLoadRequest.h:
        (WebCore::FrameLoadRequest::FrameLoadRequest): Create new overload that
        accepts a download attribute flag and a suggested filename.
        (WebCore::FrameLoadRequest::hasDownloadAttribute): Added.
        (WebCore::FrameLoadRequest::suggestedFilename): Added.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::urlSelected): Expand to accept the download attribute
        flag and suggested filename.
        (WebCore::FrameLoader::loadURL): Populate the NavigationAction with the new
        download attribute flag and suggested filename.
        (WebCore::FrameLoader::loadPostRequest): Ditto.
        * loader/FrameLoader.h:
        * loader/FrameLoaderTypes.h: Add new 'HasDownloadAttribute' enum.
        * loader/NavigationAction.cpp:
        (WebCore::navigationType):
        (WebCore::NavigationAction::NavigationAction): Update to accept new download
        attribute flag and suggested filename.
        * loader/NavigationAction.h:
        (WebCore::NavigationAction::hasDownloadAttribute): Added.
        (WebCore::NavigationAction::suggestedFilename): Added.
        * loader/PolicyChecker.cpp:
        (WebCore::PolicyChecker::checkNavigationPolicy): Pass more information to
        'continueAfterNavigationPolicy'
        (WebCore::PolicyChecker::continueAfterNavigationPolicy): Accept suggested
        filename
        * loader/PolicyChecker.h:

2016-03-31  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Add basic loading of resources for Workers
        https://bugs.webkit.org/show_bug.cgi?id=155886

        Reviewed by Alex Christensen.

        Adding impplementation to WorkerGlobalScopeFetch::fetch similarly to DOMWindowFetch::fetch.
        Refactored code in FetchResponse to share code between the two.

        Updated WorkerThreadableLoader to cope with an ASSERT.
        The ASSERT ensures that a DocumentThreadableLoader::create returns non null. 
        In our case, it might happen as all cross origin fetch requests are denied at the moment.
        This leads to calling didFail in DocumentThreadableLoader::create call and DocumentThreadableLoader::create to return null.
        Updated the ASSERT to ensures that either the load is finished or DocumentThreadableLoader::create does not return null.

        Covered by rebased tests.

        * Modules/fetch/DOMWindowFetch.cpp:
        (WebCore::DOMWindowFetch::fetch):
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::startFetching):
        (WebCore::FetchResponse::fetch):
        * Modules/fetch/FetchResponse.h:
        * Modules/fetch/WorkerGlobalScopeFetch.cpp:
        (WebCore::WorkerGlobalScopeFetch::fetch):
        * Modules/fetch/WorkerGlobalScopeFetch.h:
        * loader/WorkerThreadableLoader.cpp:
        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFinishLoading):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFail):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFailAccessControlCheck):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck):
        * loader/WorkerThreadableLoader.h:

2016-03-31  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Move isDisturbed handling to FetchBodyOwner
        https://bugs.webkit.org/show_bug.cgi?id=155968

        Reviewed by Darin Adler.

        Moved isDisturbed handling in FetchBodyOwner.
        This includes promise rejection in case of disturbed bodies.

        No behavior change observable from user scripts.

        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::arrayBuffer):
        (WebCore::FetchBody::blob):
        (WebCore::FetchBody::json):
        (WebCore::FetchBody::text):
        (WebCore::FetchBody::extractFromBody):
        (WebCore::FetchBody::consume):
        (WebCore::FetchBody::consumeArrayBuffer):
        (WebCore::FetchBody::processIfEmptyOrDisturbed): Deleted.
        * Modules/fetch/FetchBody.h:
        (WebCore::FetchBody::isEmpty): Deleted.
        * Modules/fetch/FetchBodyOwner.cpp:
        (WebCore::FetchBodyOwner::arrayBuffer):
        (WebCore::FetchBodyOwner::blob):
        (WebCore::FetchBodyOwner::formData):
        (WebCore::FetchBodyOwner::json):
        (WebCore::FetchBodyOwner::text):
        * Modules/fetch/FetchBodyOwner.h:
        (WebCore::FetchBodyOwner::isDisturbed):
        (WebCore::FetchBodyOwner::setDisturbed):
        * Modules/fetch/FetchRequest.cpp:
        (WebCore::FetchRequest::create):
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::clone):

2016-03-31  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove forEach use from Fetch Headers builtin constructor
        https://bugs.webkit.org/show_bug.cgi?id=155967

        Reviewed by Joseph Pecoraro.

        Tests: fetch/shadowing-forEach.html
               streams/shadowing-Promise.html
               streams/shadowing-defineProperty.html

        * Modules/fetch/FetchHeaders.idl: Adding fillFromJS private method.
        * Modules/fetch/FetchHeaders.js:
        (initializeFetchHeaders): Using fillFromJS private method. Using
        instanceof test to check whether parameter is Headers or subclass of it.
        * bindings/js/WebCoreBuiltinNames.h: Adding fillFromJS private symbol.

2016-03-30  Alex Christensen  <achristensen@webkit.org>

        Fix Windows build.

        * platform/text/LineEnding.cpp:
        make the char's and uint8_t's compile.

2016-03-30  Alex Christensen  <achristensen@webkit.org>

        Build fix.

        * platform/text/LineEnding.cpp:

2016-03-30  Alex Christensen  <achristensen@webkit.org>

        Fix GTK and Windows builds after r198869.

        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::blobIsOutOfDate):
        (WebCore::addEncodedBlobItemToSoupMessageBody):
        * platform/text/LineEnding.cpp:

2016-03-30  Simon Fraser  <simon.fraser@apple.com>

        [iOS WK2] Avoid creating tiles that are too large for rendering
        https://bugs.webkit.org/show_bug.cgi?id=156050
        rdar://problem/25424541

        Reviewed by Darin Adler.

        In the case of a WKWebView which is sized large enough to show an entire document
        (for example, when enclosed inside a UIScrollView), we would create tiles that were
        larger than CoreAnimation was willing to deal with.
        
        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::tileSize): Take the device scale, and the max IOSurface size
        into account when computing the max tile size.
        * platform/graphics/cocoa/IOSurface.mm:
        (IOSurface::maximumSize): CoreAnimation imposes limits in addition to the size reported
        by IOSurfaceGetPropertyMaximum(), namely an 8k cap, so mimic that here.
        (IOSurface::ensurePlatformContext): Typo.

2016-03-30  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        [EFL][CMake] WebKit include path has been added to system include path
        https://bugs.webkit.org/show_bug.cgi?id=156019

        Reviewed by Darin Adler.

        Fix wrong include path addition.

        * PlatformEfl.cmake:

            Add ${WEBCORE_DIR}/platform/graphics/surfaces/egl to WebCore include directory path.

2016-03-30  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: Update handling of SVG elements with presentational role
        https://bugs.webkit.org/show_bug.cgi?id=156042

        Reviewed by Chris Fleizach.

        Because the new expected behavior is to treat SVG elements with a
        presentational role just like we treat other host language elements
        with a presentational role, delete AccessibilitySVGElement's
        determineAriaRoleAttribute().

        No new test files. The expectations for w3c-svg-presentational-role.html
        were updated because the presentational elements which have global ARIA
        attributes are now being included in the accessibility tree. In addition,
        several new test cases were added to this layout test so that we have
        coverage for more presentational elements which lack global ARIA attributes.

        * accessibility/AccessibilitySVGElement.cpp:
        (WebCore::AccessibilitySVGElement::determineAriaRoleAttribute): Deleted.
        * accessibility/AccessibilitySVGElement.h:

2016-03-30  Brady Eidson  <beidson@apple.com>

        Make BlobData use ThreadSafeSharedBuffer instead of RawData.
        https://bugs.webkit.org/show_bug.cgi?id=156041

        Reviewed by Alex Christensen.

        No new tests (No change in behavior).

        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::consumeText):
        (WebCore::FetchBody::extractFromText):
        (WebCore::blobFromArrayBuffer):
        * Modules/fetch/FetchBody.h:
        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveBinaryData):
        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::didReceiveBinaryData):
        * Modules/websockets/WebSocket.h:
        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::processFrame):
        * Modules/websockets/WebSocketChannel.h:
        * Modules/websockets/WebSocketChannelClient.h:
        (WebCore::WebSocketChannelClient::didReceiveBinaryData):
        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveBinaryData):
        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
        * fileapi/Blob.cpp:
        (WebCore::Blob::Blob):
        * fileapi/Blob.h:
        (WebCore::Blob::create):
        * fileapi/WebKitBlobBuilder.h:
        * platform/network/BlobData.cpp:
        (WebCore::BlobData::BlobData):
        (WebCore::BlobDataItem::length):
        (WebCore::BlobData::appendData):
        (WebCore::BlobData::setContentType): Deleted.
        * platform/network/BlobData.h:
        (WebCore::BlobDataItem::type):
        (WebCore::BlobDataItem::data):
        (WebCore::BlobDataItem::file):
        (WebCore::BlobDataItem::BlobDataItem):
        (WebCore::BlobData::create):
        (WebCore::RawData::create): Deleted.
        (WebCore::RawData::data): Deleted.
        (WebCore::RawData::length): Deleted.
        (WebCore::RawData::RawData): Deleted.
        * platform/network/BlobPart.h:
        (WebCore::BlobPart::BlobPart):
        (WebCore::BlobPart::data):
        (WebCore::BlobPart::moveData):
        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::appendStorageItems):
        (WebCore::BlobRegistryImpl::registerFileBlobURL):
        (WebCore::BlobRegistryImpl::registerBlobURL):
        (WebCore::BlobRegistryImpl::registerBlobURLForSlice):
        * platform/network/BlobResourceHandle.cpp:
        (WebCore::BlobResourceHandle::getSizeForNext):
        (WebCore::BlobResourceHandle::readSync):
        (WebCore::BlobResourceHandle::readDataSync):
        (WebCore::BlobResourceHandle::readFileSync):
        (WebCore::BlobResourceHandle::readAsync):
        (WebCore::BlobResourceHandle::readDataAsync):
        (WebCore::BlobResourceHandle::readFileAsync):
        * platform/network/BlobResourceHandle.h:
        * platform/network/FormData.cpp:
        (WebCore::appendBlobResolved):
        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::blobIsOutOfDate):
        (WebCore::addEncodedBlobItemToSoupMessageBody):
        * platform/text/LineEnding.cpp:
        (WebCore::normalizeToCROrLF):
        (WebCore::normalizeLineEndingsToNative):
        (WebCore::normalizeLineEndingsToCR): Deleted.
        (WebCore::normalizeLineEndingsToLF): Deleted.
        * platform/text/LineEnding.h:
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::responseBlob):

2016-03-30  Enrica Casucci  <enrica@apple.com>

        Add a style for Data Detectors links.
        https://bugs.webkit.org/show_bug.cgi?id=155996
        rdar://problem/25343514

        Reviewed by Sam Weinig.

        Based on indication from the data detection engine,
        we style some of the links differently.

        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::detectContentInRange):
        * platform/cocoa/DataDetectorsCoreSoftLink.h:
        * platform/cocoa/DataDetectorsCoreSoftLink.mm:

2016-03-30  Myles C. Maxfield  <mmaxfield@apple.com>

        [OS X] [RTL Scrollbars] Overlay RTL scrollbars animate in from the wrong side
        https://bugs.webkit.org/show_bug.cgi?id=155962

        Reviewed by Darin Adler.

        We can control the animation direction with the NSScrollerImp property
        userInterfaceLayoutDirection.

        This patch also adds an Internals function to set whether or not we
        should mock the scrollbars. Not mocking the scrollbars is required
        to use NSScrollerImps.

        Test: fast/scrolling/rtl-scrollbars-animation-property.html

        * platform/ScrollableArea.h: Use nullptr instead of 0.
        (WebCore::ScrollableArea::horizontalScrollbar):
        (WebCore::ScrollableArea::verticalScrollbar):
        (WebCore::ScrollableArea::tiledBacking):
        (WebCore::ScrollableArea::layerForHorizontalScrollbar):
        (WebCore::ScrollableArea::layerForVerticalScrollbar):
        (WebCore::ScrollableArea::layerForScrolling):
        (WebCore::ScrollableArea::layerForScrollCorner):
        (WebCore::ScrollableArea::layerForOverhangAreas):
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::updateScrollerStyle): Set the direction
        of the new NSScrollerImps.
        * platform/mac/ScrollbarThemeMac.h:
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::ScrollbarThemeMac::didCreateScrollerImp): Set the direction
        of an NSScrollerImp.
        (WebCore::ScrollbarThemeMac::registerScrollbar): Call
        didCreateScrollerImp().
        (WebCore::ScrollbarThemeMac::isLayoutDirectionRTL): Used for testing,
        to tell if the scroller's direction is RTL.
        * platform/spi/mac/NSScrollerImpSPI.h:
        * rendering/RenderTreeAsText.cpp:
        (WebCore::write):
        * testing/Internals.cpp:
        (WebCore::Internals::setMockScrollbarsEnabled): Used for testing.
        * testing/Internals.h:
        * testing/Internals.idl:

2016-03-30  Sam Weinig  <sam@webkit.org>

        -webkit-text-underline-position: under; does not work in ToT
        https://bugs.webkit.org/show_bug.cgi?id=156038

        Reviewed by David Hyatt.

        Test: fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-under-vs-alphabetic.html

        * style/InlineTextBoxStyle.cpp:
        (WebCore::computeUnderlineOffset):
        Only resolve the underline position when based on the InlineTextBox when it is specified as auto.

2016-03-30  Alex Christensen  <achristensen@webkit.org>

        Fix Windows EWS after r198766
        https://bugs.webkit.org/show_bug.cgi?id=156029

        Reviewed by Brent Fulgham.

        * CMakeLists.txt:
        * PlatformWin.cmake:
        Copy headers before compiling WebCoreDerivedSources, not just before compiling WebCore.

2016-03-30  Brady Eidson  <beidson@apple.com>

        Random SerializedScriptValue cleanup.
        https://bugs.webkit.org/show_bug.cgi?id=156032

        Rubberstamped by Tim Hatcher.

        - Remove two unused functions.
        - Make the class always be ThreadSafeRefCounted.

        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::numberValue): Deleted.
        (WebCore::SerializedScriptValue::undefinedValue): Deleted.
        * bindings/js/SerializedScriptValue.h:

2016-03-30  Brent Fulgham  <bfulgham@apple.com>

        Avoid WebCore-prefixed paths when building WebCore
        https://bugs.webkit.org/show_bug.cgi?id=156027

        Reviewed by David Kilzer.

        Replace instances of '#include <WebCore/XXXYYY.h>"' with the normal
        '#include "XXXYYY.h"' for files inside WebCore.

        * config.h:
        * inspector/InspectorTimelineAgent.cpp:
        * page/ViewportConfiguration.cpp:
        * platform/audio/ios/AudioDestinationIOS.cpp:
        * platform/cocoa/WebVideoFullscreenModel.h:
        * platform/cocoa/WebVideoFullscreenModelVideoElement.h:
        * platform/graphics/Font.h:
        * platform/graphics/ca/cocoa/LayerFlushSchedulerMac.cpp:
        * platform/graphics/cg/ColorCG.cpp:
        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.h:
        * platform/mock/MediaPlaybackTargetPickerMock.cpp:

2016-03-30  Said Abou-Hallawa  <sabouhallawa@apple,com>

        Move the CG ImageDecoder class from ImageSourceCG.cpp to ImageDecoderCG.h and .cpp
        https://bugs.webkit.org/show_bug.cgi?id=155980

        Reviewed by Simon Fraser.

        After this step, ImageSource.cpp and ImageSourceCG.cpp look very similar
        so they can be merged in one file. All the redundant code in these two files
        can be removed.

        * PlatformAppleWin.cmake:
        * PlatformMac.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/cg/ImageDecoderCG.cpp: Copied from Source/WebCore/platform/graphics/cg/ImageSourceCG.cpp.
        (WebCore::createImageSourceOptions):
        (WebCore::imageSourceOptions):
        (WebCore::orientationFromProperties):
        (WebCore::sharedBufferGetBytesAtPosition):
        (WebCore::sharedBufferRelease):
        (WebCore::ImageDecoder::ImageDecoder):
        (WebCore::ImageDecoder::subsamplingLevelForScale):
        (WebCore::ImageDecoder::bytesDecodedToDetermineProperties):
        (WebCore::ImageDecoder::filenameExtension):
        (WebCore::ImageDecoder::isSizeAvailable):
        (WebCore::ImageDecoder::size):
        (WebCore::ImageDecoder::frameCount):
        (WebCore::ImageDecoder::repetitionCount):
        (WebCore::ImageDecoder::hotSpot):
        (WebCore::ImageDecoder::frameSizeAtIndex):
        (WebCore::ImageDecoder::frameIsCompleteAtIndex):
        (WebCore::ImageDecoder::orientationAtIndex):
        (WebCore::ImageDecoder::frameDurationAtIndex):
        (WebCore::ImageDecoder::allowSubsamplingOfFrameAtIndex):
        (WebCore::ImageDecoder::frameHasAlphaAtIndex):
        (WebCore::ImageDecoder::frameBytesAtIndex):
        (WebCore::ImageDecoder::createFrameImageAtIndex):
        (WebCore::ImageDecoder::setData):
        * platform/graphics/cg/ImageDecoderCG.h: Added.
        (WebCore::ImageDecoder::create):
        * platform/graphics/cg/ImageSourceCG.cpp:
        (WebCore::ImageDecoder::create): Deleted.
        (WebCore::createImageSourceOptions): Deleted.
        (WebCore::imageSourceOptions): Deleted.
        (WebCore::orientationFromProperties): Deleted.
        (WebCore::sharedBufferGetBytesAtPosition): Deleted.
        (WebCore::sharedBufferRelease): Deleted.
        (WebCore::ImageDecoder::ImageDecoder): Deleted.
        (WebCore::ImageDecoder::subsamplingLevelForScale): Deleted.
        (WebCore::ImageDecoder::bytesDecodedToDetermineProperties): Deleted.
        (WebCore::ImageDecoder::filenameExtension): Deleted.
        (WebCore::ImageDecoder::isSizeAvailable): Deleted.
        (WebCore::ImageDecoder::size): Deleted.
        (WebCore::ImageDecoder::frameCount): Deleted.
        (WebCore::ImageDecoder::repetitionCount): Deleted.
        (WebCore::ImageDecoder::hotSpot): Deleted.
        (WebCore::ImageDecoder::frameSizeAtIndex): Deleted.
        (WebCore::ImageDecoder::frameIsCompleteAtIndex): Deleted.
        (WebCore::ImageDecoder::orientationAtIndex): Deleted.
        (WebCore::ImageDecoder::frameDurationAtIndex): Deleted.
        (WebCore::ImageDecoder::allowSubsamplingOfFrameAtIndex): Deleted.
        (WebCore::ImageDecoder::frameHasAlphaAtIndex): Deleted.
        (WebCore::ImageDecoder::frameBytesAtIndex): Deleted.
        (WebCore::ImageDecoder::createFrameImageAtIndex): Deleted.
        (WebCore::ImageDecoder::setData): Deleted.

2016-03-30  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo][MediaFoundation] Video size is not always set.
        https://bugs.webkit.org/show_bug.cgi?id=156020

        Reviewed by Darin Adler.

        Getting the video display control object from the media session might fail the first time.
        In case it fails, we should try again when setting the video size.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::setSize):
        (WebCore::MediaPlayerPrivateMediaFoundation::getVideoDisplay):
        (WebCore::MediaPlayerPrivateMediaFoundation::onTopologySet):
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:

2016-03-30  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r198828.
        https://bugs.webkit.org/show_bug.cgi?id=156030

        Confirming PLT regression (Requested by anttik on #webkit).

        Reverted changeset:

        "Separate render tree updating from style resolve"
        https://bugs.webkit.org/show_bug.cgi?id=155298
        http://trac.webkit.org/changeset/198828

2016-03-30  Keith Miller <keith_miller@apple.com>

        Unreviewed, rollout r198808. The patch causes crashes on 32-bit and appears to be a JSBench regression.

2016-03-30  Myles C. Maxfield  <mmaxfield@apple.com>

        [OS X] [RTL Scrollbars] List boxes should obey RTL scrollbars
        https://bugs.webkit.org/show_bug.cgi?id=155991

        Reviewed by Darin Adler.

        List boxes were created before RenderLayers, and therefore don't share
        the scollbar logic with them. Instead, they manage their own Scrollbars.
        The placement logic needs to be updated to take RTL scrollbars into
        account.

        Tests: fast/scrolling/rtl-scrollbars-listbox-scroll.html
               fast/scrolling/rtl-scrollbars-listbox-select-left.html
               fast/scrolling/rtl-scrollbars-listbox-select-right.html
               fast/scrolling/rtl-scrollbars-listbox-simple.html
               fast/scrolling/rtl-scrollbars-listbox.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::contentBoxRect):
        * rendering/RenderBox.h:
        (WebCore::RenderBox::contentBoxRect): Deleted.
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::itemBoundingBoxRect):
        (WebCore::RenderListBox::paintScrollbar):
        (WebCore::RenderListBox::paintItemBackground):
        (WebCore::RenderListBox::isPointInOverflowControl):
        (WebCore::RenderListBox::listIndexAtOffset):
        (WebCore::RenderListBox::nodeAtPoint):
        (WebCore::RenderListBox::controlClipRect):
        (WebCore::RenderListBox::invalidateScrollbarRect):
        (WebCore::RenderListBox::convertFromScrollbarToContainingView):
        (WebCore::RenderListBox::convertFromContainingViewToScrollbar):
        (WebCore::RenderListBox::scrolledToTop):
        (WebCore::RenderListBox::scrolledToBottom):

2016-03-30  Myles C. Maxfield  <mmaxfield@apple.com>

        Use references instead of pointers in scrollbar-related code
        https://bugs.webkit.org/show_bug.cgi?id=155998

        Reviewed by Dean Jackson.

        Migrate pointers to references.

        No new tests because there is no behavior change.

        * page/FrameView.cpp:
        (WebCore::FrameView::invalidateScrollbarRect):
        (WebCore::FrameView::setVisibleScrollerThumbRect):
        * page/FrameView.h:
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::convertFromScrollbarToContainingView):
        (WebCore::ScrollView::convertFromContainingViewToScrollbar):
        * platform/ScrollView.h:
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::invalidateScrollbar):
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::convertFromScrollbarToContainingView):
        (WebCore::ScrollableArea::convertFromContainingViewToScrollbar):
        * platform/Scrollbar.cpp:
        (WebCore::Scrollbar::invalidateRect):
        (WebCore::Scrollbar::convertToContainingView):
        (WebCore::Scrollbar::convertFromContainingView):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::convertFromScrollbarToContainingView):
        (WebCore::RenderLayer::convertFromContainingViewToScrollbar):
        (WebCore::RenderLayer::scrollbarOffset):
        (WebCore::RenderLayer::invalidateScrollbarRect):
        * rendering/RenderLayer.h:
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::destroyRootLayer):
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::invalidateScrollbarRect):
        (WebCore::RenderListBox::convertFromScrollbarToContainingView):
        (WebCore::RenderListBox::convertFromContainingViewToScrollbar):
        * rendering/RenderListBox.h:
        * platform/win/PopupMenuWin.cpp:
        (WebCore::RenderListBox::invalidateScrollbarRect):
        * platform/win/PopupMenuWin.h:

2016-03-24  Simon Fraser  <simon.fraser@apple.com>

        Make animation events non-cancelable
        https://bugs.webkit.org/show_bug.cgi?id=78110

        Reviewed by Dan Bates.

        Make the animation events non-cancelable.

        Test: animations/animation-events-not-cancelable.html

        * dom/AnimationEvent.cpp:
        (WebCore::AnimationEvent::AnimationEvent):

2016-03-30  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Refactor positioned children code
        https://bugs.webkit.org/show_bug.cgi?id=155972

        Reviewed by Sergio Villar Senin.

        This is a refactoring of RenderGrid::offsetAndBreadthForPositionedChild()
        in order to calculate offset and breadth in a more clean way.
        Hopefully making the code easier to follow.

        Thanks to the refactoring, now positioned children in RTL
        are working fine if they use the static inline position
        (when "left" and "right" properties are both "auto").

        The other case (not having a static inline position)
        will be fixed in a separated patch.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):

2016-03-30  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Binding generator should allow passing DOM objects parameters as references
        https://bugs.webkit.org/show_bug.cgi?id=155953

        Reviewed by Alex Christensen.

        Updating binding generator to pass DOM object parameters as references.
        Introducing UsePointersEvenForNonNullableObjectArguments to disable that change.

        Updating FetchRequest.idl and DOMWindowFetch.idl to pass parameters as references.

        Updated other IDL interfaces to keep passing DOM object parameters as pointers.
        This should not change the behavior for these interfaces.
        UsePointersEvenForNonNullableObjectArguments should be progressively removed on those interfaces.

        Binding generator tests covered by rebased binding tests.

        * Modules/encryptedmedia/MediaKeySession.idl:
        * Modules/encryptedmedia/MediaKeys.idl:
        * Modules/fetch/DOMWindowFetch.cpp:
        (WebCore::DOMWindowFetch::fetch):
        * Modules/fetch/DOMWindowFetch.h:
        * Modules/fetch/DOMWindowFetch.idl:
        * Modules/fetch/FetchRequest.cpp:
        (WebCore::FetchRequest::create):
        * Modules/fetch/FetchRequest.h:
        * Modules/fetch/WorkerGlobalScopeFetch.cpp:
        (WebCore::WorkerGlobalScopeFetch::fetch):
        * Modules/fetch/WorkerGlobalScopeFetch.h:
        * Modules/mediacontrols/MediaControlsHost.idl:
        * Modules/mediasource/MediaSource.idl:
        * Modules/mediasource/SourceBuffer.idl:
        * Modules/mediastream/MediaStream.idl:
        * Modules/speech/SpeechSynthesis.idl:
        * Modules/webaudio/AudioContext.idl:
        * Modules/webaudio/OscillatorNode.idl:
        * Modules/websockets/WebSocket.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateParametersCheck):
        (IsParameterPassedByReference):
        (GenerateConstructorDefinition):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod2):
        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionVoidMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionByteMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionOctetMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionLongMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
        (WebCore::jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod8):
        (WebCore::jsTestObjPrototypeFunctionConvert1):
        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithSequence):
        (WebCore::jsTestObjPrototypeFunctionStrictFunctionWithArray):
        (WebCore::jsTestObjPrototypeFunctionVariadicNodeMethod):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2Promise):
        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalEnumArgAndDefaultValue):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod7):
        (WebCore::jsTestObjPrototypeFunctionGetSVGDocument):
        (WebCore::jsTestObjPrototypeFunctionStrictFunction):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::constructJSTestOverloadedConstructors1):
        (WebCore::constructJSTestOverloadedConstructors3):
        * css/FontFaceSet.idl:
        * css/WebKitCSSMatrix.idl:
        * dom/CompositionEvent.idl:
        * dom/DataTransfer.idl:
        * dom/Document.idl:
        * dom/Element.idl:
        * dom/EventTarget.idl:
        * dom/KeyboardEvent.idl:
        * dom/MouseEvent.idl:
        * dom/MutationEvent.idl:
        * dom/MutationObserver.idl:
        * dom/NamedNodeMap.idl:
        * dom/Node.idl:
        * dom/Range.idl:
        * dom/TextEvent.idl:
        * dom/TouchEvent.idl:
        * dom/UIEvent.idl:
        * dom/WebKitNamedFlow.idl:
        * dom/WheelEvent.idl:
        * fileapi/FileReader.idl:
        * fileapi/FileReaderSync.idl:
        * html/DOMURL.idl:
        * html/HTMLElement.idl:
        * html/HTMLMediaElement.idl:
        * html/HTMLOptionsCollection.idl:
        * html/HTMLSelectElement.idl:
        * html/canvas/CanvasRenderingContext2D.idl:
        * html/canvas/DOMPath.idl:
        * html/canvas/OESVertexArrayObject.idl:
        * html/canvas/WebGLDebugShaders.idl:
        * html/canvas/WebGLRenderingContext.idl:
        * html/canvas/WebGLRenderingContextBase.idl:
        * html/track/TextTrack.idl:
        * inspector/InspectorFrontendHost.idl:
        * page/DOMSelection.idl:
        * storage/StorageEvent.idl:
        * svg/SVGGraphicsElement.idl:
        * svg/SVGLengthList.idl:
        * svg/SVGNumberList.idl:
        * svg/SVGPathSegList.idl:
        * svg/SVGPointList.idl:
        * svg/SVGSVGElement.idl:
        * svg/SVGTransformList.idl:
        * testing/Internals.idl:
        * xml/XMLSerializer.idl:
        * xml/XPathEvaluator.idl:
        * xml/XPathExpression.idl:
        * xml/XSLTProcessor.idl:

2016-03-29  Joonghun Park  <jh718.park@samsung.com>

        [EFL] Fix build break since r198800. Unreviewed.
        https://bugs.webkit.org/show_bug.cgi?id=156011

        Currently libWebCoreDerivedSources.a cannot see the symbol located in WebCore Source files.
        This patch let the library can see the symbols of WebCore Sources.

        * PlatformEfl.cmake:

2016-03-26  Antti Koivisto  <antti@apple.com>

        Separate render tree updating from style resolve
        https://bugs.webkit.org/show_bug.cgi?id=155298

        Reviewed by Andreas Kling.

        This patch splits computing document style and applying the results into two distinct steps:

        Style::TreeResolver::resolve()
                |
                | Style::Update
                V
        RenderTreeUpdater::commit()

        Style::TreeResolver::resolve() returns a Style::Update object that contains all the changes to be made
        for the whole composed tree. RenderTreeUpdater then applies the changes updating, building or tearing
        down portions of the render tree as needed.

        Style::Update consists of a map that contains new style for each newly resolved element along with some
        metadata. A separate map contains text nodes that require reconstruction. It also tracks change roots so
        RenderTreeUpdater needs to traverse the changed subtrees only.

        The patch eliminates the recursive render tree build code path replacing it with iterative functions.

        This will enable future optimizations. For example we won't need to commit to immediate rendering
        changes simply because some script or internal function requires up-to-date style.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::State::State):
        (WebCore::StyleResolver::styleForElement):
        * css/StyleResolver.h:
        (WebCore::StyleResolver::setOverrideDocumentElementStyle):
        (WebCore::StyleResolver::State::State):

            Root element style is needed for resolving other elements. Add a way to provide it without looking
            into active document style.

        * dom/Document.cpp:
        (WebCore::Document::recalcStyle):

            Resolve the document style and commit it immediately (for now).

        (WebCore::Document::styleForElementIgnoringPendingStylesheets):
        * dom/Document.h:
        (WebCore::Document::setNeedsNotifyRemoveAllPendingStylesheet):
        (WebCore::Document::inStyleRecalc):
        (WebCore::Document::inRenderTreeUpdate):
        * dom/Element.cpp:
        (WebCore::Element::setChildIndex):

            Setting the unique bit is now done by style relations update code.

        * dom/Node.cpp:
        (WebCore::Node::setNeedsStyleRecalc):

            Prevent spurious style invalidation during render tree updating.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::styleDidChange):

            Capturing body element color for color:-webkit-text is now done by TreeResolver.

        * rendering/RenderElement.h:
        (WebCore::RenderElement::setAnimatableStyle): Deleted.

            No longer used.

        * style/RenderTreePosition.cpp:
        (WebCore::RenderTreePosition::nextSiblingRenderer):

            Skip over non-rendered slot elements.

        * style/RenderTreeUpdater.cpp: Added.
        (WebCore::RenderTreeUpdater::Parent::Parent):
        (WebCore::RenderTreeUpdater::RenderTreeUpdater):
        (WebCore::hasDisplayContents):
        (WebCore::findRenderingRoot):
        (WebCore::RenderTreeUpdater::commit):

            Call updateRenderTree for each change root.

        (WebCore::shouldCreateRenderer):
        (WebCore::RenderTreeUpdater::updateRenderTree):

            Iteratively traverse the composed tree starting for a change root.
            Apply the changes calling updateElementRenderer and updateTextRenderer as needed.
            Enter subtrees that haves changes to apply.

        (WebCore::RenderTreeUpdater::renderTreePosition):

            We may not create renderers for all elements (<slot> or more generally display:contents) that
            have rendered descendants. Search the parent stack to find the valid position.

        (WebCore::RenderTreeUpdater::pushParent):
        (WebCore::RenderTreeUpdater::popParent):
        (WebCore::RenderTreeUpdater::popParentsToDepth):

            Maintain parent stack.

        (WebCore::pseudoStyleCacheIsInvalid):
        (WebCore::RenderTreeUpdater::updateElementRenderer):

            Create, delete or update the renderer.

        (WebCore::moveToFlowThreadIfNeeded):
        (WebCore::RenderTreeUpdater::createRenderer):
        (WebCore::textRendererIsNeeded):
        (WebCore::createTextRenderer):
        (WebCore::RenderTreeUpdater::updateTextRenderer):
        (WebCore::RenderTreeUpdater::invalidateWhitespaceOnlyTextSiblingsAfterAttachIfNeeded):

            This is moved from TreeResolver.

        (WebCore::needsPseudoElement):
        (WebCore::RenderTreeUpdater::updateBeforeOrAfterPseudoElement):

            Pseudo elements are handled entirely during render tree construction. Compute their style and
            create or delete them as needed.

        * style/RenderTreeUpdater.h: Added.
        (WebCore::RenderTreeUpdater::parent):
        * style/StyleRelations.cpp:
        (WebCore::Style::commitRelationsToRenderStyle):
        (WebCore::Style::commitRelations):

            Commit to Style::Update instead of the document if needed.

        (WebCore::Style::commitRelationsToDocument): Deleted.
        * style/StyleRelations.h:
        * style/StyleSharingResolver.cpp:
        (WebCore::Style::elementHasDirectionAuto):
        (WebCore::Style::SharingResolver::resolve):

            Fetch the shareable style from Style::Update instead of the active document style.

        (WebCore::Style::SharingResolver::findSibling):
        (WebCore::Style::SharingResolver::canShareStyleWithElement):
        * style/StyleSharingResolver.h:
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::Parent::Parent):

            No need for render tree position anymore.

        (WebCore::Style::TreeResolver::popScope):
        (WebCore::Style::TreeResolver::styleForElement):
        (WebCore::Style::invalidateWhitespaceOnlyTextSiblingsAfterAttachIfNeeded):
        (WebCore::Style::createTextRendererIfNeeded):
        (WebCore::Style::updateTextRendererAfterContentChange):
        (WebCore::Style::resetStyleForNonRenderedDescendants):
        (WebCore::Style::detachChildren):
        (WebCore::Style::detachSlotAssignees):
        (WebCore::Style::detachRenderTree):
        (WebCore::Style::TreeResolver::resolveElement):

            Just resolve the style and return it, no more applying or entering render tree construction code paths.

        (WebCore::Style::resolveTextNode):
        (WebCore::Style::elementImplicitVisibility):
        (WebCore::Style::TreeResolver::pushParent):
        (WebCore::Style::TreeResolver::popParent):
        (WebCore::Style::TreeResolver::popParentsToDepth):
        (WebCore::Style::shouldResolvePseudoElement):
        (WebCore::Style::TreeResolver::resolveComposedTree):

            Add style changes to Style::Update.

        (WebCore::Style::TreeResolver::resolve):

            Return Style::Update object if non-empty.

        (WebCore::Style::postResolutionCallbackQueue):
        (WebCore::Style::shouldCreateRenderer): Deleted.
        (WebCore::Style::moveToFlowThreadIfNeeded): Deleted.
        (WebCore::Style::TreeResolver::createRenderer): Deleted.
        (WebCore::Style::TreeResolver::createRenderTreeForChildren): Deleted.
        (WebCore::Style::TreeResolver::createRenderTreeForShadowRoot): Deleted.
        (WebCore::Style::beforeOrAfterPseudoElement): Deleted.
        (WebCore::Style::setBeforeOrAfterPseudoElement): Deleted.
        (WebCore::Style::clearBeforeOrAfterPseudoElement): Deleted.
        (WebCore::Style::needsPseudoElement): Deleted.
        (WebCore::Style::TreeResolver::createRenderTreeForBeforeOrAfterPseudoElement): Deleted.
        (WebCore::Style::TreeResolver::createRenderTreeForSlotAssignees): Deleted.
        (WebCore::Style::TreeResolver::createRenderTreeRecursively): Deleted.
        (WebCore::Style::pseudoStyleCacheIsInvalid): Deleted.
        (WebCore::Style::TreeResolver::resolveBeforeOrAfterPseudoElement): Deleted.

            Remove the recursive render tree building code path.

        * style/StyleTreeResolver.h:
        (WebCore::Style::TreeResolver::scope):
        * style/StyleUpdate.cpp: Added.
        (WebCore::Style::Update::Update):
        (WebCore::Style::Update::elementUpdate):
        (WebCore::Style::Update::textUpdate):
        (WebCore::Style::Update::elementStyle):
        (WebCore::Style::Update::addElement):
        (WebCore::Style::Update::addText):
        (WebCore::Style::Update::addPossibleRoot):
        * style/StyleUpdate.h: Added.
        (WebCore::Style::Update::roots):
        (WebCore::Style::Update::document):
        * svg/SVGElement.h:
        (WebCore::SVGElement::updateRelativeLengthsInformation):
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::svgAttributeChanged):
        (WebCore::SVGUseElement::willRecalcStyle):
        (WebCore::SVGUseElement::willAttachRenderers): Deleted.

            Switch willAttachRenderers to willRecalcStyle as the former is now called too late.

        * svg/SVGUseElement.h:

2016-03-29  Nan Wang  <n_wang@apple.com>

        AX: VoiceOver not announcing the right header information for table on iOS
        https://bugs.webkit.org/show_bug.cgi?id=155907

        Reviewed by Chris Fleizach.

        Make sure we consider the case where header elements size does not equal to
        row size.

        Test: accessibility/ios-simulator/table-row-column-headers.html

        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper accessibilityHeaderElements]):

2016-03-29  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION (r198782): CGImageSourceUpdateData() is called twice with the same data every time ImageSource::setData() is called
        https://bugs.webkit.org/show_bug.cgi?id=155997

        Reviewed by Simon Fraser.

        Remove a call to CGImageSourceUpdateData() which was mistakenly left in
        ImageDecoder::setData() after ImageSource refactoring.

        * platform/graphics/cg/ImageSourceCG.cpp:
        (WebCore::ImageDecoder::setData):

2016-03-29  Myles C. Maxfield  <mmaxfield@apple.com>

        REGRESSION(r198784) Shouldn't add platform-dependent code to ScrollableArea.h
        https://bugs.webkit.org/show_bug.cgi?id=155999

        Rolling out the patch.

        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::horizontalScrollbar):
        (WebCore::ScrollableArea::verticalScrollbar):
        (WebCore::ScrollableArea::tiledBacking):
        (WebCore::ScrollableArea::layerForHorizontalScrollbar):
        (WebCore::ScrollableArea::layerForVerticalScrollbar):
        (WebCore::ScrollableArea::layerForScrolling):
        (WebCore::ScrollableArea::layerForScrollCorner):
        (WebCore::ScrollableArea::layerForOverhangAreas):
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::updateScrollerStyle): Deleted.
        * platform/mac/ScrollableAreaMac.mm:
        (WebCore::ScrollableArea::setScrollbarLayoutDirection): Deleted.
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::ScrollbarThemeMac::registerScrollbar): Deleted.
        * platform/spi/mac/NSScrollerImpSPI.h:

2016-03-29  Alex Christensen  <achristensen@webkit.org>

        Fix Windows clean build.

        * CMakeLists.txt:
        Make sure WebCoreDerivedSources is done building before building WebCore.

2016-03-29  Keith Miller  <keith_miller@apple.com>

        [ES6] Add support for Symbol.isConcatSpreadable.
        https://bugs.webkit.org/show_bug.cgi?id=155351

        Reviewed by Saam Barati.

        Makes runtime arrays have the new ArrayType

        * bridge/runtime_array.h:
        (JSC::RuntimeArray::createStructure):

2016-03-29  Nan Wang  <n_wang@apple.com>

        AX: VoiceOver: Navigating Numbered Lists Causes Number to be announced On Each Line of List
        https://bugs.webkit.org/show_bug.cgi?id=155984

        Reviewed by Chris Fleizach.

        We should limit the list marker text only to the first line of that list item.

        Test: accessibility/mac/attributed-string-with-listitem-multiple-lines.html

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::listMarkerTextForNodeAndPosition):
        (WebCore::AccessibilityObject::stringForRange):

2016-03-29  Antonio Gomes  <tonikitoo@webkit.org>

        Wheel events' latching state is not reset when appropriate
        https://bugs.webkit.org/show_bug.cgi?id=155746

        Reviewed by Simon Fraser.

        When one performs a two fingers scroll (with trackpad),
        it might either trigger a kinetic scroll movement (by
        flickering with both fingers in a given direction) or perform
        a static scroll movement (without the flicker animation).

        In case of the first scenario (kinetic), the container being
        scrolled is "latched" during the scroll animation and properly unlatched
        once the scroll ends. See the call to 'shouldResetLatching' in EventHandlerMac.mm.
        When transitioning from non-momentum to momentum scroll, the following events are seen:
        - 'phase PlatformWheelEventPhaseEnded' 'momentumPhase PlatformWheelEventPhaseNone' -> end of static scroll
        - 'phase PlatformWheelEventPhaseNone' 'momentumPhase PlatformWheelEventPhaseBegan' -> start of momentum scroll

        On the second scenario (static scroll), when the scroll movement ends,
        the latched state is not reset. This might actually cause scrolling elsewhere on the page to scroll
        the previously latched container.
        Note that, only specific wheel event below is fired when static scroll ends:
        - 'phase PlatformWheelEventPhaseEnded' 'momentumPhase PlatformWheelEventPhaseNone'

        In order to fix this, patch installs a timer as soon as a non-momentum
        wheel scroll event end fires. It works as follows:

        - If the timer fires, the latched state is reset, preventing scrolling getting stuck to
        a previously latched scrollable.
        - If platform code starts sending momentum wheel scroll events before it times out, the timer is
        stopped and the latched state remains untouched (this is a flick scroll case).
        - If a new wheel scroll gesture starts, the latched state is manually reset
        and the timer stopped.

        Note that given that latched state logic applies primarily to main frames,
        the timer only gets manipulated for main frame objects.

        Test: tiled-drawing/scrolling/scroll-iframe-latched-selects.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::doOrScheduleClearLatchedStateIfNeeded):
        * page/EventHandler.h:
        * page/MainFrame.cpp:
        (WebCore::MainFrame::MainFrame):
        (WebCore::MainFrame::~MainFrame):
        * page/MainFrame.h:
        * page/mac/EventHandlerMac.mm:
        (WebCore::scrollableAreaForContainerNode):
        (WebCore::latchedToFrameOrBody):
        (WebCore::areWheelEventsTransitioningToMomentumScrolling):
        (WebCore::areWheelEventsEndingNonMomentumScrolling):
        (WebCore::EventHandler::doOrScheduleClearLatchedStateIfNeeded):

2016-03-29  Alex Christensen  <achristensen@webkit.org>

        Fix Windows build.

        * CMakeLists.txt:

2016-03-29  Alex Christensen  <achristensen@webkit.org>

        Windows build fix.

        * CMakeLists.txt:
        DerivedSources.cpp should be in WebCore_DERIVED_SOURCES because it depends on the derived sources.

2016-03-29  Alex Christensen  <achristensen@webkit.org>

        Fix Windows build after r198777

        * CMakeLists.txt:
        * PlatformEfl.cmake:
        WebCore_DERIVED_SOURCES should not be in WebCore_SOURCES.  If it's needed for EFL,
        then keep it in the EFL-specific platform.
        * PlatformWin.cmake:
        Make more derived sources in WebCore_DERIVED_SOURCES.

2016-03-29  Saam barati  <sbarati@apple.com>

        Allow builtin JS functions to be intrinsics
        https://bugs.webkit.org/show_bug.cgi?id=155960

        Reviewed by Mark Lam.

        * ForwardingHeaders/runtime/Intrinsic.h: Added.

2016-03-29  Myles C. Maxfield  <mmaxfield@apple.com>

        [Cocoa] Rename ScrollbarPainter variables to ScrollerImp
        https://bugs.webkit.org/show_bug.cgi?id=155976

        Reviewed by Simon Fraser.

        This patch continues where r198078 left off. That patch renamed all the types,
        however, there are some variables which were left as "scrollbarPainter". This
        patch completes the transition to ScrollerImp.

        No new tests because there is no behavior change.

        * platform/mac/ScrollAnimatorMac.h:
        * platform/mac/ScrollAnimatorMac.mm:
        (scrollerImpForScrollbar):
        (-[WebScrollerImpPairDelegate scrollerImpPair:convertContentPoint:toScrollerImp:]):
        (-[WebScrollbarPartAnimation startAnimation]):
        (-[WebScrollbarPartAnimation setCurrentProgress:]):
        (-[WebScrollerImpDelegate mouseLocationInScrollerForScrollerImp:]):
        (-[WebScrollerImpDelegate scrollerImp:animateKnobAlphaTo:duration:]):
        (-[WebScrollerImpDelegate scrollerImp:animateTrackAlphaTo:duration:]):
        (-[WebScrollerImpDelegate scrollerImp:animateUIStateTransitionWithDuration:]):
        (-[WebScrollerImpDelegate scrollerImp:animateExpansionTransitionWithDuration:]):
        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
        (WebCore::ScrollAnimatorMac::~ScrollAnimatorMac):
        (WebCore::ScrollAnimatorMac::contentAreaWillPaint):
        (WebCore::ScrollAnimatorMac::mouseEnteredContentArea):
        (WebCore::ScrollAnimatorMac::mouseExitedContentArea):
        (WebCore::ScrollAnimatorMac::mouseMovedInContentArea):
        (WebCore::ScrollAnimatorMac::mouseEnteredScrollbar):
        (WebCore::ScrollAnimatorMac::mouseExitedScrollbar):
        (WebCore::ScrollAnimatorMac::mouseIsDownInScrollbar):
        (WebCore::ScrollAnimatorMac::willStartLiveResize):
        (WebCore::ScrollAnimatorMac::contentsResized):
        (WebCore::ScrollAnimatorMac::willEndLiveResize):
        (WebCore::ScrollAnimatorMac::contentAreaDidShow):
        (WebCore::ScrollAnimatorMac::contentAreaDidHide):
        (WebCore::ScrollAnimatorMac::didBeginScrollGesture):
        (WebCore::ScrollAnimatorMac::didEndScrollGesture):
        (WebCore::ScrollAnimatorMac::mayBeginScrollGesture):
        (WebCore::ScrollAnimatorMac::lockOverlayScrollbarStateToHidden):
        (WebCore::ScrollAnimatorMac::scrollbarsCanBeActive):
        (WebCore::ScrollAnimatorMac::didAddVerticalScrollbar):
        (WebCore::ScrollAnimatorMac::willRemoveVerticalScrollbar):
        (WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar):
        (WebCore::ScrollAnimatorMac::willRemoveHorizontalScrollbar):
        (WebCore::ScrollAnimatorMac::invalidateScrollbarPartLayers):
        (WebCore::ScrollAnimatorMac::verticalScrollbarLayerDidChange):
        (WebCore::ScrollAnimatorMac::horizontalScrollbarLayerDidChange):
        (WebCore::ScrollAnimatorMac::shouldScrollbarParticipateInHitTesting):
        (WebCore::ScrollAnimatorMac::notifyContentAreaScrolled):
        (WebCore::ScrollAnimatorMac::updateScrollerStyle):
        (WebCore::ScrollAnimatorMac::initialScrollbarPaintTimerFired):
        (WebCore::ScrollAnimatorMac::sendContentAreaScrolled):
        (scrollbarPainterForScrollbar): Deleted.
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::ScrollbarThemeMac::registerScrollbar):
        (WebCore::ScrollbarThemeMac::scrollbarThickness):
        (WebCore::scrollerImpPaint):
        (WebCore::ScrollbarThemeMac::paint):
        (WebCore::scrollbarPainterPaint): Deleted.

2016-03-29  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: We should have a way to capture heap snapshots programatically.
        https://bugs.webkit.org/show_bug.cgi?id=154407
        <rdar://problem/24726292>

        Reviewed by Timothy Hatcher.

        Test: inspector/console/heapSnapshot.html

        * page/PageConsoleClient.cpp:
        (WebCore::PageConsoleClient::takeHeapSnapshot):
        * page/PageConsoleClient.h:
        Pass through to Inspector Instrumentation.

        * inspector/InspectorConsoleInstrumentation.h:
        (WebCore::InspectorInstrumentation::takeHeapSnapshot):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::takeHeapSnapshotImpl):
        * inspector/InspectorInstrumentation.h:
        Pass through to InspectorConsoleAgent.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        * inspector/PageConsoleAgent.cpp:
        (WebCore::PageConsoleAgent::PageConsoleAgent):
        * inspector/PageConsoleAgent.h:
        * inspector/WebConsoleAgent.cpp:
        (WebCore::WebConsoleAgent::WebConsoleAgent):
        * inspector/WebConsoleAgent.h:
        * workers/WorkerConsoleClient.cpp:
        (WebCore::WorkerConsoleClient::takeHeapSnapshot):
        * workers/WorkerConsoleClient.h:
        Provide a HeapAgent to the ConsoleAgent.

2016-03-29  Zalan Bujtas  <zalan@apple.com>

        REGRESSION (r196813): Missing plug-in placeholder is missing
        https://bugs.webkit.org/show_bug.cgi?id=155973
        <rdar://problem/25068392>

        Reviewed by Andy Estes.

        Show unavailable plugin indicator when UnavailablePluginIndicatorState (uninitialized, hidden, visible) is not set to hidden explicitly.
        It matches pre-196813 behaviour.

        Unable to test.

        * rendering/RenderEmbeddedObject.h:
        (WebCore::RenderEmbeddedObject::showsUnavailablePluginIndicator):

2016-03-29  Myles C. Maxfield  <mmaxfield@apple.com>

        [OS X] [RTL Scrollbars] Overlay RTL scrollbars animate in from the wrong side
        https://bugs.webkit.org/show_bug.cgi?id=155962

        Reviewed by Simon Fraser.

        We can control the animation direction with the NSScrollerImp property
        userInterfaceLayoutDirection.

        Not testable.

        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::setScrollbarLayoutDirection):
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::horizontalScrollbar):
        (WebCore::ScrollableArea::verticalScrollbar):
        (WebCore::ScrollableArea::tiledBacking):
        (WebCore::ScrollableArea::layerForHorizontalScrollbar):
        (WebCore::ScrollableArea::layerForVerticalScrollbar):
        (WebCore::ScrollableArea::layerForScrolling):
        (WebCore::ScrollableArea::layerForScrollCorner):
        (WebCore::ScrollableArea::layerForOverhangAreas):
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::updateScrollerStyle):
        * platform/mac/ScrollableAreaMac.mm:
        (WebCore::ScrollableArea::setScrollbarDirection):
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::ScrollbarThemeMac::registerScrollbar):
        * platform/spi/mac/NSScrollerImpSPI.h:

2016-03-29  Dan Bernstein  <mitz@apple.com>

        Inline WebFullScreenVideoRootViewController.m
        https://bugs.webkit.org/show_bug.cgi?id=155971

        Reviewed by Anders Carlsson.

        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (createFullScreenVideoRootViewControllerClass): Replaced with the code from
          WebFullScreenVideoRootViewController.m.

2016-03-29  Said Abou-Hallawa  <sabouhallawa@apple,com>

        Create a CG ImageDecoder class instead of defining it as CGImageSourceRef
        https://bugs.webkit.org/show_bug.cgi?id=155422

        Reviewed by Simon Fraser.

        Move the image CG decoding code from the class ImageSource out to a new
        class named ImageDecoder. The purpose of this split is to unify the code
        of the ImageSource for all platforms. This class should be a container
        for the ImageDecoder. All the direct frame manipulation like querying the
        frame metadata or creating a frame image should be the responsibility of
        the ImageDecoder. The ImageSource will be responsible of the image frame
        caching. When responding to a frame metadata query, for example. the
        ImageSource checks its cache first. If an entry does not exist for the
        requested frame, the ImageSource will cache the image and the metadata
        of this frame. The ImageSource will respond at the end from the image
        frame cache.
 
        The plan after this patch is is the following:
            -- Move the new class to separate files
            -- Merge the ImageSource.cpp and ImageSourceCG.cpp. in one file
            -- Move caching the FrameData from BitmapImage to ImageSource.
 
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::imageSizeForRenderer):
        BitmapImage::sizeRespectingOrientation() does not take any argument now.
        Fix the call to this function and delete the conditionally compiled code 
        since the code is the same for the two cases.
 
        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::updateSize):
        (WebCore::BitmapImage::sizeRespectingOrientation):
        (WebCore::BitmapImage::frameImageAtIndex):
        (WebCore::BitmapImage::BitmapImage):
        An image can have two sizes: size() and sizeRespectingOrientation(). The
        sizeRespectingOrientation() is the transpose of size() iff the image
        orientation has usesWidthAsHeight() is true. So there is no need for the
        ImageOrientationDescription argument. So there is no need for the members
        m_imageOrientation or m_shouldRespectImageOrientation. Also move
        m_allowSubsampling and m_minimumSubsamplingLevel (which should be named
        m_maximumSubsamplingLevel) to ImageSource instead.

        (WebCore::BitmapImage::frameOrientationAtIndex): Replace DefaultImageOrientation
        by ImageOrientation().
        
        (WebCore::BitmapImage::dump): Move dumping the image metadata to the
        ImageSource.
        
        * platform/graphics/BitmapImage.h:
        
        * platform/graphics/GraphicsContext.h:
        * platform/graphics/ImageOrientation.h:
        (WebCore::ImageOrientation::ImageOrientation):
        (WebCore::ImageOrientation::fromEXIFValue):
        (WebCore::ImageOrientation::operator ImageOrientationEnum):
        Add a casting operator to ImageOrientation so it can be dumped as enum
        value. Also add a default constructor and make the other constructor be
        explicit. All the rvalues DefaultImageOrientation should be replaced by
        ImageOrientation().

        * platform/graphics/ImageSource.cpp:
        (WebCore::ImageSource::ImageSource):
        (WebCore::ImageSource::clear):
        m_decoder is now a unique_ptr. To release it, assign it to nullptr.

        (WebCore::ImageSource::ensureDecoderIsCreated): Ensure m_decoder is created.
        
        (WebCore::ImageSource::setData): Call ensureDecoderIsCreated() before
        actually setting the data.
        
        (WebCore::ImageSource::isSizeAvailable): Use initialized();
        
        (WebCore::ImageSource::size):
        (WebCore::ImageSource::sizeRespectingOrientation):
        (WebCore::ImageSource::frameSizeAtIndex):
        These functions return the size of the image.
    
        (WebCore::ImageSource::getHotSpot):
        (WebCore::ImageSource::repetitionCount):
        (WebCore::ImageSource::frameCount):
        (WebCore::ImageSource::createFrameImageAtIndex):
        (WebCore::ImageSource::frameDurationAtIndex):
        (WebCore::ImageSource::orientationAtIndex):
        (WebCore::ImageSource::frameHasAlphaAtIndex):
        (WebCore::ImageSource::frameIsCompleteAtIndex):
        (WebCore::ImageSource::frameBytesAtIndex):
        Check for initialized() instead of checking m_decoder.
        
        (WebCore::ImageSource::dump): Dump the image metadata.
        
        (WebCore::ImageSource::initialized): Deleted.
        
        * platform/graphics/ImageSource.h: The image decoder is now named
        ImageDecoder for all platforms.
        
        (WebCore::ImageSource::initialized): Moved to the header file.

        (WebCore::ImageSource::setAllowSubsampling): Moved from BitmapImage.
        
        * platform/graphics/cairo/BitmapImageCairo.cpp:
        (WebCore::BitmapImage::BitmapImage):
        (WebCore::BitmapImage::determineMinimumSubsamplingLevel): Deleted.
        Delete initializing m_minimumSubsamplingLevel and determineMinimumSubsamplingLevel()
        since they are moved to ImageSource.
        
        * platform/graphics/cg/BitmapImageCG.cpp:
        (WebCore::BitmapImage::BitmapImage):
        (WebCore::BitmapImage::determineMinimumSubsamplingLevel): Deleted.
        Delete members and methods which are now owned and calculated by ImageSource.
        
        * platform/graphics/cg/ImageSourceCG.cpp:
        (WebCore::ImageDecoder::create): Returns a CG ImageDecoder object.
        
        (WebCore::orientationFromProperties):  Replace DefaultImageOrientation
        by ImageOrientation().
        
        (WebCore::ImageDecoder::ImageDecoder): Creates a native CG image decoder.
        
        (WebCore::ImageDecoder::~ImageDecoder): Releases the native CG image decoder.
        
        (WebCore::ImageDecoder::subsamplingLevelForScale): Moved from ImageSource.
        A new argument named 'maximumSubsamplingLevel' is added to low filter the
        return value.
        
        (WebCore::ImageDecoder::bytesDecodedToDetermineProperties):
        (WebCore::ImageDecoder::filenameExtension):
        (WebCore::ImageDecoder::isSizeAvailable):
        (WebCore::ImageDecoder::size):
        (WebCore::ImageDecoder::frameCount):
        (WebCore::ImageDecoder::repetitionCount):
        (WebCore::ImageDecoder::hotSpot):
        (WebCore::ImageDecoder::frameSizeAtIndex):
        (WebCore::ImageDecoder::frameIsCompleteAtIndex):
        (WebCore::ImageDecoder::orientationAtIndex):
        (WebCore::ImageDecoder::frameDurationAtIndex):
        (WebCore::ImageDecoder::allowSubsamplingOfFrameAtIndex):
        (WebCore::ImageDecoder::frameHasAlphaAtIndex):
        (WebCore::ImageDecoder::frameBytesAtIndex):
        (WebCore::ImageDecoder::createFrameImageAtIndex):
        (WebCore::ImageDecoder::setData):
        The code of these function was moved from the functions of ImageSource.
        
        (WebCore::ImageSource::ImageSource):
        (WebCore::ImageSource::~ImageSource):
        (WebCore::ImageSource::clear):
        (WebCore::ImageSource::ensureDecoderIsCreated):
        (WebCore::ImageSource::setData):
        (WebCore::ImageSource::filenameExtension):
        (WebCore::ImageSource::calculateMaximumSubsamplingLevel):
        (WebCore::ImageSource::maximumSubsamplingLevel):
        (WebCore::ImageSource::subsamplingLevelForScale):
        (WebCore::ImageSource::isSizeAvailable):
        (WebCore::ImageSource::allowSubsamplingOfFrameAtIndex):
        (WebCore::ImageSource::frameSizeAtIndex):
        (WebCore::ImageSource::orientationAtIndex):
        (WebCore::ImageSource::size):
        (WebCore::ImageSource::sizeRespectingOrientation):
        (WebCore::ImageSource::getHotSpot):
        (WebCore::ImageSource::bytesDecodedToDetermineProperties):
        (WebCore::ImageSource::repetitionCount):
        (WebCore::ImageSource::frameCount):
        (WebCore::ImageSource::createFrameImageAtIndex):
        (WebCore::ImageSource::frameIsCompleteAtIndex):
        (WebCore::ImageSource::frameDurationAtIndex):
        (WebCore::ImageSource::frameHasAlphaAtIndex):
        (WebCore::ImageSource::frameBytesAtIndex):
        Call m_decoder's function to do the real work.
        
        (WebCore::ImageSource::dump): Dump the image metadata.
        
        (WebCore::ImageSource::initialized): Deleted.
        
        * platform/image-decoders/ImageDecoder.cpp:
        (WebCore::ImageDecoder::create):
        * platform/image-decoders/ImageDecoder.h:
        Change the return of ImageDecoder::create() to be unique_ptr.
        
        * platform/mac/DragImageMac.mm:
        (WebCore::createDragImageFromImage): Delete unneeded argument.

2016-03-29  Eric Carlson  <eric.carlson@apple.com>

        media/track/track-remove-track.html is flaky, crashing and failing
        https://bugs.webkit.org/show_bug.cgi?id=130971

        Reviewed by Alexey Proskuryakov.
        
        Prevent HTMLMediaElement from being collected while it is creating media controls.
        These changes prevent the test from crashing but they do not fix the flakiness,
        which is caused by another bug. Fixing that is tracked by 
        https://bugs.webkit.org/show_bug.cgi?id=155956.

        * html/HTMLMediaElement.cpp:
        (WebCore::actionName): New, debugging-only helper function.
        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize new variables.
        (WebCore::HTMLMediaElement::scheduleDelayedAction): Log the flag names to make debugging easier.
        (WebCore::HTMLMediaElement::scheduleNextSourceChild): Add logging.
        (WebCore::HTMLMediaElement::updateActiveTextTrackCues): Update logging.
        (WebCore::HTMLMediaElement::configureTextTrackGroup): Drive-by optimization: don't call 
          updateCaptionContainer here, call it before exiting configureTextTracks so we only call
          it once instead of once per track group.
        (WebCore::controllerJSValue):
        (WebCore::HTMLMediaElement::ensureMediaControlsShadowRoot): New, wrapper around calling
          ensureUserAgentShadowRoot so m_creatingControls can be set and cleared appropriately.
        (WebCore::HTMLMediaElement::updateCaptionContainer): ensureUserAgentShadowRoot -> 
          ensureMediaControlsShadowRoot. Drive by optimization: set/test m_haveSetupCaptionContainer
          so we only do this setup once.
        (WebCore::HTMLMediaElement::configureTextTracks): Call updateCaptionContainer.
        (WebCore::HTMLMediaElement::clearMediaPlayer): Log flag names.
        (WebCore::HTMLMediaElement::hasPendingActivity): Return true when creating controls so GC
          won't happen during controls setup.
        (WebCore::HTMLMediaElement::updateTextTrackDisplay): ensureUserAgentShadowRoot -> 
          ensureMediaControlsShadowRoot.
        (WebCore::HTMLMediaElement::createMediaControls): Ditto.
        (WebCore::HTMLMediaElement::configureMediaControls): Ditto.
        (WebCore::HTMLMediaElement::configureTextTrackDisplay): Ditto.
        * html/HTMLMediaElement.h:

2016-03-29  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Unreviewed EFL build fix caused by r198773

        * CMakeLists.txt: Append WebCore_DERIVED_SOURCES to WebCore source list.

2016-03-29  Joseph Pecoraro  <pecoraro@apple.com>

        Audit WebCore builtins for user overridable code
        https://bugs.webkit.org/show_bug.cgi?id=155923

        Reviewed by Youenn Fablet.

        Tests: fetch/builtin-overrides.html
               streams/builtin-overrides.html

        * Modules/fetch/FetchHeaders.js:
        (initializeFetchHeaders):
        Avoid using an Array.prototype.forEach that could be overriden.

        * Modules/streams/ByteLengthQueuingStrategy.js:
        (initializeByteLengthQueuingStrategy):
        * Modules/streams/CountQueuingStrategy.js:
        (initializeCountQueuingStrategy):
        Use the private Object.defineProperty not one that could be overriden.

        * Modules/streams/ReadableStreamInternals.js:
        (finishClosingReadableStream):
        Fix style.

        * Modules/streams/WritableStream.js:
        (write):
        Fix error message to use the correct function name.

2016-03-28  Zalan Bujtas  <zalan@apple.com>

        Pixel turds when bordered div is resized on SMF forum software.
        https://bugs.webkit.org/show_bug.cgi?id=155957
        <rdar://problem/25010646>

        Reviewed by Simon Fraser.

        Use unmodified, non-snapped bounding box rect when computing dirty rects.

        Test: fast/repaint/hidpi-box-with-subpixel-height-inflates.html

        * rendering/RenderBox.h:
        * rendering/RenderBoxModelObject.h:
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::getTrailingCorner):
        * rendering/RenderInline.h:
        * rendering/RenderLineBreak.cpp:
        (WebCore::RenderLineBreak::borderBoundingBox): Deleted.
        * rendering/RenderLineBreak.h:
        * rendering/RenderView.cpp:
        (WebCore::RenderView::setBestTruncatedAt):

2016-03-28  Chris Fleizach  <cfleizach@apple.com>

        AX: Crash when AX trying to create element for an old auto fill element
        https://bugs.webkit.org/show_bug.cgi?id=155943

        Reviewed by Joanmarie Diggs.

        When an auto-fill element is removed, the Node hangs around but the renderer is gone.
        In those cases, we can't blindly add the result of getOrCreate to the children array.

        Test: accessibility/auto-fill-crash.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::addTextFieldChildren):

2016-03-28  Chris Fleizach  <cfleizach@apple.com>

        AX: iOS: Can't navigate inside ContentEditable fields with voiceover enabled
        https://bugs.webkit.org/show_bug.cgi?id=155942

        Reviewed by Joanmarie Diggs.

        The code to set the selected text range on a non-native text control (like a contenteditable) was either
        wrong or broke at some point. It assumed that creating a Position with the contenteditable node with the right
        offset would make a valid Position, but it almost never did.

        Instead we can use this helper method to create a valid Position.

        Test: accessibility/set-selected-text-range-contenteditable.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::setSelectedTextRange):

2016-03-28  Alex Christensen  <achristensen@webkit.org>

        Fix Ninja build on Mac
        https://bugs.webkit.org/show_bug.cgi?id=151399

        Reviewed by Darin Adler.

        * CMakeLists.txt:
        * PlatformEfl.cmake:
        * PlatformGTK.cmake:
        * PlatformMac.cmake:
        This moves WebCoreDerivedSources to a separate static library to reduce linker command 
        line lengths when using ninja on mac. This also helps Windows builds, which sometimes 
        regenerate everything every time you build; now you'll be able to just build WebCore
        and WebKit without all the WebCoreDerivedSources stuff.

2016-03-28  Brady Eidson  <beidson@apple.com>

        Fix build on some stricter compilers by removing unnecessary WTFMove.
        Opportunistically remove some unnecessary "WebCore::"s
        Followup to r198762

        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::keyPathAny):
        (WebCore::IDBObjectStore::transaction):
        (WebCore::IDBObjectStore::openCursor):
        (WebCore::IDBObjectStore::get):
        (WebCore::IDBObjectStore::add):
        (WebCore::IDBObjectStore::put):
        (WebCore::IDBObjectStore::deleteFunction):
        (WebCore::IDBObjectStore::clear):
        (WebCore::IDBObjectStore::createIndex):
        (WebCore::IDBObjectStore::index):
        (WebCore::IDBObjectStore::count):
        (WebCore::IDBObjectStore::doCount):

2016-03-28  Brady Eidson  <beidson@apple.com>

        Modern IDB: Remove abstract base classes for all IDB DOM classes.
        https://bugs.webkit.org/show_bug.cgi?id=155951

        Reviewed by Alex Christensen.

        Refactor - No behavior change.

        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
        (WebCore::DOMWindowIndexedDatabase::indexedDB):
        * Modules/indexeddb/IDBAny.cpp:
        (WebCore::IDBAny::IDBAny):
        (WebCore::IDBAny::~IDBAny):
        (WebCore::IDBAny::idbDatabase):
        (WebCore::IDBAny::domStringList):
        (WebCore::IDBAny::idbCursor):
        (WebCore::IDBAny::idbCursorWithValue):
        (WebCore::IDBAny::idbFactory):
        (WebCore::IDBAny::idbIndex):
        (WebCore::IDBAny::idbObjectStore):
        (WebCore::IDBAny::idbTransaction):
        (WebCore::IDBAny::scriptValue):
        (WebCore::IDBAny::integer):
        (WebCore::IDBAny::string):
        (WebCore::IDBAny::keyPath):
        * Modules/indexeddb/IDBAny.h:
        (WebCore::IDBAny::create):
        (WebCore::IDBAny::createUndefined):
        (WebCore::IDBAny::type):
        (WebCore::IDBAny::~IDBAny): Deleted.
        (WebCore::IDBAny::isLegacy): Deleted.
        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::create):
        (WebCore::IDBCursor::IDBCursor):
        (WebCore::IDBCursor::~IDBCursor):
        (WebCore::IDBCursor::sourcesDeleted):
        (WebCore::IDBCursor::effectiveObjectStore):
        (WebCore::IDBCursor::transaction):
        (WebCore::IDBCursor::direction):
        (WebCore::IDBCursor::key):
        (WebCore::IDBCursor::primaryKey):
        (WebCore::IDBCursor::value):
        (WebCore::IDBCursor::source):
        (WebCore::IDBCursor::update):
        (WebCore::IDBCursor::advance):
        (WebCore::IDBCursor::continueFunction):
        (WebCore::IDBCursor::uncheckedIterateCursor):
        (WebCore::IDBCursor::deleteFunction):
        (WebCore::IDBCursor::setGetResult):
        (WebCore::IDBCursor::activeDOMObjectName):
        (WebCore::IDBCursor::canSuspendForDocumentSuspension):
        (WebCore::IDBCursor::hasPendingActivity):
        (WebCore::IDBCursor::decrementOutstandingRequestCount):
        * Modules/indexeddb/IDBCursor.h:
        (WebCore::IDBCursor::info):
        (WebCore::IDBCursor::setRequest):
        (WebCore::IDBCursor::clearRequest):
        (WebCore::IDBCursor::request):
        (WebCore::IDBCursor::isKeyCursor):
        (WebCore::IDBCursor::~IDBCursor): Deleted.
        (WebCore::IDBCursor::continueFunction): Deleted.
        (WebCore::IDBCursor::isModernCursor): Deleted.
        (WebCore::IDBCursor::hasPendingActivity): Deleted.
        * Modules/indexeddb/IDBCursorWithValue.cpp:
        (WebCore::IDBCursorWithValue::create):
        (WebCore::IDBCursorWithValue::IDBCursorWithValue):
        (WebCore::IDBCursorWithValue::~IDBCursorWithValue):
        * Modules/indexeddb/IDBCursorWithValue.h:
        (WebCore::IDBCursorWithValue::~IDBCursorWithValue): Deleted.
        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::create):
        (WebCore::IDBDatabase::IDBDatabase):
        (WebCore::IDBDatabase::~IDBDatabase):
        (WebCore::IDBDatabase::hasPendingActivity):
        (WebCore::IDBDatabase::name):
        (WebCore::IDBDatabase::version):
        (WebCore::IDBDatabase::objectStoreNames):
        (WebCore::IDBDatabase::createObjectStore):
        (WebCore::IDBDatabase::transaction):
        (WebCore::IDBDatabase::deleteObjectStore):
        (WebCore::IDBDatabase::close):
        (WebCore::IDBDatabase::maybeCloseInServer):
        (WebCore::IDBDatabase::activeDOMObjectName):
        (WebCore::IDBDatabase::canSuspendForDocumentSuspension):
        (WebCore::IDBDatabase::stop):
        (WebCore::IDBDatabase::startVersionChangeTransaction):
        (WebCore::IDBDatabase::didStartTransaction):
        (WebCore::IDBDatabase::willCommitTransaction):
        (WebCore::IDBDatabase::didCommitTransaction):
        (WebCore::IDBDatabase::willAbortTransaction):
        (WebCore::IDBDatabase::didAbortTransaction):
        (WebCore::IDBDatabase::didCommitOrAbortTransaction):
        (WebCore::IDBDatabase::fireVersionChangeEvent):
        (WebCore::IDBDatabase::dispatchEvent):
        (WebCore::IDBDatabase::didCreateIndexInfo):
        (WebCore::IDBDatabase::didDeleteIndexInfo):
        * Modules/indexeddb/IDBDatabase.h:
        (WebCore::IDBDatabase::info):
        (WebCore::IDBDatabase::databaseConnectionIdentifier):
        (WebCore::IDBDatabase::serverConnection):
        (WebCore::IDBDatabase::isClosingOrClosed):
        (WebCore::IDBDatabase::~IDBDatabase): Deleted.
        * Modules/indexeddb/IDBFactory.cpp:
        (WebCore::shouldThrowSecurityException):
        (WebCore::IDBFactory::create):
        (WebCore::IDBFactory::IDBFactory):
        (WebCore::IDBFactory::getDatabaseNames):
        (WebCore::IDBFactory::open):
        (WebCore::IDBFactory::openInternal):
        (WebCore::IDBFactory::deleteDatabase):
        (WebCore::IDBFactory::cmp):
        * Modules/indexeddb/IDBFactory.h:
        (WebCore::IDBFactory::~IDBFactory): Deleted.
        * Modules/indexeddb/IDBIndex.cpp:
        (WebCore::IDBIndex::IDBIndex):
        (WebCore::IDBIndex::~IDBIndex):
        (WebCore::IDBIndex::activeDOMObjectName):
        (WebCore::IDBIndex::canSuspendForDocumentSuspension):
        (WebCore::IDBIndex::hasPendingActivity):
        (WebCore::IDBIndex::name):
        (WebCore::IDBIndex::objectStore):
        (WebCore::IDBIndex::keyPathAny):
        (WebCore::IDBIndex::keyPath):
        (WebCore::IDBIndex::unique):
        (WebCore::IDBIndex::multiEntry):
        (WebCore::IDBIndex::openCursor):
        (WebCore::IDBIndex::count):
        (WebCore::IDBIndex::doCount):
        (WebCore::IDBIndex::openKeyCursor):
        (WebCore::IDBIndex::get):
        (WebCore::IDBIndex::doGet):
        (WebCore::IDBIndex::getKey):
        (WebCore::IDBIndex::doGetKey):
        (WebCore::IDBIndex::markAsDeleted):
        (WebCore::IDBIndex::ref):
        (WebCore::IDBIndex::deref):
        * Modules/indexeddb/IDBIndex.h:
        (WebCore::IDBIndex::openCursor):
        (WebCore::IDBIndex::openKeyCursor):
        (WebCore::IDBIndex::info):
        (WebCore::IDBIndex::modernObjectStore):
        (WebCore::IDBIndex::isDeleted):
        (WebCore::IDBIndex::~IDBIndex): Deleted.
        (WebCore::IDBIndex::isModern): Deleted.
        * Modules/indexeddb/IDBObjectStore.cpp:
        (WebCore::IDBObjectStore::create):
        (WebCore::IDBObjectStore::IDBObjectStore):
        (WebCore::IDBObjectStore::~IDBObjectStore):
        (WebCore::IDBObjectStore::activeDOMObjectName):
        (WebCore::IDBObjectStore::canSuspendForDocumentSuspension):
        (WebCore::IDBObjectStore::hasPendingActivity):
        (WebCore::IDBObjectStore::name):
        (WebCore::IDBObjectStore::keyPathAny):
        (WebCore::IDBObjectStore::keyPath):
        (WebCore::IDBObjectStore::indexNames):
        (WebCore::IDBObjectStore::transaction):
        (WebCore::IDBObjectStore::autoIncrement):
        (WebCore::IDBObjectStore::openCursor):
        (WebCore::IDBObjectStore::get):
        (WebCore::IDBObjectStore::add):
        (WebCore::IDBObjectStore::put):
        (WebCore::IDBObjectStore::putForCursorUpdate):
        (WebCore::IDBObjectStore::putOrAdd):
        (WebCore::IDBObjectStore::deleteFunction):
        (WebCore::IDBObjectStore::doDelete):
        (WebCore::IDBObjectStore::modernDelete):
        (WebCore::IDBObjectStore::clear):
        (WebCore::IDBObjectStore::createIndex):
        (WebCore::IDBObjectStore::index):
        (WebCore::IDBObjectStore::deleteIndex):
        (WebCore::IDBObjectStore::count):
        (WebCore::IDBObjectStore::doCount):
        (WebCore::IDBObjectStore::markAsDeleted):
        (WebCore::IDBObjectStore::rollbackInfoForVersionChangeAbort):
        (WebCore::IDBObjectStore::visitReferencedIndexes):
        * Modules/indexeddb/IDBObjectStore.h:
        (WebCore::IDBObjectStore::isDeleted):
        (WebCore::IDBObjectStore::info):
        (WebCore::IDBObjectStore::modernTransaction):
        (WebCore::IDBObjectStore::~IDBObjectStore): Deleted.
        (WebCore::IDBObjectStore::isModern): Deleted.
        * Modules/indexeddb/IDBOpenDBRequest.cpp:
        (WebCore::IDBOpenDBRequest::createDeleteRequest):
        (WebCore::IDBOpenDBRequest::createOpenRequest):
        (WebCore::IDBOpenDBRequest::IDBOpenDBRequest):
        (WebCore::IDBOpenDBRequest::~IDBOpenDBRequest):
        (WebCore::IDBOpenDBRequest::onError):
        (WebCore::IDBOpenDBRequest::versionChangeTransactionDidFinish):
        (WebCore::IDBOpenDBRequest::fireSuccessAfterVersionChangeCommit):
        (WebCore::IDBOpenDBRequest::fireErrorAfterVersionChangeCompletion):
        (WebCore::IDBOpenDBRequest::dispatchEvent):
        (WebCore::IDBOpenDBRequest::onSuccess):
        (WebCore::IDBOpenDBRequest::onUpgradeNeeded):
        (WebCore::IDBOpenDBRequest::onDeleteDatabaseSuccess):
        (WebCore::IDBOpenDBRequest::requestCompleted):
        (WebCore::IDBOpenDBRequest::requestBlocked):
        * Modules/indexeddb/IDBOpenDBRequest.h:
        (WebCore::IDBOpenDBRequest::databaseIdentifier):
        (WebCore::IDBOpenDBRequest::version):
        (WebCore::IDBOpenDBRequest::~IDBOpenDBRequest): Deleted.
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::create):
        (WebCore::IDBRequest::createCount):
        (WebCore::IDBRequest::createGet):
        (WebCore::IDBRequest::IDBRequest):
        (WebCore::IDBRequest::~IDBRequest):
        (WebCore::IDBRequest::result):
        (WebCore::IDBRequest::errorCode):
        (WebCore::IDBRequest::error):
        (WebCore::IDBRequest::source):
        (WebCore::IDBRequest::setSource):
        (WebCore::IDBRequest::setVersionChangeTransaction):
        (WebCore::IDBRequest::transaction):
        (WebCore::IDBRequest::readyState):
        (WebCore::IDBRequest::sourceObjectStoreIdentifier):
        (WebCore::IDBRequest::sourceIndexIdentifier):
        (WebCore::IDBRequest::requestedIndexRecordType):
        (WebCore::IDBRequest::eventTargetInterface):
        (WebCore::IDBRequest::activeDOMObjectName):
        (WebCore::IDBRequest::canSuspendForDocumentSuspension):
        (WebCore::IDBRequest::hasPendingActivity):
        (WebCore::IDBRequest::stop):
        (WebCore::IDBRequest::enqueueEvent):
        (WebCore::IDBRequest::dispatchEvent):
        (WebCore::IDBRequest::uncaughtExceptionInEventHandler):
        (WebCore::IDBRequest::setResult):
        (WebCore::IDBRequest::setResultToStructuredClone):
        (WebCore::IDBRequest::setResultToUndefined):
        (WebCore::IDBRequest::resultCursor):
        (WebCore::IDBRequest::willIterateCursor):
        (WebCore::IDBRequest::didOpenOrIterateCursor):
        (WebCore::IDBRequest::requestCompleted):
        (WebCore::IDBRequest::onError):
        (WebCore::IDBRequest::onSuccess):
        * Modules/indexeddb/IDBRequest.h:
        (WebCore::IDBRequest::resourceIdentifier):
        (WebCore::IDBRequest::connection):
        (WebCore::IDBRequest::modernResult):
        (WebCore::IDBRequest::pendingCursor):
        (WebCore::IDBRequest::requestType):
        (WebCore::IDBRequest::isOpenDBRequest):
        (WebCore::IDBRequest::~IDBRequest): Deleted.
        * Modules/indexeddb/IDBRequestCompletionEvent.cpp:
        (WebCore::IDBRequestCompletionEvent::IDBRequestCompletionEvent):
        * Modules/indexeddb/IDBRequestCompletionEvent.h:
        (WebCore::IDBRequestCompletionEvent::create):
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::create):
        (WebCore::IDBTransaction::IDBTransaction):
        (WebCore::IDBTransaction::~IDBTransaction):
        (WebCore::IDBTransaction::mode):
        (WebCore::IDBTransaction::db):
        (WebCore::IDBTransaction::serverConnection):
        (WebCore::IDBTransaction::error):
        (WebCore::IDBTransaction::objectStore):
        (WebCore::IDBTransaction::abortDueToFailedRequest):
        (WebCore::IDBTransaction::transitionedToFinishing):
        (WebCore::IDBTransaction::abort):
        (WebCore::IDBTransaction::abortOnServerAndCancelRequests):
        (WebCore::IDBTransaction::activeDOMObjectName):
        (WebCore::IDBTransaction::canSuspendForDocumentSuspension):
        (WebCore::IDBTransaction::hasPendingActivity):
        (WebCore::IDBTransaction::stop):
        (WebCore::IDBTransaction::isActive):
        (WebCore::IDBTransaction::isFinishedOrFinishing):
        (WebCore::IDBTransaction::addRequest):
        (WebCore::IDBTransaction::removeRequest):
        (WebCore::IDBTransaction::scheduleOperation):
        (WebCore::IDBTransaction::scheduleOperationTimer):
        (WebCore::IDBTransaction::operationTimerFired):
        (WebCore::IDBTransaction::commit):
        (WebCore::IDBTransaction::commitOnServer):
        (WebCore::IDBTransaction::finishAbortOrCommit):
        (WebCore::IDBTransaction::didStart):
        (WebCore::IDBTransaction::notifyDidAbort):
        (WebCore::IDBTransaction::didAbort):
        (WebCore::IDBTransaction::didCommit):
        (WebCore::IDBTransaction::fireOnComplete):
        (WebCore::IDBTransaction::fireOnAbort):
        (WebCore::IDBTransaction::enqueueEvent):
        (WebCore::IDBTransaction::dispatchEvent):
        (WebCore::IDBTransaction::createObjectStore):
        (WebCore::IDBTransaction::createObjectStoreOnServer):
        (WebCore::IDBTransaction::didCreateObjectStoreOnServer):
        (WebCore::IDBTransaction::createIndex):
        (WebCore::IDBTransaction::createIndexOnServer):
        (WebCore::IDBTransaction::didCreateIndexOnServer):
        (WebCore::IDBTransaction::requestOpenCursor):
        (WebCore::IDBTransaction::doRequestOpenCursor):
        (WebCore::IDBTransaction::openCursorOnServer):
        (WebCore::IDBTransaction::didOpenCursorOnServer):
        (WebCore::IDBTransaction::iterateCursor):
        (WebCore::IDBTransaction::iterateCursorOnServer):
        (WebCore::IDBTransaction::didIterateCursorOnServer):
        (WebCore::IDBTransaction::requestGetRecord):
        (WebCore::IDBTransaction::requestGetValue):
        (WebCore::IDBTransaction::requestGetKey):
        (WebCore::IDBTransaction::requestIndexRecord):
        (WebCore::IDBTransaction::getRecordOnServer):
        (WebCore::IDBTransaction::didGetRecordOnServer):
        (WebCore::IDBTransaction::requestCount):
        (WebCore::IDBTransaction::getCountOnServer):
        (WebCore::IDBTransaction::didGetCountOnServer):
        (WebCore::IDBTransaction::requestDeleteRecord):
        (WebCore::IDBTransaction::deleteRecordOnServer):
        (WebCore::IDBTransaction::didDeleteRecordOnServer):
        (WebCore::IDBTransaction::requestClearObjectStore):
        (WebCore::IDBTransaction::clearObjectStoreOnServer):
        (WebCore::IDBTransaction::didClearObjectStoreOnServer):
        (WebCore::IDBTransaction::requestPutOrAdd):
        (WebCore::IDBTransaction::putOrAddOnServer):
        (WebCore::IDBTransaction::didPutOrAddOnServer):
        (WebCore::IDBTransaction::deleteObjectStore):
        (WebCore::IDBTransaction::deleteObjectStoreOnServer):
        (WebCore::IDBTransaction::didDeleteObjectStoreOnServer):
        (WebCore::IDBTransaction::deleteIndex):
        (WebCore::IDBTransaction::deleteIndexOnServer):
        (WebCore::IDBTransaction::didDeleteIndexOnServer):
        (WebCore::IDBTransaction::operationDidComplete):
        (WebCore::IDBTransaction::establishOnServer):
        (WebCore::IDBTransaction::activate):
        (WebCore::IDBTransaction::deactivate):
        * Modules/indexeddb/IDBTransaction.h:
        (WebCore::IDBTransaction::info):
        (WebCore::IDBTransaction::database):
        (WebCore::IDBTransaction::originalDatabaseInfo):
        (WebCore::IDBTransaction::isVersionChange):
        (WebCore::IDBTransaction::isReadOnly):
        (WebCore::IDBTransaction::isFinished):
        (WebCore::TransactionActivator::TransactionActivator):
        (WebCore::TransactionActivator::~TransactionActivator):
        (WebCore::IDBTransaction::~IDBTransaction): Deleted.
        * Modules/indexeddb/IDBVersionChangeEvent.cpp:
        (WebCore::IDBVersionChangeEvent::IDBVersionChangeEvent):
        (WebCore::IDBVersionChangeEvent::newVersion):
        (WebCore::IDBVersionChangeEvent::eventInterface):
        (WebCore::IDBVersionChangeEvent::create): Deleted.
        * Modules/indexeddb/IDBVersionChangeEvent.h:
        (isType):
        * Modules/indexeddb/client/IDBAnyImpl.cpp: Removed.
        * Modules/indexeddb/client/IDBAnyImpl.h: Removed.
        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        * Modules/indexeddb/client/IDBConnectionToServer.h:
        * Modules/indexeddb/client/IDBCursorImpl.cpp: Removed.
        * Modules/indexeddb/client/IDBCursorImpl.h: Removed.
        * Modules/indexeddb/client/IDBCursorWithValueImpl.cpp: Removed.
        * Modules/indexeddb/client/IDBCursorWithValueImpl.h: Removed.
        * Modules/indexeddb/client/IDBDatabaseImpl.cpp: Removed.
        * Modules/indexeddb/client/IDBDatabaseImpl.h: Removed.
        * Modules/indexeddb/client/IDBFactoryImpl.cpp: Removed.
        * Modules/indexeddb/client/IDBFactoryImpl.h: Removed.
        * Modules/indexeddb/client/IDBIndexImpl.cpp: Removed.
        * Modules/indexeddb/client/IDBIndexImpl.h: Removed.
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp: Removed.
        * Modules/indexeddb/client/IDBObjectStoreImpl.h: Removed.
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp: Removed.
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.h: Removed.
        * Modules/indexeddb/client/IDBRequestImpl.cpp: Removed.
        * Modules/indexeddb/client/IDBRequestImpl.h: Removed.
        * Modules/indexeddb/client/IDBTransactionImpl.cpp: Removed.
        * Modules/indexeddb/client/IDBTransactionImpl.h: Removed.
        * Modules/indexeddb/client/IDBVersionChangeEventImpl.cpp: Removed.
        * Modules/indexeddb/client/IDBVersionChangeEventImpl.h: Removed.
        * Modules/indexeddb/client/TransactionOperation.cpp:
        * Modules/indexeddb/client/TransactionOperation.h:
        * Modules/indexeddb/shared/IDBCursorInfo.cpp:
        (WebCore::IDBCursorInfo::objectStoreCursor):
        (WebCore::IDBCursorInfo::indexCursor):
        (WebCore::IDBCursorInfo::IDBCursorInfo):
        * Modules/indexeddb/shared/IDBCursorInfo.h:
        * Modules/indexeddb/shared/IDBRequestData.cpp:
        (WebCore::IDBRequestData::IDBRequestData):
        * Modules/indexeddb/shared/IDBRequestData.h:
        * Modules/indexeddb/shared/IDBResourceIdentifier.cpp:
        (WebCore::IDBResourceIdentifier::IDBResourceIdentifier):
        * Modules/indexeddb/shared/IDBResourceIdentifier.h:
        * Modules/indexeddb/shared/IDBTransactionInfo.cpp:
        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        * Modules/indexeddb/shared/InProcessIDBServer.h:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSIDBCursorCustom.cpp:
        (WebCore::JSIDBCursor::visitAdditionalChildren):
        * bindings/js/JSIDBCursorWithValueCustom.cpp:
        * bindings/js/JSIDBIndexCustom.cpp:
        (WebCore::JSIDBIndex::visitAdditionalChildren):
        * bindings/js/JSIDBObjectStoreCustom.cpp:
        (WebCore::JSIDBObjectStore::visitAdditionalChildren):
        * inspector/InspectorIndexedDBAgent.cpp:

2016-03-28  Myles C. Maxfield  <mmaxfield@apple.com>

        [RTL Scrollbars] Position:sticky can be positioned under vertical RTL scrollbar
        https://bugs.webkit.org/show_bug.cgi?id=155949

        Reviewed by Simon Fraser.

        When performing sticky positioning logic, we were setting the clip rect's position
        equal to the scrollPosition of the layer. This computation assumes that the top
        left of the scroll position is the same as the top left of the clip rect. When
        using RTL scrollbars, this is not true, so this code simply needs to be made aware
        of the presence of an RTL scrollbar.

        Tests: fast/scrolling/rtl-scrollbars-sticky-document-2.html
               fast/scrolling/rtl-scrollbars-sticky-document.html
               fast/scrolling/rtl-scrollbars-sticky-iframe-2.html
               fast/scrolling/rtl-scrollbars-sticky-iframe.html
               fast/scrolling/rtl-scrollbars-sticky-overflow-scroll-2.html
               fast/scrolling/rtl-scrollbars-sticky-overflow-scroll.html

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::constrainingRectForStickyPosition):

2016-03-28  Antonio Gomes  <tonikitoo@webkit.org>

        Rename PlatformWheelEvent::isEndGesture to isEndOfMomentumScroll.
        https://bugs.webkit.org/show_bug.cgi?id=155940

        Reviewed by Simon Fraser.

        No new tests needed.

        The new name better reflects its purpose. Also it is a preparation to fix bug 155746.

        * platform/PlatformWheelEvent.h:
        (WebCore::PlatformWheelEvent::shouldResetLatching):
        (WebCore::PlatformWheelEvent::isEndOfMomentumScroll: Renamed; Formally isEndGesture.
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::gestureShouldBeginSnap):

2016-03-28  Zalan Bujtas  <zalan@apple.com>

        Setup cloned continuation renderer properly.
        https://bugs.webkit.org/show_bug.cgi?id=155640

        Reviewed by Simon Fraser.

        Set the "renderer has outline ancestor" flag on the cloned inline renderer when
        we split the original renderer for continuation.
        It ensures that when the cloned part of the continuation requests repaint, we properly
        invalidate the ancestor outline (if needed).

        Test: fast/inline/outline-with-continuation-assert.html

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::clone):

2016-03-25  Simon Fraser  <simon.fraser@apple.com>

        Inspector Memory Timeline sometimes encounters unstoppable rAF drawing
        https://bugs.webkit.org/show_bug.cgi?id=155906

        Reviewed by Anders Carlsson.

        It was possible to get Web Inspector into a state where repeated, expensive
        requestAnimationFrame calls prevented user events from being handled, making it
        unresponsive.
        
        requestAnimationFrame uses callOnMainThread() to get a notification from the 
        CVDispayLink thread to the main thread, which is a -performSelectorOnMainThread...
        Under the hood, this ends up as a CFRunLoopPerformBlock().
        
        User events come in via Connection::enqueueIncomingMessage(), which uses RunLoop::main()::dispatch(),
        which uses a CFRunLoopSource. Evidently, repeated calls to CFRunLoopPerformBlock() can prevent the
        CFRunLoopSource from being handled.
        
        Fix by moving requestAnimationFrame from callOnMainThread() to RunLoop::main()::dispatch().

        * platform/graphics/mac/DisplayRefreshMonitorMac.cpp:
        (WebCore::DisplayRefreshMonitorMac::displayLinkFired):

2016-03-28  Chris Dumez  <cdumez@apple.com>

        Disk cache speculative validation requests do not have the 'Referer' HTTP header set
        https://bugs.webkit.org/show_bug.cgi?id=155890
        <rdar://problem/25279962>

        Reviewed by Antti Koivisto.

        Export a couple more symbols so we can use them from WebKit2.

        * platform/network/HTTPHeaderMap.h:
        * platform/network/ResourceRequestBase.h:

2016-03-24  Timothy Hatcher  <timothy@apple.com>

        Web Automation: Add commands to compute layout of an element

        https://bugs.webkit.org/show_bug.cgi?id=155841
        rdar://problem/25340075

        Reviewed by Brian Burg.

        * dom/Element.h: Mark scrollIntoViewIfNeeded() method as exported so WK2 can use it.
        * platform/ScrollView.h: Mark rootViewToContents(IntRect) method as exported so WK2 can use it.

2016-03-18  Timothy Hatcher  <timothy@apple.com>

        Web Automation: Add Automation protocol commands to resolve frames as handles

        https://bugs.webkit.org/show_bug.cgi?id=155650
        rdar://problem/25242422

        Reviewed by Brian Burg.

        * page/DOMWindow.h: Marked focus() method as exported so WK2 can use them.
        * page/FrameTree.h: Marked scopedChild() methods as exported so WK2 can use them.

2016-03-28  Konstantin Tokarev  <annulen@yandex.ru>

        Remove USE(TEXTURE_MAPPER) guards inside TextureMapper sources.
        https://bugs.webkit.org/show_bug.cgi?id=155944

        Reviewed by Michael Catanzaro.

        After r196429 TextureMapper sources are built only in ports which actually
        use TextureMapper, so USE(TEXTURE_MAPPER) guards in them are redundant now.

        No new tests needed.

        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
        * platform/graphics/texmap/TextureMapper.cpp:
        * platform/graphics/texmap/TextureMapper.h:
        * platform/graphics/texmap/TextureMapperBackingStore.cpp:
        * platform/graphics/texmap/TextureMapperBackingStore.h:
        * platform/graphics/texmap/TextureMapperFPSCounter.cpp:
        * platform/graphics/texmap/TextureMapperFPSCounter.h:
        * platform/graphics/texmap/TextureMapperLayer.cpp:
        * platform/graphics/texmap/TextureMapperLayer.h:
        * platform/graphics/texmap/TextureMapperTile.cpp:
        * platform/graphics/texmap/TextureMapperTile.h:
        * platform/graphics/texmap/TextureMapperTiledBackingStore.cpp:
        * platform/graphics/texmap/TextureMapperTiledBackingStore.h:

2016-03-28  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Remove unneeded lines in offsetAndBreadthForPositionedChild()
        https://bugs.webkit.org/show_bug.cgi?id=155788

        Reviewed by Sergio Villar Senin.

        Just remove 2 lines/variables that were not needed at all in
        RenderGrid::offsetAndBreadthForPositionedChild().

        No new tests, no change of behavior.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):

2016-03-27  Konstantin Tokarev  <annulen@yandex.ru>

        Removed redundant #if conditions in ANGLEWebKitBridge.h
        https://bugs.webkit.org/show_bug.cgi?id=155880

        Reviewed by Csaba Osztrogonác.

        GTK, Efl, AppleWin, and WinCairo ports can be built only with cmake,
        so condition !defined(BUILDING_WITH_CMAKE) implies
        !PLATFORM(GTK) && !PLATFORM(EFL) && !PLATOFRM(WIN).

        No new tests needed.

        * platform/graphics/ANGLEWebKitBridge.h:

2016-03-26  Alex Christensen  <achristensen@webkit.org>

        Mac CMake build fix.

        * PlatformMac.cmake:
        Link with AVFoundation libraries.

2016-03-25  Dean Jackson  <dino@apple.com>

        Move extended color detection into Open Source
        https://bugs.webkit.org/show_bug.cgi?id=155909
        <rdar://problem/25369754>

        Reviewed by Anders Carlsson.

        The code for detecting extended color displays
        was hidden while the iPad Pro 9.7" was in development.
        Now it is public, move the detection to Open Source.

        While doing this, add a new method to PlatformScreen
        so that we have a more obvious way to detect such
        displays.

        * platform/PlatformScreen.h: Add screenSupportsExtendedColor.

        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (PlatformCALayerCocoa::commonInit): Set the backing
        store format to the RGBA10XR if we're on an extended
        display.
        * platform/ios/LegacyTileGridTile.mm:
        (WebCore::LegacyTileGridTile::LegacyTileGridTile): Ditto.
        (WebCore::setBackingStoreFormat): Deleted. Now set directly
        in the constructor.

        * platform/ios/PlatformScreenIOS.mm:
        (WebCore::screenDepthPerComponent): Cleanup.
        (WebCore::screenSupportsExtendedColor): Implement the
        iOS version of this using MobileGestalt.

        * platform/mac/PlatformScreenMac.mm:
        (WebCore::displayFromWidget): Whitespace cleanup.
        (WebCore::screenForWidget):
        (WebCore::screenForWindow):
        (WebCore::screenSupportsExtendedColor): Default implementation
        returns false for all screens at the moment.

        * platform/spi/cocoa/QuartzCoreSPI.h: New constant.
        * platform/spi/ios/MobileGestaltSPI.h: Ditto.

2016-03-26  Myles C. Maxfield  <mmaxfield@apple.com>

        [OS X] Layout  sometimes flakily assumes overlay scrollbars when clicky-scroll-wheel-mouse is attached and system preference detects scrollbar mode
        https://bugs.webkit.org/show_bug.cgi?id=155912

        Reviewed by Simon Fraser.

        When the system preference is set to detect the scrollbar type (overlay or
        always-on, and a clicky scroll wheel mouse is connected, AppKit
        asynchronously tells all the NSScrollerImpPairs about the kind of scrollbar
        it should be using. However, when this notification is delivered, it may
        be in between FrameViews, which means we may not have any
        NSScrollerImpPairs created to listen to the notification.

        r198444 solved this by asking if we missed any update whenever we create
        an NSScrollerImpPair. This works partially; however, there is a significant
        amount of layout which occurs before we create the first ScrollAnimatorMac.
        This layout will ask the ScrollbarThemeMac if overlay scrollbars are
        enabled, and the results will be stale (because we haven't created any the
        NSScrollerImpPairs yet).

        Luckly, AppKit fires a notification when it discovers what kind of
        scrollbars should be used. We can rely on this notification in the event
        that we don't have any NSScrollerImpPairs created.

        Covered (as best as possible) by existing RTL scrollbar tests. However,
        the system preference that governs this is not currently testable.

        * platform/mac/ScrollbarThemeMac.mm:
        (+[WebScrollbarPrefsObserver registerAsObserver]):
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):  Remove the old code.

2016-03-25  Jer Noble  <jer.noble@apple.com>

        [Mac] Audio tracks in alternate groups are not represented correctly as AudioTracks
        https://bugs.webkit.org/show_bug.cgi?id=155891
        <rdar://problem/24841372>

        Reviewed by Eric Carlson.

        Test: media/track/video-track-alternate-groups.html

        Previously, we created an AudioTrack for every AVPlayerItemTrack, and additionally, a
        AudioTrack for every AVMediaSelectionOption that did not have an associated AVAssetTrack.
        This caused a number of issues with various types of media, including media with fallback
        tracks.

        Now, we will create an AudioTrack for every AVMediaSelectionOption, and only create an
        AudioTrack for every AVPlayerItem track if no AVMediaSelectionGroups (and thus no
        AVMediaSeletionOptions) exist.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::determineChangedTracksFromNewTracksAndOldItems):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateAudioTracks):

2016-03-25  Zalan Bujtas  <zalan@apple.com>

        RenderImage::repaintOrMarkForLayout fails when the renderer is detached.
        https://bugs.webkit.org/show_bug.cgi?id=155885
        <rdar://problem/25359164>

        Reviewed by Simon Fraser.

        Making containingBlockFor* functions standalone ensures that we don't
        call them on an invalid object. 

        Covered by existing tests.

        * dom/Element.cpp:
        (WebCore::layoutOverflowRectContainsAllDescendants):
        * rendering/LogicalSelectionOffsetCaches.h:
        (WebCore::LogicalSelectionOffsetCaches::LogicalSelectionOffsetCaches):
        * rendering/RenderElement.cpp:
        (WebCore::containingBlockForFixedPosition):
        (WebCore::containingBlockForAbsolutePosition):
        (WebCore::containingBlockForObjectInFlow):
        (WebCore::RenderElement::containingBlockForFixedPosition): Deleted.
        (WebCore::RenderElement::containingBlockForAbsolutePosition): Deleted.
        (WebCore::isNonRenderBlockInline): Deleted.
        (WebCore::RenderElement::containingBlockForObjectInFlow): Deleted.
        * rendering/RenderElement.h:
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::styleWillChange):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::containingBlock):

2016-03-25  Dean Jackson  <dino@apple.com>

        Remove use of extern "C" to include QuartzCore files
        https://bugs.webkit.org/show_bug.cgi?id=155905
        <rdar://problem/25364798>

        Reviewed by Anders Carlson.

        We can avoid having to wrap constants in extern "C", since they
        are mangled the same in both C and C++.

        * platform/graphics/ca/cocoa/PlatformCAFiltersCocoa.mm: Now that
        QuartzCoreSPI.h has CABackdropLayer, remove the duplicate entry.
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm: Ditto.
        * platform/spi/cocoa/QuartzCoreSPI.h: Include the framework private
        file. Repace EXTERN_C with "extern".

2016-03-25  Alex Christensen  <achristensen@webkit.org>

        Add a compile time flag for using QTKit
        https://bugs.webkit.org/show_bug.cgi?id=155868

        Reviewed by Daniel Bates.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::buildMediaEnginesVector):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        * platform/graphics/mac/MediaTimeQTKit.h:
        * platform/graphics/mac/MediaTimeQTKit.mm:
        * platform/mac/WebVideoFullscreenController.mm:
        (SOFT_LINK_CLASS):
        (-[WebVideoFullscreenController setVideoElement:]):
        (-[WebVideoFullscreenController updatePowerAssertions]):

2016-03-25  Beth Dakin  <bdakin@apple.com>

        Autoscrolling from a drag selection does not work in full screen, or when the 
        window is against the screen edge
        https://bugs.webkit.org/show_bug.cgi?id=155858
        -and corresponding-
        rdar://problem/9338465

        Reviewed by Simon Fraser.

        WebKit2 has always had this bug. Since WebKit1 scrolling in handled largely 
        by AppKit, we did not have this bug because AppKit adjusts the autoscroll 
        amount whenever the window is at the edge of the screen and the user is 
        trying to autoscroll in that direction. This patch employs the same technique 
        in WebCore.

        Instead of using EventHandler::lastKnownMousePosition() as the autoscroll 
        amount, use EventHandler::effectiveMousePositionForSelectionAutoscroll() 
        which will adjust the lastKnownMousePosition if the window is at the edge of 
        the screen.
        * page/AutoscrollController.cpp:
        (WebCore::AutoscrollController::autoscrollTimerFired):

        For most ports, effectiveMousePositionForSelectionAutoscroll() will just 
        return m_lastKnownMousePosition. We override it in EventHandlerMac to return 
        an adjusted amount.
        * page/EventHandler.cpp:
        (WebCore::EventHandler::effectiveMousePositionForSelectionAutoscroll):
        * page/EventHandler.h:
        * page/mac/EventHandlerMac.mm:
        (WebCore::autoscrollAdjustmentFactorForScreenBoundaries):
        (WebCore::EventHandler::effectiveMousePositionForSelectionAutoscroll):

        Make screenForDisplayID available as on PlatformScreen.h instead of just 
        being a static function in the implementation file.
        * platform/PlatformScreen.h:
        * platform/mac/PlatformScreenMac.mm:
        (WebCore::screenForDisplayID):

2016-03-25  Brady Eidson  <beidson@apple.com>

        Soften push/replaceState frequency restrictions.
        <rdar://problem/25228439> and https://bugs.webkit.org/show_bug.cgi?id=155901

        Rubber-stamped by Timothy Hatcher.

        Covered by existing LayoutTests and a new Manual Test.

        * page/History.cpp:
        (WebCore::History::stateObjectAdded): Allow 100 state object operations every 30 seconds.
        * page/History.h:

2016-03-24  Enrica Casucci  <enrica@apple.com>

        Data Detection creates multiple links even when the detected content is within the same node.
        https://bugs.webkit.org/show_bug.cgi?id=155860
        rdar://problem/25319579

        Reviewed by Tim Horton.

        If the detected content spans over multiple query fragments,
        we need to check if consecutive fragments are all within the
        same node. This way we can avoid creating multiple ranges and
        consequntly more links.

        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::detectContentInRange):

2016-03-23  Dave Hyatt  <hyatt@apple.com>

        Implement the allow-end value of the hanging-punctuation CSS property.
        https://bugs.webkit.org/show_bug.cgi?id=104996

        Reviewed by Simon Fraser.

        Added new tests in fast/text.

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::constructLine):
        Fix a bug where empty RenderInlines were incorrectly excluding their end borders if
        they occurred at the end of a line. Needed to adequately test allow-end and empty
        inline borders.

        * rendering/RenderText.cpp:
        (WebCore::RenderText::isHangableStopOrComma):
        Helper function that identifies the hangable stops and commas.

        * rendering/RenderText.h:
        Add new isHangableStopOrComma function to RenderText.

        * rendering/line/BreakingContext.h:
        (WebCore::BreakingContext::lineBreak):
        (WebCore::BreakingContext::lineWidth):
        (WebCore::BreakingContext::atEnd):
        (WebCore::BreakingContext::fitsOnLineOrHangsAtEnd):
        (WebCore::BreakingContext::clearLineBreakIfFitsOnLine):
        (WebCore::BreakingContext::commitLineBreakAtCurrentWidth):
        (WebCore::BreakingContext::handleBR):
        (WebCore::BreakingContext::handleEmptyInline):
        (WebCore::BreakingContext::handleReplaced):
        (WebCore::tryHyphenating):
        (WebCore::BreakingContext::computeAdditionalBetweenWordsWidth):
        (WebCore::BreakingContext::handleText):
        (WebCore::BreakingContext::commitAndUpdateLineBreakIfNeeded):
        Modified breaking rules to handle allow-end. The basic idea is to see if you can
        fit without the comma and only hang if you do, and if nothing else gets added to the
        line after the comma. This involves tracking a new state, m_hangsAtEnd, that can
        be set/cleared while iterating over the objects that will end up on the line.

2016-03-25  Alex Christensen  <achristensen@webkit.org>

        Revert most of r198673.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::buildMediaEnginesVector):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        * platform/graphics/mac/MediaTimeQTKit.h:
        * platform/graphics/mac/MediaTimeQTKit.mm:
        * platform/mac/WebVideoFullscreenController.mm:

2016-03-25  Alex Christensen  <achristensen@webkit.org>

        Add a compile time flag for using QTKit
        https://bugs.webkit.org/show_bug.cgi?id=155868

        Reviewed by Dan Bates.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::buildMediaEnginesVector):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        * platform/graphics/mac/MediaTimeQTKit.h:
        * platform/graphics/mac/MediaTimeQTKit.mm:
        * platform/mac/WebVideoFullscreenController.mm:

2016-03-25  Brent Fulgham  <bfulgham@apple.com>

        [Win] Improve CMake build performance 
        https://bugs.webkit.org/show_bug.cgi?id=155871
        <rdar://problem/24747822>

        Reviewed by Alex Christensen.

        Treat DerivedSources.cpp as an 'All-in-one' file. Pass a flag to the
        PROCESS_ALLINONE_FILE macro so that it does not remove the contents of
        the file, since this breaks dependency checking and generation of the
        sources from the IDL files. Instead, include the header files in the
        project so that all files get generated.        
        
        * CMakeLists.txt: Updated for 'DerivedSources.cpp'
        * DerivedSources.cpp: Add some generated files that were missing.

2016-03-25  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Add basic loading of resources
        https://bugs.webkit.org/show_bug.cgi?id=155637

        Reviewed by Darin Adler.

        Adding support for basic fetch for Window (no support for Worker yet).
        A FetchResponse object is created for every fetch task.
        But it will only be exposed to JS at promise fulfillment time, i.e. once initial response headers are retrieved.

        Updating Blob resource handle to add Content-Type and Content-Length header and notifying of error in case of erroneous HTTP method.

        Fetch is limited to same origin requests currently due to some WPT tests that would timeout otherwise.

        Tests: http/tests/fetch/closing-while-fetching.html
               http/tests/fetch/get-response-body-while-loading.html
        Also covered by rebased tests.

        * Modules/fetch/DOMWindowFetch.cpp: Creating a FetchResponse to start fetching.
        (WebCore::DOMWindowFetch::fetch):
        * Modules/fetch/DOMWindowFetch.h:
        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::consume):
        (WebCore::FetchBody::consumeArrayBuffer): Handling of body promises in case of data stored as a buffer.
        (WebCore::FetchBody::consumeText): Passing the promise as a reference.
        (WebCore::blobFromArrayBuffer): Helper routine.
        (WebCore::FetchBody::fulfillTextPromise): Helper routine.
        (WebCore::FetchBody::loadedAsArrayBuffer): Updated to handle storing of data as a buffer.
        (WebCore::FetchBody::loadedAsText):
        (WebCore::FetchBody::bodyForInternalRequest): Helper routine to generate the request body data to be sent as part of the fetch request.
        (WebCore::FetchBody::extractFromText):
        * Modules/fetch/FetchBody.h:
        (WebCore::FetchBody::loadingBody):
        (WebCore::FetchBody::FetchBody):
        * Modules/fetch/FetchBodyOwner.cpp:
        (WebCore::FetchBodyOwner::loadBlob): Updated to cope with the change that FetchLoader::start does not return a boolean anymore
        but will directly call failure callbacks.
        (WebCore::FetchBodyOwner::loadedBlobAsText): Moving it closer to other blob loading routines.
        (WebCore::FetchBodyOwner::finishBlobLoading):
        * Modules/fetch/FetchBodyOwner.h:
        (WebCore::FetchBodyOwner::body):
        (WebCore::FetchBodyOwner::loadedBlobAsArrayBuffer):
        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::FetchHeaders::fill):
        (WebCore::FetchHeaders::filterAndFill): Helper routine to fill headers from a HTTPHeaderMap after being filtered.
        * Modules/fetch/FetchHeaders.h:
        (WebCore::FetchHeaders::internalHeaders):
        * Modules/fetch/FetchLoader.cpp:
        (WebCore::FetchLoader::start):
        (WebCore::FetchLoader::didFailRedirectCheck):
        * Modules/fetch/FetchLoader.h:
        * Modules/fetch/FetchRequest.cpp:
        (WebCore::FetchRequest::internalRequest): Routine used to create the ResourceRequest transmitted to ThreadableLoader.
       * Modules/fetch/FetchRequest.h:
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::fetch): Start fetching by creating a FetchLoader based on passed request.
        (WebCore::FetchResponse::BodyLoader::didSucceed): FetchLoader callback.
        (WebCore::FetchResponse::BodyLoader::didFail): Ditto.
        (WebCore::FetchResponse::BodyLoader::BodyLoader): Ditto.
        (WebCore::FetchResponse::BodyLoader::didReceiveResponse): Ditto.
        (WebCore::FetchResponse::BodyLoader::didFinishLoadingAsArrayBuffer): Ditto.
        (WebCore::FetchResponse::BodyLoader::start): Starting fetch loader.
        (WebCore::FetchResponse::BodyLoader::stop): Stopping fetch loader.
        (WebCore::FetchResponse::stop): Stop loader if any.
        * Modules/fetch/FetchResponse.h:
        * platform/network/BlobResourceHandle.cpp:
        (WebCore::BlobResourceHandle::doStart: Notifying the loader with an error if verb is not GET.
        (WebCore::BlobResourceHandle::notifyResponseOnSuccess): Adding support for Content-Type and Content-Lenth headers.
        (WebCore::BlobResourceHandle::createAsync): Removing GET verb check.

2016-03-25  Konstantin Tokarev  <annulen@yandex.ru>

        Removed leftovers of WCHAR_UNICODE code path after r162782.
        https://bugs.webkit.org/show_bug.cgi?id=155881

        Reviewed by Csaba Osztrogonác.

        No new tests needed.

        * platform/text/TextEncodingDetectorNone.cpp: Removed.
        * platform/text/wchar/TextBreakIteratorWchar.cpp: Removed.

2016-03-24  Alex Christensen  <achristensen@webkit.org>

        Fix Mac CMake build.

        * PlatformMac.cmake:
        Add new file and directory.

2016-03-24  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r198500.

        Roll back in r197552 as it did not seem to cause a PLT
        regression after all

        Reverted changeset:

        "Unreviewed, rolling out r197552."
        https://bugs.webkit.org/show_bug.cgi?id=154986
        http://trac.webkit.org/changeset/198500

2016-03-24  Daniel Bates  <dabates@apple.com>

        CSP: Move logic for reporting a violation from ContentSecurityPolicyDirectiveList to ContentSecurityPolicy
        https://bugs.webkit.org/show_bug.cgi?id=155842
        <rdar://problem/25340377>
        And
        https://bugs.webkit.org/show_bug.cgi?id=155133

        Reviewed by Brent Fulgham.

        Towards associating source file, line-, and column- numbers (https://bugs.webkit.org/show_bug.cgi?id=114317)
        with a CSP console message we should move the logic for logging the console message/reporting the violation
        from class ContentSecurityPolicyDirectiveList to class ContentSecurityPolicy so that it is closer to the
        script execution context that can access such information.

        The responsibilities of the class ContentSecurityPolicyDirectiveList have been reduced. It is responsible
        for parsing a string representation of the Content Security Policy and providing functions to determine
        the violated directive (if any) for a given source (e.g. URL). ContentSecurityPolicyDirectiveList no longer
        takes responsibility logging a console message or sending a violation report (if applicable). Falling out
        from this decrease in responsibility is the removal of enum ContentSecurityPolicyDirectiveList::ReportingStatus
        and the need to pass a enumerator of this enum to each ContentSecurityPolicyDirectiveList to suppress
        the sending of a violation report. The caller of ContentSecurityPolicyDirectiveList is responsible for
        making this determination.

        With the exception of a change to the error message for an inline event handler violation, there are no
        other functional changes. When an inline event handler violation occurs we will emit either:

            Refused to execute a script for an inline event handler because 'unsafe-inline' does not appear in the
            script-src directive of the Content Security Policy.

        Or:

            Refused to execute a script for an inline event handler because 'unsafe-inline' appears in neither the
            script-src directive nor the default-src directive of the Content Security Policy.

        depending on whether the Content Security Policy contains a script-src directive or not.

        * CMakeLists.txt: Add files ContentSecurityPolicyDirective.cpp and ContentSecurityPolicyDirectiveNames.cpp.
        * WebCore.xcodeproj/project.pbxproj: Add files ContentSecurityPolicyDirective.cpp and ContentSecurityPolicyDirectiveNames.{cpp, h}.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::consoleMessageForViolation): Moved from file ContentSecurityPolicyDirectiveList.cpp and
        incorporates the functionality of ContentSecurityPolicyDirectiveList::reportViolation(). Modified
        to take a reference to the violated directive (ContentSecurityPolicyDirective object) and removed
        the boolean parameter violatesDefaultSrc as we can deduce this from the violated directive.
        (WebCore::ContentSecurityPolicy::didReceiveHeader): Modified to call ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeEval().
        (WebCore::ContentSecurityPolicy::foundHashOfContentInAllPolicies): Renamed; Formerly named allPoliciesAllowHashFromContent.
        Modified to early return if either no algorithms are given or the specified content to hash is
        the empty string.
        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs): Moved logic for reporting a violation from
        ContentSecurityPolicyDirectiveList member function of the same name to here.
        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers): Moved logic for reporting a violation from
        ContentSecurityPolicyDirectiveList member function of the same name to here. Additionally, changed the
        error message text to better describe the reason for the violation.
        (WebCore::ContentSecurityPolicy::allowScriptWithNonce): Ditto.
        (WebCore::ContentSecurityPolicy::allowStyleWithNonce): Ditto.
        (WebCore::ContentSecurityPolicy::allowInlineScript): Ditto.
        (WebCore::ContentSecurityPolicy::allowInlineStyle): Ditto.
        (WebCore::ContentSecurityPolicy::allowEval): Ditto.
        (WebCore::ContentSecurityPolicy::allowFrameAncestors): Ditto.
        (WebCore::ContentSecurityPolicy::allowPluginType): Ditto.
        (WebCore::ContentSecurityPolicy::allowScriptFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowObjectFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowChildContextFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowImageFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowStyleFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowFontFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowMediaFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowConnectToSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowFormAction): Ditto.
        (WebCore::ContentSecurityPolicy::allowBaseURI): Ditto.
        (WebCore::ContentSecurityPolicy::reportViolation): Simplified signature by having it take a reference to
        a ContentSecurityPolicyDirective object. Also split functionality into two variants: one variant takes a
        pointer to a JSC::ExecState, one variant takes a source file, and line and column positions.
        (WebCore::ContentSecurityPolicy::allPoliciesAllowHashFromContent): Deleted.
        (WebCore::ContentSecurityPolicy::gatherReportURIs): Deleted.
        * page/csp/ContentSecurityPolicy.h:
        (WebCore::ContentSecurityPolicy::violatedDirectiveInAnyPolicy): Formerly named allPoliciesAllow. Modified
        to return the violated directive.
        (WebCore::ContentSecurityPolicy::allPoliciesAllow): Deleted.
        * page/csp/ContentSecurityPolicyDirective.cpp: Added.
        * page/csp/ContentSecurityPolicyDirective.h: Added.
        (WebCore::ContentSecurityPolicyDirective::ContentSecurityPolicyDirective): Modified to take a reference to the
        directive list that contains this directive instead of pointer to a ContentSecurityPolicy object.
        (WebCore::ContentSecurityPolicyDirective::name): Added.
        (WebCore::ContentSecurityPolicyDirective::directiveList): Added.
        (WebCore::ContentSecurityPolicyDirective::isDefaultSrc): Added.
        (WebCore::ContentSecurityPolicyDirective::policy): Deleted.
        * page/csp/ContentSecurityPolicyDirectiveList.cpp: Remove unused header <wtf/Optional.h>. Also remove header wtf/text/StringBuilder.h
        as the function that made use of it, consoleMessageForViolation, was moved to file ContentSecurityPolicy.cpp.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeEval): Formerly named allowEval.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScript): Formerly named allowInlineScript.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyle): Formerly named allowInlineStyle.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForScriptHash): Formerly named allowInlineScriptWithHash.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForStyleHash): Formerly named allowInlineStyleWithHash.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForScriptNonce): Formerly named allowScriptWithNonce.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForStyleNonce): Formerly named allowStyleWithNonce.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForBaseURI): Formerly named allowBaseURI.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForChildContext): Formerly named allowChildContextFromSource.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForConnectSource): Formerly named allowConnectToSource.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForFont): Formerly named allowFontFromSource.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForFormAction): Formerly named allowFormAction.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForFrame): Formerly named allowChildFrameFromSource.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForFrameAncestor): Formerly named allowFrameAncestors.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForImage): Formerly named allowImageFromSource.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForMedia): Formerly named allowMediaFromSource.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForObjectSource): Formerly named allowObjectFromSource.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForPluginType): Formerly named allowPluginType.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForScript): Formerly named allowScriptFromSource.
        (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle): Formerly named allowStyleFromSource.
        (WebCore::ContentSecurityPolicyDirectiveList::parse): Update code to make use of ContentSecurityPolicyDirectiveNames constants.
        (WebCore::ContentSecurityPolicyDirectiveList::setCSPDirective): Pass |this| instead of the ContentSecurityPolicy object.
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Update code to make use of ContentSecurityPolicyDirectiveNames constants.
        (WebCore::isExperimentalDirectiveName): Deleted.
        (WebCore::isCSPDirectiveName): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::reportViolation): Deleted.
        (WebCore::consoleMessageForViolation): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowJavaScriptURLs): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowInlineEventHandlers): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowInlineScript): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowInlineScriptWithHash): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowScriptWithNonce): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowInlineStyle): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowInlineStyleWithHash): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowStyleWithNonce): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowEval): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowPluginType): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowScriptFromSource): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowObjectFromSource): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowChildContextFromSource): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowChildFrameFromSource): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowImageFromSource): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowStyleFromSource): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowFontFromSource): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowMediaFromSource): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowConnectToSource): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowFormAction): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowBaseURI): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::allowFrameAncestors): Deleted.
        * page/csp/ContentSecurityPolicyDirectiveList.h:
        (WebCore::ContentSecurityPolicyDirectiveList::defaultSrc): Added.
        (WebCore::ContentSecurityPolicyDirectiveList::policy): Added. Also added FIXME comment to remove this function. This
        function is only used by ContentSecurityPolicyMediaListDirective so that it can log a console message on a parsing error.
        (WebCore::ContentSecurityPolicyDirectiveList::denyIfEnforcingPolicy): Deleted.
        * page/csp/ContentSecurityPolicyDirectiveNames.cpp: Added.
        * page/csp/ContentSecurityPolicyDirectiveNames.h: Added.
        * page/csp/ContentSecurityPolicyMediaListDirective.cpp:
        (WebCore::ContentSecurityPolicyMediaListDirective::ContentSecurityPolicyMediaListDirective): Modified to take a reference to the
        directive list that contains this directive instead of pointer to a ContentSecurityPolicy object.
        (WebCore::ContentSecurityPolicyMediaListDirective::parse): Updated code to use ContentSecurityPolicyDirectiveList::policy() instead
        of ContentSecurityPolicyDirective::policy() as the latter was removed. Ideally this class should not need to use the ContentSecurityPolicy
        object to log a console message.
        * page/csp/ContentSecurityPolicyMediaListDirective.h:
        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::isExperimentalDirectiveName): Moved from file ContentSecurityPolicyDirectiveList.cpp because this function is only used
        in this file.
        (WebCore::isCSPDirectiveName): Ditto.
        (WebCore::ContentSecurityPolicySourceList::isProtocolAllowedByStar): Update code to make use of ContentSecurityPolicyDirectiveNames constants.
        * page/csp/ContentSecurityPolicySourceListDirective.cpp:
        (WebCore::ContentSecurityPolicySourceListDirective::ContentSecurityPolicySourceListDirective): Modified to take a reference to
        the directive list that contains this directive instead of pointer to a ContentSecurityPolicy object. 
        * page/csp/ContentSecurityPolicySourceListDirective.h:

2016-03-24  Myles C. Maxfield  <mmaxfield@apple.com>

        [OS X] Overflow:scroll scrollbars do not obey overlay/always-on system preference changes
        https://bugs.webkit.org/show_bug.cgi?id=155830

        Reviewed by Simon Fraser.

        When the scrollbar style changes, the available width of all ScrollableAreas change,
        and therefore a relayout must occur.

        Each ScrollableArea owns its own ScrollAnimator (if necessary). Upon creation, the
        ScrollAnimator will start listening for changes to the system preference for
        overlay / always-on scrollbars. When notified, the ScrollAnimator tells its owning
        ScrollableArea that scrollbarStyleChanged().

        For main-frame scrolling, FrameView overrides scrollbarStyleChanged and causes a
        relayout. However, for overflow:scroll elements, no relayout is triggered. This
        patch overrides availableContentSizeChanged() for RenderLayer (which is used for
        overflow:scroll elements). This override triggers a relayout.

        It also updates the mechanism in RenderBlock::recomputeLogicalWidth() to ensure that
        a change in scrollbar size causes RenderBlockFlow::layoutBlock() to relayout its
        children. This is appropriate because block child positioning is affected by
        scrollbar size.

        No new tests (for now). Presumably we could mock the message we receive when the
        system preference is changed. However, I haven't implemented that yet.

        * rendering/RenderBlock.cpp: Rename setHasBorderOrPaddingLogicalWidthChanged().
        (WebCore::RenderBlock::styleDidChange):
        (WebCore::RenderBlock::recomputeLogicalWidth):
        * rendering/RenderBlock.h: Ditto.
        (WebCore::RenderBlock::setShouldForceRelayoutChildren):
        (WebCore::RenderBlock::shouldForceRelayoutChildren):
        * rendering/RenderElement.cpp: Ditto.
        (WebCore::RenderElement::RenderElement):
        * rendering/RenderElement.h: Ditto.
        (WebCore::RenderElement::setRenderBlockShouldForceRelayoutChildren):
        (WebCore::RenderElement::renderBlockShouldForceRelayoutChildren):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::availableContentSizeChanged): Cause a relayout to occur.
        * rendering/RenderLayer.h:

2016-03-24  Said Abou-Hallawa  <sabouhallawa@apple,com>

        Change NativeImagePtr for CG to be RetainPtr<CGImageRef>
        https://bugs.webkit.org/show_bug.cgi?id=155412

        Reviewed by Darin Adler.

        Having NativeImagePtr as a raw pointer makes managing the life cycle of
        the returned CGImageRef hard. A lot of work was done to ensure the CG
        pointer is refcounted correctly. It was also not possible to move a
        FrameData since calling the destructor was releasing the CGImageRef.

        With this change, PassNativeImagePtr is not needed anymore. So all the
        instance of PassNativeImagePtr can be replaced by NativeImagePtr.

        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::nativeImageForCurrentTime):
        * html/HTMLVideoElement.h: Replace PassNativeImagePtr with NativeImagePtr.

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::drawImage): Replace PassNativeImagePtr
        with NativeImagePtr.
 
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::addImageToCache):
        * loader/cache/MemoryCache.h: Remove USE(CG) and CFRetain(image) since
        this code can compile on all platforms. The image refcount will be
        incremented when the image is assigned to FrameData.m_image in the
        BitmapImage constructor.

        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::synchronousNativeIconForPageURL):
        * loader/icon/IconDatabase.h:
        * loader/icon/IconDatabaseBase.h: Replace PassNativeImagePtr with NativeImagePtr.

        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::haveFrameImageAtIndex):
        (WebCore::BitmapImage::cacheFrame):
        (WebCore::BitmapImage::ensureFrameIsCached):
        (WebCore::BitmapImage::frameImageAtIndex):
        (WebCore::BitmapImage::nativeImageForCurrentFrame):
        (WebCore::BitmapImage::haveFrameAtIndex): Deleted.
        (WebCore::BitmapImage::frameAtIndex): Deleted.
        Replace PassNativeImagePtr with NativeImagePtr, m_frame with m_image and
        *Frame* with *FrameImage*.

        * platform/graphics/BitmapImage.h:
        (WebCore::FrameData::FrameData):
        A BitmapImage can have one or more FrameData. A FrameData member can be
        named for shortness as "frame", "m_frames", etc. A FrameData can have
        zero or one NativeImagePtr. A NativeImagePtr can be named as "image",
        "m_image", etc.

        * platform/graphics/GraphicsContext.h: Replace PassNativeImagePtr with
        NativeImagePtr.

        * platform/graphics/GraphicsContext3D.h:
        * platform/graphics/Icon.h:
        Change the members of type CGImageRef to be RetainPtr<CGImageRef>.
                
        * platform/graphics/Image.h:
        (WebCore::Image::nativeImageForCurrentFrame):
        (WebCore::Image::getNSImage):
        (WebCore::Image::getTIFFRepresentation):
        (WebCore::Image::getCGImageRef):
        (WebCore::Image::getFirstCGImageRefOfSize):
        (WebCore::Image::getCGImageArray):
        (WebCore::Image::getGdkPixbuf):
        (WebCore::Image::getEvasObject):
        * platform/graphics/ImageBuffer.h:
        * platform/graphics/ImageSource.cpp:
        (WebCore::ImageSource::createFrameImageAtIndex):
        (WebCore::ImageSource::createFrameAtIndex): Deleted.
        * platform/graphics/ImageSource.h:
        Change 0 to nullptr, PassRefPtr to RefPtr and PassNativeImagePtr to
        NativeImagePtr.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::nativeImageForCurrentTime):
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::nativeImageForCurrentTime):
        Replace PassNativeImagePtr with NativeImagePtr.

        * platform/graphics/NativeImagePtr.h:
        Make NativeImagePtr a smart pointer for CG. Get rid of PassNativeImagePtr
        since NativeImagePtr is now a smart pointer on all platforms.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::nativeImageForCurrentTime):
        Replace PassNativeImagePtr with NativeImagePtr.

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::setContentsToImage):
        Since Image::nativeImageForCurrentFrame() returns a RetainPtr, move it
        to m_pendingContentsImage to remove the refcount churn.

        * platform/graphics/cairo/BitmapImageCairo.cpp:
        (WebCore::BitmapImage::BitmapImage):
        (WebCore::BitmapImage::draw):
        (WebCore::BitmapImage::checkForSolidColor):
        (WebCore::FrameData::clear):
        Replace m_frame with m_image and frame* with frameImage*.

        * platform/graphics/cairo/CairoUtilities.cpp:
        (WebCore::copyCairoImageSurface):
        * platform/graphics/cairo/CairoUtilities.h:
        Replace PassRefPtr with RefPtr.

        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
        (WebCore::GraphicsContext3D::ImageExtractor::extractImage):
        Replace *Frame* with *FrameImage*.

        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::drawNativeImage):
        Replace PassNativeImagePtr with NativeImagePtr.

        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBuffer::copyImage): Create a new NativeImagePtr so it can
        be moved to the BitmapImage::create().
        (WebCore::copySurfaceToImageAndAdjustRect):
        (WebCore::getImageData):
        (WebCore::ImageBuffer::getUnmultipliedImageData):
        (WebCore::ImageBuffer::getPremultipliedImageData):
        Replace PassRefPtr with RefPtr.

        * platform/graphics/cg/BitmapImageCG.cpp:
        (WebCore::FrameData::clear): No need to call CGImageRelease(). Just assign
        m_image to nullptr and CGImageRelease() will be called from the RetainPtr
        destructor.

        (WebCore::BitmapImage::BitmapImage):
        (WebCore::BitmapImage::checkForSolidColor):
        (WebCore::BitmapImage::getCGImageRef):
        (WebCore::BitmapImage::getFirstCGImageRefOfSize):
        (WebCore::BitmapImage::getCGImageArray):
        (WebCore::BitmapImage::draw):
        (WebCore::BitmapImage::copyUnscaledFrameImageAtIndex):
        (WebCore::BitmapImage::copyUnscaledFrameAtIndex): Deleted.
        Replace CGImageRef with RetainPtr<CGImageRef>. Replace *Frame* with
        *FrameImage*.

        * platform/graphics/cg/GraphicsContext3DCG.cpp:
        (WebCore::GraphicsContext3D::ImageExtractor::extractImage):
        (WebCore::GraphicsContext3D::paintToCanvas):
        Use m_cgImage.get() instead of m_cgImage when calling CG functions.

        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::drawNativeImage):
        (WebCore::GraphicsContext::drawPattern):
        Replace PassNativeImagePtr with NativeImagePtr. Get the raw CGImageRef
        from the NativeImagePtr when calling the CG functions.
        
        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::createBitmapImageAfterScalingIfNeeded): Move the image argument
        when calling BitmapImage::create().
        
        (WebCore::ImageBuffer::getUnmultipliedImageData):
        (WebCore::ImageBuffer::getPremultipliedImageData):
        Replace PassRefPtr with RefPtr.
        
        * platform/graphics/cg/ImageSourceCG.cpp:
        (WebCore::ImageSource::createFrameImageAtIndex):
        (WebCore::ImageSource::createFrameAtIndex): Deleted.
        Rename the function and simplify the code since the local variable
        and the return value are both smart pointers.
        
        * platform/graphics/displaylists/DisplayListItems.cpp:
        (WebCore::DisplayList::DrawNativeImage::DrawNativeImage):
        (WebCore::DisplayList::DrawNativeImage::apply):
        * platform/graphics/displaylists/DisplayListItems.h:
        (WebCore::DisplayList::DrawNativeImage::create):
        * platform/graphics/displaylists/DisplayListRecorder.cpp:
        (WebCore::DisplayList::Recorder::drawNativeImage):
        * platform/graphics/displaylists/DisplayListRecorder.h:
        Replace PassNativeImagePtr with NativeImagePtr and use constant reference. 
        
        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
        (WebCore::GraphicsContext3D::ImageExtractor::extractImage):
        Call a function with its new name.
        
        * platform/graphics/efl/IconEfl.cpp:
        (WebCore::Icon::createIconForFiles):
        * platform/graphics/gstreamer/ImageGStreamerCairo.cpp:
        (ImageGStreamer::ImageGStreamer):
        * platform/graphics/gtk/IconGtk.cpp:
        (WebCore::Icon::createIconForFiles):
        * platform/graphics/ios/IconIOS.mm:
        (WebCore::Icon::Icon):
        (WebCore::Icon::createIconForFiles):
        (WebCore::Icon::createIconForImage):
        * platform/graphics/mac/IconMac.mm:
        (WebCore::Icon::createIconForFiles):
        Use smart pointers RetainPtr<CGImageRef> instead of raw pointers CGImageRef.
        And change PassRefPtr to RefPtr and 0 to nullptr.
        
        * platform/graphics/mac/ImageMac.mm:
        (WebCore::BitmapImage::getTIFFRepresentation): Get the raw pointer from the
        returned smart pointer.
        
        * platform/graphics/texmap/coordinated/CoordinatedSurface.cpp:
        (WebCore::CoordinatedSurface::create):
        * platform/graphics/texmap/coordinated/CoordinatedSurface.h:
        Replace PassRefPtr with RefPtr.

        * platform/graphics/win/IconWin.cpp:
        (WebCore::Icon::createIconForFiles): Change PassRefPtr to RefPtr.
        
        * platform/graphics/win/ImageCGWin.cpp:
        (WebCore::BitmapImage::create): Replace PassRefPtr with RefPtr.
        (WebCore::BitmapImage::drawFrameMatchingSourceSize): Call the function
        with its new name and get the raw pointer from the returned smart pointer.
        
        * platform/graphics/win/ImageCairoWin.cpp:
        (WebCore::BitmapImage::create): Replace PassRefPtr with ReftPtr and use
        the move semantics for passing the argument to BitmapImage::create().
        (WebCore::BitmapImage::drawFrameMatchingSourceSize): Call the function
        with its new name.
        
        * platform/image-decoders/ImageDecoder.h:
        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
        (WebCore::ImageFrame::asNewNativeImage):
        * platform/win/DragImageCGWin.cpp:
        (WebCore::createDragImageFromImage):
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::nativeImageForCurrentFrame):
        * svg/graphics/SVGImage.h:
        * svg/graphics/SVGImageForContainer.cpp:
        (WebCore::SVGImageForContainer::nativeImageForCurrentFrame):
        * svg/graphics/SVGImageForContainer.h:
        Replace PassNativeImagePtr with NativeImagePtr.
        
2016-03-24  Jer Noble  <jer.noble@apple.com>

        Safari Crashes if audio.src is changed while connected to AudioAnalyserNode
        https://bugs.webkit.org/show_bug.cgi?id=153593
        <rdar://problem/23648082>

        Reviewed by Eric Carlson.

        m_ringBuffer is accessed on the high-priority WebAudio thread after it has been cleared (a
        null-deref). Protect against unsafe access on multiple threads of a non-refcounted object by
        a simple try_lock.

        Additionally, limit the use of variables in use by both the separate WebAudio thread method
        (provideInput()) and AVAudioMix thread method (process()) where possible, and convert to
        std::atomic<> where ivars must be acessed by both threads. m_writeCount is entirely superfluous,
        as it is a synonym for the endTime returned by m_ringBuffer->getCurrentFrameBounds().

        * platform/graphics/avfoundation/AudioSourceProviderAVFObjC.h:
        * platform/graphics/avfoundation/AudioSourceProviderAVFObjC.mm:
        (WebCore::AudioSourceProviderAVFObjC::provideInput):
        (WebCore::AudioSourceProviderAVFObjC::prepare):
        (WebCore::AudioSourceProviderAVFObjC::unprepare):
        (WebCore::AudioSourceProviderAVFObjC::process):

2016-03-24  Enrica Casucci  <enrica@apple.com>

        Adopt new SPI from DataDetectorsCore to decide link behavior.
        https://bugs.webkit.org/show_bug.cgi?id=155780
        rdar://problem/25303631

        Reviewed by Sam Weinig.

        isDataDetectorLink and shouldCancelDefaultAction now
        use the SPI provided by DataDetectorsCore to decide
        what is the link behavior when the user taps on it.

        * editing/cocoa/DataDetection.h:
        * editing/cocoa/DataDetection.mm:
        (WebCore::detectItemAtPositionWithRange):
        (WebCore::DataDetection::isDataDetectorLink):
        (WebCore::DataDetection::requiresExtendedContext):
        (WebCore::DataDetection::dataDetectorIdentifier):
        (WebCore::DataDetection::shouldCancelDefaultAction):
        * platform/cocoa/DataDetectorsCoreSoftLink.h:
        * platform/cocoa/DataDetectorsCoreSoftLink.mm:
        * platform/spi/cocoa/DataDetectorsCoreSPI.h:

2016-03-24  Enrica Casucci  <enrica@apple.com>

        DataDetection creates links that are longer than the actual result.
        https://bugs.webkit.org/show_bug.cgi?id=155850
        rdar://problem/25280740

        Reviewed by Anders Carlsson.

        When a data detection result is composed of multiple fragments,
        the range for the last fragment should take into account the end
        offset of the query range structure, since there could be additional
        content in that range that is not part of the result.

        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::detectContentInRange):

2016-03-24  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r198627.
        https://bugs.webkit.org/show_bug.cgi?id=155856

        Caused use-after-free (Requested by ap on #webkit).

        Reverted changeset:

        "[Fetch API] Add basic loading of resources"
        https://bugs.webkit.org/show_bug.cgi?id=155637
        http://trac.webkit.org/changeset/198627

2016-03-24  Saam barati  <sbarati@apple.com>

        Web Inspector: Separate Debugger enable state from the debugger breakpoints enabled state
        https://bugs.webkit.org/show_bug.cgi?id=152193
        <rdar://problem/23867520>

        Reviewed by Joseph Pecoraro.

        No new tests because this is already tested by inspector tests.

        * inspector/PageScriptDebugServer.cpp:
        (WebCore::PageScriptDebugServer::attachDebugger):
        (WebCore::PageScriptDebugServer::detachDebugger):

2016-03-24  Jer Noble  <jer.noble@apple.com>

        [MSE] Make calling HTMLMediaElement.buffered less expensive
        https://bugs.webkit.org/show_bug.cgi?id=155846

        Reviewed by Eric Carlson.

        The MSE specification requires a new TimeRanges object be returned when calling
        HTMLMediaElement.buffered. Additionally, the requirements for generating the buffered time
        ranges for MediaSource and its constituent SourceBuffers are specific and expensive. Rather
        than perform all these steps each time HTMLMediaElement.buffered is queried, cache the final
        result and only regenerate the cached value if the buffered ranges of the consituent
        SourceBuffers has changed.

        Also, make copying a PlatformTimeRanges more efficient by doing a straight vector-to-vector
        copy of the PlatformTimeRange's data.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::buffered):
        (WebCore::MediaSource::regenerateActiveSourceBuffers):
        * Modules/mediasource/MediaSource.h:
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::removeCodedFrames):
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):
        * Modules/mediasource/SourceBuffer.h:
        * platform/graphics/PlatformTimeRanges.cpp:
        (WebCore::PlatformTimeRanges::PlatformTimeRanges): Deleted.
        (WebCore::PlatformTimeRanges::operator=): Deleted.
        (WebCore::PlatformTimeRanges::copy): Deleted.
        * platform/graphics/PlatformTimeRanges.h:

2016-03-24  Jer Noble  <jer.noble@apple.com>

        REGRESSION(r189129): <audio> elements do not have playback controls on iOS.
        https://bugs.webkit.org/show_bug.cgi?id=155808
        <rdar://problem/23822457>

        Reviewed by Eric Carlson.

        Audio elements should never require fullscreen for playback.

        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::requiresFullscreenForVideoPlayback):

2016-03-24  Alex Christensen  <achristensen@webkit.org>

        Clean up cookie jar after r198195
        https://bugs.webkit.org/show_bug.cgi?id=155484

        Reviewed by Tim Horton.

        Get rid of a now unneeded macro.

        * loader/CookieJar.cpp:
        (WebCore::storageSession):
        (WebCore::cookies):
        (WebCore::setCookies):
        (WebCore::cookiesEnabled):
        (WebCore::cookieRequestHeaderFieldValue):
        (WebCore::getRawCookies):
        (WebCore::deleteCookie):

2016-03-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Add basic loading of resources
        https://bugs.webkit.org/show_bug.cgi?id=155637

        Reviewed by Darin Adler.

        Adding support for basic fetch for Window (no support for Worker yet).
        A FetchResponse object is created for every fetch task.
        But it will only be exposed to JS at promise fulfillment time, i.e. once initial response headers are retrieved.

        Updating Blob resource handle to add Content-Type and Content-Length header and notifying of error in case of erroneous HTTP method.

        Fetch is limited to same origin requests currently due to some WPT tests that would timeout otherwise.

        Tests: http/tests/fetch/closing-while-fetching.html
               http/tests/fetch/get-response-body-while-loading.html
        Also covered by rebased tests.

        * Modules/fetch/DOMWindowFetch.cpp: Creating a FetchResponse to start fetching.
        (WebCore::DOMWindowFetch::fetch):
        * Modules/fetch/DOMWindowFetch.h:
        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::consume):
        (WebCore::FetchBody::consumeArrayBuffer): Handling of body promises in case of data stored as a buffer.
        (WebCore::FetchBody::consumeText): Passing the promise as a reference.
        (WebCore::blobFromArrayBuffer): Helper routine.
        (WebCore::FetchBody::fulfillTextPromise): Helper routine.
        (WebCore::FetchBody::loadedAsArrayBuffer): Updated to handle storing of data as a buffer.
        (WebCore::FetchBody::loadedAsText):
        (WebCore::FetchBody::bodyForInternalRequest): Helper routine to generate the request body data to be sent as part of the fetch request.
        (WebCore::FetchBody::extractFromText):
        * Modules/fetch/FetchBody.h:
        (WebCore::FetchBody::loadingBody):
        (WebCore::FetchBody::FetchBody):
        * Modules/fetch/FetchBodyOwner.cpp:
        (WebCore::FetchBodyOwner::loadBlob): Updated to cope with the change that FetchLoader::start does not return a boolean anymore
        but will directly call failure callbacks.
        (WebCore::FetchBodyOwner::loadedBlobAsText): Moving it closer to other blob loading routines.
        (WebCore::FetchBodyOwner::finishBlobLoading):
        * Modules/fetch/FetchBodyOwner.h:
        (WebCore::FetchBodyOwner::body):
        (WebCore::FetchBodyOwner::loadedBlobAsArrayBuffer):
        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::FetchHeaders::fill):
        (WebCore::FetchHeaders::filterAndFill): Helper routine to fill headers from a HTTPHeaderMap after being filtered.
        * Modules/fetch/FetchHeaders.h:
        (WebCore::FetchHeaders::internalHeaders):
        * Modules/fetch/FetchLoader.cpp:
        (WebCore::FetchLoader::start):
        (WebCore::FetchLoader::didFailRedirectCheck):
        * Modules/fetch/FetchLoader.h:
        * Modules/fetch/FetchRequest.cpp:
        (WebCore::FetchRequest::internalRequest): Routine used to create the ResourceRequest transmitted to ThreadableLoader.
       * Modules/fetch/FetchRequest.h:
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::fetch): Start fetching by creating a FetchLoader based on passed request.
        (WebCore::FetchResponse::BodyLoader::didSucceed): FetchLoader callback.
        (WebCore::FetchResponse::BodyLoader::didFail): Ditto.
        (WebCore::FetchResponse::BodyLoader::BodyLoader): Ditto.
        (WebCore::FetchResponse::BodyLoader::didReceiveResponse): Ditto.
        (WebCore::FetchResponse::BodyLoader::didFinishLoadingAsArrayBuffer): Ditto.
        (WebCore::FetchResponse::BodyLoader::start): Starting fetch loader.
        (WebCore::FetchResponse::BodyLoader::stop): Stopping fetch loader.
        (WebCore::FetchResponse::stop): Stop loader if any.
        * Modules/fetch/FetchResponse.h:
        * platform/network/BlobResourceHandle.cpp:
        (WebCore::BlobResourceHandle::doStart: Notifying the loader with an error if verb is not GET.
        (WebCore::BlobResourceHandle::notifyResponseOnSuccess): Adding support for Content-Type and Content-Lenth headers.
        (WebCore::BlobResourceHandle::createAsync): Removing GET verb check.

2016-03-24  Andreas Kling  <akling@apple.com>

        Remove virtual inheritance from SVGTransformable.
        <https://webkit.org/b/155837>

        Reviewed by Anders Carlsson.

        Nothing else inherits SVGLocatable, so make the inheritance non-virtual.

        * svg/SVGTransformable.h:

2016-03-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove DeferredWrapper::resolve<Vector<unsigned char>>
        https://bugs.webkit.org/show_bug.cgi?id=154849

        Reviewed by Darin Adler.

        Adding fulfillPromiseWithArrayBuffer to resolve a promise with an ArrayBuffer.
        If the ArrayBuffer is null, the promise is rejected with an OutOfMemory exception.

        Not covered by tests since we would need to make tryCreate return null on failing allocation.

        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::processIfEmptyOrDisturbed):
        (WebCore::FetchBody::loadedAsArrayBuffer):
        * bindings/js/JSDOMPromise.cpp:
        (WebCore::fulfillPromiseWithArrayBuffer):
        * bindings/js/JSDOMPromise.h:
        (WebCore::DeferredWrapper::resolve<JSC::JSValue>): Deleted.
        (WebCore::DeferredWrapper::resolve): Deleted.
        * bindings/js/JSSubtleCryptoCustom.cpp:
        (WebCore::JSSubtleCrypto::encrypt):
        (WebCore::JSSubtleCrypto::decrypt):
        (WebCore::JSSubtleCrypto::sign):
        (WebCore::JSSubtleCrypto::digest):
        (WebCore::JSSubtleCrypto::exportKey):
        (WebCore::JSSubtleCrypto::wrapKey):

2016-03-23  Daniel Bates  <dabates@apple.com>

        CSP: Simplify logic for checking policies
        https://bugs.webkit.org/show_bug.cgi?id=155817
        <rdar://problem/25326546>

        Reviewed by Zalan Bujtas.

        Consolidate the various static template functions into a single function called ContentSecurityPolicy::allPoliciesAllow()
        that tests whether a resource request when evaluated with respect to a directive (given as a ContentSecurityPolicyDirectiveList
        pointer-to-member function) violates any of the CSPs that were delivered with the document.

        No functionality changed. So, no new tests.

        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::allPoliciesAllowHashFromContent): Formerly name isAllowedByAllWithHash. Made it
        a member function so that we query for the document encoding instead of taking it as an argument. Modified
        it to take a predicate function to pass it to allPoliciesAllow().
        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs): Modified to use ContentSecurityPolicy::allPoliciesAllow().
        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers): Ditto.
        (WebCore::ContentSecurityPolicy::allowScriptWithNonce): Ditto.
        (WebCore::ContentSecurityPolicy::allowStyleWithNonce): Ditto.
        (WebCore::ContentSecurityPolicy::allowInlineScript): Modified to use ContentSecurityPolicy::allPoliciesAllow() and
        ContentSecurityPolicy::allPoliciesAllowHashFromContent().
        (WebCore::ContentSecurityPolicy::allowInlineStyle): Ditto.
        (WebCore::ContentSecurityPolicy::allowEval): Modified to use ContentSecurityPolicy::allPoliciesAllow().
        (WebCore::ContentSecurityPolicy::allowFrameAncestors): Ditto.
        (WebCore::ContentSecurityPolicy::allowPluginType): Ditto.
        (WebCore::ContentSecurityPolicy::allowScriptFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowObjectFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowChildContextFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowImageFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowStyleFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowFontFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowMediaFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowConnectToSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowFormAction): Ditto.
        (WebCore::ContentSecurityPolicy::allowBaseURI): Ditto.
        (WebCore::isAllowedByAllWithFrame): Deleted.
        (WebCore::isAllowedByAll): Deleted.
        (WebCore::isAllowedByAllWithState): Deleted.
        (WebCore::isAllowedByAllWithContext): Deleted.
        (WebCore::isAllowedByAllWithNonce): Deleted.
        (WebCore::isAllowedByAllWithHash): Deleted.
        (WebCore::isAllowedByAllWithHashFromContent): Deleted.
        (WebCore::isAllowedByAllWithURL): Deleted.
        (WebCore::ContentSecurityPolicy::documentEncoding): Deleted. Incorporated its functionality into ContentSecurityPolicy::allPoliciesAllowHashFromContent().
        (WebCore::ContentSecurityPolicy::isActive): Deleted. This function has been unused since the removal of the CSP script
        interface in <http://trac.webkit.org/changeset/197142>.
        * page/csp/ContentSecurityPolicy.h:
        (WebCore::ContentSecurityPolicy::allPoliciesAllow): Added. Returns whether the predicate function evaluates to true
        for all CSP policies.

2016-03-23  Jer Noble  <jer.noble@apple.com>

        Media elements allowed to play without a user gesture, but requiring fullscreen playback, should not be allowed to autoplay.
        https://bugs.webkit.org/show_bug.cgi?id=155599

        Reviewed by Darin Adler.

        Test: media/video-autoplay-allowed-but-fullscreen-required.html

        Entering fullscreen should always require a user gesture.

        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::playbackPermitted):

2016-03-23  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r198538.
        https://bugs.webkit.org/show_bug.cgi?id=155819

        Broke two API tests on iOS simulator (Requested by ap on
        #webkit).

        Reverted changeset:

        "Media elements allowed to play without a user gesture, but
        requiring fullscreen playback, should not be allowed to
        autoplay."
        https://bugs.webkit.org/show_bug.cgi?id=155599
        http://trac.webkit.org/changeset/198538

2016-03-23  Simon Fraser  <simon.fraser@apple.com>

        Change the paint count indicator to indicate whether a layer is opaque
        https://bugs.webkit.org/show_bug.cgi?id=155810

        Reviewed by Tim Horton.

        In non-opaque layers, give the paint count indicator a diagonal top left corner. Being
        able to see layer opaqueness helps diagnose bugs.
        
        Also use CGContextStateSaver, and move the indicator in by a pixel to overlap less
        with the layer border.

        * platform/graphics/ca/PlatformCALayer.cpp:
        (WebCore::PlatformCALayer::drawRepaintIndicator):

2016-03-23  Zalan Bujtas  <zalan@apple.com>

        ASSERTION FAILED: y2 >= y1 in WebCore::RenderElement::drawLineForBoxSide
        https://bugs.webkit.org/show_bug.cgi?id=155791

        Reviewed by Simon Fraser.

        With certain combination of border rect and adjacent width, we could end up with an empty final rect.
        This patch ensures that we don't try to paint this empty rect. 

        Test: fast/borders/empty-outline-border-assert.html

        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::drawLineForBoxSide):

2016-03-23  Dean Jackson  <dino@apple.com>

        Screen queries should query the exact screen, not a default
        https://bugs.webkit.org/show_bug.cgi?id=155806
        <rdar://problem/25322916>

        Reviewed by Simon Fraser.

        Some of our media queries were using helper functions that
        would query the capabilities of the deepest screen, rather
        than the currently used screen. I changed them to use
        the existing helper function (that works with WebKit 2)
        and comment in some other helpers why a generic check is
        ok.

        Covered by the existing tests.

        * platform/mac/PlatformScreenMac.mm:
        (WebCore::screenDepth): Use the helper function.
        (WebCore::screenDepthPerComponent):
        (WebCore::screenIsMonochrome): Move these and make a comment.
        (WebCore::screenHasInvertedColors):

2016-03-23  Daniel Bates  <dabates@apple.com>

        CSP: Make violation console messages concise and consistent
        https://bugs.webkit.org/show_bug.cgi?id=155777
        <rdar://problem/25304031>

        Reviewed by Darin Adler.

        As a first step towards making the log messages that are emitted by the ContentSecurityPolicy object
        concise and consistent with the language and formatting used in other WebKit console messages, including
        other Content Security Policy messages, make the violation error messages concise and consistent.
        Being concise and consistent will help make it straightforward for a person to understand the reason
        for the violation by taking advantage of their familiarity with the language and formatting seen in
        other WebKit console messages.

        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::consoleMessageForViolation): Added. Builds up a console message for violation.
        (WebCore::ContentSecurityPolicyDirectiveList::allowJavaScriptURLs): Extract logic for logging a console message/reporting
        a violation from ContentSecurityPolicyDirectiveList::checkInlineAndReportViolation() to here and make use of WebCore::consoleMessageForViolation()
        to build the actual console message.
        (WebCore::ContentSecurityPolicyDirectiveList::allowInlineEventHandlers): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowInlineScript): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowInlineStyle): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowEval): Extract logic for logging a console message/reporting
        a violation from ContentSecurityPolicyDirectiveList::checkEvalAndReportViolation() to here and make use of WebCore::consoleMessageForViolation()
        to build the actual console message.
        (WebCore::ContentSecurityPolicyDirectiveList::allowPluginType): Extract logic for logging a console message/reporting
        a violation from ContentSecurityPolicyDirectiveList::checkMediaTypeAndReportViolation() to here and make use of WebCore::consoleMessageForViolation()
        to build the actual console message.
        (WebCore::ContentSecurityPolicyDirectiveList::allowScriptFromSource): Extract logic for logging a console message/reporting
        a violation from ContentSecurityPolicyDirectiveList::checkSourceAndReportViolation() to here and make use of WebCore::consoleMessageForViolation()
        to build the actual console message.
        (WebCore::ContentSecurityPolicyDirectiveList::allowObjectFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowChildContextFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowChildFrameFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowImageFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowStyleFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowFontFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowMediaFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowConnectToSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowFormAction): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowBaseURI): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowFrameAncestors): Extract logic for logging a console message/reporting
        a violation from ContentSecurityPolicyDirectiveList::checkFrameAncestorsAndReportViolation() to here and make use of WebCore::consoleMessageForViolation()
        to build the actual console message.
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Add FIXME comment to log that the frame-src directive is
        deprecated. See <https://bugs.webkit.org/show_bug.cgi?id=155773> for more details.
        (WebCore::ContentSecurityPolicyDirectiveList::checkEvalAndReportViolation): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::checkMediaTypeAndReportViolation): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::checkInlineAndReportViolation): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::checkSourceAndReportViolation): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::checkFrameAncestorsAndReportViolation): Deleted.
        * page/csp/ContentSecurityPolicyDirectiveList.h:

2016-03-23  Brent Fulgham  <bfulgham@apple.com>

        [WebGL] Non-power-of-two texture optimization
        https://bugs.webkit.org/show_bug.cgi?id=118409

        Reviewed by Dean Jackson.

        Based on a patch by Przemyslaw Szymanski  <p.szymanski3@samsung.com>
 
        This patch optimizes usage of handleNPOTTextures. We do not need to
        iterate over each texture unit if no black textures were set. This
        optimization provides a few more frames per seconds for certain
        draw calls.
    
        Tested by:
        (1) Existing tests: webgl/resources/webgl_test_files/conformance/textures/texture-npot.html
        (2) New test case: fast/canvas/webgl/texture-alternating-npot.html

        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::compressedTexImage2D): Use new helper method.
        (WebCore::WebGLRenderingContextBase::validateNPOTTextureLevel): Added.
        (WebCore::WebGLRenderingContextBase::drawArrays): Only check texture completeness
        if a black texture was used.
        (WebCore::WebGLRenderingContextBase::drawElements): Ditto.
        (WebCore::WebGLRenderingContextBase::texImage2DBase): Use new helper method.
        (WebCore::WebGLRenderingContextBase::validateTexFunc): Ditto.
        (WebCore::WebGLRenderingContextBase::checkTextureCompleteness): Return flag to indicate
        if a black fallbacktexture was used.
        * html/canvas/WebGLRenderingContextBase.h:

2016-03-23  Alexey Proskuryakov  <ap@apple.com>

        Build fix for a new warning.

        * editing/VisibleSelection.cpp: (WebCore::makeSearchRange): Don't move when returning,
        as that prevents copy elision.

2016-03-23  Antti Koivisto  <antti@apple.com>

        Share style by sharing RenderStyle substructures not the object itself
        https://bugs.webkit.org/show_bug.cgi?id=155787

        Reviewed by Anreas Kling.

        The current approach where we share RenderStyle objects between elements leads to lot of awkward and bug-prone code.
        Most of the RenderStyle consists of shareable substructures. It is better to just share those.

        With this patch we create shared styles with RenderStyle::clone(). Sharing is traced as state in Style::SharingResolver
        instead of relying on RenderStyle equality to locate potential sharing cousins.

        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::operator==):

            m_altText was missing from operator==
            This was exposed by TreeResolver::resolveElement change, tested by fast/css/alt-inherit-initial.html

        * style/StyleSharingResolver.cpp:
        (WebCore::Style::elementHasDirectionAuto):
        (WebCore::Style::SharingResolver::resolve):

            Save share results to a map.

        (WebCore::Style::SharingResolver::findSibling):
        (WebCore::Style::SharingResolver::locateCousinList):

            Instead of traversing we can now just do a hash lookup to locate a candidate cousin list.
            There is no need for recursion anymore, the map covers sharing beyond immediate siblings too.
            Remove most tests here as they have been already covered when sharing occured.

        (WebCore::Style::canShareStyleWithControl):
        * style/StyleSharingResolver.h:
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::styleForElement):
        (WebCore::Style::TreeResolver::resolveElement):

            No need to do forced setting anymore just to support style sharing.

2016-03-23  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Reduce PassRefPtr uses in editing
        https://bugs.webkit.org/show_bug.cgi?id=155743

        Reviewed by Darin Adler.

        Use RefPtr<>&&, raw pointer, or reference in arugments instead of PassRefPtr.
        Besides RefPtr is used if function may be able to return nullptr.

        * dom/Element.cpp:
        (WebCore::Element::setOuterHTML):
        (WebCore::Element::setInnerHTML):
        * dom/Range.cpp:
        (WebCore::Range::createContextualFragment):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::setInnerHTML):
        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::wrapContentsInDummySpan):
        * editing/CompositeEditCommand.h:
        * editing/DictationCommand.cpp:
        (WebCore::DictationCommand::insertText):
        * editing/SplitTextNodeContainingElementCommand.cpp:
        (WebCore::SplitTextNodeContainingElementCommand::doApply):
        * editing/TextInsertionBaseCommand.cpp:
        (WebCore::TextInsertionBaseCommand::applyTextInsertionCommand):
        * editing/TextInsertionBaseCommand.h:
        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::deleteSelection):
        (WebCore::TypingCommand::deleteKeyPressed):
        (WebCore::TypingCommand::forwardDeleteKeyPressed):
        (WebCore::TypingCommand::insertText):
        (WebCore::TypingCommand::insertLineBreak):
        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
        (WebCore::TypingCommand::insertParagraphSeparator):
        (WebCore::TypingCommand::lastTypingCommandIfStillOpenForTyping):
        (WebCore::TypingCommand::closeTyping):
        (WebCore::TypingCommand::ensureLastEditCommandHasCurrentSelectionIfOpenForMoreTyping):
        * editing/TypingCommand.h:
        * editing/VisibleSelection.cpp:
        (WebCore::VisibleSelection::firstRange):
        (WebCore::makeSearchRange):
        * editing/VisibleSelection.h:
        * editing/WrapContentsInDummySpanCommand.cpp:
        (WebCore::WrapContentsInDummySpanCommand::WrapContentsInDummySpanCommand):
        * editing/WrapContentsInDummySpanCommand.h:
        (WebCore::WrapContentsInDummySpanCommand::create):
        * editing/atk/FrameSelectionAtk.cpp:
        (WebCore::maybeEmitTextFocusChange):
        (WebCore::FrameSelection::notifyAccessibilityForSelectionChange):
        * editing/htmlediting.cpp:
        (WebCore::createOrderedListElement):
        (WebCore::createUnorderedListElement):
        (WebCore::createListItemElement):
        (WebCore::createTabSpanElement):
        * editing/htmlediting.h:
        * editing/markup.cpp:
        (WebCore::AttributeChange::AttributeChange):
        (WebCore::ancestorToRetainStructureAndAppearanceForBlock):
        (WebCore::styleFromMatchedRulesAndInlineDecl):
        (WebCore::createFragmentForInnerOuterHTML):
        (WebCore::createFragmentForTransformToFragment):
        (WebCore::createContextualFragment):
        * editing/markup.h:
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::insertAdjacentHTML):
        * xml/XSLTProcessor.cpp:
        (WebCore::XSLTProcessor::transformToFragment):

2016-03-23  Carlos Garcia Campos  <cgarcia@igalia.com>

        Use Region instead of IntRect in PageClient and WebPageProxy setViewNeedsDisplay method
        https://bugs.webkit.org/show_bug.cgi?id=155747

        Reviewed by Darin Adler.

        Add helper function to make cairo region out of a WebCore::Region.

        * platform/graphics/cairo/CairoUtilities.cpp:
        (WebCore::toCairoRegion):
        * platform/graphics/cairo/CairoUtilities.h:

2016-03-22  Tim Horton  <timothy_horton@apple.com>

        Invoking a link preview on a complex link (e.g. an image) results in an empty TextIndicator
        https://bugs.webkit.org/show_bug.cgi?id=155779
        <rdar://problem/22408793>

        Reviewed by Simon Fraser.

        * page/FrameSnapshotting.cpp:
        (WebCore::snapshotFrameRect):
        (WebCore::snapshotFrameRectWithClip):
        * page/FrameSnapshotting.h:
        * page/TextIndicator.cpp:
        (WebCore::takeSnapshot):
        (WebCore::takeSnapshots):
        (WebCore::initializeIndicator):
        When snapshotting, clip to the indicated range's rects. This is important
        to avoid painting into the margins in the non-selection-only painting case.
        This didn't come up with normal selection-only painting because the text
        didn't intersect the margin, and the background doesn't paint.

2016-03-22  Darin Adler  <darin@apple.com>

        showModalDialog code runs with "first window" set to wrong window
        https://bugs.webkit.org/show_bug.cgi?id=155710

        Reviewed by Brent Fulgham.

        Test: http/tests/security/cross-origin-modal-dialog-base.html

        * page/Chrome.cpp:
        (WebCore::Chrome::runModal): Null out entryScope so that the "first window"
        checks inside the modal dialog won't run in the context of the original window
        that presented the dialog.

2016-03-22  Said Abou-Hallawa  <sabouhallawa@apple.com>

        userSpaceOnUse patterns are not stroked for empty object bounding box elements
        https://bugs.webkit.org/show_bug.cgi?id=109758

        Reviewed by Brent Fulgham.

        Checking whether the patternUnits is objectBoundingBox needs to be done
        after calling collectPatternAttributes(). Otherwise the default value
        will be always checked which is 'objectBoundingBox'.

        Tests: svg/custom/pattern-units-fill-stroke.svg

        * rendering/svg/RenderSVGResourcePattern.cpp:
        (WebCore::RenderSVGResourcePattern::buildPattern):
        (WebCore::RenderSVGResourcePattern::applyResource):

2016-03-22  Myles C. Maxfield  <mmaxfield@apple.com>

        Use references instead of pointers for absolute positioning code
        https://bugs.webkit.org/show_bug.cgi?id=155775

        Reviewed by Simon Fraser.

        There are many pointers which will never be null in this code. This patch
        migrates them to use references.

        No new tests because there is no behavior change.

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::layoutBlockChild):
        (WebCore::RenderBlockFlow::marginBeforeEstimateForChild):
        (WebCore::RenderBlockFlow::insertFloatingObject):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::constrainLogicalWidthInRegionByMinMax):
        (WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats):
        (WebCore::RenderBox::computeLogicalWidthInRegion):
        (WebCore::RenderBox::computeLogicalWidthInRegionUsing):
        (WebCore::RenderBox::computeInlineDirectionMargins):
        (WebCore::RenderBox::renderBoxRegionInfo):
        (WebCore::RenderBox::computeLogicalHeight):
        (WebCore::RenderBox::skipContainingBlockForPercentHeightCalculation):
        (WebCore::RenderBox::computePercentageLogicalHeight):
        (WebCore::RenderBox::computeReplacedLogicalWidthUsing):
        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
        (WebCore::RenderBox::availableLogicalHeightUsing):
        (WebCore::RenderBox::computeBlockDirectionMargins):
        (WebCore::RenderBox::computeAndSetBlockDirectionMargins):
        (WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
        (WebCore::RenderBox::containingBlockLogicalHeightForPositioned):
        (WebCore::computeInlineStaticDistance):
        (WebCore::RenderBox::computePositionedLogicalWidth):
        (WebCore::computeLogicalLeftPositionedOffset):
        (WebCore::RenderBox::computePositionedLogicalWidthUsing):
        (WebCore::computeBlockStaticDistance):
        (WebCore::RenderBox::computePositionedLogicalHeight):
        (WebCore::computeLogicalTopPositionedOffset):
        (WebCore::RenderBox::computePositionedLogicalHeightUsing):
        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
        (WebCore::RenderBox::computePositionedLogicalHeightReplaced):
        (WebCore::percentageLogicalHeightIsResolvable):
        (WebCore::RenderBox::percentageLogicalHeightIsResolvableFromBlock):
        (WebCore::RenderBox::hasDefiniteLogicalHeight):
        (WebCore::RenderBox::hasUnsplittableScrollingOverflow):
        * rendering/RenderBox.h:
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox):
        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::computeMainAxisExtentForChild):
        (WebCore::RenderFlexibleBox::applyStretchAlignmentToChild):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::minSizeForChild):
        (WebCore::RenderGrid::computeMarginLogicalHeightForChild):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::updateLogicalWidth):
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::layout):

2016-03-22  Jon Davis  <jond@apple.com>

        Add Download Attribute to the Feature Status page
        https://bugs.webkit.org/show_bug.cgi?id=155772

        Reviewed by Timothy Hatcher.

        * features.json:

2016-03-22  Jer Noble  <jer.noble@apple.com>

        CachedResource::MediaResource types shouldn't be blocked due to mixed-content.
        https://bugs.webkit.org/show_bug.cgi?id=155588
        <rdar://problem/25177795>

        Reviewed by Brent Fulgham.

        Follow-up to address crashes caused by r198549. Rather than destroy MediaResourceLoader on a background thread,
        migrate the Ref to the main thread before releasing.

        * platform/graphics/PlatformMediaResourceLoader.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession dealloc]):

2016-03-22  John Wilander  <wilander@apple.com>

        Restrict WebSockets header parsing according to RFC6455 and RFC7230. Based on Lamarque V. Souza's original patch.
        https://bugs.webkit.org/show_bug.cgi?id=82714

        Reviewed by Brent Fulgham.

        Tests: http/tests/websocket/tests/hybi/error-event-ready-state-non-existent-url-with-server-responding-404.html
               http/tests/websocket/tests/hybi/handshake-fail-by-invalid-http-version.html
               http/tests/websocket/tests/hybi/handshake-fail-by-non-ascii-header-value-sec-websocket-accept.html
               http/tests/websocket/tests/hybi/handshake-fail-by-non-ascii-header-value-sec-websocket-extensions.html
               http/tests/websocket/tests/hybi/handshake-fail-by-non-ascii-header-value-sec-websocket-protocol.html
               http/tests/websocket/tests/hybi/handshake-fail-by-non-ascii-status-line.html
               http/tests/websocket/tests/hybi/handshake-fail-by-null-char-in-status.html
               http/tests/websocket/tests/hybi/handshake-ok-with-http-version-beyond-1_1.html

        * Modules/websockets/WebSocketHandshake.cpp:
        (WebCore::WebSocketHandshake::httpURLForAuthenticationAndCookies):
        (WebCore::headerHasValidHTTPVersion):
            - Check for HTTP version 1.1 and above.
        (WebCore::WebSocketHandshake::readStatusLine):
            - Only allow ASCII characters in status line.
            - Only allow HTTP version 1.1 and above in status line.
        (WebCore::WebSocketHandshake::readHTTPHeaders):
            - Only allow ASCII characters in values for new HTTP headers.

2016-03-22  Myles C. Maxfield  <mmaxfield@apple.com>

        [RTL Scrollbars] Position: absolute divs are covered by vertical scrollbar
        https://bugs.webkit.org/show_bug.cgi?id=155533

        Reviewed by Darin Adler.

        This patch changes the behavior of position: absolute elements when their
        containing block has overflow: scroll in RTL scrollbar mode. Previously, we
        were only adjusting the overflow calculation for such elements (but not
        their position calculation). This patch updates the position calculation,
        which automatically makes the overflow calculation work propertly, so the
        old calculation is no longer necessary.

        This patch also updates iframes to appropriately move their dirty rects
        and their painting CTM by the scrollbar width when traversing frame
        boundaries. This fixes all our existing RTL scrollbar RTL tests.

        The RTL scrollbar tests are only marked as passing on certain OSes, so these
        tests are transitioning from failing to passing in that other repository.

        Test: fast/scrolling/rtl-scrollbars-positioning.html
              fast/scrolling/rtl-scrollbars-overflow-elementFromPoint.html
              fast/scrolling/rtl-scrollbars-overflow-position-absolute.html
              fast/scrolling/rtl-scrollbars-iframe-offset.html
              fast/scrolling/rtl-scrollbars-iframe-position-absolute.html
              fast/scrolling/rtl-scrollbars-iframe-scrolled.html
              fast/scrolling/rtl-scrollbars-iframe.html

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::paint):
        (WebCore::ScrollView::locationOfContents):
        * platform/ScrollView.h:
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::repaintLayerDirtyRects):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::addOverflowFromPositionedObjects):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computePositionedLogicalWidth):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::repaintViewRectangle):

2016-03-22  Antti Koivisto  <antti@apple.com>

        Non-const DocumentRuleSets::features() does not check default style version
        https://bugs.webkit.org/show_bug.cgi?id=155766

        Reviewed by Andreas Kling.

        This may leave it out of date when the default stylesheet expands.

        No test, don't know how to hit this with current codebase. With some further optimizations
        it starts affecting some tests involving UA media control stylesheets.

        * css/DocumentRuleSets.h:
        (WebCore::DocumentRuleSets::mutableFeatures):

            Check the default style version number in non-const case too.

2016-03-22  Daniel Bates  <dabates@apple.com>

        CSP: Should only execute <script> or apply <style> if its hash appears in all policies
        https://bugs.webkit.org/show_bug.cgi?id=155709
        <rdar://problem/25263368>

        Reviewed by Darin Adler.

        Fixes an issue where a <script>/<style> was allowed to execute/be applied if its hash is listed
        in at least one Content Security Policy (CSP) delivered with the page. We should only execute/apply
        such a script/stylesheet if its hash is listed in all CSPs delivered with the page.

        Tests: http/tests/security/contentSecurityPolicy/1.1/scripthash-multiple-policies.html
               http/tests/security/contentSecurityPolicy/1.1/stylehash-multiple-policies.html

        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::isAllowedByAllWithHash): Added. Checks if the specified hash is allowed by all policies.
        (WebCore::isAllowedByAllWithHashFromContent): Modified to call WebCore::isAllowedByAllWithHash()
        to determine if the <script>/<style> is allowed by all CSPs delivered with the page.

2016-03-18  Jer Noble  <jer.noble@apple.com>

        CRASH in WebCore::MediaResourceLoader::requestResource + 698
        https://bugs.webkit.org/show_bug.cgi?id=155651
        <rdar://problem/25130582>

        Reviewed by Eric Carlson.

        No new tests, fixes existing tests running under GuardMalloc.

        Protect against the Document passed into MediaResourceLoader being destroyed during the MediaResourceLoader's lifetime.

        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::MediaResourceLoader):
        (WebCore::MediaResourceLoader::contextDestroyed):
        (WebCore::MediaResourceLoader::requestResource):
        (WebCore::MediaResource::responseReceived):
        * loader/MediaResourceLoader.h:

2016-03-22  Beth Dakin  <bdakin@apple.com>

        Advanced spell checking should be guarded behind 
        HAVE(ADVANCED_SPELL_CHECKING)
        https://bugs.webkit.org/show_bug.cgi?id=155738

        Reviewed by Geoff Garen.

        * config.h:
        (WebCore::ScrollableArea::systemLanguageIsRTL):
        * platform/spi/mac/NSSpellCheckerSPI.h:

2016-03-22  Nan Wang  <n_wang@apple.com>

        AX: Change "dialog" role description to "web dialog" so users can distinguish from native alerts
        https://bugs.webkit.org/show_bug.cgi?id=154292

        Reviewed by Chris Fleizach.

        Changed role descriptions for "dialog" and "alert dialog" roles as required.

        No new tests needed.

        * English.lproj/Localizable.strings:

2016-03-22  Alex Christensen  <achristensen@webkit.org>

        Add null check in CachedResourceLoader::determineRevalidationPolicy
        https://bugs.webkit.org/show_bug.cgi?id=155758
        rdar://problem/25108408

        Reviewed by Jer Noble.

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::frame):
        (WebCore::CachedResourceLoader::determineRevalidationPolicy):
        Null-check frame() before dereferencing it.

2016-03-22  Daniel Bates  <dabates@apple.com>

        CSP: Check inline event handlers on each run, not only the first
        https://bugs.webkit.org/show_bug.cgi?id=115700
        <rdar://problem/24211159>

        Reviewed by Andy Estes.

        Fixes an issue where an inline event handler would always be allowed to execute if it
        executed at least once.

        Currently we query whether the Content Security Policy (CSP) of the page permits inline event
        handlers each time we register a new handler for an event. And a handler is registered exactly
        once the first time the event associated with it is dispatched. Once a handler is registered
        as a listener for an event E then we will always invoke the handler when event E is dispatched
        regardless of whether the CSP of the page changes (say, as a result of programmatically inserting
        a <meta http-equiv="Content-Security-Policy">). Instead we should always check the
        CSP of the page whenever we are going to invoke an event handler.

        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::handleEvent): Check the CSP of the page and bail out if the
        policy does not permit execution of an inline event handler.
        * bindings/js/JSEventListener.h:
        (WebCore::JSEventListener::sourceURL): Added. Default implementation that returns an empty string.
        (WebCore::JSEventListener::sourcePosition): Added. Default implementation that returns a default position.
        * bindings/js/JSLazyEventListener.cpp:
        (WebCore::JSLazyEventListener::JSLazyEventListener): Update code following instance variable
        renaming in JSLazyEventListener.h.
        (WebCore::JSLazyEventListener::initializeJSFunction): Ditto. 
        * bindings/js/JSLazyEventListener.h: Override JSEventListener::sourceURL() and JSEventListener::sourcePosition().
        Changed all mutable instance variables to immutable ones as we do not modify these variables
        in any const member functions. Also renamed instance variable m_position to m_sourcePosition
        to better describe that it represents the source code position where the event handler was defined.

2016-03-22  Jer Noble  <jer.noble@apple.com>

        Media elements allowed to play without a user gesture, but requiring fullscreen playback, should not be allowed to autoplay.
        https://bugs.webkit.org/show_bug.cgi?id=155599

        Reviewed by Darin Adler.

        Test: media/video-autoplay-allowed-but-fullscreen-required.html

        Entering fullscreen should always require a user gesture.

        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::playbackPermitted):

2016-03-22  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] WebInspector broken after r197620
        https://bugs.webkit.org/show_bug.cgi?id=155497
        <rdar://problem/25171910>

        Reviewed by Philippe Normand.

        Add resource scheme to the list of secure protocols.

        * platform/SchemeRegistry.cpp:
        (WebCore::secureSchemes):

2016-03-22  Brent Fulgham  <bfulgham@apple.com>

        SharedBuffer::copy() can cause a segmentation fault.
        https://bugs.webkit.org/show_bug.cgi?id=155739

        Reviewed by Ryosuke Niwa.

        Based on a Blink patch by Huang Dongsung <luxtella@company100.net>.
        <https://src.chromium.org/viewvc/blink?revision=153850&view=revision>

        After SharedBuffer::copy(), SharedBuffer::append() can cause segmentation fault,
        because copy() calls clone->m_buffer.append(m_segments[i], segmentSize) even if
        'i' is the last index. The data size of m_segments.last() is often less than
        segmentSize. So, in the cloned instance m_size < (m_buffer.size() + SUM(m_segments[i].size())).
        This patch appends the exact size of the last segment instead of segmentSize.

        Tested by TestWebKitAPI SharedBufferTest::copy

        * platform/SharedBuffer.cpp:
        (SharedBuffer::copy): 

2016-03-22  Alberto Garcia  <berto@igalia.com>

        Unreviewed typo fix.

        * platform/gtk/LocalizedStringsGtk.cpp:
        (WebCore::textTrackAutomaticMenuItemText): "choosen" => "chosen"

2016-03-22  Zan Dobersek  <zdobersek@igalia.com>

        [TextureMapper] Destructing TextureMapperLayer should clean up its effect target
        https://bugs.webkit.org/show_bug.cgi?id=155718

        Reviewed by Darin Adler.

        TextureMapperLayer destructor should, in case of non-null effect target,
        null out the effect target's mask and replica layer pointers if those
        pointers point to the TextureMapperLayer object that's being destroyed,
        avoiding use-after-free occurrences.

        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::~TextureMapperLayer):

2016-03-22  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] Shrink-to-fit the CompositingCoordinator's update atlases vector after cleanup
        https://bugs.webkit.org/show_bug.cgi?id=155719

        Reviewed by Carlos Garcia Campos.

        Shrink the Vector object containing the cached UpdateAtlas objects
        after the inactive ones are removed. This way the capacity of the
        Vector is kept under control, preventing unnecessary waste of memory.

        * platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:
        (WebCore::CompositingCoordinator::releaseInactiveAtlasesTimerFired):

2016-03-21  Brent Fulgham  <bfulgham@apple.com>

        Improve SharedBuffer testing
        https://bugs.webkit.org/show_bug.cgi?id=93078
        <rdar://problem/25277829>

        Reviewed by Ryosuke Niwa.

        * platform/SharedBuffer.h: Mark a few methods as WEBCORE_EXPORT so they
        can be used by TestWebKitAPI.

2016-03-21  Zalan Bujtas  <zalan@apple.com>

        WebCore::RenderTableCell::setCol should put a cap on the column value. 
        https://bugs.webkit.org/show_bug.cgi?id=155642
        <rdar://problem/15895201>

        Reviewed by Simon Fraser.

        This patch ensures that we don't crash when the column number is large enough.
        see webkit.org/b/71135 for more information.

        Test: tables/colspan-with-large-value-crash.html

        * rendering/RenderTableCell.h:
        (WebCore::RenderTableCell::setCol):

2016-03-21  Simon Fraser  <simon.fraser@apple.com>

        [iOS WK2] Use larger tiles when possible to reduce per-tile painting overhead
        https://bugs.webkit.org/show_bug.cgi?id=155734
        rdar://problem/24968144

        Reviewed by Tim Horton.

        The existing tile size logic is wired to adjustScrollbars, which doesn't fire
        when scrolling is delegated. For iOS WK2, key off of a new unobscuredContentSizeChanged()
        function that runs when the UI process tells told WebCore that the unobscured size
        has changed. In addition, contentsResized() is used to update scrollability when
        page changes size.

        * page/FrameView.cpp:
        (WebCore::FrameView::contentsResized):
        (WebCore::FrameView::addedOrRemovedScrollbar):
        (WebCore::FrameView::adjustTiledBackingScrollability): Handle both delegated and non-delegated
        scrolling; the former looks at the visible size (based on the unobscuredVisibleContentRect),
        the latter at the presence of scrollbars.
        (WebCore::FrameView::unobscuredContentSizeChanged):
        * page/FrameView.h:
        * platform/ScrollView.h:
        (WebCore::ScrollView::unobscuredContentSizeChanged):
        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::adjustTileCoverageRect): Use kDefaultTileSize rather than the
        tile size, to retain the old amount of overdraw.
        (WebCore::TileController::tileSize): There was a bug in the not-scrollable case; we need
        to scale.
        * platform/ios/ScrollViewIOS.mm:
        (WebCore::ScrollView::setUnobscuredContentSize):

2016-03-21  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r197552.

        May have caused a ~2% PLT regression on iOS

        Reverted changeset:

        "Drop DocumentSharedObjectPool immediately when going into
        PageCache."
        https://bugs.webkit.org/show_bug.cgi?id=154986
        http://trac.webkit.org/changeset/197552

2016-03-21  Simon Fraser  <simon.fraser@apple.com>

        Very flashy scrolling on http://quellish.tumblr.com page
        https://bugs.webkit.org/show_bug.cgi?id=155728
        rdar://problem/22299375

        Reviewed by Zalan Bujtas.

        http://quellish.tumblr.com/post/126712999812/how-on-earth-the-facebook-ios-application-is-so
        has many elements that are nested inside elements with non-equal corner radius clipping.
        This requires building bezier paths for the rounded-rect clip which is expensive.

        For many rows of the table, we can avoid the rounded-rect clipping because the intersection
        of the paintDirtyRect and the clip is actually rectangular.

        * platform/graphics/FloatRoundedRect.cpp:
        (WebCore::FloatRoundedRect::intersectionIsRectangular):
        * platform/graphics/FloatRoundedRect.h:
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::clipToRect):

2016-03-21  Zalan Bujtas  <zalan@apple.com>

        Web Inspector search icon does not fit when zoomed in.
        https://bugs.webkit.org/show_bug.cgi?id=155708

        Reviewed by Simon Fraser.

        Adjusts the paint rect for the magnifier icon so that it fits even when zoomed in.

        Covered by existing tests.

        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::resultsButtonSizes):
        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):

2016-03-21  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo][MediaFoundation] Crash when media player is destroyed.
        https://bugs.webkit.org/show_bug.cgi?id=155716

        Reviewed by Alex Christensen.

        Increase the reference count on the video presenter object in the ActivateObject method
        to avoid referencing a deleted object when the media player is destroyed.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::CustomVideoPresenter::ActivateObject):

2016-03-21  Eric Carlson  <eric.carlson@apple.com>

        Add a WebRTC specific compile flag
        https://bugs.webkit.org/show_bug.cgi?id=155663

        Guard WebRTC-only files with ENABLE(WEB_RTC) rather than ENABLE(MEDIA_STREAM).

        Reviewed by Jer Noble.

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/mediastream/PeerConnectionBackend.h:
        * Modules/mediastream/PeerConnectionStates.h:
        * Modules/mediastream/RTCConfiguration.cpp:
        * Modules/mediastream/RTCConfiguration.h:
        * Modules/mediastream/RTCConfiguration.idl:
        * Modules/mediastream/RTCDTMFSender.cpp:
        * Modules/mediastream/RTCDTMFSender.h:
        * Modules/mediastream/RTCDTMFSender.idl:
        * Modules/mediastream/RTCDTMFToneChangeEvent.cpp:
        * Modules/mediastream/RTCDTMFToneChangeEvent.h:
        * Modules/mediastream/RTCDTMFToneChangeEvent.idl:
        * Modules/mediastream/RTCDataChannel.cpp:
        * Modules/mediastream/RTCDataChannel.h:
        * Modules/mediastream/RTCDataChannel.idl:
        * Modules/mediastream/RTCDataChannelEvent.cpp:
        * Modules/mediastream/RTCDataChannelEvent.h:
        * Modules/mediastream/RTCDataChannelEvent.idl:
        * Modules/mediastream/RTCIceCandidate.cpp:
        * Modules/mediastream/RTCIceCandidate.h:
        * Modules/mediastream/RTCIceCandidate.idl:
        * Modules/mediastream/RTCIceCandidateEvent.cpp:
        * Modules/mediastream/RTCIceCandidateEvent.h:
        * Modules/mediastream/RTCIceCandidateEvent.idl:
        * Modules/mediastream/RTCIceServer.h:
        * Modules/mediastream/RTCIceServer.idl:
        * Modules/mediastream/RTCOfferAnswerOptions.cpp:
        * Modules/mediastream/RTCOfferAnswerOptions.h:
        * Modules/mediastream/RTCPeerConnection.cpp:
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/mediastream/RTCPeerConnection.js:
        (createOffer):
        * Modules/mediastream/RTCPeerConnectionInternals.js:
        * Modules/mediastream/RTCRtpReceiver.cpp:
        * Modules/mediastream/RTCRtpReceiver.h:
        * Modules/mediastream/RTCRtpReceiver.idl:
        * Modules/mediastream/RTCRtpSender.cpp:
        * Modules/mediastream/RTCRtpSender.h:
        * Modules/mediastream/RTCRtpSender.idl:
        * Modules/mediastream/RTCRtpSenderReceiverBase.h:
        * Modules/mediastream/RTCSessionDescription.cpp:
        * Modules/mediastream/RTCSessionDescription.h:
        * Modules/mediastream/RTCSessionDescription.idl:
        * Modules/mediastream/RTCStatsReport.cpp:
        * Modules/mediastream/RTCStatsReport.idl:
        * Modules/mediastream/RTCStatsResponse.cpp:
        * Modules/mediastream/RTCStatsResponse.idl:
        * Modules/mediastream/RTCTrackEvent.cpp:
        * Modules/mediastream/RTCTrackEvent.h:
        * Modules/mediastream/RTCTrackEvent.idl:
        * Modules/mediastream/SDPProcessor.cpp:
        * Modules/mediastream/SDPProcessor.h:
        * bindings/generic/RuntimeEnabledFeatures.cpp:
        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::setMediaStreamEnabled):
        (WebCore::RuntimeEnabledFeatures::webkitGetUserMediaEnabled):
        (WebCore::RuntimeEnabledFeatures::webkitMediaStreamEnabled):
        (WebCore::RuntimeEnabledFeatures::peerConnectionEnabled):
        (WebCore::RuntimeEnabledFeatures::setPeerConnectionEnabled):
        (WebCore::RuntimeEnabledFeatures::webkitRTCPeerConnectionEnabled):
        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::addBuiltinGlobals):
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        * bindings/js/JSDictionary.h:
        * bindings/js/JSRTCIceCandidateCustom.cpp:
        * bindings/js/JSRTCPeerConnectionCustom.cpp:
        * bindings/js/JSRTCSessionDescriptionCustom.cpp:
        * bindings/js/JSRTCStatsResponseCustom.cpp:
        * bindings/js/WebCoreJSBuiltinInternals.cpp:
        (WebCore::JSBuiltinInternalFunctions::JSBuiltinInternalFunctions):
        (WebCore::JSBuiltinInternalFunctions::visit):
        (WebCore::JSBuiltinInternalFunctions::initialize):
        * bindings/js/WebCoreJSBuiltinInternals.h:
        (WebCore::JSBuiltinInternalFunctions::rtcPeerConnectionInternals):
        * bindings/js/WebCoreJSBuiltins.h:
        (WebCore::JSBuiltinFunctions::JSBuiltinFunctions):
        (WebCore::JSBuiltinFunctions::mediaDevicesBuiltins):
        (WebCore::JSBuiltinFunctions::navigatorUserMediaBuiltins):
        (WebCore::JSBuiltinFunctions::rtcPeerConnectionBuiltins):
        (WebCore::JSBuiltinFunctions::rtcPeerConnectionInternalsBuiltins):
        * dom/EventNames.in:
        * dom/EventTargetFactory.in:
        * loader/FrameLoaderClient.h:
        * platform/mediastream/IceCandidate.h:
        * platform/mediastream/MediaEndpoint.cpp:
        * platform/mediastream/MediaEndpoint.h:
        * platform/mediastream/MediaEndpointConfiguration.cpp:
        * platform/mediastream/MediaEndpointConfiguration.h:
        * platform/mediastream/MediaEndpointSessionConfiguration.h:
        * platform/mediastream/MediaPayload.h:
        * platform/mediastream/PeerMediaDescription.h:
        * platform/mediastream/RTCConfigurationPrivate.h:
        * platform/mediastream/RTCDTMFSenderHandler.h:
        * platform/mediastream/RTCDTMFSenderHandlerClient.h:
        * platform/mediastream/RTCDataChannelHandler.h:
        * platform/mediastream/RTCDataChannelHandlerClient.h:
        * platform/mediastream/RTCIceCandidateDescriptor.cpp:
        * platform/mediastream/RTCIceCandidateDescriptor.h:
        * platform/mediastream/RTCIceServerPrivate.h:
        * platform/mediastream/RTCPeerConnectionHandler.cpp:
        * platform/mediastream/RTCPeerConnectionHandler.h:
        * platform/mediastream/RTCPeerConnectionHandlerClient.h:
        * platform/mediastream/RTCSessionDescriptionDescriptor.cpp:
        * platform/mediastream/RTCSessionDescriptionDescriptor.h:
        * platform/mediastream/RTCSessionDescriptionRequest.h:
        * platform/mediastream/RTCStatsRequest.h:
        * platform/mediastream/RTCStatsResponseBase.h:
        * platform/mediastream/RTCVoidRequest.h:
        * platform/mediastream/SDPProcessorScriptResource.cpp:
        * platform/mediastream/SDPProcessorScriptResource.h:
        * platform/mock/MockMediaEndpoint.cpp:
        * platform/mock/MockMediaEndpoint.h:
        * platform/mock/RTCDTMFSenderHandlerMock.cpp:
        * platform/mock/RTCDTMFSenderHandlerMock.h:
        * platform/mock/RTCDataChannelHandlerMock.cpp:
        * platform/mock/RTCDataChannelHandlerMock.h:
        * platform/mock/RTCNotifiersMock.cpp:
        * platform/mock/RTCNotifiersMock.h:
        * platform/mock/RTCPeerConnectionHandlerMock.cpp:
        * platform/mock/RTCPeerConnectionHandlerMock.h:
        * platform/mock/TimerEventBasedMock.h:
        (WebCore::RenderLayerBacking::paintIntoLayer):
        * testing/Internals.cpp:
        (WebCore::Internals::Internals):
        (WebCore::Internals::enableMockSpeechSynthesizer):
        (WebCore::Internals::enableMockMediaEndpoint):
        (WebCore::Internals::enableMockRTCPeerConnectionHandler):
        (WebCore::Internals::setMockMediaCaptureDevicesEnabled):
        * testing/Internals.h:

2016-03-21  Joonghun Park  <jh718.park@samsung.com>

        [JSC] Add ArrayBuffer::tryCreate and change the callsites where it is needed
        https://bugs.webkit.org/show_bug.cgi?id=155328

        Reviewed by Darin Adler.

        No new tests, no new behaviours.

        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::processIfEmptyOrDisturbed):
        (WebCore::FetchBody::consumeText):
        * Modules/fetch/FetchLoader.cpp:
        (WebCore::FetchLoader::didFinishLoading):
        * bindings/js/JSDOMPromise.h:
        (WebCore::char>>):
        * dom/MessageEvent.cpp:
        (WebCore::MessageEvent::MessageEvent):
        * dom/MessageEvent.h:
        * fileapi/FileReaderLoader.cpp:
        (WebCore::FileReaderLoader::didReceiveResponse):
        (WebCore::FileReaderLoader::didReceiveData):
        (WebCore::FileReaderLoader::arrayBufferResult):
        * html/canvas/WebGLBuffer.cpp:
        (WebCore::WebGLBuffer::associateBufferDataImpl):
        * html/track/DataCue.cpp:
        (WebCore::DataCue::DataCue):
        (WebCore::DataCue::data):
        (WebCore::DataCue::setData):
        (WebCore::DataCue::cueContentsMatch):
        * html/track/DataCue.h:
        * html/track/InbandDataTextTrack.cpp:
        (WebCore::InbandDataTextTrack::addDataCue):
        (WebCore::InbandDataTextTrack::removeCue):
        * platform/mac/SerializedPlatformRepresentationMac.mm:
        (WebCore::jsValueWithDataInContext):

2016-02-03  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Fix percentage tracks' size computation in grids with gutters
        https://bugs.webkit.org/show_bug.cgi?id=153825

        Reviewed by Darin Adler.

        The track sizing algorithm is passed an available size
        (freeSpace in the code) where to size the tracks. The total size of the grid
        gutters was pre-removed from that available size because we cannot use it to size
        the tracks. However that available size is also used to compute the size of
        percentage tracks. As we're removing the size of the gutters, the base size for
        percentage computations is smaller than it should be.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):

2016-03-21  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] scrollbar thumb clipped in 2.11.92
        https://bugs.webkit.org/show_bug.cgi?id=155586

        Reviewed by Michael Catanzaro.

        In the current version of Adwaita, the scrollbar itself also has a
        one pixel border that we are not taking into account.

        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::paintThumb): Use the scrollbar size
        in indicator mode, instead of only the thumb size, to correctly
        position the thumb in indicator mode.

2016-03-20  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Reduce uses of PassRefPtr in WebCore/dom - 6
        https://bugs.webkit.org/show_bug.cgi?id=155579

        Reviewed by Darin Adler.

        * dom/MessagePortChannel.h:
        * dom/default/PlatformMessagePortChannel.cpp:
        (WebCore::PlatformMessagePortChannel::EventData::EventData):
        (WebCore::MessagePortChannel::createChannel):
        (WebCore::MessagePortChannel::MessagePortChannel):
        (WebCore::MessagePortChannel::postMessageToRemote):
        (WebCore::PlatformMessagePortChannel::create):
        (WebCore::PlatformMessagePortChannel::PlatformMessagePortChannel):
        * dom/default/PlatformMessagePortChannel.h:
        (WebCore::PlatformMessagePortChannel::EventData::message):

2016-03-20  Jinwoo Jeong  <jw00.jeong@samsung.com>

        The setter of binaryType attribute in WebSocket should raise the exception.
        https://bugs.webkit.org/show_bug.cgi?id=135874

        Reviewed by Antonio Gomes.

        According to W3C WebSocket Specification, <https://www.w3.org/TR/2012/CR-websockets-20120920/>
        when an invalid value is set on binaryType of WebSocket, a SyntaxError should be raised.

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::setBinaryType): Add a parameter to set an exception.
        * Modules/websockets/WebSocket.h: Ditto.
        * Modules/websockets/WebSocket.idl: Update that setter of binaryType could raise an exception.

2016-03-20  Dan Bernstein  <mitz@apple.com>

        [Mac] Determine TARGET_MAC_OS_X_VERSION_MAJOR from MACOSX_DEPLOYMENT_TARGET rather than from MAC_OS_X_VERSION_MAJOR
        https://bugs.webkit.org/show_bug.cgi?id=155707
        <rdar://problem/24980691>

        Reviewed by Darin Adler.

        * Configurations/Base.xcconfig: Set TARGET_MAC_OS_X_VERSION_MAJOR based on the last
          component of MACOSX_DEPLOYMENT_TARGET.
        * Configurations/DebugRelease.xcconfig: For engineering builds, preserve the behavior of
          TARGET_MAC_OS_X_VERSION_MAJOR being the host’s OS version.

2016-03-20  Konstantin Tokarev  <annulen@yandex.ru>

        Added implementations of AXObjectCache methods for !HAVE(ACCESSIBILITY).
        https://bugs.webkit.org/show_bug.cgi?id=155697

        Reviewed by Darin Adler.

        No new tests needed.

        * accessibility/AXObjectCache.h:
        (WebCore::AXObjectCache::rangeForUnorderedCharacterOffsets):
        (WebCore::AXObjectCache::absoluteCaretBoundsForCharacterOffset):
        (WebCore::AXObjectCache::characterOffsetForIndex):
        (WebCore::AXObjectCache::startOrEndCharacterOffsetForRange):
        (WebCore::AXObjectCache::endCharacterOffsetOfLine):
        (WebCore::AXObjectCache::nextCharacterOffset):
        (WebCore::AXObjectCache::previousCharacterOffset):

2016-03-20  Darin Adler  <darin@apple.com>

        Disable Caches in Safari's Develop menu does not disable caches.
        https://bugs.webkit.org/show_bug.cgi?id=64483

        Reviewed by Antti Koivisto.

        Moved feature from Settings to Page.

        * history/PageCache.cpp:
        (WebCore::canCachePage): Use function on Page instead of Settings.
        (WebCore::PageCache::take): Ditto.
        (WebCore::PageCache::get): Ditto.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::subresourceCachePolicy): Ditto.
        (WebCore::FrameLoader::addExtraFieldsToRequest): Ditto.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::cachePolicy): Ditto.

        * page/Page.h:
        (WebCore::Page::isResourceCachingDisabled): Added.
        (WebCore::Page::setResourceCachingDisabled): Added.

        * page/Settings.in: Removed resourceCachingDisabled.

2016-03-20  Dan Bernstein  <mitz@apple.com>

        Update build settings

        Rubber-stamped by Andy Estes.

        * Configurations/DebugRelease.xcconfig:
        * Configurations/FeatureDefines.xcconfig:
        * Configurations/Version.xcconfig:

2016-03-20  Chris Fleizach  <cfleizach@apple.com>

        AX: Radio button members are not identified together in all cases
        https://bugs.webkit.org/show_bug.cgi?id=155604
        <rdar://problem/21186992>

        Reviewed by Darin Adler.

        Allow aria radio buttons to be grouped together as linked ui elements even if they're not input types of radio button.

        Modified test: accessibility/radio-button-group-members.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::speakProperty):
        (WebCore::AccessibilityRenderObject::addRadioButtonGroupChildren):
        (WebCore::AccessibilityRenderObject::addRadioButtonGroupMembers):
        * accessibility/AccessibilityRenderObject.h:

2016-03-19  Joonghun Park  <jh718.park@samsung.com>

        Purge PassRefPtr from WebCore/html/shadow
        https://bugs.webkit.org/show_bug.cgi?id=155681

        Reviewed by Darin Adler.

        No new tests, no new behaviours.

        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::updateImageControls):
        (WebCore::HTMLImageElement::tryCreateImageControls):
        (WebCore::HTMLImageElement::createImageControls): Deleted.
        * html/HTMLImageElement.h:
        * html/shadow/ImageControlsRootElement.h:
        * html/shadow/MediaControls.h:
        * html/shadow/MediaControlsApple.cpp:
        (WebCore::MediaControls::tryCreate):
        (WebCore::MediaControlsApple::tryCreateControls):
        (WebCore::MediaControlsApple::showClosedCaptionTrackList):
        (WebCore::MediaControlsApple::hideClosedCaptionTrackList):
        (WebCore::MediaControlsApple::eventListener):
        (WebCore::MediaControls::create): Deleted.
        (WebCore::MediaControlsApple::createControls): Deleted.
        * html/shadow/MediaControlsApple.h:
        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
        (WebCore::ImageControlsButtonElementMac::tryCreate):
        (WebCore::ImageControlsButtonElementMac::maybeCreate): Deleted.
        * html/shadow/mac/ImageControlsButtonElementMac.h:
        * html/shadow/mac/ImageControlsRootElementMac.cpp:
        (WebCore::ImageControlsRootElement::tryCreate):
        (WebCore::ImageControlsRootElement::maybeCreate): Deleted.

2016-03-19  Antti Koivisto  <antti@apple.com>

        Data URL DecodeTask may get deleted outside main thread
        https://bugs.webkit.org/show_bug.cgi?id=155584
        rdar://problem/24492104

        Reviewed by David Kilzer.

        Follow-up: fix a possible null pointer crash.

        * platform/network/DataURLDecoder.cpp:
        (WebCore::DataURLDecoder::DecodingResultDispatcher::startTimer):

            If timer fires under startOneShot m_decodeTask may become zero before schedule() is called.
            Fix by copying schedule context to a local before calling startOneShot.

2016-03-18  Zhuo Li  <zachli@apple.com>

        Update AutoFill button in input fields.
        https://bugs.webkit.org/show_bug.cgi?id=155619.
        rdar://problem/24486939.

        Reviewed by Daniel Bates.

        * css/html.css:
        (input::-webkit-contacts-auto-fill-button):
        Use the new AutoFill button.

2016-03-18  Alex Christensen  <achristensen@webkit.org>

        Give NSURLSessionConfiguration information about parent process
        https://bugs.webkit.org/show_bug.cgi?id=155661

        Reviewed by Anders Carlsson.

        * platform/spi/cf/CFNetworkSPI.h:
        Add newly-used SPI declarations.

2016-03-18  Simon Fraser  <simon.fraser@apple.com>

        Sideways-scrollable RTL document has wrong initial and reload offset in WKWebView
        https://bugs.webkit.org/show_bug.cgi?id=155660
        rdar://problem/22212662

        Reviewed by Tim Horton.
        
        There were two problems with the scroll position of RTL documents on initial and reload
        in WKWebView.

        First, in the delegatesScrolling() code path, ScrollView::updateScrollbars() needs to
        tell someone that the scroll origin changed, to trigger a scroll to the page origin.

        Secondly, WKWebView had scrollPosition/scrollOffset confusion in various places.

        Test: fast/scrolling/rtl-initial-scroll-position.html

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::updateScrollbars):

2016-03-18  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r198443.

        This change caused API test failures on El Capitan

        Reverted changeset:

        "CRASH in WebCore::MediaResourceLoader::requestResource + 698"
        https://bugs.webkit.org/show_bug.cgi?id=155651
        http://trac.webkit.org/changeset/198443

2016-03-18  Darin Adler  <darin@apple.com>

        ASSERTION FAILED: m_isValid == valid() in WebCore::HTMLFormControlElement::isValidFormControlElement
        https://bugs.webkit.org/show_bug.cgi?id=139481

        Reviewed by Daniel Bates.

        Test: fast/forms/validity-assertion-inserting-into-datalist.html

        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::insertedInto): Set the flags that will cause
        "will validate" to be recomputed *before* calling willValidate().

2016-03-18  Chris Dumez  <cdumez@apple.com>

        Speculative revalidation requests do not have their HTTP user-agent set
        https://bugs.webkit.org/show_bug.cgi?id=155620
        <rdar://problem/24657567>

        Reviewed by Brady Eidson.

        Export a couple of symbols so they can be used from WebKit2.

        Test: http/tests/cache/disk-cache/speculative-validation/validation-request.html

        * platform/network/ResourceRequestBase.h:

2016-03-18  Zhuo Li  <zachli@apple.com>

        Need to forward declare NSScrollerImpSPI::scrollerLayoutDirection.
        https://bugs.webkit.org/show_bug.cgi?id=155662.

        Reviewed by Myles C. Maxfield.

        * platform/spi/mac/NSScrollerImpSPI.h:
        Forward declare NSScrollerImpSPI::scrollerLayoutDirection.

2016-03-18  Myles C. Maxfield  <mmaxfield@apple.com>

        [OS X] Scrollbars are sometimes erroneously reported as overlay
        https://bugs.webkit.org/show_bug.cgi?id=155630

        Reviewed by Darin Adler.

        When AppKit boots up, if the system preference is set to determine at runtime whether
        scrollbars should be overlay or always-on, AppKit must do some processing to determine
        this scrollbar state. We listen for the results by using NSScrollerImpPairDelegate's
        scrollerImpPair:updateScrollerStyleForNewRecommendedScrollerStyle: method.

        However, our NSScrollerImpPairDelegates are owned by the FrameView, and when loading
        a page, there is a short amount of time when no FrameViews are alive. This means that
        there is a point in time when we don't have any NSScrollerImpPairs alive. Unfortunately,
        the processesing that AppKit does to determine the scrollbar state is done
        asynchronously, and the results may be reported within this short window. In this case,
        we don't receive the notification that the scrollbar should be non-overlay, and our
        internal state (gUsesOverlayScrollbars in ScrollbarThemeMac) becomes stale.

        The solution is to simply always check what the scrollbar state is upon creation of a
        NSScrollerImpPair. That way, as soon as the second FrameView is created, the scrollbar
        state will be correctly updated immediately.

        An alternative, similar, approach would be for ScrollbarThemeMac to listen to the
        NSPreferredScrollerStyleDidChangeNotification. This patch doesn't use this approach
        in order to align with the current division of responsibilities between ScrollAnimator
        and ScrollbarTheme.

        Covered by existing (RTL Scrollbar) tests.

        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):

2016-03-18  Jer Noble  <jer.noble@apple.com>

        CRASH in WebCore::MediaResourceLoader::requestResource + 698
        https://bugs.webkit.org/show_bug.cgi?id=155651
        <rdar://problem/25130582>

        Reviewed by Eric Carlson.

        No new tests, fixes existing tests running under GuardMalloc.

        Protect against the Document passed into MediaResourceLoader being destroyed during the MediaResourceLoader's lifetime.

        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::MediaResourceLoader):
        (WebCore::MediaResourceLoader::contextDestroyed):
        (WebCore::MediaResourceLoader::requestResource):
        (WebCore::MediaResource::responseReceived):
        * loader/MediaResourceLoader.h:

2016-03-18  Mark Lam  <mark.lam@apple.com>

        JSDOMGlobalObject.h needs to #include StructureInlines.h.
        https://bugs.webkit.org/show_bug.cgi?id=155657

        Reviewed by Filip Pizlo.

        No new tests needed.  This is a build fix for the Win EWS.

        * bindings/js/JSDOMGlobalObject.h:

2016-03-18  Brent Fulgham  <bfulgham@apple.com>

        Local file restrictions should not block sessionStorage access
        https://bugs.webkit.org/show_bug.cgi?id=155609
        <rdar://problem/25229461>

        Reviewed by Andy Estes.

        Use of 'sesssionStorage' is governed by SecurityOrigin with third party access
        set to 'ShouldAllowFromThirdParty::AlwaysAllowFromThirdParty'. We should not
        reject local files for this combination of arguments.

        Test: storage/domstorage/sessionstorage/blocked-file-access.html

        * page/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::canAccessStorage): For the case of sessionStorage,
        allow local file access.

2016-03-18  Jer Noble  <jer.noble@apple.com>

        CachedResource::MediaResource types shouldn't be blocked due to mixed-content.
        https://bugs.webkit.org/show_bug.cgi?id=155588
        <rdar://problem/25177795>

        Reviewed by Daniel Bates.

        The Mixed Content spec specifically allows (with certain restrictions) loads of <image>,
        <video>, and <audio> resources from mixed-content origins, albeit with warnings.

        No new tests, fixes existing test: http/tests/security/mixedContent/insecure-audio-video-in-main-frame.html

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::contentTypeFromResourceType):

2016-03-18  Nan Wang  <n_wang@apple.com>

        AX: AXARIACurrent exposed but not displayed in Accessibility Inspector
        https://bugs.webkit.org/show_bug.cgi?id=155600

        Reviewed by Chris Fleizach.

        AXARIACurrent attribute was added to a temporary array that was never returned.

        Test: accessibility/mac/aria-current-attribute-exposed.html

        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper accessibilityAttributeNames]):

2016-03-18  Nan Wang  <n_wang@apple.com>

        AX: Typing broken on form input field while using VoiceOver
        https://bugs.webkit.org/show_bug.cgi?id=155613

        Reviewed by Chris Fleizach.

        The div element inside the INPUT element gives a collapsed TextMarkerRange which then creates
        a collapsed Range. Fixed it by using the parent node to create the Range when the div node has
        no children.

        Test: accessibility/mac/text-marker-range-for-node-without-children.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::setRangeStartOrEndWithCharacterOffset):

2016-03-18  Chris Fleizach  <cfleizach@apple.com>

        AX: Implement AutoFill Available attribute for a text field
        https://bugs.webkit.org/show_bug.cgi?id=155567

        Reviewed by Darin Adler.

        This file was left out of original commit accidentally.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::addTextFieldChildren):

2016-03-18  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] Unreviewed speculative buildfix after r197956. Just for fun.

        * PlatformMac.cmake:

2016-03-18  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] Unreviewed speculative buildfix after r197628. Just for fun.

        * PlatformMac.cmake:

2016-03-18  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] One more attempt to try to fix the build after r197633.

        * PlatformMac.cmake:

2016-03-18  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] One more attempt to try to fix the build after r197633.

        * PlatformMac.cmake:

2016-03-18  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] One more attempt to try to fix the build after r197633.

        * PlatformMac.cmake: Revert r198398, which was incorrect.

2016-03-18  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] Last attempt to try to fix the build after r197633.

        * PlatformMac.cmake:

2016-03-18  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Rename GridSpan properties
        https://bugs.webkit.org/show_bug.cgi?id=155636

        Reviewed by Sergio Villar Senin.

        GridSpan was using old names initialResolvedPosition and
        finalResolvedPosition.
        This patch rename them to startLine and endLine.

        Some reasons for this refactoring:
        - "position" is a vague term not defined in the spec.
        - GridSpan is currently storing grid lines. A grid "line" is defined
          in the spec: https://drafts.csswg.org/css-grid/#grid-line-concept
        - The spec uses the concepts "start" and "end" lines too.

        No new tests, no change of behavior.

        * css/CSSGridTemplateAreasValue.cpp:
        (WebCore::stringForPosition):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateAreasRow):
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::createImplicitNamedGridLinesFromGridArea):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
        (WebCore::RenderGrid::insertItemIntoGrid):
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        (WebCore::RenderGrid::gridAreaBreadthForChildIncludingAlignmentOffsets):
        (WebCore::RenderGrid::columnAxisOffsetForChild):
        (WebCore::RenderGrid::rowAxisOffsetForChild):
        * rendering/style/GridArea.h:
        (WebCore::GridSpan::untranslatedDefiniteGridSpan):
        (WebCore::GridSpan::translatedDefiniteGridSpan):
        (WebCore::GridSpan::operator==):
        (WebCore::GridSpan::integerSpan):
        (WebCore::GridSpan::untranslatedStartLine):
        (WebCore::GridSpan::untranslatedEndLine):
        (WebCore::GridSpan::startLine):
        (WebCore::GridSpan::endLine):
        (WebCore::GridSpan::begin):
        (WebCore::GridSpan::end):
        (WebCore::GridSpan::translate):
        (WebCore::GridSpan::GridSpan):
        (WebCore::GridSpan::untranslatedResolvedInitialPosition): Deleted.
        (WebCore::GridSpan::untranslatedResolvedFinalPosition): Deleted.
        (WebCore::GridSpan::resolvedInitialPosition): Deleted.
        (WebCore::GridSpan::resolvedFinalPosition): Deleted.
        * rendering/style/GridPositionsResolver.cpp:
        (WebCore::definiteGridSpanWithNamedLineSpanAgainstOpposite):
        (WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveGridPositionAgainstOppositePosition):
        (WebCore::GridPositionsResolver::resolveGridPositionsFromStyle):

2016-03-18  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] One more unreviewed speculative buildfix after r197633. Just for fun.

        * PlatformMac.cmake:

2016-03-18  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] Unreviewed speculative buildfix after r197633. Just for fun.

        * PlatformMac.cmake:

2016-03-18  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        crossorigin element resource loading should check HTTP redirection
        https://bugs.webkit.org/show_bug.cgi?id=130578

        Reviewed by Daniel Bates and Brent Fulgham.

        Moved part of DocumentThreadableLoader redirection cross origin control code
        into functions in CrossOriginAccessControl.cpp. Added cross origin control for
        redirections in SubResourceLoader when policy is set to PotentiallyCrossOriginEnabled 
        using CrossOriginAccessControl.cpp new functions. Added a new test that checks that 
        cross-origin redirections are checked against CORS.

        Test: http/tests/security/shape-image-cors-redirect.html

        * loader/CrossOriginAccessControl.cpp:
        (WebCore::isValidCrossOriginRedirectionURL): Returns true if the redirected URL is a valid URL for cross-origin requests.
        (WebCore::cleanRedirectedRequestForAccessControl): Removes all headers added by the network backend that may cause the response CORS validation to fail.
        * loader/CrossOriginAccessControl.h: Added above function prototypes.
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::redirectReceived): Used new CORS redirection methods of CrossOriginAccessControl.cpp.
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::init): Initialize the SecurityOrigin to be used for loading the resource.
        (WebCore::SubresourceLoader::willSendRequest): Added cross-origin redirection response check.
        (WebCore::SubresourceLoader::checkCrossOriginAccessControl): Checks CORS and update request if needed. Returns true if control checks passed.
        * loader/SubresourceLoader.h: Added checkCrossOriginAccessControl declaration and m_origin declaration.

2016-03-18  Darin Adler  <darin@apple.com>

        Disable Caches in Safari's Develop menu does not disable caches.
        https://bugs.webkit.org/show_bug.cgi?id=64483

        Reviewed by Antti Koivisto.

        Add a new setting, ResourceCachingDisabled, for use in future versions of Safari.

        * history/PageCache.cpp:
        (WebCore::canCachePage): Check resourceCachingDisabled and return false.
        (WebCore::PageCache::take): Check resourceCachingDisabled, and return null.
        (WebCore::PageCache::get): Ditto.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::subresourceCachePolicy): Check resourceCachingDisabled, and
        request a reload.
        (WebCore::FrameLoader::addExtraFieldsToRequest): Check resourceCachingDisabled, and
        set the cache policy to trigger a reload.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::cachePolicy): Check resourceCachingDisabled, and
        request a reload.

        * page/Settings.in: Added resourceCachingDisabled.

2016-03-18  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] Unreviewed speculative buildfix. Just for fun.

        * loader/EmptyClients.cpp:

2016-03-17  Antti Koivisto  <antti@apple.com>

        Data URL DecodeTask may get deleted outside main thread
        https://bugs.webkit.org/show_bug.cgi?id=155584
        rdar://problem/24492104

        Reviewed by Darin Adler.

        This is unsafe as it owns strings and other types that are only safe to delete in the main thread.

        There is a race between deref in dispatch() and deref in timerFired(). If the timer fires before dispatch()
        exits the implicit deref will trigger deletion of DecodingResultDispatcher in the dispatching thread.

        (WebCore::DataURLDecoder::DecodingResultDispatcher::timerFired):

            Fix by clearing m_decodeTask when the timer fires.

2016-03-17  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r195661): [GTK] very slow scrolling
        https://bugs.webkit.org/show_bug.cgi?id=155334

        Reviewed by Michael Catanzaro.

        We need to also restore the PerAxisData visible length when it's
        reset because of a non animated scroll. To prevent making the same
        mistake in the future, the current position and visible lengths
        members are now required to construct PerAxisData. This also
        simplifies the code and ensures that when the ScrollAnimatorSmooth
        is created, it's updated to the current position.

        * platform/ScrollAnimationSmooth.cpp:
        (WebCore::ScrollAnimationSmooth::ScrollAnimationSmooth):
        Initialize PerAxisData members.
        (WebCore::ScrollAnimationSmooth::setCurrentPosition): Pass the
        current position and visible length as parameters to the
        PerAxisData constructor.
        (WebCore::ScrollAnimationSmooth::animateScroll): Ditto.
        * platform/ScrollAnimationSmooth.h: Add a PerAxisData constructor
        that receives current position and visible length and disallow to
        use the default constructor.
        * platform/ScrollAnimatorSmooth.cpp:
        (WebCore::ScrollAnimatorSmooth::ScrollAnimatorSmooth): Pass the
        current position to the ScrollAnimationSmooth constructor.
        * platform/gtk/ScrollAnimatorGtk.cpp:
        (WebCore::ScrollAnimatorGtk::ensureSmoothScrollingAnimation): Ditto.

2016-03-17  Chris Fleizach  <cfleizach@apple.com>

        AX: WEB: VoiceOver does not announce some WAI-ARIA document structures
        https://bugs.webkit.org/show_bug.cgi?id=155603
        <rdar://problem/25227385>

        Reviewed by Darin Adler.

        Expose more ARIA landmark type roles on iOS for accessibility.

        Updated test: accessibility/ios-simulator/landmark-type.html

        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper _accessibilityIsLandmarkRole:]):
        (-[WebAccessibilityObjectWrapper accessibilityLabel]):
        * platform/LocalizedStrings.cpp:
        (WebCore::searchMenuClearRecentSearchesText):
        (WebCore::AXWebAreaText):
        (WebCore::AXListItemActionVerb):
        (WebCore::AXAutoFillCredentialsLabel):
        * platform/LocalizedStrings.h:

2016-03-17  Daniel Bates  <dabates@apple.com>

        Cleanup: Remove the need to pass reporting status to ContentSecurityPolicy functions
        https://bugs.webkit.org/show_bug.cgi?id=155623

        Reviewed by Andy Estes and Alex Christensen.

        ScriptController::initScript() is the only function that passes ContentSecurityPolicy::ReportingStatus::SuppressReport
        following the removal of the SecurityPolicy script interface in <http://trac.webkit.org/changeset/197142>. It
        passes this reporting status to prevent sending a violation report when determining whether the CSP policy allows
        use of the JavaScript eval()/operator eval so that it enable or disable this capability as appropriate. We
        should teach ScriptController::initScript() to delegate the responsibility of enabling/disabling this capability
        to the ContentSecurityPolicy. Then we can remove the need to expose ContentSecurityPolicy::ReportingStatus as
        part of the ContentSecurityPolicy interface.

        No functionality changed. So, no new tests.

        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::createWindowShell): Return a reference to a JSDOMWindowShell object
        instead of a pointer as the pointer is always non-null.
        (WebCore::ScriptController::initScript): Updated as needed now that ScriptController::createWindowShell()
        returns a reference. Moved logic to enable/disable JavaScript eval() and operator eval from here into
        ContentSecurityPolicy::didCreateWindowShell() and make use of this member function.
        * bindings/js/ScriptController.h:
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::didCreateWindowShell): Added. Moved logic from to enable/disable JavaScript
        eval() and operator eval from ScriptController::initScript() to here.
        (WebCore::ContentSecurityPolicy::didReceiveHeader): Substitute ContentSecurityPolicyDirectiveList::ReportingStatus::SuppressReport
        for ContentSecurityPolicy::ReportingStatus::SuppressReport as the enum has moved from class ContentSecurityPolicy
        to ContentSecurityPolicyDirectiveList. Fix minor code style nit; substitute nullptr for 0 in the first argument
        to ContentSecurityPolicyDirectiveList::allowEval().
        (WebCore::isAllowedByAllWithFrame): Substitute ContentSecurityPolicyDirectiveList::ReportingStatus::SuppressReport
        for ContentSecurityPolicy::ReportingStatus::SuppressReport as the enum has moved from class ContentSecurityPolicy
        to ContentSecurityPolicyDirectiveList.
        (WebCore::isAllowedByAll): Substitute ContentSecurityPolicyDirectiveList::ReportingStatus::SuppressReport
        for ContentSecurityPolicy::ReportingStatus::SuppressReport as the enum has moved from class ContentSecurityPolicy
        to ContentSecurityPolicyDirectiveList. Also make this function static so that it has internal linkage.
        (WebCore::isAllowedByAllWithState): Ditto.
        (WebCore::isAllowedByAllWithContext): Ditto.
        (WebCore::isAllowedByAllWithHashFromContent): Ditto.
        (WebCore::isAllowedByAllWithURL): Ditto.
        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs): Remove argument reportingStatus and always pass
        ContentSecurityPolicyDirectiveList::ReportingStatus::SendReport to the directive list member function. In a
        subsequent patch we will remove the need to pass the reporting status to the directive list member function.
        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers): Ditto.
        (WebCore::ContentSecurityPolicy::allowInlineScript): Ditto.
        (WebCore::ContentSecurityPolicy::allowInlineStyle): Ditto.
        (WebCore::ContentSecurityPolicy::allowEval): Ditto.
        (WebCore::ContentSecurityPolicy::allowFrameAncestors): Ditto.
        (WebCore::ContentSecurityPolicy::allowPluginType): Ditto.
        (WebCore::ContentSecurityPolicy::allowScriptFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowObjectFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowChildFrameFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowChildContextFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowImageFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowStyleFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowFontFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowMediaFromSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowConnectToSource): Ditto.
        (WebCore::ContentSecurityPolicy::allowFormAction): Ditto.
        (WebCore::ContentSecurityPolicy::allowBaseURI): Ditto.
        (WebCore::ContentSecurityPolicy::evalDisabledErrorMessage): Deleted.
        * page/csp/ContentSecurityPolicy.h:
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::allowJavaScriptURLs): Substitute ReportingStatus for
        ContentSecurityPolicy::ReportingStatus as the enum has moved from class ContentSecurityPolicy to this class.
        (WebCore::ContentSecurityPolicyDirectiveList::allowInlineEventHandlers): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowInlineScript): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowInlineStyle): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowEval): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowPluginType): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowScriptFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowObjectFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowChildContextFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowChildFrameFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowImageFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowStyleFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowFontFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowMediaFromSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowConnectToSource): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowFormAction): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowBaseURI): Ditto.
        (WebCore::ContentSecurityPolicyDirectiveList::allowFrameAncestors): Ditto.
        * page/csp/ContentSecurityPolicyDirectiveList.h:

2016-03-17  Brent Fulgham  <bfulgham@apple.com>

        [XSS Auditor] Off by one in XSSAuditor::canonicalizedSnippetForJavaScript()
        https://bugs.webkit.org/show_bug.cgi?id=155624
        <rdar://problem/25219962>

        Unreviewed merge from Blink (patch by Tom Sepez <tsepez@chromium.org>):
        <https://src.chromium.org/viewvc/blink?revision=201803&view=revision>

        Test: http/tests/security/xssAuditor/script-tag-with-trailing-script-and-urlencode.html

        * html/parser/XSSAuditor.cpp:
        (WebCore::XSSAuditor::canonicalizedSnippetForJavaScript): Correct off-by-one error.

2016-03-17  Zalan Bujtas  <zalan@apple.com>

        Images in feed on ebay.com jiggle when one is hovered
        https://bugs.webkit.org/show_bug.cgi?id=155608
        <rdar://problem/25160681>

        The content offset in compositing layer = subpixel gap between the graphics layer and the layer bounds + layer bounds top left.

        Reviewed by Simon Fraser.

        Test: compositing/hidpi-viewport-clipping-on-composited-content.html

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateGeometry):
        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
        * rendering/RenderLayerBacking.h:

2016-03-17  Zalan Bujtas  <zalan@apple.com>

        Don't initiate a style recall while drawing text 
        https://bugs.webkit.org/show_bug.cgi?id=155618

        Reviewed by Simon Fraser.

        This patch ensures that we don't initiate a style recalc while in the middle of text drawing.

        Test: fast/canvas/crash-while-resizing-canvas.html

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::drawTextInternal):

2016-03-17  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r198335.
        https://bugs.webkit.org/show_bug.cgi?id=155617

        This change caused existing LayoutTests to crash
        intermittently (Requested by ryan|afk on #webkit).

        Reverted changeset:

        "DataURLDecoder::DecodingResultDispatcher may get deleted
        outside main thread"
        https://bugs.webkit.org/show_bug.cgi?id=155584
        http://trac.webkit.org/changeset/198335

2016-03-17  Eric Carlson  <eric.carlson@apple.com>

        Improve some metadata tests
        https://bugs.webkit.org/show_bug.cgi?id=155616

        Reviewed by Saam Barati.

        * html/track/DataCue.cpp:
        (WebCore::DataCue::DataCue):
        (WebCore::DataCue::setData):

2016-03-17  Myles C. Maxfield  <mmaxfield@apple.com>

        [RTL Scrollbars] Position: absolute divs are covered by vertical scrollbar
        https://bugs.webkit.org/show_bug.cgi?id=155531

        Reviewed by Darin Adler.

        This patch updates ScrollView::documentScrollPositionRelativeToViewOrigin(), which is
        a helper function primarily used by WebCore::ScrollView::viewToContents() and
        WebCore::ScrollView::contentsToView().

        Tests: fast/scrolling/rtl-scrollbars-elementFromPoint-static.html
               fast/scrolling/rtl-scrollbars-elementFromPoint.html
               fast/scrolling/rtl-scrollbars-iframe-offset.html
               fast/scrolling/rtl-scrollbars-iframe-position-absolute.html
               fast/scrolling/rtl-scrollbars-iframe-scrolled.html
               fast/scrolling/rtl-scrollbars-iframe.html
               fast/scrolling/rtl-scrollbars-overflow-elementFromPoint.html
               fast/scrolling/rtl-scrollbars-overflow-position-absolute.html
               fast/scrolling/rtl-scrollbars-overflow-text-selection-scrolled.html
               fast/scrolling/rtl-scrollbars-position-absolute.html
               fast/scrolling/rtl-scrollbars-position-fixed.html
               fast/scrolling/rtl-scrollbars-text-selection-scrolled.html
               fast/scrolling/rtl-scrollbars-text-selection.html

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::documentScrollPositionRelativeToViewOrigin):

2016-03-17  Filip Pizlo  <fpizlo@apple.com>

        Replace all of the various non-working and non-compiling sampling profiler hacks with a single super hack
        https://bugs.webkit.org/show_bug.cgi?id=155561

        Reviewed by Saam Barati.

        No new tests because no new behavior.

        * platform/audio/ios/MediaSessionManagerIOS.mm:
        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:

2016-03-17  Brent Fulgham  <bfulgham@apple.com>

        Some media tests are flaky.
        https://bugs.webkit.org/show_bug.cgi?id=155614

        Reviewed by Eric Carlson.

        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::~TextTrack):

2016-03-17  Brady Eidson  <beidson@apple.com>

        Don't try to restore deleted MemoryIndexes if their owning object store is not restored.
        https://bugs.webkit.org/show_bug.cgi?id=155068

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/deleteindex-4-private.html

        * Modules/indexeddb/server/MemoryBackingStoreTransaction.cpp:
        (WebCore::IDBServer::MemoryBackingStoreTransaction::indexDeleted):

2016-03-17  Doug Russell  <d_russell@apple.com>

        AX: attributes to retrieve focusable and editable ancestors
        https://bugs.webkit.org/show_bug.cgi?id=155554

        Reviewed by Chris Fleizach.

        Add attributes to help give context to focus changes:
        AXFocusableAncestor - nearest accessibility ancestor that returns true for
        canSetFocusAttribute().
        AXEditableAncestor - nearest accessibility ancestor that returns true for
        isTextControl().
        AXHighestEditableAncestor - highest element in accessibility that returns true
        for isTextControl().

        Test: accessibility/mac/ancestor-attributes.html

        * accessibility/AccessibilityNodeObject.cpp:
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::focusableAncestor):
        (WebCore::AccessibilityObject::editableAncestor):
        (WebCore::AccessibilityObject::highestEditableAncestor):
        * accessibility/AccessibilityObject.h:
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper accessibilityAttributeNames]):
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):

2016-03-17  Sam Weinig  <sam@webkit.org>

        Implement document.queryCommandSupported("copy")
        https://bugs.webkit.org/show_bug.cgi?id=155548
        <rdar://problem/25195295>

        Reviewed by Enrica Casucci.

        - document.queryCommandSupported("copy") and document.queryCommandSupported("cut") need
          to return true if the ClipboardAccessPolicy is either Allow or RequiresUserGesture.
          But, document.queryCommandEnabled("copy") and document.queryCommandEnabled("cut")
          should still return false when there is no user gesture. I also had to maintain a weird
          quirk that copy and cut should be allowed to execute, and thus fire the oncopy and oncut
          events, even when disabled, if coming from a "MenuOrKeyBinding" source. To do this, I
          upgraded the allowExecutionWhenDisabled bit to a function taking a source, and return true
          only when the correct source is specified.

        * editing/Editor.h:
        * editing/EditorCommand.cpp:
        (WebCore::defaultValueForSupportedCopyCut):
        (WebCore::allowCopyCutFromDOM):
        (WebCore::enabledCopy):
        (WebCore::enabledCut):
        (WebCore::allowExecutionWhenDisabled):
        (WebCore::doNotAllowExecutionWhenDisabled):
        (WebCore::allowExecutionWhenDisabledCopyCut):
        (WebCore::Editor::Command::execute):
        (WebCore::Editor::Command::allowExecutionWhenDisabled):

2016-03-17  Antti Koivisto  <antti@apple.com>

        DataURLDecoder::DecodingResultDispatcher may get deleted outside main thread
        https://bugs.webkit.org/show_bug.cgi?id=155584
        rdar://problem/24492104

        Reviewed by Chris Dumez.

        This is unsafe as it owns strings and other types that are only safe to delete in the main thread.

        * platform/network/DataURLDecoder.cpp:
        (WebCore::DataURLDecoder::DecodingResultDispatcher::dispatch):

            The problem is that this was a refcounted type. This created a race. If the timer fired before dispatch()
            was exited the implicit deref here would trigger the deletion in the dispatching thread.

            Fix by getting rid of the unnecessary refcounting. Timer firing will now delete the instance explicitly.

        (WebCore::DataURLDecoder::DecodingResultDispatcher::startTimer):
        (WebCore::DataURLDecoder::DecodingResultDispatcher::timerFired):

2016-03-17  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r198201.
        https://bugs.webkit.org/show_bug.cgi?id=155585

        That was not the proper solution (Requested by KaL on
        #webkit).

        Reverted changeset:

        "REGRESSION (r197724): [GTK] Web Inspector: Images being
        blocked by CSP 2.0"
        https://bugs.webkit.org/show_bug.cgi?id=155432
        http://trac.webkit.org/changeset/198201

2016-03-16  Chris Fleizach  <cfleizach@apple.com>

        AX: Implement AutoFill Available attribute for a text field
        https://bugs.webkit.org/show_bug.cgi?id=155567

        Reviewed by Darin Adler.

        Expose the auto fill buttons to the AX hierarchy.
        Add an attribute for the textfield to inform when the auto fill button is available.

        Test: accessibility/auto-fill-types.html

        * English.lproj/Localizable.strings:
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::element):
        (WebCore::AccessibilityObject::isValueAutofillAvailable):
        (WebCore::AccessibilityObject::isValueAutofilled):
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::passwordFieldValue):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::addTextFieldChildren):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):
        * html/TextFieldInputType.cpp:
        (WebCore::limitLength):
        (WebCore::autoFillButtonTypeToAccessibilityLabel):
        (WebCore::autoFillButtonTypeToAutoFillButtonPseudoClassName):
        (WebCore::TextFieldInputType::createAutoFillButton):
        (WebCore::TextFieldInputType::updateAutoFillButton):
        * platform/LocalizedStrings.cpp:
        (WebCore::AXListItemActionVerb):
        (WebCore::AXAutoFillCredentialsLabel):
        (WebCore::AXAutoFillContactsLabel):
        (WebCore::AXARIAContentGroupText):
        * platform/LocalizedStrings.h:

2016-03-17  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] Unreviewed speculative buildfix after r198179. Just for fun.

        * PlatformMac.cmake:

2016-03-17  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] response-consume.html is crashing on Mac WK1 Debug builds
        https://bugs.webkit.org/show_bug.cgi?id=155490

        Reviewed by Darin Adler.

        Covered by existing tests.

        Ensured to lock state before calling JSC:JSONParse.
        Adding fulfillPromiseWithJSON routine to handle it.
        Applied it to FetchBody.

        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::json):
        (WebCore::FetchBody::loadedAsText):
        (WebCore::FetchBody::resolveAsJSON): Deleted.
        * Modules/fetch/FetchBody.h:
        * Modules/fetch/FetchBodyOwner.cpp:
        (WebCore::FetchBodyOwner::loadedBlobAsText):
        * bindings/js/JSDOMPromise.cpp:
        (WebCore::parseAsJSON):
        (WebCore::fulfillPromiseWithJSON):
        * bindings/js/JSDOMPromise.h:

2016-03-17  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Update RTCIceCandidate
        https://bugs.webkit.org/show_bug.cgi?id=155535

        Reviewed by Eric Carlson.

        Update the RTCIceCandidate constructor procedure to match the WebRTC 1.0 specification [1].
        In short: The "candidate" init dictionary member is required. At least one of the dictionary
        members "sdpMid" and "sdpMLine" needs to be present; the corresponding attribute of the
        other, is initialized to null.

        [1] https://w3c.github.io/webrtc-pc/archives/20160215/webrtc.html

        Tests: Updated fast/mediastream/RTCIceCandidate.htm

        * Modules/mediastream/RTCIceCandidate.cpp:
        (WebCore::RTCIceCandidate::create):
        (WebCore::RTCIceCandidate::RTCIceCandidate):
        * Modules/mediastream/RTCIceCandidate.h:
        (WebCore::RTCIceCandidate::sdpMLineIndex):
        (WebCore::RTCIceCandidate::setSdpMLineIndex):
        * Modules/mediastream/RTCIceCandidate.idl:
        * bindings/js/JSRTCIceCandidateCustom.cpp:
        (WebCore::JSRTCIceCandidate::sdpMid):
        (WebCore::JSRTCIceCandidate::sdpMLineIndex):

2016-03-16  Nikos Andronikos  <nikos.andronikos-webkit@cisra.canon.com.au>

        SVG tear offs should return a const reference if possible
        https://bugs.webkit.org/show_bug.cgi?id=153214

        Reviewed by Alex Christensen.

        A smaller change than expected because the returned reference is being copied into a value in additional locations that baseVal and animVal are used.

        No new tests as there is no change in behaviour.

        * svg/properties/SVGAnimatedEnumerationPropertyTearOff.h:
        * svg/properties/SVGAnimatedStaticPropertyTearOff.h:
        (WebCore::SVGAnimatedStaticPropertyTearOff::baseVal):
        (WebCore::SVGAnimatedStaticPropertyTearOff::animVal):

2016-03-16  Chris Dumez  <cdumez@apple.com>

        Unreviewed, partial roll out of r197254.
        <rdar://problem/25078552>

        It caused a ~1.1% PLT regression on iOS.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad): Deleted.

2016-03-16  Enrica Casucci  <enrica@apple.com>

        Recognize mailto and tel url as data detector links.
        https://bugs.webkit.org/show_bug.cgi?id=155569
        rdar://problem/24836185

        Reviewed by Sam Weinig.

        When we check if the element is a data detector link,
        we should return true also for URLs with mailto: and tel: scheme.

        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::isDataDetectorLink):

2016-03-16  Zalan Bujtas  <zalan@apple.com>

        Subpixel rendering: Directly composited image layers need pixelsnapping.
        https://bugs.webkit.org/show_bug.cgi?id=155558

        Reviewed by Simon Fraser.

        In order to match non-composited image size/position, we need to pixelsnap both the contents and the clipping
        layer bounds for directly composited images.

        Test: fast/images/hidpi-directly-composited-image-on-subpixel-position.html

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::resetContentsRect):
        (WebCore::RenderLayerBacking::updateChildClippingStrategy):
        (WebCore::RenderLayerBacking::updateImageContents):

2016-03-16  Beth Dakin  <bdakin@apple.com>

        Provide NSSpellChecker spellChecking methods with the current insertion point
        https://bugs.webkit.org/show_bug.cgi?id=155532
        -and corresponding-
        rdar://problem/24066952

        Reviewed by Simon Fraser.

        Pass the Frame’s selection to a handful of spelling checking methods that 
        call into WebKit/WebKit2 to ultimately call into NSSpellChecker.
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::hasMisspelling):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (AXAttributeStringSetSpelling):
        * editing/AlternativeTextController.cpp:
        (WebCore::AlternativeTextController::timerFired):
        * editing/Editor.cpp:
        (WebCore::Editor::guessesForMisspelledWord):
        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
        * editing/SpellChecker.cpp:
        (WebCore::SpellChecker::invokeRequest):
        (WebCore::SpellChecker::enqueueRequest):
        * editing/TextCheckingHelper.cpp:
        (WebCore::TextCheckingHelper::findFirstMisspellingOrBadGrammar):
        (WebCore::TextCheckingHelper::guessesForMisspelledOrUngrammaticalRange):
        (WebCore::TextCheckingHelper::unifiedTextCheckerEnabled):
        (WebCore::checkTextOfParagraph):
        * editing/TextCheckingHelper.h:
        * loader/EmptyClients.cpp:
        (WebCore::EmptyFrameLoaderClient::createNetworkingContext):
        (WebCore::EmptyTextCheckerClient::requestCheckingOfString):
        * loader/EmptyClients.h:
        * platform/text/TextCheckerClient.h:
        (WebCore::TextCheckerClient::~TextCheckerClient):

        The key needed to include the insertion point.
        * platform/spi/mac/NSSpellCheckerSPI.h:

2016-03-16  Alex Christensen  <achristensen@webkit.org>

        Fix assertion failure on drive.google.com after r196052
        https://bugs.webkit.org/show_bug.cgi?id=155562

        Reviewed by Jer Noble.

        * rendering/RenderGeometryMap.cpp:
        (WebCore::RenderGeometryMap::mapToContainer):
        Change float equality check to areEssentiallyEqual.
        This assertion was failing because rendererMappedResult was (944.335693, 232.047409)
        but result was (944.335693, 232.047394).  They differ by (0, 0.000015).

2016-03-16  Nan Wang  <n_wang@apple.com>

        AX: Expose aria-current status to children
        https://bugs.webkit.org/show_bug.cgi?id=155469

        Reviewed by Chris Fleizach.

        Added aria-current to the global ARIA attributes list.

        Test: accessibility/aria-current-global-attribute.html

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::supportsARIAAttributes):

2016-03-16  Tim Horton  <timothy_horton@apple.com>

        [mac] Printing test snapshots are upside-down after r198242
        https://bugs.webkit.org/show_bug.cgi?id=155543

        Reviewed by Simon Fraser.

        * page/PrintContext.cpp:
        (WebCore::PrintContext::spoolAllPagesWithBoundaries):
        Stop PLATFORM(COCOA)-conditionally flipping here. Just paint.
        This function is only used by the test runners so this doesn't have a
        huge impact on anything else.

2016-03-16  Daniel Bates  <dabates@apple.com>

        Update WebKit Feature Status page to include the status of Content Security Policy Level 2 and Level 3

        * features.json:

2016-03-16  Daniel Bates  <dabates@apple.com>

        <video> and <audio> elements do not obey Content Security Policy on redirect
        https://bugs.webkit.org/show_bug.cgi?id=155509
        <rdar://problem/10234844>

        Reviewed by Alex Christensen.

        Fixes an issue where the Content Security Policy of the page was not enforced
        on redirects when loading a media subresource via an HTML video or HTML audio
        element.

        Tests: http/tests/security/contentSecurityPolicy/audio-redirect-allowed.html
               http/tests/security/contentSecurityPolicy/audio-redirect-blocked.html
               http/tests/security/contentSecurityPolicy/font-redirect-allowed.html
               http/tests/security/contentSecurityPolicy/font-redirect-blocked.html
               http/tests/security/contentSecurityPolicy/image-redirect-allowed.html
               http/tests/security/contentSecurityPolicy/image-redirect-blocked.html
               http/tests/security/contentSecurityPolicy/script-redirect-allowed.html
               http/tests/security/contentSecurityPolicy/script-redirect-blocked.html
               http/tests/security/contentSecurityPolicy/stylesheet-redirect-allowed.html
               http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked.html
               http/tests/security/contentSecurityPolicy/svg-font-redirect-allowed.html
               http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked.html
               http/tests/security/contentSecurityPolicy/svg-image-redirect-allowed.html
               http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked.html
               http/tests/security/contentSecurityPolicy/track-redirect-allowed.html
               http/tests/security/contentSecurityPolicy/track-redirect-blocked.html
               http/tests/security/contentSecurityPolicy/video-redirect-allowed.html
               http/tests/security/contentSecurityPolicy/video-redirect-blocked.html
               http/tests/security/contentSecurityPolicy/xsl-redirect-allowed.html
               http/tests/security/contentSecurityPolicy/xsl-redirect-blocked.html

        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::cachedResourceContent): Treat media resources as raw resources just as we do currently.
        (WebCore::InspectorPageAgent::cachedResourceType): Ditto.
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::requestResource): Modified to use CachedResourceLoader::requestMedia() instead
        of CachedResourceLoader::requestRawResource() so that we can differentiate between a media resource and a raw
        resource in CachedResourceLoader. Added FIXME comment to skip checking the Content Security Policy for loads
        initiated by an element in a user agent shadow tree. See <https://bugs.webkit.org/show_bug.cgi?id=155505> for
        more details.
        * loader/ResourceLoadInfo.cpp:
        (WebCore::toResourceType): Treat media resources as raw resources just as we do currently. Also, add cases for
        CachedResource::LinkPrefetch and CachedResource::LinkSubresource (when ENABLE(LINK_PREFETCH) is enabled) and
        remove the default statement to force a compile-time error when a new CachedResource enumerator is added and
        the switch block in this function is not updated.
        * loader/SubresourceLoader.cpp:
        (WebCore::logResourceLoaded): Ditto.
        * loader/cache/CachedRawResource.cpp:
        (WebCore::CachedRawResource::CachedRawResource): Substitute CachedResource::isMainOrMediaOrRawResource() for
        CachedResource::isMainOrRawResource() as the latter was renamed to the former.
        * loader/cache/CachedRawResource.h:
        (isType): Ditto.
        * loader/cache/CachedResource.cpp:
        (WebCore::defaultPriorityForResourceType): Use priority ResourceLoadPriority::Medium for media resources just as
        we do currently.
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::isMainOrMediaOrRawResource): Formerly named isMainOrRawResource. Returns true if the type
        of this resource is a main resource, media resource, or raw resource.
        (WebCore::CachedResource::isMainOrRawResource): Deleted.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::createResource): Treat media resources as raw resources just as we do currently.
        (WebCore::CachedResourceLoader::requestMedia): Added.
        (WebCore::contentTypeFromResourceType): Consider media resources as MixedContentChecker::ContentType::Active
        just as we do currently.
        (WebCore::CachedResourceLoader::checkInsecureContent): Apply the mixed content policy to media resources
        just as we do currently.
        (WebCore::CachedResourceLoader::canRequest): Apply the Same Origin Policy to media resources just as we
        do currently. Query the Content Security Policy of the page to determine if the media resource can be
        requested.
        (WebCore::CachedResourceLoader::determineRevalidationPolicy): Substitute CachedResource::isMainOrMediaOrRawResource()
        for CachedResource::isMainOrRawResource() as the latter was renamed to the former.
        * loader/cache/CachedResourceLoader.h:
        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::startLoading): Modified to use CachedResourceLoader::requestMedia() instead
        of CachedResourceLoader::requestRawResource() so that we can differentiate between a media resource and a raw
        resource in CachedResourceLoader. Added FIXME comment to skip checking the Content Security Policy for loads
        initiated by an element in a user agent shadow tree. See <https://bugs.webkit.org/show_bug.cgi?id=155505> for
        more details. Additionally, simplified code that determined whether to request the media resource or error out
        by coalescing two conditional expressions into one conditional on whether we have a loader and substituted
        nullptr for 0.

2016-03-16  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r198235, r198240, r198241, and
        r198252.

        Causing crashes on ARM

        Reverted changesets:

        "Remove compile time define for SEPARATED_HEAP"
        https://bugs.webkit.org/show_bug.cgi?id=155508
        http://trac.webkit.org/changeset/198235

        "Gardening: build fix after r198235."
        http://trac.webkit.org/changeset/198240

        "Build fix."
        http://trac.webkit.org/changeset/198241

        "Rename performJITMemcpy to something more inline with our
        normal webkit function names"
        https://bugs.webkit.org/show_bug.cgi?id=155525
        http://trac.webkit.org/changeset/198252

2016-03-16  Jiewen Tan  <jiewen_tan@apple.com>

        URL Parsing should signal failure for illegal IDN
        https://bugs.webkit.org/show_bug.cgi?id=154945
        <rdar://problem/8014795>

        Reviewed by Brent Fulgham.

        WebCore::URL will now invalidate URLs with illegal IDN. And functions inside WebCoreNSURLExtras.h
        that deal with IDN mapping will now return nil to signal error.

        Test: fast/url/invalid-idn.html

        * platform/URL.cpp:
        (WebCore::isSchemeFirstChar):
        (WebCore::URL::init):
        (WebCore::appendEncodedHostname):
        (WebCore::encodeHostnames):
        (WebCore::encodeRelativeString):
        * platform/mac/WebCoreNSURLExtras.h:
        * platform/mac/WebCoreNSURLExtras.mm:
        (WebCore::mapHostNameWithRange):
        (WebCore::hostNameNeedsDecodingWithRange):
        (WebCore::hostNameNeedsEncodingWithRange):
        (WebCore::decodeHostNameWithRange):
        (WebCore::encodeHostNameWithRange):
        (WebCore::decodeHostName):
        (WebCore::encodeHostName):
        (WebCore::collectRangesThatNeedMapping):
        (WebCore::mapHostNames):
        (WebCore::URLWithData):
        (WebCore::dataWithUserTypedString):
        (WebCore::URLWithUserTypedString):
        (WebCore::URLWithUserTypedStringDeprecated):
        (WebCore::userVisibleString):

2016-03-16  Antti Koivisto  <antti@apple.com>

        Don't invalidate style unnecessarily when setting inline style cssText
        https://bugs.webkit.org/show_bug.cgi?id=155541
        rdar://problem/23318893

        Reviewed by Simon Fraser.

        We currently invalidate style when cssText is set whether the style declaration changed or not.

        Based on a patch by Simon.

        Test: fast/css/style-invalidation-inline-csstext.html

        * css/PropertySetCSSStyleDeclaration.cpp:
        (WebCore::PropertySetCSSStyleDeclaration::cssText):
        (WebCore::PropertySetCSSStyleDeclaration::setCssText):

            Invalidate only if the parsed style changed.

        * css/StyleProperties.cpp:
        (WebCore::MutableStyleProperties::parseDeclaration):

            Compare the original and new style after parsing, return result.

        * css/StyleProperties.h:

2016-03-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r195661): [GTK] very slow scrolling
        https://bugs.webkit.org/show_bug.cgi?id=155334

        Reviewed by Sergio Villar Senin.

        Fix smooth scrolling behaviour change after r195661.

        * platform/ScrollAnimationSmooth.cpp:
        (WebCore::getAnimationParametersForGranularity): Fix a typo,
        animationTime for pixel granularity should be 11 * tickTime.
        (WebCore::ScrollAnimationSmooth::animateScroll): Previous code
        reset all the data except the visibleLenght, so keep it in the
        PerAxisData after the reset.

2016-03-16  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196803.
        https://bugs.webkit.org/show_bug.cgi?id=155534

        Introduced several rendering issues in popular websites
        (Requested by KaL on #webkit).

        Reverted changeset:

        "[GTK] Limit the number of tiles according to the visible
        area"
        https://bugs.webkit.org/show_bug.cgi?id=126122
        http://trac.webkit.org/changeset/196803

2016-03-15  Zalan Bujtas  <zalan@apple.com>

        Remove overflow: -webkit-marquee
        https://bugs.webkit.org/show_bug.cgi?id=155517
        <rdar://problem/25028481>

        Reviewed by Simon Fraser.

        This patch is based on Blink patch from jchaffraix@chromium.org (https://src.chromium.org/viewvc/blink?revision=151756&view=revision)

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Deleted.
        (WebCore::CSSPrimitiveValue::operator EOverflow): Deleted.
        * css/CSSValueKeywords.in:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::adjustRenderStyle):
        * css/html.css:
        (marquee): Deleted.
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::sizesLogicalWidthToFitContent):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollTo):
        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/RenderLayer.h:
        * rendering/RenderMarquee.h:
        * rendering/style/RenderStyleConstants.h:

2016-03-15  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: Expose pointers to SVG elements referenced by aria-labelledby
        https://bugs.webkit.org/show_bug.cgi?id=155481

        Reviewed by Chris Fleizach.

        Expose elements referenced by aria-labelledby via ATK_RELATION_LABELLED_BY.
        Stop calling the supportsARIA* methods before getting the elements referred
        to by the associated ARIA property in the accessible wrapper for ATK and
        the inspector: Getting the elements will be just as fast when there are no
        such elements, and faster when there are.

        Modified the w3c-svg-name-calculation.html test to include AXTitleUIElement
        in its output.

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::supportsARIAAttributes):
        (WebCore::AccessibilityObject::ariaElementsFromAttribute): Added.
        (WebCore::AccessibilityObject::ariaControlsElements): Added.
        (WebCore::AccessibilityObject::ariaDescribedByElements): Added.
        (WebCore::AccessibilityObject::ariaFlowToElements): Added.
        (WebCore::AccessibilityObject::ariaLabelledByElements): Added.
        (WebCore::AccessibilityObject::ariaOwnsElements): Added.
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::ariaOwnsElements): No longer virtual.
        (WebCore::AccessibilityObject::supportsARIAFlowTo): Deleted.
        (WebCore::AccessibilityObject::ariaFlowToElements): No longer virtual.
        (WebCore::AccessibilityObject::supportsARIADescribedBy): Deleted.
        (WebCore::AccessibilityObject::ariaDescribedByElements): No longer virtual.
        (WebCore::AccessibilityObject::supportsARIAControls): Deleted.
        (WebCore::AccessibilityObject::ariaControlsElements): No longer virtual.
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::ariaElementsFromAttribute): Moved to AccessibilityObject.
        (WebCore::AccessibilityRenderObject::supportsARIAFlowTo): Deleted.
        (WebCore::AccessibilityRenderObject::ariaFlowToElements): Moved to AccessibilityObject.
        (WebCore::AccessibilityRenderObject::supportsARIADescribedBy): Deleted.
        (WebCore::AccessibilityRenderObject::ariaDescribedByElements): Moved to AccessibilityObject.
        (WebCore::AccessibilityRenderObject::supportsARIAControls): Deleted.
        (WebCore::AccessibilityRenderObject::ariaControlsElements): Moved to AccessibilityObject.
        (WebCore::AccessibilityRenderObject::ariaOwnsElements): Moved to AccessibilityObject.
        * accessibility/AccessibilityRenderObject.h:
        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (setAtkRelationSetFromCoreObject):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):

2016-03-15  Simon Fraser  <simon.fraser@apple.com>

        Occasional crash under GraphicsContext::platformContext when dragging Google maps
        https://bugs.webkit.org/show_bug.cgi?id=155521
        rdar://problem/24357307

        Reviewed by Tim Horton.

        It's possible for createDragImageForSelection() to return a null image, if the bounds
        of the selection are an empty rect. That would cause a crash under convertImageToBitmap()
        because a zero-sized ShareableBitmap will return a null GraphicsContext.
        
        To avoid this, early return from DragController::startDrag() if the dragImage is null.
        
        I wasn't able to come up with a test for this.

        * page/DragController.cpp:
        (WebCore::DragController::startDrag):

2016-03-15  Tim Horton  <timothy_horton@apple.com>

        iOS <attachment> element should allow customization of action text color
        https://bugs.webkit.org/show_bug.cgi?id=155513
        <rdar://problem/24805991>

        Reviewed by Simon Fraser.

        Test: fast/attachment/attachment-action.html

        * css/html.css:
        (attachment):
        On iOS (the only place it is used), <attachment> color should default to system blue.

        * rendering/RenderThemeIOS.mm:
        (WebCore::attachmentActionColor):
        (WebCore::AttachmentInfo::AttachmentInfo):
        Make use of the <attachment>'s CSS color for the action text.
        This is a little weird because there are multiple bits of text in an
        <attachment>, but only the action text ever changes color.

2016-03-15  Zalan Bujtas  <zalan@apple.com>

        Delay HTMLFormControlElement::focus() call until after layout is finished.
        https://bugs.webkit.org/show_bug.cgi?id=155503
        <rdar://problem/24046635>

        Reviewed by Simon Fraser.

        Calling focus on a form element can trigger arbitrary JS code which could interfere with
        the ongoing layout. 
        This patch delays HTMLFormControlElement::focus() call until after layout is finished.
        If we are currently not in the middle of a layout, HTMLFormControlElement::focus() is delayed until
        after style resolution is done. 

        Covered by LayoutTests/fast/dom/adopt-node-crash-2.html

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::updateBackingStore):
        * dom/Document.cpp:
        (WebCore::Document::updateStyleIfNeeded):
        (WebCore::Document::updateLayout):
        (WebCore::Document::updateLayoutIfDimensionsOutOfDate):
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::renderWidgetLoadingPlugin):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::didAttachRenderers):
        * page/FrameView.cpp:
        (WebCore::FrameView::layout):
        (WebCore::FrameView::queuePostLayoutCallback):
        (WebCore::FrameView::flushPostLayoutTasksQueue):
        (WebCore::FrameView::performPostLayoutTasks):
        (WebCore::FrameView::sendResizeEventIfNeeded):
        * page/FrameView.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::imageChanged):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollTo):

2016-03-15  Oliver Hunt  <oliver@apple.com>

        Remove compile time define for SEPARATED_HEAP
        https://bugs.webkit.org/show_bug.cgi?id=155508

        Reviewed by Mark Lam.

        Remove the feature define.

        * Configurations/FeatureDefines.xcconfig:

2016-03-15  Chris Dumez  <cdumez@apple.com>

        Restore pre-r197244 behavior on Mac
        https://bugs.webkit.org/show_bug.cgi?id=155507
        <rdar://problem/25174132>

        Reviewed by Gavin Barraclough.

        <http://trac.webkit.org/changeset/197244> changed the session restore
        behavior to disallow stale content on all platforms except iOS.
        We would also like to maintain the behavior on Mac for performance
        reasons and consistency between iOS and Mac.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadDifferentDocumentItem):

2016-03-15  Tim Horton  <timothy_horton@apple.com>

        <attachment> on iOS isn't quite vertically centered
        https://bugs.webkit.org/show_bug.cgi?id=155502
        <rdar://problem/24805991>

        Reviewed by Beth Dakin.

        No new tests; there are existing tests that will be enabled shortly.

        * rendering/RenderThemeIOS.mm:
        (WebCore::AttachmentInfo::AttachmentInfo):
        We were overcounting the total height of the attachment content by one margin, because each item
        would add in its margin, including the last one. Remove one margin.

2016-03-15  Chris Fleizach  <cfleizach@apple.com>

        AX: certain elements not included in accessibility tree
        https://bugs.webkit.org/show_bug.cgi?id=155480

        Reviewed by Beth Dakin.

        This test case exposed a hole in the nextSibling logic where you can get into a state where we skip content.
        The fix is to check if an inline element continuation has no sibling, to fall back on to the parent case to see if that has a sibling.

        Test: accessibility/double-nested-inline-element-missing-from-tree.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::nextSibling):

2016-03-15  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r198203.

        Favorites view is no longer loading on iOS

        Reverted changeset:

        "URL Parsing should signal failure for illegal IDN"
        https://bugs.webkit.org/show_bug.cgi?id=154945
        http://trac.webkit.org/changeset/198203

2016-03-15  Tim Horton  <timothy_horton@apple.com>

        <attachment> on iOS should use short and emphasized fonts
        https://bugs.webkit.org/show_bug.cgi?id=155485
        <rdar://problem/24805991>

        Reviewed by Simon Fraser.

        No new tests; there are existing tests that will be enabled shortly.

        * rendering/RenderThemeIOS.mm:
        (WebCore::attachmentActionFont):
        (WebCore::attachmentTitleFont):
        (WebCore::attachmentSubtitleFont):
        (WebCore::AttachmentInfo::buildTitleLines):
        (WebCore::AttachmentInfo::buildSingleLine):
        (WebCore::AttachmentInfo::AttachmentInfo):
        No need for UIFonts, we can use CoreText, and that allows us to ask for the
        correct Short and Emphasized variants that we need.

2016-03-15  Antti Koivisto  <antti@apple.com>

        REGRESSION (196383): Class change invalidation does not handle :not correctly
        https://bugs.webkit.org/show_bug.cgi?id=155493
        <rdar://problem/24846762>

        Reviewed by Andreas Kling.

        We fail to invalidate bar style in

            :not(.foo) bar { }

        when class foo is added or removed.

        There is a logic error in the invalidation code. It assumes that class addition can only make new selectors match
        and removal make them not match. This is not true when :not is present.

        * style/AttributeChangeInvalidation.h:
        (WebCore::Style::AttributeChangeInvalidation::AttributeChangeInvalidation):
        * style/ClassChangeInvalidation.cpp:
        (WebCore::Style::ClassChangeInvalidation::invalidateStyle):

            Invalidate style and collect full set of rules that may affect descendant style.

        (WebCore::Style::ClassChangeInvalidation::invalidateDescendantStyle):

            Invalidate with this set both before and after committing the changes.

        (WebCore::Style::ClassChangeInvalidation::computeClassChange): Deleted.
        * style/ClassChangeInvalidation.h:
        (WebCore::Style::ClassChangeInvalidation::ClassChangeInvalidation):
        (WebCore::Style::ClassChangeInvalidation::~ClassChangeInvalidation):

2016-03-14  Jer Noble  <jer.noble@apple.com>

        Video elements with autoplay do not begin playing when scrolling into view if InvisibleAutoplayNotPermitted is set.
        https://bugs.webkit.org/show_bug.cgi?id=155468

        Reviewed by Eric Carlson.

        Test: media/video-restricted-invisible-autoplay-allowed-when-visible.html

        A few bugs came together to cause this behavior. We were not telling the media session that we were going to begin
        the autoplaying state, we were not restoring the correct state when the interruption ended, and we were not checking
        to see if we could actually play correctly when the interruption ended.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::prepareForLoad):
        (WebCore::HTMLMediaElement::canTransitionFromAutoplayToPlay):
        (WebCore::HTMLMediaElement::setReadyState):
        (WebCore::HTMLMediaElement::resumeAutoplaying):
        (WebCore::HTMLMediaElement::updateShouldPlay):
        (WebCore::elementCanTransitionFromAutoplayToPlay): Deleted.
        * html/HTMLMediaElement.h:
        * platform/audio/PlatformMediaSession.cpp:
        (WebCore::PlatformMediaSession::endInterruption):

2016-03-15  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Rename GridCoordinate to GridArea
        https://bugs.webkit.org/show_bug.cgi?id=155489

        Reviewed by Sergio Villar Senin.

        As the comment in GridCoordinate states,
        it actually represents a grid area as it stores
        the initial and final positions in both axis (columns and rows).

        Someone can think about a grid coordinate just like a single cell.
        However this class was representing an area of several cells.

        On top of that the "grid area" concept is defined in the spec:
        https://drafts.csswg.org/css-grid/#grid-area-concept

        No new tests, no change of behavior.

        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSGridTemplateAreasValue.cpp:
        (WebCore::stringForPosition):
        * css/CSSGridTemplateAreasValue.h:
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateAreasRow):
        * css/CSSParser.h:
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::GridIterator::nextEmptyGridArea):
        (WebCore::RenderGrid::insertItemIntoGrid):
        (WebCore::RenderGrid::placeItemsOnGrid):
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        (WebCore::RenderGrid::clearGrid):
        (WebCore::RenderGrid::cachedGridArea):
        (WebCore::RenderGrid::cachedGridSpan):
        * rendering/RenderGrid.h:
        * rendering/style/GridArea.h: Renamed from Source/WebCore/rendering/style/GridCoordinate.h.
        (WebCore::GridSpan::untranslatedDefiniteGridSpan):
        (WebCore::GridSpan::translatedDefiniteGridSpan):
        (WebCore::GridSpan::indefiniteGridSpan):
        (WebCore::GridSpan::operator==):
        (WebCore::GridSpan::integerSpan):
        (WebCore::GridSpan::untranslatedResolvedInitialPosition):
        (WebCore::GridSpan::untranslatedResolvedFinalPosition):
        (WebCore::GridSpan::resolvedInitialPosition):
        (WebCore::GridSpan::resolvedFinalPosition):
        (WebCore::GridSpan::GridSpanIterator::GridSpanIterator):
        (WebCore::GridSpan::GridSpanIterator::operator unsigned&):
        (WebCore::GridSpan::GridSpanIterator::operator*):
        (WebCore::GridSpan::begin):
        (WebCore::GridSpan::end):
        (WebCore::GridSpan::isTranslatedDefinite):
        (WebCore::GridSpan::isIndefinite):
        (WebCore::GridSpan::translate):
        (WebCore::GridSpan::GridSpan):
        (WebCore::GridArea::GridArea):
        (WebCore::GridArea::operator==):
        (WebCore::GridArea::operator!=):
        * rendering/style/GridPositionsResolver.cpp:
        * rendering/style/StyleGridData.h:

2016-03-15  Joonghun Park  <jh718.park@samsung.com>

        [GTK] Remove duplicate HashMap traversal and unneeded reference count churn in DataObjectGtk::forClipboard
        https://bugs.webkit.org/show_bug.cgi?id=155470

        Reviewed by Carlos Garcia Campos.

        No new tests, no new behaviours.

        * platform/gtk/DataObjectGtk.cpp:
        (WebCore::DataObjectGtk::forClipboard):

2016-03-15  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Rename GridResolvedPosition to GridPositionsResolver
        https://bugs.webkit.org/show_bug.cgi?id=155486

        Reviewed by Sergio Villar Senin.

        GridResolvedPosition is not storing a position (track or line) anymore.
        Currently it's just a class wrapping the methods to resolve
        grid positions from style.
        Renamed the class to avoid confusions.

        No new tests, no change of behavior.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::placeItemsOnGrid):
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        * rendering/RenderGrid.h:
        * rendering/style/GridCoordinate.h:
        * rendering/style/GridPositionsResolver.cpp: Renamed from Source/WebCore/rendering/style/GridResolvedPosition.cpp.
        (WebCore::isColumnSide):
        (WebCore::isStartSide):
        (WebCore::initialPositionSide):
        (WebCore::finalPositionSide):
        (WebCore::gridLinesForSide):
        (WebCore::implicitNamedGridLineForSide):
        (WebCore::GridPositionsResolver::isNonExistentNamedLineOrArea):
        (WebCore::adjustGridPositionsFromStyle):
        (WebCore::GridPositionsResolver::explicitGridColumnCount):
        (WebCore::GridPositionsResolver::explicitGridRowCount):
        (WebCore::explicitGridSizeForSide):
        (WebCore::lookAheadForNamedGridLine):
        (WebCore::lookBackForNamedGridLine):
        (WebCore::resolveNamedGridLinePositionFromStyle):
        (WebCore::definiteGridSpanWithNamedLineSpanAgainstOpposite):
        (WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveGridPositionAgainstOppositePosition):
        (WebCore::GridPositionsResolver::spanSizeForAutoPlacedItem):
        (WebCore::resolveGridPositionFromStyle):
        (WebCore::GridPositionsResolver::resolveGridPositionsFromStyle):
        * rendering/style/GridPositionsResolver.h: Renamed from Source/WebCore/rendering/style/GridResolvedPosition.h.
        * rendering/style/StyleAllInOne.cpp:

2016-03-15  Miguel Gomez  <magomez@igalia.com>

        Leak: Accelerated ImageBufferCairo doesn't destroy the used textures
        https://bugs.webkit.org/show_bug.cgi?id=155431

        Reviewed by Žan Doberšek.

        When using the Cairo backend, add a destructor to ImageBufferData and use it to destroy the
        textures created if the buffer is being accelerated.

        No new tests, already covered by existing ones.

        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBufferData::ImageBufferData):
        Store the renderingMode flag.
        (WebCore::ImageBufferData::~ImageBufferData):
        Destroy gl resources if renderingMode is accelerated.
        (WebCore::ImageBuffer::ImageBuffer):
        Pass renderingMode to the data class and use it fro checks instead of the function parameter.
        * platform/graphics/cairo/ImageBufferDataCairo.h:
        Add destructor and a renderingMode flag.

2016-03-15  Jiewen Tan  <jiewen_tan@apple.com>

        URL Parsing should signal failure for illegal IDN
        https://bugs.webkit.org/show_bug.cgi?id=154945
        <rdar://problem/8014795>

        Reviewed by Brent Fulgham.

        WebCore::URL will now invalidate URLs with illegal IDN. And functions inside WebCoreNSURLExtras.h
        that deal with IDN mapping will now return nil to signal error.

        Test: fast/url/invalid-idn.html

        * platform/URL.cpp:
        (WebCore::isSchemeFirstChar):
        (WebCore::URL::init):
        (WebCore::appendEncodedHostname):
        (WebCore::encodeHostnames):
        (WebCore::encodeRelativeString):
        * platform/mac/WebCoreNSURLExtras.h:
        * platform/mac/WebCoreNSURLExtras.mm:
        (WebCore::mapHostNameWithRange):
        (WebCore::hostNameNeedsDecodingWithRange):
        (WebCore::hostNameNeedsEncodingWithRange):
        (WebCore::decodeHostNameWithRange):
        (WebCore::encodeHostNameWithRange):
        (WebCore::decodeHostName):
        (WebCore::encodeHostName):
        (WebCore::collectRangesThatNeedMapping):
        (WebCore::mapHostNames):
        (WebCore::URLWithData):
        (WebCore::dataWithUserTypedString):
        (WebCore::URLWithUserTypedString):
        (WebCore::URLWithUserTypedStringDeprecated):
        (WebCore::userVisibleString):

2016-03-15  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION (r197724): [GTK] Web Inspector: Images being blocked by CSP 2.0
        https://bugs.webkit.org/show_bug.cgi?id=155432

        Reviewed by Darin Adler.

        The GTK+ port Web Inspector uses GResources for all internal
        resources (images, fonts, scripts, etc.) that are now blocked by
        the CSP. GResouces are like data URLs in practice, so we should
        always allow them.

        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::isProtocolAllowedByStar):

2016-03-14  Alex Christensen  <achristensen@webkit.org>

        Fix WinCairo build after r198195.

        * platform/network/NetworkingContext.h:
        curl networking now uses NetworkingContext::storageSession.  That's everybody!

2016-03-14  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo] Compile fix.
        https://bugs.webkit.org/show_bug.cgi?id=155463

        Reviewed by Alex Christensen.

        Get the NetworkStorageSession object from the document in the same way as other platforms do.

        * loader/CookieJar.cpp:
        (WebCore::storageSession):

2016-03-14  Tim Horton  <timothy_horton@apple.com>

        <attachment> on iOS should paint its progress indicator instead of a green square
        https://bugs.webkit.org/show_bug.cgi?id=155482
        <rdar://problem/24805991>

        Reviewed by Simon Fraser.

        No new tests; there are existing tests that will be enabled shortly.

        * rendering/RenderThemeIOS.mm:
        (WebCore::getAttachmentProgress):
        Clamp progress to 0-1.

        (WebCore::paintAttachmentProgress):
        Paint a pie.

2016-03-14  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r197981.

        Caused a massive PLT regression on Mac.

        Reverted changeset:

        "Font antialiasing (smoothing) changes when elements are
        rendered into compositing layers"
        https://bugs.webkit.org/show_bug.cgi?id=23364
        http://trac.webkit.org/changeset/197981

2016-03-14  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r198145.

        This attempt to disable the feature did not fix the PLT
        regression

        Reverted changeset:

        "Regression(r197981): Huge regression on Mac PLT"
        https://bugs.webkit.org/show_bug.cgi?id=155443
        http://trac.webkit.org/changeset/198145

2016-03-14  Sam Weinig  <sam@webkit.org>

        Remove errant space.

        * page/UserContentController.cpp:

2016-03-14  Sam Weinig  <sam@webkit.org>

        Fix the windows build.

        * page/UserContentController.cpp:

2016-03-14  Sam Weinig  <sam@webkit.org>

        Add a baseURL parameter to _WKUserStyleSheet
        https://bugs.webkit.org/show_bug.cgi?id=155219

        Reviewed by Tim Horton.

        - Moves to a model for user content where instead of each page having a WebCore::UserContentController
          object, we have an abstract WebCore::UserContentProvider interface that can be implemented at the WebKit
          level. For now, legacy WebKit continues to use the old UserContentController, which implements 
          WebCore::UserContentProvider, and WebKit2 implements its own implementation so it can store additional
          state.

        * WebCore.xcodeproj/project.pbxproj:
        Add new files.

        * dom/ExtensionStyleSheets.cpp:
        (WebCore::ExtensionStyleSheets::updateInjectedStyleSheetCache):
        Switch to using forEachUserStyleSheet on the UserContentProvider.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadResource):
        Remove null check now that we always have a UserContentProvider.

        * loader/EmptyClients.cpp:
        (WebCore::fillWithEmptyClients):
        * loader/EmptyClients.h:
        Add new EmptyClients.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadResourceSynchronously):
        Remove null check now that we always have a UserContentProvider.

        * loader/PingLoader.cpp:
        (WebCore::processContentExtensionRulesForLoad):
        Remove null check now that we always have a UserContentProvider.

        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::willSendRequestInternal):
        Remove null check now that we always have a UserContentProvider.

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestResource):
        Remove null check now that we always have a UserContentProvider.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::shouldHaveWebKitNamespaceForWorld):
        Remove null checks now that we always have a UserContentProvider, and userMessageHandlerDescriptors
        returns a reference.

        (WebCore::DOMWindow::open):
        Remove null check now that we always have a UserContentProvider.

        * page/Frame.cpp:
        (WebCore::Frame::injectUserScripts):
        Simplify by lifting document check out of the main loop and using forEachUserScript.

        * page/Page.cpp:
        (WebCore::Page::Page):
        (WebCore::Page::~Page):
        (WebCore::Page::userContentProvider):
        (WebCore::Page::setUserContentProvider):
        (WebCore::Page::setUserContentController): Deleted.
        * page/Page.h:
        (WebCore::Page::userContentController): Deleted.
        * page/PageConfiguration.h:
        Store the UserContentProvider in a Ref, and require PageConfigurations to provide one. This
        removes a bunch of null checks and simplifies the code.

        * page/UserContentController.cpp:
        (WebCore::UserContentController::~UserContentController):
        (WebCore::UserContentController::forEachUserScript):
        (WebCore::UserContentController::forEachUserStyleSheet):
        (WebCore::UserContentController::addUserScript):
        (WebCore::UserContentController::removeUserScript):
        (WebCore::UserContentController::removeUserScripts):
        (WebCore::UserContentController::addUserStyleSheet):
        (WebCore::UserContentController::removeUserStyleSheet):
        (WebCore::UserContentController::removeUserStyleSheets):
        (WebCore::UserContentController::addUserMessageHandlerDescriptor):
        (WebCore::UserContentController::removeUserMessageHandlerDescriptor):
        (WebCore::UserContentController::addUserContentExtension):
        (WebCore::UserContentController::removeUserContentExtension):
        (WebCore::UserContentController::removeAllUserContentExtensions):
        (WebCore::UserContentController::removeAllUserContent):
        (WebCore::UserContentController::addPage): Deleted.
        (WebCore::UserContentController::removePage): Deleted.
        (WebCore::contentExtensionsEnabled): Deleted.
        (WebCore::UserContentController::processContentExtensionRulesForLoad): Deleted.
        (WebCore::UserContentController::actionsForResourceLoad): Deleted.
        * page/UserContentController.h:
        (WebCore::UserContentController::userScripts): Deleted.
        (WebCore::UserContentController::userStyleSheets): Deleted.
        (WebCore::UserContentController::userMessageHandlerDescriptors): Deleted.
        Add inheritance from UserContentProvider and simplify things by removing unique_ptrs
        that were holding the member variables. There is usually only one UserContentController
        so having these in unique_ptrs doesn't make much sense.
        
        * page/UserContentProvider.cpp: Added.
        (WebCore::UserContentProvider::UserContentProvider):
        (WebCore::UserContentProvider::~UserContentProvider):
        (WebCore::UserContentProvider::addPage):
        (WebCore::UserContentProvider::removePage):
        (WebCore::UserContentProvider::invalidateInjectedStyleSheetCacheInAllFramesInAllPages):
        (WebCore::contentExtensionsEnabled):
        (WebCore::UserContentProvider::processContentExtensionRulesForLoad):
        (WebCore::UserContentProvider::actionsForResourceLoad):
        * page/UserContentProvider.h: Added.
        Add abstract class for providing user content and add some helpers on it.

        * page/UserMessageHandlerDescriptor.h:
        (WebCore::UserMessageHandlerDescriptor::create):
        (WebCore::UserMessageHandlerDescriptor::client):
        (WebCore::UserMessageHandlerDescriptor::invalidateClient):
        * page/UserMessageHandlersNamespace.cpp:
        (WebCore::UserMessageHandlersNamespace::handler):
        Simplify now that userContentProvider() and userMessageHandlerDescriptors() are references.

2016-03-14  Enrica Casucci  <enrica@apple.com>

        iOS: RTFD format is not available in the pasteboard after copy/cut.
        https://bugs.webkit.org/show_bug.cgi?id=155477
        rdar://problem/23500600

        Reviewed by Tim Horton.

        WebKit is using UTTypeRTFD instead of UTTypeFlatRTFD that is the
        proper RTFD format for pastedboard. I also discovered that, when
        we create the NSTextAttachment in the NSAttributedString we produce
        from the DOM range, we are not generating a file name with the
        appropriate extension for the MIME type. The iOS specific implementation
        of the MIMETypeRegistry functions were empty.
        There is no need to have a differentiation between OS X and iOS, so
        we now have only one file called MIMETypeRegistryCocoa.mm.

        * WebCore.xcodeproj/project.pbxproj:
        * platform/cocoa/MIMETypeRegistryCocoa.mm: Added.
        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
        (WebCore::MIMETypeRegistry::getExtensionsForMIMEType):
        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
        (WebCore::MIMETypeRegistry::isApplicationPluginMIMEType):
        * platform/ios/MIMETypeRegistryIOS.mm: Removed.
        * platform/ios/PasteboardIOS.mm:
        (WebCore::Pasteboard::read):
        (WebCore::Pasteboard::supportedPasteboardTypes):
        (WebCore::Pasteboard::hasData):
        * platform/ios/PlatformPasteboardIOS.mm:
        (WebCore::PlatformPasteboard::write):
        * platform/mac/MIMETypeRegistryMac.mm: Removed.

2016-03-14  Daniel Bates  <dabates@apple.com>

        Web Inspector: Display Content Security Policy hash in details sidebar for script and style elements
        https://bugs.webkit.org/show_bug.cgi?id=155466
        <rdar://problem/25152480>

        Reviewed by Joseph Pecoraro and Timothy Hatcher.

        For convenience, display the SHA-256 Content Security Policy (CSP) hash in the node details
        sidebar for the selected HTML script element or HTML style element. A CSP script hash is
        only applicable to inline JavaScript scripts. Therefore, we will display a hash for HTML
        script elements only if they do not have a src attribute.

        Tests: inspector/dom/csp-big5-hash.html
               inspector/dom/csp-hash.html

        * inspector/InspectorDOMAgent.cpp:
        (WebCore::computeContentSecurityPolicySHA256Hash): Added.
        (WebCore::InspectorDOMAgent::buildObjectForNode): For an applicable HTML script- or style-
        element, pass the computed SHA-256 CSP hash to the Inspector front end.

2016-03-14  Joonghun Park  <jh718.park@samsung.com>

        Purge PassRefPtr from ArrayBuffer, ArchiveResource, Pasteboard, LegacyWebArchive and DataObjectGtk
        https://bugs.webkit.org/show_bug.cgi?id=150497

        Reviewed by Darin Adler.

        No new tests, no new behaviours.

        * Modules/indexeddb/IDBGetResult.h:
        (WebCore::IDBGetResult::IDBGetResult):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::getIndexRecord):
        * Modules/mediastream/RTCDataChannel.cpp:
        (WebCore::RTCDataChannel::didReceiveRawData):
        * dom/MessageEvent.cpp:
        (WebCore::MessageEvent::MessageEvent):
        * dom/MessageEvent.h:
        * editing/Editor.cpp:
        (WebCore::Editor::selectedRange):
        * editing/Editor.h:
        * editing/FrameSelection.h:
        (WebCore::FrameSelection::toNormalizedRange):
        * editing/VisiblePosition.cpp:
        (WebCore::makeRange):
        * editing/VisiblePosition.h:
        * editing/VisibleSelection.cpp:
        (WebCore::VisibleSelection::toNormalizedRange):
        * editing/VisibleSelection.h:
        * editing/VisibleUnits.cpp:
        (WebCore::enclosingTextUnitOfGranularity):
        (WebCore::wordRangeFromPosition):
        (WebCore::rangeExpandedByCharactersInDirectionAtWordBoundary):
        (WebCore::rangeExpandedAroundPositionByCharacters):
        * editing/VisibleUnits.h:
        * editing/cocoa/HTMLConverter.mm:
        (HTMLConverter::_addAttachmentForElement):
        (fileWrapperForURL):
        * editing/efl/EditorEfl.cpp:
        (WebCore::Editor::webContentFromPasteboard):
        * editing/gtk/EditorGtk.cpp:
        (WebCore::createFragmentFromPasteboardData):
        (WebCore::Editor::webContentFromPasteboard):
        * editing/ios/EditorIOS.mm:
        (WebCore::dataInRTFDFormat):
        (WebCore::dataInRTFFormat):
        (WebCore::Editor::selectionInWebArchiveFormat):
        (WebCore::Editor::WebContentReader::addFragment):
        (WebCore::Editor::WebContentReader::readWebArchive):
        (WebCore::Editor::WebContentReader::readRTFD):
        (WebCore::Editor::WebContentReader::readRTF):
        (WebCore::Editor::WebContentReader::readImage):
        (WebCore::Editor::WebContentReader::readURL):
        (WebCore::Editor::webContentFromPasteboard):
        (WebCore::Editor::pasteWithPasteboard):
        (WebCore::Editor::createFragmentAndAddResources):
        (WebCore::Editor::createFragmentForImageResourceAndAddResource):
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::selectionInWebArchiveFormat):
        (WebCore::Editor::adjustedSelectionRange):
        (WebCore::dataInRTFDFormat):
        (WebCore::dataInRTFFormat):
        (WebCore::Editor::dataSelectionForPasteboard):
        (WebCore::Editor::WebContentReader::readWebArchive):
        (WebCore::Editor::WebContentReader::readRTFD):
        (WebCore::Editor::WebContentReader::readRTF):
        (WebCore::Editor::WebContentReader::readImage):
        (WebCore::Editor::WebContentReader::readURL):
        (WebCore::Editor::webContentFromPasteboard):
        (WebCore::Editor::createFragmentForImageResourceAndAddResource):
        (WebCore::Editor::createFragmentAndAddResources):
        * editing/win/EditorWin.cpp:
        (WebCore::createFragmentFromPlatformData):
        (WebCore::Editor::webContentFromPasteboard):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::archive):
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::mainResourceData):
        (WebCore::DocumentLoader::maybeCreateArchive):
        (WebCore::DocumentLoader::addArchiveResource):
        (WebCore::DocumentLoader::mainResource):
        * loader/DocumentLoader.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadArchive):
        * loader/SubstituteData.h:
        (WebCore::SubstituteData::SubstituteData):
        (WebCore::SubstituteData::isValid):
        * loader/SubstituteResource.h:
        (WebCore::SubstituteResource::data):
        (WebCore::SubstituteResource::SubstituteResource):
        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::didReceiveResponse):
        (WebCore::ApplicationCacheGroup::didReceiveData):
        (WebCore::ApplicationCacheGroup::didFail):
        (WebCore::ApplicationCacheGroup::didReceiveManifestData):
        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
        * loader/appcache/ApplicationCacheHost.cpp:
        (WebCore::ApplicationCacheHost::maybeLoadMainResource):
        (WebCore::ApplicationCacheHost::maybeLoadSynchronously):
        (WebCore::ApplicationCacheHost::maybeLoadFallbackSynchronously):
        * loader/appcache/ApplicationCacheResource.cpp:
        (WebCore::ApplicationCacheResource::ApplicationCacheResource):
        (WebCore::ApplicationCacheResource::deliver):
        (WebCore::ApplicationCacheResource::estimatedSizeInStorage):
        * loader/appcache/ApplicationCacheResource.h:
        (WebCore::ApplicationCacheResource::create):
        * loader/appcache/ApplicationCacheStorage.cpp:
        (WebCore::ApplicationCacheStorage::store):
        (WebCore::ApplicationCacheStorage::writeDataToUniqueFileInDirectory):
        * loader/appcache/ApplicationCacheStorage.h:
        * loader/archive/ArchiveFactory.cpp:
        (WebCore::archiveFactoryCreate):
        (WebCore::ArchiveFactory::create):
        * loader/archive/ArchiveFactory.h:
        * loader/archive/ArchiveResource.cpp:
        (WebCore::ArchiveResource::ArchiveResource):
        (WebCore::ArchiveResource::create):
        * loader/archive/ArchiveResource.h:
        * loader/archive/ArchiveResourceCollection.cpp:
        (WebCore::ArchiveResourceCollection::addResource):
        * loader/archive/ArchiveResourceCollection.h:
        * loader/archive/cf/LegacyWebArchive.cpp:
        (WebCore::LegacyWebArchive::createPropertyListRepresentation):
        (WebCore::LegacyWebArchive::createResource):
        (WebCore::LegacyWebArchive::create):
        (WebCore::LegacyWebArchive::createFromSelection):
        * loader/archive/cf/LegacyWebArchive.h:
        * loader/archive/mhtml/MHTMLArchive.cpp:
        (WebCore::MHTMLArchive::create):
        * loader/archive/mhtml/MHTMLArchive.h:
        * loader/archive/mhtml/MHTMLParser.cpp:
        (WebCore::MHTMLParser::parseArchive):
        (WebCore::MHTMLParser::parseArchiveWithHeader):
        (WebCore::MHTMLParser::parseNextPart):
        * loader/archive/mhtml/MHTMLParser.h:
        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::didAddClient):
        * loader/icon/IconDatabase.cpp:
        (WebCore::loadDefaultIconRecord):
        * loader/icon/IconRecord.cpp:
        (WebCore::IconRecord::setImageData):
        * loader/icon/IconRecord.h:
        * platform/Pasteboard.h:
        * platform/PasteboardStrategy.h:
        * platform/PlatformPasteboard.h:
        * platform/SharedBuffer.cpp:
        (WebCore::SharedBuffer::createArrayBuffer):
        (WebCore::utf8Buffer):
        * platform/SharedBuffer.h:
        (WebCore::SharedBuffer::create):
        * platform/cf/SharedBufferCF.cpp:
        (WebCore::SharedBuffer::wrapCFData):
        * platform/cocoa/NetworkExtensionContentFilter.mm:
        (WebCore::NetworkExtensionContentFilter::replacementData):
        * platform/cocoa/ParentalControlsContentFilter.mm:
        (WebCore::ParentalControlsContentFilter::replacementData):
        * platform/graphics/Image.cpp:
        (WebCore::Image::setData):
        * platform/graphics/Image.h:
        * platform/gtk/DataObjectGtk.cpp:
        (WebCore::DataObjectGtk::forClipboard):
        * platform/gtk/DataObjectGtk.h:
        (WebCore::DataObjectGtk::create):
        * platform/gtk/PasteboardGtk.cpp:
        (WebCore::Pasteboard::Pasteboard):
        (WebCore::Pasteboard::dataObject):
        * platform/ios/PasteboardIOS.mm:
        (WebCore::Pasteboard::read):
        * platform/ios/PlatformPasteboardIOS.mm:
        (WebCore::PlatformPasteboard::bufferForType):
        (WebCore::PlatformPasteboard::readBuffer):
        * platform/mac/PasteboardMac.mm:
        (WebCore::writeFileWrapperAsRTFDAttachment):
        (WebCore::Pasteboard::read):
        * platform/mac/PlatformPasteboardMac.mm:
        (WebCore::PlatformPasteboard::bufferForType):
        * platform/mac/SharedBufferMac.mm:
        (WebCore::SharedBuffer::wrapNSData):
        (WebCore::SharedBuffer::createFromReadingFile):
        * platform/network/MIMEHeader.cpp:
        (WebCore::retrieveKeyValuePairs):
        (WebCore::MIMEHeader::parseHeader):
        * platform/network/MIMEHeader.h:
        * platform/soup/SharedBufferSoup.cpp:
        (WebCore::SharedBuffer::wrapSoupBuffer):
        * platform/win/ClipboardUtilitiesWin.cpp:
        (WebCore::fragmentFromFilenames):
        (WebCore::fragmentFromCFHTML):
        (WebCore::fragmentFromHTML):
        * platform/win/ClipboardUtilitiesWin.h:
        * platform/win/PasteboardWin.cpp:
        (WebCore::Pasteboard::documentFragment):

2016-03-14  Oliver Hunt  <oliver@apple.com>

        Temporarily disable the separated heap.
        https://bugs.webkit.org/show_bug.cgi?id=155472

        Reviewed by Geoffrey Garen.

        Temporarily disable this.

        * Configurations/FeatureDefines.xcconfig:

2016-03-10  Antonio Gomes  <tonikitoo@webkit.org>

        Selecting with shift+drag results in unexpected drag-n-drop
        https://bugs.webkit.org/show_bug.cgi?id=155314

        Reviewed by Darin Adler.

        Test: editing/selection/shift-drag-selection-no-drag-n-drop.html

        Whenever user tries to extend an existing text selection by dragging the mouse
        (left button hold) with shift key pressed, WebKit enters drag-n-drop mode.
        This behavior does not match common editing behavior out there, including other
        browsers' (Firefox, Opera/Presto and IE).

        Patch changes WebKit so that whenever one extends a selection with mouse
        and shift key pressed off of a #text node, it does not enter drag-n-drop mode.

        Additionally, patch also adds some further tests to ensure that when
        selection is extended off of either a link or an image, drag-n-drop does
        get triggered, no matter if shift key is pressed.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMousePressEvent):

2016-03-14  Brent Fulgham  <bfulgham@apple.com>

        REGRESSION (r197114): Crash in WebCore::MediaDevicesRequest::didCompletePermissionCheck
        https://bugs.webkit.org/show_bug.cgi?id=155453
        <rdar://problem/24879447>

        Reviewed by Daniel Bates.

        Tested by fast/mediastream/enumerating-crash.html.

        * Modules/mediastream/MediaDevicesRequest.cpp:
        (WebCore::MediaDevicesRequest::didCompletePermissionCheck): Prevent UserMediaPermissionCheck object from being
        destroyed before the method completes.

2016-03-14  Simon Fraser  <simon.fraser@apple.com>

        Fix crash when reloading a page using requestAnimationFrame on iOS
        https://bugs.webkit.org/show_bug.cgi?id=155465
        rdar://problem/25100202

        Reviewed by Tim Horton.

        On iOS, it's possible for all clients for a DisplayRefreshMonitor
        to be unregistered, but still get a subsequent displayDidRefresh() for that monitor.
        In this case, we would remove(notFound) which release-asserts.
        
        Fix by just checking for notFound.
        
        Unable to test because requestAnimationFrame doesn't work in the simulator.

        * platform/graphics/DisplayRefreshMonitorManager.cpp:
        (WebCore::DisplayRefreshMonitorManager::displayDidRefresh):

2016-03-14  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo][MediaFoundation] Implement float versions of MediaPlayer methods.
        https://bugs.webkit.org/show_bug.cgi?id=155357

        Reviewed by Brent Fulgham.

        It is better to implement the float versions of some of the MediaPlayer methods,
        since the default implementation of the double versions is to call the float version.
        Also added override keyword to overridden methods.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::seeking):
        (WebCore::MediaPlayerPrivateMediaFoundation::seek):
        (WebCore::MediaPlayerPrivateMediaFoundation::setRate):
        (WebCore::MediaPlayerPrivateMediaFoundation::duration):
        (WebCore::MediaPlayerPrivateMediaFoundation::currentTime):
        (WebCore::MediaPlayerPrivateMediaFoundation::seekDouble): Deleted.
        (WebCore::MediaPlayerPrivateMediaFoundation::setRateDouble): Deleted.
        (WebCore::MediaPlayerPrivateMediaFoundation::durationDouble): Deleted.
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:

2016-03-14  Tim Horton  <timothy_horton@apple.com>

        Revert r194125 and r194186: We're going to fix this a different way.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::clear):
        * page/EventHandler.h:

2016-03-14  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] FetchLoader should check for empty bodies
        https://bugs.webkit.org/show_bug.cgi?id=155440

        Reviewed by Darin Adler.

        Covered by added tests.

        * Modules/fetch/FetchLoader.cpp:
        (WebCore::FetchLoader::didFinishLoading): returning empty array buffer/empty string if no data received during loading.

2016-03-14  Chris Dumez  <cdumez@apple.com>

        Regression(r197981): Huge regression on Mac PLT
        https://bugs.webkit.org/show_bug.cgi?id=155443
        <rdar://problem/25113391>

        Reviewed by Gavin Barraclough.

        We have experience a huge regression on Mac PLT after r197981, so
        disable the feature until the performance issue is resolved.

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayer::supportsSmoothedLayerText):

2016-03-14  Chris Vienneau  <chris.vno@outlook.com>

        PingHandle delete's itself but pointer is still used by handleDataURL
        https://bugs.webkit.org/show_bug.cgi?id=154752
        <rdar://problem/24872347>

        Reviewed by Alex Christensen.

        When a PingHandle is destroyed, we should tell its client so that the client can clear the pointer it
        holds to the element to avoid accidentally attempting to use deallocated memory.

        The ResourceHandle's client member may be null after "didReceiveResponse" is called. We should confirm
        the client is still valid after these calls.

        * platform/network/DataURL.cpp:
        (WebCore::handleDataURL): Check the client pointer before using it.
        * platform/network/PingHandle.h:
        (WebCore::PingHandle::~PingHandle): Notify the client we are being destroyed.
        * platform/platform/network/ResourceHandle.h:

2016-03-14  Zalan Bujtas  <zalan@apple.com>

        Negative outline offset could break curved outline-style: auto
        https://bugs.webkit.org/show_bug.cgi?id=155416

        Reviewed by Tim Horton.

        When radius becomes negative the rounded rect could end up being un-renderable -> no rounded corners at all.

        Test: fast/inline/hidpi-outline-auto-negative-offset-with-border-radius.html

        * platform/graphics/PathUtilities.cpp:
        (WebCore::adjustedtRadiiForHuggingCurve):

2016-03-14  Zalan Bujtas  <zalan@apple.com>

        [Outline: auto] Fractional radius value could result in non-renderable rounded border.
        https://bugs.webkit.org/show_bug.cgi?id=155420

        Reviewed by Tim Horton.

        RoundedRect::pixelSnappedRoundedRectForPainting ensures that the rounded rect is always renderable.

        Test: fast/inline/hidpi-outline-auto-with-fractional-radius.html

        * platform/graphics/PathUtilities.cpp:
        (WebCore::PathUtilities::pathWithShrinkWrappedRectsForOutline):
        * platform/graphics/PathUtilities.h:
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::paintFocusRing):

2016-03-14  Zalan Bujtas  <zalan@apple.com>

        Outline: auto has sharp corners with single line contenteditable.
        https://bugs.webkit.org/show_bug.cgi?id=155418

        Reviewed by Tim Horton.

        Multiple rectangles assumed multiline content and it broke bottomLeft and bottomRight corner check.
        This patch adds fast path for polygons with 4 corners.

        Test: fast/inline/hidpi-outline-auto-with-one-focusring-rect.html

        * platform/graphics/PathUtilities.cpp:
        (WebCore::cornerType):
        (WebCore::cornerTypeForMultiline):
        (WebCore::rectFromPolygon):
        (WebCore::PathUtilities::pathWithShrinkWrappedRectsForOutline):

2016-03-14  Joanmarie Diggs  <jdiggs@igalia.com>

        [AX] SVG element with child desc not exposed
        https://bugs.webkit.org/show_bug.cgi?id=155374

        Reviewed by Darin Adler.

        Covered by the accessibility/w3c-svg-roles.html test, which was updated.

        AccessibilitySVGRoot is now a subclass of AccessibilitySVGElement, which
        exposes SVG elements with a child desc element as per the specification.
        Also made existing protected methods private.

        * accessibility/AccessibilitySVGElement.h:
        * accessibility/AccessibilitySVGRoot.cpp:
        (WebCore::AccessibilitySVGRoot::AccessibilitySVGRoot):
        (WebCore::AccessibilitySVGRoot::parentObject):
        * accessibility/AccessibilitySVGRoot.h:

2016-03-14  Alexey Proskuryakov  <ap@apple.com>

        Build fix.

        * Modules/fetch/FetchBodyOwner.cpp:
        (WebCore::FetchBodyOwner::loadedBlobAsText):

2016-03-14  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Implement data resolution for blob stored in Body
        https://bugs.webkit.org/show_bug.cgi?id=155359

        Reviewed by Darin Adler.

        Introducing FetchLoader as a wrapper around ThreadableLoader to load resources.
        FetchLoader can retrieve data as text or array buffer. It only supports blob currently.

        Introducing FetchLoaderClient interface and FetchBodyOwner::BlobLoader as specifc blob loader client.

        Covered by existing rebased tests.

        * CMakeLists.txt:
        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::loadingType):
        (WebCore::FetchBody::loadedAsArrayBuffer):
        (WebCore::FetchBody::loadedAsText):
        * Modules/fetch/FetchBody.h:
        * Modules/fetch/FetchBodyOwner.cpp: Added.
        (WebCore::FetchBodyOwner::FetchBodyOwner):
        (WebCore::FetchBodyOwner::loadBlob):
        (WebCore::FetchBodyOwner::finishBlobLoading):
        (WebCore::FetchBodyOwner::blobLoadingFailed):
        (WebCore::FetchBodyOwner::BlobLoader::didReceiveResponse):
        * Modules/fetch/FetchBodyOwner.h:
        (WebCore::FetchBodyOwner::loadedBlobAsText):
        (WebCore::FetchBodyOwner::loadedBlobAsArrayBuffer):
        (WebCore::FetchBodyOwner::blobLoadingSucceeded):
        * Modules/fetch/FetchLoader.cpp: Added.
        (WebCore::FetchLoader::start):
        (WebCore::FetchLoader::FetchLoader):
        (WebCore::FetchLoader::stop):
        (WebCore::FetchLoader::didReceiveResponse):
        (WebCore::FetchLoader::didReceiveData):
        (WebCore::FetchLoader::didFinishLoading):
        (WebCore::FetchLoader::didFail):
        * Modules/fetch/FetchLoader.h: Added.
        * Modules/fetch/FetchLoaderClient.h: Added.
        (WebCore::FetchLoaderClient::~FetchLoaderClient):
        (WebCore::FetchLoaderClient::didReceiveResponse):
        (WebCore::FetchLoaderClient::didFinishLoadingAsText):
        (WebCore::FetchLoaderClient::didFinishLoadingAsArrayBuffer):
        * WebCore.xcodeproj/project.pbxproj:

2016-03-14  Frederic Wang  <fwang@igalia.com>

        Make MathML colspan/rowspan consistent with HTML table cells.
        https://bugs.webkit.org/show_bug.cgi?id=150253

        Reviewed by Martin Robinson.

        Test: mathml/rowspan-crash.xhtml

        We make MathMLElement::colSpan and MathMLElement::rowSpan consistent with the corresponding functions in HTMLTableCellElement.cpp.
        These functions now return unsigned integers, use the same parsing functions and set a maximum for rowspan.
        This latter change fixes crash/timeout with large values of rowspan.

        * mathml/MathMLElement.cpp: Include HTMLParserIdioms to use limitToOnlyHTMLNonNegative.
        (WebCore::MathMLElement::colSpan): Use unsigned integer and limitToOnlyHTMLNonNegative.
        (WebCore::MathMLElement::rowSpan): ditto. We also use the same maximum limit as HTMLTableCellElement.
        * mathml/MathMLElement.h: Make colSpan and rowSpan return unsigned integers.

2016-03-14  Tomas Popela  <tpopela@redhat.com>

        Enable GSS-Negotiate support in libsoup
        https://bugs.webkit.org/show_bug.cgi?id=155354

        Reviewed by Carlos Garcia Campos.

        Enable the SOUP_TYPE_AUTH_NEGOTIATE feature if libsoup was compiled
        with the GSS-Negotiate support.

        * platform/network/soup/SoupNetworkSession.cpp:
        (WebCore::SoupNetworkSession::SoupNetworkSession):

2016-03-14  Ryosuke Niwa  <rniwa@webkit.org>

        Add slotchange event
        https://bugs.webkit.org/show_bug.cgi?id=155424
        <rdar://problem/24997534>

        Reviewed by Antti Koivisto.

        Added `slotchange` event as discussed on https://github.com/w3c/webcomponents/issues/288.

        While the exact semantics of it could still evolve over time, this patch implements as
        an asynchronous event that fires on a slot element whenever its distributed nodes change
        (flattened assigned nodes):
        http://w3c.github.io/webcomponents/spec/shadow/#dfn-distributed-nodes

        Since inserting or removing an element from a shadow host could needs to enqueue this event
        on the right slot element, this patch moves the invalidation point of element removals and
        insertions from Element::childrenChanged to Element::insertedInto and Element::removedFrom.
        Text nodes are still invalidated at Element::childrenChanged for performance reasons
        since it could only appear within a default slot element.

        Because this more fine-grained invalidation needs to be overridden by HTMLDetailsElement,
        we now subclass SlotAssignment in HTMLDetailsElement instead of passing in a std::function.

        Test: fast/shadow-dom/slotchange-event.html

        * dom/Document.cpp:
        (WebCore::Document::enqueueSlotchangeEvent): Added.
        * dom/Document.h:
        * dom/Element.cpp:
        (WebCore::Element::attributeChanged): Call hostChildElementDidChangeSlotAttr.
        (WebCore::Element::insertedInto): Call hostChildElementDidChange.
        (WebCore::Element::removedFrom): Ditto.
        (WebCore::Element::childrenChanged): Don't invalidate the slots on ElementInserted and
        ElementRemoved since they're now done in Element::insertedInto and Element::removedFrom.
        * dom/Event.cpp:
        (WebCore::Event::scoped): slotchange event is scoped.
        * dom/EventNames.h: Added eventNames().slotchange.
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::invalidateSlotAssignments): Deleted.
        (WebCore::ShadowRoot::invalidateDefaultSlotAssignments): Deleted.
        * dom/ShadowRoot.h:
        (ShadowRoot): Added more fine-grained invalidators, mirroring changes to SlotAssignment.
        * dom/SlotAssignment.cpp:
        (WebCore::SlotAssignment::SlotAssignment): Removed a variant that takes SlotNameFunction
        since HTMLDetailsElement now subclasses SlotAssignment.
        (WebCore::SlotAssignment::~SlotAssignment): Added now that the class is virtual.
        (WebCore::recursivelyFireSlotChangeEvent): Added.
        (WebCore::SlotAssignment::didChangeSlot): Added. Invalidates the style tree only if there
        is a corresponding slot element, and fires slotchange event. When the slot element we found
        in this shadow tree is assigned to a slot element inside an inner shadow tree, recursively
        fire slotchange event on each such inner slots.
        (WebCore::SlotAssignment::hostChildElementDidChange): Added. Update the matching slot when
        an element is inserted or removed under a shadow host.
        (WebCore::SlotAssignment::assignedNodesForSlot): Removed the superfluous early exit to an
        release assert since addSlotElementByName should always create a SlotInfo for each element.
        (WebCore::SlotAssignment::slotNameForHostChild): Added. This is the equivalent of old
        m_slotNameFunction which DetailsSlotAssignment overrides.
        (WebCore::SlotAssignment::invalidateDefaultSlot): Deleted.
        (WebCore::SlotAssignment::findFirstSlotElement): Added an assertion. slotInfo.element must
        be nullptr if elementCount is 0, and elementCount must be 0 if slotInfo.element is nullptr
        after calling resolveAllSlotElements, which traverses the entire shadow tree to find all
        slot elements.
        (WebCore::SlotAssignment::assignSlots):
        * dom/SlotAssignment.h: Implemented inline functions of ShadowRoot here to avoid including
        SlotAssignment.h in ShadowRoot.h. Not inlining them results in extra function calls for all
        builtin elements with shadow root without slot elements, which impacts performance.
        (WebCore::ShadowRoot::didRemoveAllChildrenOfShadowHost): Added.
        (WebCore::ShadowRoot::didChangeDefaultSlot): Added.
        (WebCore::ShadowRoot::hostChildElementDidChange): Added.
        (WebCore::ShadowRoot::hostChildElementDidChangeSlotAttribute): Added.
        (WebCore::ShadowRoot::innerSlotDidChange):
        * html/HTMLDetailsElement.cpp:
        (WebCore::DetailsSlotAssignment): Added. Subclasses SlotAssignment to override
        hostChildElementDidChange and slotNameForHostChild.
        (WebCore::DetailsSlotAssignment::hostChildElementDidChange): Added. We don't check if this
        is the first summary element since we don't know the answer when this function is called
        inside Element::removedFrom.
        (WebCore::DetailsSlotAssignment::slotNameForHostChild): Renamed from slotNameFunction. Also
        removed the code to return nullAtom when details element is not open as that messes up new
        fine-grained invalidation. Insert/remove the slot element in parseAttribute instead.
        (WebCore::HTMLDetailsElement::didAddUserAgentShadowRoot): Don't insert the slot element for
        the summary since the details element is not open now.
        (WebCore::HTMLDetailsElement::parseAttribute): Remove and insert the slot element for the
        summary here instead of changing the behavior of slotNameForHostChild.
        * html/HTMLDetailsElement.h:
        * html/HTMLSlotElement.cpp:
        (WebCore::HTMLSlotElement::enqueueSlotChangeEvent): Added. Enqueues a new slotchange event
        if we haven't done so for this element yet.
        (WebCore::HTMLSlotElement::dispatchEvent): Added. Clear m_hasEnqueuedSlotChangeEvent when
        dispatching a slotchange event so that a subsequent call to enqueueSlotChangeEvent would
        enqueue a new event. Note scripts call EventTarget::dispatchEventForBindings instead.
        * html/HTMLSlotElement.h:

2016-03-14  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Introduce CallWith=Document in binding generator
        https://bugs.webkit.org/show_bug.cgi?id=155358

        Reviewed by Darin Adler.

        Covered by existing tests and binding test.

        * Modules/notifications/Notification.cpp:
        (WebCore::Notification::permission): Taking a Document& instead of ScriptExecutionContext&.
        (WebCore::Notification::requestPermission): Ditto.
        * Modules/notifications/Notification.h:
        * Modules/notifications/Notification.idl: Using CallWith=Document.
        * bindings/scripts/CodeGeneratorJS.pm: Adding support for CallWith=Document and changed name from scriptContext to context.
        (GenerateCallWith):
        (GenerateConstructorDefinition):
        * bindings/scripts/IDLAttributes.txt: Adding support for CallWith=Document.
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_with_document_argument):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod2):
        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjWithScriptExecutionContextAttribute):
        (WebCore::jsTestObjWithScriptExecutionContextAttributeRaises):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttribute):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContext):
        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState):
        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException):
        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces):
        (WebCore::jsTestObjPrototypeFunctionWithDocumentArgument):
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj withDocumentArgument]):
        * bindings/scripts/test/TestObj.idl: Adding binding test.
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::focus): Taking a Document& instead of ScriptExecutionContext&.
        (WebCore::DOMWindow::close): Ditto.
        * page/DOMWindow.h:
        * page/DOMWindow.idl:
        * page/History.cpp:
        (WebCore::History::back): Ditto.
        (WebCore::History::forward): Ditto.
        (WebCore::History::go): Ditto.
        * page/History.h:
        * page/History.idl:
        * testing/Internals.cpp:
        (WebCore::InspectorStubFrontend::closeWindow): Calling DOMWindow::close() directly.

2016-03-13  Joseph Pecoraro  <pecoraro@apple.com>

        Remove ENABLE(ES6_TEMPLATE_LITERAL_SYNTAX) guards
        https://bugs.webkit.org/show_bug.cgi?id=155417

        Reviewed by Yusuke Suzuki.

        * Configurations/FeatureDefines.xcconfig:

2016-03-13  Sam Weinig  <sam@webkit.org>

        Implement unprivileged execCommand("copy") and execCommand("cut")
        <rdar://problem/24354406>
        https://bugs.webkit.org/show_bug.cgi?id=146336

        Reviewed by Dean Jackson.

        Test: editing/execCommand/clipboard-access-with-user-gesture.html

        * WebCore.xcodeproj/project.pbxproj:
        Add new files.

        * editing/ClipboardAccessPolicy.h:
        Added.

        * editing/EditorCommand.cpp:
        (WebCore::defaultValueForSupportedCopyCut):
        (WebCore::supportedCopyCut):
        Match other browsers and allow the copy and cut commands
        to be executed when there is a user gesture.

        * page/Settings.h:
        Add include of ClipboardAccessPolicy.h.

        * page/Settings.in:
        Add new setting for ClipboardAccessPolicy

2016-03-13  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION (r190840): crash inside details element's slotNameFunction
        https://bugs.webkit.org/show_bug.cgi?id=155388

        Reviewed by Antti Koivisto.

        The bug was caused by HTMLDetailsElement::isActiveSummary calling findAssignedSlot with a summary element
        inside the shadow tree of the detials element. Fixed it by existing early when the summary element passed
        to isActiveSummary is not a direct child of the details element.

        Test: fast/html/details-summary-tabindex-crash.html

        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::findAssignedSlot): Added an assertion for regression testing.
        * dom/SlotAssignment.cpp:
        (WebCore::SlotAssignment::findAssignedSlot): Removed the superfluous call to assignSlots added in r190840.
        There is no need to update the slot assignments here (entires in m_slots are added or removed by
        addSlotElementByName or removeSlotElementByName and assignSlots only updates assignedNodes in each SlotInfo
        which is never used in this function or findFirstSlotElement.
        * html/HTMLDetailsElement.cpp:
        (WebCore::HTMLDetailsElement::isActiveSummary): Fixed the bug.

2016-03-13  Antti Koivisto  <antti@apple.com>

        ComposedTreeIterator fails to traverse slots if root is shadow host
        https://bugs.webkit.org/show_bug.cgi?id=155407

        Reviewed by Darin Adler.

        Test: fast/shadow-dom/composed-tree-shadow-subtree.html

        * dom/ComposedTreeIterator.cpp:
        (WebCore::ComposedTreeIterator::ComposedTreeIterator):

            Traversal functions assume m_contextStack is deeper than 1 before they need to enter slot traversal code paths.
            Call initializeContextStack in case of shadow host which does the right thing.

        (WebCore::ComposedTreeIterator::traverseSiblingInSlot):
        (WebCore::composedTreeAsText):

            Add option to include pointers as debugging aid.

        * dom/ComposedTreeIterator.h:
        (WebCore::composedTreeChildren):

2016-03-12  Sam Weinig  <sam@webkit.org>

        WebKit can easily crash below NetworkSession::dataTaskForIdentifier() with NSURLSession enabled
        <rdar://problem/25129946>
        https://bugs.webkit.org/show_bug.cgi?id=155401

        Reviewed by Alex Christensen.

        Add a SessionID as a member of NetworkStorageSession. This allows us to avoid having HashMaps
        to map between the two types.

        * platform/network/NetworkStorageSession.h:
        (WebCore::NetworkStorageSession::sessionID):
        (WebCore::NetworkStorageSession::credentialStorage):
        (WebCore::NetworkStorageSession::platformSession):
        * platform/network/NetworkStorageSessionStub.cpp:
        (WebCore::NetworkStorageSession::NetworkStorageSession):
        (WebCore::NetworkStorageSession::context):
        (WebCore::NetworkStorageSession::createPrivateBrowsingSession):
        (WebCore::defaultSession):
        (WebCore::NetworkStorageSession::defaultStorageSession):
        (WebCore::NetworkStorageSession::switchToNewTestingSession):
        * platform/network/cf/NetworkStorageSessionCFNet.cpp:
        (WebCore::NetworkStorageSession::NetworkStorageSession):
        (WebCore::NetworkStorageSession::switchToNewTestingSession):
        (WebCore::NetworkStorageSession::defaultStorageSession):
        (WebCore::NetworkStorageSession::createPrivateBrowsingSession):
        * platform/network/soup/NetworkStorageSessionSoup.cpp:
        (WebCore::NetworkStorageSession::NetworkStorageSession):
        (WebCore::NetworkStorageSession::defaultStorageSession):
        (WebCore::NetworkStorageSession::createPrivateBrowsingSession):
        (WebCore::NetworkStorageSession::switchToNewTestingSession):
        (WebCore::NetworkStorageSession::soupNetworkSession):

2016-03-13  Jon Lee  <jonlee@apple.com>

        getUserMedia requests from the main frame should be treated the same as requests from an iframe with the same origin
        https://bugs.webkit.org/show_bug.cgi?id=155405
        <rdar://problem/25131007>

        Reviewed by Eric Carlson.

        When gUM is called from the main frame, or from a subframe with the same origin, the
        top level document origin should be the same.

        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::userMediaDocumentOrigin): Reverse the logic so that it is similar
        to topLevelDocumentOrigin.
        (WebCore::UserMediaRequest::topLevelDocumentOrigin): Return the top origin always.

2016-03-13  David Kilzer  <ddkilzer@apple.com>

        REGRESSION (r198079): Windows build broke because of "%PRId64" format specifier

        * platform/network/ParsedContentRange.cpp: Add #include
        <wtf/StdLibExtras.h> and remove local definition of "PRId64".

2016-03-13  Joonghun Park  <jh718.park@samsung.com>

        [EFL] Fix debug build error since r197690. Unreviewed.
        https://bugs.webkit.org/show_bug.cgi?id=155408

        Unreviewed. Change %lld to %PRId instead to correct the error below.
        error: format ‘%lld’ expects argument of type ‘long long int’,
        but argument 5 has type ‘std::chrono::duration<long int, std::ratio<1l, 1000l> >::rep
        {aka long int}’ [-Werror=format=]

        * page/DOMTimer.cpp:
        (WebCore::DOMTimer::updateTimerIntervalIfNecessary):

2016-03-12  Myles C. Maxfield  <mmaxfield@apple.com>

        [Cocoa] Remove typedef from NSScrollerImp to ScrollbarPainter
        https://bugs.webkit.org/show_bug.cgi?id=155379

        Reviewed by Beth Dakin.

        There's no reason to not call them what they are.

        No new tests because there is no behavior change.

        * page/scrolling/AsyncScrollingCoordinator.cpp:
        (WebCore::AsyncScrollingCoordinator::frameViewLayoutUpdated):
        * page/scrolling/ScrollingStateFrameScrollingNode.cpp:
        (WebCore::ScrollingStateFrameScrollingNode::ScrollingStateFrameScrollingNode):
        (WebCore::ScrollingStateFrameScrollingNode::setScrollerImpsFromScrollbars):
        (WebCore::ScrollingStateFrameScrollingNode::setScrollbarPaintersFromScrollbars): Deleted.
        * page/scrolling/ScrollingStateFrameScrollingNode.h:
        * page/scrolling/mac/ScrollingStateFrameScrollingNodeMac.mm:
        (WebCore::ScrollingStateFrameScrollingNode::setScrollerImpsFromScrollbars):
        (WebCore::ScrollingStateFrameScrollingNode::setScrollbarPaintersFromScrollbars): Deleted.
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h:
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeMac::ScrollingTreeFrameScrollingNodeMac):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::releaseReferencesToScrollerImpsOnTheMainThread):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::handleWheelEvent):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollLayerPosition):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::releaseReferencesToScrollbarPaintersOnTheMainThread): Deleted.
        * platform/ScrollbarThemeComposite.h:
        * platform/mac/ScrollAnimatorMac.h:
        * platform/mac/ScrollAnimatorMac.mm:
        (scrollbarPainterForScrollbar):
        (-[WebScrollerImpDelegate setUpAlphaAnimation:scrollerPainter:part:animateAlphaTo:duration:]):
        (-[WebScrollerImpDelegate scrollerImp:animateKnobAlphaTo:duration:]):
        (-[WebScrollerImpDelegate scrollerImp:animateTrackAlphaTo:duration:]):
        (-[WebScrollerImpDelegate scrollerImp:animateUIStateTransitionWithDuration:]):
        (-[WebScrollerImpDelegate scrollerImp:animateExpansionTransitionWithDuration:]):
        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
        (WebCore::ScrollAnimatorMac::~ScrollAnimatorMac):
        (WebCore::ScrollAnimatorMac::mouseEnteredScrollbar):
        (WebCore::ScrollAnimatorMac::mouseExitedScrollbar):
        (WebCore::ScrollAnimatorMac::mouseIsDownInScrollbar):
        (WebCore::ScrollAnimatorMac::didAddVerticalScrollbar):
        (WebCore::ScrollAnimatorMac::willRemoveVerticalScrollbar):
        (WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar):
        (WebCore::ScrollAnimatorMac::willRemoveHorizontalScrollbar):
        (WebCore::ScrollAnimatorMac::invalidateScrollbarPartLayers):
        (WebCore::ScrollAnimatorMac::verticalScrollbarLayerDidChange):
        (WebCore::ScrollAnimatorMac::horizontalScrollbarLayerDidChange):
        (WebCore::ScrollAnimatorMac::shouldScrollbarParticipateInHitTesting):
        (WebCore::ScrollAnimatorMac::notifyContentAreaScrolled):
        (WebCore::ScrollAnimatorMac::cancelAnimations):
        (WebCore::ScrollAnimatorMac::updateScrollerStyle):
        (WebCore::ScrollAnimatorMac::initialScrollbarPaintTimerFired):
        (-[WebScrollbarPainterDelegate setUpAlphaAnimation:scrollerPainter:part:animateAlphaTo:duration:]): Deleted.
        (-[WebScrollbarPainterDelegate scrollerImp:animateKnobAlphaTo:duration:]): Deleted.
        (-[WebScrollbarPainterDelegate scrollerImp:animateTrackAlphaTo:duration:]): Deleted.
        (-[WebScrollbarPainterDelegate scrollerImp:animateUIStateTransitionWithDuration:]): Deleted.
        (-[WebScrollbarPainterDelegate scrollerImp:animateExpansionTransitionWithDuration:]): Deleted.
        * platform/mac/ScrollbarThemeMac.h:
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::scrollbarMap):
        (+[WebScrollbarPrefsObserver appearancePrefsChanged:]):
        (WebCore::ScrollbarThemeMac::registerScrollbar):
        (WebCore::ScrollbarThemeMac::setNewPainterForScrollbar):
        (WebCore::ScrollbarThemeMac::painterForScrollbar):
        (WebCore::ScrollbarThemeMac::scrollbarThickness):
        (WebCore::ScrollbarThemeMac::updateScrollbarOverlayStyle):
        (WebCore::ScrollbarThemeMac::hasThumb):
        (WebCore::ScrollbarThemeMac::setPaintCharacteristicsForScrollbar):
        (WebCore::scrollbarPainterPaint):

2016-03-12  Dean Jackson  <dino@apple.com>

        REGRESSION (r188647): Teamtreehouse website sidebar buttons are not rendered
        https://bugs.webkit.org/show_bug.cgi?id=155400
        <rdar://problem/24818602>

        Reviewed by Anders Carlsson.

        When we unprefixed CSS filters we accidentally
        stopped SVG elements that use the CSS filter shorthands
        from rendering. We still don't actually support
        the shorthands in this case, but we should render
        the element without the filter.

        Tests: css3/filters/filters-on-svg-element.html
               css3/filters/filters-on-svg-root.html

        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::hasReferenceFilterOnly): Add
        this new function that tells us if we have the
        style of filter that we can handle in SVG content.
        * rendering/style/RenderStyle.h:
        * rendering/svg/SVGRenderingContext.cpp:
        (WebCore::SVGRenderingContext::prepareToRenderSVGContent):
        We can mark an element as ready to render if it
        has a shorthand filter.

2016-03-12  Myles C. Maxfield  <mmaxfield@apple.com>

        Delete dead SVG Font code
        https://bugs.webkit.org/show_bug.cgi?id=154718

        Reviewed by Antti Koivisto.

        All the ports have adopted the SVG -> OTF Font Converter, so there will never
        be an instantiation of a font backed by a DOM subtree. We can remove all the
        infrastructure used to support that.

        No new tests because there is no behavior change.

        * CMakeLists.txt:
        * Configurations/FeatureDefines.xcconfig:
        * WebCore.order:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::CSSFontFaceSource): Deleted.
        (WebCore::CSSFontFaceSource::font): Deleted.
        * css/CSSFontFaceSource.h:
        * loader/cache/CachedFont.cpp:
        * loader/cache/CachedSVGFont.cpp:
        (WebCore::CachedSVGFont::createFont): Deleted.
        (WebCore::CachedSVGFont::ensureCustomFontData): Deleted.
        * loader/cache/CachedSVGFont.h:
        * platform/graphics/Font.cpp:
        (WebCore::Font::Font):
        (WebCore::fillGlyphPage):
        (WebCore::Font::description): Deleted.
        (WebCore::Font::createScaledFont): Deleted.
        (WebCore::Font::applyTransforms): Deleted.
        * platform/graphics/Font.h:
        (WebCore::Font::widthForGlyph):
        (WebCore::Font::SVGData::~SVGData): Deleted.
        (WebCore::Font::create): Deleted.
        (WebCore::Font::svgData): Deleted.
        (WebCore::Font::isSVGFont): Deleted.
        * platform/graphics/win/FontWin.cpp:
        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::drawText):
        (WebCore::FontCascade::drawEmphasisMarks):
        (WebCore::FontCascade::glyphDataForCharacter):
        (WebCore::FontCascade::adjustSelectionRectForText):
        (WebCore::FontCascade::offsetForPosition):
        (WebCore::FontCascade::drawEmphasisMarksForSimpleText):
        (WebCore::FontCascade::drawGlyphBuffer):
        (WebCore::isDrawnWithSVGFont): Deleted.
        (WebCore::FontCascade::width): Deleted.
        (WebCore::FontCascade::codePath): Deleted.
        * platform/graphics/FontCascade.h:
        * platform/graphics/GraphicsContext.h:
        * platform/graphics/SVGGlyph.cpp: Removed.
        (WebCore::processArabicFormDetection): Deleted.
        (WebCore::charactersWithArabicForm): Deleted.
        (WebCore::isCompatibleArabicForm): Deleted.
        (WebCore::isCompatibleGlyph): Deleted.
        * platform/graphics/SVGGlyph.h: Removed.
        (WebCore::SVGGlyph::SVGGlyph): Deleted.
        (WebCore::SVGGlyph::inheritedValue): Deleted.
        (WebCore::SVGGlyph::operator==): Deleted.
        * platform/graphics/TextRun.cpp:
        * platform/graphics/TextRun.h:
        (WebCore::TextRun::RenderingContext::~RenderingContext): Deleted.
        (WebCore::TextRun::renderingContext): Deleted.
        (WebCore::TextRun::setRenderingContext): Deleted.
        * platform/graphics/WidthIterator.cpp:
        (WebCore::WidthIterator::applyFontTransforms):
        (WebCore::WidthIterator::advanceInternal):
        (WebCore::WidthIterator::glyphDataForCharacter): Deleted.
        * platform/graphics/WidthIterator.h:
        (WebCore::WidthIterator::lastGlyphName): Deleted.
        (WebCore::WidthIterator::setLastGlyphName): Deleted.
        (WebCore::WidthIterator::arabicForms): Deleted.
        * platform/graphics/cairo/FontCairo.cpp:
        (WebCore::CairoGlyphToPathTranslator::advance):
        (WebCore::FontCascade::dashesForIntersectionsWithRect):
        (WebCore::CairoGlyphToPathTranslator::moveToNextValidGlyph): Deleted.
        * platform/graphics/cocoa/FontCascadeCocoa.mm:
        (WebCore::MacGlyphToPathTranslator::advance):
        (WebCore::FontCascade::dashesForIntersectionsWithRect):
        (WebCore::FontCascade::primaryFontIsSystemFont):
        (WebCore::FontCascade::drawEmphasisMarksForComplexText):
        (WebCore::MacGlyphToPathTranslator::moveToNextValidGlyph): Deleted.
        * platform/graphics/harfbuzz/HarfBuzzShaper.cpp:
        (WebCore::HarfBuzzShaper::shapeHarfBuzzRuns): Deleted.
        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::TextLayout::isNeeded):
        (WebCore::TextLayout::TextLayout):
        (WebCore::TextLayout::constructTextRun):
        * rendering/EllipsisBox.cpp:
        (WebCore::EllipsisBox::paint):
        (WebCore::EllipsisBox::selectionRect):
        (WebCore::EllipsisBox::paintSelection):
        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::localSelectionRect):
        (WebCore::InlineTextBox::paint):
        (WebCore::InlineTextBox::paintSelection):
        (WebCore::InlineTextBox::paintCompositionBackground):
        (WebCore::InlineTextBox::paintDocumentMarker):
        (WebCore::InlineTextBox::paintTextMatchMarker):
        (WebCore::InlineTextBox::offsetForPosition):
        (WebCore::InlineTextBox::positionForOffset):
        (WebCore::InlineTextBox::constructTextRun):
        * rendering/InlineTextBox.h:
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::constructTextRun):
        * rendering/RenderBlock.h:
        * rendering/RenderBlockFlow.cpp:
        (WebCore::stripTrailingSpace):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::checkLinesForTextOverflow):
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):
        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::paintObject):
        (WebCore::RenderFileUploadControl::computeIntrinsicLogicalWidths):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::setImageSizeForAltText):
        (WebCore::RenderImage::paintReplaced):
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::updateFromElement):
        * rendering/RenderListMarker.cpp:
        (WebCore::RenderListMarker::paint):
        (WebCore::RenderListMarker::computePreferredLogicalWidths):
        (WebCore::RenderListMarker::getRelativeMarkerRect):
        * rendering/RenderMenuList.cpp:
        (RenderMenuList::updateOptionsWidth):
        * rendering/RenderText.cpp:
        (WebCore::RenderText::widthFromCache):
        (WebCore::RenderText::trimmedPrefWidths):
        (WebCore::hyphenWidth):
        (WebCore::maxWordFragmentWidth):
        (WebCore::RenderText::computePreferredLogicalWidths):
        (WebCore::RenderText::width):
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::getAverageCharWidth):
        * rendering/RenderThemeIOS.mm:
        (WebCore::RenderThemeMeasureTextClient::RenderThemeMeasureTextClient):
        (WebCore::adjustInputElementButtonStyle):
        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::canUseForFontAndText): Deleted.
        * rendering/line/BreakingContext.h:
        (WebCore::WordTrailingSpace::WordTrailingSpace):
        (WebCore::WordTrailingSpace::width):
        (WebCore::measureHyphenWidth):
        (WebCore::textWidth):
        (WebCore::tryHyphenating):
        (WebCore::BreakingContext::handleText):
        * rendering/svg/RenderSVGAllInOne.cpp:
        * rendering/svg/RenderSVGText.cpp:
        * rendering/svg/SVGInlineTextBox.cpp:
        (WebCore::SVGInlineTextBox::prepareGraphicsContextForTextPainting):
        (WebCore::SVGInlineTextBox::restoreGraphicsContextAfterTextPainting):
        (WebCore::SVGInlineTextBox::paintTextWithShadows):
        (WebCore::SVGInlineTextBox::constructTextRun): Deleted.
        * rendering/svg/SVGInlineTextBox.h:
        * rendering/svg/SVGTextLayoutEngine.cpp:
        (WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath):
        * rendering/svg/SVGTextLayoutEngineSpacing.cpp:
        (WebCore::SVGTextLayoutEngineSpacing::calculateSVGKerning): Deleted.
        * rendering/svg/SVGTextLayoutEngineSpacing.h:
        * rendering/svg/SVGTextMetrics.cpp:
        (WebCore::SVGTextMetrics::SVGTextMetrics):
        (WebCore::SVGTextMetrics::constructTextRun): Deleted.
        * rendering/svg/SVGTextMetrics.h:
        * rendering/svg/SVGTextMetricsBuilder.cpp:
        (WebCore::SVGTextMetricsBuilder::advanceSimpleText):
        * rendering/svg/SVGTextRunRenderingContext.cpp: Removed.
        (WebCore::svgFontAndFontFaceElementForFontData): Deleted.
        (WebCore::SVGTextRunRenderingContext::floatWidthUsingSVGFont): Deleted.
        (WebCore::SVGTextRunRenderingContext::applySVGKerning): Deleted.
        (WebCore::SVGGlyphToPathTranslator::SVGGlyphToPathTranslator): Deleted.
        (WebCore::SVGGlyphToPathTranslator::transform): Deleted.
        (WebCore::SVGGlyphToPathTranslator::path): Deleted.
        (WebCore::SVGGlyphToPathTranslator::extents): Deleted.
        (WebCore::SVGGlyphToPathTranslator::moveToNextValidGlyph): Deleted.
        (WebCore::SVGGlyphToPathTranslator::advance): Deleted.
        (WebCore::SVGTextRunRenderingContext::createGlyphToPathTranslator): Deleted.
        (WebCore::SVGTextRunRenderingContext::drawSVGGlyphs): Deleted.
        (WebCore::missingGlyphForFont): Deleted.
        (WebCore::SVGTextRunRenderingContext::glyphDataForCharacter): Deleted.
        * rendering/svg/SVGTextRunRenderingContext.h: Removed.
        * svg/SVGAllInOne.cpp:
        * svg/SVGFontData.cpp: Removed.
        (WebCore::SVGFontData::SVGFontData): Deleted.
        (WebCore::SVGFontData::initializeFont): Deleted.
        (WebCore::SVGFontData::widthForSVGGlyph): Deleted.
        (WebCore::SVGFontData::applySVGGlyphSelection): Deleted.
        (WebCore::SVGFontData::fillSVGGlyphPage): Deleted.
        (WebCore::SVGFontData::fillBMPGlyphs): Deleted.
        (WebCore::SVGFontData::fillNonBMPGlyphs): Deleted.
        (WebCore::computeNormalizedSpaces): Deleted.
        (WebCore::createStringWithMirroredCharacters): Deleted.
        * svg/SVGFontData.h: Removed.
        (WebCore::SVGFontData::~SVGFontData): Deleted.
        (WebCore::SVGFontData::svgFontFaceElement): Deleted.
        (WebCore::SVGFontData::horizontalOriginX): Deleted.
        (WebCore::SVGFontData::horizontalOriginY): Deleted.
        (WebCore::SVGFontData::horizontalAdvanceX): Deleted.
        (WebCore::SVGFontData::verticalOriginX): Deleted.
        (WebCore::SVGFontData::verticalOriginY): Deleted.
        (WebCore::SVGFontData::verticalAdvanceY): Deleted.
        * svg/SVGFontElement.cpp:
        (WebCore::SVGFontElement::SVGFontElement): Deleted.
        (WebCore::SVGFontElement::invalidateGlyphCache): Deleted.
        (WebCore::SVGFontElement::firstMissingGlyphElement): Deleted.
        (WebCore::SVGFontElement::registerLigaturesInGlyphCache): Deleted.
        (WebCore::SVGFontElement::ensureGlyphCache): Deleted.
        (WebCore::SVGKerningMap::clear): Deleted.
        (WebCore::SVGKerningMap::insert): Deleted.
        (WebCore::stringMatchesUnicodeRange): Deleted.
        (WebCore::stringMatchesGlyphName): Deleted.
        (WebCore::stringMatchesUnicodeName): Deleted.
        (WebCore::matches): Deleted.
        (WebCore::kerningForPairOfStringsAndGlyphs): Deleted.
        (WebCore::SVGFontElement::horizontalKerningForPairOfStringsAndGlyphs): Deleted.
        (WebCore::SVGFontElement::verticalKerningForPairOfStringsAndGlyphs): Deleted.
        (WebCore::SVGFontElement::collectGlyphsForString): Deleted.
        (WebCore::SVGFontElement::collectGlyphsForGlyphName): Deleted.
        (WebCore::SVGFontElement::svgGlyphForGlyph): Deleted.
        (WebCore::SVGFontElement::missingGlyph): Deleted.
        * svg/SVGFontElement.h:
        (WebCore::SVGKerning::SVGKerning): Deleted.
        (WebCore::SVGKerningMap::isEmpty): Deleted.
        * svg/SVGGlyphElement.cpp:
        (WebCore::SVGGlyphElement::invalidateGlyphCache): Deleted.
        (WebCore::SVGGlyphElement::parseAttribute): Deleted.
        (WebCore::SVGGlyphElement::insertedInto): Deleted.
        (WebCore::SVGGlyphElement::removedFrom): Deleted.
        (WebCore::parseArabicForm): Deleted.
        (WebCore::parseOrientation): Deleted.
        (WebCore::SVGGlyphElement::inheritUnspecifiedAttributes): Deleted.
        (WebCore::parseSVGGlyphAttribute): Deleted.
        (WebCore::SVGGlyphElement::buildGenericGlyphIdentifier): Deleted.
        (WebCore::SVGGlyphElement::buildGlyphIdentifier): Deleted.
        * svg/SVGGlyphElement.h:
        * svg/SVGGlyphMap.h: Removed.
        (WebCore::GlyphMapNode::GlyphMapNode): Deleted.
        (WebCore::GlyphMapNode::create): Deleted.
        (WebCore::SVGGlyphMap::SVGGlyphMap): Deleted.
        (WebCore::SVGGlyphMap::addGlyph): Deleted.
        (WebCore::SVGGlyphMap::appendToGlyphTable): Deleted.
        (WebCore::SVGGlyphMap::compareGlyphPriority): Deleted.
        (WebCore::SVGGlyphMap::collectGlyphsForString): Deleted.
        (WebCore::SVGGlyphMap::clear): Deleted.
        (WebCore::SVGGlyphMap::svgGlyphForGlyph): Deleted.
        (WebCore::SVGGlyphMap::glyphIdentifierForGlyphName): Deleted.
        * svg/SVGHKernElement.cpp:
        (WebCore::SVGHKernElement::insertedInto): Deleted.
        (WebCore::SVGHKernElement::removedFrom): Deleted.
        * svg/SVGHKernElement.h:
        * svg/SVGToOTFFontConversion.cpp:
        * svg/SVGToOTFFontConversion.h:
        * svg/SVGVKernElement.cpp:
        (WebCore::SVGVKernElement::insertedInto): Deleted.
        (WebCore::SVGVKernElement::removedFrom): Deleted.
        * svg/SVGVKernElement.h:

2016-03-12  Myles C. Maxfield  <mmaxfield@apple.com>

        [OS X] Scrollbars of overflow:scroll divs should appear on the left on RTL systems
        https://bugs.webkit.org/show_bug.cgi?id=155385

        Reviewed by Simon Fraser.

        There is already some existing setup for RTL scrollbars. This patch hooks up this
        existing support to the OS X triggering mechanism introduced in r197956. It also
        fixes up the existing support to function even when the direction of the
        RTL-scrollbar div is LTR (this means the contents of the div must be pushed
        over by the width of the scrollbar).

        Tests: fast/scrolling/rtl-scrollbars-overflow-contents.html
               fast/scrolling/rtl-scrollbars-overflow-dir-rtl.html
               fast/scrolling/rtl-scrollbars-overflow-padding.html
               fast/scrolling/rtl-scrollbars-overflow-simple.html
               fast/scrolling/rtl-scrollbars-overflow.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::addOverflowFromPositionedObjects):
        (WebCore::RenderBlock::logicalLeftOffsetForContent):
        (WebCore::RenderBlock::logicalRightOffsetForContent):
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::determineLogicalLeftPositionForChild):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::overflowClipRect):
        (WebCore::RenderBox::layoutOverflowRectForPropagation):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::computeScrollDimensions):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::shouldPlaceBlockDirectionScrollbarOnLogicalLeft):
        * rendering/style/RenderStyle.h:

2016-03-12  Zalan Bujtas  <zalan@apple.com>

        [Forms: focus] focus rings around text fields do not follow contour (border-radius)
        https://bugs.webkit.org/show_bug.cgi?id=154099
        rdar://problem/9988429

        Reviewed by Tim Horton.

        This patch enables outline-style: auto to follow the curve of border-radius.
        When both border-radius and outline-style: auto are set, the native focusring painting will take the border-radius values
        into account. This is only for outline-style: auto, other non-auto outline styles paint as if there
        was no border-radius set.
        It supports both single and multiline content with joint rectangles.
        However in case of disjoint rectangles, we fallback to the non-radius drawing.

        Tests: fast/inline/hidpi-outline-auto-with-border-radius-horizontal-ltr.html
               fast/inline/hidpi-outline-auto-with-border-radius-horizontal-rtl.html
               fast/inline/hidpi-outline-auto-with-border-radius-vertical-ltr.html
               fast/inline/hidpi-outline-auto-with-border-radius-vertical-rtl.html

        * platform/graphics/GraphicsContext.h:
        * platform/graphics/Path.cpp:
        (WebCore::Path::addBeziersForRoundedRect):
        * platform/graphics/Path.h:
        (WebCore::Path::circleControlPoint):
        * platform/graphics/PathUtilities.cpp:
        (WebCore::polygonsForRect):
        (WebCore::PathUtilities::pathsWithShrinkWrappedRects):
        (WebCore::startAndEndPointsForCorner):
        (WebCore::cornerType):
        (WebCore::controlPointsForBezierCurve):
        (WebCore::adjustedtRadiiForHuggingCurve):
        (WebCore::PathUtilities::pathWithShrinkWrappedRectsForOutline):
        * platform/graphics/PathUtilities.h:
        * platform/graphics/mac/GraphicsContextMac.mm:
        (WebCore::GraphicsContext::drawFocusRing):
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::paintFocusRing):

2016-03-11  Ryosuke Niwa  <rniwa@webkit.org>

        Add Event.deepPath() and Event.scoped
        https://bugs.webkit.org/show_bug.cgi?id=153538
        <rdar://problem/24363836>

        Reviewed by Darin Adler.

        Added the support for deepPath(), scoped, and relatedTargetScoped on Event.prototype for shadow DOM:
        http://w3c.github.io/webcomponents/spec/shadow/#extensions-to-event-interface
        and updated the EventPath class to respect scoped and relatedTargetScoped flags as specified at:
        http://w3c.github.io/webcomponents/spec/shadow/#get-the-parent

        Tests: fast/shadow-dom/Extensions-to-Event-Interface.html
               fast/shadow-dom/trusted-event-scoped-flags.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition): Added the support for Conditional for InitializedByEventConstructor.
        * bindings/scripts/test/GObject/WebKitDOMTestEventConstructor.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestEventConstructor.h:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        * bindings/scripts/test/ObjC/DOMTestEventConstructor.h:
        * bindings/scripts/test/ObjC/DOMTestEventConstructor.mm:
        * bindings/scripts/test/TestEventConstructor.idl: Added a test case for using InitializedByEventConstructor
        with Conditional.
        * dom/Event.cpp:
        (WebCore::Event::Event): Initialize m_scoped and m_relatedTargetScoped from EventInit dictionary.
        (WebCore::Event::scoped): Added. Implements http://w3c.github.io/webcomponents/spec/shadow/#scoped-flag
        (WebCore::Event::deepPath): Added.
        * dom/Event.h:
        (WebCore::Event::relatedTargetScoped): Added. Overridden by FocusEvent and MouseEvent to implement
        http://w3c.github.io/webcomponents/spec/shadow/#relatedtargetscoped-flag
        (WebCore::Event::setEventPath): Added.
        (WebCore::Event::clearEventPath): Added.
        * dom/Event.idl: Added scoped, relatedTargetScoped, and deepPath() conditionally enabled for shadow DOM.
        * dom/EventContext.h:
        (WebCore::EventContext::currentTarget):
        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::dispatchEvent): Set the event path while the event is being dispatched.
        * dom/EventPath.cpp:
        (WebCore::shouldEventCrossShadowBoundary): Check event.scoped flag instead of hard-coding a list of events here
        which has been moved to Event::scoped. See above.
        (WebCore::EventPath::setRelatedTarget): Check m_event.relatedTargetScoped() instead of hard-coding a list of
        events here. relatedTargetScoped is overridden by FocusEvent and MouseEvent.
        (WebCore::EventPath::hasEventListeners): Fixed the misleading variable name.
        (WebCore::isUnclosedNodeOf): Added. Implements http://w3c.github.io/webcomponents/spec/shadow/#dfn-unclosed-node
        (WebCore::EventPath::computePathDisclosedToTarget): Added. Implements the algorithm to filter event targets:
        http://w3c.github.io/webcomponents/spec/shadow/#widl-Event-deepPath-sequence-EventTarget
        * dom/EventPath.h:
        * dom/FocusEvent.cpp:
        (WebCore::FocusEvent::relatedTargetScoped): Returns true when this is a trusted event per:
        http://w3c.github.io/webcomponents/spec/shadow/#relatedtargetscoped-flag
        * dom/FocusEvent.h:
        * dom/MouseEvent.cpp:
        (WebCore::MouseEvent::relatedTargetScoped): Ditto.
        * dom/MouseEvent.h:

2016-03-11  John Wilander  <wilander@apple.com>

        Move prevalent resource classifier from WebCore to WebKit.
        https://bugs.webkit.org/show_bug.cgi?id=155242
        <rdar://problem/24913272>

        Reviewed by Andy Estes.

        No new tests since we have yet to decide how to set up tests for prevalent resources.

        * loader/ResourceLoadObserver.cpp:
        (WebCore::ResourceLoadObserver::logFrameNavigation):
        (WebCore::ResourceLoadObserver::logSubresourceLoading):
            - Removed calls to old classifier in WebCore.
        * loader/ResourceLoadStatistics.cpp:
        (WebCore::encodeHashCountedSet):
        (WebCore::ResourceLoadStatistics::checkAndSetAsPrevalentResourceIfNecessary): Deleted.
        (WebCore::ResourceLoadStatistics::hasPrevalentResourceCharacteristics): Deleted.
        * loader/ResourceLoadStatistics.h:
            - Deleted old classification functions.
        * loader/ResourceLoadStatisticsStore.cpp:
        (WebCore::ResourceLoadStatisticsStore::create):
        (WebCore::ResourceLoadStatisticsStore::fireDataModificationHandler):
        (WebCore::ResourceLoadStatisticsStore::hasEnoughDataForStatisticsProcessing):
            - New function to allow for checks before calls to processStatistics.
        (WebCore::ResourceLoadStatisticsStore::processStatistics):
            - New function that receives a lamda and executes it on every entry in its statistics map.
        * loader/ResourceLoadStatisticsStore.h:

2016-03-11  Jiewen Tan  <jiewen_tan@apple.com>

        WebKit should not be redirected to an invalid URL
        https://bugs.webkit.org/show_bug.cgi?id=155263
        <rdar://problem/22820172>

        Reviewed by Brent Fulgham.

        Test: http/tests/navigation/redirect-to-invalid-url.html

        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::willSendRequestInternal):

2016-03-10  Maksim Kisilev <mkisilev@yandex-team.ru>

        Fix typo in StyleTreeResolver.cpp
        https://bugs.webkit.org/show_bug.cgi?id=139946

        Reviewed by Andy Estes.

        The constructor for CheckForVisibilityChangeOnRecalcStyle was improperly comparing the
        result of WKContentChange() (which is not a function) to WKContentVisibilityChange. I
        believe the above cast would implicitly resolve to WKContentNoChange in all cases,
        whether a visibility change had been observed or not.
        
        This patch corrects this problem. I would expect that this might affect some content
        visibility change behavior, but I'm not sure what the appropriate test case would be
        since this was apparently found through code inspection.

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::CheckForVisibilityChangeOnRecalcStyle::CheckForVisibilityChangeOnRecalcStyle):

2016-03-11  Chris Dumez  <cdumez@apple.com>

        iOS-sim debug: WebCoreNSURLSessionTest.BasicOperation and WebCoreNSURLSessionTest.InvalidateEmpty asserting
        https://bugs.webkit.org/show_bug.cgi?id=155256

        Reviewed by Alexey Proskuryakov.

        r197628 consolidated the runtime application checking code for iOS and
        Mac. However, while the new code works fine for WebKit2, it is unsafe
        on WebKit1 / iOS and hits assertion in debug. The reason is that
        applicationBundleIdentifier() for getting called from several threads
        (WebThread, UIThread).

        To address the problem, this patch renames applicationBundleIdentifier()
        to applicationBundleIdentifierOverride() and only initializes the
        override upon WebProcess and Network process initialization. We therefore
        do not initialize the override in WebKit1 or in the WebKit2 UIProcess.
        When the override is not set, we fall back to using the main bundle
        identifier (which does the right thing for WebKit1 / WebKit2 UIProcess)
        but without caching it to avoid thread safety issues.

        No new tests, already covered by API tests currently crashing.

        * platform/RuntimeApplicationChecks.mm:
        (WebCore::applicationBundleIdentifierOverride):
        - Renamed applicationBundleIdentifier() to applicationBundleIdentifierOverride()
          and only initialize upon initialization of the WebProcess or the Network
          process.
        - In debug, set a flag to indicate that the override was already queried.

        (WebCore::applicationBundleIdentifier):
        New utility function that is returns the application bundle override if it is
        set and fallback to calling [[NSBundle mainBundle] bundleIdentifier] otherwise.

        (WebCore::setApplicationBundleIdentifier):
        Add assertions to make sure that:
        1. This is always called from the main thread.
        2. The application bundle identifier has not been queried *before* getting
           overriden as this would indicate a bug in our code and we would have wrongly
           returned the main bundle identifier in such case.

        (WebCore::MacApplication::isAppleMail):
        (WebCore::MacApplication::isIBooks):
        (WebCore::MacApplication::isITunes):
        (WebCore::MacApplication::isMicrosoftMessenger):
        (WebCore::MacApplication::isAdobeInstaller):
        (WebCore::MacApplication::isMicrosoftOutlook):
        (WebCore::MacApplication::isQuickenEssentials):
        (WebCore::MacApplication::isAperture):
        (WebCore::MacApplication::isVersions):
        (WebCore::MacApplication::isHRBlock):
        (WebCore::MacApplication::isHipChat):
        (WebCore::IOSApplication::isMobileSafari):
        (WebCore::IOSApplication::isDumpRenderTree):
        (WebCore::IOSApplication::isMobileStore):
        (WebCore::IOSApplication::isFacebook):
        (WebCore::IOSApplication::isDaijisenDictionary):
        (WebCore::IOSApplication::isNASAHD):
        (WebCore::IOSApplication::isTheEconomistOnIphone):
        (WebCore::IOSApplication::isWebProcess):
        (WebCore::IOSApplication::isIBooks):
        Drop assertions making sure the cached flag is correct. We now have
        an assertion to detect this earlier in setApplicationBundleIdentifier().

2016-03-10  Jer Noble  <jer.noble@apple.com>

        Web Audio becomes distorted after sample rate changes
        https://bugs.webkit.org/show_bug.cgi?id=154538
        <rdar://problem/24771292>

        Reviewed by Darin Adler.

        When the underlying audio hardware sample rate changes, the AudioUnit render callback will begin asking
        for fewer or more frames. For example, when the sample rate goes from 44.1kHz to 48kHz, it will ask for
        118 samples instead of 128. (And vice-versa, 140 samples instead of 128.) But the Web Audio engine can only
        really handle requests in multiples of 128 samples. In the case where there are requests for < 128 samples,
        actually render 128, but save off the unrequested samples in a separate bus. Then fill that bus during the
        next request.

        * platform/audio/AudioBus.cpp:
        (WebCore::AudioBus::copyFromRange): Added utility method.
        * platform/audio/AudioBus.h:
        * platform/audio/ios/AudioDestinationIOS.cpp:
        (WebCore::AudioDestinationIOS::AudioDestinationIOS): Create a "spare" bus.
        (WebCore::assignAudioBuffersToBus): Moved from inside render.
        (WebCore::AudioDestinationIOS::render): Save off extra samples to the "spare" bus.
        * platform/audio/ios/AudioDestinationIOS.h:

2016-03-11  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed build fix after r198023.
        https://bugs.webkit.org/show_bug.cgi?id=155024

        Reviewed by Geoffrey Garen.

        Update binding test results.

        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjWithScriptExecutionContextAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):

2016-03-11  Ryan Haddad  <ryanhaddad@apple.com>

        Unreviewed, rolling out r197984.

        This change caused an existing LayoutTest to fail

        Reverted changeset:

        "WebKit should not be redirected to an invalid URL"
        https://bugs.webkit.org/show_bug.cgi?id=155263
        http://trac.webkit.org/changeset/197984

2016-03-11  Yusuke Suzuki  <utatane.tea@gmail.com>

        [ES6] Implement Reflect.set without receiver support
        https://bugs.webkit.org/show_bug.cgi?id=155024

        Reviewed by Geoffrey Garen.

        CustomSetter returns boolean value that indicates the result of [[Set]].
        According to this change, this patch modifies the CodeGeneratorJS and test results.

        Currently, DOM elements' [[Set]] return true when the setter is found.
        This is good for the first step.

        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
        (WebCore::JSCSSStyleDeclaration::putDelegate):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::throwSetterTypeError):
        * bindings/js/JSDOMBinding.h:
        * bindings/js/JSDOMStringMapCustom.cpp:
        (WebCore::JSDOMStringMap::putDelegate):
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::updateDocument):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::put):
        (WebCore::JSDOMWindow::putByIndex):
        * bindings/js/JSHTMLAppletElementCustom.cpp:
        (WebCore::JSHTMLAppletElement::putDelegate):
        * bindings/js/JSHTMLEmbedElementCustom.cpp:
        (WebCore::JSHTMLEmbedElement::putDelegate):
        * bindings/js/JSHTMLObjectElementCustom.cpp:
        (WebCore::JSHTMLObjectElement::putDelegate):
        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate):
        (WebCore::JSLocationPrototype::putDelegate):
        * bindings/js/JSPluginElementFunctions.cpp:
        (WebCore::pluginElementCustomPut):
        * bindings/js/JSPluginElementFunctions.h:
        * bindings/js/JSStorageCustom.cpp:
        (WebCore::JSStorage::putDelegate):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        (GeneratePrototypeDeclaration):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::setJSTestActiveDOMObjectConstructor):
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::setJSTestClassWithJSBuiltinConstructorConstructor):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::setJSTestCustomConstructorWithNoInterfaceObjectConstructor):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::setJSTestCustomNamedGetterConstructor):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::setJSTestEventConstructorConstructor):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::setJSTestEventTargetConstructor):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::setJSTestExceptionConstructor):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::setJSTestGenerateIsReachableConstructor):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::setJSTestInterfaceConstructor):
        (WebCore::JSTestInterface::put):
        (WebCore::JSTestInterface::putByIndex):
        (WebCore::setJSTestInterfaceConstructorImplementsStaticAttr):
        (WebCore::setJSTestInterfaceImplementsStr2):
        (WebCore::setJSTestInterfaceImplementsStr3):
        (WebCore::setJSTestInterfaceImplementsNode):
        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
        (WebCore::setJSTestInterfaceSupplementalStr2):
        (WebCore::setJSTestInterfaceSupplementalStr3):
        (WebCore::setJSTestInterfaceSupplementalNode):
        * bindings/scripts/test/JS/JSTestInterface.h:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        (WebCore::setJSTestJSBuiltinConstructorConstructor):
        (WebCore::setJSTestJSBuiltinConstructorTestAttributeRWCustom):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::setJSTestMediaQueryListListenerConstructor):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::setJSTestNamedConstructorConstructor):
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::setJSTestNodeConstructor):
        (WebCore::setJSTestNodeName):
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::setJSTestNondeterministicConstructor):
        (WebCore::setJSTestNondeterministicNondeterministicWriteableAttr):
        (WebCore::setJSTestNondeterministicNondeterministicExceptionAttr):
        (WebCore::setJSTestNondeterministicNondeterministicGetterExceptionAttr):
        (WebCore::setJSTestNondeterministicNondeterministicSetterExceptionAttr):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjConstructor):
        (WebCore::setJSTestObjConstructorStaticStringAttr):
        (WebCore::setJSTestObjTestSubObjEnabledBySettingConstructor):
        (WebCore::setJSTestObjEnumAttr):
        (WebCore::setJSTestObjByteAttr):
        (WebCore::setJSTestObjOctetAttr):
        (WebCore::setJSTestObjShortAttr):
        (WebCore::setJSTestObjUnsignedShortAttr):
        (WebCore::setJSTestObjLongAttr):
        (WebCore::setJSTestObjLongLongAttr):
        (WebCore::setJSTestObjUnsignedLongLongAttr):
        (WebCore::setJSTestObjStringAttr):
        (WebCore::setJSTestObjTestObjAttr):
        (WebCore::setJSTestObjLenientTestObjAttr):
        (WebCore::setJSTestObjStringAttrTreatingNullAsEmptyString):
        (WebCore::setJSTestObjXMLObjAttr):
        (WebCore::setJSTestObjCreate):
        (WebCore::setJSTestObjReflectedStringAttr):
        (WebCore::setJSTestObjReflectedIntegralAttr):
        (WebCore::setJSTestObjReflectedUnsignedIntegralAttr):
        (WebCore::setJSTestObjReflectedBooleanAttr):
        (WebCore::setJSTestObjReflectedURLAttr):
        (WebCore::setJSTestObjReflectedCustomIntegralAttr):
        (WebCore::setJSTestObjReflectedCustomBooleanAttr):
        (WebCore::setJSTestObjReflectedCustomURLAttr):
        (WebCore::setJSTestObjTypedArrayAttr):
        (WebCore::setJSTestObjAttrWithGetterException):
        (WebCore::setJSTestObjAttrWithGetterExceptionWithMessage):
        (WebCore::setJSTestObjAttrWithSetterException):
        (WebCore::setJSTestObjAttrWithSetterExceptionWithMessage):
        (WebCore::setJSTestObjStringAttrWithGetterException):
        (WebCore::setJSTestObjStringAttrWithSetterException):
        (WebCore::setJSTestObjStrictTypeCheckingAttribute):
        (WebCore::setJSTestObjCustomAttr):
        (WebCore::setJSTestObjOnfoo):
        (WebCore::setJSTestObjWithScriptStateAttribute):
        (WebCore::setJSTestObjWithCallWithAndSetterCallWithAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAttribute):
        (WebCore::setJSTestObjWithScriptStateAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
        (WebCore::setJSTestObjWithScriptArgumentsAndCallStackAttribute):
        (WebCore::setJSTestObjConditionalAttr1):
        (WebCore::setJSTestObjConditionalAttr2):
        (WebCore::setJSTestObjConditionalAttr3):
        (WebCore::setJSTestObjConditionalAttr4Constructor):
        (WebCore::setJSTestObjConditionalAttr5Constructor):
        (WebCore::setJSTestObjConditionalAttr6Constructor):
        (WebCore::setJSTestObjAnyAttribute):
        (WebCore::setJSTestObjMutablePoint):
        (WebCore::setJSTestObjImmutablePoint):
        (WebCore::setJSTestObjStrawberry):
        (WebCore::setJSTestObjStrictFloat):
        (WebCore::setJSTestObjId):
        (WebCore::setJSTestObjReplaceableAttribute):
        (WebCore::setJSTestObjNullableLongSettableAttribute):
        (WebCore::setJSTestObjNullableStringSettableAttribute):
        (WebCore::setJSTestObjNullableStringValue):
        (WebCore::setJSTestObjAttributeWithReservedEnumType):
        (WebCore::setJSTestObjPutForwardsAttribute):
        (WebCore::setJSTestObjPutForwardsNullableAttribute):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::setJSTestOverloadedConstructorsConstructor):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::setJSTestOverrideBuiltinsConstructor):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::setJSTestSerializedScriptValueInterfaceConstructor):
        (WebCore::setJSTestSerializedScriptValueInterfaceValue):
        (WebCore::setJSTestSerializedScriptValueInterfaceCachedValue):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::setJSTestTypedefsConstructor):
        (WebCore::setJSTestTypedefsUnsignedLongLongAttr):
        (WebCore::setJSTestTypedefsImmutableSerializedScriptValue):
        (WebCore::setJSTestTypedefsAttrWithGetterException):
        (WebCore::setJSTestTypedefsAttrWithSetterException):
        (WebCore::setJSTestTypedefsStringAttrWithGetterException):
        (WebCore::setJSTestTypedefsStringAttrWithSetterException):
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::setJSattributeConstructor):
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::setJSreadonlyConstructor):
        * bridge/c/c_runtime.cpp:
        (JSC::Bindings::CField::setValueToInstance):
        * bridge/c/c_runtime.h:
        * bridge/jsc/BridgeJSC.h:
        (JSC::Bindings::Instance::put):
        * bridge/objc/objc_runtime.h:
        * bridge/objc/objc_runtime.mm:
        (JSC::Bindings::ObjcField::setValueToInstance):
        (JSC::Bindings::ObjcArray::setValueAt):
        (JSC::Bindings::ObjcFallbackObjectImp::put):
        * bridge/runtime_array.cpp:
        (JSC::RuntimeArray::put):
        (JSC::RuntimeArray::putByIndex):
        * bridge/runtime_array.h:
        * bridge/runtime_object.cpp:
        (JSC::Bindings::RuntimeObject::put):
        * bridge/runtime_object.h:

2016-03-11  David Kilzer  <ddkilzer@apple.com>

        REGRESSION (r197956): WebContent process crashes on launch due to unrecognized selector
        <http://webkit.org/b/155356>

        Reviewed by Alexey Proskuryakov.

        * platform/mac/ScrollableAreaMac.mm:
        (WebCore::ScrollableArea::systemLanguageIsRTL): Add
        -respondsToSelector: check.

2016-03-11  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        WTF should have a similar function as equalLettersIgnoringASCIICase to match beginning of strings
        https://bugs.webkit.org/show_bug.cgi?id=153419

        Reviewed by Darin Adler.

        Covered by added unint tests.

        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::isForbiddenHeaderName): Using startsWithLettersIgnoringASCIICase.

2016-03-11  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Use DeferredWrapper directly in FetchBody promise handling
        https://bugs.webkit.org/show_bug.cgi?id=155291

        Reviewed by Darin Adler.

        Moved from typed DOMPromise to DeferredWrapper as there can only be one promise resolved.
        Started preparing the handling of blobs translation to other resolved types.

        Fixed the case of empty body, in which case promises should resolve with empty objects (strings, buffers...) and not null.

        Added Consumer structure to handle asynchronous resolution/rejection of promises.
        Added preliminary API to resolve promises based on data stored as a Blob.
        FetchBodyOwner will be responsible to do/stop blob loading.

        Tests: imported/w3c/web-platform-tests/fetch/api/request/request-consume-empty.html
               imported/w3c/web-platform-tests/fetch/api/response/response-consume-empty.html

        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::processIfEmptyOrDisturbed): Fixed empty body case.
        (WebCore::FetchBody::arrayBuffer):
        (WebCore::FetchBody::blob):
        (WebCore::FetchBody::json):
        (WebCore::FetchBody::text):
        (WebCore::FetchBody::consume):
        (WebCore::FetchBody::consumeText):
        (WebCore::FetchBody::loadingType):
        (WebCore::FetchBody::consumeBlob):
        (WebCore::FetchBody::resolveAsJSON):
        (WebCore::FetchBody::loadingFailed):
        (WebCore::FetchBody::loadedAsBlob):
        * Modules/fetch/FetchBody.h:
        (WebCore::FetchBody::formData):
        (WebCore::FetchBody::Consumer::Consumer):
        * Modules/fetch/FetchBody.idl:
        * Modules/fetch/FetchBodyOwner.h:
        (WebCore::FetchBodyOwner::arrayBuffer):
        (WebCore::FetchBodyOwner::blob):
        (WebCore::FetchBodyOwner::formData):
        (WebCore::FetchBodyOwner::json):
        (WebCore::FetchBodyOwner::text):
        (WebCore::FetchBodyOwner::loadBlob):

2016-03-11  Yoav Weiss  <yoav@yoav.ws>

        Avoid applying link tags with an invalid media attribute
        https://bugs.webkit.org/show_bug.cgi?id=143262

        Reviewed by Brent Fulgham.

        In current HTML spec, unlike HTML4, the UA must not apply <link> based resources
        when the media attribute does not match:
        https://html.spec.whatwg.org/multipage/semantics.html#attr-link-media

        An invalid media attribute parsing creates a non-empty MediaQuerySet
        containing a single query with no expressions and no media type.
        (and with its m_ignored flag off)

        In order to ignore such MediaQueries, I added an extra check that makes sure
        that the queries handled by MediaQueryEvaluator::eval have either expressions
        or a media type, and if not, they are ignored.

        Test: fast/dom/HTMLLinkElement/link-stylesheet-invalid-media.html

        * css/MediaQueryEvaluator.cpp:
        (WebCore::MediaQueryEvaluator::eval):

2016-03-11  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [CallWith=ScriptExecutionContext] should pass ScriptExecutionContext to the implementation by reference
        https://bugs.webkit.org/show_bug.cgi?id=155297

        Reviewed by Darin Adler.

        Changing the binding generator to pass ScriptExecutionContext by reference.
        Updating DOM classes accordingly.

        Covered by existing tests.

        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::create):
        (WebCore::MediaKeySession::MediaKeySession):
        * Modules/encryptedmedia/MediaKeySession.h:
        * Modules/encryptedmedia/MediaKeys.cpp:
        (WebCore::MediaKeys::createSession):
        * Modules/encryptedmedia/MediaKeys.h:
        * Modules/fetch/FetchRequest.cpp:
        (WebCore::FetchRequest::clone):
        * Modules/fetch/FetchRequest.h:
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::error):
        (WebCore::FetchResponse::redirect):
        (WebCore::FetchResponse::clone):
        * Modules/fetch/FetchResponse.h:
        * Modules/indexeddb/IDBCursor.h:
        (WebCore::IDBCursor::continueFunction):
        * Modules/indexeddb/IDBFactory.h:
        * Modules/indexeddb/IDBIndex.h:
        * Modules/indexeddb/IDBKeyRange.cpp:
        (WebCore::IDBKeyRange::lowerValue):
        (WebCore::IDBKeyRange::upperValue):
        (WebCore::IDBKeyRange::only):
        (WebCore::IDBKeyRange::lowerBound):
        (WebCore::IDBKeyRange::upperBound):
        (WebCore::IDBKeyRange::bound):
        * Modules/indexeddb/IDBKeyRange.h:
        (WebCore::IDBKeyRange::lowerBound):
        (WebCore::IDBKeyRange::upperBound):
        (WebCore::IDBKeyRange::bound):
        * Modules/indexeddb/IDBObjectStore.h:
        * Modules/indexeddb/IDBOpenDBRequest.cpp:
        (WebCore::IDBOpenDBRequest::IDBOpenDBRequest):
        * Modules/indexeddb/IDBOpenDBRequest.h:
        * Modules/indexeddb/IDBRequest.cpp:
        (WebCore::IDBRequest::IDBRequest):
        * Modules/indexeddb/IDBRequest.h:
        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::continueFunction):
        (WebCore::IDBClient::IDBCursor::deleteFunction):
        * Modules/indexeddb/client/IDBCursorImpl.h:
        * Modules/indexeddb/client/IDBFactoryImpl.cpp:
        (WebCore::IDBClient::shouldThrowSecurityException):
        (WebCore::IDBClient::IDBFactory::getDatabaseNames):
        (WebCore::IDBClient::IDBFactory::open):
        (WebCore::IDBClient::IDBFactory::openInternal):
        (WebCore::IDBClient::IDBFactory::deleteDatabase):
        (WebCore::IDBClient::IDBFactory::cmp):
        * Modules/indexeddb/client/IDBFactoryImpl.h:
        * Modules/indexeddb/client/IDBIndexImpl.cpp:
        (WebCore::IDBClient::IDBIndex::IDBIndex):
        (WebCore::IDBClient::IDBIndex::openCursor):
        (WebCore::IDBClient::IDBIndex::count):
        (WebCore::IDBClient::IDBIndex::openKeyCursor):
        (WebCore::IDBClient::IDBIndex::get):
        (WebCore::IDBClient::IDBIndex::getKey):
        * Modules/indexeddb/client/IDBIndexImpl.h:
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::create):
        (WebCore::IDBClient::IDBObjectStore::IDBObjectStore):
        (WebCore::IDBClient::IDBObjectStore::openCursor):
        (WebCore::IDBClient::IDBObjectStore::get):
        (WebCore::IDBClient::IDBObjectStore::deleteFunction):
        (WebCore::IDBClient::IDBObjectStore::doDelete):
        (WebCore::IDBClient::IDBObjectStore::modernDelete):
        (WebCore::IDBClient::IDBObjectStore::clear):
        (WebCore::IDBClient::IDBObjectStore::createIndex):
        (WebCore::IDBClient::IDBObjectStore::index):
        (WebCore::IDBClient::IDBObjectStore::count):
        * Modules/indexeddb/client/IDBObjectStoreImpl.h:
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::createDeleteRequest):
        (WebCore::IDBClient::IDBOpenDBRequest::createOpenRequest):
        (WebCore::IDBClient::IDBOpenDBRequest::IDBOpenDBRequest):
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.h:
        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::IDBRequest):
        * Modules/indexeddb/client/IDBRequestImpl.h:
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::objectStore):
        (WebCore::IDBClient::IDBTransaction::createObjectStore):
        (WebCore::IDBClient::IDBTransaction::createIndex):
        * Modules/mediasource/DOMURLMediaSource.cpp:
        (WebCore::DOMURLMediaSource::createObjectURL):
        * Modules/mediasource/DOMURLMediaSource.h:
        * Modules/mediastream/DOMURLMediaStream.cpp:
        (WebCore::DOMURLMediaStream::createObjectURL):
        * Modules/mediastream/DOMURLMediaStream.h:
        * Modules/mediastream/HTMLMediaElementMediaStream.cpp:
        (WebCore::HTMLMediaElementMediaStream::setSrcObject):
        * Modules/mediastream/HTMLMediaElementMediaStream.h:
        * Modules/mediastream/HTMLMediaElementMediaStream.idl:
        * Modules/notifications/Notification.cpp:
        (WebCore::Notification::Notification):
        (WebCore::Notification::create):
        (WebCore::Notification::permission):
        (WebCore::Notification::requestPermission):
        * Modules/notifications/Notification.h:
        * Modules/notifications/NotificationCenter.cpp:
        (WebCore::NotificationCenter::createNotification):
        * Modules/notifications/NotificationClient.h:
        * Modules/quota/StorageInfo.cpp:
        (WebCore::StorageInfo::queryUsageAndQuota):
        (WebCore::StorageInfo::requestQuota):
        * Modules/quota/StorageInfo.h:
        * Modules/quota/StorageQuota.h:
        * bindings/js/JSIDBObjectStoreCustom.cpp:
        (WebCore::JSIDBObjectStore::createIndex):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateCallWith):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod2):
        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjWithScriptExecutionContextAttribute):
        (WebCore::jsTestObjWithScriptExecutionContextAttributeRaises):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttribute):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContext):
        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState):
        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException):
        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces):
        * fileapi/FileReaderSync.cpp:
        (WebCore::FileReaderSync::readAsArrayBuffer):
        (WebCore::FileReaderSync::readAsBinaryString):
        (WebCore::FileReaderSync::readAsText):
        (WebCore::FileReaderSync::readAsDataURL):
        (WebCore::FileReaderSync::startLoading):
        * fileapi/FileReaderSync.h:
        (WebCore::FileReaderSync::readAsText):
        * html/DOMURL.cpp:
        (WebCore::DOMURL::createObjectURL):
        (WebCore::DOMURL::createPublicURL):
        (WebCore::DOMURL::revokeObjectURL):
        * html/DOMURL.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setSrcObject):
        * html/HTMLMediaElement.h:
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore::InspectorIndexedDBAgent::requestDatabaseNames):
        * page/DOMWindow.h:
        * page/History.h:
        (WebCore::History::back):
        (WebCore::History::forward):
        (WebCore::History::go):

2016-03-10  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Fix rendering of slider input elements
        https://bugs.webkit.org/show_bug.cgi?id=155296

        Reviewed by Michael Catanzaro.

        Use the new gadgets for newer GTK+ and improve a bit the rendering
        for previous versions to better match GTK+.

        * rendering/RenderThemeGtk.cpp:
        (WebCore::createStyleContext): Add ScaleContents and
        ScaleHighlight parts that are only used with GTK+ 3.19.
        (WebCore::RenderThemeGtk::paintSliderTrack): Use a smaller trough,
        centered in the given rectangle to better match GTK+. Also render
        the hightlight gadget with GTK+ 3.19.
        (WebCore::RenderThemeGtk::paintSliderThumb): Also create the style
        context for contents gadget.
        (WebCore::RenderThemeGtk::adjustSliderThumbSize): Take into
        account the slider border when calculating the slider thumb size.

2016-03-10  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Scrollbars are broken once again with current GTK+ master
        https://bugs.webkit.org/show_bug.cgi?id=155292

        Reviewed by Michael Catanzaro.

        Most of the trough theming properties have been moved to the
        scrollbar, and a new gadget "contents" has been added between the
        scrollbar and its children.

        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::getOrCreateStyleContext): Add
        left/bottom style classes to ensure the scrollbars border is taken
        into account and rendered.
        (WebCore::ScrollbarThemeGtk::paintTrackBackground): Also create
        style context for contents gadget.
        (WebCore::ScrollbarThemeGtk::paintThumb): Ditto.
        (WebCore::ScrollbarThemeGtk::paintButton): Ditto.
        (WebCore::ScrollbarThemeGtk::scrollbarThickness): Take the
        scrollbar border into account.
        (WebCore::ScrollbarThemeGtk::buttonSize): Also create style
        context for contents gadget.
        (WebCore::ScrollbarThemeGtk::getStepperSpacing): Ditto.
        (WebCore::ScrollbarThemeGtk::minimumThumbLength): Ditto.
        (WebCore::ScrollbarThemeGtk::thumbFatness): Ditto.
        (WebCore::ScrollbarThemeGtk::getTroughBorder): Take the scrollbar
        border into account.

2016-03-10  David Kilzer  <ddkilzer@apple.com>

        REGRESSION (r197983): Build fails due to missing inline method

        Attempt to fix the following build failure:

            Undefined symbols for architecture arm64:
              "JSC::GenericTypedArrayView<JSC::Uint8ClampedAdaptor>::createUninitialized(unsigned int)", referenced from:
                  WebCore::ImageBufferData::getData(WebCore::IntRect const&, WebCore::IntSize const&, bool, bool, float) const in ImageBufferDataCG.o

        * platform/graphics/cg/ImageBufferDataCG.cpp: Include some
        headers to match FEGaussianBlur.cpp and FilterEffect.cpp.

2016-03-10  Tim Horton  <timothy_horton@apple.com>

        Try to fix the iOS 9 build.

        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::detectContentInRange):
        * platform/cocoa/DataDetectorsCoreSoftLink.h:
        * platform/cocoa/DataDetectorsCoreSoftLink.mm:
        * platform/spi/cocoa/DataDetectorsCoreSPI.h:

2016-03-10  David Kilzer  <ddkilzer@apple.com>

        REGRESSION (r197976): Build failure due to missing DDOptionalSource.h header

        Follow-up fix for:
            Expose additional WKDataDetectorTypes.
            <https://bugs.webkit.org/show_bug.cgi?id=155331>

        * platform/spi/cocoa/DataDetectorsCoreSPI.h: Protect
        DDOptionalSource.h with version check.

2016-03-10  Alex Christensen  <achristensen@webkit.org>

        Fix Windows build after r197986.

        * accessibility/AccessibilityObject.h:

2016-03-10  Jeremy Jones  <jeremyj@apple.com>

        Set AVURLAssetUsesNoPersistentCacheKey on AVAsset to match caching policy.
        https://bugs.webkit.org/show_bug.cgi?id=155117
        rdar://problem/6802240

        Reviewed by Simon Fraser.

        No new tests because no new functionality was added.

        This will prevent persistent media caches when webkit is using in memory caching.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerShouldUsePersistentCache): Added.
        * html/HTMLMediaElement.h: Declare mediaPlayerShouldUsePersistentCache().
        * page/ChromeClient.h: Declare mediaPlayerShouldUsePersistentCache().
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerShouldUsePersistentCache): Added.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Set property on AVAssetOptions.

2016-03-10  Jer Noble  <jer.noble@apple.com>

        CRASH at WebCore::RenderView::updateVisibleViewportRect
        https://bugs.webkit.org/show_bug.cgi?id=155209
        <rdar://problem/23997530>

        Reviewed by Simon Fraser.

        Test: media/video-crash-invisible-autoplay-display-none.html

        Between the time when the video element's renderer is created and destroyed, we may have unset the
        InvisibleAutoplayNotPermitted restriction. So rather than check for that restriction before
        unregistering for the "visible in viewport" notification, unregister only if the renderer
        was previously registered.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::willDetachRenderers):

2016-03-10  Zalan Bujtas  <zalan@apple.com>

        Simple line layout: Add text-align: justify support.
        https://bugs.webkit.org/show_bug.cgi?id=155006

        Reviewed by Antti Koivisto.

        This patch enables text-align: justify; for simple line layout (only latin text for now).
        It speeds up/reduced memory consumption for justified text.

        PerformanceTests/Layout/line-layout-simple.html
        before text-align: justify support -> mean: 86.20513022288704 runs/s
        after -> mean: 96.73972475626084 runs/s

        Covered by existing text-align: justify tests.

        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::canUseForFontAndText):
        (WebCore::SimpleLineLayout::LineState::expansionOpportunityCount):
        (WebCore::SimpleLineLayout::LineState::expansionOportunity):
        (WebCore::SimpleLineLayout::expansionBehavior):
        (WebCore::SimpleLineLayout::justifyRuns):
        (WebCore::SimpleLineLayout::closeLineEndingAndAdjustRuns):
        (WebCore::SimpleLineLayout::createTextRuns):
        (WebCore::SimpleLineLayout::printReason):
        (WebCore::SimpleLineLayout::canUseForStyle): Deleted.
        * rendering/SimpleLineLayout.h:
        * rendering/SimpleLineLayoutFunctions.cpp:
        (WebCore::SimpleLineLayout::paintFlow):
        * rendering/SimpleLineLayoutResolver.h:
        (WebCore::SimpleLineLayout::RunResolver::Run::expansion):
        (WebCore::SimpleLineLayout::RunResolver::Run::expansionBehavior):

2016-03-10  Nan Wang  <n_wang@apple.com>

        AX: Force allow user zoom
        https://bugs.webkit.org/show_bug.cgi?id=155056

        Reviewed by Simon Fraser.

        Override the maximum/minimum scale factor when forceAlwaysUserScalable is true.

        Test: fast/viewport/ios/force-always-user-scalable.html

        * Configurations/WebCoreTestSupport.xcconfig:
        * page/ViewportConfiguration.cpp:
        (WebCore::ViewportConfiguration::minimumScale):
        * page/ViewportConfiguration.h:
        (WebCore::ViewportConfiguration::maximumScale):
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::Internals):
        (WebCore::Internals::composedTreeAsText):
        (WebCore::Internals::setViewportForceAlwaysUserScalable):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-03-10  Jiewen Tan  <jiewen_tan@apple.com>

        WebKit should not be redirected to an invalid URL
        https://bugs.webkit.org/show_bug.cgi?id=155263
        <rdar://problem/22820172>

        Reviewed by Brent Fulgham.

        Test: http/tests/navigation/redirect-to-invalid-url.html

        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::willSendRequestInternal):

2016-03-10  Nan Wang  <n_wang@apple.com>

        AX: Implement bounds/position and index related text marker functions using TextIterator
        https://bugs.webkit.org/show_bug.cgi?id=154976

        Reviewed by Chris Fleizach.

        Implemented position and index related text marker calls with TextIterator. Also fixed some
        VoiceOver navigation issues.

        Test: accessibility/mac/text-marker-for-index.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::traverseToOffsetInRange):
        (WebCore::AXObjectCache::startOrEndCharacterOffsetForRange):
        (WebCore::AXObjectCache::textMarkerDataForCharacterOffset):
        (WebCore::AXObjectCache::shouldSkipBoundary):
        (WebCore::AXObjectCache::textMarkerDataForNextCharacterOffset):
        (WebCore::AXObjectCache::startCharacterOffsetOfWord):
        (WebCore::AXObjectCache::nextBoundary):
        (WebCore::AXObjectCache::previousBoundary):
        (WebCore::AXObjectCache::previousSentenceStartCharacterOffset):
        (WebCore::AXObjectCache::localCaretRectForCharacterOffset):
        (WebCore::AXObjectCache::absoluteCaretBoundsForCharacterOffset):
        (WebCore::AXObjectCache::characterOffsetForPoint):
        (WebCore::AXObjectCache::characterOffsetForBounds):
        (WebCore::AXObjectCache::endCharacterOffsetOfLine):
        (WebCore::AXObjectCache::startCharacterOffsetOfLine):
        (WebCore::AXObjectCache::characterOffsetForIndex):
        (WebCore::AXObjectCache::indexForCharacterOffset):
        (WebCore::AXObjectCache::rootAXEditableElement):
        * accessibility/AXObjectCache.h:
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::visiblePositionRangeForRange):
        (WebCore::AccessibilityObject::rangeForPlainTextRange):
        (WebCore::AccessibilityObject::lineRangeForPosition):
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::boundsForVisiblePositionRange):
        (WebCore::AccessibilityObject::boundsForRange):
        (WebCore::AccessibilityObject::setSelectedVisiblePositionRange):
        (WebCore::AccessibilityObject::doAXStringForRange):
        (WebCore::AccessibilityObject::doAXBoundsForRange):
        (WebCore::AccessibilityObject::doAXBoundsForRangeUsingCharacterOffset):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::nodeIsTextControl):
        (WebCore::AccessibilityRenderObject::boundsForRects):
        (WebCore::AccessibilityRenderObject::boundsForVisiblePositionRange):
        (WebCore::AccessibilityRenderObject::boundsForRange):
        (WebCore::AccessibilityRenderObject::setSelectedVisiblePositionRange):
        (WebCore::AccessibilityRenderObject::doAXBoundsForRange):
        (WebCore::AccessibilityRenderObject::doAXBoundsForRangeUsingCharacterOffset):
        (WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):
        * accessibility/AccessibilityRenderObject.h:
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper positionForTextMarker:]):
        (-[WebAccessibilityObjectWrapper textMarkerRange]):
        (-[WebAccessibilityObjectWrapper textMarkerRangeForSelection]):
        (-[WebAccessibilityObjectWrapper textMarkerForPosition:]):
        (-[WebAccessibilityObjectWrapper _stringForRange:attributed:]):
        (-[WebAccessibilityObjectWrapper frameForTextMarkers:]):
        (-[WebAccessibilityObjectWrapper textMarkerForPoint:]):
        (-[WebAccessibilityObjectWrapper nextMarkerForCharacterOffset:]):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper doAXAttributedStringForRange:]):
        (-[WebAccessibilityObjectWrapper _convertToNSRange:]):
        (-[WebAccessibilityObjectWrapper _indexForTextMarker:]):
        (-[WebAccessibilityObjectWrapper _textMarkerForIndex:]):
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
        * editing/htmlediting.cpp:
        (WebCore::localCaretRectInRendererForCaretPainting):
        (WebCore::localCaretRectInRendererForRect):
        * editing/htmlediting.h:

2016-03-10  Simon Fraser  <simon.fraser@apple.com>

        Font antialiasing (smoothing) changes when elements are rendered into compositing layers
        https://bugs.webkit.org/show_bug.cgi?id=23364

        Reviewed by Tim Horton.

        Improve the appearance of subpixel-antialiased ("smoothed") text in non-opaque layers
        by opting in to a new CALayer backing store format.

        GraphicsLayer now has setSupportsSmoothedFonts(), which is called by RenderLayerBacking
        when the platform has support for the new feature. Ideally this would only be set when
        we know a layer has smoothed text drawn into it, but, for now, enable this for all
        layers. The right thing happens with opaque layers under the hood.

        setSupportsSmoothedFonts() is turned into a PlatformCALayer contentsFormat flag, which
        is ultimately passed to setBackingStoreFormat().

        We also need to propagate this flag to TileController tiles.

        * platform/graphics/GraphicsLayer.cpp:
        (WebCore::GraphicsLayer::supportsSmoothedLayerText):
        (WebCore::GraphicsLayer::setSmoothedLayerTextEnabled):
        (WebCore::GraphicsLayer::smoothedLayerTextEnabled):
        (WebCore::GraphicsLayer::GraphicsLayer):
        * platform/graphics/GraphicsLayer.h:
        (WebCore::GraphicsLayer::supportsSmoothedFonts):
        (WebCore::GraphicsLayer::setSupportsSmoothedFonts):
        * platform/graphics/TiledBacking.h:
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayer::supportsSmoothedLayerText):
        (WebCore::GraphicsLayer::setSmoothedLayerTextEnabled):
        (WebCore::GraphicsLayer::smoothedLayerTextEnabled):
        (WebCore::GraphicsLayerCA::setSupportsSmoothedFonts):
        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
        (WebCore::GraphicsLayerCA::updateContentsFormat):
        * platform/graphics/ca/GraphicsLayerCA.h:
        * platform/graphics/ca/PlatformCALayer.cpp:
        (WebCore::PlatformCALayer::drawRepaintIndicator): Give the number a "shadow" when
        the contents format says we support smoothed fonts.
        * platform/graphics/ca/PlatformCALayer.h:
        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::setTileContentsFormatFlags):
        (WebCore::TileController::createTileLayer):
        * platform/graphics/ca/TileController.h:
        * platform/graphics/ca/TileGrid.cpp:
        (WebCore::TileGrid::updateTileLayerProperties):
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.h:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (WebCore::setBackingStoreFormat):
        (PlatformCALayerCocoa::commonInit):
        (PlatformCALayerCocoa::setContentsFormat):
        (PlatformCALayer::drawLayerContents): Previously, we turned off font smoothing in
        non-opaque layers to improve text appearance. We no longer need to do that when
        the contents format has "SmoothedFonts".
        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
        (PlatformCALayerWin::setContentsFormat):
        (PlatformCALayerWin::contentsFormat):
        * platform/graphics/ca/win/PlatformCALayerWin.h:
        * platform/ios/LegacyTileGridTile.mm:
        (WebCore::setBackingStoreFormat):
        (WebCore::LegacyTileGridTile::LegacyTileGridTile):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::createGraphicsLayer):

2016-03-10  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197922.
        https://bugs.webkit.org/show_bug.cgi?id=155340

        This change broke storage/websql tests on ios-simulator.
        (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "WebKit should adopt journal_mode=wal for all SQLite
        databases."
        https://bugs.webkit.org/show_bug.cgi?id=133496
        http://trac.webkit.org/changeset/197922

2016-03-10  Tim Horton  <timothy_horton@apple.com>

        Fix the build again.

        * editing/cocoa/DataDetection.mm:
        (WebCore::constructURLStringForResult):

2016-03-10  Tim Horton  <timothy_horton@apple.com>

        Fix the build.

        * editing/cocoa/DataDetection.mm:

2016-03-10  Enrica Casucci  <enrica@apple.com>

        Expose additional WKDataDetectorTypes.
        https://bugs.webkit.org/show_bug.cgi?id=155331
        rdar://problem/24175813

        Reviewed by Tim Horton.

        Adding support for additional data detector types (tracking
        numbers, flight information and spotlight suggestions).

        * editing/cocoa/DataDetection.h:
        * editing/cocoa/DataDetection.mm:
        (WebCore::constructURLStringForResult):
        (WebCore::DataDetection::detectContentInRange):
        * platform/cocoa/DataDetectorsCoreSoftLink.h:
        * platform/cocoa/DataDetectorsCoreSoftLink.mm:
        * platform/spi/cocoa/DataDetectorsCoreSPI.h:

2016-03-10  Daniel Bates  <dabates@apple.com>

        CSP: Implement frame-ancestors directive
        https://bugs.webkit.org/show_bug.cgi?id=154345
        <rdar://problem/24702161>

        Reviewed by Brent Fulgham.

        Add support for the Content Security Policy directive frame-ancestors per the Content Security
        Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        Tests: http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-in-meta-element-ignored.html
               http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-in-report-only-ignored.html
               http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-https.html
               http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin.html
               http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-https.html
               http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin.html

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::stopLoadingAfterXFrameOptionsOrContentSecurityPolicyDenied): Extracted from DocumentLoader::responseReceived().
        (WebCore::DocumentLoader::responseReceived): Extracted logic to cancel a load and dispatch a DOM Load
        event at the frame owner into DocumentLoader::stopLoadingAfterXFrameOptionsOrContentSecurityPolicyDenied().
        Make use of this function when loading of the frame is blocked by either the Content Security Policy or
        the X-Frame-Option policy. We explicitly instantiate a ContentSecurityPolicy object with a SecurityOrigin
        and Frame instead of using ScriptExecutionContext m_frame->document() because m_frame->document() is not
        in a stable state (for instance, Document::m_url has not been initialized) as we are in the process of
        loading the underlying document data for it.
        * loader/DocumentLoader.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::didBeginDocument): Pass ContentSecurityPolicy::ReportParsingErrors::No to silence
        errors raised when parsing the Content Security Policy headers to avoid duplicate error messages. Any
        parsing errors would have been raised when we parsed the Content Security Policy in DocumentLoader.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy): Modified to take an optional pointer to a Frame (defaults
        to nullptr). The specified Frame is used to support emitting console messages for violations/syntax errors and
        send violation reports. We make use of this constructor variant in DocumentLoader to support emitting console
        message and sending violation reports in the context of DocumentLoader where its associated Document is not in a
        stable state and making use of a Frame seems less error prone.
        (WebCore::ContentSecurityPolicy::didReceiveHeaders): Modified to take argument reportParsingErrors as
        to whether to silence parsing errors when parsing the specified headers.
        (WebCore::isAllowedByAllWithFrame): Helper function to query a ContentSecurityPolicyDirectiveList function
        passing a Frame and URL for each Content Security Policy.
        (WebCore::ContentSecurityPolicy::allowFrameAncestors): Calls WebCore::isAllowedByAllWithFrame().
        (WebCore::ContentSecurityPolicy::reportViolation): Modified to support sending a violation report when
        we have a Frame and no ScriptExecutionContext (such as when we are instantiated in DocumentLoader).
        Additionally, we only will send a report if reporting is enabled (i.e. ContentSecurityPolicy::m_isReportingEnabled == true).
        (WebCore::ContentSecurityPolicy::logToConsole): Modified to support logging a message to the console
        we have a Frame and no ScriptExecutionContext. We also only allow logging if reporting is enabled.
        * page/csp/ContentSecurityPolicy.h:
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::checkFrameAncestors): Added.
        (WebCore::ContentSecurityPolicyDirectiveList::checkFrameAncestorsAndReportViolation): Added.
        (WebCore::ContentSecurityPolicyDirectiveList::allowFrameAncestors): Added.
        (WebCore::ContentSecurityPolicyDirectiveList::parse): Ignore the directive frame-ancestors when defined
        in a policy given in an HTML meta element and report such use as invalid.
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Parse the directive frame-ancestors.
        * page/csp/ContentSecurityPolicyDirectiveList.h:
        * page/csp/ContentSecurityPolicyResponseHeaders.h: Mark constructor "explicit".

2016-03-10  Jer Noble  <jer.noble@apple.com>

        Add WebCore, WebKit, & WebKit2 preference/setting to enable Main Content heuristic.
        https://bugs.webkit.org/show_bug.cgi?id=155326
        <rdar://problem/25095408>

        Reviewed by Beth Dakin.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement): Set the OverrideUserGestureRequirementForMainContent if the new setting is enabled.
        * page/Settings.in:

2016-03-10  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION: GuardMallloc crash in SVGListPropertyTearOff<SVGPointList>::processIncomingListItemWrapper
        https://bugs.webkit.org/show_bug.cgi?id=154969

        Reviewed by Darin Adler.

        The life cycle of the SVGAnimatedPropertyTearOff::m_baseVal and m_animVal
        was not correct. Like what was done in SVGAnimatedListPropertyTearOff,
        m_baseVal and m_animVal have to be raw RefCounted pointers. When requested
        through, SVGAnimatedPropertyTearOff::baseVal() and animVal() they are
        encapsulated in a RefPtr to ensure they existence as long as they are
        referenced. When the animated property object (which is stored in either
        m_baseVal or m_animVal) is not referenced by anyone, it is going to be
        deleted. In the destructor of their class, SVGAnimatedPropertyTearOff
        will be notified of this deletion through propertyWillBeDeleted() to clean
        its member m_baseVal or m_animVal.

        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): Now all the SVG animated property return RefPtrs. In
        addition to that, SVGViewSpec.transform also returns
        RefPtr<SVGTransformListPropertyTearOff>.
        
        * svg/properties/SVGAnimatedListPropertyTearOff.h:
        (WebCore::SVGAnimatedListPropertyTearOff::animVal):
        (WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
        (WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
        (WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
        (WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
        (WebCore::SVGAnimatedListPropertyTearOff::isAnimating):
        (WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
        Change propertyWillBeDeleted() to be virtual and make it takes an SVGProperty*.
        Rename m_animatingAnimVal to be m_animatedProperty. Add isAnimating() which
        returns true if m_animatedProperty is not null. Use isAnimating() instead of
        m_isAnimating because it's deleted from the base class.
        
        * svg/properties/SVGAnimatedProperty.cpp:
        (WebCore::SVGAnimatedProperty::SVGAnimatedProperty):
        (WebCore::SVGAnimatedProperty::~SVGAnimatedProperty):
        * svg/properties/SVGAnimatedProperty.h:
        (WebCore::SVGAnimatedProperty::isAnimating):
        (WebCore::SVGAnimatedProperty::propertyWillBeDeleted):
        Delete m_isAnimating since its value can be deduced from the value of
        m_animatedProperty in the derived class. Add propertyWillBeDeleted() and
        isAnimating() as virtual functions with the default behavior.
        
        * svg/properties/SVGAnimatedPropertyTearOff.h:
        (WebCore::SVGAnimatedPropertyTearOff::baseVal):
        (WebCore::SVGAnimatedPropertyTearOff::animVal):
        Like SVGAnimatedListPropertyTearOff::baseVal() and animVal() create the
        value if it does not exist. Keep a raw RefCounted pointer but return a
        RefPtr.

        (WebCore::SVGAnimatedPropertyTearOff::isAnimating):
        (WebCore::SVGAnimatedPropertyTearOff::propertyWillBeDeleted):
        Override virtual functions.
        
        (WebCore::SVGAnimatedPropertyTearOff::currentAnimatedValue):
        (WebCore::SVGAnimatedPropertyTearOff::animationStarted):
        (WebCore::SVGAnimatedPropertyTearOff::animationEnded):
        (WebCore::SVGAnimatedPropertyTearOff::animValWillChange):
        (WebCore::SVGAnimatedPropertyTearOff::animValDidChange):
        Replace m_isAnimating with isAnimating(). Ensure that we get a new animated
        property through animVal() and store it in a RefPtr to ensure it will not
        go away while animating.
        
        * svg/properties/SVGAnimatedStaticPropertyTearOff.h:
        (WebCore::SVGAnimatedStaticPropertyTearOff::isAnimating):
        (WebCore::SVGAnimatedStaticPropertyTearOff::currentAnimatedValue):
        (WebCore::SVGAnimatedStaticPropertyTearOff::animationStarted):
        (WebCore::SVGAnimatedStaticPropertyTearOff::animationEnded):
        (WebCore::SVGAnimatedStaticPropertyTearOff::animValWillChange):
        (WebCore::SVGAnimatedStaticPropertyTearOff::animValDidChange):
        Add isAnimating() and replace all the instances of m_isAnimating with calls
        to isAnimating().
        
        * svg/properties/SVGPropertyTearOff.h:
        (WebCore::SVGPropertyTearOff::animatedProperty):
        (WebCore::SVGPropertyTearOff::setAnimatedProperty):
        (WebCore::SVGPropertyTearOff::contextElement):
        (WebCore::SVGPropertyTearOff::SVGPropertyTearOff):
        (WebCore::SVGPropertyTearOff::~SVGPropertyTearOff):
        SVGPropertyTearOff is what SVGAnimatedPropertyTearOff creates for its 
        baseVal() and animVal() values. These values can be null anytime once
        they are not referenced. The SVGAnimatedPropertyTearOff holds only raw
        RefCounted pointer for them. So (1) SVGPropertyTearOff needs to hold a
        RefPtr for its SVGAnimatedProperty and (2) it needs to notify its
        SVGAnimatedProperty when it's deleted by calling propertyWillBeDeleted()
        from the destructor. Also there is no need to get the contextElement()
        and save it in class member, m_contextElement since it can be always be
        retrieved from SVGAnimatedProperty::contextElement().

2016-03-10  Jonathan Davis  <jond@apple.com>

        Fixed broken link for "WebGL 2" on the Feature Status page
        https://bugs.webkit.org/show_bug.cgi?id=155235

        Reviewed by Alex Christensen.

        * features.json:

2016-03-10  Myles C. Maxfield  <mmaxfield@apple.com>

        [OS X] Main frame scrollbars should appear on the left on RTL systems
        https://bugs.webkit.org/show_bug.cgi?id=155149

        Reviewed by Simon Fraser.

        A helper function, ScrollableArea::systemLanguageIsRTL() is used to determine
        if we should be in this new mode. Once we have determined we should be in
        this new mode, there are some scattered places where the geometry math
        needed to be updated.

        Tests: fast/scrolling/rtl-scrollbars-simple.html
               fast/scrolling/rtl-scrollbars.html

        * page/scrolling/AsyncScrollingCoordinator.cpp:
        (WebCore::AsyncScrollingCoordinator::requestScrollPositionUpdate):
        (WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll):
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollLayerPosition):
        * platform/mac/ScrollableAreaMac.mm:
        (WebCore::ScrollableArea::systemLanguageIsRTL):
        * platform/ScrollableArea.h:
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::updateScrollbars):
        (WebCore::ScrollView::scrollCornerRect):
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimator::scrollbarsAreRTL):
        * platform/spi/mac/NSScrollerImpSPI.h:
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::positionForClipLayer):

2016-03-07  Jer Noble  <jer.noble@apple.com>

        Add separate WK and WK2 preferences for requiring user gestures for video media, distinct from user gestures for media generally
        https://bugs.webkit.org/show_bug.cgi?id=155141

        Reviewed by Beth Dakin.

        Rename RequireUserGestureForRateChange -> RequireUserGestureForVideoRateChange.
        Rename Settings::requiresUserGestureForMediaPlayback -> Settings::videoPlaybackRequiresUserGesture.

        Fix longstanding FIXME unifying our behavior restrictions between iOS and Mac.

        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::constructCommon): Rename.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement): Unify behavior restriction behavior.
        (WebCore::HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture): Rename.
        * html/MediaElementSession.cpp:
        (WebCore::restrictionName): Rename.
        (WebCore::MediaElementSession::playbackPermitted): Rename.
        * html/MediaElementSession.h:
        * page/Settings.cpp:
        * page/Settings.in:
        * testing/Internals.cpp:
        (WebCore::Internals::setMediaElementRestrictions): Rename.

2016-03-10  Ryosuke Niwa  <rniwa@webkit.org>

        Add :defined support
        https://bugs.webkit.org/show_bug.cgi?id=155108

        Reviewed by Antti Koivisto.

        Added :defined pseudo class which applies to a successfully instantiated custom element or a builtin element.
        A new node flag, isUnresolvedCustomElement, which was added in r197917 tracks un-upgraded / unresolved custom
        elements for which :defined should not apply.

        Tests: fast/custom-elements/defined-pseudo-class.html
               fast/custom-elements/defined-rule.html

        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::constructElement): Unset isUnresolvedCustomElement now that HTMLElement's
        constructor sets isUnresolvedCustomElement.
        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore::constructJSHTMLElement): Set isUnresolvedCustomElement to true since :defined should never apply to
        a custom element inside its constructor as HTMLElement constructor does not set the defined flag:
        https://w3c.github.io/webcomponents/spec/custom/#htmlelement-constructor
        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::selectorText): Added the support for serializing :defined.
        * css/CSSSelector.h:
        (PseudoClassType): Added PseudoClassDefined for :defined.
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOne): Added the support for :defined.
        * css/SelectorCheckerTestFunctions.h:
        (WebCore::isDefinedElement): Added. Returns true for any builtin element and a custom element after a successful
        construction / upgrades.
        * css/SelectorPseudoClassAndCompatibilityElementMap.in: Added :defined.
        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::addPseudoClassType): Added the support for :defined.

2016-03-10  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197943.
        https://bugs.webkit.org/show_bug.cgi?id=155317

        This change broke Windows, WinCairo, GTK and EFL builds
        (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "Add a baseURL parameter to _WKUserStyleSheet"
        https://bugs.webkit.org/show_bug.cgi?id=155219
        http://trac.webkit.org/changeset/197943

2016-03-10  Daniel Bates  <dabates@apple.com>

        CSP: Implement support for script and style nonces
        https://bugs.webkit.org/show_bug.cgi?id=116508
        <rdar://problem/24963980>

        Reviewed by Brent Fulgham.

        Add support for script-src and style-src nonces as per sections Nonce usage for script elements
        and Nonce usage for style elements of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        * dom/InlineStyleSheetOwner.cpp:
        (WebCore::InlineStyleSheetOwner::createSheet): Check if the nonce for an HTML style element matches a known nonce.
        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::requestScript): Check if the nonce for an HTML script element for an external JavaScript
        script matches a known nonce. If it does then skip subsequent checks of the Content Security Policy when loading
        the script.
        (WebCore::ScriptElement::executeScript): Check if the nonce for an HTML script element for an inline JavaScript
        script matches a known nonce.
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::process): Check if the nonce for an HTML link element matches a known nonce. If it does
        then skip subsequent checks of the Content Security Policy when loading the stylesheet.
        * html/HTMLScriptElement.idl: Unconditionally expose attribute nonce.
        * html/HTMLStyleElement.idl: Ditto.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::isAllowedByAllWithNonce):
        (WebCore::ContentSecurityPolicy::allowScriptWithNonce): Check if the nonce attribute value of a script element
        matches a known nonce. This function delegates the check to ContentSecurityPolicyDirectiveList::allowScriptWithNonce().
        (WebCore::ContentSecurityPolicy::allowStyleWithNonce): Check if the nonce attribute value of a style/link element
        matches a known nonce. This function delegates the check to ContentSecurityPolicyDirectiveList::allowStyleWithNonce().
        * page/csp/ContentSecurityPolicy.h:
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::checkNonce): Checks if the directive allows the specified nonce.
        (WebCore::ContentSecurityPolicyDirectiveList::allowScriptWithNonce): Check if the specified nonce is in
        the source list of the script-src directive (if specified) or the source list of the default-src directive (if specified).
        (WebCore::ContentSecurityPolicyDirectiveList::allowStyleWithNonce): Check if the specified nonce is in
        the source list of the style-src directive (if specified) or the source list of the default-src directive (if specified).
        * page/csp/ContentSecurityPolicyDirectiveList.h:
        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::matches): Returns whether the specified nonce is in the HashSet of
        nonces for the directive.
        (WebCore::ContentSecurityPolicySourceList::parse): Modified to call ContentSecurityPolicySourceList::parseNonceSource()
        to parse a nonce source expression.
        (WebCore::isBase64Character): Moved function to be above function ContentSecurityPolicySourceList::parseNonceSource()
        so that it can referenced from both ContentSecurityPolicySourceList::parseNonceSource() and ContentSecurityPolicySourceList::parseHashSource().
        (WebCore::isNonceCharacter): Added. Matches Blink's definition of a valid nonce character. This definition differs
        from the definition in the Content Security Policy Level 3 spec., <https://w3c.github.io/webappsec-csp/> (29 February 2016).
        (WebCore::ContentSecurityPolicySourceList::parseNonceSource): Parses a source expression for a nonce value.
        * page/csp/ContentSecurityPolicySourceList.h:
        (WebCore::ContentSecurityPolicySourceList::allowInline): We only allow inline scripts/stylesheets if
        'unsafe-inline' was specified in the source list and the source list does not contain any hash sources
        or nonce sources.
        * page/csp/ContentSecurityPolicySourceListDirective.cpp:
        (WebCore::ContentSecurityPolicySourceListDirective::allows): Checks if the specified nonce is in the source list.
        * page/csp/ContentSecurityPolicySourceListDirective.h:

2016-03-08  Sam Weinig  <sam@webkit.org>

        Add a baseURL parameter to _WKUserStyleSheet
        https://bugs.webkit.org/show_bug.cgi?id=155219

        Reviewed by Tim Horton.

        - Moves to a model for user content where instead of each page having a WebCore::UserContentController
          object, we have an abstract WebCore::UserContentProvider interface that can be implemented at the WebKit
          level. For now, legacy WebKit continues to use the old UserContentController, which implements 
          WebCore::UserContentProvider, and WebKit2 implements its own implementation so it can store additional
          state.

        * WebCore.xcodeproj/project.pbxproj:
        Add new files.

        * dom/ExtensionStyleSheets.cpp:
        (WebCore::ExtensionStyleSheets::updateInjectedStyleSheetCache):
        Switch to using forEachUserStyleSheet on the UserContentProvider.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadResource):
        Remove null check now that we always have a UserContentProvider.

        * loader/EmptyClients.cpp:
        (WebCore::fillWithEmptyClients):
        * loader/EmptyClients.h:
        Add new EmptyClients.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadResourceSynchronously):
        Remove null check now that we always have a UserContentProvider.

        * loader/PingLoader.cpp:
        (WebCore::processContentExtensionRulesForLoad):
        Remove null check now that we always have a UserContentProvider.

        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::willSendRequestInternal):
        Remove null check now that we always have a UserContentProvider.

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestResource):
        Remove null check now that we always have a UserContentProvider.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::shouldHaveWebKitNamespaceForWorld):
        Remove null checks now that we always have a UserContentProvider, and userMessageHandlerDescriptors
        returns a reference.

        (WebCore::DOMWindow::open):
        Remove null check now that we always have a UserContentProvider.

        * page/Frame.cpp:
        (WebCore::Frame::injectUserScripts):
        Simplify by lifting document check out of the main loop and using forEachUserScript.

        * page/Page.cpp:
        (WebCore::Page::Page):
        (WebCore::Page::~Page):
        (WebCore::Page::userContentProvider):
        (WebCore::Page::setUserContentProvider):
        (WebCore::Page::setUserContentController): Deleted.
        * page/Page.h:
        (WebCore::Page::userContentController): Deleted.
        * page/PageConfiguration.h:
        Store the UserContentProvider in a Ref, and require PageConfigurations to provide one. This
        removes a bunch of null checks and simplifies the code.

        * page/UserContentController.cpp:
        (WebCore::UserContentController::~UserContentController):
        (WebCore::UserContentController::forEachUserScript):
        (WebCore::UserContentController::forEachUserStyleSheet):
        (WebCore::UserContentController::addUserScript):
        (WebCore::UserContentController::removeUserScript):
        (WebCore::UserContentController::removeUserScripts):
        (WebCore::UserContentController::addUserStyleSheet):
        (WebCore::UserContentController::removeUserStyleSheet):
        (WebCore::UserContentController::removeUserStyleSheets):
        (WebCore::UserContentController::addUserMessageHandlerDescriptor):
        (WebCore::UserContentController::removeUserMessageHandlerDescriptor):
        (WebCore::UserContentController::addUserContentExtension):
        (WebCore::UserContentController::removeUserContentExtension):
        (WebCore::UserContentController::removeAllUserContentExtensions):
        (WebCore::UserContentController::removeAllUserContent):
        (WebCore::UserContentController::addPage): Deleted.
        (WebCore::UserContentController::removePage): Deleted.
        (WebCore::contentExtensionsEnabled): Deleted.
        (WebCore::UserContentController::processContentExtensionRulesForLoad): Deleted.
        (WebCore::UserContentController::actionsForResourceLoad): Deleted.
        * page/UserContentController.h:
        (WebCore::UserContentController::userScripts): Deleted.
        (WebCore::UserContentController::userStyleSheets): Deleted.
        (WebCore::UserContentController::userMessageHandlerDescriptors): Deleted.
        Add inheritance from UserContentProvider and simplify things by removing unique_ptrs
        that were holding the member variables. There is usually only one UserContentController
        so having these in unique_ptrs doesn't make much sense.
        
        * page/UserContentProvider.cpp: Added.
        (WebCore::UserContentProvider::UserContentProvider):
        (WebCore::UserContentProvider::~UserContentProvider):
        (WebCore::UserContentProvider::addPage):
        (WebCore::UserContentProvider::removePage):
        (WebCore::UserContentProvider::invalidateInjectedStyleSheetCacheInAllFramesInAllPages):
        (WebCore::contentExtensionsEnabled):
        (WebCore::UserContentProvider::processContentExtensionRulesForLoad):
        (WebCore::UserContentProvider::actionsForResourceLoad):
        * page/UserContentProvider.h: Added.
        Add abstract class for providing user content and add some helpers on it.

        * page/UserMessageHandlerDescriptor.h:
        (WebCore::UserMessageHandlerDescriptor::create):
        (WebCore::UserMessageHandlerDescriptor::client):
        (WebCore::UserMessageHandlerDescriptor::invalidateClient):
        * page/UserMessageHandlersNamespace.cpp:
        (WebCore::UserMessageHandlersNamespace::handler):
        Simplify now that userContentProvider() and userMessageHandlerDescriptors() are references.

2016-03-10  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197923.
        https://bugs.webkit.org/show_bug.cgi?id=155301

        Rolling out this change due to breaking the build and
        LayoutTests. (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "Font antialiasing (smoothing) changes when elements are
        rendered into compositing layers"
        https://bugs.webkit.org/show_bug.cgi?id=23364
        http://trac.webkit.org/changeset/197923

2016-03-10  Daniel Bates  <dabates@apple.com>

        CSP: Implement support for inline script and inline style hashes
        https://bugs.webkit.org/show_bug.cgi?id=155007
        <rdar://problem/24964098>

        Reviewed by Brent Fulgham.

        Inspiration taken from the analogous implementation in Blink.

        Add support for script-src and style-src hashes as per sections Hash usage for script elements
        and Hash usage for style elements of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        Test: http/tests/security/contentSecurityPolicy/1.1/scripthash-tests.html

        * WebCore.xcodeproj/project.pbxproj: Add file ContentSecurityPolicyHash.h. Also sort the list of files
        in the group WebCore/page/csp.
        * dom/InlineStyleSheetOwner.cpp:
        (WebCore::InlineStyleSheetOwner::createSheet): Pass the content of the stylesheet when querying whether
        the stylesheet is allowed by the Content Security Policy.
        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::executeScript): Pass the content of the inline JavaScript script when querying
        whether the script is allowed by the Content Security Policy.
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::styleAttributeChanged): The Content Security Policy style-src hashes do not apply
        to inline styles defined in the HTML style attribute. So, pass a null string (to indicate the absence of
        content) when querying whether the inline style is allowed by the Content Security Policy.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::toCryptoDigestAlgorithm): Convenience function that maps a ContentSecurityPolicyHashAlgorithm
        enumerator to a CryptoDigest::Algorithm enumerator.
        (WebCore::isAllowedByAllWithHashFromContent): Computes the digest of the specified content for each
        hash algorithm and checks if digest matches a hash that was specified in a policy.
        (WebCore::ContentSecurityPolicy::documentEncoding): Added.
        (WebCore::ContentSecurityPolicy::allowInlineScript): Check if the hash of the script matches a known
        hash if applicable. Otherwise, fall back to checking the URL of the script.
        (WebCore::ContentSecurityPolicy::allowInlineStyle): Check if the hash of the stylesheet matches a
        known hash if applicable. Otherwise, fall back to checking the URL of the stylesheet.
        * page/csp/ContentSecurityPolicy.h:
        (WebCore::ContentSecurityPolicy::addHashAlgorithmsForInlineScripts): Adds the specified set of
        hash algorithms to the existing set of hash algorithms we know are used for inline scripts.
        (WebCore::ContentSecurityPolicy::addHashAlgorithmsForInlineStylesheets): Adds the specified set of
        hash algorithms to the existing set of hash algorithms we know are used for inline stylesheets.
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::checkEval): Make this a static, non-member function because it does not depend on any
        instance or class variables. Mark this function as inline to give a hint to the compiler that it
        should consider inlining the implementation of this function into the caller.
        (WebCore::checkInline): Ditto.
        (WebCore::checkSource): Ditto.
        (WebCore::checkHash): Checks if the directive allows content with the specified hash.
        (WebCore::checkMediaType): Make this a static, non-member function because it does not depend on
        any instance or class variables. Mark this function as inline to give a hint to the compiler that
        it should consider inlining the implementation of this function into the caller.
        (WebCore::ContentSecurityPolicyDirectiveList::create): Modified as needed now that WebCore::checkEval()
        is a static, non-member function.
        (WebCore::ContentSecurityPolicyDirectiveList::allowInlineScriptWithHash): Added.
        (WebCore::ContentSecurityPolicyDirectiveList::allowInlineStyleWithHash): Added.
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Modified to pass the hash algorithms seen
        from parsing the directives script-src, style-src, and default-src to the ContentSecurityPolicy object.
        (WebCore::ContentSecurityPolicyDirectiveList::checkEval): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::checkInline): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::checkSource): Deleted.
        (WebCore::ContentSecurityPolicyDirectiveList::checkMediaType): Deleted.
        * page/csp/ContentSecurityPolicyDirectiveList.h:
        * page/csp/ContentSecurityPolicyHash.h: Added.
        (WTF::DefaultHash<WebCore::ContentSecurityPolicyDigest>::Hash::hash): Compute the hash of a digest as
        we would compute the hash of a string.
        (WTF::DefaultHash<WebCore::ContentSecurityPolicyDigest>::Hash::equal): Compare digests for equality
        by making use of Vector's equality operator.
        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::matches): Checks if the hash is in the set of known hashes.
        (WebCore::ContentSecurityPolicySourceList::parse): Modified to call ContentSecurityPolicySourceList::parseHashSource()
        to try to parse the source list expression as a hash source. If this fails then we try to parse the
        source expression as a scheme/host/port expression.
        (WebCore::parseHashAlgorithmAdvancingPosition): Parses the hash algorithm from a hash source expression.
        (WebCore::isBase64Character): Returns whether the specified character is a valid Base64/Base64url character,
        excluding the padding character '='. Disregarding the omission of the padding character '=', this function
        conforms to the ABNF grammar defined in section Source Lists of the Content Security Policy Level 3 spec.,
        <https://w3c.github.io/webappsec-csp> (Editor’s Draft, 29 February 2016). We take the padding character '='
        into account in ContentSecurityPolicySourceList::parseHashSource().
        (WebCore::ContentSecurityPolicySourceList::parseHashSource): Parses a hash source expression per the ABNF
        grammar described in section Source Lists of the Content Security Policy Level 3 spec.
        * page/csp/ContentSecurityPolicySourceList.h:
        (WebCore::ContentSecurityPolicySourceList::hashAlgorithmsUsed): Returns the set of hash algorithms seen from
        parsing the source list.
        (WebCore::ContentSecurityPolicySourceList::allowInline): We only allow inline scripts/stylesheets if
        'unsafe-inline' was specified in the source list and the source list does not contain any hash sources.
        * page/csp/ContentSecurityPolicySourceListDirective.cpp:
        (WebCore::ContentSecurityPolicySourceListDirective::allows): Checks if the specified hash is in the source list.
        * page/csp/ContentSecurityPolicySourceListDirective.h:
        (WebCore::ContentSecurityPolicySourceListDirective::hashAlgorithmsUsed): Turns around and calls ContentSecurityPolicySourceList::hashAlgorithmsUsed().
        

2016-03-10  Chris Dumez  <cdumez@apple.com>

        Speculative revalidation requests do not have their 'first party for cookies' URL set
        https://bugs.webkit.org/show_bug.cgi?id=155284
        <rdar://problem/25053203>

        Reviewed by Antti Koivisto.

        Export a few more symbols so they can be used in WebKit2.

        * platform/URL.h:
        * platform/network/ResourceRequestBase.h:

2016-02-22  Jer Noble  <jer.noble@apple.com>

        Enable AVFoundationNSURLSessionEnabled by default
        https://bugs.webkit.org/show_bug.cgi?id=154469

        Reviewed by Sam Weinig.

        * page/Settings.cpp:

2016-03-10  Frederic Wang  <fwang@igalia.com>

        [GTK] Add support for WOFF2
        https://bugs.webkit.org/show_bug.cgi?id=152616

        Reviewed by Carlos Garcia Campos.

        No new tests (Covered by existing tests).

        * CMakeLists.txt: Add woff2 source to the include directory and link WebCore against brotli and woff2.
        * platform/graphics/WOFFFileFormat.cpp:
        (WebCore::isWOFF): Recognize the signature of WOFF2 font.
        (WebCore::convertWOFFToSfnt): If the font has the WOFF2 signature, then try and decompress it using the woff2 library.
        * platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:
        (WebCore::FontCustomPlatformData::supportsFormat): Add woff2 to the list of supported formats.

2016-03-10  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Fix placement for unknown named grid lines
        https://bugs.webkit.org/show_bug.cgi?id=155230

        Reviewed by Sergio Villar Senin.

        The spec has changed and now all the implicit lines should be considered
        when we're resolving named grid lines with an unknown name.

        The relevant part of the spec is
        (http://dev.w3.org/csswg/css-grid/#line-placement):
        "If a name is given as a <custom-ident>, only lines with that name
         are counted. If not enough lines with that name exist,
         all implicit grid lines are assumed to have that name
         for the purpose of finding this position."

        Modified the code to resolve named grid lines in GridResolvedPosition.
        We need to keep the old behavior of considering "auto" unknown named
        grid lines for the case of positioned grid items.

        Test: fast/css-grid-layout/grid-item-unknown-named-grid-line-resolution.html

        * rendering/style/GridResolvedPosition.cpp:
        (WebCore::adjustGridPositionsFromStyle):
        (WebCore::lookAheadForNamedGridLine):
        (WebCore::lookBackForNamedGridLine):
        (WebCore::resolveNamedGridLinePositionFromStyle):
        (WebCore::definiteGridSpanWithNamedLineSpanAgainstOpposite):
        (WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveGridPositionAgainstOppositePosition):
        (WebCore::resolveGridPositionFromStyle):

2016-03-10  Eric Carlson  <eric.carlson@apple.com>

        [MediaStream] push media stream state to the UI process
        https://bugs.webkit.org/show_bug.cgi?id=155281

        Reviewed by Darin Adler.

        * Modules/mediastream/MediaStream.cpp:
        (WebCore::MediaStream::MediaStream): Register with the document as an audio producer.
        (WebCore::MediaStream::~MediaStream): Unregister.
        (WebCore::MediaStream::setIsActive): Update document status.
        (WebCore::MediaStream::pageMutedStateDidChange): Mute/unmute according to the page mute setting.
        (WebCore::MediaStream::mediaState): Return state.
        (WebCore::MediaStream::statusDidChange): Call document.updateIsPlayingMedia.
        (WebCore::MediaStream::characteristicsChanged): Track stream mute state.
        (WebCore::MediaStream::scheduleActiveStateChange): m_isActive -> m_active.
        * Modules/mediastream/MediaStream.h:

        * page/MediaProducer.h: Add HasActiveMediaCaptureDevice.

        * platform/mediastream/MediaStreamPrivate.cpp:
        (WebCore::MediaStreamPrivate::hasVideo): Make const.
        (WebCore::MediaStreamPrivate::hasAudio): Ditto.
        (WebCore::MediaStreamPrivate::muted): New.
        * platform/mediastream/MediaStreamPrivate.h:

        * platform/mediastream/mac/AVMediaCaptureSource.mm:
        (WebCore::AVMediaCaptureSource::AVMediaCaptureSource): Initialize muted to true.
        (WebCore::AVMediaCaptureSource::captureSessionIsRunningDidChange): Set muted.

2016-03-09  Ryosuke Niwa  <rniwa@webkit.org>

        Extract EventPath.h/cpp out of EventDispatcher.cpp
        https://bugs.webkit.org/show_bug.cgi?id=155285

        Reviewed by Chris Dumez.

        Extracted EventPath.h/cpp out of EventDispatcher.cpp to add the support for Event.deepPath()
        in webkit.org/b/153538. The new file defines member functions of EventPath and RelatedNodeRetargeter.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/DOMAllInOne.cpp:
        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::dispatchScopedEvent):
        (WebCore::EventDispatcher::dispatchEvent):
        (WebCore::EventPath): Moved to EventPath.cpp.
        (WebCore::eventTargetRespectingTargetRules): Moved to EventPath.h.
        (WebCore::shouldEventCrossShadowBoundary): Moved to EventPath.cpp.
        (WebCore::nodeOrHostIfPseudoElement): Ditto.
        (WebCore::RelatedNodeRetargeter): Moved to EventPath.cpp.
        * dom/EventPath.cpp: Added.
        (WebCore::shouldEventCrossShadowBoundary): Moved from EventDispatcher.cpp.
        (WebCore::nodeOrHostIfPseudoElement): Ditto.
        (WebCore::EventPath::EventPath): Ditto.
        (WebCore::RelatedNodeRetargeter): Ditto.
        * dom/EventPath.h: Added.
        (WebCore::EventPath::isEmpty):
        (WebCore::EventPath::size):
        (WebCore::EventPath::contextAt):
        (WebCore::EventPath::lastContextIfExists):
        (WebCore::EventPath::eventTargetRespectingTargetRules): Moved from EventDispatcher.cpp.

2016-03-09  Simon Fraser  <simon.fraser@apple.com>

        Font antialiasing (smoothing) changes when elements are rendered into compositing layers
        https://bugs.webkit.org/show_bug.cgi?id=23364
        rdar://problem/7288429

        Reviewed by Tim Horton.

        Improve the appearance of subpixel-antialiased ("smoothed") text in non-opaque layers
        by opting in to a new CALayer backing store format.
        
        GraphicsLayer now has setSupportsSmoothedFonts(), which is called by RenderLayerBacking
        when the platform has support for the new feature. Ideally this would only be set when
        we know a layer has smoothed text drawn into it, but, for now, enable this for all
        layers. The right thing happens with opaque layers under the hood.
        
        setSupportsSmoothedFonts() is turned into a PlatformCALayer contentsFormat flag, which
        is ultimately passed to setBackingStoreFormat().
        
        We also need to propagate this flag to TileController tiles.

        * platform/graphics/GraphicsLayer.cpp:
        (WebCore::GraphicsLayer::supportsSmoothedFontsInNonOpaqueLayers):
        (WebCore::GraphicsLayer::GraphicsLayer):
        * platform/graphics/GraphicsLayer.h:
        (WebCore::GraphicsLayer::supportsSmoothedFonts):
        (WebCore::GraphicsLayer::setSupportsSmoothedFonts):
        * platform/graphics/TiledBacking.h:
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayer::supportsSmoothedFontsInNonOpaqueLayers):
        (WebCore::GraphicsLayerCA::setSupportsSmoothedFonts):
        (WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
        (WebCore::GraphicsLayerCA::updateContentsFormat):
        * platform/graphics/ca/GraphicsLayerCA.h:
        * platform/graphics/ca/PlatformCALayer.cpp:
        (WebCore::PlatformCALayer::drawRepaintIndicator): Give the number a "shadow" when
        the contents format says we support smoothed fonts.
        * platform/graphics/ca/PlatformCALayer.h:
        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::setTileContentsFormatFlags):
        (WebCore::TileController::createTileLayer):
        * platform/graphics/ca/TileController.h:
        * platform/graphics/ca/TileGrid.cpp:
        (WebCore::TileGrid::updateTileLayerProperties):
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.h:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (WebCore::setBackingStoreFormat):
        (PlatformCALayerCocoa::commonInit):
        (PlatformCALayerCocoa::setContentsFormat):
        (PlatformCALayer::drawLayerContents): Previously, we turned off font smoothing in
        non-opaque layers to improve text appearance. We no longer need to do that when
        the contents format has "SmoothedFonts".
        * platform/ios/LegacyTileGridTile.mm:
        (WebCore::setBackingStoreFormat):
        (WebCore::LegacyTileGridTile::LegacyTileGridTile):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::createGraphicsLayer):

2016-03-09  Gavin Barraclough  <barraclough@apple.com>

        WebKit should adopt journal_mode=wal for all SQLite databases.
        https://bugs.webkit.org/show_bug.cgi?id=133496

        Reviewed by Brady Eidson & Darin Adler.

        The statement intended to enable WAL mode is always failing because it is missing a
        prepare(). Fix this. We were also previously permitting SQLITE_OK results - this
        was in error (we were only getting these because stepping the unprepared statement
        returned SQLITE_OK). Also set the SQLITE_OPEN_AUTOPROXY flag when opening the
        database - this will improve perfomance when the database is accessed via an AFP
        mount.

        * platform/sql/SQLiteDatabase.cpp:
        (WebCore::SQLiteDatabase::open):
            - call prepareAndStep(), only check for SQLITE_ROW result.
        * platform/sql/SQLiteFileSystem.cpp:
        (WebCore::SQLiteFileSystem::openDatabase):
            - should set SQLITE_OPEN_AUTOPROXY flag when opening database.

2016-03-09  Ryosuke Niwa  <rniwa@webkit.org>

        Add runtime flags for shadow DOM and custom elements
        https://bugs.webkit.org/show_bug.cgi?id=155213

        Reviewed by Dean Jackson.

        Added new runtime flags for shadow DOM and custom elements.

        * bindings/generic/RuntimeEnabledFeatures.h:
        (WebCore::RuntimeEnabledFeatures::setShadowDOMEnabled): Added.
        (WebCore::RuntimeEnabledFeatures::shadowDOMEnabled): Added.
        (WebCore::RuntimeEnabledFeatures::setCustomElementsEnabled): Added.
        (WebCore::RuntimeEnabledFeatures::customElementsEnabled): Added.
        * dom/Document.idl:
        * dom/Element.idl:
        * dom/Node.idl:
        * dom/NonDocumentTypeChildNode.idl:
        * dom/ShadowRoot.idl:
        * html/HTMLSlotElement.idl:

2016-03-09  Ryosuke Niwa  <rniwa@webkit.org>

        defineElement should upgrade existing unresolved custom elements
        https://bugs.webkit.org/show_bug.cgi?id=155107

        Reviewed by Darin Adler.

        Added the support for upgrading existing unresolved custom elements when defineElement is called.

        The current implementation upgrades elements in the order they were created and has the issue that
        it keeps accumulating all elements with a hyphen in its name until defineElement is called as
        documented in https://github.com/w3c/webcomponents/issues/419

        This patch re-purposes IsEditingTextFlag to indicate that the node is an unresolved custom element.
        Since isEditingText() is only called in textRendererIsNeeded only on Text nodes, it's mutually
        exclusive with isUnresolvedCustomElement().

        The list of unresolved custom elements is kept in m_upgradeCandidatesMap, a hash map of element names
        to the list of unresolved elements with that name.

        In addition, added the logic to use HTMLElement as the interface for unresolved custom element instead
        of HTMLUnknownElement.

        Test: fast/custom-elements/upgrading/upgrading-parser-created-element.html

        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::upgradeElement): Clear the flag.
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::defineElement): Set the unique private name to keep the interface alive before
        calling addElementDefinition as the call can now invoke author scripts.
        * dom/CustomElementDefinitions.cpp:
        (WebCore::CustomElementDefinitions::addElementDefinition): Upgrade existing unresolved elements kept
        in m_upgradeCandidatesMap.
        (WebCore::CustomElementDefinitions::addUpgradeCandidate): Added.
        * dom/CustomElementDefinitions.h:
        * dom/Document.cpp:
        (WebCore::createHTMLElementWithNameValidation): Added the code to add the unresolved custom elements
        to the upgrade candidates map. Also instantiate it as HTMLElement instead of HTMLUnknownElement.
        (WebCore::createFallbackHTMLElement): Ditto.
        * dom/Node.h:
        (WebCore::Node::setIsCustomElement):
        (WebCore::Node::isUnresolvedCustomElement): Added.
        (WebCore::Node::setIsUnresolvedCustomElement): Added.
        (WebCore::Node::setCustomElementIsResolved): Added. Clears IsEditingTextOrUnresolvedCustomElementFlag
        and sets IsCustomElement.
        (WebCore::Node::isEditingText): Check both IsEditingTextOrUnresolvedCustomElementFlag and IsTextFlag
        for safety even though it's currently only used in textRendererIsNeeded which takes Text&.
        * dom/make_names.pl:
        (defaultParametersHash): Added customElementInterfaceName as a parameter.
        (printWrapperFactoryCppFile): Generate the code to use customElementInterfaceName when the element
        for which the wrapper is created has isUnresolvedCustomElement flag set.
        * html/HTMLTagNames.in: Use HTMLElement for unresolved custom elements.
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface): Added the code to add
        the unresolved custom elements to the upgrade candidates map. Also instantiate it as HTMLElement instead
        of HTMLUnknownElement. 

2016-03-09  Enrica Casucci  <enrica@apple.com>

        Retrieve additional context for some data detector link for preview and action menu.
        https://bugs.webkit.org/show_bug.cgi?id=155278
        rdar://problem/24884951

        Reviewed by Tim Horton.

        Adding helper function to compute a range by moving by a number of characters
        from a given position and direction.
        Adding function to check if the given data detector link element requires
        an extended context.

        * editing/VisibleUnits.cpp:
        (WebCore::rangeExpandedByCharactersInDirectionAtWordBoundary):
        * editing/VisibleUnits.h:
        * editing/cocoa/DataDetection.h:
        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::requiresExtendedContext):

2016-03-09  Daniel Bates  <dabates@apple.com>

        Fix the Windows build after <https://trac.webkit.org/changeset/197905>
        (https://bugs.webkit.org/show_bug.cgi?id=155247)

        We need to call the std::unique_ptr<CryptoDigest>() constructor directly
        instead of using the convenience function std::make_unique<CryptoDigest>()
        because std::make_unique<CryptoDigest>() cannot access the private constructor
        CryptoDigest().

        * platform/crypto/win/CryptoDigestWin.cpp:
        (WebCore::CryptoDigest::create):

2016-03-09  Daniel Bates  <dabates@apple.com>

        [Win] Implement CryptoDigest
        https://bugs.webkit.org/show_bug.cgi?id=155247
        <rdar://problem/25065843>

        Reviewed by Brent Fulgham.

        Implement the CryptoDigest abstraction for Windows so that we can compute cryptographically
        secure hashes. This will allow us to support Content Security Policy inline script and inline
        stylesheet hashes on Windows.

        * PlatformWin.cmake: Add file CryptoDigestWin.cpp.
        * PlatformWinCairo.cmake: Ditto.
        * platform/crypto/win/CryptoDigestWin.cpp: Added.
        (WebCore::CryptoDigest::CryptoDigest): Instantiate a CryptoDigestContext object.
        (WebCore::CryptoDigest::~CryptoDigest): Destroy the cryptographic service provider and hash
        object if non-null.
        (WebCore::CryptoDigest::create): Acquire a handle to a cryptographic service provider (HCRYPTPROV)
        and a handle to a hash object (HCRYPTHASH).
        (WebCore::CryptoDigest::addBytes): Add the contents of the specified buffer to the hash object.
        (WebCore::CryptoDigest::computeHash): Compute and return a Vector of bytes that represent the digest.

2016-03-09  David Kilzer  <ddkilzer@apple.com>

        REGRESSION (r197149): Missing availability checks when soft-linking DataDetectors.framework
        <http://webkit.org/b/155258>

        Reviewed by Andy Estes.

        * page/mac/ServicesOverlayController.mm:
        (WebCore::ServicesOverlayController::Highlight::setDDHighlight):
        (WebCore::ServicesOverlayController::Highlight::paintContents):
        (WebCore::ServicesOverlayController::mouseIsOverHighlight):
        - Add check that returns early if DataDetectors.framework is not
          available.

        * platform/spi/mac/DataDetectorsSPI.h:
        - Mark Objective-C classses as optional.

2016-03-09  Jer Noble  <jer.noble@apple.com>

        Add heuristic for "main content" videos which override user gesture requirements
        https://bugs.webkit.org/show_bug.cgi?id=155224

        Reviewed by Eric Carlson.

        Tests: media/video-main-content-allow-then-deny.html
               media/video-main-content-allow.html
               media/video-main-content-deny-display-none.html
               media/video-main-content-deny-not-in-dom.html
               media/video-main-content-deny-not-visible.html
               media/video-main-content-deny-obscured.html
               media/video-main-content-deny-too-small.html

        Add a new behavior "restriction" to MediaElementSession that allows media elements
        to optionally overriding their own user gesture requirements if the session determines
        that the media element is the page's "main content".

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::didAttachRenderers):
        (WebCore::HTMLMediaElement::updateShouldPlay):
        * html/HTMLMediaElement.h:
        * html/MediaElementSession.cpp:
        (WebCore::restrictionName):
        (WebCore::MediaElementSession::MediaElementSession):
        (WebCore::MediaElementSession::addBehaviorRestriction):
        (WebCore::MediaElementSession::playbackPermitted):
        (WebCore::MediaElementSession::dataLoadingPermitted):
        (WebCore::isMainContent):
        (WebCore::MediaElementSession::mainContentCheckTimerFired):
        (WebCore::MediaElementSession::updateIsMainContent):
        * html/MediaElementSession.h:
        * testing/Internals.cpp:
        (WebCore::Internals::setMediaElementRestrictions):

2016-03-09  Konstantin Tokarev  <annulen@yandex.ru>

        Added missing #if(SOUP) after r197591.
        https://bugs.webkit.org/show_bug.cgi?id=155259

        Reviewed by Alex Christensen.

        No new tests needed.

        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:

2016-03-09  Ada Chan  <adachan@apple.com>

        Add a getter for WebVideoFullscreenInterfaceObjC and update its rate property
        https://bugs.webkit.org/show_bug.cgi?id=155239

        Reviewed by Eric Carlson.

        * platform/mac/WebVideoFullscreenInterfaceMac.h:
        Move the stub implementation of setVideoDimensions() to the mm file.
        Declare a getter to WebVideoFullscreenInterfaceMacObjC.
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::setRate):
        Also update the rate property of WebVideoFullscreenInterfaceMacObjC.
        (WebCore::WebVideoFullscreenInterfaceMac::setVideoDimensions):
        Stub implementation of setVideoDimensions() has been moved to here.

2016-03-09  Alex Christensen  <achristensen@webkit.org>

        Fix Mac build without video enabled after r197633.

        * bindings/objc/DOM.mm:

2016-03-09  Ryosuke Niwa  <rniwa@webkit.org>

        Rename Node.treeRoot to rootNode and turn it on by default
        https://bugs.webkit.org/show_bug.cgi?id=155226

        Reviewed by Antonio Gomes.

        Node.prototype.treeRoot has been merged into DOM spec from Shadow DOM spec and renamed to rootNode:
        https://dom.spec.whatwg.org/#dom-node-rootnode

        Rename the method and expose it unconditionally on Node.prototype.

        Tests: fast/dom/Node/rootNode.html
               fast/shadow-dom/Node-interface-rootNode.html

        * dom/ContainerNode.h:
        (WebCore::Node::highestAncestor): Deleted. There is no need for this function to be inlined.
        * dom/Document.h: Now that both TreeScope and Node defines rootNode, we need to pick either.
        Here, we pick TreeScope's definition since Document is by definition always in a document so there is
        no need to even check inTreeScope().
        * dom/Node.cpp:
        (WebCore::Node::rootNode): Moved here. Also added a fast path for when "this" node is in a document
        or a shadow root since TreeScope stores its root node as a member variable (m_rootNode).
        * dom/Node.h:
        * dom/Node.idl: Renamed the method and removed Conditional=SHADOW_DOM.
        * dom/ShadowRoot.h: Similar to the change in Document.h. See above.
        * editing/Editor.cpp:
        (WebCore::correctSpellcheckingPreservingTextCheckingParagraph): Use rootNode instead of free function
        defined in htmlediting.cpp, which was removed in this patch.
        * editing/htmlediting.cpp:
        (WebCore::highestAncestor): Deleted.
        * editing/htmlediting.h:
        * html/FormAssociatedElement.cpp:
        (WebCore::computeRootNode): Added.
        (WebCore::FormAssociatedElement::removedFrom): We can't use Node::rootNode here because this function
        is called in the middle of removing a subtree, and some associated form element's inDocument flag may
        not have been updated yet. So use computeRootNode to manually find the highest ancestor.
        (WebCore::FormAssociatedElement::formRemovedFromTree): Ditto.
        * xml/XPathPath.cpp:
        (WebCore::XPath::LocationPath::evaluate):

2016-03-09  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Fixed All-in-One build.
        https://bugs.webkit.org/show_bug.cgi?id=155241

        Reviewed by Csaba Osztrogonác.

        No new tests needed.

        * bindings/js/JSBindingsAllInOne.cpp: Should not include generated
        file.

2016-03-09  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rebaseline bindings tests after r197874.

        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::JSattribute::getOwnPropertySlot):
        * bindings/scripts/test/JS/JSattribute.h:

2016-03-09  Chris Dumez  <cdumez@apple.com>

        focus() / blur() should be on HTMLElement / SVGElement, not Element
        https://bugs.webkit.org/show_bug.cgi?id=155216

        Reviewed by Darin Adler.

        focus() / blur() should be on HTMLElement / SVGElement, not Element:
        - https://html.spec.whatwg.org/multipage/dom.html#htmlelement
        - https://www.w3.org/TR/SVG2/types.html#InterfaceSVGElement

        Chrome and Firefox match the specification.

        Note that after this change, focus() / blur() is no longer exposed
        on MathMLElement. This matches the MathML specification and is
        consistent with Firefox and Chrome.

        * dom/Element.idl:
        * html/HTMLElement.idl:
        * svg/SVGElement.idl:

2016-03-09  Chris Dumez  <cdumez@apple.com>

        Move attributes to the instance for most interfaces that have "Error" in their name
        https://bugs.webkit.org/show_bug.cgi?id=155231

        Reviewed by Darin Adler.

        Our bindings generator was keeping attributes on the instances for
        interfaces having "Error" or "Exception" in their name. The reason is
        that interfaces that have "Error" in their prototype would not behave
        correctly otherwise because "Error" incorrectly has its attributes on
        the instance at the moment. However, in our bindings generator, the
        condition to decide if an interface's prototype should be "Error" is
        if $interface->isException. Therefore, we should use the same condition
        to decide if we should keep attributes on the instance until "Error"
        is updated to have its attributes on the prototype. Doing this for any
        interface having "Error" or "Exception" in their name is overkill.

        No new tests, already covered by existing test.

        * bindings/scripts/CodeGeneratorJS.pm:
        (InterfaceRequiresAttributesOnInstance):

2016-03-09  Daniel Bates  <dabates@apple.com>

        Rename WebCore/platform/crypto/mac/CryptoDigestMac.cpp to WebCore/platform/crypto/commoncrypto/CryptoDigestCommonCrypto.cpp
        https://bugs.webkit.org/show_bug.cgi?id=155244

        Reviewed by Alexey Proskuryakov.

        The file WebCore/platform/crypto/mac/CryptoDigestMac.cpp is applicable to both iOS and OS X.
        We should move and rename this file to reflect that is applicable to both of these platforms.

        * PlatformMac.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/crypto/commoncrypto/CryptoDigestCommonCrypto.cpp: Renamed from Source/WebCore/platform/crypto/mac/CryptoDigestMac.cpp.

2016-03-09  Tim Horton  <timothy_horton@apple.com>

        Removing and re-adding a script message handler with the same name results in an unusable message handler
        https://bugs.webkit.org/show_bug.cgi?id=155223

        Reviewed by Sam Weinig.
        Patch by Geoff Garen and myself.

        New API test: WKUserContentController.ScriptMessageHandlerReplaceWithSameName.

        * page/UserMessageHandler.h:
        (WebCore::UserMessageHandler::descriptor):
        * page/UserMessageHandlersNamespace.cpp:
        (WebCore::UserMessageHandlersNamespace::handler):
        This lazy removal mechanism combined with the fact that we only compare
        handler name and world makes it such that m_messageHandlers could have
        a stale UserMessageHandler with a UserMessageHandlerDescriptor that differed
        only in client.

        It is safe to compare the descriptors by pointer instead because m_messageHandler
        holds a strong reference to its UserMessageHandlerDescriptors, and this will ensure
        that the add-remove-add path (with identical name and world) causes a new
        UserContentController to be created.

        We also now clean up any stale UserMessageHandlers whenever we're about to
        add a new one, by removing any which the UserContentController no longer knows about.

2016-03-09  Chris Dumez  <cdumez@apple.com>

        Align HTMLKeygenElement.keytype with the specification
        https://bugs.webkit.org/show_bug.cgi?id=155214

        Reviewed by Darin Adler.

        Align HTMLKeygenElement.keytype with the specification:
        - https://html.spec.whatwg.org/#dom-keygen-keytype
        - https://html.spec.whatwg.org/#attr-keygen-keytype

        In particular, the following changes were made:
        1. Return "rsa" by default (i.e. when the corresponding content attribute is missing)
        2. Only return known values

        Test: fast/dom/HTMLKeygenElement/keygen-keytype.html

        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::setKeytype):
        (WebCore::HTMLKeygenElement::keytype):
        (WebCore::HTMLKeygenElement::appendFormData):
        * html/HTMLKeygenElement.h:
        * html/HTMLKeygenElement.idl:

2016-03-09  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] Fix MediaPlayerPrivate conflicts
        https://bugs.webkit.org/show_bug.cgi?id=155236

        Reviewed by Martin Robinson.

        In some cases the mediastream player would be used to play
        non-mediastream videos or MSE streams. The OWR player should be
        used only for mediastreams and the MediaPlayerPrivateGStreamer
        player should be used only for normal <video> elements and
        MediaSource support.

        This patch intends to fix the massive tests timeouts currently
        happening on the GTK bots after r197752.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::supportsType): Bail out if
        the type checked represents a mediastream.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        Prevent signal disconnection on possible NULL GObjects.
        (WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.cpp:
        (WebCore::MediaPlayerPrivateGStreamerOwr::MediaPlayerPrivateGStreamerOwr):
        Simplify constructor to the bare minimum.
        (WebCore::MediaPlayerPrivateGStreamerOwr::load): Create sinks only
        if needed from the load method.
        (WebCore::MediaPlayerPrivateGStreamerOwr::getSupportedTypes):
        Initialize the type cache to an empty static hashset.
        (WebCore::MediaPlayerPrivateGStreamerOwr::supportsType): This
        player does support mediastreams and nothing else.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.h:

2016-03-08  Brent Fulgham  <bfulgham@apple.com>

        Local HTML should be blocked from localStorage access unless "Disable Local File Restrictions" is checked..
        https://bugs.webkit.org/show_bug.cgi?id=155185
        <rdar://problem/11101440>

        Reviewed by Zalan Bujtas.

        Tested by storage/domstorage/localstorage/blocked-file-access.html.

        * page/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::canAccessStorage): If the origin is a local file, and we have not been granted
        universal file access, prevent access to DOM localStorage.

2016-03-09  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Allow to place positioned grid items on the padding
        https://bugs.webkit.org/show_bug.cgi?id=155199

        Reviewed by Sergio Villar Senin.

        According to the following discussion on the CSS WG mailing list,
        we should be able to place positioned grid items on the padding directly:
        https://lists.w3.org/Archives/Public/www-style/2015Nov/0070.html

        This means that a positioned grid item can be placed on the padding itself.
        The "auto" value resolves to the padding edges (0th and -0th lines).
        So if a positioned item is placed with: grid-column: auto / 1;
        it'd be placed on the padding, from line 0th to 1st line.

        On top of that, we've to detect properly the first and last explicit
        grid lines during the layout of positioned grid items.
        We have to consider that the grid can have implicit tracks created
        previously by regular grid items.

        Tests: fast/css-grid-layout/grid-positioned-items-padding.html
               fast/css-grid-layout/grid-positioned-items-within-grid-implicit-track.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):

2016-03-09  Andreas Kling  <akling@apple.com>

        ImageDocuments leak their world.
        <https://webkit.org/b/155167>
        <rdar://problem/24987363>

        Reviewed by Antti Koivisto.

        ImageDocument uses a special code path in ImageLoader in order to manually
        control how the image is loaded. It has to do this because the ImageDocument
        is really just a synthetic wrapper around a main resource that's an image.

        This custom loading code had a bug where it would create a new CachedImage
        and neglect to set its CachedResource::m_state flag to Pending (which is
        normally set by CachedResource::load(), but we don't call that for these.)

        This meant that when ImageDocument called CachedImage::finishLoading() to
        trigger the notifyFinished() callback path, the image would look at its
        loading state and see that it was Unknown (not Pending), and conclude that
        it hadn't loaded yet. So we never got the notifyFinished() signal.

        The world leaks here because ImageLoader slaps a ref on its <img> element
        while it waits for the loading operation to complete. Once finished, whether
        successfully or with an error, it derefs the <img>.

        Since we never fired notifyFinished(), we ended up with an extra ref on
        these <img> forever, and then the element kept its document alive too.

        Test: fast/dom/ImageDocument-world-leak.html

        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::updateFromElement):

2016-03-08  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Fix auto-track sizing with min-size:auto and specific sizes
        https://bugs.webkit.org/show_bug.cgi?id=155165

        Reviewed by Darin Adler.

        Specs recently changed the way auto tracks are sized. In the
        previous versions, when sizing auto minimums, only the
        min-width|height of the items spanning through the auto tracks
        were used to size them. The new text specifies that for items
        with a specified minimum size of auto, the behavior is
        equivalent to a min-content minimum.

        This means that from now on, auto tracks with min-size:auto
        will no longer be smaller than min-content tracks (which was
        pretty weird from the user POV).

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::minSizeForChild): use grid items
        min-content contributions whenever the specified size is not
        auto or when min-size is auto.

2016-03-09  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Initial support for implicit grid before explicit grid
        https://bugs.webkit.org/show_bug.cgi?id=155014

        Reviewed by Darin Adler.

        Change GridSpan to store int instead of unsigned. This allows us to
        resolve positions before the explicit grid with negative values.

        This patch adds a new type of GridSpan called "Untranslated".
        This type is only used in populateExplicitGridAndOrderIterator().
        Where we store the smallest negative position in both axis.

        Then the GridSpans are translated into positive values, using the offset
        calculated before. This is done in placeItemsOnGrid() and from that
        moment the rest of the code uses "Definite" GridSpans, which returns
        only positive positions (unsigned instead of int).
        This allows us to don't have to modify the rest of the code, as it keeps
        using GridSpans as before.

        Let's use an example to explain how it works. Imagine that we've a 2
        columns grid and 2 items placed like:
        * Item A: grid-column: -5;
        * Item B: grid-column: 1;

        Initially we'll use "Unstranslated" GridSpans with the following values:
        * Item A: GridSpan(-2, -1)
        * Item B: GridSpan(0, 1)

        Then we'll translate them using the smallest position as offset (-2)
        so we've "Definite" GridSpans:
        * Item A: GridSpan(0, 1)
        * Item B: GridSpan(2, 3)

        Test: fast/css-grid-layout/implicit-tracks-before-explicit.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateAreasRow):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::GridIterator::nextEmptyGridArea):
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
        (WebCore::RenderGrid::gridTrackSize):
        (WebCore::RenderGrid::insertItemIntoGrid):
        (WebCore::RenderGrid::placeItemsOnGrid):
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        (WebCore::RenderGrid::placeAutoMajorAxisItemsOnGrid): Deleted.
        (WebCore::RenderGrid::layoutPositionedObject): Deleted.
        * rendering/RenderGrid.h:
        * rendering/style/GridCoordinate.h:
        (WebCore::GridSpan::untranslatedDefiniteGridSpan):
        (WebCore::GridSpan::translatedDefiniteGridSpan):
        (WebCore::GridSpan::integerSpan):
        (WebCore::GridSpan::untranslatedResolvedInitialPosition):
        (WebCore::GridSpan::untranslatedResolvedFinalPosition):
        (WebCore::GridSpan::resolvedInitialPosition):
        (WebCore::GridSpan::resolvedFinalPosition):
        (WebCore::GridSpan::begin):
        (WebCore::GridSpan::end):
        (WebCore::GridSpan::isTranslatedDefinite):
        (WebCore::GridSpan::isIndefinite):
        (WebCore::GridSpan::translate):
        (WebCore::GridSpan::GridSpan):
        (WebCore::GridSpan::operator==): Deleted.
        (WebCore::GridSpan::GridSpanIterator::GridSpanIterator): Deleted.
        (WebCore::GridSpan::GridSpanIterator::operator unsigned&): Deleted.
        * rendering/style/GridResolvedPosition.cpp:
        (WebCore::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveGridPositionAgainstOppositePosition):
        (WebCore::resolveGridPositionFromStyle):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromStyle):
        (WebCore::GridResolvedPosition::spanSizeForAutoPlacedItem): Deleted.

2016-03-09  Myles C. Maxfield  <mmaxfield@apple.com>

        [iOS] Arabic text on Wikipedia is shown as boxes
        https://bugs.webkit.org/show_bug.cgi?id=155129
        <rdar://problem/24919902>

        Reviewed by Darin Adler.

        GeezaPro is the PostScript name, not the family name.

        Test: fast/text/arabic-blacklisted.html

        * platform/graphics/ios/FontCacheIOS.mm:
        (WebCore::platformLookupFallbackFont):

2016-03-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197825.
        https://bugs.webkit.org/show_bug.cgi?id=155222

        It broke the EFL build. It is not dead code. (Requested by
        gyuyoung on #webkit).

        Reverted changeset:

        "Delete dead scrolling code"
        https://bugs.webkit.org/show_bug.cgi?id=155210
        http://trac.webkit.org/changeset/197825

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Element with maximum tabIndex cannot be returned by nextElementWithGreaterTabIndex()
        https://bugs.webkit.org/show_bug.cgi?id=155215

        Reviewed by Ryosuke Niwa.

        Element with maximum tabIndex cannot be returned by nextElementWithGreaterTabIndex()
        due to a bug in r197726. This patch fixes the issue by only comparing
        candidate.tabIndex to winningTabIndex if winner is non-null.

        Test: fast/events/max-tabindex-focus.html

        * page/FocusController.cpp:
        (WebCore::nextElementWithGreaterTabIndex):

2016-03-08  Sam Weinig  <sam@webkit.org>

        Stop using the UserContentController for injecting the override style sheet from CaptionUserPreferences
        https://bugs.webkit.org/show_bug.cgi?id=155211

        Reviewed by Dan Bernstein.

        The UserContentController is going to become read only from WebCore's perspective. The CaptionUserPreferences
        was relying on being able to set a UserStyleSheet on it, but this was really unnecessary complexity. Simplify
        things by storing the style sheet's source directly on the Page and teaching ExtensionStyleSheets about it
        explicitly.

        * dom/ExtensionStyleSheets.cpp:
        (WebCore::ExtensionStyleSheets::updateInjectedStyleSheetCache):
        If there is a captionUserPreferencesStyleSheet on the page, inject it.

        * page/CaptionUserPreferences.cpp:
        (WebCore::CaptionUserPreferences::updateCaptionStyleSheetOveride):
        Greatly simplify the code. Now, all this does is set the style sheet on each page.

        * page/Page.cpp:
        (WebCore::Page::invalidateInjectedStyleSheetCacheInAllFrames):
        Extract this out from UserContentController.

        (WebCore::Page::setUserContentController):
        Call the newly extracted invalidateInjectedStyleSheetCacheInAllFrames().

        (WebCore::Page::captionUserPreferencesStyleSheet):
        (WebCore::Page::setCaptionUserPreferencesStyleSheet):
        Add getter/setter. When setting, invalidate the style sheet cache.

        * page/Page.h:
        Add new members and functions.

        * page/UserContentController.cpp:
        (WebCore::UserContentController::addUserStyleSheet):
        (WebCore::UserContentController::removeUserStyleSheet):
        (WebCore::UserContentController::removeUserStyleSheets):
        (WebCore::UserContentController::removeAllUserContent):
        Switch to calling invalidateInjectedStyleSheetCacheInAllFramesInAllPages().

        (WebCore::UserContentController::invalidateInjectedStyleSheetCacheInAllFramesInAllPages):
        Rename and implement in terms of Page::invalidateInjectedStyleSheetCacheInAllFrames().

        * page/UserContentController.h:
        Rename function.

2016-03-08  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Memory Timeline should show MemoryPressure events
        https://bugs.webkit.org/show_bug.cgi?id=155158
        <rdar://problem/25026610>

        Reviewed by Brian Burg.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::releaseMemory):
        When responding to memory pressure, notify page inspectors.

        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        Remove unused includes.

        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::didHandleMemoryPressureImpl):
        * inspector/InspectorInstrumentation.h:
        (WebCore::InspectorInstrumentation::playbackStarted):
        (WebCore::InspectorInstrumentation::playbackPaused):
        (WebCore::InspectorInstrumentation::playbackFinished):
        (WebCore::InspectorInstrumentation::playbackHitPosition):
        (WebCore::InspectorInstrumentation::didHandleMemoryPressure):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore::InspectorMemoryAgent::didCreateFrontendAndBackend):
        (WebCore::InspectorMemoryAgent::willDestroyFrontendAndBackend):
        (WebCore::InspectorMemoryAgent::enable):
        (WebCore::InspectorMemoryAgent::disable):
        (WebCore::InspectorMemoryAgent::didHandleMemoryPressure):
        * inspector/InspectorMemoryAgent.h:
        * inspector/InstrumentingAgents.cpp:
        (WebCore::InstrumentingAgents::reset):
        * inspector/InstrumentingAgents.h:
        (WebCore::InstrumentingAgents::inspectorMemoryAgent):
        (WebCore::InstrumentingAgents::setInspectorMemoryAgent):
        Plumbing to notify the right active inspector.

2016-03-08  Myles C. Maxfield  <mmaxfield@apple.com>

        Delete dead scrolling code
        https://bugs.webkit.org/show_bug.cgi?id=155210

        Reviewed by Simon Fraser.

        No new tests because there is no behavior change.

        * page/FrameView.cpp:
        (WebCore::FrameView::layerForScrolling): Deleted.
        * page/FrameView.h:
        * page/scrolling/ScrollingCoordinator.cpp:
        (WebCore::ScrollingCoordinator::scrollLayerForScrollableArea): Deleted.
        * page/scrolling/ScrollingCoordinator.h:
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::horizontalScrollbar):
        (WebCore::ScrollableArea::verticalScrollbar):
        (WebCore::ScrollableArea::tiledBacking):
        (WebCore::ScrollableArea::layerForHorizontalScrollbar):
        (WebCore::ScrollableArea::layerForVerticalScrollbar):
        (WebCore::ScrollableArea::layerForScrollCorner):
        (WebCore::ScrollableArea::layerForOverhangAreas):
        (WebCore::ScrollableArea::layerForScrolling): Deleted.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::calculateClipRects): Deleted.
        * rendering/RenderLayer.h:

2016-03-08  Oliver Hunt  <oliver@apple.com>

        Start moving to separated writable and executable mappings in the JIT
        https://bugs.webkit.org/show_bug.cgi?id=155178

        Reviewed by Fil Pizlo.

        Update feature defines.

        * Configurations/FeatureDefines.xcconfig:

2016-03-08  Myles C. Maxfield  <mmaxfield@apple.com>

        Font size computed style is innaccurate
        https://bugs.webkit.org/show_bug.cgi?id=154705
        <rdar://problem/23474068>

        Reviewed by Timothy Hatcher.

        Safari rounds the font size value reported to getComputedStyle(). Neither Firefox
        nor Chrome do this.

        Covered by existing tests.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::getFontSizeCSSValuePreferringKeyword):
        (WebCore::fontSizeFromStyle):

2016-03-08  Ada Chan  <adachan@apple.com>

        Enable API related to the video fullscreen layer in MediaPlayerPrivateMediaStreamAVFObjC for Mac.
        https://bugs.webkit.org/show_bug.cgi?id=153239

        Reviewed by Eric Carlson.

        Reuse VideoFullscreenLayerManager to manage moving the video layer between the fullscreen
        layer and the inline layer depending on the current presentation mode.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::MediaPlayerPrivateMediaStreamAVFObjC):
        Create m_videoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::platformLayer):
        Return the video inline layer from the VideoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::createPreviewLayers):
        Call VideoFullscreenLayerManager::setVideoLayer() with the m_videoBackgroundLayer. To make sure
        the preview layer (a sublayer of m_videoBackgroundLayer) resize according to aspect ratio, set
        its contents gravity to kCAGravityResizeAspect. Also, set its autoresizing mask so it'll resize
        with its superlayer.
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::setVideoFullscreenLayer):
        Call VideoFullscreenLayerManager::setVideoFullscreenLayer().
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::setVideoFullscreenFrame):
        Call VideoFullscreenLayerManager::setVideoFullscreenFrame().

2016-03-08  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] Crash when a single load request causes multiple fonts to fail loading
        https://bugs.webkit.org/show_bug.cgi?id=155009

        Reviewed by Simon Fraser.

        In JavaScript, the first promise fulfillment/failure wins. However, in C++, any
        subsequent fulfillments/failures cause a crash.

        Test: fast/text/font-face-set-document-multiple-failure.html

        * css/CSSFontFace.cpp:
        (WebCore::iterateClients): Notifying a client may cause some other client
        to be destroyed, thereby modifying the clients set. This function allows
        for notifying clients in a resilient manner.
        (WebCore::CSSFontFace::setStyle): Update to use iterateClients().
        (WebCore::CSSFontFace::setWeight): Ditto.
        (WebCore::CSSFontFace::setUnicodeRange): Ditto.
        (WebCore::CSSFontFace::setVariantLigatures): Ditto.
        (WebCore::CSSFontFace::setVariantPosition): Ditto.
        (WebCore::CSSFontFace::setVariantCaps): Ditto.
        (WebCore::CSSFontFace::setVariantNumeric): Ditto.
        (WebCore::CSSFontFace::setVariantAlternates): Ditto.
        (WebCore::CSSFontFace::setVariantEastAsian): Ditto.
        (WebCore::CSSFontFace::setFeatureSettings): Ditto.
        (WebCore::CSSFontFace::setStatus): Ditto.
        (WebCore::CSSFontFace::notifyClientsOfFontPropertyChange): Deleted.
        * css/CSSFontFace.h: Adding a way for clients to make sure they don't register
        or deregister another client.
        * css/CSSFontFaceSet.cpp:
        (WebCore::CSSFontFaceSet::guardAgainstClientRegistrationChanges): Simple
        ref()/deref() pair.
        (WebCore::CSSFontFaceSet::stopGuardingAgainstClientRegistrationChanges):
        * css/CSSFontFaceSet.h:
        * css/FontFace.cpp: Ditto.
        (WebCore::FontFace::guardAgainstClientRegistrationChanges):
        (WebCore::FontFace::stopGuardingAgainstClientRegistrationChanges):
        * css/FontFace.h:
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::faceFinished): Make sure that we only fulfil or reject
        a promise once.
        * css/FontFaceSet.h:
        * dom/Document.cpp:
        (WebCore::Document::fonts): The CSSFontFaces inside the CSSFontSelector get
        created during style recalc. We may be in a state where there is a style
        recalc pending. In order to make sure the Javascript API sees the current
        state of the world, force a style recalc here (but only if one is pending).

2016-03-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197793 and r197799.
        https://bugs.webkit.org/show_bug.cgi?id=155195

        something weird happened while landing this and everything
        broke (Requested by olliej on #webkit).

        Reverted changesets:

        "Start moving to separated writable and executable mappings in
        the JIT"
        https://bugs.webkit.org/show_bug.cgi?id=155178
        http://trac.webkit.org/changeset/197793

        "arm64 build fix after r197793."
        http://trac.webkit.org/changeset/197799

2016-03-08  Mark Lam  <mark.lam@apple.com>

        synthesizePrototype() and friends need to be followed by exception checks (or equivalent).
        https://bugs.webkit.org/show_bug.cgi?id=155169

        Reviewed by Geoffrey Garen.

        No new tests because this issue is covered by existing tests when the fix for
        https://bugs.webkit.org/show_bug.cgi?id=154865 lands.  That patch is waiting for
        this patch to land first so as to not introduce test failures.

        * Modules/plugins/QuickTimePluginReplacement.mm:
        (WebCore::QuickTimePluginReplacement::installReplacement):
        * bindings/js/JSDeviceMotionEventCustom.cpp:
        (WebCore::readAccelerationArgument):
        (WebCore::readRotationRateArgument):
        * bindings/js/JSGeolocationCustom.cpp:
        (WebCore::createPositionOptions):
        * bindings/js/JSHTMLCanvasElementCustom.cpp:
        (WebCore::get3DContextAttributes):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructorConstructor::construct):
        * contentextensions/ContentExtensionParser.cpp:
        (WebCore::ContentExtensions::getTypeFlags):
        * html/HTMLMediaElement.cpp:
        (WebCore::setPageScaleFactorProperty):
        (WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
        (WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):

2016-03-08  Oliver Hunt  <oliver@apple.com>

        Start moving to separated writable and executable mappings in the JIT
        https://bugs.webkit.org/show_bug.cgi?id=155178

        Reviewed by Filip Pizlo.

        Update feature defines.

        * Configurations/FeatureDefines.xcconfig:

2016-03-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197766.
        https://bugs.webkit.org/show_bug.cgi?id=155183

        Has platform-specific code in non-platform files (Requested by
        smfr on #webkit).

        Reverted changeset:

        "AX: Force allow user zoom"
        https://bugs.webkit.org/show_bug.cgi?id=155056
        http://trac.webkit.org/changeset/197766

2016-03-08  Beth Dakin  <bdakin@apple.com>

        Add an event for when touch force changes
        https://bugs.webkit.org/show_bug.cgi?id=155143
        -and corresponding-
        rdar://problem/24068726

        Reviewed by Darin Adler.

        We will be able to test this once we fix the iOS touch tests. 

        This patch adds touchforcechange which is a lot like the iOS equivalent of 
        webkitmouseforcechanged. We had originally hoped to use touchmove to dispatch 
        force changes, but that turned out to be a compatibility nightmare.

        * dom/EventNames.h:
        (WebCore::EventNames::isTouchEventType):
        (WebCore::EventNames::isWheelEventType):
        (WebCore::EventNames::touchEventNames):
        * dom/GlobalEventHandlers.idl:
        * html/HTMLAttributeNames.in:
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::createEventHandlerNameMap):
        * platform/PlatformEvent.h:

2016-03-08  Anders Carlsson  <andersca@apple.com>

        Ignore deprecation warnings.

        * editing/cocoa/HTMLConverter.mm:
        (HTMLConverter::computedAttributesForElement):
        (HTMLConverter::_addMarkersToList):
        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::keyEvent):
        (WebCore::lastEventIsMouseUp):
        (WebCore::EventHandler::passSubframeEventToSubframe):
        (WebCore::EventHandler::passWheelEventToWidget):
        (WebCore::EventHandler::sendFakeEventsAfterWidgetTracking):
        * page/mac/TextIndicatorWindow.mm:
        (WebCore::TextIndicatorWindow::setTextIndicator):
        * platform/graphics/mac/IconMac.mm:
        (WebCore::Icon::paint):
        * platform/mac/CursorMac.mm:
        (WebCore::createCustomCursor):
        * platform/mac/DragImageMac.mm:
        (WebCore::dissolveDragImageToFraction):
        (WebCore::createDragImageFromImage):
        * platform/mac/EventLoopMac.mm:
        (WebCore::EventLoop::cycle):
        * platform/mac/PasteboardMac.mm:
        (WebCore::Pasteboard::setDragImage):
        * platform/mac/PlatformEventFactoryMac.mm:
        (WebCore::globalPointForEvent):
        (WebCore::pointForEvent):
        (WebCore::mouseButtonForEvent):
        (WebCore::mouseEventTypeForEvent):
        (WebCore::clickCountForEvent):
        (WebCore::textFromEvent):
        (WebCore::unmodifiedTextFromEvent):
        (WebCore::keyIdentifierForKeyEvent):
        (WebCore::isKeypadEvent):
        (WebCore::windowsKeyCodeForKeyEvent):
        (WebCore::isKeyUpEvent):
        (WebCore::modifiersForEvent):
        (WebCore::PlatformKeyboardEventBuilder::PlatformKeyboardEventBuilder):
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::scrollbarControlSizeToNSControlSize):
        * platform/mac/ThemeMac.mm:
        (-[WebCoreThemeView window]):
        (WebCore::controlSizeForFont):
        (WebCore::controlSizeFromPixelSize):
        (WebCore::setUpButtonCell):
        (WebCore::stepperControlSizeForFont):
        (WebCore::paintStepper):
        (WebCore::ThemeMac::minimumControlSize):
        * platform/mac/WebVideoFullscreenHUDWindowController.mm:
        (-[WebVideoFullscreenHUDWindow initWithContentRect:styleMask:backing:defer:]):
        (-[WebVideoFullscreenHUDWindow performKeyEquivalent:]):
        (-[WebVideoFullscreenHUDWindowController init]):
        (-[WebVideoFullscreenHUDWindowController keyDown:]):
        (-[WebVideoFullscreenHUDWindowController windowDidLoad]):
        * platform/mac/WebWindowAnimation.mm:
        (WebWindowAnimationDurationFromDuration):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::updateCachedSystemFontDescription):
        (WebCore::RenderThemeMac::controlSizeForFont):
        (WebCore::RenderThemeMac::controlSizeForCell):
        (WebCore::RenderThemeMac::controlSizeForSystemFont):
        (WebCore::RenderThemeMac::paintProgressBar):
        (WebCore::RenderThemeMac::popupMenuSize):
        (WebCore::RenderThemeMac::sliderThumbHorizontal):
        (WebCore::RenderThemeMac::sliderThumbVertical):

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed attempt to fix the 32bit build after r197782.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::ReliefLogger::logMemoryUsageChange):

2016-03-08  Antonio Gomes  <tonikitoo@webkit.org>

        Scrolling does not work when the mouse down is handled by a node
        https://bugs.webkit.org/show_bug.cgi?id=19033

        Reviewed by Simon Fraser.

        Test: fast/events/prevent-default-prevents-interaction-with-scrollbars-.html

        When a mouse press/down event happens on a scrollbar area, but event
        is default prevented in the document level**, for example, event does not get
        properly passed to scrollbars, although it should.

        Problem started long ago with r17770, and was improved with r19596.
        However, years later, the way Scrollbar* is obtained is still currently different
        weither event is default prevented or not.

        Patch uniforms the logic for both cases, and fixes the bug.

        Note: code before used to look like

        if (swallowEvent) {
            <code>
        } else {
            <bleh>
            <foo>
        }

        .. and now looks like

        if (!swallowEvent)
            <bleh>

        <code>

        if (!swallowEvent)
            <foo>

        ** e.g. document.addEventListener('mousedown', function (e) { e.preventDefault(); });

        * page/EventHandler.cpp:
        (WebCore::scrollbarForMouseEvent):
        (WebCore::EventHandler::handleMousePressEvent):

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed Windows build fix after r197728.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::ReliefLogger::logMemoryUsageChange):

2016-03-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197765.
        https://bugs.webkit.org/show_bug.cgi?id=155172

        The test added with this change is failing on all platforms.
        (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "ImageDocuments leak their world."
        https://bugs.webkit.org/show_bug.cgi?id=155167
        http://trac.webkit.org/changeset/197765

2016-03-08  Antti Koivisto  <antti@apple.com>

        Make Element const in ElementRuleCollector
        https://bugs.webkit.org/show_bug.cgi?id=155170

        Reviewed by Andreas Kling.

        More const.

        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::ElementRuleCollector):
        (WebCore::ElementRuleCollector::matchAllRules):
        * css/ElementRuleCollector.h:
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOne):
        (WebCore::SelectorChecker::matchesFocusPseudoClass):
        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateAddStyleRelationIfResolvingStyle):
        (WebCore::SelectorCompiler::addStyleRelationFunction):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateContextFunctionCallTest):
        (WebCore::SelectorCompiler::elementIsActive):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsFirstChild):
        (WebCore::SelectorCompiler::elementIsHovered):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsOnlyChild):
        (WebCore::SelectorCompiler::makeContextStyleUniqueIfNecessaryAndTestIsPlaceholderShown):
        (WebCore::SelectorCompiler::isPlaceholderShown):
        * cssjit/SelectorCompiler.h:
        * dom/StyledElement.h:
        (WebCore::StyledElement::additionalPresentationAttributeStyle):
        (WebCore::StyledElement::inlineStyle):
        (WebCore::StyledElement::collectStyleForPresentationAttribute):
        (WebCore::StyledElement::invalidateStyleAttribute):
        (WebCore::StyledElement::presentationAttributeStyle):
        * html/HTMLTableCellElement.cpp:
        (WebCore::HTMLTableCellElement::parseAttribute):
        (WebCore::HTMLTableCellElement::additionalPresentationAttributeStyle):
        * html/HTMLTableCellElement.h:
        * html/HTMLTableColElement.cpp:
        (WebCore::HTMLTableColElement::parseAttribute):
        (WebCore::HTMLTableColElement::additionalPresentationAttributeStyle):
        * html/HTMLTableColElement.h:
        * html/HTMLTableElement.cpp:
        (WebCore::leakBorderStyle):
        (WebCore::HTMLTableElement::additionalPresentationAttributeStyle):
        * html/HTMLTableElement.h:
        * html/HTMLTableSectionElement.cpp:
        (WebCore::HTMLTableSectionElement::create):
        (WebCore::HTMLTableSectionElement::additionalPresentationAttributeStyle):
        * html/HTMLTableSectionElement.h:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::didUnregisterNamedFlowContentElement):
        (WebCore::InspectorCSSAgent::forcePseudoState):
        * inspector/InspectorCSSAgent.h:
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
        (WebCore::InspectorDOMAgent::boundNodeId):
        (WebCore::InspectorDOMAgent::backendNodeIdForNode):
        * inspector/InspectorDOMAgent.h:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::handleMousePressImpl):
        (WebCore::InspectorInstrumentation::forcePseudoStateImpl):
        * inspector/InspectorInstrumentation.h:
        (WebCore::InspectorInstrumentation::handleMousePress):
        (WebCore::InspectorInstrumentation::forcePseudoState):

2016-03-08  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Commonalize handling of FetchBody by FetchRequest and FetchResponse
        https://bugs.webkit.org/show_bug.cgi?id=154959

        Reviewed by Darin Adler.

        Introducing FetchBodyOwner class as base class of FetchRequest and FetchResponse.
        This class is an ActiveDOMObject and is responsible of handling the Body API implemented by Request and Response.

        Covered by existing tests.

        * Modules/fetch/FetchBodyOwner.h: Added.
        (WebCore::FetchBodyOwner::isDisturbed):
        (WebCore::FetchBodyOwner::arrayBuffer):
        (WebCore::FetchBodyOwner::formData):
        (WebCore::FetchBodyOwner::blob):
        (WebCore::FetchBodyOwner::json):
        (WebCore::FetchBodyOwner::text):
        (WebCore::FetchBodyOwner::body):
        (WebCore::FetchBodyOwner::FetchBodyOwner):
        * Modules/fetch/FetchRequest.h:
        (WebCore::FetchRequest::FetchRequest):
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::FetchResponse):
        * Modules/fetch/FetchResponse.h:
        * WebCore.xcodeproj/project.pbxproj:

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed, fix 32-bit build after r197726.

        Also, re-enable static_assert to check the ElementRareData size.

        * dom/ElementRareData.cpp:

2016-03-08  Brent Fulgham  <bfulgham@apple.com>

        Unreviewed test fix after r197721.
        https://bugs.webkit.org/show_bug.cgi?id=155120
        <rdar://problem/25010167>

        If a WK1 client turns on the "Resource Load Statistics" debug flag, but
        does not supply a data modification handler, we dereference a null function.

        * loader/ResourceLoadStatisticsStore.cpp:
        (WebCore::ResourceLoadStatisticsStore::fireDataModificationHandler): Check
        for nullptr function before invoking it.

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed, temporarily comment out static_assert while I investigate.

        It still did not build on some platforms.

        * dom/ElementRareData.cpp:

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed, another build fix after r197726.

        * dom/ElementRareData.cpp:

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed Windows build fix after r197728.

        * platform/MemoryPressureHandler.cpp:

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed build fix after r197726.

        * dom/ElementRareData.cpp:

2016-03-08  Nan Wang  <n_wang@apple.com>

        AX: Force allow user zoom
        https://bugs.webkit.org/show_bug.cgi?id=155056

        Reviewed by Chris Fleizach.

        Override the maximum scale factor when forceAlwaysUserScalable is true.

        Test: accessibility/ios-simulator/force-user-scalable.html

        * page/ViewportConfiguration.h:
        (WebCore::ViewportConfiguration::maximumScale):
        * testing/Internals.cpp:
        (WebCore::Internals::composedTreeAsText):
        (WebCore::Internals::setViewportForceAlwaysUserScalable):
        (WebCore::Internals::viewportConfigurationMaximumScale):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-03-08  Andreas Kling  <akling@apple.com>

        ImageDocuments leak their world.
        <https://webkit.org/b/155167>
        <rdar://problem/24987363>

        Reviewed by Antti Koivisto.

        ImageDocument uses a special code path in ImageLoader in order to manually
        control how the image is loaded. It has to do this because the ImageDocument
        is really just a synthetic wrapper around a main resource that's an image.

        This custom loading code had a bug where it would create a new CachedImage
        and neglect to set its CachedResource::m_state flag to Pending (which is
        normally set by CachedResource::load(), but we don't call that for these.)

        This meant that when ImageDocument called CachedImage::finishLoading() to
        trigger the notifyFinished() callback path, the image would look at its
        loading state and see that it was Unknown (not Pending), and conclude that
        it hadn't loaded yet. So we never got the notifyFinished() signal.

        The world leaks here because ImageLoader slaps a ref on its <img> element
        while it waits for the loading operation to complete. Once finished, whether
        successfully or with an error, it derefs the <img>.

        Since we never fired notifyFinished(), we ended up with an extra ref on
        these <img> forever, and then the element kept its document alive too.

        Test: fast/dom/ImageDocument-world-leak.html

        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::updateFromElement):

2016-03-07  Antti Koivisto  <antti@apple.com>

        ElementRuleCollector should not mutate document and style
        https://bugs.webkit.org/show_bug.cgi?id=155113

        Reviewed by Andreas Kling.

        Move applying of style relations out of ElementRuleCollector and StyleResolver.
        This gets us closer to making StyleResolver const for Element.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::ElementRuleCollector):

            No need for style parameter anymore.

        (WebCore::ElementRuleCollector::collectMatchingRules):
        (WebCore::ElementRuleCollector::sortAndTransferMatchedRules):
        (WebCore::ElementRuleCollector::ruleMatches):

            Client will now do the style and element mutations. Just collect the data here.

        (WebCore::ElementRuleCollector::collectMatchingRulesForList):
        (WebCore::ElementRuleCollector::commitStyleRelations): Deleted.

            Moves to StyleRelations.cpp

        * css/ElementRuleCollector.h:
        (WebCore::ElementRuleCollector::hasMatchedRules):
        (WebCore::ElementRuleCollector::matchedPseudoElementIds):
        (WebCore::ElementRuleCollector::styleRelations):
        (WebCore::ElementRuleCollector::didMatchUncommonAttributeSelector):
        * css/MediaQueryMatcher.cpp:
        (WebCore::MediaQueryMatcher::prepareEvaluator):
        (WebCore::MediaQueryMatcher::evaluate):
        * css/SelectorChecker.cpp:
        (WebCore::addStyleRelation):
        (WebCore::isFirstChildElement):
        (WebCore::isFirstOfType):
        (WebCore::countElementsBefore):
        (WebCore::countElementsOfTypeBefore):
        (WebCore::SelectorChecker::matchRecursively):
        (WebCore::SelectorChecker::checkOne):
        * css/SelectorChecker.h:
        (WebCore::SelectorChecker::CheckingContext::CheckingContext):
        * css/StyleMedia.cpp:
        (WebCore::StyleMedia::matchMedium):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::StyleResolver):
        (WebCore::isAtShadowBoundary):
        (WebCore::StyleResolver::styleForElement):

            Apply the style relations affecting current style immediately.
            Pass the rest to the client.

        (WebCore::StyleResolver::styleForKeyframe):
        (WebCore::StyleResolver::pseudoStyleForElement):
        (WebCore::StyleResolver::pseudoStyleRulesForElement):
        * css/StyleResolver.h:
        (WebCore::ElementStyle::ElementStyle):
        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateAddStyleRelationIfResolvingStyle):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateAddStyleRelation):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorCheckerExcludingPseudoElements):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateDirectAdjacentTreeWalker):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateIndirectAdjacentTreeWalker):
        (WebCore::SelectorCompiler::addStyleRelationFunction):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsActive):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsEmpty):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsFirstChild):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsHovered):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsLastChild):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsOnlyChild):
        (WebCore::SelectorCompiler::makeContextStyleUniqueIfNecessaryAndTestIsPlaceholderShown):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChild):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChildOf):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthLastChild):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthLastChildOf):
        * dom/Document.cpp:
        (WebCore::Document::styleForElementIgnoringPendingStylesheets):

            Apply style relations.

        (WebCore::Document::updateLayoutIfDimensionsOutOfDate):
        * dom/Element.cpp:
        (WebCore::Element::styleResolver):
        (WebCore::Element::resolveStyle):
        (WebCore::Element::didDetachRenderers):
        (WebCore::Element::resolveCustomStyle):

            Return ElementStyle (which contains style relations along with the render style).
            Rename for consistency.

        (WebCore::Element::cloneAttributesFromElement):
        (WebCore::Element::customStyleForRenderer): Deleted.
        * dom/Element.h:
        (WebCore::Element::isVisibleInViewportChanged):
        * dom/PseudoElement.cpp:
        (WebCore::PseudoElement::clearHostElement):
        (WebCore::PseudoElement::resolveCustomStyle):
        (WebCore::PseudoElement::didAttachRenderers):
        (WebCore::PseudoElement::customStyleForRenderer): Deleted.
        * dom/PseudoElement.h:
        * html/HTMLTitleElement.cpp:
        (WebCore::HTMLTitleElement::computedTextWithDirection):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::hostInput):
        (WebCore::SliderThumbElement::resolveCustomStyle):
        (WebCore::SliderThumbElement::shadowPseudoId):
        (WebCore::SliderContainerElement::createElementRenderer):
        (WebCore::SliderContainerElement::resolveCustomStyle):
        (WebCore::SliderContainerElement::shadowPseudoId):
        (WebCore::SliderThumbElement::customStyleForRenderer): Deleted.
        (WebCore::SliderContainerElement::customStyleForRenderer): Deleted.
        * html/shadow/SliderThumbElement.h:
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::TextControlInnerElement::create):
        (WebCore::TextControlInnerElement::resolveCustomStyle):
        (WebCore::TextControlInnerTextElement::renderer):
        (WebCore::TextControlInnerTextElement::resolveCustomStyle):
        (WebCore::TextControlPlaceholderElement::TextControlPlaceholderElement):
        (WebCore::TextControlPlaceholderElement::resolveCustomStyle):
        (WebCore::TextControlInnerElement::customStyleForRenderer): Deleted.
        (WebCore::TextControlInnerTextElement::customStyleForRenderer): Deleted.
        (WebCore::TextControlPlaceholderElement::customStyleForRenderer): Deleted.
        * html/shadow/TextControlInnerElements.h:
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::getUncachedPseudoStyle):
        * rendering/RenderNamedFlowFragment.cpp:
        (WebCore::RenderNamedFlowFragment::computeStyleInRegion):
        (WebCore::RenderNamedFlowFragment::computeChildrenStyleInRegion):
        * style/StyleRelations.cpp: Added.
        (WebCore::Style::commitRelationsToRenderStyle):

            Commit relations affecting style that is being computed.

        (WebCore::Style::commitRelationsToDocument):

            Commit relations that mutate document.

        * style/StyleRelations.h: Added.

            Factor style relation data structures and functions to a file of their own.

        (WebCore::Style::Relation::Relation):
        * style/StyleSharingResolver.cpp:
        (WebCore::Style::SharingResolver::styleSharingCandidateMatchesRuleSet):
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::styleForElement):

            Apply style relations.

        * style/StyleTreeResolver.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::synchronizeSystemLanguage):
        (WebCore::SVGElement::resolveCustomStyle):
        (WebCore::SVGElement::customStyleForRenderer): Deleted.
        * svg/SVGElement.h:
        * svg/SVGElementRareData.h:
        (WebCore::SVGElementRareData::overrideComputedStyle):

2016-03-08  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Implement fetch skeleton
        https://bugs.webkit.org/show_bug.cgi?id=155111

        Reviewed by Darin Adler.

        Adding skeleton code to call fetch API from normal and worker scopes.
        Fetch API implementation is limited to reject the promise.

        Updating the binding generator to fix the case of overloaded promise-returning functions.
        Made overloaded utility functions "static inline".

        Tests: imported/w3c/web-platform-tests/fetch/api/basic/accept-header-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/accept-header.html
               imported/w3c/web-platform-tests/fetch/api/basic/integrity-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/integrity.html
               imported/w3c/web-platform-tests/fetch/api/basic/mode-no-cors-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/mode-no-cors.html
               imported/w3c/web-platform-tests/fetch/api/basic/mode-same-origin-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/mode-same-origin.html
               imported/w3c/web-platform-tests/fetch/api/basic/request-forbidden-headers-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/request-forbidden-headers.html
               imported/w3c/web-platform-tests/fetch/api/basic/request-headers-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/request-headers.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-about-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-about.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-blob-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-blob.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-data-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-data.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-others-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-others.html
               imported/w3c/web-platform-tests/fetch/api/basic/stream-response-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/stream-response.html

        * CMakeLists.txt:
        * DerivedSources.make:
        * Modules/fetch/DOMWindowFetch.cpp: Added.
        (WebCore::DOMWindowFetch::fetch):
        * Modules/fetch/DOMWindowFetch.h: Added.
        * Modules/fetch/DOMWindowFetch.idl: Added.
        * Modules/fetch/WorkerGlobalScopeFetch.cpp: Added.
        (WebCore::WorkerGlobalScopeFetch::fetch):
        * Modules/fetch/WorkerGlobalScopeFetch.h: Added.
        * Modules/fetch/WorkerGlobalScopeFetch.idl: Added.
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation): Fixing the case of overloaded promise-returning functions.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod1):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod3):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod4):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod5):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod6):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod7):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod8):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod9):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod10):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod11):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod12):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter1):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2):
        (WebCore::jsTestObjConstructorFunctionOverloadedMethod11):
        (WebCore::jsTestObjConstructorFunctionOverloadedMethod12):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1Promise):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2Promise):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod): Deleted.
        (WebCore::jsTestObjConstructorFunctionClassMethod2): Deleted.
        (WebCore::jsTestObjPrototypeFunctionAny): Deleted.
        (WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionPromise): Deleted.
        (WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithFloatArgumentPromise): Deleted.
        (WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithExceptionPromise): Deleted.
        * bindings/scripts/test/TestObj.idl:

2016-03-08  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Make FetchRequest and FetchResponse ActiveDOMObject
        https://bugs.webkit.org/show_bug.cgi?id=154729

        Reviewed by Darin Adler.

        Covered by existing tests.

        Making FetchRequest and FetchResponse ActiveDOMObject.
        Both objects can always be suspended now.
        This might be updated when blob conversion is added or when fetching data to fill in FetchResponse.

        * Modules/fetch/FetchRequest.cpp:
        (WebCore::FetchRequest::create):
        (WebCore::FetchRequest::clone):
        (WebCore::FetchRequest::activeDOMObjectName):
        (WebCore::FetchRequest::canSuspendForDocumentSuspension):
        * Modules/fetch/FetchRequest.h:
        (WebCore::FetchRequest::FetchRequest):
        * Modules/fetch/FetchRequest.idl:
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::error):
        (WebCore::FetchResponse::redirect):
        (WebCore::FetchResponse::FetchResponse):
        (WebCore::FetchResponse::clone):
        (WebCore::FetchResponse::activeDOMObjectName):
        (WebCore::FetchResponse::canSuspendForDocumentSuspension):
        * Modules/fetch/FetchResponse.h:
        (WebCore::FetchResponse::create):
        * Modules/fetch/FetchResponse.idl:

2016-03-08  Nikos Andronikos  <nikos.andronikos-webkit@cisra.canon.com.au>

        [SVG2] Implement marker orient='auto-start-reverse'
        https://bugs.webkit.org/show_bug.cgi?id=138456

        Reviewed by Darin Adler.

        https://www.w3.org/TR/SVG2/painting.html#OrientAttribute
        marker-start markers must be oriented at 180 degrees to the direction of the path when
        the orient attribute of the marker is set to 'auto-start-reverse'.

        To acheive this the SVGMarkerData class which calculates the angles for each marker on
        a path must know whether the orient type is set to reverse the start marker. 

        Tests: svg/animations/animate-marker-orient-from-angle-to-autostartreverse.html
               svg/animations/animate-marker-orienttype-4.html
               svg/custom/marker-auto-start-reverse.html

        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::processMarkerPositions):
          Create marker data, using animated value of orient to determine
          if first marker should be reversed.
        * rendering/svg/SVGMarkerData.h:
        (WebCore::SVGMarkerData::SVGMarkerData):
          Constructor now requires boolean indicating if start marker is 
          reversed.
        (WebCore::SVGMarkerData::currentAngle):
          Take into account whether start marker should be reversed.
        * rendering/svg/SVGResources.cpp:
        (WebCore::SVGResources::markerReverseStart):
          New function to query whether start marker should be reversed.
        * rendering/svg/SVGResources.h:
          Add declaration for new function.
        * svg/SVGAnimatedAngle.cpp:
        (WebCore::SVGAnimatedAngleAnimator::calculateAnimatedValue):
          Support animation including the value auto-start-reverse.
        * svg/SVGMarkerElement.cpp:
        (WebCore::SVGMarkerElement::setOrient):
          Combine duplicated functionality into one private method
        (WebCore::SVGMarkerElement::setOrientToAuto):
          Set orient type and angle correctly for orient=auto. Uses setOrient.
        (WebCore::SVGMarkerElement::setOrientToAngle):
          Set orient type and angle correctly for orient=<angle>. Uses setOrient.
        (WebCore::SVGMarkerElement::synchronizeOrientType):
          Support auto-start-reverse as a possible case.
        * svg/SVGMarkerElement.h:
        (WebCore::SVGIDLEnumLimits<SVGMarkerOrientType>::highestExposedEnumValue):
          Limit the orient DOM property so that the new enum value
          required for auto-start-reverse is not exposed.
        (WebCore::SVGPropertyTraits<SVGMarkerOrientType>::highestEnumValue):
          Support auto-start-reverse.
        (WebCore::SVGPropertyTraits<SVGMarkerOrientType>::fromString):
          Support auto-start-reverse.

2016-03-07  Keith Rollin  <krollin@apple.com>

        Enhance logging: Use "always on" macros
        https://bugs.webkit.org/show_bug.cgi?id=154499
        <rdar://problem/24757730>

        Reviewed by Chris Dumez.

        Make use of new logging macros by reporting on frame and resource
        load activity.

        Add new logging to memory pressure handler to show when it's called
        and its effectiveness. As part of this change, the various
        platform-specific implementations have been unified.

        No new tests. No new basic functionality has been added. Only new
        logging has been added in release mode or has been enabled to execute
        in release mode as well as debug mode.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::prepareForLoadStart):
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        (WebCore::FrameLoader::isAlwaysOnLoggingAllowed):
        * loader/FrameLoader.h:
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::isAlwaysOnLoggingAllowed):
        * loader/ResourceLoader.h:
        * page/Frame.cpp:
        (WebCore::Frame::isAlwaysOnLoggingAllowed):
        * page/Frame.h:
        * page/Page.cpp:
        (WebCore::Page::isAlwaysOnLoggingAllowed):
        * page/Page.h:
        * page/SessionID.h:
        (WebCore::SessionID::isAlwaysOnLoggingAllowed):
        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::ReliefLogger::logMemoryUsageChange):
        (WebCore::MemoryPressureHandler::ReliefLogger::platformLog): Deleted.
        * platform/MemoryPressureHandler.h:
        (WebCore::MemoryPressureHandler::ReliefLogger::ReliefLogger):
        (WebCore::MemoryPressureHandler::ReliefLogger::~ReliefLogger):
        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        (WebCore::MemoryPressureHandler::ReliefLogger::platformLog): Deleted.
        * platform/linux/MemoryPressureHandlerLinux.cpp:
        (WebCore::MemoryPressureHandler::ReliefLogger::platformLog): Deleted.
        * platform/win/MemoryPressureHandlerWin.cpp:
        (WebCore::MemoryPressureHandler::ReliefLogger::platformLog): Deleted.

2016-03-07  Chris Dumez  <cdumez@apple.com>

        Align HTMLCanvasElement.width / height with the specification
        https://bugs.webkit.org/show_bug.cgi?id=155156

        Reviewed by Ryosuke Niwa.

        Align HTMLCanvasElement.width / height with the specification:
        - https://html.spec.whatwg.org/multipage/scripting.html#dom-canvas-width
        - https://html.spec.whatwg.org/multipage/scripting.html#attr-canvas-width

        In particular, the following changes were made:
        1. The attributes are now 'unsigned long' instead of 'long'
        2. The corresponding content attributes are parsed as per the HTML rules
           for passing non-negative integers.
        3. Upon setting, if the value is out-of-range, the content attributes is
           set to its default value.

        No new tests, already covered by existing test.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::setHeight):
        (WebCore::HTMLCanvasElement::setWidth):
        (WebCore::HTMLCanvasElement::reset):
        * html/HTMLCanvasElement.h:
        * html/HTMLCanvasElement.idl:

2016-03-07  Chris Dumez  <cdumez@apple.com>

        Stop clamping HTMLElement.tabIndex to the range of a short
        https://bugs.webkit.org/show_bug.cgi?id=155159

        Reviewed by Ryosuke Niwa.

        Stop clamping HTMLElement.tabIndex to the range of a short. We
        apparently did this to match Firefox. However, this no longer matches
        Firefox's behavior nor the HTML specification:
        - https://html.spec.whatwg.org/multipage/interaction.html#dom-tabindex

        No new tests, already covered by existing test.

        * dom/Element.cpp:
        (WebCore::Element::setTabIndexExplicitly):
        (WebCore::Element::tabIndex):
        * dom/Element.h:
        * dom/ElementRareData.h:
        (WebCore::ElementRareData::tabIndex):
        (WebCore::ElementRareData::setTabIndexExplicitly):
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::tabIndex):
        * html/HTMLAnchorElement.h:
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::parseAttribute):
        (WebCore::HTMLElement::tabIndex):
        * html/HTMLElement.h:
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::tabIndex):
        * html/HTMLFormControlElement.h:
        * page/FocusController.cpp:
        (WebCore::nextElementWithGreaterTabIndex):
        (WebCore::FocusController::previousFocusableElement):
        * svg/SVGAElement.cpp:
        (WebCore::SVGAElement::tabIndex):
        * svg/SVGAElement.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::tabIndex):
        (WebCore::SVGElement::parseAttribute):
        * svg/SVGElement.h:

2016-03-07  Daniel Bates  <dabates@apple.com>

        CSP: Source '*' should not match URLs with schemes blob, data, or filesystem
        https://bugs.webkit.org/show_bug.cgi?id=154122
        <rdar://problem/24613336>

        Reviewed by Brent Fulgham.

        Restrict matching of source expression * to HTTP or HTTPS URLs for all directives except
        img-src and media-src. This policy is more restrictive than the policy described in section
        Matching Source Expressions of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721>,
        which restricts matching * to schemes that are not blob, data, or filesystem.

        For directive img-src we restrict matching of * to HTTP, HTTPS, and data URLs. For directive
        media-src we restrict matching of * to HTTP, HTTPS, data URLs and blob URLs. We use a
        more lenient interpretation of * for directives img-src and media-src than required by
        the spec. to mitigate web compatibility issues.

        Tests: fast/dom/HTMLImageElement/image-with-blob-url-blocked-by-csp-img-src-star.html
               fast/dom/HTMLImageElement/image-with-data-url-allowed-by-csp-img-src-star.html
               fast/dom/HTMLImageElement/image-with-file-url-blocked-by-csp-img-src-star.html
               fast/dom/HTMLLinkElement/link-with-blob-url-blocked-by-csp-style-src-star.html
               fast/dom/HTMLLinkElement/link-with-data-url-blocked-by-csp-style-src-star.html
               fast/dom/HTMLLinkElement/link-with-file-url-blocked-by-csp-style-src-star.html
               http/tests/security/contentSecurityPolicy/image-with-http-url-allowed-by-csp-img-src-star.html
               http/tests/security/contentSecurityPolicy/image-with-https-url-allowed-by-csp-img-src-star.html
               http/tests/security/contentSecurityPolicy/javascript-url-blocked-by-default-src-star.html
               http/tests/security/contentSecurityPolicy/link-with-http-url-allowed-by-csp-style-src-star.html
               http/tests/security/contentSecurityPolicy/link-with-https-url-allowed-by-csp-style-src-star.html
               http/tests/security/contentSecurityPolicy/video-with-http-url-allowed-by-csp-media-src-star.html
               http/tests/security/contentSecurityPolicy/video-with-https-url-allowed-by-csp-media-src-star.html
               media/video-with-blob-url-allowed-by-csp-media-src-star.html
               media/video-with-data-url-allowed-by-csp-media-src-star.html
               media/video-with-file-url-blocked-by-csp-media-src-star.html

        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::isProtocolAllowedByStar): Added.
        (WebCore::ContentSecurityPolicySourceList::matches): Modified to only match * if ContentSecurityPolicySourceList::isProtocolAllowedByStar().
        evaluates to true.
        * page/csp/ContentSecurityPolicySourceList.h:

2016-03-07  Brent Fulgham  <bfulgham@apple.com>

        Reduce startup and shutdown cost of resource load statistics
        https://bugs.webkit.org/show_bug.cgi?id=155120
        <rdar://problem/25010167>

        Reviewed by Andy Estes.

        Move all file-related code out of WebCore.

        * loader/ResourceLoadStatisticsStore.cpp:
        (WebCore::ResourceLoadStatisticsStore::create): Deleted path overload.
        (WebCore::ResourceLoadStatisticsStore::createEncoderFromData): Added.
        (WebCore::ResourceLoadStatisticsStore::readDataFromDecoder): Added.
        (WebCore::ResourceLoadStatisticsStore::ResourceLoadStatisticsStore): Deleted.
        (WebCore::ResourceLoadStatisticsStore::writeDataToDisk): Deleted.
        (WebCore::ResourceLoadStatisticsStore::setStatisticsStorageDirectory): Deleted.
        (WebCore::ResourceLoadStatisticsStore::persistentStoragePath): Deleted.
        (WebCore::ResourceLoadStatisticsStore::readDataFromDiskIfNeeded): Deleted.
        (WebCore::ResourceLoadStatisticsStore::createDecoderFromDisk): Deleted.
        (WebCore::ResourceLoadStatisticsStore::writeEncoderToDisk): Deleted.
        * loader/ResourceLoadStatisticsStore.h:
        (WebCore::ResourceLoadStatisticsStore::clear): Added.

2016-03-07  Zalan Bujtas  <zalan@apple.com>

        Crash in WebCore::RenderElement::containingBlockForObjectInFlow
        https://bugs.webkit.org/show_bug.cgi?id=155109

        Reviewed by Simon Fraser.

        It's unsafe to call containingBlock() on RenderView.

        Unable to reproduce.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::styleWillChange):
        (WebCore::RenderBlock::isSelfCollapsingBlock):
        (WebCore::RenderBlock::selectionGaps):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::borderBoxRectInRegion):
        (WebCore::RenderBox::computePercentageLogicalHeight):
        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
        (WebCore::logicalWidthIsResolvable):
        (WebCore::RenderBox::percentageLogicalHeightIsResolvableFromBlock):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::hasAutoHeightOrContainingBlockWithAutoHeight):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::adjustedPositionRelativeToOffsetParent):
        (WebCore::RenderFlowThread::offsetFromLogicalTopOfFirstRegion):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::hasCompositedLayerInEnclosingPaginationChain):
        (WebCore::RenderLayer::updatePagination):
        (WebCore::inContainingBlockChain):
        * rendering/RenderMultiColumnFlowThread.cpp:
        (WebCore::isValidColumnSpanner):
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::decorationsClipRectForBoxInNamedFlowFragment):
        * rendering/RenderObject.cpp:
        (WebCore::hasFixedPosInNamedFlowContainingBlock):
        * rendering/RenderReplaced.cpp:
        (WebCore::firstContainingBlockWithLogicalWidth):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::subtreeSelectionBounds):
        (WebCore::RenderView::repaintSubtreeSelection):
        (WebCore::RenderView::clearSubtreeSelection):
        (WebCore::RenderView::applySubtreeSelection):

2016-03-07  Daniel Bates  <dabates@apple.com>

        Cleanup: Add convenience function URL::procotolIsBlob()
        https://bugs.webkit.org/show_bug.cgi?id=155127
        <rdar://problem/25016829>

        Reviewed by Brent Fulgham.

        Similar to the class member function URL::protocolIsData(), add a class member function to
        class URL to determine if a URL is a blob URL.

        No functionality was changed. So, no new tests.

        * page/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::shouldUseInnerURL): Modified to use URL::protocolIsBlob().
        (WebCore::getCachedOrigin): Ditto.
        * platform/URL.h:
        (WebCore::URL::protocolIsBlob): Added.
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (webKitWebSrcStart): Modified to use URL::protocolIsBlob().
        (urlHasSupportedProtocol): Ditto.
        * workers/Worker.cpp:
        (WebCore::Worker::didReceiveResponse): Ditto.
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::createRequest): Ditto.

2016-03-07  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Implement MediaEndpointPeerConnection::createOffer()
        https://bugs.webkit.org/show_bug.cgi?id=154867

        Reviewed by Eric Carlson and Jer Noble.

        - MediaEndpointPeerConnection: Initial implementation of createOffer()
        added. createOffer() is split up into a synchronous part, and a
        scheduled task. The task will be deferred until information, requiring
        some amount of work, such as the DTLS fingerprint is available. Other
        async API functions will also follow this pattern.

        - SDPProcessor (added): The SDPProcessors parses SDP to a
        MediaEndpointSessionConfiguration object and generates SDP in the
        reverse direction. Any SDP string handling is confined to the
        SDPProcessor and all configuration of the media session is done via the
        MediaEndpointSessionConfiguration object.

        The SDP parser and generator logic is implemented in JavaScript and
        works with JSON (SDP->JSON, JSON->SDP). The SDPProcessor runs JS in an
        isolated scope and converts JSON to a MediaEndpointSessionConfiguration
        object and the reverse. Using JSON signaling (nonstandard) can be
        helpful during debugging.

        - MockMediaEndpoint (added): Mock MediaEndpoint implementation with
        support for generating offers. DTLS information, such as fingerprint,
        is hard coded to facilitate testing with expected values.

        Test: fast/mediastream/RTCPeerConnection-inspect-offer.html

        The test is currently skipped on the mac port until support to read the
        SDPProcessor JavaScript resource is added.

        * CMakeLists.txt:
        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::WrappedSessionDescriptionPromise::create):
        (WebCore::WrappedSessionDescriptionPromise::promise):
        (WebCore::WrappedSessionDescriptionPromise::WrappedSessionDescriptionPromise):
        (WebCore::randomString):
        (WebCore::MediaEndpointPeerConnection::MediaEndpointPeerConnection):
        (WebCore::MediaEndpointPeerConnection::runTask):
        (WebCore::MediaEndpointPeerConnection::startRunningTasks):
        (WebCore::MediaEndpointPeerConnection::createOffer):
        (WebCore::MediaEndpointPeerConnection::createOfferTask):
        (WebCore::MediaEndpointPeerConnection::gotDtlsFingerprint):
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/mediastream/SDPProcessor.cpp: Added.
        (WebCore::SDPProcessor::SDPProcessor):
        (WebCore::createCandidateObject):
        (WebCore::createCandidate):
        (WebCore::configurationFromJSON):
        (WebCore::iceCandidateFromJSON):
        (WebCore::configurationToJSON):
        (WebCore::iceCandidateToJSON):
        (WebCore::SDPProcessor::generate):
        (WebCore::SDPProcessor::parse):
        (WebCore::SDPProcessor::generateCandidateLine):
        (WebCore::SDPProcessor::parseCandidateLine):
        (WebCore::SDPProcessor::callScript):
        * Modules/mediastream/SDPProcessor.h: Added.
        * Modules/mediastream/sdp.js: Added.
        (match):
        (addDefaults):
        (fillTemplate):
        (SDP.parse):
        (SDP.generate):
        (SDP.generateCandidateLine):
        (hasAllProperties):
        (SDP.verifyObject):
        (generate):
        (parse):
        (generateCandidateLine):
        (parseCandidateLine):
        * PlatformGTK.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/mediastream/MediaEndpoint.cpp:
        (WebCore::createMediaEndpoint):
        * platform/mediastream/MediaEndpoint.h:
        * platform/mediastream/PeerMediaDescription.h:
        * platform/mediastream/SDPProcessorScriptResource.cpp: Added.
        (WebCore::SDPProcessorScriptResource::scriptString):
        * platform/mediastream/SDPProcessorScriptResource.h: Added.
        * platform/mediastream/gtk/SDPProcessorScriptResourceGtk.cpp: Added.
        (WebCore::SDPProcessorScriptResource::scriptString):
        * platform/mock/MockMediaEndpoint.cpp: Added.
        (WebCore::MockMediaEndpoint::create):
        (WebCore::MockMediaEndpoint::MockMediaEndpoint):
        (WebCore::MockMediaEndpoint::~MockMediaEndpoint):
        (WebCore::MockMediaEndpoint::setConfiguration):
        (WebCore::MockMediaEndpoint::generateDtlsInfo):
        (WebCore::MockMediaEndpoint::getDefaultAudioPayloads):
        (WebCore::MockMediaEndpoint::getDefaultVideoPayloads):
        (WebCore::MockMediaEndpoint::updateReceiveConfiguration):
        (WebCore::MockMediaEndpoint::updateSendConfiguration):
        (WebCore::MockMediaEndpoint::addRemoteCandidate):
        (WebCore::MockMediaEndpoint::replaceSendSource):
        (WebCore::MockMediaEndpoint::stop):
        * platform/mock/MockMediaEndpoint.h: Added.
        * testing/Internals.cpp:
        (WebCore::Internals::Internals):
        (WebCore::Internals::enableMockMediaEndpoint):
        * testing/Internals.h:

2016-03-07  Daniel Bates  <dabates@apple.com>

        CSP: object-src directive should prohibit creation of nested browsing context
        https://bugs.webkit.org/show_bug.cgi?id=153153
        <rdar://problem/24383209>

        Reviewed by Brent Fulgham.

        Enforce the Content Security Policy object-src directive when fetching a URL for content
        that will cause an HTML object or HTML embed element to act as a nested browsing context
        (i.e. behave as if the content was loaded in an HTML iframe element). This makes our
        enforcement of the object-src directive match the behavior of the object-src directive
        in the Content Security Policy 2.0 spec., <http://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        Tests: http/tests/security/contentSecurityPolicy/embed-src-url-blocked.html
               http/tests/security/contentSecurityPolicy/embed-src-url-blocked2.html
               http/tests/security/contentSecurityPolicy/object-src-param-src-blocked2.html
               http/tests/security/contentSecurityPolicy/object-src-url-blocked2.html

        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::isPluginContentAllowedByContentSecurityPolicy): Extracted from SubframeLoader::pluginIsLoadable().
        Checks if the plugin element is allowed by the Content Security Policy to load the URL and MIME type.
        (WebCore::SubframeLoader::pluginIsLoadable): Extract out the logic for determining if
        the plugin content is allowed to load by the Content Security Policy into SubframeLoader::isPluginContentAllowedByContentSecurityPolicy()
        and make use of this function.
        (WebCore::SubframeLoader::requestObject): Modified to call SubframeLoader::isPluginContentAllowedByContentSecurityPolicy()
        before loading plugin content into a sub frame. If the plugin content is not allowed to load then we
        mark the plugin as unavailable with the reason being that it was blocked by the Content Security Policy.
        * loader/SubframeLoader.h:

2016-03-06  Gavin Barraclough  <barraclough@apple.com>

        Convert DOMTimer to std::chrono::milliseconds
        https://bugs.webkit.org/show_bug.cgi?id=155085

        Reviewed by Andreas Kling.

        DOMTimer currently uses a mix of millisecond (was int, now std::chrono) and second (as double)
        time values. Constant conversion back and forth is a complete mess. Stop that.

        * dom/Document.cpp:
        (WebCore::Document::minimumTimerInterval):
        (WebCore::Document::timerAlignmentInterval):
        * dom/Document.h:
            - double -> std::chrono::milliseconds
        * dom/ScriptExecutionContext.cpp:
        (WebCore::ScriptExecutionContext::adjustMinimumTimerInterval):
        (WebCore::ScriptExecutionContext::minimumTimerInterval):
        (WebCore::ScriptExecutionContext::timerAlignmentInterval):
        * dom/ScriptExecutionContext.h:
            - double -> std::chrono::milliseconds
        * page/DOMTimer.cpp:
        (WebCore::DOMTimer::updateTimerIntervalIfNecessary):
        (WebCore::DOMTimer::intervalClampedToMinimum):
        (WebCore::DOMTimer::alignedFireTime):
        * page/DOMTimer.h:
            - double -> std::chrono::milliseconds
        * page/Page.cpp:
        (WebCore::Page::setTimerThrottlingState):
        (WebCore::Page::setTimerAlignmentIntervalIncreaseLimit):
        (WebCore::Page::updateDOMTimerAlignmentInterval):
        * page/Page.h:
            - double -> std::chrono::milliseconds
        * page/Settings.cpp:
        (WebCore::Settings::setNeedsAdobeFrameReloadingQuirk):
        (WebCore::Settings::setMinimumDOMTimerInterval):
        * page/Settings.h:
            - double -> std::chrono::milliseconds
        * page/SuspendableTimer.h:
        (WebCore::SuspendableTimer::startRepeating):
        (WebCore::SuspendableTimer::startOneShot):
        (WebCore::SuspendableTimer::repeatIntervalMS):
        (WebCore::SuspendableTimer::augmentFireInterval):
        (WebCore::SuspendableTimer::augmentRepeatInterval):
            - added std::chrono::milliseconds interface.
        * platform/Timer.cpp:
        (WebCore::TimerBase::setNextFireTime):
            - restructured for new alignedFireTime signatured, moved zero-delay handling to here.
              This change made because inside alignedFireTime fireTime will have already been truncated.
        * platform/Timer.h:
        (WebCore::TimerBase::msToSeconds):
        (WebCore::TimerBase::secondsToMS):
            - internal helper functions to bridge std::chrono::milliseconds to internal double.
        (WebCore::TimerBase::startRepeating):
        (WebCore::TimerBase::startOneShot):
        (WebCore::TimerBase::repeatIntervalMS):
        (WebCore::TimerBase::augmentFireInterval):
        (WebCore::TimerBase::augmentRepeatInterval):
            - expanded std::chrono::milliseconds interface.
        (WebCore::TimerBase::alignedFireTime):
            - changed to std::chrono::milliseconds, made return value Optional (null means no alignment).
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setMinimumTimerInterval):
        * testing/InternalSettings.h:
            - double -> std::chrono::milliseconds

2016-03-07  Andreas Kling  <akling@apple.com>

        Make RenderStyle copy-on-write a bit less.
        <https://webkit.org/b/155106>

        Reviewed by Antti Koivisto.

        Add a cheesy SET_NESTED_VAR macro complement to SET_VAR so we can avoid copy-on-write
        detachment of nested RenderStyle substructures when the leaf value doesn't change.

        I spotted about 300kB of these mistakes being made during PLT on iOS, most of them
        in the transformX setter.

        * rendering/style/RenderStyle.h:

2016-03-07  Miguel Gomez  <magomez@igalia.com>

        [TextureMapper] [BitmapTexturePool] Use appropriate list size when freeing textures
        https://bugs.webkit.org/show_bug.cgi?id=155105

        Reviewed by Žan Doberšek.

        Use appropriate list size when releasing the textures used as attachment.
        This is a fix for the patch to https://bugs.webkit.org/show_bug.cgi?id=154965.

        No new tests because no new functionality was added.

        * platform/graphics/texmap/BitmapTexturePool.cpp:
        (WebCore::BitmapTexturePool::releaseUnusedTexturesTimerFired):

2016-03-06  Benjamin Poulain  <bpoulain@apple.com>

        [JSC] Improve codegen of Compare and Test
        https://bugs.webkit.org/show_bug.cgi?id=155055

        Reviewed by Filip Pizlo.

        * cssjit/FunctionCall.h:
        (WebCore::FunctionCall::callAndBranchOnCondition):

2016-03-06  Saam Barati  <sbarati@apple.com>

        [[GetPrototypeOf]] should be a fully virtual method in the method table
        https://bugs.webkit.org/show_bug.cgi?id=155002

        Reviewed by Filip Pizlo.

        Change ::getPrototype(.) to ::prototype(.) in various places to prevent
        a naming conflict with JSC.

        No new tests because no new functionality was added.

        * bindings/js/JSDOMWindowShell.cpp:
        (WebCore::JSDOMWindowShell::setWindow):
        * bindings/js/JSImageConstructor.cpp:
        (WebCore::JSImageConstructor::initializeProperties):
        (WebCore::JSImageConstructor::prototypeForStructure):
        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::initScript):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        (GenerateConstructorHelperMethods):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::JSTestActiveDOMObjectConstructor::initializeProperties):
        (WebCore::JSTestActiveDOMObject::createPrototype):
        (WebCore::JSTestActiveDOMObject::prototype):
        (WebCore::JSTestActiveDOMObject::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::JSTestClassWithJSBuiltinConstructorConstructor::initializeProperties):
        (WebCore::JSTestClassWithJSBuiltinConstructor::createPrototype):
        (WebCore::JSTestClassWithJSBuiltinConstructor::prototype):
        (WebCore::JSTestClassWithJSBuiltinConstructor::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::initializeProperties):
        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::createPrototype):
        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::prototype):
        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::JSTestCustomNamedGetterConstructor::initializeProperties):
        (WebCore::JSTestCustomNamedGetter::createPrototype):
        (WebCore::JSTestCustomNamedGetter::prototype):
        (WebCore::JSTestCustomNamedGetter::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructorConstructor::initializeProperties):
        (WebCore::JSTestEventConstructor::createPrototype):
        (WebCore::JSTestEventConstructor::prototype):
        (WebCore::JSTestEventConstructor::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestEventConstructor.h:
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::JSTestEventTargetConstructor::initializeProperties):
        (WebCore::JSTestEventTarget::createPrototype):
        (WebCore::JSTestEventTarget::prototype):
        (WebCore::JSTestEventTarget::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestEventTarget.h:
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::JSTestExceptionConstructor::initializeProperties):
        (WebCore::JSTestException::createPrototype):
        (WebCore::JSTestException::prototype):
        (WebCore::JSTestException::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestException.h:
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::JSTestGenerateIsReachableConstructor::initializeProperties):
        (WebCore::JSTestGenerateIsReachable::createPrototype):
        (WebCore::JSTestGenerateIsReachable::prototype):
        (WebCore::JSTestGenerateIsReachable::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterfaceConstructor::initializeProperties):
        (WebCore::JSTestInterface::createPrototype):
        (WebCore::JSTestInterface::prototype):
        (WebCore::JSTestInterface::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestInterface.h:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        (WebCore::JSTestJSBuiltinConstructorConstructor::initializeProperties):
        (WebCore::JSTestJSBuiltinConstructor::createPrototype):
        (WebCore::JSTestJSBuiltinConstructor::prototype):
        (WebCore::JSTestJSBuiltinConstructor::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h:
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::JSTestMediaQueryListListenerConstructor::initializeProperties):
        (WebCore::JSTestMediaQueryListListener::createPrototype):
        (WebCore::JSTestMediaQueryListListener::prototype):
        (WebCore::JSTestMediaQueryListListener::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::JSTestNamedConstructorConstructor::initializeProperties):
        (WebCore::JSTestNamedConstructorNamedConstructor::initializeProperties):
        (WebCore::JSTestNamedConstructor::createPrototype):
        (WebCore::JSTestNamedConstructor::prototype):
        (WebCore::JSTestNamedConstructor::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::JSTestNodeConstructor::initializeProperties):
        (WebCore::JSTestNode::createPrototype):
        (WebCore::JSTestNode::prototype):
        (WebCore::JSTestNode::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestNode.h:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::JSTestNondeterministicConstructor::initializeProperties):
        (WebCore::JSTestNondeterministic::createPrototype):
        (WebCore::JSTestNondeterministic::prototype):
        (WebCore::JSTestNondeterministic::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestNondeterministic.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjConstructor::initializeProperties):
        (WebCore::JSTestObj::createPrototype):
        (WebCore::JSTestObj::prototype):
        (WebCore::JSTestObj::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::JSTestOverloadedConstructorsConstructor::initializeProperties):
        (WebCore::JSTestOverloadedConstructors::createPrototype):
        (WebCore::JSTestOverloadedConstructors::prototype):
        (WebCore::JSTestOverloadedConstructors::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::JSTestOverrideBuiltinsConstructor::initializeProperties):
        (WebCore::JSTestOverrideBuiltins::createPrototype):
        (WebCore::JSTestOverrideBuiltins::prototype):
        (WebCore::JSTestOverrideBuiltins::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::initializeProperties):
        (WebCore::JSTestSerializedScriptValueInterface::createPrototype):
        (WebCore::JSTestSerializedScriptValueInterface::prototype):
        (WebCore::JSTestSerializedScriptValueInterface::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::JSTestTypedefsConstructor::initializeProperties):
        (WebCore::JSTestTypedefs::createPrototype):
        (WebCore::JSTestTypedefs::prototype):
        (WebCore::JSTestTypedefs::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestTypedefs.h:
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::JSattributeConstructor::initializeProperties):
        (WebCore::JSattribute::createPrototype):
        (WebCore::JSattribute::prototype):
        (WebCore::JSattribute::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSattribute.h:
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::JSreadonlyConstructor::initializeProperties):
        (WebCore::JSreadonly::createPrototype):
        (WebCore::JSreadonly::prototype):
        (WebCore::JSreadonly::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSreadonly.h:

2016-03-06  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Enable DOM class create functions to take parameters in case of JSBuiltinConstructor
        https://bugs.webkit.org/show_bug.cgi?id=155022

        Reviewed by Darin Adler.

        Introducing JSDOMObjectInspector to check whether a given JS class is built-in (no DOM class).
        If that is not the case, the JS class wraps a DOM class.
        The inspector detects whether the DOM class create static method takes no parameter or some parameters.
        This is used in JSDOMConstructor.h to generate correctly the createJSObject functions needed by JSBuiltinConstructor.

        Updated binding generator to not generate anymore createJSObject as it is handled directly in JSDOMConstructor.h.

        Covered by existing tests.

        * bindings/js/JSDOMConstructor.h:
        (WebCore::JSBuiltinConstructor<JSClass>::callConstructor):
        (WebCore::createJSObject):
        (WebCore::JSBuiltinConstructor<JSClass>::construct):
        * bindings/js/JSDOMWrapper.h:
        * bindings/js/JSKeyValueIterator.h: Taking benefit of JSClass::DOMWrapper type declaration.
        * bindings/js/JSReadableStreamPrivateConstructors.cpp:
        (WebCore::JSBuiltinReadableStreamReaderPrivateConstructor::initializeExecutable): Deleted.
        (WebCore::JSBuiltinReadableStreamControllerPrivateConstructor::initializeExecutable): Deleted.
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition): Deleted.
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::JSTestClassWithJSBuiltinConstructorConstructor::prototypeForStructure): Deleted.

2016-03-06  Antti Koivisto  <antti@apple.com>

        RenderTextControlSingleLine shouldn't mutate placeholder element inline style
        https://bugs.webkit.org/show_bug.cgi?id=155086

        Reviewed by Andreas Kling.

        Text field placeholder element is currently managed by changing its inline style
        from the host renderer based on the host style and state. Rendering poking
        into DOM is wrong.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setRangeText):
        (WebCore::HTMLInputElement::shouldTruncateText):

            Add a helper.

        (WebCore::HTMLInputElement::createInnerTextStyle):
        * html/HTMLInputElement.h:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
        (WebCore::HTMLTextAreaElement::placeholderElement):
        (WebCore::HTMLTextAreaElement::matchesReadWritePseudoClass):
        (WebCore::HTMLTextAreaElement::updatePlaceholderText):

            Use the new shadow element.

        * html/HTMLTextAreaElement.h:
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):

            No more poking to inline style.

        (WebCore::HTMLTextFormControlElement::setSelectionStart):
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::updatePlaceholderText):

            Use the new shadow element.

        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::TextControlPlaceholderElement::TextControlPlaceholderElement):

            Add a subclass for the placeholder element instead of just using div.

        (WebCore::TextControlPlaceholderElement::customStyleForRenderer):

            Compute style base on the host state and style.

        (WebCore::SearchFieldResultsButtonElement::SearchFieldResultsButtonElement):
        * html/shadow/TextControlInnerElements.h:
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::styleDidChange):

            No more setInlineStyleProperty.
            This now needs to trigger layout like it does with other inner elements.

        (WebCore::RenderTextControlSingleLine::computeControlLogicalHeight):
        (WebCore::RenderTextControlSingleLine::autoscroll):
        (WebCore::RenderTextControlSingleLine::textShouldBeTruncated): Deleted.
        * rendering/RenderTextControlSingleLine.h:

2016-03-05  Ryosuke Niwa  <rniwa@webkit.org>

        Add the support for upgrading custom elements in cloneNode
        https://bugs.webkit.org/show_bug.cgi?id=155062

        Reviewed by Antti Koivisto.

        Implement https://w3c.github.io/webcomponents/spec/custom/#upgrading and steps 6 through 11 in
        https://w3c.github.io/webcomponents/spec/custom/#htmlelement-constructor to support upgrading elements
        created by Node.prototype.cloneNode.

        Tests: fast/custom-elements/lifecycle-callback-timing.html
               fast/custom-elements/upgrading/Node-cloneNode.html

        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::upgradeElement): Added. Implements
         https://w3c.github.io/webcomponents/spec/custom/#dfn-upgrade-a-custom-element
        (WebCore::JSCustomElementInterface::didUpgradeLastElementInConstructionStack): Added. Implements step 10
         "Replace the last entry in definition's construction stacka with an already constructed marker."
         in https://w3c.github.io/webcomponents/spec/custom/#dom-htmlelement-constructor
        * bindings/js/JSCustomElementInterface.h:
        (WebCore::JSCustomElementInterface::isUpgradingElement):
        (WebCore::JSCustomElementInterface::lastElementInConstructionStack):
        (WebCore::JSCustomElementInterface): Added m_constructionStack. This is the construction stack:
         https://w3c.github.io/webcomponents/spec/custom/#dfn-element-definition-construction-stack
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::throwInvalidStateError): Added.
        * bindings/js/JSDOMBinding.h:
        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore::constructJSHTMLElement): Implement the upgrading case in:
         https://w3c.github.io/webcomponents/spec/custom/#htmlelement-constructor
        * dom/Document.cpp:
        (WebCore::createFallbackHTMLElement): Added. Enqueues upgrades of custom elements (enqueueElementUpgrade
         currently does nothing if there is no InvokesCustomElementLifecycleCallbacks; e.g. in other DOM APIs).
         This function implements https://w3c.github.io/webcomponents/spec/custom/#dfn-element-upgrade-algorithm
        (WebCore::Document::createElement):
        * dom/LifecycleCallbackQueue.cpp:
        (WebCore::LifecycleQueueItem::LifecycleQueueItem): Added a generic constructor.
        (WebCore::LifecycleQueueItem::invoke): Call upgradeElement when m_type is Type::ElementUpgrade.
        (WebCore::LifecycleCallbackQueue::enqueueElementUpgrade): Added.
        * dom/LifecycleCallbackQueue.h:
        * dom/Node.idl: Added InvokesCustomElementLifecycleCallbacks on cloneNode.
        * dom/make_names.pl:
        (printFactoryCppFile): Added a variant of createKnownElement which takes QualifiedName. Also directly call
         find(HTML|SVG|MathML)ElementConstructorFunction in createElement that takes AtomicString to avoid an extra
         function call.
        (printFactoryHeaderFile): Added a function declaration for createKnownElement that takes QualifiedName and
         outdented class and function declarations to match the modern code style guideline.

2016-03-05  Tim Horton  <timothy_horton@apple.com>

        Create a DOMHTMLVideoElement when wrapping <video> elements
        https://bugs.webkit.org/show_bug.cgi?id=155084
        <rdar://problem/24997193>

        Reviewed by Dan Bernstein.

        * bindings/objc/DOM.mm:
        (WebCore::createElementClassMap):
        Add <video> to the mapping.

2016-03-05  Ryosuke Niwa  <rniwa@webkit.org>

        Minor cleans up in custom elements' code per Darin's comments
        https://bugs.webkit.org/show_bug.cgi?id=155081

        Reviewed by Darin Adler.

        Cleanup per Darin's comments.

        * dom/CustomElementDefinitions.cpp:
        (WebCore::CustomElementDefinitions::findInterface): Use get instead of explicitly checking against end().
        * dom/LifecycleCallbackQueue.h: Remove unecessary header includes.

2016-03-05  Sam Weinig  <sam@webkit.org>

        Fix two minor typos from http://trac.webkit.org/changeset/197626 that were causing some test failures.

        * html/Autofill.cpp:
        (WebCore::fieldNameMap):
        (WebCore::AutofillData::createFromHTMLFormControlElement):

2016-03-05  Chris Dumez  <cdumez@apple.com>

        Consolidate RuntimeApplicationChecks and RuntimeApplicationChecksIOS
        https://bugs.webkit.org/show_bug.cgi?id=155035

        Reviewed by Darin Adler.

        Consolidate RuntimeApplicationChecks and RuntimeApplicationChecksIOS into
        one file. The following changes were made:
        - The checks now all rely on applicationBundleIdentifier(), which has the
          benefit of working in WK1 and WK2 UI/WebContent/Networking processes.
        - Use namespaces to distinguish Mac and iOS applications instead of relying
          on the method name. So, applicationIsIBooksForIOS() becomes
          IOSApplication::isIBooks().
        - Use NSBundle API on both iOS and Mac instead of using the CF API on Mac
          and the NS API on iOS.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper _accessibilityWebDocumentView]):
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::commonVM):
        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate):
        * html/HTMLMediaElement.cpp:
        * html/HTMLObjectElement.cpp:
        (WebCore::shouldNotPerformURLAdjustment):
        * html/MediaElementSession.cpp:
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::currentRunLoop):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::willLoadMediaElementURL):
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::create):
        (WebCore::SubresourceLoader::startLoading):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::shouldIgnoreHTTPStatusCodeErrors):
        * platform/RuntimeApplicationChecks.cpp: Removed.
        * platform/RuntimeApplicationChecks.h:
        * platform/RuntimeApplicationChecks.mm: Added.
        (WebCore::applicationBundleIdentifier):
        (WebCore::applicationBundleIsEqualTo):
        (WebCore::MacApplication::isSafari):
        (WebCore::MacApplication::isAppleMail):
        (WebCore::MacApplication::isIBooks):
        (WebCore::MacApplication::isITunes):
        (WebCore::MacApplication::isMicrosoftMessenger):
        (WebCore::MacApplication::isAdobeInstaller):
        (WebCore::MacApplication::isAOLInstantMessenger):
        (WebCore::MacApplication::isMicrosoftMyDay):
        (WebCore::MacApplication::isMicrosoftOutlook):
        (WebCore::MacApplication::isQuickenEssentials):
        (WebCore::MacApplication::isAperture):
        (WebCore::MacApplication::isVersions):
        (WebCore::MacApplication::isHRBlock):
        (WebCore::MacApplication::isSolidStateNetworksDownloader):
        (WebCore::MacApplication::isHipChat):
        (WebCore::IOSApplication::isMobileMail):
        (WebCore::IOSApplication::isMobileSafari):
        (WebCore::IOSApplication::isDumpRenderTree):
        (WebCore::IOSApplication::isMobileStore):
        (WebCore::IOSApplication::isWebApp):
        (WebCore::IOSApplication::isOkCupid):
        (WebCore::IOSApplication::isFacebook):
        (WebCore::IOSApplication::isDaijisenDictionary):
        (WebCore::IOSApplication::isNASAHD):
        (WebCore::IOSApplication::isTheEconomistOnIphone):
        (WebCore::IOSApplication::isWebProcess):
        (WebCore::IOSApplication::isIBooks):
        (WebCore::setApplicationBundleIdentifier):
        * platform/RuntimeApplicationChecksIOS.h: Removed.
        * platform/RuntimeApplicationChecksIOS.mm: Removed.
        * platform/audio/ios/AudioDestinationIOS.cpp:
        * platform/cf/URLCF.cpp:
        * platform/graphics/ca/cocoa/LayerFlushSchedulerMac.cpp:
        (WebCore::currentRunLoop):
        * platform/ios/PasteboardIOS.mm:
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        * platform/ios/wak/WebCoreThread.mm:
        (WebThreadEnable):
        * platform/mac/WidgetMac.mm:
        (WebCore::Widget::paint):
        * platform/network/ios/QuickLook.mm:
        * platform/network/mac/ResourceHandleMac.mm:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::needsIOSDumpRenderTreeMainFrameRenderViewLayerIsAlwaysOpaqueHack):

2016-03-05  Zalan Bujtas  <zalan@apple.com>

        Make table collapsed borders subpixel aware.
        https://bugs.webkit.org/show_bug.cgi?id=150383

        Reviewed by Simon Fraser.

        This patch enables authors to 
        - set subpixel width on collapsed borders
        - and push those borders to subpixel positions.

        Test: fast/table/collapsed-border-with-odd-pixel-width.html

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::calcBorderStart):
        (WebCore::RenderTable::calcBorderEnd):
        (WebCore::RenderTable::outerBorderBefore):
        (WebCore::RenderTable::outerBorderAfter):
        (WebCore::RenderTable::outerBorderStart):
        (WebCore::RenderTable::outerBorderEnd):
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::borderHalfStart):
        (WebCore::RenderTableCell::borderHalfEnd):
        (WebCore::RenderTableCell::borderHalfBefore):
        (WebCore::RenderTableCell::borderHalfAfter):
        (WebCore::RenderTableCell::paintCollapsedBorders):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::calcOuterBorderBefore):
        (WebCore::RenderTableSection::calcOuterBorderAfter):
        (WebCore::RenderTableSection::calcOuterBorderStart):
        (WebCore::RenderTableSection::calcOuterBorderEnd):
        * rendering/style/CollapsedBorderValue.h:
        (WebCore::CollapsedBorderValue::adjustedCollapsedBorderWidth):

2016-03-05  Sam Weinig  <sam@webkit.org>

        Add support for processing the autofill field name out of form control elements ultimately to aid input methods
        <rdar://problem/23041180>
        https://bugs.webkit.org/show_bug.cgi?id=155079

        Reviewed by Enrica Casucci.

        Added additional cases to fast/forms/autocomplete-tokens.html.

        * WebCore.xcodeproj/project.pbxproj:
        Add Autofill.h/cpp

        * html/Autofill.cpp: Added.
        (WebCore::fieldNameMap):
        (WebCore::toAutofillFieldName):
        (WebCore::isContactToken):
        (WebCore::maxTokensForAutofillFieldCategory):
        (WebCore::AutofillData::createFromHTMLFormControlElement):
        * html/Autofill.h: Added.
        (WebCore::AutofillData::AutofillData):
        Refactored the autofill data processing algorithm into it's own file and added support
        returning not just the IDL-exposed autofill value but also the autofill field name. The
        code is structured simply enough that if we find a need for the hint set or scope information
        we could return it as well.

        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::autocomplete):
        (WebCore::HTMLFormControlElement::setAutocomplete):
        (WebCore::HTMLFormControlElement::autofillMantle):
        (WebCore::HTMLFormControlElement::autofillData):
        Use AutofillData to implement these.

        * html/HTMLFormControlElement.h:
        Expose accessor for mantle and AutofillData.

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::autocomplete):
        * html/HTMLFormElement.h:
        Switch to return an AtomicString as it will always
        return one of two known values.

        * testing/Internals.cpp:
        (WebCore::Internals::autofillFieldName):
        * testing/Internals.h:
        * testing/Internals.idl:
        Add accessor of the field name for testing purposes.

2016-03-05  Ryosuke Niwa  <rniwa@webkit.org>

        Build fix after r197612 (under ASAN/GuardMalloc).

        * dom/CustomElementDefinitions.cpp:
        (WebCore::CustomElementDefinitions::findInterface):

2016-03-05  Michael Catanzaro  <mcatanzaro@igalia.com>

        Unreviewed, fix GTK/EFL build after r197575 and add mandatory GnuTLS dependency

        * PlatformEfl.cmake:
        * PlatformGTK.cmake:

2016-03-05  Simon Fraser  <simon.fraser@apple.com>

        Add support for the object-position CSS property
        https://bugs.webkit.org/show_bug.cgi?id=122811
        rdar://problem/15836338

        Reviewed by Sam Weinig.

        Take object-position into account when rendering replaced elements.
        RenderReplaced::replacedContentRect() is the one place where we compute
        the content rect for replaced elements.

        Also return false from foregroundIsKnownToBeOpaqueInRect() if we have
        any non-default object-position, as the foreground may no longer fill the box.

        Tests: compositing/video/video-object-position.html
               fast/css/object-position/object-position-canvas.html
               fast/css/object-position/object-position-embed.html
               fast/css/object-position/object-position-img-svg.html
               fast/css/object-position/object-position-img.html
               fast/css/object-position/object-position-input-image.html
               fast/css/object-position/object-position-object.html
               fast/css/object-position/object-position-video-poster.html

        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::foregroundIsKnownToBeOpaqueInRect):
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::replacedContentRect):

2016-03-05  Simon Fraser  <simon.fraser@apple.com>

        Add parsing support for object-position
        https://bugs.webkit.org/show_bug.cgi?id=155065

        Reviewed by Sam Weinig.
        
        Add parsing support for object-position. This is the first property with
        CSS <position> values which does not have equivalent -x and -y shorthands,
        so we can store it as a new LengthPoint type.
        
        Per the CSS Values spec, bottom- and right-relative values are translated
        into calc() expressions, which are exposed via computed style. For example,
        "right 10px bottom" becomes "calc(100% - 10px) 100%". This also allows transitions
        between, say, "left 10px bottom" and "right 10px bottom".

        Test: fast/css/object-position/parsing-object-position.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::propertyValue):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        * css/CSSPrimitiveValue.h:
        (WebCore::CSSPrimitiveValue::isPair):
        * css/CSSPropertyNames.in:
        * css/CSSValue.h:
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertLength):
        (WebCore::StyleBuilderConverter::convertTo100PercentMinusLength):
        (WebCore::StyleBuilderConverter::convertPositionComponent):
        (WebCore::StyleBuilderConverter::convertObjectPosition):
        * platform/LengthPoint.cpp: Added.
        (WebCore::operator<<):
        * platform/LengthPoint.h: Added.
        (WebCore::LengthPoint::LengthPoint):
        (WebCore::LengthPoint::operator==):
        (WebCore::LengthPoint::setX):
        (WebCore::LengthPoint::x):
        (WebCore::LengthPoint::setY):
        (WebCore::LengthPoint::y):
        (WebCore::LengthPoint::blend):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::changeRequiresRepaint):
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:

2016-03-05  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: Implement missing/different accessibility API mappings for SVG
        https://bugs.webkit.org/show_bug.cgi?id=155034

        Reviewed by Chris Fleizach.

        Create an AccessibilitySVGElement class for the SVG-specific mappings;
        fix name and description mappings for ATK; add new AccessibilityRole
        types (SVGTextRole, SVGTSpanRole, SVGTextPathRole) and map them for
        ATK and AX API.

        Tests: accessibility/w3c-svg-description-calculation.html
               accessibility/w3c-svg-elements-not-exposed.html
               accessibility/w3c-svg-name-calculation.html
               accessibility/w3c-svg-presentational-role.html
               accessibility/w3c-svg-roles.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * accessibility/AXObjectCache.cpp:
        (WebCore::createFromRenderer):
        * accessibility/AccessibilityAllInOne.cpp:
        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::alternativeText): Deleted.
        (WebCore::AccessibilityNodeObject::accessibilityDescription): Deleted.
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::isAccessibilitySVGElement):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::determineAccessibilityRole): Deleted.
        * accessibility/AccessibilitySVGElement.cpp: Added.
        (WebCore::AccessibilitySVGElement::AccessibilitySVGElement):
        (WebCore::AccessibilitySVGElement::~AccessibilitySVGElement):
        (WebCore::AccessibilitySVGElement::create):
        (WebCore::AccessibilitySVGElement::targetForUseElement):
        (WebCore::AccessibilitySVGElement::accessibilityText):
        (WebCore::AccessibilitySVGElement::accessibilityDescription):
        (WebCore::AccessibilitySVGElement::helpText):
        (WebCore::AccessibilitySVGElement::computeAccessibilityIsIgnored):
        (WebCore::AccessibilitySVGElement::inheritsPresentationalRole):
        (WebCore::AccessibilitySVGElement::determineAriaRoleAttribute):
        (WebCore::AccessibilitySVGElement::determineAccessibilityRole):
        * accessibility/AccessibilitySVGElement.h: Added.
        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (webkitAccessibleGetName):
        (webkitAccessibleGetDescription):
        (atkRole):
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper determineIsAccessibilityElement]):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (createAccessibilityRoleMap):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::isSVGTSpan):
        * rendering/svg/RenderSVGTSpan.h:

2016-03-05  Yusuke Suzuki  <utatane.tea@gmail.com>

        [ES6] Support Reflect.construct
        https://bugs.webkit.org/show_bug.cgi?id=147330

        Reviewed by Saam Barati.

        * Modules/plugins/QuickTimePluginReplacement.mm:
        (WebCore::QuickTimePluginReplacement::installReplacement):
        * bindings/js/CallbackFunction.cpp:
        (WebCore::checkFunctionOnlyCallback):
        * bindings/js/JSCallbackData.cpp:
        (WebCore::JSCallbackData::invokeCallback):
        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::constructElement):
        (WebCore::JSCustomElementInterface::attributeChanged):
        * bindings/js/JSCustomXPathNSResolver.cpp:
        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::callFunctionWithCurrentArguments):
        (WebCore::DOMConstructorObject::getCallData):
        * bindings/js/JSDOMConstructor.h:
        (WebCore::JSDOMConstructorNotConstructable::getCallData):
        (WebCore::JSDOMConstructor<JSClass>::getConstructData):
        (WebCore::JSDOMNamedConstructor<JSClass>::getConstructData):
        (WebCore::JSBuiltinConstructor<JSClass>::getConstructData):
        * bindings/js/JSDOMPromise.cpp:
        (WebCore::DeferredWrapper::callFunction):
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::defineElement):
        * bindings/js/JSErrorHandler.cpp:
        (WebCore::JSErrorHandler::handleEvent):
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::handleEvent):
        * bindings/js/JSHTMLAllCollectionCustom.cpp:
        (WebCore::JSHTMLAllCollection::getCallData):
        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::open):
        * bindings/js/JSKeyValueIterator.h:
        (WebCore::keyValueIteratorForEach):
        * bindings/js/JSMainThreadExecStateInstrumentation.h:
        (WebCore::JSMainThreadExecState::instrumentFunctionCall):
        (WebCore::JSMainThreadExecState::instrumentFunctionConstruct):
        * bindings/js/JSMutationCallback.cpp:
        (WebCore::JSMutationCallback::call):
        * bindings/js/JSMutationObserverCustom.cpp:
        (WebCore::constructJSMutationObserver):
        * bindings/js/JSPluginElementFunctions.cpp:
        (WebCore::callPlugin):
        (WebCore::pluginElementGetCallData):
        * bindings/js/ScheduledAction.cpp:
        (WebCore::ScheduledAction::create):
        (WebCore::ScheduledAction::executeFunctionInContext):
        * bindings/objc/WebScriptObject.mm:
        (-[WebScriptObject callWebScriptMethod:withArguments:]):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorHelperMethods):
        * bindings/scripts/test/JS/JSFloat64Array.cpp:
        (WebCore::JSFloat64ArrayConstructor::getConstructData):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterfaceConstructor::getConstructData):
        * bridge/NP_jsobject.cpp:
        (_NPN_InvokeDefault):
        (_NPN_Invoke):
        (_NPN_Construct):
        * bridge/objc/objc_runtime.mm:
        (JSC::Bindings::ObjcFallbackObjectImp::getCallData):
        * bridge/runtime_method.cpp:
        (JSC::RuntimeMethod::getCallData):
        * bridge/runtime_object.cpp:
        (JSC::Bindings::RuntimeObject::getCallData):
        (JSC::Bindings::RuntimeObject::getConstructData):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::updateCaptionContainer):
        (WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
        (WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):
        * testing/Internals.cpp:
        (WebCore::Internals::isReadableStreamDisturbed):

2016-03-05  Ryosuke Niwa  <rniwa@webkit.org>

        Fix the bindings test after r197611.

        * bindings/scripts/test/TestObj.idl:

2016-03-05  Ryosuke Niwa  <rniwa@webkit.org>

        Move QualifiedName from CustomElementInfo to JSCustomElementInterface
        https://bugs.webkit.org/show_bug.cgi?id=155061

        Reviewed by Antti Koivisto.

        Store QualifiedName of custom elements in JSCustomElementInterface instead of CustomElementInfo
        now that each interface is associated with exactly one custom element as of r197602.

        No new tests since this is a refactoring.

        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::JSCustomElementInterface): Now takes QualifiedName as the
        first argument.
        * bindings/js/JSCustomElementInterface.h:
        (WebCore::JSCustomElementInterface::create):
        (WebCore::JSCustomElementInterface::name): Added.
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::defineElement):
        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore::constructJSHTMLElement): Use findInterface instead of the deleted findName.
        * dom/CustomElementDefinitions.cpp:
        (WebCore::CustomElementDefinitions::checkName):
        (WebCore::CustomElementDefinitions::addElementDefinition): Renamed from defineElement.
        (WebCore::CustomElementDefinitions::findInterface): Add a variant that finds the interface object
        by a JS constructor.
        (WebCore::CustomElementDefinitions::containsConstructor):
        (WebCore::CustomElementDefinitions::findName): Deleted.
        * dom/CustomElementDefinitions.h:
        (WebCore::CustomElementDefinitions::CustomElementInfo::CustomElementInfo): Deleted.

2016-03-04  Ryosuke Niwa  <rniwa@webkit.org>

        Add basic support for attributeChanged lifecycle callback
        https://bugs.webkit.org/show_bug.cgi?id=155011

        Reviewed by Antti Koivisto.

        Add basic support for attributeChangedCallback in setAttribute, removeAttribute, setAttributeNS,
        remoteAttributeNS, setAttributeNode, and removeAttributeNS. There are many other DOM APIs that
        could modify attributes but we would annotate those APIs in a separate patch to limit the scope
        of this change.

        In order to invoke the lifecycle callback right before returning to the author script, allocate
        an instance of CustomElementLifecycleProcessingStack in each of these functions' binding code.
        The stack object's destructor invokes all callbacks enqueued by the DOM API if there are any.

        Spec: https://w3c.github.io/webcomponents/spec/custom/#dfn-attribute-changed-callback

        Tests: fast/custom-elements/attribute-changed-callback.html
               fast/custom-elements/lifecycle-callback-timing.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::attributeChanged): Added. Invokes attributeChangedCallback.
        * bindings/js/JSCustomElementInterface.h:
        * bindings/js/JSMainThreadExecState.h:
        (JSMainThreadNullState): Allocate an instance of CustomElementLifecycleProcessingStack in GObject
        and Objective-C binding code for consistency with JavaScript. We can't do this in JavaScript
        because there is no RAII object all functions, getters, and setters allocate (for a good reason).

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation): Generate an instance of CustomElementLifecycleProcessingStack when
        NeedsLifecycleProcessingStack is specified as an extended IDL attribute.
        * bindings/scripts/IDLAttributes.txt: Added NeedsLifecycleProcessingStack.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionMethodWithNeedsLifecycleProcessingStack):
        * bindings/scripts/test/TestObj.idl: Added a test for NeedsLifecycleProcessingStack.

        * dom/DOMAllInOne.cpp:
        * dom/Element.cpp:
        (WebCore::Element::attributeChanged): Enqueue attributeChanged callback if the context object
        is a custom element and there is a CustomElementLifecycleProcessingStack allocated in the stack.
        * dom/Element.idl:

        * dom/LifecycleCallbackQueue.cpp: Added.
        (WebCore::LifecycleQueueItem): Added.
        (WebCore::LifecycleQueueItem::LifecycleQueueItem): Added.
        (WebCore::LifecycleQueueItem::invoke): Added.
        (WebCore::LifecycleCallbackQueue::LifecycleCallbackQueue): Added.
        (WebCore::LifecycleCallbackQueue::~LifecycleCallbackQueue): Added.
        (WebCore::LifecycleCallbackQueue::enqueueAttributeChangedCallback): Added.
        (WebCore::LifecycleCallbackQueue::invokeAll): Added.
        (WebCore::CustomElementLifecycleProcessingStack::ensureCurrentQueue): Added. As noted in FIXME,
        the early exit in the code is necessary only because we haven't added NeedsLifecycleProcessingStack
        in all places. It should go away in a follow up patch.
        (WebCore::CustomElementLifecycleProcessingStack::processQueue): Added.
        * dom/LifecycleCallbackQueue.h: Added.
        (WebCore::CustomElementLifecycleProcessingStack): This is a light weight RAII object the binding
        code will allocate in order to queue up lifecycle callbacks. We don't use Ref or std::unique_ptr
        in m_queue to avoid generating the code to destruct LifecycleCallbackQueue everywhere.
        (WebCore::CustomElementLifecycleProcessingStack::CustomElementLifecycleProcessingStack): Added.
        (WebCore::CustomElementLifecycleProcessingStack::~CustomElementLifecycleProcessingStack): Added.
        (WebCore::CustomElementLifecycleProcessingStack::hasCurrentProcessingStack): Added.

2016-03-04  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Scrollbars are broken again with GTK+ >= 3.19.11
        https://bugs.webkit.org/show_bug.cgi?id=154890

        Reviewed by Michael Catanzaro.

        Scrollbar style properties have been deprecated in GTK+, and it
        seems that now deprecating means keeping the properties but
        ignoring them. So, this reworks the whole scrollbars theme code
        again to not cache style properties anymore, but retrieve them
        from the GtkStyleContext. Previous GTK+ versions still need to
        query the style properties, so I've added helper functions to get
        all the style properties with the ifdefs, trying to keep the
        common render code free of GTK+ versions ifdefs.

        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::backButtonRect):
        (WebCore::ScrollbarThemeGtk::forwardButtonRect):
        (WebCore::ScrollbarThemeGtk::trackRect):
        (WebCore::ScrollbarThemeGtk::thumbRect):
        (WebCore::ScrollbarThemeGtk::paintTrackBackground):
        (WebCore::ScrollbarThemeGtk::paintThumb):
        (WebCore::ScrollbarThemeGtk::paint):
        (WebCore::ScrollbarThemeGtk::scrollbarThickness):
        (WebCore::ScrollbarThemeGtk::buttonSize):
        (WebCore::ScrollbarThemeGtk::stepperSize):
        (WebCore::ScrollbarThemeGtk::getStepperSpacing):
        (WebCore::ScrollbarThemeGtk::troughUnderSteppers):
        (WebCore::ScrollbarThemeGtk::minimumThumbLength):
        (WebCore::ScrollbarThemeGtk::thumbFatness):
        (WebCore::ScrollbarThemeGtk::getTroughBorder):
        (WebCore::ScrollbarThemeGtk::getOrCreateStyleContext):
        (WebCore::ScrollbarThemeGtk::updateThemeProperties):
        (WebCore::ScrollbarThemeGtk::handleMousePressEvent):
        * platform/gtk/ScrollbarThemeGtk.h:

2016-03-04  Brent Fulgham  <bfulgham@apple.com>

        Resource load statistics are not honoring private browsing
        https://bugs.webkit.org/show_bug.cgi?id=155054
        <rdar://problem/24987873>

        Reviewed by Andy Estes.

        Modify the points where we capture resource load statistics to ignore
        loads made during private browsing. Do this by moving more of the logic
        about whether to gather statistics into the logging functions, passing
        the raw input types (frame, ResourceRequest, ResourceResponse) internally
        so that we don't pay any cost until we decide we want to gather data.s

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::willSendRequest): Revise for the new API on
        ResourceLoadObserver.
        * loader/ResourceLoadObserver.cpp:
        (WebCore::ResourceLoadObserver::logFrameNavigation): Revise signature and
        check for private browsing.
        (WebCore::ResourceLoadObserver::logSubresourceLoading): Ditto.
        (WebCore::ResourceLoadObserver::logUserInteraction): Ditto.
        * loader/ResourceLoadObserver.h:
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::willSendRequestInternal): Ditto.

2016-03-04  Alex Christensen  <achristensen@webkit.org>

        Fix file mime-types when using NetworkSession
        https://bugs.webkit.org/show_bug.cgi?id=155058

        Reviewed by Andy Estes.

        This fixes platform/mac/fast/loader/file-url-mimetypes-3.html
        and platform/mac/fast/loader/file-url-mimetypes.html.

        * platform/network/mac/WebCoreURLResponse.h:

2016-03-04  Sam Weinig  <sam@webkit.org>

        [WebKit2] Add WebKit2 equivalent of -[WebView _insertNewlineInQuotedContent]
        <rdar://problem/24943591>
        https://bugs.webkit.org/show_bug.cgi?id=155057

        Reviewed by Tim Horton.

        Move Editor::insertParagraphSeparatorInQuotedContent() into Editor.cpp
        and remove the duplicated code in EditorIOS.mm and EditorMac.mm.

        * editing/Editor.cpp:
        (WebCore::Editor::insertParagraphSeparatorInQuotedContent):
        * editing/Editor.h:
        * editing/ios/EditorIOS.mm:
        (WebCore::Editor::insertParagraphSeparatorInQuotedContent): Deleted.
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::insertParagraphSeparatorInQuotedContent): Deleted.

2016-03-04  Gavin Barraclough  <barraclough@apple.com>

        Convert DOMTimer interval from int to std::chromo::milliseconds
        https://bugs.webkit.org/show_bug.cgi?id=155051

        Speculative build fix.

        * inspector/TimelineRecordFactory.cpp:
        (WebCore::TimelineRecordFactory::createTimerInstallData):

2016-03-04  Gavin Barraclough  <barraclough@apple.com>

        Convert DOMTimer interval from int to std::chromo::milliseconds
        https://bugs.webkit.org/show_bug.cgi?id=155051

        iOS build fix

        * page/DOMTimer.cpp:
        (WebCore::DOMTimer::install):

2016-03-04  Ryosuke Niwa  <rniwa@webkit.org>

        Update defineCustomElement according to the spec rewrite
        https://bugs.webkit.org/show_bug.cgi?id=155010
        <rdar://problem/24970878>

        Reviewed by Chris Dumez.

        Updated the implementation of defineCustomElement and HTMLConstructor per recent rewrite of the spec:
        https://w3c.github.io/webcomponents/spec/custom/#dom-document-defineelement
        https://w3c.github.io/webcomponents/spec/custom/#htmlelement-constructor

        defineCustomElement is now called defineElement and we disallow defining multiple custom elements with
        a single class and throw an exception in defineElement.

        Test: fast/custom-elements/Document-defineElement.html

        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::defineElement): Renamed from defineCustomElement. Throw an exception when the interface
        already defines another custom element. Also added FIXME's for missing steps.

        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore::constructJSHTMLElement): Removed the support for specifying a tag name in the first argument when
        a single class defines multiple custom elements since that now results in an exception (in defineElement).

        * dom/CustomElementDefinitions.cpp:
        (WebCore::CustomElementDefinitions::containsConstructor): Added.
        * dom/CustomElementDefinitions.h:
        * dom/Document.idl: Renamed defineCustomElement to defineElement.
        * html/HTMLElement.idl: Removed the optional tag name from the constructor.

2016-03-04  Tim Horton  <timothy_horton@apple.com>

        Begin implementing <attachment> painting on iOS
        https://bugs.webkit.org/show_bug.cgi?id=155046
        <rdar://problem/24805991>

        Reviewed by Enrica Casucci.

        No new tests; there are existing tests that I will unskip and rebaseline
        in the near future.

        * rendering/RenderThemeIOS.h:
        * rendering/RenderThemeIOS.mm:
        (WebCore::AttachmentInfo::addLine):
        (WebCore::AttachmentInfo::buildTitleLines):
        (WebCore::AttachmentInfo::buildSingleLine):
        (WebCore::getAttachmentProgress):
        (WebCore::iconForAttachment):
        (WebCore::AttachmentInfo::AttachmentInfo):
        (WebCore::RenderThemeIOS::attachmentIntrinsicSize):
        (WebCore::RenderThemeIOS::attachmentBaseline):
        (WebCore::paintAttachmentIcon):
        (WebCore::paintAttachmentText):
        (WebCore::paintAttachmentProgress):
        (WebCore::paintAttachmentBorder):
        (WebCore::RenderThemeIOS::paintAttachment):
        There are still a few missing pieces, but get <attachment> painting a bit on iOS.
        We will paint an icon, action, title, and subtitle - in that order - depending on what we have.
        The content is vertically and horizontally centered.

2016-03-04  Gavin Barraclough  <barraclough@apple.com>

        Convert DOMTimer interval from int to std::chromo::milliseconds
        https://bugs.webkit.org/show_bug.cgi?id=155051

        Reviewed by Ryosuke Niwa.

        This change is pretty much mechanical, replacing int with std::chrono::milliseconds.

        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::willSendXMLHttpRequestImpl):
        (WebCore::InspectorInstrumentation::didInstallTimerImpl):
        * inspector/InspectorInstrumentation.h:
        (WebCore::InspectorInstrumentation::willSendXMLHttpRequest):
        (WebCore::InspectorInstrumentation::didInstallTimer):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::didPaint):
        (WebCore::InspectorTimelineAgent::didInstallTimer):
        * inspector/InspectorTimelineAgent.h:
        * inspector/TimelineRecordFactory.cpp:
        (WebCore::TimelineRecordFactory::createGenericTimerData):
        (WebCore::TimelineRecordFactory::createTimerInstallData):
        * inspector/TimelineRecordFactory.h:
        * page/DOMTimer.cpp:
        (WebCore::shouldForwardUserGesture):
        (WebCore::DOMTimer::DOMTimer):
        (WebCore::DOMTimer::~DOMTimer):
        (WebCore::DOMTimer::install):
        (WebCore::DOMTimer::intervalClampedToMinimum):
        * page/DOMTimer.h:
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::setTimeout):
        (WebCore::DOMWindow::clearTimeout):
        (WebCore::DOMWindow::setInterval):
        (WebCore::DOMWindow::clearInterval):
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::setTimeout):
        (WebCore::WorkerGlobalScope::clearTimeout):
        (WebCore::WorkerGlobalScope::setInterval):
        (WebCore::WorkerGlobalScope::clearInterval):

2016-03-03  Enrica Casucci  <enrica@apple.com>

        Add a mechanism to customize the long press action.
        https://bugs.webkit.org/show_bug.cgi?id=154995
        rdar://problem/24823732

        Reviewed by Tim Horton.

        We want to allow long press on attachment elements as well.

        * WebCore.xcodeproj/project.pbxproj: Making HTMLAttachmentElement.h private.
        * html/HTMLAttachmentElement.h: Adding exported functions.

2016-03-04  Andreas Kling  <akling@apple.com>

        [iOS] Throw away compiled RegExp code when navigating to a new page.
        <https://webkit.org/b/155015>

        Reviewed by Anders Carlsson.

        Discard RegExp code when doing a top-level navigation.
        This frees up a couple hundred kilobytes on many pages.

        * bindings/js/GCController.cpp:
        (WebCore::GCController::deleteAllRegExpCode):
        * bindings/js/GCController.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):

2016-03-04  Simon Fraser  <simon.fraser@apple.com>

        Use larger tiles when possible to reduce per-tile painting overhead
        https://bugs.webkit.org/show_bug.cgi?id=154985

        Reviewed by Zalan Bujtas.

        r197541 inadvertently missed FrameView changes that push scrollability data
        onto the TiledBacking, so didn't actually change behavior (hence the 512x512 tiles
        in the failing tests).

        Also remove m_tileSizeAtLastRevalidate from TileGrid; it's replaced by a simpler test.

        * page/FrameView.cpp:
        (WebCore::FrameView::addedOrRemovedScrollbar):
        * platform/graphics/ca/TileGrid.cpp:
        (WebCore::TileGrid::revalidateTiles):
        (WebCore::TileGrid::TileGrid): Deleted.
        * platform/graphics/ca/TileGrid.h:

2016-03-04  Simon Fraser  <simon.fraser@apple.com>

        Use BoxExtent instead of EdgeSet in TileController
        https://bugs.webkit.org/show_bug.cgi?id=155040

        Reviewed by Zalan Bujtas.

        Remove EdgeSet, which was very similar to the existing BoxExtent, and use BoxExtent
        in TileController.

        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/EdgeSet.h: Removed.
        (WebCore::EdgeSet::EdgeSet): Deleted.
        (WebCore::EdgeSet::top): Deleted.
        (WebCore::EdgeSet::setTop): Deleted.
        (WebCore::EdgeSet::right): Deleted.
        (WebCore::EdgeSet::setRight): Deleted.
        (WebCore::EdgeSet::bottom): Deleted.
        (WebCore::EdgeSet::setBottom): Deleted.
        (WebCore::EdgeSet::left): Deleted.
        (WebCore::EdgeSet::setLeft): Deleted.
        (WebCore::EdgeSet::operator==): Deleted.
        (WebCore::EdgeSet::operator!=): Deleted.
        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::setHasMargins):
        * platform/graphics/ca/TileController.h:

2016-03-04  Brent Fulgham  <bfulgham@apple.com>

        [WK2] Gather resource load statistics
        https://bugs.webkit.org/show_bug.cgi?id=154278
        <rdar://problem/24702892>

        Reviewed by Andy Estes.

        Tested (now under WK2) by http/tests/navigation/statistics.html

        Split part of the ResourceLoadObserver into a new class (ResourceLoadStatisticsStore)
        that manages the collection of ResourceLoadStatistic objects, and that can be used
        in the UIProcess without touching various WebProcess-specific WebCore classes.

        Have the WebProcess only fire a message to the UIProcess if data has been modified. Otherwise,
        no messages should be sent. When new data is encountered, start a 5 second timer. If more
        data is found during this delay, just accumulate it. When the timer fires, all data is sent
        and the timer stops until a new batch of data arrives.

        * CMakeLists.txt: Add the new ResourceLoadStatisticsStore class.
        * WebCore.xcodeproj/project.pbxproj: Adjust visibility of ResourceLoadStatistics header,
        and add new ResourceLoadStatisticsStore class.
        * loader/ResourceLoadObserver.cpp:
        (WebCore::ResourceLoadObserver::setResourceLoadStatisticsEnabled): Deleted.
        (WebCore::ResourceLoadObserver::resourceLoadStatisticsEnabled): Deleted.
        (WebCore::ResourceLoadObserver::setStatisticsStore): Added.
        (WebCore::ResourceLoadObserver::logFrameNavigation): Tell the ResourceLoadStatisticsStore to fire its 'data changed'
        handler if necessary.
        (WebCore::ResourceLoadObserver::logSubresourceLoading): Ditto.
        (WebCore::ResourceLoadObserver::logUserInteraction): Ditto.
        (WebCore::ResourceLoadObserver::statisticsForOrigin): Use new ResourceLoadStatisticsStore.
        (WebCore::ResourceLoadObserver::isPrevalentResource): Deleted.
        (WebCore::ResourceLoadObserver::resourceStatisticsForPrimaryDomain): Deleted.
        (WebCore::ResourceLoadObserver::writeDataToDisk): Deleted.
        (WebCore::ResourceLoadObserver::setStatisticsStorageDirectory): Deleted.
        (WebCore::ResourceLoadObserver::persistentStoragePath): Deleted.
        (WebCore::ResourceLoadObserver::readDataFromDiskIfNeeded): Deleted.
        (WebCore::ResourceLoadObserver::createDecoderFromDisk): Deleted.
        (WebCore::ResourceLoadObserver::writeEncoderToDisk): Deleted.
        * loader/ResourceLoadObserver.h:
        * loader/ResourceLoadStatistics.cpp:
        (WebCore::ResourceLoadStatistics::encode): Get rid of unneeded argument.
        (WebCore::ResourceLoadStatistics::decode): Ditto.
        (WebCore::mergeHashCountedSet): Added helper function.
        (WebCore::ResourceLoadStatistics::merge): Added.
        * loader/ResourceLoadStatistics.h:
        (WebCore::ResourceLoadStatistics::ResourceLoadStatistics):
        * loader/ResourceLoadStatisticsStore.cpp: Added.
        (WebCore::ResourceLoadStatisticsStore::create):
        (WebCore::ResourceLoadStatisticsStore::ResourceLoadStatisticsStore):
        (WebCore::ResourceLoadStatisticsStore::isPrevalentResource):
        (WebCore::ResourceLoadStatisticsStore::resourceStatisticsForPrimaryDomain):
        (WebCore::ResourceLoadStatisticsStore::writeDataToDisk):
        (WebCore::ResourceLoadStatisticsStore::setStatisticsStorageDirectory):
        (WebCore::ResourceLoadStatisticsStore::persistentStoragePath):
        (WebCore::ResourceLoadStatisticsStore::readDataFromDiskIfNeeded):
        (WebCore::ResourceLoadStatisticsStore::createDecoderFromDisk):
        (WebCore::ResourceLoadStatisticsStore::writeEncoderToDisk):
        (WebCore::ResourceLoadStatisticsStore::statisticsForOrigin):
        (WebCore::ResourceLoadStatisticsStore::takeStatistics):
        (WebCore::ResourceLoadStatisticsStore::mergeStatistics):
        (WebCore::ResourceLoadStatisticsStore::setNotificationCallback):
        (WebCore::ResourceLoadStatisticsStore::fireDataModificationHandler):
        * loader/ResourceLoadStatisticsStore.h: Added.

2016-03-04  Konstantin Tokarev  <annulen@yandex.ru>

        Added missing override specifiers under Source/WebCore.
        https://bugs.webkit.org/show_bug.cgi?id=155021

        Reviewed by Michael Catanzaro.

        No new tests needed.

        * bridge/NP_jsobject.cpp:
        * css/CSSStyleSheet.cpp:
        * dom/MutationObserver.cpp:
        * editing/DictationCommand.cpp:
        * editing/EditingStyle.cpp:
        * loader/EmptyClients.cpp:
        * loader/SinkDocument.cpp:
        * page/DOMWindow.cpp:
        * page/animation/CSSPropertyAnimation.cpp:
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        Also added #if(SOUP) guard to
        ResourceHandleStreamingClient::getOrCreateReadBuffer
        because it is not an overridden method otherwise.
        * platform/text/LineEnding.cpp:
        * xml/parser/XMLDocumentParserLibxml2.cpp:

2016-03-04  Gavin Barraclough  <barraclough@apple.com>

        Max out timer throttling immediately for pre-render pages
        https://bugs.webkit.org/show_bug.cgi?id=155038

        Reviewed by Chris Dumez.

        If a hidden page has never been visible, no need to gently ramp into throttling - treat it
        the same as a page that has been viewed, but has been in the background for a long time.

        Why? The throttling mechanism scales with the amount of background work by shifting the
        limit - once all background pages have maxed out the limit, they should no longer be burden
        of the system. However the mechanism doesn't currently do anything to accelerate towards
        the limit based on the number of pages in the ramp up phase, and ramp up duration is
        proportional to limit (so ramping up to a high limit takes a long time). So if you quickly
        create a large number of hidden pages the system may be under excessive load for a while,
        as we slowly ramp up to a limit that will adequately constrain resource consumption.
        In cases where a large number of hidden pages are rapidly generated, many likely remain in
        the pre-render state, so this mitigation should typically help.

        * page/Page.cpp:
        (WebCore::Page::updateDOMTimerAlignmentInterval):
            - if m_isPrerender then m_timerAlignmentInterval is set to the limit.
        (WebCore::Page::setIsPrerender):
            - When this changes updateDOMTimerAlignmentInterval().

2016-03-04  Gavin Barraclough  <barraclough@apple.com>

        Unify determination of page timer alignment
        https://bugs.webkit.org/show_bug.cgi?id=155031

        Reviewed by Chris Dumez.

        Currently this is scattered throughout Page - sites that call setDOMTimerAlignmentInterval have
        to determine the correct alignment interval. Instead, replace setDOMTimerAlignmentInterval with
        updateDOMTimerAlignmentInterval, and unify the policy decision here.

        * page/Page.cpp:
        (WebCore::Page::setTimerThrottlingState):
            - setDOMTimerAlignmentInterval -> updateDOMTimerAlignmentInterval
              Also, to simplify always record the timestamp when the state changes.
        (WebCore::Page::setTimerAlignmentIntervalIncreaseLimit):
            - setDOMTimerAlignmentInterval -> updateDOMTimerAlignmentInterval
        (WebCore::Page::updateDOMTimerAlignmentInterval):
            - Was setDOMTimerAlignmentInterval, now determines the new alignment value.
        (WebCore::Page::timerAlignmentIntervalIncreaseTimerFired):
            - setDOMTimerAlignmentInterval -> updateDOMTimerAlignmentInterval
        (WebCore::Page::setDOMTimerAlignmentInterval): Deleted.
            - Removed, became updateDOMTimerAlignmentInterval.
        * page/Page.h:
            - setDOMTimerAlignmentInterval -> updateDOMTimerAlignmentInterval
              m_timerThrottlingEnabledTime -> m_timerThrottlingStateLastChangedTime

2016-03-04  Simon Fraser  <simon.fraser@apple.com>

        Fix crash seen in iOS simulator tests
        https://bugs.webkit.org/show_bug.cgi?id=155030

        Reviewed by Tim Horton.

        owningGraphicsLayer() can be null when the tileSizeChangeTimer fires, so null check
        it and return, as we do for the tileRevalidationTimer.

        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::tileSizeChangeTimerFired):

2016-03-04  Alex Christensen  <achristensen@webkit.org>

        Remove vcxproj build system
        https://bugs.webkit.org/show_bug.cgi?id=154388

        Rubber-stamped by Brent Fulgham.

        * WebCore.vcxproj/WebCore.submit.sln: Removed.
        * WebCore.vcxproj/WebCore.vcxproj: Removed.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Removed.
        * WebCore.vcxproj/WebCoreCFNetwork.props: Removed.
        * WebCore.vcxproj/WebCoreCG.props: Removed.
        * WebCore.vcxproj/WebCoreCURL.props: Removed.
        * WebCore.vcxproj/WebCoreCairo.props: Removed.
        * WebCore.vcxproj/WebCoreCommon.props: Removed.
        * WebCore.vcxproj/WebCoreDebug.props: Removed.
        * WebCore.vcxproj/WebCoreDebugWinCairo.props: Removed.
        * WebCore.vcxproj/WebCoreGenerated.make: Removed.
        * WebCore.vcxproj/WebCoreGenerated.vcxproj: Removed.
        * WebCore.vcxproj/WebCoreGenerated.vcxproj.filters: Removed.
        * WebCore.vcxproj/WebCoreGeneratedCommon.props: Removed.
        * WebCore.vcxproj/WebCoreGeneratedDebug.props: Removed.
        * WebCore.vcxproj/WebCoreGeneratedDebugWinCairo.props: Removed.
        * WebCore.vcxproj/WebCoreGeneratedProduction.props: Removed.
        * WebCore.vcxproj/WebCoreGeneratedRelease.props: Removed.
        * WebCore.vcxproj/WebCoreGeneratedReleaseWinCairo.props: Removed.
        * WebCore.vcxproj/WebCoreGeneratedWinCairo.make: Removed.
        * WebCore.vcxproj/WebCoreGeneratedWinCairoCommon.props: Removed.
        * WebCore.vcxproj/WebCoreIncludeCommon.props: Removed.
        * WebCore.vcxproj/WebCoreMediaQT.props: Removed.
        * WebCore.vcxproj/WebCorePostBuild.cmd: Removed.
        * WebCore.vcxproj/WebCorePreBuild.cmd: Removed.
        * WebCore.vcxproj/WebCoreProduction.props: Removed.
        * WebCore.vcxproj/WebCoreQuartzCore.props: Removed.
        * WebCore.vcxproj/WebCoreRelease.props: Removed.
        * WebCore.vcxproj/WebCoreReleaseWinCairo.props: Removed.
        * WebCore.vcxproj/WebCoreTestSupport.vcxproj: Removed.
        * WebCore.vcxproj/WebCoreTestSupport.vcxproj.filters: Removed.
        * WebCore.vcxproj/WebCoreTestSupportCommon.props: Removed.
        * WebCore.vcxproj/WebCoreTestSupportDebug.props: Removed.
        * WebCore.vcxproj/WebCoreTestSupportDebugWinCairo.props: Removed.
        * WebCore.vcxproj/WebCoreTestSupportProduction.props: Removed.
        * WebCore.vcxproj/WebCoreTestSupportRelease.props: Removed.
        * WebCore.vcxproj/WebCoreTestSupportReleaseWinCairo.props: Removed.
        * WebCore.vcxproj/build-generated-files.pl: Removed.
        * WebCore.vcxproj/copyForwardingHeaders.cmd: Removed.
        * WebCore.vcxproj/copyWebCoreResourceFiles.cmd: Removed.
        * WebCore.vcxproj/migrate-scripts.pl: Removed.

2016-03-04  Brady Eidson  <beidson@apple.com>

        Remove use of deprecated sqlite3_expired
        https://bugs.webkit.org/show_bug.cgi?id=155025

        Reviewed by Tim Horton.

        Since we exclusively use sqlite3_prepare_v2 and don't use sqlite3_prepare,
        manually checking for expired statements is not necessary.

        * platform/sql/SQLiteStatement.cpp:
        (WebCore::SQLiteStatement::isExpired): Null check the statement, but don't bother
          with sqlite3_expired.

2016-03-04  Daniel Bates  <dabates@apple.com>

        Move CryptoDigest to WebCore/platform
        https://bugs.webkit.org/show_bug.cgi?id=155008
        <rdar://problem/24969787>

        Reviewed by Brent Fulgham.

        CryptoDigest provides a platform-independent interface for interacting with platform-
        specific cryptographic hashing services. We currently make use of this code as part
        of the implementation of Web Crypto. This code will also be beneficial as part of
        implementing support for Content Security Policy inline script and inline stylesheet
        hashes. We should move CryptoDigest to WebCore/platform to convey that it a general
        purpose platform abstraction.

        * CMakeLists.txt: Add include directory WebCore/platform/crypto.
        * PlatformEfl.cmake: Add file platform/crypto/gnutls/CryptoDigestGnuTLS.cpp and
        remove file crypto/gnutls/CryptoDigestGnuTLS.cpp.
        * PlatformGTK.cmake: Ditto.
        * PlatformMac.cmake: Add file platform/crypto/mac/CryptoDigestMac.cpp and
        remove file crypto/mac/CryptoDigestMac.cpp.
        * WebCore.xcodeproj/project.pbxproj:
        * crypto/algorithms/CryptoAlgorithmSHA1.cpp:
        (WebCore::CryptoAlgorithmSHA1::digest): Substitute "CryptoDigest::Algorithm" for "CryptoAlgorithmIdentifier".
        * crypto/algorithms/CryptoAlgorithmSHA224.cpp:
        (WebCore::CryptoAlgorithmSHA224::digest): Ditto.
        * crypto/algorithms/CryptoAlgorithmSHA256.cpp:
        (WebCore::CryptoAlgorithmSHA256::digest): Ditto.
        * crypto/algorithms/CryptoAlgorithmSHA384.cpp:
        (WebCore::CryptoAlgorithmSHA384::digest): Ditto.
        * crypto/algorithms/CryptoAlgorithmSHA512.cpp:
        (WebCore::CryptoAlgorithmSHA512::digest): Ditto.
        * crypto/mac/CryptoAlgorithmRSASSA_PKCS1_v1_5Mac.cpp:
        (WebCore::getCryptoDigestAlgorithm): Converts a CryptoAlgorithmIdentifier enumerator to a
        CryptoDigest::Algorithm enumerator, if applicable.
        (WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::platformSign): Write in terms of WebCore::getCryptoDigestAlgorithm().
        (WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::platformVerify): Ditto.
        * platform/crypto/CryptoDigest.h: Renamed from Source/WebCore/crypto/CryptoDigest.h. Also added enum CryptoDigest::Algorithm
        and changed constructor to take this enum.
        * platform/crypto/gnutls/CryptoDigestGnuTLS.cpp: Renamed from Source/WebCore/crypto/gnutls/CryptoDigestGnuTLS.cpp.
        (WebCore::CryptoDigest::CryptoDigest): Substitute "CryptoDigest::Algorithm" for "CryptoAlgorithmIdentifier".
        (WebCore::CryptoDigest::~CryptoDigest): Ditto.
        (WebCore::CryptoDigest::create): Ditto.
        (WebCore::CryptoDigest::addBytes): Ditto.
        (WebCore::CryptoDigest::computeHash): Ditto.
        * platform/crypto/mac/CryptoDigestMac.cpp: Renamed from Source/WebCore/crypto/mac/CryptoDigestMac.cpp.
        (WebCore::toSHA1Context): Ditto.
        (WebCore::toSHA224Context): Ditto.
        (WebCore::toSHA256Context): Ditto.
        (WebCore::toSHA384Context): Ditto.
        (WebCore::toSHA512Context): Ditto.
        (WebCore::CryptoDigest::CryptoDigest): Ditto.
        (WebCore::CryptoDigest::~CryptoDigest): Ditto.
        (WebCore::CryptoDigest::create): Ditto.
        (WebCore::CryptoDigest::addBytes): Ditto.
        (WebCore::CryptoDigest::computeHash): Ditto.

2016-03-04  Myles C. Maxfield  <mmaxfield@apple.com>

        Whitespace causes font-variant: all-small-caps to synthesize
        https://bugs.webkit.org/show_bug.cgi?id=155004
        <rdar://problem/24630796>

        Reviewed by Darin Adler.

        Many fonts (such as Avenir Next) don't report to support whitespace characters under
        smcp or c2sc. Previously, we were using this as a signal to synthesize small caps
        instead of true small caps. However, a better solution is for whitespace to never
        cause synthesis with all-small-caps.

        Test: fast/text/all-small-caps-whitespace.html

        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::shouldSynthesize):
        (WebCore::ComplexTextController::collectComplexTextRuns):

2016-03-04  Myles C. Maxfield  <mmaxfield@apple.com>

        [iOS] Crash during font loading when injected bundle cancels load
        https://bugs.webkit.org/show_bug.cgi?id=155001

        Reviewed by Tim Horton.

        If a injected bundle cancels the load, the fontLoaded() callback will be
        called twice. We can simply detect this condition.

        Test: CancelLoading.CancelFontSubresource API test

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::fontLoaded):

2016-03-03  Ada Chan  <adachan@apple.com>

        The visibility of the airplay menu also depends on whether there's a custom menu item.
        https://bugs.webkit.org/show_bug.cgi?id=154987

        Reviewed by Darin Adler.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::enqueuePlaybackTargetAvailabilityChangedEvent):

2016-03-04  Timothy Hatcher  <timothy@apple.com>

        Inform WebKit and WebCore if a page is controlled by automation.

        https://bugs.webkit.org/show_bug.cgi?id=154991
        rdar://problem/24965784

        Reviewed by Joseph Pecoraro.

        * page/Page.h:
        (WebCore::Page::isControlledByAutomation): Added.
        (WebCore::Page::setControlledByAutomation): Added.

2016-03-03  Antti Koivisto  <antti@apple.com>

        ComposedTreeIterator may traverse slotted nodes multiple times
        https://bugs.webkit.org/show_bug.cgi?id=154983

        Reviewed by Ryosuke Niwa.

        Traversal of slotted nodes can escape to real siblings. Those siblings are then traversed again as slotted nodes.

        Test: fast/shadow-dom/composed-tree-slots.html

        * dom/ComposedTreeIterator.cpp:
        (WebCore::ComposedTreeIterator::initializeContextStack):
        (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
        (WebCore::ComposedTreeIterator::traverseNextLeavingContext):
        (WebCore::ComposedTreeIterator::advanceInSlot):
        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::Context::Context):

            Include end iterator to the context.
            For slotted nodes set it up to point to the next sibling of the node.

        (WebCore::ComposedTreeIterator::context):
        (WebCore::ComposedTreeIterator::traverseNextSkippingChildren):

2016-03-04  Andreas Kling  <akling@apple.com>

        Drop DocumentSharedObjectPool immediately when going into PageCache.
        <https://webkit.org/b/154986>

        Reviewed by Antti Koivisto.

        The DocumentSharedObjectPool is a weirdly efficient little optimization
        that deduplicates ElementData during the first 10s of a Document's lifetime.
        While it's up, every ElementData created will persist so it can be used for
        deduplication.

        If a Document goes into the PageCache while its shared object pool is still
        alive, we can just kill it right away. This will sometimes allow us to free
        a bunch of ElementData sooner.

        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::setInPageCache):
        (WebCore::Document::clearSharedObjectPool):
        (WebCore::Document::sharedObjectPoolClearTimerFired): Deleted.
        * dom/Document.h:

2016-03-04  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove PassRefPtr from ThreadableLoader and relatives
        https://bugs.webkit.org/show_bug.cgi?id=154966

        Reviewed by Darin Adler.

        Covered by existing tests.

        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::create):
        * loader/DocumentThreadableLoader.h:
        * loader/ThreadableLoader.cpp:
        (WebCore::ThreadableLoader::create):
        * loader/ThreadableLoader.h:
        * loader/WorkerThreadableLoader.cpp:
        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
        * loader/WorkerThreadableLoader.h:

2016-03-03  Ryosuke Niwa  <rniwa@webkit.org>

        Let XCode have its own way and also sort the file.

        * WebCore.xcodeproj/project.pbxproj:

2016-03-03  Chris Dumez  <cdumez@apple.com>

        Regression(r196770): Unable to use HipChat Mac app
        https://bugs.webkit.org/show_bug.cgi?id=154999
        <rdar://problem/24931959>

        Reviewed by Darin Adler.

        r196770 made [Unforgeable] operations such as Location.reload()
        non-writable as per the Web IDL specification. As a result,
        trying to set such properties will be ignored in non-strict
        mode and will throw an exception is strict mode. This also matches
        Firefox and Chrome.

        However, this broke the HipChat Mac App (the Web App seems fine)
        because it sets Location.reload() and is using strict mode, therefore
        causing an exception to be thrown.

        This patch adds a quirk to JSLocation::putDelegate() which disable
        strict mode when we detect that the application is HipChat. As a
        result, we no longer throw when HipChat tries to set Location.reload
        and the application is able to connect again.

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate):
        Add a quirk which disables strict mode if the application is HipChat.

        * platform/RuntimeApplicationChecks.cpp:
        (WebCore::mainBundleIdentifier):
        Extract this from mainBundleIsEqualTo() so it can be shared with
        applicationBundleIdentifier().

        (WebCore::applicationBundleIdentifier):
        Returns the application bundle identifier, which is a static variable.
        For the WebContent / Networking processes, the application bundle
        identifier gets set to the UIProcess bundle identifier upon
        initialization. If unset, we fall back to using mainBundleIdentifier()
        which will do the right thing for the WK2 UIProcess and WK1.

        (WebCore::mainBundleIsEqualTo):
        Extract part of the code to mainBundleIdentifier() to better share
        code.

        (WebCore::applicationIsHipChat):
        Add utility function that checks if the application is HipChat. This
        will do the right thing whether it is called from the UIProcess, the
        WebProcess or the UIProcess.

        (WebCore::setApplicationBundleIdentifier):
        Add utility function to set the application bundle identifier. It gets
        called with the UIProcess bundle identifier by the NetworkProcess and
        the WebProcess upon initialization.

        * platform/RuntimeApplicationChecks.h:

2016-03-03  Keith Miller  <keith_miller@apple.com>

        JSArrayBuffers should be collected less aggressively
        https://bugs.webkit.org/show_bug.cgi?id=154982

        Reviewed by Geoffrey Garen.

        We are currently too aggressive in our collection of ArrayBuffer wrappers.
        There are three cases where we need to avoid collecting ArrayBuffer wrappers.
        1. If the wrapper has custom properties.
        2. If the wrapper is a subclass of ArrayBuffer.
        3. If the wrapper is in a WeakMap/WeakSet.

        Currently, we only pass the first case in WebCore and none in the jsc CLI.
        This patch removes some optimizations that cause us to collect when we
        should not. Namely, always skipping the object unless it has custom
        properties. Additionally, in the case of subclassing, we also need a way
        for custom JSArrayBuffer objects to register themselves as the wrapper for
        an ArrayBuffer class.

        Finally, this patch removes an unnecessary ref() and deref() of
        ArrayBuffer objects during the creation/destruction of the wrapper.
        Since an ArrayBuffer object's GC lifetime will be at least as long
        as the lifetime of the wrapper we are creating for it we don't need
        to ref() and deref() the ArrayBuffer object. This lifetime is
        guaranteed because ArrayBuffer objects are both GCed and refcounted
        and any new wrapper will visit the ArrayBuffer object as long as the
        wrapper is still alive.

        Test: js/arraybuffer-wrappers.html

        * bindings/js/JSDOMBinding.h:
        (WebCore::toJS):
        * bindings/js/WebCoreTypedArrayController.cpp:
        (WebCore::WebCoreTypedArrayController::registerWrapper):
        (WebCore::WebCoreTypedArrayController::JSArrayBufferOwner::finalize):
        (WebCore::WebCoreTypedArrayController::JSArrayBufferOwner::isReachableFromOpaqueRoots): Deleted.
        * bindings/js/WebCoreTypedArrayController.h:

2016-03-03  Simon Fraser  <simon.fraser@apple.com>

        Use larger tiles when possible to reduce per-tile painting overhead
        https://bugs.webkit.org/show_bug.cgi?id=154985
        rdar://problem/23635219

        Reviewed by Tim Horton.

        There's no reason to use lots of 512x512 tiles on a non-scrollable page. We can reduce
        per-tile painting overhead by using one big tile. On vertically scrolling pages, we
        can also use wide tiles to reduce tile-crossing when painting. Have FrameView tell
        the TiledBacking about scrollability, allowing TileController to make tile size decisions.

        Change the "giant tile" code path to just return whether Settings says we're in giant
        tile mode, so that tile size decisions can be made in TileController.

        TileController now stores a single margin size, and a per-edge margin flag rather than a size
        per edge. It computes tile size based on scrollability, but adjusts tile size with some 
        hysteresis to avoid size thrashing for content that frequently resizes the document (e.g.
        some performance tests).

        TileGrid stores a copy of the tile size, so that it remains unchanged from one revalidate
        to the next, and the grid can detect when the tile size changes, since it needs to throw away
        all tiles in that case.

        Tests: tiled-drawing/tile-size-both-scrollable.html
               tiled-drawing/tile-size-horizontally-scrollable.html
               tiled-drawing/tile-size-unscrollable.html
               tiled-drawing/tile-size-vertically-scrollable.html

        * WebCore.xcodeproj/project.pbxproj:
        * page/FrameView.cpp:
        (WebCore::FrameView::addedOrRemovedScrollbar):
        (WebCore::FrameView::willStartLiveResize): Tell the tile backing when live resize starts and stops.
        (WebCore::FrameView::willEndLiveResize):
        * platform/graphics/EdgeSet.h: Added. Template class that just stores some value
        per edge.
        (WebCore::EdgeSet::EdgeSet):
        (WebCore::EdgeSet::top):
        (WebCore::EdgeSet::setTop):
        (WebCore::EdgeSet::right):
        (WebCore::EdgeSet::setRight):
        (WebCore::EdgeSet::bottom):
        (WebCore::EdgeSet::setBottom):
        (WebCore::EdgeSet::left):
        (WebCore::EdgeSet::setLeft):
        (WebCore::EdgeSet::operator==):
        (WebCore::EdgeSet::operator!=):
        * platform/graphics/GraphicsLayerClient.h: Rather than have the client return the
        tile size, have it return whether we're in giant tile mode.
        (WebCore::GraphicsLayerClient::useGiantTiles):
        (WebCore::GraphicsLayerClient::tileSize): Deleted.
        * platform/graphics/TiledBacking.h:
        (WebCore::defaultTileSize): Deleted.
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::platformCALayerUseGiantTiles):
        (WebCore::GraphicsLayerCA::platformCALayerTileSize): Deleted.
        * platform/graphics/ca/GraphicsLayerCA.h:
        * platform/graphics/ca/PlatformCALayerClient.h:
        (WebCore::PlatformCALayerClient::platformCALayerUseGiantTiles):
        (WebCore::PlatformCALayerClient::platformCALayerTileSize): Deleted.
        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::TileController):
        (WebCore::TileController::setScrollability):
        (WebCore::TileController::willStartLiveResize):
        (WebCore::TileController::didEndLiveResize):
        (WebCore::TileController::tileSize):
        (WebCore::TileController::setHasMargins):
        (WebCore::TileController::setMarginSize):
        (WebCore::TileController::hasMargins):
        (WebCore::TileController::hasHorizontalMargins):
        (WebCore::TileController::hasVerticalMargins):
        (WebCore::TileController::topMarginHeight):
        (WebCore::TileController::bottomMarginHeight):
        (WebCore::TileController::leftMarginWidth):
        (WebCore::TileController::rightMarginWidth):
        (WebCore::TileController::setTileMargins): Deleted.
        * platform/graphics/ca/TileController.h:
        * platform/graphics/ca/TileGrid.cpp:
        (WebCore::TileGrid::TileGrid):
        (WebCore::TileGrid::setNeedsDisplayInRect):
        (WebCore::TileGrid::rectForTileIndex):
        (WebCore::TileGrid::getTileIndexRangeForRect):
        (WebCore::TileGrid::removeAllTiles):
        (WebCore::TileGrid::revalidateTiles):
        * platform/graphics/ca/TileGrid.h:
        (WebCore::TileGrid::tileSize):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::setTiledBackingHasMargins):
        (WebCore::RenderLayerBacking::useGiantTiles):
        (WebCore::RenderLayerBacking::tileSize): Deleted.
        * rendering/RenderLayerBacking.h:

2016-03-03  Ryosuke Niwa  <rniwa@webkit.org>

        Disallow custom elements inside a window-less documents
        https://bugs.webkit.org/show_bug.cgi?id=154944
        <rdar://problem/24944875>

        Reviewed by Antti Koivisto.

        Disallow custom elements inside a window-less documents such as the shared inert document of template elements
        and the ones created by DOMImplementation.createDocument and DOMImplementation.createHTMLDocument.

        Throw NotSupportedError in defineCustomElement when it's called in such a document as discussed in:
        https://github.com/w3c/webcomponents/issues/369

        Tests: fast/custom-elements/parser/parser-constructs-custom-element-in-document-write.html
               fast/custom-elements/parser/parser-uses-registry-of-owner-document.html

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::throwNotSupportedError): Added.
        * bindings/js/JSDOMBinding.h:
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::defineCustomElement): Throw NotSupportedError when the context object's document doesn't
        have a browsing context (i.e. window-less).
        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder): Replaced a FIXME with an assertion now that we
        disallow instantiation of custom elements inside a template element.

2016-03-03  Alex Christensen  <achristensen@webkit.org>

        Move SPI to CFNetworkSPI.h
        https://bugs.webkit.org/show_bug.cgi?id=154992

        Reviewed by Andy Estes.

        * platform/spi/cf/CFNetworkSPI.h:

2016-03-03  Alex Christensen  <achristensen@webkit.org>

        Use CredentialStorage with NetworkSession
        https://bugs.webkit.org/show_bug.cgi?id=154939

        Reviewed by Darin Adler.

        This makes the credential-based http tests pass when using NetworkSession.

        * platform/network/CredentialBase.h:
        (WebCore::CredentialBase::encodingRequiresPlatformData):
        * platform/network/CredentialStorage.h:
        WEBCORE_EXPORT more things that are newly used in WebKit2.

2016-03-03  Zalan Bujtas  <zalan@apple.com>

        Subpixel rendering: Make collapsed borders painting subpixel aware.
        https://bugs.webkit.org/show_bug.cgi?id=154980

        Reviewed by David Hyatt.

        This patch enables collapsed borders with odd pixel width paint on subpixel position.
        Currently borders with odd pixels are split at integral position so that border-width: 3px;
        paints 1px on the left(top) and 2px on the right(bottom) side. With this patch
        we paint 1.5px on both sides(on 2x display).

        Test: fast/table/hidpi-collapsed-border-with-odd-pixel-width.html

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::paintCollapsedBorders):

2016-03-03  Dave Hyatt  <hyatt@apple.com>

        Add support for the "last" value of hanging-punctuation
        https://bugs.webkit.org/show_bug.cgi?id=154977

        Reviewed by Darin Adler and Simon Fraser.

        New tests in fast/text.

        This patch adds support for the new "last" value and also fixes up both
        "first" and "last" to work with leading and trailing whitespace that ends
        up getting collapsed away.

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::computeInlinePreferredLogicalWidths):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::inlineAncestorHasStartBorderPaddingOrMargin):
        (WebCore::inlineAncestorHasEndBorderPaddingOrMargin):
        (WebCore::isLastInFlowRun):
        (WebCore::RenderBlockFlow::computeInlineDirectionPositionsForSegment):
        * rendering/RenderText.cpp:
        (WebCore::isHangablePunctuationAtLineEnd):
        (WebCore::RenderText::hangablePunctuationStartWidth):
        (WebCore::RenderText::hangablePunctuationEndWidth):
        (WebCore::RenderText::firstCharacterIndexStrippingSpaces):
        (WebCore::RenderText::lastCharacterIndexStrippingSpaces):
        (WebCore::RenderText::trimmedPrefWidths):
        * rendering/RenderText.h:
        * rendering/line/BreakingContext.h:
        (WebCore::BreakingContext::handleText):

2016-03-03  Andy Estes  <aestes@apple.com>

        Adopt CFNetwork storage partitioning SPI
        https://bugs.webkit.org/show_bug.cgi?id=154957
        rdar://problem/23614620

        Reviewed by Darin Adler.

        Adopt CFNetwork SPI for creating storage partitions. If Settings::cookieStoragePartitioningEnabled() is true,
        create cookie storage partitions for third-party contexts. This feature is disabled by default.

        No new tests. Test support is tracked by <https://webkit.org/b/154958>.

        * page/Settings.cpp:
        (WebCore::Settings::setCookieStoragePartitioningEnabled): Controls whether storage partitioning for cookies is enabled.
        * page/Settings.h:
        (WebCore::Settings::cookieStoragePartitioningEnabled):
        * platform/network/NetworkStorageSession.h:
        * platform/network/cf/NetworkStorageSessionCFNet.cpp:
        (WebCore::cookieStoragePartition): Computes a storage partition identifier by determining the top
        privately-controlled domain of the cookie's first-party (main frame document) URL, then determining whether the
        cookie's document hostname is a subdomain of it. If is is not, the first-party top domain is the partition name.
        Otherwise, there is no partition name.
        * platform/network/mac/CookieJarMac.mm:
        (WebCore::applyPartitionToCookies): Returns a deep copy of the given cookie array after adding a storage
        partition property to each copied cookie.
        (WebCore::cookiesInPartitionForURL): Returns cookies for the partition computed by the given URLs. If no
        partition can be determined, nil is returned.
        (WebCore::cookiesForURL): Returns cookiesInPartitionForURL() if non-nil, otherwise returns wkHTTPCookiesForURL().
        (WebCore::cookiesForSession): Started calling cookiesForURL().
        (WebCore::setCookiesFromDOM): Called applyPartitionToCookies() if a partition can be computed from the given URLs.
        (WebCore::getRawCookies): Started calling cookiesForURL().
        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::createNSURLConnection): Computed the storage partition identifier for the new request.
        If non-empty, set it as a property on the NSURLRequest where CFNetwork knows to find it.
        * platform/spi/cf/CFNetworkSPI.h: Declare new SPI for building with the public SDK.

2016-03-03  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Fix order of grid shorthands in CSSPropertyNames.in
        https://bugs.webkit.org/show_bug.cgi?id=154915

        Reviewed by Darin Adler.

        The order of columns and rows in grid and grid-template shorthands
        has been swapped recently (r196906 & r196934).
        However the order was not updated in CSSPropertyNames.in file.

        * css/CSSPropertyNames.in:

2016-03-03  Alexey Proskuryakov  <ap@apple.com>

        AllInOne build fix.

        * rendering/RenderFlexibleBox.cpp:
        * rendering/RenderGrid.cpp:
        Don't have two static functions with the same name.

2016-03-03  Chris Dumez  <cdumez@apple.com>

        Drop [TreatNullAs=EmptyString] from URL interface attributes
        https://bugs.webkit.org/show_bug.cgi?id=154951

        Reviewed by Darin Adler.

        Drop [TreatNullAs=EmptyString] from URL interface attributes to match
        the specification:
        - https://url.spec.whatwg.org/#api

        Firefox and Chrome both already follow the specification and convert
        null to the "null" string.

        No new tests, already covered by existing tests.

        * html/URLUtils.idl:

2016-03-03  Miguel Gomez  <magomez@igalia.com>

        [TextureMapper] Use RGBA format for textures attached to framebuffers
        https://bugs.webkit.org/show_bug.cgi?id=154965

        Reviewed by Žan Doberšek.

        Use RGBA format when allocating textures that will be used as framebuffer
        attachments. This means adding a new flag to BitmapTexture and modifying
        BitmapTextureGL to use the appropriate format according to the flag. Also,
        BitmapTexturePool needs to use two vectors to handle both types of textures
        separately, as we want to avoid constantly switching the format of a reused
        texture.

        No new tests since the behavior change is covered by existing tests.

        * platform/graphics/texmap/BitmapTexture.h: Add new flag.
        * platform/graphics/texmap/BitmapTextureGL.cpp:
        (WebCore::BitmapTextureGL::BitmapTextureGL): Receive flags on constructor and use RGBA
        when the FBOAttachment flag is enabled.
        (WebCore::BitmapTextureGL::applyFilters): Use FBOAttachemt flag to request a texture.
        * platform/graphics/texmap/BitmapTextureGL.h: Add flags to the constructor.
        * platform/graphics/texmap/BitmapTexturePool.cpp: Add a new vector of textures to hold
        those in RGBA format.
        (WebCore::BitmapTexturePool::acquireTexture): Return a texture for the usage specified
        in the incoming flags.
        (WebCore::BitmapTexturePool::releaseUnusedTexturesTimerFired): Release textures from
        both vectors.
        (WebCore::BitmapTexturePool::createTexture): Pass the usage flag when creating a new
        texture.
        * platform/graphics/texmap/BitmapTexturePool.h: Add new texture vector and add flags to
        the needed headers.
        * platform/graphics/texmap/TextureMapper.cpp:
        (WebCore::TextureMapper::acquireTextureFromPool): Pass the received flags to the BitmapTexturePool.
        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::paintIntoSurface): Use FBOAttachemt flag to request a texture.

2016-03-03  Javier Fernandez  <jfernandez@igalia.com>

        [CSS Box Alignment] New CSS Value 'normal' for Content Alignment
        https://bugs.webkit.org/show_bug.cgi?id=154282

        Reviewed by David Hyatt.

        The Box Alignment specification defines a new value 'normal' to be used
        as default for the different layout models, which will define the
        specific behavior for each case. This patch adds a new CSS value in the
        parsing logic and adapts the Content Alignment properties to the new
        value.

        The 'auto' value is no longer valid and the Computed Value will be
        always the specified value. Hence, I removed the StyleResolver logic
        because is not required now; the specific behavior of the 'normal'
        value will be resolved at layout time.

        Computed value of both align-content and justify-content is the
        specified value, we don't have to resolve any 'auto' value now.

        Additionally, this patch updates the layout logic as well, for both
        Flexbox and Grid layout models.

        No new tests, since we only need to rebaseline those test cases
        affected by the new default computed value.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::valueForContentPositionAndDistributionWithOverflowAlignment):
        (WebCore::ComputedStyleExtractor::propertyValue):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Deleted.
        (WebCore::CSSComputedStyleDeclaration::copyProperties): Deleted.
        (WebCore::nodeOrItsAncestorNeedsStyleRecalc): Deleted.
        (WebCore::isFlexOrGrid): Deleted.
        (WebCore::ComputedStyleExtractor::customPropertyValue): Deleted.
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseContentDistributionOverflowPosition):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator ContentPosition):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::normalValueBehavior):
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
        (WebCore::RenderFlexibleBox::layoutColumnReverse):
        (WebCore::RenderFlexibleBox::alignFlexLines):
        (WebCore::alignContentSpaceBetweenChildren): Deleted.
        * rendering/RenderGrid.cpp:
        (WebCore::normalValueBehavior):
        (WebCore::RenderGrid::applyStretchAlignmentToTracksIfNeeded):
        (WebCore::RenderGrid::columnAxisOffsetForChild):
        (WebCore::RenderGrid::rowAxisOffsetForChild):
        (WebCore::resolveContentDistributionFallback):
        (WebCore::contentDistributionOffset):
        (WebCore::RenderGrid::computeContentPositionAndDistributionOffset):
        * rendering/style/RenderStyle.cpp:
        (WebCore::resolvedContentAlignmentPosition):
        (WebCore::resolvedContentAlignmentDistribution):
        (WebCore::RenderStyle::resolvedJustifyContentPosition):
        (WebCore::RenderStyle::resolvedJustifyContentDistribution):
        (WebCore::RenderStyle::resolvedAlignContentPosition):
        (WebCore::RenderStyle::resolvedAlignContentDistribution):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:

2016-03-03  Antti Koivisto  <antti@apple.com>

        Slider thumb style should not depend on renderers
        https://bugs.webkit.org/show_bug.cgi?id=154961

        Reviewed by Andreas Kling.

        Currently slider thumb pseudo id is computed based on host element renderer.
        Style is the input for building a render tree and should be computable without having one.

        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::hostInput):
        (WebCore::SliderThumbElement::customStyleForRenderer):

            Compute pseudo id based on the host style.
            Return nullptr so style recalc will otherwise proceed normally.

        (WebCore::SliderThumbElement::shadowPseudoId):
        (WebCore::SliderThumbElement::cloneElementWithoutAttributesAndChildren):
        (WebCore::SliderContainerElement::SliderContainerElement):
        (WebCore::SliderContainerElement::create):
        (WebCore::SliderContainerElement::createElementRenderer):
        (WebCore::SliderContainerElement::customStyleForRenderer):

            Here too.

        (WebCore::SliderContainerElement::shadowPseudoId):
        (WebCore::sliderThumbShadowPseudoId): Deleted.
        (WebCore::mediaSliderThumbShadowPseudoId): Deleted.
        * html/shadow/SliderThumbElement.h:

2016-03-03  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Simplify method to resolve auto-placed items
        https://bugs.webkit.org/show_bug.cgi?id=154911

        Reviewed by Sergio Villar Senin.

        Refactor the method to resolve auto-placed items
        as we're only interested in knowing the span size.

        Adapt the calls to use the span size instead of a GridSpan.

        No new tests, no change of behavior.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        * rendering/style/GridResolvedPosition.cpp:
        (WebCore::GridResolvedPosition::spanSizeForAutoPlacedItem):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
        Renamed to spanSizeForAutoPlacedItem().
        * rendering/style/GridResolvedPosition.h:

2016-03-02  Chris Dumez  <cdumez@apple.com>

        HTMLFormElement's named property getter does not return a RadioNodelist
        https://bugs.webkit.org/show_bug.cgi?id=154949

        Reviewed by Ryosuke Niwa.

        HTMLFormElement's named property getter should return a RadioNodeList
        when there are several matches:
        https://html.spec.whatwg.org/multipage/forms.html#the-form-element

        Previously, WebKit returned a generic NodeList. As a result, users
        cannot create a white-and-gold hat in the MAKE A HAT GREAT AGAIN
        section at:
        https://www.washingtonpost.com/news/the-fix/wp/2015/10/06/hey-lets-all-make-our-own-donald-trump-hats/

        Chrome and Firefox already match the specification. Edge will soon.

        Test: fast/dom/HTMLFormElement/named-property-getter-radionodelist.html

        * bindings/js/JSHTMLFormElementCustom.cpp:
        (WebCore::JSHTMLFormElement::nameGetter):

2016-03-02  Chris Dumez  <cdumez@apple.com>

        Drop [TreatNullAs=LegacyNullString] from HTMLBaseElement.href
        https://bugs.webkit.org/show_bug.cgi?id=154952

        Reviewed by Ryosuke Niwa.

        Drop [TreatNullAs=LegacyNullString] from HTMLBaseElement.href as this
        does not match the specification:
        - https://html.spec.whatwg.org/multipage/semantics.html#the-base-element

        Firefox and Chrome both convert null to the string "null".

        No new tests, updated the following existing test:
        fast/dom/HTMLBaseElement/href-attribute-resolves-with-respect-to-document.html

        * html/HTMLBaseElement.idl:

2016-03-02  Zalan Bujtas  <zalan@apple.com>

        Paint table borders on empty cells even in quirks mode.
        https://bugs.webkit.org/show_bug.cgi?id=154928

        Reviewed by David Hyatt.

        Enable border painting for empty cells unless 'empty-cells: hide' is set. 
        This is inline with FF and Chrome behaviour.

        Test: fast/table/border-on-empty-table-cells-quirks-mode.html

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::paintBoxDecorations):

2016-03-02  Ryosuke Niwa  <rniwa@webkit.org>

        HTML parser instantiates a custom element inside a template element with a wrong owner document
        https://bugs.webkit.org/show_bug.cgi?id=154936

        Reviewed by Chris Dumez.

        The bug was caused by our implementation following the old spec which didn't create a appropriate template
        contents owner document [1] for a document without a browsing context. The new spec no longer has this clause,
        and we should be always creating the appropriate template contents owner document unless the document itself
        is an appropriate template contents owner document for another document (comes up in nested template elements).

        No new tests since the behavior change is covered by existing tests.

        [1] https://html.spec.whatwg.org/#appropriate-template-contents-owner-document

        * dom/Document.h:
        (WebCore::Document::templateDocument):

2016-03-02  Gavin Barraclough  <barraclough@apple.com>

        PageThrottler should apply hysteresis to media activity
        https://bugs.webkit.org/show_bug.cgi?id=154940

        Reviewed by Ryosuke Niwa.

        Currently PageThrottler keeps a track of audible plugin activity and HTML media element
        activity separately. Audible plugin activity also gets an extra 5s hysteresis applied,
        so that after audio playback has completed there is a chance to queue up more audio
        before timer throttling kicks in. HTML audio does not get this grace. Funnel both
        together into a single activity flag, such that the hysteresis is applied to both.

        * page/PageThrottler.cpp:
        (WebCore::PageThrottler::PageThrottler):
        (WebCore::m_mediaActivityHysteresis):
            - PageActivityState::AudiblePlugin -> PageActivityState::MediaActivity.
        (WebCore::m_mediaActivityCounter):
            - when m_mediaActivityCounter value changes call mediaActivityCounterChanged().
        (WebCore::PageThrottler::mediaActivityCounterChanged):
            - Drive PageActivityState::MediaActivity indirectly via m_mediaActivityHysteresis,
              such that a 5s hysteresis is applied.
        * page/PageThrottler.h:
            - Removed AudiblePlugin (merged in with MediaActivity).
        (WebCore::PageThrottler::pluginDidEvaluateWhileAudioIsPlaying):
            - m_audiblePluginHysteresis.impulse -> m_mediaActivityHysteresis.impulse.

2016-03-01  Ada Chan  <adachan@apple.com>

        Update the media element's presentation mode properly after going in and out of full screen via the Full Screen API
        https://bugs.webkit.org/show_bug.cgi?id=154834

        Reviewed by Simon Fraser.

        * dom/Document.cpp:
        (WebCore::Document::webkitWillEnterFullScreenForElement):
        * dom/Element.cpp:
        (WebCore::Element::willBecomeFullscreenElement):
        * dom/Element.h:
        (WebCore::Element::ancestorWillEnterFullscreen):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::enterFullscreen):
        If the Full Screen API is enabled and this media element is entering a mode other than standard
        full screen, see if it's currently contained in a full screen element. If so, exit full screen.
        (WebCore::HTMLMediaElement::willBecomeFullscreenElement):
        If this media element is going to standard full screen, update its presentation mode. If
        this media element also supports presentation mode and it currently has a presentation mode
        that's not standard full screen, exit that presentation mode directly without animation.
        (WebCore::HTMLMediaElement::willStopBeingFullscreenElement):
        Set the presentation mode back to inline unless it's already changed to a different
        presentation mode.
        * html/HTMLMediaElement.h:
        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::ancestorWillEnterFullscreen):
        Reset this video element's presentation state to inline if its ancestor is going to full screen.
        (WebCore::HTMLVideoElement::exitToFullscreenModeWithoutAnimationIfPossible):
        If the fullscreen mode the video element is exiting from is supported, exit that mode to the new mode.
        * html/HTMLVideoElement.h:
        * page/ChromeClient.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::exitFullscreenWithoutAnimationToMode):

2016-03-02  Brady Eidson  <beidson@apple.com>

        Modern IDB: Close UniqueIDBDatabases once they become unused.
        https://bugs.webkit.org/show_bug.cgi?id=154922

        Reviewed by Alex Christensen.

        Tests: storage/indexeddb/modern/256-open-databases.html
               storage/indexeddb/modern/exceed-open-file-limit.html

        Without this change, attempts to open a 256th database in the DatabaseProcess will fail on Mac.
        
        Due to SQLite journal files, this limit could come up as early as 128 databases if they are all
        in active use.
        
        This is because launchd - by default - limits xpc services to having 256 open file handles by default.
        
        While we should explore raising the limit, we should also close databases we no longer need.
        
        * Modules/indexeddb/server/IDBBackingStore.h:

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::closeUniqueIDBDatabase):
        (WebCore::IDBServer::IDBServer::deleteUniqueIDBDatabase): Deleted.
        * Modules/indexeddb/server/IDBServer.h:

        * Modules/indexeddb/server/MemoryBackingStoreTransaction.cpp:
        (WebCore::IDBServer::MemoryBackingStoreTransaction::MemoryBackingStoreTransaction):

        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::getOrEstablishDatabaseInfo):
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::~UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation): Handle the case where opening
          the backing store failed by firing an error event instead of pretending everything is okay.
        (WebCore::IDBServer::UniqueIDBDatabase::deleteBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::openBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::didOpenBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::isCurrentlyInUse):
        (WebCore::IDBServer::UniqueIDBDatabase::operationAndTransactionTimerFired): If the database is not
          currently in use, close it.
        (WebCore::IDBServer::UniqueIDBDatabase::inProgressTransactionCompleted):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        (WebCore::IDBServer::UniqueIDBDatabase::deletePending): Deleted.

        * Modules/indexeddb/shared/IDBObjectStoreInfo.cpp:
        (WebCore::IDBObjectStoreInfo::isolatedCopy): Actually get this right.

2016-03-02  Gavin Barraclough  <barraclough@apple.com>

        Disable timer throttling increases for visually idle / active pages.
        https://bugs.webkit.org/show_bug.cgi?id=154935

        Reviewed by Chris Dumez.

        Currently any page that is visually idle can timer throttle, and all are eligible for throttling
        allow throttling to increase.

        Instead, still allow any visually idle page to timer throttle, but only allow increasing in those
        that are fully hidden & inactive (no page loading or media activity).

        * page/Page.cpp:
        (WebCore::Page::setTimerThrottlingState):
            - Updated policy per commet above.
        (WebCore::Page::setPageActivityState):
        (WebCore::Page::setIsVisible):
            - We now may need to updated timer throttling when these change.

2016-03-02  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK.
        https://bugs.webkit.org/show_bug.cgi?id=154651

        Reviewed by Alex Christensen.

        No new tests needed.

        * CMakeLists.txt: Moved shared code to WEBKIT_FRAMEWORK macro.

2016-03-02  Dave Hyatt  <hyatt@apple.com>

        Add support for the "first" value of the hanging-punctuation property.
        https://bugs.webkit.org/show_bug.cgi?id=154919

        Reviewed by Simon Fraser.

        New tests added in fast/text.

        Implement the "first" value for hanging-punctuation as described here:
        https://drafts.csswg.org/css-text-3/#propdef-hanging-punctuation

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::computeInlinePreferredLogicalWidths):
        Update the preferred logical width computation to factor in hanging punctuation.
        This check is similar to the text-indent logic in that we only want to do it for
        the first formatted line.

        * rendering/RenderBlockFlow.h:
        (WebCore::RenderBlockFlow::simpleLineLayout):
        Make sure to turn off simple line layout when hanging punctuation is present. Eventually
        it should be feasible to support this in simple line layout, but since the full line
        layout model has to work with it anyway, we are starting there.

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::inlineAncestorHasStartBorderPaddingOrMargin):
        (WebCore::isLastInFlowRun):
        Helper functions that are needed to determine whether or not we're allowed to apply
        hanging punctuation "first" to a text run.

        (WebCore::RenderBlockFlow::computeInlineDirectionPositionsForSegment):
        This function manipulates logicalLeft and availableWidth when hanging punctuation
        is present to shift the line as needed and to expand the availableWidth of the line.

        * rendering/RenderText.cpp:
        (WebCore::isHangablePunctuationAtLineStart):
        (WebCore::isHangablePunctuationAtLineEnd):
        (WebCore::RenderText::hangablePunctuationStartWidth):
        (WebCore::RenderText::trimmedPrefWidths):
        * rendering/RenderText.h:
        RenderText has a helper function for handing back the hangable punctuation width. This
        is used everywhere line layout wants to apply that offset. There are also helper functions
        that detect whether the character is a hangable punctuation character.

        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::canUseForWithReason):
        (WebCore::SimpleLineLayout::printReason):
        Turn off simple line layout when hanging punctuation is enabled.

        * rendering/line/BreakingContext.h:
        (WebCore::BreakingContext::handleText):
        Modified to expand the available width when hanging punctuation is present so that we
        know we have more room on the line.

        * rendering/line/LineWidth.h:
        (WebCore::LineWidth::isFirstLine):
        Add an accessor for whether or not we're the first line.

2016-03-01  Ryosuke Niwa  <rniwa@webkit.org>

        Make HTML parser construct custom elements
        https://bugs.webkit.org/show_bug.cgi?id=154908
        <rdar://problem/24923735>

        Reviewed by Antti Koivisto.

        Added the support for instantiating custom elements inside the parser. Based on Jan F2F discussion,
        the HTML parser is going to synchronously construct custom elements. When a custom element constructor
        throws, the HTML parser creates a HTMLUnknownElement instead.

        In our implementation, we pause the parser completely and construct custom elements using the same
        mechanism used to run author scripts. It's possible that we may want to apply some optimizations to
        to make custom element construction but it's probably a good idea to get semantics right first.

        Tests: fast/custom-elements/parser/parser-constructs-custom-elements.html
               fast/custom-elements/parser/parser-fallsback-to-unknown-element.html
               fast/custom-elements/parser/parser-sets-attributes-and-children.html
               fast/custom-elements/parser/parser-uses-constructed-element.html

        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::constructElement): Added ShouldClearException as an argument
        to be used by the HTML parser since the parser can't re-throw to anywhere or fail parsing.

        * bindings/js/JSCustomElementInterface.h:
        (WebCore::JSCustomElementInterface::ShouldClearException): Added.

        * dom/Document.cpp:
        (WebCore::createHTMLElementWithNameValidation): Do not clear the exception here since createElement
        must re-throw the exception thrown by a custom element constructor.
        (WebCore::Document::createElementForBindings):

        * dom/make_names.pl:
        (printFactoryCppFile): Added ConstructorFunctionMapEntry which contains the constructor function
        as well as the qualified name.
        (printFactoryHeaderFile): Added a variant of createKnownElement and createElement that takes
        AtomicString instead of QualifiedName.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::setAttributes): Added a variant that takes Vector<Attribute>.
        (WebCore::HTMLConstructionSite::insertHTMLElementOrFindCustomElementInterface): Added. Returns a
        custom element interface when the element doesn't match any builtin element and there is a custom
        element definition that matches the specified name.
        (WebCore::HTMLConstructionSite::insertCustomElement): Added. Like insertElement but also sets the
        attributes on the newly created custom element.
        (WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface): Extracted from
        createHTMLElement. When customElementInterface is not nullptr, we optionally find the custom
        element interface and return nullptr.
        (WebCore::HTMLConstructionSite::createHTMLElement):
        * html/parser/HTMLConstructionSite.h:

        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder): Create a custom element when there
        is a pending custom element to create (i.e. m_customElementToConstruct is not empty).
        (WebCore::HTMLDocumentParser::isWaitingForScripts):

        * html/parser/HTMLStackItem.h:
        (WebCore::HTMLStackItem::create): Added a variant used for custom elements.
        (WebCore::HTMLStackItem::HTMLStackItem): Ditto.

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::CustomElementConstructionData::CustomElementConstructionData): Added. It needs to be in
        the cpp file to avoid introducing more header dependencies in HTMLTreeBuilder.h.
        (WebCore::CustomElementConstructionData::~CustomElementConstructionData): Ditto.
        (WebCore::HTMLTreeBuilder::processStartTagForInBody): Use insertGenericHTMLElement when creating
        a generic element that could be custom elements.
        (WebCore::HTMLTreeBuilder::insertGenericHTMLElement): Added. Create and insert a new element
        or set m_customElementToConstruct so that the HTMLDocumentParser will create a custom element later.
        (WebCore::HTMLTreeBuilder::didCreateCustomOrCallbackElement): Added. Called by HTMLDocumentParser
        when it finishes creating a new custom element.

        * html/parser/HTMLTreeBuilder.h:
        (WebCore::HTMLTreeBuilder::takeCustomElementConstructionData): Added.
        (WebCore::HTMLTreeBuilder::hasParserBlockingScriptWork): Renamed from hasParserBlockingScript.
        Checks the existence of m_customElementToConstruct as well as m_scriptToProcess.

2016-03-02  Zalan Bujtas  <zalan@apple.com>

        Use IndentTextOrNot instead of passing isFirstLine/shouldIndentText as bool.
        https://bugs.webkit.org/show_bug.cgi?id=154628

        Reviewed by Simon Fraser.

        No change in behaviour.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeStartPositionDeltaForChildAvoidingFloats):
        (WebCore::RenderBlock::logicalLeftSelectionOffset):
        (WebCore::RenderBlock::logicalRightSelectionOffset):
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::availableLogicalWidthForLineInRegion):
        (WebCore::RenderBlock::logicalRightOffsetForLineInRegion):
        (WebCore::RenderBlock::logicalLeftOffsetForLineInRegion):
        (WebCore::RenderBlock::startOffsetForLineInRegion):
        (WebCore::RenderBlock::endOffsetForLineInRegion):
        (WebCore::RenderBlock::availableLogicalWidthForLine):
        (WebCore::RenderBlock::logicalRightOffsetForLine):
        (WebCore::RenderBlock::logicalLeftOffsetForLine):
        (WebCore::RenderBlock::startOffsetForLine):
        (WebCore::RenderBlock::endOffsetForLine):
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::getClearDelta):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::updateLogicalInlinePositions):
        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
        (WebCore::RenderBlockFlow::deleteEllipsisLineBoxes):
        (WebCore::RenderBlockFlow::checkLinesForTextOverflow):
        (WebCore::RenderBlockFlow::startAlignedOffsetForLine):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats):
        (WebCore::RenderBox::containingBlockAvailableLineWidthInRegion):
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):
        * rendering/RenderListItem.cpp:
        (WebCore::RenderListItem::positionListMarker):
        * rendering/RootInlineBox.cpp:
        (WebCore::RootInlineBox::selectionTop):
        (WebCore::RootInlineBox::selectionBottom):
        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::canUseForWithReason):
        (WebCore::SimpleLineLayout::updateLineConstrains):
        * rendering/line/LineBreaker.cpp:
        (WebCore::LineBreaker::skipLeadingWhitespace):
        * rendering/line/LineWidth.cpp:
        (WebCore::LineWidth::shrinkAvailableWidthForNewFloatIfNeeded):
        (WebCore::availableWidthAtOffset):
        * rendering/line/LineWidth.h:
        (WebCore::LineWidth::shouldIndentText):

2016-03-02  Beth Dakin  <bdakin@apple.com>

        Add support for playbackControlsManager
        https://bugs.webkit.org/show_bug.cgi?id=154742
        -and corresponding-
        rdar://problem/23833753

        Reviewed by Jer Noble.

        Make AVKitSPI.h private so that it can be used from other projects.
        * WebCore.xcodeproj/project.pbxproj:

        Right now, set up a controls manager for a video when it starts playing. In 
        the future, this is something that should be handled by the 
        PlatformMediaSessionManager since we only want a controls for the 
        currentSession.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::playInternal):

        New function setUpVideoControlsManager.
        * page/ChromeClient.h:

        Make these CoreMedia functions available on Mac and iOS instead of just iOS.
        * platform/cf/CoreMediaSoftLink.cpp:
        * platform/cf/CoreMediaSoftLink.h:

        This patch fleshes out an implementation for a bunch of these interface 
        functions since they need to communicate to the playbackControlsManager. This 
        is also where the playbackControlsManager lives.
        * platform/mac/WebVideoFullscreenInterfaceMac.h:

        Define an interface and implementation for WebPlaybackControlsManager.
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (-[WebPlaybackControlsManager initWithWebVideoFullscreenInterfaceMac:]):
        (-[WebPlaybackControlsManager isSeeking]):
        (-[WebPlaybackControlsManager seekToTime:toleranceBefore:toleranceAfter:]):
        (-[WebPlaybackControlsManager audioMediaSelectionOptions]):
        (-[WebPlaybackControlsManager currentAudioMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentAudioMediaSelectionOption:]):
        (-[WebPlaybackControlsManager legibleMediaSelectionOptions]):
        (-[WebPlaybackControlsManager currentLegibleMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentLegibleMediaSelectionOption:]):
        (-[WebPlaybackControlsManager cancelThumbnailAndAudioAmplitudeSampleGeneration]):

        Relay this information to the playbackControlsManager.
        (WebCore::WebVideoFullscreenInterfaceMac::setDuration):
        (WebCore::WebVideoFullscreenInterfaceMac::setCurrentTime):
        (WebCore::WebVideoFullscreenInterfaceMac::setRate):
        (WebCore::WebVideoFullscreenInterfaceMac::setSeekableRanges):
        (WebCore::WebVideoFullscreenInterfaceMac::ensureControlsManager):
        (WebCore::WebVideoFullscreenInterfaceMac::playBackControlsManager):
        (WebCore::WebVideoFullscreenInterfaceMac::setupFullscreen):

        New SPI needed.
        * platform/spi/cocoa/AVKitSPI.h:
        * platform/spi/mac/AVFoundationSPI.h:

2016-03-02  Gavin Barraclough  <barraclough@apple.com>

        Add Page::TimerThrottlingState
        https://bugs.webkit.org/show_bug.cgi?id=154926

        Reviewed by Chris Dumez.

        Hidden page timer throttling is currently a boolean state, indicated by whether the Optional
        m_timerThrottlingEnabledTime is in a set/unset state. When enabled, the increasing mechanism
        may or may not be enabled, this is controlled directly by the setting.

        Refactor to add an enum tracking timer throttling being in one of three states - disabled,
        enabled, or enabled-increasing. This cleans things up, and will enabled up to introduce a
        dynamic policy for when enabled-throttling is enabled. (Behavior is unchanged in this patch.)

        * page/Page.cpp:
        (WebCore::Page::Page):
        (WebCore::Page::setIsVisuallyIdleInternal):
        (WebCore::Page::hiddenPageDOMTimerThrottlingStateChanged):
            - setTimerThrottlingEnabled -> updateTimerThrottlingState.
        (WebCore::Page::updateTimerThrottlingState):
            - policy decision (currently enabled if visually-idle) was scattered across
              all call sites to setTimerThrottlingState. Unify in one place.
        (WebCore::Page::setTimerThrottlingState):
            - Was setTimerThrottlingEnabled.
        (WebCore::Page::setTimerAlignmentIntervalIncreaseLimit):
        (WebCore::Page::setDOMTimerAlignmentInterval):
        (WebCore::Page::timerAlignmentIntervalIncreaseTimerFired):
            - updated to check m_timerThrottlingState.
        (WebCore::Page::setTimerThrottlingEnabled): Deleted.
            - This became updateTimerThrottlingState.
        * page/Page.h:
        (WebCore::Page::timerThrottlingEnabled): Deleted.
            - Removed, it's easy enough now to just check m_timerThrottlingState.

2016-03-02  Chris Dumez  <cdumez@apple.com>

        Align HTMLInputElement.maxLength with the specification
        https://bugs.webkit.org/show_bug.cgi?id=154906

        Reviewed by Ryosuke Niwa.

        Align HTMLInputElement.maxLength with the specification:
        - https://html.spec.whatwg.org/multipage/forms.html#dom-input-maxlength
        - https://html.spec.whatwg.org/multipage/forms.html#attr-input-maxlength

        In particular, the following Web-facing change was made:
        - HTMLInputElement.maxLength returns -1 instead of 524288 when
          the corresponding content attribute is missing, cannot be parsed
          or out of range (i.e. negative), as per:
          - https://html.spec.whatwg.org/multipage/infrastructure.html#limited-to-only-non-negative-numbers

        Note that HTMLTextAreaElement.maxLength was already returning -1 in
        this case.

        The new behavior matches Firefox. Chrome however, still seems to
        return 524288.

        Note that we keep using 524288 as a maximum maxLength internally for
        performance reasons. However, we stop exposing this arbitrary value to
        the Web as this is an internal limitation.

        No new tests, already covered by existing tests.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::HTMLInputElement):
        Initialize m_maxLength to -1 initially, instead of 524288.

        (WebCore::HTMLInputElement::tooLong):
        Call effectiveMaxLength() instead of maxLength(), which no longer
        exists. effectiveMaxLength() makes sure of returning a value in
        the range [0, 524288].

        (WebCore::HTMLInputElement::parseAttribute):

        (WebCore::HTMLInputElement::effectiveMaxLength):
        Split maxLength() into maxLengthForBindings() and effectiveMaxLength().
        effectiveMaxLength() returns a value in the range [0, 524288], while
        maxLengthForBindings() returns values in the range [-1, 2147483647].

        (WebCore::HTMLInputElement::setMaxLength): Deleted.
        The implementation was moved to the parent class so that it can be
        shared with HTMLTextAreaElement.

        (WebCore::HTMLInputElement::maxLengthAttributeChanged):
        Rename for clarity.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::parseAttribute):
        (WebCore::HTMLTextAreaElement::maxLengthAttributeChanged):
        Cache the parsed maxLength when the content attribute changes, similarly
        to what is already done in HTMLInputElement.

        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
        (WebCore::HTMLTextAreaElement::validationMessage):
        (WebCore::HTMLTextAreaElement::tooLong):
        Call effectiveMaxLength() instead of maxLength() which no longer exists.
        effectiveMaxLength() returns a cached value and is therefore a lot more
        efficient.

        * html/HTMLTextAreaElement.h:
        * html/HTMLTextAreaElement.idl:
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::setMaxLengthForBindings):
        This was moved up from HTMLInputElement / HTMLTextAreaElement to avoid code
        duplication.

        * html/HTMLTextFormControlElement.h:

        * html/InputType.cpp:
        (WebCore::InputType::validationMessage):
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::handleBeforeTextInsertedEvent):
        Call HTMLInputElement::effectiveMaxLength() instead of
        HTMLInputElement::maxLength() which no longer exists.

2016-03-02  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197434 and r197436.
        https://bugs.webkit.org/show_bug.cgi?id=154921

        This change caused a LayoutTest assertion in debug (Requested
        by ryanhaddad on #webkit).

        Reverted changesets:

        "Extend CSSFontSelector's lifetime to be longer than the
        Document's lifetime"
        https://bugs.webkit.org/show_bug.cgi?id=154101
        http://trac.webkit.org/changeset/197434

        "Unreviewed build fix after r197434."
        http://trac.webkit.org/changeset/197436

2016-03-02  Zalan Bujtas  <zalan@apple.com>

        Subpixel layout: Enable vertical/horizontal subpixel spacing for tables.
        https://bugs.webkit.org/show_bug.cgi?id=154899

        Reviewed by Simon Fraser.

        This patch enables authors to specify device pixel values for table border spacing.
        (see border-spacing)

        Test: fast/table/hidpi-vertical-and-horizontal-spacing.html

        * css/CSSPropertyNames.in:
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::offsetLeftForColumn):
        (WebCore::RenderTable::offsetWidthForColumn):
        (WebCore::RenderTable::RenderTable): Deleted.
        * rendering/RenderTable.h:
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::horizontalBorderSpacing):
        (WebCore::RenderStyle::verticalBorderSpacing):
        (WebCore::RenderStyle::setHorizontalBorderSpacing):
        (WebCore::RenderStyle::setVerticalBorderSpacing):
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleInheritedData.h:

2016-03-02  Chris Dumez  <cdumez@apple.com>

        Have parseHTMLInteger() / parseHTMLNonNegativeInteger() use WTF::Optional
        https://bugs.webkit.org/show_bug.cgi?id=154845

        Reviewed by Darin Adler.

        Take into consideration review comments made after landing r197389.

        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::parseBorderWidthAttribute):
        (WebCore::HTMLElement::parseAttribute):
        * html/HTMLInputElement.cpp:
        * html/HTMLInputElement.h:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::maxLength):
        * html/ImageInputType.cpp:
        (WebCore::ImageInputType::height):
        (WebCore::ImageInputType::width):
        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::parseHTMLNonNegativeInteger):
        * html/parser/HTMLParserIdioms.h:
        (WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
        (WebCore::limitToOnlyHTMLNonNegative):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::parseAttribute):

2016-03-01  Ryosuke Niwa  <rniwa@webkit.org>

        Unreviewed. Remove the "Partial Support" status from web components since shadow DOM and custom elements
        are in active development.

        * features.json:

2016-03-01  Ryosuke Niwa  <rniwa@webkit.org>

        Unreviewed. Update the feature status for custom elements API.

        * features.json:

2016-02-26  Ryosuke Niwa  <rniwa@webkit.org>

        Contents inside a shadow host with a negative tabindex should not be tab focusable
        https://bugs.webkit.org/show_bug.cgi?id=154769

        Reviewed by Antti Koivisto.

        Contents inside a shadow host with a negative tabindex content attribute should not be included in
        the sequential focus navigation order as discussed on https://github.com/w3c/webcomponents/issues/399.

        Test: fast/shadow-dom/negative-tabindex-on-shadow-host.html

        * dom/Element.cpp:
        (WebCore::Element::tabIndexSetExplicitly): Added.
        * dom/Element.h:
        * page/FocusController.cpp:
        (WebCore::shadowAdjustedTabIndex): Renamed from adjustedTabIndex. Return 0 when tabindex content attribute
        is not explicitly set since element.tabIndex() would return -1 for HTML elements in such case.
        (WebCore::isFocusableOrHasShadowTreeWithoutCustomFocusLogic): Renamed from shouldVisit.
        (WebCore::FocusController::findElementWithExactTabIndex):
        (WebCore::nextElementWithGreaterTabIndex):
        (WebCore::previousElementWithLowerTabIndex):
        (WebCore::FocusController::nextFocusableElement):
        (WebCore::FocusController::previousFocusableElement):

2016-03-01  Michael Saboff  <msaboff@apple.com>

        REGRESSION (r197426): Missed adding unicode parameter to call to Yarr::parse() in URLFilterParser::addPattern()
        https://bugs.webkit.org/show_bug.cgi?id=154898

        Reviewed by Saam Barati.

        This is a fix for the API tests after r197426.

        Added missing bool unicode parameter of "false".

        * contentextensions/URLFilterParser.cpp:
        (WebCore::ContentExtensions::URLFilterParser::addPattern):

2016-03-01  Myles C. Maxfield  <mmaxfield@apple.com>

        Unreviewed build fix after r197434.

        Unreviewed

        * css/SourceSizeList.cpp:
        (WebCore::parseSizesAttribute):

2016-03-01  Myles C. Maxfield  <mmaxfield@apple.com>

        Small-caps non-BMP characters are garbled in the complex text codepath
        https://bugs.webkit.org/show_bug.cgi?id=154875

        Reviewed by Michael Saboff.

        We were assuming that all characters able to be capitalized are in BMP. This is not true.

        Test: fast/text/complex-small-caps-non-bmp-capitalize.html

        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::capitalized):
        (WebCore::ComplexTextController::collectComplexTextRuns):

2016-03-01  Myles C. Maxfield  <mmaxfield@apple.com>

        Extend CSSFontSelector's lifetime to be longer than the Document's lifetime
        https://bugs.webkit.org/show_bug.cgi?id=154101

        Reviewed by Darin Adler.

        Rather than destroying the Document's CSSFontSelector, instead, the object should
        live for the lifetime of the document, and it should instead be asked to clear its
        contents.

        This is important for the CSS Font Loading API, where the identity of objects the
        CSSFontSelector references needs to persist throughout the lifetime of the
        Document. This patch represents the first step to implementing this correctly.
        The second step is for the CSSFontSelector to perform a diff instead of a
        wholesale clear of its contents. Once this is done, font loading objects can
        survive through a call to Document::clearStyleResolver().

        This patch gives the CSSFontSelector two states: building underway and building not
        underway. The state is building underway in between calls to clearStyleResolver()
        and when the style resolver gets built back up. Otherwise, the state is building
        not underway. Because of this new design, creation of all FontFace objects can be
        postponed until a state transition from building underway to building not underway.
        A subsequent patch will perform the diff at this point. An ASSERT() makes sure that
        we never service a font lookup request while Building.

        No new tests because there is no behavior change.

        * css/CSSFontFaceSet.cpp:
        (WebCore::CSSFontFaceSet::clear):
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::buildStarted):
        (WebCore::CSSFontSelector::buildCompleted):
        (WebCore::CSSFontSelector::addFontFaceRule):
        (WebCore::CSSFontSelector::fontRangesForFamily):
        (WebCore::CSSFontSelector::CSSFontSelector): Deleted.
        (WebCore::CSSFontSelector::clearDocument): Deleted.
        * css/CSSFontSelector.h:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::appendAuthorStyleSheets):
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::~Document):
        (WebCore::Document::clearStyleResolver):
        (WebCore::Document::fontSelector): Deleted.
        * dom/Document.h:
        (WebCore::Document::fontSelector):

2016-03-01  Alexey Proskuryakov  <ap@apple.com>

        Update Xcode project for InstallAPI
        https://bugs.webkit.org/show_bug.cgi?id=154896
        rdar://problem/24825992

        Patch by Daniel Dunbar, reviewed by me.

        * Configurations/WebCore.xcconfig:
        * WebCore.xcodeproj/project.pbxproj:

2016-03-01  Ada Chan  <adachan@apple.com>

        One more attempt to fix the build.

        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
        (WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):

2016-03-01  Ada Chan  <adachan@apple.com>

        Attempt to fix the internal build.

        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
        (WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):

2016-02-29  Ada Chan  <adachan@apple.com>

        Adopt the new version of AVOutputDeviceMenuController's showMenuForRect method.
        https://bugs.webkit.org/show_bug.cgi?id=154823

        Reviewed by Tim Horton.

        * Modules/mediasession/WebMediaSessionManager.cpp:
        (WebCore::WebMediaSessionManager::showPlaybackTargetPicker):
        (WebCore::WebMediaSessionManager::customPlaybackActionSelected):
        Call customPlaybackActionSelected() on the client that requested the picker.
        * Modules/mediasession/WebMediaSessionManager.h:
        * Modules/mediasession/WebMediaSessionManagerClient.h:
        * dom/Document.cpp:
        (WebCore::Document::showPlaybackTargetPicker):
        (WebCore::Document::customPlaybackActionSelected):
        * dom/Document.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::customPlaybackActionSelected):
        (WebCore::HTMLMediaElement::playbackTargetPickerCustomActionName):
        * html/HTMLMediaElement.h:
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::showPlaybackTargetPicker):
        (WebCore::MediaElementSession::customPlaybackActionSelected):
        * html/MediaElementSession.h:
        * page/ChromeClient.h:
        * page/Page.cpp:
        (WebCore::Page::showPlaybackTargetPicker):
        (WebCore::Page::customPlaybackActionSelected):
        * page/Page.h:
        * platform/audio/PlatformMediaSession.h:
        (WebCore::PlatformMediaSessionClient::customPlaybackActionSelected):
        * platform/graphics/MediaPlaybackTargetClient.h:
        * platform/graphics/MediaPlaybackTargetPicker.cpp:
        (WebCore::MediaPlaybackTargetPicker::pendingActionTimerFired):
        (WebCore::MediaPlaybackTargetPicker::showPlaybackTargetPicker):
        * platform/graphics/MediaPlaybackTargetPicker.h:
        (WebCore::MediaPlaybackTargetPicker::Client::customPlaybackActionSelected):
        (WebCore::MediaPlaybackTargetPicker::customPlaybackActionSelected):
        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.h:
        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
        Update the forward declaration of AVOutputDeviceMenuController's showMenuForRect method.
        (WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):
        Call the new version of showMenuForRect if available.
        * platform/mac/WebVideoFullscreenInterfaceMac.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::setExternalPlayback):
        * platform/mock/MediaPlaybackTargetPickerMock.cpp:
        (WebCore::MediaPlaybackTargetPickerMock::showPlaybackTargetPicker):
        * platform/mock/MediaPlaybackTargetPickerMock.h:
        * platform/spi/cocoa/AVKitSPI.h:
        Updated with the new version of showMenuForRect.

2016-03-01  Daniel Bates  <dabates@apple.com>

        com.apple.WebKit.Networking.Development crashes in WebCore::formOpen()
        https://bugs.webkit.org/show_bug.cgi?id=154682
        <rdar://problem/23550269>

        Reviewed by Brent Fulgham.

        Speculative fix for a race condition when opening the stream for the next form data element.
        Calling CFReadStreamOpen(s) in WebCore::openNextStream() can cause stream s to be closed and
        deallocated before CFReadStreamOpen(s) returns.

        When WebCore::openNextStream() is called it closes and deallocates the current stream and
        then opens a new stream for the next form data element. Calling CFReadStreamOpen() in
        WebCore::openNextStream() can lead to WebCore::openNextStream() being re-entered via
        WebCore::formEventCallback() from another thread. One example when this can occur is when
        the stream being opened has no data (i.e. WebCore::formEventCallback() is called
        back with event type kCFStreamEventEndEncountered).

        I have been unable to reproduce this crash. We know that it occurs from crash reports.

        * platform/network/cf/FormDataStreamCFNet.cpp:
        (WebCore::closeCurrentStream): Assert that we had acquired a lock to close the stream.
        (WebCore::advanceCurrentStream): Assert that we had acquired a lock to advance the stream.
        (WebCore::openNextStream): Acquire a lock before we open the next stream to ensure that
        exactly one thread executes this critical section at a time.
        (WebCore::formFinalize): Acquire a lock before we close the current stream.
        (WebCore::formClose): Ditto.

2016-03-01  Michael Saboff  <msaboff@apple.com>

        ASSERT in platform/graphics/mac/ComplexTextController.cpp::capitalize()
        https://bugs.webkit.org/show_bug.cgi?id=154875

        Reviewed by Myles C. Maxfield.

        Change an ASSERT to verify that uper casing a character doesn't change its size.

        Test: fast/text/regress-154875.html

        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::capitalized):

2016-03-01  Gavin Barraclough  <barraclough@apple.com>

        Timer alignment in separate web processes should not all sync up to the same point.
        https://bugs.webkit.org/show_bug.cgi?id=154878

        Reviewed by Chris Dumez.

        For any given WebContent process it is desirable that timers are synchronized to a single
        alignment point, but if all WebContent processes align to the same point then there may
        be a thundering herd of processes waking up.

        * page/DOMTimer.cpp:
        (WebCore::DOMTimer::alignedFireTime):
            - align to a randomized point.

2016-03-01  Alex Christensen  <achristensen@webkit.org>

        Reduce size of internal windows build output
        https://bugs.webkit.org/show_bug.cgi?id=154763

        Reviewed by Brent Fulgham.

        * WebCore.vcxproj/WebCore.proj:

2016-03-01  Andreas Kling  <akling@apple.com>

        REGRESSION (r154616): Accelerated drawing is off during the initial load
        <https://webkit.org/b/123812>

        Reviewed by Tim Horton.

        Robustify the hey-the-Settings-changed callbacks in Page to handle document-less frames.
        This is needed because now Settings are changed even before the main Frame has a Document.

        * page/Page.cpp:
        (WebCore::networkStateChanged):
        (WebCore::Page::updateStyleForAllPagesAfterGlobalChangeInEnvironment):
        (WebCore::Page::takeAnyMediaCanStartListener):
        (WebCore::Page::setMediaVolume):
        (WebCore::Page::setPageScaleFactor):
        (WebCore::Page::invalidateStylesForAllLinks):
        (WebCore::Page::invalidateStylesForLink):
        (WebCore::Page::dnsPrefetchingStateChanged):
        (WebCore::Page::storageBlockingStateChanged):
        (WebCore::Page::setMuted):
        (WebCore::Page::captionPreferencesChanged):
        (WebCore::Page::setSessionID):
        (WebCore::Page::setPlaybackTarget):
        (WebCore::Page::playbackTargetAvailabilityDidChange):
        (WebCore::Page::setShouldPlayToPlaybackTarget):
        * page/Settings.cpp:
        (WebCore::setImageLoadingSettings):

2016-03-01  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197056.
        https://bugs.webkit.org/show_bug.cgi?id=154870

        broke win ews (Requested by alexchristensen on #webkit).

        Reverted changeset:

        "[cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK."
        https://bugs.webkit.org/show_bug.cgi?id=154651
        http://trac.webkit.org/changeset/197056

2016-03-01  Brady Eidson  <beidson@apple.com>

        Modern IDB: Possible crash deallocating IDBDatabaseInfo/IDBObjectStoreInfo/IDBIndexInfo.
        https://bugs.webkit.org/show_bug.cgi?id=154860

        Reviewed by Alex Christensen.

        Covered by existing tests.

        * Modules/indexeddb/shared/IDBDatabaseInfo.cpp:
        (WebCore::IDBDatabaseInfo::IDBDatabaseInfo):
        (WebCore::IDBDatabaseInfo::isolatedCopy):
        * Modules/indexeddb/shared/IDBDatabaseInfo.h:

        * Modules/indexeddb/shared/IDBTransactionInfo.cpp:
        (WebCore::IDBTransactionInfo::isolatedCopy): If there's an IDBDatabaseInfo to copy,  that
          copy needs to be isolated.

2016-03-01  Tim Horton  <timothy_horton@apple.com>

        Expose MediaElement and VideoElement to the Objective-C DOM bindings
        https://bugs.webkit.org/show_bug.cgi?id=154830

        Reviewed by Sam Weinig.

        * Modules/mediasession/HTMLMediaElementMediaSession.idl:
        * Modules/mediastream/HTMLMediaElementMediaStream.idl:
        * html/HTMLMediaElement.idl:
        * html/HTMLVideoElement.idl:
        Avoid Objective-C bindings for various extraneous bits, like MediaSource and MediaSession,
        to avoid exposing way more than we need to.

        * WebCore.xcodeproj/project.pbxproj:
        Add a bunch of Derived Sources.

2016-03-01  Antti Koivisto  <antti@apple.com>

        Text control shadow element style shouldn't depend on renderers
        https://bugs.webkit.org/show_bug.cgi?id=154855

        Reviewed by Andreas Kling.

        Currently the code for computing style for text control shadow elements lives in render tree.
        Style is the input for building a render tree and should be computable without having one.

        Fix by moving virtual createInnerTextStyle() from RenderTextControl hierarchy to the DOM side
        HTMLTextFormControlElement hierarchy.

        * dom/Element.cpp:
        (WebCore::Element::didDetachRenderers):
        (WebCore::Element::customStyleForRenderer):

            Also pass shadow host style as it is needed for text controls.

        * dom/Element.h:
        * dom/PseudoElement.cpp:
        (WebCore::PseudoElement::clearHostElement):
        (WebCore::PseudoElement::customStyleForRenderer):
        * dom/PseudoElement.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setRangeText):
        (WebCore::HTMLInputElement::createInnerTextStyle):
        (WebCore::HTMLInputElement::setupDateTimeChooserParameters):
        * html/HTMLInputElement.h:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::willRespondToMouseClickEvents):
        (WebCore::HTMLTextAreaElement::createInnerTextStyle):
        * html/HTMLTextAreaElement.h:
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::directionForFormData):
        (WebCore::HTMLTextFormControlElement::adjustInnerTextStyle):
        * html/HTMLTextFormControlElement.h:
        (WebCore::HTMLTextFormControlElement::cachedSelectionDirection):
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::TextControlInnerElement::create):
        (WebCore::TextControlInnerElement::customStyleForRenderer):
        (WebCore::TextControlInnerTextElement::renderer):
        (WebCore::TextControlInnerTextElement::customStyleForRenderer):
        * html/shadow/TextControlInnerElements.h:
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::styleDidChange):
        (WebCore::RenderTextControl::textBlockLogicalHeight):
        (WebCore::RenderTextControl::adjustInnerTextStyle): Deleted.
        * rendering/RenderTextControl.h:
        * rendering/RenderTextControlMultiLine.cpp:
        (WebCore::RenderTextControlMultiLine::baselinePosition):
        (WebCore::RenderTextControlMultiLine::layoutSpecialExcludedChild):
        (WebCore::RenderTextControlMultiLine::createInnerTextStyle): Deleted.

            createInnerTextStyle moves to HTMLTextAreaElement::createInnerTextStyle

        * rendering/RenderTextControlMultiLine.h:
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):

            Remove m_desiredInnerTextLogicalHeight cache. It doesn't work, it is never valid when hit.

        (WebCore::RenderTextControlSingleLine::layout):
        (WebCore::RenderTextControlSingleLine::styleDidChange):
        (WebCore::RenderTextControlSingleLine::computeControlLogicalHeight):
        (WebCore::RenderTextControlSingleLine::textShouldBeTruncated):
        (WebCore::RenderTextControlSingleLine::createInnerTextStyle): Deleted.
        (WebCore::RenderTextControlSingleLine::createInnerBlockStyle): Deleted.

            - createInnerTextStyle moves to HTMLInputElement::createInnerTextStyle
            - createInnerBlockStyle moves to TextControlInnerElement::customStyleForRenderer

        * rendering/RenderTextControlSingleLine.h:
        (WebCore::RenderTextControlSingleLine::centerContainerIfNeeded):
        (WebCore::RenderTextControlSingleLine::containerElement):
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::styleForElement):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::synchronizeSystemLanguage):
        (WebCore::SVGElement::customStyleForRenderer):
        * svg/SVGElement.h:

2016-03-01  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Get rid of GridResolvedPosition
        https://bugs.webkit.org/show_bug.cgi?id=154818

        Reviewed by Darin Adler.

        GridResolvedPosition was a small class just wrapping a unsigned.
        In the future it should actually wrap an integer,
        as we want to support implicit tracks before the explicit grid.

        The class itself is not providing any benefit,
        so we can get rid of it and store directly 2 unsigned in GridSpan.

        This will make simpler future changes related to this task.

        We keep the class just as a utility for the methods
        that deal with the positions resolution.
        But it should be renamed in a follow-up patch.

        No new tests, no change of behavior.

        * css/CSSGridTemplateAreasValue.cpp:
        (WebCore::stringForPosition):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateAreasRow):
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::createImplicitNamedGridLinesFromGridArea):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
        (WebCore::RenderGrid::findFlexFactorUnitSize):
        (WebCore::RenderGrid::spanningItemCrossesFlexibleSizedTracks):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForItems):
        (WebCore::RenderGrid::insertItemIntoGrid):
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        (WebCore::RenderGrid::gridAreaBreadthForChild):
        (WebCore::RenderGrid::gridAreaBreadthForChildIncludingAlignmentOffsets):
        (WebCore::RenderGrid::columnAxisOffsetForChild):
        (WebCore::RenderGrid::rowAxisOffsetForChild):
        * rendering/style/GridCoordinate.h:
        (WebCore::GridSpan::definiteGridSpan):
        (WebCore::GridSpan::integerSpan):
        (WebCore::GridSpan::resolvedInitialPosition):
        (WebCore::GridSpan::resolvedFinalPosition):
        (WebCore::GridSpan::GridSpanIterator::GridSpanIterator):
        (WebCore::GridSpan::GridSpanIterator::operator*):
        (WebCore::GridSpan::GridSpanIterator::operator++):
        (WebCore::GridSpan::GridSpanIterator::operator!=):
        (WebCore::GridSpan::begin):
        (WebCore::GridSpan::end):
        (WebCore::GridSpan::GridSpan):
        * rendering/style/GridResolvedPosition.cpp:
        (WebCore::resolveNamedGridLinePositionFromStyle):
        (WebCore::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveGridPositionAgainstOppositePosition):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
        (WebCore::resolveGridPositionFromStyle):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromStyle):
        * rendering/style/GridResolvedPosition.h:
        (WebCore::GridResolvedPosition::GridResolvedPosition): Deleted.
        (WebCore::GridResolvedPosition::operator*): Deleted.
        (WebCore::GridResolvedPosition::operator++): Deleted.
        (WebCore::GridResolvedPosition::operator==): Deleted.
        (WebCore::GridResolvedPosition::operator!=): Deleted.
        (WebCore::GridResolvedPosition::operator<): Deleted.
        (WebCore::GridResolvedPosition::operator>): Deleted.
        (WebCore::GridResolvedPosition::operator<=): Deleted.
        (WebCore::GridResolvedPosition::operator>=): Deleted.
        (WebCore::GridResolvedPosition::toInt): Deleted.
        (WebCore::GridResolvedPosition::next): Deleted.
        (WebCore::GridResolvedPosition::prev): Deleted.

2016-03-01  Andreas Kling  <akling@apple.com>

        MemoryCache::forEachResource() should guard resources across function invocation.
        <https://webkit.org/b/154846>

        Reviewed by Antti Koivisto.

        It occurred to me that we should protect the CachedResources from being
        deleted while invoking the custom function here, lest we create a giant footgun.

        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::forEachResource):

2016-03-01  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] One more unreviewed speculative buildfix after r197375. Just for fun.

        * PlatformMac.cmake:

2016-03-01  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] Unreviewed speculative buildfix after r197375. Just for fun.

        * PlatformMac.cmake:

2016-03-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Support Request and Response blob() when body data is a blob
        https://bugs.webkit.org/show_bug.cgi?id=154820

        Reviewed by Darin Adler.

        Adding support for returning the same Blob that is stored in Body in case JS blob() is called.
        Adding support for Blob creation when data is stored as text.
        Updated JSDOMBinding and JSDOMPromise to return a JS ArrayBuffer for Vector<char> as well as Vector<unsigned char>.

        Covered by added tests.

        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::arrayBuffer):
        (WebCore::FetchBody::blob):
        (WebCore::FetchBody::extractFromText):
        * Modules/fetch/FetchBody.h:
        * bindings/js/JSDOMBinding.h:
        (WebCore::toJS):
        * bindings/js/JSDOMPromise.h:
        (WebCore::DeferredWrapper::resolve): Deleted.

2016-02-29  Chris Dumez  <cdumez@apple.com>

        Have parseHTMLInteger() / parseHTMLNonNegativeInteger() use WTF::Optional
        https://bugs.webkit.org/show_bug.cgi?id=154845

        Reviewed by Ryosuke Niwa.

        Have parseHTMLInteger() / parseHTMLNonNegativeInteger() use
        WTF::Optional.

        * dom/Element.cpp:
        (WebCore::Element::getIntegralAttribute):
        (WebCore::Element::getUnsignedIntegralAttribute):
        (WebCore::Element::setUnsignedIntegralAttribute): Deleted.
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::parseBorderWidthAttribute):
        (WebCore::HTMLElement::parseAttribute):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::parseMaxLengthAttribute):
        * html/HTMLInputElement.h:
        * html/HTMLOListElement.cpp:
        (WebCore::HTMLOListElement::parseAttribute):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::maxLength):
        * html/ImageInputType.cpp:
        (WebCore::ImageInputType::height):
        (WebCore::ImageInputType::width):
        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::parseHTMLIntegerInternal):
        (WebCore::parseHTMLInteger):
        (WebCore::parseHTMLNonNegativeInteger):
        * html/parser/HTMLParserIdioms.h:
        (WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
        (WebCore::limitToOnlyHTMLNonNegative):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::parseAttribute):

2016-02-29  Zan Dobersek  <zdobersek@igalia.com>

        TextureMapperGL: simplify TransformationMatrix copies in draw(), beginClip()
        https://bugs.webkit.org/show_bug.cgi?id=154791

        Reviewed by Carlos Garcia Campos.

        In both functions, the passed-in model-view matrix is first copied, multiplied
        against a rect-to-rect TransformationMatrix, and then assigned into a local
        TransformationMatrix variable, which causes another copy due to the multiply()
        function returning a reference to the modified object.

        To avoid the last copy, first copy the model-view matrix into a local variable,
        and multiply the rect-to-rect TransformationMatrix into the new object afterwards.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::draw):
        (WebCore::TextureMapperGL::beginClip):

2016-02-29  Zan Dobersek  <zdobersek@igalia.com>

        ImageBufferCairo should support OpenGL ES 2 configurations
        https://bugs.webkit.org/show_bug.cgi?id=154790

        Reviewed by Carlos Garcia Campos.

        When building with OpenGL ES 2 and with accelerated 2D canvas support,
        the GLES2 header should be included instead of the OpenGLShims.h header.

        The glTexParameterf() calls targeting GL_TEXTURE_WRAP_S and
        GL_TEXTURE_WRAP_T parameters should use the GL_CLAMP_TO_EDGE value.
        GL_CLAMP isn't available in OpenGL ES 2 and was dropped in OpenGL 3.

        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBufferData::createCairoGLSurface):

2016-02-29  Zan Dobersek  <zdobersek@igalia.com>

        TextureMapperGL: beginPainting() should handle the PaintingMirrored value in PaintFlags
        https://bugs.webkit.org/show_bug.cgi?id=154789

        Reviewed by Carlos Garcia Campos.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::beginPainting): The ClipStack should be reset with
        a Y-axis mode that corresponds to the presence of the PaintingMirrored value in
        the passed-in PaintFlags argument. If present, the default Y-axis mode should be
        used, and the inverted Y-axis otherwise.

2016-02-29  Zan Dobersek  <zdobersek@igalia.com>

        CoordinatedGraphicsLayer should override the inherited TextureMapperPlatformLayer::Client methods
        https://bugs.webkit.org/show_bug.cgi?id=154788

        Reviewed by Carlos Garcia Campos.

        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:
        Add the override specifiers for the two methods that are inherited
        from the TextureMapperPlatformLayer::Client interface.

2016-02-29  Simon Fraser  <simon.fraser@apple.com>

        Remove the experimental feature of antialiased font dilation
        https://bugs.webkit.org/show_bug.cgi?id=154843

        Reviewed by Zalan Bujtas.
        
        Remove the "antialiased font dilation" code path, and related prefs.

        * page/Settings.cpp:
        (WebCore::Settings::Settings): Deleted.
        (WebCore::Settings::setAntialiasedFontDilationEnabled): Deleted.
        * page/Settings.h:
        (WebCore::Settings::antialiasedFontDilationEnabled): Deleted.
        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::setAntialiasedFontDilationEnabled): Deleted.
        (WebCore::FontCascade::antialiasedFontDilationEnabled): Deleted.
        * platform/graphics/FontCascade.h:
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContextStateChange::changesFromState): Deleted.
        (WebCore::GraphicsContextStateChange::accumulate): Deleted.
        (WebCore::GraphicsContextStateChange::apply): Deleted.
        (WebCore::GraphicsContextStateChange::dump): Deleted.
        (WebCore::GraphicsContext::setAntialiasedFontDilationEnabled): Deleted.
        * platform/graphics/GraphicsContext.h:
        (WebCore::GraphicsContextState::GraphicsContextState): Deleted.
        (WebCore::GraphicsContext::antialiasedFontDilationEnabled): Deleted.
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (PlatformCALayer::drawLayerContents): Deleted.
        * platform/graphics/cocoa/FontCascadeCocoa.mm:
        (WebCore::dilationSizeForTextColor): Deleted.
        (WebCore::FontCascade::drawGlyphs): Deleted.
        * platform/graphics/displaylists/DisplayList.cpp:
        (WebCore::DisplayList::DisplayList::shouldDumpForFlags): Deleted.

2016-02-29  Jer Noble  <jer.noble@apple.com>

        Refactor CoreVideo API access into their own classes so code can be re-used.
        https://bugs.webkit.org/show_bug.cgi?id=154544

        Reviewed by Eric Carlson.

        In order for common CoreVideo code paths to be re-used in other classes, pull those paths
        out of MediaPlayerPrivateAVFoundationObjC and into re-usable clasess.

        * WebCore.xcodeproj/project.pbxproj:
        * platform/cf/CoreMediaSoftLink.cpp:
        * platform/cf/CoreMediaSoftLink.h:
        * platform/cocoa/CoreVideoSoftLink.cpp: Added.
        * platform/cocoa/CoreVideoSoftLink.h: Added.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createPixelBuffer):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateLastImage):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::copyVideoTextureToPlatformTexture):
        (WebCore::CVPixelBufferGetBytePointerCallback): Deleted.
        (WebCore::CVPixelBufferReleaseBytePointerCallback): Deleted.
        (WebCore::CVPixelBufferReleaseInfoCallback): Deleted.
        (WebCore::createImageFromPixelBuffer): Deleted.
        (WebCore::enumToStringMap): Deleted.
        * platform/graphics/cv/PixelBufferConformerCV.cpp: Added.
        (WebCore::PixelBufferConformerCV::PixelBufferConformerCV):
        (WebCore::CVPixelBufferGetBytePointerCallback):
        (WebCore::CVPixelBufferReleaseBytePointerCallback):
        (WebCore::CVPixelBufferReleaseInfoCallback):
        (WebCore::PixelBufferConformerCV::createImageFromPixelBuffer):
        * platform/graphics/cv/PixelBufferConformerCV.h: Added.
        * platform/graphics/cv/TextureCacheCV.h: Added.
        (WebCore::TextureCacheCV::context):
        * platform/graphics/cv/TextureCacheCV.mm: Added.
        (WebCore::TextureCacheCV::create):
        (WebCore::TextureCacheCV::TextureCacheCV):
        (WebCore::TextureCacheCV::textureFromImage):
        * platform/graphics/cv/VideoTextureCopierCV.cpp: Added.
        (WebCore::VideoTextureCopierCV::VideoTextureCopierCV):
        (WebCore::VideoTextureCopierCV::~VideoTextureCopierCV):
        (WebCore::enumToStringMap):
        (WebCore::VideoTextureCopierCV::copyVideoTextureToPlatformTexture):
        * platform/graphics/cv/VideoTextureCopierCV.h: Added.
        (WebCore::VideoTextureCopierCV::context):
        * platform/mediastream/mac/AVVideoCaptureSource.mm: Move SOFT_LINK declarations into CoreVideoSoftLink.h/cpp.

2016-02-29  Chris Dumez  <cdumez@apple.com>

        Use WTF::Optional for HTMLOListElement::m_start
        https://bugs.webkit.org/show_bug.cgi?id=154824

        Reviewed by Andreas Kling.

        Use WTF::Optional for HTMLOListElement::m_start.

        * html/HTMLOListElement.cpp:
        (WebCore::HTMLOListElement::parseAttribute):
        * html/HTMLOListElement.h:

2016-02-29  Gavin Barraclough  <barraclough@apple.com>

        RefCounter<T>::Event -> RefCounterEvent
        https://bugs.webkit.org/show_bug.cgi?id=154767

        Reviewed by Darin Adler.

        RefCounter<T>::Event is kinda verbose to use, and there is no need for this
        to be specific to a particular typeof RefCounter. Move the enum class up to
        the top level & rename to RefCounterEvent.

        * page/PageThrottler.cpp:
        (WebCore::PageThrottler::PageThrottler):
        (WebCore::m_audiblePluginHysteresis):
        (WebCore::m_mediaActivityCounter):
        (WebCore::m_pageLoadActivityCounter):
        * platform/VNodeTracker.cpp:
        (WebCore::VNodeTracker::singleton):
        (WebCore::VNodeTracker::VNodeTracker):
        (WebCore::m_lastWarningTime):

2016-02-29  Chris Dumez  <cdumez@apple.com>

        Use HTML parsing rules for textarea.maxLength
        https://bugs.webkit.org/show_bug.cgi?id=154805

        Reviewed by Andreas Kling.

        Use HTML parsing rules for textarea.maxLength:
        - https://html.spec.whatwg.org/multipage/forms.html#dom-textarea-maxlength
        - https://html.spec.whatwg.org/multipage/infrastructure.html#limited-to-only-non-negative-numbers

        No new tests, already covered by existing test.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::maxLength):

2016-02-29  Chris Dumez  <cdumez@apple.com>

        Align td.rowSpan / td.colSpan with the specification
        https://bugs.webkit.org/show_bug.cgi?id=154803

        Reviewed by Darin Adler.

        Align td.rowSpan / td.colSpan with the specification:
        - https://html.spec.whatwg.org/multipage/tables.html#htmltablecellelement
        - https://html.spec.whatwg.org/multipage/tables.html#dom-tdth-colspan
        - https://html.spec.whatwg.org/multipage/tables.html#dom-tdth-rowspan

        In particular, the following changes were made:
        - Change type from 'long' to 'unsigned long'.
        - Use HTML rules for parsing unsigned integers:
          - https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-non-negative-integers
        - Use 1 as default value when the input value is out of range instead
          of 0 when setting.
        - rowspan is still clamped to [1, 8190] internally but we now expose the
          unclamped value to JS as this is an internal restriction. The same is
          done for a colSpan value of 0, we expose 0 to the Web but clamp to 1
          internally.

        No new tests, already covered by existing test.

        * html/HTMLTableCellElement.cpp:
        (WebCore::HTMLTableCellElement::colSpan):
        (WebCore::HTMLTableCellElement::rowSpan):
        (WebCore::HTMLTableCellElement::rowSpanForBindings):
        (WebCore::HTMLTableCellElement::setColSpan):
        (WebCore::HTMLTableCellElement::setRowSpanForBindings):
        (WebCore::HTMLTableCellElement::axis): Deleted.
        (WebCore::HTMLTableCellElement::headers): Deleted.
        * html/HTMLTableCellElement.h:
        * html/HTMLTableCellElement.idl:

2016-02-29  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Add support for [TreatNullAs=EmptyString] and use it
        https://bugs.webkit.org/show_bug.cgi?id=154654

        Reviewed by Darin Adler.

        Add support for [TreatNullAs=EmptyString] standard Web IDL extended
        attribute:
        - http://heycam.github.io/webidl/#TreatNullAs

        This replaces the WebKit-specific [TreatNullAs=NullString] IDL
        extended attribute. Instead of passing a null String() to the
        implementation, emptyString() is passed.

        This patch does not cause any web-exposed behavior change. For
        case where switching from NullString to EmptyString would change
        the behavior (or require changes to the implementation), the old
        IDL attribute was kept. However, it was renamed to
        [TreatNullAs=LegacyNullString] to discourage its use in new code.
        Eventually, this legacy IDL attribute should go away entirely.

        [TreatNullAs=EmptyString] should only be used when it is present
        in the corresponding specification. Note that there are a lot of
        places where we use [TreatNullAs=EmptyString] in our IDL where it
        does not match the specification. I have added FIXME comments for
        those so we can clean them up later.

        No new tests, no web-exposed behavior change.

        * Modules/mediastream/RTCPeerConnection.idl:
        No behavior change because this is not implemented.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::valueToStringTreatingNullAsEmptyString):
        * bindings/js/JSDOMBinding.h:
        Add new function to convert a JSValue into a String while treating
        null as the empty string.

        * bindings/scripts/CodeGeneratorJS.pm:
        (JSValueToNative):
        * bindings/scripts/IDLAttributes.txt:
        - Add support for [TreatNullAs=EmptyString].
        - Rename NullString to LegacyNullString to discourage its use.

        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        * bindings/scripts/test/TestObj.idl:
        Add bindings tests coverage for [TreatNullAs=EmptyString].

        * css/CSSStyleDeclaration.idl:
        * dom/CharacterData.idl:
        * dom/DOMImplementation.idl:
        * dom/Document.idl:
        * dom/Element.idl:
        * dom/ShadowRoot.idl:
        * html/HTMLOutputElement.idl:
        * html/HTMLScriptElement.idl:
        * html/URLUtils.idl:
        * svg/SVGAngle.idl:
        * svg/SVGLength.idl:
        Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString].
        There is not behavior change because the implementation does
        not distinguish the null string from the empty string.

        * html/HTMLBaseElement.idl:
        * html/HTMLButtonElement.idl:
        * html/HTMLFormElement.idl:
        * html/HTMLMediaElement.idl:
        * html/HTMLSelectElement.idl:
        * svg/SVGElement.idl:
        * svg/SVGScriptElement.idl:
        Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString],
        no behavior change.

        * html/HTMLDocument.idl:
        - dir and *Color: Rename [TreatNullAs=NullString] to
          [TreatNullAs=LegacyNullString].
        - designMode: Drop [TreatNullAs=NullString] as per the specification:
          - https://html.spec.whatwg.org/multipage/dom.html#the-document-object
          null now gets converted to "null" instead of the null String but this
          does not change behavior because the implementation only recognizes
          "on" / "off" / others. So we still end up using inherit mode when
          set to null.

        * html/HTMLElement.idl:
        - Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString] for
          innerText / outerText. Does not change behavior because the
          implementation does not distinguishes.
        - Drop [TreatNullAs=NullString] from contentEditable to match the spec:
          - https://html.spec.whatwg.org/multipage/interaction.html#elementcontenteditable
          This does not change behavior because the implementation will the a SyntaxError
          wether a null String or the string "null" is passed.

        * html/HTMLFrameElement.idl:
        Drop [TreatNullAs=NullString] from location attribute. This does not
        change behavior because the attribute is using a custom setter.

        * html/HTMLInputElement.idl:
        - formEnctype / formMethod / autocapitalize: Rename [TreatNullAs=NullString] to
          [TreatNullAs=LegacyNullString].
        - value: Rename [TreatNullAs=NullString] to Rename [TreatNullAs=EmptyString], which
          does not change behavior because the implementation does not distinguish. Also
          drop the extended attribute for non-JS bindings as it has no impact.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setMediaGroup):
        Drop redundant group.isNull() check as group.isEmpty() already checks for null.

        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::setText):
        Drop useless .impl() call as we have a String and the method requires a String
        as input.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::setValueCommon):
        Use emptyString() instead of "" as it is slightly more efficient.

        * html/HTMLTextAreaElement.idl:
        - value: Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString]. No
          behavior change because the implementation does not distinguish.
        - autocapitalize: Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString].

        * html/canvas/CanvasRenderingContext2D.idl:
        - globalCompositeOperation / repetitionType: Use [TreatNullAs=EmptyString] instead of
          [TreatNullAs=NullString]. No behavior change because the implementation does not
          distinguish.
        - lineCap / lineJoin: Drop the [TreatNullAs=NullString] to match the spec:
          - https://html.spec.whatwg.org/multipage/scripting.html#canvaspathdrawingstyles
          There is no behavior change because those are string enumerations and the value
          is not recognized either way (String() or String("null")).
        - shadowColor: Drop the [TreatNullAs=NullString] to match the spec:
          - https://html.spec.whatwg.org/multipage/scripting.html#canvasshadowstyles
          No behavior change because this is not a valid color either way.

2016-02-29  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Refactor FetchBody constructors
        https://bugs.webkit.org/show_bug.cgi?id=154721

        Reviewed by Sam Weinig and Darin Adler.

        Covered by existing tests.

        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::extract): Renamed from "fromJSValue"
        (WebCore::FetchBody::extractFromBody): Renamed from "fromRequestBody" and making use of move constructor.
        * Modules/fetch/FetchBody.h:
        (WebCore::FetchBody::FetchBody): Making default constructor public and removing empty static method.
        * Modules/fetch/FetchRequest.cpp:
        (WebCore::buildBody):
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::error):
        (WebCore::FetchResponse::redirect):
        (WebCore::FetchResponse::initializeWith):
        * Modules/fetch/FetchResponse.h:
        (WebCore::FetchResponse::create):

2016-02-28  Antti Koivisto  <antti@apple.com>

        ::slotted doesn't work in nested shadow trees
        https://bugs.webkit.org/show_bug.cgi?id=154765
        <rdar://problem/24870995>

        Reviewed by Ryosuke Niwa.

        See https://github.com/w3c/webcomponents/issues/331#issuecomment-189191593

        Test: fast/shadow-dom/css-scoping-shadow-slotted-nested.html

        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::matchSlottedPseudoElementRules):

        Collect ::slotted rules from all the nested shadow trees instead of just the host's.

2016-02-28  Chris Dumez  <cdumez@apple.com>

        Parse HTMLOLElement.start as per the HTML spec
        https://bugs.webkit.org/show_bug.cgi?id=154802

        Reviewed by Andreas Kling.

        Parse HTMLOLElement.start as per the HTML spec:
        - https://html.spec.whatwg.org/multipage/semantics.html#dom-ol-start
        - https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-integers

        No new tests, already covered by existing test.

        * html/HTMLOListElement.cpp:
        (WebCore::HTMLOListElement::parseAttribute):

2016-02-28  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Reduce uses of PassRefPtr in indexeddb
        https://bugs.webkit.org/show_bug.cgi?id=154273

        Reviewed by Darin Adler.

        No new tests, no behavior changes.

        * Modules/indexeddb/IDBDatabaseError.h:
        (WebCore::IDBDatabaseError::create):
        * Modules/indexeddb/IDBKeyData.cpp:
        (WebCore::IDBKeyData::maybeCreateIDBKey):
        * Modules/indexeddb/IDBKeyData.h:
        * Modules/indexeddb/IDBKeyRange.cpp:
        (WebCore::IDBKeyRange::create):
        (WebCore::IDBKeyRange::IDBKeyRange):
        (WebCore::IDBKeyRange::only):
        (WebCore::IDBKeyRange::lowerBound):
        (WebCore::IDBKeyRange::upperBound):
        (WebCore::IDBKeyRange::bound):
        * Modules/indexeddb/IDBKeyRange.h:
        (WebCore::IDBKeyRange::create):
        (WebCore::IDBKeyRange::lower):
        (WebCore::IDBKeyRange::upper):
        (WebCore::IDBKeyRange::lowerBound):
        (WebCore::IDBKeyRange::upperBound):
        (WebCore::IDBKeyRange::bound):
        * Modules/indexeddb/IDBKeyRangeData.cpp:
        (WebCore::IDBKeyRangeData::maybeCreateIDBKeyRange):
        * Modules/indexeddb/IDBKeyRangeData.h:
        * Modules/indexeddb/IDBServerConnection.h:
        * Modules/indexeddb/legacy/IDBCallbacks.h:
        * Modules/indexeddb/legacy/IDBCursorBackend.cpp:
        (WebCore::IDBCursorBackend::continueFunction):
        * Modules/indexeddb/legacy/IDBCursorBackend.h:
        * Modules/indexeddb/legacy/IDBCursorBackendOperations.h:
        (WebCore::CursorIterationOperation::create):
        (WebCore::CursorIterationOperation::CursorIterationOperation):
        * Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp:
        (WebCore::GetOperation::perform):
        (WebCore::PutOperation::perform):
        * Modules/indexeddb/legacy/LegacyCursor.cpp:
        (WebCore::LegacyCursor::continueFunction):
        * Modules/indexeddb/legacy/LegacyCursor.h:
        * Modules/indexeddb/legacy/LegacyFactory.h:
        (WebCore::LegacyFactory::create):
        * Modules/indexeddb/legacy/LegacyRequest.cpp:
        (WebCore::LegacyRequest::onSuccess):
        * Modules/indexeddb/legacy/LegacyRequest.h:
        * inspector/InspectorIndexedDBAgent.cpp:

2016-02-28  Tim Horton  <timothy_horton@apple.com>

        Switch to application/vnd.apple.folder for <attachment> folder special-case
        https://bugs.webkit.org/show_bug.cgi?id=154786
        <rdar://problem/24416632>

        Reviewed by Anders Carlsson.

        No new tests, adjusted an existing test to cover this.

        * rendering/RenderThemeMac.mm:
        (WebCore::iconForAttachment):
        Add a second folder MIME type.

2016-02-28  Tim Horton  <timothy_horton@apple.com>

        Variables can resolve to the wrong value when elements differ in nothing but inherited variable value
        https://bugs.webkit.org/show_bug.cgi?id=154785

        Reviewed by Antti Koivisto.

        Test: fast/css/variables/avoid-matched-property-cache.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::MatchResult::addMatchedProperties):
        Disable the matched property cache when a value is variable-dependent, because
        they can resolve to inherited values, and the matched property cache could
        end up copying the wrong value from another similarly-styled element.

2016-02-28  Konstantin Tokarev  <annulen@yandex.ru>

        SVGToOTFFontConversion.cpp does not compile with libstdc++ 4.8
        https://bugs.webkit.org/show_bug.cgi?id=154794

        Reviewed by Michael Catanzaro.

        No new tests needed.

        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::appendLigatureSubtable): Added const
        qualifiers.

2016-02-27  Chris Dumez  <cdumez@apple.com>

        Prevent cross-origin access to Location.assign() / Location.reload()
        https://bugs.webkit.org/show_bug.cgi?id=154779

        Reviewed by Darin Adler.

        Prevent cross-origin access to Location.assign() / Location.reload()
        to match the latest specification:
        - https://html.spec.whatwg.org/multipage/browsers.html#crossoriginproperties-(-o-)

        Firefox and Chrome already prevent this but WebKit allowed it.

        No new tests, already covered by existing tests.

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::getOwnPropertySlotDelegate):
        (WebCore::JSLocation::putDelegate): Deleted.

2016-02-27  Andy VanWagoner  <thetalecrafter@gmail.com>

        Intl.Collator uses POSIX locale (detected by js/intl-collator.html on iOS Simulator)
        https://bugs.webkit.org/show_bug.cgi?id=152448

        Reviewed by Darin Adler.

        Pass defaultLanguage from Language.h to the globalObjectMethodTable to
        ensure Intl objects can be initialized with the correct default locale.

        * bindings/js/JSDOMWindowBase.cpp:
        * bindings/js/JSWorkerGlobalScopeBase.cpp:

2016-02-27  Chris Dumez  <cdumez@apple.com>

        Align HTMLMarqueeElement.scrollAmount / scrollDelay with the specification
        https://bugs.webkit.org/show_bug.cgi?id=154781

        Reviewed by Darin Adler.

        Align HTMLMarqueeElement.scrollAmount / scrollDelay with the
        specification:
        - https://www.w3.org/TR/html5/obsolete.html#the-marquee-element-0

        In particular:
        - The attributes should have unsigned long type
        - We should not throw for negative values
        - Values should be in the range [0, 2147483647] as per:
        - https://html.spec.whatwg.org/multipage/infrastructure.html#reflect

        No new tests, already covered by existing tests.

        * html/HTMLMarqueeElement.cpp:
        (WebCore::HTMLMarqueeElement::scrollAmount):
        (WebCore::HTMLMarqueeElement::setScrollAmount):
        (WebCore::HTMLMarqueeElement::scrollDelay):
        (WebCore::HTMLMarqueeElement::setScrollDelay):
        (WebCore::HTMLMarqueeElement::loop): Deleted.
        * html/HTMLMarqueeElement.h:
        * html/HTMLMarqueeElement.idl:

2016-02-27  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197204, r197207, r197211, r197217,
        r197218, and r197219.
        https://bugs.webkit.org/show_bug.cgi?id=154780

        Caused crashes in WebVideoFullscreenManagerProxy (Requested by
        ap on #webkit).

        Reverted changesets:

        "Add support for playbackControlsManager"
        https://bugs.webkit.org/show_bug.cgi?id=154742
        http://trac.webkit.org/changeset/197204

        "Attempted build fix."
        http://trac.webkit.org/changeset/197207

        "Attempted build fix."
        http://trac.webkit.org/changeset/197211

        "Attempted 32-bit build fix."
        http://trac.webkit.org/changeset/197217

        "Another 32-bit build fix."
        http://trac.webkit.org/changeset/197218

        "32-bit!!!"
        http://trac.webkit.org/changeset/197219

2016-02-27  Chris Dumez  <cdumez@apple.com>

        Optimize parseHTMLInteger()
        https://bugs.webkit.org/show_bug.cgi?id=154772

        Reviewed by Ryosuke Niwa.

        Optimize parseHTMLInteger() a bit now that it is used a lot more and
        that it has decent API test coverage. In particular, we now:
        - Avoid using a StringBuilder for the digits.
        - Get rid of a is8Bit() branch.
        - Only traverse the input string once.

        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::parseHTMLIntegerInternal):
        (WebCore::parseHTMLInteger):
        (WebCore::parseHTMLNonNegativeInteger): Deleted.

2016-02-27  Andreas Kling  <akling@apple.com>

        [iOS] Discard decoded image data on top-level navigation.
        <https://webkit.org/b/154776>

        Reviewed by Anders Carlsson.

        Add a mechanism that destroys decoded data for all CachedImages and invoke it
        when performing a top-level navigation on iOS.

        This substantially reduces the ImageIO contribution to our peak memory footprint.

        It would be even better if we could mark these images volatile during the transition
        but we currently don't have framework support for such machinations.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::forEachResource):
        (WebCore::MemoryCache::destroyDecodedDataForAllImages):
        * loader/cache/MemoryCache.h:

2016-02-26  Carlos Garcia Campos  <cgarcia@igalia.com>

        Network cache: old pages returned by disk cache on history navigation after session is restored
        https://bugs.webkit.org/show_bug.cgi?id=153230

        Reviewed by Chris Dumez.

        Add a flag to HistoryItem to mark them as restored from session
        and use it from the FrameLoader to not change the policy request
        when navigating to a history item that was restored from session,
        except for iOS port.

        * history/HistoryItem.h:
        (WebCore::HistoryItem::setWasRestoredFromSession):
        (WebCore::HistoryItem::wasRestoredFromSession):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadDifferentDocumentItem):

2016-02-26  Michael Catanzaro  <mcatanzaro@igalia.com>

        Remove unused private field from WEBPImageDecoder

        Unreviewed.

        * platform/image-decoders/webp/WEBPImageDecoder.cpp:
        (WebCore::WEBPImageDecoder::WEBPImageDecoder):
        * platform/image-decoders/webp/WEBPImageDecoder.h:

2016-02-26  Chris Dumez  <cdumez@apple.com>

        Fix the behavior of reflecting IDL attributes of type unsigned long
        https://bugs.webkit.org/show_bug.cgi?id=154771

        Reviewed by Ryosuke Niwa.

        Fix the behavior of reflecting IDL attributes of type unsigned long to
        align with the specification:
        - https://html.spec.whatwg.org/multipage/infrastructure.html#reflecting-content-attributes-in-idl-attributes
        - https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-non-negative-integers

        Firefox and Chrome already follow the specification.

        There were several issues with our implementation, which are all
        addressed in this patch:
        - Upon getting, the value returned must be in the range 0 to 2147483647.
          Otherwise, we must return the default value (0 unless specified
          otherwise). We previously returned values in the range 0 to 4294967295
          instead.
        - Upon setting, we must set the content attribute to the default value
          (0 unless specified otherwise) if the input value is not in the range
          0 to 2147483647. We previously allowed values in the range 0 to
          4294967295 instead.
        - "-0" was not recognized as a valid unsigned integer

        Test: fast/dom/reflect-unsigned-long.html

        * dom/Element.cpp:
        (WebCore::Element::setUnsignedIntegralAttribute):
        Update setUnsignedIntegralAttribute() to limit the input value in the
        0 to 2147483647 range, as per the HTML specification. This method is
        called by the bindings implementation of reflecting attributes setters.

        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::parseHTMLNonNegativeInteger):
        Update parseHTMLNonNegativeInteger() to call parseHTMLInteger() instead
        of duplicating most of its code and fail if the value returned is
        negative. This matches the algorithm in the specification:
        - https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-non-negative-integers

        This has 2 behavior changes:
        1. "-0" is now correctly parsed as 0.
        2. The returned values are in the range 0 to 2147483647.

        * html/parser/HTMLParserIdioms.h:
        (WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
        (WebCore::limitToOnlyHTMLNonNegative):
        Drop the checks for "<= 2147483647" and replace with an assertion
        now that parseHTMLNonNegativeInteger() already returned values in
        the right range.

2016-02-26  Zalan Bujtas  <zalan@apple.com>

        REGRESSION (188611): Search field Cancel button should not overlap search text on extensions page.
        https://bugs.webkit.org/show_bug.cgi?id=154692
        <rdar://problem/22840453>

        Reviewed by Brent Fulgham.

        Adjust the cancel button position using the actual size of the cancel button.

        When the input box and the font height trigger different cancel button sizes, we need to readjust
        the rectangle returned by cancelButtonRectForBounds.
        This fixes both the mispositioned cancel button and the squared off icon when the input field is zoomed all the way in.

        Covered by existing tests.

        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
        (WebCore::RenderThemeMac::cancelButtonSizes): Update button size.

2016-02-26  Brady Eidson  <beidson@apple.com>

        Modern IDB: New database versions are never committed to SQLite.
        <rdar://problem/24860952> and https://bugs.webkit.org/show_bug.cgi?id=154741
        
        Modern IDB: If a database handle is not open, files are not actually deleted from disk
        https://bugs.webkit.org/show_bug.cgi?id=154756

        Reviewed by Alex Christensen.

        Tested by API test "IndexedDBPersistence"

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::deleteDatabase): If there's not an open handle to the database, create one.

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::beginTransaction): If a version change transaction, actually
          set the new version on disk.
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::deleteBackingStore): If there is no open backing store, create one.
          This is necessary to both read the current database version, and to actually delete the file on disk.
        (WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore): If necessary, manufacture a "most recently
          deleted database info" from the version returned by deleteBackingStore.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2016-02-26  Chris Dumez  <cdumez@apple.com>

        Add API test coverage for parseHTMLInteger / parseHTMLNonNegativeInteger
        https://bugs.webkit.org/show_bug.cgi?id=154714

        Reviewed by Darin Adler.

        Export a couple more symbols for API testing.

        * html/parser/HTMLParserIdioms.h:

2016-02-26  Beth Dakin  <bdakin@apple.com>

        32-bit!!!

        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (-[WebPlaybackControlsManager initWithWebVideoFullscreenInterfaceMac:]):

2016-02-26  Beth Dakin  <bdakin@apple.com>

        Another 32-bit build fix.

        * platform/spi/cocoa/AVKitSPI.h:

2016-02-26  Beth Dakin  <bdakin@apple.com>

        Attempted 32-bit build fix.

        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (-[WebPlaybackControlsManager initWithWebVideoFullscreenInterfaceMac:]):

2016-02-26  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197160.
        https://bugs.webkit.org/show_bug.cgi?id=154757

        This change causes editing/mac/attributed-string/font-
        size.html to fail on El Capitan WK1 (Requested by ryanhaddad
        on #webkit).

        Reverted changeset:

        "Font size computed style is innaccurate"
        https://bugs.webkit.org/show_bug.cgi?id=154705
        http://trac.webkit.org/changeset/197160

2016-02-26  Gavin Barraclough  <barraclough@apple.com>

        Page TimerAlignmentIntervalIncrease mechanism should have upper limit
        https://bugs.webkit.org/show_bug.cgi?id=154744

        Reviewed by Geoff Garen.

        There would be diminishing returns from throttling timers in background pages infinitely.
        Add a heuristic to limit appropriately.

        Keep track of the current limit, and make the increase time take this into account.

        * page/Page.cpp:
        (WebCore::Page::setTimerThrottlingEnabled):
            - When timer throttling is disabled visit all timers to resume.
        (WebCore::Page::setTimerAlignmentIntervalIncreaseLimit):
            - Track the maximum alignment interval, and call setDOMTimerAlignmentInterval
              to ensure m_timerAlignmentInterval is updated in accordance with the new limit.
        (WebCore::Page::setDOMTimerAlignmentInterval):
            - When the timer alignemnt interval changes update the increase timer.
        (WebCore::Page::timerAlignmentIntervalIncreaseTimerFired):
            - Apply limit.
        * page/Page.h:
        (WebCore::Page::timerThrottlingEnabled):
            - Accessor for readability.

2016-02-26  Beth Dakin  <bdakin@apple.com>

        Attempted build fix.

        * platform/spi/cocoa/AVKitSPI.h:

2016-02-26  Beth Dakin  <bdakin@apple.com>

        Add support for playbackControlsManager
        https://bugs.webkit.org/show_bug.cgi?id=154742
        -and corresponding-
        rdar://problem/23833753

        Reviewed by Jer Noble.

        Make AVKitSPI.h private so that it can be used from other projects.
        * WebCore.xcodeproj/project.pbxproj:

        Right now, set up a controls manager for a video when it starts playing. In 
        the future, this is something that should be handled by the 
        PlatformMediaSessionManager since we only want a controls for the 
        currentSession.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::playInternal):

        New function setUpVideoControlsManager.
        * page/ChromeClient.h:

        Make these CoreMedia functions available on Mac and iOS instead of just iOS.
        * platform/cf/CoreMediaSoftLink.cpp:
        * platform/cf/CoreMediaSoftLink.h:

        This patch fleshes out an implementation for a bunch of these interface 
        functions since they need to communicate to the playbackControlsManager. This 
        is also where the playbackControlsManager lives.
        * platform/mac/WebVideoFullscreenInterfaceMac.h:

        Define an interface and implementation for WebPlaybackControlsManager.
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (-[WebPlaybackControlsManager initWithWebVideoFullscreenInterfaceMac:]):
        (-[WebPlaybackControlsManager isSeeking]):
        (-[WebPlaybackControlsManager seekToTime:toleranceBefore:toleranceAfter:]):
        (-[WebPlaybackControlsManager audioMediaSelectionOptions]):
        (-[WebPlaybackControlsManager currentAudioMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentAudioMediaSelectionOption:]):
        (-[WebPlaybackControlsManager legibleMediaSelectionOptions]):
        (-[WebPlaybackControlsManager currentLegibleMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentLegibleMediaSelectionOption:]):
        (-[WebPlaybackControlsManager cancelThumbnailAndAudioAmplitudeSampleGeneration]):

        Relay this information to the playbackControlsManager.
        (WebCore::WebVideoFullscreenInterfaceMac::setDuration):
        (WebCore::WebVideoFullscreenInterfaceMac::setCurrentTime):
        (WebCore::WebVideoFullscreenInterfaceMac::setRate):
        (WebCore::WebVideoFullscreenInterfaceMac::setSeekableRanges):
        (WebCore::WebVideoFullscreenInterfaceMac::ensureControlsManager):
        (WebCore::WebVideoFullscreenInterfaceMac::playBackControlsManager):
        (WebCore::WebVideoFullscreenInterfaceMac::setupFullscreen):

        New SPI needed.
        * platform/spi/cocoa/AVKitSPI.h:
        * platform/spi/mac/AVFoundationSPI.h:

2016-02-26  Said Abou-Hallawa  <sabouhallawa@apple.com>

        <g> wrapping <symbol> causes display of hidden <symbol>
        https://bugs.webkit.org/show_bug.cgi?id=154576

        Reviewed by Darin Adler.
        
        The SVGSymbolElement is allowed in the shadow tree of an SVGUseElement
        only if it subtree root element. Any descendant SVGSymbolElement should
        be removed from the subtree because it is a hidden container. If the cloned
        subtree includes an SVGUseElement which references an SVGSymbolElement,
        the same rule will be applied to the descendant SVGUseElement. The goal
        is to remove all the descendant SVGSymbolElements from the cloned target
        because these SVGSymbolElements will be expanded to SVGSVGElements and
        hence become visible.

        * svg/SVGUseElement.cpp:
        (WebCore::disassociateAndRemoveClones): A helper function which removes
        cloned SVGElements and their subtrees from their parents and disassociate
        them from their originals.
        
        (WebCore::removeDisallowedElementsFromSubtree): Use disassociateAndRemoveClones().
        
        (WebCore::removeSymbolElementsFromSubtree): Removes all the descendant
        SVGSymbolElements from the cloned subtree. It does not remove the root
        element itself if it is an SVGSymbolElement because this one will be
        expanded to an SVGSVGElement which is exactly what we need.
        
        (WebCore::SVGUseElement::cloneTarget): Call removeSymbolElementsFromSubtree()
        to remove the descendant SVGSymbolElements from the cloned subtree before
        appending it to the container shadow root.

2016-02-26  Olivier Blin  <olivier.blin@softathome.com>

        Initialize LocaleICU data members in header
        https://bugs.webkit.org/show_bug.cgi?id=154731

        Reviewed by Michael Catanzaro.

        LocaleICU data members should be initialized in the header, to
        avoid conditional initialization lines in the constructor, as
        suggested by Darin in bug 154484.

        * platform/text/LocaleICU.cpp:
        (WebCore::LocaleICU::LocaleICU): Deleted.
        * platform/text/LocaleICU.h:

2016-02-26  Brady Eidson  <beidson@apple.com>

        Modern IDB: Using existing database info from SQLite backing store is busted.
        <rdar://problem/24848143> and https://bugs.webkit.org/show_bug.cgi?id=154735

        Reviewed by Alex Christensen.

        No new tests.
        
        Reproducing the bug requires having a known database on disk *before* launching the DatabaseProcess to
        read in the existing IDBDatabaseInfo.
        
        Our automated infrastructure currently has no way of testing this.

        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::openDatabase):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo): Do the optional migrate on
          the IndexRecords table here; *every* time we open a SQLite backing store.
        (WebCore::IDBServer::SQLiteIDBBackingStore::createAndPopulateInitialDatabaseInfo): Deleted.
        * Modules/indexeddb/shared/IDBDatabaseInfo.cpp:
        (WebCore::IDBDatabaseInfo::isolatedCopy): Copy the entire object, not just name/version.

2016-02-25  Gavin Barraclough  <barraclough@apple.com>

        RefCounter value changed callback should be called on all changes (not just zero edge).
        https://bugs.webkit.org/show_bug.cgi?id=154699

        Reviewed by Anders Carlsson.

        RefCounter currently only triggers a callback when the count goes from zero
        to non-zero and vice-versa. Change that, to be useful to more clients.

        * page/PageThrottler.cpp:
        (WebCore::PageThrottler::PageThrottler):
            - Updated for change in RefCounter callback siganture.
        * platform/VNodeTracker.cpp:
        (WebCore::VNodeTracker::VNodeTracker):
            - Can now use RefCounter callback to trigger checkPressureState().
        (WebCore::VNodeTracker::pressureWarningTimerFired):
            - RefCounter count is now a size_t (%d -> %ul).
        * platform/VNodeTracker.h:
            - simplified VNodeTracker::token() [no longer needs to call checkPressureState()].

2016-02-26  Andreas Kling  <akling@apple.com>

        Remove unused CFNetwork disk cache mmap optimization in WebKit2.
        <https://webkit.org/b/154727>

        Reviewed by Darin Adler.

        Remove some now-unused SPI.

        * platform/spi/cf/CFNetworkSPI.h:

2016-02-26  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197167.
        https://bugs.webkit.org/show_bug.cgi?id=154730

        This change broke the Mac build (Requested by ryanhaddad on
        #webkit).

        Reverted changeset:

        "REGRESSION (188611): Search field Cancel button should not
        overlap search text on extensions page."
        https://bugs.webkit.org/show_bug.cgi?id=154692
        http://trac.webkit.org/changeset/197167

2016-02-26  Martin Robinson  <mrobinson@igalia.com>

        Remove libqcms support
        https://bugs.webkit.org/show_bug.cgi?id=154707

        Reviewed by Žan Doberšek.

        No new tests. This change simply removes dead code.

        * platform/image-decoders/ImageDecoder.h: Remove QCMS support.
        (WebCore::ImageDecoder::qcmsOutputDeviceProfile): Deleted.
        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp: Remove QCMS support.
        (WebCore::JPEGImageReader::JPEGImageReader): Deleted.
        (WebCore::JPEGImageReader::close): Deleted.
        (WebCore::JPEGImageReader::decode): Deleted.
        (WebCore::JPEGImageReader::colorTransform): Deleted.
        (WebCore::JPEGImageReader::createColorTransform): Deleted.
        (WebCore::JPEGImageDecoder::outputScanlines): Deleted.
        * platform/image-decoders/png/PNGImageDecoder.cpp: Remove QCMS support.
        (WebCore::PNGImageReader::PNGImageReader): Deleted.
        (WebCore::PNGImageReader::close): Deleted.
        (WebCore::PNGImageReader::rowBuffer): Deleted.
        (WebCore::PNGImageReader::createRowBuffer): Deleted.
        (WebCore::PNGImageReader::colorTransform): Deleted.
        (WebCore::PNGImageReader::createColorTransform): Deleted.
        (WebCore::PNGImageDecoder::headerAvailable): Deleted.
        (WebCore::PNGImageDecoder::rowAvailable): Deleted.
        (WebCore::PNGImageDecoder::frameComplete): Deleted.
        * platform/image-decoders/webp/WEBPImageDecoder.cpp: Remove QCMS support.
        (WebCore::WEBPImageDecoder::decode): Remove QCMS support.
        (WebCore::WEBPImageDecoder::WEBPImageDecoder): Deleted.
        (WebCore::WEBPImageDecoder::clear): Deleted.
        (WebCore::WEBPImageDecoder::createColorTransform): Deleted.
        (WebCore::WEBPImageDecoder::readColorProfile): Deleted.
        (WebCore::WEBPImageDecoder::applyColorProfile): Deleted.
        * platform/image-decoders/webp/WEBPImageDecoder.h: Remove QCMS support.
        (WebCore::WEBPImageDecoder::colorTransform): Deleted.

2016-02-26  Zalan Bujtas  <zalan@apple.com>

        RenderTheme::controlSize* methods should take const RenderStyle&.
        https://bugs.webkit.org/show_bug.cgi?id=154708

        Reviewed by Darin Adler.

        No change in functionality.

        * rendering/RenderTheme.h:
        (WebCore::RenderTheme::minimumMenuListSize):
        (WebCore::RenderTheme::popupInternalPaddingLeft):
        (WebCore::RenderTheme::popupInternalPaddingRight):
        (WebCore::RenderTheme::popupInternalPaddingTop):
        (WebCore::RenderTheme::popupInternalPaddingBottom):
        * rendering/RenderThemeMac.h:
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::controlSizeForFont):
        (WebCore::RenderThemeMac::sizeForFont):
        (WebCore::RenderThemeMac::sizeForSystemFont):
        (WebCore::RenderThemeMac::controlSizeForSystemFont):
        (WebCore::RenderThemeMac::minimumProgressBarHeight):
        (WebCore::RenderThemeMac::popupInternalPaddingLeft):
        (WebCore::RenderThemeMac::popupInternalPaddingRight):
        (WebCore::RenderThemeMac::popupInternalPaddingTop):
        (WebCore::RenderThemeMac::popupInternalPaddingBottom):
        (WebCore::RenderThemeMac::minimumMenuListSize):

2016-02-26  Zalan Bujtas  <zalan@apple.com>

        REGRESSION (188611): Search field Cancel button should not overlap search text on extensions page.
        https://bugs.webkit.org/show_bug.cgi?id=154692
        <rdar://problem/22840453>

        Reviewed by Brent Fulgham.

        Adjust the cancel button position using the actual size of the cancel button.

        When the input box and the font height trigger different cancel button sizes, we need to readjust
        the rectangle returned by cancelButtonRectForBounds.
        This fixes both the mispositioned cancel button and the squared off icon when the input field is zoomed all the way in.

        Covered by existing tests.

        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
        (WebCore::RenderThemeMac::cancelButtonSizes): Update button size.

2016-02-25  Antti Koivisto  <antti@apple.com>

        Implement ::slotted pseudo element
        https://bugs.webkit.org/show_bug.cgi?id=149441
        <rdar://problem/22731987>

        Reviewed by Andreas Kling.

        Based on latest in https://github.com/w3c/webcomponents/issues/331

        * css/CSSGrammar.y.in:

            Parse ::slotted.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::detectFunctionTypeToken):
        * css/CSSParserValues.cpp:
        (WebCore::CSSParserSelector::parsePseudoElementCueFunctionSelector):
        (WebCore::CSSParserSelector::parsePseudoElementSlottedFunctionSelector):

            Tokenize ::slotted.

        (WebCore::CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector):
        * css/CSSParserValues.h:
        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::pseudoId):
        * css/CSSSelector.h:
        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::matchAuthorRules):
        (WebCore::ElementRuleCollector::matchHostPseudoClassRules):
        (WebCore::ElementRuleCollector::matchSlottedPseudoElementRules):

            Match ::slotted selector.

        (WebCore::ElementRuleCollector::collectSlottedPseudoElementRulesForSlot):

            Collect ::slotted rules that may apply to an element in a slot.

        (WebCore::ElementRuleCollector::matchUserRules):
        (WebCore::ElementRuleCollector::matchUARules):
        (WebCore::findSlottedPseudoElementSelector):
        (WebCore::ElementRuleCollector::ruleMatches):
        * css/ElementRuleCollector.h:
        * css/RuleSet.cpp:
        (WebCore::RuleSet::addRule):

            Collect ::slotted rules.

        (WebCore::RuleSet::shrinkToFit):
        * css/RuleSet.h:
        (WebCore::RuleSet::hostPseudoClassRules):
        (WebCore::RuleSet::slottedPseudoElementRules):
        (WebCore::RuleSet::focusPseudoClassRules):
        (WebCore::RuleSet::universalRules):
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOne):
        * style/StyleSharingResolver.cpp:
        (WebCore::Style::SharingResolver::resolve):

            Disable style sharing for children of shadow host. They may be affected by the shadow tree style
            which is not considered in style sharing checks.

2016-02-25  Myles C. Maxfield  <mmaxfield@apple.com>

        Font size computed style is innaccurate
        https://bugs.webkit.org/show_bug.cgi?id=154705
        <rdar://problem/23474068>

        Reviewed by Timothy Hatcher.

        Safari rounds the font size value reported to getComputedStyle(). Neither Firefox
        nor Chrome do this.

        Covered by existing tests.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::getFontSizeCSSValuePreferringKeyword):
        (WebCore::fontSizeFromStyle):

2016-02-25  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Mark DOMString parameters as nullable when they should be
        https://bugs.webkit.org/show_bug.cgi?id=154666

        Reviewed by Darin Adler.

        Mark DOMString parameters as nullable when they should be. We previously
        emulated nullable DOMString attributes by using:
        [TreatNullAs=NullString, TreatUndefinedAs=NullString]
        However, this was non-standard and very verbose. Also, developers would
        sometimes forget the [TreatUndefinedAs=NullString] part and the behavior
        would end up being wrong for undefined.

        After this clean up, the non-standard [TreatUndefinedAs=NullString] is
        no longer used so this patch drops support for it. Only
        [TreatNullAs=NullString] remains and this one will be renamed to
        [TreatNullAs=EmptyString] via Bug 154654 to match Web IDL standard.

        Tests: fast/dom/Element/getElementsByTagNameNS-nullable.html
               fast/dom/Node/nullable-parameters.html
               fast/events/storageevent-initStorageEvent-nullable.html

        * Modules/mediastream/RTCPeerConnection.idl:
        Drop [TreatUndefinedAs=NullString] from createDataChannel()'s first
        parameter instead of marking it as nullable. This matches the
        specification:
        - http://w3c.github.io/webrtc-pc/#rtcpeerconnection-interface-extensions-1
        This means there is a slight behavior change when undefined is passed, it
        now becomes the string "undefined" instead of a null String.

        * bindings/scripts/CodeGeneratorJS.pm:
        (JSValueToNative):
        Drop handling of [TreatUndefinedAs=] as it is no longer used.

        * bindings/scripts/IDLAttributes.txt:
        Drop support for [TreatUndefinedAs=] as it is no longer used.

        * bindings/scripts/test/TestObj.idl:

        * dom/DOMImplementation.idl:
        Make a few parameters nullable and drop [TreatNullAs=NullString,
        TreatUndefinedAs=NullString]. There is no web-exposed behavior
        change.

        * dom/Document.idl:
        - Make a few parameters nullable and drop [TreatNullAs=NullString,
          TreatUndefinedAs=NullString]. There is no web-exposed behavior
          change from this.
        - Drop these attributes from ObjC-specific bindings as they only
          matter to JS bindings.
        - The namespaceURI parameter to getElementsByTagNameNS() is now marked
          as nullable even though it only treated null as a null String, not
          undefined. This was a bug and did not match the specification:
          https://dom.spec.whatwg.org/#document

        * dom/Element.idl:
        - Make a few parameters nullable and drop [TreatNullAs=NullString,
          TreatUndefinedAs=NullString]. There is no web-exposed behavior
          change from this.
        - Drop these attributes from ObjC-specific bindings as they only
          matter to JS bindings.
        - The namespaceURI parameter to getElementsByTagNameNS() is now marked
          as nullable even though it only treated null as a null String, not
          undefined. This was a bug and did not match the specification:
          https://dom.spec.whatwg.org/#interface-element

        * dom/NamedNodeMap.idl:
        Make a few parameters nullable and drop [TreatNullAs=NullString,
        TreatUndefinedAs=NullString]. There is no web-exposed behavior
        change from this.

        * dom/Node.idl:
        - Drop these attributes from isSupported() as this is not exposed
          to JS (only native bindings) and these attributes only matter to
          JS bindings.
        - Make the first parameter to lookupPrefix() / isDefaultNamespace()
          and lookupNamespaceURI() nullable. Previously, we treated null
          as a null string but not undefined. There is therefore a slight
          behavior change but this matches the specification:
          https://dom.spec.whatwg.org/#node

        * fileapi/Blob.idl:
        * html/HTMLButtonElement.idl:
        * html/HTMLCanvasElement.idl:
        * html/HTMLFieldSetElement.idl:
        * html/HTMLInputElement.idl:
        * html/HTMLKeygenElement.idl:
        * html/HTMLMediaElement.idl:
        * html/HTMLObjectElement.idl:
        * html/HTMLOutputElement.idl:
        * html/HTMLSelectElement.idl:
        * html/HTMLTextAreaElement.idl:
        * page/DOMWindow.idl:
        Make a few parameters nullable and drop [TreatNullAs=NullString,
        TreatUndefinedAs=NullString]. There is no web-exposed behavior
        change from this.

        * storage/StorageEvent.idl:
        Mark oldValueArg / newValueArg parameters to initStorageEvent()
        as nullable. Previously, we only treated null as a null string,
        not undefined. This is therefore a slight behavior change but
        it matches the specification:
        https://www.w3.org/TR/webstorage/#storageeventinit

2016-02-25  David Kilzer  <ddkilzer@apple.com>

        REGRESSION (r196744): NetworkExtension.framework and NEFilterSource class are not available on Recovery partition
        <http://webkit.org/b/154703>

        Reviewed by Andy Estes.

        * platform/cocoa/NetworkExtensionContentFilter.mm: Make
        soft-linking of NetworkExtension.framework and NEFilterSource
        class optional since they are not available on the Recovery
        partition.  Note that NetworkExtensionContentFilter::enabled()
        does not need to change since it already had the correct
        behavior when getNEFilterSourceClass() returned nullptr.

2016-02-25  Ada Chan  <adachan@apple.com>

        Update the definition of ENABLE_VIDEO_PRESENTATION_MODE for Mac platform
        https://bugs.webkit.org/show_bug.cgi?id=154702

        Reviewed by Dan Bernstein.

        * Configurations/FeatureDefines.xcconfig:

2016-02-25  David Kilzer  <ddkilzer@apple.com>

        Change ASSERT to RELEASE_ASSERT in SOFT_LINK_CLASS() macro

        Follow-up fix noted by Andy Estes for:

            [Cocoa] Always check the return value of dlopen() and dlsym() in Release builds
            <http://webkit.org/b/154364>

        * platform/mac/SoftLinking.h:
        (SOFT_LINK_CLASS): Change ASSERT to RELEASE_ASSERT to check the
        return value of objc_getClass().  This matches what we do for
        SOFT_LINK_CLASS_FOR_SOURCE().

2016-02-25  Daniel Bates  <dabates@apple.com>

        CSP: Remove SecurityPolicy script interface
        https://bugs.webkit.org/show_bug.cgi?id=154694
        <rdar://problem/24846482>

        Reviewed by Andy Estes.

        Remove the Content Security Policy script interface, SecurityPolicy. This interface was only
        enabled when building with ENABLE(CSP_NEXT) (disabled by default).

        For completeness, the SecurityPolicy interface was removed from the Content Security Policy 1.1 spec.
        in <https://github.com/w3c/webappsec/commit/18882953ce2d8afca25f685557fef0e0471b2c9a> (12/26/2013).

        * CMakeLists.txt: Remove files to DOMSecurityPolicy.{cpp, idl}.
        * DerivedSources.cpp: Remove file JSDOMSecurityPolicy.cpp.
        * DerivedSources.make: Remove file DOMSecurityPolicy.idl.
        * PlatformGTK.cmake: Ditto.
        * PlatformMac.cmake: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Remove files DOMSecurityPolicy files.
        * bindings/scripts/CodeGeneratorGObject.pm: Remove reference to DOMSecurityPolicy.
        * dom/Document.cpp:
        (WebCore::Document::securityPolicy): Deleted.
        * dom/Document.h:
        * dom/Document.idl: Remove attribute securityPolicy.
        * page/DOMSecurityPolicy.cpp: Removed.
        * page/DOMSecurityPolicy.h: Removed.
        * page/DOMSecurityPolicy.idl: Removed.

2016-02-25  Andreas Kling  <akling@apple.com>

        Don't clear the weak JSString cache on memory pressure.
        <https://webkit.org/b/154693>

        Reviewed by Antti Koivisto.

        This was stupid. The cache is a WeakGCMap, so all the JSStrings pointed to are
        still alive anyway. This way we keep the ability to deduplicate common strings.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::releaseNoncriticalMemory): Deleted.

2016-02-25  Chris Dumez  <cdumez@apple.com>

        Drop [TreatReturnedNullStringAs=Undefined] WebKit-specific IDL attribute
        https://bugs.webkit.org/show_bug.cgi?id=154662

        Reviewed by Darin Adler.

        Drop [TreatReturnedNullStringAs=Undefined] WebKit-specific IDL attribute.
        This has no standard equivalent and all uses in WebKit are either useless
        or wrong.

        Test: fast/frames/detached-frame-document-defaultCharset.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): Deleted.
        * bindings/scripts/IDLAttributes.txt:
        Drop support for [TreatReturnedNullStringAs=X] entirely.

        * dom/Document.cpp:
        (WebCore::Document::defaultCharset):
        Fall back to return "UTF-8" instead of the null string, similarly to
        what is done in for Document.characterSet. Note that this attribute
        is non-standard and is an IE extension. Firefox never supported it
        and Chrome dropped it last year.

        * dom/Document.idl:
        - Drop extended attribute for Document.defaultCharset as the
          implementation has been updated to never return a null String.
        - Drop extended attribute for Document.readyState. It was useless
          because the implementation could never return a null String.

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::getAllResponseHeaders):
        Update implementation to return emptyString() instead of "" in case
        of error.

        * xml/XMLHttpRequest.idl:
        Drop extended attribute from XMLHttpRequest.getAllResponseHeaders().
        It was useless because the implementation could never return a
        null String.

        * xml/XSLTProcessor.idl:
        Drop extended attribute from XSLTProcessor.getParameter(). The
        operation is already marked as [Custom] so the extended attribute
        had no effect.

2016-02-25  Gavin Barraclough  <barraclough@apple.com>

        Should template RefCounter instead of RefCounter::Token
        https://bugs.webkit.org/show_bug.cgi?id=154691

        Reviewed by Anders Carlsson.

        Mechanical update per RefCounter interface change.

        * page/PageThrottler.cpp:
        (WebCore::PageThrottler::mediaActivityToken):
        (WebCore::PageThrottler::pageLoadActivityToken):
        (WebCore::PageThrottler::setActivityFlag):
        * page/PageThrottler.h:
        * platform/VNodeTracker.h:

2016-02-25  Brady Eidson  <beidson@apple.com>

        Remove LegacyIDB.
        https://bugs.webkit.org/show_bug.cgi?id=150854

        Reviewed by Alex Christensen.

        No new tests (No change in behavior).

        * CMakeLists.txt:
        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
        (WebCore::DOMWindowIndexedDatabase::indexedDB):
        * Modules/indexeddb/IDBDatabaseMetadata.cpp: Removed.
        * Modules/indexeddb/IDBDatabaseMetadata.h: Removed.
        * Modules/indexeddb/IDBFactory.h:
        * Modules/indexeddb/IDBIndex.h:
        * Modules/indexeddb/IDBIndexMetadata.h: Removed.
        * Modules/indexeddb/IDBObjectStoreMetadata.h: Removed.
        * Modules/indexeddb/IDBOperation.h: Removed.
        * Modules/indexeddb/IDBServerConnection.h: Removed.
        * Modules/indexeddb/IDBTransaction.h:
        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.cpp:
        (WebCore::WorkerGlobalScopeIndexedDatabase::indexedDB):
        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.h:
        * Modules/indexeddb/legacy/IDBCallbacks.h: Removed.
        * Modules/indexeddb/legacy/IDBCursorBackend.cpp: Removed.
        * Modules/indexeddb/legacy/IDBCursorBackend.h: Removed.
        * Modules/indexeddb/legacy/IDBCursorBackendOperations.cpp: Removed.
        * Modules/indexeddb/legacy/IDBCursorBackendOperations.h: Removed.
        * Modules/indexeddb/legacy/IDBDatabaseBackend.cpp: Removed.
        * Modules/indexeddb/legacy/IDBDatabaseBackend.h: Removed.
        * Modules/indexeddb/legacy/IDBDatabaseCallbacks.h: Removed.
        * Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.cpp: Removed.
        * Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.h: Removed.
        * Modules/indexeddb/legacy/IDBFactoryBackendInterface.h: Removed.
        * Modules/indexeddb/legacy/IDBPendingDeleteCall.h: Removed.
        * Modules/indexeddb/legacy/IDBPendingOpenCall.h: Removed.
        * Modules/indexeddb/legacy/IDBPendingTransactionMonitor.cpp: Removed.
        * Modules/indexeddb/legacy/IDBPendingTransactionMonitor.h: Removed.
        * Modules/indexeddb/legacy/IDBTransactionBackend.cpp: Removed.
        * Modules/indexeddb/legacy/IDBTransactionBackend.h: Removed.
        * Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp: Removed.
        * Modules/indexeddb/legacy/IDBTransactionBackendOperations.h: Removed.
        * Modules/indexeddb/legacy/IDBTransactionCoordinator.cpp: Removed.
        * Modules/indexeddb/legacy/IDBTransactionCoordinator.h: Removed.
        * Modules/indexeddb/legacy/LegacyAny.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyAny.h: Removed.
        * Modules/indexeddb/legacy/LegacyCursor.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyCursor.h: Removed.
        * Modules/indexeddb/legacy/LegacyCursorWithValue.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyCursorWithValue.h: Removed.
        * Modules/indexeddb/legacy/LegacyDatabase.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyDatabase.h: Removed.
        * Modules/indexeddb/legacy/LegacyFactory.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyFactory.h: Removed.
        * Modules/indexeddb/legacy/LegacyIndex.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyIndex.h: Removed.
        * Modules/indexeddb/legacy/LegacyObjectStore.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyObjectStore.h: Removed.
        * Modules/indexeddb/legacy/LegacyOpenDBRequest.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyOpenDBRequest.h: Removed.
        * Modules/indexeddb/legacy/LegacyRequest.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyRequest.h: Removed.
        * Modules/indexeddb/legacy/LegacyTransaction.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyTransaction.h: Removed.
        * Modules/indexeddb/legacy/LegacyVersionChangeEvent.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyVersionChangeEvent.h: Removed.
        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
        (WebCore::IDBServer::SQLiteIDBCursor::establishStatement):
        (WebCore::IDBServer::SQLiteIDBCursor::internalAdvanceOnce):
        * Modules/indexeddb/server/SQLiteIDBCursor.h:
        * Modules/indexeddb/shared/IDBIndexInfo.h:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::generateIndexKeysForValue): Deleted.
        * bindings/js/IDBBindingUtilities.h:
        * bindings/js/JSMainThreadExecState.cpp:
        (WebCore::JSMainThreadExecState::didLeaveScriptContext): Deleted.
        * inspector/InspectorIndexedDBAgent.cpp:
        * loader/EmptyClients.cpp:
        * page/DatabaseProvider.cpp:
        (WebCore::DatabaseProvider::idbFactoryBackend): Deleted.
        * page/DatabaseProvider.h:
        * platform/CrossThreadCopier.cpp:
        (WebCore::IDBDatabaseMetadata>::copy): Deleted.
        (WebCore::IDBIndexMetadata>::copy): Deleted.
        (WebCore::IDBObjectStoreMetadata>::copy): Deleted.
        * platform/CrossThreadCopier.h:

2016-02-25  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION (r196268): Many assertion failures and crashes on SVG path animation tests when JS garbage collection happens quickly
        https://bugs.webkit.org/show_bug.cgi?id=154331

        Reviewed by Darin Adler.

        This is not an actual regression. The bug did exist before r196268 but
        the whole document was leaking once an SVGAnimatedProperty was created
        so there was no way to produce this bug. After fixing the leak, one crash
        and one assert got uncovered. Both of them happen because of the fact:
        "if an SVGAnimatedProperty is not referenced it will be deleted."

        * svg/SVGPathElement.cpp:
        (WebCore::SVGPathElement::lookupOrCreateDWrapper):
        The code in this function was assuming that the wrapper will be created
        only once which happens when SVGAnimatedProperty::lookupOrCreateWrapper()
        is called. Before making this single call, lookupOrCreateDWrapper() was
        building an initial SVGPathSegList from byte stream. But now
        SVGAnimatedProperty::lookupWrapper() can return false even after creating
        the SVGAnimatedProperty because it was deleted later. Calling
        buildSVGPathSegListFromByteStream() more than once was causing
        SVGAnimatedListPropertyTearOff::animationStarted() to fire the assertion
        ASSERT(m_values.size() == m_wrappers.size()) because the path segments were
        appended twice to m_values which is in fact SVGPathElement::m_pathSegList.value.
        The fix is to build the initial SVGPathSegList only once which should happen
        when m_pathSegList.value.isEmpty().
        
        (WebCore::SVGPathElement::animatedPropertyWillBeDeleted):
        * svg/SVGPathElement.h:
        * svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::~SVGAnimatedPathSegListPropertyTearOff):
        SVGPathElement is assuming the following equivalence relation:
        m_pathSegList.shouldSynchronize ~ SVGAnimatedProperty_is_created_and_not_null.
        SVGPathElement::animatedPathSegList() and animatedNormalizedPathSegList()
        set m_pathSegList.shouldSynchronize to true when SVGAnimatedProperty is
        created but nothing sets m_pathSegList.shouldSynchronize back to false.
        This was not a problem when the SVGAnimatedProperty was leaking but after
        ensuring it is deleted when it is not referenced this equivalence relation
        becomes untrue sometimes. This caused SVGPathElement::svgAttributeChanged()
        to crash when we check m_pathSegList.shouldSynchronize and if it is true we
        assume that SVGAnimatedProperty::lookupWrapper() will return a non-null pointer
        and therefore we deference this pointer and call SVGAnimatedProperty::isAnimating().
        To fix this crash we need to set m_pathSegList.shouldSynchronize back to false
        when the associated SVGAnimatedProperty is deleted.

2016-02-25  Brady Eidson  <beidson@apple.com>

        Modern IDB: WebKit 2 IPC layer.
        https://bugs.webkit.org/show_bug.cgi?id=153808

        Reviewed by Alex Christensen.

        No new tests (Covered by over 1,000 existing tests).

        * Modules/indexeddb/IDBKeyData.h:
        (WebCore::IDBKeyData::encode): It's okay to encode Min and Max.
        (WebCore::IDBKeyData::decode): It's okay to decode Min and Max.

2016-02-25  Daniel Bates  <dabates@apple.com>

        CSP: Make SecurityPolicyViolationEvent more closely conform to CSP spec and enable it by default
        https://bugs.webkit.org/show_bug.cgi?id=154522
        <rdar://problem/24762078>

        Reviewed by Brent Fulgham.

        Include attributes statusCode and columnNumber in a dispatched SecurityPolicyViolationEvent and
        as part of the SecurityPolicyViolationEventInit dictionary as per section Violation DOM Events
        of the Content Security Policy Level 3 spec., <https://w3c.github.io/webappsec-csp/> (24 February 2016).
        Additionally, enable dispatching of this event when a Content Security Policy violation occurs regardless
        of whether ENABLE(CSP_NEXT) is enabled.

        Test: http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html

        * WebCore.xcodeproj/project.pbxproj: Add files JSSecurityPolicyViolationEvent.{cpp, h}.
        * dom/EventNames.in: Enable support for SecurityPolicyViolationEvent unconditionally.
        * dom/SecurityPolicyViolationEvent.h: Remove ENABLE(CSP_NEXT)-guard so that we compile this
        code unconditionally. Modified SecurityPolicyViolationEventInit and SecurityPolicyViolationEvent
        to support attributes statusCode and columnNumebr.
        * dom/SecurityPolicyViolationEvent.idl: Add attributes statusCode and columnNumber.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportViolation): Modified to both dispatch a SecurityPolicyViolationEvent
        and send a violation report (if applicable).

2016-02-25  Eric Carlson  <eric.carlson@apple.com>

        [MediaStream] MediaDeviceInfo deviceId and groupId must be unique to the page's origin
        https://bugs.webkit.org/show_bug.cgi?id=153163
        <rdar://problem/24334526>

        Reviewed by Tim Horton.

        Tests: http/tests/media/media-stream/enumerate-devices-source-id-persistent.html
               http/tests/media/media-stream/enumerate-devices-source-id.html

        * Modules/mediastream/MediaDevicesRequest.cpp:
        (WebCore::MediaDevicesRequest::start): Don't check document.hasHadActiveMediaStreamTrack, do it
          in didCompleteTrackSourceInfoRequest where we need the information.
        (WebCore::MediaDevicesRequest::didCompletePermissionCheck): Renamed from didCompleteCheck, save
          device ID hash string.
        (WebCore::hashString): Hash a string with SHA1.
        (WebCore::MediaDevicesRequest::hashID): Hash and ID.
        (WebCore::MediaDevicesRequest::didCompleteTrackSourceInfoRequest): Hash deviceId and groupId.
        (WebCore::MediaDevicesRequest::didCompleteCheck): Deleted.
        (WebCore::MediaDevicesRequest::getTrackSources): Deleted.
        (WebCore::MediaDevicesRequest::didCompleteRequest): Deleted.
        * Modules/mediastream/MediaDevicesRequest.h:

        * Modules/mediastream/UserMediaPermissionCheck.cpp:
        (WebCore::UserMediaPermissionCheck::userMediaDocumentOrigin): Renamed from securityOrigin.
        (WebCore::UserMediaPermissionCheck::topLevelDocumentOrigin): New, return the top level document origin.
        (WebCore::UserMediaPermissionCheck::setUserMediaAccessInfo): Renamed from setHasPersistentPermission.
        (WebCore::UserMediaPermissionCheck::securityOrigin): Deleted.
        (WebCore::UserMediaPermissionCheck::setHasPersistentPermission): Deleted.
        * Modules/mediastream/UserMediaPermissionCheck.h:

        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::userMediaDocumentOrigin): Renamed from securityOrigin.
        (WebCore::UserMediaRequest::topLevelDocumentOrigin): New, return the top level document origin.
        (WebCore::UserMediaRequest::securityOrigin): Deleted.
        * Modules/mediastream/UserMediaRequest.h:
        (WebCore::UserMediaRequest::requiresAudio): Deleted, unused.
        (WebCore::UserMediaRequest::requiresVideo): Ditto.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerMediaDeviceIdentifierStorageDirectory): Deleted, unused.
        * html/HTMLMediaElement.h:

        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerMediaDeviceIdentifierStorageDirectory): Deleted.

        * platform/mediastream/MediaStreamTrackSourcesRequestClient.h:
        (WebCore::MediaStreamTrackSourcesRequestClient::didCompleteTrackSourceInfoRequest): Renamed from didCompleteRequest.

        * platform/mediastream/mac/RealtimeMediaSourceCenterMac.cpp:
        (WebCore::RealtimeMediaSourceCenterMac::getMediaStreamTrackSources): Ditto.

        * platform/mock/MockRealtimeMediaSourceCenter.cpp:
        (WebCore::MockRealtimeMediaSourceCenter::getMediaStreamTrackSources): Ditto.

2016-02-24  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Tearing when entering AC mode
        https://bugs.webkit.org/show_bug.cgi?id=150955

        Reviewed by Michael Catanzaro.

        * platform/gtk/GtkUtilities.cpp:
        (WebCore::widgetIsOnscreenToplevelWindow): Allow passing nullptr.

2016-02-24  Chris Dumez  <cdumez@apple.com>

        Drop [TreatReturnedNullStringAs=Null] WebKit-specific IDL attribute
        https://bugs.webkit.org/show_bug.cgi?id=154659

        Reviewed by Sam Weinig.

        Drop [TreatReturnedNullStringAs=Null] WebKit-specific IDL attribute and
        use nullable DOMString types instead:
        http://heycam.github.io/webidl/#idl-nullable-type

        This is the standard way of doing things. We already had support
        in the bindings generator for nullable DOMString attributes so
        we now just leverage this support. However, our IDL parser did
        not correctly parse nullable DOMString return values for operations.
        This patch fixes this.

        This patch also drops [TreatNullAs=NullString] and
        [TreatUndefinedAs=NullString] for writable DOMString attributes that
        are now marked as nullable because they are implied.

        * Modules/fetch/FetchHeaders.idl:
        * Modules/indexeddb/IDBObjectStore.idl:
        * Modules/mediasource/DOMURLMediaSource.idl:
        * Modules/mediastream/DOMURLMediaStream.idl:
        * Modules/websockets/WebSocket.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): Deleted.
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/IDLParser.pm:
        (parseAttributeOrOperationRest):
        (parseOperationOrIterator):
        (parseSpecialOperation):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_nullable_string_method):
        (webkit_dom_test_obj_nullable_string_special_method):
        (webkit_dom_test_obj_conditional_method3): Deleted.
        (webkit_dom_test_obj_convert1): Deleted.
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObj::getOwnPropertySlot):
        (WebCore::JSTestObj::getOwnPropertySlotByIndex):
        (WebCore::JSTestObj::getOwnPropertyNames):
        (WebCore::jsTestObjPrototypeFunctionNullableStringMethod):
        (WebCore::jsTestObjConstructorFunctionNullableStringStaticMethod):
        (WebCore::jsTestObjPrototypeFunctionNullableStringSpecialMethod):
        (WebCore::jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence): Deleted.
        (WebCore::jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence2): Deleted.
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj nullableStringMethod]):
        (-[DOMTestObj nullableStringStaticMethod]):
        (-[DOMTestObj nullableStringSpecialMethod:]):
        (-[DOMTestObj overloadedMethod1:]): Deleted.
        (-[DOMTestObj getSVGDocument]): Deleted.
        * bindings/scripts/test/TestObj.idl:
        * css/CSSCharsetRule.idl:
        * css/CSSImportRule.idl:
        * css/CSSKeyframesRule.idl:
        * css/CSSPageRule.idl:
        * css/CSSRule.idl:
        * css/CSSStyleDeclaration.idl:
        * css/CSSStyleRule.idl:
        * css/CSSValue.idl:
        * css/MediaList.idl:
        * css/StyleSheet.idl:
        * dom/Attr.idl:
        * dom/CharacterData.idl:
        * dom/DOMStringList.idl:
        * dom/Document.idl:
        * dom/DocumentType.idl:
        * dom/Element.idl:
        * dom/Entity.idl:
        * dom/MutationRecord.idl:
        * dom/Node.idl:
        * dom/ProcessingInstruction.idl:
        * html/DOMSettableTokenList.idl:
        * html/DOMTokenList.idl:
        * html/DOMURL.idl:
        * html/canvas/WebGLDebugShaders.idl:
        * html/canvas/WebGLRenderingContextBase.idl:
        * page/DOMWindow.idl:
        * storage/Storage.idl:
        * storage/StorageEvent.idl:
        * xml/XMLHttpRequest.idl:
        * xml/XPathNSResolver.idl:

2016-02-24  Nikos Andronikos  <nikos.andronikos-webkit@cisra.canon.com.au>

        [web-animations] Add AnimationTimeline, DocumentTimeline and add extensions to Document interface
        https://bugs.webkit.org/show_bug.cgi?id=151688

        Reviewed by Dean Jackson.

        - Adds DocumentTimeline interface and class implementation
        - Implements the DocumentAnimation extension to the Document Interface that contains a default DocumentTimeline
        - Add AnimationTimeline interface stub (i.e. without getAnimations and currentTime)
        - Adds AnimationTimeline class implementation for AnimationTimeline interface stub
        - Adds Javascript bindings for the above classes and interfaces
        - Enables the WEB_ANIMATIONS compiler switch

        No tests yet.  Tests will be added as class functionality is added incrementally.

        * CMakeLists.txt:
        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.make:
        * PlatformGTK.cmake:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.vcxproj/WebCoreIncludeCommon.props:
        * WebCore.vcxproj/copyForwardingHeaders.cmd:
        * WebCore.xcodeproj/project.pbxproj:
        * animation/AnimationTimeline.cpp: Added.
        (WebCore::AnimationTimeline::AnimationTimeline):
        (WebCore::AnimationTimeline::~AnimationTimeline):
        (WebCore::AnimationTimeline::destroy):
        * animation/AnimationTimeline.h: Added.
        (WebCore::AnimationTimeline::deref):
        (WebCore::AnimationTimeline::isDocumentTimeline):
        (WebCore::AnimationTimeline::classType):
        * animation/AnimationTimeline.idl: Added.
        * animation/DocumentAnimation.cpp: Added.
        (WebCore::DocumentAnimation::DocumentAnimation):
        (WebCore::DocumentAnimation::~DocumentAnimation):
        (WebCore::DocumentAnimation::timeline):
        (WebCore::DocumentAnimation::supplementName):
        (WebCore::DocumentAnimation::from):
        * animation/DocumentAnimation.h: Added.
        * animation/DocumentAnimation.idl: Added.
        * animation/DocumentTimeline.cpp: Added.
        (WebCore::DocumentTimeline::create):
        (WebCore::DocumentTimeline::DocumentTimeline):
        (WebCore::DocumentTimeline::~DocumentTimeline):
        * animation/DocumentTimeline.h: Added.
        * animation/DocumentTimeline.idl: Added.
        * bindings/js/JSAnimationTimelineCustom.cpp: Added.
        (WebCore::toJS):
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/scripts/CodeGeneratorGObject.pm:
        * dom/Document.h:

2016-02-24  Brady Eidson  <beidson@apple.com>

        Modern IDB: Some w3c objectstore tests crash under GuardMalloc.
        https://bugs.webkit.org/show_bug.cgi?id=154460

        Reviewed by Alex Christensen.

        No new tests (Covered by existing tests).

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::~UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore):  Don't delete the UniqueIDBDatabase yet 
          if there are still any connections pending close.
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformCommitTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformAbortTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::inProgressTransactionCompleted): It's possible that with this
          transaction completing, and a connection finished its close process, that the UniqueIDBDatabase is
          now ready to be deleted.

        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::abortTransactionWithoutCallback):
        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.h:

        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::abortWithoutCallback):

2016-02-24  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK.
        https://bugs.webkit.org/show_bug.cgi?id=154651

        Reviewed by Alex Christensen.

        No new tests needed.

        * CMakeLists.txt: Moved shared code to WEBKIT_FRAMEWORK macro.

2016-02-24  Ryosuke Niwa  <rniwa@webkit.org>

        Use more references in FocusNavigationScope
        https://bugs.webkit.org/show_bug.cgi?id=154637

        Reviewed by Chris Dumez.

        Use references in various functions of FocusNavigationScope as well as m_treeScope.

        * page/FocusController.cpp:
        (WebCore::FocusNavigationScope::FocusNavigationScope): Takes TreeScope& instead of TreeScope*.
        (WebCore::FocusNavigationScope::rootNode): Returns ContainerNode& instead of ContainerNode*.
        (WebCore::FocusNavigationScope::owner):
        (WebCore::FocusNavigationScope::scopeOf): Takes Node& instead of Node*. Renamed from focusNavigationScopeOf.
        (WebCore::FocusNavigationScope::scopeOwnedByShadowHost): Ditto. Renamed from focusNavigationScopeOwnedByShadowHost.
        (WebCore::FocusNavigationScope::scopeOwnedByIFrame): Ditto. Renamed from focusNavigationScopeOwnedByIFrame.
        (WebCore::FocusController::findFocusableElementDescendingDownIntoFrameDocument):
        (WebCore::FocusController::advanceFocusInDocumentOrder):
        (WebCore::FocusController::findFocusableElementAcrossFocusScope): Define currentScope inside the loop now that
        the copy constructor of FocusNavigationScope no longer exists (since m_treeScope is a reference).
        (WebCore::FocusController::findFocusableElementRecursively):
        (WebCore::nextElementWithGreaterTabIndex):
        (WebCore::FocusController::nextFocusableElement):
        (WebCore::FocusController::previousFocusableElement):

2016-02-24  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Add MediaEndpoint interface (WebRTC backend abstraction)
        https://bugs.webkit.org/show_bug.cgi?id=150165

        Reviewed by Eric Carlson.

        Add the MediaEndpoint interface along with its companion objects.

        MediaEndpoint interface: A WebRTC platform abstraction that is used to
        configure how the the WebRTC backend sends and receives. It also abstracts
        ICE functionality such as generating local candidates and doing
        checking on remote candidates. The RTCPeerConnection API, and other API
        objects such as RTCRtpSender/Receiver, live above MediaEndpoint.

        MediaEndpointConfiguration: A settings object used to configure a
        MediaEndpoint with, for example, ICE helper servers and other polices.
        A MediaEndpointConfiguration is used to initialize a MediaEndpoint, but
        can also be used to update settings.

        MediaEndpointSessionConfiguration: An object that describes how the
        MediaEndpoint should send and receive. Contains PeerMediaDescription,
        MediaPayload and IceCandidate objects.

        Tests: The MediaEndpoint platform interface has no implementations yet.

        * CMakeLists.txt:
        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::gotDtlsFingerprint):
        (WebCore::MediaEndpointPeerConnection::gotIceCandidate):
        (WebCore::MediaEndpointPeerConnection::doneGatheringCandidates):
        (WebCore::MediaEndpointPeerConnection::gotRemoteSource):
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/mediastream/IceCandidate.h: Added.
        (WebCore::IceCandidate::create):
        (WebCore::IceCandidate::~IceCandidate):
        (WebCore::IceCandidate::type):
        (WebCore::IceCandidate::setType):
        (WebCore::IceCandidate::foundation):
        (WebCore::IceCandidate::setFoundation):
        (WebCore::IceCandidate::componentId):
        (WebCore::IceCandidate::setComponentId):
        (WebCore::IceCandidate::transport):
        (WebCore::IceCandidate::setTransport):
        (WebCore::IceCandidate::priority):
        (WebCore::IceCandidate::setPriority):
        (WebCore::IceCandidate::address):
        (WebCore::IceCandidate::setAddress):
        (WebCore::IceCandidate::port):
        (WebCore::IceCandidate::setPort):
        (WebCore::IceCandidate::tcpType):
        (WebCore::IceCandidate::setTcpType):
        (WebCore::IceCandidate::relatedAddress):
        (WebCore::IceCandidate::setRelatedAddress):
        (WebCore::IceCandidate::relatedPort):
        (WebCore::IceCandidate::setRelatedPort):
        (WebCore::IceCandidate::clone):
        (WebCore::IceCandidate::IceCandidate):
        * platform/mediastream/MediaEndpoint.cpp: Added.
        (WebCore::createMediaEndpoint):
        * platform/mediastream/MediaEndpoint.h: Added.
        (WebCore::MediaEndpointClient::~MediaEndpointClient):
        (WebCore::MediaEndpoint::~MediaEndpoint):
        * platform/mediastream/MediaEndpointConfiguration.cpp: Added.
        (WebCore::IceServerInfo::IceServerInfo):
        (WebCore::MediaEndpointConfiguration::MediaEndpointConfiguration):
        * platform/mediastream/MediaEndpointConfiguration.h: Added.
        (WebCore::IceServerInfo::create):
        (WebCore::IceServerInfo::~IceServerInfo):
        (WebCore::IceServerInfo::urls):
        (WebCore::IceServerInfo::credential):
        (WebCore::IceServerInfo::username):
        (WebCore::MediaEndpointConfiguration::create):
        (WebCore::MediaEndpointConfiguration::iceServers):
        (WebCore::MediaEndpointConfiguration::iceTransportPolicy):
        (WebCore::MediaEndpointConfiguration::bundlePolicy):
        * platform/mediastream/MediaEndpointSessionConfiguration.h: Added.
        (WebCore::MediaEndpointSessionConfiguration::create):
        (WebCore::MediaEndpointSessionConfiguration::~MediaEndpointSessionConfiguration):
        (WebCore::MediaEndpointSessionConfiguration::sessionId):
        (WebCore::MediaEndpointSessionConfiguration::setSessionId):
        (WebCore::MediaEndpointSessionConfiguration::sessionVersion):
        (WebCore::MediaEndpointSessionConfiguration::setSessionVersion):
        (WebCore::MediaEndpointSessionConfiguration::mediaDescriptions):
        (WebCore::MediaEndpointSessionConfiguration::addMediaDescription):
        (WebCore::MediaEndpointSessionConfiguration::clone):
        (WebCore::MediaEndpointSessionConfiguration::MediaEndpointSessionConfiguration):
        * platform/mediastream/MediaPayload.h: Added.
        (WebCore::MediaPayload::create):
        (WebCore::MediaPayload::~MediaPayload):
        (WebCore::MediaPayload::type):
        (WebCore::MediaPayload::setType):
        (WebCore::MediaPayload::encodingName):
        (WebCore::MediaPayload::setEncodingName):
        (WebCore::MediaPayload::clockRate):
        (WebCore::MediaPayload::setClockRate):
        (WebCore::MediaPayload::channels):
        (WebCore::MediaPayload::setChannels):
        (WebCore::MediaPayload::ccmfir):
        (WebCore::MediaPayload::setCcmfir):
        (WebCore::MediaPayload::nackpli):
        (WebCore::MediaPayload::setNackpli):
        (WebCore::MediaPayload::nack):
        (WebCore::MediaPayload::setNack):
        (WebCore::MediaPayload::parameters):
        (WebCore::MediaPayload::addParameter):
        (WebCore::MediaPayload::clone):
        (WebCore::MediaPayload::MediaPayload):
        * platform/mediastream/PeerMediaDescription.h: Added.
        (WebCore::PeerMediaDescription::create):
        (WebCore::PeerMediaDescription::~PeerMediaDescription):
        (WebCore::PeerMediaDescription::type):
        (WebCore::PeerMediaDescription::setType):
        (WebCore::PeerMediaDescription::port):
        (WebCore::PeerMediaDescription::setPort):
        (WebCore::PeerMediaDescription::address):
        (WebCore::PeerMediaDescription::setAddress):
        (WebCore::PeerMediaDescription::mode):
        (WebCore::PeerMediaDescription::setMode):
        (WebCore::PeerMediaDescription::payloads):
        (WebCore::PeerMediaDescription::addPayload):
        (WebCore::PeerMediaDescription::setPayloads):
        (WebCore::PeerMediaDescription::rtcpMux):
        (WebCore::PeerMediaDescription::setRtcpMux):
        (WebCore::PeerMediaDescription::rtcpAddress):
        (WebCore::PeerMediaDescription::setRtcpAddress):
        (WebCore::PeerMediaDescription::rtcpPort):
        (WebCore::PeerMediaDescription::setRtcpPort):
        (WebCore::PeerMediaDescription::mediaStreamId):
        (WebCore::PeerMediaDescription::setMediaStreamId):
        (WebCore::PeerMediaDescription::mediaStreamTrackId):
        (WebCore::PeerMediaDescription::setMediaStreamTrackId):
        (WebCore::PeerMediaDescription::dtlsSetup):
        (WebCore::PeerMediaDescription::setDtlsSetup):
        (WebCore::PeerMediaDescription::dtlsFingerprintHashFunction):
        (WebCore::PeerMediaDescription::setDtlsFingerprintHashFunction):
        (WebCore::PeerMediaDescription::dtlsFingerprint):
        (WebCore::PeerMediaDescription::setDtlsFingerprint):
        (WebCore::PeerMediaDescription::cname):
        (WebCore::PeerMediaDescription::setCname):
        (WebCore::PeerMediaDescription::ssrcs):
        (WebCore::PeerMediaDescription::addSsrc):
        (WebCore::PeerMediaDescription::clearSsrcs):
        (WebCore::PeerMediaDescription::iceUfrag):
        (WebCore::PeerMediaDescription::setIceUfrag):
        (WebCore::PeerMediaDescription::icePassword):
        (WebCore::PeerMediaDescription::setIcePassword):
        (WebCore::PeerMediaDescription::iceCandidates):
        (WebCore::PeerMediaDescription::addIceCandidate):
        (WebCore::PeerMediaDescription::source):
        (WebCore::PeerMediaDescription::setSource):
        (WebCore::PeerMediaDescription::clone):
        (WebCore::PeerMediaDescription::PeerMediaDescription):

2016-02-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Implement Fetch API Response
        https://bugs.webkit.org/show_bug.cgi?id=154536

        Reviewed by Alex Christensen.

        Tests: imported/w3c/web-platform-tests/fetch/api/response/response-clone.html
               imported/w3c/web-platform-tests/fetch/api/response/response-consume.html
               imported/w3c/web-platform-tests/fetch/api/response/response-error.html
               imported/w3c/web-platform-tests/fetch/api/response/response-idl.html
               imported/w3c/web-platform-tests/fetch/api/response/response-init-001.html
               imported/w3c/web-platform-tests/fetch/api/response/response-init-002.html
               imported/w3c/web-platform-tests/fetch/api/response/response-static-error.html
               imported/w3c/web-platform-tests/fetch/api/response/response-static-redirect.html

        Adding Fetch Response as FetchResponse class.
        Constructor uses a built-in to pre-process the parameters.
        Support of body as ReadableStream is missing.

        * CMakeLists.txt:
        * DerivedSources.make:
        * Modules/fetch/FetchBody.h:
        (WebCore::FetchBody::empty):
        * Modules/fetch/FetchResponse.cpp: Added.
        (WebCore::JSFetchResponse::body):
        (WebCore::isRedirectStatus):
        (WebCore::isNullBodyStatus):
        (WebCore::FetchResponse::error):
        (WebCore::FetchResponse::redirect):
        (WebCore::FetchResponse::initializeWith):
        (WebCore::FetchResponse::FetchResponse):
        (WebCore::FetchResponse::clone):
        (WebCore::FetchResponse::type):
        * Modules/fetch/FetchResponse.h: Added.
        (WebCore::FetchResponse::create):
        (WebCore::FetchResponse::redirect):
        (WebCore::FetchResponse::url):
        (WebCore::FetchResponse::redirected):
        (WebCore::FetchResponse::status):
        (WebCore::FetchResponse::ok):
        (WebCore::FetchResponse::statusText):
        (WebCore::FetchResponse::headers):
        (WebCore::FetchResponse::isDisturbed):
        (WebCore::FetchResponse::arrayBuffer):
        (WebCore::FetchResponse::formData):
        (WebCore::FetchResponse::blob):
        (WebCore::FetchResponse::json):
        (WebCore::FetchResponse::text):
        * Modules/fetch/FetchResponse.idl: Added.
        * Modules/fetch/FetchResponse.js: Added.
        (initializeFetchResponse):
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/WebCoreJSBuiltins.cpp:
        * bindings/js/WebCoreJSBuiltins.h:
        (WebCore::JSBuiltinFunctions::JSBuiltinFunctions):
        (WebCore::JSBuiltinFunctions::fetchResponseBuiltins):

2016-02-24  Ryosuke Niwa  <rniwa@webkit.org>

        A function named canTakeNextToken executing blocking scripts is misleading
        https://bugs.webkit.org/show_bug.cgi?id=154636

        Reviewed by Darin Adler.

        Merged canTakeNextToken into pumpTokenizer and extracted pumpTokenizerLoop out of pumpTokenizer.

        Inlined m_parserChunkSize in HTMLParserScheduler into checkForYieldBeforeToken, and removed needsYield
        from PumpSession in favor of making checkForYieldBeforeToken and checkForYieldBeforeScript return a bool.

        No new tests since this is a pure refactoring.

        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::canTakeNextToken): Deleted.
        (WebCore::HTMLDocumentParser::pumpTokenizerLoop): Extracted from pumpTokenizer. We don't have to check
        isStopped() at the beginning since pumpTokenizer asserts that. Return true when session.needsYield would
        have been set to true in the old code and return false elsewhere (for stopping or incomplete token).
        (WebCore::HTMLDocumentParser::pumpTokenizer):
        * html/parser/HTMLDocumentParser.h:
        * html/parser/HTMLParserScheduler.cpp:
        (WebCore::PumpSession::PumpSession):
        (WebCore::HTMLParserScheduler::HTMLParserScheduler):
        (WebCore::HTMLParserScheduler::shouldYieldBeforeExecutingScript): Renamed from checkForYieldBeforeScript.
        * html/parser/HTMLParserScheduler.h:
        (WebCore::HTMLParserScheduler::shouldYieldBeforeToken): Renamed from checkForYieldBeforeToken.
        (WebCore::HTMLParserScheduler::isScheduledForResume):
        (WebCore::HTMLParserScheduler::checkForYield): Extracted from checkForYieldBeforeToken. Reset
        processedTokens to 1 instead of setting it to 0 here and incrementing it later as done in the old code.

2016-02-24  Daniel Bates  <dabates@apple.com>

        CSP: Enable plugin-types directive by default
        https://bugs.webkit.org/show_bug.cgi?id=154420
        <rdar://problem/24730322>

        Reviewed by Brent Fulgham.

        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::isExperimentalDirectiveName): Move plugin-types from the directives considered
        experimental to...
        (WebCore::isCSPDirectiveName): ...the list of standard directives.
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Move logic to parse the plugin-types
        directive outside the ENABLE(CSP_NEXT) macro guarded section/experimental feature runtime flag.

2016-02-24  Ryan Haddad  <ryanhaddad@apple.com>

        Speculative fix for ios build.

        Unreviewed build fix.

        * bindings/objc/DOM.mm:
        (-[DOMNode nextFocusNode]):
        (-[DOMNode previousFocusNode]):

2016-02-24  Zalan Bujtas  <zalan@apple.com>

        Background of an absolutely positioned inline element inside text-indented parent is positioned statically.
        https://bugs.webkit.org/show_bug.cgi?id=154019

        Reviewed by Simon Fraser.

        This patch ensures that statically positioned out-of-flow renderers are also text-aligned
        even when none of the renderers on the first line generate a linebox (so we end up with no bidi runs at all).
        The fix is to pass IndentTextOrNot information to startAlignedOffsetForLine through updateStaticInlinePositionForChild
        so that we can compute the left position for this statically positioned out of flow renderer.

        Test: fast/css3-text/css3-text-indent/text-indent-with-absolute-pos-child.html

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::adjustPositionedBlock):
        (WebCore::RenderBlockFlow::updateStaticInlinePositionForChild):
        * rendering/RenderBlockFlow.h:
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
        (WebCore::RenderBlockFlow::startAlignedOffsetForLine):
        * rendering/line/LineBreaker.cpp:
        (WebCore::LineBreaker::skipTrailingWhitespace):
        (WebCore::LineBreaker::skipLeadingWhitespace):
        * rendering/line/LineInlineHeaders.h: webkit.org/b/154628 fixes the bool vs IndentTextOrNot issue.
        (WebCore::setStaticPositions):

2016-02-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove IteratorKey and IteratorValue declarations from JSXX class declarations.
        https://bugs.webkit.org/show_bug.cgi?id=154577

        Reviewed by Myles C. Maxfield.

        No change of behavior.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader): Deleted declaration of IteratorKey and IteratorValue.
        * bindings/scripts/test/JS/JSTestObj.h:
        (WebCore::JSTestObj::createStructure): Rebasing of binding test expectation.

2016-02-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Refactor FetchHeaders initialization with iterators
        https://bugs.webkit.org/show_bug.cgi?id=154537

        Reviewed by Darin Adler.

        Covered by existing tests.

        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::initializeWith): Deleted.
        * Modules/fetch/FetchHeaders.h: Removed FetchHeaders::initializeWith.
        * Modules/fetch/FetchHeaders.idl: Ditto.
        * Modules/fetch/FetchHeaders.js:
        (initializeFetchHeaders): Making use of iterators to fill headers.

2016-02-24  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GObject DOM bindings API break after r196998.

        webkit_dom_node_clone_node can now raise exceptions, so rename it
        as webkit_dom_node_clone_node_with_error and deprecate the old one
        that calls the new one ignoring the error.

        * bindings/gobject/WebKitDOMDeprecated.cpp:
        (webkit_dom_node_clone_node):
        * bindings/gobject/WebKitDOMDeprecated.h:
        * bindings/gobject/WebKitDOMDeprecated.symbols:
        * bindings/gobject/webkitdom.symbols:
        * bindings/scripts/CodeGeneratorGObject.pm:
        (FunctionUsedToNotRaiseException):
        (GenerateFunction):

2016-02-24  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r195949): [GTK] Test /webkit2/WebKitWebView/insert/link is failing since r195949
        https://bugs.webkit.org/show_bug.cgi?id=153747

        Reviewed by Michael Catanzaro.

        Do not return early when reaching a boundary if there's a range
        selection. In that case, the selection will be cleared and
        accessibility will be notified.

        Test: editing/selection/move-to-line-boundary-clear-selection.html

        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::modify):

2016-02-24  Alejandro G. Castro  <alex@igalia.com>

        [Gstreamer] Mediaplayer should observe the tracks and not the source
        https://bugs.webkit.org/show_bug.cgi?id=154582

        Reviewed by Philippe Normand.

        We have to observe the track objects that define the
        mediastream. Replace the source attributes with the new tracks and
        use them properly in the class.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.cpp:
        (WebCore::MediaPlayerPrivateGStreamerOwr::~MediaPlayerPrivateGStreamerOwr):
        Make sure we are not observing anymore the tracks after
        destruction.
        (WebCore::MediaPlayerPrivateGStreamerOwr::hasVideo): Used the track
        instead of the source.
        (WebCore::MediaPlayerPrivateGStreamerOwr::hasAudio): Ditto.
        (WebCore::MediaPlayerPrivateGStreamerOwr::currentTime): Ditto.
        (WebCore::MediaPlayerPrivateGStreamerOwr::internalLoad): Ditto.
        (WebCore::MediaPlayerPrivateGStreamerOwr::stop): Ditto.
        (WebCore::MediaPlayerPrivateGStreamerOwr::trackEnded): Added, new
        track observer API, make sure we disable the ended tracks.
        (WebCore::MediaPlayerPrivateGStreamerOwr::trackMutedChanged):
        Added, new track observer API.
        (WebCore::MediaPlayerPrivateGStreamerOwr::trackSettingsChanged):
        Added, new track observer API.
        (WebCore::MediaPlayerPrivateGStreamerOwr::trackEnabledChanged):
        Added, new track observer API.
        (WebCore::MediaPlayerPrivateGStreamerOwr::sourceStopped): Deleted,
        source observer API.
        (WebCore::MediaPlayerPrivateGStreamerOwr::sourceMutedChanged):
        Deleted, source observer API.
        (WebCore::MediaPlayerPrivateGStreamerOwr::sourceSettingsChanged):
        Deleted, source observer API.
        (WebCore::MediaPlayerPrivateGStreamerOwr::preventSourceFromStopping):
        Deleted, source observer API.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.h:
        Replaced the attributes representing the source with the tracks
        and added the new track observer functions.

2016-02-23  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Swap the order of columns/rows in grid-gap shorthand
        https://bugs.webkit.org/show_bug.cgi?id=154584

        The latest editor's draft have just changed the order. Now it
        should be <grid-row-gap> <grid-column-gap>?.

        Reviewed by Darin Adler.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridGapShorthand):
        * css/CSSPropertyNames.in:

2016-02-24  Ryosuke Niwa  <rniwa@webkit.org>

        Move FocusNavigationScope into FocusController.cpp
        https://bugs.webkit.org/show_bug.cgi?id=154630

        Reviewed by Darin Adler.

        Moved FocusNavigationScope from FocusController.h to FocusController.cpp.

        * bindings/objc/DOM.mm:
        (-[DOMNode nextFocusNode]):
        (-[DOMNode previousFocusNode]):
        * page/FocusController.cpp:
        (WebCore::parentInScope):
        (WebCore::FocusNavigationScope::firstChildInScope): Moved into FocusNavigationScope.
        (WebCore::FocusNavigationScope::lastChildInScope): Ditto.
        (WebCore::FocusNavigationScope::nextInScope): Ditto.
        (WebCore::FocusNavigationScope::previousInScope): Ditto.
        (WebCore::FocusController::findFocusableElementAcrossFocusScope):
        (WebCore::FocusController::findFocusableElementRecursively):
        (WebCore::FocusController::findFocusableElement):
        (WebCore::nextElementWithGreaterTabIndex):
        (WebCore::previousElementWithLowerTabIndex):
        (WebCore::FocusController::nextFocusableElement): Added a variant for DOM.mm and WebPageIOS.mm.
        (WebCore::FocusController::previousFocusableElement): Ditto.
        (WebCore::FocusController::nextFocusableElement):
        (WebCore::FocusController::previousFocusableElement): Use if instead of for loop for clarity.
        * page/FocusController.h:

2016-02-24  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: RTCPeerConnection: Sort out responsibilities of close() and stop()
        https://bugs.webkit.org/show_bug.cgi?id=154581

        Reviewed by Eric Carlson.

        Let RTCPeerConnection::close() contain all teardown logic be called by stop().
        close() is also responisble for stopping the PeerConnectionBackend and stopping
        all RTCRtpSender objects.

        Test coverage:
        fast/mediastream/RTCRtpSender-replaceTrack.html (updated)
        fast/mediastream/RTCPeerConnection-closed-state.html

        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::close):
        (WebCore::RTCPeerConnection::stop):
        (WebCore::RTCPeerConnection::RTCPeerConnection): Deleted.
        * Modules/mediastream/RTCPeerConnection.h:

2016-02-24  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Add addReceiver() function to PeerConnectionBackendClient interface
        https://bugs.webkit.org/show_bug.cgi?id=154583

        Reviewed by Eric Carlson.

        The addRecevier() notifies the PeerConnectionBackendClient that a new RTCRtpReceiver,
        representing an MediaStreamTrack received from a remote peer, is added.

        * Modules/mediastream/PeerConnectionBackend.h:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::addReceiver):
        * Modules/mediastream/RTCPeerConnection.h:

2016-02-23  Olivier Blin  <olivier.blin@softathome.com>

        Support building LocaleICU with light ICU (UCONFIG_NO_FORMATTING)
        https://bugs.webkit.org/show_bug.cgi?id=154484

        Reviewed by Darin Adler.

        In this mode, this makes LocaleICU with UCONFIG_NO_FORMATTING
        essentially the same as LocaleNone, but allows to keep using ICU for
        other features.

        * platform/text/LocaleICU.cpp:
        (WebCore::LocaleICU::LocaleICU):
        (WebCore::LocaleICU::~LocaleICU):
        (WebCore::LocaleICU::initializeLocaleData):
        * platform/text/LocaleICU.h:

2016-02-23  Myles C. Maxfield  <mmaxfield@apple.com>

        Remove dead FontLoader code
        https://bugs.webkit.org/show_bug.cgi?id=154625

        Reviewed by Darin Adler.

        This code has been replaced by FontFaceSet.

        No new tests because there is no behavior change.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSAllInOne.cpp:
        * css/FontLoader.cpp: Removed.
        (WebCore::LoadFontCallback::create): Deleted.
        (WebCore::LoadFontCallback::createFromParams): Deleted.
        (WebCore::LoadFontCallback::~LoadFontCallback): Deleted.
        (WebCore::LoadFontCallback::familyCount): Deleted.
        (WebCore::LoadFontCallback::LoadFontCallback): Deleted.
        (WebCore::LoadFontCallback::notifyLoaded): Deleted.
        (WebCore::LoadFontCallback::notifyError): Deleted.
        (WebCore::FontLoader::loadFontDone): Deleted.
        (WebCore::FontLoader::FontLoader): Deleted.
        (WebCore::FontLoader::~FontLoader): Deleted.
        (WebCore::FontLoader::eventTargetData): Deleted.
        (WebCore::FontLoader::ensureEventTargetData): Deleted.
        (WebCore::FontLoader::eventTargetInterface): Deleted.
        (WebCore::FontLoader::scriptExecutionContext): Deleted.
        (WebCore::FontLoader::didLayout): Deleted.
        (WebCore::FontLoader::activeDOMObjectName): Deleted.
        (WebCore::FontLoader::canSuspendForDocumentSuspension): Deleted.
        (WebCore::FontLoader::scheduleEvent): Deleted.
        (WebCore::FontLoader::firePendingEvents): Deleted.
        (WebCore::FontLoader::beginFontLoading): Deleted.
        (WebCore::FontLoader::fontLoaded): Deleted.
        (WebCore::FontLoader::loadError): Deleted.
        (WebCore::FontLoader::notifyWhenFontsReady): Deleted.
        (WebCore::FontLoader::loadingDone): Deleted.
        (WebCore::FontLoader::loadFont): Deleted.
        (WebCore::FontLoader::checkFont): Deleted.
        (WebCore::applyPropertyToCurrentStyle): Deleted.
        (WebCore::FontLoader::resolveFontStyle): Deleted.
        * css/FontLoader.h: Removed.
        * css/FontLoader.idl: Removed.
        * page/FrameView.cpp:

2016-02-23  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo][MediaFoundation] Implement methods to set volume.
        https://bugs.webkit.org/show_bug.cgi?id=154580

        Reviewed by Alex Christensen.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::paused):
        (WebCore::MediaPlayerPrivateMediaFoundation::setVolume):
        (WebCore::MediaPlayerPrivateMediaFoundation::supportsMuting):
        (WebCore::MediaPlayerPrivateMediaFoundation::setMuted):
        (WebCore::MediaPlayerPrivateMediaFoundation::networkState):
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:

2016-02-23  Chris Dumez  <cdumez@apple.com>

        [Reflected] IDL attributes of integer types should use HTML rules for parsing integers
        https://bugs.webkit.org/show_bug.cgi?id=154573

        Reviewed by Darin Adler.

        [Reflected] IDL attributes of integer types should use HTML rules for
        parsing integers:
        - https://html.spec.whatwg.org/#reflecting-content-attributes-in-idl-attributes

        Those rules are defined here:
        - https://html.spec.whatwg.org/#rules-for-parsing-integers
        - https://html.spec.whatwg.org/#rules-for-parsing-non-negative-integers

        We already had an implementation for parsing HTML integers but our reflected
        attributes currently use WTFString::toInt() / toUint() instead.

        No new tests, already covered by existing tests.

        * dom/Element.cpp:
        (WebCore::Element::getIntegralAttribute):
        This method used by the bindings only, for reflected IDL attributed of
        type 'long'. Now call parseHTMLInteger() instead of String::toInt() to
        parse the content attribute as per the HTML specification.

        (WebCore::Element::getUnsignedIntegralAttribute):
        This method used by the bindings only, for reflected IDL attributed of
        type 'unsigned long'. Now call parseHTMLNonNegativeInteger() instead of
        String::toUInt() to parse the content attribute as per the HTML
        specification.

        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::parseHTMLIntegerInternal):
        Fix a bug in our implementation of parseHTMLIntegerInternal() that
        would cause the string "−2147483648" to be parsed as 0. It should
        be parsed as −2147483648, which is in the valid range as per:
        http://heycam.github.io/webidl/#idl-long

2016-02-23  Chris Dumez  <cdumez@apple.com>

        Align our implementation of Range.createContextualFragment with the specification
        https://bugs.webkit.org/show_bug.cgi?id=154627

        Reviewed by Ryosuke Niwa.

        Align our implementation of Range.createContextualFragment with the
        specification:
        - https://w3c.github.io/DOM-Parsing/#widl-Range-createContextualFragment-DocumentFragment-DOMString-fragment

        In particular, if the Range's start node is a Document / DocumentFragment,
        we now create a new HTMLBodyElement and use it as context element, instead
        of throwing an exception.

        This also aligns our behavior with Firefox and Chrome.

        Tests: imported/blink/fast/dom/Range/create-contextual-fragment-from-bodyless-document-range.html
               imported/blink/fast/dom/Range/create-contextual-fragment-from-detached-text-node-range.html
               imported/blink/fast/dom/Range/create-contextual-fragment-from-document-fragment-range.html
               imported/blink/fast/dom/Range/create-contextual-fragment-from-document-range.html
               imported/blink/fast/dom/Range/create-contextual-fragment-from-xhtml-document-range.xhtml
               imported/blink/fast/dom/Range/create-contextual-fragment-script-not-ran.html
               imported/blink/fast/dom/Range/create-contextual-fragment-script-unmark-already-started.html

        * dom/Range.cpp:
        (WebCore::Range::createContextualFragment):

2016-02-23  Dan Bernstein  <mitz@apple.com>

        [Xcode] Linker errors display mangled names, but no longer should
        https://bugs.webkit.org/show_bug.cgi?id=154632

        Reviewed by Sam Weinig.

        * Configurations/Base.xcconfig: Stop setting LINKER_DISPLAYS_MANGLED_NAMES to YES.

2016-02-23  Dean Jackson  <dino@apple.com>

        [WebGL] iOS doesn't respect the alpha:false context creation attribute
        https://bugs.webkit.org/show_bug.cgi?id=154617
        <rdar://problem/13417023>

        Reviewed by Sam Weinig.

        On iOS we were not respecting the alpha:false context creation
        attribute, which meant you always got output that could
        have an alpha channel.

        The good news is that now we're setting the opaque flag on
        the CALayer, there should be a performance improvement when
        compositing WebGL into the page.

        Test: fast/canvas/webgl/context-attributes-alpha.html

        * platform/graphics/mac/GraphicsContext3DMac.mm:
        (WebCore::GraphicsContext3D::GraphicsContext3D): Don't tell the layer
        to be transparent.
        (WebCore::GraphicsContext3D::setRenderbufferStorageFromDrawable): Do it
        here instead, but based on the value of the alpha attribute.

2016-02-23  Daniel Bates  <dabates@apple.com>

        CSP: Enable base-uri directive by default
        https://bugs.webkit.org/show_bug.cgi?id=154521
        <rdar://problem/24762032>

        Reviewed by Brent Fulgham.

        Tests: http/tests/security/contentSecurityPolicy/1.1/base-uri-default-ignored.html
               http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-base-uri-deny.html

        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::isExperimentalDirectiveName): Move base-uri from the directives considered
        experimental to...
        (WebCore::isCSPDirectiveName): ...the list of standard directives.
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Move logic to parse the base-uri
        directive outside the ENABLE(CSP_NEXT) macro guarded section/experimental feature runtime flag.

2016-02-23  Gavin Barraclough  <barraclough@apple.com>

        Remove HIDDEN_PAGE_DOM_TIMER_THROTTLING feature define
        https://bugs.webkit.org/show_bug.cgi?id=112323

        Reviewed by Chris Dumez.

        This feature is controlled by a runtime switch, and defaults off.

        * Configurations/FeatureDefines.xcconfig:
        * page/Page.cpp:
        (WebCore::Page::setTimerThrottlingEnabled):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        (WebCore::Settings::shouldRespectPriorityInCSSAttributeSetters):
        (WebCore::Settings::setHiddenPageDOMTimerThrottlingEnabled):
        (WebCore::Settings::setHiddenPageDOMTimerThrottlingAutoIncreases):
        * page/Settings.h:
        (WebCore::Settings::layoutInterval):
        (WebCore::Settings::hiddenPageDOMTimerThrottlingEnabled):
        (WebCore::Settings::hiddenPageDOMTimerThrottlingAutoIncreases):

2016-02-23  Gavin Barraclough  <barraclough@apple.com>

        Add a mechanism to automatically ramp up timer alignment.
        https://bugs.webkit.org/show_bug.cgi?id=154578

        Reviewed by Antti Koivisto & Chris Dumez.

        Allow timer alignment duration to be proportional to the time the page
        has been hidden. This implementation does so by scaling up the throttle
        in exponential steps, spaced exponentially far apart.

        * page/Page.cpp:
        (WebCore::Page::Page):
            - initialize timer.
        (WebCore::Page::hiddenPageDOMTimerThrottlingStateChanged):
            - if setting are changed fully disable/reenable to ensure new setting are read.
        (WebCore::Page::setTimerThrottlingEnabled):
            - enebled bool flag converted to an Optional<double>, tracking time throttling
              is enabled.
        (WebCore::Page::setDOMTimerAlignmentInterval):
            - when new mechanism is enabled schedule a timer to step up alignment.
        (WebCore::Page::timerAlignmentIntervalIncreaseTimerFired):
            - when timer fires increase alignment.
        * page/Page.h:
            - added new member.
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
            - initialize new member.
        (WebCore::Settings::setHiddenPageDOMTimerThrottlingAutoIncreaseLimit):
            - added, update new setting. Setting to zero disabled. A non-zero value is a
              duration in seconds for timer throttling to ramp up to.
        * page/Settings.h:
        (WebCore::Settings::hiddenPageDOMTimerThrottlingAutoIncreases):
            - read as boolean whether throttle increasing is enabled.
        (WebCore::Settings::hiddenPageDOMTimerThrottlingAutoIncreaseLimit):
            - read throttle increasing limit.

2016-02-22  Ada Chan  <adachan@apple.com>

        Refactor script that updates fullscreen buttons.
        https://bugs.webkit.org/show_bug.cgi?id=154562

        Reviewed by Dean Jackson.

        Also expose extra property and element in getCurrentControlsStatus() for future testing.

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.updatePictureInPictureButton):
        (Controller.prototype.updateFullscreenButtons):

2016-02-22  Ryosuke Niwa  <rniwa@webkit.org>

        Calling importNode on shadow root causes a crash
        https://bugs.webkit.org/show_bug.cgi?id=154570

        Reviewed by Anders Carlsson.

        The bug was caused by a missing check in cloneNode. Added cloneNodeForBindings to explicitly throw
        an NotSupportedError when it's called on a shadow root. We don't clone shadow root when deep-cloning
        the tree so we don't have to check that condition.

        The behavior of cloneNode is specified at:
        http://w3c.github.io/webcomponents/spec/shadow/#the-shadowroot-interface
        (it current says we should throw DATA_CLONE_ERR but I have an spec bug filed at
        https://github.com/w3c/webcomponents/issues/393)

        The behavior of importNode and adoptNode are specified in DOM4 specification:
        https://dom.spec.whatwg.org/#dom-document-importnode
        https://dom.spec.whatwg.org/#dom-document-adoptnode

        Tests: fast/shadow-dom/Document-prototype-adoptNode.html
               fast/shadow-dom/Document-prototype-importNode.html
               fast/shadow-dom/Node-prototype-cloneNode.html

        * dom/Document.cpp:
        (WebCore::Document::importNode): Throw NotSupportedError when importing a shadow root.
        * dom/Node.cpp:
        (WebCore::Node::cloneNodeForBindings): Added.
        * dom/Node.h:
        * dom/Node.idl: Use cloneNodeForBindings here.

2016-02-23  Daniel Bates  <dabates@apple.com>

        REGRESSION (r196892): No longer emit error message when CSP form-action directive is used as a source expression
        https://bugs.webkit.org/show_bug.cgi?id=154555
        <rdar://problem/24776777>

        Reviewed by Andy Estes.

        Fixes an issue where an error message is not emitted when directive form-action is used as a
        source expression. Prior to <http://trac.webkit.org/changeset/196892>, when directive form-action
        was used as a source expression a console error message would be emitted with the form:

            The Content Security Policy directive 'script-src' contains 'form-action' as a source expression.
            Did you mean 'script-src ...; form-action...' (note the semicolon)?

        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::isCSPDirectiveName): Return true if the specified directive name is "form-action".

2016-02-23  Simon Fraser  <simon.fraser@apple.com>

        Lay the groundwork for more constness in StyleResolver-related code
        https://bugs.webkit.org/show_bug.cgi?id=154598

        Reviewed by Antti Koivisto.

        Make some of the leaf functions that are used by the style resolver take 
        const CSSValues, and use 'auto' more to automatically get const stack variables
        when appropriate.

        * css/CSSBorderImageSliceValue.h:
        (WebCore::CSSBorderImageSliceValue::slices):
        * css/CSSPrimitiveValue.h:
        (WebCore::CSSPrimitiveValue::isQuirkValue):
        * css/FontVariantBuilder.cpp:
        (WebCore::extractFontVariantLigatures):
        (WebCore::extractFontVariantNumeric):
        (WebCore::extractFontVariantEastAsian):
        * css/FontVariantBuilder.h:
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertReflection):
        (WebCore::StyleBuilderConverter::convertGridAutoFlow):
        * css/StyleBuilderCustom.h:
        (WebCore::StyleBuilderCustom::applyValueSize):
        (WebCore::StyleBuilderCustom::applyValueStroke):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::colorFromPrimitiveValueIsDerivedFromElement):
        (WebCore::StyleResolver::colorFromPrimitiveValue):
        (WebCore::StyleResolver::createFilterOperations):
        * css/StyleResolver.h:
        * css/TransformFunctions.cpp:
        (WebCore::transformsForValue):
        * css/TransformFunctions.h:
        * rendering/style/StylePendingImage.h:
        * svg/SVGLength.cpp:
        (WebCore::SVGLength::fromCSSPrimitiveValue):
        * svg/SVGLength.h:

2016-02-23  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Avoid duplicated calls to resolution code
        https://bugs.webkit.org/show_bug.cgi?id=154336

        Reviewed by Sergio Villar Senin.

        We were calling GridResolvedPosition::resolveGridPositionsFromStyle()
        several times per item.

        We can store the GridCoordinates in
        RenderGrid::populateExplicitGridAndOrderIterator()
        and reuse them in the placement code.
        Once RenderGrid::placeItemsOnGrid() is over,
        all the items will have a definite position in both axis.

        No new tests, no change of behavior.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::insertItemIntoGrid):
        (WebCore::RenderGrid::placeItemsOnGrid):
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        (WebCore::RenderGrid::cachedGridCoordinate):
        (WebCore::RenderGrid::cachedGridSpan):
        * rendering/RenderGrid.h:

2016-02-23  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Rows track sizes are optional in grid-template shorthand
        https://bugs.webkit.org/show_bug.cgi?id=154586

        Reviewed by Sergio Villar Senin.

        You can omit the size of the rows in grid-template shorthand,
        even if you specify a named grid line for the end of the row,
        due to a change in the spec back in 2014:
        https://github.com/w3c/csswg-drafts/commit/9f660c4183c73c1f5279c46904dc6cb314f76194

        Before if you want to specify a named grid line,
        you need to set the row size.

        Update parsing, so it nows accepts things like:
            grid-template: 100px / "a" [bottom];

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateRowsAndAreasAndColumns):
        (WebCore::CSSParser::parseGridTemplateShorthand):

2016-02-23  Nikos Andronikos  <nikos.andronikos-webkit@cisra.canon.com.au>

        [SVG] Update SVG source to return string literals as ASCIILiteral and add test cases for case sensitivity
        https://bugs.webkit.org/show_bug.cgi?id=154373

        Reviewed by Youenn Fablet.

        Update SVGAnimatedEnumeration toString method to return ASCIILiteral for string literals and add test cases for
        case-sensitivity for these elements.

        Test: svg/dom/SVGAnimatedEnumeration-case-sensitive.html

        * svg/SVGComponentTransferFunctionElement.h:
        (WebCore::SVGPropertyTraits<ComponentTransferType>::toString):
        * svg/SVGFEBlendElement.h:
        (WebCore::SVGPropertyTraits<BlendMode>::toString):
        * svg/SVGFEColorMatrixElement.h:
        (WebCore::SVGPropertyTraits<ColorMatrixType>::toString):
        * svg/SVGFECompositeElement.h:
        (WebCore::SVGPropertyTraits<CompositeOperationType>::toString):
        * svg/SVGFEConvolveMatrixElement.h:
        (WebCore::SVGPropertyTraits<EdgeModeType>::toString):
        * svg/SVGFEDisplacementMapElement.h:
        (WebCore::SVGPropertyTraits<ChannelSelectorType>::toString):
        * svg/SVGFEMorphologyElement.h:
        (WebCore::SVGPropertyTraits<MorphologyOperatorType>::toString):
        * svg/SVGFETurbulenceElement.h:
        (WebCore::SVGPropertyTraits<SVGStitchOptions>::toString):
        (WebCore::SVGPropertyTraits<TurbulenceType>::toString):
        * svg/SVGGradientElement.h:
        (WebCore::SVGPropertyTraits<SVGSpreadMethodType>::toString):
        * svg/SVGMarkerElement.h:
        (WebCore::SVGPropertyTraits<SVGMarkerUnitsType>::toString):
        * svg/SVGTextContentElement.h:
        (WebCore::SVGPropertyTraits<SVGLengthAdjustType>::toString):
        * svg/SVGTextPathElement.h:
        (WebCore::SVGPropertyTraits<SVGTextPathMethodType>::toString):
        (WebCore::SVGPropertyTraits<SVGTextPathSpacingType>::toString):
        * svg/SVGUnitTypes.h:
        (WebCore::SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::toString):

2016-02-23  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] Unreviewed speculative buildfix after r196779. Just for fun.

        * PlatformMac.cmake:

2016-02-23  Antti Koivisto  <antti@apple.com>

        Remove tab suspension code
        https://bugs.webkit.org/show_bug.cgi?id=154585

        Reviewed by Andreas Kling.

        It causes too many problems.

        * page/Page.cpp:
        (WebCore::networkStateChanged):
        (WebCore::Page::Page):
        (WebCore::Page::setPageActivityState):
        (WebCore::Page::setIsVisible):
        (WebCore::Page::setIsVisibleInternal):
        (WebCore::Page::setIsPrerender):
        (WebCore::Page::setResourceUsageOverlayVisible):
        (WebCore::Page::canTabSuspend): Deleted.
        (WebCore::Page::setIsTabSuspended): Deleted.
        (WebCore::Page::setTabSuspensionEnabled): Deleted.
        (WebCore::Page::updateTabSuspensionState): Deleted.
        (WebCore::Page::tabSuspensionTimerFired): Deleted.
        * page/Page.h:
        (WebCore::Page::setEditable):
        (WebCore::Page::isEditable):
        (WebCore::Page::setShowAllPlugins):

2016-02-23  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Refactor DOM Iterator next signature
        https://bugs.webkit.org/show_bug.cgi?id=154531

        Reviewed by Myles C. Maxfield.

        Covered by existing tests.

        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::FetchHeaders::Iterator::next): Using Optional<KeyValuePair> to return iterator value.
        * Modules/fetch/FetchHeaders.h:
        * bindings/js/JSKeyValueIterator.h: Using Optional<KeyValuePair> as returned iterator value.
        (WebCore::keyValueIteratorForEach):
        (WebCore::JSKeyValueIterator<JSWrapper>::next):
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::Iterator::next): Using Optional<KeyValuePair> to return iterator value.
        * css/FontFaceSet.h:

2016-02-22  Gavin Barraclough  <barraclough@apple.com>

        Some timer alignment cleanup.
        https://bugs.webkit.org/show_bug.cgi?id=154559

        Reviewed by Chris Dumez.

        Document shouldn't override Page's timer alignment policy with a lower alignment,
        and m_domTimerAlignmentInterval isn't really a Settings, it's just the current state
        for the page.

        * dom/Document.cpp:
        (WebCore::Document::timerAlignmentInterval):
            - take the max of the possible intervals.
        * page/Page.cpp:
        (WebCore::Page::Page):
        (WebCore::Page::setTimerThrottlingEnabled):
        (WebCore::Page::setDOMTimerAlignmentInterval):
            - moved here from Settings.
        * page/Page.h:
        (WebCore::Page::domTimerAlignmentInterval):
            - moved here from Settings.
        * page/Settings.cpp:
        (WebCore::Settings::setDOMTimerAlignmentInterval): Deleted.
            - moved to Page.
        * page/Settings.h:
        (WebCore::Settings::domTimerAlignmentInterval): Deleted.
            - moved to Page.

2016-02-22  Myles C. Maxfield  <mmaxfield@apple.com>

        Font features specified in @font-face blocks don't apply to local() families
        https://bugs.webkit.org/show_bug.cgi?id=154554

        Reviewed by Dean Jackson.

        The correct variables just need to be wired up. In addition, our caches need to be sensitive
        to the new data.

        Test: css3/font-feature-font-face-local.html

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):
        * platform/graphics/FontCache.cpp:
        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
        (WebCore::FontPlatformDataCacheKey::operator==):
        (WebCore::FontPlatformDataCacheKeyHash::hash):
        (WebCore::FontCache::getCachedFontPlatformData):
        (WebCore::FontCache::fontForFamily):
        * platform/graphics/FontCache.h:
        * platform/graphics/FontFeatureSettings.h:
        (WebCore::FontFeature::operator!=):
        (WebCore::FontFeatureSettings::operator!=):
        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::fontWithFamily):
        (WebCore::FontCache::createFontPlatformData):
        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters):
        * platform/graphics/mac/FontCacheMac.mm:
        (WebCore::FontCache::lastResortFallbackFont):
        * platform/text/TextFlags.h:
        (WebCore::FontVariantSettings::operator==):
        (WebCore::FontVariantSettings::operator!=):
        (WebCore::FontVariantSettings::uniqueValue):

2016-02-22  Daniel Bates  <dabates@apple.com>

        REGRESSION (r196892): Crash in DocumentLoader::startLoadingMainResource()
        https://bugs.webkit.org/show_bug.cgi?id=154563
        <rdar://problem/24780678>

        Reviewed by Alexey Proskuryakov.

        Fixes an issue where the provisional loader may be deallocated when starting
        a load. One example where this can occur is when cancelling the provisional load
        as part of a form submission because the Content Security Policy of the page
        blocks the submission (it violates the directive form-action).

        This crash is covered by the test http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource): Take a ref before calling
        DocumentLoader::willSendRequest().

2016-02-16  Ada Chan  <adachan@apple.com>

        Implement basic functionality in WebVideoFullscreenInterfaceMac.
        https://bugs.webkit.org/show_bug.cgi?id=153241

        Reviewed by Beth Dakin.

        * platform/cocoa/WebVideoFullscreenInterface.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::setupFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::enterFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::exitFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::cleanupFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::invalidate):
        (WebCore::WebVideoFullscreenInterfaceMac::preparedToReturnToInline):

2016-02-22  Chris Dumez  <cdumez@apple.com>

        REGRESSION (r196563): Images not loading on https://klim.co.nz/blog/paypal-sans-design-information/
        https://bugs.webkit.org/show_bug.cgi?id=154547
        <rdar://problem/24772167>

        Reviewed by Gavin Barraclough.

        The Website was doing the following:
        $ var e = window.addEventListener;
        $ e("eventname", handler)

        In such case, the jsEventTargetPrototypeFunctionDispatchEvent() bindings
        implementation was caused with a thisValue which is a JSLexicalEnvironment
        and the implementation did not know how to convert it into a global object.
        The previous implementation on JSDOMWindow used to handle tis correctly
        because it was always calling JSValue::toThis() on the thisValue before
        trying to cast it to a JSDOMWindow, and JSLexicalEnvironment::toThis()
        gets the globalThisValue. This patch updates the EventTarget bindings
        code to call always call toThis() on the thisValue before trying to
        cast it. This should correctly deal with JSLexicalEnvironment and be a
        no-op in usual cases.

        No new tests, extended existing test.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateFunctionCastedThis):

2016-02-22  Simon Fraser  <simon.fraser@apple.com>

        Repeated background images have the wrong position when using bottom/right-relative background-position
        https://bugs.webkit.org/show_bug.cgi?id=154478

        Reviewed by Dave Hyatt.

        Fix RenderBoxModelObject::calculateBackgroundImageGeometry() to use the right position when
        painting repeated background images when right/bottom edges are used.

        Also rename BackgroundEdgeOrigin to Edge

        Test: fast/images/background-position.html

        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator Edge):
        (WebCore::CSSPrimitiveValue::operator BackgroundEdgeOrigin): Deleted.
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::resolveEdgeRelativeLength):
        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
        * rendering/style/FillLayer.cpp:
        (WebCore::FillLayer::FillLayer):
        * rendering/style/FillLayer.h:
        (WebCore::FillLayer::backgroundXOrigin):
        (WebCore::FillLayer::backgroundYOrigin):
        (WebCore::FillLayer::setBackgroundXOrigin):
        (WebCore::FillLayer::setBackgroundYOrigin):
        * rendering/style/RenderStyleConstants.cpp:
        (WebCore::operator<<):
        * rendering/style/RenderStyleConstants.h:

2016-02-22  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196935.
        https://bugs.webkit.org/show_bug.cgi?id=154557

        This change causes timeouts and crashes in LayoutTests
        (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "Enable AVFoundationNSURLSessionEnabled by default"
        https://bugs.webkit.org/show_bug.cgi?id=154469
        http://trac.webkit.org/changeset/196935

2016-02-22  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] Split CSSFontSelector into a FontFaceSet implementation and the rest of the class
        https://bugs.webkit.org/show_bug.cgi?id=153347

        Reviewed by Antti Koivisto.

        This patch implements the document.fonts Javascript object. It does so by briding the
        already-existing FontFaceSet Javascript object with the CSSFontSelector WebCore object.
        CSSFontSelector used to hold internal objects for each @font-face object in the
        Document. These objects have been moved into CSSFontFaceSet, so CSSFontSelector simply
        just owns an instance of a CSSFontFaceSet.

        The lifetime of the FontFace and FontFaceSet objects is a little interesting: because
        all the ownership references are inside the WebCore CSSFontFace{,Set} objects, the
        higher-level Javascript FontFace{,Set} objects are held through a WeakPtr. This means
        that if all the references to these higher-level objects go away, and you re-query the
        document for its FontFace objects, you may get a new object (albeit with the same
        state as a previous object). However, this won't occur if there are any references to
        the old object, which means it is almost not observable.

        This patch doesn't implement the relationship between the CSSOM and the FontFace
        objects. Changing one should result in a change in the other, but that will be
        implemented in a forthcoming patch.

        This patch also doesn't alter the lifetime of the CSSFontSelector, which means that all
        the Document's fonts may be destroyed and recreated from CSS. There are a few things
        which can trigger this. A subsequent patch will make the CSSFontSelector outlive the
        Document.

        This patch does implement (and test) the ability to add a new FontFace to the Document
        to cause a relayout, as well as changing properties of existing FontFace objects already
        in the Document to cause a relayout.

        Test: fast/text/font-face-set-document.html

        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::FetchHeaders::Iterator::next): Pass an extra argument.
        * Modules/fetch/FetchHeaders.h:
        * bindings/js/JSKeyValueIterator.h: The ExecState is necessary to build an external
        wrapper from an existing CSSFontFace object.
        (WebCore::JSKeyValueIterator<JSWrapper>::next):
        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::appendSources): Moved from CSSFontSelector.
        (WebCore::CSSFontFace::CSSFontFace):
        (WebCore::CSSFontFace::notifyClientsOfFontPropertyChange):
        (WebCore::CSSFontFace::setFamilies):
        (WebCore::CSSFontFace::calculateStyle): Shared code between CSSFontFaceSet and
        CSSFontFace.
        (WebCore::CSSFontFace::setStyle): Update to use calculateStyle().
        (WebCore::CSSFontFace::calculateWeight): Ditto.
        (WebCore::CSSFontFace::setWeight): Update to use caculateWeight().
        (WebCore::CSSFontFace::setUnicodeRange): Notify clients.
        (WebCore::CSSFontFace::setVariantLigatures): Ditto.
        (WebCore::CSSFontFace::setVariantPosition): Ditto.
        (WebCore::CSSFontFace::setVariantCaps): Ditto.
        (WebCore::CSSFontFace::setVariantNumeric): Ditto.
        (WebCore::CSSFontFace::setVariantAlternates): Ditto.
        (WebCore::CSSFontFace::setVariantEastAsian): Ditto.
        (WebCore::CSSFontFace::setFeatureSettings): Ditto.
        (WebCore::CSSFontFace::removeClient):
        (WebCore::CSSFontFace::wrapper): Build a new wrapper if one doesn't already
        exist. Note that this requires an ExecState to create a promise.
        (WebCore::CSSFontFace::setStatus):
        (WebCore::CSSFontFace::fontLoaded):
        (WebCore::CSSFontFace::pump):
        (WebCore::CSSFontFace::font):
        * css/CSSFontFace.h:
        * css/CSSFontFaceSet.cpp:
        (WebCore::CSSFontFaceSet::CSSFontFaceSet): Moved code from CSSFontSelector.
        (WebCore::CSSFontFaceSet::~CSSFontFaceSet):
        (WebCore::CSSFontFaceSet::addClient): This object can now have multiple
        clients.
        (WebCore::CSSFontFaceSet::removeClient):
        (WebCore::CSSFontFaceSet::incrementActiveCount): Update for multiple clients.
        (WebCore::CSSFontFaceSet::decrementActiveCount): Ditto.
        (WebCore::CSSFontFaceSet::hasFace):
        (WebCore::CSSFontFaceSet::registerLocalFontFacesForFamily): Moved from
        CSSFontSelector.
        (WebCore::CSSFontFaceSet::familyNameFromPrimitive): Ditto.
        (WebCore::CSSFontFaceSet::addToFacesLookupTable): This helper function can
        be used when a property of a FontFace is changed.
        (WebCore::CSSFontFaceSet::add): Update to use addToFacesLookupTable().
        (WebCore::CSSFontFaceSet::removeFromFacesLookupTable): Same as
        addToFacesLookupTable().
        (WebCore::CSSFontFaceSet::remove): Update to use removeFromFacesLookupTable().
        (WebCore::CSSFontFaceSet::clear):
        (WebCore::CSSFontFaceSet::operator[]):
        (WebCore::computeFontTraitsMask): Moved from CSSFontSelector.
        (WebCore::CSSFontFaceSet::matchingFaces): Update to use new data structures.
        (WebCore::FontFaceComparator::FontFaceComparator): Moved from
        CSSFontSelector.
        (WebCore::FontFaceComparator::operator()):
        (WebCore::CSSFontFaceSet::getFontFace): Update to use new data structures.
        (WebCore::CSSFontFaceSet::fontStateChanged): Update to use multiple clients.
        (WebCore::CSSFontFaceSet::fontPropertyChanged): We must update our internal
        data structure if the family name changed.
        (WebCore::extractFamilies): Deleted.
        (WebCore::familiesIntersect): Deleted.
        (WebCore::CSSFontFaceSet::load): Deleted.
        (WebCore::CSSFontFaceSet::stateChanged): Deleted.
        * css/CSSFontFaceSet.h: Now needs to be RefCounted. New data structures are
        taken from CSSFontSelector.
        (WebCore::CSSFontFaceSetClient::faceFinished):
        (WebCore::CSSFontFaceSetClient::fontModified):
        (WebCore::CSSFontFaceSetClient::startedLoading):
        (WebCore::CSSFontFaceSetClient::completedLoading):
        * css/CSSFontFaceSource.h:
        * css/CSSFontSelector.cpp: Move code into CSSFontFaceSet.
        (WebCore::CSSFontSelector::CSSFontSelector):
        (WebCore::CSSFontSelector::~CSSFontSelector):
        (WebCore::CSSFontSelector::fontFaceSet):
        (WebCore::CSSFontSelector::isEmpty):
        (WebCore::CSSFontSelector::addFontFaceRule):
        (WebCore::CSSFontSelector::fontModified):
        (WebCore::CSSFontSelector::fontRangesForFamily):
        (WebCore::CSSFontSelector::clearDocument):
        (WebCore::CSSFontSelector::appendSources): Deleted.
        (WebCore::CSSFontSelector::familyNameFromPrimitive): Deleted.
        (WebCore::CSSFontSelector::registerLocalFontFacesForFamily): Deleted.
        (WebCore::FontFaceComparator::FontFaceComparator): Deleted.
        (WebCore::FontFaceComparator::operator()): Deleted.
        (WebCore::CSSFontSelector::getFontFace): Deleted.
        * css/CSSFontSelector.h:
        * css/CSSSegmentedFontFace.cpp:
        (WebCore::CSSSegmentedFontFace::CSSSegmentedFontFace):
        * css/CSSSegmentedFontFace.h:
        * css/FontFace.cpp:
        (WebCore::FontFace::create):
        (WebCore::FontFace::FontFace):
        (WebCore::FontFace::createWeakPtr):
        (WebCore::FontFace::fontStateChanged):
        (WebCore::FontFace::stateChanged): Deleted.
        * css/FontFace.h:
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::create):
        (WebCore::FontFaceSet::FontFaceSet):
        (WebCore::FontFaceSet::~FontFaceSet):
        (WebCore::FontFaceSet::Iterator::next):
        (WebCore::FontFaceSet::has):
        (WebCore::FontFaceSet::size):
        (WebCore::FontFaceSet::add):
        (WebCore::FontFaceSet::remove):
        (WebCore::FontFaceSet::clear):
        (WebCore::FontFaceSet::load):
        (WebCore::FontFaceSet::check):
        (WebCore::FontFaceSet::status):
        (WebCore::FontFaceSet::canSuspendForDocumentSuspension):
        (WebCore::FontFaceSet::faceFinished):
        * css/FontFaceSet.h:
        * css/FontFaceSet.idl:
        * dom/Document.cpp:
        (WebCore::Document::fonts):
        * dom/Document.h:
        * dom/Document.idl:
        * svg/SVGFontFaceElement.h:

2016-02-22  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Moved library setup code to WEBKIT_FRAMEWORK macro.
        https://bugs.webkit.org/show_bug.cgi?id=154450

        Reviewed by Alex Christensen.

        No new tests needed.

        * CMakeLists.txt:

2016-02-22  Konstantin Tokarev  <annulen@yandex.ru>

        Workaround for ICE in GCC 4.8 appeared in r196846.
        https://bugs.webkit.org/show_bug.cgi?id=154535

        Reviewed by Chris Dumez.

        No new tests needed.

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::autocomplete):

2016-02-22  Jer Noble  <jer.noble@apple.com>

        Enable AVFoundationNSURLSessionEnabled by default
        https://bugs.webkit.org/show_bug.cgi?id=154469

        Reviewed by Sam Weinig.

        * page/Settings.cpp:

2016-02-22  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Swap columns and rows in grid-template shorthand
        https://bugs.webkit.org/show_bug.cgi?id=154472

        Reviewed by Darin Adler.

        The spec was modified past December to change the order of
        columns and rows in the grid-template shorthand:
        https://github.com/w3c/csswg-drafts/commit/f6c7691679a519017a80ebae44fd86c3eae5c5f9

        Updated the parsing and modified the tests to follow the new syntax.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateColumns):
        (WebCore::CSSParser::parseGridTemplateRowsAndAreasAndColumns):
        (WebCore::CSSParser::parseGridTemplateShorthand):
        (WebCore::CSSParser::parseGridTemplateRowsAndAreas): Renamed to
        parseGridTemplateRowsAndAreasAndColumns().
        * css/CSSParser.h:

2016-02-22  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Swap columns and rows in grid shorthand
        https://bugs.webkit.org/show_bug.cgi?id=154449

        Reviewed by Darin Adler.

        The spec was modified past December to change the order of
        columns and rows in the grid shorthand:
        https://github.com/w3c/csswg-drafts/commit/7454c7c8c5857b61bbbe2ee5f07803c264bf37e4

        Updated the parsing and modified the tests to follow the new syntax.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridShorthand):

2016-02-22  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Binding generator should support key value iterable
        https://bugs.webkit.org/show_bug.cgi?id=154413

        Reviewed by Darin Adler.

        Covered by added layout and binding tests.

        iterable<key, value> in a IDL file will trigger the generation of entries, keys, values, [Symbol.iterator] and forEach methods to the prototype.
        Updated FetchHeaders and FontFaceSet to use it.

        IDLParser.pm parses the iterable<> and adds an iterable field in the interface containing the iterable information and objects for the five operations.
        IDLParser.pm is cleaned up a bit to remove previous Iterator support, which does not seem to be supported.

        CodeGeneratorJS.pm is updated to generate the code for the five operations, using JSKeyValueIterator. Set iterators are not yet supported.
        Moved definition of Iterator Key and Value Type to binding generated JSXX class based on iterable<> declaration in the IDL.

        Added binding test and Fetch Headers tests.

        * CMakeLists.txt:
        * Modules/fetch/FetchHeaders.idl:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSFetchHeadersCustom.cpp: Removed.
        * bindings/js/JSFontFaceSetCustom.cpp:
        (WebCore::JSFontFaceSet::ready): Removed iterable custom methods.
        * bindings/js/JSKeyValueIterator.h:
        (WebCore::createKeyValueIterator):
        (WebCore::keyValueIteratorForEach):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GetFunctionName):
        (PrototypeFunctionCount):
        (PrototypePropertyCount):
        (GeneratePropertiesHashTable):
        (GenerateImplementation):
        (GenerateImplementationFunctionCall):
        (GenerateImplementationIterableFunctions):
        * bindings/scripts/IDLParser.pm:
        (parseOperationOrIterator):
        (parseOperationOrIteratorRest):
        (parseIterableRest):
        (parseOptionalIterableInterface):
        (applyMemberList):
        (parseSpecial): Deleted.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjPrototype::finishCreation):
        (WebCore::jsTestObjPrototypeFunctionSymbolIterator):
        (WebCore::jsTestObjPrototypeFunctionEntries):
        (WebCore::jsTestObjPrototypeFunctionKeys):
        (WebCore::jsTestObjPrototypeFunctionValues):
        (WebCore::jsTestObjPrototypeFunctionForEach):
        * bindings/scripts/test/TestObj.idl:
        * css/FontFaceSet.idl:

2016-02-21  Chris Dumez  <cdumez@apple.com>

        HTMLScriptElement.crossOrigin / HTMLImageElement.crossOrigin should only return known values
        https://bugs.webkit.org/show_bug.cgi?id=154502

        Reviewed by Darin Adler.

        HTMLScriptElement.crossOrigin / HTMLImageElement.crossOrigin should only
        return known values and should be nullable as per the specification:
        - https://html.spec.whatwg.org/multipage/scripting.html#attr-script-crossorigin
        - https://html.spec.whatwg.org/multipage/embedded-content.html#attr-img-crossorigin
        - https://html.spec.whatwg.org/multipage/infrastructure.html#cors-settings-attribute

        This aligns our behavior with the HTML specification and Firefox.

        No new tests, already covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        Add support for nullable DOMString attributes. If such attribute is
        marked as nullable:
        - A null string is passed to the implementation if the setter is called
          with null/undefined.
        - null is returned to the Javascript if the getter implementation
          returns a null string.

        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        * bindings/scripts/test/TestObj.idl:
        Add test coverage for nullable DOMString attributes
        and rebaseline bindings tests.

        * html/HTMLImageElement.cpp:
        * html/HTMLImageElement.h:
        * html/HTMLImageElement.idl:
        * html/HTMLScriptElement.cpp:
        * html/HTMLScriptElement.h:
        * html/HTMLScriptElement.idl:
        * html/parser/HTMLParserIdioms.cpp:
        * html/parser/HTMLParserIdioms.h:

2016-02-21  Chris Dumez  <cdumez@apple.com>

        Make HTMLSelectElement.size behave as per the specification
        https://bugs.webkit.org/show_bug.cgi?id=154504

        Reviewed by Darin Adler.

        Make HTMLSelectElement.size behave as per the specification:
        - https://html.spec.whatwg.org/#htmlselectelement
        - https://html.spec.whatwg.org/#dom-select-size
        - https://html.spec.whatwg.org/#reflecting-content-attributes-in-idl-attributes:idl-unsigned-long

        In particular, it should be unsigned and be in the range [0; 2147483647].

        Also update several unsigned long attributes in our HTML implementation to use
        parseHTMLNonNegativeInteger() to parse unsigned integers as per the HTML
        specification, instead of calling String::toUint().

        No new tests, already covered by existing tests.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::parseAttribute):
        (WebCore::HTMLInputElement::size):
        (WebCore::HTMLInputElement::setSize):
        * html/HTMLInputElement.h:
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::parseAttribute):
        (WebCore::HTMLSelectElement::setSize):
        (WebCore::HTMLSelectElement::namedItem): Deleted.
        (WebCore::HTMLSelectElement::item): Deleted.
        * html/HTMLSelectElement.h:
        (WebCore::HTMLSelectElement::size):
        * html/HTMLSelectElement.idl:
        * html/HTMLTableColElement.cpp:
        (WebCore::HTMLTableColElement::parseAttribute):
        (WebCore::HTMLTableColElement::setSpan):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::parseAttribute):
        (WebCore::HTMLTextAreaElement::setCols):
        (WebCore::HTMLTextAreaElement::setRows):
        * html/parser/HTMLParserIdioms.h:
        (WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
        (WebCore::limitToOnlyHTMLNonNegative):

2016-02-21  Daniel Bates  <dabates@apple.com>

        CSP: Enable form-action directive by default
        https://bugs.webkit.org/show_bug.cgi?id=154520
        <rdar://problem/24762029>

        Reviewed by Sam Weinig.

        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Move logic to parse the form-action
        directive outside the ENABLE(CSP_NEXT) macro guarded section/experimental feature runtime flag.
        (WebCore::isExperimentalDirectiveName): Remove form-action from the directives considered
        experimental.

2016-02-21  Chris Dumez  <cdumez@apple.com>

        Add username / password attributes to HTMLAnchorElement / HTMLAreaElement
        https://bugs.webkit.org/show_bug.cgi?id=154519

        Reviewed by Sam Weinig.

        Add username / password attributes to HTMLAnchorElement / HTMLAreaElement as per:
        https://html.spec.whatwg.org/#htmlhyperlinkelementutils

        Firefox and Chrome already implement these.

        Also stop treating null as the empty string for the HTMLHyperlinkElementUtils
        attributes. This behavior does not match the specification or other browsers
        (tested Firefox and Chrome).

        Test: fast/dom/HTMLAnchorElement/set-href-attribute-user-pass.html

        * CMakeLists.txt:
        * DerivedSources.make:
        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::username):
        (WebCore::HTMLAnchorElement::setUsername):
        (WebCore::HTMLAnchorElement::password):
        (WebCore::HTMLAnchorElement::setPassword):
        * html/HTMLAnchorElement.h:
        * html/HTMLAnchorElement.idl:
        * html/HTMLAreaElement.idl:
        * html/HTMLHyperlinkElementUtils.idl: Added.

2016-02-21  Chris Dumez  <cdumez@apple.com>

        iframe/frame/object.contentDocument should be on the prototype
        https://bugs.webkit.org/show_bug.cgi?id=154409

        Reviewed by Sam Weinig.

        Move iframe/frame/object.contentDocument to the prototype. They used
        to be on the instance due to the [CheckSecurityForNode] IDL extended
        attribute. This patch updates the bindings generator so that such
        attributes are now on the prototype. While they are now on the
        prototype, the security checks are still generated in the
        corresponding getters and setters so cross origin access is still
        prevented.

        Test: http/tests/security/cross-origin-iframe-contentDocument.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (AttributeShouldBeOnInstance): Deleted.

2016-02-21  Darin Adler  <darin@apple.com>

        Refactor LazyEventListener creation to separate Element and Document cases
        https://bugs.webkit.org/show_bug.cgi?id=154231

        Reviewed by Andreas Kling.

        * bindings/js/JSLazyEventListener.cpp:
        (WebCore::JSLazyEventListener::create): Added. Newly factored to separate
        Element, Document, and DOMWindow with overloading.
        (WebCore::JSLazyEventListener::createForNode): Deleted.
        (WebCore::JSLazyEventListener::createForDOMWindow): Deleted.

        * bindings/js/JSLazyEventListener.h: Replaced the separate createForNode
        and createForDOMWindow functions with a single overloaded function create,
        which takes an Element, Document, or DOMWindow. Also changed indentation
        to match the style guide.

        * dom/Attr.h: Added newly needed forward class declaration.

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::setAttributeEventListener): Deleted.
        * dom/ContainerNode.h: Deleted setAttributeEventListener override; it's now
        done separately by Element and Document.

        * dom/Document.cpp:
        (WebCore::Document::setAttributeEventListener): Added. Makes the lazy event
        listener and calls through to the base class's setAttributeEventListener.
        (WebCore::Document::setWindowAttributeEventListener): Updated to call just
        create instead of createForDOMWindow.

        * dom/Document.h: Removed some unneeded forward declarations. Added the
        overload for setAttributeEventListener. Removed a no longer useful comment.

        * dom/Element.cpp:
        (WebCore::Element::setAttributeEventListener): Added. Makes the lazy event
        listener and calls through to the base class's setAttributeEventListener.

        * dom/Element.h: Removed some unneeded forward declarations. Added the
        overload for setAttributeEventListener.

        * dom/Node.h: Removed many unneeded forward declarations.

        * dom/NodeRareData.h: Added one forward declaration.

        * editing/Editor.h: Added one forward declaration.

2016-02-21  Daniel Bates  <dabates@apple.com>

        CSP: Violation report should include column number
        https://bugs.webkit.org/show_bug.cgi?id=154418
        <rdar://problem/24729525>

        Reviewed by Brent Fulgham.

        Include column-number in the Content Security Policy violation report for the column number
        in the source script where the violation occurred (for a script violation) as per section
        Reporting of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        When a CSP report is created for a script violation the source file and line number of the
        source code line where the violation occurred are included in the report. We now include
        the column number in the source file where the violation occurred so as to help narrow
        down the operation that triggered the violation in a complicated source code line.

        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportViolation):

2016-02-21  Daniel Bates  <dabates@apple.com>

        CSP: Violation report should include HTTP status code and effective-directive of protected resource
        https://bugs.webkit.org/show_bug.cgi?id=154288
        <rdar://problem/24674982>
        And
        https://bugs.webkit.org/show_bug.cgi?id=115707
        <rdar://problem/24383128>

        Reviewed by Brent Fulgham.

        Include status-code and effective-directive in the Content Security Policy violation report for
        the HTTP status code of the protected resource and name of the policy directive that was violated,
        respectively, as per section Reporting of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        Test: http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https.html

        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportViolation): Add key status-code to the report with value
        equal to the HTTP response code for the document or 0 depending on whether the document was
        delivered over HTTP or not. Additionally, remove ENABLE(CSP_NEXT)-guard/experimentalFeaturesEnabled()-condition
        around code to include the effective-directive property in the report.

2016-02-21  Daniel Bates  <dabates@apple.com>

        CSP: report-url directive should be ignored when contained in a policy defined via a meta element
        https://bugs.webkit.org/show_bug.cgi?id=154307
        <rdar://problem/24684817>

        Reviewed by Brent Fulgham.

        The Content Security Policy report-uri directive should only be honored when defined via an HTTP header
        as per section report-uri of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        Currently we honor the report-uri directive when enforcing or monitoring a policy defined either via
        an HTML meta element or an HTTP header. Instead we should only honor this directive when defined
        via an HTTP header and log a message to the Web Inspector console to explain that the directive
        was ignored as suggested in <https://www.w3.org/TR/2015/CR-CSP2-20150721/#delivery-html-meta-element>.

        Test: http/tests/security/contentSecurityPolicy/report-uri-in-meta-tag-ignored.html

        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::parse): Modified to ignore the directive report-uri when
        the Content Security Policy came from an HTML meta element.

2016-02-21  Daniel Bates  <dabates@apple.com>

        CSP: sandbox directive should be ignored when contained in a policy defined via a meta element
        https://bugs.webkit.org/show_bug.cgi?id=154299
        <rdar://problem/24680433>

        Reviewed by Brent Fulgham.

        The Content Security Policy sandbox directive should only be honored when enforcing a policy
        defined via an HTTP header as per section sandbox of the Content Security Policy 2.0 spec.,
        <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        Currently we honor the sandbox directive when enforcing a policy defined either via an HTML
        meta element or an HTTP header. Instead we should only honor this directive when defined
        via an HTTP header and log a message to the Web Inspector console to explain that the directive
        was ignored as suggested in <https://www.w3.org/TR/2015/CR-CSP2-20150721/#delivery-html-meta-element>.

        Tests: http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header2.php
               http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header-inherited-by-subframe.php
               http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header.php
               http/tests/security/contentSecurityPolicy/sandbox-in-meta-tag-ignored.html

        * dom/Document.cpp:
        (WebCore::Document::processHttpEquiv): Substitute ContentSecurityPolicy::processHTTPEquiv() for
        ContentSecurityPolicy::didReceiveHeader() as the latter was made private.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::copyStateFrom): Updated as needed based on ContentSecurityPolicy::didReceiveHeader() change below.
        (WebCore::ContentSecurityPolicy::didReceiveHeaders): Ditto.
        (WebCore::ContentSecurityPolicy::didReceiveHeader): Modified to take argument of type ContentSecurityPolicy::PolicyFrom
        and pass it through to ContentSecurityPolicyDirectiveList::create().
        (WebCore::ContentSecurityPolicy::reportInvalidDirectiveInHTTPEquivMeta): Logs a message to the Web Inspector console
        that the specified directive was ignored because it was delivered via an HTML meta element.
        * page/csp/ContentSecurityPolicy.h: Made member function ContentSecurityPolicy::didReceiveHeader() private. Defined
        enum class PolicyFrom to represent the source of the Content Security Policy: HTTP equiv meta element, HTTP header, or
        inherited from another ContentSecurityPolicy object (this value is only used by ContentSecurityPolicy::copyStateFrom()).
        (WebCore::ContentSecurityPolicy::processHTTPEquiv): Added; turns around and calls ContentSecurityPolicy::didReceiveHeader().
        The name of this function better describes its purpose - to handle the processing of a Content Security Policy
        delivered via <meta http-equiv="Content-Security-Policy" content="...">.
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::create): Modified to take argument of type ContentSecurityPolicy::PolicyFrom
        as pass it through to ContentSecurityPolicyDirectiveList::parse().
        (WebCore::ContentSecurityPolicyDirectiveList::parse): Modified to ignore the directive sandbox when the Content Security
        Policy came from an HTML meta element.
        * page/csp/ContentSecurityPolicyDirectiveList.h:

2016-02-21  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196866.
        https://bugs.webkit.org/show_bug.cgi?id=154515

        still crashy on EFL/GTK (Requested by smfr on #webkit).

        Reverted changeset:

        "Wheel event callback removing the window causes crash in
        WebCore."
        https://bugs.webkit.org/show_bug.cgi?id=150871
        http://trac.webkit.org/changeset/196866

2016-02-20  Simon Fraser  <simon.fraser@apple.com>

        Wheel event callback removing the window causes crash in WebCore.
        https://bugs.webkit.org/show_bug.cgi?id=150871

        Reviewed by Brent Fulgham.

        Null check the FrameView before using it, since the iframe may have been removed
        from its parent document inside the event handler.

        The new test triggered a cross-load side-effect, where wheel event filtering wasn't
        reset between page loads. Fix by calling clearLatchedState() in EventHandler::clear(),
        which resets the filtering.

        Test: fast/events/wheel-event-destroys-frame.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::clear):
        (WebCore::EventHandler::clearLatchedState):
        * page/Frame.cpp:
        (WebCore::Frame::setView): If the view doesn't change (e.g. was and is null)
        don't bother clearing the event handler; should avoid EventHandler::clearLatchedState()
        from accessing a deleted MainFrame.
        * page/WheelEventDeltaFilter.cpp:
        (WebCore::WheelEventDeltaFilter::filteredDelta):
        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::platformCompleteWheelEvent):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollTo):

2016-02-20  Antti Koivisto  <antti@apple.com>

        Resolve style iteratively
        https://bugs.webkit.org/show_bug.cgi?id=154355

        Reviewed by Andreas Kling.

        Instead of a set of recursive functions use ComposedTreeIterator for traversing the DOM
        tree in composed tree order.

        This, along with maintaining explicit parent stack makes style resolve code more tractable
        for future work.

        It also makes the ComposedTreeIterator the definite authority for the shape of the composed tree
        instead of duplicating it as a set of recursive style resolve functions. This eliminates
        a significant source of bugs and confusion.

        The render tree building code path remains recursive for now.

        * css/StyleInvalidationAnalysis.cpp:
        (WebCore::StyleInvalidationAnalysis::invalidateIfNeeded):

            Invalidate the host element instead of the shadow root. This reduces need for special handling for shadow roots.

        * dom/ComposedTreeIterator.cpp:
        (WebCore::ComposedTreeIterator::initializeContextStack):
        (WebCore::ComposedTreeIterator::dropAssertions):

            Add support for dropping DOM mutation assertions.

        (WebCore::ComposedTreeIterator::traverseShadowRoot):
        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::context):
        (WebCore::ComposedTreeIterator::current):
        * dom/PseudoElement.h:
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::TreeResolver):
        (WebCore::Style::TreeResolver::Scope::Scope):
        (WebCore::Style::TreeResolver::Parent::Parent):
        (WebCore::Style::TreeResolver::pushScope):
        (WebCore::Style::resetStyleForNonRenderedDescendants):
        (WebCore::Style::pseudoStyleCacheIsInvalid):
        (WebCore::Style::TreeResolver::resolveElement):
        (WebCore::Style::resolveTextNode):
        (WebCore::Style::TreeResolver::resolveBeforeOrAfterPseudoElement):
        (WebCore::Style::TreeResolver::pushParent):
        (WebCore::Style::TreeResolver::popParent):
        (WebCore::Style::TreeResolver::popParentsToDepth):

            Maintain explicit parent stack.

        (WebCore::Style::TreeResolver::resolveComposedTree):

            The main loop that iterates over the composed tree and computes style for dirty elements.

        (WebCore::Style::TreeResolver::resolve):
        (WebCore::Style::detachRenderTree):
        (WebCore::Style::TreeResolver::resolveLocally): Deleted.
        (WebCore::Style::TreeResolver::resolveChildAtShadowBoundary): Deleted.
        (WebCore::Style::TreeResolver::resolveShadowTree): Deleted.
        (WebCore::Style::TreeResolver::resolveChildren): Deleted.
        (WebCore::Style::TreeResolver::resolveSlotAssignees): Deleted.
        (WebCore::Style::TreeResolver::resolveRecursively): Deleted.

            Recursive functions go away.

        * style/StyleTreeResolver.h:
        (WebCore::Style::TreeResolver::scope):
        (WebCore::Style::TreeResolver::parent):

2016-02-20  Andreas Kling  <akling@apple.com>

        REGRESSION(r196780): Fake memory handler takes too long to run now.

        Unreviewed bot fix.

        Put the footprint comparison code behind a compile-time flag for now.
        It's taking too long to run on bots, and memory is getting measured
        before all the pressure relief code has a chance to run.

        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        (WebCore::MemoryPressureHandler::install):

2016-02-20  Olivier Blin  <olivier.blin@softathome.com>

        Do not require UDate in LocaleICU with !ENABLE_DATE_AND_TIME_INPUT_TYPES
        https://bugs.webkit.org/show_bug.cgi?id=154483

        Reviewed by Michael Catanzaro.

        Put initializeShortDateFormat(), dateFormat(), m_shortDateFormat and
        m_didCreateShortDateFormat under flag, since they are only used by
        code under the ENABLE_DATE_AND_TIME_INPUT_TYPES flag.

        This helps to build with a light ICU that does not provide UDate
        features (with UCONFIG_NO_FORMATTING).

        * platform/text/LocaleICU.cpp:
        (WebCore::LocaleICU::LocaleICU):
        (WebCore::LocaleICU::~LocaleICU):
        (WebCore::createFallbackMonthLabels): Deleted.
        (WebCore::createFallbackAMPMLabels): Deleted.
        * platform/text/LocaleICU.h:

2016-02-20  Olivier Blin  <olivier.blin@softathome.com>

        Remove declaration of unimplemented methods in LocaleICU
        https://bugs.webkit.org/show_bug.cgi?id=154482

        Reviewed by Michael Catanzaro.

        detectSignAndGetDigitRange() and matchedDecimalSymbolIndex() are
        implemented in PlatformLocale, not LocaleICU.

        They were moved out from LocaleICU to NumberLocalizer in r124459
        (2012), which has then been renamed as Localizer, then Locale, and
        finally PlatformLocale.

        * platform/text/LocaleICU.h:

2016-02-20  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196837.
        https://bugs.webkit.org/show_bug.cgi?id=154495

        It caused a lot of crashes in EFL and GTK bots (Requested by
        KaL on #webkit).

        Reverted changeset:

        "Wheel event callback removing the window causes crash in
        WebCore."
        https://bugs.webkit.org/show_bug.cgi?id=150871
        http://trac.webkit.org/changeset/196837

2016-02-19  Chris Dumez  <cdumez@apple.com>

        Land release assertions to help track down a possible HTMLCollection lifetime bug
        https://bugs.webkit.org/show_bug.cgi?id=154490

        Reviewed by Ryosuke Niwa.

        Land release assertions to help track down a possible HTMLCollection
        lifetime bug: <rdar://problem/24457478>.

        * bindings/js/JSHTMLCollectionCustom.cpp:
        (WebCore::JSHTMLCollection::getOwnPropertyNames):
        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollection::HTMLCollection):
        (WebCore::HTMLCollection::~HTMLCollection):
        * html/HTMLCollection.h:
        (WebCore::HTMLCollection::wasDeletionStarted):
        * html/HTMLCollection.idl:

2016-02-19  Doug Russell  <d_russell@apple.com>

        Bug 154366 - AX: AXObjectCache::visiblePositionForTextMarkerData() doesn't account for equivalent visibly equivalent positions
        https://bugs.webkit.org/show_bug.cgi?id=154366

        Reviewed by Chris Fleizach.

        Test: accessibility/mac/text-marker-line-boundary.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):

2016-02-19  Simon Fraser  <simon.fraser@apple.com>

        Use more concrete types for parsing positions
        https://bugs.webkit.org/show_bug.cgi?id=154481

        Reviewed by Dean Jackson.

        Use CSSPrimitiveValues for position-parsing functions where possible, to avoid
        the need to downcast<> the values returned by the parsing functions.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parsePositionX):
        (WebCore::CSSParser::parsePositionY):
        (WebCore::CSSParser::parse4ValuesFillPosition):
        (WebCore::CSSParser::parse3ValuesFillPosition):
        (WebCore::CSSParser::parseFillPosition):
        (WebCore::CSSParser::parse2ValuesFillPosition):
        (WebCore::CSSParser::parseFillProperty):
        (WebCore::CSSParser::parseTransformOriginShorthand):
        (WebCore::CSSParser::parseBasicShapeCircle):
        (WebCore::CSSParser::parseBasicShapeEllipse):
        (WebCore::CSSParser::parseDeprecatedRadialGradient):
        (WebCore::CSSParser::parseRadialGradient):
        (WebCore::CSSParser::parseTransformOrigin):
        (WebCore::CSSParser::parsePerspectiveOrigin):
        * css/CSSParser.h:

2016-02-18  Gavin Barraclough  <barraclough@apple.com>

        JSObject::getPropertySlot - index-as-propertyname, override on prototype, & shadow
        https://bugs.webkit.org/show_bug.cgi?id=154416

        Reviewed by Geoff Garen.

        * testing/Internals.cpp:
        (WebCore::Internals::isReadableStreamDisturbed):
            - fastGetOwnPropertySlot -> getOwnPropertySlot
              (internal method removed; test shouldn't really have been using this anyway)

2016-02-19  Chris Dumez  <cdumez@apple.com>

        HTMLFormElement.autocomplete should only return known values
        https://bugs.webkit.org/show_bug.cgi?id=154247
        <rdar://problem/24658195>

        Reviewed by Ryosuke Niwa.

        Update HTMLFormElement.autocomplete to only return known values:
        - https://html.spec.whatwg.org/multipage/forms.html#dom-form-autocomplete
        - https://html.spec.whatwg.org/multipage/forms.html#attr-form-autocomplete

        Also, update HTMLInputElement.autocomplete to fall back to using the form
        owner's autocomplete attribute ("on" or "off") when it's autocomplete
        attribute is omitted and the input element is wearing the "autofill
        expectation mantle" (i.e. the input is not hidden). If there is no
        form owner, the "on" value is used instead. This behavior is specified
        in:
        https://html.spec.whatwg.org/multipage/forms.html#autofilling-form-controls:-the-autocomplete-attribute:attr-fe-autocomplete-7

        No new tests, already covered by existing tests.

        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::autocomplete):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::setAutocomplete):
        (WebCore::HTMLFormElement::autocomplete):
        * html/HTMLFormElement.h:
        * html/HTMLFormElement.idl:

2016-02-19  Chris Dumez  <cdumez@apple.com>

        Drop UnsafeVectorOverflow on ElementDescendantConstIterator::m_ancestorSiblingStack
        https://bugs.webkit.org/show_bug.cgi?id=154477

        Reviewed by Ryosuke Niwa.

        Drop UnsafeVectorOverflow on ElementDescendantConstIterator::m_ancestorSiblingStack to
        restore bounds checking.

        Andreas already dropped in on ElementDescendantIterator::m_ancestorSiblingStack in
        r178253 but did not update the "Const" counterpart.

        * dom/ElementDescendantIterator.h:

2016-02-19  Simon Fraser  <simon.fraser@apple.com>

        Wheel event callback removing the window causes crash in WebCore.
        https://bugs.webkit.org/show_bug.cgi?id=150871

        Reviewed by Brent Fulgham.

        Null check the FrameView before using it, since the iframe may have been removed
        from its parent document inside the event handler.
        
        The new test triggered a cross-load side-effect, where wheel event filtering wasn't
        reset between page loads. Fix by calling clearLatchedState() in EventHandler::clear(),
        which resets the filtering.

        Test: fast/events/wheel-event-destroys-frame.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::clear):
        * page/WheelEventDeltaFilter.cpp:
        (WebCore::WheelEventDeltaFilter::filteredDelta):
        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::platformCompleteWheelEvent):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollTo):

2016-02-19  Myles C. Maxfield  <mmaxfield@apple.com>

        [Win] [SVG -> OTF Converter] All uses of a font except the first one are invisible
        https://bugs.webkit.org/show_bug.cgi?id=154465

        Reviewed by Alex Christensen.

        We should re-use the existing converted data if it exists.

        Covered by existing tests.

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):

2016-02-19  Antti Koivisto  <antti@apple.com>

        ComposedTreeIterator traverses normal children for elements with empty shadow root
        https://bugs.webkit.org/show_bug.cgi?id=154464

        Reviewed by Ryosuke Niwa.

        Test: fast/shadow-dom/composed-tree-basic.html

        * dom/ComposedTreeIterator.cpp:
        (WebCore::ComposedTreeIterator::initializeContextStack):
        (WebCore::ComposedTreeIterator::traverseShadowRoot):

            If the shadow root is empty continue by skipping the real children.

        (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
        (WebCore::composedTreeAsText):
        (WebCore::ComposedTreeIterator::pushContext): Deleted.
        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::context):
        (WebCore::ComposedTreeIterator::current):
        (WebCore::ComposedTreeIterator::traverseNext):
        (WebCore::composedTreeChildren):
        * testing/Internals.cpp:
        (WebCore::Internals::composedTreeAsText):

            Testing support.

        * testing/Internals.h:
        * testing/Internals.idl:

2016-02-19  Jer Noble  <jer.noble@apple.com>

        Adopt CachedRawResourceClient::shouldCacheResponse() in MediaResourceLoader and WebCoreNSURLSession
        https://bugs.webkit.org/show_bug.cgi?id=154466

        Reviewed by Alex Christensen.

        Adopt the new shouldCacheResponse() callback so that byte-range
        requests generated by WebCoreNSURLSession are not cached.

        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResource::shouldCacheResponse):
        * loader/MediaResourceLoader.h:
        * platform/graphics/PlatformMediaResourceLoader.h:
        (WebCore::PlatformMediaResourceClient::shouldCacheResponse):
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession downloadTaskWithRequest:]):
        (-[WebCoreNSURLSession streamTaskWithHostName:port:]):
        (-[WebCoreNSURLSession streamTaskWithNetService:]):
        (-[WebCoreNSURLSessionDataTask _timingData]):
        (-[WebCoreNSURLSessionDataTask resource:sentBytes:totalBytesToBeSent:]):

2016-02-12  Jer Noble  <jer.noble@apple.com>

        [Mac] CORS-compliant videos throw security errors when painting to Canvas
        https://bugs.webkit.org/show_bug.cgi?id=154188
        <rdar://problem/22959556>

        Reviewed by Alex Christensen.

        Pass the CORS access check results from WebCoreNSURLSession to it's client,
        MediaPlayerPrivateAVFoundationObjC.

        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::didPassCORSAccessCheck): Ask the WebCoreNSURLSession.
        * platform/network/cocoa/WebCoreNSURLSession.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession task:didReceiveCORSAccessCheckResult:]): Conditionally set _corsResults.
        (-[WebCoreNSURLSession didPassCORSAccessChecks]): Return _corsResults.
        (WebCoreNSURLSessionDataTaskClient::accessControlCheckFailed): Call -resource:accessControlCheckFailedWithError:.
        (WebCoreNSURLSessionDataTaskClient::loadFailed): Call -resource:loadFailedWithError:.
        (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]): Set _response within the delegate queue.
        (-[WebCoreNSURLSessionDataTask _resource:loadFinishedWithError:]): Renamed from resourceFinished:
        (-[WebCoreNSURLSessionDataTask resource:accessControlCheckFailedWithError:]): Ditto.
        (-[WebCoreNSURLSessionDataTask resource:loadFailedWithError:]): Ditto.
        (-[WebCoreNSURLSessionDataTask resourceFinished:]): Ditto.

2016-02-19  Chris Dumez  <cdumez@apple.com>

        Unreviewed build fix.

        * loader/cocoa/SubresourceLoaderCocoa.mm:
        (WebCore::SubresourceLoader::willCacheResponse):

2016-02-19  Nan Wang  <n_wang@apple.com>

        AX: Inconsistency between CharacterOffset and VisiblePostition
        https://bugs.webkit.org/show_bug.cgi?id=154431

        Reviewed by Chris Fleizach.

        VoiceOver is not getting the correct text marker from VisiblePostition when
        navigating using arrow keys. We should make the CharacterOffset behavior consistent
        with VisiblePosition so that the conversion between the two won't create different
        text markers.
        
        Changes are covered in the modified tests.

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::characterOffsetForTextMarkerData):
        (WebCore::AXObjectCache::traverseToOffsetInRange):
        (WebCore::AXObjectCache::startOrEndCharacterOffsetForRange):
        (WebCore::AXObjectCache::startOrEndTextMarkerDataForRange):
        (WebCore::AXObjectCache::characterOffsetForNodeAndOffset):
        (WebCore::AXObjectCache::textMarkerDataForNextCharacterOffset):
        (WebCore::AXObjectCache::textMarkerDataForPreviousCharacterOffset):
        (WebCore::AXObjectCache::visiblePositionFromCharacterOffset):
        (WebCore::AXObjectCache::characterOffsetFromVisiblePosition):
        (WebCore::AXObjectCache::accessibilityObjectForTextMarkerData):
        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
        (WebCore::AXObjectCache::nextCharacterOffset):
        (WebCore::AXObjectCache::previousCharacterOffset):
        (WebCore::AXObjectCache::startCharacterOffsetOfWord):
        (WebCore::AXObjectCache::endCharacterOffsetOfWord):
        (WebCore::AXObjectCache::previousWordStartCharacterOffset):
        (WebCore::AXObjectCache::previousParagraphStartCharacterOffset):
        (WebCore::AXObjectCache::previousSentenceStartCharacterOffset):
        * accessibility/AXObjectCache.h:
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):

2016-02-19  Jer Noble  <jer.noble@apple.com>

        Allow CachedRawResource clients to opt out of caching on a per-response basis
        https://bugs.webkit.org/show_bug.cgi?id=154453

        Reviewed by Brady Eidson.

        For CF or NS networking clients, the system loader will ask whether the client (the
        SubResourceLoader in this case) wants the response to be cached. This breaks for byte
        range requests due to <rdar://problem/20001985>. Allow the SubresourceLoader to query
        its clients, and return null, if they opt out.

        * loader/cache/CachedRawResource.cpp:
        (WebCore::CachedRawResource::shouldCacheResponse):
        * loader/cache/CachedRawResource.h:
        * loader/cache/CachedRawResourceClient.h:
        (WebCore::CachedRawResourceClient::shouldCacheResponse):
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::shouldCacheResponse):
        * loader/cocoa/SubresourceLoaderCocoa.mm:
        (WebCore::SubresourceLoader::willCacheResponse):

2016-02-19  Zalan Bujtas  <zalan@apple.com>

        Blocked plug-in placeholder is sometimes not shown.
        https://bugs.webkit.org/show_bug.cgi?id=154434
        <rdar://problem/22584973>

        Reviewed by Brent Fulgham.

        m_isUnavailablePluginIndicatorHidden was set to false incorrectly as initial value.
        It prevented RenderEmbeddedObject from issuing repaint when the plugin indicator
        was set to visible (m_isUnavailablePluginIndicatorHidden <- false) the first time.
        (The reason why the indicator showed up most of the time was because some renderer
        triggered repaint on the view.)

        Unable to test.

        * rendering/RenderEmbeddedObject.cpp:
        (WebCore::RenderEmbeddedObject::setUnavailablePluginIndicatorIsHidden):
        (WebCore::RenderEmbeddedObject::RenderEmbeddedObject): Deleted.
        (WebCore::RenderEmbeddedObject::setUnavailablePluginIndicatorIsPressed): Deleted.
        * rendering/RenderEmbeddedObject.h:
        (WebCore::RenderEmbeddedObject::showsUnavailablePluginIndicator):

2016-02-19  Csaba Osztrogonác  <ossy@webkit.org>

        Fix pessimizing-move warnings
        https://bugs.webkit.org/show_bug.cgi?id=154395

        Reviewed by Michael Catanzaro.

        * platform/graphics/efl/CairoUtilitiesEfl.cpp:
        (WebCore::evasObjectFromCairoImageSurface):
        * platform/graphics/surfaces/GLTransportSurface.cpp:
        (WebCore::GLTransportSurface::createTransportSurface):
        (WebCore::GLTransportSurfaceClient::createTransportSurfaceClient):

2016-02-19  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] clean-up various leaks
        https://bugs.webkit.org/show_bug.cgi?id=154285

        Reviewed by Carlos Garcia Campos.

        * platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
        (webkit_web_audio_src_init): Take full ownership of the GstTask.
        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
        (WTF::adoptGRef): Null pointer support in ASSERTs.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::initializeGStreamerAndRegisterWebKitElements): Take full ownership of the GstElementFactory pointers.
        (WebCore::MediaPlayerPrivateGStreamer::isAvailable): Ditto.

2016-02-18  Andy Estes  <aestes@apple.com>

        Revert to dispatching the popstate event synchronously
        https://bugs.webkit.org/show_bug.cgi?id=153297
        rdar://problem/24092294

        Reviewed by Brent Fulgham.

        r192369 made the popstate event dispatch asynchronously, which matches what the HTML5 spec says to do. However,
        due to compatibility regressions we need to revert back to dispatching synchronously. This change reverts
        r192369's changes to Document.cpp, but retains the new tests.

        Firing popstate synchronously makes both fast/loader/remove-iframe-during-history-navigation-different.html and
        fast/loader/remove-iframe-during-history-navigation-same.html crash, because their onpopstate handlers remove
        frames from the document that will later be accessed by HistoryController::recursiveGoToItem().

        To prevent the crashes, this change does two things:
        1. Keep a reference to the current frame inside FrameLoader::loadSameDocumentItem(), since calling
           loadInSameDocument() might otherwise delete it.
        2. Handle a null frame when iterating a HistoryItem's child frames in HistoryController::recursiveGoToItem(),
           since calling goToItem() on one frame might cause another frame to be deleted.

        Covered by existing tests. fast/loader/stateobjects/popstate-is-asynchronous.html was renamed to
        fast/loader/stateobjects/popstate-is-synchronous.html and modified to expect synchronous dispatch.

        * dom/Document.cpp:
        (WebCore::Document::enqueuePopstateEvent):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadSameDocumentItem):
        * loader/HistoryController.cpp:
        (WebCore::HistoryController::recursiveGoToItem):

2016-02-19  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GObject DOM bindings API break after r196769.

        * html/HTMLTextAreaElement.idl:

2016-02-18  Gwang Yoon Hwang  <yoon@igalia.com>

        [GTK] Limit the number of tiles according to the visible area
        https://bugs.webkit.org/show_bug.cgi?id=126122

        Reviewed by Carlos Garcia Campos.

        TextureMapperTiledBackingStore creates tiles for whole layer bounds, which
        means it creates the huge amount of textures if there is an excessively big
        layer.  Not only it wastes the memory and the CPU time, it even can crash GPU
        drivers.

        This patch modifies TextureMapperTiledBackingStore to take into account the
        visible area with a coverage multiplier when creating tiles.

        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::GraphicsLayerTextureMapper):
        Set a flag to recalculate the visible area of the layer when there are
        geometric changes.
        (WebCore::GraphicsLayerTextureMapper::setContentsToImage):
        (WebCore::GraphicsLayerTextureMapper::flushCompositingStateForThisLayerOnly):
        (WebCore::GraphicsLayerTextureMapper::updateBackingStoreIncludingSubLayers):
        (WebCore::GraphicsLayerTextureMapper::updateBackingStoreIfNeeded):
        (WebCore::GraphicsLayerTextureMapper::markVisibleRectAsDirty):
        (WebCore::GraphicsLayerTextureMapper::selfOrAncestorHasActiveTransformAnimation):
        (WebCore::GraphicsLayerTextureMapper::computeTransformedVisibleRect):
        Compute the inverse transform matrix to map a global visible are to
        the local visible area.
        (WebCore::clampToContentsRectIfRectIsInfinite):
        (WebCore::GraphicsLayerTextureMapper::transformedVisibleRect):
        * platform/graphics/texmap/TextureMapperTiledBackingStore.cpp:
        (WebCore::TextureMapperTiledBackingStore::paintToTextureMapper):
        In HiDPI, the directly composited image is uploaded to the unscaled
        texture to reduce memory usages. So we should apply device scale
        factor to render it correctly.
        (WebCore::TextureMapperTiledBackingStore::createOrDestroyTilesIfNeeded):
        Create tiles which covered by visible rect with a coverage multiplier.

2016-02-18  Brent Fulgham  <bfulgham@apple.com>

        Extend HashCountedSet with a method to efficiently set the count of an entry
        https://bugs.webkit.org/show_bug.cgi?id=154352

        Reviewed by Geoffrey Garen.

        Tested by new TestWebKitAPI tests.

        * loader/ResourceLoadStatistics.cpp:
        (WebCore::decodeHashCountedSet): Update to use new HashCountedSet::add method.

2016-02-18  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196790.
        https://bugs.webkit.org/show_bug.cgi?id=154439

        made fast/events/wheelevent-basic-actual.txt fail in WK2
        (Requested by alexchristensen on #webkit).

        Reverted changeset:

        "Wheel event callback removing the window causes crash in
        WebCore."
        https://bugs.webkit.org/show_bug.cgi?id=150871
        http://trac.webkit.org/changeset/196790

2016-02-18  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196791.
        https://bugs.webkit.org/show_bug.cgi?id=154438

        broke windows build (Requested by alexchristensen on #webkit).

        Reverted changeset:

        "Extend HashCountedSet with a method to efficiently set the
        count of an entry"
        https://bugs.webkit.org/show_bug.cgi?id=154352
        http://trac.webkit.org/changeset/196791

2016-02-18  Chris Dumez  <cdumez@apple.com>

        window.history / window.navigator should not be replaceable
        https://bugs.webkit.org/show_bug.cgi?id=154412

        Reviewed by Ryosuke Niwa.

        window.history / window.navigator should not be replaceable as per
        the latest HTML specification:
        https://html.spec.whatwg.org/multipage/browsers.html#the-window-object

        Firefox and Chrome already match the specification. This patch aligns
        our behavior.

        No new tests, already covered by existing tests.

        * page/DOMWindow.idl:

2016-02-18  Chris Dumez  <cdumez@apple.com>

        HTMLTableHeaderCellElement.scope should only return known values
        https://bugs.webkit.org/show_bug.cgi?id=154423
        <rdar://problem/24731018>

        Reviewed by Ryosuke Niwa.

        HTMLTableHeaderCellElement.scope should only return known values as per:
        - https://html.spec.whatwg.org/multipage/tables.html#dom-th-scope

        Known values are document here:
        - https://html.spec.whatwg.org/multipage/tables.html#attr-th-scope

        No new tests, already covered by existing test.

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLElementsAllInOne.cpp:
        * html/HTMLTableHeaderCellElement.cpp: Copied from Source/WebCore/html/HTMLTableHeaderCellElement.h.
        (WebCore::HTMLTableHeaderCellElement::scope):
        (WebCore::HTMLTableHeaderCellElement::setScope):
        * html/HTMLTableHeaderCellElement.h:
        * html/HTMLTableHeaderCellElement.idl:

2016-02-18  Brent Fulgham  <bfulgham@apple.com>

        Extend HashCountedSet with a method to efficiently set the count of an entry
        https://bugs.webkit.org/show_bug.cgi?id=154352

        Reviewed by Geoffrey Garen.

        Tested by new TestWebKitAPI tests.

        * loader/ResourceLoadStatistics.cpp:
        (WebCore::decodeHashCountedSet): Update to use new HashCountedSet::add method.

2016-02-18  Simon Fraser  <simon.fraser@apple.com>

        Wheel event callback removing the window causes crash in WebCore.
        https://bugs.webkit.org/show_bug.cgi?id=150871

        Reviewed by Brent Fulgham.
        
        Null check the FrameView before using it, since the iframe may have been removed
        from its parent document inside the event handler.

        Test: fast/events/wheel-event-destroys-frame.html

        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::platformCompleteWheelEvent):

2016-02-18  Brady Eidson  <beidson@apple.com>

        Modern IDB: Fix IDBGetResult encoder/decoder.
        https://bugs.webkit.org/show_bug.cgi?id=154421

        Reviewed by Alex Christensen.

        No new tests, as Modern IDB is still disabled for WK2.
        
        But if you manually enable it, "Basic IndexedDB Seems To Work"

        * Modules/indexeddb/IDBGetResult.h:
        (WebCore::IDBGetResult::encode):
        (WebCore::IDBGetResult::decode):

2016-02-18  Myles C. Maxfield  <mmaxfield@apple.com>

        Addressing post-review comments after r196747.

        Unreviewed.

        * css/CSSFontFaceSet.h:
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::size):
        (WebCore::FontFaceSet::clear):
        * css/FontFaceSet.h:

2016-02-18  Zalan Bujtas  <zalan@apple.com>

        Soft hyphen is not shown when it is placed at the end of an inline element
        https://bugs.webkit.org/show_bug.cgi?id=153980

        Reviewed by David Hyatt.

        This patch handles the case when the character at the breaking position does not fit the
        line and soft-hyphen, as the first breaking opportunity, is followed by this overflowing character.
        (foo&shy;bar where b overflows the line).
        In such cases we don't yet have an item in the breaking history so we need to take a look at
        the current context instead.    

        Test: fast/text/soft-hyphen-as-first-breaking-opportunity.html

        * rendering/line/BreakingContext.h:
        (WebCore::BreakingContext::InlineIteratorHistory::nextBreakablePosition):
        (WebCore::BreakingContext::handleText):

2016-02-18  Andreas Kling  <akling@apple.com>

        Fake memory pressure handler should log detailed memory breakdown.
        <https://webkit.org/b/154415>

        Reviewed by Antti Koivisto.

        Piggyback on the RESOURCE_USAGE code to implement some detailed memory footprint diffing
        and have the fake memory handler dump before/after/diff after it runs.

        * page/ResourceUsageThread.h:
        (WebCore::TagInfo::TagInfo):
        * page/cocoa/ResourceUsageThreadCocoa.mm:
        (WebCore::logFootprintComparison):
        (WebCore::displayNameForVMTag):
        (WebCore::pagesPerVMTag):
        (WebCore::TagInfo::TagInfo): Deleted.
        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        (WebCore::MemoryPressureHandler::install):

2016-02-18  Brady Eidson  <beidson@apple.com>

        Modern IDB: Implement server->client operations in WK2.
        https://bugs.webkit.org/show_bug.cgi?id=154411

        Reviewed by Alex Christensen.

        No change in behavior yet; Just laying the groundwork.
    
        * Modules/indexeddb/client/IDBConnectionToServer.h:
        * Modules/indexeddb/server/IDBServer.h:
        * Modules/indexeddb/shared/IDBTransactionInfo.h:
        (WebCore::IDBTransactionInfo::encode):
        (WebCore::IDBTransactionInfo::decode):

2016-02-18  Csaba Osztrogonác  <ossy@webkit.org>

        Fix unused-const-variable warning on non Cocoa platforms
        https://bugs.webkit.org/show_bug.cgi?id=154394

        Reviewed by Michael Catanzaro.

        * html/HTMLPlugInImageElement.cpp:

2016-02-18  Brady Eidson  <beidson@apple.com>

        Modern IDB: Implement client->server operations in WK2.
        https://bugs.webkit.org/show_bug.cgi?id=154400

        Reviewed by Alex Christensen.

        No change in behavior yet; Just laying the groundwork.

        * Modules/indexeddb/server/IDBServer.h:
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        * Modules/indexeddb/shared/IDBIndexInfo.h:
        * Modules/indexeddb/shared/IDBObjectStoreInfo.h:

2016-02-18  Chris Dumez  <cdumez@apple.com>

        [Unforgeable] operations should not be writable as per Web IDL
        https://bugs.webkit.org/show_bug.cgi?id=154396
        <rdar://problem/24721063>

        Reviewed by Ryosuke Niwa.

        [Unforgeable] operations should not be writable as per the Web IDL specification:
        http://heycam.github.io/webidl/#es-operations

        They were currently non-configurable in WebKit but still writable.

        No new tests, already covered by existing test.

        * bindings/scripts/CodeGeneratorJS.pm:
        Mark [Unforgeable] operations as ReadOnly.

        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        * bindings/scripts/test/TestObj.idl:
        Add bindings test coverage for [Unforgeable].

2016-02-18  Chris Dumez  <cdumez@apple.com>

        Fix behavior of reflecting unsigned long IDL attributes that are limited to only non-negative numbers greater than zero
        https://bugs.webkit.org/show_bug.cgi?id=154398

        Reviewed by Ryosuke Niwa.

        Fix behavior of reflecting unsigned long IDL attributes that are limited
        to only non-negative numbers greater than zero to comply with:
        - https://html.spec.whatwg.org/#limited-to-only-non-negative-numbers-greater-than-zero

        This patch updates the following IDL attributes:
        - colgroup.span
        - col.span
        - input.size
        - textarea.cols
        - textareal.rows

        All of them now:
        - Have "unsigned long" type on IDL size and "unsigned" type on native
          side.
        - On getting, return the value if it is in the range [1; 2147483647],
          otherwise return the default value.
        - On setting, set to the input value if it is in the range
          [1; 2147483647], otherwise, set to the default value.

        Note that as per the specification, we are supposed to throw an
        IndexSizeError exception when trying to set those attributes to zero.
        However, we instead use the default value to match other browsers.
        It would be risky to be the only browser to throw in this case.

        No new tests, already covered by existing test.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::parseAttribute):
        (WebCore::HTMLInputElement::setSize):
        * html/HTMLTableColElement.cpp:
        (WebCore::HTMLTableColElement::parseAttribute):
        (WebCore::HTMLTableColElement::setSpan):
        * html/HTMLTableColElement.h:
        * html/HTMLTableColElement.idl:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::parseAttribute):
        (WebCore::HTMLTextAreaElement::setCols):
        (WebCore::HTMLTextAreaElement::setRows):
        (WebCore::HTMLTextAreaElement::shouldUseInputMethod): Deleted.
        * html/HTMLTextAreaElement.h:
        * html/HTMLTextAreaElement.idl:
        * html/parser/HTMLParserIdioms.h:
        (WebCore::limitToOnlyNonNegativeNumbersGreaterThanZero):

2016-02-18  David Kilzer  <ddkilzer@apple.com>

        Remove redundant ASSERT_WITH_MESSAGE_UNUSED() from SOFT_LINK_FRAMEWORK_FOR_SOURCE() macro

        Follow-up fix noted by Andy Estes for:

            [Cocoa] Always check the return value of dlopen() and dlsym() in Release builds
            <http://webkit.org/b/154364>

        * platform/mac/SoftLinking.h:
        (SOFT_LINK_FRAMEWORK_FOR_SOURCE): Remove redundant
        ASSERT_WITH_MESSAGE_UNUSED().

2016-02-18  Andreas Kling  <akling@apple.com>

        Reduce tiling coverage immediately when memory pressure hits.
        <https://webkit.org/b/154374>

        Reviewed by Simon Fraser.

        We already had a policy that reduced tiling coverage to a minimum while the system
        is under memory pressure. However, that policy wouldn't kick in immediately after
        receiving the pressure notification, but the next time we flush compositing state.

        This change makes it happen sooner, improving our chances to escape death!

        * page/Page.h:
        * page/Page.cpp:
        (WebCore::Page::forEachPage):

            Add a little helper for visiting every Page.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::releaseCriticalMemory):

            When under critical memory pressure, schedule a compositing flush in all Pages.
            This ensures that the reduced tiling coverage policy takes effect, allowing us to
            immediately drop several tiles in each visible web view.

        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        (WebCore::MemoryPressureHandler::install):

            To ensure that this behavior is testable with the fake memory pressure notification,
            make the fake handler set the "in memory pressure" state just like the real one would.
            I don't know why we were not doing this previously, it was just an oversight.
            After the simulation completes, it schedules a runloop callback that resets the
            "in memory pressure" state.

2016-02-17  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] Implement FontFaceSet
        https://bugs.webkit.org/show_bug.cgi?id=153348

        Reviewed by Simon Fraser.

        The CSS Font Loading spec includes a FontFaceSet object which represents
        a collection of FontFaces. This patch implements such an object, and
        backs it with a vector of FontFaces. Similarly to the FontFace object,
        FontFaceSet is separated into a FontFaceSet frontend object and a
        CSSFontFaceSet backend object, which actually owns the FontFace objects.
        All the interaction with Promises is performed in the frontend object.

        This patch does not implement the EventTarget part of the FontFaceSet
        API, so the only way to know when a font is finished loading is by using
        the associated Promise objects.

        The CSS Font Loading spec describes how the Document should vend an
        instance of FontFaceSet which represents the font faces currently
        associated with the Document. However, that functionality is
        forthcoming. Currently, the only way to get a FontFaceSet is to create
        one yourself (using the constructor). Therefore, this patch does not
        implement the spec's notion of a "CSS-connected font face."

        Test: fast/text/font-face-set-javascript.html

        * CMakeLists.txt: Add new files.
        * DerivedSources.make: Ditto.
        * WebCore.vcxproj/WebCore.vcxproj: Ditto.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * bindings/js/JSFontFaceSetCustom.cpp: Added.
        (WebCore::JSFontFaceSet::ready): Use the Promise member.
        (WebCore::JSFontFaceSet::entries): Use existing iterator code.
        (WebCore::JSFontFaceSet::keys):
        (WebCore::JSFontFaceSet::values):
        * css/CSSAllInOne.cpp: Add new files.
        * css/CSSFontFace.cpp: We now have a collection of clients (instead of
        just one). Also, we need to keep a pointer to our FontFace wrapper.
        (WebCore::CSSFontFace::CSSFontFace):
        (WebCore::CSSFontFace::addClient):
        (WebCore::CSSFontFace::removeClient):
        (WebCore::CSSFontFace::setStatus): Rename the delegate callback to be
        more clear.
        (WebCore::CSSFontFace::fontLoaded):
        (WebCore::CSSFontFace::addedToSegmentedFontFace): Deleted.
        (WebCore::CSSFontFace::removedFromSegmentedFontFace): Deleted.
        * css/CSSFontFace.h: Same as above.
        (WebCore::CSSFontFace::create):
        (WebCore::CSSFontFace::Client::~Client):
        (WebCore::CSSFontFace::Client::kick):
        (WebCore::CSSFontFace::Client::stateChanged):
        (WebCore::CSSFontFace::wrapper):
        (WebCore::CSSFontFaceClient::~CSSFontFaceClient): Deleted.
        * css/CSSFontFaceSet.cpp: Added. Initial imlementation.
        (WebCore::CSSFontFaceSet::CSSFontFaceSet):
        (WebCore::CSSFontFaceSet::~CSSFontFaceSet):
        (WebCore::CSSFontFaceSet::incrementActiveCount):
        (WebCore::CSSFontFaceSet::decrementActiveCount):
        (WebCore::CSSFontFaceSet::has):
        (WebCore::CSSFontFaceSet::add):
        (WebCore::CSSFontFaceSet::remove):
        (WebCore::extractFamilies):
        (WebCore::familiesIntersect): Because this is an initial imlementation,
        this function is not optimized. A subsequent patch (which implements
        Document.fonts) will optimize this.
        (WebCore::CSSFontFaceSet::matchingFaces):
        (WebCore::CSSFontFaceSet::load):
        (WebCore::CSSFontFaceSet::check):
        (WebCore::CSSFontFaceSet::stateChanged):
        * css/CSSFontFaceSet.h: Added.
        (WebCore::CSSFontFaceSetClient::~CSSFontFaceSetClient):
        (WebCore::CSSFontFaceSet::size):
        (WebCore::CSSFontFaceSet::operator[]):
        (WebCore::CSSFontFaceSet::status):
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::familyNameFromPrimitive):
        (WebCore::CSSFontSelector::registerLocalFontFacesForFamily):
        (WebCore::CSSFontSelector::addFontFaceRule):
        (WebCore::familyNameFromPrimitive): Deleted.
        (WebCore::CSSFontSelector::kick): Deleted.
        * css/CSSFontSelector.h:
        * css/CSSSegmentedFontFace.cpp:
        (WebCore::CSSSegmentedFontFace::~CSSSegmentedFontFace):
        (WebCore::CSSSegmentedFontFace::appendFontFace):
        (WebCore::CSSSegmentedFontFace::kick):
        (WebCore::CSSSegmentedFontFace::fontLoaded): Deleted.
        * css/CSSSegmentedFontFace.h:
        * css/FontFace.cpp:
        (WebCore::FontFace::FontFace):
        (WebCore::FontFace::~FontFace):
        (WebCore::FontFace::stateChanged): Renamed to make its purpose clearer.
        (WebCore::FontFace::kick): Deleted.
        * css/FontFace.h:
        * css/FontFaceSet.cpp: Added.
        (WebCore::createPromise):
        (WebCore::FontFaceSet::FontFaceSet):
        (WebCore::FontFaceSet::~FontFaceSet):
        (WebCore::FontFaceSet::Iterator::Iterator):
        (WebCore::FontFaceSet::Iterator::next):
        (WebCore::FontFaceSet::PendingPromise::PendingPromise):
        (WebCore::FontFaceSet::PendingPromise::~PendingPromise):
        (WebCore::FontFaceSet::has):
        (WebCore::FontFaceSet::size):
        (WebCore::FontFaceSet::add):
        (WebCore::FontFaceSet::remove):
        (WebCore::FontFaceSet::clear):
        (WebCore::FontFaceSet::load): Most of the complexity of loading is
        due to the promises involved. Rather than use the Javascript function
        Promise.all(), this patch builds a data structure to represent the
        promises which need to be resolved. When fonts finish loading, we look
        at the data structure to determine which promises to resolve.
        (WebCore::FontFaceSet::check):
        (WebCore::FontFaceSet::status):
        (WebCore::FontFaceSet::canSuspendForDocumentSuspension):
        (WebCore::FontFaceSet::startedLoading):
        (WebCore::FontFaceSet::completedLoading):
        (WebCore::FontFaceSet::fulfillPromise): Keep the promise alive.
        (WebCore::FontFaceSet::faceFinished):
        * css/FontFaceSet.h: Added.
        (WebCore::FontFaceSet::create):
        (WebCore::FontFaceSet::load):
        (WebCore::FontFaceSet::check):
        (WebCore::FontFaceSet::createIterator):
        (WebCore::FontFaceSet::PendingPromise::create):
        * css/FontFaceSet.idl: Added.
        * dom/EventNames.h:
        * dom/EventTargetFactory.in:

2016-02-17  Mark Lam  <mark.lam@apple.com>

        Callers of JSString::value() should check for exceptions thereafter.
        https://bugs.webkit.org/show_bug.cgi?id=154346

        Reviewed by Geoffrey Garen.

        No new tests.  The crash that results from this issue is dependent on a race
        condition where an OutOfMemory error occurs precisely at the point where the
        JSString::value() function is called on a rope JSString.

        * bindings/js/JSHTMLAllCollectionCustom.cpp:
        (WebCore::callHTMLAllCollection):
        * bindings/js/JSStorageCustom.cpp:
        (WebCore::JSStorage::putDelegate):
        - Added a comment at the site of the exception check to clarify the meaning of
          the return value.

2016-02-17  David Kilzer  <ddkilzer@apple.com>

        [Cocoa] Always check the return value of dlopen() and dlsym() in Release builds
        <http://webkit.org/b/154364>

        Reviewed by Alexey Proskuryakov.

        * platform/mac/SoftLinking.h:
        (SOFT_LINK_LIBRARY): Change ASSERT_WITH_MESSAGE() to
        RELEASE_ASSERT_WITH_MESSAGE().
        (SOFT_LINK_FRAMEWORK): Ditto.
        (SOFT_LINK_PRIVATE_FRAMEWORK): Ditto.
        (SOFT_LINK_STAGED_FRAMEWORK): Ditto.
        (SOFT_LINK_FRAMEWORK_IN_UMBRELLA): Ditto.
        (SOFT_LINK): Ditto.
        (SOFT_LINK_POINTER): Ditto.
        (SOFT_LINK_CONSTANT): Ditto.
        (SOFT_LINK_FRAMEWORK_FOR_SOURCE): Add
        RELEASE_ASSERT_WITH_MESSAGE() when soft-link is not
        optional.

2016-02-17  Chris Dumez  <cdumez@apple.com>

        Regression(r196648): http://w3c-test.org/html/dom/interfaces.html redirects at the end of the test
        https://bugs.webkit.org/show_bug.cgi?id=154357

        Reviewed by Alexey Proskuryakov.

        Make location.assign() / location.replace()'s parameter mandatory,
        as per the specification:
        https://html.spec.whatwg.org/multipage/browsers.html#the-location-interface

        Previously, calling location.assign() / location.replace() without
        parameter would be identical to calling location.assign("undefined") /
        location.replace("undefined"), which is not useful.

        After r196648, http://w3c-test.org/html/dom/interfaces.html was able to
        test location.assign() / location.replace() further because they are now
        on the instance (where they should be) instead of the prototype. One of
        these tests calls these functions without parameter, expecting them to
        throw an exception. However, in WebKit, it would not throw and it would
        redirect us to http://w3c-test.org/html/dom/undefined.

        Firefox and Chrome both follow the specification already and throw in
        this case.

        No new tests, already covered by existing test.

        * page/Location.idl:
        Make location.assign() / location.replace()'s parameter mandatory,
        as per the specification.

2016-02-17  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196738.
        https://bugs.webkit.org/show_bug.cgi?id=154380

        broke css3/calc/transforms-translate.html (Requested by
        alexchristensen on #webkit).

        Reverted changeset:

        "WebKitCSSMatrix transformList with calculated relative length
        crashes Safari."
        https://bugs.webkit.org/show_bug.cgi?id=153333
        http://trac.webkit.org/changeset/196738

2016-02-17  Dean Jackson  <dino@apple.com>

        WebKitCSSMatrix transformList with calculated relative length crashes Safari.
        https://bugs.webkit.org/show_bug.cgi?id=153333
        <rdar://problem/17198383>

        Reviewed by Simon Fraser.

        WebKitCSSMatrix objects should fail to construct when not
        using absolute lengths.

        Updated existing tests:
        - transforms/cssmatrix-2d-interface.xhtml
        - transforms/cssmatrix-3d-interface.xhtml

        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertTransform): Tell transformsForValue
        that we don't require absolute lengths.
        * css/TransformFunctions.cpp:
        (WebCore::convertToFloatLength): Add an optional parameter that will
        cause the conversion to fail if the primitive value has a non-absolute
        length.
        (WebCore::transformsForValue): Pass the parameter for requiring an
        absolute length on to convertToFloatLength when necessary.
        * css/TransformFunctions.h:
        * css/WebKitCSSMatrix.cpp:
        (WebCore::WebKitCSSMatrix::setMatrixValue): In this case we do
        require all transform strings to have absolute lengths, not ones
        that depend on the font size or are calculated.

2016-02-17  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196712.
        https://bugs.webkit.org/show_bug.cgi?id=154371

        This change caused 5 API test failures on ios-simulator
        (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "[iOS] Purge GraphicsServices font cache on memory warning."
        https://bugs.webkit.org/show_bug.cgi?id=154343
        http://trac.webkit.org/changeset/196712

2016-02-17  Brady Eidson  <beidson@apple.com>

        Modern IDB: More Encoder/Decoder/Messaging scaffolding for WK2 IPC.
        https://bugs.webkit.org/show_bug.cgi?id=154356

        Reviewed by Alex Christensen.

        No change in behavior yet; Just laying the groundwork.

        * Modules/indexeddb/shared/IDBDatabaseInfo.h:
        (WebCore::IDBDatabaseInfo::encode):
        (WebCore::IDBDatabaseInfo::decode):

        * Modules/indexeddb/shared/IDBError.h:
        (WebCore::IDBError::encode):
        (WebCore::IDBError::decode):

        * Modules/indexeddb/shared/IDBRequestData.h:
        (WebCore::IDBRequestData::decode):

        * Modules/indexeddb/shared/IDBResultData.h:
        (WebCore::IDBResultData::encode):
        (WebCore::IDBResultData::decode):

2016-02-17  Saam barati  <sbarati@apple.com>

        Implement Proxy [[Get]]
        https://bugs.webkit.org/show_bug.cgi?id=154081

        Reviewed by Michael Saboff.

        Tests are in JavaScriptCore.

        * bindings/js/JSCryptoAlgorithmDictionary.cpp:
        (WebCore::getProperty):
        (WebCore::getHashAlgorithm):
        * bindings/js/JSCryptoKeySerializationJWK.cpp:
        (WebCore::getJSArrayFromJSON):
        (WebCore::getStringFromJSON):
        (WebCore::getBooleanFromJSON):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::DialogHandler::returnValue):
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::tryGetProperty):
        * bindings/js/JSStorageCustom.cpp:
        (WebCore::JSStorage::deleteProperty):
        (WebCore::JSStorage::deletePropertyByIndex):
        (WebCore::JSStorage::putDelegate):
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneSerializer::getProperty):
        * testing/Internals.cpp:
        (WebCore::Internals::isReadableStreamDisturbed):

2016-02-17  Simon Fraser  <simon.fraser@apple.com>

        PDFPlugin's scrollableArea container is not properly unregistered when page is going into the PageCache
        https://bugs.webkit.org/show_bug.cgi?id=148182

        Reviewed by Brent Fulgham.

        When handling Command-arrow key while showing a scrollable PDF, the timing of PDFPlugin
        teardown and navigation could result in PDFPlugin::destroy() getting the wrong FrameView,
        so the old FrameView was left with a stale pointer in its scrollableAreaSet.

        Fix this by adding an explicit willDetatchRenderer() which is called on the plugin
        before the Frame gets a new FrameView.

        Also narrow the scope of the RefPtr<Widget> in HTMLPlugInElement::defaultEventHandler()
        so that the Widget is not kept alive over a possible navigation.

        I was unable to make an automated test, because reproducing the bug requires handling
        a Command-arrow key event in a way that the last ref to a Widget is held over the event
        handling, and this wasn't possible in an iframe.

        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::defaultEventHandler):
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::willDetachRenderers):
        * plugins/PluginViewBase.h:
        (WebCore::PluginViewBase::willDetatchRenderer):
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::detachRenderTree): Drive-by nullptr.

2016-02-17  Brady Eidson  <beidson@apple.com>

        Modern IDB: Encoder/Decoder/Messaging scaffolding for WK2 IPC.
        https://bugs.webkit.org/show_bug.cgi?id=154351

        Reviewed by Alex Christensen.

        No change in behavior yet; Just laying the groundwork.

        * Modules/indexeddb/IDBDatabaseIdentifier.h:
        (WebCore::IDBDatabaseIdentifier::encode):
        (WebCore::IDBDatabaseIdentifier::decode):
        
        * Modules/indexeddb/shared/IDBCursorInfo.h:
        (WebCore::IDBCursorInfo::encode):
        (WebCore::IDBCursorInfo::decode):
        
        * Modules/indexeddb/shared/IDBIndexInfo.h:
        (WebCore::IDBIndexInfo::encode):
        (WebCore::IDBIndexInfo::decode):
        
        * Modules/indexeddb/shared/IDBObjectStoreInfo.h:
        (WebCore::IDBObjectStoreInfo::encode):
        (WebCore::IDBObjectStoreInfo::decode):
        
        * Modules/indexeddb/shared/IDBRequestData.h:
        (WebCore::IDBRequestData::encode):
        (WebCore::IDBRequestData::decode):
        
        * Modules/indexeddb/shared/IDBResourceIdentifier.h:
        (WebCore::IDBResourceIdentifier::encode):
        (WebCore::IDBResourceIdentifier::decode):
        
        * Modules/indexeddb/shared/IDBTransactionInfo.h:
        (WebCore::IDBTransactionInfo::encode):
        (WebCore::IDBTransactionInfo::decode):

2016-02-17  Andreas Kling  <akling@apple.com>

        [iOS] Purge GraphicsServices font cache on memory warning.
        <https://webkit.org/b/154343>

        Reviewed by Antti Koivisto.

        The GS font cache was holding on to the last retain on CSS fonts after they stop being used.
        Call SPI to purge it on memory pressure.

        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        (WebCore::MemoryPressureHandler::platformReleaseMemory):
        * platform/spi/ios/GraphicsServicesSPI.h:

2016-02-17  Chris Dumez  <cdumez@apple.com>

        Regression(r196648): window.showModalDialog is no longer undefined if the client does not allow showing modal dialog
        https://bugs.webkit.org/show_bug.cgi?id=154330

        Reviewed by Gavin Barraclough.

        window.showModalDialog is no longer undefined if the client does not
        allow showing modal dialog after r196648. This patch fixes the issue
        and add test coverage for this.

        Test: fast/dom/Window/forbid-showModalDialog.html

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        - Move the DOMWindow::canShowModalDialog() check *before* checking
          for static properties as showModalDialog is now in the static
          property table after r196648.
        - Add check for Base::getOwnPropertySlot() first to support overriding
          window.showModalDialog (This behavior matches Firefox).
        - Return false if DOMWindow::canShowModalDialog() returns false as this
          seems cleaner than claiming that the property is there but undefined.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::canShowModalDialogNow): Deleted.
        This was indentical to canShowModalDialog().

        (WebCore::DOMWindow::canShowModalDialog):
        (WebCore::DOMWindow::setCanShowModalDialogOverride):
        (WebCore::DOMWindow::showModalDialog):
        * page/DOMWindow.h:
        * testing/Internals.cpp:
        (WebCore::Internals::setCanShowModalDialogOverride):
        * testing/Internals.h:
        * testing/Internals.idl:
        Add support for overriding the ChromeClient's canShowModalDialog
        decision and hook it up to Internals to add layout test coverage.

2016-02-17  Brady Eidson  <beidson@apple.com>

        Modern IDB: More WK2 IPC Scaffolding.
        https://bugs.webkit.org/show_bug.cgi?id=154317

        Reviewed by Alex Christensen.

        No change in behavior yet; Just laying the groundwork.

        * Modules/indexeddb/shared/IDBCursorInfo.cpp:
        (WebCore::IDBCursorInfo::IDBCursorInfo):
        * Modules/indexeddb/shared/IDBCursorInfo.h:
        (WebCore::IDBCursorInfo::decode):
        * Modules/indexeddb/shared/IDBError.h:
        (WebCore::IDBError::decode):
        * Modules/indexeddb/shared/IDBIndexInfo.h:
        (WebCore::IDBIndexInfo::decode):
        * Modules/indexeddb/shared/IDBObjectStoreInfo.h:
        (WebCore::IDBObjectStoreInfo::decode):
        * Modules/indexeddb/shared/IDBRequestData.cpp:
        (WebCore::IDBRequestData::IDBRequestData):
        * Modules/indexeddb/shared/IDBRequestData.h:
        (WebCore::IDBRequestData::decode):
        * Modules/indexeddb/shared/IDBResourceIdentifier.cpp:
        (WebCore::IDBResourceIdentifier::IDBResourceIdentifier):
        * Modules/indexeddb/shared/IDBResourceIdentifier.h:
        (WebCore::IDBResourceIdentifier::decode):
        * Modules/indexeddb/shared/IDBResultData.cpp:
        (WebCore::IDBResultData::IDBResultData):
        * Modules/indexeddb/shared/IDBResultData.h:
        (WebCore::IDBResultData::decode):
        * Modules/indexeddb/shared/IDBTransactionInfo.cpp:
        (WebCore::IDBTransactionInfo::IDBTransactionInfo):
        * Modules/indexeddb/shared/IDBTransactionInfo.h:
        (WebCore::IDBTransactionInfo::decode):
        * WebCore.xcodeproj/project.pbxproj:

2016-02-17  Eric Carlson  <eric.carlson@apple.com>

        [Win] Allow ports to disable automatic text track selection
        https://bugs.webkit.org/show_bug.cgi?id=154322
        <rdar://problem/24623986>

        Reviewed by Brent Fulgham.

        * page/CaptionUserPreferencesMediaAF.cpp:
        (MTEnableCaption2015BehaviorPtr): Implement for Windows.

2016-02-17  Gavin Barraclough  <barraclough@apple.com>

        JSDOMWindow::put should not do the same thing twice
        https://bugs.webkit.org/show_bug.cgi?id=154334

        Reviewed by Chris Dumez.

        It either calls JSGlobalObject::put or Base::put. Hint: these are basically the same thing.
        In the latter case it might call lookupPut. That's redundant; JSObject::put handles static
        table entries.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::put):
            - just call Base::put.
        (WebCore::JSDOMWindow::putByIndex):
            - just call Base::putByIndex.

2016-02-17  Nan Wang  <n_wang@apple.com>

        AX: Implement sentence related text marker functions using TextIterator
        https://bugs.webkit.org/show_bug.cgi?id=154312

        Reviewed by Chris Fleizach.

        Using CharacterOffset to implement sentence related text marker calls. Reused
        logic from VisibleUnits class. Also fixed an issue where paragraph navigation
        should skip preceding and following BR nodes.

        Test: accessibility/mac/text-marker-sentence-nav.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::resetNodeAndOffsetForReplacedNode):
        (WebCore::setRangeStartOrEndWithCharacterOffset):
        (WebCore::AXObjectCache::characterOffsetForNodeAndOffset):
        (WebCore::AXObjectCache::previousCharacterOffset):
        (WebCore::AXObjectCache::startCharacterOffsetOfWord):
        (WebCore::AXObjectCache::endCharacterOffsetOfWord):
        (WebCore::AXObjectCache::previousWordStartCharacterOffset):
        (WebCore::AXObjectCache::leftWordRange):
        (WebCore::AXObjectCache::rightWordRange):
        (WebCore::AXObjectCache::characterBefore):
        (WebCore::characterOffsetNodeIsBR):
        (WebCore::parentEditingBoundary):
        (WebCore::AXObjectCache::nextBoundary):
        (WebCore::AXObjectCache::previousBoundary):
        (WebCore::AXObjectCache::paragraphForCharacterOffset):
        (WebCore::AXObjectCache::nextParagraphEndCharacterOffset):
        (WebCore::AXObjectCache::previousParagraphStartCharacterOffset):
        (WebCore::AXObjectCache::startCharacterOffsetOfSentence):
        (WebCore::AXObjectCache::endCharacterOffsetOfSentence):
        (WebCore::AXObjectCache::sentenceForCharacterOffset):
        (WebCore::AXObjectCache::nextSentenceEndCharacterOffset):
        (WebCore::AXObjectCache::previousSentenceStartCharacterOffset):
        (WebCore::AXObjectCache::rootAXEditableElement):
        (WebCore::startWordBoundary): Deleted.
        (WebCore::endWordBoundary): Deleted.
        (WebCore::AXObjectCache::nextWordBoundary): Deleted.
        (WebCore::AXObjectCache::previousWordBoundary): Deleted.
        * accessibility/AXObjectCache.h:
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
        * editing/VisibleUnits.cpp:
        (WebCore::startWordBoundary):
        (WebCore::startOfWord):
        (WebCore::endWordBoundary):
        (WebCore::startSentenceBoundary):
        (WebCore::startOfSentence):
        (WebCore::endSentenceBoundary):
        * editing/VisibleUnits.h:

2016-02-17  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] GridSpan refactoring
        https://bugs.webkit.org/show_bug.cgi?id=153868

        Reviewed by Sergio Villar Senin.

        Add new enum to know if a GridSpan is definite or indefinite.
        That way we don't need GridUnresolvedSpan class (which is removed).
        We can always have two GridSpans in GridCoordinate,
        if the position is "auto" the GridSpan will be marked as indefinite.
        This will allow in a follow-up patch to avoid repeated calls
        to methods that resolve positions.

        Most operations in GridSpan are restricted to definite GridSpans (access
        to positions, iterator, etc.). For indefinite GridSpans we only need to
        know that they're indefinite, we shouldn't use the rest of the data.

        No new tests, no change of behavior.

        * css/CSSGridTemplateAreasValue.cpp:
        (WebCore::stringForPosition):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateAreasRow):
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::createImplicitNamedGridLinesFromGridArea):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::GridIterator::nextEmptyGridArea):
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
        (WebCore::RenderGrid::insertItemIntoGrid):
        (WebCore::RenderGrid::placeItemsOnGrid):
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        (WebCore::RenderGrid::gridAreaBreadthForChildIncludingAlignmentOffsets):
        (WebCore::RenderGrid::columnAxisOffsetForChild):
        (WebCore::RenderGrid::rowAxisOffsetForChild):
        (WebCore::RenderGrid::placeAutoMajorAxisItemsOnGrid): Deleted.
        (WebCore::RenderGrid::autoPlacementMinorAxisDirection): Deleted.
        (WebCore::RenderGrid::populateGridPositions): Deleted.
        * rendering/style/GridCoordinate.h:
        (WebCore::GridSpan::definiteGridSpan):
        (WebCore::GridSpan::indefiniteGridSpan):
        (WebCore::GridSpan::operator==):
        (WebCore::GridSpan::integerSpan):
        (WebCore::GridSpan::resolvedInitialPosition):
        (WebCore::GridSpan::resolvedFinalPosition):
        (WebCore::GridSpan::begin):
        (WebCore::GridSpan::end):
        (WebCore::GridSpan::isDefinite):
        (WebCore::GridSpan::GridSpan):
        (WebCore::GridCoordinate::GridCoordinate):
        * rendering/style/GridResolvedPosition.cpp:
        (WebCore::initialPositionSide):
        (WebCore::finalPositionSide):
        (WebCore::adjustGridPositionsFromStyle):
        (WebCore::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveGridPositionAgainstOppositePosition):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromStyle):
        (WebCore::implicitNamedGridLineForSide): Deleted.
        (WebCore::GridResolvedPosition::isNonExistentNamedLineOrArea): Deleted.
        (WebCore::resolveNamedGridLinePositionFromStyle): Deleted.
        (WebCore::resolveGridPositionFromStyle): Deleted.
        * rendering/style/GridResolvedPosition.h:
        (WebCore::GridResolvedPosition::GridResolvedPosition): Deleted.
        (WebCore::GridResolvedPosition::operator*): Deleted.
        (WebCore::GridResolvedPosition::operator++): Deleted.
        (WebCore::GridResolvedPosition::operator==): Deleted.

2016-02-17  Chris Dumez  <cdumez@apple.com>

        Window should have its 'constructor' property on the prototype
        https://bugs.webkit.org/show_bug.cgi?id=154037
        <rdar://problem/24689078>

        Reviewed by Gavin Barraclough.

        Window should have its 'constructor' property on the prototype as per
        the Web IDL specification:
        http://heycam.github.io/webidl/#interface-prototype-object

        Firefox and Chrome already match the specification.

        No new tests, covered by:
        - fast/dom/Window/window-constructor-settable.html
        - fast/dom/Window/window-constructor.html
        - http/tests/security/cross-origin-window-property-access.html
        - imported/w3c/web-platform-tests/html/dom/interfaces.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (ConstructorShouldBeOnInstance): Deleted.
        Drop this routine as all constructors are now on the prototype.

        (InstancePropertyCount):
        Do not account for constructor properties as these can only be
        on the prototype now.

        (PrototypePropertyCount):
        Increment the property count by 1 if the interface has a constructor
        property (e.g. [NoInterfaceObject] interfaces do not have one).

        (GeneratePropertiesHashTable):
        Stop calling ConstructorShouldBeOnInstance() as it no longer exists.
        Always generated the "constructor" property if:
        1. We are generating the prototype hash table.
        and
        2. The interface needs a constructor (i.e. not marked as
           [NoInterfaceObject]).

        (GenerateImplementation):
        - Drop code handling the case where ConstructorShouldBeOnInstance()
          returns true as constructors are not always on the prototype and
          the ConstructorShouldBeOnInstance() routine has been dropped.
        - Drop code handling [CustomProxyToJSObject]. Now that the constructor
          is always on the prototype, we never need to cast thisValue to a
          JSDOMWindow (by calling toJSDOMWindow). In the Window case, thisValue
          is now casted to a JSDOMWindowPrototype*, similarly to other interfaces
          so we don't need a special casting function anymore.
        - Stop generating security checks. This only impacts Window as it is the
          only interface marked as [CheckSecurity]. The cross-origin checking code
          as it was would not work when "constructor" is on the prototype because
          thisValue is a JSDOMWindowPrototype, not a JSDOMWindow and we have no
          way of getting the wrapped window. Also, the security check is no longer
          needed because:
          1. Accessing crossOriginWindow.constructor will not work now that
             constructor is on the prototype because
             JSDOMWindow::getOwnPropertySlot() already prevents access to the
             prototype in the cross-origin case.
          2. "constructor" is a value property, not a getter/setter. Therefore,
             it is no possible to use the getter/setter from a same origin window
             instance and call it on a cross origin window.

2016-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        Add a way to test ScrollAnimator
        https://bugs.webkit.org/show_bug.cgi?id=153479

        Reviewed by Michael Catanzaro.

        Tests: fast/scrolling/overlay-scrollbars-scroll-corner.html
               fast/scrolling/scroll-animator-basic-events.html
               fast/scrolling/scroll-animator-overlay-scrollbars-hovered.html
               fast/scrolling/scroll-animator-select-list-events.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * page/FrameView.cpp:
        (WebCore::FrameView::usesMockScrollAnimator):
        (WebCore::FrameView::logMockScrollAnimatorMessage):
        * page/FrameView.h:
        * page/Settings.cpp:
        (WebCore::Settings::setUsesMockScrollAnimator):
        (WebCore::Settings::usesMockScrollAnimator):
        * page/Settings.h:
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::scrollAnimator):
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::usesMockScrollAnimator):
        (WebCore::ScrollableArea::logMockScrollAnimatorMessage):
        * platform/mock/ScrollAnimatorMock.cpp: Added.
        (WebCore::ScrollAnimatorMock::create):
        (WebCore::ScrollAnimatorMock::ScrollAnimatorMock):
        (WebCore::ScrollAnimatorMock::~ScrollAnimatorMock):
        (WebCore::ScrollAnimatorMock::didAddVerticalScrollbar):
        (WebCore::ScrollAnimatorMock::didAddHorizontalScrollbar):
        (WebCore::ScrollAnimatorMock::willRemoveVerticalScrollbar):
        (WebCore::ScrollAnimatorMock::willRemoveHorizontalScrollbar):
        (WebCore::ScrollAnimatorMock::mouseEnteredContentArea):
        (WebCore::ScrollAnimatorMock::mouseMovedInContentArea):
        (WebCore::ScrollAnimatorMock::mouseExitedContentArea):
        (WebCore::ScrollAnimatorMock::mouseEnteredScrollbar):
        (WebCore::ScrollAnimatorMock::mouseExitedScrollbar):
        (WebCore::ScrollAnimatorMock::mouseIsDownInScrollbar):
        * platform/mock/ScrollAnimatorMock.h: Added.
        * platform/mock/ScrollbarThemeMock.cpp:
        (WebCore::ScrollbarThemeMock::usesOverlayScrollbars):
        * platform/mock/ScrollbarThemeMock.h:
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::usesMockScrollAnimator):
        (WebCore::RenderLayer::logMockScrollAnimatorMessage):
        * rendering/RenderLayer.h:
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::usesMockScrollAnimator):
        (WebCore::RenderListBox::logMockScrollAnimatorMessage):
        * rendering/RenderListBox.h:
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::setUsesMockScrollAnimator):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Enable overlay scrollbars in GTK+ after r196641.

        This was blocked by bug #153404, but the commit that introduced
        the regression was rolled out in r196641.

        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk):

2016-02-16  Gavin Barraclough  <barraclough@apple.com>

        JSDOMWindow::getOwnPropertySlot should just call getStaticPropertySlot
        https://bugs.webkit.org/show_bug.cgi?id=154257

        Reviewed by Chris Dumez.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::getOwnPropertySlot):
            - JSDOMWindow::getOwnPropertySlot should just call getStaticPropertySlot

2016-02-16  Gavin Barraclough  <barraclough@apple.com>

        JSDOMWindow::getOwnPropertySlot should not search photo chain
        https://bugs.webkit.org/show_bug.cgi?id=154102

        Reviewed by Chris Dumez.

        Should only return *own* properties.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowGetOwnPropertySlotNamedItemGetter):

2016-02-16  Alex Christensen  <achristensen@webkit.org>

        CMake build fix.

        * PlatformMac.cmake:

2016-02-16  Chris Dumez  <cdumez@apple.com>

        Navigator.geolocation should not be marked a [Replaceable] and should be on the prototype
        https://bugs.webkit.org/show_bug.cgi?id=154304
        <rdar://problem/24685092>

        Reviewed by Gavin Barraclough.

        1. Drop the [Replaceable] IDL extended attribute for navigator.geolocation
           as this does not match other browsers or the specification:
           - https://dev.w3.org/geo/api/spec-source.html#geolocation_interface
        2. Move Navigator attributes to the prototype, where they should be as
           per the Web IDL specification.

        The previous behavior was meant as a workaround for a bug in the Amazon
        iOS app (rdar://problem/16332749). However, I have confirmed that the
        latest Amazon App no longer has any issue with those changes.

        Test: js/navigator-set-geolocation.html

        * Modules/geolocation/NavigatorGeolocation.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (InterfaceRequiresAttributesOnInstanceForCompatibility): Deleted.

2016-02-16  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION(r196268): WTFCrashWithSecurityImplication on SVG path animation tests
        https://bugs.webkit.org/show_bug.cgi?id=154221

        Reviewed by Brent Fulgham.

        In r196268, a destructor was added to SVGListPropertyTearOff that notifies
        its wrapper (the SVGAnimatedListPropertyTearoff) about its deletion. This
        allows the wrapper to nullify any references to the wrapped content.
        
        We needed to do the same thing for SVGPathSegListPropertyTearOff. Both
        SVGPathSegListPropertyTearOff and SVGListPropertyTearOff inherit from
        SVGListProperty and both hold pointers to SVGAnimatedListPropertyTearOff
        which needs to be notified.
        
        Tests: exiting svg path animation tests should not crash.

        * svg/properties/SVGPathSegListPropertyTearOff.h:
        (WebCore::SVGPathSegListPropertyTearOff::~SVGPathSegListPropertyTearOff):

2016-02-16  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION (r190430): WTFCrashWithSecurityImplication in:void SVGRootInlineBox::layoutCharactersInTextBoxes()
        https://bugs.webkit.org/show_bug.cgi?id=154185

        Reviewed by Ryosuke Niwa.

        This is a regression caused by adding support for HTMLSlotElement. The
        crash happens when adding an HTMLSlotElement to anther element which should
        not have it as a child like SVGTextElement for example. In this case, we
        were creating a RenderText which should not be happen inside an SVG document.
        The RenderText::createTextBox() was creating InlineTextBox for the slot's
        text and attach it to the SVGRootInlineBox. In layoutCharactersInTextBoxes(),
        the assumption is the inline box is either SVGInlineTextBox or SVGInlineFlowBox.
        But since we have an InlineTextBox instead, the crash happens when casting
        the InlineTextBox to SVGInlineFlowBox.

        The fix is for createRenderTreeForSlotAssignees() to not create a renderer
        when the parent element should not have a renderer for the this element.
        This is the same thing we do for createRenderer() which handles the non
        HTMLSlotElement case and which is called also from createRenderTreeRecursively().
        
        Test: fast/shadow-dom/text-slot-child-crash.svg

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::moveToFlowThreadIfNeeded):
        (WebCore::Style::TreeResolver::createRenderer): Delete the check for
        shouldCreateRenderer() and handling the case when resolvedStyle is null
        since these are handled by the caller createRenderTreeRecursively().
        
        (WebCore::Style::TreeResolver::createRenderTreeForSlotAssignees):
        Assert shouldCreateRenderer() is true for this element.
        
        (WebCore::Style::TreeResolver::createRenderTreeRecursively): Don't create
        the renderer if shouldCreateRenderer() returns false. Also handle the case
        when resolvedStyle is null and pass the new style to createRenderer().
        
        * style/StyleTreeResolver.h:

2016-02-16  Simon Fraser  <simon.fraser@apple.com>

        Every RenderLayer should not have to remove itself from the scrollableArea set
        https://bugs.webkit.org/show_bug.cgi?id=154311

        Reviewed by Zalan Bujtas.

        A subset of RenderLayers are are scrollable, and get registered on the FrameView,
        but we pay the cost of a hash lookup for removal on every RenderLayer, which is a waste.
        
        Store a bit that tells RenderLayer that it's in the set and needs to be removed.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::RenderLayer):
        (WebCore::RenderLayer::~RenderLayer):
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/RenderLayer.h:

2016-02-16  Daniel Bates  <dabates@apple.com>

        CSP: Update violation report 'Content-Type' header
        https://bugs.webkit.org/show_bug.cgi?id=153166
        <rdar://problem/24383327>

        Reviewed by Brent Fulgham.

        Inspired by Blink patch:
        <https://src.chromium.org/viewvc/blink?view=rev&revision=154215>

        Post the Content Security Policy violation report with Content-Type application/csp-report as
        per section Reporting of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        Currently we post CSP violation reports with Content-Type application/json.

        * html/parser/XSSAuditorDelegate.cpp:
        (WebCore::XSSAuditorDelegate::didBlockScript): Use report type ViolationReportType::XSSAuditor to PingLoader.
        * loader/PingLoader.cpp:
        (WebCore::PingLoader::sendViolationReport): Modified to take argument of type ViolationReportType
        to determine the appropriate Content-Type header to use for the report. For a XSS Auditor violation report
        we use Content-Type application/json. For a Content Security Policy violation report we use Content-Type
        application/csp-report. Additionally, pass a ASCIILiteral() to ResourceRequestBase::setHTTPMethod()
        as opposed to a constant string literal to avoid a copy of a constant string literal.
        * loader/PingLoader.h: Add enum class ViolationReportType.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportViolation): Use report type ViolationReportType::ContentSecurityPolicy.

2016-02-16  Alex Christensen  <achristensen@webkit.org>

        Add checks before redirecting with NetworkSession
        https://bugs.webkit.org/show_bug.cgi?id=154298

        Reviewed by Andy Estes.

        This fixes http/tests/security/cors-post-redirect-307.html and 
        http/tests/navigation/post-307-response.html when using NetworkSession.

        * platform/network/ResourceRequestBase.h:
        WEBCORE_EXPORT some functions newly used in WebKit2.

2016-02-16  Daniel Bates  <dabates@apple.com>

        CSP: Fix parsing of 'host/path' source expressions
        https://bugs.webkit.org/show_bug.cgi?id=153170
        <rdar://problem/24383407>

        Reviewed by Brent Fulgham.

        Merged from Blink (patch by Mike West):
        <https://src.chromium.org/viewvc/blink?revision=154875&view=revision>

        Fixes an issue where a source of the form example.com/A/ was incorrectly considered
        invalid and hence such a requested resource would be blocked. A source of this form
        is valid by the definition of host-source in section Source List Syntax of the Content
        Security Policy 2.0 spec., <http://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::parseSource):

2016-02-16  Daniel Bates  <dabates@apple.com>

        CSP: Disallow an empty host in a host-source source expression
        https://bugs.webkit.org/show_bug.cgi?id=153168
        <rdar://problem/24383366>

        Reviewed by Brent Fulgham.

        Merged from Blink (patch by rob@robwu.nl):
        <https://src.chromium.org/viewvc/blink?revision=180407&view=revision>

        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::parseSource):

2016-02-16  Brady Eidson  <beidson@apple.com>

        Modern IDB: WK2 IPC Scaffolding.
        https://bugs.webkit.org/show_bug.cgi?id=154296

        Reviewed by Alex Christensen.
        
        No change in behavior yet; Just laying the groundwork.

        * Modules/indexeddb/client/IDBConnectionToServer.h:
        * Modules/indexeddb/server/IDBConnectionToClient.h:
        * Modules/indexeddb/shared/IDBResourceIdentifier.h:

2016-02-16  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Operations should be on the instance for global objects or if [Unforgeable]
        https://bugs.webkit.org/show_bug.cgi?id=154120
        <rdar://problem/24613231>

        Reviewed by Gavin Barraclough.

        Operations should be on the instance for global objects or if
        [Unforgeable] as per the Web IDL specification:
        - http://heycam.github.io/webidl/#es-operations
        - http://heycam.github.io/webidl/#dfn-unforgeable-on-an-interface

        This patch implements this behavior in order to align
        with the specification and other browsers.

        No new tests, already covered by existing tests.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess):
        Update function names now that they have "Instance" in their
        name instead of "Prototype".

        (WebCore::JSDOMWindow::getOwnPropertySlot):
        - Update function names now that they have "Instance" in their
          name instead of "Prototype".
        - Move the functions hard-coding *before* the static table check
          now that these functions are in the static table to maintain
          the previous behavior.

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::getOwnPropertySlotDelegate):
        Update function names now that they have "Instance" in their
        name instead of "Prototype".

        * bindings/scripts/CodeGeneratorJS.pm:
        - Move functions to the instance if their interface is a global
          object or if they are marked as [Unforgeable]. Operations are
          now treated more like attributes, as they can now be either on
          the instance or the prototype. In a lot of places, I now use
          the naming "properties" instead of "attributes" as "properties"
          refer both "attributes" and "operations" / "functions".

        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        Rebaseline bindings tests.

2016-02-16  Simon Fraser  <simon.fraser@apple.com>

        Rollout r188659. This broke scrolling of iframes and overflow when
        navigating back to a page in the page cache.
        
        The fix was overly agressive and had no layout test. I will fix the original
        issue a different way.

        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::CachedFrame):
        * page/FrameView.cpp:
        (WebCore::FrameView::clearScrollableAreas): Deleted.
        * page/FrameView.h:

2016-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] No hover-horizontal scrolling available
        https://bugs.webkit.org/show_bug.cgi?id=122859

        Reviewed by Michael Catanzaro.

        This is a regression of WebKit2, because in WebKit1 we used native
        widgets for frame scrollbars that handled this automatically. Now
        we need to also check if the mouse is over frame scrollbars to
        adjust the wheel event.

        Test: platform/gtk/scrollbars/main-frame-scrollbar-horizontal-wheel-scroll.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleWheelEvent): Pass the adjusted wheel
        event to platformCompleteWheelEvent().
        * page/gtk/EventHandlerGtk.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
        Check also frame scrollbars.

2016-02-16  Antti Koivisto  <antti@apple.com>

        Factor id mutation style invalidation code into a class
        https://bugs.webkit.org/show_bug.cgi?id=154287

        Reviewed by Andreas Kling.

        Also add a cheap basic optimization that avoids descendant invalidation if they can not be affected.

        It would be easy to implement fine grained invalidation like with classes and attribute selectors.
        However dynamic id changes are not common enough (nor recommended) to pay the memory cost of
        the required data structures.

        Test: fast/css/style-invalidation-id-change-descendants.html

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.xcodeproj/project.pbxproj:
        * css/RuleFeature.cpp:
        (WebCore::RuleFeatureSet::recursivelyCollectFeaturesFromSelector):
        (WebCore::RuleFeatureSet::add):
        (WebCore::RuleFeatureSet::clear):
        * css/RuleFeature.h:
        * dom/Element.cpp:
        (WebCore::makeIdForStyleResolution):
        (WebCore::Element::attributeChanged):
        (WebCore::checkNeedsStyleInvalidationForIdChange): Deleted.
        * style/IdChangeInvalidation.cpp: Added.
        (WebCore::Style::IdChangeInvalidation::invalidateStyle):
        * style/IdChangeInvalidation.h: Added.
        (WebCore::Style::IdChangeInvalidation::IdChangeInvalidation):
        (WebCore::Style::IdChangeInvalidation::~IdChangeInvalidation):

2016-02-16  Andreas Kling  <akling@apple.com>

        Drop StyleResolver and SelectorQueryCache when entering PageCache.
        <https://webkit.org/b/154238>

        Reviewed by Antti Koivisto.

        Stop keeping these around for cached pages to save lots of memory.
        We can easily rebuild them if a cached navigation occurs, and this
        way we also don't need to worry about invalidating style for cached
        pages in all the right places.

        Restoring a cached page will now lead to a forced style recalc.
        We don't try to defer this (beyond a zero-timer) since it's going
        to happen anyway, and it's nicer to front-load the cost rather than
        stuttering on the first user content interaction.

        * dom/Document.cpp:
        (WebCore::Document::setInPageCache):
        * history/CachedPage.cpp:
        (WebCore::CachedPage::restore):
        (WebCore::CachedPage::clear): Deleted.
        * history/CachedPage.h:
        (WebCore::CachedPage::markForVisitedLinkStyleRecalc): Deleted.
        (WebCore::CachedPage::markForFullStyleRecalc): Deleted.
        * history/PageCache.cpp:
        (WebCore::PageCache::markPagesForVisitedLinkStyleRecalc): Deleted.
        (WebCore::PageCache::markPagesForFullStyleRecalc): Deleted.
        * history/PageCache.h:
        * page/Frame.cpp:
        (WebCore::Frame::setPageAndTextZoomFactors): Deleted.
        * page/Page.cpp:
        (WebCore::Page::setViewScaleFactor): Deleted.
        (WebCore::Page::setDeviceScaleFactor): Deleted.
        (WebCore::Page::setPagination): Deleted.
        (WebCore::Page::setPaginationLineGridEnabled): Deleted.
        (WebCore::Page::setVisitedLinkStore): Deleted.

2016-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] clicking on the scrollbar trough steps rather than jumps to the clicked position
        https://bugs.webkit.org/show_bug.cgi?id=115363

        Reviewed by Michael Catanzaro.

        Allow ScrollbarTheme to decide the behavior of a button press event,
        instead of only deciding whether to center on thumb or not. This
        way we can match the current GTK+ behavior in WebKit, without
        affecting other ports.

        * platform/ScrollTypes.h: Add ScrollbarButtonPressAction enum.
        * platform/Scrollbar.cpp:
        (WebCore::Scrollbar::mouseDown): Ask ScrollbarTheme to handle the
        event for the pressed part and do the requested action.
        * platform/ScrollbarTheme.cpp:
        (WebCore::ScrollbarTheme::handleMousePressEvent): Add default
        implementation. It's equivalent to the previous default implementation.
        * platform/ScrollbarTheme.h:
        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::handleMousePressEvent): Match current
        GTK+ behavior: left click centers on thumb and right click
        scrolls. Dragging the thumb works for left and middle buttons.
        * platform/gtk/ScrollbarThemeGtk.h:
        * platform/ios/ScrollbarThemeIOS.h: Remove shouldCenterOnThumb,
        and don't override handleMousePressEvent since iOS wants the
        default behavior.
        * platform/ios/ScrollbarThemeIOS.mm:
        * platform/mac/ScrollbarThemeMac.h: Override handleMousePressEvent
        and remove shouldCenterOnThumb.
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::shouldCenterOnThumb): Same implementation just made it
        static to be used as helper.
        (WebCore::ScrollbarThemeMac::handleMousePressEvent): Return the
        desired action keeping the same behavior.
        * platform/win/ScrollbarThemeWin.cpp:
        (WebCore::ScrollbarThemeWin::handleMousePressEvent): Ditto.
        * platform/win/ScrollbarThemeWin.h:
        * rendering/RenderScrollbarTheme.h:

2016-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        Mouse cursor doesn't change when entering scrollbars
        https://bugs.webkit.org/show_bug.cgi?id=154243

        Reviewed by Simon Fraser.

        If the scrollbar is over or very close to text or a link, when
        entering the scrollbar the cursor is not changed, keeping the beam
        or hand cursor when using the scrollbar. Same happens for image
        documents where the magnifier cursor is used and it remains when
        entering the scrollbars. We should use pointer cursor always for
        scrollbars.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::updateCursor): Request also to include
        frame scrollbars in hit test result.
        (WebCore::EventHandler::selectCursor): Use always pointer cursor
        for scrollbars.

2016-02-15  Antti Koivisto  <antti@apple.com>

        Optimize style invalidations for attribute selectors
        https://bugs.webkit.org/show_bug.cgi?id=154242

        Reviewed by Andreas Kling.

        Currently we invalidate the whole element subtree if there are any attribute selectors for the changed attribute.
        This is slow as generally few if any elements are really affected. Using attribute selectors for dynamic styling
        should be performant.

        This patch implements optimization strategy for attributes similar to what we already have for classes:

        - Collect a map of all rules that contains descendant-affecting attribute selectors for a given attribute.
        - When an attribute value changes check if there are any such rules for it.
        - Check if the value change affects the results of any of the attribute selectors.
        - Only if it does invalidate the exact descendant elements affected by the rules.

        Test: fast/css/style-invalidation-attribute-change-descendants.html

        * WebCore.xcodeproj/project.pbxproj:
        * css/DocumentRuleSets.cpp:
        (WebCore::DocumentRuleSets::ancestorClassRules):
        (WebCore::DocumentRuleSets::ancestorAttributeRulesForHTML):

            Create optimization RuleSets when needed.

        * css/DocumentRuleSets.h:
        (WebCore::DocumentRuleSets::uncommonAttribute):
        (WebCore::DocumentRuleSets::features):
        * css/RuleFeature.cpp:
        (WebCore::RuleFeatureSet::recursivelyCollectFeaturesFromSelector):
        (WebCore::makeAttributeSelectorKey):
        (WebCore::RuleFeatureSet::collectFeatures):

            Collect rules with descendant affecting attribute selectors.

        (WebCore::RuleFeatureSet::add):
        (WebCore::RuleFeatureSet::clear):
        (WebCore::RuleFeatureSet::shrinkToFit):
        * css/RuleFeature.h:
        * css/SelectorChecker.cpp:
        (WebCore::anyAttributeMatches):
        (WebCore::SelectorChecker::attributeSelectorMatches):

            Expose function for matching single attribute selectors.

        (WebCore::canMatchHoverOrActiveInQuirksMode):
        * css/SelectorChecker.h:
        * dom/Attr.cpp:
        (WebCore::Attr::setValue):
        (WebCore::Attr::childrenChanged):
        * dom/Element.cpp:
        (WebCore::Element::setAttributeInternal):
        (WebCore::makeIdForStyleResolution):
        (WebCore::Element::attributeChanged):
        (WebCore::Element::removeAttributeInternal):
        (WebCore::Element::addAttributeInternal):
        (WebCore::Element::removeAttribute):

            Add AttributeChangeInvalidation where needed.

        (WebCore::Element::needsStyleInvalidation):

            Move to Element from ClassChangeInvalidation.

        (WebCore::Element::willModifyAttribute):

            No more full style invalidation on attribute change.

        * style/AttributeChangeInvalidation.cpp: Added.
        (WebCore::Style::AttributeChangeInvalidation::invalidateStyle):

            Invalidate local style.
            Check if we need to invalidate descendants by looking into ancestorAttributeRules.

        (WebCore::Style::AttributeChangeInvalidation::invalidateDescendants):

            Use StyleInvalidationAnalysis to invalidate the subtree for the relevant rules.

        * style/AttributeChangeInvalidation.h: Added.
        (WebCore::Style::AttributeChangeInvalidation::needsInvalidation):
        (WebCore::Style::AttributeChangeInvalidation::AttributeChangeInvalidation):
        (WebCore::Style::AttributeChangeInvalidation::~AttributeChangeInvalidation):

            If needed, invalidate descendants before and after attribute change to catch rules that start and stop applying.

2016-02-16  Chris Dumez  <cdumez@apple.com>

        Do security checks early in JSDOMWindow::put*()
        https://bugs.webkit.org/show_bug.cgi?id=154270

        Reviewed by Gavin Barraclough.

        Do security checks early in JSDOMWindow::put() / JSDOMWindow::putByIndex()
        and return as soon as possible. This makes it less error-prone as we need
        to do the security check only once, at the top of the function.

        Also lock down the security further by calling lookupPut() only if the
        property name is "location". The "location" property is the only one that
        can be set cross-origin. Previously, trying to set a property such as
        "name" (which cannot be set cross-origin) relied on the attribute setter
        doing the security check when getting called. The new check is less error
        prone and will correctly prevent overriding window's method cross-origin
        once these move down from the prototype (Bug 154120).

        Finally, the previous code was failing to set the "location" property
        cross-origin after the window has been reified. This patch fixes the
        issue by always calling the original "location" property setter from the
        static table in the cross-origin case.

        Test: http/tests/security/cross-origin-reified-window-location-setting.html

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::put):
        (WebCore::JSDOMWindow::putByIndex):

2016-02-15  Brent Fulgham  <bfulgham@apple.com>

        [Mac] Gather some rudimentary statistics during resource load 
        https://bugs.webkit.org/show_bug.cgi?id=153575
        <rdar://problem/24075254>

        Reviewed by Brady Eidson.

        Tested by: http/tests/navigation/statistics.html

        * CMakeLists.txt:
        * PlatformWin.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Document.cpp:
        (WebCore::Document::updateLastHandledUserGestureTimestamp): Log user interaction
        with the ResourceLoadObserver.
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::willSendRequest): Track load statistics if the
        user interacted with the document.
        * loader/ResourceLoadObserver.cpp: Added.
        * loader/ResourceLoadObserver.h: Added.
        * loader/ResourceLoadStatistics.cpp: Added.
        * loader/ResourceLoadStatistics.h: Added.
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::willSendRequestInternal): Track load statistics.
        * page/Settings.cpp:
        (WebCore::Settings::setResourceLoadStatisticsEnabled): Added.
        * page/Settings.h:
        (WebCore::Settings::resourceLoadStatisticsEnabled): Added.
        * platform/Logging.h:
        * testing/Internals.cpp:
        (WebCore::Internals::resourceLoadStatisticsForOrigin):
        (WebCore::Internals::setResourceLoadStatisticsEnabled):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-02-15  Chris Dumez  <cdumez@apple.com>

        The following properties should exist on the global object: AudioTrackList, AudioTrack, VideoTrackList, VideoTrack
        https://bugs.webkit.org/show_bug.cgi?id=154250
        <rdar://problem/24660829>

        Reviewed by Eric Carlson.

        The following properties should exist on the global object:
        - AudioTrackList, AudioTrack, VideoTrackList, VideoTrack

        These interfaces are not marked as [NoInterfaceObject] in:
        - https://html.spec.whatwg.org/#audiotracklist-and-videotracklist-objects

        No new tests, already covered by existing tests.

        * html/track/AudioTrack.idl:
        * html/track/AudioTrackList.idl:
        * html/track/VideoTrack.idl:
        * html/track/VideoTrackList.idl:

2016-02-15  Sam Weinig  <sam@webkit.org>

        Stop using NSMapTable in places where we were only using it to be GC safe
        <rdar://problem/24063723>
        https://bugs.webkit.org/show_bug.cgi?id=154264

        Reviewed by Dan Bernstein.

        Switch from NSMapTable to HashMap.

        * WebCore.xcodeproj/project.pbxproj:
        * bindings/objc/DOMInternal.h:
        * bindings/objc/DOMInternal.mm:
        * bindings/objc/WebScriptObject.mm:
        * bridge/objc/objc_instance.mm:
        * platform/spi/cocoa/NSPointerFunctionsSPI.h: Removed. No longer used.

2016-02-15  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] Implement FontFace JavaScript object
        https://bugs.webkit.org/show_bug.cgi?id=153345

        Reviewed by Antti Koivisto.

        Test: fast/text/font-face-javascript.html

        This patch implements the FontFace Javascript object. This object mostly consists of
        style getters / setters, which we implement by parsing input strings and generating
        output strings similarly to getComputedStyle(). This object also has a load() function
        which returns a promise which will be fulfilled or rejected depending on the load.
        There is also a "loaded" attribute which exposes this promise directly. Also, a status
        field is exposed so script knows what the state of the load is.

        Currently, loading depends on our CachedResourceLoader which is part of the Document,
        so this API is not available in a non-document context.

        Another caveat is that immediate-mode font loading (where the content provides an
        ArrayBuffer containing the bytes of the font file) is forthcoming. This requires
        changing the relationship between CSSFontFaceSource and CachedFont.

        CSSFontFace has been modified to keep a strong reference to the CSSFontSelector. This
        is because the lifetime of the CSSFontFace can now outlive the CSSFontSelector. When
        the CSSFontSelector is removed from the Document, it explicitly clears its constituent
        CSSFontFaces, thereby breaking the reference cycle.

        Test: fast/text/font-face-javascript-expected.html

        * CMakeLists.txt: Add new files.
        * DerivedSources.cpp: Ditto.
        * DerivedSources.make: Ditto.
        * WebCore.vcxproj/WebCore.vcxproj: Ditto.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * bindings/js/JSDOMPromise.cpp:
        (WebCore::DeferredWrapper::globalObject): Remove whitespace.
        (WebCore::DeferredWrapper::deferred): Allow access to the inner JSC object.
        * bindings/js/JSDOMPromise.h:
        (WebCore::DOMPromise::deferred): Ditto.
        * bindings/js/JSFontFaceCustom.cpp: Copied from Source/WebCore/bindings/js/JSDOMPromise.cpp.
        (WebCore::JSFontFace::loaded):
        (WebCore::JSFontFace::load):
        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::CSSFontFace): 
        (WebCore::CSSFontFace::adoptSource):
        (WebCore::CSSFontFace::updateStatus): Enforce the state machine's transitions.
        (WebCore::CSSFontFace::fontLoaded):
        (WebCore::CSSFontFace::pump):
        (WebCore::CSSFontFace::load):
        * css/CSSFontFace.h:
        (WebCore::CSSFontFaceClient::~CSSFontFaceClient):
        (WebCore::CSSFontFace::create):
        (WebCore::CSSFontFace::status):
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::appendSources): Update for new CSSFontFace API.
        (WebCore::CSSFontSelector::registerLocalFontFacesForFamily): Ditto.
        (WebCore::CSSFontSelector::addFontFaceRule): Ditto.
        (WebCore::CSSFontSelector::kick): Ditto.
        (WebCore::appendSources): Deleted.
        (WebCore::registerLocalFontFacesForFamily): Deleted.
        * css/CSSFontSelector.h:
        * css/CSSUnicodeRangeValue.cpp: Use for serializing the "unicodeRange" property.
        * css/FontFace.cpp:
        (WebCore::createPromise): Implement the remaining Javascript API functions.
        (WebCore::valueFromDictionary):
        (WebCore::FontFace::create):
        (WebCore::FontFace::FontFace):
        (WebCore::FontFace::parseString):
        (WebCore::FontFace::status):
        (WebCore::FontFace::kick):
        (WebCore::FontFace::load):
        (WebCore::FontFace::fulfillPromise):
        (WebCore::FontFace::rejectPromise):
        (WebCore::parseString): Deleted.
        * css/FontFace.h:
        (WebCore::FontFace::promise):
        (WebCore::FontFace::backing):
        (WebCore::FontFace::create): Deleted.
        * css/FontFace.idl: Copied from Source/WebCore/bindings/js/JSDOMPromise.cpp.

2016-02-15  Jer Noble  <jer.noble@apple.com>

        Null-deref crash in DefaultAudioDestinationNode::suspend()
        https://bugs.webkit.org/show_bug.cgi?id=154248

        Reviewed by Alex Christensen.

        Drive-by fix: AudioContext should be a reference, not a pointer.

        * Modules/webaudio/AnalyserNode.cpp:
        (WebCore::AnalyserNode::AnalyserNode):
        * Modules/webaudio/AnalyserNode.h:
        (WebCore::AnalyserNode::create):
        * Modules/webaudio/AudioBasicInspectorNode.cpp:
        (WebCore::AudioBasicInspectorNode::AudioBasicInspectorNode):
        (WebCore::AudioBasicInspectorNode::connect):
        (WebCore::AudioBasicInspectorNode::disconnect):
        (WebCore::AudioBasicInspectorNode::checkNumberOfChannelsForInput):
        (WebCore::AudioBasicInspectorNode::updatePullStatus):
        * Modules/webaudio/AudioBasicInspectorNode.h:
        * Modules/webaudio/AudioBasicProcessorNode.cpp:
        (WebCore::AudioBasicProcessorNode::AudioBasicProcessorNode):
        (WebCore::AudioBasicProcessorNode::checkNumberOfChannelsForInput):
        * Modules/webaudio/AudioBasicProcessorNode.h:
        * Modules/webaudio/AudioBufferSourceNode.cpp:
        (WebCore::AudioBufferSourceNode::create):
        (WebCore::AudioBufferSourceNode::AudioBufferSourceNode):
        (WebCore::AudioBufferSourceNode::renderFromBuffer):
        (WebCore::AudioBufferSourceNode::setBuffer):
        (WebCore::AudioBufferSourceNode::startPlaying):
        (WebCore::AudioBufferSourceNode::looping):
        (WebCore::AudioBufferSourceNode::setLooping):
        * Modules/webaudio/AudioBufferSourceNode.h:
        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::AudioContext):
        (WebCore::AudioContext::createBufferSource):
        (WebCore::AudioContext::createMediaElementSource):
        (WebCore::AudioContext::createMediaStreamDestination):
        (WebCore::AudioContext::createScriptProcessor):
        (WebCore::AudioContext::createBiquadFilter):
        (WebCore::AudioContext::createWaveShaper):
        (WebCore::AudioContext::createPanner):
        (WebCore::AudioContext::createConvolver):
        (WebCore::AudioContext::createDynamicsCompressor):
        (WebCore::AudioContext::createAnalyser):
        (WebCore::AudioContext::createGain):
        (WebCore::AudioContext::createDelay):
        (WebCore::AudioContext::createChannelSplitter):
        (WebCore::AudioContext::createChannelMerger):
        (WebCore::AudioContext::createOscillator):
        * Modules/webaudio/AudioContext.h:
        (WebCore::operator==):
        (WebCore::operator!=):
        * Modules/webaudio/AudioDestinationNode.cpp:
        (WebCore::AudioDestinationNode::AudioDestinationNode):
        (WebCore::AudioDestinationNode::render):
        (WebCore::AudioDestinationNode::updateIsEffectivelyPlayingAudio):
        * Modules/webaudio/AudioDestinationNode.h:
        * Modules/webaudio/AudioNode.cpp:
        (WebCore::AudioNode::AudioNode):
        (WebCore::AudioNode::connect):
        (WebCore::AudioNode::disconnect):
        (WebCore::AudioNode::setChannelCount):
        (WebCore::AudioNode::setChannelCountMode):
        (WebCore::AudioNode::setChannelInterpretation):
        (WebCore::AudioNode::scriptExecutionContext):
        (WebCore::AudioNode::processIfNecessary):
        (WebCore::AudioNode::checkNumberOfChannelsForInput):
        (WebCore::AudioNode::propagatesSilence):
        (WebCore::AudioNode::pullInputs):
        (WebCore::AudioNode::enableOutputsIfNecessary):
        (WebCore::AudioNode::deref):
        (WebCore::AudioNode::finishDeref):
        * Modules/webaudio/AudioNode.h:
        (WebCore::AudioNode::context):
        * Modules/webaudio/AudioNodeInput.cpp:
        (WebCore::AudioNodeInput::connect):
        (WebCore::AudioNodeInput::disconnect):
        (WebCore::AudioNodeInput::disable):
        (WebCore::AudioNodeInput::enable):
        (WebCore::AudioNodeInput::updateInternalBus):
        (WebCore::AudioNodeInput::bus):
        (WebCore::AudioNodeInput::internalSummingBus):
        (WebCore::AudioNodeInput::sumAllConnections):
        (WebCore::AudioNodeInput::pull):
        * Modules/webaudio/AudioNodeOutput.cpp:
        (WebCore::AudioNodeOutput::setNumberOfChannels):
        (WebCore::AudioNodeOutput::updateNumberOfChannels):
        (WebCore::AudioNodeOutput::propagateChannelCount):
        (WebCore::AudioNodeOutput::pull):
        (WebCore::AudioNodeOutput::bus):
        (WebCore::AudioNodeOutput::fanOutCount):
        (WebCore::AudioNodeOutput::paramFanOutCount):
        (WebCore::AudioNodeOutput::addInput):
        (WebCore::AudioNodeOutput::removeInput):
        (WebCore::AudioNodeOutput::disconnectAllInputs):
        (WebCore::AudioNodeOutput::addParam):
        (WebCore::AudioNodeOutput::removeParam):
        (WebCore::AudioNodeOutput::disconnectAllParams):
        (WebCore::AudioNodeOutput::disable):
        (WebCore::AudioNodeOutput::enable):
        * Modules/webaudio/AudioNodeOutput.h:
        (WebCore::AudioNodeOutput::context):
        * Modules/webaudio/AudioParam.cpp:
        (WebCore::AudioParam::value):
        (WebCore::AudioParam::smooth):
        (WebCore::AudioParam::calculateSampleAccurateValues):
        (WebCore::AudioParam::calculateFinalValues):
        (WebCore::AudioParam::calculateTimelineValues):
        (WebCore::AudioParam::connect):
        (WebCore::AudioParam::disconnect):
        * Modules/webaudio/AudioParam.h:
        (WebCore::AudioParam::create):
        (WebCore::AudioParam::AudioParam):
        * Modules/webaudio/AudioParamTimeline.cpp:
        (WebCore::AudioParamTimeline::valueForContextTime):
        * Modules/webaudio/AudioParamTimeline.h:
        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        (WebCore::AudioScheduledSourceNode::AudioScheduledSourceNode):
        (WebCore::AudioScheduledSourceNode::updateSchedulingInfo):
        (WebCore::AudioScheduledSourceNode::start):
        (WebCore::AudioScheduledSourceNode::finish):
        * Modules/webaudio/AudioScheduledSourceNode.h:
        * Modules/webaudio/AudioSummingJunction.cpp:
        (WebCore::AudioSummingJunction::AudioSummingJunction):
        (WebCore::AudioSummingJunction::~AudioSummingJunction):
        (WebCore::AudioSummingJunction::changedOutputs):
        (WebCore::AudioSummingJunction::updateRenderingState):
        * Modules/webaudio/AudioSummingJunction.h:
        (WebCore::AudioSummingJunction::context):
        * Modules/webaudio/BiquadFilterNode.cpp:
        (WebCore::BiquadFilterNode::BiquadFilterNode):
        * Modules/webaudio/BiquadFilterNode.h:
        (WebCore::BiquadFilterNode::create):
        * Modules/webaudio/BiquadProcessor.cpp:
        (WebCore::BiquadProcessor::BiquadProcessor):
        * Modules/webaudio/BiquadProcessor.h:
        * Modules/webaudio/ChannelMergerNode.cpp:
        (WebCore::ChannelMergerNode::create):
        (WebCore::ChannelMergerNode::ChannelMergerNode):
        (WebCore::ChannelMergerNode::checkNumberOfChannelsForInput):
        * Modules/webaudio/ChannelMergerNode.h:
        * Modules/webaudio/ChannelSplitterNode.cpp:
        (WebCore::ChannelSplitterNode::create):
        (WebCore::ChannelSplitterNode::ChannelSplitterNode):
        * Modules/webaudio/ChannelSplitterNode.h:
        * Modules/webaudio/ConvolverNode.cpp:
        (WebCore::ConvolverNode::ConvolverNode):
        (WebCore::ConvolverNode::setBuffer):
        * Modules/webaudio/ConvolverNode.h:
        (WebCore::ConvolverNode::create):
        * Modules/webaudio/DefaultAudioDestinationNode.cpp:
        (WebCore::DefaultAudioDestinationNode::DefaultAudioDestinationNode):
        (WebCore::DefaultAudioDestinationNode::resume):
        (WebCore::DefaultAudioDestinationNode::suspend):
        (WebCore::DefaultAudioDestinationNode::close):
        * Modules/webaudio/DefaultAudioDestinationNode.h:
        (WebCore::DefaultAudioDestinationNode::create):
        * Modules/webaudio/DelayNode.cpp:
        (WebCore::DelayNode::DelayNode):
        * Modules/webaudio/DelayNode.h:
        (WebCore::DelayNode::create):
        * Modules/webaudio/DelayProcessor.cpp:
        (WebCore::DelayProcessor::DelayProcessor):
        * Modules/webaudio/DelayProcessor.h:
        * Modules/webaudio/DynamicsCompressorNode.cpp:
        (WebCore::DynamicsCompressorNode::DynamicsCompressorNode):
        * Modules/webaudio/DynamicsCompressorNode.h:
        (WebCore::DynamicsCompressorNode::create):
        * Modules/webaudio/GainNode.cpp:
        (WebCore::GainNode::GainNode):
        (WebCore::GainNode::checkNumberOfChannelsForInput):
        * Modules/webaudio/GainNode.h:
        (WebCore::GainNode::create):
        * Modules/webaudio/MediaElementAudioSourceNode.cpp:
        (WebCore::MediaElementAudioSourceNode::create):
        (WebCore::MediaElementAudioSourceNode::MediaElementAudioSourceNode):
        (WebCore::MediaElementAudioSourceNode::setFormat):
        * Modules/webaudio/MediaElementAudioSourceNode.h:
        * Modules/webaudio/MediaStreamAudioDestinationNode.cpp:
        (WebCore::MediaStreamAudioDestinationNode::create):
        (WebCore::MediaStreamAudioDestinationNode::MediaStreamAudioDestinationNode):
        * Modules/webaudio/MediaStreamAudioDestinationNode.h:
        * Modules/webaudio/MediaStreamAudioSourceNode.cpp:
        (WebCore::MediaStreamAudioSourceNode::MediaStreamAudioSourceNode):
        (WebCore::MediaStreamAudioSourceNode::setFormat):
        * Modules/webaudio/OfflineAudioDestinationNode.cpp:
        (WebCore::OfflineAudioDestinationNode::OfflineAudioDestinationNode):
        (WebCore::OfflineAudioDestinationNode::offlineRender):
        (WebCore::OfflineAudioDestinationNode::notifyComplete):
        * Modules/webaudio/OfflineAudioDestinationNode.h:
        (WebCore::OfflineAudioDestinationNode::create):
        * Modules/webaudio/OscillatorNode.cpp:
        (WebCore::OscillatorNode::create):
        (WebCore::OscillatorNode::OscillatorNode):
        * Modules/webaudio/OscillatorNode.h:
        * Modules/webaudio/PannerNode.cpp:
        (WebCore::PannerNode::PannerNode):
        (WebCore::PannerNode::pullInputs):
        (WebCore::PannerNode::process):
        (WebCore::PannerNode::listener):
        (WebCore::PannerNode::setPanningModel):
        * Modules/webaudio/PannerNode.h:
        (WebCore::PannerNode::create):
        * Modules/webaudio/ScriptProcessorNode.cpp:
        (WebCore::ScriptProcessorNode::create):
        (WebCore::ScriptProcessorNode::ScriptProcessorNode):
        (WebCore::ScriptProcessorNode::initialize):
        (WebCore::ScriptProcessorNode::fireProcessEvent):
        * Modules/webaudio/ScriptProcessorNode.h:
        * Modules/webaudio/WaveShaperNode.cpp:
        (WebCore::WaveShaperNode::WaveShaperNode):
        (WebCore::WaveShaperNode::setOversample):
        * Modules/webaudio/WaveShaperNode.h:
        (WebCore::WaveShaperNode::create):

2016-02-15  Jer Noble  <jer.noble@apple.com>

        Null-deref crash in DefaultAudioDestinationNode::suspend()
        https://bugs.webkit.org/show_bug.cgi?id=154248

        Reviewed by Alex Christensen.

        Null-check scriptExecutionContext() before deref.

        * Modules/webaudio/DefaultAudioDestinationNode.cpp:
        (WebCore::DefaultAudioDestinationNode::resume):
        (WebCore::DefaultAudioDestinationNode::suspend):
        (WebCore::DefaultAudioDestinationNode::close):

2016-02-15  Chris Dumez  <cdumez@apple.com>

        XMLHttpRequest / XMLHttpRequestUpload should inherit XMLHttpRequestEventTarget
        https://bugs.webkit.org/show_bug.cgi?id=154230

        Reviewed by Alex Christensen.

        MLHttpRequest / XMLHttpRequestUpload should inherit XMLHttpRequestEventTarget
        as per:
        https://xhr.spec.whatwg.org/#xmlhttprequesteventtarget

        Firefox and Chrome already match the specification.

        No new tests, already covered by existing tests.

        * CMakeLists.txt:
        * DerivedSources.make:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * xml/XMLHttpRequest.h:
        * xml/XMLHttpRequest.idl:
        * xml/XMLHttpRequestEventTarget.h: Added.
        * xml/XMLHttpRequestEventTarget.idl: Copied from Source/WebCore/xml/XMLHttpRequestUpload.idl.
        * xml/XMLHttpRequestUpload.h:
        * xml/XMLHttpRequestUpload.idl:

2016-02-15  Jiewen Tan  <jiewen_tan@apple.com>

        Refine SimulatedMouseEvent to support Event.isTrusted
        https://bugs.webkit.org/show_bug.cgi?id=154133
        <rdar://problem/24616246>

        Reviewed by Darin Adler.

        This patch extracts everything related to create/dispatch SimulatedMouseEvent from MouseEvent.h/cpp
        and EventDispatcher.h/cpp, and produces SimulateClick.h/cpp which will handle simulated click solely.
        After that, we hide the SimulatedMouseEvent and only expose simulateClick to be called. The reason is
        that we both want to tell whether the call sites are from user agent/bindings and keep the
        SimulatedMouseEvent intact.

        Also, this patch separate Element::dispatchSimulatedClick into two: one for the user agent, and another
        for the bindings. Therefore, HTMLElement.click will be treated as untrusted.

        Some of the changes in this patch referred Blink r200401:
        https://codereview.chromium.org/1285793004

        Modified test:
        LayoutTests/imported/blink/fast/events/event-trusted.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Element.cpp:
        (WebCore::Element::dispatchSimulatedClick):
        (WebCore::Element::dispatchSimulatedClickForBindings):
        * dom/Element.h:
        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::dispatchSimulatedClick): Deleted.
        * dom/EventDispatcher.h:
        * dom/MouseEvent.cpp:
        (WebCore::SimulatedMouseEvent::create): Deleted.
        (WebCore::SimulatedMouseEvent::~SimulatedMouseEvent): Deleted.
        (WebCore::SimulatedMouseEvent::SimulatedMouseEvent): Deleted.
        * dom/MouseEvent.h:
        * dom/SimulatedClick.cpp: Added.
        (WebCore::simulateMouseEvent):
        (WebCore::simulateClick):
        * dom/SimulatedClick.h: Added.
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::click):

2016-02-15  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Web Workers have no access to console for debugging
        https://bugs.webkit.org/show_bug.cgi?id=26237

        Reviewed by Timothy Hatcher.

        This adds the most basic console message support to Workers.
        Messages logged from workers get surfaced through the Page's console.
        This lacks support for logging and interacting with arguments,
        which would be addressed when adding more complete Worker
        debugging tools.

        Test: inspector/console/messageAdded-from-worker.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        Add new files.

        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::~WorkerScriptController):
        (WebCore::WorkerScriptController::initScript):
        Set the ConsoleClient for the Worker's global object. We route
        the messages to the Page's console.

        * bindings/js/WorkerScriptController.h:
        * workers/WorkerConsoleClient.h: Added.
        * workers/WorkerConsoleClient.cpp: Added.
        (WebCore::WorkerConsoleClient::WorkerConsoleClient):
        (WebCore::WorkerConsoleClient::~WorkerConsoleClient):
        (WebCore::WorkerConsoleClient::profile):
        (WebCore::WorkerConsoleClient::profileEnd):
        (WebCore::WorkerConsoleClient::count):
        (WebCore::WorkerConsoleClient::time):
        (WebCore::WorkerConsoleClient::timeEnd):
        (WebCore::WorkerConsoleClient::timeStamp):
        Stub most console methods in a Worker.

        (WebCore::WorkerConsoleClient::messageWithTypeAndLevel):
        Send worker log messages to the global scope and on to the main page.

        * workers/WorkerGlobalScope.h:
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::addConsoleMessage):
        (WebCore::WorkerGlobalScope::addMessageToWorkerConsole):
        Ideally we want to converge on simple addConsoleMessage
        APIs that just take a ConsoleMessage, without a barrage
        of parameters. Add these versions now.

2016-02-15  Alex Christensen  <achristensen@webkit.org>

        CMake build fix.

        * PlatformMac.cmake:

2016-02-15  Chris Dumez  <cdumez@apple.com>

        Regression(r196563): It is no longer possible to call window.addEventListener without an explicit 'this'
        https://bugs.webkit.org/show_bug.cgi?id=154245

        Reviewed by Ryosuke Niwa.

        This patch adds support for calling the EventListener API without an
        explicit 'this' value. If no explicit 'this' value is passed, then we
        fall back to using the global object. This matches Chrome and Firefox's
        behavior. It also fixes the Dromaeo/cssquery-dojo.html test.

        Test: fast/dom/Window/addEventListener-implicit-this.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateFunctionCastedThis):

2016-02-14  Gavin Barraclough  <barraclough@apple.com>

        Organize, deduplicate & comment JSDOMWindowCustom getOwnPropertySlot
        https://bugs.webkit.org/show_bug.cgi?id=154224

        Reviewed by Chris Dumez.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess):
        (WebCore::jsDOMWindowGetOwnPropertySlotNamedItemGetter):
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        (WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
            - organized property access sequence into a more logical order, removed
              duplicated code & added comments.
        (WebCore::namedItemGetter): Deleted.
            - there was no need for a custom callback here; merged functionality into
              jsDOMWindowGetOwnPropertySlotNamedItemGetter.
        (WebCore::jsDOMWindowGetOwnPropertySlotCrossOrigin): Deleted.
            - renamed to jsDOMWindowGetOwnPropertySlotRestrictedAccess
              (this now also handles frameless access).

2016-02-15  Daniel Bates  <dabates@apple.com>

        CSP: 'sandbox' should be ignored in report-only mode
        https://bugs.webkit.org/show_bug.cgi?id=153167
        <rdar://problem/22708669>

        Reviewed by Brent Fulgham.

        Merged from Blink (patch by Mike West):
        <https://src.chromium.org/viewvc/blink?revision=165322&view=revision>

        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportInvalidDirectiveInReportOnlyMode): Added. Logs a
        console message to the console to explain that the specified directive is invalid in
        report-only mode.
        * page/csp/ContentSecurityPolicy.h:
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::applySandboxPolicy): Do not apply sandbox
        policy when in report-only mode and call ContentSecurityPolicy::reportInvalidDirectiveInReportOnlyMode()
        to log a message to the console.

2016-02-15  Daniel Bates  <dabates@apple.com>

        CSP: Allow schemeless source expressions to match an HTTP or HTTPS resource
        https://bugs.webkit.org/show_bug.cgi?id=154177
        <rdar://problem/22708772>

        Reviewed by Brent Fulgham.

        Allow a schemeless source expression to match an HTTP or HTTPS subresource when the page is
        delivered over HTTP as per section Matching Source Expressions of the Content Security Policy
        2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/> (21 July 2015).

        Currently we have logic that implements this functionality, but it is guarded behind the compile-
        time macro ENABLE(CSP_NEXT) that is disabled by default. Instead we should always compile such
        code. In subsequent commits we will move more code out from under the ENABLE(CSP_NEXT)-guard
        towards removing the ENABLE_CSP_NEXT macro entirely.

        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::protocolMatchesSelf):

2016-02-15  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Consolidated Linux-specific file lists.
        https://bugs.webkit.org/show_bug.cgi?id=154219

        Reviewed by Gyuyoung Kim.

        No new tests needed.

        * PlatformEfl.cmake: Moved Linux files and include dir to Linux.cmake.
        * PlatformGTK.cmake: Ditto.
        * platform/Linux.cmake: Added.

2016-02-15  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !(ENABLE(SVG_FONTS) || ENABLE(SVG_OTF_CONVERTER)) build after r196322
        https://bugs.webkit.org/show_bug.cgi?id=154104

        Reviewed by Myles C. Maxfield.

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::CSSFontFaceSource):

2016-02-14  Antti Koivisto  <antti@apple.com>

        Add test for class change style invalidation optimization
        https://bugs.webkit.org/show_bug.cgi?id=154226

        Reviewed by Myles Maxfield.

        Test for https://trac.webkit.org/r196383

        Add internals.styleChangeType function.

        Test: fast/css/style-invalidation-class-change-descendants.html

        * testing/Internals.cpp:
        (WebCore::Internals::nodeNeedsStyleRecalc):
        (WebCore::asString):
        (WebCore::Internals::styleChangeType):
        (WebCore::Internals::description):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-02-14  Simon Fraser  <simon.fraser@apple.com>

        [CSS Filters] When applying an SVG filter on a composited image using CSS the image is rendered without the filter
        https://bugs.webkit.org/show_bug.cgi?id=154108

        Reviewed by Sam Weinig.
        
        When checking whether we can directly composite an image, we need to check for software-rendered
        filters.

        Test: compositing/filters/simple-image-with-svg-filter.html

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::isDirectlyCompositedImage):

2016-02-14  Chris Dumez  <cdumez@apple.com>

        Drop the [EventTarget] WebKit-specific IDL extended attribute
        https://bugs.webkit.org/show_bug.cgi?id=154171

        Reviewed by Sam Weinig.

        Drop the [EventTarget] WebKit-specific IDL extended attribute now that
        all interfaces inherit EventTarget when they should.

        No new tests, no Web-Exposed behavior change.

        * Modules/battery/BatteryManager.idl:
        * Modules/encryptedmedia/MediaKeySession.idl:
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBOpenDBRequest.idl:
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.idl:
        * Modules/mediasession/MediaRemoteControls.idl:
        * Modules/mediasource/MediaSource.idl:
        * Modules/mediasource/SourceBuffer.idl:
        * Modules/mediasource/SourceBufferList.idl:
        * Modules/mediastream/MediaStream.idl:
        * Modules/mediastream/MediaStreamTrack.idl:
        * Modules/mediastream/RTCDTMFSender.idl:
        * Modules/mediastream/RTCDataChannel.idl:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/notifications/Notification.idl:
        * Modules/speech/SpeechSynthesisUtterance.idl:
        * Modules/webaudio/AudioContext.idl:
        * Modules/webaudio/AudioNode.idl:
        * Modules/webaudio/OfflineAudioContext.idl:
        * Modules/websockets/WebSocket.idl:
        * bindings/scripts/CodeGeneratorGObject.pm:
        (ImplementsInterface):
        (SkipFunction): Deleted.
        (GenerateCFile): Deleted.
        * bindings/scripts/CodeGeneratorJS.pm:
        (InstanceNeedsVisitChildren):
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/TestEventTarget.idl:
        * bindings/scripts/test/TestNode.idl:
        * css/FontLoader.idl:
        * dom/EventTarget.idl:
        * dom/MessagePort.idl:
        * dom/Node.idl:
        * dom/WebKitNamedFlow.idl:
        * fileapi/FileReader.idl:
        * html/MediaController.idl:
        * html/track/AudioTrackList.idl:
        * html/track/TextTrack.idl:
        * html/track/TextTrackCue.idl:
        * html/track/TextTrackList.idl:
        * html/track/VideoTrackList.idl:
        * loader/appcache/DOMApplicationCache.idl:
        * page/DOMWindow.idl:
        * page/EventSource.idl:
        * page/Performance.idl:
        * workers/WorkerGlobalScope.idl:
        * xml/XMLHttpRequest.idl:
        * xml/XMLHttpRequestUpload.idl:

2016-02-14  Chris Dumez  <cdumez@apple.com>

        Unreviewed attempt to fix the Mac CMake build after r196136

        * PlatformMac.cmake:

2016-02-14  Chris Dumez  <cdumez@apple.com>

        Unreviewed attempt to fix the Windows build.

        * Modules/webdatabase/Database.cpp:
        * bridge/c/c_utility.cpp:
        * platform/MemoryPressureHandler.cpp:

2016-02-14  Chris Dumez  <cdumez@apple.com>

        Window and WorkerGlobalScope should inherit EventTarget
        https://bugs.webkit.org/show_bug.cgi?id=154170
        <rdar://problem/24642377>

        Reviewed by Darin Adler.

        Window and WorkerGlobalScope should inherit EventTarget instead of
        duplicating the EventTarget API in their IDL. These were the last
        interfaces that needed fixing. The next step will be to get rid
        of the [EventTarget] IDL extended attribute and rely entirely
        on the EventTarget inheritance.

        Test:
        - fast/frames/detached-frame-eventListener.html
        - Covered by existing tests.

        * WebCore.xcodeproj/project.pbxproj:
        Add JSEventTargetCustom.h header to the project.

        * bindings/js/JSDOMWindowCustom.cpp:
        Drop custom bindings for Window's addEventListener() and
        removeEventListener(). The only reason these needed custom
        code was to add a check for frameless windows. The frameless
        Window checks was moved to the respective methods in the
        JSEventTarget generated bindings.

        * bindings/js/JSDOMWindowShell.cpp:
        (WebCore::JSDOMWindowShell::setWindow):
        Set WindowPrototype's prototype to EventTarget's prototype.

        * bindings/js/JSDOMWindowShell.h:
        * bindings/js/JSDictionary.cpp:
        Include "DOMWindow.h" to fix the build.

        * bindings/js/JSEventTargetCustom.cpp:
        (WebCore::JSEventTarget::toWrapped):
        Handle DOMWindow and WorkerGlobalScope explicitely in toWrapped()
        and get rid of the DOM_EVENT_TARGET_INTERFACES_FOR_EACH(TRY_TO_UNWRAP_WITH_INTERFACE)
        now that all interfaces inherit EventTarget when they should.
        The reason DOMWindow and WorkerGlobalScope still need special
        handling is because their wrappers (JSDOMWindow /
        JSWorkerGlobalScope) do not subclass JSEventTarget.

        (WebCore::JSEventTargetOrGlobalScope::create):
        * bindings/js/JSEventTargetCustom.h: Added.
        (WebCore::JSEventTargetOrGlobalScope::wrapped):
        (WebCore::JSEventTargetOrGlobalScope::operator JSC::JSObject&):
        (WebCore::JSEventTargetOrGlobalScope::JSEventTargetOrGlobalScope):
        Add a wrapper type for JSEventTarget / JSDOMWindow and
        JSWorkerGlobalScope for use in the generated bindings. This is
        needed because JSDOMWindow and JSWorkerGlobalScope do not
        subclass JSEventTarget. Subclassing JSEventTarget would be
        complicated for them because they already subclass
        JSDOMWindowBase / JSWorkerGlobalScopeBase, which subclasses
        JSDOMGlobalObject.

        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::initScript):
        Set WorkerGlobalScopePrototype's prototype to EventTarget's prototype.

        * bindings/scripts/CodeGeneratorJS.pm:
        (ShouldGenerateToJSDeclaration):
        Do not generate to toJS() implementation for interfaces that use
        the [CustomProxyToJSObject] IDL extended attribute, even if they
        inherit EventTarget.

        (GetCastingHelperForThisObject):
        To initialize castedThis from thisValue JSValue, we now use the
        JSEventTargetOrGlobalScope wrapper for the EventTarget
        implementation. This is to work around the fact that JSDOMWindow
        and JSWorkerGlobalScope do not subclass JSEventTarget.

        (GenerateFunctionCastedThis):
        - Drop code handling [WorkerGlobalScope] IDL extended attribute
          as there is no such attribute.
        - Use auto instead of auto* type for castedThis because
          JSEventTargetOrGlobalScope::create() returns a unique_ptr.
        - Do not check that castedThis inherits JSEventTarget in the
          EventTarget bindings code as this no longer holds true.

        (GenerateImplementation):
        Generate frameless window() and security checks for EventTarget
        methods when thisValue is a JSDOMWindow.

        * dom/EventTarget.idl:
        Add [JSCustomHeader] IDL Extended attribute as we need a header
        to expose JSEventTargetOrGlobalScope class.

        * page/DOMWindow.idl:
        * workers/WorkerGlobalScope.idl:
        Inherit EventTarget and stop duplicating the EventTarget API.
        This matches the HTML specification.

2016-02-14  Darin Adler  <darin@apple.com>

        Small tweaks to some SimpleLineLayout code
        https://bugs.webkit.org/show_bug.cgi?id=154229

        Reviewed by Zalan Bujtas.

        * rendering/SimpleLineLayoutFunctions.cpp:
        (WebCore::SimpleLineLayout::paintFlow): Use std::ceil instead of ceilf.
        Use auto instead of const auto& for a for loop where the local object is
        copied and not a reference.
        (WebCore::SimpleLineLayout::hitTestFlow): Use modern for loop.
        (WebCore::SimpleLineLayout::collectFlowOverflow): Use std::ceil instead of
        ceilf. Use a modern for loop, and use slightly more descriptive local
        variable names.
        (WebCore::SimpleLineLayout::computeBoundingBox): Use auto instead of
        const auto& as above.
        (WebCore::SimpleLineLayout::computeFirstRunLocation): Use auto and use
        the name "range" for the range rather than the name "it", since the range
        is not an iterator.
        (WebCore::SimpleLineLayout::collectAbsoluteRects): Use auto instead of
        const auto& as above.
        (WebCore::SimpleLineLayout::collectAbsoluteQuads): Ditto.
        (WebCore::SimpleLineLayout::showLineLayoutForFlow): Use modern for loop.

        * rendering/SimpleLineLayoutResolver.cpp:
        (WebCore::SimpleLineLayout::RunResolver::Run::text): Convert from a String
        to a StringView using the StringView constructor instead of writing out
        explicit 8-bit and 16-bit cases.

2016-02-13  Antti Koivisto  <antti@apple.com>

        Factor class change style invalidation code into a class
        https://bugs.webkit.org/show_bug.cgi?id=154163

        Reviewed by Andreas Kling.

        Factor this piece of functionality out of Element and into ClassChangeInvalidation class.

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Element.cpp:
        (WebCore::classStringHasClassName):
        (WebCore::Element::classAttributeChanged):
        (WebCore::collectClasses): Deleted.
        (WebCore::computeClassChange): Deleted.
        (WebCore::invalidateStyleForClassChange): Deleted.
        * style/ClassChangeInvalidation.cpp: Added.
        (WebCore::Style::ClassChangeInvalidation::computeClassChange):
        (WebCore::Style::ClassChangeInvalidation::invalidateStyle):
        * style/ClassChangeInvalidation.h: Added.
        (WebCore::Style::ClassChangeInvalidation::needsInvalidation):
        (WebCore::Style::ClassChangeInvalidation::ClassChangeInvalidation):
        (WebCore::Style::ClassChangeInvalidation::~ClassChangeInvalidation):

2016-02-13  Myles C. Maxfield  <mmaxfield@apple.com>

        [Win] [SVG -> OTF Converter] SVG fonts drawn into ImageBuffers are invisible
        https://bugs.webkit.org/show_bug.cgi?id=154222

        Reviewed by Antti Koivisto.

        Windows ImageBuffer code is sensitive to broken bounding box and
        descent code.

        Covered by existing tests.

        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::appendHHEATable):
        (WebCore::SVGToOTFFontConverter::appendOS2Table):
        (WebCore::SVGToOTFFontConverter::processGlyphElement):
        (WebCore::SVGToOTFFontConverter::SVGToOTFFontConverter):

2016-02-13  Antti Koivisto  <antti@apple.com>

        Add version number for default stylesheet
        https://bugs.webkit.org/show_bug.cgi?id=154220

        Reviewed by Ryosuke Niwa.

        We currently fail to update RuleFeatureSets for shadow trees when the default stylesheet grows
        (for example when media controls stylesheet is initialized).

        No test since this is not causing known bugs. It is blocking optimizations in shadow trees that
        rely on rule features being up-to-date.

        * css/CSSDefaultStyleSheets.cpp:
        (WebCore::CSSDefaultStyleSheets::loadSimpleDefaultStyle):
        (WebCore::CSSDefaultStyleSheets::ensureDefaultStyleSheetsForElement):

            Increment version number when the default stylesheet changes.

        * css/CSSDefaultStyleSheets.h:
        * css/DocumentRuleSets.cpp:
        (WebCore::DocumentRuleSets::appendAuthorStyleSheets):
        (WebCore::DocumentRuleSets::collectFeatures):

            Store the current default stylesheet version number.

        * css/DocumentRuleSets.h:
        (WebCore::DocumentRuleSets::features):

            Collect features again if the default stylesheet has changed.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::styleForElement):

2016-02-13  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Consolidate building of GStreamer and OpenWebRTC code.
        https://bugs.webkit.org/show_bug.cgi?id=154116

        Reviewed by Michael Catanzaro.

        No new tests needed.

        * PlatformEfl.cmake: Migrated shared code to GStreamer.cmake.
        * PlatformGTK.cmake: Ditto.
        * platform/GStreamer.cmake: Added.

2016-02-13  Mark Lam  <mark.lam@apple.com>

        Add thread violation checks to WebView public APIs.
        https://bugs.webkit.org/show_bug.cgi?id=154183

        Reviewed by Timothy Hatcher.

        No new tests.  Just adding a new thread violation round.

        * platform/ThreadCheck.h:
        * platform/mac/ThreadCheck.mm:
        - Adding WebCoreThreadViolationCheckRoundThree().

2016-02-12  Nan Wang  <n_wang@apple.com>

        AX: Implement paragraph related text marker functions using TextIterator
        https://bugs.webkit.org/show_bug.cgi?id=154098
        <rdar://problem/24269675>

        Reviewed by Chris Fleizach.

        Using CharacterOffset to implement paragraph related text marker calls. Reused
        logic from VisibleUnits class. And refactored textMarkerForCharacterOffset method
        to get better performance. Also fixed an issue where we can't navigate through a text
        node with line breaks in it using next/previousCharacterOffset call.

        Test: accessibility/mac/text-marker-paragraph-nav.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::traverseToOffsetInRange):
        (WebCore::AXObjectCache::startOrEndTextMarkerDataForRange):
        (WebCore::AXObjectCache::characterOffsetForNodeAndOffset):
        (WebCore::AXObjectCache::textMarkerDataForCharacterOffset):
        (WebCore::AXObjectCache::textMarkerDataForNextCharacterOffset):
        (WebCore::AXObjectCache::textMarkerDataForPreviousCharacterOffset):
        (WebCore::AXObjectCache::nextNode):
        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
        (WebCore::AXObjectCache::nextCharacterOffset):
        (WebCore::AXObjectCache::previousCharacterOffset):
        (WebCore::startWordBoundary):
        (WebCore::AXObjectCache::startCharacterOffsetOfWord):
        (WebCore::AXObjectCache::endCharacterOffsetOfWord):
        (WebCore::AXObjectCache::previousWordStartCharacterOffset):
        (WebCore::AXObjectCache::previousWordBoundary):
        (WebCore::AXObjectCache::startCharacterOffsetOfParagraph):
        (WebCore::AXObjectCache::endCharacterOffsetOfParagraph):
        (WebCore::AXObjectCache::paragraphForCharacterOffset):
        (WebCore::AXObjectCache::nextParagraphEndCharacterOffset):
        (WebCore::AXObjectCache::previousParagraphStartCharacterOffset):
        (WebCore::AXObjectCache::rootAXEditableElement):
        * accessibility/AXObjectCache.h:
        (WebCore::CharacterOffset::remaining):
        (WebCore::CharacterOffset::isNull):
        (WebCore::CharacterOffset::isEqual):
        (WebCore::AXObjectCache::isNodeInUse):
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (+[WebAccessibilityTextMarker textMarkerWithCharacterOffset:cache:]):
        (-[WebAccessibilityObjectWrapper nextMarkerForCharacterOffset:]):
        (-[WebAccessibilityObjectWrapper previousMarkerForCharacterOffset:]):
        (-[WebAccessibilityObjectWrapper rangeForTextMarkers:]):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (startOrEndTextmarkerForRange):
        (nextTextMarkerForCharacterOffset):
        (previousTextMarkerForCharacterOffset):
        (-[WebAccessibilityObjectWrapper nextTextMarkerForCharacterOffset:]):
        (-[WebAccessibilityObjectWrapper previousTextMarkerForCharacterOffset:]):
        (-[WebAccessibilityObjectWrapper textMarkerForCharacterOffset:]):
        (textMarkerForCharacterOffset):
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
        (-[WebAccessibilityObjectWrapper nextTextMarkerForNode:offset:]): Deleted.
        (-[WebAccessibilityObjectWrapper previousTextMarkerForNode:offset:]): Deleted.
        (-[WebAccessibilityObjectWrapper textMarkerForNode:offset:ignoreStart:]): Deleted.
        (-[WebAccessibilityObjectWrapper textMarkerForNode:offset:]): Deleted.
        * editing/VisibleUnits.cpp:
        (WebCore::nextSentencePosition):
        (WebCore::findStartOfParagraph):
        (WebCore::findEndOfParagraph):
        (WebCore::startOfParagraph):
        (WebCore::endOfParagraph):
        * editing/VisibleUnits.h:

2016-02-12  Ryan Haddad  <ryanhaddad@apple.com>

        Reset results for bindings tests after r196520

        Unreviewed test gardening.

        No new tests needed.

        * bindings/scripts/test/GObject/WebKitDOMTestEventTarget.cpp:
        (webkit_dom_test_event_target_dispatch_event):
        * bindings/scripts/test/GObject/WebKitDOMTestNode.cpp:
        (webkit_dom_test_node_dispatch_event):

2016-02-12  Saam barati  <sbarati@apple.com>

        Attempting build fix from https://bugs.webkit.org/show_bug.cgi?id=154144.

        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::addBuiltinGlobals):

2016-02-12  Daniel Bates  <dabates@apple.com>

        CSP: 'blob:' URLs should not match 'self' in CSP source expression lists.
        https://bugs.webkit.org/show_bug.cgi?id=153158
        <rdar://problem/24383264>

        Reviewed by Brent Fulgham.

        A blob URL should not match source 'self' by section Security Considerations for GUID URL schemes
        of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/CSP2/> (21 July 2015).

        Tests: http/tests/security/contentSecurityPolicy/blob-url-does-not-match-source-self.html
               http/tests/security/contentSecurityPolicy/blob-url-matches-source-blob.html

        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::matches): Do not make a distinction between URLs that
        contain a nested URL (e.g. blob://http://www.example.com/...) and URLs that do not contain a nested
        URL. The URL of the requested resource should be matched against the source list source expressions.

2016-02-12  Daniel Bates  <dabates@apple.com>

        CSP: Implement child-src directive
        https://bugs.webkit.org/show_bug.cgi?id=153562
        <rdar://problem/24610087>

        Reviewed by Brent Fulgham.

        Add support for the child-src directive, <https://w3c.github.io/webappsec-csp/2/#child_src> (29 August 2015),
        which formally replaces the deprecated frame-src directive as of the Content Security Policy 2.0 spec. The
        child-src directive was first introduced in the Content Security Policy 1.1 spec, <https://www.w3.org/TR/2014/WD-CSP11-20140211/>.

        As a side effect of this change, the script URL for a Web Worker is checked against the child-src directive
        as opposed to the script-src directive. This is a backward incompatible change from the CSP 1.0 spec.

        Tests: http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-blocked.html
               http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-redirect-blocked.html
               http/tests/security/contentSecurityPolicy/1.1/child-src/frame-src-takes-precedence-over-child-src.html
               http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked.html
               http/tests/security/isolatedWorld/bypass-main-world-csp-worker-redirect.html

        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy): Check child-src directive (if applicable).
        * loader/ThreadableLoader.h: Add enum value EnforceChildSrcDirective to enum class ContentSecurityPolicyEnforcement to
        enforce the child-src directive on redirect.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::allowChildContextFromSource): Added.
        * page/csp/ContentSecurityPolicy.h:
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::checkSourceAndReportViolation): Add message prefix for a child-src violation.
        We use the same message prefix as used by Blink.
        (WebCore::ContentSecurityPolicyDirectiveList::allowChildContextFromSource): Added.
        (WebCore::ContentSecurityPolicyDirectiveList::allowChildFrameFromSource): Modified to check the frame-src
        directive (if specified) before checking the child-src directive by <https://w3c.github.io/webappsec-csp/2/#directive-child-src-nested>.
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Parse the child-src directive.
        * page/csp/ContentSecurityPolicyDirectiveList.h:
        * workers/AbstractWorker.cpp:
        (WebCore::AbstractWorker::resolveURL): Check if the script URL for the worker is allowed by the child-src directive
        as opposed to the script-src directive. This is a backwards incompatible change from the CSP 1.0 spec.
        * workers/Worker.cpp:
        (WebCore::Worker::create): Enforce the child-src directive on redirects (if applicable).

2016-02-12  Saam barati  <sbarati@apple.com>

        The parser doesn't properly protect against global variable references in builtins
        https://bugs.webkit.org/show_bug.cgi?id=154144

        Reviewed by Geoffrey Garen.

        Change JS builtins to no longer reference global variables.

        No new tests because old tests cover the issues here.

        * Modules/mediastream/NavigatorUserMedia.js:
        (webkitGetUserMedia):
        * Modules/mediastream/RTCPeerConnection.js:
        (addIceCandidate):
        (getStats):
        * Modules/mediastream/RTCPeerConnectionInternals.js:
        (setLocalOrRemoteDescription):
        * Modules/plugins/QuickTimePluginReplacement.js:
        (Replacement.prototype.handleEvent):
        * Modules/streams/ByteLengthQueuingStrategy.js:
        (initializeByteLengthQueuingStrategy):
        * Modules/streams/CountQueuingStrategy.js:
        (initializeCountQueuingStrategy):
        * Modules/streams/ReadableStreamInternals.js:
        (teeReadableStream):
        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::addBuiltinGlobals):
        * bindings/js/WebCoreBuiltinNames.h:

2016-02-12  Jiewen Tan  <jiewen_tan@apple.com>

        WebKit should expose the DOM 4 Event.isTrusted property
        https://bugs.webkit.org/show_bug.cgi?id=76121
        <rdar://problem/22558494>

        Reviewed by Darin Adler.

        Implements Event.isTrusted. The implementation here is slitely different from and better than
        the DOM specification. Here Event.isTrusted will be initialized differently depending on the
        callers of the constructors/create methods. If the caller is from user agent, the isTrusted
        will be true. Otherwise, it will be false. Since a user agent dispatched event can be catched
        and re-initialized/redispatched by the bindings, the flag will be unset at *Event::init*Event
        and EventTarget::dispatchEventForBindings. As currently there is no way to let user agent to
        dispatch a bindings created event, therefore we ensure that the Event.isTrusted is set for
        events dispatched by user agent, and unset for those by bindings.

        EventTarget::dispatchEvent(Event*, ExceptionCode&) is renamed to EventTarget::dispatchEventForBindings
        in this patch as well. So that, together with the improved design of the API, developers in
        the future will be less likely using a wrong dispatchEvent method and setting Event.isTrusted
        incorrectly comparing to the DOM design.

        After this patch, all events that are created by user agent should be dispatched by
        EventTarget::dispatchEvent, and those are created by bindings should be dispatched by
        EventTarget::dispatchEventForBindings.

        Some of the changes in this patch referred Blink r198996:
        https://codereview.chromium.org/1241613004

        Test: imported/blink/fast/events/event-trusted.html

        * bindings/scripts/CodeGeneratorGObject.pm:
        (GenerateEventTargetIface):
        * dom/Event.cpp:
        (WebCore::Event::Event):
        (WebCore::Event::initEvent):
        * dom/Event.h:
        (WebCore::Event::isTrusted):
        (WebCore::Event::setUntrusted):
        * dom/Event.idl:
        * dom/EventTarget.cpp:
        (WebCore::EventTarget::dispatchEventForBindings):
        (WebCore::EventTarget::dispatchEvent): Deleted.
        * dom/EventTarget.h:
        * dom/EventTarget.idl:
        * page/DOMWindow.idl:
        * page/EventHandler.cpp:
        (WebCore::EventHandler::dispatchDragEvent):
        * workers/WorkerGlobalScope.idl:

2016-02-12  Brady Eidson  <beidson@apple.com>

        Modern IDB: IDBObjectStore and IDBIndex need to be ActiveDOMObjects.
        https://bugs.webkit.org/show_bug.cgi?id=154153

        Reviewed by Alex Christensen.

        No new tests (No testable change in behavior).

        This is needed so that IDBObjectStore and IDBIndex JS wrappers are not garbage collected
        while their IDBTransaction is still in progress.

        * Modules/indexeddb/client/IDBIndexImpl.cpp:
        (WebCore::IDBClient::IDBIndex::IDBIndex):
        (WebCore::IDBClient::IDBIndex::activeDOMObjectName):
        (WebCore::IDBClient::IDBIndex::canSuspendForDocumentSuspension):
        (WebCore::IDBClient::IDBIndex::hasPendingActivity):
        * Modules/indexeddb/client/IDBIndexImpl.h:
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::create):
        (WebCore::IDBClient::IDBObjectStore::IDBObjectStore):
        (WebCore::IDBClient::IDBObjectStore::activeDOMObjectName):
        (WebCore::IDBClient::IDBObjectStore::canSuspendForDocumentSuspension):
        (WebCore::IDBClient::IDBObjectStore::hasPendingActivity):
        (WebCore::IDBClient::IDBObjectStore::index):
        * Modules/indexeddb/client/IDBObjectStoreImpl.h:
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::objectStore):
        (WebCore::IDBClient::IDBTransaction::createObjectStore):
        (WebCore::IDBClient::IDBTransaction::createIndex):

2016-02-12  Brady Eidson  <beidson@apple.com>

        Modern IDB: Simplify the relationship between IDBObjectStore and IDBIndex.
        https://bugs.webkit.org/show_bug.cgi?id=154187

        Reviewed by Alex Christensen.

        Tests: storage/indexeddb/modern/deleteindex-3-private.html
               storage/indexeddb/modern/deleteindex-3.html

        Instead of allowing IDBIndex to have two different lifecycle modes, it is now always
        owned by an IDBObjectStore.
        
        To support the case where an IDBIndex is deleted from its IDBObjectStore, the object
        store simply hangs on to deleted indexes until it is destroyed itself.
        
        * Modules/indexeddb/client/IDBIndexImpl.cpp:
        (WebCore::IDBClient::IDBIndex::markAsDeleted):
        (WebCore::IDBClient::IDBIndex::ref):
        (WebCore::IDBClient::IDBIndex::deref):
        * Modules/indexeddb/client/IDBIndexImpl.h:
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::deleteIndex):
        * Modules/indexeddb/client/IDBObjectStoreImpl.h:

2016-02-12  Myles C. Maxfield  <mmaxfield@apple.com>

        [CSS Font Loading] Implement CSSFontFace Boilerplate
        https://bugs.webkit.org/show_bug.cgi?id=154145

        Reviewed by Dean Jackson.

        The CSS Font Loading spec[1] dictates that the FontFace object needs to have string
        accessors and mutators for a bunch of properties. Our CSSFontFace object currently
        contains this parsed information, but it isn't accessible via string-based methods.
        This patch adds the necessary accessors and mutators, and migrates CSSFontSelector
        to use these mutators where necessary.

        There is more work to come on CSSFontFace; the next step is to create an .idl file
        and hook it up to our CSSFontFace object. In this patch I have left some
        unimplemented pieces (for example: where the spec dictates that some operation should
        throw a JavaScript exception) which will be implemented in a follow-up patch. This
        patch does not have any visible behavior change; I'm separating out the boilerplate
        into this patch in order to ease reviewing burden.

        This patch separates the externally-facing JavaScript API into a new class, FontFace.
        This class owns a CSSFontFace, which provides the backing implementation. There will
        be a system of shared ownership of these objects once FontFaceSet is implemented.

        No new tests because there is no behavior change.

        * CMakeLists.txt: Add new files to CMake builds.
        * WebCore.vcxproj/WebCore.vcxproj: Ditto for Windows.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto for Cocoa.
        * css/CSSAllInOne.cpp: Ditto for All-In-One builds.
        * css/CSSFontFace.cpp: Move shared code from CSSFontSelector into CSSFontFace.
        (WebCore::CSSFontFace::CSSFontFace):
        (WebCore::CSSFontFace::~CSSFontFace):
        (WebCore::CSSFontFace::setFamilies):
        (WebCore::CSSFontFace::setStyle):
        (WebCore::CSSFontFace::setWeight):
        (WebCore::CSSFontFace::setUnicodeRange):
        (WebCore::CSSFontFace::setVariantLigatures):
        (WebCore::CSSFontFace::setVariantPosition):
        (WebCore::CSSFontFace::setVariantCaps):
        (WebCore::CSSFontFace::setVariantNumeric):
        (WebCore::CSSFontFace::setVariantAlternates):
        (WebCore::CSSFontFace::setVariantEastAsian):
        (WebCore::CSSFontFace::setFeatureSettings):
        * css/CSSFontFace.h: Clean up.
        (WebCore::CSSFontFace::create):
        (WebCore::CSSFontFace::families):
        (WebCore::CSSFontFace::traitsMask):
        (WebCore::CSSFontFace::featureSettings):
        (WebCore::CSSFontFace::variantSettings):
        (WebCore::CSSFontFace::setVariantSettings):
        (WebCore::CSSFontFace::setTraitsMask):
        (WebCore::CSSFontFace::isLocalFallback):
        (WebCore::CSSFontFace::addRange): Deleted.
        (WebCore::CSSFontFace::insertFeature): Deleted.
        (WebCore::CSSFontFace::setVariantCommonLigatures): Deleted.
        (WebCore::CSSFontFace::setVariantDiscretionaryLigatures): Deleted.
        (WebCore::CSSFontFace::setVariantHistoricalLigatures): Deleted.
        (WebCore::CSSFontFace::setVariantContextualAlternates): Deleted.
        (WebCore::CSSFontFace::setVariantPosition): Deleted.
        (WebCore::CSSFontFace::setVariantCaps): Deleted.
        (WebCore::CSSFontFace::setVariantNumericFigure): Deleted.
        (WebCore::CSSFontFace::setVariantNumericSpacing): Deleted.
        (WebCore::CSSFontFace::setVariantNumericFraction): Deleted.
        (WebCore::CSSFontFace::setVariantNumericOrdinal): Deleted.
        (WebCore::CSSFontFace::setVariantNumericSlashedZero): Deleted.
        (WebCore::CSSFontFace::setVariantAlternates): Deleted.
        (WebCore::CSSFontFace::setVariantEastAsianVariant): Deleted.
        (WebCore::CSSFontFace::setVariantEastAsianWidth): Deleted.
        (WebCore::CSSFontFace::setVariantEastAsianRuby): Deleted.
        (WebCore::CSSFontFace::CSSFontFace): Deleted.
        * css/CSSFontSelector.cpp: Migrate shared code into CSSFontFace, and udpate
        to use the new API.
        (WebCore::appendSources):
        (WebCore::registerLocalFontFacesForFamily):
        (WebCore::CSSFontSelector::addFontFaceRule):
        (WebCore::computeTraitsMask): Deleted.
        (WebCore::createFontFace): Deleted.
        * css/FontFace.cpp: Added. External JavaScript API. Owns a CSSFontFace.
        (WebCore::FontFace::FontFace):
        (WebCore::FontFace::~FontFace):
        (WebCore::parseString):
        (WebCore::FontFace::setFamily):
        (WebCore::FontFace::setStyle):
        (WebCore::FontFace::setWeight):
        (WebCore::FontFace::setStretch):
        (WebCore::FontFace::setUnicodeRange):
        (WebCore::FontFace::setVariant):
        (WebCore::FontFace::setFeatureSettings):
        (WebCore::FontFace::family):
        (WebCore::FontFace::style):
        (WebCore::FontFace::weight):
        (WebCore::FontFace::stretch):
        (WebCore::FontFace::unicodeRange):
        (WebCore::FontFace::variant):
        (WebCore::FontFace::featureSettings):
        * css/FontFace.h: Added. Ditto.
        (WebCore::FontFace::create):
        * css/FontVariantBuilder.cpp: Added. Moved code here from FontVariantBuilder.h.
        Refactored to support a new client (CSSFontFace).
        (WebCore::extractFontVariantLigatures):
        (WebCore::extractFontVariantNumeric):
        (WebCore::extractFontVariantEastAsian):
        (WebCore::computeFontVariant):
        * css/FontVariantBuilder.h: Moved code from here into FontVariantBuilder.cpp.
        (WebCore::applyValueFontVariantLigatures): Deleted.
        (WebCore::applyValueFontVariantNumeric): Deleted.
        (WebCore::applyValueFontVariantEastAsian): Deleted.
        * css/StyleBuilderCustom.h: Update for new FontVariantBuilder API.
        (WebCore::StyleBuilderCustom::applyValueFontVariantLigatures):
        (WebCore::StyleBuilderCustom::applyValueFontVariantNumeric):
        (WebCore::StyleBuilderCustom::applyValueFontVariantEastAsian):
        * platform/text/TextFlags.h: Provide convenience classes.
        (WebCore::FontVariantLigaturesValues::FontVariantLigaturesValues):
        (WebCore::FontVariantNumericValues::FontVariantNumericValues):
        (WebCore::FontVariantEastAsianValues::FontVariantEastAsianValues):

2016-02-12  Jer Noble  <jer.noble@apple.com>

        Build fix after r196506; publish MediaResourceLoader.h as a private header so it can be used by
        TestWebKitAPI.

        * WebCore.xcodeproj/project.pbxproj:

2016-02-11  Jer Noble  <jer.noble@apple.com>

        [Mac] Adopt MediaResourceLoader (instead of CachedResourceLoader) in WebCoreNSURLSession.
        https://bugs.webkit.org/show_bug.cgi?id=154136

        Reviewed by Alex Christensen.

        MediaResourceLoader already supports using CORS attribute to verify CORS access requirements
        when loading media resources, so use it, rather than CachedResourceLoader, as the backing for
        WebCoreNSURLSession.

        * platform/network/cocoa/WebCoreNSURLSession.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession delegateQueue]):
        (-[WebCoreNSURLSession streamTaskWithNetService:]):
        (-[WebCoreNSURLSession isKindOfClass:]):
        (-[WebCoreNSURLSessionDataTask initWithSession:identifier:request:]):
        (-[WebCoreNSURLSessionDataTask _restart]):
        (-[WebCoreNSURLSessionDataTask _cancel]):
        (-[WebCoreNSURLSessionDataTask resume]):
        (-[WebCoreNSURLSessionDataTask _timingData]):
        (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]):
        (-[WebCoreNSURLSessionDataTask resource:receivedData:length:]):
        (-[WebCoreNSURLSession initWithResourceLoader:delegate:delegateQueue:]): Deleted.
        (-[WebCoreNSURLSession loader]): Deleted.
        (WebCore::WebCoreNSURLSessionDataTaskClient::dataSent): Deleted.
        (WebCore::WebCoreNSURLSessionDataTaskClient::responseReceived): Deleted.
        (WebCore::WebCoreNSURLSessionDataTaskClient::dataReceived): Deleted.
        (WebCore::WebCoreNSURLSessionDataTaskClient::redirectReceived): Deleted.
        (WebCore::WebCoreNSURLSessionDataTaskClient::notifyFinished): Deleted.
        (-[WebCoreNSURLSessionDataTask initWithSession:identifier:URL:]): Deleted.
        (-[WebCoreNSURLSessionDataTask _finish]): Deleted.
        (-[WebCoreNSURLSessionDataTask _setDefersLoading:]): Deleted.
        (-[WebCoreNSURLSessionDataTask resource:sentBytes:totalBytesToBeSent:]): Deleted.
        (-[WebCoreNSURLSessionDataTask resource:receivedRedirect:request:]): Deleted.
        (-[WebCoreNSURLSessionDataTask resourceFinished:]): Deleted.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL):

2016-02-12  Alex Christensen  <achristensen@webkit.org>

        Fix non-internal builds when using NetworkSession
        https://bugs.webkit.org/show_bug.cgi?id=152285

        * platform/spi/cf/CFNetworkSPI.h:
        Add SPI declaration used in r194156.

2016-02-12  Andreas Kling  <akling@apple.com>

        Throw out all live resource decoded data on memory pressure / suspension.
        <https://webkit.org/b/154176>

        Reviewed by Antti Koivisto.

        When pruning live resource decoded data from the memory cache,
        we normally avoid pruning anything that's been painted in the last second.
        This is an optimization to avoid getting into image decoding loops.

        For memory pressure / process suspension scenarios this doesn't really
        make sense though:

            - In the pressure case, if we have to render again soon it'll likely
              be a new GIF frame which we have to decode anyway.

            - In the process suspension case, we might *never* render again,
              so we should be good citizens and drop all the decoded data we can.

        This patch makes us drop all the decoded data, recently painted or not.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::releaseCriticalMemory):

2016-02-12  Gavin Barraclough  <barraclough@apple.com>

        Separate out !allowsAccess path in JSDOMWindowCustom getOwnPropertySlot
        https://bugs.webkit.org/show_bug.cgi?id=154156

        Reviewed by Chris Dumez.

        JSDOMWindowCustom getOwnPropertySlot currently allows cross-origin access to all
        static properties, relying on the property to perform the access check. This is
        a little insecure, since it is error prone - someone could easily add a property
        to the static table without realizing it would be automatcially exposed.

        Instead, add a hard-coded filter to restrict access. As a future implementation
        we might consider autogenerating this (the properties are already tagged in IDL,
        we might be able to track this in a flag on the static table).

        By separating out the handling of the same- and cross-origin access we can
        simplify & make the policy being enforced much clearer.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::objectToStringFunctionGetter): Deleted.
            - removed objectToStringFunctionGetter - this duplicated functionality of
              nonCachingStaticFunctionGetter.
        * bindings/js/JSDOMBinding.h:
        (WebCore::objectToStringFunctionGetter): Deleted.
            - removed objectToStringFunctionGetter - this duplicated functionality of
              nonCachingStaticFunctionGetter.
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowGetOwnPropertySlotDisallowAccess):
            - explicitly handle providing access to only the things we do want to allow cross-origin.
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        (WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
            - push all !allowsAccess handling to jsDOMWindowGetOwnPropertySlotDisallowAccess
        (WebCore::childFrameGetter): Deleted.
            - this was just a deoptimiztion - moving access into a callback saved very
              little & caused more work to be duplicated.

2016-02-12  Sukolsak Sakshuwong  <sukolsak@gmail.com>

        Update ICU header files to version 52
        https://bugs.webkit.org/show_bug.cgi?id=154160

        Reviewed by Alex Christensen.

        Update ICU header files to version 52 to allow the use of newer APIs.

        No new tests because there is no behavior change.

        * icu/unicode/bytestream.h:
        * icu/unicode/chariter.h:
        * icu/unicode/localpointer.h:
        * icu/unicode/platform.h:
        * icu/unicode/ptypes.h:
        * icu/unicode/putil.h:
        * icu/unicode/rep.h:
        (Replaceable::Replaceable):
        * icu/unicode/std_string.h:
        * icu/unicode/strenum.h:
        * icu/unicode/stringpiece.h:
        * icu/unicode/ubrk.h:
        * icu/unicode/uchar.h:
        * icu/unicode/ucnv.h:
        * icu/unicode/ucol.h:
        * icu/unicode/ucoleitr.h:
        * icu/unicode/uconfig.h:
        * icu/unicode/ucsdet.h:
        * icu/unicode/uenum.h:
        * icu/unicode/uidna.h:
        * icu/unicode/uiter.h:
        * icu/unicode/uloc.h:
        * icu/unicode/umachine.h:
        * icu/unicode/unistr.h:
        (UnicodeString::UnicodeString):
        (UnicodeString::operator== ):
        (UnicodeString::startsWith):
        (UnicodeString::setTo):
        (UnicodeString::remove):
        (UnicodeString::replace): Deleted.
        (UnicodeString::extract): Deleted.
        (UnicodeString::char32At): Deleted.
        (UnicodeString::getChar32Start): Deleted.
        (UnicodeString::getChar32Limit): Deleted.
        (UnicodeString::getTerminatedBuffer): Deleted.
        (UnicodeString::append): Deleted.
        (UnicodeString::truncate): Deleted.
        * icu/unicode/unorm2.h:
        * icu/unicode/uobject.h:
        * icu/unicode/urename.h:
        * icu/unicode/uscript.h:
        * icu/unicode/usearch.h:
        * icu/unicode/uset.h:
        * icu/unicode/ushape.h:
        * icu/unicode/ustring.h:
        * icu/unicode/utext.h:
        * icu/unicode/utf.h:
        * icu/unicode/utf16.h:
        * icu/unicode/utf8.h:
        * icu/unicode/utf_old.h:
        * icu/unicode/utypes.h:
        * icu/unicode/uvernum.h:
        * icu/unicode/uversion.h:

2016-02-12  Andreas Kling  <akling@apple.com>

        [Mac] BitmapImage::decodedDataIsPurgeable() is telling lies and causing massive memory usage.
        <https://webkit.org/b/154172>

        Reviewed by Antti Koivisto.

        The underlying mechanism in CoreAnimation that made this work is no longer in place.

        Instead of keeping purgeable frames and juggling volatility bits, we were simply caching
        every single frame of large GIF animations, sometimes leading to monstrous memory usage.

        Remove the code from WebCore since it's not doing at all what it means to.

        Now iOS and Mac will behave the same again, and frame caching decisions will be
        made by WebKit, based on total pixel byte size.

        * loader/cache/CachedImage.h:
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::decodedDataIsPurgeable): Deleted.
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::pruneLiveResourcesToSize): Deleted.
        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::decodedDataIsPurgeable): Deleted.
        (WebCore::BitmapImage::destroyDecodedDataIfNecessary): Deleted.
        * platform/graphics/BitmapImage.h:
        * platform/graphics/Image.h:
        (WebCore::Image::decodedDataIsPurgeable): Deleted.
        * platform/graphics/cg/BitmapImageCG.cpp:
        (WebCore::BitmapImage::decodedDataIsPurgeable): Deleted.
        * platform/graphics/cg/ImageSourceCG.cpp:
        (WebCore::ImageSource::createFrameAtIndex): Deleted.

2016-02-12  Brady Eidson  <beidson@apple.com>

        Modern IDB: Ref cycle between IDBObjectStore and IDBIndex.
        https://bugs.webkit.org/show_bug.cgi?id=154110

        Reviewed by Darin Adler.

        No new tests (Currently untestable).

        The lifetime of IDBObjectStore and IDBIndex are closely intertwined, but we have to break the ref cycle.
        
        This patch does a few semi-gnarly things:
        1 - Makes both IDBIndex and IDBObjectStore have a custom marking function so they can add each other as 
            opaque roots.
        2 - Adds a lock to protect IDBObjectStore's collection of referenced indexes to support #1, as GC marking
            can happen on any thread.
        3 - Makes IDBIndex not be traditionally RefCounted; Instead, IDBIndex::ref()/deref() simply ref()/deref()
            the owning IDBObjectStore.
        4 - ...Except when somebody deletes an IDBIndex from its IDBObjectStore. Once that happens, the object
            store no longer has a reference back to the index, but the index still needs a reference back to the
            object store. To support this, the IDBIndex becomes "traditionally RefCounted" while holding a ref to
            its IDBObjectStore.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        * Modules/indexeddb/IDBIndex.h:
        (WebCore::IDBIndex::isModern):
        * Modules/indexeddb/IDBIndex.idl:
        
        * Modules/indexeddb/IDBObjectStore.h:
        (WebCore::IDBObjectStore::isModern):
        * Modules/indexeddb/IDBObjectStore.idl:
        
        * Modules/indexeddb/client/IDBIndexImpl.cpp:
        (WebCore::IDBClient::IDBIndex::objectStore):
        (WebCore::IDBClient::IDBIndex::openCursor):
        (WebCore::IDBClient::IDBIndex::doCount):
        (WebCore::IDBClient::IDBIndex::openKeyCursor):
        (WebCore::IDBClient::IDBIndex::doGet):
        (WebCore::IDBClient::IDBIndex::doGetKey):
        (WebCore::IDBClient::IDBIndex::markAsDeleted):
        (WebCore::IDBClient::IDBIndex::ref):
        (WebCore::IDBClient::IDBIndex::deref):
        (WebCore::IDBClient::IDBIndex::create): Deleted.
        * Modules/indexeddb/client/IDBIndexImpl.h:
        (WebCore::IDBClient::IDBIndex::modernObjectStore):
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::createIndex):
        (WebCore::IDBClient::IDBObjectStore::index):
        (WebCore::IDBClient::IDBObjectStore::deleteIndex):
        (WebCore::IDBClient::IDBObjectStore::visitReferencedIndexes):
        * Modules/indexeddb/client/IDBObjectStoreImpl.h:
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::createIndex):
        * Modules/indexeddb/client/IDBTransactionImpl.h:
        
        * Modules/indexeddb/legacy/LegacyIndex.cpp:
        (WebCore::LegacyIndex::ref):
        (WebCore::LegacyIndex::deref):
        * Modules/indexeddb/legacy/LegacyIndex.h:
        
        * bindings/js/JSIDBIndexCustom.cpp: Added.
        (WebCore::JSIDBIndex::visitAdditionalChildren):
        
        * bindings/js/JSIDBObjectStoreCustom.cpp:
        (WebCore::JSIDBObjectStore::visitAdditionalChildren):

2016-02-12  Csaba Osztrogonác  <ossy@webkit.org>

        [EFL][GTK] Fix ENABLE(SVG_OTF_CONVERTER) build
        https://bugs.webkit.org/show_bug.cgi?id=154165

        Reviewed by Alex Christensen.

        * CMakeLists.txt:
        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):
        * svg/SVGToOTFFontConversion.cpp:
        * svg/SVGToOTFFontConversion.h:

2016-02-12  Chris Dumez  <cdumez@apple.com>

        Unreviewed nit fixes after r196466.

        * Modules/speech/SpeechSynthesisUtterance.idl: Fix curly bracket
          placement.
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader): Use wrappableObject instead of domObject.
        * bindings/scripts/test/*: Rebaseline.
        * dom/WebKitNamedFlow.idl: Drop unnecessary #if case.

2016-02-12  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Properly handle classes inheriting from EventTarget
        https://bugs.webkit.org/show_bug.cgi?id=154158

        Reviewed by Michael Catanzaro.

        Instead of removing its parent we now handle the case of classes
        having EventTarget as parent to make them implement the interface
        instead.

        * bindings/scripts/CodeGeneratorGObject.pm:
        (ShouldBeExposedAsInterface): Whether the parent given class
        should be exposed as an interface instead of a parent class.
        (GetParentClassName): Return Object as parent for classes having
        a parent that should be exposed as an interface.
        (GetParentImplClassName): Ditto.
        (GetBaseClass): Ditto.
        (GetParentGObjType): Ditto.
        (SkipFunction): Add FIXME comment.
        (ImplementsInterface): Helper function to check if a class
        implements the given interface.
        (GenerateCFile): Check whether the class implements EventTarget to
        generate the interface implementation.
        (GenerateInterface): Do not remove the parent class when it's EventTarget.

2016-02-12  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196470.
        https://bugs.webkit.org/show_bug.cgi?id=154167

        Broke some tests (Requested by anttik on #webkit).

        Reverted changeset:

        "Factor class change style invalidation code into a class"
        https://bugs.webkit.org/show_bug.cgi?id=154163
        http://trac.webkit.org/changeset/196470

2016-02-12  Antti Koivisto  <antti@apple.com>

        Factor class change style invalidation code into a class
        https://bugs.webkit.org/show_bug.cgi?id=154163

        Reviewed by Andreas Kling.

        Factor this piece of functionality out of Element and into ClassChangeInvalidation class.

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Element.cpp:
        (WebCore::classStringHasClassName):
        (WebCore::Element::classAttributeChanged):
        (WebCore::collectClasses): Deleted.
        (WebCore::computeClassChange): Deleted.
        (WebCore::invalidateStyleForClassChange): Deleted.
        * style/ClassChangeInvalidation.cpp: Added.
        (WebCore::Style::ClassChangeInvalidation::computeClassChange):
        (WebCore::Style::ClassChangeInvalidation::invalidateStyle):
        * style/ClassChangeInvalidation.h: Added.
        (WebCore::Style::ClassChangeInvalidation::needsInvalidation):
        (WebCore::Style::ClassChangeInvalidation::ClassChangeInvalidation):
        (WebCore::Style::ClassChangeInvalidation::~ClassChangeInvalidation):

2016-02-12  Csaba Osztrogonác  <ossy@webkit.org>

        GCC buildfix in Source/WebCore/svg/SVGToOTFFontConversion.cpp
        https://bugs.webkit.org/show_bug.cgi?id=154162

        Reviewed by Andreas Kling.

        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::finishAppendingKERNSubtable):

2016-02-12  Andreas Kling  <akling@apple.com>

        Don't invalidate the FontCache on memory pressure.
        <https://webkit.org/b/154161>

        Reviewed by Antti Koivisto.

        Invalidating the FontCache does more harm than good:

            - Anything that's still in the cache at this point is also
              referenced outside the cache, thus will not actually get deleted.

            - Future deduplication will fail, leading to more objects.

            - The global FontCache generation gets bumped, causing future style
              recalcs to be less efficient and breaking style sharing.

            - All FontSelector invalidation callbacks will fire, potentially
              causing forced full-document style recalcs.

        In fact, the only win from invalidating the FontCache comes from some
        minor shrinkage in the containers that make up the cache itself.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::releaseCriticalMemory): Deleted.

2016-02-11  Chris Dumez  <cdumez@apple.com>

        [Web IDL] interfaces should inherit EventTarget instead of duplicating the EventTarget API
        https://bugs.webkit.org/show_bug.cgi?id=154121
        <rdar://problem/24613234>

        Reviewed by Gavin Barraclough.

        Interfaces should inherit EventTarget instead of duplicating the
        EventTarget API in their IDL. Not only the duplication is ugly and
        error-prone, but this also does not match the specifications and
        have subtle web-exposed differences.

        This patch takes care of all interfaces except for DOMWindow and
        WorkerGlobalScope. Those will be updated in the follow-up patch
        as they will require a little bit more work and testing.

        We should also be able to get rid of the [EventTarget] WebKit IDL
        attribute in a follow-up.

        No new tests, already covered by existing tests.

        * Modules/battery/BatteryManager.idl:
        * Modules/encryptedmedia/MediaKeySession.idl:
        * Modules/indexeddb/IDBDatabase.h:
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBRequest.h:
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.h:
        * Modules/indexeddb/IDBTransaction.idl:
        * Modules/mediasession/MediaRemoteControls.idl:
        * Modules/mediasource/MediaSource.h:
        * Modules/mediasource/MediaSource.idl:
        * Modules/mediasource/SourceBuffer.h:
        * Modules/mediasource/SourceBuffer.idl:
        * Modules/mediasource/SourceBufferList.h:
        * Modules/mediasource/SourceBufferList.idl:
        * Modules/mediastream/MediaStream.h:
        * Modules/mediastream/MediaStream.idl:
        * Modules/mediastream/MediaStreamTrack.h:
        * Modules/mediastream/MediaStreamTrack.idl:
        * Modules/mediastream/RTCDTMFSender.h:
        * Modules/mediastream/RTCDTMFSender.idl:
        * Modules/mediastream/RTCDataChannel.h:
        * Modules/mediastream/RTCDataChannel.idl:
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/notifications/Notification.idl:
        * Modules/speech/SpeechSynthesisUtterance.idl:
        * Modules/webaudio/AudioContext.idl:
        * Modules/webaudio/AudioNode.idl:
        * Modules/websockets/WebSocket.idl:
        * css/FontLoader.idl:
        * dom/EventTarget.h:
        * dom/MessagePort.idl:
        * dom/Node.h:
        * dom/Node.idl:
        * dom/WebKitNamedFlow.idl:
        * fileapi/FileReader.idl:
        * html/MediaController.idl:
        * html/track/AudioTrackList.idl:
        * html/track/TextTrack.idl:
        * html/track/TextTrackCue.idl:
        * html/track/TextTrackList.idl:
        * html/track/VideoTrackList.idl:
        * loader/appcache/DOMApplicationCache.h:
        * loader/appcache/DOMApplicationCache.idl:
        * page/EventSource.idl:
        * page/Performance.h:
        * page/Performance.idl:
        * workers/Worker.idl:
        * xml/XMLHttpRequest.h:
        * xml/XMLHttpRequest.idl:
        * xml/XMLHttpRequestUpload.idl:
        - Drop hardcoded EventTarget operations and inherit EventTarget instead.
        - Drop JSGenerateToNativeObject / JSGenerateToJSObject IDL extended
          attributes for interfaces inheriting the EventTarget interface as
          the bindings generator now does this automatically for us.
        - On native side, have EventTarget subclass ScriptWrappable instead of
          each of its subclasses doing so. The issue was that
          EventTargetOwner::finalize() was calling uncacheWrapper() with an
          EventTarget*, which would not clear inlined cached wrapped (see
          clearInlineCachedWrapper()) because EventTarget did not subclass
          ScriptWrappable. However, cacheWrapper() is called is a specific
          subtype pointer (e.g. Node*) and we would decide to create an
          inline cached wrapper because Node subclassed ScriptWrappable
          (as well as EventTarget).

        * WebCore.xcodeproj/project.pbxproj:
        Export JSEventTarget.h as private header to fix the build.

        * bindings/js/JSDOMBinding.h:
        (WebCore::wrapperKey):
        (WebCore::getCachedWrapper):
        (WebCore::cacheWrapper):
        (WebCore::uncacheWrapper):
        Use new wrapperKey() function that is generated for each bindings
        class that also has wrapperOwner(). This is used instead of the
        C cast to void* in order to cast to the base wrapped type to fix
        issues with multiple inheritance. The issue was that cacheWrapper()
        was getting called with a DOM object subtype pointer (e.g.
        AudioContext*) but uncacheWrapper() was getting called with a base
        wrapped type pointer (e.g. EventTarget*). Most of our DOM classes
        use multiple inheritance and thus the pointer values (used as keys
        in the weak map) may differ.

        * bindings/js/JSTrackCustom.cpp:
        (WebCore::toJS):
        Call CREATE_DOM_WRAPPER() with an actual wrapped type (e.g. AudioTrack)
        instead of TrackBase type. TrackBase does not have corresponding
        generated bindings and therefore does not have a wrapperKey()
        function.

        * bindings/scripts/CodeGeneratorJS.pm:
        (ShouldGenerateToWrapped):
        (ShouldGenerateToJSDeclaration):
        (GenerateHeader):
        - Generate a wrapperKey() utility function along-side wrapperOwner()
          to help cast to the base wrapped type.
        - Generate toWrapped() / toJS() utility functions for interfaces
          that inherit EventTarget as those are required by our
          implementation and this avoids having to explicitly have them in
          the IDL.

        * bindings/scripts/test/*:
        Rebaseline bindings tests.

2016-02-11  Brent Fulgham  <bfulgham@apple.com>

        Optimize texture-complete checks
        https://bugs.webkit.org/show_bug.cgi?id=98308

        Reviewed by Dean Jackson.

        No new tests: No change in behavior.

        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::initializeNewContext): Initially consider all
        textures as suspect.
        (WebCore::WebGLRenderingContextBase::extensions): New helper function.
        (WebCore::WebGLRenderingContextBase::reshape): Mark textures as invalid when appropriate.
        (WebCore::WebGLRenderingContextBase::bindTexture): Identify invalid textures and mark
        them for later fix-up. Likewise, remove 'known good' textures from the fix-up pass.
        (WebCore::WebGLRenderingContextBase::deleteTexture): Remove instances of the deleted texture
        from our set of invalid textures.
        (WebCore::WebGLRenderingContextBase::checkTextureCompleteness): Only iterate through
        the 'bad' textures, rather than checking every single texture.
        * html/canvas/WebGLRenderingContextBase.h:

2016-02-11  Alex Christensen  <achristensen@webkit.org>

        Assert that IDBTransaction::transitionedToFinishing transitions to finishing.
        https://bugs.webkit.org/show_bug.cgi?id=154061

        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::transitionedToFinishing):
        Added assertion that we are transitioning to a finished or finishing state, based on Darin's feedback.

2016-02-11  Enrica Casucci  <enrica@apple.com>

        WebContent process crashes when performing data detection on content with existing data detector links.
        https://bugs.webkit.org/show_bug.cgi?id=154118
        rdar://problem/24511860

        Reviewed by Tim Horton.

        The DOM mutation caused by removing the existing links, can shift the range endpoints.
        We now save the range enpoints as positions so that we can recreate the ranges,
        if a DOM mutation occurred.

        * editing/cocoa/DataDetection.mm:
        (WebCore::removeResultLinksFromAnchor):
        (WebCore::searchForLinkRemovingExistingDDLinks):
        (WebCore::DataDetection::detectContentInRange):

2016-02-11  Jer Noble  <jer.noble@apple.com>

        Make MediaResourceLoader behave more like a CachedResourceLoader.
        https://bugs.webkit.org/show_bug.cgi?id=154117

        Reviewed by Alex Christensen.

        MediaResourceLoader currently can only handle a single request at a time. Split the class
        into two, MediaResourceLoader and MediaResource, effectively wrapping CachedResourceLoader
        and CachedRawResource respectively. With this devision, the same loader can be used to issue
        multiple simultaneous resource requests.

        This necessecitates splitting PlatformMediaResource into two classes as well.  To simplify
        the HTMLMediaElement, MediaPlayer, and MediaPlayerClient APIs, do not require a client
        object when creating the loader; instead, the client is required to create the resource.
        This also matches the CachedRawResource API.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerCreateResourceLoader): Remove the client parameter.
        * html/HTMLMediaElement.h:
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::MediaResourceLoader):
        (WebCore::MediaResourceLoader::~MediaResourceLoader):
        (WebCore::MediaResourceLoader::requestResource): Renamed from start().
        (WebCore::MediaResourceLoader::removeResource): Remove resource from live resource list.
        (WebCore::MediaResource::create): Utility factory.
        (WebCore::MediaResource::MediaResource):
        (WebCore::MediaResource::~MediaResource):
        (WebCore::MediaResource::stop): Moved from MediaResourceLoader.
        (WebCore::MediaResource::setDefersLoading): Ditto.
        (WebCore::MediaResource::responseReceived): Ditto.
        (WebCore::MediaResource::redirectReceived): Ditto.
        (WebCore::MediaResource::dataSent): Ditto.
        (WebCore::MediaResource::dataReceived): Ditto.
        (WebCore::MediaResource::notifyFinished): Ditto.
        (WebCore::MediaResource::getOrCreateReadBuffer): Ditto.
        * loader/MediaResourceLoader.h:
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::createResourceLoader):
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerCreateResourceLoader):
        * platform/graphics/PlatformMediaResourceLoader.h:
        (WebCore::PlatformMediaResourceClient::~PlatformMediaResourceClient): Renamed from PlatformMediaResourceLoaderClient.
        (WebCore::PlatformMediaResourceClient::responseReceived): Client methods now take a reference to the resource.
        (WebCore::PlatformMediaResourceClient::redirectReceived): Ditto.
        (WebCore::PlatformMediaResourceClient::dataSent): Ditto. 
        (WebCore::PlatformMediaResourceClient::dataReceived): Ditto.
        (WebCore::PlatformMediaResourceClient::accessControlCheckFailed): Ditto.
        (WebCore::PlatformMediaResourceClient::loadFailed): Ditto.
        (WebCore::PlatformMediaResourceClient::loadFinished): Ditto.
        (WebCore::PlatformMediaResourceClient::getOrCreateReadBuffer): Ditto.
        (WebCore::PlatformMediaResourceLoader::PlatformMediaResourceLoader): Ditto.
        (WebCore::PlatformMediaResource::PlatformMediaResource): 
        (WebCore::PlatformMediaResource::~PlatformMediaResource): 
        (WebCore::PlatformMediaResource::setClient):
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (webKitWebSrcStart):
        (webKitWebSrcNeedData):
        (webKitWebSrcEnoughData):
        (CachedResourceStreamingClient::getOrCreateReadBuffer):
        (CachedResourceStreamingClient::responseReceived):
        (CachedResourceStreamingClient::dataReceived):
        (CachedResourceStreamingClient::accessControlCheckFailed):
        (CachedResourceStreamingClient::loadFailed):
        (CachedResourceStreamingClient::loadFinished):

2016-02-11  Zalan Bujtas  <zalan@apple.com>

        Subpixel rendering: Make focusring painting subpixel aware.
        https://bugs.webkit.org/show_bug.cgi?id=154111

        Reviewed by David Hyatt.

        Do not integral snap focusring rects while collecting them (use device pixel snapping instead
        right before passing them to GraphicsContext::drawFocusRing).

        Unable to test.

        * platform/graphics/GraphicsContext.h:
        * platform/graphics/displaylists/DisplayListItems.h:
        (WebCore::DisplayList::DrawFocusRingRects::create):
        (WebCore::DisplayList::DrawFocusRingRects::rects):
        (WebCore::DisplayList::DrawFocusRingRects::DrawFocusRingRects):
        * platform/graphics/displaylists/DisplayListRecorder.cpp:
        (WebCore::DisplayList::Recorder::drawFocusRing):
        * platform/graphics/displaylists/DisplayListRecorder.h:
        * platform/graphics/mac/GraphicsContextMac.mm:
        (WebCore::GraphicsContext::drawFocusRing):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::addFocusRingRectsForInlineChildren):
        (WebCore::RenderBlock::addFocusRingRects):
        * rendering/RenderBlock.h:
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::addFocusRingRectsForInlineChildren):
        * rendering/RenderBlockFlow.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::addFocusRingRects):
        * rendering/RenderBox.h:
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::paintFocusRing):
        (WebCore::RenderElement::issueRepaintForOutlineAuto):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::absoluteRects):
        (WebCore::RenderInline::addFocusRingRects):
        * rendering/RenderInline.h:
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::addFocusRingRects):
        * rendering/RenderListBox.h:
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::addPDFURLRect):
        (WebCore::RenderObject::absoluteFocusRingQuads):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::addFocusRingRects):
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::addFocusRingRects):
        * rendering/RenderTextControl.h:
        * rendering/svg/RenderSVGContainer.cpp:
        (WebCore::RenderSVGContainer::addFocusRingRects):
        * rendering/svg/RenderSVGContainer.h:
        * rendering/svg/RenderSVGImage.cpp:
        (WebCore::RenderSVGImage::addFocusRingRects):
        * rendering/svg/RenderSVGImage.h:
        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::addFocusRingRects):
        * rendering/svg/RenderSVGShape.h:

2016-02-11  Myles C. Maxfield  <mmaxfield@apple.com>

        Addressing post-review comments after r196393

        Unreviewed.

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::getFontFace):
        * css/CSSSegmentedFontFace.h:

2016-02-11  Antti Koivisto  <antti@apple.com>

        Rename Element::style() to Element::cssomStyle()
        https://bugs.webkit.org/show_bug.cgi?id=154107

        Reviewed by Alex Christensen.

        It implements the IDL "style" attribute that returns a CSSOM object.
        Inside WebCore "style" generally refers to a RenderStyle.

        * dom/Element.cpp:
        (WebCore::Element::hasAttributeNS):
        (WebCore::Element::cssomStyle):
        (WebCore::Element::focus):
        (WebCore::Element::style): Deleted.
        * dom/Element.h:
        (WebCore::Element::tagQName):
        * dom/Element.idl:
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::~StyledElement):
        (WebCore::StyledElement::cssomStyle):
        (WebCore::StyledElement::style): Deleted.
        * dom/StyledElement.h:
        (WebCore::StyledElement::synchronizeStyleAttributeInternal):
        (WebCore::StyledElement::collectStyleForPresentationAttribute):
        * editing/Editor.cpp:
        (WebCore::Editor::applyEditingStyleToElement):
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::getMatchedStylesForNode):
        (WebCore::InspectorCSSAgent::getInlineStylesForNode):
        (WebCore::InspectorCSSAgent::asInspectorStyleSheet):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyleSheetForInlineStyle::didModifyElementAttribute):
        (WebCore::InspectorStyleSheetForInlineStyle::inlineStyle):
        (WebCore::InspectorStyleSheetForInlineStyle::elementStyleText):
        * svg/SVGElement.idl:

2016-02-11  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Consolidate TextureMapper file and include dir lists.
        https://bugs.webkit.org/show_bug.cgi?id=154106

        Reviewed by Michael Catanzaro.

        No new tests needed.

        * CMakeLists.txt: Moved texmap include dir and source list to
        TextureMapper.cmake, removed non-existent include dir "filters/texmap".
        * PlatformEfl.cmake: Moved texmap and coordinatedgraphics include
        dirs and source list to TextureMapper.cmake.
        * PlatformGTK.cmake: Ditto, also removed non-existent include dir
        "texmap/threadedcompositor"
        * PlatformWinCairo.cmake: Moved texmap files to TextureMapper.cmake.
        * platform/TextureMapper.cmake: Added.

2016-02-11  Chris Dumez  <cdumez@apple.com>

        Move 'length' property to the prototype
        https://bugs.webkit.org/show_bug.cgi?id=154051
        <rdar://problem/24577385>

        Reviewed by Darin Adler.

        Move 'length' property to the prototype, where it should be. We used to
        keep it on the instance because our implementation of
        getOwnPropertySlot() was wrong for interfaces with a named property
        getter. However, our implementation of getOwnPropertySlot() is now
        spec-compliant so this should be OK.

        Moving 'length' to the prototype is also a little bit risky in terms of
        performance, especially for HTMLCollection / NodeList. However, I did
        not see an impact on realistic benchmarks like Speedometer and only saw
        a small impact (< 5%) on micro-benchmarks. I propose we make our behavior
        correct and monitor performance. If we see any benchmark we care about
        regress then we should try and optimize while keeping the attribute on
        the prototype.

        No new tests, already covered by existing tests.

        * bindings/js/JSDOMBinding.h:
        (WebCore::getStaticValueSlotEntryWithoutCaching):
        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::getOwnPropertySlot):
        (WebCore::JSHTMLDocument::nameGetter): Deleted.
        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate):
        * bindings/js/JSPluginElementFunctions.h:
        (WebCore::pluginElementCustomGetOwnPropertySlot):
        * bindings/js/JSStorageCustom.cpp:
        (WebCore::JSStorage::deleteProperty):
        (WebCore::JSStorage::deletePropertyByIndex):
        (WebCore::JSStorage::putDelegate):
        Leverage the new hasStaticPropertyTable static property in the
        generated bindings for performance.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        Generate a "hasStaticPropertyTable" static const boolean property
        for each bindings class so we can check at build time if
        ClassInfo::staticPropHashTable is null.

        (AttributeShouldBeOnInstance):
        Move "length" to the prototype.

        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
        * bindings/scripts/test/JS/JSTestEventConstructor.h:
        * bindings/scripts/test/JS/JSTestEventTarget.h:
        * bindings/scripts/test/JS/JSTestException.h:
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
        * bindings/scripts/test/JS/JSTestInterface.h:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h:
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
        * bindings/scripts/test/JS/JSTestNode.h:
        * bindings/scripts/test/JS/JSTestNondeterministic.h:
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
        * bindings/scripts/test/JS/JSTestTypedefs.h:
        * bindings/scripts/test/JS/JSattribute.h:
        * bindings/scripts/test/JS/JSreadonly.h:
        Rebaseline bindings tests.


2016-02-11  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !(ENABLE(SHADOW_DOM) || ENABLE(DETAILS_ELEMENT)) after r196281
        https://bugs.webkit.org/show_bug.cgi?id=154035

        Reviewed by Antti Koivisto.

        Follow-up fix after r196365. Removed guards around slotNodeIndex.

        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::Context::Context):

2016-02-10  Ryan Haddad  <ryanhaddad@apple.com>

        Updating bindings test reference file for JSTestEventConstructor.cpp after r196400

        Unreviewed test gardening.

        No new tests needed.

        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructorConstructor::construct):

2016-02-10  Eric Carlson  <eric.carlson@apple.com>

        Update "manual" caption track logic
        https://bugs.webkit.org/show_bug.cgi?id=154084
        <rdar://problem/24530516>

        Reviewed by Dean Jackson.

        No new tests, media/track/track-manual-mode.html was updated.

        * English.lproj/Localizable.strings: Add new string.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::addTextTrack): track.setManualSelectionMode is no more.
        (WebCore::HTMLMediaElement::configureTextTrackGroup): Never enable a track automatically when
          in manual selection mode.
        (WebCore::HTMLMediaElement::captionPreferencesChanged):  track.setManualSelectionMode is no more.

        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::containsOnlyForcedSubtitles): Return true for forced tracks.
        (WebCore::TextTrack::kind): Deleted.
        * html/track/TextTrack.h:

        * html/track/TrackBase.h:
        (WebCore::TrackBase::kind): De-virtualize, nobody overrides it.

        * page/CaptionUserPreferencesMediaAF.cpp:
        (WebCore::trackDisplayName): Include "forced" in the name of forced tracks.

        * platform/LocalizedStrings.cpp:
        (WebCore::forcedTrackMenuItemText): New.
        * platform/LocalizedStrings.h:

2016-02-10  Jiewen Tan  <jiewen_tan@apple.com>

        Rename *Event::create* which creates events for bindings to *Event::createForBindings* and cleanup corresponding paths
        https://bugs.webkit.org/show_bug.cgi?id=153903
        <rdar://problem/24518146>

        Reviewed by Darin Adler.

        Rename Event::create(const AtomicString&, const EventInit&) to Event::createForBindings
        (const AtomicString&, const EventInit&) and for all the subclasses as well in order to
        support Event.isTrusted. Besides, some of the subclasses use the create method for bindings
        to create events not for bindings and vice versa. Therefore, this patch also cleanup
        corresponding paths to ensure no misuse of the create mehtod. The same for Event::create()
        as it is combined with Event::initEvent to create an event for bindings for legacy content.

        After this patch, all call sites of *Event::create* are supposed to use *Event::create
        to create events for user agent and *Event::createForBindings for bindings.

        No change in behavior.

        * Modules/airplay/WebKitPlaybackTargetAvailabilityEvent.h:
        (WebCore::WebKitPlaybackTargetAvailabilityEvent::create):
        (WebCore::WebKitPlaybackTargetAvailabilityEvent::createForBindings):
        (WebCore::WebKitPlaybackTargetAvailabilityEventInit::WebKitPlaybackTargetAvailabilityEventInit): Deleted.
        * Modules/encryptedmedia/MediaKeyMessageEvent.cpp:
        (WebCore::MediaKeyMessageEvent::MediaKeyMessageEvent):
        (WebCore::MediaKeyMessageEventInit::MediaKeyMessageEventInit): Deleted.
        * Modules/encryptedmedia/MediaKeyMessageEvent.h:
        (WebCore::MediaKeyMessageEvent::create):
        (WebCore::MediaKeyMessageEvent::createForBindings):
        * Modules/encryptedmedia/MediaKeyNeededEvent.cpp:
        (WebCore::MediaKeyNeededEvent::MediaKeyNeededEvent):
        (WebCore::MediaKeyNeededEventInit::MediaKeyNeededEventInit): Deleted.
        * Modules/encryptedmedia/MediaKeyNeededEvent.h:
        (WebCore::MediaKeyNeededEvent::create):
        (WebCore::MediaKeyNeededEvent::createForBindings):
        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::sendMessage):
        * Modules/gamepad/GamepadEvent.h:
        (WebCore::GamepadEvent::create):
        (WebCore::GamepadEvent::createForBindings):
        (WebCore::GamepadEventInit::GamepadEventInit): Deleted.
        * Modules/indieui/UIRequestEvent.cpp:
        (WebCore::UIRequestEvent::createForBindings):
        (WebCore::UIRequestEvent::UIRequestEvent):
        (WebCore::UIRequestEventInit::UIRequestEventInit): Deleted.
        (WebCore::UIRequestEvent::create): Deleted.
        * Modules/indieui/UIRequestEvent.h:
        * Modules/mediastream/MediaStreamEvent.cpp:
        (WebCore::MediaStreamEvent::createForBindings):
        (WebCore::MediaStreamEventInit::MediaStreamEventInit): Deleted.
        (WebCore::MediaStreamEvent::create): Deleted.
        * Modules/mediastream/MediaStreamEvent.h:
        * Modules/mediastream/MediaStreamTrackEvent.cpp:
        (WebCore::MediaStreamTrackEvent::createForBindings):
        (WebCore::MediaStreamTrackEventInit::MediaStreamTrackEventInit): Deleted.
        (WebCore::MediaStreamTrackEvent::create): Deleted.
        * Modules/mediastream/MediaStreamTrackEvent.h:
        * Modules/mediastream/RTCDTMFToneChangeEvent.cpp:
        (WebCore::RTCDTMFToneChangeEvent::createForBindings):
        (WebCore::RTCDTMFToneChangeEvent::create): Deleted.
        * Modules/mediastream/RTCDTMFToneChangeEvent.h:
        * Modules/mediastream/RTCDataChannelEvent.cpp:
        (WebCore::RTCDataChannelEvent::createForBindings):
        (WebCore::RTCDataChannelEvent::create): Deleted.
        * Modules/mediastream/RTCDataChannelEvent.h:
        * Modules/mediastream/RTCIceCandidateEvent.cpp:
        (WebCore::RTCIceCandidateEvent::createForBindings):
        (WebCore::RTCIceCandidateEvent::create): Deleted.
        * Modules/mediastream/RTCIceCandidateEvent.h:
        * Modules/mediastream/RTCTrackEvent.cpp:
        (WebCore::RTCTrackEvent::createForBindings):
        (WebCore::RTCTrackEventInit::RTCTrackEventInit): Deleted.
        (WebCore::RTCTrackEvent::create): Deleted.
        * Modules/mediastream/RTCTrackEvent.h:
        * Modules/speech/SpeechSynthesisEvent.cpp:
        (WebCore::SpeechSynthesisEvent::createForBindings):
        (WebCore::SpeechSynthesisEvent::create):
        (WebCore::SpeechSynthesisEvent::SpeechSynthesisEvent):
        * Modules/speech/SpeechSynthesisEvent.h:
        * Modules/webaudio/AudioProcessingEvent.cpp:
        (WebCore::AudioProcessingEvent::create): Deleted.
        * Modules/webaudio/AudioProcessingEvent.h:
        (WebCore::AudioProcessingEvent::create):
        (WebCore::AudioProcessingEvent::createForBindings):
        * Modules/webaudio/OfflineAudioCompletionEvent.cpp:
        (WebCore::OfflineAudioCompletionEvent::createForBindings):
        (WebCore::OfflineAudioCompletionEvent::create): Deleted.
        * Modules/webaudio/OfflineAudioCompletionEvent.h:
        * Modules/websockets/CloseEvent.h:
        (WebCore::CloseEvent::create):
        (WebCore::CloseEvent::createForBindings):
        (WebCore::CloseEvent::CloseEvent):
        (WebCore::CloseEventInit::CloseEventInit): Deleted.
        * bindings/objc/DOM.mm:
        (-[DOMNode nextFocusNode]):
        (-[DOMNode previousFocusNode]):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition):
        * dom/AnimationEvent.cpp:
        (WebCore::AnimationEventInit::AnimationEventInit): Deleted.
        * dom/AnimationEvent.h:
        * dom/BeforeLoadEvent.h:
        (WebCore::BeforeLoadEventInit::BeforeLoadEventInit): Deleted.
        * dom/ClipboardEvent.h:
        * dom/CompositionEvent.cpp:
        (WebCore::CompositionEventInit::CompositionEventInit): Deleted.
        * dom/CompositionEvent.h:
        * dom/CustomEvent.cpp:
        (WebCore::CustomEventInit::CustomEventInit): Deleted.
        * dom/CustomEvent.h:
        * dom/DeviceMotionEvent.h:
        * dom/DeviceOrientationEvent.h:
        * dom/Document.cpp:
        (WebCore::Document::createEvent):
        * dom/Element.cpp:
        (WebCore::Element::dispatchMouseEvent):
        * dom/ErrorEvent.cpp:
        (WebCore::ErrorEventInit::ErrorEventInit): Deleted.
        * dom/ErrorEvent.h:
        * dom/Event.cpp:
        (WebCore::EventInit::EventInit): Deleted.
        * dom/Event.h:
        (WebCore::Event::createForBindings):
        (WebCore::Event::create): Deleted.
        * dom/FocusEvent.cpp:
        (WebCore::FocusEventInit::FocusEventInit): Deleted.
        * dom/FocusEvent.h:
        * dom/HashChangeEvent.h:
        (WebCore::HashChangeEventInit::HashChangeEventInit): Deleted.
        * dom/KeyboardEvent.cpp:
        (WebCore::KeyboardEvent::KeyboardEvent):
        (WebCore::KeyboardEventInit::KeyboardEventInit): Deleted.
        * dom/KeyboardEvent.h:
        * dom/MessageEvent.cpp:
        (WebCore::MessageEvent::MessageEvent):
        (WebCore::MessageEventInit::MessageEventInit): Deleted.
        * dom/MessageEvent.h:
        * dom/MouseEvent.cpp:
        (WebCore::MouseEvent::createForBindings):
        (WebCore::MouseEvent::create):
        (WebCore::MouseEvent::MouseEvent):
        (WebCore::MouseEvent::cloneFor):
        (WebCore::MouseEventInit::MouseEventInit): Deleted.
        * dom/MouseEvent.h:
        (WebCore::MouseEvent::createForBindings):
        (WebCore::MouseEvent::create): Deleted.
        * dom/MouseRelatedEvent.cpp:
        (WebCore::MouseRelatedEvent::MouseRelatedEvent):
        (WebCore::MouseRelatedEvent::init):
        * dom/MouseRelatedEvent.h:
        (WebCore::MouseRelatedEvent::screenX):
        (WebCore::MouseRelatedEvent::screenY):
        (WebCore::MouseRelatedEvent::screenLocation):
        (WebCore::MouseRelatedEvent::clientX):
        (WebCore::MouseRelatedEvent::clientY):
        (WebCore::MouseRelatedEvent::movementX):
        (WebCore::MouseRelatedEvent::movementY):
        (WebCore::MouseRelatedEvent::clientLocation):
        (WebCore::MouseRelatedEvent::isSimulated):
        (WebCore::MouseRelatedEvent::absoluteLocation):
        (WebCore::MouseRelatedEvent::setAbsoluteLocation):
        * dom/MutationEvent.h:
        * dom/OverflowEvent.cpp:
        (WebCore::OverflowEvent::OverflowEvent):
        (WebCore::OverflowEvent::initOverflowEvent):
        (WebCore::OverflowEventInit::OverflowEventInit): Deleted.
        * dom/OverflowEvent.h:
        * dom/PageTransitionEvent.cpp:
        (WebCore::PageTransitionEventInit::PageTransitionEventInit): Deleted.
        * dom/PageTransitionEvent.h:
        * dom/PopStateEvent.cpp:
        (WebCore::PopStateEvent::createForBindings):
        (WebCore::PopStateEventInit::PopStateEventInit): Deleted.
        (WebCore::PopStateEvent::PopStateEvent): Deleted.
        (WebCore::PopStateEvent::create): Deleted.
        * dom/PopStateEvent.h:
        * dom/ProgressEvent.cpp:
        (WebCore::ProgressEventInit::ProgressEventInit): Deleted.
        * dom/ProgressEvent.h:
        (WebCore::ProgressEvent::createForBindings):
        (WebCore::ProgressEvent::create): Deleted.
        * dom/SecurityPolicyViolationEvent.h:
        (WebCore::SecurityPolicyViolationEventInit::SecurityPolicyViolationEventInit): Deleted.
        * dom/TextEvent.cpp:
        (WebCore::TextEvent::createForBindings):
        (WebCore::TextEvent::create): Deleted.
        * dom/TextEvent.h:
        * dom/TouchEvent.h:
        * dom/TransitionEvent.cpp:
        (WebCore::TransitionEventInit::TransitionEventInit): Deleted.
        * dom/TransitionEvent.h:
        * dom/UIEvent.cpp:
        (WebCore::UIEventInit::UIEventInit): Deleted.
        * dom/UIEvent.h:
        (WebCore::UIEvent::createForBindings):
        (WebCore::UIEvent::create): Deleted.
        * dom/UIEventWithKeyState.h:
        (WebCore::UIEventWithKeyState::ctrlKey):
        (WebCore::UIEventWithKeyState::shiftKey):
        (WebCore::UIEventWithKeyState::altKey):
        (WebCore::UIEventWithKeyState::metaKey):
        (WebCore::UIEventWithKeyState::UIEventWithKeyState):
        * dom/WebKitAnimationEvent.cpp:
        (WebCore::WebKitAnimationEventInit::WebKitAnimationEventInit): Deleted.
        * dom/WebKitAnimationEvent.h:
        * dom/WebKitTransitionEvent.cpp:
        (WebCore::WebKitTransitionEventInit::WebKitTransitionEventInit): Deleted.
        * dom/WebKitTransitionEvent.h:
        * dom/WheelEvent.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerKeyAdded):
        (WebCore::HTMLMediaElement::mediaPlayerKeyError):
        (WebCore::HTMLMediaElement::mediaPlayerKeyMessage):
        (WebCore::HTMLMediaElement::mediaPlayerKeyNeeded):
        * html/MediaKeyEvent.cpp:
        (WebCore::MediaKeyEvent::MediaKeyEvent):
        (WebCore::MediaKeyEventInit::MediaKeyEventInit): Deleted.
        * html/MediaKeyEvent.h:
        * html/canvas/WebGLContextEvent.cpp:
        (WebCore::WebGLContextEventInit::WebGLContextEventInit): Deleted.
        * html/canvas/WebGLContextEvent.h:
        * html/track/TrackEvent.cpp:
        (WebCore::TrackEvent::TrackEvent):
        (WebCore::TrackEventInit::TrackEventInit): Deleted.
        * html/track/TrackEvent.h:
        * html/track/TrackListBase.cpp:
        (TrackListBase::scheduleTrackEvent):
        (TrackListBase::scheduleChangeEvent):
        * page/EventSource.cpp:
        (WebCore::EventSource::createMessageEvent):
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportViolation):
        (WebCore::gatherSecurityPolicyViolationEventData): Deleted.
        * storage/StorageEvent.cpp:
        (WebCore::StorageEvent::createForBindings):
        (WebCore::StorageEventInit::StorageEventInit): Deleted.
        (WebCore::StorageEvent::create): Deleted.
        * storage/StorageEvent.h:
        * svg/SVGZoomEvent.h:
        (WebCore::SVGZoomEvent::createForBindings):
        (WebCore::SVGZoomEvent::create): Deleted.
        * xml/XMLHttpRequestProgressEvent.h:
        (WebCore::XMLHttpRequestProgressEvent::createForBindings):
        (WebCore::XMLHttpRequestProgressEvent::create): Deleted.

2016-02-10  Ryan Haddad  <ryanhaddad@apple.com>

        Rebaselining bindings tests

        Unreviewed test gardening.

        No new tests needed.

        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestCallback.cpp:
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        * bindings/scripts/test/JS/JSTestException.cpp:
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/JS/JSattribute.cpp:
        * bindings/scripts/test/JS/JSreadonly.cpp:

2016-02-10  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Consolidate CMake code related to image decoders.
        https://bugs.webkit.org/show_bug.cgi?id=154074

        Reviewed by Alex Christensen.

        Common image decoder sources, includes and libs are moved to
        platform/ImageDecoders.cmake.

        Also, added include directories of libjpeg and libpng to
        WebCore_SYSTEM_INCLUDE_DIRECTORIES.

        No new tests needed.

        * CMakeLists.txt: Moved common include paths to ImageDecoders.cmake.
        * PlatformEfl.cmake: Moved common sources and libs to ImageDecoders.cmake.
        * PlatformGTK.cmake: Ditto.
        * PlatformWinCairo.cmake: Moved common sources to ImageDecoders.cmake.
        * platform/ImageDecoders.cmake: Added.

2016-02-10  Myles C. Maxfield  <mmaxfield@apple.com>

        CSSSegmentedFontFace does not need to be reference counted
        https://bugs.webkit.org/show_bug.cgi?id=154083

        Reviewed by Antti Koivisto.

        ...There is only ever a single reference to one.

        No new tests because there is no behavior change.

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::getFontFace):
        * css/CSSFontSelector.h:
        * css/CSSSegmentedFontFace.h:
        (WebCore::CSSSegmentedFontFace::create): Deleted.

2016-02-10  Myles C. Maxfield  <mmaxfield@apple.com>

        FontCache's clients should use references instead of pointers
        https://bugs.webkit.org/show_bug.cgi?id=154085

        Reviewed by Antti Koivisto.

        They are never null.

        No new tests because there is no behavior change.

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::CSSFontSelector):
        (WebCore::CSSFontSelector::~CSSFontSelector):
        * platform/graphics/FontCache.cpp:
        (WebCore::FontCache::addClient):
        (WebCore::FontCache::removeClient):
        * platform/graphics/FontCache.h:

2016-02-10  Chris Dumez  <cdumez@apple.com>

        [Web IDL] interface objects should be Function objects
        https://bugs.webkit.org/show_bug.cgi?id=154038
        <rdar://problem/24569358>

        Reviewed by Geoffrey Garen.

        interface objects should be Function objects as per Web IDL:
        - http://heycam.github.io/webidl/#interface-object
        - http://heycam.github.io/webidl/#es-interfaces

        So window.Event should be a Function object for e.g. but in WebKit it
        is a regular EventConstructor JSObject.
        Firefox and Chrome match the specification.

        Test: js/interface-objects.html

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::callThrowTypeError):
        (WebCore::DOMConstructorObject::getCallData):
        When calling the interface object as a function, we throw a TypeError
        with a message asking to use the 'new' operator to match the behavior
        of Firefox and Chrome.

        * bindings/js/JSDOMBinding.h:
        Add JSC::TypeOfShouldCallGetCallData structure flag and implement
        getCallData() so that typeof returns "function", as per the
        specification and the behavior of other browsers.

        (WebCore::DOMConstructorObject::className):
        Implement className() and return "Function" to match the specification and
        other browsers. Otherwise, it would fall back to using ClassInfo::className
        which os the function name and interface name (e.g. "Event").

        * bindings/js/JSDOMConstructor.h:
        (WebCore::JSDOMConstructorNotConstructable::callThrowTypeError):
        (WebCore::JSDOMConstructorNotConstructable::getCallData):
        As per the specification, interfaces that do not have a [Constructor]
        should throw a TypeError when called as a function. Use the "Illegal
        constructor" error message to match Firefox and Chrome.

        * bindings/js/JSDOMGlobalObject.h:
        (WebCore::getDOMConstructor):
        Instead of using objectPrototype as prototype for all DOM constructors,
        we now call the prototypeForStructure() static function that is
        generated for each bindings class. As per the Web IDL specification,
        The [[Prototype]] internal property of an interface object for a
        non-callback interface is determined as follows:
        1. If the interface inherits from some other interface, the value of
           [[Prototype]] is the interface object for that other interface.
        2. If the interface doesn't inherit from any other interface, the value
           of [[Prototype]] is %FunctionPrototype% ([ECMA-262], section 6.1.7.4).

        * bindings/js/JSImageConstructor.cpp:
        (WebCore::JSImageConstructor::prototypeForStructure):
        Have the Image's interface object use HTMLElement's interface object
        as prototype as HTMLImageElement inherits HTMLElement.

        * bindings/scripts/CodeGenerator.pm:
        (getInterfaceExtendedAttributesFromName):
        Add a utility function to cheaply retrieve an interface's IDL extended
        attributes without actually parsing the IDL. This is used to check if
        an interface's parent is marked as [NoInterfaceObject] currently.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        (GenerateCallbackHeader):
        (GenerateCallbackImplementation):
        Mark JSGlobalObject* parameter as const as the implementation does not
        alter the globalObject.

        (GenerateConstructorHelperMethods):
        - Generate prototypeForStructure() function for each bindings class that
          is not marked as [NoInterfaceObject] so getDOMConstructor() knows which
          prototype to use for the interface object / constructor when constructing
          it.
        - Use the interface name for the interface object, without the "Constructor"
          suffix, to match the behavior of Firefox and Chrome.

        * bindings/scripts/test/*:
        Rebaseline bindings tests.

2016-02-10  Jer Noble  <jer.noble@apple.com>

        [Mac] Graphical corruption in videos when enabling custom loading path
        https://bugs.webkit.org/show_bug.cgi?id=154044

        Reviewed by Alex Christensen.

        Revert the "Drive-by fix" in r196345 as it breaks the WebCoreNSURLSessionTests.BasicOperation API test.

        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSessionDataTask resource:receivedData:length:]):

2016-02-10  Myles C. Maxfield  <mmaxfield@apple.com>

        CSSSegmentedFontFace does not need to be reference counted
        https://bugs.webkit.org/show_bug.cgi?id=154083

        Reviewed by Antti Koivisto.

        ...There is only ever a single reference to one.

        No new tests because there is no behavior change.

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::getFontFace):
        * css/CSSFontSelector.h:
        * css/CSSSegmentedFontFace.h:
        (WebCore::CSSSegmentedFontFace::create): Deleted.

2016-02-10  Antti Koivisto  <antti@apple.com>

        Optimize style invalidation after class attribute change
        https://bugs.webkit.org/show_bug.cgi?id=154075
        rdar://problem/12526450

        Reviewed by Andreas Kling.

        Currently a class attribute change invalidates style for the entire element subtree for any class found in the
        active stylesheet set.

        This patch optimizes class changes by building a new optimization structure called ancestorClassRules. It contains
        rules that have class selectors in the portion of the complex selector that matches ancestor elements. The sets
        of rules are hashes by the class name.

        On class attribute change the existing StyleInvalidationAnalysis mechanism is used with ancestorClassRules to invalidate
        exactly those descendants that are affected by the addition or removal of the class name. This is fast because the CSS JIT
        makes selector matching cheap and the number of relevant rules is typically small.

        This optimization is very effective on many dynamic pages. For example when focusing and unfocusing the web inspector it
        cuts down the number of resolved elements from ~1000 to ~50. Even in PLT it reduces the number of resolved elements by ~11%.

        * css/DocumentRuleSets.cpp:
        (WebCore::DocumentRuleSets::collectFeatures):
        (WebCore::DocumentRuleSets::ancestorClassRules):

            Create optimization RuleSets on-demand when there is an actual dynamic class change.

        * css/DocumentRuleSets.h:
        (WebCore::DocumentRuleSets::features):
        (WebCore::DocumentRuleSets::sibling):
        (WebCore::DocumentRuleSets::uncommonAttribute):
        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::ElementRuleCollector):

            Add a new constructor that doesn't requires DocumentRuleSets. Only the user and author style is required.

        (WebCore::ElementRuleCollector::matchAuthorRules):
        (WebCore::ElementRuleCollector::matchUserRules):
        * css/ElementRuleCollector.h:
        * css/RuleFeature.cpp:
        (WebCore::RuleFeatureSet::recursivelyCollectFeaturesFromSelector):

            Collect class names that show up in the ancestor portion of the selector.
            Make this a member.

        (WebCore::RuleFeatureSet::collectFeatures):

            Move this code from RuleData.
            Add the rule to ancestorClassRules if needed.

        (WebCore::RuleFeatureSet::add):
        (WebCore::RuleFeatureSet::clear):
        (WebCore::RuleFeatureSet::shrinkToFit):
        (WebCore::recursivelyCollectFeaturesFromSelector): Deleted.
        (WebCore::RuleFeatureSet::collectFeaturesFromSelector): Deleted.
        * css/RuleFeature.h:
        (WebCore::RuleFeature::RuleFeature):
        (WebCore::RuleFeatureSet::RuleFeatureSet): Deleted.
        * css/RuleSet.cpp:
        (WebCore::RuleData::RuleData):
        (WebCore::RuleSet::RuleSet):
        (WebCore::RuleSet::~RuleSet):
        (WebCore::RuleSet::addToRuleSet):
        (WebCore::RuleSet::addRule):
        (WebCore::RuleSet::addRulesFromSheet):
        (WebCore::collectFeaturesFromRuleData): Deleted.
        * css/RuleSet.h:
        (WebCore::RuleSet::tagRules):
        (WebCore::RuleSet::RuleSet): Deleted.
        * css/StyleInvalidationAnalysis.cpp:
        (WebCore::shouldDirtyAllStyle):
        (WebCore::StyleInvalidationAnalysis::StyleInvalidationAnalysis):

            Add a new constructor that takes a ready made RuleSet instead of a stylesheet.

        (WebCore::StyleInvalidationAnalysis::invalidateIfNeeded):
        (WebCore::StyleInvalidationAnalysis::invalidateStyleForTree):
        (WebCore::StyleInvalidationAnalysis::invalidateStyle):
        (WebCore::StyleInvalidationAnalysis::invalidateStyle):

            New function for invalidating a subtree instead of the whole document.

        * css/StyleInvalidationAnalysis.h:
        (WebCore::StyleInvalidationAnalysis::dirtiesAllStyle):
        (WebCore::StyleInvalidationAnalysis::hasShadowPseudoElementRulesInAuthorSheet):
        * dom/Element.cpp:
        (WebCore::classStringHasClassName):
        (WebCore::collectClasses):
        (WebCore::computeClassChange):

            Factor to return the changed classes.

        (WebCore::invalidateStyleForClassChange):

            First filter out classes that don't show up in stylesheets. If something remains invalidate the current
            element for inline style change (that is a style change that doesn't affect descendants).

            Next check if there are any ancestorClassRules for the changed class. If so use the StyleInvalidationAnalysis
            to find any affected descendants and invalidate them with inline style change as well.

        (WebCore::Element::classAttributeChanged):

            Invalidate for removed classes before setting new attribute value, invalidate for added classes afterwards.

        (WebCore::Element::absoluteLinkURL):
        (WebCore::checkSelectorForClassChange): Deleted.
        * dom/ElementData.h:
        (WebCore::ElementData::setClassNames):
        (WebCore::ElementData::classNames):
        (WebCore::ElementData::classNamesMemoryOffset):
        (WebCore::ElementData::clearClass): Deleted.
        (WebCore::ElementData::setClass): Deleted.

2016-02-10  Myles C. Maxfield  <mmaxfield@apple.com>

        Addressing post-review comments after r196322

        Unreviwed.

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):
        * css/CSSFontFaceSource.h:

2016-02-10  Chris Dumez  <cdumez@apple.com>

        Attributes on the Window instance should be configurable unless [Unforgeable]
        https://bugs.webkit.org/show_bug.cgi?id=153920
        <rdar://problem/24563211>

        Reviewed by Darin Adler.

        Attributes on the Window instance should be configurable unless [Unforgeable]:
        1. 'constructor' property:
           - http://www.w3.org/TR/WebIDL/#interface-prototype-object
        2. Constructor properties (e.g. window.Node):
           - http://www.w3.org/TR/WebIDL/#es-interfaces
        3. IDL attributes:
           - http://heycam.github.io/webidl/#es-attributes (configurable unless
             [Unforgeable], e.g. window.location)

        Firefox complies with the WebIDL specification but WebKit does not for 1. and 3.

        Test: fast/dom/Window/window-properties-configurable.html

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        For known Window properties (i.e. properties in the static property table),
        if we have reified and this is same-origin access, then call
        Base::getOwnPropertySlot() to get the property from the local property
        storage. If we have not reified yet, or this is cross-origin access, query
        the static property table. This is to match the behavior of Firefox and
        Chrome which seem to keep returning the original properties upon cross
        origin access, even if those were deleted or redefined.

        (WebCore::JSDOMWindow::put):
        The previous code used to call the static property setter for properties in
        the static table. However, this does not do the right thing if properties
        were reified. For example, deleting window.name and then trying to set it
        again would not work. Therefore, update this code to only do this if the
        properties have not been reified, similarly to what is done in
        JSObject::putInlineSlow().

        * bindings/scripts/CodeGeneratorJS.pm:
        (ConstructorShouldBeOnInstance):
        Add a FIXME comment indicating that window.constructor should be on
        the prototype as per the Web IDL specification.

        (GenerateAttributesHashTable):
        - Mark 'constructor' property as configurable for Window, as per the
          specification and consistently with other 'constructor' properties:
          http://www.w3.org/TR/WebIDL/#interface-prototype-object
        - Mark properties as configurable even though they are on the instance.
          Window has its properties on the instance as per the specification:
          1. http://heycam.github.io/webidl/#es-attributes
          2. http://heycam.github.io/webidl/#PrimaryGlobal (window is [PrimaryGlobal]
          However, these properties should be configurable as long as they are
          not marked as [Unforgeable], as per 1.

        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestException.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        Rebaseline bindings tests.

2016-02-10  Brady Eidson  <beidson@apple.com>

        Modern IDB: Ref cycle between IDBObjectStore and IDBTransaction.
        https://bugs.webkit.org/show_bug.cgi?id=154061

        Reviewed by Alex Christensen.

        No new tests (Currently untestable).

        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::transitionedToFinishing): Make sure the new state makes sense,
          set the new state, and then clear the set of referenced object stores which is no longer needed.
        (WebCore::IDBClient::IDBTransaction::abort):
        (WebCore::IDBClient::IDBTransaction::commit):
        * Modules/indexeddb/client/IDBTransactionImpl.h:

2016-02-10  Jer Noble  <jer.noble@apple.com>

        REGRESSION(r195770): Use-after-free in ResourceLoaderOptions::cachingPolicy
        https://bugs.webkit.org/show_bug.cgi?id=153727
        <rdar://problem/24429886>

        Reviewed by Darin Adler.

        Follow-up after r195965. Only protect those parts of CachedResource::removeClient() which
        affect the MemoryCache when allowsCaching() is false.

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::removeClient):

2016-02-10  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !(ENABLE(SHADOW_DOM) || ENABLE(DETAILS_ELEMENT)) after r196281
        https://bugs.webkit.org/show_bug.cgi?id=154035

        Reviewed by Antti Koivisto.

        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::Context::Context):

2016-02-09  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Toggle buttons are blurry with GTK+ 3.19
        https://bugs.webkit.org/show_bug.cgi?id=154007

        Reviewed by Michael Catanzaro.

        Use min-width/min-height style properties when GTK+ >= 3.19.7 to
        get the size of toggle buttons.

        * rendering/RenderThemeGtk.cpp:
        (WebCore::setToggleSize):
        (WebCore::paintToggle):

2016-02-09  Aakash Jain  <aakash_jain@apple.com>

        Headers that use WEBCORE_EXPORT should include PlatformExportMacros.h
        https://bugs.webkit.org/show_bug.cgi?id=146984

        Reviewed by Alexey Proskuryakov.

        * Modules/speech/SpeechSynthesis.h:
        * contentextensions/ContentExtensionError.h:
        * dom/DeviceOrientationClient.h:
        * platform/graphics/Color.h:
        * platform/ios/wak/WebCoreThread.h:
        * platform/network/CacheValidation.h:
        * platform/network/cf/CertificateInfo.h:

2016-02-09  Nan Wang  <n_wang@apple.com>

        AX: Implement word related text marker functions using TextIterator
        https://bugs.webkit.org/show_bug.cgi?id=153939
        <rdar://problem/24269605>

        Reviewed by Chris Fleizach.

        Using CharacterOffset to implement word related text marker calls. Reused
        logic from previousBoundary and nextBoundary in VisibleUnits class.

        Test: accessibility/mac/text-marker-word-nav.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::traverseToOffsetInRange):
        (WebCore::AXObjectCache::rangeForNodeContents):
        (WebCore::isReplacedNodeOrBR):
        (WebCore::characterOffsetsInOrder):
        (WebCore::resetNodeAndOffsetForReplacedNode):
        (WebCore::setRangeStartOrEndWithCharacterOffset):
        (WebCore::AXObjectCache::rangeForUnorderedCharacterOffsets):
        (WebCore::AXObjectCache::setTextMarkerDataWithCharacterOffset):
        (WebCore::AXObjectCache::startOrEndCharacterOffsetForRange):
        (WebCore::AXObjectCache::startOrEndTextMarkerDataForRange):
        (WebCore::AXObjectCache::characterOffsetForNodeAndOffset):
        (WebCore::AXObjectCache::textMarkerDataForCharacterOffset):
        (WebCore::AXObjectCache::previousNode):
        (WebCore::AXObjectCache::visiblePositionFromCharacterOffset):
        (WebCore::AXObjectCache::characterOffsetFromVisiblePosition):
        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
        (WebCore::AXObjectCache::nextCharacterOffset):
        (WebCore::AXObjectCache::previousCharacterOffset):
        (WebCore::startWordBoundary):
        (WebCore::endWordBoundary):
        (WebCore::AXObjectCache::startCharacterOffsetOfWord):
        (WebCore::AXObjectCache::endCharacterOffsetOfWord):
        (WebCore::AXObjectCache::previousWordStartCharacterOffset):
        (WebCore::AXObjectCache::nextWordEndCharacterOffset):
        (WebCore::AXObjectCache::leftWordRange):
        (WebCore::AXObjectCache::rightWordRange):
        (WebCore::characterForCharacterOffset):
        (WebCore::AXObjectCache::characterAfter):
        (WebCore::AXObjectCache::characterBefore):
        (WebCore::parentEditingBoundary):
        (WebCore::AXObjectCache::nextWordBoundary):
        (WebCore::AXObjectCache::previousWordBoundary):
        (WebCore::AXObjectCache::rootAXEditableElement):
        * accessibility/AXObjectCache.h:
        (WebCore::AXObjectCache::removeNodeForUse):
        (WebCore::AXObjectCache::isNodeInUse):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper previousTextMarkerForNode:offset:]):
        (-[WebAccessibilityObjectWrapper textMarkerForNode:offset:ignoreStart:]):
        (-[WebAccessibilityObjectWrapper textMarkerForNode:offset:]):
        (textMarkerForCharacterOffset):
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
        * editing/VisibleUnits.cpp:
        (WebCore::rightWordPosition):
        (WebCore::prepend):
        (WebCore::appendRepeatedCharacter):
        (WebCore::suffixLengthForRange):
        (WebCore::prefixLengthForRange):
        (WebCore::backwardSearchForBoundaryWithTextIterator):
        (WebCore::forwardSearchForBoundaryWithTextIterator):
        (WebCore::previousBoundary):
        (WebCore::nextBoundary):
        * editing/VisibleUnits.h:

2016-02-09  Daniel Bates  <dabates@apple.com>

        CSP: Extract helper classes into their own files
        https://bugs.webkit.org/show_bug.cgi?id=154040
        <rdar://problem/24571189>

        Reviewed by Brent Fulgham.

        No functionality was changed. So, no new tests.

        * CMakeLists.txt: Add files ContentSecurityPolicy{DirectiveList, MediaListDirective, Source, SourceList, SourceListDirective}.cpp.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * page/csp/ContentSecurityPolicy.cpp: Clean up #includes. Include header ParsingUtilities.h so that we can remove our own
        variants of skip{Exactly, Until, While}(). Update code as necessary for class renames.
        (WebCore::skipExactly): Deleted; instead use the analogous function in ParsingUtilities.h.
        (WebCore::skipUntil): Deleted; instead use the analogous function in ParsingUtilities.h.
        (WebCore::skipWhile): Deleted; instead use the analogous function in ParsingUtilities.h.
        (WebCore::isSourceListNone): Moved to file ContentSecurityPolicySourceList.cpp.
        (WebCore::CSPSource): Deleted; moved implementation to files ContentSecurityPolicySource.{cpp, h}.
        (WebCore::CSPSourceList): Deleted; moved implementation to files ContentSecurityPolicySourceList.{cpp, h}.
        (WebCore::CSPDirective): Deleted; moved implementation to file ContentSecurityPolicyDirective.h.
        (WebCore::MediaListDirective): Deleted; moved implementation to files ContentSecurityPolicyMediaListDirective.{cpp, h}.
        (WebCore::SourceListDirective): Deleted; moved implementation to files ContentSecurityPolicySourceListDirective.{cpp, h}.
        (WebCore::CSPDirectiveList): Deleted; moved implementation to files ContentSecurityPolicyDirectiveList.{cpp, h}.
        * page/csp/ContentSecurityPolicy.h:
        * page/csp/ContentSecurityPolicyDirective.h: Added.
        * page/csp/ContentSecurityPolicyDirectiveList.cpp: Added; removed use of ternary operator where it made the code less readable.
        Updated code to make use of the functions defined in ParsingUtilities.h.
        (WebCore::isExperimentalDirectiveName): Moved from file ContentSecurityPolicy.cpp.
        (WebCore::isCSPDirectiveName): Ditto.
        (WebCore::isDirectiveNameCharacter): Ditto.
        (WebCore::isDirectiveValueCharacter): Ditto.
        (WebCore::isNotASCIISpace): Ditto.
        * page/csp/ContentSecurityPolicyDirectiveList.h: Added.
        * page/csp/ContentSecurityPolicyMediaListDirective.cpp: Added. Updated code to make use of the functions defined in ParsingUtilities.h.
        (WebCore::isMediaTypeCharacter): Moved from file ContentSecurityPolicy.cpp.
        (WebCore::isNotASCIISpace): Ditto.
        * page/csp/ContentSecurityPolicyMediaListDirective.h: Added.
        * page/csp/ContentSecurityPolicySource.cpp: Added.
        * page/csp/ContentSecurityPolicySource.h: Added.
        * page/csp/ContentSecurityPolicySourceList.cpp: Added. Updated code to make use of the functions defined in ParsingUtilities.h.
        (WebCore::isSourceCharacter): Moved from file ContentSecurityPolicy.cpp.
        (WebCore::isHostCharacter): Ditto.
        (WebCore::isPathComponentCharacter): Ditto.
        (WebCore::isSchemeContinuationCharacter): Ditto.
        (WebCore::isNotColonOrSlash): Ditto.
        (WebCore::isSourceListNone): Ditto.
        * page/csp/ContentSecurityPolicySourceList.h: Added.
        * page/csp/ContentSecurityPolicySourceListDirective.cpp: Added.
        * page/csp/ContentSecurityPolicySourceListDirective.h: Added.

2016-02-09  Brady Eidson  <beidson@apple.com>

        Modern IDB: TransactionOperation objects leak.
        https://bugs.webkit.org/show_bug.cgi?id=154054

        Reviewed by Alex Christensen.

        No new tests (Currently untestable).

        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::abortOnServerAndCancelRequests): Remove the TransactionOperation from
          the map, as this operation doesn't complete "normally" like most others.
        (WebCore::IDBClient::IDBTransaction::commitOnServer): Ditto.
        
        * Modules/indexeddb/client/TransactionOperation.h:
        (WebCore::IDBClient::TransactionOperation::perform): Clear the m_performFunction after use,
          as it holds a lambda that holds a RefPtr to the IDBTransaction, as well as a self-ref.
        (WebCore::IDBClient::TransactionOperation::completed): Clear m_completeFunction for the same reasons.

2016-02-09  Jer Noble  <jer.noble@apple.com>

        [Mac] Graphical corruption in videos when enabling custom loading path
        https://bugs.webkit.org/show_bug.cgi?id=154044

        Reviewed by Alex Christensen.

        The NSOperationQueue provided by AVFoundation from the AVAssetResourceLoader queue is not
        set to be a serial queue. So when adding dataReceived operations to that queue, there exists
        the possibility that some operations are handled before others, and the client will receieve
        data out of order.

        A real NSURLSession object will only issue another operation when the first operation
        completes, so emulate this behavior in WebCoreNSURLSession by using a serial dispatch queue.
        The internal queue will enqueue an operation to the resource loader's queue, and block until
        that operation completes, thus ensuring ordering of the data (and other) operations.

        * platform/network/cocoa/WebCoreNSURLSession.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession initWithResourceLoader:delegate:delegateQueue:]): Initialize _internalQueue
        (-[WebCoreNSURLSession addDelegateOperation:]): Added utility method.
        (-[WebCoreNSURLSession taskCompleted:]): Call -addDelegateOperation:
        (-[WebCoreNSURLSession finishTasksAndInvalidate]): Ditto.
        (-[WebCoreNSURLSession resetWithCompletionHandler:]): Ditto.
        (-[WebCoreNSURLSession flushWithCompletionHandler:]): Ditto.
        (-[WebCoreNSURLSession getTasksWithCompletionHandler:]): Ditto.
        (-[WebCoreNSURLSession getAllTasksWithCompletionHandler:]): Ditto.
        (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]): Ditto.
        (-[WebCoreNSURLSessionDataTask resource:receivedData:length:]): Ditto.
        (-[WebCoreNSURLSessionDataTask resourceFinished:]): Ditto.

        Drive-by fix:
        (-[WebCoreNSURLSessionDataTask resource:receivedData:length:]): Set countOfBytesReceived outside the operation,
            queue, matching NSURLSessionDataTask's behavior.

2016-02-09  Nan Wang  <n_wang@apple.com>

        [iOS Simulator] accessibility/text-marker/text-marker-range-stale-node-crash.html crashing
        https://bugs.webkit.org/show_bug.cgi?id=154039

        Reviewed by Chris Fleizach.

        We are accessing the derefed node in the CharacterOffset object, we should create an empty
        CharacterOffset object if the node is not in use.

        It's covered by the test accessibility/text-marker/text-marker-range-stale-node-crash.html.

        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityTextMarker characterOffset]):
        (-[WebAccessibilityTextMarker isIgnored]):

2016-02-09  Myles C. Maxfield  <mmaxfield@apple.com>

        Unreviewed build fix after r196322

        Unreviewed.

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::font):

2016-02-09  Zalan Bujtas  <zalan@apple.com>

        Outline corners do not align properly for multiline inlines.
        https://bugs.webkit.org/show_bug.cgi?id=154025

        Reviewed by David Hyatt.

        Adjust border position when outline-offset > 0. This patch also
        removes integral pixelsnapping (drawLineForBoxSide takes care of
        device pixelsnapping). 

        Test: fast/inline/outline-corners-with-offset.html

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::paintOutlineForLine):

2016-02-09  Jer Noble  <jer.noble@apple.com>

        [Mac] Adopt NSURLSession properties in AVAssetResourceLoader

        Rubber-stamped by Eric Carlson;

        Set the correct global variable from setAVFoundationNSURLSessionEnabled().

        * page/Settings.cpp:
        (WebCore::Settings::setAVFoundationNSURLSessionEnabled):

2016-02-07  Gavin Barraclough  <barraclough@apple.com>

        GetValueFunc/PutValueFunc should not take both slotBase and thisValue
        https://bugs.webkit.org/show_bug.cgi?id=154009

        Reviewed by Geoff Garen.

        In JavaScript there are two types of properties - regular value properties, and accessor properties.
        One difference between these is how they are reflected by getOwnPropertyDescriptor, and another is
        what object they operate on in the case of a prototype access. If you access a value property of a
        prototype object it return a value pertinent to the prototype, but in the case of a prototype object
        returning an accessor, then the accessor function is applied to the base object of the access.

        JSC supports special 'custom' properties implemented as a c++ callback, and these custom properties
        can be used to implement either value- or accessor-like behavior. getOwnPropertyDescriptor behavior
        is selected via the CustomAccessor attribute. Value- or accessor-like object selection is current
        supported by passing both the slotBase and the thisValue to the callback,and hoping it uses the
        right one. This is probably inefficient, bug-prone, and leads to crazy like JSBoundSlotBaseFunction.

        Instead, just pass one thisValue to the callback functions, consistent with CustomAccessor.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::printErrorMessageForFrame):
        (WebCore::objectToStringFunctionGetter):
        * bindings/js/JSDOMBinding.h:
        (WebCore::propertyNameToString):
        (WebCore::getStaticValueSlotEntryWithoutCaching<JSDOMObject>):
        (WebCore::nonCachingStaticFunctionGetter):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::visitAdditionalChildren):
        (WebCore::childFrameGetter):
        (WebCore::namedItemGetter):
        (WebCore::jsDOMWindowWebKit):
        (WebCore::jsDOMWindowIndexedDB):
            - add missing null check, in case indexDB acessor is applied to non-window object.
        * bindings/js/JSPluginElementFunctions.cpp:
        (WebCore::pluginScriptObject):
        (WebCore::pluginElementPropertyGetter):
        * bindings/js/JSPluginElementFunctions.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        * bridge/runtime_array.cpp:
        (JSC::RuntimeArray::destroy):
        (JSC::RuntimeArray::lengthGetter):
        * bridge/runtime_array.h:
        * bridge/runtime_method.cpp:
        (JSC::RuntimeMethod::finishCreation):
        (JSC::RuntimeMethod::lengthGetter):
        * bridge/runtime_method.h:
        * bridge/runtime_object.cpp:
        (JSC::Bindings::RuntimeObject::invalidate):
        (JSC::Bindings::RuntimeObject::fallbackObjectGetter):
        (JSC::Bindings::RuntimeObject::fieldGetter):
        (JSC::Bindings::RuntimeObject::methodGetter):
        * bridge/runtime_object.h:
            - Merged slotBase & thisValue to custom property callbacks.

2016-02-09  Jer Noble  <jer.noble@apple.com>

        Build-fix; add Nullibility macros around previously un-macro'd class definitions.

        * platform/spi/mac/AVFoundationSPI.h:

2016-02-04  Jer Noble  <jer.noble@apple.com>

        [Mac] Adopt NSURLSession properties in AVAssetResourceLoader
        https://bugs.webkit.org/show_bug.cgi?id=153873

        Reviewed by Eric Carlson.

        Adopt a new AVAssetResourceLoader API allowing clients to specify a NSURLSession object to
        use for media loading, and control the use of this property with a new Setting.

        * page/Settings.cpp:
        (WebCore::Settings::setAVFoundationNSURLSessionEnabled):
        * page/Settings.h:
        (WebCore::Settings::isAVFoundationNSURLSessionEnabled):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL):
        * platform/spi/mac/AVFoundationSPI.h:

2016-02-09  Myles C. Maxfield  <mmaxfield@apple.com>

        Decouple font creation from font loading
        https://bugs.webkit.org/show_bug.cgi?id=153414

        Reviewed by Darin Adler.

        Previously, CSSFontFaceSource never triggered a font download until that font was actually used. This means
        that the function which triggers the download also has the goal of returning a font to use. However,
        the CSS Font Loading JavaScript API requires being able to trigger a font download without this extra font
        creation overhead.

        In addition, this patch adds an explicit (and enforced) state transition diagram. The diagram looks like
        this:
                            => Success
                          //
        Pending => Loading
                          \\
                            => Failure

        Therefore, the API for CSSFontFaceSource has changed to expose the concept of these new states. This means
        that its user (CSSSegmentedFontFaceSource) has been updated to handle each possible state that its constituent
        CSSFontFaceSources may be in.

        No new tests because there is no behavior change.

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::allSourcesFailed): Renamed to make the name clearer.
        (WebCore::CSSFontFace::addedToSegmentedFontFace): Use references instead of pointers.
        (WebCore::CSSFontFace::removedFromSegmentedFontFace): Ditto.
        (WebCore::CSSFontFace::adoptSource): Renamed to make the name clearer.
        (WebCore::CSSFontFace::fontLoaded): Use references instead of pointers. Also, remove old dead code.
        (WebCore::CSSFontFace::font): Adapt to the new API of CSSFontFaceSource.
        (WebCore::CSSFontFace::isValid): Deleted.
        (WebCore::CSSFontFace::addSource): Deleted.
        (WebCore::CSSFontFace::notifyFontLoader): Deleted. Old dead code.
        (WebCore::CSSFontFace::notifyLoadingDone): Deleted. Old dead code.
        * css/CSSFontFace.h:
        (WebCore::CSSFontFace::create): Remove old dead code.
        (WebCore::CSSFontFace::CSSFontFace): Use references instead of pointers.
        (WebCore::CSSFontFace::loadState): Deleted. Remove old dead code.
        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::setStatus): Enforce state transitions.
        (WebCore::CSSFontFaceSource::CSSFontFaceSource): Explicitly handle new state transitions.
        (WebCore::CSSFontFaceSource::fontLoaded): Update for new states.
        (WebCore::CSSFontFaceSource::load): Pulled out code from font().
        (WebCore::CSSFontFaceSource::font): Moved code into load().
        (WebCore::CSSFontFaceSource::isValid): Deleted.
        (WebCore::CSSFontFaceSource::isDecodeError): Deleted.
        (WebCore::CSSFontFaceSource::ensureFontData): Deleted.
        * css/CSSFontFaceSource.h: Much cleaner API.
        * css/CSSFontSelector.cpp:
        (WebCore::createFontFace): Migrate to references instead of pointers. This requires a little
        reorganization.
        (WebCore::registerLocalFontFacesForFamily): Update to new CSSFontFaceSource API.
        (WebCore::CSSFontSelector::addFontFaceRule): Ditto.
        (WebCore::CSSFontSelector::getFontFace): Ditto.
        * css/CSSSegmentedFontFace.cpp:
        (WebCore::CSSSegmentedFontFace::CSSSegmentedFontFace): Migrate to references instead of pointers.
        (WebCore::CSSSegmentedFontFace::~CSSSegmentedFontFace): Ditto.
        (WebCore::CSSSegmentedFontFace::fontLoaded): Remove old dead code.
        (WebCore::CSSSegmentedFontFace::appendFontFace): Cleanup.
        (WebCore::CSSSegmentedFontFace::fontRanges): Adopt to new API.
        (WebCore::CSSSegmentedFontFace::pruneTable): Deleted.
        (WebCore::CSSSegmentedFontFace::isLoading): Deleted. Old dead code.
        (WebCore::CSSSegmentedFontFace::checkFont): Deleted. Ditto.
        (WebCore::CSSSegmentedFontFace::loadFont): Deleted. Ditto.
        * css/CSSSegmentedFontFace.h:
        (WebCore::CSSSegmentedFontFace::create): Migrate to references instead of pointers.
        (WebCore::CSSSegmentedFontFace::fontSelector): Ditto.
        (WebCore::CSSSegmentedFontFace::LoadFontCallback::~LoadFontCallback): Deleted.
        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::didAddClient): Migrate to references instead of pointers.
        (WebCore::CachedFont::checkNotify): Ditto.
        * loader/cache/CachedFontClient.h:
        (WebCore::CachedFontClient::fontLoaded): Ditto.

2016-02-09  Brady Eidson  <beidson@apple.com>

        Modern IDB: IDBOpenDBRequests leak.
        https://bugs.webkit.org/show_bug.cgi?id=154032

        Reviewed by Alex Christensen.

        No new tests (Currently untestable).

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        Add a simple Event subclass that holds a ref to an IDBRequest, to make sure that we
        drop the last ref to the request after its last event fires or is otherwise destroyed:
        * Modules/indexeddb/IDBRequestCompletionEvent.cpp: Added.
        (WebCore::IDBRequestCompletionEvent::IDBRequestCompletionEvent):
        * Modules/indexeddb/IDBRequestCompletionEvent.h: Added.
        (WebCore::IDBRequestCompletionEvent::create):

        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::onError): IDBRequestCompletionEvent instead of Event.
        (WebCore::IDBClient::IDBOpenDBRequest::fireSuccessAfterVersionChangeCommit): Ditto.
        (WebCore::IDBClient::IDBOpenDBRequest::fireErrorAfterVersionChangeCompletion): Ditto.
        (WebCore::IDBClient::IDBOpenDBRequest::onSuccess): Ditto.

        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::dispatchEvent): After setting up the request's 
          completion event to fire, clear the back-ref to the request.

2016-02-09  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196286.
        https://bugs.webkit.org/show_bug.cgi?id=154026

        Looks like 5% iOS PLT regression (Requested by kling on
        #webkit).

        Reverted changeset:

        "[iOS] Throw away some unlinked code when navigating to a new
        page."
        https://bugs.webkit.org/show_bug.cgi?id=154014
        http://trac.webkit.org/changeset/196286

2016-02-08  Chris Dumez  <cdumez@apple.com>

        Attribute getters should not require an explicit 'this' value for Window properties
        https://bugs.webkit.org/show_bug.cgi?id=153968

        Reviewed by Darin Adler.

        Attribute getters should not require an explicit 'this' value for
        Window properties. This is because the Window interface is marked
        as [ImplicitThis]:
        - http://heycam.github.io/webidl/#ImplicitThis
        - https://www.w3.org/Bugs/Public/show_bug.cgi?id=29421

        This matches the behavior of Firefox and the expectations of the W3C
        web-platform-tests.

        No new tests, already covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        In attribute getters of an interface marked as [ImplicitThis],
        if 'thisValue' is undefined or null, fall back to using the
        global object as 'thisValue'.

        * bindings/scripts/IDLAttributes.txt:
        Add support for [ImplicitThis]:
        http://heycam.github.io/webidl/#ImplicitThis

        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        * bindings/scripts/test/JS/JSTestException.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        * bindings/scripts/test/JS/JSTestNode.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/JS/JSattribute.cpp:
        Rebaseline bindings tests.

        * page/DOMWindow.idl:
        Mark Window as [ImplicitThis]:
        http://heycam.github.io/webidl/#ImplicitThis

2016-02-08  Nan Wang  <n_wang@apple.com>

        AX: crash at WebCore::Range::selectNodeContents(WebCore::Node*, int&)
        https://bugs.webkit.org/show_bug.cgi?id=154018

        Reviewed by Chris Fleizach.

        Sometimes rangeForUnorderedCharacterOffsets call is accessing derefed node objects
        and leading to a crash. Fixed it by checking isNodeInUse before creating the CharacterOffset
        object.

        Test: accessibility/text-marker/text-marker-range-stale-node-crash.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):
        (WebCore::AXObjectCache::characterOffsetForTextMarkerData):
        (WebCore::AXObjectCache::traverseToOffsetInRange):
        * accessibility/AXObjectCache.h:
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper rangeForTextMarkerRange:]):
        (characterOffsetForTextMarker):
        (-[WebAccessibilityObjectWrapper characterOffsetForTextMarker:]):
        (textMarkerForVisiblePosition):

2016-02-08  Andreas Kling  <akling@apple.com>

        [iOS] Throw away some unlinked code when navigating to a new page.
        <https://webkit.org/b/154014>

        Reviewed by Gavin Barraclough.

        Extended the mechanism introduced earlier to also throw away unlinked code
        that's only relevant to the page that we're navigating away from.

        The new JSC::VM API is deleteAllCodeExceptCaches() and it does what it sounds
        like, deleting unlinked and linked code but leaving code caches alone.

        This means that if the page we're navigating to wants to parse some of the
        same JS that the page we're leaving had on it, it might still be found in the
        JSC::CodeCache.

        Doing a back navigation to a PageCache'd page may now incur some reparsing,
        just like leaving the app or tab would.

        * bindings/js/GCController.cpp:
        (WebCore::GCController::deleteAllCodeExceptCaches):
        (WebCore::GCController::deleteAllLinkedCode): Deleted.
        * bindings/js/GCController.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):

2016-02-08  Daniel Bates  <dabates@apple.com>

        CSP connect-src directive should block redirects
        https://bugs.webkit.org/show_bug.cgi?id=69359
        <rdar://problem/24383025>

        Reviewed by Brent Fulgham.

        Inspired by Blink patch:
        <https://src.chromium.org/viewvc/blink?revision=150246&view=revision>

        Apply the connect-src directive of the Content Security Policy for the document or worker to the redirect URL
        of an XMLHttpRequest and EventSource load so as to conform to section Paths and Redirects of the CSP 2.0 spec.,
        <https://w3c.github.io/webappsec-csp/2/#source-list-paths-and-redirects> (29 August 2015).

        Additionally, check that each requested script URL passed to WorkerGlobalScope.importScripts() is allowed by
        the CSP of the worker before initiating a load for it. If some URL i is blocked by the CSP policy
        then we do not try to load URLs j >= i.

        Tests: http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports.html
               http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked.html
               http/tests/security/contentSecurityPolicy/worker-csp-blocks-xhr-redirect-cross-origin.html
               http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-allowed.html
               http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked.html
               http/tests/security/contentSecurityPolicy/worker-without-csp-importScripts-redirect-cross-origin-allowed.html
               http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-redirect.html
               http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-importScript-redirect-cross-origin.html
               http/tests/security/isolatedWorld/bypass-main-world-csp-worker-importScripts-redirect-cross-origin.html
               http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr-redirect-cross-origin.html
               http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr.html

        * fileapi/FileReaderLoader.cpp:
        (WebCore::FileReaderLoader::start): Do not enforce a CSP directive as CSP is not applicable to File API.
        * inspector/InspectorNetworkAgent.cpp:
        (WebCore::InspectorNetworkAgent::loadResource): Do not enforce a CSP directive as CSP should not interfere
        with the Web Inspector.
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Modified to take an optional ContentSecurityPolicy
        and pass it through to DocumentThreadableLoader::create().
        (WebCore::DocumentThreadableLoader::create): Modified to take an optional ContentSecurityPolicy and pass it through
        to DocumentThreadableLoader::DocumentThreadableLoader().
        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Modified to take an optional ContentSecurityPolicy.
        Asserts that the CSP allows the load of the request URL so as to catch when a caller creates a loader for a request
        that is not allowed by the CSP. The caller should not create a loader for such a request.
        (WebCore::DocumentThreadableLoader::redirectReceived): Check if the CSP allows the redirect URL. If it does not
        then notify the client that the redirect check failed.
        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
        (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy): Checks that the specified URL is allowed
        by the enforced CSP directive.
        (WebCore::DocumentThreadableLoader::contentSecurityPolicy): Returns the ContentSecurityPolicy object passed to
        DocumentThreadableLoader on instantiation or the ContentSecurityPolicy object of the associated document.
        * loader/DocumentThreadableLoader.h: Add overloaded variants of DocumentThreadableLoader::{create, loadResourceSynchronously}()
        that take a std::unique_ptr<ContentSecurityPolicy>&&. Remove some unnecessary headers.
        * loader/ThreadableLoader.cpp:
        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Take the CSP directive to enforce and store it.
        (WebCore::ThreadableLoaderOptions::isolatedCopy): Copy the CSP directive to enforce.
        * loader/ThreadableLoader.h: Added member field to store the CSP directive to enforce (defaults to enforce the
        directive connect-src - the most appropriate directive in most circumstances). As of the time of writing,
        only WorkerGlobalScope.importScripts() enforces a different directive: script-src.
        * loader/WorkerThreadableLoader.cpp:
        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader): Pass the SecurityOrigin and ContentSecurityPolicy associated
        with the WorkerGlobalScope to WorkerThreadableLoader::MainThreadBridge::MainThreadBridge().
        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Pass a copy of the worker's ContentSecurityPolicy
        to the DocumentThreadableLoader.
        * loader/WorkerThreadableLoader.h:
        * page/EventSource.cpp:
        (WebCore::EventSource::connect): Enforce the CSP directive connect-src on redirects unless we are running in an isolated world.
        * workers/AbstractWorker.cpp:
        (WebCore::AbstractWorker::resolveURL): Modified to take a boolean whether to bypass the main world Content Security Policy
        instead of querying for it directly.
        * workers/AbstractWorker.h:
        * workers/Worker.cpp:
        (WebCore::Worker::create): Added FIXME to enforce child-src directive of the document's CSP to the worker's script URL
        on redirect once we fix <https://bugs.webkit.org/show_bug.cgi?id=153562>. For now, do not enforce a CSP policy on redirect
        of the worker's script URL.
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::importScripts): Check that the requested URL is allowed by the CSP of the worker (if applicable).
        Enforce the CSP directive script-src on redirects unless we are running in an isolated world.
        * workers/WorkerScriptLoader.cpp:
        (WebCore::WorkerScriptLoader::loadSynchronously): Pass SecurityOrigin and ContentSecurityPolicyEnforcement to WorkerThreadableLoader.
        (WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.
        * workers/WorkerScriptLoader.h:
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::createRequest): Enforce the CSP directive connect-src on redirects unless we are running in
        an isolated world.

2016-02-08  Antti Koivisto  <antti@apple.com>

        Try to fix Yosemite build.

        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::ComposedTreeIterator):
        (WebCore::ComposedTreeIterator::traverseNext):

2016-02-08  Antti Koivisto  <antti@apple.com>

        Implement ComposedTreeIterator in terms of ElementAndTextDescendantIterator
        https://bugs.webkit.org/show_bug.cgi?id=154003

        Reviewed by Darin Adler.

        Currently ComposedTreeIterator implements tree traversal using NodeTraversal. This makes it overly complicated.
        It can also return nodes other than Element and Text which should not be part of the composed tree.

        This patch adds a new iterator type, ElementAndTextDescendantIterator, similar to the existing ElementDescendantIterator.
        ComposedTreeIterator is then implemented using this new iterator.

        When entering a shadow tree or a slot the local iterator is pushed along with the context stack and a new local
        iterator is initialized for the new context. When leaving a shadow tree the context stack is popped and the previous
        local iterator becomes active.

        * WebCore.xcodeproj/project.pbxproj:
        * dom/ComposedTreeIterator.cpp:
        (WebCore::ComposedTreeIterator::ComposedTreeIterator):
        (WebCore::ComposedTreeIterator::initializeContextStack):
        (WebCore::ComposedTreeIterator::pushContext):
        (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
        (WebCore::ComposedTreeIterator::traverseNextLeavingContext):
        (WebCore::ComposedTreeIterator::advanceInSlot):
        (WebCore::ComposedTreeIterator::traverseSiblingInSlot):
        (WebCore::ComposedTreeIterator::initializeShadowStack): Deleted.
        (WebCore::ComposedTreeIterator::traverseParentInShadowTree): Deleted.
        (WebCore::ComposedTreeIterator::traverseNextSiblingSlot): Deleted.
        (WebCore::ComposedTreeIterator::traversePreviousSiblingSlot): Deleted.
        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::operator*):
        (WebCore::ComposedTreeIterator::operator->):
        (WebCore::ComposedTreeIterator::operator==):
        (WebCore::ComposedTreeIterator::operator!=):
        (WebCore::ComposedTreeIterator::operator++):
        (WebCore::ComposedTreeIterator::Context::Context):
        (WebCore::ComposedTreeIterator::context):
        (WebCore::ComposedTreeIterator::current):
        (WebCore::ComposedTreeIterator::ComposedTreeIterator):
        (WebCore::ComposedTreeIterator::traverseNext):
        (WebCore::ComposedTreeIterator::traverseNextSkippingChildren):
        (WebCore::ComposedTreeIterator::traverseNextSibling):
        (WebCore::ComposedTreeIterator::traversePreviousSibling):
        (WebCore::ComposedTreeDescendantAdapter::ComposedTreeDescendantAdapter):
        (WebCore::ComposedTreeDescendantAdapter::begin):
        (WebCore::ComposedTreeDescendantAdapter::end):
        (WebCore::ComposedTreeDescendantAdapter::at):
        (WebCore::ComposedTreeChildAdapter::Iterator::Iterator):
        (WebCore::ComposedTreeChildAdapter::ComposedTreeChildAdapter):
        (WebCore::ComposedTreeChildAdapter::begin):
        (WebCore::ComposedTreeChildAdapter::end):
        (WebCore::ComposedTreeChildAdapter::at):
        (WebCore::ComposedTreeIterator::ShadowContext::ShadowContext): Deleted.
        (WebCore::ComposedTreeIterator::traverseParent): Deleted.
        * dom/ElementAndTextDescendantIterator.h: Added.

            New iterator type that traverses Element and Text nodes (that is renderable nodes only).
            It also tracks depth for future use.

2016-02-08  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: copy({x:1}) should copy "{x:1}", not "[object Object]"
        https://bugs.webkit.org/show_bug.cgi?id=148605

        Reviewed by Brian Burg.

        Test: inspector/console/command-line-api-copy.html

        * inspector/CommandLineAPIModuleSource.js:
        (CommandLineAPIImpl.prototype.copy):
        Support copying different types. This is meant to be more
        convenient then just JSON.stringify, so it handles types
        like Node, Symbol, RegExp, and Function a bit better.

2016-02-08  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION(r181345): SVG polyline and polygon leak page
        https://bugs.webkit.org/show_bug.cgi?id=152759

        Reviewed by Darin Adler.

        The leak happens because of cyclic reference between SVGListPropertyTearOff 
        and SVGAnimatedListPropertyTearOff which is derived from SVGAnimatedProperty.
        There is also cyclic reference between SVGAnimatedProperty and SVGElement
        and this causes the whole document to be leaked. So if the JS requests, for
        example, an instance of SVGPolylineElement.points, the whole document will be
        leaked.

        The fix depends on having the cyclic reference as is since the owning and the
        owned classes have to live together if any of them is referenced. But the owning
        class caches a raw 'ref-counted' pointer of the owned class. If it is requested
        for an instance of the owned class it returned a RefPtr<> of it. Once the owned
        class is not used, it can delete itself. The only thing needed here is to notify
        the owner class of the deletion so it cleans its caches and be able to create a
        new pointer if it is requested for an instance of the owned class later.

        Revert the change of r181345 in SVGAnimatedProperty::lookupOrCreateWrapper()
        to break the cyclic reference between SVGElement and SVGAnimatedProperty.
        
        Also apply the same approach in SVGAnimatedListPropertyTearOff::baseVal() and
        animVal() to break cyclic reference between SVGListPropertyTearOff and
        SVGAnimatedListPropertyTearOff.

        Test: svg/animations/smil-leak-list-property-instances.svg

        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): The SVG non-string list tear-off properties became of
        type RefPtr<>. So we need to use get() with the casting expressions.
        
        * svg/SVGMarkerElement.cpp:
        (WebCore::SVGMarkerElement::orientType):
        Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().

        * svg/SVGPathElement.cpp:
        (WebCore::SVGPathElement::pathByteStream):
        (WebCore::SVGPathElement::lookupOrCreateDWrapper):
        Since SVGAnimatedProperty::lookupWrappe() returns a RefPtr<> we need to 
        use get() for the casting expressions.
        
        (WebCore::SVGPathElement::pathSegList):
        (WebCore::SVGPathElement::normalizedPathSegList):
        (WebCore::SVGPathElement::animatedPathSegList):
        (WebCore::SVGPathElement::animatedNormalizedPathSegList):
        * svg/SVGPathElement.h:
        Change the return value from raw pointer to RefPtr<>.

        * svg/SVGPathSegWithContext.h:
        (WebCore::SVGPathSegWithContext::animatedProperty):
        Change the return type to be RefPtr<> to preserve the value from being deleted.
        
        * svg/SVGPolyElement.cpp:
        (WebCore::SVGPolyElement::parseAttribute):
        Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to 
        use get() for the casting expressions.
        
        (WebCore::SVGPolyElement::points):
        (WebCore::SVGPolyElement::animatedPoints):
        * svg/SVGPolyElement.h:
        Change the return value from raw pointer to RefPtr<>.
        
        * svg/SVGViewSpec.cpp:
        (WebCore::SVGViewSpec::setTransformString):
        Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to 
        use get() for the casting expressions.

        (WebCore::SVGViewSpec::transform):
        * svg/SVGViewSpec.h:
        Change the return value from raw pointer to RefPtr<>.
        
        * svg/properties/SVGAnimatedListPropertyTearOff.h:
        (WebCore::SVGAnimatedListPropertyTearOff::baseVal):
        (WebCore::SVGAnimatedListPropertyTearOff::animVal):
        Change the return value from raw pointer to RefPtr<> and change the cached
        value from RefPtr<> to raw pointer. If the property is null, it will be
        created, its raw pointer will be cached and the only ref-counted RefPtr<>
        will be returned. This will guarantee, the RefPtr<> will be deleted once
        it is not used anymore. 
        
        (WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
        Clean the raw pointer caches m_baseVal and m_animVal upon deleting the
        actual pointer. This function will be called from the destructor of
        SVGListPropertyTearOff.
        
        (WebCore::SVGAnimatedListPropertyTearOff::findItem):
        (WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
        We have to ensure the baseVal() is created before using it.
        
        (WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
        (WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
        (WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
        (WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
        (WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
        (WebCore::SVGAnimatedListPropertyTearOff::animValWillChange):
        (WebCore::SVGAnimatedListPropertyTearOff::animValDidChange):
        For animation, a separate RefPtr<> 'm_animatingAnimVal' will be assigned
        to the animVal(). This will prevent deleting m_animVal while animation.
        
        * svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::baseVal):
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::animVal):
        Same as what is done in SVGAnimatedListPropertyTearOff.
        
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::findItem):
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::removeItemFromList):
        Same as what is done in SVGAnimatedListPropertyTearOff.
        
        * svg/properties/SVGAnimatedProperty.h:
        (WebCore::SVGAnimatedProperty::lookupOrCreateWrapper):
        Change the return value from raw reference to Ref<> and change the
        cached value from Ref<> to raw pointer. This reverts the change of
        r181345 in this function.
        
        (WebCore::SVGAnimatedProperty::lookupWrapper):
        Change the return value from raw pointer to RefPtr<>.
        
        * svg/properties/SVGAnimatedPropertyMacros.h:
        Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().
        
        * svg/properties/SVGAnimatedTransformListPropertyTearOff.h:
        (WebCore::SVGAnimatedTransformListPropertyTearOff::baseVal):
        (WebCore::SVGAnimatedTransformListPropertyTearOff::animVal):
        Same as what is done in SVGAnimatedListPropertyTearOff.

        * svg/properties/SVGListPropertyTearOff.h:
        (WebCore::SVGListPropertyTearOff::~SVGListPropertyTearOff):
        Call the SVGAnimatedListPropertyTearOff::propertyWillBeDeleted() to clean
        its raw pointers when the RefPtr<> deletes itself.

2016-02-08  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] WebKitWebView should send crossing events to the WebProcess
        https://bugs.webkit.org/show_bug.cgi?id=153740

        Reviewed by Michael Catanzaro.

        Update the target element under the mouse also when only updating
        scrollbars, so that if the mouse enters the page when the window
        is not active, the scroll animator is notified that the mouse
        entered the scrollable area.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMouseMoveEvent): Call
        updateMouseEventTargetNode() before early returning in case of
        only updating scrollbars.

2016-02-08  Jeremy Jones  <jeremyj@apple.com>

        PiP and external playback are mutually exclusive.
        https://bugs.webkit.org/show_bug.cgi?id=153988
        rdar://problem/24108661

        Reviewed by Eric Carlson.

        Adding isPlayingOnSecondScreen to isPlayingOnExternalScreen allows AVKit to disable PiP
        when appropriate. Testing video fullscreen mode in updateDisableExternalPlayback allows us to 
        turn-off external playback when entering picture-in-picture.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenMode):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateDisableExternalPlayback):
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (-[WebAVPlayerController isPlayingOnExternalScreen]):
        (+[WebAVPlayerController keyPathsForValuesAffectingPlayingOnExternalScreen]):

2016-02-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196253.
        https://bugs.webkit.org/show_bug.cgi?id=153990

        Caused several crashes in GTK+ bots (Requested by KaL on
        #webkit).

        Reverted changeset:

        "[GTK] WebKitWebView should send crossing events to the
        WebProcess"
        https://bugs.webkit.org/show_bug.cgi?id=153740
        http://trac.webkit.org/changeset/196253

2016-02-08  Jeremy Jones  <jeremyj@apple.com>

        WebAVPlayerController should implement currentTimeWithinEndTimes.
        https://bugs.webkit.org/show_bug.cgi?id=153983
        rdar://problem/22864621

        Reviewed by Eric Carlson.

        Implement currentTimeWithinEndTimes in terms of seekToTime and AVTiming. This is a trivial
        implementation becuase AVPlayer start and end times aren't used.

        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (-[WebAVPlayerController currentTimeWithinEndTimes]):
        (-[WebAVPlayerController setCurrentTimeWithinEndTimes:]):
        (+[WebAVPlayerController keyPathsForValuesAffectingCurrentTimeWithinEndTimes]):

2016-02-08  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] WebKitWebView should send crossing events to the WebProcess
        https://bugs.webkit.org/show_bug.cgi?id=153740

        Reviewed by Michael Catanzaro.

        Update the target element under the mouse also when only updating
        scrollbars, so that if the mouse enters the page when the window
        is not active, the scroll animator is notified that the mouse
        entered the scrollable area.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMouseMoveEvent): Call
        updateMouseEventTargetNode() before early returning in case of
        only updating scrollbars.

2016-02-08  Jeremy Jones  <jeremyj@apple.com>

        WebVideoFullscreenInterface should handle video resizing.
        https://bugs.webkit.org/show_bug.cgi?id=153982
        rdar://problem/22031249

        Reviewed by Eric Carlson.

        Video fullscreen can be initiated before video dimension are available.
        Protect against an initial width or height of zero and observe resize events 
        to update once video dimensions become available or change.

        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
        (WebVideoFullscreenModelVideoElement::updateForEventName):
        (WebVideoFullscreenModelVideoElement::observedEventNames):
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (-[WebAVPlayerLayer layoutSublayers]):
        (-[WebAVPlayerLayer videoRect]):
        (WebVideoFullscreenInterfaceAVKit::setVideoDimensions):

2016-02-08  Adrien Plazas  <aplazas@igalia.com>

        Indent inline box test fails due to assertion in VisibleSelection::selectionFromContentsOfNode()
        https://bugs.webkit.org/show_bug.cgi?id=153824

        Reviewed by Michael Catanzaro.

        * editing/markup.cpp:
        (WebCore::highestAncestorToWrapMarkup):

2016-02-07  Sam Weinig  <sam@webkit.org>

        Remove unused enum ScrollbarOverlayState.

        Rubber-stamped by Dan Bernstein.

        * platform/ScrollTypes.h:

2016-02-07  Sam Weinig  <sam@webkit.org>

        Remove unnecessary respondsToSelector checks for methods that exist on all supported platforms
        https://bugs.webkit.org/show_bug.cgi?id=153970

        Reviewed by Dan Bernstein.

        -[NSScrollerImp mouseEnteredScroller], -[NSScrollerImp expansionTransitionProgress],
        -[NSScrollerImpPair contentAreaScrolledInDirection:], and -[NSScrollerImp setExpanded:]
        are now available on all supported OS's. No need to check for them.

        * platform/mac/ScrollAnimatorMac.mm:
        (macScrollbarTheme):
        (-[WebScrollbarPainterDelegate scrollerImp:animateUIStateTransitionWithDuration:]):
        (-[WebScrollbarPainterDelegate scrollerImp:animateExpansionTransitionWithDuration:]):
        (WebCore::ScrollAnimatorMac::mouseEnteredScrollbar):
        (WebCore::ScrollAnimatorMac::mouseExitedScrollbar):
        (WebCore::ScrollAnimatorMac::sendContentAreaScrolled):
        (WebCore::ScrollAnimatorMac::sendContentAreaScrolledTimerFired):
        (supportsUIStateTransitionProgress): Deleted.
        (supportsExpansionTransitionProgress): Deleted.
        (supportsContentAreaScrolledInDirection): Deleted.
        * platform/mac/ScrollbarThemeMac.mm:
        (+[WebScrollbarPrefsObserver appearancePrefsChanged:]):
        (+[WebScrollbarPrefsObserver behaviorPrefsChanged:]):
        (WebCore::ScrollbarThemeMac::scrollbarThickness):

2016-02-07  Sam Weinig  <sam@webkit.org>

        Use modern SPI header idiom for NSScrollerImp and NSScrollerImpPair
        https://bugs.webkit.org/show_bug.cgi?id=153969

        Reviewed by Dan Bernstein.

        * WebCore.xcodeproj/project.pbxproj:
        Add new file NSScrollerImpSPI.h

        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        Use new include of NSScrollerImpSPI.h.

        * platform/ScrollbarThemeComposite.h:
        Define ScrollbarPainter more precisely as NSScrollerImp * now that the type is available to us.

        * platform/mac/NSScrollerImpDetails.h:
        Remove NSObject category based SPI usage with the modern one NSScrollerImpSPI.h

        * platform/mac/NSScrollerImpDetails.mm:
        (WebCore::recommendedScrollerStyle):
        Simplify recommendedScrollerStyle() now that all OS's we ship on have +[NSScroller preferredScrollerStyle].

        * platform/mac/ScrollAnimatorMac.mm:
        (supportsUIStateTransitionProgress):
        (supportsExpansionTransitionProgress):
        (supportsContentAreaScrolledInDirection):
        Stop using NSClassFromString now that we can reference the classes explicitly.

        (-[WebScrollbarPainterControllerDelegate invalidate]):
        (-[WebScrollbarPainterControllerDelegate contentAreaRectForScrollerImpPair:]):
        (-[WebScrollbarPainterControllerDelegate inLiveResizeForScrollerImpPair:]):
        (-[WebScrollbarPainterControllerDelegate mouseLocationInContentAreaForScrollerImpPair:]):
        (-[WebScrollbarPainterControllerDelegate scrollerImpPair:convertContentPoint:toScrollerImp:]):
        (-[WebScrollbarPainterControllerDelegate scrollerImpPair:setContentAreaNeedsDisplayInRect:]):
        (-[WebScrollbarPainterControllerDelegate scrollerImpPair:updateScrollerStyleForNewRecommendedScrollerStyle:]):
        (-[WebScrollbarPainterDelegate layer]):
        (-[WebScrollbarPainterDelegate mouseLocationInScrollerForScrollerImp:]):
        (-[WebScrollbarPainterDelegate convertRectToLayer:]):
        (-[WebScrollbarPainterDelegate shouldUseLayerPerPartForScrollerImp:]):
        (-[WebScrollbarPainterDelegate setUpAlphaAnimation:scrollerPainter:part:animateAlphaTo:duration:]):
        (-[WebScrollbarPainterDelegate scrollerImp:animateKnobAlphaTo:duration:]):
        (-[WebScrollbarPainterDelegate scrollerImp:animateTrackAlphaTo:duration:]):
        (-[WebScrollbarPainterDelegate scrollerImp:animateUIStateTransitionWithDuration:]):
        (-[WebScrollbarPainterDelegate scrollerImp:animateExpansionTransitionWithDuration:]):
        (-[WebScrollbarPainterDelegate scrollerImp:overlayScrollerStateChangedTo:]):
        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
        (WebCore::ScrollAnimatorMac::lockOverlayScrollbarStateToHidden):
        (WebCore::ScrollAnimatorMac::didAddVerticalScrollbar):
        (WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar):
        (WebCore::ScrollAnimatorMac::updateScrollerStyle):
        Add proper conforming to protocols and replace ids with proper types.

        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::supportsExpandedScrollbars):
        (WebCore::ScrollbarThemeMac::registerScrollbar):
        (WebCore::ScrollbarThemeMac::scrollbarThickness):
        (WebCore::ScrollbarThemeMac::setUpContentShadowLayer):
        Stop using NSClassFromString now that we can reference the classes explicitly.

        * platform/spi/mac/NSScrollerImpSPI.h: Added.

2016-02-07  Zalan Bujtas  <zalan@apple.com>

        Outline does not clip when ancestor has overflow: hidden and requires layer.
        https://bugs.webkit.org/show_bug.cgi?id=153901

        Now that outline is part of visual overflow, we no longer need the special outline cliprect.
        PaintPhaseChildOutlines drawing will switch to foreground cliprect. It ensures proper overflow clipping
        at parent level. PaintPhaseSelfOutline drawing will start using the visual overflow inflated background cliprect.
        With this change, outline will be using the same cliprects as the other visual overflow properties (box-shadow etc). 

        Reviewed by David Hyatt.

        Test: fast/repaint/outline-with-overflow-hidden-ancestor.html

        * rendering/LayerFragment.h:
        (WebCore::LayerFragment::setRects):
        (WebCore::LayerFragment::moveBy): Deleted.
        (WebCore::LayerFragment::intersect): Deleted.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::collectFragments):
        (WebCore::RenderLayer::paintOutlineForFragments):
        (WebCore::RenderLayer::calculateClipRects):
        (WebCore::RenderLayer::paintForegroundForFragments): Deleted.
        * rendering/RenderLayer.h:
        * rendering/RenderTreeAsText.cpp:
        (WebCore::write):
        (WebCore::writeLayers):

2016-02-07  Daniel Bates  <dabates@apple.com>

        CSP: Allow Web Workers initiated from an isolated world to bypass the main world Content Security Policy
        https://bugs.webkit.org/show_bug.cgi?id=153622
        <rdar://problem/24400023>

        Reviewed by Gavin Barraclough.

        Fixes an issue where Web Workers initiated from an isolated world (say, a Safari Content Script Extension)
        would be subject to the Content Security Policy of the page.

        Currently code in an isolated world that does not execute in a Web Worker is exempt from the CSP of
        the page. However, code that runs inside a Web Worker that was initiated from an isolated world is
        subject to the CSP of the page. Instead, such Web Worker code should also be exempt from the CSP of
        the page.

        Tests: http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-eval.html
               http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-xhr.html
               http/tests/security/isolatedWorld/bypass-main-world-csp-worker.html

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect): Modified to ask the script execution context whether to bypass the
        main world Content Security Policy now that script execution context knows this information.
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::shouldBypassMainWorldContentSecurityPolicy): Deleted; moved logic from here...
        * bindings/js/ScriptController.h:
        * dom/Document.cpp:
        (WebCore::Document::shouldBypassMainWorldContentSecurityPolicy): ...to here.
        * dom/Document.h:
        * dom/ScriptExecutionContext.h:
        (WebCore::ScriptExecutionContext::shouldBypassMainWorldContentSecurityPolicy): Added; defaults to false -
        do not bypass the main world Content Security Policy.
        * page/EventSource.cpp:
        (WebCore::EventSource::create): Modified to ask the script execution context whether to bypass the
        main world Content Security Policy now that script execution context knows this information.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::shouldBypassMainWorldContentSecurityPolicy): Deleted.
        * page/csp/ContentSecurityPolicy.h:
        * workers/AbstractWorker.cpp:
        (WebCore::AbstractWorker::resolveURL): Bypass the main world Content Security Policy if applicable.
        Added FIXME comment to enforce the child-src directive of the document's CSP (as opposed to the script-src
        directive) on the worker's script URL. Also, scriptExecutionContext()->contentSecurityPolicy() should
        always be non-null just as we expect scriptExecutionContext()->securityOrigin() to be non-null. Assert
        this invariant to catch cases where a ScriptExecutionContext is not properly initialized.
        * workers/DedicatedWorkerGlobalScope.cpp:
        (WebCore::DedicatedWorkerGlobalScope::create): Modified to take boolean argument shouldBypassMainWorldContentSecurityPolicy
        as to whether to bypass the main world Content Security Policy and only apply the Content Security
        Policy headers when shouldBypassMainWorldContentSecurityPolicy is false.
        (WebCore::DedicatedWorkerGlobalScope::DedicatedWorkerGlobalScope): Pass through a boolean argument shouldBypassMainWorldContentSecurityPolicy
        as to whether to bypass the main world Content Security Policy.
        * workers/DedicatedWorkerGlobalScope.h:
        * workers/DedicatedWorkerThread.cpp:
        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread): Ditto.
        (WebCore::DedicatedWorkerThread::createWorkerGlobalScope): Ditto.
        * workers/DedicatedWorkerThread.h:
        * workers/Worker.cpp:
        (WebCore::Worker::create): Store whether we should bypass the main world Content Security Policy so
        that we can pass it to WorkerMessagingProxy::startWorkerGlobalScope() in Worker::notifyFinished().
        We need to store this decision here as opposed to determining it at any later time (say, in Worker::notifyFinished())
        because it is dependent on the current JavaScript program stack at the time this function is invoked.
        (WebCore::Worker::notifyFinished): Pass whether to bypass the main world Content Security Policy.
        * workers/Worker.h:
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::WorkerGlobalScope): Modified to take a boolean as to whether to bypass the
        main world Content Security Policy and store it in a member field. Also, always instantiate a Content
        Security Policy object as our current code assumes that one is always created.
        * workers/WorkerGlobalScope.h:
        * workers/WorkerGlobalScopeProxy.h:
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::startWorkerGlobalScope): Pass through a boolean argument shouldBypassMainWorldContentSecurityPolicy
        as to whether to bypass the main world Content Security Policy.
        * workers/WorkerMessagingProxy.h:
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData): Modified to take a boolean argument as to
        whether to bypass the main world Content Security Policy and store it in a member field.
        (WebCore::WorkerThread::WorkerThread): Pass through a boolean argument shouldBypassMainWorldContentSecurityPolicy
        as to whether to bypass the main world Content Security Policy.
        (WebCore::WorkerThread::workerThread): Ditto.
        * workers/WorkerThread.h:
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::open): Modified to ask the script execution context whether to bypass the
        main world Content Security Policy now that script execution context knows this information.

2016-02-07  Dan Bernstein  <mitz@apple.com>

        [Cocoa] Replace __has_include guards around inclusion of Apple-internal-SDK headers with USE(APPLE_INTERNAL_SDK)
        https://bugs.webkit.org/show_bug.cgi?id=153963

        Reviewed by Sam Weinig.

        * accessibility/mac/AXObjectCacheMac.mm:
        * crypto/CommonCryptoUtilities.cpp:
        * crypto/CommonCryptoUtilities.h:
        * editing/mac/TextUndoInsertionMarkupMac.h:
        * editing/mac/TextUndoInsertionMarkupMac.mm:
        * platform/cocoa/TelephoneNumberDetectorCocoa.cpp:
        * platform/graphics/cg/ImageSourceCG.cpp:
        * platform/graphics/mac/PDFDocumentImageMac.mm:
        * platform/network/ios/NetworkStateNotifierIOS.mm:
        * platform/network/mac/BlobDataFileReferenceMac.mm:
        * platform/network/mac/ResourceHandleMac.mm:
        * rendering/RenderThemeMac.mm:

2016-02-07  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r195661): [GTK] Scrollbar tests crashing after overlay scrollbar groundwork
        https://bugs.webkit.org/show_bug.cgi?id=153695

        Reviewed by Michael Catanzaro.

        The problem is that ScrollAnimation objects are not destroyed by
        the ScrollAnimator destructor, because I forgot to add a virtual
        destructor for ScrollAnimation in r195661.

        * platform/ScrollAnimation.h:
        (WebCore::ScrollAnimation::~ScrollAnimation):

2016-02-06  Chris Dumez  <cdumez@apple.com>

        Prevent cross-origin access to window.history
        https://bugs.webkit.org/show_bug.cgi?id=153931

        Reviewed by Darin Adler.

        Prevent cross-origin access to window.history to match the specification [1]
        and the behavior of other browsers (tested Firefox and Chrome).

        [1] https://html.spec.whatwg.org/multipage/browsers.html#security-window

        No new tests, already covered by existing tests that
        were updated in this patch.

        * bindings/js/JSHistoryCustom.cpp:
        (WebCore::JSHistory::pushState):
        (WebCore::JSHistory::replaceState):
        (WebCore::JSHistory::state): Deleted.
        * page/DOMWindow.idl:
        * page/History.idl:

2016-02-06  Beth Dakin  <bdakin@apple.com>

        ScrollbarPainters needs to be deallocated on the main thread
        https://bugs.webkit.org/show_bug.cgi?id=153932
        -and corresponding-
        rdar://problem/24015483

        Reviewed by Dan Bernstein.

        Darin pointed out that this was still race-y. There was still a race 
        condition between the destruction of the two local variables and the
        destruction of the lambda on the main thread. This should fix that. 
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h:
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::releaseReferencesToScrollbarPaintersOnTheMainThread):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):

2016-02-06  Darin Adler  <darin@apple.com>

        Finish auditing call sites of upper() and lower(), eliminate many, and rename the functions
        https://bugs.webkit.org/show_bug.cgi?id=153905

        Reviewed by Sam Weinig.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::isTypeSupported): Use convertToASCIILowercase on MIME type.

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::selectText): Use new names for lower and upper. Also
        tweaked style a tiny bit and used u_toupper rather than converting an entire
        string to uppercase.

        * dom/Document.cpp:
        (WebCore::Document::addImageElementByCaseFoldedUsemap): Renamed to reflect the use
        of case folding rather than lowercasing.
        (WebCore::Document::removeImageElementByCaseFoldedUsemap): Ditto.
        (WebCore::Document::imageElementByCaseFoldedUsemap): Ditto.
        * dom/Document.h: Ditto.
        * dom/DocumentOrderedMap.cpp:
        (WebCore::DocumentOrderedMap::getElementByCaseFoldedMapName): Ditto.
        (WebCore::DocumentOrderedMap::getElementByCaseFoldedUsemap): Ditto.
        * dom/DocumentOrderedMap.h: Ditto.

        * dom/TreeScope.cpp:
        (WebCore::TreeScope::getImageMap): Removed unneeded special case for null string.
        Simplified logic for cases where the URL does not have a "#" character in it.
        Use case folding instead of lowercase.

        * editing/cocoa/HTMLConverter.mm:
        (HTMLConverter::_processText): Removed unneded special case for the empty string.
        Use makCapitalized instead of Cocoa function for "capitalize". Use upper and lower
        functions by their new names.

        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::parseAttribute): Use case folding instead of
        lowerasing for the usemap attribute.
        (WebCore::HTMLImageElement::insertedInto): Ditto.
        (WebCore::HTMLImageElement::removedFrom): Ditto.
        (WebCore::HTMLImageElement::matchesCaseFoldedUsemap): Ditto.
        * html/HTMLImageElement.h: Rename since usemap is case folded now, not lowercased.

        * html/HTMLMapElement.cpp:
        (WebCore::HTMLMapElement::imageElement): Use case folding instead of lowercasing
        for usemap.
        (WebCore::HTMLMapElement::parseAttribute): Ditto.

        * platform/Language.cpp:
        (WebCore::canonicalLanguageIdentifier): Use convertToASCIILowercase for language code.
        (WebCore::indexOfBestMatchingLanguageInList): Ditto.

        * platform/graphics/harfbuzz/HarfBuzzShaper.cpp:
        (WebCore::HarfBuzzShaper::shapeHarfBuzzRuns): Use new name for the upper function.

        * platform/network/HTTPParsers.cpp:
        (WebCore::parseContentTypeOptionsHeader): Use equalLettersIgnoringASCIICase instead
        of lowercasing to check for a specific header value.

        * platform/network/MIMEHeader.cpp:
        (WebCore::retrieveKeyValuePairs): Use convertToASCIILowercase for MIME header name.
        (WebCore::MIMEHeader::parseContentTransferEncoding): Use equalLettersIgnoringASCIICase
        instead of lowercasing.

        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::allowsAnyHTTPSCertificateHosts): Make this hash ASCII case-insensitive.
        (WebCore::clientCertificates): Ditto.
        (WebCore::ResourceHandle::createCFURLConnection): Remove call to lower since the
        set is now ASCII case-insensitive.
        (WebCore::ResourceHandle::setHostAllowsAnyHTTPSCertificate): Ditto.
        (WebCore::ResourceHandle::setClientCertificate): Ditto.

        * platform/network/curl/CookieJarCurl.cpp:
        (WebCore::getNetscapeCookieFormat): Use equalLettersIgnoringASCIICase instead of
        lowercasing.

        * platform/network/curl/MultipartHandle.cpp:
        (WebCore::MultipartHandle::didReceiveResponse): Use convertToASCIILowercase to
        make a MIME type lowercase.

        * platform/network/curl/ResourceHandleCurl.cpp:
        (WebCore::ResourceHandle::setHostAllowsAnyHTTPSCertificate): Removed unneeded
        conversion to lowercase now that the set is ASCII case-insensitive.
        (WebCore::ResourceHandle::setClientCertificate): Removed code that populates a map
        that is then never used for anything.

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::headerCallback): Use convertToASCIILowercase for MIME type.

        * platform/network/curl/SSLHandle.cpp: Made hash maps keyed by host names
        ASCII case-insensitive.
        (WebCore::addAllowedClientCertificate): Removed lowercasing since the map itself
        is now ASCII case insensitve.
        (WebCore::setSSLClientCertificate): Ditto. Also use auto for iterator type so we
        don't have to write out the map type.
        (WebCore::sslIgnoreHTTPSCertificate): Ditto.
        (WebCore::certVerifyCallback): Ditto.

        * platform/network/soup/ResourceHandleSoup.cpp: Made hash maps keyed by host names
        ASCII case-insensitive.
        (WebCore::allowsAnyHTTPSCertificateHosts): Ditto.
        (WebCore::handleUnignoredTLSErrors): Ditto.
        (WebCore::ResourceHandle::setHostAllowsAnyHTTPSCertificate): Ditto.
        (WebCore::ResourceHandle::setClientCertificate): Ditto.

        * platform/text/LocaleToScriptMappingDefault.cpp: Made hash maps keyed by script
        names ASCII case-insensitive. USE WTF_ARRAY_LENGTH as appropriate.
        (WebCore::scriptNameToCode): Use modern style to initialize the map. Removed
        unnecessary lowercasing of the script name before looking at the map.
        (WebCore::localeToScriptCodeForFontSelection): Ditto.

        * platform/text/win/LocaleWin.cpp:
        (WebCore::convertLocaleNameToLCID): Made map ASCII case-insensitive and removed
        unneeded lowercasing.

        * platform/win/PasteboardWin.cpp:
        (WebCore::clipboardTypeFromMIMEType): Use equalLettersIgnoringASCIICase instead
        of lowercasing.

        * rendering/RenderText.cpp:
        (WebCore::applyTextTransform): Use new names for the upper and lower functions.

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::responseIsXML): Remove unneeded lowercasing, since
        DOMImplementation now has ASCII case-insensitive handling of MIME types.

2016-02-06  Zalan Bujtas  <zalan@apple.com>

        Outline should contribute to visual overflow.
        https://bugs.webkit.org/show_bug.cgi?id=153299

        This patch eliminates the special outline handling (RenderView::setMaximalOutlineSize).
        Now that outline is part of visual overflow, we don't have to inflate the layers to accomodate
        outline borders.
        This patch fixes several focusring related repaint issues. However when both the outline: auto
        and the descendant renderer are composited, we still don't paint properly in certain cases. -not a regression.
        (Also when parent renderer has overflow: hidden repaint does not take outline into account. -regression.)
        It changes column behavior (see TestExpectations) since outline behaves now like any other visual overflow properties.

        Reviewed by David Hyatt.

        Test: fast/repaint/focus-ring-repaint.html
              fast/repaint/focus-ring-repaint-with-negative-offset.html

        * css/html.css: resetting to old behavior.
        (:focus):
        (input:focus, textarea:focus, isindex:focus, keygen:focus, select:focus):
        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::addToLine):
        (WebCore::InlineFlowBox::addOutlineVisualOverflow):
        (WebCore::InlineFlowBox::computeOverflow):
        (WebCore::InlineFlowBox::paint): Deleted.
        * rendering/InlineFlowBox.h:
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeOverflow):
        (WebCore::RenderBlock::outlineStyleForRepaint):
        (WebCore::RenderBlock::paint): Deleted.
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::layoutBlock): Deleted.
        (WebCore::RenderBlockFlow::addFocusRingRectsForInlineChildren): Deleted.
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::addOverflowFromInlineChildren):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::addVisualEffectOverflow):
        (WebCore::RenderBox::applyVisualEffectOverflow):
        (WebCore::RenderBox::clippedOverflowRectForRepaint): Deleted.
        * rendering/RenderBoxModelObject.h:
        * rendering/RenderDetailsMarker.cpp:
        (WebCore::RenderDetailsMarker::paint): Deleted.
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::insertChildInternal):
        (WebCore::RenderElement::styleDidChange):
        (WebCore::RenderElement::repaintAfterLayoutIfNeeded):
        (WebCore::RenderElement::issueRepaintForOutlineAuto):
        (WebCore::RenderElement::updateOutlineAutoAncestor):
        (WebCore::RenderElement::computeMaxOutlineSize): Deleted.
        (WebCore::RenderElement::styleWillChange): Deleted.
        * rendering/RenderElement.h:
        (WebCore::RenderElement::hasContinuation):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::paintOutlineForLine): Deleted.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/RenderLineBoxList.cpp:
        (WebCore::RenderLineBoxList::anyLineIntersectsRect):
        (WebCore::RenderLineBoxList::lineIntersectsDirtyRect):
        (WebCore::RenderLineBoxList::paint):
        (WebCore::isOutlinePhase): Deleted.
        * rendering/RenderLineBoxList.h:
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::computePreferredLogicalWidths):
        * rendering/RenderListMarker.cpp:
        (WebCore::RenderListMarker::paint): Deleted.
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::propagateRepaintToParentWithOutlineAutoIfNeeded): The renderer with outline: auto is responsible for
        painting focusring around the descendants. If we issued repaint only on the descendant when it changes,
        the focusring would not refresh properly. We have to find the ancestor with outline: auto, inflate the repaint rect and
        issue the repaint on the ancestor if we crossed repaint container.
 
        (WebCore::RenderObject::repaintUsingContainer):
        (WebCore::RenderObject::adjustRectForOutlineAndShadow):
        (WebCore::RenderObject::setHasOutlineAutoAncestor):
        (WebCore::RenderObject::adjustRectWithMaximumOutline): Deleted.
        
        * rendering/RenderObject.h: We mark the descendants of outline: auto so that
        when a child renderer changes we can propagate the repaint to the ancestor with outline.

        (WebCore::RenderObject::hasOutlineAutoAncestor):
        (WebCore::RenderObject::RenderObjectRareData::RenderObjectRareData):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::overflowRectForFlowThreadPortion):
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::shouldPaint): Deleted.
        (WebCore::RenderReplaced::clippedOverflowRectForRepaint): Deleted.
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::paint): Deleted.
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::clippedOverflowRectForRepaint): Deleted.
        (WebCore::RenderTableCell::paintCollapsedBorders): Deleted.
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::layout):
        (WebCore::RenderTableRow::clippedOverflowRectForRepaint): Deleted.
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layoutRows):
        (WebCore::RenderTableSection::computeOverflowFromCells): Deleted.
        (WebCore::RenderTableSection::paintObject): Deleted.
        * rendering/RenderTheme.h:
        (WebCore::RenderTheme::platformFocusRingWidth):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::setMaximalOutlineSize): Deleted.
        * rendering/RenderView.h:
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::changeAffectsVisualOverflow):
        (WebCore::RenderStyle::outlineWidth):
        * rendering/style/RenderStyle.h:

2016-02-06  Andreas Kling  <akling@apple.com>

        [iOS] Throw away linked code when navigating to a new page.
        <https://webkit.org/b/153851>

        Reviewed by Gavin Barraclough.

        When navigating to a new page, tell JSC to throw out any linked code it has lying around.
        Linked code is tied to a specific global object, and as we're creating a new one for the
        new page, none of it is useful to us here.

        In the event that the user navigates back, the cost of relinking some code will be far
        lower than the memory cost of keeping all of it around.

        This landed previously but was rolled out due to a Speedometer regression. I've made one
        minor but important change here: only throw away code if we're navigating away from an
        existing history item. Or in other words, don't throw away code for "force peeks" or any
        other navigations that are not traditional top-level main frame navigations.

        * bindings/js/GCController.cpp:
        (WebCore::GCController::deleteAllLinkedCode):
        * bindings/js/GCController.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):

2016-02-06  Konstantin Tokarev  <annulen@yandex.ru>

        Added implementations of AXObjectCache methods for !HAVE(ACCESSIBILITY).
        https://bugs.webkit.org/show_bug.cgi?id=153924

        Reviewed by Andreas Kling.

        No new tests needed.

        * accessibility/AXObjectCache.h:
        (WebCore::AXObjectCache::ariaModalNode): Added stub implementation.
        (WebCore::AXObjectCache::postLiveRegionChangeNotification): Ditto.
        (WebCore::AXObjectCache::rangeForNodeContents): Ditto.
        (WebCore::AXObjectCache::setIsSynchronizingSelection): Ditto.
        (WebCore::AXObjectCache::setTextSelectionIntent): Ditto.
        (WebCore::AXAttributeCacheEnabler::AXAttributeCacheEnabler): Ditto.
        (WebCore::AXAttributeCacheEnabler::~AXAttributeCacheEnabler): Ditto.

2016-02-04  Antti Koivisto  <antti@apple.com>

        Use scope stack instead of nested TreeResolvers for shadow trees
        https://bugs.webkit.org/show_bug.cgi?id=153893

        Reviewed by Andreas Kling.

        Make TreeResolver per-document. This is a step towards iterative style resolve.

        This is done replacing use of nested TreeResolvers with a scope stack that maintains
        the style resolver and the selector filter for the current tree scope.

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::ensurePlaceholderStyle):
        (WebCore::Style::TreeResolver::Scope::Scope):
        (WebCore::Style::TreeResolver::TreeResolver):
        (WebCore::Style::shouldCreateRenderer):
        (WebCore::Style::TreeResolver::styleForElement):
        (WebCore::Style::TreeResolver::createRenderTreeForShadowRoot):
        (WebCore::Style::TreeResolver::createRenderTreeForSlotAssignees):
        (WebCore::Style::TreeResolver::createRenderTreeRecursively):
        (WebCore::Style::TreeResolver::resolveLocally):
        (WebCore::Style::TreeResolver::resolveShadowTree):
        (WebCore::Style::TreeResolver::resolveBeforeOrAfterPseudoElement):
        (WebCore::Style::TreeResolver::resolveChildren):
        (WebCore::Style::TreeResolver::resolveSlotAssignees):
        (WebCore::Style::TreeResolver::resolveRecursively):
        (WebCore::Style::TreeResolver::resolve):
        (WebCore::Style::detachRenderTree):
        * style/StyleTreeResolver.h:
        (WebCore::Style::TreeResolver::scope):
        (WebCore::Style::TreeResolver::pushScope):
        (WebCore::Style::TreeResolver::pushEnclosingScope):
        (WebCore::Style::TreeResolver::popScope):

2016-02-06  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196104.
        https://bugs.webkit.org/show_bug.cgi?id=153940

        Regressed Speedometer on iOS (Requested by kling on #webkit).

        Reverted changeset:

        "[iOS] Throw away linked code when navigating to a new page."
        https://bugs.webkit.org/show_bug.cgi?id=153851
        http://trac.webkit.org/changeset/196104

2016-02-05  Beth Dakin  <bdakin@apple.com>

        ScrollbarPainters needs to be deallocated on the main thread
        https://bugs.webkit.org/show_bug.cgi?id=153932
        -and corresponding-
        rdar://problem/24015483

        Reviewed by Geoff Garen.

        Follow-up fix since the first one was still race-y.
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):

2016-02-05  Beth Dakin  <bdakin@apple.com>

        ScrollbarPainters needs to be deallocated on the main thread
        https://bugs.webkit.org/show_bug.cgi?id=153932
        -and corresponding-
        rdar://problem/24015483

        Reviewed by Tim Horton.

        Ensure the the destructor of ScrollingTreeFrameScrollingNodeMac and the 
        assignments done in this class are not responsible for deallocating the 
        ScrollbarPainter. 
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):

2016-02-05  Chris Dumez  <cdumez@apple.com>

        Instance property getters / setters cannot be called on another instance of the same type
        https://bugs.webkit.org/show_bug.cgi?id=153895

        Reviewed by Gavin Barraclough.

        It should be possible to call instance property getters / setters on
        other instances of the same type, as per the WEB IDL specification:
        - http://heycam.github.io/webidl/#dfn-attribute-getter
        - http://heycam.github.io/webidl/#dfn-attribute-setter

        This matches the behavior of Firefox.

        The issue without our bindings was that the getters / setters were
        using |slotBase| instead of |thisValue| and therefore ended up using
        the instance the getter was taken from instead of the actual target
        object.

        Test:
        js/instance-property-getter-other-instance.html
        js/instance-property-setter-other-instance.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        - Have instance getters / setters use thisValue instead of slotBase.
        - In the case of interfaces that have attributes on the instance for
          compatibility reasons, try the prototype object if |thisValue| does
          does have the right type, instead of using slotBase like previously.
          I believe this maintains the original compatibility intention while
          also behaving correctly when called on another instance.

        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        * bindings/scripts/test/JS/JSTestException.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        * bindings/scripts/test/JS/JSTestNode.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/JS/JSattribute.cpp:
        Rebaseline bindings tests.

2016-02-05  Brady Eidson  <beidson@apple.com>

        Modern IDB: UniqueIDBDatabase's m_databaseInfo is unsafely used from multiple threads.
        https://bugs.webkit.org/show_bug.cgi?id=153912

        Reviewed by Alex Christensen.

        No new tests (Anything testable about this patch is already covered by existing tests).

        * Modules/indexeddb/server/IDBBackingStore.h:

        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::infoForObjectStore):
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:

        Teach the SQLiteIDBBackingStore to actually keep its m_databaseInfo up to date as it changes,
        and to revert it when version change transactions abort:
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::beginTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::abortTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::commitTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::infoForObjectStore):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd): Use the IDBBackingStore's copy of the 
          IDBObjectStoreInfo, meant only for the database thread, instead of the UniqueIDBDatabase's copy, 
          which is meant only for the main thread.

2016-02-05  Alex Christensen  <achristensen@webkit.org>

        Clean up Blob code
        https://bugs.webkit.org/show_bug.cgi?id=153910

        Reviewed by Alexey Proskuryakov.

        No new tests, no change in behavior.

        * css/StyleSheet.h:
        * fileapi/Blob.cpp:
        (WebCore::Blob::Blob):
        (WebCore::Blob::normalizedContentType):
        (WebCore::Blob::isNormalizedContentType):
        (WebCore::Blob::registry):
        * fileapi/Blob.h:
        * fileapi/BlobURL.cpp:
        (WebCore::BlobURL::createPublicURL):
        * fileapi/BlobURL.h:
        (WebCore::BlobURL::BlobURL):
        (WebCore::BlobURL::blobProtocol): Deleted.
        * platform/PlatformStrategies.cpp:
        (WebCore::setPlatformStrategies):
        (WebCore::hasPlatformStrategies): Deleted.
        * platform/PlatformStrategies.h:
        * platform/network/BlobRegistry.cpp:
        (WebCore::blobRegistry):
        * platform/network/BlobRegistry.h:
        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::~BlobRegistryImpl):
        (WebCore::createResourceHandle):
        (WebCore::registerBlobResourceHandleConstructor):
        (WebCore::BlobRegistryImpl::createResourceHandle):
        (WebCore::BlobRegistryImpl::appendStorageItems):
        (WebCore::BlobRegistryImpl::registerFileBlobURL):
        (WebCore::BlobRegistryImpl::registerBlobURL):
        * platform/network/BlobRegistryImpl.h:
        * platform/network/BlobResourceHandle.cpp:
        (WebCore::BlobResourceHandle::loadResourceSynchronously):
        (WebCore::BlobResourceHandle::BlobResourceHandle):
        * platform/network/ResourceHandle.h:

2016-02-05  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Scrollbars incorrectly rendered with older versions of GTK+
        https://bugs.webkit.org/show_bug.cgi?id=153861

        Reviewed by Michael Catanzaro.

        The theme doesn't really know it's a scrollbar. Older versions of
        GTK+ require to explicitly add the scrollbar style class to the
        child GtkStyleContext.

        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::createChildStyleContext):

2016-02-05  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Scrollbars not correctly rendered in non GNOME environments
        https://bugs.webkit.org/show_bug.cgi?id=153860

        Reviewed by Michael Catanzaro.

        I noticed this in a matchbox environment, where there's no
        gnome-setting-daemon running. The problem is only with the
        scrollbars, because we initialize the GtkSettings in
        RenderThemeGtk and notify the ScrollbarTheme when it changes, but
        ScrollbarTheme is created before RenderThemeGtk so we initialize
        the theme properties before the GtkSettings have been
        initialized. We can just let the ScrollbarTheme monitor the
        theme itself instead of relying on being notified by the WebCore
        layer.

        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::themeChangedCallback):
        (WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk):
        * rendering/RenderThemeGtk.cpp:
        (WebCore::gtkStyleChangedCallback): Deleted.

2016-02-05  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove DOMWrapped parameter from JSKeyValueIterator
        https://bugs.webkit.org/show_bug.cgi?id=153859

        Reviewed by Sam Weinig.

        No change in behavior.

        Using std::declval to infer DOMWrapped from JSWrapper::wrapped.

        * bindings/js/JSFetchHeadersCustom.cpp:
        (WebCore::JSFetchHeaders::entries):
        (WebCore::JSFetchHeaders::keys):
        (WebCore::JSFetchHeaders::values):
        * bindings/js/JSKeyValueIterator.h:
        (WebCore::createIterator):
        (WebCore::JSKeyValueIterator<JSWrapper>::destroy):
        (WebCore::JSKeyValueIterator<JSWrapper>::next):
        (WebCore::JSKeyValueIteratorPrototypeFunctionNext):
        (WebCore::JSKeyValueIteratorPrototype<JSWrapper>::finishCreation):

2016-02-05  Nan Wang  <n_wang@apple.com>

        AX: WebKit hanging when VoiceOver attempts to focus in on page
        https://bugs.webkit.org/show_bug.cgi?id=153899
        <rdar://problem/24506603>

        Reviewed by Chris Fleizach.

        The VisiblePosition to CharacterOffset conversion will lead to an infinite loop if the
        nextVisiblePostion call is returning the original VisiblePosition. Fixed it by breaking out
        of the loop early in that situation. 

        Test: accessibility/text-marker/character-offset-visible-position-conversion-hang.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::characterOffsetFromVisiblePosition):

2016-02-04  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: InspectorTimelineAgent doesn't need to recompile functions because it now uses the sampling profiler
        https://bugs.webkit.org/show_bug.cgi?id=153500
        <rdar://problem/24352458>

        Reviewed by Timothy Hatcher.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::supportsLegacyProfiling):
        (WebCore::JSDOMWindowBase::supportsRichSourceInfo):
        (WebCore::JSDOMWindowBase::supportsProfiling): Deleted.
        * bindings/js/JSDOMWindowBase.h:
        * bindings/js/JSWorkerGlobalScopeBase.cpp:
        (WebCore::JSWorkerGlobalScopeBase::supportsLegacyProfiling):
        (WebCore::JSWorkerGlobalScopeBase::supportsProfiling): Deleted.
        * bindings/js/JSWorkerGlobalScopeBase.h:
        * inspector/InspectorController.h:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::legacyProfilerEnabled):
        (WebCore::InspectorController::setLegacyProfilerEnabled):
        Be more explicit about enabling legacy profiling.

        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::willDestroyFrontendAndBackend):
        (WebCore::InspectorTimelineAgent::didCreateFrontendAndBackend): Deleted.
        TimelineAgent doesn't need to recompile if using the sampling profiler.
        This breaks console.profile, but console.profile should move to using
        the sampling profiler as well.

        (WebCore::InspectorTimelineAgent::startFromConsole):
        (WebCore::InspectorTimelineAgent::stopFromConsole):
        (WebCore::startProfiling): Deleted.
        (WebCore::stopProfiling): Deleted.
        Inlined the use once static functions.

        * page/PageConsoleClient.cpp:
        (WebCore::PageConsoleClient::profile):
        (WebCore::PageConsoleClient::profileEnd):
        Added FIXMEs for improving console.profile and profileEnd.

        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::setLegacyJavaScriptProfilingEnabled):
        (WebCore::Internals::setJavaScriptProfilingEnabled): Deleted.
        * testing/Internals.h:
        * testing/Internals.idl:
        Be more explicit about enabling legacy profiling.

2016-02-04  Brent Fulgham  <bfulgham@apple.com>

        Follow-up: Add "WebKit built-in PDF" Plugin to set of publicly visible plugins
        https://bugs.webkit.org/show_bug.cgi?id=153657
        <rdar://problem/24413107>

        Reviewed by Darin Adler.

        * plugins/PluginData.cpp:
        (WebCore::shouldBePubliclyVisible): Revise comments to provide a
        better explanation of the function and why it exists.

2016-02-04  Jonathan Davis  <jond@apple.com>

        Add Fetch API and CSS Variables to feature status
        https://bugs.webkit.org/show_bug.cgi?id=153896

        Reviewed by Timothy Hatcher.

        * features.json:

2016-02-04  Daniel Bates  <dabates@apple.com>

        WebKit for iOS Simulator fails to build with public iOS SDK
        https://bugs.webkit.org/show_bug.cgi?id=153881

        Reviewed by Alex Christensen.

        Make constants have internal linkage to match the Apple Internal SDK.

        * platform/spi/ios/MobileGestaltSPI.h:

2016-02-04  Chris Dumez  <cdumez@apple.com>

        Object.getOwnPropertyDescriptor() returns incomplete descriptor for instance properties
        https://bugs.webkit.org/show_bug.cgi?id=153817

        Reviewed by Geoffrey Garen.

        Update the bindings generator so that property getters / setters now
        make sure |this| has the right type and throw a TypeError if it does
        not, as per:
        - http://heycam.github.io/webidl/#dfn-attribute-getter (step 2.4.2)
        - http://heycam.github.io/webidl/#dfn-attribute-setter (step 3.5)

        This was an issue when doing something like:
        Object.getOwnPropertyDescriptor(window, "location").get.call(nonWindow)

        We would call toJSDOMWindow(thisValue), which would return null as
        thisValue is not a JSDOMWindow. We would then dereference this null
        pointer and crash. We now do a null check and throw a TypeError in
        this case, as per the Web IDL specification.

        The generated bindings still have some non-spec compliant behavior
        though:
        1. The getters / setters of instance properties use slotBase instead
           of thisValue, which means that calling instanceA's getter on
           instanceB returns instanceA's property insteas of instanceB's.
        2. Global object property getters should not require an explicit
           |this| so calling the following should work:
           - Object.getOwnPropertyDescriptor(window, "location").get.call()
           We currently throw in this case.

        These issues will be addressed in follow-up patches.

        Tests: js/getOwnPropertyDescriptor-unforgeable-attributes.html
               js/getOwnPropertyDescriptor-window-attributes.html
               js/instance-property-getter-other-instance.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::jsTestActiveDOMObjectExcitingAttr):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::jsTestExceptionName):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjConstructorTestSubObj):
        (WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
        (WebCore::jsTestObjConditionalAttr4Constructor):
        (WebCore::jsTestObjConditionalAttr5Constructor):
        (WebCore::jsTestObjConditionalAttr6Constructor):
        (WebCore::jsTestObjContentDocument):
        (WebCore::setJSTestObjTestSubObjEnabledBySettingConstructor):
        (WebCore::setJSTestObjConditionalAttr4Constructor):
        (WebCore::setJSTestObjConditionalAttr5Constructor):
        (WebCore::setJSTestObjConditionalAttr6Constructor):
        (WebCore::setJSTestObjConstructor): Deleted.
        (WebCore::setJSTestObjConstructorStaticStringAttr): Deleted.
        (WebCore::setJSTestObjConditionalAttr3): Deleted.
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::jsTestTypedefsConstructorTestSubObj):

2016-02-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: LayoutTest imported/w3c/indexeddb/keyorder-private.html is flaky.
        https://bugs.webkit.org/show_bug.cgi?id=153438.

        Reviewed by Alex Christensen.

        Tests: storage/indexeddb/modern/idbkey-array-equality-private.html
               storage/indexeddb/modern/idbkey-array-equality.html

        * Modules/indexeddb/IDBKeyData.cpp:
        (WebCore::IDBKeyData::loggingString):
        (WebCore::IDBKeyData::operator==): Fix obvious bug.

2016-02-04  Chris Dumez  <cdumez@apple.com>

        Unreviewed, fix the EFL clean build after r196123
        https://bugs.webkit.org/show_bug.cgi?id=153875

        * CMakeLists.txt:
        * PlatformGTK.cmake:
        * PlatformMac.cmake:
        * html/DOMSettableTokenList.h:
        * html/DOMSettableTokenList.idl:

2016-02-04  Eric Carlson  <eric.carlson@apple.com>

        PageGroup::captionPreferences should return a reference
        https://bugs.webkit.org/show_bug.cgi?id=153877
        <rdar://problem/24506917>

        Reviewed by Jer Noble.

        No new tests, no functional change.

        * Modules/mediacontrols/MediaControlsHost.cpp:
        (WebCore::MediaControlsHost::sortedTrackListForMenu):
        (WebCore::MediaControlsHost::displayNameForTrack):
        (WebCore::MediaControlsHost::captionMenuOffItem):
        (WebCore::MediaControlsHost::captionDisplayMode):
        * dom/Document.cpp:
        (WebCore::Document::registerForCaptionPreferencesChangedCallbacks):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::addTextTrack):
        (WebCore::HTMLMediaElement::configureTextTrackGroup):
        (WebCore::HTMLMediaElement::setSelectedTextTrack):
        (WebCore::HTMLMediaElement::configureTextTracks):
        (WebCore::HTMLMediaElement::captionPreferencesChanged):
        (WebCore::HTMLMediaElement::mediaPlayerPreferredAudioCharacteristics):
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlClosedCaptionsTrackListElement::updateDisplay):
        (WebCore::MediaControlClosedCaptionsTrackListElement::rebuildTrackListMenu):
        (WebCore::MediaControlTextTrackContainerElement::updateActiveCuesFontSize):
        * page/PageGroup.cpp:
        (WebCore::PageGroup::captionPreferencesChanged):
        (WebCore::PageGroup::captionPreferences):
        * page/PageGroup.h:
        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
        (WebVideoFullscreenModelVideoElement::updateLegibleOptions):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setShouldDisplayTrackKind):
        (WebCore::InternalSettings::shouldDisplayTrackKind):
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::Internals):
        (WebCore::Internals::userPreferredAudioCharacteristics):
        (WebCore::Internals::setUserPreferredAudioCharacteristic):
        (WebCore::Internals::captionsStyleSheetOverride):
        (WebCore::Internals::setCaptionsStyleSheetOverride):
        (WebCore::Internals::setPrimaryAudioTrackLanguageOverride):
        (WebCore::Internals::setCaptionDisplayMode):

2016-02-04  Konstantin Tokarev  <annulen@yandex.ru>

        Removed unused Settings::setPrivateBrowsingEnabled.
        https://bugs.webkit.org/show_bug.cgi?id=153869

        Reviewed by Alexey Proskuryakov.

        Implementation of Settings::setPrivateBrowsingEnabled was removed
        in r166661, but declaration is still here.

        No new tests needed.

        * page/Settings.h:
        (WebCore::Settings::setPrivateBrowsingEnabled): Deleted.

2016-02-04  Eric Carlson  <eric.carlson@apple.com>

        Don't discard in-band cues with negative start times
        https://bugs.webkit.org/show_bug.cgi?id=153867
        <rdar://problem/19588632>

        Reviewed by Jer Noble.

        No new tests, updated and un-skipped http/tests/media/track-in-band-hls-metadata.html.

        * platform/graphics/avfoundation/InbandMetadataTextTrackPrivateAVF.cpp:
        (WebCore::InbandMetadataTextTrackPrivateAVF::addDataCue):  ASSERT if passed negative time value.
        (WebCore::InbandMetadataTextTrackPrivateAVF::updatePendingCueEndTimes): Ditto. Correct logging.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::processCue): ASSERT if passed negative time value.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::metadataDidArrive): Convert negative cue times to zero.
        (-[WebCoreAVFMovieObserver legibleOutput:didOutputAttributedStrings:nativeSampleBuffers:forItemTime:]):
          Ditto.

2016-02-04  Hyemi Shin  <hyemi.sin@samsung.com>

        Specify an exception for createChannelMerger, createChannelSplitter and createPeriodicWave
        https://bugs.webkit.org/show_bug.cgi?id=150925

        Reviewed by Darin Adler.

        createChannelMerger and createChannelSplitter should throw INDEX_SIZE_ERR
        for invalid numberOfInputs value.
        createPeriodicWave should throw INDEX_SIZE_ERR for invalid lengths of parameters.

        Tests: webaudio/audiochannelmerger-basic.html
               webaudio/audiochannelsplitter.html
               webaudio/periodicwave-lengths.html

        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::createChannelSplitter):
        (WebCore::AudioContext::createChannelMerger):
        (WebCore::AudioContext::createPeriodicWave):

2016-02-04  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Add support for iterating over Headers
        https://bugs.webkit.org/show_bug.cgi?id=153787

        Reviewed by Darin Adler.

        Relanding, updating bindings/js/JSKeyValueIterator.h for Windows bots.

        Covered by updated tests.
        Introducing template class (JSKeyValueIterator) to support key-value iterators in DOM classes.
        Using JSKeyValueIterator to implement Headers entries(), keys() and values() as custom methods.
        Binding generator should be updated to generate directly these custom methods and handle iterator Symbol.

        * CMakeLists.txt:
        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::FetchHeaders::Iterator::next):
        (WebCore::FetchHeaders::Iterator::Iterator):
        * Modules/fetch/FetchHeaders.h:
        (WebCore::FetchHeaders::createIterator):
        * Modules/fetch/FetchHeaders.idl:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSDOMBinding.h:
        (WebCore::jsPair):
        * bindings/js/JSFetchHeadersCustom.cpp: Added.
        (WebCore::JSFetchHeaders::entries):
        (WebCore::JSFetchHeaders::keys):
        (WebCore::JSFetchHeaders::values):
        * bindings/js/JSKeyValueIterator.h: Added.
        (WebCore::JSKeyValueIteratorPrototype::create):
        (WebCore::JSKeyValueIteratorPrototype::createStructure):
        (WebCore::JSKeyValueIteratorPrototype::JSKeyValueIteratorPrototype):
        (WebCore::createIterator):
        (WebCore::DOMWrapped>::destroy):
        (WebCore::DOMWrapped>::next):
        (WebCore::DOMWrapped>::finishCreation):

2016-02-04  Chris Dumez  <cdumez@apple.com>

        Merge DOMTokenList and DOMSettableTokenList
        https://bugs.webkit.org/show_bug.cgi?id=153677
        <rdar://problem/24419675>

        Reviewed by Sam Weinig.

        Merge DOMTokenList and DOMSettableTokenList, as per a recent
        specification change:
        - https://github.com/whatwg/dom/pull/120
        - https://github.com/whatwg/html/issues/361

        No new tests, already covered by existing tests.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Element.idl:
        * dom/Node.h:
        * dom/NodeRareData.h:
        * html/AttributeDOMTokenList.h:
        * html/DOMSettableTokenList.cpp: Removed.
        * html/DOMSettableTokenList.h:
        * html/DOMSettableTokenList.idl:
        * html/DOMTokenList.cpp:
        (WebCore::DOMTokenList::setValue):
        * html/DOMTokenList.h:
        * html/DOMTokenList.idl:
        * html/HTMLAnchorElement.idl:
        * html/HTMLAreaElement.idl:
        * html/HTMLElement.cpp:
        * html/HTMLElement.idl:
        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::sandbox):
        * html/HTMLIFrameElement.h:
        * html/HTMLIFrameElement.idl:
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::sizes):
        * html/HTMLLinkElement.h:
        * html/HTMLLinkElement.idl:
        * html/HTMLOutputElement.cpp:
        (WebCore::HTMLOutputElement::htmlFor):
        * html/HTMLOutputElement.h:
        * html/HTMLOutputElement.idl:
        * html/HTMLTableCellElement.idl:
        * page/DOMWindow.cpp:
        * page/DOMWindow.idl:

2016-02-04  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Unreviewed.
        Reverting r196115 and r19116, related tohttps://bugs.webkit.org/show_bug.cgi?id=153787.

2016-02-04  Alejandro G. Castro  <alex@igalia.com>

        [GTK] Implement mediastream mediaplayer
        https://bugs.webkit.org/show_bug.cgi?id=153541

        Reviewed by Martin Robinson.

        Added the implementation of the mediaplayer for the
        mediastream. The code was implemented by Philippe Normand and
        Alessandro Decina.

        * PlatformGTK.cmake: Added the file to the compilation.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setSrcObject): Set the src of the
        media element to the mediastream.
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::buildMediaEnginesVector): Register the mediastream
        mediaplayer as an option in the media engines vector.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.cpp: Added.
        (WebCore::MediaPlayerPrivateGStreamerOwr::MediaPlayerPrivateGStreamerOwr):
        (WebCore::MediaPlayerPrivateGStreamerOwr::~MediaPlayerPrivateGStreamerOwr):
        (WebCore::MediaPlayerPrivateGStreamerOwr::play):
        (WebCore::MediaPlayerPrivateGStreamerOwr::pause):
        (WebCore::MediaPlayerPrivateGStreamerOwr::hasVideo):
        (WebCore::MediaPlayerPrivateGStreamerOwr::hasAudio):
        (WebCore::MediaPlayerPrivateGStreamerOwr::currentTime):
        (WebCore::MediaPlayerPrivateGStreamerOwr::load):
        (WebCore::MediaPlayerPrivateGStreamerOwr::loadingFailed):
        (WebCore::MediaPlayerPrivateGStreamerOwr::didLoadingProgress):
        (WebCore::MediaPlayerPrivateGStreamerOwr::internalLoad):
        (WebCore::MediaPlayerPrivateGStreamerOwr::stop):
        (WebCore::MediaPlayerPrivateGStreamerOwr::registerMediaEngine):
        (WebCore::MediaPlayerPrivateGStreamerOwr::getSupportedTypes):
        (WebCore::MediaPlayerPrivateGStreamerOwr::supportsType):
        (WebCore::MediaPlayerPrivateGStreamerOwr::isAvailable):
        (WebCore::MediaPlayerPrivateGStreamerOwr::createGSTAudioSinkBin):
        (WebCore::MediaPlayerPrivateGStreamerOwr::sourceStopped):
        (WebCore::MediaPlayerPrivateGStreamerOwr::sourceMutedChanged):
        (WebCore::MediaPlayerPrivateGStreamerOwr::sourceSettingsChanged):
        (WebCore::MediaPlayerPrivateGStreamerOwr::preventSourceFromStopping):
        (WebCore::MediaPlayerPrivateGStreamerOwr::createVideoSink):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.h: Added.
        (WebCore::MediaPlayerPrivateGStreamerOwr::engineDescription):
        (WebCore::MediaPlayerPrivateGStreamerOwr::load):
        (WebCore::MediaPlayerPrivateGStreamerOwr::cancelLoad):
        (WebCore::MediaPlayerPrivateGStreamerOwr::prepareToPlay):
        (WebCore::MediaPlayerPrivateGStreamerOwr::duration):
        (WebCore::MediaPlayerPrivateGStreamerOwr::seek):
        (WebCore::MediaPlayerPrivateGStreamerOwr::seeking):
        (WebCore::MediaPlayerPrivateGStreamerOwr::setRate):
        (WebCore::MediaPlayerPrivateGStreamerOwr::setPreservesPitch):
        (WebCore::MediaPlayerPrivateGStreamerOwr::paused):
        (WebCore::MediaPlayerPrivateGStreamerOwr::hasClosedCaptions):
        (WebCore::MediaPlayerPrivateGStreamerOwr::setClosedCaptionsVisible):
        (WebCore::MediaPlayerPrivateGStreamerOwr::maxTimeSeekable):
        (WebCore::MediaPlayerPrivateGStreamerOwr::buffered):
        (WebCore::MediaPlayerPrivateGStreamerOwr::totalBytes):
        (WebCore::MediaPlayerPrivateGStreamerOwr::bytesLoaded):
        (WebCore::MediaPlayerPrivateGStreamerOwr::canLoadPoster):
        (WebCore::MediaPlayerPrivateGStreamerOwr::setPoster):
        (WebCore::MediaPlayerPrivateGStreamerOwr::isLiveStream):
        (WebCore::MediaPlayerPrivateGStreamerOwr::audioSink):

2016-02-04  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Add support for iterating over Headers
        https://bugs.webkit.org/show_bug.cgi?id=153787

        Reviewed by Darin Adler.

        Covered by updated tests.
        Introducing template class (JSKeyValueIterator) to support key-value iterators in DOM classes.
        Using JSKeyValueIterator to implement Headers entries(), keys() and values() as custom methods.
        Binding generator should be updated to generate directly these custom methods and handle iterator Symbol.

        * CMakeLists.txt:
        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::FetchHeaders::Iterator::next):
        (WebCore::FetchHeaders::Iterator::Iterator):
        * Modules/fetch/FetchHeaders.h:
        (WebCore::FetchHeaders::createIterator):
        * Modules/fetch/FetchHeaders.idl:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSDOMBinding.h:
        (WebCore::jsPair):
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSFetchHeadersCustom.cpp: Added.
        (WebCore::JSFetchHeaders::entries):
        (WebCore::JSFetchHeaders::keys):
        (WebCore::JSFetchHeaders::values):
        * bindings/js/JSKeyValueIterator.h: Added.
        (WebCore::JSKeyValueIteratorPrototype::create):
        (WebCore::JSKeyValueIteratorPrototype::createStructure):
        (WebCore::JSKeyValueIteratorPrototype::JSKeyValueIteratorPrototype):
        (WebCore::JSKeyValueIteratorPrototypeFuncNext):

2016-02-03  Carlos Garcia Campos  <cgarcia@igalia.com>

        Do not show context menu when right clicking on a scrollbar
        https://bugs.webkit.org/show_bug.cgi?id=153493

        Reviewed by Michael Catanzaro.

        Scrollbars don't currently handle right clicks, but we are showing
        the context menu when they are right clicked. This is not desired
        at least in GTK+ and I've checked that it isn't consistent with
        other applications in Mac either.

        Test: fast/events/contextmenu-on-scrollbars.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::sendContextMenuEvent):

2016-02-03  Andreas Kling  <akling@apple.com>

        [iOS] Throw away linked code when navigating to a new page.
        <https://webkit.org/b/153851>

        Reviewed by Gavin Barraclough.

        When navigating to a new page, tell JSC to throw out any linked code it has lying around.
        Linked code is tied to a specific global object, and as we're creating a new one for the
        new page, none of it is useful to us here.
        In the event that the user navigates back, the cost of relinking some code will be far
        lower than the memory cost of keeping all of it around.

        * bindings/js/GCController.cpp:
        (WebCore::GCController::deleteAllLinkedCode):
        * bindings/js/GCController.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):

2016-02-03  Alex Christensen  <achristensen@webkit.org>

        Report wasBlocked and cannotShowURL errors when using NetworkSession
        https://bugs.webkit.org/show_bug.cgi?id=153846

        Reviewed by Antti Koivisto.

        No new tests, but this fixes http/tests/xmlhttprequest/redirect-cross-origin-2.html
        when using NetworkSession.

        * platform/URL.h:
        WEBCORE_EXPORT because we are using portAllowed in WebKit2 now.

2016-02-03  Jer Noble  <jer.noble@apple.com>

        iOS build fix after Yosemite build fix broke iOS build.

        * platform/network/cocoa/WebCoreNSURLSession.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:

2016-02-03  Beth Dakin  <bdakin@apple.com>

        Accepted candidates should not be autocorrected
        https://bugs.webkit.org/show_bug.cgi?id=153813
        -and corresponding-
        rdar://problem/24066924

        Reviewed by Darin Adler.

        New document marker to mark inserted candidates. This was we can treat 
        inserted candidates just like a RejectedCorrection and we won’t accidentally 
        autocorrect them later on.
        * dom/DocumentMarker.h:
        (WebCore::DocumentMarker::AllMarkers::AllMarkers):
        * editing/AlternativeTextController.cpp:
        (WebCore::AlternativeTextController::processMarkersOnTextToBeReplacedByResult):

        When handling an acceptant candidate, set m_isHandlingAcceptedCandidate to
        true while the text is being inserted, and then mark the range as an accepted 
        candidate.
        * editing/Editor.cpp:
        (WebCore::Editor::handleAcceptedCandidate):
        * editing/Editor.h:
        (WebCore::Editor::isHandlingAcceptedCandidate):

        If frame.editor. isHandlingAcceptedCandidate() then return early from 
        markMisspellingsAfterTyping.
        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::markMisspellingsAfterTyping):

        Add some test infrastructure. 
        * testing/Internals.cpp:
        (WebCore::Internals::handleAcceptedCandidate):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-02-03  Jer Noble  <jer.noble@apple.com>

        [Win] Pass entire request (rather than just URL) to clients of WebCoreAVCFResourceLoader
        https://bugs.webkit.org/show_bug.cgi?id=153653

        Reviewed by Brent Fulgham.

        This will allow those clients to see the byte-range request ("Range:") header and respond
        appropriately.

        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
        (WebCore::WebCoreAVCFResourceLoader::startLoading):

2016-02-03  Jer Noble  <jer.noble@apple.com>

        Yosemite build fix; hide the entire WebCoreNSURLSessionDataTask class from Yosemite and prior.

        * platform/network/cocoa/WebCoreNSURLSession.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSessionDataTask initWithSession:identifier:URL:]):
        (-[WebCoreNSURLSessionDataTask initWithSession:identifier:request:]):

2016-02-03  Jer Noble  <jer.noble@apple.com>

        [EME][Mac] MediaKeys.createSession() fails with initData containing a contentId whose length is > 1/2 the initData.
        https://bugs.webkit.org/show_bug.cgi?id=153517
        <rdar://problem/24303782>

        Reviewed by Eric Carlson.

        The length of contentId is given in bytes, not Uint16 characters. Use the former when extracting
        the contentId string from the initData.

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::extractKeyURIKeyIDAndCertificateFromInitData):

2016-02-03  Jer Noble  <jer.noble@apple.com>

        [Mac] Wrap a resource and resource loader in a NSURLSession-like object for use by lower level frameworks
        https://bugs.webkit.org/show_bug.cgi?id=153669

        Reviewed by Alex Christensen.

        API Test: WebCore.WebCoreNSURLSession

        Add a NSURLSession-like object, which wraps a CachedResourceLoader and CachedRawResource, which we can
        hand to lower-level frameworks, so that network loads by those frameworks use WebKit's loader.

        * platform/network/cocoa/WebCoreNSURLSession.h: Added.
        * platform/network/cocoa/WebCoreNSURLSession.mm: Added.
        (-[WebCoreNSURLSession initWithResourceLoader:delegate:delegateQueue:]):
        (-[WebCoreNSURLSession dealloc]):
        (-[WebCoreNSURLSession copyWithZone:]):
        (-[WebCoreNSURLSession delegateQueue]):
        (-[WebCoreNSURLSession configuration]):
        (-[WebCoreNSURLSession loader]):
        (-[WebCoreNSURLSession finishTasksAndInvalidate]):
        (-[WebCoreNSURLSession invalidateAndCancel]):
        (-[WebCoreNSURLSession resetWithCompletionHandler:]):
        (-[WebCoreNSURLSession flushWithCompletionHandler:]):
        (-[WebCoreNSURLSession getTasksWithCompletionHandler:]):
        (-[WebCoreNSURLSession getAllTasksWithCompletionHandler:]):
        (-[WebCoreNSURLSession dataTaskWithRequest:]):
        (-[WebCoreNSURLSession dataTaskWithURL:]):
        (-[WebCoreNSURLSession uploadTaskWithRequest:fromFile:]):
        (-[WebCoreNSURLSession uploadTaskWithRequest:fromData:]):
        (-[WebCoreNSURLSession uploadTaskWithStreamedRequest:]):
        (-[WebCoreNSURLSession downloadTaskWithRequest:]):
        (-[WebCoreNSURLSession downloadTaskWithURL:]):
        (-[WebCoreNSURLSession downloadTaskWithResumeData:]):
        (-[WebCoreNSURLSession streamTaskWithHostName:port:]):
        (-[WebCoreNSURLSession streamTaskWithNetService:]):
        (-[WebCoreNSURLSession isKindOfClass:]):

        Add a C++ class which can act as a CachedRawResourceClient, passing the results back to a WebCoreNSURLSessionDataTask:

        (WebCore::WebCoreNSURLSessionDataTaskClient::WebCoreNSURLSessionDataTaskClient):
        (WebCore::WebCoreNSURLSessionDataTaskClient::dataSent):
        (WebCore::WebCoreNSURLSessionDataTaskClient::responseReceived):
        (WebCore::WebCoreNSURLSessionDataTaskClient::dataReceived):
        (WebCore::WebCoreNSURLSessionDataTaskClient::redirectReceived):
        (WebCore::WebCoreNSURLSessionDataTaskClient::notifyFinished):

        Add a NSURLSessionDataTask-like object, which takes a request, then uses it to create and wrap a CachedRawResource.
        Becase NSURSessionDataTask is intended to be used off-main-thread, care must be taken to dispatch back to the main-
        (or web-) thread before calling CachedRawResource functions.

        (-[WebCoreNSURLSessionDataTask initWithSession:identifier:URL:]):
        (-[WebCoreNSURLSessionDataTask initWithSession:identifier:request:]):
        (-[WebCoreNSURLSessionDataTask copyWithZone:]):
        (-[WebCoreNSURLSessionDataTask _restart]):
        (-[WebCoreNSURLSessionDataTask _cancel]):
        (-[WebCoreNSURLSessionDataTask _finish]):
        (-[WebCoreNSURLSessionDataTask _setDefersLoading:]):
        (-[WebCoreNSURLSessionDataTask cancel]):
        (-[WebCoreNSURLSessionDataTask suspend]):
        (-[WebCoreNSURLSessionDataTask resume]):
        (-[WebCoreNSURLSessionDataTask _timingData]):
        (-[WebCoreNSURLSessionDataTask resource:sentBytes:totalBytesToBeSent:]):
        (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]):
        (-[WebCoreNSURLSessionDataTask resource:receivedData:length:]):
        (-[WebCoreNSURLSessionDataTask resource:receivedRedirect:request:]):
        (-[WebCoreNSURLSessionDataTask resourceFinished:]):
        * WebCore.xcodeproj/project.pbxproj: Add new files to project.

2016-02-03  Darin Adler  <darin@apple.com>

        Convert another batch of String::lower callsites to something better, typically convertToASCIILowercase
        https://bugs.webkit.org/show_bug.cgi?id=153789

        Reviewed by Sam Weinig.

        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::isXMLMIMEType): Use equalLettersIgnoringASCIICase
        and the boolean argument to endsWith to ignore ASCII case.
        (WebCore::DOMImplementation::isTextMIMEType): Ditto. Also simplified the logic
        by removing an if statement.

        * dom/Document.cpp:
        (WebCore::isSeparator): Deleted. Moved to WindowFeatures.cpp.
        (WebCore::processArguments): Ditto.
        (WebCore::Document::processViewport): Call the processFeaturesString function
        from WindowFeatures.h; the code here was originally just a pasted copy of that code!
        (WebCore::Document::processFormatDetection): Ditto.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::toEncodingMimeType): Remove now-unneeded
        lowercasing of MIME type before calling isSupportedImageMIMETypeForEncoding,
        since the MIME type registry now ignores ASCII case. Use convertToASCIILowercase
        on the return value, to preserve behavior.
        (WebCore::HTMLCanvasElement::toDataURL): Minor coding style tweaks.

        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::parseAttribute): Use convertToASCIILowercase for
        the service type here.

        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::bestFitSourceFromPictureElement): Remove now-unneeded
        lowercasing since MIME type registry now ignores ASCII case. And use
        equalLettersIgnoringASCIICase for the case here.

        * html/HTMLInputElement.cpp:
        (WebCore::parseAcceptAttribute): Use convertToASCIILowercase for the type here.

        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::parseAttribute): Use convertToASCIILowercase for the
        media value here.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::canPlayType): Use convertToASCIILowercase for the
        content type here.
        (WebCore::HTMLMediaElement::selectNextSourceChild): Ditto.

        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::parseAttribute): Use convertToASCIILowercase for
        the service type here.

        * html/HTMLTrackElement.cpp:
        (WebCore::HTMLTrackElement::parseAttribute): Use convertToASCIILowercase for
        the kind here.
        (WebCore::HTMLTrackElement::ensureTrack): Ditto. Also use fastGetAttribute
        since this is neither the style attribute nor an animatable SVG attribute.

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::createCaseMap): Use convertToASCIILowercase for the local names here.

        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::patchNode): Use containsIgnoringASCIICase instead
        of combining lower with find == notFound here.
        (WebCore::nodeName): Use convertToASCIILowercase here.

        * inspector/InspectorOverlay.cpp:
        (WebCore::buildObjectForElementData): Use convertToASCIILowercase for node
        name here.

        * inspector/InspectorPageAgent.cpp:
        (WebCore::createXHRTextDecoder): Remove a now-unneeded call to lower since
        DOMImplementation::isXMLMIMEType now ignores ASCII case.

        * inspector/InspectorStyleSheet.cpp:
        (WebCore::lowercasePropertyName): Use convertToASCIILowercase for property
        names here. Also use startsWith rather than a hand-written alternative.
        (WebCore::InspectorStyle::populateAllProperties): Use the return value of
        the add function to avoid doing a double hash table lookp.
        (WebCore::InspectorStyle::styleWithProperties): Use convertToASCIILowercase
        to lowercase the property name.

        * inspector/NetworkResourcesData.cpp:
        (WebCore::createOtherResourceTextDecoder): Remove unneeded call to lower since
        DOMImplement::isXMLMIMEType now ignores ASCII case.

        * loader/CrossOriginAccessControl.cpp:
        (WebCore::createAccessControlPreflightRequest): Use convertToASCIILowercase
        to lowercase the access control request header field value.

        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::mimeType): Use convertToASCIILowercase on the content type.

        * page/CaptionUserPreferencesMediaAF.cpp:
        (WebCore::languageIdentifier): Use convertToASCIILowercase on the language code.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::open): Call parseWindowFeatures instead of using the
        constructor for WindowFeatures.
        (WebCore::DOMWindow::showModalDialog): Call parseDialogFeatures instead of
        using the constructor for WindowFeatures.

        * page/EventHandler.cpp:
        (WebCore::findDropZone): Remove unneeded lowercasing and empty string checking,
        and use the option SpaceSplitString already has to convert to lowercase.
        (WebCore::EventHandler::handleAccessKey): Remove unneeded call to lower since
        getElementByAccessKey now ignores case. Also tweaked coding style a bit.

        * page/OriginAccessEntry.cpp:
        (WebCore::OriginAccessEntry::OriginAccessEntry): Use convertToASCIILowercase
        on the protocol and host.
        (WebCore::OriginAccessEntry::matchesOrigin): Ditto.

        * page/SecurityOrigin.cpp:
        (WebCore::shouldTreatAsUniqueOrigin): Remove unneeded call to lower since
        SchemeRegistry now ignores ASCII case.
        (WebCore::SecurityOrigin::SecurityOrigin): Use convertToASCIILowercase on
        the protocol and host.
        (WebCore::SecurityOrigin::setDomainFromDOM): Use convertToASCIILowercase on
        the domain.
        (WebCore::SecurityOrigin::canDisplay): Remove call to lower since SchemeRegistry
        now ignores ASCII case and because this now uses equalIgnoringASCIICase in
        one place that used to use exact matching.

        * page/WindowFeatures.cpp: Refactored so this is now some helper functions
        plus a struct rather than a class.
        (WebCore::isSeparator): Renamed this and removed special handling for NUL.
        (WebCore::parseWindowFeatures): Moved the code that was formerly in the
        WindowFeatures constructor in here. Refactored the parsing into the
        processFeaturesString function, shared with the functions in Document that
        do the same kind of parsing. Removed the code that converts the entire string
        to lowercase before parsing.
        (WebCore::processFeaturesString): Moved the improved version of this function
        here from Document.cpp; more efficient because it doesn't allocate strings.
        (WebCore::setWindowFeature): Changed to be a function private to this file
        with internal linkage. Use equalLettersIgnoringASCIICase so we no longer
        rely on converting the string to lowercase before parsing.
        (WebCore::parseDialogFeatures): Similar refactoring, but also changed all
        the default handling to use Optional<> instead of default values.
        (WebCore::boolFeature): Changed to use option and to ignore ASCII case.
        (WebCore::floatFeature): Ditto.
        (WebCore::parseDialogFeaturesMap): Removed the calls to lower, which are
        not needed any more.

        * page/WindowFeatures.h: Added default values for all the data members,
        and removed all the functions from the WindowFeatures struct. Added the two
        functions for parsing window and dialog features. Also added the
        processFeaturesString function so we can share it with Document.cpp.

        * platform/SchemeRegistry.cpp:
        (WebCore::SchemeRegistry::removeURLSchemeRegisteredAsLocal): Use
        equalLettersIgnoringASCIICase to ignore ASCII case.

        * platform/efl/MIMETypeRegistryEfl.cpp:
        (WebCore::MIMETypeRegistry::getMIMETypeForExtension): Use a modern for loop,
        and equalIgnoringASCIICase rather than calling lower.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::load): Use convertToASCIILowercase on MIME type and
        key system.
        (WebCore::MediaPlayer::generateKeyRequest): Ditto.
        (WebCore::MediaPlayer::addKey): Ditto.
        (WebCore::MediaPlayer::cancelKeyRequest): Ditto.

        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
        (WebCore::Extensions3DOpenGLCommon::Extensions3DOpenGLCommon): Use
        convertToASCIILowercase on vendor string.

        * platform/gtk/MIMETypeRegistryGtk.cpp:
        (WebCore::MIMETypeRegistry::getMIMETypeForExtension): Use a modern for loop,
        and equalIgnoringASCIICase rather than calling lower.

        * platform/mac/PasteboardMac.mm:
        (WebCore::cocoaTypeFromHTMLClipboardType): Use convertToASCIILowercase
        on the type. Also did a bit of renaming and tweaking the logic.

2016-02-03  Dave Hyatt  <hyatt@apple.com>

        Implement hanging-punctuation property parsing.
        https://bugs.webkit.org/show_bug.cgi?id=18109.

        Reviewed by Zalan Bujtas.

        Added parsing test in fast/css.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::renderEmphasisPositionFlagsToCSSValue):
        (WebCore::hangingPunctuationToCSSValue):
        (WebCore::fillRepeatToCSSValue):
        (WebCore::ComputedStyleExtractor::propertyValue):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseTextIndent):
        (WebCore::CSSParser::parseHangingPunctuation):
        (WebCore::CSSParser::parseLineBoxContain):
        * css/CSSParser.h:
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator HangingPunctuation):
        (WebCore::CSSPrimitiveValue::operator LineBreak):
        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertRegionBreakInside):
        (WebCore::StyleBuilderConverter::convertHangingPunctuation):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::changeRequiresLayout):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:
        (WebCore::operator| ):
        (WebCore::operator|= ):
        * rendering/style/StyleRareInheritedData.cpp:
        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
        (WebCore::StyleRareInheritedData::operator==):
        * rendering/style/StyleRareInheritedData.h:

2016-02-03  Jessie Berlin  <jberlin@webkit.org>

        Build fix.

        [NSEvent context] has always returned nil. Replace uses with nullptr.

        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::sendFakeEventsAfterWidgetTracking):

2016-02-03  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Layout Test http/tests/appcache/different-https-origin-resource-main.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=145253

        Reviewed by Michael Catanzaro.

        The problem is that when the load is cancelled while the
        connection is still being established,
        SoupMessage::notify::tls-errors is emitted and the handler calls
        ResourceHandleClient::didFail() which can delete the ResourceHandle.

        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::tlsErrorsChangedCallback): Protect the ResourceHandle
        for the scope of the callback because
        ResourceHandleClient::didFail() could delete the object.

2016-02-03  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r191948): [GStreamer] 4 new timeouts on layout tests.
        https://bugs.webkit.org/show_bug.cgi?id=152797

        Reviewed by Darin Adler.

        Always schedule messages to the main thread, even when the bus
        sync handlder was called in the main thread. It seems that
        GStreamer expects things to happen in the next main loop
        iteration.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):

2016-02-03  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] CompositingCoordinator should store the overlay layer, flush it as appropriate
        https://bugs.webkit.org/show_bug.cgi?id=152058

        Reviewed by Michael Catanzaro.

        Previously, the CompositingCoordinator only added the overlay layer to the
        layer tree, but flushing its compositing state is also required. For that to
        happen, CompositingCoordinator has to store a pointer to the overlay layer
        object and flush it in ::flushPendingLayerChanges().

        Overlay layers are most prominently used by the Web Inspector to highlight
        the DOM elements on the Web page that are being hovered in the inspector.

        * platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:
        (WebCore::CompositingCoordinator::CompositingCoordinator):
        (WebCore::CompositingCoordinator::setRootCompositingLayer):
        (WebCore::CompositingCoordinator::flushPendingLayerChanges):
        * platform/graphics/texmap/coordinated/CompositingCoordinator.h:

2016-02-03  Zan Dobersek  <zdobersek@igalia.com>

        [CoordinatedGraphics] CompositingCoordinator destructor is scheduling layer flushes
        https://bugs.webkit.org/show_bug.cgi?id=153823

        Reviewed by Carlos Garcia Campos.

        Purging the backing stores during the CompositingCoordinator destructor
        is also scheduling layer flushes in the object's client, which is an object
        of the LayerTreeHost-deriving class that owns the CompositingCoordinator
        object in question and is also being destroyed.

        In case of ThreadedCoordinatedLayerTreeHost, this scheduling can access
        the RunLoop::Timer object which has already been destroyed, causing a
        crash. Another problem with this is that we're invoking a virtual function
        on an object that's being destructed, which works well enough in this case
        but should be discouraged in general.

        In order to avoid this, add the m_isDestructing boolean to the
        CompositingCoordinator class, flip it to true during the destruction,
        and check for its falseness before scheduling a layer flush.

        * platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:
        (WebCore::CompositingCoordinator::CompositingCoordinator):
        (WebCore::CompositingCoordinator::~CompositingCoordinator):
        (WebCore::CompositingCoordinator::notifyFlushRequired):
        * platform/graphics/texmap/coordinated/CompositingCoordinator.h:

2016-02-03  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] Don't use RELEASE_ASSERT in TextureMapperLayer::computeTransformsRecursive()
        https://bugs.webkit.org/show_bug.cgi?id=153822

        Reviewed by Carlos Garcia Campos.

        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::computeTransformsRecursive):
        Use ASSERT to check that the m_children members are indeed children
        of the current layer, RELEASE_ASSERT probably slipped in unnoticed
        at some point.

2016-02-03  Zan Dobersek  <zdobersek@igalia.com>

        PlatformPathCairo: Lazily allocate the path surface
        https://bugs.webkit.org/show_bug.cgi?id=153821

        Reviewed by Carlos Garcia Campos.

        Move the static variable that holds the Cairo surface into
        the pathSurface() function (previously getPathSurface). This
        way the surface will only be allocated once the function is
        called for the first time from the CairoPath surface.

        No change in functionality, just a cleanup.

        * platform/graphics/cairo/PlatformPathCairo.cpp:
        (WebCore::pathSurface):
        (WebCore::CairoPath::CairoPath):
        (WebCore::getPathSurface): Deleted.

2016-02-02  Fujii Hironori  <Hironori.Fujii@jp.sony.com>

        ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result)
        https://bugs.webkit.org/show_bug.cgi?id=153576

        Reviewed by Darin Adler.

        Tests: fast/block/geometry-map-assertion-with-rounding-negative-half.html

        The results of roundedIntPoint of FloatPoint and LayoutPoint may be different
        because of the uniqueness of LayoutUnit::round introduced by this bug
        <https://bugs.webkit.org/show_bug.cgi?id=107208>.
        Should convert a FloatPoint to a LayoutPoint before rounding.

        * rendering/RenderGeometryMap.cpp:
        (WebCore::RenderGeometryMap::mapToContainer):

2016-02-02  Aakash Jain  <aakash_jain@apple.com>

        Remove references to CallFrameInlines.h
        https://bugs.webkit.org/show_bug.cgi?id=153810

        Reviewed by Mark Lam.

        * ForwardingHeaders/interpreter/CallFrameInlines.h: Removed.

2016-02-02  Jinyoung Hur  <hur.ims@navercorp.com>

        WEBGL_debug_shaders should be disabled for OpenGLES backend also
        https://bugs.webkit.org/show_bug.cgi?id=153788

        Reviewed by Darin Adler.

        WEBGL_debug_shaders extension is disabled for OpenGL backed platform
        because the implementation is not fully compliant to the spec yet.
        Because this is not an OpenGL-specific problem, WEBGL_debug_shaders extension
        should be disabled for OpenGLES backed platforms also.

        No new tests, already covered by existing tests.

        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
        (WebCore::Extensions3DOpenGL::supportsExtension): Deleted.
        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
        (WebCore::Extensions3DOpenGLCommon::supports):

2016-02-02  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/cursor-primary-key-order.html fails with SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153800

        Reviewed by Alex Christensen.

        No new tests (Existing tests now unskipped).

        The IndexRecords SQL schema did not order things by primaryKey.
        
        Easy fix to the schema. Sadly requires a migration...

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::v1IndexRecordsTableSchema):
        (WebCore::IDBServer::v1IndexRecordsTableSchemaAlternate):
        (WebCore::IDBServer::v2IndexRecordsTableSchema):
        (WebCore::IDBServer::v2IndexRecordsTableSchemaAlternate):
        (WebCore::IDBServer::SQLiteIDBBackingStore::ensureValidIndexRecordsTable):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createAndPopulateInitialDatabaseInfo):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

2016-02-02  Tim Horton  <timothy_horton@apple.com>

        <attachment> should attempt to guess the icon from the file extension if all else fails
        https://bugs.webkit.org/show_bug.cgi?id=153804
        <rdar://problem/24448146>

        Reviewed by Anders Carlsson.

        Test: fast/attachment/attachment-icon-from-file-extension.html

        * platform/graphics/Icon.h:
        * platform/graphics/mac/IconMac.mm:
        (WebCore::Icon::createIconForFileExtension):
        * rendering/RenderThemeMac.mm:
        (WebCore::iconForAttachment):
        If we can't find an icon any other way, try assuming that the title is a filename,
        grab its extension, and have NSWorkspace try to work out an icon for it.

2016-02-02  Antti Koivisto  <antti@apple.com>

        Factor style sharing code out of StyleResolver
        https://bugs.webkit.org/show_bug.cgi?id=153768

        Reviewed by Darin Adler.

        Move the code to a new class, Style::SharingResolver.

        When resolving document style we query the sharing resolver first before using the regular style resolver.
        Other paths that call style resolver were mostly already disabling it with DisallowStyleSharing flag.

        * WebCore.xcodeproj/project.pbxproj:
        * css/ElementRuleCollector.cpp:
        (WebCore::MatchRequest::MatchRequest):
        (WebCore::ElementRuleCollector::matchAllRules):
        (WebCore::ElementRuleCollector::hasAnyMatchingRules):

            More const.

        * css/ElementRuleCollector.h:
        (WebCore::ElementRuleCollector::setRegionForStyling):
        (WebCore::ElementRuleCollector::setMedium):
        * css/MediaQueryMatcher.cpp:
        (WebCore::MediaQueryMatcher::prepareEvaluator):
        * css/StyleMedia.cpp:
        (WebCore::StyleMedia::matchMedium):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::State::cacheBorderAndBackground):
        (WebCore::StyleResolver::StyleResolver):
        (WebCore::StyleResolver::sweepMatchedPropertiesCache):
        (WebCore::StyleResolver::State::State):
        (WebCore::StyleResolver::State::setStyle):
        (WebCore::isAtShadowBoundary):
        (WebCore::StyleResolver::styleForElement):
        (WebCore::StyleResolver::classNamesAffectedByRules): Deleted.
        (WebCore::parentElementPreventsSharing): Deleted.
        (WebCore::StyleResolver::locateCousinList): Deleted.
        (WebCore::StyleResolver::styleSharingCandidateMatchesRuleSet): Deleted.
        (WebCore::StyleResolver::canShareStyleWithControl): Deleted.
        (WebCore::elementHasDirectionAuto): Deleted.
        (WebCore::StyleResolver::sharingCandidateHasIdenticalStyleAffectingAttributes): Deleted.
        (WebCore::StyleResolver::canShareStyleWithElement): Deleted.
        (WebCore::StyleResolver::findSiblingForStyleSharing): Deleted.
        (WebCore::StyleResolver::locateSharedStyle): Deleted.

            Style sharing code moves to SharingResolver.

        * css/StyleResolver.h:
        (WebCore::StyleResolver::mediaQueryEvaluator):
        (WebCore::StyleResolver::State::regionForStyling):
        (WebCore::StyleResolver::State::elementLinkState):
        (WebCore::StyleResolver::State::setApplyPropertyToRegularStyle):
        (WebCore::StyleResolver::State::setApplyPropertyToVisitedLinkStyle):
        (WebCore::StyleResolver::state):
        (WebCore::StyleResolver::setTextOrientation):
        (WebCore::StyleResolver::State::setElementAffectedByClassRules): Deleted.
        (WebCore::StyleResolver::State::elementAffectedByClassRules): Deleted.
        (WebCore::StyleResolver::styleNotYetAvailable): Deleted.

            Placeholder code moves to TreeResolver.

        * dom/VisitedLinkState.cpp:
        (WebCore::linkAttribute):
        (WebCore::VisitedLinkState::invalidateStyleForAllLinks):
        (WebCore::linkHashForElement):
        (WebCore::VisitedLinkState::invalidateStyleForLink):
        (WebCore::VisitedLinkState::determineLinkStateSlowCase):
        * dom/VisitedLinkState.h:
        (WebCore::VisitedLinkState::determineLinkState):
        * html/HTMLFormControlElement.h:
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::getUncachedPseudoStyle):
        * rendering/RenderNamedFlowFragment.cpp:
        (WebCore::RenderNamedFlowFragment::computeStyleInRegion):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::isStyleAvailable):
        (WebCore::RenderStyle::hasUniquePseudoStyle):
        * style/StyleSharingResolver.cpp: Added.
        (WebCore::Style::SharingResolver::SharingResolver):
        (WebCore::Style::parentElementPreventsSharing):
        (WebCore::Style::elementHasDirectionAuto):
        (WebCore::Style::SharingResolver::searchSimilar):
        (WebCore::Style::SharingResolver::findSibling):
        (WebCore::Style::SharingResolver::locateCousinList):
        (WebCore::Style::canShareStyleWithControl):
        (WebCore::Style::SharingResolver::canShareStyleWithElement):
        (WebCore::Style::SharingResolver::styleSharingCandidateMatchesRuleSet):
        (WebCore::Style::SharingResolver::sharingCandidateHasIdenticalStyleAffectingAttributes):
        (WebCore::Style::SharingResolver::classNamesAffectedByRules):
        * style/StyleSharingResolver.h: Added.
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::ensurePlaceholderStyle):
        (WebCore::Style::TreeResolver::TreeResolver):
        (WebCore::Style::TreeResolver::styleForElement):

            Try to use SharingResolver first.
            Also move placeholder style handling here, it is only relevant when resolving document style.

        (WebCore::Style::postResolutionCallbacksAreSuspended):
        (WebCore::Style::isPlaceholderStyle):
        * style/StyleTreeResolver.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::customStyleForRenderer):
        * svg/SVGElementRareData.h:
        (WebCore::SVGElementRareData::overrideComputedStyle):

2016-02-02  Tim Horton  <timothy_horton@apple.com>

        <attachment> icon should be a folder for the custom MIME type multipart/x-folder
        https://bugs.webkit.org/show_bug.cgi?id=153795
        <rdar://problem/24416632>

        Reviewed by Anders Carlsson.

        Test: fast/attachment/attachment-folder-icon.html

        * rendering/RenderThemeMac.mm:
        (WebCore::iconForAttachment):
        (WebCore::paintAttachmentIcon):
        Mail uses this special MIME type to indicate that something is a folder, which there
        isn't a normal non-deprecated MIME type for.

2016-02-02  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/cursor-continue-validity.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=153791

        Reviewed by Alex Christensen.

        No new tests (Existing test now unskipped).

        There was a preexisting check in the SQLite cursor for remembering the current record and
        refusing to refetch it.
        
        This check was causing this bug, because we needed to refetch the current record.
        
        Removing the check (and its associated flag) doesn't regress any other test, and fixes this one.

        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::resetAndRebindStatement):
        (WebCore::IDBServer::SQLiteIDBCursor::internalAdvanceOnce):
        * Modules/indexeddb/server/SQLiteIDBCursor.h:

2016-02-01  Dave Hyatt  <hyatt@apple.com>

        Add a line grid pagination SPI to WebKit.
        https://bugs.webkit.org/show_bug.cgi?id=153757
        <rdar://problem/23041598>

        Reviewed by Anders Carlsson.

        New tests in fast/multicol/pagination.

        * page/Page.cpp:
        (WebCore::Page::setPaginationLineGridEnabled):
        * page/Page.h:
        (WebCore::Page::paginationLineGridEnabled):
        Add a boolean to the page to turn the line grid on and off.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::styleDidChange):
        Propagate the body's font up to the paginated RenderView so that
        it can be used to establish the line grid.

        * style/StyleResolveForDocument.cpp:
        (WebCore::Style::resolveForDocument):
        Set up a line grid with containment snapping by default if the
        line grid enabled flag is set.

        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::setPagination):
        (WebCore::Internals::setPaginationLineGridEnabled):
        (WebCore::Internals::configurationForViewport):
        * testing/Internals.h:
        (WebCore::Internals::setPagination):
        * testing/Internals.idl:
        Add support for testing the grid being enabled.

2016-02-01  Antti Koivisto  <antti@apple.com>

        Tab suspension code shouldn't use page cache cacheability logic
        https://bugs.webkit.org/show_bug.cgi?id=153680

        Reviewed by Andreas Kling.

        Most of PageCache::canCache() is unnecessary for tab suspension.

        Also improve robustness and introduce 1 minute delay before suspending.

        * page/Page.cpp:
        (WebCore::Page::setPageActivityState):
        (WebCore::Page::setIsVisible):
        (WebCore::Page::setIsVisibleInternal):
        (WebCore::Page::setIsPrerender):
        (WebCore::Page::canTabSuspend):

            Include visibility test here.

            Instead of calling PageCache::canCache() just check for each frame
            - that the document is loaded
            - that active DOM objects allow suspension

        (WebCore::Page::setIsTabSuspended):
        (WebCore::Page::setTabSuspensionEnabled):
        (WebCore::Page::updateTabSuspensionState):

            Refactor for robustness.

        (WebCore::Page::tabSuspensionTimerFired):

            Call canTabSuspend, the result might have changed.

        (WebCore::Page::scheduleTabSuspension): Deleted.
        * page/Page.h:

2016-02-02  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Introduce BytecodeIntrinsic constant rep like @undefined
        https://bugs.webkit.org/show_bug.cgi?id=153737

        Reviewed by Darin Adler.

        * Modules/fetch/FetchHeaders.js:
        (initializeFetchHeaders):
        * Modules/streams/ReadableStream.js:
        (initializeReadableStream):
        (closeDestination):
        (abortDestination):
        (pipeTo):
        * Modules/streams/ReadableStreamInternals.js:
        (privateInitializeReadableStreamController):
        (teeReadableStream):
        (isReadableStreamReader):
        (errorReadableStream):
        (finishClosingReadableStream):
        (enqueueInReadableStream):
        (readFromReadableStreamReader):
        * Modules/streams/ReadableStreamReader.js:
        (releaseLock):
        * Modules/streams/StreamInternals.js:
        (shieldingPromiseResolve):
        (promiseInvokeOrNoopNoCatch):
        (promiseInvokeOrFallbackOrNoop):
        (validateAndNormalizeQueuingStrategy):
        * Modules/streams/WritableStream.js:
        (initializeWritableStream):
        (write):
        * Modules/streams/WritableStreamInternals.js:
        (errorWritableStream):

2016-02-02  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/dont-wedge.html sometimes ASSERTs.
        https://bugs.webkit.org/show_bug.cgi?id=153790

        Reviewed by Tim Horton.

        No new tests (Failing test now unskipped).

        This test uncovered an unhandled race where the main thread tried to perform an OpenDB operation 
        multiple times while it was already in-progress on the server thread.

        There was already a flag meant to cover this race, and it just needed to be applied to one more site.
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::openBackingStore):

2016-02-02  Daniel Bates  <dabates@apple.com>

        CSP: Support checking content security policy without a script execution context
        https://bugs.webkit.org/show_bug.cgi?id=153748
        <rdar://problem/24439149>

        Reviewed by Darin Alder.

        Towards checking a Web Worker's content security policy against a redirected worker
        script load or redirected XHR request for an XHR request initiated from it, we should
        support instantiating a ContentSecurityPolicy object without a ScriptExecutionContext.

        No functionality was changed. So, no new tests.

        * dom/Document.cpp:
        (WebCore::Document::initSecurityContext): Pass |this| as a reference instead of as a pointer.
        * page/csp/ContentSecurityPolicy.cpp: Remove extraneous includes ScriptState.h, TextEncoding.h,
        and URL.h as they are included by ContentSecurityPolicy.h, FormDataList.h and FormData.h, respectively.
        (WebCore::CSPSource::CSPSource): Take a constant reference to a ContentSecurityPolicy instead
        of a pointer since we never expected a null pointer.
        (WebCore::CSPSource::schemeMatches): Move logic for checking the protocol of source "self"
        from here to ContentSecurityPolicy::protocolMatchesSelf() because we may not have a security
        origin if ContentSecurityPolicy was initiated without a ScriptExecutionContext object.
        (WebCore::CSPSourceList::allowSelf): Added.
        (WebCore::CSPSourceList::CSPSourceList): Take a constant reference to a ContentSecurityPolicy
        instead of a pointer since we never expected a null pointer. Remove fields from member
        initialization list that can be initialized using C++11 in-class initialization syntax.
        (WebCore::CSPSourceList::matches): Call ContentSecurityPolicy::urlMatchesSelf() to match the
        effective URL against the URL of source "self".
        (WebCore::CSPSourceList::parse): Update code as necessary now that m_policy is a reference
        instead of a pointer.
        (WebCore::CSPSourceList::parseSource): Simplify code by setting internal member fields directly
        instead of via member functions.
        (WebCore::CSPSourceList::parsePath): Update code as necessary now that m_policy is a reference
        instead of a pointer.
        (WebCore::CSPDirective::CSPDirective): Take a constant reference to a ContentSecurityPolicy
        instead of a pointer since we never expected a null pointer.
        (WebCore::CSPDirective::policy): Return a reference to a const ContentSecurityPolicy.
        (WebCore::MediaListDirective::MediaListDirective): Take a constant reference to a ContentSecurityPolicy
        instead of a pointer since we never expected a null pointer.
        (WebCore::MediaListDirective::parse): Update code as necessary now that m_policy is a reference
        instead of a pointer.
        (WebCore::SourceListDirective::SourceListDirective): Take a constant reference to a ContentSecurityPolicy
        instead of a pointer since we never expected a null pointer.
        (WebCore::SourceListDirective::allows): Write in terms of CSPSourceList::allowSelf() because we
        may not have a security origin to get a URL from if ContentSecurityPolicy was initiated without
        a ScriptExecutionContext object.
        (WebCore::CSPDirectiveList::reportURIs): Change return type from Vector<URL> to Vector<String>
        The caller will convert the strings to URLs with respect to the script execution context.
        (WebCore::CSPDirectiveList::parseReportURI): Store the report URI as a string instead of a URL
        because we may not have a security origin to compute the absolute URL if ContentSecurityPolicy
        was initiated without a ScriptExecutionContext object.
        (WebCore::CSPDirectiveList::CSPDirectiveList): Take a reference to a ContentSecurityPolicy
        instead of a pointer since we never expected a null pointer. It would be better to take a const
        reference to a ContentSecurityPolicy, but ContentSecurityPolicy::applySandboxPolicy() needs to set
        state on ContentSecurityPolicy :(
        (WebCore::CSPDirectiveList::create): Ditto.
        (WebCore::CSPDirectiveList::reportViolation): Update code as necessary now that m_policy is a reference
        instead of a pointer.
        (WebCore::CSPDirectiveList::checkEvalAndReportViolation): Ditto.
        (WebCore::CSPDirectiveList::checkInlineAndReportViolation): Ditto.
        (WebCore::CSPDirectiveList::parseDirective): Ditto.
        (WebCore::CSPDirectiveList::parseReportURI): Store the report URI as a string instead of a URL
        because we may not have a security origin to compute the absolute URL if ContentSecurityPolicy
        was initiated without a ScriptExecutionContext object.
        (WebCore::CSPDirectiveList::setCSPDirective): Update code as necessary now that m_policy is a reference
        instead of a pointer.
        (WebCore::CSPDirectiveList::applySandboxPolicy): Ditto.
        (WebCore::CSPDirectiveList::parseReflectedXSS): Ditto.
        (WebCore::CSPDirectiveList::addDirective): Ditto.
        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy): Modified to take the ScriptExecutionObject
        as a reference and compute the CSPSource object for "self" and cache the protocol for "self". Removed
        field m_overrideInlineStyleAllowed from the member initialization list and used C++11 in-class
        initialization syntax to initialize it. Added overloaded constructor that takes a SecurityOrigin object.
        We are not making use of this overloaded constructor at this time. We will in a subsequent patch.
        (WebCore::ContentSecurityPolicy::didReceiveHeader): Store the eval disabled error message for
        the last parsed policy in a member field instead of using it as part of disabling eval execution
        on the script execution context because we may not have such a context.
        (WebCore::ContentSecurityPolicy::applyPolicyToScriptExecutionContext): Applies the content security
        policy eval and sandbox restrictions to the script execution context.
        (WebCore::ContentSecurityPolicy::urlMatchesSelf): Match the specified URL against the URL for
        source "self".
        (WebCore::ContentSecurityPolicy::protocolMatchesSelf): Match the protocol of the specified URL
        against the protocol for source "self".
        (WebCore::ContentSecurityPolicy::gatherReportURIs): Modified to use the script execution context
        to compute the absolute URL for each report URI.
        (WebCore::ContentSecurityPolicy::reportViolation): Bail out if we do not have a script execution
        context.
        (WebCore::ContentSecurityPolicy::logToConsole): Only log to the console if we have a script
        execution context.
        (WebCore::ContentSecurityPolicy::reportBlockedScriptExecutionToInspector): Only report blocked
        script execution to the Web Inspector if we have a script execution context.
        (WebCore::CSPSourceList::addSourceSelf): Deleted.
        (WebCore::CSPSourceList::addSourceStar): Deleted.
        (WebCore::CSPSourceList::addSourceUnsafeInline): Deleted.
        (WebCore::CSPSourceList::addSourceUnsafeEval): Deleted.
        (WebCore::CSPDirectiveList::gatherReportURIs): Deleted.
        (WebCore::ContentSecurityPolicy::securityOrigin): Deleted.
        (WebCore::ContentSecurityPolicy::url): Deleted.
        (WebCore::ContentSecurityPolicy::completeURL): Deleted.
        (WebCore::ContentSecurityPolicy::enforceSandboxFlags): Deleted.
        * page/csp/ContentSecurityPolicy.h:
        (WebCore::ContentSecurityPolicy::enforceSandboxFlags): Accumulates the parsed sandbox flags. We
        will apply the sandbox flags in ContentSecurityPolicy::applyPolicyToScriptExecutionContext().
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::WorkerGlobalScope): Instantiate ContentSecurityPolicy.
        (WebCore::WorkerGlobalScope::applyContentSecurityPolicyResponseHeaders): Move instantiation of
        ContentSecurityPolicy from here to constructor.

2016-02-02  Eric Carlson  <eric.carlson@apple.com>

        Allow ports to disable automatic text track selection
        https://bugs.webkit.org/show_bug.cgi?id=153761
        <rdar://problem/24416768>

        Reviewed by Darin Adler.

        Test: media/track/track-manual-mode.html

        * Modules/mediacontrols/MediaControlsHost.cpp:
        (WebCore::MediaControlsHost::manualKeyword): New.
        (WebCore::MediaControlsHost::captionDisplayMode): Support 'manual' mode.
        * Modules/mediacontrols/MediaControlsHost.h:

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.buildCaptionMenu): Check the 'off' item when in manual mode.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::addTextTrack): Update m_captionDisplayMode when called for the first
          time so it is always correct. Set the track's manual selection mode as appropriate.
        (WebCore::HTMLMediaElement::captionPreferencesChanged): Set each track's manual selection 
          mode as appropriate.

        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::kind): Return 'subtitles' for forced tracks when in manual mode.
        * html/track/TextTrack.h:

        * html/track/TrackBase.h:
        (WebCore::TrackBase::kind): Make virtual.

        * page/CaptionUserPreferences.cpp:
        (WebCore::CaptionUserPreferences::beginBlockingNotifications): New.
        (WebCore::CaptionUserPreferences::endBlockingNotifications): Ditto.
        (WebCore::CaptionUserPreferences::notify): Don't notify when blocked.
        * page/CaptionUserPreferences.h:

        * page/CaptionUserPreferencesMediaAF.cpp:
        (WebCore::CaptionUserPreferencesMediaAF::CaptionUserPreferencesMediaAF): Set manual mode 
          when appropriate.
        (WebCore::CaptionUserPreferencesMediaAF::captionDisplayMode): Check manual mode.
        (WebCore::CaptionUserPreferencesMediaAF::setCaptionDisplayMode): Ditto.
        (WebCore::CaptionUserPreferencesMediaAF::setPreferredLanguage): Ditto.
        (WebCore::CaptionUserPreferencesMediaAF::textTrackSelectionScore): Return zero when in manual mode.
        (WebCore::CaptionUserPreferencesMediaAF::sortedTrackListForMenu): Consider manual mode. Fix
          typos in logging.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::mediaDescriptionForKind): Return 'auxiliary' when in manual mode.

        * testing/Internals.cpp:
        (WebCore::Internals::setCaptionDisplayMode): Support manual mode.

2016-02-02  Adrien Plazas  <aplazas@igalia.com>

        REGRESSION(r195899): ASSERTION FAILED: is<Target>(source) in EventPath::retargetTouch() since r195899
        https://bugs.webkit.org/show_bug.cgi?id=153741

        Reviewed by Ryosuke Niwa.

        * dom/EventDispatcher.cpp:
        (WebCore::EventPath::retargetTouch):

2016-02-01  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: High Level Memory Overview Instrument
        https://bugs.webkit.org/show_bug.cgi?id=153516
        <rdar://problem/24356378>

        Reviewed by Brian Burg.

        Add a new agent that gathers data from the ResourceUsageThread
        and sends to the frontend.

        Test: inspector/memory/tracking.html

        * CMakeLists.txt:
        * Configurations/FeatureDefines.xcconfig:
        * WebCore.xcodeproj/project.pbxproj:
        New files.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        Add the new agent.

        * inspector/InspectorMemoryAgent.h: Added.
        * inspector/InspectorMemoryAgent.cpp: Added.
        (WebCore::InspectorMemoryAgent::InspectorMemoryAgent):
        (WebCore::InspectorMemoryAgent::didCreateFrontendAndBackend):
        (WebCore::InspectorMemoryAgent::willDestroyFrontendAndBackend):
        (WebCore::InspectorMemoryAgent::startTracking):
        (WebCore::InspectorMemoryAgent::stopTracking):
        (WebCore::InspectorMemoryAgent::collectSample):
        Implement the agent by adding / removing it as a ResourceUsage
        observer. When receiving the data forward it to the frontend.

2016-02-01  Alex Christensen  <achristensen@webkit.org>

        Fix CMake build.

        * PlatformMac.cmake:

2016-02-01  Brady Eidson  <beidson@apple.com>

        Modern IDB: Cursors (still) do not keep their opening request alive.
        https://bugs.webkit.org/show_bug.cgi?id=153724

        Reviewed by Alex Christensen.

        No new tests (All existing tests pass without flakiness).

        IDBCursors did not properly keep their JS wrappers alive.
        Making them ActiveDOMObjects that keep track of how many requests might be in flight fixes this.
        This also makes them actually keep their opening-request live via the opaque-root mechanism.
        
        IDBCursorWithValue also needed to opt in to all of these mechanisms.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        * Modules/indexeddb/IDBCursor.h:
        (WebCore::IDBCursor::hasPendingActivity): The base IDBCursor always has no pending activity,
          to maintain current behavior in LegacyIDB. This weirdness will go away when LegacyIDB does.
        * Modules/indexeddb/IDBCursor.idl:
        * Modules/indexeddb/IDBCursorWithValue.idl:

        Track a count for all outstanding requests to keep the cursor alive as an ActiveDOMObject.
        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::IDBCursor):
        (WebCore::IDBClient::IDBCursor::update):
        (WebCore::IDBClient::IDBCursor::uncheckedIterateCursor):
        (WebCore::IDBClient::IDBCursor::deleteFunction):
        (WebCore::IDBClient::IDBCursor::activeDOMObjectName):
        (WebCore::IDBClient::IDBCursor::canSuspendForDocumentSuspension):
        (WebCore::IDBClient::IDBCursor::hasPendingActivity):
        (WebCore::IDBClient::IDBCursor::decrementOutstandingRequestCount):
        * Modules/indexeddb/client/IDBCursorImpl.h:
        
        Rework the "delete" family of functions on the object store to allow for returning a modern IDBRequest.
        A lot of this can go away when LegacyIDB does.
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::deleteFunction):
        (WebCore::IDBClient::IDBObjectStore::doDelete):
        (WebCore::IDBClient::IDBObjectStore::modernDelete):
        * Modules/indexeddb/client/IDBObjectStoreImpl.h:
        
        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::setSource): Setup a ScopeGuard to decrement the cursor's request
          count whenever it makes sense to do so.
        (WebCore::IDBClient::IDBRequest::dispatchEvent): Clear the ScopeGuard (if it exists) to decrement the count.
        (WebCore::IDBClient::IDBRequest::willIterateCursor): Set the ScopeGuard.
        (WebCore::IDBClient::IDBRequest::didOpenOrIterateCursor): Clear the ScopeGuard (if it exists) to decrement the count.
        * Modules/indexeddb/client/IDBRequestImpl.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::ScopeGuard::ScopeGuard): Deleted.
        (WebCore::IDBServer::ScopeGuard::~ScopeGuard): Deleted.
        (WebCore::IDBServer::ScopeGuard::enable): Deleted.
        (WebCore::IDBServer::ScopeGuard::disable): Deleted.
        
        * bindings/js/JSIDBCursorWithValueCustom.cpp: Added.
        (WebCore::JSIDBCursorWithValue::visitAdditionalChildren):
        
        * platform/ScopeGuard.h: Added.
        (WebCore::ScopeGuard::ScopeGuard):
        (WebCore::ScopeGuard::~ScopeGuard):
        (WebCore::ScopeGuard::enable):
        (WebCore::ScopeGuard::disable):

2016-02-01  Sun-woo Nam  <sunny.nam@samsung.com>

        Free Colormap when XWindow is destroyed.
        https://bugs.webkit.org/show_bug.cgi?id=153413

        Reviewed by Žan Doberšek.

        Colormap is needed to create XWindow and it should be freed when XWindow is destroyed.
        Unless Colormap is freed before destroying XWindow, memory leak is suspected.
        XFreeColormap therefore is needed on X11Helper.

        * platform/graphics/surfaces/glx/X11Helper.cpp: Added XFreeColormap.
        (WebCore::X11Helper::destroyWindow):

2016-02-01  Tim Horton  <timothy_horton@apple.com>

        Move some SPI declarations into the appropriate SPI header
        https://bugs.webkit.org/show_bug.cgi?id=153755

        Reviewed by Darin Adler.

        * platform/graphics/cocoa/IOSurface.mm:
        * platform/spi/cg/CoreGraphicsSPI.h:

2016-02-01  Tim Horton  <timothy_horton@apple.com>

        Snapshot surfaces are forever wired after being compressed
        https://bugs.webkit.org/show_bug.cgi?id=153751
        <rdar://problem/24354546>

        Reviewed by Darin Adler.

        * platform/graphics/cocoa/IOSurface.mm:
        (IOSurface::convertToFormat):
        Allow IOSurfaceAccelerator to unwire surfaces after they're transformed.

2016-02-01  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/20150072> [iOS] Remove some file upload code only needed before iOS 9
        https://bugs.webkit.org/show_bug.cgi?id=153754

        Reviewed by Darin Adler.

        * English.lproj/Localizable.strings: Updated for removal of WebKit2 string.

2016-02-01  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Cache the Path instead of creating it every time it is required
        https://bugs.webkit.org/show_bug.cgi?id=152939

        Reviewed by Darin Adler.

        Instead of creating the Path object every time it is required, we should 
        cache it in an LRU cache. TinyLRUCache returns a reference to the cached
        entry so we do not have to pay the cost of copying it either.

        * platform/graphics/FloatRoundedRect.h:
        (WebCore::operator!=):
        Implement the inequality operator for FloatRoundedRect since it is
        called by TinyLRUCache.
        
        * rendering/ClipPathOperation.h:
        Return a reference to the path in the cache since instead of creating a
        new copy.
        
        * rendering/style/BasicShapes.cpp:
        (WebCore::SVGPathTranslatedByteStream::SVGPathTranslatedByteStream):
        (WebCore::SVGPathTranslatedByteStream::operator==):
        (WebCore::SVGPathTranslatedByteStream::operator!=):
        (WebCore::SVGPathTranslatedByteStream::isEmpty):
        (WebCore::SVGPathTranslatedByteStream::path):
        This struct holds an offset and an SVGPathByteStream. It is the key of 
        the LRU cache for the the translated SVGPathByteStream.
        
        (WebCore::EllipsePathPolicy::isKeyNull):
        (WebCore::EllipsePathPolicy::createValueForKey):
        (WebCore::RoundedRectPathPolicy::isKeyNull):
        (WebCore::RoundedRectPathPolicy::createValueForKey):
        (WebCore::PolygonPathPolicy::isKeyNull):
        (WebCore::PolygonPathPolicy::createValueForKey):
        (WebCore::TranslatedByteStreamPathPolicy::isKeyNull):
        (WebCore::TranslatedByteStreamPathPolicy::createValueForKey):
        Inherit from the LRU cache policy template, so have a specific name for
        the desired path contents and pass this class explicitly to the LRU cache
        template.
        
        (WebCore::cachedEllipsePath):
        (WebCore::cachedRoundedRectPath):
        (WebCore::cachedPolygonPath):
        (WebCore::cachedTranslatedByteStreamPath):
        Return a cached path object for specific path contents.
        
        (WebCore::BasicShapeCircle::path):
        (WebCore::BasicShapeEllipse::path):
        (WebCore::BasicShapePolygon::path):
        (WebCore::BasicShapePath::path):
        (WebCore::BasicShapeInset::path):
        Get the Path object from the cache; create a new one if it does not exist.
        
        * rendering/style/BasicShapes.h:
        Change the prototype of the path() function to return a reference to the
        path in the cache instead of a having to copying it.
        
        * svg/SVGPathByteStream.h:
        (WebCore::SVGPathByteStream::operator!=):
        Implement the inequality operator for SVGPathByteStream because it is
        called by TinyLRUCache.

2016-02-01  Chris Dumez  <cdumez@apple.com>

        Move properties that use custom bindings to the prototype
        https://bugs.webkit.org/show_bug.cgi?id=153735

        Reviewed by Darin Adler.

        Move properties that use custom bindings to the prototype. Whether a
        property's bindings code is generated or custom-written should not
        impact where the property is located.

        No new tests, already covered by existing tests.

        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::getOwnPropertySlot):
        Add null-check for staticPropHashTable. HTMLDocument no longer has
        any property on the instance so staticPropHashTable is now null.

        * bindings/scripts/CodeGeneratorJS.pm:

2016-02-01  Jer Noble  <jer.noble@apple.com>

        REGRESSION(r195770): Use-after-free in ResourceLoaderOptions::cachingPolicy
        https://bugs.webkit.org/show_bug.cgi?id=153727
        <rdar://problem/24429886>

        Reviewed by Chris Dumez.

        The `this` object may be freed after calling deleteIfPossible(). Make the early-return-if-
        deleted more explicit, and only check allowsCaching() after the deleteIfPossible() return
        value check.

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::removeClient):

2016-02-01  Dan Bernstein  <mitz@apple.com>

        Tried to fix a build after r195899.

        * dom/EventContext.h: Enabled TouchEventContext type trait specialization on iOS.

2016-02-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Implement Fetch API Request
        https://bugs.webkit.org/show_bug.cgi?id=153437

        Added support for Fetch Request and Body.
        Body is sharing functionality between Request and Response.
        Conversion between various body types are not implemented yet.

        Added a FetchOptions class. Options in this class are partially redundant with ResourceLoaderOptions.

        Fixing bug in Headers constructor.
        Making error reporting in case of modifying headers compliant with the spec.

        Reviewed by Darin Adler.

        Tests: imported/w3c/web-platform-tests/fetch/api/request/request-clone.sub.html
               imported/w3c/web-platform-tests/fetch/api/request/request-consume.html
               imported/w3c/web-platform-tests/fetch/api/request/request-disturbed.html
               imported/w3c/web-platform-tests/fetch/api/request/request-error.html
               imported/w3c/web-platform-tests/fetch/api/request/request-headers.html
               imported/w3c/web-platform-tests/fetch/api/request/request-idl.html
               imported/w3c/web-platform-tests/fetch/api/request/request-init-001.sub.html
               imported/w3c/web-platform-tests/fetch/api/request/request-init-002.html
               imported/w3c/web-platform-tests/fetch/api/request/request-init-003.sub.html
               imported/w3c/web-platform-tests/fetch/api/request/request-structure.html

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * Modules/fetch/FetchBody.cpp: Added.
        (WebCore::FetchBody::initBody):
        (WebCore::FetchBody::clear):
        (WebCore::FetchBody::processIfEmptyOrDisturbed):
        (WebCore::FetchBody::arrayBuffer):
        (WebCore::FetchBody::formData):
        (WebCore::FetchBody::blob):
        (WebCore::FetchBody::text):
        (WebCore::FetchBody::json):
        * Modules/fetch/FetchBody.h: Added.
        (WebCore::FetchBody::~FetchBody):
        (WebCore::FetchBody::isEmpty):
        (WebCore::FetchBody::isDisturbed):
        (WebCore::FetchBody::setDisturbed):
        (WebCore::FetchBody::setMimeType):
        (WebCore::FetchBody::mimeType):
        * Modules/fetch/FetchBody.idl: Added.
        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::canWriteHeader):
        (WebCore::FetchHeaders::append):
        (WebCore::FetchHeaders::remove):
        (WebCore::FetchHeaders::set):
        (WebCore::FetchHeaders::fill): Helper routine implementing https://fetch.spec.whatwg.org/#concept-headers-fill
        * Modules/fetch/FetchHeaders.h: Adding header getter/setter for FetchRequest.
        (WebCore::FetchHeaders::fastGet):
        (WebCore::FetchHeaders::fastSet):
        * Modules/fetch/FetchHeaders.js: Fixing bug in constructor (covered by modified headers-basc.html test).
        (initializeFetchHeaders):
        * Modules/fetch/FetchOptions.h: Added.
        (WebCore::FetchOptions::FetchOptions):
        (WebCore::FetchOptions::type):
        (WebCore::FetchOptions::destination):
        (WebCore::FetchOptions::mode):
        (WebCore::FetchOptions::credentials):
        (WebCore::FetchOptions::cache):
        (WebCore::FetchOptions::redirect):
        (WebCore::FetchOptions::referrerPolicy):
        (WebCore::FetchOptions::setType):
        (WebCore::FetchOptions::setDestination):
        (WebCore::FetchOptions::setMode):
        (WebCore::FetchOptions::setCredentials):
        (WebCore::FetchOptions::setCache):
        (WebCore::FetchOptions::setRedirect):
        (WebCore::FetchOptions::setReferrerPolicy):
        * Modules/fetch/FetchRequest.cpp: Added.
        (WebCore::FetchRequest::create):
        (WebCore::FetchRequest::FetchRequest):
        (WebCore::FetchRequest::init):
        (WebCore::FetchRequest::setReferrer):
        (WebCore::FetchRequest::setReferrerPolicy):
        (WebCore::FetchRequest::setMode):
        (WebCore::FetchRequest::setCredentials):
        (WebCore::FetchRequest::setCache):
        (WebCore::FetchRequest::setRedirect):
        (WebCore::FetchRequest::type):
        (WebCore::FetchRequest::destination):
        (WebCore::FetchRequest::referrerPolicy):
        (WebCore::FetchRequest::referrer):
        (WebCore::FetchRequest::mode):
        (WebCore::FetchRequest::credentials):
        (WebCore::FetchRequest::cache):
        (WebCore::FetchRequest::redirect):
        (WebCore::FetchRequest::setMethod):
        (WebCore::FetchRequest::clone):
        * Modules/fetch/FetchRequest.h: Added.
        (WebCore::FetchRequest::method):
        (WebCore::FetchRequest::url):
        (WebCore::FetchRequest::integrity):
        (WebCore::FetchRequest::headers):
        * Modules/fetch/FetchRequest.idl: Added.
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/Dictionary.h:
        (WebCore::Dictionary::execState):
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        * bindings/js/JSDictionary.h:
        (WebCore::JSDictionary::get):

2016-01-31  Jeremy Jones  <jeremyj@apple.com>

        Add resize event for HTMLMediaElement
        https://bugs.webkit.org/show_bug.cgi?id=125715

        Reviewed by Darin Adler.

        Tests: http/tests/media/hls/hls-video-resize.html
               media/video-resize.html

        Move resize javascript event from DOMWindow.idl to GlobalEventHandlers.idl
        per https://html.spec.whatwg.org/multipage/webappapis.html#globaleventhandlers

        Post resize event from video element when metadata loads and when content size changes.

        * dom/GlobalEventHandlers.idl: Add onresize.
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::createEventHandlerNameMap): Add onresizeAttr.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setReadyState):
        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
        * html/HTMLMediaElement.h:
        (WebCore::HTMLMediaElement::scheduleResizeEvent):
        (WebCore::HTMLMediaElement::scheduleResizeEventIfSizeChanged):
        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::scheduleResizeEvent): Sechedule event.
        (WebCore::HTMLVideoElement::scheduleResizeEventIfSizeChanged): Schedule event if size has changed.
        * html/HTMLVideoElement.h: Add declarations.
        * page/DOMWindow.idl: Remove onresize.

2016-01-31  Darin Adler  <darin@apple.com>

        Revert accidental behavior change from previous patch.

        * platform/URL.cpp:
        (WebCore::mimeTypeFromDataURL): Restore behavior where an empty MIME type would
        be turned into "text/plain".

2016-01-31  Darin Adler  <darin@apple.com>

        Cut down on calls to String::lower; mostly replace with convertToASCIILowercase
        https://bugs.webkit.org/show_bug.cgi?id=153732

        Reviewed by Dean Jackson.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::isTypeSupported): Added comment about mysterious call
        to lower(); should probably return here and remove it.

        * Modules/navigatorcontentutils/NavigatorContentUtils.cpp:
        (WebCore::initProtocolHandlerWhitelist): Deleted. Moved into isProtocolWhitelisted.
        (WebCore::isProtocolWhitelisted): Changed set to be ASCIICaseInsensitiveHash and
        initialized it using a lambda instead of a separate function.
        (WebCore::verifyProtocolHandlerScheme): Added a FIXME about some case sensitive
        checking of the protocol prefix here.

        * Modules/plugins/QuickTimePluginReplacement.mm:
        (WebCore::QuickTimePluginReplacement::supportsMimeType): Changed set to be
        ASCIICaseInsensitiveHash and initialized it using a lambda instead of using
        an explict check for empty.
        (WebCore::QuickTimePluginReplacement::supportsFileExtension): Ditto.

        * Modules/plugins/YouTubePluginReplacement.cpp:
        (WebCore::queryKeysAndValues): Use convertToASCIILowercase. The keys here are
        going to be all ASCII.
        (WebCore::isYouTubeURL): Use equalLettersIgnoringASCIICase instead of lowercasing
        the string.
        (WebCore::processAndCreateYouTubeURL): Use url.protocolIsInHTTPFamily instead of
        listing "http" and then "https" explicitly. Use equalLettersIgnoringASCIICase
        instead of lowercasing a string.
        (WebCore::YouTubePluginReplacement::youTubeURL): Ditto.

        * Modules/websockets/WebSocketHandshake.cpp:
        (WebCore::hostName): Use convertToASCIILowercase on host name.
        (WebCore::WebSocketHandshake::host): Ditto.

        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (webkitAccessibleGetAttributes): Call convertToASCIILowercase instead of lower
        to lowercase an element's tag name. This is a strange way to do things; typically
        would be better to use some other function on Element, since tagName goes out of
        its way to be capitalized, but some ATK expert can improve this later.

        * css/CSSGrammar.y.in: Use the new convertToASCIILowercaseInPlace function rather
        than the old lower function. We only need to lowercase the ASCII letters, and it's
        also better to have the function have a clearer name.

        * css/CSSParser.cpp:
        (WebCore::convertToASCIILowercaseInPlace): Renamed from makeLower and made it deal
        with only ASCII lowercasing.
        (WebCore::CSSParserString::convertToASCIILowercaseInPlace): Renamed from lower.
        (WebCore::isUniversalKeyword): Added. Helper for the function below that uses
        equalLettersIgnoringASCIICase rather than lowercasing the string.
        (WebCore::parseKeywordValue): Use isUniversalKeyword. Also clarified a comment.
        (WebCore::CSSParser::parseAttr): Use convertToASCIILowercaseInPlace and delay
        String creation until later in the function, using CSSParserString operations more.

        * css/CSSParserValues.cpp:
        (WebCore::CSSParserSelector::parsePseudoElementSelector): Use
        convertToASCIILowercaseInPlace by its new name, with its new behavior.

        * css/CSSParserValues.h: Tweaked comment and formatting a bit. Replaced the lower
        function with the convertToASCIILowercaseInPlace function.

        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::RareData::parseNth): Rewrote this to avoid the need to
        make a lowercased copy of m_argument. Use equalLettersIgnoringASCIICase, and two
        calls to find. Also use String::toIntStrict so we don't have to create String
        objects for substrings.

        * css/MediaQuery.cpp:
        (WebCore::MediaQuery::MediaQuery): Use convertToASCIILowercase for media type name.
        * css/MediaQueryExp.cpp:
        (WebCore::MediaQueryExp::serialize): Use convertToASCIILowercase for media feature name.

        * dom/Document.cpp:
        (WebCore::isSeparator): Tweaked formatting and removed non-helpful comment.
        (WebCore::processArguments): Changed this from a static member function to a non-member
        file internal function. Use a std::function instead of a function pointer with a void*
        pointer. Rewrote algorithm to simplify it and use StringView instead of String for the
        keys and values.
        (WebCore::Document::processViewport): Use a lambda instead of a function pointer to
        call setViewportFeature, so that function's interface is no longer dictated by
        the exact type of the function pointer argument to processArguments.
        (WebCore::Document::processFormatDetection): Use a lambda instead of the
        setParserFeature function above; use equalLettersIgnoringASCIICase for both the
        key and the value, since processArguments no longer lowercases the string.
        (WebCore::Document::processArguments): Deleted.

        * dom/Document.h: Removed unnecessary declaration of processArguments and
        ArgumentsCallback. Both are now private to the cpp file.

        * dom/Element.cpp:
        (WebCore::makeIdForStyleResolution): Use convertToASCIILowercase. When in quirks mode,
        we want to match IDs in an ASCII case-insensitive way not match compatibility caseless.

        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::isScriptTypeSupported): Remove the use of lower here since
        the MIME type registry is now itself ASCII case-insensitive.

        * dom/ViewportArguments.cpp:
        (WebCore::numericPrefix): Changed to use StringView and take a Document&, rearranged
        argument order so Document& comes first.
        (WebCore::findSizeValue): Ditto.
        (WebCore::findScaleValue): Ditto.
        (WebCore::findBooleanValue): Ditto. Also use std::abs instead of fabs, possibly
        avoiding a conversion from float to double (not sure it was happening before but it's
        definitely not happening now).
        (WebCore::setViewportFeature): Changed to put arguments in a more logical order, to take
        the ViewportArguments as a reference, not a void*, and to use StringView to avoid forcing
        the caller to allocate strings. Also changed to use equalLettersIgnoringASCIICase so we
        don't rely on the caller to make the key lowercase for us.
        (WebCore::reportViewportWarning): Changed argument types. Added a couple comments about
        mistakes in the function.

        * dom/ViewportArguments.h: Removed unnecessary declaration of reportViewportWarning,
        which is now private to the cpp file. Updated for new arguments to setViewportFeature.

        * editing/EditorCommand.cpp:
        (WebCore::executeFormatBlock): Use convertToASCIILowercase on the argument, which is
        specifying a tag name.

        * fileapi/Blob.cpp:
        (WebCore::Blob::isValidContentType): Removed unnecessary separate loops for
        8-bit and 16-bit strings. Content types are short strings and this small optimization is
        not worth the additional code complexity.
        (WebCore::Blob::normalizedContentType): Use convertToASCIILowercase since valid
        content types are guaranteed to be all ASCII.
        (WebCore::Blob::isNormalizedContentType): Removed unnecessary separate loops for
        8-bit and 16-bit strings. Content types are short strings and this small optimization is
        not worth the additional code complexity.

        * html/parser/HTMLParserIdioms.cpp: Added now-needed include of QualifiedName.h.

        * html/parser/HTMLParserIdioms.h: Removed unneeded include of QualifiedName.h and
        WTFString.h. Made sure every function is declared first, even if it's also defined
        later in the header in the section for functions templates and inline functions.

        * loader/archive/ArchiveFactory.cpp:
        (WebCore::ArchiveFactory::registerKnownArchiveMIMETypes): Use auto& for the type of
        the set of MIME types here, since it's now using ASCIICaseInsensitiveHash.

        * platform/MIMETypeRegistry.cpp: Changed the MIME type sets to use
        ASCIICaseInsensitiveHash since MIME type are not case sensitive.
        (WebCore::initializeSupportedImageMIMETypes): Use a modern for loop.
        (WebCore::initializeSupportedImageMIMETypesForEncoding): Updated for HashSet type change.
        (WebCore::initializePDFMIMETypes): Use a modern for loop.
        (WebCore::initializeSupportedNonImageMimeTypes): Use a modern for loop.
        (WebCore::initializeSupportedMediaMIMETypes): Updated for HashSet type change.
        (WebCore::initializeUnsupportedTextMIMETypes): Use a modern for loop.
        (WebCore::initializeMIMETypeRegistry): Updated for HashSet type change.
        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypes): Ditto.
        (WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes): Ditto.
        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding): Ditto.
        (WebCore::MIMETypeRegistry::getSupportedNonImageMIMETypes): Ditto.
        (WebCore::MIMETypeRegistry::getSupportedMediaMIMETypes): Ditto.
        (WebCore::MIMETypeRegistry::getPDFMIMETypes): Ditto.
        (WebCore::MIMETypeRegistry::getPDFAndPostScriptMIMETypes): Ditto.
        (WebCore::MIMETypeRegistry::getUnsupportedTextMIMETypes): Ditto.
        (WebCore::mimeTypeAssociationMap): Use ASCIICaseInsensitiveHash.
        (WebCore::MIMETypeRegistry::getNormalizedMIMEType): Use auto to make code tighter.

        * platform/MIMETypeRegistry.h: Changed return types of the getMIMETypes functions
        to use ASCIICaseInsensitiveHash.

        * platform/SchemeRegistry.cpp:
        (WebCore::schemesForbiddenFromDomainRelaxation): Changed type to
        use ASCIICaseInsensitiveHash.

        * platform/URL.cpp:
        (WebCore::mimeTypeFromDataURL): Use convertToASCIILowercase instead of lower.
        Also removed some dead code that tried to handle the case where the data URL
        has a comma as one of the first 5 characters: That can't happen since it's a
        precondition of this function that the first five characters are "data:".

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::getSupportedTypes): Change type of argument to
        a HashSet with ASCIICaseInsensitiveHash.
        * platform/graphics/MediaPlayer.h: Ditto.

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::staticMIMETypeList):
        Changed type of HashSet to use ASCIICaseInsensitiveHash.
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h: Ditto.

        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::avfMIMETypes):
        Changed type of HashSet to use ASCIICaseInsensitiveHash.
        (WebCore::MediaPlayerPrivateAVFoundationCF::getSupportedTypes): Ditto.
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h: Ditto.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        Changed type of HashSet to use ASCIICaseInsensitiveHash.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithImageGenerator): Removed
        an unnecessary line of code to set a local variable to 0 just before it falls
        out of scope.
        (WebCore::avfMIMETypes): Ditto. Also tightened up the code a bit.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::getSupportedTypes): Ditto.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
        Changed type of HashSet to use ASCIICaseInsensitiveHash.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::mimeTypeCache): Ditto.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::getSupportedTypes): Ditto.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h: Ditto.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::getSupportedTypes): Ditto.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::mimeTypeCache): Ditto.
        (WebCore::MediaPlayerPrivateGStreamer::getSupportedTypes): Ditto.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h: Ditto.

        * platform/graphics/mac/MediaPlayerPrivateQTKit.h: Ditto.
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::shouldRejectMIMEType): Made this non-case-sensitive by using startsWith
        and the "false" argument. Later change this to startsWithIgnoringASCIICase or
        startsWithLettersIgnoringASCIICase.
        (WebCore::addFileTypesToCache): Use ASCIICaseInsensitiveHash. ALso rewrote to
        tighten up the code a bit and use modern Objective-C for loops.
        (WebCore::mimeCommonTypesCache): Use ASCIICaseInsensitiveHash.
        (WebCore::mimeModernTypesCache): Ditto.
        (WebCore::concatenateHashSets): Ditto.
        (WebCore::MediaPlayerPrivateQTKit::getSupportedTypes): Ditto.
        (WebCore::MediaPlayerPrivateQTKit::disableUnsupportedTracks): Initialied
        track type set using lambda, but left it case sensitive.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::mimeTypeCache): Changed type of HashSet to use ASCIICaseInsensitiveHash.
        (WebCore::MediaPlayerPrivateMediaFoundation::getSupportedTypes): Ditto.
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:

        * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:
        (WebCore::mimeTypeCache): Ditto.
        (WebCore::MockMediaPlayerMediaSource::getSupportedTypes): Ditto.
        * platform/mock/mediasource/MockMediaPlayerMediaSource.h: Ditto.

2016-01-31  Brent Fulgham  <bfulgham@apple.com>

        Add "WebKit built-in PDF" Plugin to set of publicly visible plugins
        https://bugs.webkit.org/show_bug.cgi?id=153657
        <rdar://problem/24413107>

        Reviewed by Darin Adler.

        Tested by http/tests/plugins/visible_plugins.html.

        A number of poorly-coded sites break when WebKit reports that it understands PDF mime types,
        but does not have a list of plugins that the site can iterate through.

        To avoid this compatibility problem, we should also expose the "WebKit built-in PDF" plugin
        to avoid this edge case.

        * plugins/PluginData.cpp:
        (WebCore::shouldBePubliclyVisible): Add "WebKit built-in PDF" plugin.

2016-01-31  Doug Russell  <d_russell@apple.com>

        AX: Add a boundary value to AXTextStateChangeType
        https://bugs.webkit.org/show_bug.cgi?id=153085

        Reviewed by Darin Adler.

        Post an AT notification when navigation is attempted past
        an editable element's boundaries.

        Test: accessibility/mac/selection-boundary-userinfo.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::showIntent):
        * accessibility/AXTextStateChangeIntent.h:
        * accessibility/mac/AXObjectCacheMac.mm:
        (platformChangeTypeForWebCoreChangeType):
        (WebCore::AXObjectCache::postTextStateChangePlatformNotification):
        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::modifyMovingRight):
        (WebCore::FrameSelection::modifyMovingForward):
        (WebCore::FrameSelection::modifyMovingLeft):
        (WebCore::FrameSelection::modifyMovingBackward):
        (WebCore::textSelectionWithDirectionAndGranularity):
        (WebCore::FrameSelection::modify):
        (WebCore::FrameSelection::modifyExtendingBackward): Deleted.
        (WebCore::FrameSelection::textSelectionIntent): Deleted.
        * editing/FrameSelection.h:
        * editing/VisiblePosition.cpp:
        (WebCore::VisiblePosition::next):
        (WebCore::VisiblePosition::previous):
        (WebCore::VisiblePosition::left):
        (WebCore::VisiblePosition::right):
        (WebCore::VisiblePosition::honorEditingBoundaryAtOrBefore):
        (WebCore::VisiblePosition::honorEditingBoundaryAtOrAfter):
        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate): Deleted.
        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate): Deleted.
        * editing/VisiblePosition.h:
        * editing/VisibleUnits.cpp:
        (WebCore::startOfLine):
        (WebCore::logicalStartOfLine):
        (WebCore::endOfLine):
        (WebCore::logicalEndOfLine):
        (WebCore::leftBoundaryOfLine):
        (WebCore::rightBoundaryOfLine):
        (WebCore::inSameLogicalLine): Deleted.
        (WebCore::endOfEditableContent): Deleted.
        (WebCore::isEndOfEditableOrNonEditableContent): Deleted.
        * editing/VisibleUnits.h:

2016-01-31  Daniel Bates  <dabates@apple.com>

        CSP: Use the served CSP header for dedicated workers
        https://bugs.webkit.org/show_bug.cgi?id=153157
        <rdar://problem/24383254>
        And
        https://bugs.webkit.org/show_bug.cgi?id=153156
        <rdar://problem/24383246>

        Reviewed by Brent Fulgham.

        Inspired by Blink commit:
        <https://src.chromium.org/viewvc/blink?revision=194143&view=revision>

        Implement support for respecting Content Security Policy (CSP) HTTP headers included in the
        HTTP response for a Web Worker's script as per section Workers of the CSP 2.0 spec,
        <https://w3c.github.io/webappsec-csp/2/#processing-model-workers> (29 August 2015).

        Currently a Web Worker always inherits the CSP of its owner document. Instead a web worker
        will inherit the CSP of its owner document only if its script is incapable of defining a
        content security policy (i.e. its origin is a globally unique identifier). Otherwise, the
        CSP HTTP headers delivered with the script will be used to define the CSP for the worker.

        Tests: fast/workers/worker-inherits-csp-blocks-eval.html
               fast/workers/worker-inherits-csp-blocks-xhr.html
               http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-blocks-eval.html

        * CMakeLists.txt: Add file ContentSecurityPolicyResponseHeaders.cpp.
        * WebCore.vcxproj/WebCore.vcxproj: Add files ContentSecurityPolicyResponseHeaders.{cpp, h}.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * dom/Document.cpp:
        (WebCore::Document::processHttpEquiv): Update code to use enum class ContentSecurityPolicyHeaderType.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::didBeginDocument): Extract logic to collect Content Security Policy HTTP headers
        into class ContentSecurityPolicyResponseHeaders and make use of it here.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirectiveList::headerType): Modified to use enum class ContentSecurityPolicyHeaderType.
        (WebCore::CSPDirectiveList::CSPDirectiveList): Ditto.
        (WebCore::CSPDirectiveList::create): Ditto.
        (WebCore::ContentSecurityPolicy::responseHeaders): Creates and returns a ContentSecurityPolicyResponseHeaders
        object with the parsed CSP policy headers.
        (WebCore::ContentSecurityPolicy::didReceiveHeaders): Processed the CSP policy headers represented by the
        specified ContentSecurityPolicyResponseHeaders object.
        (WebCore::ContentSecurityPolicy::deprecatedHeader): Deleted.
        (WebCore::ContentSecurityPolicy::deprecatedHeaderType): Deleted.
        * page/csp/ContentSecurityPolicy.h: Defines a class that represents a collection of CSP policy headers.
        This class has two purposes:
            - It extracts the CSP policy headers from a HTTP response (ResourceResponse object). We make use of
            this functionality in both FrameLoader::didBeginDocument() and Worker::didReceiveResponse().
            - It serves as a memento that externalizes the internal CSP policy details of an instance of
            ContentSecurityPolicy. We make use of this memento functionality to support inheriting the
            CSP policy of the worker's owner document in a thread-safe manner. You can create and restore
            a memento using ContentSecurityPolicy::responseHeaders() and ContentSecurityPolicy::didReceiveHeaders(), respectively.
        * page/csp/ContentSecurityPolicyResponseHeaders.cpp: Added.
        (WebCore::ContentSecurityPolicyResponseHeaders::ContentSecurityPolicyResponseHeaders): Extracts the
        CSP HTTP headers from a ResourceResponse object.
        (WebCore::ContentSecurityPolicyResponseHeaders::isolatedCopy): Make a copy of this object that is
        safe to pass to another thread.
        * page/csp/ContentSecurityPolicyResponseHeaders.h: Added.
        * workers/DedicatedWorkerGlobalScope.cpp:
        (WebCore::DedicatedWorkerGlobalScope::create): Modified to use class ContentSecurityPolicyResponseHeaders.
        * workers/DedicatedWorkerGlobalScope.h:
        * workers/DedicatedWorkerThread.cpp:
        (WebCore::DedicatedWorkerThread::create): Ditto.
        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread): Ditto.
        (WebCore::DedicatedWorkerThread::createWorkerGlobalScope): Ditto.
        * workers/DedicatedWorkerThread.h:
        * workers/Worker.cpp:
        (WebCore::Worker::didReceiveResponse): Create a ContentSecurityPolicyResponseHeaders if the origin of
        the worker's script is capable of providing a CSP. Otherwise, we will inherit the CSP of the worker's owner
        document in Worker::notifyFinished().
        (WebCore::Worker::notifyFinished): Pass the appropriate CSP response headers to WorkerMessagingProxy::startWorkerGlobalScope().
        * workers/Worker.h:
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::applyContentSecurityPolicyResponseHeaders): Renamed; formerly named applyContentSecurityPolicyFromString().
        Modified to take a ContentSecurityPolicyResponseHeaders and apply it to the ContentSecurityPolicy object associated with the worker.
        (WebCore::WorkerGlobalScope::applyContentSecurityPolicyFromString): Deleted.
        * workers/WorkerGlobalScope.h:
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::startWorkerGlobalScope): Pass the worker's ContentSecurityPolicyResponseHeaders object.
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData): Added field m_contentSecurityPolicyResponseHeaders to store
        the CSP response headers to be applied to the worker's ContentSecurityPolicy object.
        (WebCore::WorkerThread::WorkerThread): Modified to use ContentSecurityPolicyResponseHeaders.
        (WebCore::WorkerThread::workerThread): Pass the ContentSecurityPolicyResponseHeaders object from the start up data struct
        to DedicatedWorkerThread::createWorkerGlobalScope().
        * workers/WorkerThread.h:

2016-01-31  Darin Adler  <darin@apple.com>

        Get rid of most calls to String::upper; mostly replace them with convertToASCIIUppercase
        https://bugs.webkit.org/show_bug.cgi?id=153715

        Reviewed by Gyuyoung Kim.

        * editing/cocoa/HTMLConverter.mm:
        (HTMLConverter::computedAttributesForElement): Use convertToASCIILowercase to fold
        ASCII case when searching for fonts by name.

        * platform/network/cf/ResourceResponseCFNet.cpp:
        (WebCore::ResourceResponse::platformLazyInit): Use convertToASCIIUppercase to make
        the HTTP version string canonical. Not sure why it's needed at all, but the letters
        we might be uppercasing are "HTTP", so no need to handle non-ASCII.
        * platform/network/cocoa/ResourceResponseCocoa.mm:
        (WebCore::ResourceResponse::platformLazyInit): Ditto.

        * rendering/svg/SVGRenderTreeAsText.cpp:
        (WebCore::operator<<): Use convertToASCIIUppercase when writing the spread
        method type into a text stream. The method types are all ASCII.

2016-01-31  Dan Bernstein  <mitz@apple.com>

        [Cocoa] Remove __has_include guards around use of WebKitAdditions
        https://bugs.webkit.org/show_bug.cgi?id=153728

        Reviewed by Andy Estes.

        Guard WebKitAdditions includes with #if USE(APPLE_INTERNAL_SDK) rather than with __has_include.

        * dom/EventNames.h:
        * loader/EmptyClients.cpp:
        (WebCore::fillWithEmptyClients):
        * page/MainFrame.cpp:
        (WebCore::MainFrame::MainFrame):
        * page/MainFrame.h:
        * page/PageConfiguration.h:
        * platform/cocoa/WebKitAdditions.mm:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        * platform/ios/LegacyTileGridTile.mm:

2016-01-31  Darin Adler  <darin@apple.com>

        Replace CaseFoldingHash with ASCIICaseInsensitiveHash
        https://bugs.webkit.org/show_bug.cgi?id=153639

        Reviewed by Filip Pizlo.

        * Modules/webdatabase/DatabaseAuthorizer.h: Use ASCIICaseInsensitiveHash
        for whitelisted functions. Function names are all ASCII.

        * accessibility/AccessibilityObject.cpp: Use ASCIICaseInsensitiveHash
        for ARIA roles. ARIA roles are all ASCII.

        * crypto/CryptoAlgorithmRegistry.h: Use ASCIICaseInsensitiveHash for
        crypto algorithm names. Algorithm names are all ASCII.

        * css/CSSFontSelector.cpp:
        (WebCore::registerLocalFontFacesForFamily): Use ASCIICaseInsensitiveHash
        for font faces. Face names should use ASCII case insensitive matching;
        there is no need for non-ASCII case folding.
        * css/CSSFontSelector.h: Ditto.

        * dom/DOMImplementation.cpp: Use ASCIICaseInsensitiveHash for the
        FeatureSet. The features are all ASCII.

        * dom/Document.h: Use ASCIICaseInsensitiveHash for the access key
        map. Access keys are all ASCII.

        * dom/ScriptElement.cpp:
        (WebCore::isLegacySupportedJavaScriptLanguage): Use ASCIICaseInsensitiveHash
        for the language set. These strings are all ASCII.

        * editing/EditorCommand.cpp: Use ASCIICaseInsensitiveHash for editor
        command names. These names are all ASCII.

        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::parametersForPlugin): Use ASCIICaseInsensitiveHash
        for parameter names. These names are all ASCII.

        * html/InputType.cpp: Use ASCIICaseInsensitiveHash for the input types.
        The input types are all ASCII.

        * loader/CrossOriginAccessControl.h: Use ASCIICaseInsensitiveHash for
        HTTP header field names. These names are all ASCII.
        * loader/CrossOriginPreflightResultCache.h: Ditto.

        * loader/archive/ArchiveFactory.cpp: Use ASCIICaseInsensitiveHash for
        MIME types. MIME types are all ASCII.
        * platform/MIMETypeRegistry.cpp:
        (WebCore::initializeSupportedImageMIMETypes): Ditto.

        * platform/SchemeRegistry.h: Use ASCIICaseInsensitiveHas for URL schemes.
        URL schemes are all ASCII.
        * platform/URL.cpp: Ditto.

        * platform/graphics/FontCache.cpp:
        (WebCore::FontPlatformDataCacheKey::operator==): Use ASCIICaseInsensitiveHash.
        (WebCore::FontPlatformDataCacheKeyHash::hash): Use ASCIICaseInsensitiveHash.

        * platform/graphics/FontCascade.cpp:
        (WebCore::keysMatch): Rename from operator== since this operation is not
        equality. Changed to equalIgnoringASCIICase and did a little streamlining.
        (WebCore::makeFontCascadeCacheKey): Use reserveInitialCapacity for slightly
        better memory use.
        (WebCore::computeFontCascadeCacheHash): Use IntegerHasher to make computing
        a hash more efficient by eliminating the overhead of building a vector and
        even possible heap allocation and deallocation.
        (WebCore::retrieveOrAddCachedFonts): Use keysMatch instead of ==.

        * platform/graphics/cocoa/FontCacheCoreText.cpp: Use ASCIICaseInsensitiveHash
        for font family names. These names should use ASCII case insensitive matching;
        there is no need for non-ASCII case folding.

        * platform/network/HTTPHeaderMap.h: Use ASCIICaseInsensitiveHash for
        HTTP header field names. These names are all ASCII.

        * rendering/style/RenderStyle.cpp:
        (WebCore::computeFontHash): Use IntegerHasher to avoid allocating memory just
        to compute a hash. Use ASCIICaseInsensitiveHash.

2016-01-31  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Reduce PassRefPtr uses in dom - 5
        https://bugs.webkit.org/show_bug.cgi?id=153470

        Reviewed by Darin Adler.

        As a step to remove PassRefPtr, this patch reduces uses of PassRefPtr in WebCore/dom. 

        * dom/Document.cpp:
        (WebCore::Document::adoptNode):
        (WebCore::Document::implicitClose):
        (WebCore::Document::enqueuePopstateEvent):
        (WebCore::Document::setInputCursor):
        * dom/Document.h:
        * dom/DocumentMarker.cpp:
        (WebCore::DocumentMarkerTextMatch::instanceFor):
        * dom/Event.cpp:
        (WebCore::Event::setUnderlyingEvent):
        * dom/Event.h:
        * dom/EventDispatcher.h:
        * dom/GenericEventQueue.cpp:
        (WebCore::GenericEventQueue::enqueueEvent):
        * dom/GenericEventQueue.h:
        * dom/MouseEvent.cpp:
        (WebCore::SimulatedMouseEvent::SimulatedMouseEvent):
        * dom/Node.cpp:
        (WebCore::Node::dispatchDOMActivateEvent):
        * dom/NodeIterator.h:
        * dom/PendingScript.h:
        * dom/PopStateEvent.cpp:
        (WebCore::PopStateEvent::create):
        * dom/PopStateEvent.h:
        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::setCSSStyleSheet): Deleted. Nobody calls this function.
        * dom/ProcessingInstruction.h:
        * dom/RangeBoundaryPoint.h:
        (WebCore::RangeBoundaryPoint::RangeBoundaryPoint):
        * dom/TextEvent.cpp:
        (WebCore::TextEvent::createForFragmentPaste):
        (WebCore::TextEvent::TextEvent):
        * dom/TextEvent.h:
        * editing/Editor.cpp:
        (WebCore::Editor::pasteAsFragment):
        * editing/Editor.h:
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::replaceNodeFromPasteboard):

2016-01-31  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Use std::make_unique<> when creating an unique_ptr object.
        https://bugs.webkit.org/show_bug.cgi?id=153705

        Reviewed by Darin Adler.

        Some factory functions have used std::unique_ptr<> for creating an unique_ptr object.
        It is wrong. We have to use std::make_unique<>.

        * Modules/mediasession/WebMediaSessionManager.cpp:
        (WebCore::WebMediaSessionManager::mockPicker):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::internalStart):
        * platform/cf/RunLoopObserver.cpp:
        (WebCore::RunLoopObserver::create): Deleted.
        * platform/cf/RunLoopObserver.h:
        (WebCore::RunLoopObserver::RunLoopObserver):
        * platform/graphics/avfoundation/WebMediaSessionManagerMac.cpp:
        (WebCore::WebMediaSessionManagerMac::platformPicker):
        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.h:
        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
        (WebCore::MediaPlaybackTargetPickerMac::create): Deleted.
        * platform/graphics/ca/cocoa/LayerFlushSchedulerMac.cpp:
        (WebCore::LayerFlushScheduler::LayerFlushScheduler):
        * platform/mock/MediaPlaybackTargetPickerMock.cpp:
        (WebCore::MediaPlaybackTargetPickerMock::create): Deleted.
        * platform/mock/MediaPlaybackTargetPickerMock.h:
        * rendering/FloatingObjects.cpp:
        (WebCore::FloatingObject::copyToNewContainer):

2016-01-30  Michael Catanzaro  <mcatanzaro@igalia.com>

        Unreviewed, fix GTK debug build after r195899

        * dom/EventContext.h:
        (isType):

2016-01-30  Jeremy Huddleston Sequoia  <jeremyhu@apple.com>

        Add missing include to fix building debug configuration
        https://bugs.webkit.org/show_bug.cgi?id=153719

        Reviewed by Darin Adler.

        No new tests.

        * rendering/RenderObject.cpp:

2016-01-30  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195911.
        https://bugs.webkit.org/show_bug.cgi?id=153723

        Caused frequent assertion failures on bots (Requested by ap on
        #webkit).

        Reverted changeset:

        "Replace CaseFoldingHash with ASCIICaseInsensitiveHash"
        https://bugs.webkit.org/show_bug.cgi?id=153639
        http://trac.webkit.org/changeset/195911

2016-01-30  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195799 and r195828.
        https://bugs.webkit.org/show_bug.cgi?id=153722

        Caused assertion failures, severely affecting EWS (Requested
        by ap on #webkit).

        Reverted changesets:

        "Web Inspector: InspectorTimelineAgent doesn't need to
        recompile functions because it now uses the sampling profiler"
        https://bugs.webkit.org/show_bug.cgi?id=153500
        http://trac.webkit.org/changeset/195799

        "Attempt to fix the Windows build after r195799"
        http://trac.webkit.org/changeset/195828

2016-01-30  Brady Eidson  <beidson@apple.com>

        Modern IDB: Some tests crash with specific odd database names.
        https://bugs.webkit.org/show_bug.cgi?id=153688

        Reviewed by Darin Adler.

        No new tests (2 existing tests now pass).

        * platform/FileSystem.cpp:
        (WebCore::shouldEscapeUChar): Return true for some surrogate-pair situations.
        (WebCore::encodeForFileName): Pass along the previous and next characters, as well,
          and do a two byte escaping for some characters.

2016-01-30  Eric Carlson  <eric.carlson@apple.com>

        More than one audio and/or text track sometimes selected in media controls menu
        https://bugs.webkit.org/show_bug.cgi?id=153664

        Use an <img> element for the track menu item checkmark instead of a background image and
        the ::before selector.

        Reviewed by Jer Noble.

        Test: media/controls/track-menu.html

        * Modules/mediacontrols/mediaControlsApple.css:
        (audio::-webkit-media-controls-closed-captions-container li:hover):
        (audio::-webkit-media-controls-closed-captions-container li .checkmark-container):
        (audio::-webkit-media-controls-closed-captions-container li.selected .checkmark-container):
        (audio::-webkit-media-controls-closed-captions-container li.selected:hover .checkmark-container):
        (audio::-webkit-media-controls-closed-captions-container li.selected::before): Deleted.
        (audio::-webkit-media-controls-closed-captions-container li.selected:hover::before): Deleted.
        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.buildCaptionMenu):
        (Controller.prototype.):
        (Controller.prototype.getCurrentControlsStatus):

2016-01-30  Darin Adler  <darin@apple.com>

        Replace CaseFoldingHash with ASCIICaseInsensitiveHash
        https://bugs.webkit.org/show_bug.cgi?id=153639

        Reviewed by Filip Pizlo.

        * Modules/webdatabase/DatabaseAuthorizer.h: Use ASCIICaseInsensitiveHash
        for whitelisted functions. Function names are all ASCII.

        * accessibility/AccessibilityObject.cpp: Use ASCIICaseInsensitiveHash
        for ARIA roles. ARIA roles are all ASCII.

        * crypto/CryptoAlgorithmRegistry.h: Use ASCIICaseInsensitiveHash for
        crypto algorithm names. Algorithm names are all ASCII.

        * css/CSSFontSelector.cpp:
        (WebCore::registerLocalFontFacesForFamily): Use ASCIICaseInsensitiveHash
        for font faces. Face names should use ASCII case insensitive matching;
        there is no need for non-ASCII case folding.
        * css/CSSFontSelector.h: Ditto.

        * dom/DOMImplementation.cpp: Use ASCIICaseInsensitiveHash for the
        FeatureSet. The features are all ASCII.

        * dom/Document.h: Use ASCIICaseInsensitiveHash for the access key
        map. Access keys are all ASCII.

        * dom/ScriptElement.cpp:
        (WebCore::isLegacySupportedJavaScriptLanguage): Use ASCIICaseInsensitiveHash
        for the language set. These strings are all ASCII.

        * editing/EditorCommand.cpp: Use ASCIICaseInsensitiveHash for editor
        command names. These names are all ASCII.

        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::parametersForPlugin): Use ASCIICaseInsensitiveHash
        for parameter names. These names are all ASCII.

        * html/InputType.cpp: Use ASCIICaseInsensitiveHash for the input types.
        The input types are all ASCII.

        * loader/CrossOriginAccessControl.h: Use ASCIICaseInsensitiveHash for
        HTTP header field names. These names are all ASCII.
        * loader/CrossOriginPreflightResultCache.h: Ditto.

        * loader/archive/ArchiveFactory.cpp: Use ASCIICaseInsensitiveHash for
        MIME types. MIME types are all ASCII.
        * platform/MIMETypeRegistry.cpp:
        (WebCore::initializeSupportedImageMIMETypes): Ditto.

        * platform/SchemeRegistry.h: Use ASCIICaseInsensitiveHas for URL schemes.
        URL schemes are all ASCII.
        * platform/URL.cpp: Ditto.

        * platform/graphics/FontCache.cpp: Reworked FontPlatformDataCacheKey struct:
        Made it a conventional struct with non-prefixed data members names. Removed
        the "==" operator since it was appropriate for hash table lookup but wasn't
        a true equality operator. Tightened the implementations of the constructors.
        (WebCore::FontPlatformDataCacheKeyHash::hash): Use ASCIICaseInsensitiveHash.
        (WebCore::FontPlatformDataCacheKeyHash::equal): Do the equality check here,
        not using the == operator. And use equalIgnoringASCIICase.
        (WebCore::FontPlatformDataCacheKeyTraits::isEmptyValue): Added this entire
        traits struct so we check empty values in a more efficient way.
        (WebCore::FontCache::getCachedFontPlatformData): Added comments and tweaked
        style in this function.

        * platform/graphics/FontCascade.cpp:
        (WebCore::keysMatch): Rename from operator== since this operation is not
        equality. Changed to equalIgnoringASCIICase and did a little streamlining.
        (WebCore::makeFontCascadeCacheKey): Use reserveInitialCapacity for slightly
        better memory use.
        (WebCore::computeFontCascadeCacheHash): Use IntegerHasher to make computing
        a hash more efficient by eliminating the overhead of building a vector and
        even possible heap allocation and deallocation.
        (WebCore::retrieveOrAddCachedFonts): Use keysMatch instead of ==.

        * platform/graphics/cocoa/FontCacheCoreText.cpp: Use ASCIICaseInsensitiveHash
        for font family names. These names should use ASCII case insensitive matching;
        there is no need for non-ASCII case folding.

        * platform/network/HTTPHeaderMap.h: Use ASCIICaseInsensitiveHash for
        HTTP header field names. These names are all ASCII.

        * rendering/style/RenderStyle.cpp:
        (WebCore::computeFontHash): Use IntegerHasher to avoid allocating memory just
        to compute a hash. Use ASCIICaseInsensitiveHash.

2016-01-30  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r195871.

        Caused several layout tests to time out

        Reverted changeset:

        "Tab suspension code shouldn't use page cache cacheability
        logic"
        https://bugs.webkit.org/show_bug.cgi?id=153680
        http://trac.webkit.org/changeset/195871

2016-01-30  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rebaseline bindings tests after r195904.

        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::JSTestCustomNamedGetter::getOwnPropertySlot):
        (WebCore::jsTestCustomNamedGetterConstructor):
        (WebCore::setJSTestCustomNamedGetterConstructor):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::JSTestEventTarget::getOwnPropertySlot):
        (WebCore::jsTestEventTargetConstructor):
        (WebCore::setJSTestEventTargetConstructor):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::JSTestOverrideBuiltins::getOwnPropertySlot):
        (WebCore::jsTestOverrideBuiltinsConstructor):
        (WebCore::setJSTestOverrideBuiltinsConstructor):

2016-01-30  Chris Dumez  <cdumez@apple.com>

        [JS Bindings] prototype.constructor should be writable
        https://bugs.webkit.org/show_bug.cgi?id=149412
        <rdar://problem/22545096>

        Reviewed by Darin Adler.

        prototype.constructor should have the following properties:
        { [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }

        as per the Web IDL specification:
        https://heycam.github.io/webidl/#interface-prototype-object

        In WebKit, it is currently not writable. It is writable in Firefox.

        This patch was first landed in r190085 but was rolled out for causing
        crashes: <rdar://problem/22825602>. The issue was that even though we
        marked constructor as writable, we failed to generate a setter for it.
        This patch addresses the issue and the crash in <rdar://problem/22825602>
        no longer occurs after this change. A regression test is also added for
        this crash.

        Tests:
        fast/dom/HTMLDocument/constructor-setter-crash.html
        fast/dom/prototype-constructor-setter.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateAttributesHashTable):
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::setJSTestActiveDOMObjectConstructor):
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::setJSTestClassWithJSBuiltinConstructorConstructor):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::setJSTestCustomConstructorWithNoInterfaceObjectConstructor):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::setJSTestCustomNamedGetterConstructor):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::setJSTestEventConstructorConstructor):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::setJSTestEventTargetConstructor):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::setJSTestExceptionConstructor):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::setJSTestGenerateIsReachableConstructor):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::setJSTestInterfaceConstructor):
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        (WebCore::setJSTestJSBuiltinConstructorConstructor):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::setJSTestMediaQueryListListenerConstructor):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::setJSTestNamedConstructorConstructor):
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::setJSTestNodeConstructor):
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::setJSTestNondeterministicConstructor):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjConstructor):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::setJSTestOverloadedConstructorsConstructor):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::setJSTestOverrideBuiltinsConstructor):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::setJSTestSerializedScriptValueInterfaceConstructor):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::setJSTestTypedefsConstructor):
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::setJSattributeConstructor):
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::setJSreadonlyConstructor):
        * page/DOMWindow.idl:

2016-01-30  Chris Dumez  <cdumez@apple.com>

        Move more 'constructor' properties to the prototype
        https://bugs.webkit.org/show_bug.cgi?id=153667

        Reviewed by Darin Adler.

        Move more 'constructor' properties to the prototype. In particular, we
        used to keep the 'constructor' on the instance for interfaces that have
        an indexed / named property getter because our getOwnPropertySlot()
        implementation used to be wrong for such interfaces.

        However, getOwnPropertySlot() should be correct after r188590 so we
        should now be able to move the 'constructor' up to the prototype for
        these interfaces, as per the specification:
        http://heycam.github.io/webidl/#interface-prototype-object

        No new tests, already covered by existing tests.

        * bindings/js/JSPluginElementFunctions.h:
        (WebCore::pluginElementCustomGetOwnPropertySlot):
        Add a null check for staticPropHashTable. It is now null because this
        type no longer has any property on the instance now that 'constructor'
        is on the prototype.

        * bindings/scripts/CodeGeneratorJS.pm:
        (ConstructorShouldBeOnInstance):

2016-01-29  Ada Chan  <adachan@apple.com>

        Enable VIDEO_PRESENTATION_MODE only in Debug and Release builds on Mac
        https://bugs.webkit.org/show_bug.cgi?id=153665

        Reviewed by Dan Bernstein.

        * Configurations/FeatureDefines.xcconfig:

2016-01-30  David Kilzer  <ddkilzer@apple.com>

        [iOS] WebKit1 apps crash in ___ZN7WebCore16DiskCacheMonitorC2ERKNS_15ResourceRequestENS_9SessionIDEPK20_CFCachedURLResponse_block_invoke1
        <http://webkit.org/b/153710>
        <rdar://problem/23116706>

        Reviewed by Darin Adler.

        * loader/cocoa/DiskCacheMonitorCocoa.mm:
        (WebCore::DiskCacheMonitor::DiskCacheMonitor):
        - Fix race condition on iOS WebKit1 clients by calling the block
          to cancel the DiskCacheMonitor on the WebThread, which is the
          same thread where the CFCachedURLResponseCallBackBlock is
          called.
        - Removed whitespace to adhere to style.

2016-01-30  Ryosuke Niwa  <rniwa@webkit.org>

        TouchList should be retargeted
        https://bugs.webkit.org/show_bug.cgi?id=149592

        Reviewed by Antti Koivisto.

        Retarget touch target's using the same algorithm as the one used for related targets instead of
        EventRelatedNodeResolver which is removed in this patch.

        Also enable the retargeting on iOS.

        Test: fast/shadow-dom/touch-event-ios.html

        * dom/EventContext.cpp:
        (WebCore::TouchEventContext::TouchEventContext):
        (WebCore::TouchEventContext::handleLocalEvents):
        (WebCore::TouchEventContext::checkReachability):
        * dom/EventContext.h:
        (WebCore::toTouchEventContext):
        (WebCore::EventContext::isUnreachableNode):
        * dom/EventDispatcher.cpp:
        (WebCore::EventRelatedNodeResolver): Deleted.
        (WebCore::EventPath::EventPath):
        (WebCore::EventDispatcher::dispatchEvent): 
        (WebCore::addRelatedNodeResolversForTouchList): Deleted.
        (WebCore::EventPath::updateTouchLists): Deleted.
        (WebCore::EventPath::setRelatedTarget): Removed superfluous UNUSED_PARAM since the argument is always used.
        (WebCore::EventPath::retargetTouch): Extracted from updateTouchLists/setRelatedTarget. Clones Touch object
        with the new target for each event context just like related targets.
        (WebCore::EventPath::retargetTouchLists): Renamed from updateTouchLists. Calls retargetTouch on each Touch
        object in each TouchList.
        * dom/TouchEvent.h:

2016-01-30 Dave Hyatt  <hyatt@apple.com>

        Support break-after, break-before and break-inside.
        https://bugs.webkit.org/show_bug.cgi?id=148814

        Reviewed by Dean Jackson.

        New tests added in printing/, fast/multicol/, and fast/regions.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::convertToPageBreak):
        (WebCore::convertToColumnBreak):
        (WebCore::convertToRegionBreak):
        For backwards compatibility, keep support for all the old properties in
        computed style. This means we have to convert the break-* property values
        into keywords that make sense for the legacy properties. This mainly
        involves mapping "page", "column", "region" to "always" (similar rule for
        the avoid-* versions as well).

        (WebCore::ComputedStyleExtractor::propertyValue):
        Add support for the three new break-* properties.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        Add support for the new break properties.

        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::operator BreakBetween):
        (WebCore::CSSPrimitiveValue::operator BreakInside):
        Add converters for the new BreakBetween and BreakInside enums. Remove
        the EPageBreak enum, since it is no longer used.

        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        Add the new properties and the new values supported by the properties
        to the keywords lists.

        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertFontSynthesis):
        (WebCore::StyleBuilderConverter::convertPageBreakBetween):
        (WebCore::StyleBuilderConverter::convertPageBreakInside):
        (WebCore::StyleBuilderConverter::convertColumnBreakBetween):
        (WebCore::StyleBuilderConverter::convertColumnBreakInside):
        (WebCore::StyleBuilderConverter::convertRegionBreakBetween):
        (WebCore::StyleBuilderConverter::convertRegionBreakInside):
        In order to map the legacy properties into the new break-* values
        we have custom converter functions.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintChild):
        (WebCore::RenderBlock::childBoxIsUnsplittableForFragmentation):
        (WebCore::RenderBlock::computeRegionRangeForBoxChild):
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::applyBeforeBreak):
        (WebCore::RenderBlockFlow::applyAfterBreak):
        Patch the block code to check the correct new break-* constants. For
        avoidance, this means checking both the general avoid value and the
        specific value (e.g., avoid-page). In place of "always", we check
        the specific value (e.g., column) and then for page specifically, we
        also treat "left", "right", "recto" and "verso" as "always break" for now.

        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::changeRequiresLayout):
        Make sure changes to the break properties trigger relayout.

        * rendering/style/RenderStyle.h:
        Add getters and setters for the break-* properties and remove all
        occurrences of the legacy page, column and region values from the RenderStyle.

        * rendering/style/RenderStyleConstants.cpp:
        (WebCore::alwaysPageBreak):
        We have a helper function here for mapping several constant values to "page".

        * rendering/style/RenderStyleConstants.h:
        Definitions of the new BreakBetween and BreakInside enums.

        * rendering/style/StyleMultiColData.cpp:
        (WebCore::StyleMultiColData::StyleMultiColData):
        (WebCore::StyleMultiColData::operator==):
        * rendering/style/StyleMultiColData.h:
        Remove the column-specific break data.

        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        Remove the region-specific break data and replace it with generic break
        data that is now used by all three pagination models.

2016-01-29  Per Arne Vollan  <peavo@outlook.com>

        [Win] Fix compile error.
        https://bugs.webkit.org/show_bug.cgi?id=153646

        Reviewed by Darin Adler.

        * platform/text/win/LocaleWin.cpp:
        (WebCore::LCIDFromLocaleInternal):

2016-01-29  Antti Koivisto  <antti@apple.com>

        Tab suspension code shouldn't use page cache cacheability logic
        https://bugs.webkit.org/show_bug.cgi?id=153680

        Reviewed by Andreas Kling.

        Most of PageCache::canCache() is unnecessary for tab suspension.

        Also improve robustness.

        * page/Page.cpp:
        (WebCore::Page::setPageActivityState):
        (WebCore::Page::setIsVisible):
        (WebCore::Page::setIsVisibleInternal):
        (WebCore::Page::setIsPrerender):
        (WebCore::Page::canTabSuspend):

            Include visibility test here.

            Instead of calling PageCache::canCache() just check for each frame that
            - that the document is loaded
            - that active DOM objects allow suspension

        (WebCore::Page::setIsTabSuspended):
        (WebCore::Page::setTabSuspensionEnabled):
        (WebCore::Page::updateTabSuspensionState):

            Refactor for robustness.

        (WebCore::Page::tabSuspensionTimerFired):

            Call canTabSuspend, the result might have changed.

        (WebCore::Page::scheduleTabSuspension): Deleted.
        * page/Page.h:

2016-01-29  Ryosuke Niwa  <rniwa@webkit.org>

        fast/shadow-dom/Element-interface-attachShadow.html fails on iOS
        https://bugs.webkit.org/show_bug.cgi?id=153681

        Reviewed by Antti Koivisto.

        The bug was caused by canHaveUserAgentShadowRoot() returning false on a meter element since it's disabled on iOS.
        Override HTMLUnknownElement's canHaveUserAgentShadowRoot to return false for compatbility on iOS.

        * html/HTMLUnknownElement.h:
        (WebCore::HTMLUnknownElement::canHaveUserAgentShadowRoot):

2016-01-29  Brady Eidson  <beidson@apple.com>

        Modern IDB: Getting records for key ranges with null keys aren't properly handled in SQLite backend
        https://bugs.webkit.org/show_bug.cgi?id=153666

        Reviewed by Tim Horton.

        No new tests (Two failing tests now pass).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::getRecord):

2016-01-29  Simon Fraser  <simon.fraser@apple.com>

        image-rendering: -webkit-optimize-contrast not working for background images
        https://bugs.webkit.org/show_bug.cgi?id=97991

        Reviewed by Darin Adler.
        
        Don't equate "pixelated" and "crisp-edges" values for image-rendering with low
        quality scaling; they should map to InterpolationNone, not InterpolationLow.
        
        To support this change ImageQualityController to return a InterpolationQuality
        from the renamed chooseInterpolationQuality(). If the returned value is not
        InterpolationDefault, set the GraphicsContext image interpolation when drawing
        images and image buffers.
        
        Remove the redundant "useLowQualityScale" from 

        Test: fast/images/image-rendering-interpolation.html

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::paint):
        * html/HTMLCanvasElement.h:
        * page/DragController.cpp:
        (WebCore::DragController::doImageDrag):
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::drawImage):
        (WebCore::GraphicsContext::drawTiledImage):
        (WebCore::GraphicsContext::drawImageBuffer):
        (WebCore::GraphicsContext::drawConsumingImageBuffer):
        (WebCore::InterpolationQualityMaintainer::InterpolationQualityMaintainer): Deleted.
        (WebCore::InterpolationQualityMaintainer::~InterpolationQualityMaintainer): Deleted.
        * platform/graphics/GraphicsContext.h:
        (WebCore::ImagePaintingOptions::ImagePaintingOptions):
        (WebCore::ImagePaintingOptions::usesDefaultInterpolation):
        (WebCore::InterpolationQualityMaintainer::InterpolationQualityMaintainer):
        (WebCore::InterpolationQualityMaintainer::~InterpolationQualityMaintainer):
        * platform/graphics/GraphicsTypes.h:
        * platform/graphics/ImageBuffer.h:
        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::ImageBuffer::drawConsuming):
        (WebCore::ImageBuffer::draw):
        * rendering/ImageQualityController.cpp:
        (WebCore::ImageQualityController::interpolationQualityFromStyle):
        (WebCore::ImageQualityController::chooseInterpolationQuality):
        (WebCore::ImageQualityController::ImageQualityController): Deleted.
        (WebCore::ImageQualityController::shouldPaintAtLowQuality): Deleted.
        * rendering/ImageQualityController.h:
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::chooseInterpolationQuality):
        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
        (WebCore::RenderBoxModelObject::shouldPaintAtLowQuality): Deleted.
        * rendering/RenderBoxModelObject.h:
        * rendering/RenderEmbeddedObject.cpp:
        (WebCore::RenderEmbeddedObject::paintSnapshotImage):
        * rendering/RenderHTMLCanvas.cpp:
        (WebCore::RenderHTMLCanvas::paintReplaced):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::paintIntoRect):
        * rendering/RenderSnapshottedPlugIn.cpp:
        (WebCore::RenderSnapshottedPlugIn::paintSnapshot):
        * rendering/style/RenderStyle.h:

2016-01-29  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/modern/index-3.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=153661

        Reviewed by Tim Horton.

        No new tests (1 failing test now passes, others get closer).

        When indexing a new record fails due to uniqueness constraints, remove all traces of the record.

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateAllIndexesForAddRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):

2016-01-29  Brent Fulgham  <bfulgham@apple.com>

        [WebGL] Check vertex array bounds before permitting a glDrawArrays to execute
        https://bugs.webkit.org/show_bug.cgi?id=153643
        <rdar://problem/23424456>

        Reviewed by Dean Jackson.

        Tested by fast/canvas/webgl/webgl-drawarrays-crash.html.

        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::validateDrawArrays): Make sure that we have at
        least one buffer bound to a program if a drawArray call with a non-zero range of
        requested data is being made.
        (WebCore::WebGLRenderingContextBase::validateDrawElements): Drive-by formatting fix.

2016-01-29  Brady Eidson  <beidson@apple.com>

        Modern IDB: Fix logging that overwhelms python with strings of excessive length.
        https://bugs.webkit.org/show_bug.cgi?id=153652

        Reviewed by Tim Horton.

        No new tests (Two skipped tests now pass).

        * Modules/indexeddb/IDBKeyData.cpp:
        (WebCore::IDBKeyData::loggingString): Limit the length of the string.
        
        * Modules/indexeddb/IDBKeyRangeData.cpp:
        (WebCore::IDBKeyRangeData::loggingString): Limit the length of the string.

2016-01-29  Jer Noble  <jer.noble@apple.com>

        Unreviewed Windows build fix; one more ResourceLoaderOptions call site which needs to
        be updated after adding the CachingPolicy parameter.

        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
        (WebCore::WebCoreAVCFResourceLoader::startLoading):

2016-01-29  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Implement overlay scrollbars
        https://bugs.webkit.org/show_bug.cgi?id=153405

        Reviewed by Michael Catanzaro.

        Add support for overlay scrollbars to GTK+ platform following the
        same style and behavior than GtkScrolledWindow. They are only
        available for GTK+ >= 3.19, but honoring the GTK_OVERLAY_SCROLLING
        environment variable, so they could be disable at run time, except
        when threaded compositor is enabled. A new ScrollAnimator class
        has been added for GTK+ to implement overlay scrollbars and still
        allow smooth scrolling when available.

        * PlatformGTK.cmake: Add ScrollAnimatorGtk and stop building ScrollAnimatorSmooth.
        * platform/ScrollAnimator.h:
        (WebCore::ScrollAnimator::ScrollAnimator::mouseEnteredContentArea):
        Remove const to allow the ScrollAnimator to be updated.
        (WebCore::ScrollAnimator::ScrollAnimator::mouseExitedContentArea): Ditto.
        (WebCore::ScrollAnimator::ScrollAnimator::mouseMovedInContentArea): Ditto.
        (WebCore::ScrollAnimator::ScrollAnimator::contentAreaDidShow): Ditto.
        (WebCore::ScrollAnimator::ScrollAnimator::contentAreaDidHide): Ditto.
        * platform/Scrollbar.h:
        (WebCore::Scrollbar::opacity): Get scrollbar opacity.
        (WebCore::Scrollbar::setOpacity): Set scrollbar opacity.
        * platform/gtk/ScrollAnimatorGtk.cpp: Added.
        (WebCore::ScrollAnimator::create): Create a ScrollAnimatorGtk.
        (WebCore::ScrollAnimatorGtk::ScrollAnimatorGtk):
        (WebCore::ScrollAnimatorGtk::~ScrollAnimatorGtk):
        (WebCore::ScrollAnimatorGtk::ensureSmoothScrollingAnimation):
        Initialize the ScrollAnimationSmooth if it doesn't exist.
        (WebCore::ScrollAnimatorGtk::scroll): Ensure we have a
        ScrollAnimationSmooth if smooth scrolling is enabled. This also
        fixes the problem of having to reload the page after changing the
        smooth scrolling setting.
        (WebCore::ScrollAnimatorGtk::scrollToOffsetWithoutAnimation):
        (WebCore::ScrollAnimatorGtk::willEndLiveResize):
        (WebCore::ScrollAnimatorGtk::didAddVerticalScrollbar): Register
        the scrollbar if it's an overlay scrollbar and make it visible
        without animating it. Start the hide animation.
        (WebCore::ScrollAnimatorGtk::didAddHorizontalScrollbar): Ditto.
        (WebCore::ScrollAnimatorGtk::willRemoveVerticalScrollbar):
        Unregister the scrollbar if it was registered and resrt the
        animation state if it was the only scrollbar.
        (WebCore::ScrollAnimatorGtk::willRemoveHorizontalScrollbar): Ditto.
        (WebCore::ScrollAnimatorGtk::updateOverlayScrollbarsOpacity): Update
        the scrollbars opacity and invalidate the indicator.
        (WebCore::easeOutCubic):
        (WebCore::ScrollAnimatorGtk::overlayScrollbarAnimationTimerFired):
        Update the scrollbars opacity and schedule a next frame if the
        animation didn't finish or start the hide animation otherwhise.
        (WebCore::ScrollAnimatorGtk::showOverlayScrollbars): Start the
        fade animation to show the scrollbars if needed.
        (WebCore::ScrollAnimatorGtk::hideOverlayScrollbars): Start the
        dafe animation to hide the scrollbars if needed.
        (WebCore::ScrollAnimatorGtk::mouseEnteredContentArea): Call
        showOverlayScrollbars().
        (WebCore::ScrollAnimatorGtk::mouseExitedContentArea): Call
        hideOverlayScrollbars().
        (WebCore::ScrollAnimatorGtk::mouseMovedInContentArea): Call
        showOverlayScrollbars().
        (WebCore::ScrollAnimatorGtk::contentAreaDidShow): Ditto.
        (WebCore::ScrollAnimatorGtk::contentAreaDidHide): Hide the
        scrollbars without animations.
        (WebCore::ScrollAnimatorGtk::notifyContentAreaScrolled): Call
        showOverlayScrollbars().
        (WebCore::ScrollAnimatorGtk::lockOverlayScrollbarStateToHidden):
        Update the lock state and hide or show the scrollbars when locked
        or unlocked.
        * platform/gtk/ScrollAnimatorGtk.h: Added.
        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::backButtonRect): Pass
        StyleContextMode to getOrCreateStyleContext depending on the
        painting parameter.
        (WebCore::ScrollbarThemeGtk::forwardButtonRect): Ditto.
        (WebCore::ScrollbarThemeGtk::trackRect): Ditto.
        (WebCore::ScrollbarThemeGtk::getOrCreateStyleContext): Add
        StyleContextMode parameter to add the hovering class
        unconditionally when using overlay scrollbars in layout mode. In
        paint mode we add the hovering clas only when the scrollbar is
        hovered. This way we always claim the size of the scrollbar when
        hovered to be able to show the full scrollbar when the mouse is
        close enough to the indicator.
        (WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk): Initialize
        m_usesOverlayScrollbars.
        (WebCore::ScrollbarThemeGtk::thumbRect): Pass the scrollbar to
        getOrCreateStyleContext().
        (WebCore::adjustRectAccordingToMargin): Fix the top margin.
        (WebCore::ScrollbarThemeGtk::paintTrackBackground): Pass the
        scrollbar and paint mode to getOrCreateStyleContext().
        (WebCore::ScrollbarThemeGtk::paintScrollbarBackground): Ditto.
        (WebCore::ScrollbarThemeGtk::paintThumb): Adjust the thumb
        rectangle when overlay scrollbar is not hovered to its current
        size, since we always claim the size of the scrollbar in hovered
        mode.
        (WebCore::ScrollbarThemeGtk::paintButton): Pass the scrollbar and
        paint mode to getOrCreateStyleContext().
        (WebCore::ScrollbarThemeGtk::paint): Take the scrollbar opacity
        into account when rendering overlay scrollbars as indicators. Also
        get the scrollbar opacity from the GTK+ theme and use a
        transparency group when the global opacity is not full opaque.
        (WebCore::ScrollbarThemeGtk::buttonSize): Pass the scrollbar to
        getOrCreateStyleContext().
        * platform/gtk/ScrollbarThemeGtk.h:
        * platform/mac/ScrollAnimatorMac.h:
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::mouseEnteredContentArea):
        (WebCore::ScrollAnimatorMac::mouseExitedContentArea):
        (WebCore::ScrollAnimatorMac::mouseMovedInContentArea):
        (WebCore::ScrollAnimatorMac::contentAreaDidShow):
        (WebCore::ScrollAnimatorMac::contentAreaDidHide):

2016-01-29  ChangSeok Oh  <changseok.oh@collabora.com>

        [GStreamer] built-in media player doesn't update
        https://bugs.webkit.org/show_bug.cgi?id=151816

        Reviewed by Xabier Rodriguez-Calvar.

        The timeline of audio controls in media document is not properly updated since it is assumed
        that the controls are hidden as soon as playing. However, such full page audio always has
        opacity : 1 declared by video:-webkit-full-page-media::-webkit-media-controls-panel.no-video.
        i.e. it is not actually hidden. We can fix this by simply returning false for no-video media
        in controlsAreHidden();

        Test: media/audio-controls-timeline-in-media-document.html

        * Modules/mediacontrols/mediaControlsBase.js:
        (Controller.prototype.controlsAreAlwaysVisible):
        (Controller.prototype.controlsAreHidden):

2016-01-29  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Store lines instead of tracks in GridResolvedPosition
        https://bugs.webkit.org/show_bug.cgi?id=153592

        Reviewed by Sergio Villar Senin.

        Due to the new feature that allows to create implicit tracks before the
        explicit ones, we will need to use lines instead of tracks in the
        code to be able to implement it properly.

        This is just a first simple patch using lines instead of tracks in
        GridResolvedPosition. It modifies the code that was using it, as it was
        considering that the resolvedFinalPosition was a track index and
        not a line index.

        So if we've an item positioned like:
          grid-column: 2 / 5;
          grid-row: 1 / span 2;

        Before we were storing this information on the GridSpan:
        * columns:
          * resolvedInitialPosition: 1
          * resolvedFinalPosition:  3
        * rows:
          * resolvedInitialPosition: 0
          * resolvedFinalPosition:  1

        And now we're storing:
        * columns:
          * resolvedInitialPosition: 1
          * resolvedFinalPosition:  4
        * rows:
          * resolvedInitialPosition: 0
          * resolvedFinalPosition:  2

        No new tests, no change of behavior.

        * css/CSSGridTemplateAreasValue.cpp:
        (WebCore::stringForPosition):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateAreasRow):
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::createImplicitNamedGridLinesFromGridArea):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::GridIterator::nextEmptyGridArea):
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
        (WebCore::RenderGrid::ensureGridSize):
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        (WebCore::RenderGrid::gridAreaBreadthForChildIncludingAlignmentOffsets):
        (WebCore::RenderGrid::columnAxisOffsetForChild):
        (WebCore::RenderGrid::rowAxisOffsetForChild):
        * rendering/RenderGrid.h:
        * rendering/style/GridCoordinate.h:
        (WebCore::GridSpan::GridSpan):
        (WebCore::GridSpan::integerSpan):
        (WebCore::GridSpan::end):
        (WebCore::GridCoordinate::GridCoordinate):
        * rendering/style/GridResolvedPosition.cpp:
        (WebCore::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveGridPositionAgainstOppositePosition):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromStyle):
        (WebCore::resolveNamedGridLinePositionFromStyle): Deleted.
        * rendering/style/GridResolvedPosition.h:

2016-01-28  Brady Eidson  <beidson@apple.com>

        Modern IDB: SQLite backend mismanages key generator values.
        https://bugs.webkit.org/show_bug.cgi?id=153625

        Reviewed by Andy Estes.

        No new tests (Many failing tests pass, a few get closer).

        There's mixed assumptions about whether the value stored is the current value or the next value.

        Fixing those assumptions fixes tests.
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::generateKeyNumber): Store/retrieve the correct value.
        (WebCore::IDBServer::SQLiteIDBBackingStore::revertGeneratedKeyNumber): Ditto.
        (WebCore::IDBServer::SQLiteIDBBackingStore::maybeUpdateKeyGeneratorNumber): Ditto.

2016-01-28  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: InspectorTimelineAgent doesn't need to recompile functions because it now uses the sampling profiler
        https://bugs.webkit.org/show_bug.cgi?id=153500
        <rdar://problem/24352458>

        Reviewed by Timothy Hatcher.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::supportsLegacyProfiling):
        (WebCore::JSDOMWindowBase::supportsRichSourceInfo):
        (WebCore::JSDOMWindowBase::supportsProfiling): Deleted.
        * bindings/js/JSDOMWindowBase.h:
        * bindings/js/JSWorkerGlobalScopeBase.cpp:
        (WebCore::JSWorkerGlobalScopeBase::supportsLegacyProfiling):
        (WebCore::JSWorkerGlobalScopeBase::supportsProfiling): Deleted.
        * bindings/js/JSWorkerGlobalScopeBase.h:
        * inspector/InspectorController.h:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::legacyProfilerEnabled):
        (WebCore::InspectorController::setLegacyProfilerEnabled):
        Be more explicit about enabling legacy profiling.

        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::willDestroyFrontendAndBackend):
        (WebCore::InspectorTimelineAgent::didCreateFrontendAndBackend): Deleted.
        TimelineAgent doesn't need to recompile if using the sampling profiler.
        This breaks console.profile, but console.profile should move to using
        the sampling profiler as well.

        (WebCore::InspectorTimelineAgent::startFromConsole):
        (WebCore::InspectorTimelineAgent::stopFromConsole):
        (WebCore::startProfiling): Deleted.
        (WebCore::stopProfiling): Deleted.
        Inlined the use once static functions.

        * page/PageConsoleClient.cpp:
        (WebCore::PageConsoleClient::profile):
        (WebCore::PageConsoleClient::profileEnd):
        Added FIXMEs for improving console.profile and profileEnd.

        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::setLegacyJavaScriptProfilingEnabled):
        (WebCore::Internals::setJavaScriptProfilingEnabled): Deleted.
        * testing/Internals.h:
        * testing/Internals.idl:
        Be more explicit about enabling legacy profiling.

2016-01-28  Chris Dumez  <cdumez@apple.com>

        Move attributes to the prototype for List types / and types with indexed/named property getters
        https://bugs.webkit.org/show_bug.cgi?id=153599

        Reviewed by Darin Adler.

        Move attributes to the prototype for List types / and types with indexed/named property getters.

        We used to keep them on the instance because:
        1. Our GetOwnProperty lookup used to be in incorrect order for interfaces with indexed/named property getters.
        -> This was fixed recently and we now match the specification and other browsers.
        2. This used to regress performance when iterating over those list types
        -> Local testing seems to show that this is no longer a regression (tested Speedometer and various related Bindings PerformanceTests).

        No new tests, already covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (InterfaceRequiresAttributesOnInstance): Deleted.
        (AttributeShouldBeOnInstanceForCompatibility): Deleted.

2016-01-28  Antti Koivisto  <antti@apple.com>

        Tab suspension code hits asserts
             

        Reviewed by Chris Dumez.

        Enabling tab suspension and navigating around in a few tabs hits an assert in
        ScriptExecutionContext::suspendActiveDOMObject. This is because suspend/resume reasons don't pair properly

        * dom/Document.cpp:
        (WebCore::Document::documentWillBecomeInactive):
        (WebCore::Document::suspend):
        (WebCore::Document::resume):

            Provide the reason as argument.

        * dom/Document.h:
        * history/CachedFrame.cpp:
        (WebCore::CachedFrameBase::restore):

            No need to call resumeActiveDOMObjects/resumeScriptedAnimationControllerCallbacks explicitly as Document::resume does that.

        (WebCore::CachedFrame::CachedFrame):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):
        * page/Page.cpp:
        (WebCore::Page::canTabSuspend):
        (WebCore::Page::setIsTabSuspended):

2016-01-28  Brady Eidson  <beidson@apple.com>

        Modern IDB: Fix several more problems with object store changes during cursor iteration in SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153616

        Reviewed by Alex Christensen.

        No new tests (A few failing tests pass, a few get closer).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::clearObjectStore):
        
        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::resetAndRebindStatement):
        (WebCore::IDBServer::SQLiteIDBCursor::bindArguments):
        
        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::iterateCursor):

2016-01-28  Daniel Bates  <dabates@apple.com>

        Cleanup: Make DedicatedWorkerThread::create() an inline template method
        https://bugs.webkit.org/show_bug.cgi?id=153612

        Reviewed by Andy Estes.

        Make use of variadic template arguments and std::forward() to forward the arguments passed
        from DedicatedWorkerThread::create() to DedicatedWorkerThread::DedicatedWorkerThread(). This
        removes the need to duplicate code whenever we modify the parameter types or number of
        parameters taken by DedicatedWorkerThread::DedicatedWorkerThread().

        * workers/DedicatedWorkerThread.cpp:
        (WebCore::DedicatedWorkerThread::create): Deleted.
        * workers/DedicatedWorkerThread.h: Reorganized listing of member functions such that we
        group the creation/constructor and destructor functions.
        (WebCore::DedicatedWorkerThread::create): Modified to be an inline template with variadic
        parameters that std::forward()s its arguments to DedicatedWorkerThread::DedicatedWorkerThread().

2016-01-28  Brady Eidson  <beidson@apple.com>

        Modern IDB: SQLite backend doesn't handle mutation during cursor iteration.
        https://bugs.webkit.org/show_bug.cgi?id=153614

        Reviewed by Alex Christensen.

        No new tests (A few failing tests pass, a few get closer).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteRange): Call notifyCursorsOfChanges.
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord): Ditto.

        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
        (WebCore::IDBServer::SQLiteIDBCursor::~SQLiteIDBCursor):
        * Modules/indexeddb/server/SQLiteIDBCursor.h:

        * Modules/indexeddb/server/SQLiteIDBTransaction.cpp:
        (WebCore::IDBServer::SQLiteIDBTransaction::maybeOpenBackingStoreCursor): Remember these transient backing 
          store cursors so they can be notified of changes.
        (WebCore::IDBServer::SQLiteIDBTransaction::closeCursor): Handle removing the cursor from the right set.
        (WebCore::IDBServer::SQLiteIDBTransaction::notifyCursorsOfChanges):
        * Modules/indexeddb/server/SQLiteIDBTransaction.h:

2016-01-28  Brady Eidson  <beidson@apple.com>

        Modern IDB: SQLite backend doesn't support deleting ranges with more than one key.
        https://bugs.webkit.org/show_bug.cgi?id=153604

        Reviewed by Andy Estes.

        No new tests (A few failing tests pass, a few get closer).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteRange):

2016-01-28  Alex Christensen  <achristensen@webkit.org>

        Fix Windows build after r195774.

        * platform/network/ParsedContentRange.cpp:

2016-01-28  Anders Carlsson  <andersca@apple.com>

        Add an ArrayValue::get overload that returns a string
        https://bugs.webkit.org/show_bug.cgi?id=153613

        Reviewed by Tim Horton.

        * bindings/js/ArrayValue.cpp:
        (WebCore::ArrayValue::get):
        * bindings/js/ArrayValue.h:

2016-01-28  Chris Dumez  <cdumez@apple.com>

        EventHandler IDL attributes should be enumerable
        https://bugs.webkit.org/show_bug.cgi?id=153595

        Reviewed by Sam Weinig.

        Most of our EventHandler IDL attributes were marked as [NotEnumerable]
        but should not have been according to the specification:
        - https://html.spec.whatwg.org/#globaleventhandlers
        - https://html.spec.whatwg.org/#windoweventhandlers

        Firefox and Chrome behave according to the specification.
        This patch aligns our behavior.

        No new tests, already covered by existing tests.

        * dom/Document.idl:
        * dom/GlobalEventHandlers.idl:
        * page/WindowEventHandlers.idl:

2016-01-28  Jer Noble  <jer.noble@apple.com>

        Windows build fix; PRId64 formatting macro for int64_t undefined, so provide Windows-specific alternative.

        * platform/network/ParsedContentRange.cpp:

2016-01-28  ChangSeok Oh  <changseok.oh@collabora.com>

        [ThreadedCompositor] Fix flickers happening on video when entering/leaving fullscreen.
        https://bugs.webkit.org/show_bug.cgi?id=153585

        Reviewed by Michael Catanzaro.

        Video thumbnail flickers where threaded compositor is enabled. This is because
        a content buffer is not set to a target layer which changes before swapBuffer.
        This is a very rare case though, it happens where video size changes many times in a short period.

        * platform/graphics/texmap/TextureMapperPlatformLayerProxy.cpp:
        (WebCore::TextureMapperPlatformLayerProxy::activateOnCompositingThread):

2016-01-27  Jer Noble  <jer.noble@apple.com>

        Allow CachedResourceLoader clients to opt out of the MemoryCache.
        https://bugs.webkit.org/show_bug.cgi?id=153549

        Reviewed by Darin Adler.

        Add a flag to ResourceLoaderOptions which allow loader clients to opt out of having
        resources stored in the MemoryCache. 

        * loader/ResourceLoaderOptions.h:
        (WebCore::ResourceLoaderOptions::ResourceLoaderOptions):
        (WebCore::ResourceLoaderOptions::cachingPolicy):

        Existing clients will have to add the (default) AllowCaching flag when they create a
        ResourceLoaderOptions object.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource):
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::start):
        * loader/NetscapePlugInStreamLoader.cpp:
        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader):
        (WebCore::ResourceLoaderOptions::setCachingPolicy):
        * loader/icon/IconLoader.cpp:
        (WebCore::IconLoader::startLoading):
        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::startLoading):

        Every time the CachedResource or CachedResourceLoader accesses the MemoryCache, check
        to see whether the resource or the request have allowed caching before adding resources
        to, removing resources from, or sourcing resource data from the MemoryCache.

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::~CachedResource):
        (WebCore::CachedResource::failBeforeStarting):
        (WebCore::CachedResource::addClientToSet):
        (WebCore::CachedResource::removeClient):
        (WebCore::CachedResource::setDecodedSize):
        (WebCore::CachedResource::setEncodedSize):
        (WebCore::CachedResource::didAccessDecodedData):
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::allowsCaching):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet):
        (WebCore::CachedResourceLoader::requestResource):
        (WebCore::CachedResourceLoader::revalidateResource):
        (WebCore::CachedResourceLoader::loadResource):
        (WebCore::CachedResourceLoader::printPreloadStats):
        (WebCore::CachedResourceLoader::defaultCachedResourceOptions):
        * loader/cache/CachedResourceRequest.h:
        (WebCore::CachedResourceRequest::allowsCaching):

2016-01-28  Enrica Casucci  <enrica@apple.com>

        Should avoid navigation for some data detector urls.
        https://bugs.webkit.org/show_bug.cgi?id=153600

        Reviewed by Tim Horton.

        Adding helper function to decide whether the default action should be performed.

        * editing/cocoa/DataDetection.h:
        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::shouldCancelDefaultAction):

2016-01-28  Dave Hyatt  <hyatt@apple.com>

        Roll out r194555, as it introduced some bad regressions and was not
        correct.

        * rendering/RenderText.cpp:
        (WebCore::RenderText::computePreferredLogicalWidths):

2016-01-28  Brady Eidson  <beidson@apple.com>

        Modern IDB: Index uniqueness broken in the SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153596

        Reviewed by Alex Christensen.

        No new tests (Many failing tests now pass, others improve).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedHasIndexRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexKey):
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateOneIndexForAddRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateAllIndexesForAddRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateIndexesForAddRecord): Deleted.
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

2016-01-08  Jer Noble  <jer.noble@apple.com>

        Custom protocol loading through AVFoundation does not support byte-range requests.
        https://bugs.webkit.org/show_bug.cgi?id=152919
        <rdar://problem/23664657>

        Reviewed by Alex Christensen.

        Tests: http/tests/xmlhttprequest/blob-request-byte-range.html
               TestWebkitAPI/Tests/WebCore/ParsedContentRange.cpp

        When loading data through the AVAssetResourceLoaderDelegateProtocol, AVFoundation will issue
        requests for specific byte-ranges by adding a "Range:" HTTP header to the NSURLRequest it
        passes to the delegate.  WebCore ignores this header, loads the entire resource, and replies
        to the callback with the requested subset of the entire resource.

        For byte-range requests near the end of a resource, this is inefficient, as the entire
        resource up to, and including, the requested range must be loaded before any data can be
        returned. Explicitly handle byte-range requests by creating a CachedResourceRequest with the
        underlying NSURLRequest (which includes the "Range:" header) rather than just the request's
        URL. BlobResourceHandle must be modified to add the "Content-Range:" response header to the
        ResourceResponse. 

        To facilitate both generating and parsing the "Content-Range:" header, add a new
        ParsedContentRange class for use by ResourceResponse and its clients. This class provides
        methods both for parsing a "Content-Range" header value string, and for generating the
        header value from elemental values.

        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::startLoading):
        (WebCore::WebCoreAVFResourceLoader::responseReceived):
        (WebCore::WebCoreAVFResourceLoader::fulfillRequestWithResource):
        * platform/network/BlobResourceHandle.cpp:
        (WebCore::BlobResourceHandle::BlobResourceHandle):
        (WebCore::BlobResourceHandle::didGetSize):
        (WebCore::BlobResourceHandle::seek):
        (WebCore::BlobResourceHandle::notifyResponseOnSuccess):
        * platform/network/BlobResourceHandle.h:
        * platform/network/HTTPHeaderNames.in:
        * platform/network/ParsedContentRange.cpp: Added.
        (WebCore::areContentRangeValuesValid):
        (WebCore::parseContentRange):
        (WebCore::ParsedContentRange::ParsedContentRange):
        (WebCore::ParsedContentRange::headerValue):
        * platform/network/ParsedContentRange.h: Added.
        (WebCore::ParsedContentRange::ParsedContentRange):
        (WebCore::ParsedContentRange::isValid):
        (WebCore::ParsedContentRange::firstBytePosition):
        (WebCore::ParsedContentRange::lastBytePosition):
        (WebCore::ParsedContentRange::instanceLength):
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::updateHeaderParsedState):
        (WebCore::parseContentRangeInHeader):
        (WebCore::ResourceResponseBase::contentRange):
        * platform/network/ResourceResponseBase.h:
        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:

2016-01-28  Chris Dumez  <cdumez@apple.com>

        Storage interface's attributes / operations should be enumerable
        https://bugs.webkit.org/show_bug.cgi?id=153573

        Reviewed by Darin Adler.

        Storage interface's attributes / operations should be enumerable:
        - https://html.spec.whatwg.org/#the-storage-interface

        Firefox matches the specification.

        No new tests, already covered by existing test.

        * storage/Storage.idl:

2016-01-26  Ada Chan  <adachan@apple.com>

        Get WebVideoFullscreenManager and related classes to also compile for Mac platform
        with video presentation mode support.
        https://bugs.webkit.org/show_bug.cgi?id=153221

        Reviewed by Eric Carlson.

        No new tests, no actual behavior change with a stub implementation of WebVideoFullscreenInterfaceMac.

        * WebCore.xcodeproj/project.pbxproj:
        Add PlatformView.h, WebVideoFullscreenChangeObserver.h, and WebVideoFullscreenInterfaceMac.h.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::mediaPlayerEngineUpdated):
        (WebCore::HTMLMediaElement::shouldOverrideBackgroundPlaybackRestriction):
        * html/HTMLMediaElement.h:
        Enable the code that deals with the video fullscreen layer also for Mac platform with
        video presentation mode support.

        * platform/cocoa/PlatformView.h:
        Header file for declaring the view types for each Cocoa platform.

        * platform/cocoa/WebVideoFullscreenChangeObserver.h:
        (WebCore::WebVideoFullscreenChangeObserver::~WebVideoFullscreenChangeObserver):
        Interface declaration moved from WebVideoFullscreenInterfaceAVKit.h.

        * platform/cocoa/WebVideoFullscreenInterface.h:
        Stop guarding the declaration of WebVideoFullscreenInterface to be iOS specific. It is now
        enabled for iOS and Mac platform with video presentation mode support.

        * platform/cocoa/WebVideoFullscreenModel.h:
        * platform/cocoa/WebVideoFullscreenModelVideoElement.h:
        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
        Enable also for Mac platform with video presentation mode support.
        (WebVideoFullscreenModelVideoElement::setVideoFullscreenLayer):
        Set the video fullscreen layer's anchor point to (0, 0) since we are not changing the position of
        the video layer on Mac.

        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        Import WebVideoFullscreenChangeObserver.h now that the interface declaration has been moved to that file.
        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
        Move the declaration of WebVideoFullscreenChangeObserver to a separate header.
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        Import WebVideoFullscreenChangeObserver.h now that the interface declaration has been moved to that file.

        * platform/mac/WebVideoFullscreenInterfaceMac.h: Added.
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::~WebVideoFullscreenInterfaceMac):
        (WebCore::WebVideoFullscreenInterfaceMac::setWebVideoFullscreenModel):
        (WebCore::WebVideoFullscreenInterfaceMac::setWebVideoFullscreenChangeObserver):
        (WebCore::WebVideoFullscreenInterfaceMac::resetMediaState):
        (WebCore::WebVideoFullscreenInterfaceMac::setDuration):
        (WebCore::WebVideoFullscreenInterfaceMac::setCurrentTime):
        (WebCore::WebVideoFullscreenInterfaceMac::setBufferedTime):
        (WebCore::WebVideoFullscreenInterfaceMac::setRate):
        (WebCore::WebVideoFullscreenInterfaceMac::setVideoDimensions):
        (WebCore::WebVideoFullscreenInterfaceMac::setSeekableRanges):
        (WebCore::WebVideoFullscreenInterfaceMac::setCanPlayFastReverse):
        (WebCore::WebVideoFullscreenInterfaceMac::setAudioMediaSelectionOptions):
        (WebCore::WebVideoFullscreenInterfaceMac::setLegibleMediaSelectionOptions):
        (WebCore::WebVideoFullscreenInterfaceMac::setExternalPlayback):
        (WebCore::WebVideoFullscreenInterfaceMac::setWirelessVideoPlaybackDisabled):
        (WebCore::WebVideoFullscreenInterfaceMac::setupFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::enterFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::exitFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::cleanupFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::invalidate):
        (WebCore::WebVideoFullscreenInterfaceMac::requestHideAndExitFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::preparedToReturnToInline):
        (WebCore::WebVideoFullscreenInterfaceMac::setMode):
        (WebCore::WebVideoFullscreenInterfaceMac::clearMode):
        (WebCore::WebVideoFullscreenInterfaceMac::mayAutomaticallyShowVideoPictureInPicture):
        (WebCore::WebVideoFullscreenInterfaceMac::applicationDidBecomeActive):
        (WebCore::supportsPictureInPicture):
        Add a stub implementation of WebVideoFullscreenInterfaceMac.

2016-01-28  Nikos Andronikos  <nikos.andronikos-webkit@cisra.canon.com.au>

        [SVG] Add support for 'lighter' operator in feComposite
        https://bugs.webkit.org/show_bug.cgi?id=141376

        Reviewed by Darin Adler.

        Added new cases where needed to support the lighter (aka 'plus')
        Porter Duff operator in SVG Filter Effects.
        https://www.w3.org/TR/filter-effects/#valdef-operator-lighter
        Note that in the specification, no constant was added to the IDL for
        the lighter operator. 

        Test: svg/filters/feCompositeOpaque.html
              svg/dom/script-tests/SVGAnimatedEnumeration-SVGFECompositeElement.js

        * platform/graphics/filters/FEComposite.cpp:
        (WebCore::FEComposite::platformApplySoftware):
          Add case to support lighter.
        (WebCore::operator<<):
          Add case to support lighter for text stream operations.
        * platform/graphics/filters/FEComposite.h:
          Add case for lighter to CompositeOperationType enum.
        * svg/SVGFECompositeElement.h:
        (WebCore::SVGIDLEnumLimits<CompositeOperationType>::highestExposedEnumValue):
          Higest exposed value is arithmetic - do not expose lighter.
        (WebCore::SVGPropertyTraits<CompositeOperationType>::highestEnumValue):
          Highest possible value is now lighter.
        (WebCore::SVGPropertyTraits<CompositeOperationType>::toString):
          Add case to support lighter.
        (WebCore::SVGPropertyTraits<CompositeOperationType>::fromString):
          Add case to support lighter.

2016-01-28  Darin Adler  <darin@apple.com>

        Remove equalIgnoringCase since all callers really wanted equalIgnoringASCIICase
        https://bugs.webkit.org/show_bug.cgi?id=153411

        Reviewed by Ryosuke Niwa.

        Tests: fast/media/media-query-non-ASCII-case-folding.html
               fast/dom/HTMLAnchorElement/anchor-non-ASCII-case-folding.html
               fast/xpath/xpath-non-ASCII-case-folding.html

        No tests included that cover the minor behavior changes in Document::setDomain,
        CSPSource::schemeMatches, CSPSource::hostMatches, OriginAccessEntry::operator==,
        UserContentURLPattern::matches, UserContentURLPattern::matchesHost,
        ContentFilterUnblockHandler::canHandleRequest. Would like to add tests for those
        if possible, but it seems clear all are progressions.

        For background on why this is the right thing to do in almost every case:

        - MIME types are all ASCII and not case sensitive (details in RFC 2045)
          <http://tools.ietf.org/html/rfc2045>
        - case insensitive comparisons in HTML are all "ASCII case-insensitive"
          https://www.w3.org/TR/html/infrastructure.html#ascii-case-insensitive
        - same for CSS

        * Modules/webdatabase/DatabaseAuthorizer.cpp:
        (WebCore::DatabaseAuthorizer::denyBasedOnTableName): Use equalIgnoringASCIICase.
        No change in behavior since the string we are comparing with is always
        "__WebKitDatabaseInfoTable__" in practice.

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::siblingWithAriaRole): Changed argument type to take a const char*,
        added some FIXMEs and use equalIgnoringCase. No change in behavior since the
        strings we are comparing with are "menu" and "menuitem".
        (WebCore::AccessibilityNodeObject::menuElementForMenuButton): Updated to pass
        arguments in reverse order.
        (WebCore::AccessibilityNodeObject::menuItemElementForMenu): Ditto.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFontFaceValue): Use equalIgnoringASCIICase.
        No change in behavior because the property names are all ASCII constants.

        * css/CSSParserValues.h: Removed unused equalIgnoringCase function.

        * css/MediaQueryEvaluator.cpp:
        (WebCore::MediaQueryEvaluator::mediaTypeMatch): Use equalIgnoringASCIICase.
        Changes behavior: No non-ASCII case folding when matching media types.
        Covered by new test.
        (WebCore::MediaQueryEvaluator::mediaTypeMatchSpecific): Use equalIgnoringASCIICase.
        No change in behavior since the only string this is ever called with is "print".

        * dom/DataTransfer.cpp:
        (WebCore::DataTransfer::hasFileOfType): Use equalIgnoringASCIICase.
        No change in behavior because local files will not have content types with
        non-ASCII characters in them. In the extremely unlikely case that this is incorrect,
        the change in behavior is a progression.

        * dom/Document.cpp:
        (WebCore::Document::setDomain): Use equalIgnoringASCIICase.
        Changes behavior: Domains considered equal because of non-ASCII case folding
        would get through without an error before, and now will properly throw an exception.

        * dom/Element.cpp:
        (WebCore::isStyleAttribute): Refactored into a helper function. Use
        equalLettersIgnoringASCIICase. No change in behavior.
        (WebCore::Element::synchronizeAttribute): Use isStyleAttribute.

        * dom/TreeScope.cpp:
        (WebCore::TreeScope::findAnchor): Use equalIgnoringASCIICase.
        Changes behavior: Could go to an anchor and it would be considered a match because
        of non-ASCII case folding. Covered by new test.

        * html/HiddenInputType.cpp:
        (WebCore::HiddenInputType::appendFormData): Use equalIgnoringASCIICase.
        No change in behavior: comparing with an ASCII literal.
        * html/canvas/WebGL2RenderingContext.cpp:
        (WebCore::WebGL2RenderingContext::getExtension): Ditto.
        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore::WebGLRenderingContext::getExtension): Ditto.

        * html/parser/CSSPreloadScanner.cpp:
        (WebCore::CSSPreloadScanner::emitRule): Use equalLettersIgnoringASCIICase and
        StringView to avoid needing a special ruleEqualIgnoringCase function.
        No change in behavior.

        * inspector/InspectorNodeFinder.cpp:
        (WebCore::InspectorNodeFinder::matchesElement): Use equalIgnoringASCIICase.
        Changes behavior, but it's an inspector UI thing, not a web behavior thing,
        so I don't think a new regression test is needed.

        * loader/HistoryController.cpp:
        (WebCore::HistoryController::currentItemShouldBeReplaced): Use
        equalIgnoringASCIICase. No change in behavior because we are comparing
        with "about:blank".

        * loader/SubframeLoader.cpp:
        (WebCore::findPluginMIMETypeFromURL): Use equalIgnoringASCIICase.
        No change in behavior unless a plug-in claims an extension with non-ASCII
        characters. I don't think a new regression test is needed.

        * loader/appcache/ApplicationCacheHost.cpp:
        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache):
        Use equalIgnoringASCIICase. No change in behavior because both strings are
        protocols from URLs and we don't parse non-ASCII characters into protocol strings;
        non-ASCII are already encoding as punycode.
        * loader/appcache/ManifestParser.cpp:
        (WebCore::parseManifest): Ditto.

        * page/ContentSecurityPolicy.cpp:
        (WebCore::isExperimentalDirectiveName): Added. Used by isDirectiveName.
        Uses equalLettersIgnoringASCIICase. No change in behavior.
        (WebCore::isDirectiveName): Use equalLettersIgnoringASCIICase.
        No change in behavior.
        (WebCore::isSourceListNone): Use equalLettersIgnoringASCIICase. No
        change in behavior.
        (WebCore::CSPSource::schemeMatches): Use equalLettersIgnoringASCIICase
        and equalIgnoringASCIICase. It's all about comparing URL protocols. The
        old code might have done something strange if someone specified a protocol
        with a non-ASCII character in it.
        (WebCore::CSPSource::hostMatches): Use equalIgnoringASCIICase.
        (WebCore::CSPSourceList::parseSource): Use equalLettersIgnoringASCIICase.
        No change in behavior.
        (WebCore::CSPDirectiveList::checkSourceAndReportViolation): Tweaked code
        to do less unnecessary String allocation.
        (WebCore::CSPDirectiveList::parseReflectedXSS): Use
        equalLettersIgnoringASCIICase. No change in behavior.
        (WebCore::CSPDirectiveList::addDirective): Ditto.
        (WebCore::ContentSecurityPolicy::reportUnsupportedDirective): Use
        equalLettersIgnoringASCIICase and remove unneeded global constant strings.
        No change in behavior.
        (WebCore::ContentSecurityPolicy::reportDirectiveAsSourceExpression):
        Tweak code to eliminate unneeded local.
        (WebCore::ContentSecurityPolicy::reportDuplicateDirective): Ditto.
        (WebCore::ContentSecurityPolicy::reportInvalidSourceExpression): Use
        equalLettersIgnoringASCIICase. No change in behavior.

        * page/OriginAccessEntry.h:
        (WebCore::operator==): Use equalLettersIgnoringASCIICase.

        * page/Performance.cpp:
        (WebCore::Performance::webkitGetEntriesByName): Use equalLettersIgnoringASCIICase.
        No change in behavior.

        * page/UserContentURLPattern.cpp:
        (WebCore::UserContentURLPattern::matches): Use equalIgnoringASCIICase to match
        schemes.
        (WebCore::UserContentURLPattern::matchesHost): Use equalIgnoringASCIICase to
        match host names.

        * platform/URL.cpp:
        (WebCore::URL::init): Use equalIgnoringASCIICase, and also use StringView to
        avoid having to allocate a second string just for comparison purposes. Should be
        better for efficiency with no change in behavior.

        * platform/cocoa/ContentFilterUnblockHandlerCocoa.mm:
        (WebCore::ContentFilterUnblockHandler::canHandleRequest): Use equalIgnoringASCIICase
        to compare hosts.

        * platform/efl/PlatformSpeechSynthesisProviderEfl.cpp:
        (WebCore::PlatformSpeechSynthesisProviderEfl::voiceName): Use StringView and
        equalIgnoringASCIICase to compare language tags. No test needed because there are
        no language tags with non-ASCII characters in them.

        * platform/graphics/FontCache.cpp:
        (WebCore::FontPlatformDataCacheKey::operator==): Changed to use the equal
        function from CaseFoldingHash. In a subsequent patch we will change this to be
        ASCIICaseFoldingHash since font names don't need to compare non-ASCII characters
        in a case folding manner, but for now preserve behavior.
        (WebCore::alternateFamilyName): Use equalLettersIgnoringASCIICase to avoid having
        to use a special familyNameEqualIgnoringCase function. This does mean there will
        be a null check and a length check that wasn't there before, but the actual
        comparison function will be tighter. Guessing it will be a wash. Also improved
        the comments and sorted the Windows cases in with the others. No behavior change.

        * platform/graphics/FontCascade.cpp:
        (WebCore::operator==): Changed to use the equal function from CaseFoldingHash.
        Same rationale as above in FontPlatformDataCacheKey.

        * platform/graphics/FontDescription.cpp:
        (WebCore::FontCascadeDescription::familiesEqualForTextAutoSizing): Use
        equalIgnoringASCIICase to compare font family names. Only possible change in
        behavior would be if actual fonts with non-ASCII names but that were specified
        with different case in style sheets. Highly unlikely this exists.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::supportsType): Use equalLettersIgnoringASCIICase.
        No change in behavior.
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::keySystemIsSupported): Ditto.

        * platform/graphics/freetype/FontCacheFreeType.cpp:
        (WebCore::isCommonlyUsedGenericFamily): Added.
        (WebCore::FontCache::createFontPlatformData): Moved code into the
        isCommonlyUsedGenericFamily helper and used equalIgnoringASCIICase.

        * platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:
        (WebCore::FontCustomPlatformData::supportsFormat): Use
        equalLettersIgnoringASCIICase. No change in behavior.
        * platform/graphics/win/FontCacheWin.cpp:
        (WebCore::adjustedGDIFontWeight): Ditto.
        (WebCore::FontCache::createFontPlatformData): Ditto.
        * platform/graphics/win/FontCustomPlatformData.cpp:
        (WebCore::FontCustomPlatformData::supportsFormat): Ditto.
        * platform/graphics/win/FontCustomPlatformDataCairo.cpp:
        (WebCore::FontCustomPlatformData::supportsFormat): Ditto.

        * platform/mac/PlatformSpeechSynthesizerMac.mm:
        (-[WebSpeechSynthesisWrapper speakUtterance:]): Use equalIgnoringASCIICase to
        compare languages. No change in behavior because languages have all-ASCII names.

        * platform/network/CacheValidation.cpp:
        (WebCore::shouldUpdateHeaderAfterRevalidation): Use equalIgnoringASCIICase.
        No change in behavior since it's a fixed list of all ASCII headers.
        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::isAppendableHeader): Ditto.

        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::willSendRequest): Use equalIgnoringASCIICase.
        No change in behavior because HTTP methods are all ASCII letters.

        * platform/text/mac/LocaleMac.mm:
        (WebCore::determineLocale): Use equalIgnoringASCIICase. No change in behavior
        because locale languages identifiers are all ASCII.
        * platform/text/win/LocaleWin.cpp:
        (WebCore::LCIDFromLocaleInternal): Ditto.

        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::appendArabicReplacementSubtable):
        Use equalIgnoringASCIICase. No change in behavior because Arabic form attribute
        values are all ASCII.

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::uppercaseKnownHTTPMethod): Use equalIgnoringASCIICase.
        No change in behavior because these are all fixed known ASCII HTTP method names.

        * xml/XPathFunctions.cpp:
        (WebCore::XPath::FunLang::evaluate): Use equalIgnoringASCIICase. Changes behavior
        if specifying a non-ASCII character. Covered by new test.

        * xml/XPathStep.cpp:
        (WebCore::XPath::nodeMatchesBasicTest): Use equalIgnoringASCIICase. Changes
        behavior if an element local name or XPath predicate has a non-ASCII character.
        Covered by new test.

2016-01-28  Zalan Bujtas  <zalan@apple.com>

        Unexpected content wrapping at http://email.osh.com/H/2/v100000152474feb8ec7c1a1f4bbe5c7c0/HTML
        https://bugs.webkit.org/show_bug.cgi?id=153430

        Reviewed by Simon Fraser.

        Ensure that min/max preferred and computed widths never shrink while converting LayoutUnit to float and back.

        Test: fast/table/fixed-size-table-with-fixed-size-content.html

        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::recalcColumn):
        (WebCore::AutoTableLayout::calcEffectiveLogicalWidth):
        (WebCore::AutoTableLayout::layout):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computePreferredLogicalWidths): Deleted.

2016-01-28  Gwang Yoon Hwang  <yoon@igalia.com>

        [GStreamer] Clean up includes and headers related with GStreamerGL
        https://bugs.webkit.org/show_bug.cgi?id=153590

        Reviewed by Philippe Normand.

        Remove gstglmemory from the including list and reorder includes to
        organize GSTREAMER_GL related headers. It violates style rules of the
        include order, but there is no clean way to include gst/gl/gl.h
        without violating it.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:

2016-01-28  Gwang Yoon Hwang  <yoon@igalia.com>

        [GStreamer] MediaPlayerPrivateGStreamerBase::handleSyncMessage leaks GstContext
        https://bugs.webkit.org/show_bug.cgi?id=153580

        Reviewed by Philippe Normand.

        When we creates GstContext using gst_context_new it increases refcount itself.
        And the refcount of GstContext is increased when it is passed to
        gst_element_set_context, also. Therefore We should unref GstContext after
        using it to prevent GstContext leaks.

        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
        (WTF::adoptGRef): Added for GstContext.
        (WTF::refGPtr<GstContext>): Ditto
        (WTF::derefGPtr<GstContext>): Ditto
        * platform/graphics/gstreamer/GRefPtrGStreamer.h:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::handleSyncMessage):
        Use GRefPtr<GstContext> to handle currect refcounting

2016-01-27  Alex Christensen  <achristensen@webkit.org>

        Fix clean CMake build after r195711.

        * PlatformWin.cmake:
        Copy forwarding headers from the new directory to find ContentSecurityPolicy.h.
        This should fix EWS issues like the one seen in bug 153573.

2016-01-27  Chris Dumez  <cdumez@apple.com>

        Expose ValidityState on the global Window object
        https://bugs.webkit.org/show_bug.cgi?id=153582

        Reviewed by Antti Koivisto.

        Expose ValidityState on the global Window object:
        https://html.spec.whatwg.org/#validitystate

        Firefox and Chrome match the specification.

        No new tests, already covered by existing tests.

        * html/ValidityState.idl:

2016-01-27  Chris Dumez  <cdumez@apple.com>

        Expose ApplicationCache on the global Window object
        https://bugs.webkit.org/show_bug.cgi?id=153578

        Reviewed by Antti Koivisto.

        Expose ApplicationCache on the global Window object as per:
        https://html.spec.whatwg.org/#the-storage-interface

        Chrome follows the spec.

        No new tests, already covered by existing test.

        * loader/appcache/DOMApplicationCache.idl:

2016-01-27  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r190430): Assertion failure in Text::~Text()
        https://bugs.webkit.org/show_bug.cgi?id=153577

        Reviewed by Antti Koivisto.

        The bug was caused by destroyRenderTreeIfNeeded exiting early on all HTMLSlotElement as it lacks a render object.
        Fixed it by explicitly avoiding the early return when child is a HTMLSlotElement.

        Test: fast/shadow-dom/slot-removal-crash-2.html

        * dom/ContainerNode.cpp:
        (WebCore::destroyRenderTreeIfNeeded):

2016-01-27  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Garbage is displayed when root svg element has mix-blend-mode set
        https://bugs.webkit.org/show_bug.cgi?id=150556

        Reviewed by Darin Adler.

        This bug happens when compositing on a CALayer and drawing on a transparent
        layer, so it happens with WK2 with <svg style="mix-blend-mode...">. And it
        can happen with WK1 also with <svg style="opacity=...;mix-blend-mode...">.
        But in both cases, the SVG root renderer should be the root of the render
        tree. So it happens only with the stand alone SVG documents.

        SVGRenderContext::prepareToRenderSVGContent() ignores the opacity of
        the SVG root but it creates a transparent layer for the blend-mode.

        But RenderLayer::beginTransparencyLayers() creates a transparent layer
        for opacity and it sets the blend-mode also.

        The fix is to begin two transparent layers for the SVG root renderer: one
        for the opacity and the second for the blend-mode. The opacity transparent
        layer will be still managed by RenderLayer::beginTransparencyLayers(). While
        the blend-mode transparent layer will be managed by SVGRenderContext
        ::prepareToRenderSVGContent().

        Tests: svg/css/mix-blend-mode-background-root.svg
               svg/css/mix-blend-mode-opacity-root.svg

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::beginTransparencyLayers):

2016-01-27  Enrica Casucci  <enrica@apple.com>

        Cache results of data detection in the UI process when load completes.
        https://bugs.webkit.org/show_bug.cgi?id=153560

        Reviewed by Tim Horton.

        Adding new FrameLoaderClient method to notify that data
        detection is complete and provide the results.

        * loader/EmptyClients.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        * loader/FrameLoaderClient.h:

2016-01-27  Daniel Bates  <dabates@apple.com>

        Move ContentSecurityPolicy.{cpp, h} to its own directory
        https://bugs.webkit.org/show_bug.cgi?id=153527
        <rdar://problem/24359892>

        Reviewed by Sam Weinig.

        Move ContentSecurityPolicy.{cpp, h} from Source/WebCore/page to Source/WebCore/page/csp.
        This will facilitate separating out the policy support classes (e.g. CSPDirectiveList)
        into their own files to improve the hackability of this code.

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * page/csp/ContentSecurityPolicy.cpp: Renamed from Source/WebCore/page/ContentSecurityPolicy.cpp.
        * page/csp/ContentSecurityPolicy.h: Renamed from Source/WebCore/page/ContentSecurityPolicy.h.

2016-01-27  Brady Eidson  <beidson@apple.com>

        Modern IDB: Incorrect handling of iterating cursors to their end.
        https://bugs.webkit.org/show_bug.cgi?id=153569

        Reviewed by Alex Christensen.

        No new tests (3 tests now pass, others are closer to passing).

        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::advance):
        (WebCore::IDBServer::SQLiteIDBCursor::internalAdvanceOnce):

2016-01-27  Nan Wang  <n_wang@apple.com>

        AX: Crash in AccessibilityTableColumn::headerObject
        https://bugs.webkit.org/show_bug.cgi?id=153553
        <rdar://problem/23196278>

        Reviewed by Chris Fleizach.

        Webkit was crashing sometimes when we asked for column headers of a table.
        The columns vector of the table was reset during the iteration when we
        were asking for the headerObject of each column. The column's addChildren()
        function calls elementRect() for each child cell and that sometimes causes 
        the parent table to reset its children.
        Fixed it by caching the columns vector and moving out the elementRect() logic
        from AccessibilityTalbeColumn::addChildren().  

        * accessibility/AccessibilityTable.cpp:
        (WebCore::AccessibilityTable::columnHeaders):
        (WebCore::AccessibilityTable::rowHeaders):
        * accessibility/AccessibilityTableColumn.cpp:
        (WebCore::AccessibilityTableColumn::elementRect):
        (WebCore::AccessibilityTableColumn::headerObject):
        (WebCore::AccessibilityTableColumn::addChildren):
        * accessibility/AccessibilityTableColumn.h:

2016-01-27  Chris Dumez  <cdumez@apple.com>

        Settings a reflected DOMString attribute to null should set it to the "null" string rather than the empty string
        https://bugs.webkit.org/show_bug.cgi?id=153504
        <rdar://problem/24353072>

        Reviewed by Ryosuke Niwa.

        Settings a reflected DOMString attribute to null should set it to the "null"
        string rather than the empty string:
        - https://html.spec.whatwg.org/#reflecting-content-attributes-in-idl-attributes
        - http://heycam.github.io/webidl/#es-DOMString
        - http://people.mozilla.org/~jorendorff/es6-draft.html#sec-tostring

        Firefox and Chrome match the specification here.

        This is causing a lot of W3C HTML reflection tests to fail on WebKit, e.g.:
        - http://w3c-test.org/html/dom/reflection-text.html

        No new tests, already covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (JSValueToNative):
        Call toString() instead of valueToStringWithNullCheck() for reflected
        attributes. This way, null gets converted to the string "null", as
        expected, instead of a null String object.

        * html/HTMLInputElement.idl:
        Dropping [TreatNullAs=NullString] IDL extended attribute for
        input.defaultValue, as this is not present in the specification:
        - https://html.spec.whatwg.org/#htmlinputelement

        Without this change, assigning null to input.defaultValue would not
        set to to the "null" string, as is expected.

        * html/HTMLTextAreaElement.idl:
        Dropping [TreatNullAs=NullString] IDL extended attribute for
        textArea.defaultValue, as this is not present in the specification:
        - https://html.spec.whatwg.org/#htmltextareaelement

        Without this change, assigning null to textArea.defaultValue would not
        set to to the "null" string, as is expected.

        * html/HTMLTitleElement.idl:
        Dropping [TreatNullAs=NullString] IDL extended attribute for
        title.text, as this is not present in the specification:
        - https://html.spec.whatwg.org/#htmltitleelement

        Without this change, assigning null to title.text would not
        set to to the "null" string, as is expected.

2016-01-27  Simon Fraser  <simon.fraser@apple.com>

        Support CSS3 Images values for the image-rendering property
        https://bugs.webkit.org/show_bug.cgi?id=153556

        Reviewed by Dean Jackson.

        CSS3 Images has the following values for image-rendering:
            auto, crisp-edges, pixelated

        The old code supported:
            optimizeSpeed, optimizeQuality, -webkit-crisp-edges, -webkit-optimize-contrast

        Add support for the new values without prefixes. Map -webkit-crisp-edges to crisp-edges,
        and -webkit-optimize-contrast to crisp-edges. Support pixelated which behaves like 
        crisp-edges (a low quality scale).

        The spec says that optimizeQuality should behave like 'auto', but that would be
        a behavior change since ImageQualityController::shouldPaintAtLowQuality() currently
        uses it as a trigger to avoid low quality scaling, so don't change that for now.

        No new tests, covered by fast/css/script-tests/image-rendering-parsing.js

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator EImageRendering):
        * css/CSSValueKeywords.in:
        * rendering/ImageQualityController.cpp:
        (WebCore::ImageQualityController::shouldPaintAtLowQuality):
        * rendering/RenderHTMLCanvas.cpp:
        (WebCore::RenderHTMLCanvas::paintReplaced):
        * rendering/style/RenderStyleConstants.h:
        * rendering/style/StyleRareInheritedData.h: Need another bit.

2016-01-27  Anders Carlsson  <andersca@apple.com>

        Add WebKitAdditions extension points to WebCore, WebKit and WebKitLegacy
        https://bugs.webkit.org/show_bug.cgi?id=153550

        Reviewed by Sam Weinig.

        * DerivedSources.make:
        Add the ability for WebKitAdditions to add events and event targets.

        * WebCore.xcodeproj/project.pbxproj:
        Add new files.

        * bindings/scripts/InFilesCompiler.pm:
        (initializeFromCommandLine):
        (compile):
        Handle multiple --input parameters.

        * dom/EventNames.h:
        Handle adding more event names.

        * loader/EmptyClients.cpp:
        (WebCore::fillWithEmptyClients):
        * page/MainFrame.cpp:
        (WebCore::MainFrame::MainFrame):
        * page/MainFrame.h:
        * page/PageConfiguration.h:
        Add extension points.

        * platform/cocoa/WebKitAdditions.mm: Added.
        Import additions.

2016-01-27  Brady Eidson  <beidson@apple.com>

        Modern IDB: Fix many Index tests.
        https://bugs.webkit.org/show_bug.cgi?id=153561

        Reviewed by Alex Christensen.

        No new tests (Many failing tests now pass).

        * Modules/indexeddb/server/MemoryIndex.cpp:
        (WebCore::IDBServer::MemoryIndex::getResultForKeyRange):
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexKey):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getIndexRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::iterateCursor):
        
        * Modules/indexeddb/server/SQLiteIDBCursor.h:
        (WebCore::IDBServer::SQLiteIDBCursor::didComplete):

2016-01-27  Brady Eidson  <beidson@apple.com>

        Modern IDB: Cursors are utterly broken in the SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153558

        Reviewed by Alex Christensen.

        No new tests (35 failures now pass, others improve).

        - Fixes incorrect usage of Index cursors when ObjectStore cursors are intended.
        - Improves the state of getting the cursor value vs. reaching the end of a cursor.

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::openCursor):
        (WebCore::IDBServer::SQLiteIDBBackingStore::iterateCursor):

        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
        (WebCore::IDBServer::SQLiteIDBCursor::currentData):
        * Modules/indexeddb/server/SQLiteIDBCursor.h:

2016-01-27  Chris Dumez  <cdumez@apple.com>

        Getting / Setting property on prototype object must throw TypeError
        https://bugs.webkit.org/show_bug.cgi?id=153547
        <rdar://problem/24370650>

        Reviewed by Ryosuke Niwa.

        Gettingi / Setting property on prototype object must throw TypeError as per
        Web IDL specification:
        http://heycam.github.io/webidl/#dfn-attribute-getter (Step 2.4.2)
        http://heycam.github.io/webidl/#dfn-attribute-setter (Step 3.5)

        Firefox and Chrome already throw a TypeError in this case, as per
        the specification. However, WebKit was returning null and merely
        logging a deprecation error message. This patch aligns our behavior
        with other browsers and the specification.

        This patch also adds support for the [LenientThis] IDL extended
        attribute:
        http://heycam.github.io/webidl/#LenientThis

        For [LenientThis] attributes, we do not throw a TypeError if the
        attribute getter / setter is called on an object which does not
        implement the expected interface, as per:
        http://heycam.github.io/webidl/#dfn-attribute-getter (Step 2.4.1)
        http://heycam.github.io/webidl/#dfn-attribute-setter (Step 3.5)

        No new tests, already covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        Add support for [LenientThis]:
        http://heycam.github.io/webidl/#LenientThis

        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestNode.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/JS/JSattribute.cpp:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        Rebaseline bindings tests.

        * bindings/scripts/test/TestObj.idl:
        Add coverage for [LenientThis] attributes.

        * dom/Document.idl:
        Mark 'onreadystatechange' as [LenientThis] as per the HTML
        specification:
        https://html.spec.whatwg.org/#document

        * dom/GlobalEventHandlers.idl:
        Mark 'onmouseeneter' / 'onmouseleave' as [LenientThis] as per the
        HTML specification:
        https://html.spec.whatwg.org/#globaleventhandlers

2016-01-27  Chris Dumez  <cdumez@apple.com>

        window.atob() should ignore spaces in input
        https://bugs.webkit.org/show_bug.cgi?id=153522
        <rdar://problem/24357822>

        Reviewed by Benjamin Poulain.

        window.atob() should ignore spaces in input as per:
        - https://html.spec.whatwg.org/#dom-windowbase64-atob (Step 3)

        Previously, WebKit would throw an exception and it was the only browser
        to do so. Firefox and Chrome behavior according to the specification.

        This was causing us to fail 10 checks in the following W3C HTML test:
        http://w3c-test.org/html/webappapis/atob/base64.html

        No new tests, updated existing test.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::atob):
        * page/Page.cpp:
        (WebCore::Page::userStyleSheetLocationChanged):
        * platform/network/DataURL.cpp:
        (WebCore::handleDataURL):
        * platform/network/DataURLDecoder.cpp:
        (WebCore::DataURLDecoder::decodeBase64):

2016-01-27  Ada Chan  <adachan@apple.com>

        Move some logic related to the presentation mode button from mediaControlsiOS.js to mediaControlsApple.js
        https://bugs.webkit.org/show_bug.cgi?id=153476

        Reviewed by Eric Carlson.

        Also, add the necessary styles to support that control in mediaControlsApple.css.

        * Modules/mediacontrols/mediaControlsApple.css:
        (video::-webkit-media-controls-panel.picture-in-picture):
        (audio::-webkit-media-controls-wireless-playback-status.picture-in-picture):
        (audio::-webkit-media-controls-wireless-playback-text-top.picture-in-picture):
        (audio::-webkit-media-controls-wireless-playback-text-bottom.picture-in-picture):
        (video::-webkit-media-controls-panel .picture-in-picture-button):
        Use the same mask image as iOS, but with a different size and a background color specified
        (since there's another rule that makes buttons within the panel have a transparent
        background color).
        (video::-webkit-media-controls-panel .picture-in-picture-button.return-from-picture-in-picture):

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.addVideoListeners):
        (Controller.prototype.removeVideoListeners):
        Listen for (and stop listening for) the webkitpresentationmodechanged event if presentation
        mode is supported for this video element.
        (Controller.prototype.createControls):
        Add a class name to the pictureInPictureButton so we can query for it in the stylesheet.
        (Controller.prototype.configureInlineControls):
        Call updatePictureInPictureButton().
        (Controller.prototype.presentationMode):
        Moved from mediaControlsiOS.js.
        (Controller.prototype.isFullScreen):
        Ditto, with a bug fix to not call presentationMode(), since that method calls isFullScreen(),
        resulting in infinite recursion.
        (Controller.prototype.updatePictureInPictureButton):
        Ditto.
        (Controller.prototype.handlePresentationModeChange):
        Ditto.
        (Controller.prototype.handleFullscreenChange):
        Call handlePresentationModeChanged() if presentation mode is supported for this video element.
        (Controller.prototype.controlsAlwaysVisible):
        Ditto.
        (Controller.prototype.handlePictureInPictureButtonClicked):
        Ditto.
        * Modules/mediacontrols/mediaControlsiOS.js:
        (ControllerIOS.prototype.handlePresentationModeChange):
        Most logic has been moved to the same method in mediaControlsApple.js, except
        updating the style of the panelContainer, which doesn't exist in the Mac controls.
        (ControllerIOS.prototype.addVideoListeners): Deleted.
        (ControllerIOS.prototype.removeVideoListeners): Deleted.
        (ControllerIOS.prototype.presentationMode): Deleted.
        (ControllerIOS.prototype.isFullScreen): Deleted.
        (ControllerIOS.prototype.handlePictureInPictureButtonClicked): Deleted.
        (ControllerIOS.prototype.updatePictureInPictureButton): Deleted.
        (ControllerIOS.prototype.handleFullscreenChange): Deleted.
        (ControllerIOS.prototype.controlsAlwaysVisible): Deleted.
        Delete all code that's already handled in the Controller.

2016-01-26  Ada Chan  <adachan@apple.com>

        Enable API related to the video fullscreen layer in MediaPlayerPrivateMediaSourceAVFObjC
        also on Mac platform with video presentation mode support.
        https://bugs.webkit.org/show_bug.cgi?id=153223

        Reviewed by Jer Noble.

        Reuse VideoFullscreenLayerManager to manage moving the video layer between the fullscreen
        layer and the inline layer depending on the current presentation mode.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::MediaPlayerPrivateMediaSourceAVFObjC):
        Create m_videoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::platformLayer):
        Return the video inline layer from the VideoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::addDisplayLayer):
        Call VideoFullscreenLayerManager::setVideoLayer() with the m_sampleBufferDisplayLayer.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::removeDisplayLayer):
        Call VideoFullscreenLayerManager::didDestroyVideoLayer().
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setVideoFullscreenLayer):
        Call VideoFullscreenLayerManager::setVideoFullscreenLayer().
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setVideoFullscreenFrame):
        Call VideoFullscreenLayerManager::setVideoFullscreenFrame().

2016-01-27  Brady Eidson  <beidson@apple.com>

        Modern IDB: SQLite backend doesn't update index records as object records are added.
        https://bugs.webkit.org/show_bug.cgi?id=153548

        Reviewed by Alex Christensen.

        No new tests (4 more tests pass, others improve).

        * Modules/indexeddb/server/IDBBackingStore.h:
        
        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::addRecord):
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::initializeVM):
        (WebCore::IDBServer::SQLiteIDBBackingStore::vm):
        (WebCore::IDBServer::SQLiteIDBBackingStore::globalObject):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexKey):
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateIndexesForAddRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd):
        
        * Modules/indexeddb/shared/IDBObjectStoreInfo.h:

2016-01-27  Ryosuke Niwa  <rniwa@webkit.org>

        Add API to access closed shadowRoot in InjectedBundle
        https://bugs.webkit.org/show_bug.cgi?id=153533

        Reviewed by Antti Koivisto.

        Always return the shadow root in Element.shadowRootForBindings when the DOM wrapper world has
        shadowRootIsAlwaysOpen set to true. Also renamed bindingShadowRoot to shadowRootForBindings
        to be consistent.

        * bindings/js/DOMWrapperWorld.h:
        (WebCore::DOMWrapperWorld::setShadowRootIsAlwaysOpen): Added.
        (WebCore::DOMWrapperWorld::shadowRootIsAlwaysOpen): Added.
        * dom/Element.cpp:
        (WebCore::Element::shadowRootForBindings): Renamed from bindingShadowRoot.
        * dom/Element.h:
        * dom/Element.idl:

2016-01-27  Zhuo Li  <zachli@apple.com>

        Need ability to specify alternate image for AutoFill button in input fields.
        https://bugs.webkit.org/show_bug.cgi?id=153116.
        rdar://problem/23384854.

        Reviewed by Darin Adler.

        Add a new AutoFill button that can be shown in <input> elements.

        Tests: fast/forms/auto-fill-button/input-contacts-auto-fill-button.html
               fast/forms/auto-fill-button/show-correct-auto-fill-button-when-auto-fill-button-type-changes.html

        * css/html.css:
        (input::-webkit-contacts-auto-fill-button):
        (input::-webkit-contacts-auto-fill-button:hover):
        (input::-webkit-contacts-auto-fill-button:active):
        Add default style rules for the Contacts AutoFill button based on the ones used for
        Manual AutoFill button.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setShowAutoFillButton):
        * html/HTMLInputElement.h:
        (WebCore::HTMLInputElement::autoFillButtonType):
        - Replace the boolean parameter with a new parameter to specify the type of the AutoFill button.
        - Declare a private variable to keep a record of the type of the current AutoFill
        button.
        (WebCore::HTMLInputElement::showAutoFillButton): Deleted.

        * html/HTMLTextFormControlElement.h:
        Declare enum for AutoFill button type.

        * html/TextFieldInputType.cpp:
        (WebCore::autoFillButtonTypeToAutoFillButtonPseudoClassName):
        (WebCore::isAutoFillButtonTypeChanged):
        (WebCore::TextFieldInputType::shouldDrawAutoFillButton): None means the AutoFill button is not
        enabled.
        (WebCore::TextFieldInputType::createAutoFillButton): Only create the AutoFill button
        if the type is expected.
        (WebCore::TextFieldInputType::updateAutoFillButton):
        Handle the case where AutoFill button type changes in the text field.
        * html/TextFieldInputType.h:

        * testing/Internals.cpp:
        (WebCore::stringToAutoFillButtonType): Convert the string to AutoFill button type.
        (WebCore::Internals::setShowAutoFillButton): Add a new parameter to specify the type of the AutoFill button.
        * testing/Internals.h: Ditto.
        * testing/Internals.idl: Ditto.

2016-01-26  Ryosuke Niwa  <rniwa@webkit.org>

        Add Node.treeRoot
        https://bugs.webkit.org/show_bug.cgi?id=153537

        Reviewed by Antti Koivisto.

        Exposed highestAncestor as Node.prototype.treeRoot, which was added to shadow DOM spec in
        https://github.com/w3c/webcomponents/commit/6864a40fe4efa8a737e78512e3c85319ddc5bf8b

        See also:
        http://w3c.github.io/webcomponents/spec/shadow/#extensions-to-node-interface

        Test: fast/shadow-dom/Node-interface-treeRoot.html

        * dom/Node.idl:

2016-01-26  Ryosuke Niwa  <rniwa@webkit.org>

        Rename HTMLSlotElement.getDistributedNodes to getAssignedNodes
        https://bugs.webkit.org/show_bug.cgi?id=153534

        Reviewed by Antti Koivisto.

        Did the rename.

        * html/HTMLSlotElement.idl:

2016-01-27  Tim Horton  <timothy_horton@apple.com>

        Need to be able to specify MIME type for <attachment> without filename or handle
        https://bugs.webkit.org/show_bug.cgi?id=153552
        <rdar://problem/20145857>

        Reviewed by Anders Carlsson.

        Tests: fast/attachment/attachment-default-icon.html
               fast/attachment/attachment-type-attribute.html

        * html/HTMLAttachmentElement.cpp:
        (WebCore::HTMLAttachmentElement::parseAttribute):
        Invalidate attachment when 'type' attribute changes.

        (WebCore::HTMLAttachmentElement::attachmentType):
        * html/HTMLAttachmentElement.h:
        * platform/graphics/Icon.h:
        * platform/graphics/mac/IconMac.mm:
        (WebCore::Icon::createIconForUTI):
        (WebCore::Icon::createIconForMIMEType):
        Add Icon class methods to retrieve an icon given a UTI or MIME type.

        * rendering/RenderThemeMac.mm:
        (WebCore::paintAttachmentIcon):
        Use the 'type' attribute (a MIME type) if we have one. Otherwise,
        use the filename. Lastly fall back to a plain file icon (using the root
        file UTI, public.data).

2016-01-27  Alexey Proskuryakov  <ap@apple.com>

        Remove ENABLE_CURRENTSRC
        https://bugs.webkit.org/show_bug.cgi?id=153545

        Reviewed by Simon Fraser.

        * Configurations/FeatureDefines.xcconfig:

2016-01-26  Anders Carlsson  <andersca@apple.com>

        Stop echoing echo commands to stdout
        https://bugs.webkit.org/show_bug.cgi?id=153531

        Reviewed by Csaba Osztrogonác.

        * DerivedSources.make:

2016-01-26  Jer Noble  <jer.noble@apple.com>

        Calling video.controls=true during a scrub operation cancels scrub.
        https://bugs.webkit.org/show_bug.cgi?id=153494

        Reviewed by Eric Carlson.

        Test: media/media-controls-drag-timeline-set-controls-property.html

        Verify that the video.controls attribute actually changed before tearing down and
        re-adding the media controls to the Shadow DOM.

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.handleControlsChange):
        (Controller.prototype.hasControls):

2016-01-27  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK][EFL] Rename ScrollAnimationNone as ScrollAnimationSmooth
        https://bugs.webkit.org/show_bug.cgi?id=153481

        Reviewed by Simon Fraser.

        ScrollAnimationNone has always been used by EFL and GTK ports to
        implement smooth scrolling. I think it should be possible for
        other scroll animators to implement smooth scrolling or even
        implement other kind of scroll animations. For example, in the
        future I would like to have kinetic scrolling implemented for the
        GTK+ port to match all other GTK+ application and decide at
        runtime between different animations without having to use a
        different scroll animator class. So, this patch also moves the
        smooth scrolling animation implementation to its own class
        ScrollAnimationSmooth that impements an interface ScrollAnimation
        that could be used to implement other animations. This will allow
        the GTK+ port to add its own scroll animator class and still
        support smooth scrolling sharing the code with the
        ScrollAnimationSmooth.

        * PlatformEfl.cmake: Add new files to compilation and remove ScrollAnimationNone.
        * PlatformGTK.cmake: Ditto.
        * platform/ScrollAnimation.h: Added.
        (WebCore::ScrollAnimation::serviceAnimation):
        (WebCore::ScrollAnimation::ScrollAnimation):
        * platform/ScrollAnimationSmooth.cpp: Added.
        (WebCore::ScrollAnimationSmooth::ScrollAnimationSmooth):
        (WebCore::ScrollAnimationSmooth::scroll):
        (WebCore::ScrollAnimationSmooth::stop):
        (WebCore::ScrollAnimationSmooth::updateVisibleLengths):
        (WebCore::ScrollAnimationSmooth::setCurrentPosition):
        (WebCore::ScrollAnimationSmooth::serviceAnimation):
        (WebCore::ScrollAnimationSmooth::~ScrollAnimationSmooth):
        (WebCore::curveAt):
        (WebCore::attackCurve):
        (WebCore::releaseCurve):
        (WebCore::coastCurve):
        (WebCore::curveIntegralAt):
        (WebCore::attackArea):
        (WebCore::releaseArea):
        (WebCore::getAnimationParametersForGranularity):
        (WebCore::ScrollAnimationSmooth::updatePerAxisData):
        (WebCore::ScrollAnimationSmooth::animateScroll):
        (WebCore::ScrollAnimationSmooth::animationTimerFired):
        (WebCore::ScrollAnimationSmooth::startNextTimer):
        (WebCore::ScrollAnimationSmooth::animationTimerActive):
        * platform/ScrollAnimationSmooth.h: Added.
        * platform/ScrollAnimator.cpp:
        (WebCore::ScrollAnimator::scroll):
        (WebCore::ScrollAnimator::scrollToOffsetWithoutAnimation):
        (WebCore::ScrollAnimator::setCurrentPosition):
        (WebCore::ScrollAnimator::updateActiveScrollSnapIndexForOffset):
        (WebCore::ScrollAnimator::notifyPositionChanged):
        (WebCore::ScrollAnimator::scrollOffsetOnAxis):
        * platform/ScrollAnimator.h:
        (WebCore::ScrollAnimator::ScrollAnimator::currentPosition):
        * platform/ScrollAnimatorNone.cpp: Removed.
        * platform/ScrollAnimatorNone.h: Removed.
        * platform/ScrollAnimatorSmooth.cpp: Added.
        (WebCore::ScrollAnimator::create):
        (WebCore::ScrollAnimatorSmooth::ScrollAnimatorSmooth):
        (WebCore::ScrollAnimatorSmooth::~ScrollAnimatorSmooth):
        (WebCore::ScrollAnimatorSmooth::scroll):
        (WebCore::ScrollAnimatorSmooth::scrollToOffsetWithoutAnimation):
        (WebCore::ScrollAnimatorSmooth::cancelAnimations):
        (WebCore::ScrollAnimatorSmooth::serviceScrollAnimations):
        (WebCore::ScrollAnimatorSmooth::willEndLiveResize):
        (WebCore::ScrollAnimatorSmooth::didAddVerticalScrollbar):
        (WebCore::ScrollAnimatorSmooth::didAddHorizontalScrollbar):
        * platform/ScrollAnimatorSmooth.h: Added.
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::immediateScrollToPosition):
        (WebCore::ScrollAnimatorMac::immediateScrollBy):

2016-01-27  Carlos Garcia Campos  <cgarcia@igalia.com>

        Overlay scrollbars should always use the whole contents
        https://bugs.webkit.org/show_bug.cgi?id=153352

        Reviewed by Michael Catanzaro.

        In case of having both horizontal and vertical scrollbars, the
        scrollbars respect the scroll corner. That looks good for legacy
        scrollbars that show the track, but with the overlay indicators
        it looks weird that the indicator stops so early before the end of
        the contents, giving the impression that there's something else to
        scroll. This happens because the scroll corner is transparent, so
        it's not obvious that's the scroll corner. It also happens with
        the text areas having a resizer. Legacy scrollbars take into
        account the resizer, which is good, but I expect overlay
        scrollbars to be rendered also over the resizer. The resizer takes
        precedence so you can still click and drag to resize the text area.
        In the case of main frame scrollbars we are indeed returning an
        empty rectangle from ScrollView::scrollCornerRect() when using
        overlay scrollbars, but when calculating the size of the
        scrollbars we are using the actual width/height instead of the
        occupied with/height. For other scrollbars
        RenderLayer::scrollCornerRect() is not checking whether scrollbars
        are overlay or not and we are always returning a scroll corner
        rectangle when scrollbars are present.

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::updateScrollbars): Use the occupied
        width/height when calculating the space the one scrollbar
        should leave for the other.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollCornerRect): Return an empty
        rectangle when using overlay scrollbars.

2016-01-27  Carlos Garcia Campos  <cgarcia@igalia.com>

        ScrollAnimator is not notified when mouse entered, moved or exited a RenderListBox
        https://bugs.webkit.org/show_bug.cgi?id=153398

        Reviewed by Michael Catanzaro.

        EvenHandler is checking whether the enclosing layer of a node is
        registered as scrollable area of its frame view. That doesn't work
        for list boxes, because they are the scrollable area
        themselves. Also when entering a list box the node under mouse is
        not usually the list box itself, but any of its children, a
        HTMLOptionElement or a HTMLOptGroupElement. Instead of comparing
        layers, we should find the enclosing scrollable area of the target
        elements and compare them to decide whether the mouse has entered,
        left or moved a scrollable area.

        * page/EventHandler.cpp:
        (WebCore::enclosingScrollableArea): Return the enclosing
        scrollable area of the given node. If the node doesn't have a
        renderer, it traverses its parents. If the renderer is a
        RenderListBox it is returned, otherwhise the enclosing layer is
        returned.
        (WebCore::EventHandler::mouseMoved): Use enclosingScrollableArea.
        (WebCore::EventHandler::updateMouseEventTargetNode): Ditto.

2016-01-26  Sam Weinig  <sam@webkit.org>

        Try touching DerivedSources.make to force rebuilding.

        * DerivedSources.make:
        * page/DOMWindow.idl:

2016-01-26  Sam Weinig  <sam@webkit.org>

        Try to force a rebuild.

        * page/DOMWindow.idl:

2016-01-26  Chris Dumez  <cdumez@apple.com>

        fast/history/page-cache-webdatabase-no-transaction-db.html flakily crashes
        https://bugs.webkit.org/show_bug.cgi?id=153525

        Reviewed by Andreas Kling.

        The test was crashing because DatabaseThread::hasPendingDatabaseActivity()
        was accessing m_openDatabaseSet from the main thread without any locking
        mechanism. This is an issue because m_openDatabaseSet is altered by the
        database thread.

        No new tests, already covered by fast/history/page-cache-webdatabase-no-transaction-db.html.

        * Modules/webdatabase/DatabaseThread.cpp:
        (WebCore::DatabaseThread::databaseThread):
        (WebCore::DatabaseThread::recordDatabaseOpen):
        (WebCore::DatabaseThread::recordDatabaseClosed):
        (WebCore::DatabaseThread::hasPendingDatabaseActivity):
        * Modules/webdatabase/DatabaseThread.h:

2016-01-26  Joseph Pecoraro  <pecoraro@apple.com>

        Unreviewed CMake build fix after r195644.

        * PlatformMac.cmake:

2016-01-26  Brady Eidson  <beidson@apple.com>

        Modern IDB: Key generator support for SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153427

        Reviewed by Alex Christensen.

        No new tests (Existing failing tests now pass, others improved).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedGetKeyGeneratorValue):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedSetKeyGeneratorValue):
        (WebCore::IDBServer::SQLiteIDBBackingStore::generateKeyNumber):
        (WebCore::IDBServer::SQLiteIDBBackingStore::revertGeneratedKeyNumber):
        (WebCore::IDBServer::SQLiteIDBBackingStore::maybeUpdateKeyGeneratorNumber):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

2016-01-26  Simon Fraser  <simon.fraser@apple.com>

        Allow canvas to use display-list drawing for testing
        https://bugs.webkit.org/show_bug.cgi?id=153475

        Reviewed by Dean Jackson.

        Optionally have 2D <canvas> use display-list drawing, which is only enabled
        via Internals for now.

        Support displayListAsText() and replayDisplayListAsText() on canvas, so we can
        use it to test playback optimizations. [Note that displayListAsText() always
        returns an empty string currently, because the display list is cleared when the
        canvas is painted to the page.]

        Display list rendering is implemented by giving CanvasRenderingContext2D an
        optional DisplayListDrawingContext, which packages up a display list, recorder
        and recording context. The existing paintRenderingResultsToCanvas() is overridden
        to replay the recorded display list into the primary canvas context.

        Tracked replay display lists are stored in a static map, keyed by the CanvasRenderingContext2D.

        Test: displaylists/canvas-display-list.html

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::HTMLCanvasElement):
        (WebCore::HTMLCanvasElement::getContext):
        (WebCore::HTMLCanvasElement::paint):
        (WebCore::HTMLCanvasElement::setUsesDisplayListDrawing):
        (WebCore::HTMLCanvasElement::setTracksDisplayListReplay):
        (WebCore::HTMLCanvasElement::displayListAsText):
        (WebCore::HTMLCanvasElement::replayDisplayListAsText):
        * html/HTMLCanvasElement.h:
        * html/canvas/CanvasRenderingContext.h:
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::DisplayListDrawingContext::DisplayListDrawingContext):
        (WebCore::contextDisplayListMap):
        (WebCore::CanvasRenderingContext2D::~CanvasRenderingContext2D):
        (WebCore::CanvasRenderingContext2D::setTracksDisplayListReplay):
        (WebCore::CanvasRenderingContext2D::displayListAsText):
        (WebCore::CanvasRenderingContext2D::replayDisplayListAsText):
        (WebCore::CanvasRenderingContext2D::paintRenderingResultsToCanvas):
        (WebCore::CanvasRenderingContext2D::drawingContext):
        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D): Deleted.
        * html/canvas/CanvasRenderingContext2D.h:
        * testing/Internals.cpp:
        (WebCore::Internals::setElementUsesDisplayListDrawing):
        (WebCore::Internals::setElementTracksDisplayListReplay):
        (WebCore::Internals::displayListForElement):
        (WebCore::Internals::replayDisplayListForElement):

2016-01-26  Joseph Pecoraro  <pecoraro@apple.com>

        Generalize ResourceUsageData gathering to be used outside of ResourceUsageOverlay
        https://bugs.webkit.org/show_bug.cgi?id=153509
        <rdar://problem/24354291>

        Reviewed by Andreas Kling.

        * CMakeLists.txt:
        * PlatformMac.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * page/Page.cpp:
        * page/Page.h:
        * page/Settings.cpp:
        * page/Settings.h:
        * page/ResourceUsageOverlay.cpp:
        * page/ResourceUsageOverlay.h:
        Add new files to the build and updated ENABLE flag name.

        * page/ResourceUsageData.cpp: Added.
        (WebCore::ResourceUsageData::ResourceUsageData):
        * page/ResourceUsageData.h: Added.
        (WebCore::MemoryCategoryInfo::MemoryCategoryInfo):
        Platform agnostic resource data that may be used by multiple clients,
        such as the ResourceUsageOverlay and later the Inspector.

        * page/ResourceUsageThread.h: Added.
        * page/ResourceUsageThread.cpp: Added.
        (WebCore::ResourceUsageThread::ResourceUsageThread):
        (WebCore::ResourceUsageThread::singleton):
        (WebCore::ResourceUsageThread::addObserver):
        (WebCore::ResourceUsageThread::removeObserver):
        (WebCore::ResourceUsageThread::waitUntilObservers):
        (WebCore::ResourceUsageThread::notifyObservers):
        (WebCore::ResourceUsageThread::createThreadIfNeeded):
        (WebCore::ResourceUsageThread::threadCallback):
        (WebCore::ResourceUsageThread::threadBody):
        Platform agnostic resource usage thread that can be used to gather data
        into a ResourceUsageData struct on a background thread and notify observers
        on the main thread. Platforms need only implement ResourceUsageThread::platformThreadBody
        to populate the ResourceUsageData struct with data.

        * page/cocoa/ResourceUsageOverlayCocoa.mm:
        (WebCore::HistoricMemoryCategoryInfo::HistoricMemoryCategoryInfo):
        (WebCore::HistoricResourceUsageData::HistoricResourceUsageData):
        (WebCore::historicUsageData):
        (WebCore::appendDataToHistory):
        (WebCore::ResourceUsageOverlay::platformInitialize):
        (WebCore::ResourceUsageOverlay::platformDestroy):
        (WebCore::drawMemHistory):
        (WebCore::drawMemoryPie):
        (WebCore::ResourceUsageOverlay::platformDraw):
        Move CPU and memory resource usage calculations to ResourceUsageThread.
        The overlay adds itself as an observer, and builds its RingBuffer list
        of data from notifications from the ResourceUsageThread. Renamed
        some of the fields.

        * page/cocoa/ResourceUsageThreadCocoa.mm: Added.
        (WebCore::vmPageSize):
        (WebCore::TagInfo::TagInfo):
        (WebCore::pagesPerVMTag):
        (WebCore::cpuUsage):
        (WebCore::categoryForVMTag):
        (WebCore::ResourceUsageThread::platformThreadBody):
        Extracted from ResourceUsageOverlayCocoa.

        * page/scrolling/ScrollingThread.cpp:
        (WebCore::ScrollingThread::dispatch):
        Drive-by, don't call singleton again, we already have the result.

2016-01-26  Simon Fraser  <simon.fraser@apple.com>

        Use initializers in HTMLCanvasElement
        https://bugs.webkit.org/show_bug.cgi?id=153472

        Reviewed by Michael Catanzaro.

        Use initializers, and re-order member variables for better packing.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::HTMLCanvasElement):
        * html/HTMLCanvasElement.h:

2016-01-26  Chris Dumez  <cdumez@apple.com>

        Setting HTMLInputElement.value to null to set its value to the empty string
        https://bugs.webkit.org/show_bug.cgi?id=153519

        Reviewed by Ryosuke Niwa.

        Setting HTMLInputElement.value to null to set its value to the empty string:
        - https://html.spec.whatwg.org/#htmlinputelement
        - http://heycam.github.io/webidl/#TreatNullAs

        WebKit would previously unset the value attribute instead, which caused
        it to fallback to input.defaultValue if set.

        Firefox and Chrome behave correctly.

        Test: fast/dom/HTMLInputElement/input-value-set-null.html

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setValue):

2016-01-26  Anders Carlsson  <andersca@apple.com>

        WebKitAdditions should be able to modify derived source rules
        https://bugs.webkit.org/show_bug.cgi?id=153514

        Reviewed by Tim Horton.

        * DerivedSources.make:
        Include WebCoreDerivedSourcesAdditions.make.

        * WebCore.xcodeproj/project.pbxproj:
        Pass our WebKitAdditions paths as include paths to make.

2016-01-26  Chris Dumez  <cdumez@apple.com>

        document.open() / write() should be prevented in beforeunload event handlers
        https://bugs.webkit.org/show_bug.cgi?id=153432

        Reviewed by Ryosuke Niwa.

        document.open() / write() should be prevented in beforeunload event handlers:
        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-open (step 6)
        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-write (step 3)
        - https://html.spec.whatwg.org/multipage/webappapis.html#ignore-opens-during-unload-counter
        - https://html.spec.whatwg.org/multipage/browsers.html#unload-a-document

        Test: fast/frames/page-beforeunload-document-open.html

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::dispatchBeforeUnloadEvent):

2016-01-26  Chris Dumez  <cdumez@apple.com>

        Add support for HTMLDataElement
        https://bugs.webkit.org/show_bug.cgi?id=153459

        Reviewed by Ryosuke Niwa.

        Add support for HTMLDataElement:
        https://html.spec.whatwg.org/multipage/semantics.html#the-data-element

        Firefox already supports it.

        No new tests, already covered by existing tests.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLDataElement.cpp: Added.
        (WebCore::HTMLDataElement::create):
        (WebCore::HTMLDataElement::HTMLDataElement):
        * html/HTMLDataElement.h: Added.
        * html/HTMLDataElement.idl: Added.
        * html/HTMLElementsAllInOne.cpp:
        * html/HTMLTagNames.in:

2016-01-26  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195610.
        https://bugs.webkit.org/show_bug.cgi?id=153513

        The test added with this change is timing out on almost every
        run (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "Calling video.controls=true during a scrub operation cancels
        scrub."
        https://bugs.webkit.org/show_bug.cgi?id=153494
        http://trac.webkit.org/changeset/195610

2016-01-26  Brady Eidson  <beidson@apple.com>

        History.pushState causes intense memory pressure.
        https://bugs.webkit.org/show_bug.cgi?id=153435

        Reviewed by Sam Weinig, Oliver Hunt, and Geoff Garen.

        Tests: fast/loader/stateobjects/pushstate-frequency-iframe.html
               fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html
               fast/loader/stateobjects/pushstate-frequency.html
               fast/loader/stateobjects/replacestate-frequency-iframe.html
               fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html
               fast/loader/stateobjects/replacestate-frequency.html
               loader/stateobjects/pushstate-size-iframe.html
               loader/stateobjects/pushstate-size.html
               loader/stateobjects/replacestate-size-iframe.html
               loader/stateobjects/replacestate-size.html

        Add restrictions on how frequently push/replaceState can be called,
        as well as how much of a cumulative payload they can deliver.
        
        * bindings/js/JSHistoryCustom.cpp:
        (WebCore::JSHistory::pushState):
        (WebCore::JSHistory::replaceState):
        
        * page/History.cpp:
        (WebCore::History::stateObjectAdded):
        * page/History.h:

2016-01-26  Anders Carlsson  <andersca@apple.com>

        Add a Dictionary overload that returns an Optional result
        https://bugs.webkit.org/show_bug.cgi?id=153507

        Reviewed by Tim Horton.

        * bindings/js/Dictionary.h:
        (WebCore::Dictionary::get):

2016-01-26  Philip Rogers  <pdr@chromium.org>

        Let SVG images not taint canvases except when containing foreignObjects
        https://bugs.webkit.org/show_bug.cgi?id=119639

        Reviewed by Brent Fulgham.

        r153876 caused SVG images to not taint canvases but the patch allowed
        for subimage resources. This can be a problem if a subimage (e.g., data
        uri image) contains a foreignObject which can violate security (e.g.,
        visited links).

        This patch updates SVGImage::hasSingleSecurityOrigin to check if the
        image contains any foreignObjects or images that themselves contain
        foreignObjects. SVG images without foreignObjects are allowed to not
        taint canvases.

        Canvas patterns are problematic because an animated SVG image can switch
        between tainting and not tainting the canvas. A FIXME has been added to
        solve this, and in the meantime we cause SVG images to taint patterns.

        Tests: svg/as-image/svg-canvas-pattern-with-link-tainted.html
               svg/as-image/svg-canvas-svg-with-feimage-with-link-tainted.html
               svg/as-image/svg-canvas-svg-with-image-with-link-tainted.html

        * html/canvas/CanvasPattern.cpp:
        (WebCore::CanvasPattern::CanvasPattern):
        (WebCore::CanvasPattern::~CanvasPattern):
        * svg/SVGFEImageElement.cpp:
        (WebCore::SVGFEImageElement::~SVGFEImageElement):
        (WebCore::SVGFEImageElement::hasSingleSecurityOrigin):
        (WebCore::SVGFEImageElement::clearResourceReferences):
        * svg/SVGFEImageElement.h:
        * svg/SVGImageElement.cpp:
        (WebCore::SVGImageElement::create):
        (WebCore::SVGImageElement::hasSingleSecurityOrigin):
        (WebCore::SVGImageElement::isSupportedAttribute):
        * svg/SVGImageElement.h:
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::hasSingleSecurityOrigin):

2016-01-26  Michael Catanzaro  <mcatanzaro@igalia.com>

        CSSGrammar.y:1742.31-34: warning: unused value: $3
        https://bugs.webkit.org/show_bug.cgi?id=153462

        Reviewed by Alex Christensen.

        This warning indicates that we have a memory leak. From the bison manual:

        "Right-hand side symbols of a rule that explicitly triggers a syntax error via YYERROR are
        not discarded automatically. As a rule of thumb, destructors are invoked only when user
        actions cannot manage the memory."

        Arguably a design error, but that's how it is.

        * css/CSSGrammar.y.in:

2016-01-26  Jer Noble  <jer.noble@apple.com>

        Calling video.controls=true during a scrub operation cancels scrub.
        https://bugs.webkit.org/show_bug.cgi?id=153494

        Reviewed by Eric Carlson.

        Test: media/media-controls-drag-timeline-set-controls-property.html

        Verify that the video.controls attribute actually changed before tearing down and
        re-adding the media controls to the Shadow DOM.

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.handleControlsChange):
        (Controller.prototype.hasControls):

2016-01-26  Jeremy Noble  <jer.noble@apple.com>

        [EME][Mac] Crash in [AVStreamSession addStreamDataParser:]; uncaught exception
        https://bugs.webkit.org/show_bug.cgi?id=153495

        Reviewed by Eric Carlson.

        When AVContentKeySession is not available, fall back to pre-AVContentKeySession behavior;
        namely, immediately create an AVStreamSession object in
        willProvideContentKeyRequestInitializationData, rather than waiting for didProvide.

        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
        (WebCore::SourceBufferPrivateAVFObjC::willProvideContentKeyRequestInitializationDataForTrackID):

2016-01-26  Dean Jackson  <dino@apple.com>

        [iOS] Documents without an explicit width should not get fast tapping
        https://bugs.webkit.org/show_bug.cgi?id=153465
        <rdar://problem/23962529>

        Reviewed by Simon Fraser (and Wenson Hseih).

        As the title says, documents that do not set a viewport should
        not get the fast click behaviour. There were complaints that we broke
        double-tap to scroll in ImageDocuments where the image was narrow and long.

        The fix is to just keep a flag that tells the UI process if the
        width was explicit. However, it turns out that those ImageDocuments
        are given an explicit device-width, which is fine for scaling but
        really should behave as auto for fast tapping. So we also need
        to tell the UIProcess if the viewport arguments came from an
        ImageDocument.

        Test: fast/events/ios/viewport-no-width-value-allows-double-tap.html

        * dom/ViewportArguments.cpp:
        (WebCore::findSizeValue): Add a parameter that toggles a flag
        if the size was explicitly set.
        (WebCore::setViewportFeature): Remember if the width was
        explicit.
        * dom/ViewportArguments.h: Add a widthWasExplicit flag.
        (WebCore::ViewportArguments::operator==):

2016-01-25  Dave Hyatt  <hyatt@apple.com>

        Speculative fixes for crashing in viewportChangeAffectedPicture
        https://bugs.webkit.org/show_bug.cgi?id=153450

        Reviewed by Dean Jackson.

        Don't attach any conditions to the removal of a picture element from
        the document's HashSet. This ensures that if the condition is ever
        wrong for any reason, we'll still remove the picture element on
        destruction.

        Fix the media query evaluation to match the other evaluations (used by
        the preload scanner and HTMLImageElement). This includes using the
        document element's computed style instead of our own and also null
        checking the document element first. This is the likely cause of the
        crashes.

        * html/HTMLPictureElement.cpp:
        (WebCore::HTMLPictureElement::~HTMLPictureElement):
        (WebCore::HTMLPictureElement::didMoveToNewDocument):
        (WebCore::HTMLPictureElement::viewportChangeAffectedPicture):

2016-01-26  Chris Dumez  <cdumez@apple.com>

        Make sure a page is still PageCache-able after firing the 'pagehide' events
        https://bugs.webkit.org/show_bug.cgi?id=153449

        Reviewed by Andreas Kling.

        Make sure a page is still PageCache-able after firing the 'pagehide'
        events and abort if it isn't. This should improve robustness and it is
        easy for pagehide event handlers to do things that would make a Page no
        longer PageCache-able and this leads to bugs that are difficult to
        investigate.

        To achieve this, the 'pagehide' event firing logic was moved out of the
        CachedFrame constructor. It now happens earlier in
        PageCache::addIfCacheable() after checking if the page is cacheable and
        before constructing the CachedPage / CachedFrames. After firing the
        'pagehide' event in PageCache::addIfCacheable(), we check again that
        the page is still cacheable and we abort early if it is not.

        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::CachedFrame):
        * history/PageCache.cpp:
        (WebCore::setInPageCache):
        (WebCore::firePageHideEventRecursively):
        (WebCore::PageCache::addIfCacheable):
        * history/PageCache.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):

2016-01-26  Beth Dakin  <bdakin@apple.com>

        Rubber-stamped by Tim Horton.

        Add one more bit of SPI.
        * platform/spi/mac/NSSpellCheckerSPI.h:

2016-01-26  Olivier Blin  <olivier.blin@softathome.com>

        Fix build with ENABLE_DEVICE_ORIENTATION on non-iOS platforms
        https://bugs.webkit.org/show_bug.cgi?id=153490

        Reviewed by Michael Catanzaro.

        This has been broken since r178702, which changed the Page
        argument from a pointer to a reference in logCanCachePageDecision().

        No new tests since this is a build fix.

        * history/PageCache.cpp:
        (WebCore::canCachePage):

2016-01-25  Ada Chan  <adachan@apple.com>

        Move WebVideoFullscreenManager and related classes from iOS specific folders to cocoa folders
        https://bugs.webkit.org/show_bug.cgi?id=153473

        Reviewed by Eric Carlson.

        No new tests, just moving files.

        * WebCore.xcodeproj/project.pbxproj:
        Update due to changes to the file locations.
        * platform/cocoa/WebVideoFullscreenModel.h: Renamed from Source/WebCore/platform/ios/WebVideoFullscreenModel.h.
        * platform/cocoa/WebVideoFullscreenModelVideoElement.h: Renamed from Source/WebCore/platform/ios/WebVideoFullscreenModelVideoElement.h.
        (WebCore::WebVideoFullscreenModelVideoElement::create):
        Fix a style error by moving the opening curly brace down one line.
        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm: Renamed from Source/WebCore/platform/ios/WebVideoFullscreenModelVideoElement.mm.

2016-01-26  Konstantin Tokarev  <annulen@yandex.ru>

        Do not convert GlyphBufferAdvance to FloatSize
        https://bugs.webkit.org/show_bug.cgi?id=153429

        GlyphBufferAdvance is not necessaryly convertible to FloatSize.
        Also, this code was doing extra work by transforming height value.

        Reviewed by Antti Koivisto.

        No new tests needed.

        * rendering/svg/SVGTextRunRenderingContext.cpp:
        (WebCore::SVGGlyphToPathTranslator::extents):

2016-01-22  Ada Chan  <adachan@apple.com>

        Enable API related to the video fullscreen layer in MediaPlayerPrivateAVFoundationObjC
        also on Mac with video presentation mode support.
        https://bugs.webkit.org/show_bug.cgi?id=153222

        Reviewed by Eric Carlson.

        No new tests. Covered by existing tests.

        Introduce VideoFullscreenLayerManager to deal with the video layer when switching
        between inline and fullscreen mode. We'll reuse it in other MediaPlayerPrivateInterface
        implementations.

        Now that MediaPlayerPrivateAVFoundationObjC's platform layer can be a WebVideoContainerLayer,
        this exposes a bug in PlatformCALayerCocoa::clone() where we assumed the platform layer
        is always an AVPlayerLayer if the PlatformCALayer's layer type is LayerTypeAVPlayerLayer.
        Add a helper method to get an AVPlayerLayer from a PlatformCALayerCocoa (which also handles
        WebVideoContainerLayer case) and use it in PlatformCALayerCocoa::clone().

        * WebCore.xcodeproj/project.pbxproj:
        Add VideoFullscreenLayerManager to the project.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC):
        Create m_videoFullscreenLayerManager. The video inline layer, video fullscreen layer,
        and the video fullscreen frame are now managed by that class.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer):
        Just call VideoFullscreenLayerManager::setVideoLayer() to handle adding the video
        layer in either the inline or fullscreen layer.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer):
        Call VideoFullscreenLayerManager::didDestroyVideoLayer().
        (WebCore::MediaPlayerPrivateAVFoundationObjC::platformLayer):
        Get the video inline layer from VideoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenLayer):
        Call VideoFullscreenLayerManager::setVideoFullscreenLayer().
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenFrame):
        Call VideoFullscreenLayerManager::setVideoFullscreenFrame().
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenMode):
        Guard the iOS specific code properly.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateVideoLayerGravity):
        Get the video fullscreen layer from VideoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::requiresTextTrackRepresentation):
        Ditto.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::syncTextTrackBounds):
        Get the video fullscreen layer and video fullscreen frame from VideoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setTextTrackRepresentation):
        Get the video fullscreen layer from VideoFullscreenLayerManager.

        * platform/graphics/avfoundation/objc/VideoFullscreenLayerManager.h: Added.
        (WebCore::VideoFullscreenLayerManager::videoInlineLayer):
        (WebCore::VideoFullscreenLayerManager::videoFullscreenLayer):
        (WebCore::VideoFullscreenLayerManager::videoFullscreenFrame):
        * platform/graphics/avfoundation/objc/VideoFullscreenLayerManager.mm: Added.
        (-[WebVideoContainerLayer setBounds:]):
        (-[WebVideoContainerLayer setPosition:]):
        WebVideoContainerLayer was moved from MediaPlayerPrivateAVFoundationObjC.mm.
        (WebCore::VideoFullscreenLayerManager::create):
        (WebCore::VideoFullscreenLayerManager::VideoFullscreenLayerManager):
        (WebCore::VideoFullscreenLayerManager::setVideoLayer):
        Code moved from MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer().
        (WebCore::VideoFullscreenLayerManager::setVideoFullscreenLayer):
        Code moved from MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenLayer().
        (WebCore::VideoFullscreenLayerManager::setVideoFullscreenFrame):
        Code moved from MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenFrame().
        (WebCore::VideoFullscreenLayerManager::didDestroyVideoLayer):
        Code moved from MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer().

        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.h:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (PlatformCALayerCocoa::clone):
        Use the new PlatformCALayerCocoa::avPlayerLayer() method to get the AVPlayerLayer from both the
        destination and source PlatformCALayers.
        (PlatformCALayerCocoa::avPlayerLayer):
        Return nil if the layer type is not LayerTypeAVPlayerLayer. Otherwise, return the
        platform layer if it is indeed an AVPlayerLayer. If not, it should be a WebVideoContainerLayer
        and we should return its sublayer which should be an AVPlayerLayer.

2016-01-26  Chris Dumez  <cdumez@apple.com>

        First parameter to window.showModalDialog() should be mandatory
        https://bugs.webkit.org/show_bug.cgi?id=153436

        Reviewed by Youenn Fablet.

        Make window.showModalDialog()'s first parameter mandatory to match the
        last specification containing it:
        http://dev.w3.org/html5/spec-preview/user-prompts.html#dialogs-implemented-using-separate-documents

        The new behavior also matches Firefox, while Chrome no longer supports
        this operation.

        With this change, the W3C HTML test suite no longer hangs in the middle
        because it mistakenly pops up a modal dialog during testing.

        Test: fast/dom/Window/showModalDialog-mandatory-parameter.html

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::showModalDialog):

2016-01-26  Eric Carlson  <eric.carlson@apple.com>

        LayoutTest media/airplay-target-availability.html is flaky
        https://bugs.webkit.org/show_bug.cgi?id=153100
        <rdar://problem/24346796>

        Reviewed by Daniel Bates.

        No new tests, media/airplay-target-availability.html was updated

        * Modules/mediasession/WebMediaSessionManager.cpp:
        (WebCore::WebMediaSessionManager::clientStateDidChange): Schedule a configuration scan if
          any of the config flags have changed.
        (WebCore::WebMediaSessionManager::configurePlaybackTargetMonitoring): Update logging.

2016-01-25  Carlos Garcia Campos  <cgarcia@igalia.com>

        Main frame scrollbars not updated on hovering when using overlay scrollbars
        https://bugs.webkit.org/show_bug.cgi?id=153304

        Reviewed by Michael Catanzaro.

        Legacy scrollbars were fixed in r194155, but overlay scrollbars
        are not notified when they are hovered. This is because the layer
        hit test in RenderView::hitTest always returns true when using
        overlay scrollbars and we are returning early in such case,
        ignoring the HitTestRequest::AllowFrameScrollbars flag. So, in
        case of using overlay scrollbars we still need to check the
        RenderView scrollbars even when the layer hit test succeeded.

        * rendering/RenderView.cpp:
        (WebCore::RenderView::hitTest):

2016-01-26  Daniel Bates  <dabates@apple.com>

        LayoutTest http/tests/security/xssAuditor/embed-tag-in-path-unterminated.html crashing
        https://bugs.webkit.org/show_bug.cgi?id=153250
        <rdar://problem/12172843>
        And
        <rdar://problem/24248040>

        Reviewed by Alexey Proskuryakov.

        Remove an incorrect assertion that the absolute URL associated with a protection space cannot
        contain consecutive forward slash (/) characters. A URL can contain consecutive forward slashes.
        This also makes the invariants for CredentialStorage::findDefaultProtectionSpaceForURL() symmetric
        with the invariants for WebCore::protectionSpaceMapKeyFromURL().

        Tests: http/tests/loading/basic-auth-load-URL-with-consecutive-slashes.html
               http/tests/xmlhttprequest/basic-auth-load-URL-with-consecutive-slashes.html

        * platform/network/CredentialStorage.cpp:
        (WebCore::CredentialStorage::findDefaultProtectionSpaceForURL):

2016-01-26  Daniel Bates  <dabates@apple.com>

        Remove XMLHttpRequestException
        https://bugs.webkit.org/show_bug.cgi?id=102698
        <rdar://problem/24338476>

        Reviewed by Chris Dumez.

        Inspired by a patch by Erik Arvidsson.

        As per <https://xhr.spec.whatwg.org> (21 January 2016) and <https://html.spec.whatwg.org/multipage/workers.html#dom-workerglobalscope-importscripts> (25 January 2016)
        XMLHttpRequest and WorkerGlobalScope.importScripts() should throw a DOMException object instead
        of a XMLHttpRequestException object when a NetworkError, AbortError, or TimeoutError occur. This
        makes the behavior of WebKit more closely conform to these standards as well as the behavior of
        other browsers.

        * CMakeLists.txt: Remove entries for XMLHttpRequestException.idl and XMLHttpRequestException.cpp.
        * DerivedSources.make: Remove entry for XMLHttpRequestException.idl.
        * WebCore.order: Remove exported symbols for XMLHttpRequestException.
        * WebCore.vcxproj/WebCore.vcxproj: Remove entries for JSXMLHttpRequestException.{cpp, h}, XMLHttpRequestException.{cpp, h}
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * bindings/js/JSExceptionBase.cpp:
        (WebCore::toExceptionBase): Remove logic for XMLHttpRequestException.
        * dom/DOMExceptions.in: Remove entry for XMLHttpRequestException.
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::importScripts): Throw DOMException.NETWORK_ERR instead of XMLHttpRequestException.NETWORK_ERR.
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::createRequest): Ditto.
        (WebCore::XMLHttpRequest::didFail): Throw DOMException.ABORT_ERR instead of XMLHttpRequestException.ABORT_ERR.
        (WebCore::XMLHttpRequest::didReachTimeout): Throw DOMException.TIMEOUT_ERR instead of XMLHttpRequestException.TIMEOUT_ERR.
        * xml/XMLHttpRequestException.cpp: Removed.
        * xml/XMLHttpRequestException.h: Removed.
        * xml/XMLHttpRequestException.idl: Removed.

2016-01-25  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        WebCoreJSBuiltins do not use to do conditional include
        https://bugs.webkit.org/show_bug.cgi?id=153306

        Reviewed by Alex Christensen.

        Removing compilation guards as builtin generator adds them in the files themselves.
        Fixing MediaDevices.js to generate MEDIA_STREAM compilation guard.

        No change in behavior.

        * Modules/mediastream/MediaDevices.js: Changing @optional to @conditional.
        * Modules/mediastream/NavigatorUserMedia.js: Making it @conditional.
        * bindings/js/WebCoreJSBuiltins.cpp:
        * bindings/js/WebCoreJSBuiltins.h:

2016-01-25  Alex Christensen  <achristensen@webkit.org>

        Fix internal Windows build
        https://bugs.webkit.org/show_bug.cgi?id=153469

        Reviewed by Brent Fulgham.

        * CMakeLists.txt:
        Pass the GPERF_EXECUTABLE that we found to perl scripts so they can use it instead of just calling gperf.
        This is needed for builds where gperf is not in the PATH.
        * DerivedSources.make:
        Pass "gperf" as the gperf command to retain existing functionality on mac.
        * bindings/scripts/preprocess-idls.pl:
        (CygwinPathIfNeeded):
        * bindings/scripts/preprocessor.pm:
        (applyPreprocessor):
        Add /cygdrive/c/cygwin/bin to the PATH before calling cygpath.
        This is needed for builds where we are using cygwin, but C:/cygwin/bin is not in the PATH.
        * css/makeSelectorPseudoClassAndCompatibilityElementMap.py:
        * css/makeSelectorPseudoElementsMap.py:
        * css/makeprop.pl:
        * platform/network/create-http-header-name-table:
        Use the gperf executable passed in as a command line parameter if it is given.

2016-01-25  Simon Fraser  <simon.fraser@apple.com>

        DisplayList items can log paths now
        https://bugs.webkit.org/show_bug.cgi?id=153417

        Reviewed by Zalan Bujtas.

        Now that Path supports TextStream logging, clean up its output a little and
        enable dumping of Paths in DisplayListItems.

        * platform/graphics/Path.cpp:
        (WebCore::operator<<):
        * platform/graphics/displaylists/DisplayListItems.cpp:
        (WebCore::DisplayList::operator<<):

2016-01-25  Antti Koivisto  <antti@apple.com>

        Fix the comment.

        * rendering/style/RenderStyle.h:

2016-01-25  Enrica Casucci  <enrica@apple.com>

        Add support for DataDetectors in WK (iOS).
        https://bugs.webkit.org/show_bug.cgi?id=152989
        rdar://problem/22855960

        Reviewed by Tim Horton.

        Adding new helper functions for data detection related tasks.
        The patch also fixes a bug when creating DOM ranges from DDQueryRange
        spanning multiple fragments.

        * editing/cocoa/DataDetection.h:
        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::isDataDetectorLink):
        (WebCore::DataDetection::dataDetectorIdentifier):
        (WebCore::detectItemAtPositionWithRange):
        (WebCore::DataDetection::detectItemAroundHitTestResult):
        (WebCore::resultIsURL):
        (WebCore::removeResultLinksFromAnchor):
        (WebCore::searchForLinkRemovingExistingDDLinks):
        (WebCore::DataDetection::detectContentInRange):

2016-01-25  Myles C. Maxfield  <mmaxfield@apple.com>

        Remove broken cache from CSSFontFaceSource
        https://bugs.webkit.org/show_bug.cgi?id=153440

        Reviewed by Simon Fraser.

        This cache has been broken since 2013 (r158085). Given we didn't notice a perf
        hit when it broke, and the fact it's been broken for years, it clearly isn't
        necessary.

        https://bugs.webkit.org/show_bug.cgi?id=153414 consists of a fairly invasive
        change to CSSFontFaceSource; this patch includes a working version of this
        cache, along with an easy way to enable/disable it (to measure possible perf
        changes).

        This patch is a short-term cleanup patch in the mean time until the above
        invasive change gets landed.

        No new tests because there is no behavior (or performance!) change.

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):
        (WebCore::CSSFontFaceSource::~CSSFontFaceSource): Deleted.
        (WebCore::CSSFontFaceSource::pruneTable): Deleted.
        (WebCore::CSSFontFaceSource::fontLoaded): Deleted.
        * css/CSSFontFaceSource.h:

2016-01-25  Sam Weinig  <sam@webkit.org>

        Try to fix the simulator build.

        * platform/spi/cocoa/DataDetectorsCoreSPI.h:

2016-01-25  Sam Weinig  <sam@webkit.org>

        Roll back in r195559 with a build fix.

        * WebCore.xcodeproj/project.pbxproj:
        * editing/cocoa/DataDetection.mm:
        * platform/cocoa/DataDetectorsCoreSoftLink.mm: Added.
        * platform/cocoa/DataDetectorsCoreSoftLink.h: Added.
        * platform/spi/cocoa/DataDetectorsCoreSPI.h:

2016-01-25  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195559.
        https://bugs.webkit.org/show_bug.cgi?id=153458

        This change broke the iOS build (Requested by ryanhaddad on
        #webkit).

        Reverted changeset:

        "Fix the ASAN build."
        http://trac.webkit.org/changeset/195559

2016-01-25  Antti Koivisto  <antti@apple.com>

        Resolving direction and writing mode properties should not mutate document
        https://bugs.webkit.org/show_bug.cgi?id=153446

        Reviewed by Andreas Kling.

        Replace directionSetOnDocumentElement/writingModeSetOnDocumentElement document flags them with style flags.

        * css/StyleBuilderCustom.h:
        (WebCore::StyleBuilderCustom::applyValueDirection):
        (WebCore::StyleBuilderCustom::resetEffectiveZoom):
        (WebCore::StyleBuilderCustom::applyValueWebkitWritingMode):
        (WebCore::StyleBuilderCustom::applyValueWebkitTextOrientation):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::styleForElement):
        * dom/Document.cpp:
        (WebCore::Document::Document):
        * dom/Document.h:
        (WebCore::Document::markers):
        (WebCore::Document::directionSetOnDocumentElement): Deleted.
        (WebCore::Document::writingModeSetOnDocumentElement): Deleted.
        (WebCore::Document::setDirectionSetOnDocumentElement): Deleted.
        (WebCore::Document::setWritingModeSetOnDocumentElement): Deleted.
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::styleDidChange):
        * rendering/style/RenderStyle.h:
        * style/StyleResolveForDocument.cpp:
        (WebCore::Style::resolveForDocument):

2016-01-25  Sam Weinig  <sam@webkit.org>

        Fix the ASAN build.

        * WebCore.xcodeproj/project.pbxproj:
        * editing/cocoa/DataDetection.mm:
        * platform/cocoa/DataDetectorsCoreSoftLink.mm: Added.
        * platform/cocoa/DataDetectorsCoreSoftLink.h: Added.
        * platform/spi/cocoa/DataDetectorsCoreSPI.h:

2016-01-25  Alex Christensen  <achristensen@webkit.org>

        [Win] Another build fix after r195545

        * CMakeLists.txt:
        r195548 didn't change all the pre-builds back to post-builds.

2016-01-25  Alex Christensen  <achristensen@webkit.org>

        [Win] Fix clean build after r195545.

        * CMakeLists.txt:
        * PlatformWin.cmake:
        I got a little carried away.  WebCore already had a pre-build event.  It was correct before r195545.

2016-01-25  Beth Dakin  <bdakin@apple.com>

        Handle soft spaces after accepted candidates
        https://bugs.webkit.org/show_bug.cgi?id=153331
        -and corresponding-
        rdar://problem/23958418

        Reviewed by Darin Adler.

        Candidates now come with built-in spaces, so we should not insert a space for 
        them.
        * editing/Editor.cpp:
        (WebCore::Editor::handleAcceptedCandidate):

        New SPI to properly handle these soft spaces.
        * platform/spi/mac/NSSpellCheckerSPI.h:

2016-01-25  Alex Christensen  <achristensen@webkit.org>

        [Win] Copy forwarding headers before building a project
        https://bugs.webkit.org/show_bug.cgi?id=153434

        Reviewed by Brent Fulgham.

        * CMakeLists.txt:
        * PlatformWin.cmake:

2016-01-25  Brady Eidson  <beidson@apple.com>

        Modern IDB: Implement getIndexRecord in the SQLite backing store.
        https://bugs.webkit.org/show_bug.cgi?id=153425

        Reviewed by Darin Adler.

        No new tests (Some failures now pass, other failures progressed closer to passing).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::getIndexRecord):

2016-01-25  Eric Carlson  <eric.carlson@apple.com>

        Media "ended" event incorrectly fires when currentTime is set
        https://bugs.webkit.org/show_bug.cgi?id=150348
        <rdar://problem/24247974>

        Reviewed by Jer Noble.

        Test: media/media-ended-fired-once.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::invalidateCachedTime): Always mark m_cachedTime as invalid.

2016-01-25  Konstantin Tokarev  <annulen@yandex.ru>

        Do not convert GlyphBufferAdvance to FloatSize
        https://bugs.webkit.org/show_bug.cgi?id=153421

        Reviewed by Simon Fraser.

        No new tests needed.

        * platform/graphics/displaylists/DisplayListItems.cpp:
        (WebCore::DisplayList::DrawGlyphs::computeBounds):

2016-01-22  Ryosuke Niwa  <rniwa@webkit.org>

        document.createElement should be able to create a custom element
        https://bugs.webkit.org/show_bug.cgi?id=153173

        Reviewed by Darin Adler.

        Added the support for constructing a custom element via document.createElement.

        Extracted HTMLElementFactory::createKnownElement, which returns nullptr when the specified name doesn't match
        any builtin element instead of out of HTMLUnknownElement, out of HTMLElementFactory::createElement.

        Test: fast/custom-elements/Document-createElement.html

        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::constructHTMLElement): Added. Constructs a custom element by invoking its
        constructor. We allow exceptions to be thrown by the constructor so the caller is responsible for checking
        any exceptions in the ExecState before preceeding if the returned value is null.

        * bindings/js/JSCustomElementInterface.h:
        (WebCore::JSCustomElementInterface::constructSVGElement): Added.
        * bindings/js/JSElementCustom.cpp:
        (WebCore::toJSNewlyCreated): Exit early if the element is a custom element as the wrapper had already been
        created by super() call inside the custom element'c constructor.

        * bindings/js/JSMainThreadExecState.h:
        (WebCore::JSMainThreadExecState):
        * bindings/js/JSMainThreadExecStateInstrumentation.h:
        (WebCore::JSMainThreadExecState::instrumentFunctionInternal): Generalized from instrumentFunctionCall so that
        we can use it for both call and construct.
        (WebCore::JSMainThreadExecState::instrumentFunctionCall): Specialized the above function for call.
        (WebCore::JSMainThreadExecState::instrumentFunctionConstruct): Ditto for construct.

        * dom/CustomElementDefinitions.cpp:
        (WebCore::CustomElementDefinitions::findInterface): Added.
        * dom/CustomElementDefinitions.h:

        * dom/Document.cpp:
        (WebCore::createHTMLElementWithNameValidation): Extracted from createElement.
        (WebCore::Document::createElementForBindings): Renamed from createElement. Specifies
        ShouldCreateCustomElement::Create to create a custom element before using fallback elements.
        * dom/Document.h:
        * dom/Document.idl:

        * dom/Node.h:
        (WebCore::Node::isCustomElement): Added. This flag is used to identify a custom element.
        (WebCore::Node::setIsCustomElement): Added.

        * dom/make_names.pl: Extracted createKnownElement from createElement for createHTMLElementWithNameValidation.

        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::createInspectorStyleSheetForDocument): Use qualified name object to instantiate
        a style element and set type content attribute.
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::setNodeName): Use createElementForBindings here since we might be creating an
        arbitrary element here. Also use RefPtr instead of raw pointers while mutating DOM for safety.

2016-01-25  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r192773): [GTK] maps.google.com unresponsive/stalls since r192773
        https://bugs.webkit.org/show_bug.cgi?id=153194

        Reviewed by Michael Catanzaro.

        In r192773 we implemented the JavaScriptCore garbage collector
        timers for the GTK+ port. Those timers schedule sources in the
        current thread default main context, but JS web worker threads
        implementation doesn't use WTF::RunLoop, but its own WorkerRunLoop
        class that doesn't create a GMainContext for the new thread. This
        means that for web sites using workers, we are now doing garbage
        collection of worker VMs in the main thread which ends up in a
        deadlock at some point. We need to ensure that worker threads
        create a GMainContext and push it as the default one for the
        thread before the WorkerGlobalScope is created. This way when the
        worker Heap is created, the GC timers use the right context to
        schedule their sources. And then we need to check if there are
        sources pending in the thread main context on every worker run
        loop iteration.

        * workers/WorkerRunLoop.cpp:
        (WebCore::WorkerRunLoop::runInMode):
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThread::workerThread):

2016-01-25  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195533.
        https://bugs.webkit.org/show_bug.cgi?id=153423

        It is again breaking builds of several ports (Requested by
        youenn on #webkit).

        Reverted changeset:

        "WebCoreJSBuiltins do not use to do conditional include"
        https://bugs.webkit.org/show_bug.cgi?id=153306
        http://trac.webkit.org/changeset/195533

2016-01-25  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        WebCoreJSBuiltins do not use to do conditional include
        https://bugs.webkit.org/show_bug.cgi?id=153306

        Reviewed by Alex Christensen.

        Removing compilation guards as builtin generator adds them in the files themselves.
        Fixing MediaDevices.js to generate MEDIA_STREAM compilation guard.

        No change in behavior.

        * Modules/mediastream/MediaDevices.js: Changing @optional to @conditional.
        * bindings/js/WebCoreJSBuiltins.cpp:
        * bindings/js/WebCoreJSBuiltins.h:

2016-01-25  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195531.
        https://bugs.webkit.org/show_bug.cgi?id=153420

        It is breaking builds of several ports (Requested by youenn on
        #webkit).

        Reverted changeset:

        "WebCoreJSBuiltins do not use to do conditional include"
        https://bugs.webkit.org/show_bug.cgi?id=153306
        http://trac.webkit.org/changeset/195531

2016-01-25  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        WebCoreJSBuiltins do not use to do conditional include
        https://bugs.webkit.org/show_bug.cgi?id=153306

        Reviewed by Alex Christensen.

        Removing compilation guards as builtin generator adds them in the files themselves.

        No change in behavior.

        * bindings/js/WebCoreJSBuiltins.cpp:
        * bindings/js/WebCoreJSBuiltins.h:

2016-01-25  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Implement Fetch API Headers
        https://bugs.webkit.org/show_bug.cgi?id=152384

        Reviewed by Darin Adler.

        Adding Fetch Headers API as a wapper around HTTPHeaderMap.

        Tests: imported/w3c/web-platform-tests/fetch/api/headers/headers-basic.html
               imported/w3c/web-platform-tests/fetch/api/headers/headers-casing.html
               imported/w3c/web-platform-tests/fetch/api/headers/headers-errors.html
               imported/w3c/web-platform-tests/fetch/api/headers/headers-idl.html
               imported/w3c/web-platform-tests/fetch/api/headers/headers-nameshake.html
               imported/w3c/web-platform-tests/fetch/api/headers/headers-normalize.html
               imported/w3c/web-platform-tests/fetch/api/headers/headers-structure.html

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * Modules/fetch/FetchHeaders.cpp: Added.
        (WebCore::FetchHeaders::initializeWith):
        (WebCore::isForbiddenHeaderName):
        (WebCore::isForbiddenResponseHeaderName):
        (WebCore::isSimpleHeader):
        (WebCore::canWriteHeader):
        (WebCore::FetchHeaders::append):
        (WebCore::FetchHeaders::remove):
        (WebCore::FetchHeaders::get):
        (WebCore::FetchHeaders::has):
        (WebCore::FetchHeaders::set):
        * Modules/fetch/FetchHeaders.h: Added.
        (WebCore::FetchHeaders::create):
        (WebCore::FetchHeaders::~FetchHeaders):
        (WebCore::FetchHeaders::internalHeaders):
        (WebCore::FetchHeaders::FetchHeaders):
        * Modules/fetch/FetchHeaders.idl: Added.
        * Modules/fetch/FetchHeaders.js: Added.
        (initializeFetchHeaders):
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/WebCoreBuiltinNames.h:
        * bindings/js/WebCoreJSBuiltins.cpp:
        * bindings/js/WebCoreJSBuiltins.h:
        (WebCore::JSBuiltinFunctions::JSBuiltinFunctions):
        (WebCore::JSBuiltinFunctions::fetchHeadersBuiltins):
        * platform/network/HTTPHeaderMap.cpp:
        (WebCore::HTTPHeaderMap::contains):
        (WebCore::HTTPHeaderMap::remove):
        * platform/network/HTTPHeaderMap.h:

2016-01-22  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] grid shorthand must reset gap properties to their initial values
        https://bugs.webkit.org/show_bug.cgi?id=153354

        Reviewed by Darin Adler.

        Both 'grid-row-gap' & 'grid-column-gap' are considered reset-only subproperties of the
        'grid' shorthand meaning that, even thought the shorthand does not offer a way to set
        their values, it must in any case reset them to the initial ones.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridShorthand):
        * css/CSSPropertyNames.in:

2016-01-24  Brady Eidson  <beidson@apple.com>

        Modern IDB: Implement deleteIndex and getCount for the SQLite backing store.
        https://bugs.webkit.org/show_bug.cgi?id=153415

        Reviewed by Darin Adler.

        No new tests (Handful of tests now pass, improvements on a handful of others).

        * Modules/indexeddb/server/IDBBackingStore.h:
        
        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::deleteIndex):
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:
        
        * Modules/indexeddb/server/MemoryObjectStore.cpp:
        (WebCore::IDBServer::MemoryObjectStore::takeIndexByIdentifier):
        (WebCore::IDBServer::MemoryObjectStore::deleteIndex):
        (WebCore::IDBServer::MemoryObjectStore::deleteAllIndexes):
        (WebCore::IDBServer::MemoryObjectStore::takeIndexByName): Deleted.
        * Modules/indexeddb/server/MemoryObjectStore.h:
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getCount):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
        
        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::maybeCreateBackingStoreCursor):
        (WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
        * Modules/indexeddb/server/SQLiteIDBCursor.h:
        
        * Modules/indexeddb/server/SQLiteIDBTransaction.cpp:
        (WebCore::IDBServer::SQLiteIDBTransaction::maybeOpenBackingStoreCursor):
        * Modules/indexeddb/server/SQLiteIDBTransaction.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::deleteIndex):
        (WebCore::IDBServer::UniqueIDBDatabase::performDeleteIndex):
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformDeleteIndex):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        
        * Modules/indexeddb/shared/IDBObjectStoreInfo.cpp:
        (WebCore::IDBObjectStoreInfo::deleteIndex):
        * Modules/indexeddb/shared/IDBObjectStoreInfo.h:

2016-01-24  Brady Eidson  <beidson@apple.com>

        Unreviewed, speculative fix for:
        Modern IDB: Some IDB tests crash in ~SQLiteIDBBackingStore
        https://bugs.webkit.org/show_bug.cgi?id=153418

        No new tests.

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::~SQLiteIDBBackingStore): Clear the global object
          before wiping out the VM.

2016-01-24  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Reduce PassRefPtr uses in dom - 4
        https://bugs.webkit.org/show_bug.cgi?id=153270

        Reviewed by Darin Adler.

        As a step to remove PassRefPtr uses, this patch reduces the uses in WebCore/dom.

        * bindings/js/JSDeviceMotionEventCustom.cpp:
        (WebCore::JSDeviceMotionEvent::initDeviceMotionEvent):
        * dom/DeviceMotionData.cpp:
        (WebCore::DeviceMotionData::create):
        (WebCore::DeviceMotionData::DeviceMotionData):
        * dom/DeviceMotionData.h:
        * dom/Document.cpp:
        (WebCore::Document::setBodyOrFrameset):
        (WebCore::Document::setFocusedElement):
        (WebCore::Document::setDecoder):
        (WebCore::Document::pushCurrentScript):
        * dom/Document.h:
        * dom/Event.cpp:
        (WebCore::Event::cloneFor):
        * dom/Event.h:
        * dom/MouseEvent.cpp:
        (WebCore::MouseEvent::cloneFor):
        * dom/MouseEvent.h:
        * dom/NodeIterator.cpp:
        (WebCore::NodeIterator::NodePointer::NodePointer):
        (WebCore::NodeIterator::NodeIterator):
        * dom/NodeIterator.h:
        (WebCore::NodeIterator::create):
        * html/RadioInputType.cpp:
        (WebCore::RadioInputType::handleKeydownEvent):
        * platform/ios/DeviceMotionClientIOS.mm:
        (WebCore::DeviceMotionClientIOS::motionChanged):
        * xml/XSLTProcessor.cpp:
        (WebCore::XSLTProcessor::createDocumentFromSource):

2016-01-24  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] General cleanup
        https://bugs.webkit.org/show_bug.cgi?id=153403

        Reviewed by Darin Adler.

        It turns out that CSSFontFaceSource::m_hasExternalSVGFont exactly equals
        whether or not CSSFontFaceSource::m_font is a CachedSVGFont. Therefore,
        the variable is redundant.

        In addition, it was being passed to functions on CSSFontFaceSource::m_font,
        which means it was always true inside the CachedSVGFont subclass and
        always false for the CachedFont. Therefore, there is no reason pass this
        variable to these functions because its value can be determined at
        authorship time.

        No new tests because there is no behavior change.

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):
        (WebCore::CSSFontFaceSource::CSSFontFaceSource): Deleted.
        * css/CSSFontFaceSource.h:
        * css/CSSFontSelector.cpp:
        (WebCore::createFontFace):
        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::ensureCustomFontData):
        (WebCore::CachedFont::createFont):
        * loader/cache/CachedFont.h:
        * loader/cache/CachedSVGFont.cpp:
        (WebCore::CachedSVGFont::createFont):
        (WebCore::CachedSVGFont::ensureCustomFontData):
        * loader/cache/CachedSVGFont.h:
        * platform/network/HTTPParsers.cpp:
        (WebCore::isValidHTTPToken):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::uppercaseKnownHTTPMethod):

2016-01-24  Chris Dumez  <cdumez@apple.com>

        An XMLDocument interface should be exposed on the global Window object
        https://bugs.webkit.org/show_bug.cgi?id=153378
        <rdar://problem/24315465>

        Reviewed by Darin Adler.

        Expose an XMLDocument interface on the global Window object, as per:
        - https://dom.spec.whatwg.org/#xmldocument

        DOMImplementation.createDocument() now returns an XMLDocument instead
        of a Document, as per:
        - https://dom.spec.whatwg.org/#dom-domimplementation-createdocument

        Previously, WebKit would alias XMLDocument to Document which caused
        some W3C tests to fail.

        Chrome and Firefox already match the specification here.

        No new tests, already covered by existing tests.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::createNewDocumentWrapper):
        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createDocument):
        * dom/DOMImplementation.h:
        * dom/DOMImplementation.idl:
        * dom/Document.cpp:
        (WebCore::Document::cloneDocumentWithoutChildren):
        * dom/Document.h:
        (WebCore::Document::isXMLDocument):
        (WebCore::Document::create): Deleted.
        (WebCore::Document::createNonRenderedPlaceholder): Deleted.
        * dom/XMLDocument.h: Added.
        (WebCore::XMLDocument::create):
        (WebCore::XMLDocument::createXHTML):
        (WebCore::XMLDocument::XMLDocument):
        (isType):
        * dom/XMLDocument.idl: Added.
        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::patchDocument):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::setOuterHTML):
        * page/DOMWindow.idl:
        * page/PageSerializer.cpp:
        (WebCore::SerializerMarkupAccumulator::SerializerMarkupAccumulator):
        * svg/SVGDocument.cpp:
        (WebCore::SVGDocument::SVGDocument):
        * svg/SVGDocument.h:
        * svg/SVGDocument.idl:
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::responseXML):
        * xml/XSLTProcessor.cpp:
        (WebCore::XSLTProcessor::createDocumentFromSource):

2016-01-24  Brady Eidson  <beidson@apple.com>

        Modern IDB: Support IDBObjectStore.createIndex in the SQLite backing store.
        https://bugs.webkit.org/show_bug.cgi?id=153410

        Reviewed by Darin Adler.

        No new tests (Covered by unskipping many existing tests).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::~SQLiteIDBBackingStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedHasIndexRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexRecord):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::maybeCreateBackingStoreCursor):
        (WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
        * Modules/indexeddb/server/SQLiteIDBCursor.h:

        * Modules/indexeddb/server/SQLiteIDBTransaction.cpp:
        (WebCore::IDBServer::SQLiteIDBTransaction::maybeOpenBackingStoreCursor):
        * Modules/indexeddb/server/SQLiteIDBTransaction.h:

2016-01-24  Simon Fraser  <simon.fraser@apple.com>

        Make the dumped display list representation a bit more compact
        https://bugs.webkit.org/show_bug.cgi?id=153409

        Reviewed by Zalan Bujtas.

        Don't make a group for every display list item.

        * platform/graphics/displaylists/DisplayList.cpp:
        (WebCore::DisplayList::DisplayList::asText):

2016-01-24  Simon Fraser  <simon.fraser@apple.com>

        Add testing for display list replay, and skip clipped-out items on replay
        https://bugs.webkit.org/show_bug.cgi?id=153408

        Reviewed by Zalan Bujtas.
        
        Make it possible to save and serialize a DisplayList of Items which were
        actually applied on replay, so that replay-time optimizations can be tested.
        
        This exposes internals.setElementTracksDisplayListReplay() and
        internals.replayDisplayListForElement().
        
        Do a trivial replay-time optimization, which is to skip items whose extents are
        outside the replay clip.

        Test: displaylists/replay-skip-clipped-rect.html

        * platform/graphics/GraphicsLayer.cpp:
        (WebCore::GraphicsLayer::GraphicsLayer):
        * platform/graphics/GraphicsLayer.h:
        (WebCore::GraphicsLayer::setIsTrackingDisplayListReplay):
        (WebCore::GraphicsLayer::isTrackingDisplayListReplay):
        (WebCore::GraphicsLayer::replayDisplayListAsText):
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::layerDisplayListMap): Use a singleton map to store the replay display lists
        to avoid bloating GraphicsLayerCA for test-only code. The map stores a pair of the
        replay list and a clip rect, which are both dumped. Dumping the clip rect ensures that
        we're reporting the replay for the correct tile in a test (since there will be a replay
        for each tile).
        (WebCore::GraphicsLayerCA::~GraphicsLayerCA):
        (WebCore::GraphicsLayerCA::platformCALayerPaintContents):
        (WebCore::GraphicsLayerCA::setIsTrackingDisplayListReplay):
        (WebCore::GraphicsLayerCA::replayDisplayListAsText):
        * platform/graphics/ca/GraphicsLayerCA.h:
        * platform/graphics/displaylists/DisplayList.h:
        (WebCore::DisplayList::DisplayList::appendItem):
        * platform/graphics/displaylists/DisplayListReplayer.cpp:
        (WebCore::DisplayList::Replayer::replay): In the unlikely event of tracking replays,
        allocate a new DisplayList and append to it items which actually get applied.
        * platform/graphics/displaylists/DisplayListReplayer.h:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::setIsTrackingDisplayListReplay):
        (WebCore::RenderLayerBacking::replayDisplayListAsText):
        * rendering/RenderLayerBacking.h:
        * testing/Internals.cpp:
        (WebCore::Internals::setElementTracksDisplayListReplay):
        (WebCore::Internals::replayDisplayListForElement):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-01-23  Wonchul Lee  <wonchul.lee@collabora.co.uk>

        [GTK] Fix media controls displaying without controls attribute
        https://bugs.webkit.org/show_bug.cgi?id=152500

        Media controls is not displayed without controls attribute by default
        when the video element has text track. It'll be displayed on fullscreen
        regardless of controls attribute.

        Reviewed by Michael Catanzaro.

        * Modules/mediacontrols/mediaControlsGtk.js:
        (ControllerGtk.prototype.shouldHaveControls):
        (ControllerGtk.prototype.reconnectControls):
        (ControllerGtk.prototype.removeControls):
        (ControllerGtk.prototype.configureControls): Deleted.
2016-01-23  Alex Christensen  <achristensen@webkit.org>

        Use credentials from a URL with NetworkSession like we did with ResourceHandle
        https://bugs.webkit.org/show_bug.cgi?id=153328

        Reviewed by Alexey Proskuryakov.

        This patch fixes at least http/tests/xmlhttprequest/basic-auth-credentials-escaping.html when using NetworkSession.

        * platform/network/ProtectionSpaceBase.h:
        (WebCore::ProtectionSpaceBase::encodingRequiresPlatformData):
        * platform/network/ResourceRequestBase.h:
        Add some WEBCORE_EXPORT macros for functions that are now used in WebKit2.

2016-01-23  Brady Eidson  <beidson@apple.com>

        Modern IDB: Implement clearing object stores and opening cursors in the SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153396

        Reviewed by Alex Christensen.

        No new tests (Some failing tests now pass, others improved).

        Copy more LegacyIDB SQLite backend code over to the new SQLite backend.
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::clearObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::openCursor):
        (WebCore::IDBServer::SQLiteIDBBackingStore::iterateCursor):

2016-01-22  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195493.
        https://bugs.webkit.org/show_bug.cgi?id=153397

        Broke authenticaiton tests (leaks credentials) (Requested by
        ap on #webkit).

        Reverted changeset:

        "LayoutTest http/tests/security/xssAuditor/embed-tag-in-path-
        unterminated.html crashing"
        https://bugs.webkit.org/show_bug.cgi?id=153250
        http://trac.webkit.org/changeset/195493

2016-01-20  Ryosuke Niwa  <rniwa@webkit.org>

        HTMLElement::nodeName should not upper case non-ASCII characters
        https://bugs.webkit.org/show_bug.cgi?id=153231

        Reviewed by Darin Adler.

        Use the newly added convertToASCIIUppercase to generate the string for tagName and nodeName.

        Test: fast/dom/Element/tagName-must-be-ASCII-uppercase-in-HTML-document.html

        * dom/QualifiedName.cpp:
        (WebCore::QualifiedName::localNameUpper): Use convertToASCIIUppercase.
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::nodeName): Use convertToASCIIUppercase.

2016-01-22  Brady Eidson  <beidson@apple.com>

        Modern IDB: Disable simultaneous transactions in the SQLite backend for now.
        https://bugs.webkit.org/show_bug.cgi?id=153381

        Reviewed by Alex Christensen.

        No new tests (This resolves many of the currently crashing/asserting tests).

        Right now we're porting the Legacy IDB SQLite backend to Modern IDB.
        
        The way the Legacy backend works is restricted to one transaction at a time.
        
        There's many tricks we can play to resolve this, but that task is better performed
        once all of the basic functionality is done.
        
        Fixing this limitation is covered by https://bugs.webkit.org/show_bug.cgi?id=153382

        * Modules/indexeddb/server/IDBBackingStore.h: Add a "supports simultaneous transactions" getter.
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::deleteBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::openBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::enqueueTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::takeNextRunnableTransaction): If the backing store does
          not support simultaneous transactions but there is a transaction in progress, return.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2016-01-22  Chris Dumez  <cdumez@apple.com>

        document.charset should be an alias for document.characterSet
        https://bugs.webkit.org/show_bug.cgi?id=153367

        Reviewed by Ryosuke Niwa.

        document.charset should be an alias for document.characterSet:
        - https://dom.spec.whatwg.org/#dom-document-charset

        It should also be read-only.

        Chrome matches the specification.

        No new tests, already covered by existing tests.

        * dom/Document.h:
        * dom/Document.idl:

2016-01-22  Chris Dumez  <cdumez@apple.com>

        Document.open / Document.write should be prevented while the document is being unloaded
        https://bugs.webkit.org/show_bug.cgi?id=153255
        <rdar://problem/22741293>

        Reviewed by Ryosuke Niwa.

        Document.open / Document.write should be prevented while the document
        is being unloaded, as per the HTML specification:
        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-open (step 6)
        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-write (step 3)

        This patch is aligning our behavior with the specification and Firefox.
        Calling Document.open / Document.write during the document was being
        unloaded would cause us to crash as this was unexpected.

        Tests: fast/frames/page-hide-document-open.html
               fast/frames/page-unload-document-open.html

        * WebCore.xcodeproj/project.pbxproj:
        Add new IgnoreOpensDuringUnloadCountIncrementer.h header.

        * dom/Document.cpp:
        (WebCore::Document::open):
        Abort if the document's ignore-opens-during-unload counter is greater
        than zero, as per:
        https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-open (step 6)

        (WebCore::Document::write):
        Abort if the insertion point is undefined and the document's
        ignore-opens-during-unload counter is greater than zero, as per:
        https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-write (step 3)

        * dom/Document.h:
        Add data member to maintain the document's ignore-opens-during-unload counter:
        https://html.spec.whatwg.org/multipage/webappapis.html#ignore-opens-during-unload-counter

        * dom/IgnoreOpensDuringUnloadCountIncrementer.h: Added.
        Add utility class to increment / decrement a document's
        ignore-opens-during-unload counter.

        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::CachedFrame):
        When a page goes into PageCache, we don't end up calling
        FrameLoader::detachChildren() so we need to increment the document's
        ignore-opens-during-unload counter before calling stopLoading() on each
        subframe.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::detachChildren):
        detachChildren() will end up firing the pagehide / unload events in each
        child frame so we increment the parent frame's document's
        ignore-opens-during-unload counter. This behavior matches the text of:
        https://html.spec.whatwg.org/multipage/browsers.html#unload-a-document

        As per the spec, the document's ignore-opens-during-unload counter should
        be incremented before firing the pagehide / unload events at the document's
        Window object. It should be decremented only after firing the pagehide /
        unload events in each subframe. This is needed in case a subframe tries to
        call document.open / document.write on a parent frame's document, from its
        pagehide or unload handler.

        (WebCore::FrameLoader::dispatchUnloadEvents):
        Increment the document's ignore-opens-during-unload counter before firing
        the pagehide / unload events and decrement it after. As per the spec, we
        are not supposed to decrement this early. We actually supposed to wait
        until the pagehide / unload events have been fired in all the subframes.
        For this reason, we take care of re-incrementing the document's
        ignore-opens-during-unload in detachChildren(), which will take care of
        firing the pagehide / unload in the subframes.

2016-01-22  Brady Eidson  <beidson@apple.com>

        Modern IDB: Implement put, get, and delete records for the SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153375

        Reviewed by Alex Christensen.

        No new tests (Covered by many existing tests now passing).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::keyExistsInObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteRange):
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getRecord):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

2016-01-22  Enrica Casucci  <enrica@apple.com>

        Add support for DataDetectors in WK (iOS).
        https://bugs.webkit.org/show_bug.cgi?id=152989
        rdar://problem/22855960

        Reviewed by Tim Horton.

        This patch adds the logic to perform data detection and modify
        the DOM by adding data detector links as appropriate.
        The data detector results returned by detectContentInRange are
        stored in the Frame object.

        * editing/cocoa/DataDetection.h:
        * editing/cocoa/DataDetection.mm:
        (WebCore::resultIsURL):
        (WebCore::constructURLStringForResult):
        (WebCore::removeResultLinksFromAnchor):
        (WebCore::searchForLinkRemovingExistingDDLinks):
        (WebCore::dataDetectorTypeForCategory):
        (WebCore::buildQuery):
        (WebCore::DataDetection::detectContentInRange):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        * page/Frame.h:
        (WebCore::Frame::setDataDetectionResults):
        (WebCore::Frame::dataDetectionResults):
        * platform/spi/cocoa/DataDetectorsCoreSPI.h:
        (DDQueryOffsetCompare):

2016-01-22  Daniel Bates  <dabates@apple.com>

        LayoutTest http/tests/security/xssAuditor/embed-tag-in-path-unterminated.html crashing
        https://bugs.webkit.org/show_bug.cgi?id=153250
        <rdar://problem/12172843>
        And
        <rdar://problem/24248040>

        Reviewed by Alexey Proskuryakov.

        Remove an incorrect assertion that the absolute URL associated with a protection space cannot
        contain consecutive forward slash (/) characters. A URL can contain consecutive forward slashes.
        This also makes the invariants for CredentialStorage::findDefaultProtectionSpaceForURL() symmetric
        with the invariants for WebCore::protectionSpaceMapKeyFromURL().

        Tests: http/tests/loading/basic-auth-load-URL-with-consecutive-slashes.html
               http/tests/xmlhttprequest/basic-auth-load-URL-with-consecutive-slashes.html

        * platform/network/CredentialStorage.cpp:
        (WebCore::CredentialStorage::findDefaultProtectionSpaceForURL):

2016-01-22  Chris Dumez  <cdumez@apple.com>

        DOMImplementation.createHTMLDocument("") should append an empty Text Node to the title Element
        https://bugs.webkit.org/show_bug.cgi?id=153374

        Reviewed by Ryosuke Niwa.

        DOMImplementation.createHTMLDocument("") should append an empty Text
        Node to the title Element as per the steps at:
        - https://dom.spec.whatwg.org/#dom-domimplementation-createhtmldocument (step 6)

        Firefox and Chrome follow the specification here.

        Previously, WebKit would rely on HTMLTitleElement.text setter which
        does not create a Text Node if the title is the empty string, as per:
        - https://html.spec.whatwg.org/multipage/semantics.html#dom-title-text
        - https://dom.spec.whatwg.org/#dom-node-textcontent

        No new tests, already covered by existing test.

        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createHTMLDocument):

2016-01-17  Ada Chan  <adachan@apple.com>

        Add a mode parameter to MediaControllerInterface::supportsFullscreen() and ChromeClient::supportsVideoFullscreen().
        https://bugs.webkit.org/show_bug.cgi?id=153220

        Reviewed by Eric Carlson.

        No new tests, just code refactoring.

        * Modules/mediacontrols/MediaControlsHost.cpp:
        (WebCore::MediaControlsHost::supportsFullscreen):
        Just pass in VideoFullscreenModeStandard as this is used for checking the standard fullscreen case.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::enterFullscreen):
        Only use the FullScreen API if the mode is VideoFullscreenModeStandard. Call ChromeClient::supportsVideoFullscreen()
        with the mode.
        (WebCore::HTMLMediaElement::exitFullscreen):
        Move the fullscreen element check up so we can use this method to exit picture-in-picture mode.
        * html/HTMLMediaElement.h:

        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::supportsFullscreen):
        Ditto.
        (WebCore::HTMLVideoElement::webkitEnterFullscreen):
        Pass in VideoFullscreenModeStandard to supportsFullscreen() as this is used for the standard fullscreen case.
        (WebCore::HTMLVideoElement::webkitSupportsFullscreen):
        Ditto.
        (WebCore::HTMLVideoElement::webkitSupportsPresentationMode):
        Pass in the correct VideoFullscreenMode to supportsFullscreen() corresponding to the mode string passed in.
        (WebCore::HTMLVideoElement::setFullscreenMode):
        Pass in the mode to supportsFullscreen().
        * html/HTMLVideoElement.h:

        * html/MediaController.h:
        * html/MediaControllerInterface.h:
        Make supportsFullscreen() take a VideoFullscreenMode.

        * html/shadow/MediaControls.cpp:
        (WebCore::MediaControls::reset):
        Pass in VideoFullscreenModeStandard to supportsFullscreen() here since this is used for the standard
        fullscreen button.
        * html/shadow/MediaControlsApple.cpp:
        (WebCore::MediaControlsApple::reset):
        Ditto.

        * page/ChromeClient.h:
        Make supportsVideoFullscreen() take a VideoFullscreenMode.

        * rendering/HitTestResult.cpp:
        (WebCore::HitTestResult::mediaSupportsFullscreen):
        (WebCore::HitTestResult::toggleMediaFullscreenState):
        (WebCore::HitTestResult::enterFullscreenForVideo):
        Pass in VideoFullscreenModeStandard in the code relating to the standard fullscreen.

2016-01-22  Chris Dumez  <cdumez@apple.com>

        Document.URL / Document.documentURI should return "about:blank" instead of empty string / null
        https://bugs.webkit.org/show_bug.cgi?id=153363
        <rdar://problem/22549736>

        Reviewed by Ryosuke Niwa.

        Document.URL / Document.documentURI should return "about:blank" instead
        of empty string / null, as per the specification:
        - https://dom.spec.whatwg.org/#dom-document-url
        - https://dom.spec.whatwg.org/#concept-document-url

        Also, Document.documentURI should be an alias for Document.URL as per:
        - https://dom.spec.whatwg.org/#dom-document-url

        Firefox matches the specification.

        No new tests, already covered by existing W3C tests.

        * dom/Document.h:
        (WebCore::Document::urlForBindings):
        * dom/Document.idl:

2016-01-22  Brent Fulgham  <bfulgham@apple.com>

        Don't ignore the return value of CCRandomCopyBytes
        https://bugs.webkit.org/show_bug.cgi?id=153369
        <rdar://problem/22198376>
        <rdar://problem/22198378>

        Reviewed by Alexey Proskuryakov.

        Tested by existing Crypto tests.

        * crypto/mac/CryptoKeyMac.cpp:
        (WebCore::CryptoKey::randomData): RELEASE_ASSERT if CCRandomCopyBytes ever returns
        anything besides kCCSuccess.
        * crypto/mac/SerializedCryptoKeyWrapMac.mm:
        (WebCore::createAndStoreMasterKey): Ditto.
        (WebCore::wrapSerializedCryptoKey): Ditto.

2016-01-21  Sam Weinig  <sam@webkit.org>

        Treat non-https actions on secure pages as mixed content
        <rdar://problem/23144492>
        https://bugs.webkit.org/show_bug.cgi?id=153322

        Reviewed by Alexey Proskuryakov.

        Tests:  http/tests/security/mixedContent/insecure-form-in-iframe.html
                http/tests/security/mixedContent/insecure-form-in-main-frame.html
                http/tests/security/mixedContent/javascript-url-form-in-main-frame.html

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::parseAttribute):
        Check form actions for mixed content.

        * loader/MixedContentChecker.cpp:
        (WebCore::MixedContentChecker::checkFormForMixedContent):
        * loader/MixedContentChecker.h:
        Add new function to check and warn if a form's action is mixed content.

2016-01-22  Nan Wang  <n_wang@apple.com>

        AX: Crash in setTextMarkerDataWithCharacterOffset
        https://bugs.webkit.org/show_bug.cgi?id=153365
        <rdar://problem/24287924>

        Reviewed by Chris Fleizach.

        Sometimes when we try to create a text marker range from a stale text marker with a removed
        node, it will cause crash. Fixed it by adding a null check for the AccessibilityObject we
        create in setTextMarkerDataWithCharacterOffset.

        Test: accessibility/text-marker/text-marker-range-with-removed-node-crash.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::setTextMarkerDataWithCharacterOffset):

2016-01-22  Brady Eidson  <beidson@apple.com>

        Modern IDB: Add transactions and create/delete object store to SQLite backend
        https://bugs.webkit.org/show_bug.cgi?id=153359

        Reviewed by Alex Christensen.

        No new tests (Covered by many tests now passing).

        * Modules/indexeddb/server/IDBBackingStore.h: Change deleteObjectStore to work on an ID instead of name.

        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::deleteObjectStore):
        (WebCore::IDBServer::MemoryIDBBackingStore::takeObjectStoreByIdentifier):
        (WebCore::IDBServer::MemoryIDBBackingStore::takeObjectStoreByName): Deleted.
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:

        Clean up filename generation a bit to actually match the previous directory structure.
        Add begin/commit/abort transaction support.
        Add create/delete object store support:
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::filenameForDatabaseName):
        (WebCore::IDBServer::SQLiteIDBBackingStore::fullDatabaseDirectory):
        (WebCore::IDBServer::SQLiteIDBBackingStore::fullDatabasePath):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo):
        (WebCore::IDBServer::SQLiteIDBBackingStore::beginTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::abortTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::commitTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteBackingStore):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
        
        Clean up SQLiteIDBTransaction to fit with the new WebCore backing store model, which is slightly
        different from the old WebKit2 backing store model:
        * Modules/indexeddb/server/SQLiteIDBTransaction.cpp:
        (WebCore::IDBServer::SQLiteIDBTransaction::SQLiteIDBTransaction):
        (WebCore::IDBServer::SQLiteIDBTransaction::begin):
        (WebCore::IDBServer::SQLiteIDBTransaction::commit):
        (WebCore::IDBServer::SQLiteIDBTransaction::abort):
        (WebCore::IDBServer::SQLiteIDBTransaction::reset):
        (WebCore::IDBServer::SQLiteIDBTransaction::rollback): Deleted.
        * Modules/indexeddb/server/SQLiteIDBTransaction.h:
        (WebCore::IDBServer::SQLiteIDBTransaction::transactionIdentifier):
        (WebCore::IDBServer::SQLiteIDBTransaction::mode):
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::deleteObjectStore):
        (WebCore::IDBServer::UniqueIDBDatabase::performDeleteObjectStore):
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformDeleteObjectStore):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        
        * Modules/indexeddb/shared/IDBDatabaseInfo.cpp:
        (WebCore::IDBDatabaseInfo::deleteObjectStore):
        * Modules/indexeddb/shared/IDBDatabaseInfo.h:
        
        * Modules/indexeddb/shared/IDBObjectStoreInfo.h:
        (WebCore::IDBObjectStoreInfo::maxIndexID):
        
        * Modules/indexeddb/shared/IDBTransactionInfo.h:
        (WebCore::IDBTransactionInfo::identifier):

2016-01-22  Antti Koivisto  <antti@apple.com>

        Style resolver initialization cleanups
        https://bugs.webkit.org/show_bug.cgi?id=153356

        Reviewed by Simon Fraser.

            Simplify StyleResolver::State initialization.
            Also use more references and other cleanups.

        * css/MediaQueryMatcher.cpp:
        (WebCore::MediaQueryMatcher::prepareEvaluator):
        * css/StyleMedia.cpp:
        (WebCore::StyleMedia::matchMedium):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::State::clear):
        (WebCore::StyleResolver::StyleResolver):
        (WebCore::StyleResolver::classNamesAffectedByRules):
        (WebCore::StyleResolver::State::State):

            Initialize State using a constructor instead of bunch of construction functions.
            Remove m_styledElement field which is just a casted version of m_element.

        (WebCore::StyleResolver::State::updateConversionData):
        (WebCore::StyleResolver::State::setStyle):
        (WebCore::StyleResolver::sharingCandidateHasIdenticalStyleAffectingAttributes):
        (WebCore::StyleResolver::canShareStyleWithElement):
        (WebCore::StyleResolver::locateSharedStyle):
        (WebCore::isAtShadowBoundary):
        (WebCore::StyleResolver::styleForElement):
        (WebCore::StyleResolver::styleForKeyframe):
        (WebCore::StyleResolver::keyframeStylesForAnimation):
        (WebCore::StyleResolver::pseudoStyleForElement):
        (WebCore::StyleResolver::styleForPage):
        (WebCore::StyleResolver::pseudoStyleRulesForElement):
        (WebCore::StyleResolver::clearCachedPropertiesAffectedByViewportUnits):
        (WebCore::isCacheableInMatchedPropertiesCache):

            Disallow caching of document element style entirely because the writing-mode and direction properties have special handling.
            The existing check wasn't robust.

        (WebCore::extractDirectionAndWritingMode):
        (WebCore::StyleResolver::applyMatchedProperties):
        (WebCore::StyleResolver::applyPropertyToStyle):
        (WebCore::StyleResolver::State::initElement): Deleted.
        (WebCore::StyleResolver::initElement): Deleted.
        (WebCore::StyleResolver::State::initForStyleResolve): Deleted.
        * css/StyleResolver.h:
        (WebCore::StyleResolver::mediaQueryEvaluator):
        (WebCore::StyleResolver::State::State):
        (WebCore::StyleResolver::State::document):
        (WebCore::StyleResolver::State::element):
        (WebCore::StyleResolver::State::style):
        (WebCore::StyleResolver::State::takeStyle):
        (WebCore::StyleResolver::State::styledElement): Deleted.
        * dom/Element.cpp:
        (WebCore::Element::resolveStyle):
        * page/animation/KeyframeAnimation.cpp:
        (WebCore::KeyframeAnimation::KeyframeAnimation):
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::getUncachedPseudoStyle):
        (WebCore::RenderElement::containingBlockForFixedPosition):
        * rendering/RenderNamedFlowFragment.cpp:
        (WebCore::RenderNamedFlowFragment::computeStyleInRegion):
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::styleForElement):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::customStyleForRenderer):
        (WebCore::SVGElement::computedStyle):
        (WebCore::addQualifiedName):
        * svg/SVGElementRareData.h:
        (WebCore::SVGElementRareData::ensureAnimatedSMILStyleProperties):
        (WebCore::SVGElementRareData::overrideComputedStyle):

2016-01-22  Chris Fleizach  <cfleizach@apple.com>

        AX: <code> group and friends should have a custom subrole
        https://bugs.webkit.org/show_bug.cgi?id=153282

        Reviewed by Mario Sanchez Prada.

        Add some custom subroles for the mac for code, ins, del, cite, var, samp, pre, kbd,
        so that assistive tech can recognize them.

        Test: accessibility/mac/subroles-for-formatted-groups.html

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::isStyleFormatGroup):
        * accessibility/AccessibilityObject.h:
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored):
        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper subrole]):

2016-01-22  Enrica Casucci  <enrica@apple.com>

        Remove dependency from DataDetectorsCore on iOS.
        https://bugs.webkit.org/show_bug.cgi?id=153358
        rdar://problem/24294651

        Reviewed by Anders Carlsson.

        Avoid build dependencies.

        * Configurations/WebCore.xcconfig:

2016-01-22  Chris Fleizach  <cfleizach@apple.com>

        AX: ARIA combo boxes are not returning the right value for selected text range
        https://bugs.webkit.org/show_bug.cgi?id=153260

        Reviewed by Darin Adler.

        Just because an element has an ARIA role doesn't mean we should always use the selected text range of the whole document.
        If the element is also a text based ARIA control, we can still use the element's inner text range to return the right value.

        Test: accessibility/selected-text-range-aria-elements.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::selectedTextRange):

2016-01-22  Chris Dumez  <cdumez@apple.com>

        Unreviewed iOS build fix after r195452.

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::colorValue):

2016-01-21  Dave Hyatt  <hyatt@apple.com>

        Elements with overflow and border-radius don't show in multicolumn properly.
        https://bugs.webkit.org/show_bug.cgi?id=152920

        Reviewed by Simon Fraser.

        Added new test in fast/multicol.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::convertToLayerCoords):
        (WebCore::RenderLayer::offsetFromAncestor):
        (WebCore::RenderLayer::clipToRect):
        * rendering/RenderLayer.h:

        Make sure the crawl up the containing block chain to apply clips properly offsets
        to account for columns. convertToLayerCoords could already handle this, so
        offsetFromAncestor now takes the same extra argument (whether or not to adjust for
        columns) that convertToLayerCoords does.

2016-01-22  Darin Adler  <darin@apple.com>

        Reduce use of equalIgnoringCase to just ignore ASCII case
        https://bugs.webkit.org/show_bug.cgi?id=153266

        Reviewed by Ryosuke Niwa.

        Changed many call sites that were using equalIgnoringCase to instead use
        equalLettersIgnoringASCIICase. What these all have in common is that the
        thing they are comparing with is a string literal that has all lowercase
        letters, spaces, and a few simple examples of punctuation.

        Not 100% sure that the new function name is just right, but it's a long name
        so it's easy to change it with a global replace if we come up with a better one.

        Or if we decide ther eis no need for the "letters" optimization, we can change
        these all to just use equalIgnoringASCIICase, also with a global replace.

        Also made a few tweaks to some code nearby and some includes.

        * Modules/encryptedmedia/CDMPrivateClearKey.cpp:
        (WebCore::CDMPrivateClearKey::supportsKeySystem): Use equalLettersIgnoringASCIICase.
        (WebCore::CDMPrivateClearKey::supportsKeySystemAndMimeType): Ditto.
        * Modules/encryptedmedia/CDMSessionClearKey.cpp:
        (WebCore::CDMSessionClearKey::update): Ditto.
        * Modules/plugins/YouTubePluginReplacement.cpp:
        (WebCore::YouTubePluginReplacement::supportsMimeType): Ditto.
        (WebCore::YouTubePluginReplacement::supportsFileExtension): Ditto.
        * Modules/webdatabase/DatabaseAuthorizer.cpp:
        (WebCore::DatabaseAuthorizer::createVTable): Ditto.
        (WebCore::DatabaseAuthorizer::dropVTable): Ditto.
        * Modules/websockets/WebSocketHandshake.cpp:
        (WebCore::WebSocketHandshake::readHTTPHeaders): Ditto.
        (WebCore::WebSocketHandshake::checkResponseHeaders): Ditto.
        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::findAriaModalNodes): Ditto.
        (WebCore::AXObjectCache::handleMenuItemSelected): Ditto.
        (WebCore::AXObjectCache::handleAriaModalChange): Ditto.
        (WebCore::isNodeAriaVisible): Ditto.
        * accessibility/AccessibilityListBoxOption.cpp:
        (WebCore::AccessibilityListBoxOption::isEnabled): Ditto.

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::determineAccessibilityRole): Use isColorControl
        instead of checking the typeAttr of the HTMLInputElement directly.
        (WebCore::AccessibilityNodeObject::isEnabled): Use equalLettersIgnoringASCIICase.
        (WebCore::AccessibilityNodeObject::isPressed): Ditto.
        (WebCore::AccessibilityNodeObject::isChecked): Ditto.
        (WebCore::AccessibilityNodeObject::isMultiSelectable): Ditto.
        (WebCore::AccessibilityNodeObject::isRequired): Ditto.
        (WebCore::shouldUseAccessibilityObjectInnerText): Ditto.
        (WebCore::AccessibilityNodeObject::colorValue): Ditto.

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::contentEditableAttributeIsEnabled):
        Use equalLettersIgnoringASCIICase.
        (WebCore::AccessibilityObject::ariaIsMultiline): Ditto.
        (WebCore::AccessibilityObject::liveRegionStatusIsEnabled): Ditto.
        (WebCore::AccessibilityObject::sortDirection): Ditto.
        (WebCore::AccessibilityObject::supportsARIAPressed): Ditto.
        (WebCore::AccessibilityObject::supportsExpanded): Ditto.
        (WebCore::AccessibilityObject::isExpanded): Ditto.
        (WebCore::AccessibilityObject::checkboxOrRadioValue): Ditto.
        (WebCore::AccessibilityObject::isARIAHidden): Ditto.
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::supportsARIADragging): Ditto.
        (WebCore::AccessibilityRenderObject::defaultObjectInclusion): Ditto.
        (WebCore::AccessibilityRenderObject::elementAttributeValue): Ditto.
        (WebCore::AccessibilityRenderObject::isSelected): Ditto.
        (WebCore::AccessibilityRenderObject::determineAccessibilityRole): Ditto.
        (WebCore::AccessibilityRenderObject::orientation): Ditto.
        (WebCore::AccessibilityRenderObject::canSetExpandedAttribute): Ditto.
        (WebCore::AccessibilityRenderObject::canSetValueAttribute): Ditto.
        (WebCore::AccessibilityRenderObject::ariaLiveRegionAtomic): Ditto.

        * accessibility/AccessibilityTableCell.cpp:
        (WebCore::AccessibilityTableCell::ariaRowSpan): Use == to compare a string
        with "0" since there is no need to "ignore case" when there are no letters.

        * css/CSSCalculationValue.cpp:
        (WebCore::CSSCalcValue::create): Use equalLettersIgnoringASCIICase.

        * css/CSSCalculationValue.h: Removed unneeded include of CSSParserValues.h.
        * css/CSSCustomPropertyValue.h: Ditto.

        * css/CSSFontFaceSrcValue.cpp:
        (WebCore::CSSFontFaceSrcValue::isSVGFontFaceSrc): Use equalLettersIgnoringASCIICase.

        * css/CSSGrammar.y.in: Use equalLettersIgnoringASCIICase. Also restructured the code
        a bit to have more normal formatting and reordered it slightly.

        * css/CSSParser.cpp:
        (WebCore::equal): Deleted.
        (WebCore::equalIgnoringCase): Deleted.
        (WebCore::equalLettersIgnoringASCIICase): Added. Replaces function templates named
        equal and equalIgnoringCase that are no longer used.
        (WebCore::CSSParser::parseValue): Use equalLettersIgnoringASCIICase.
        (WebCore::CSSParser::parseNonElementSnapPoints): Ditto.
        (WebCore::CSSParser::parseAlt): Ditto.
        (WebCore::CSSParser::parseContent): Ditto.
        (WebCore::CSSParser::parseFillImage): Ditto.
        (WebCore::CSSParser::parseAnimationName): Ditto.
        (WebCore::CSSParser::parseAnimationTrigger): Ditto.
        (WebCore::CSSParser::parseAnimationProperty): Ditto.
        (WebCore::CSSParser::parseKeyframeSelector): Ditto.
        (WebCore::CSSParser::parseAnimationTimingFunction): Ditto.
        (WebCore::CSSParser::parseGridTrackList): Ditto.
        (WebCore::CSSParser::parseGridTrackSize): Ditto.
        (WebCore::CSSParser::parseDashboardRegions): Ditto.
        (WebCore::CSSParser::parseClipShape): Ditto.
        (WebCore::CSSParser::parseBasicShapeInset): Ditto.
        (WebCore::CSSParser::parseBasicShape): Ditto.
        (WebCore::CSSParser::parseFontFaceSrcURI): Ditto.
        (WebCore::CSSParser::parseFontFaceSrc): Ditto.
        (WebCore::CSSParser::isCalculation): Ditto.
        (WebCore::CSSParser::parseColorFromValue): Ditto.
        (WebCore::CSSParser::parseBorderImage): Ditto.
        (WebCore::parseDeprecatedGradientPoint): Ditto.
        (WebCore::parseDeprecatedGradientColorStop): Ditto.
        (WebCore::CSSParser::parseDeprecatedGradient): Ditto.
        (WebCore::CSSParser::parseLinearGradient): Ditto.
        (WebCore::CSSParser::parseRadialGradient): Ditto.
        (WebCore::CSSParser::isGeneratedImageValue): Ditto.
        (WebCore::CSSParser::parseGeneratedImage): Ditto.
        (WebCore::filterInfoForName): Ditto.
        (WebCore::validFlowName): Ditto.
        (WebCore::CSSParser::realLex): Ditto.
        (WebCore::isValidNthToken): Ditto.
        * css/CSSParserValues.cpp:
        (WebCore::CSSParserSelector::parsePagePseudoSelector): Ditto.

        * css/CSSParserValues.h:
        (WebCore::equalLettersIgnoringASCIICase): Added.

        * css/CSSVariableDependentValue.h: Removed unneeded include of CSSParserValues.h.

        * css/MediaList.cpp:
        (WebCore::reportMediaQueryWarningIfNeeded): Use equalLettersIgnoringASCIICase.
        * css/MediaQueryEvaluator.cpp:
        (WebCore::MediaQueryEvaluator::mediaTypeMatch): Ditto.
        (WebCore::MediaQueryEvaluator::mediaTypeMatchSpecific): Ditto.
        (WebCore::evalResolution): Ditto.

        * css/SelectorPseudoTypeMap.h: Removed unneeded include of CSSParserValues.h.

        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertTouchCallout): Use equalLettersIgnoringASCIICase.

        * css/makeSelectorPseudoClassAndCompatibilityElementMap.py: Added an include of
        CSSParserValues.h since it's no longer included by SelectorPseudoTypeMap.h.

        * dom/Document.cpp:
        (WebCore::setParserFeature): Use equalLettersIgnoringASCIICase.
        (WebCore::Document::processReferrerPolicy): Ditto.
        (WebCore::Document::createEvent): Ditto.
        (WebCore::Document::parseDNSPrefetchControlHeader): Ditto.

        * dom/Element.cpp:
        (WebCore::Element::spellcheckAttributeState): Use isNull instead of doing
        checking equality with nullAtom. Use isEmpty instead of equalIgnoringCase("").
        Use equalLettersIgnoringASCIICase.
        (WebCore::Element::canContainRangeEndPoint): Ditto.

        * dom/InlineStyleSheetOwner.cpp:
        (WebCore::isValidCSSContentType): Use equalLettersIgnoringASCIICase.
        Added comment about peculiar behavior where we do case-sensitive processing of
        the MIME type if the document is XML.

        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::requestScript): Use equalLettersIgnoringASCIICase.
        (WebCore::ScriptElement::isScriptForEventSupported): Ditto.
        * dom/SecurityContext.cpp:
        (WebCore::SecurityContext::parseSandboxPolicy): Ditto.
        * dom/ViewportArguments.cpp:
        (WebCore::findSizeValue): Ditto.
        (WebCore::findScaleValue): Ditto.
        (WebCore::findBooleanValue): Ditto.

        * editing/EditorCommand.cpp:
        (WebCore::executeDefaultParagraphSeparator): Use equalLettersIgnoringASCIICase.
        (WebCore::executeInsertBacktab): Use ASCIILiteral.
        (WebCore::executeInsertHTML): Use emptyString.
        (WebCore::executeInsertLineBreak): Use ASCIILiteral.
        (WebCore::executeInsertNewline): Ditto.
        (WebCore::executeInsertTab): Ditto.
        (WebCore::executeJustifyCenter): Ditto.
        (WebCore::executeJustifyFull): Ditto.
        (WebCore::executeJustifyLeft): Ditto.
        (WebCore::executeJustifyRight): Ditto.
        (WebCore::executeStrikethrough): Ditto.
        (WebCore::executeStyleWithCSS): Use equalLettersIgnoringASCIICase.
        (WebCore::executeUseCSS): Ditto.
        (WebCore::executeSubscript): Use ASCIILiteral.
        (WebCore::executeSuperscript): Ditto.
        (WebCore::executeToggleBold): Ditto.
        (WebCore::executeToggleItalic): Ditto.
        (WebCore::executeUnderline): Ditto.
        (WebCore::executeUnscript): Ditto.
        (WebCore::stateBold): Ditto.
        (WebCore::stateItalic): Ditto.
        (WebCore::stateStrikethrough): Ditto.
        (WebCore::stateSubscript): Ditto.
        (WebCore::stateSuperscript): Ditto.
        (WebCore::stateUnderline): Ditto.
        (WebCore::stateJustifyCenter): Ditto.
        (WebCore::stateJustifyFull): Ditto.
        (WebCore::stateJustifyLeft): Ditto.
        (WebCore::stateJustifyRight): Ditto.
        (WebCore::valueFormatBlock): Use emptyString.
        (WebCore::Editor::Command::value): Use ASCIILiteral.

        * editing/TextIterator.cpp:
        (WebCore::isRendererReplacedElement): Use equalLettersIgnoringASCIICase.

        * fileapi/Blob.cpp:
        (WebCore::Blob::isNormalizedContentType): Use isASCIIUpper.

        * history/HistoryItem.cpp:
        (WebCore::HistoryItem::setFormInfoFromRequest): Use equalLettersIgnoringASCIICase.

        * html/Autocapitalize.cpp:
        (WebCore::valueOn): Deleted.
        (WebCore::valueOff): Deleted.
        (WebCore::valueNone): Deleted.
        (WebCore::valueWords): Deleted.
        (WebCore::valueSentences): Deleted.
        (WebCore::valueAllCharacters): Deleted.
        (WebCore::autocapitalizeTypeForAttributeValue): Use equalLettersIgnoringASCIICase.
        (WebCore::stringForAutocapitalizeType): Put the AtomicString globals right in the
        switch statement instead of in separate functions.

        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::draggable): Use equalLettersIgnoringASCIICase.
        * html/HTMLAreaElement.cpp:
        (WebCore::HTMLAreaElement::parseAttribute): Ditto.
        * html/HTMLBRElement.cpp:
        (WebCore::HTMLBRElement::collectStyleForPresentationAttribute): Ditto.
        * html/HTMLBodyElement.cpp:
        (WebCore::HTMLBodyElement::collectStyleForPresentationAttribute): Ditto.
        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::parseAttribute): Ditto.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::toDataURL): Use ASCIILiteral.

        * html/HTMLDivElement.cpp:
        (WebCore::HTMLDivElement::collectStyleForPresentationAttribute):
        Use equalLettersIgnoringASCIICase.

        * html/HTMLDocument.cpp:
        (WebCore::HTMLDocument::designMode): Use ASCIILiteral.
        (WebCore::HTMLDocument::setDesignMode): Use equalLettersIgnoringASCIICase.

        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::nodeName): Updated comment.
        (WebCore::isLTROrRTLIgnoringCase): Use equalLettersIgnoringASCIICase.
        (WebCore::contentEditableType): Ditto.
        (WebCore::HTMLElement::collectStyleForPresentationAttribute): Ditto.
        (WebCore::toValidDirValue): Ditto.
        (WebCore::HTMLElement::insertAdjacent): Ditto.
        (WebCore::contextElementForInsertion): Ditto.
        (WebCore::HTMLElement::applyAlignmentAttributeToStyle): Ditto.
        (WebCore::HTMLElement::setContentEditable): Ditto.
        (WebCore::HTMLElement::draggable): Ditto.
        (WebCore::HTMLElement::translateAttributeMode): Ditto.
        (WebCore::HTMLElement::hasDirectionAuto): Ditto.
        (WebCore::HTMLElement::directionality): Ditto.
        (WebCore::HTMLElement::dirAttributeChanged): Ditto.
        (WebCore::HTMLElement::addHTMLColorToStyle): Ditto.
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::collectStyleForPresentationAttribute): Ditto.
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::autocorrect): Ditto.
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::autocorrect): Ditto.
        (WebCore::HTMLFormElement::shouldAutocomplete): Ditto.
        * html/HTMLFrameElementBase.cpp:
        (WebCore::HTMLFrameElementBase::parseAttribute): Ditto.

        * html/HTMLFrameSetElement.cpp:
        (WebCore::HTMLFrameSetElement::parseAttribute): Use equalLettersIgnoringASCIICase.
        Use == when comparing with "0" and "1" since there is no need for case folding.

        * html/HTMLHRElement.cpp:
        (WebCore::HTMLHRElement::collectStyleForPresentationAttribute):
        Use equalLettersIgnoringASCIICase.
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::draggable): Ditto.
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::parseAttribute): Ditto.
        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::appendFormData): Ditto.
        * html/HTMLMarqueeElement.cpp:
        (WebCore::HTMLMarqueeElement::collectStyleForPresentationAttribute): Ditto.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::parseAttribute): Ditto.
        * html/HTMLMetaElement.cpp:
        (WebCore::HTMLMetaElement::process): Ditto.

        * html/HTMLObjectElement.cpp:
        (WebCore::mapDataParamToSrc): Use references, modern for loops, simplify
        logic to not use array indices, use ASCIILiteral and equalLettersIgnoringASCIICase.
        (WebCore::HTMLObjectElement::parametersForPlugin): Update to call new function.
        (WebCore::HTMLObjectElement::shouldAllowQuickTimeClassIdQuirk): Use equalLettersIgnoringASCIICase.
        (WebCore::HTMLObjectElement::containsJavaApplet): Ditto.
        * html/HTMLParagraphElement.cpp:
        (WebCore::HTMLParagraphElement::collectStyleForPresentationAttribute): Ditto.
        * html/HTMLParamElement.cpp:
        (WebCore::HTMLParamElement::isURLParameter): Ditto.
        * html/HTMLTableElement.cpp:
        (WebCore::getBordersFromFrameAttributeValue): Ditto.
        (WebCore::HTMLTableElement::collectStyleForPresentationAttribute): Ditto.
        (WebCore::HTMLTableElement::parseAttribute): Ditto.
        * html/HTMLTablePartElement.cpp:
        (WebCore::HTMLTablePartElement::collectStyleForPresentationAttribute): Ditto.
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::parseAttribute): Ditto.
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::setRangeText): Ditto.
        (WebCore::HTMLTextFormControlElement::directionForFormData): Ditto.
        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::parseAttribute): Ditto.
        * html/InputType.cpp:
        (WebCore::InputType::applyStep): Ditto.
        * html/LinkRelAttribute.cpp:
        (WebCore::LinkRelAttribute::LinkRelAttribute): Ditto.
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::wirelessVideoPlaybackDisabled): Ditto.
        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::sizeShouldIncludeDecoration): Ditto.
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::createStepRange): Ditto.
        (WebCore::RangeInputType::handleKeydownEvent): Ditto.
        * html/StepRange.cpp:
        (WebCore::StepRange::parseStep): Ditto.
        * html/canvas/CanvasStyle.cpp:
        (WebCore::parseColor): Ditto.
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::setCompatibilityModeFromDoctype): Ditto.
        * html/parser/HTMLElementStack.cpp:
        (WebCore::HTMLElementStack::isHTMLIntegrationPoint): Ditto.
        * html/parser/HTMLMetaCharsetParser.cpp:
        (WebCore::HTMLMetaCharsetParser::encodingFromMetaAttributes): Ditto.
        * html/parser/HTMLPreloadScanner.cpp:
        (WebCore::TokenPreloadScanner::StartTagScanner::processAttribute): Ditto.
        (WebCore::TokenPreloadScanner::StartTagScanner::crossOriginModeAllowsCookies): Ditto.
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::processStartTagForInBody): Ditto.
        (WebCore::HTMLTreeBuilder::processStartTagForInTable): Ditto.
        * html/parser/XSSAuditor.cpp:
        (WebCore::isDangerousHTTPEquiv): Ditto.

        * html/track/WebVTTParser.cpp:
        (WebCore::WebVTTParser::hasRequiredFileIdentifier): Removed unneeded special case
        for empty string.

        * inspector/InspectorPageAgent.cpp:
        (WebCore::createXHRTextDecoder): Use equalLettersIgnoringASCIICase.
        * inspector/NetworkResourcesData.cpp:
        (WebCore::createOtherResourceTextDecoder): Ditto.
        * loader/CrossOriginAccessControl.cpp:
        (WebCore::isOnAccessControlSimpleRequestHeaderWhitelist): Ditto.
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::continueAfterContentPolicy): Ditto.
        * loader/FormSubmission.cpp:
        (WebCore::appendMailtoPostFormDataToURL): Ditto.
        (WebCore::FormSubmission::Attributes::parseEncodingType): Ditto.
        (WebCore::FormSubmission::Attributes::parseMethodType): Ditto.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::shouldPerformFragmentNavigation): Ditto.
        (WebCore::FrameLoader::shouldTreatURLAsSrcdocDocument): Ditto.
        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::updateFromElement): Ditto.
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::start): Ditto.
        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::createJavaAppletWidget): Ditto.
        * loader/TextResourceDecoder.cpp:
        (WebCore::TextResourceDecoder::determineContentType): Ditto.
        * loader/TextTrackLoader.cpp:
        (WebCore::TextTrackLoader::load): Ditto.
        * loader/appcache/ApplicationCache.cpp:
        (WebCore::ApplicationCache::requestIsHTTPOrHTTPSGet): Ditto.
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::canUseSheet): Ditto.
        * loader/cache/CachedResource.cpp:
        (WebCore::shouldCacheSchemeIndefinitely): Ditto.
        * page/DOMSelection.cpp:
        (WebCore::DOMSelection::modify): Ditto.
        * page/EventSource.cpp:
        (WebCore::EventSource::didReceiveResponse): Ditto.
        * page/FrameView.cpp:
        (WebCore::FrameView::scrollToAnchor): Ditto.
        * page/Performance.cpp:
        (WebCore::Performance::webkitGetEntriesByType): Ditto.
        * page/PerformanceResourceTiming.cpp:
        (WebCore::passesTimingAllowCheck): Ditto.

        * page/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::SecurityOrigin): Use emptyString.
        (WebCore::SecurityOrigin::toString): Use ASCIILiteral.
        (WebCore::SecurityOrigin::databaseIdentifier): Ditto.

        * page/UserContentURLPattern.cpp:
        (WebCore::UserContentURLPattern::parse): Use equalLettersIgnoringASCIICase.
        (WebCore::UserContentURLPattern::matches): Ditto.
        * platform/URL.cpp:
        (WebCore::URL::protocolIs): Ditto.

        * platform/graphics/avfoundation/CDMPrivateMediaSourceAVFObjC.mm:
        (WebCore::CDMPrivateMediaSourceAVFObjC::supportsKeySystemAndMimeType):
        Changed to use early exit and equalLettersIgnoringASCIICase. Added comment
        about inconsistency with next function.
        (WebCore::CDMPrivateMediaSourceAVFObjC::supportsMIMEType): Added comment
        about inconsistency with previous function.

        * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm:
        (WebCore::CDMSessionAVContentKeySession::generateKeyRequest):
        Use equalLettersIgnoringASCIICase.
        * platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.mm:
        (WebCore::CDMSessionAVStreamSession::generateKeyRequest): Ditto.
        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::utiFromMIMEType): Ditto.

        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::FontCache::similarFont): Changed to not use so many global
        variables and use equalLettersIgnoringASCIICase.
        * platform/graphics/ios/FontCacheIOS.mm:
        (WebCore::platformFontWithFamilySpecialCase): Ditto.

        * platform/graphics/mac/FontCustomPlatformData.cpp:
        (WebCore::FontCustomPlatformData::supportsFormat): Use equalLettersIgnoringASCIICase.
        * platform/mac/PasteboardMac.mm:
        (WebCore::Pasteboard::readString): Ditto.
        * platform/network/BlobResourceHandle.cpp:
        (WebCore::BlobResourceHandle::createAsync): Ditto.
        (WebCore::BlobResourceHandle::loadResourceSynchronously): Ditto.
        * platform/network/CacheValidation.cpp:
        (WebCore::parseCacheControlDirectives): Ditto.
        * platform/network/FormData.h:
        (WebCore::FormData::parseEncodingType): Ditto.
        * platform/network/HTTPParsers.cpp:
        (WebCore::contentDispositionType): Ditto.
        (WebCore::parseXFrameOptionsHeader): Ditto.

        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::isHTTP): Use protocolIsInHTTPFamily, which is
        both clearer and more efficient.
        (WebCore::ResourceResponseBase::isAttachment): Rewrite to be a bit more terse
        and use equalLettersIgnoringASCIICase.

        * platform/network/cf/ResourceHandleCFURLConnectionDelegate.cpp:
        (WebCore::ResourceHandleCFURLConnectionDelegate::createResourceRequest):
        Use equalLettersIgnoringASCIICase.
        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::willSendRequest): Ditto.
        * platform/sql/SQLiteDatabase.cpp:
        (WebCore::SQLiteDatabase::open): Ditto.
        * platform/sql/SQLiteStatement.cpp:
        (WebCore::SQLiteStatement::isColumnDeclaredAsBlob): Ditto.

        * platform/text/TextEncodingRegistry.cpp:
        (WebCore::defaultTextEncodingNameForSystemLanguage): Use ASCIILiteral
        and equalLettersIgnoringASCIICase.

        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::updateFromElement): Use equalLettersIgnoringASCIICase.
        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::compareCodepointsLexicographically): Ditto.
        (WebCore::SVGToOTFFontConverter::SVGToOTFFontConverter): Ditto.
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setEditingBehavior): Ditto.
        (WebCore::InternalSettings::setShouldDisplayTrackKind): Ditto.
        (WebCore::InternalSettings::shouldDisplayTrackKind): Ditto.
        * testing/Internals.cpp:
        (WebCore::markerTypeFrom): Ditto.
        (WebCore::markerTypesFrom): Ditto.
        (WebCore::Internals::mediaElementHasCharacteristic): Ditto.
        (WebCore::Internals::setCaptionDisplayMode): Ditto.
        (WebCore::Internals::beginMediaSessionInterruption): Ditto.
        (WebCore::Internals::endMediaSessionInterruption): Ditto.
        (WebCore::Internals::setMediaSessionRestrictions): Ditto.
        (WebCore::Internals::setMediaElementRestrictions): Ditto.
        (WebCore::Internals::postRemoteControlCommand): Ditto.
        (WebCore::Internals::setAudioContextRestrictions): Ditto.
        (WebCore::Internals::setMockMediaPlaybackTargetPickerState): Ditto.
        * testing/MockCDM.cpp:
        (WebCore::MockCDM::supportsKeySystem): Ditto.
        (WebCore::MockCDM::supportsKeySystemAndMimeType): Ditto.
        (WebCore::MockCDM::supportsMIMEType): Ditto.
        * xml/XMLHttpRequest.cpp:
        (WebCore::isSetCookieHeader): Ditto.
        (WebCore::XMLHttpRequest::responseXML): Ditto.
        (WebCore::XMLHttpRequest::isAllowedHTTPMethod): Ditto.
        (WebCore::XMLHttpRequest::didReceiveData): Ditto.

2016-01-22  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove PassRefPtr from ResourceRequest and FormData
        https://bugs.webkit.org/show_bug.cgi?id=153229

        Reviewed by Chris Dumez.

        Covered by existing tests.

        Making ResourceRequest::setHTTPBody take a RefPtr<FormData>&&.
        Moving FormData from PassRefPtr to RefPtr.

        * html/parser/XSSAuditorDelegate.cpp:
        (WebCore::XSSAuditorDelegate::didBlockScript):
        * loader/FormSubmission.cpp:
        (WebCore::FormSubmission::populateFrameLoadRequest):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadPostRequest):
        (WebCore::FrameLoader::loadDifferentDocumentItem):
        * loader/PingLoader.cpp:
        (WebCore::PingLoader::sendViolationReport):
        * loader/PingLoader.h:
        * page/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportViolation):
        * platform/network/FormData.cpp:
        (WebCore::FormData::create):
        (WebCore::FormData::createMultiPart):
        (WebCore::FormData::copy):
        (WebCore::FormData::deepCopy):
        (WebCore::FormData::resolveBlobReferences):
        * platform/network/FormData.h:
        (WebCore::FormData::decode):
        * platform/network/ResourceRequestBase.cpp:
        (WebCore::ResourceRequestBase::adopt):
        (WebCore::ResourceRequestBase::setHTTPBody):
        * platform/network/ResourceRequestBase.h:
        (WebCore::ResourceRequestBase::setHTTPBody):
        * platform/network/cf/FormDataStreamCFNet.cpp:
        (WebCore::setHTTPBody):
        * platform/network/cf/FormDataStreamCFNet.h:
        * platform/network/cf/ResourceRequestCFNet.cpp:
        (WebCore::ResourceRequest::doUpdatePlatformHTTPBody):
        (WebCore::ResourceRequest::updateFromDelegatePreservingOldProperties):
        * platform/network/cocoa/ResourceRequestCocoa.mm:
        (WebCore::ResourceRequest::doUpdatePlatformHTTPBody):
        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::getFormElementsCount):
        * platform/network/mac/FormDataStreamMac.h:
        * platform/network/mac/FormDataStreamMac.mm:
        (WebCore::setHTTPBody):
        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::doRedirect):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::createRequest):

2016-01-22  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !ENABLE(INDEXED_DATABASE) build after r195443
        https://bugs.webkit.org/show_bug.cgi?id=153350

        Unreviewed buildfix.

        * page/Page.cpp:
        (WebCore::Page::setSessionID):

2016-01-22  ChangSeok Oh  <changseok.oh@collabora.com>

        [GTK] Remove a focus ring on anchor node when focused by mouse.
        https://bugs.webkit.org/show_bug.cgi?id=136121

        Reviewed by Michael Catanzaro.

        Safari, Chrome and FF don't show a focus ring, the dotted rectangle on anchor node
        for mouse clicking. I think the behavior is reasonable and looks better.
        No reason for gtk & efl ports to keep the focus on anchor node. Of course, this change should not
        affect the focus ring for tab navigation.

        No new tests since an existing test can cover this.
        Tests: fast/events/click-focus-anchor.html

        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::isMouseFocusable):

2016-01-21  Simon Fraser  <simon.fraser@apple.com>

        REGRESSION (r168244): Content in horizontal-bt page is offset such that only the end is viewable and there is a white gap at the top
        https://bugs.webkit.org/show_bug.cgi?id=136019

        Reviewed by Dan Bernstein.

        In horizontal-bt documents (where the page starts scrolled to the bottom, and scrolling up goes into negative scroll positions),
        the position of the root content layer would be set incorrectly by the scrolling thread, resulting in misplaced
        content.

        Fix by having the renamed "yPositionForRootContentLayer" take scroll origin into
        account, and being more consistent about using scrollOrigin to position this layer.

        Test: fast/scrolling/programmatic-horizontal-bt-document-scroll.html

        * page/FrameView.cpp:
        (WebCore::FrameView::yPositionForFooterLayer): Moved
        (WebCore::FrameView::positionForRootContentLayer): Take scrollOrigin, and subtract it from the computed value.
        (WebCore::FrameView::yPositionForRootContentLayer): Renamed.
        * page/FrameView.h:
        * page/scrolling/AsyncScrollingCoordinator.cpp:
        (WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll): We've already pushed the new scrollPosition onto the FrameView,
        so we can just use the member function to compute the positionForContentsLayer.
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollLayerPosition): This is the bug fix; FrameView::positionForRootContentLayer()
        now takes scrollOrigin into account.
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateRootLayerPosition): Rather than using the documentRect, position the root content layer
        in terms of the scroll origin (which is -documentRect.location()).

2016-01-21  Brady Eidson  <beidson@apple.com>

        Modern IDB: Support populating/extracting database metadata with SQLite backend.
        Nhttps://bugs.webkit.org/show_bug.cgi?id=153318

        Reviewed by Alex Christensen.

        No new tests (Covered by current tests).

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::willAbortTransaction): Committing transactions can abort if the commit
          ends in error.

        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::didCommit): Before a committing transaction is aborted, notify the
          IDBDatabase that it aborted.

        Copied over from WK2:
        * Modules/indexeddb/server/IDBSerialization.cpp: Added.
        (WebCore::serializeIDBKeyPath):
        (WebCore::deserializeIDBKeyPath):
        (WebCore::serializeIDBKeyData):
        (WebCore::deserializeIDBKeyData):
        * Modules/indexeddb/server/IDBSerialization.h: Added.

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::createBackingStore): Optionally create a SQLite backing store.
        
        Mostly copied over verbatim from WebKit2's UniqueIDBDatabaseBackingStoreSQLite.cpp: 
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::idbKeyCollate):
        (WebCore::IDBServer::v1RecordsTableSchema):
        (WebCore::IDBServer::v1RecordsTableSchemaAlternate):
        (WebCore::IDBServer::v2RecordsTableSchema):
        (WebCore::IDBServer::v2RecordsTableSchemaAlternate):
        (WebCore::IDBServer::createOrMigrateRecordsTableIfNecessary):
        (WebCore::IDBServer::SQLiteIDBBackingStore::ensureValidRecordsTable):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createAndPopulateInitialDatabaseInfo):
        (WebCore::IDBServer::SQLiteIDBBackingStore::extractExistingDatabaseInfo):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo):
        (WebCore::IDBServer::SQLiteIDBBackingStore::beginTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::abortTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::commitTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::unregisterCursor):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
        
        Copied over from WK2:
        * Modules/indexeddb/server/SQLiteIDBCursor.cpp: Added.
        (WebCore::IDBServer::SQLiteIDBCursor::maybeCreate):
        (WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
        (WebCore::IDBServer::buildIndexStatement):
        (WebCore::IDBServer::buildObjectStoreStatement):
        (WebCore::IDBServer::SQLiteIDBCursor::establishStatement):
        (WebCore::IDBServer::SQLiteIDBCursor::createSQLiteStatement):
        (WebCore::IDBServer::SQLiteIDBCursor::objectStoreRecordsChanged):
        (WebCore::IDBServer::SQLiteIDBCursor::resetAndRebindStatement):
        (WebCore::IDBServer::SQLiteIDBCursor::bindArguments):
        (WebCore::IDBServer::SQLiteIDBCursor::advance):
        (WebCore::IDBServer::SQLiteIDBCursor::advanceUnique):
        (WebCore::IDBServer::SQLiteIDBCursor::advanceOnce):
        (WebCore::IDBServer::SQLiteIDBCursor::internalAdvanceOnce):
        (WebCore::IDBServer::SQLiteIDBCursor::iterate):
        * Modules/indexeddb/server/SQLiteIDBCursor.h: Added.
        (WebCore::IDBServer::SQLiteIDBCursor::identifier):
        (WebCore::IDBServer::SQLiteIDBCursor::transaction):
        (WebCore::IDBServer::SQLiteIDBCursor::objectStoreID):
        (WebCore::IDBServer::SQLiteIDBCursor::currentKey):
        (WebCore::IDBServer::SQLiteIDBCursor::currentPrimaryKey):
        (WebCore::IDBServer::SQLiteIDBCursor::currentValueBuffer):
        (WebCore::IDBServer::SQLiteIDBCursor::didError):

        Copied over from WK2:
        * Modules/indexeddb/server/SQLiteIDBTransaction.cpp: Added.
        (WebCore::IDBServer::SQLiteIDBTransaction::SQLiteIDBTransaction):
        (WebCore::IDBServer::SQLiteIDBTransaction::~SQLiteIDBTransaction):
        (WebCore::IDBServer::SQLiteIDBTransaction::begin):
        (WebCore::IDBServer::SQLiteIDBTransaction::commit):
        (WebCore::IDBServer::SQLiteIDBTransaction::reset):
        (WebCore::IDBServer::SQLiteIDBTransaction::rollback):
        (WebCore::IDBServer::SQLiteIDBTransaction::maybeOpenCursor):
        (WebCore::IDBServer::SQLiteIDBTransaction::closeCursor):
        (WebCore::IDBServer::SQLiteIDBTransaction::notifyCursorsOfChanges):
        (WebCore::IDBServer::SQLiteIDBTransaction::clearCursors):
        (WebCore::IDBServer::SQLiteIDBTransaction::inProgress):
        * Modules/indexeddb/server/SQLiteIDBTransaction.h: Added.
        (WebCore::IDBServer::SQLiteIDBTransaction::transactionIdentifier):
        (WebCore::IDBServer::SQLiteIDBTransaction::mode):
        (WebCore::IDBServer::SQLiteIDBTransaction::sqliteTransaction):

        * page/Page.cpp:
        (WebCore::Page::setSessionID): If the new SessionID is different from the last one,
          clear the IDBConnectionToServer.
        (WebCore::Page::idbConnection): Always ask the DatabaseProvider; It handles whether or not 
          the session is ephemeral.

2016-01-21  Alex Christensen  <achristensen@webkit.org>

        CMake build fix after r195302.

        * PlatformMac.cmake:

2016-01-21  Ryosuke Niwa  <rniwa@webkit.org>

        createElementFromSavedToken shouldn't have the code to create a non-HTML element
        https://bugs.webkit.org/show_bug.cgi?id=153327

        Reviewed by Chris Dumez.

        Since HTMLConstructionSite::createElementFromSavedToken is only used to instantiate a formatting element,
        there is no need for it to support creating a non-HTML elements. Remove the branch and assert that this
        is indeed the case.

        createElementFromSavedToken is called in HTMLTreeBuilder::callTheAdoptionAgency and HTMLConstructionSite's
        reconstructTheActiveFormattingElements. In both cases, the stack item passed to createElementFromSavedToken
        is guaranteed to be in the list of active formatting elements, which only contains formatting elements.

        No new tests since there is no behavioral change.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::insertHTMLHeadElement):
        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML):
        (WebCore::HTMLConstructionSite::insertFormattingElement):
        (WebCore::HTMLConstructionSite::createElement): Returns Ref<Element> instead of PassRefPtr<Element>.
        (WebCore::HTMLConstructionSite::createHTMLElement): Ditto.
        (WebCore::HTMLConstructionSite::createElementFromSavedToken): Ditto. Removed the code to instantiate
        a non-HTML element. Also assert that an element created by this function is a formatting tag.
        * html/parser/HTMLConstructionSite.h:
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLConstructionSite::isFormattingTag): Put into HTMLConstructionSite to add an assertion.
        (WebCore::HTMLTreeBuilder::processEndTagForInBody):

2016-01-21  Andreas Kling  <akling@apple.com>

        CGImageSource sometimes retains temporary SharedBuffer data indefinitely, doubling memory cost.
        <https://webkit.org/b/153325>

        Reviewed by Anders Carlsson.

        After a resource has finished downloading, and has been cached to disk cache,
        we mmap() the disk cached version so we can throw out the temporary download buffer.

        Due to the way CGImageSource works on Mac/iOS, it's not possible to replace the data
        being decoded once the image has been fully decoded once. When doing the replacement,
        we'd end up with the SharedBuffer wrapping the mmap() data, and the CGImageSource
        keeping the old SharedBuffer::DataBuffer alive, effectively doubling the memory cost.

        This patch adds a CachedResource::didReplaceSharedBufferContents() callback that
        CachedImage implements to throw out the decoded data. This is currently the only way
        to make CGImageSource drop the retain it holds on the SharedBuffer::DataBuffer.
        The downside of this approach is that we'll sometimes incur the cost of one additional
        image decode after an image downloads and is cached for the first time.

        I put a FIXME in there since we could do better with a little help from CGImageSource.

        * loader/cache/CachedImage.cpp:
        (WebCore::CachedImage::didReplaceSharedBufferContents):
        * loader/cache/CachedImage.h:
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::tryReplaceEncodedData):
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::didReplaceSharedBufferContents):

2016-01-21  Beth Dakin  <bdakin@apple.com>

        Add the ability to update WebKitAdditions to WK2
        https://bugs.webkit.org/show_bug.cgi?id=153320
        -and corresponding-
        rdar://problem/23639629

        Reviewed by Anders Carlsson.

        This SPI is un-used now.
        * platform/spi/mac/NSSpellCheckerSPI.h:

2016-01-21  Simon Fraser  <simon.fraser@apple.com>

        GraphicsContext: low quality drawImage and drawImageBuffer should use InterpolationLow
        https://bugs.webkit.org/show_bug.cgi?id=49002

        Reviewed by Chris Dumez.

        When using low quality image scaling for images which are getting painted often,
        the code used InterpolationNone, which make the images look even worse than they should.

        Not easily testable.

        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::drawImage):
        (WebCore::GraphicsContext::drawImageBuffer):
        (WebCore::GraphicsContext::drawConsumingImageBuffer):

2016-01-19  Ada Chan  <adachan@apple.com>

        Make it possible to enable VIDEO_PRESENTATION_MODE on other Cocoa platforms.
        https://bugs.webkit.org/show_bug.cgi?id=153218

        Reviewed by Eric Carlson.

        No new tests. Code refactoring.

        * Configurations/FeatureDefines.xcconfig:
        * WebCore.xcodeproj/project.pbxproj:
        Move WebVideoFullscreenInterface.h from ios to cocoa.
        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::webkitSupportsPresentationMode):
        The declaration of supportsPictureInPicture() has been moved to WebVideoFullscreenInterface.h
        so include that header instead. Guard the supportsPictureInPicture() call with PLATFORM(COCOA)
        as that method is only defined in Cocoa.
        * platform/cocoa/WebVideoFullscreenInterface.h: Renamed from Source/WebCore/platform/ios/WebVideoFullscreenInterface.h.
        Also move the declaration of supportsPictureInPicture() here.
        * platform/graphics/MediaPlayer.cpp:
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:
        Implementations of methods related to the video fullscreen layer are now guarded by
        PLATFORM(IOS) || (PLATFORM(MAC) && ENABLE(VIDEO_PRESENTATION_MODE)) instead.
        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
        Declaration of supportsPictureInPicture() has been moved to WebVideoFullscreenInterface.h
        * platform/mac/WebVideoFullscreenInterfaceMac.mm: Added.
        (WebCore::supportsPictureInPicture):
        Return false for now.

2016-01-21  Said Abou-Hallawa  <sabouhallawa@apple.com>

        A crash reproducible in Path::isEmpty() under RenderSVGShape::paint()
        https://bugs.webkit.org/show_bug.cgi?id=149613

        Reviewed by Darin Adler.

        When RenderSVGRoot::layout() realizes its layout size has changed and
        it has resources which have relative sizes, it marks all the clients of
        the resources for invalidates regardless whether they belong to the
        same RenderSVGRoot or not. But it reruns the layout only for its children.
        If one of these clients comes before the current RenderSVGRoot in the render
        tree, ee end up having renderer marked for invalidation at rendering time.
        This also prevents scheduling the layout if the same renderer is marked
        for another invalidation later. We prevent this because we do not want
        to schedule another layout for a renderer which is already marked for
        invalidation. This can cause crash if the renderer is an RenderSVGPath.
        
        The fix is to mark "only" the clients of a resource which belong to the
        same RenderSVGRoot of the resource. Also we need to run the layout for
        all the resources which belong to different RenderSVGRoots before running
        the layout for an SVG renderer.
         
        Tests: svg/custom/filter-update-different-root.html
               svg/custom/pattern-update-different-root.html

        * rendering/svg/RenderSVGResourceContainer.cpp:
        (WebCore::RenderSVGResourceContainer::markAllClientsForInvalidation):
        We should not mark any client outside the current root for invalidation
        
        * rendering/svg/RenderSVGResourceContainer.h: Remove unneeded private keyword.
        
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::addResourceForClientInvalidation):
        Code clean up; use findTreeRootObject() instead of repeating the same code.
        
        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::isEmpty): Avoid crashing if RenderSVGShape::isEmpty()
        is called before calling RenderSVGShape::layout().
         
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::layout): findTreeRootObject() now returns a pointer.
        
        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::findTreeRootObject): I do think nothing 
        guarantees that an SVG renderer has to have an RenderSVGRoot in its
        ancestors. So change this function to return a pointer. Also Provide
        the non-const version of this function.
         
        (WebCore::SVGRenderSupport::layoutDifferentRootIfNeeded): Runs the layout
        if needed for all the resources which belong to different RenderSVGRoots.
        
        (WebCore::SVGRenderSupport::layoutChildren): Make sure all the renderer's
        resources which belong to different RenderSVGRoots are laid out before
        running the layout for this renderer.
        
        * rendering/svg/SVGRenderSupport.h: Remove a mysterious comment.
        
        * rendering/svg/SVGResources.cpp:
        (WebCore::SVGResources::layoutDifferentRootIfNeeded): Run the layout for
        all the resources which belong to different RenderSVGRoots outside the
        context of their RenderSVGRoots.
        
        * rendering/svg/SVGResources.h:
        (WebCore::SVGResources::clipper):
        (WebCore::SVGResources::markerStart):
        (WebCore::SVGResources::markerMid):
        (WebCore::SVGResources::markerEnd):
        (WebCore::SVGResources::masker):
        (WebCore::SVGResources::filter):
        (WebCore::SVGResources::fill):
        (WebCore::SVGResources::stroke):
        Code clean up; use nullptr instead of 0.

2016-01-21  Jer Noble  <jer.noble@apple.com>

        [EME] Correctly report errors when generating key requests from AVContentKeySession.
        https://bugs.webkit.org/show_bug.cgi?id=151963

        Reviewed by Eric Carlson.

        WebIDL's "unsigned long" is a 32-bit unsigned integer, and C++'s "unsigned long" is (or, can
        be) a 64-bit integer on 64-bit platforms. Casting a negative integer to a 64-bit integer
        results in a number which cannot be accurately stored in a double-length floating point
        number. Previously, the mac CDM code would work around this issue by returning the absolute
        value of NSError code returned by media frameworks. Instead, fix the underlying problem by
        storing the MediaKeyError's systemCode as a uint32_t (which more accurately represents the
        size of a WebIDL "unsigned long" on all platforms.)

        Check the error code issued by -contentKeyRequestDataForApp:contentIdentifier:options:error:.

        * Modules/encryptedmedia/CDM.h:
        * Modules/encryptedmedia/CDMSessionClearKey.cpp:
        (WebCore::CDMSessionClearKey::generateKeyRequest):
        (WebCore::CDMSessionClearKey::update):
        * Modules/encryptedmedia/CDMSessionClearKey.h:
        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::keyRequestTimerFired):
        (WebCore::MediaKeySession::addKeyTimerFired):
        (WebCore::MediaKeySession::sendError):
        * Modules/encryptedmedia/MediaKeySession.h:
        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.handleReadyStateChange):
        * WebCore.xcodeproj/project.pbxproj:
        * html/MediaKeyError.h:
        (WebCore::MediaKeyError::create):
        (WebCore::MediaKeyError::systemCode):
        * html/MediaKeyEvent.h:
        * platform/graphics/CDMSession.h:
        * platform/graphics/avfoundation/cf/CDMSessionAVFoundationCF.cpp:
        (WebCore::CDMSessionAVFoundationCF::generateKeyRequest):
        (WebCore::CDMSessionAVFoundationCF::update):
        * platform/graphics/avfoundation/cf/CDMSessionAVFoundationCF.h:
        * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.h:
        * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm:
        (WebCore::CDMSessionAVContentKeySession::generateKeyRequest):
        (WebCore::CDMSessionAVContentKeySession::update):
        (WebCore::CDMSessionAVContentKeySession::generateKeyReleaseMessage):
        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm:
        (WebCore::CDMSessionAVFoundationObjC::generateKeyRequest):
        (WebCore::CDMSessionAVFoundationObjC::update):
        * platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.h:
        * platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.mm:
        (WebCore::CDMSessionAVStreamSession::generateKeyRequest):
        (WebCore::CDMSessionAVStreamSession::update):
        (WebCore::CDMSessionAVStreamSession::generateKeyReleaseMessage):
        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.h:
        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm:
        (WebCore::CDMSessionMediaSourceAVFObjC::layerDidReceiveError):
        (WebCore::CDMSessionMediaSourceAVFObjC::rendererDidReceiveError):
        (WebCore::CDMSessionMediaSourceAVFObjC::systemCodeForError): Deleted.
        * testing/MockCDM.cpp:
        (WebCore::MockCDMSession::generateKeyRequest):
        (WebCore::MockCDMSession::update):2016-01-15  Simon Fraser  <simon.fraser@apple.com>

2016-01-21  Carlos Garcia Campos  <cgarcia@igalia.com>

        [SOUP] GResource resources should be cached indefinitely in memory cache
        https://bugs.webkit.org/show_bug.cgi?id=153275

        Reviewed by Žan Doberšek.

        GResources can't change so they will always return the same data,
        we never need to revalidate them.

        * loader/cache/CachedResource.cpp:
        (WebCore::shouldCacheSchemeIndefinitely):

2016-01-21  Nan Wang  <n_wang@apple.com>

        AX: [IOS] Implement next/previous text marker functions using TextIterator
        https://bugs.webkit.org/show_bug.cgi?id=153292
        <rdar://problem/24268243>

        Reviewed by Chris Fleizach.

        Added support for the refactored next/previous text marker functions on iOS. And 
        made text marker tests working on iOS.
        Also, fixed an issue in AXObjectCache where creating a range with a replaced node
        at the start or end might exclude that node.

        Tests: accessibility/text-marker/text-marker-previous-next.html
               accessibility/text-marker/text-marker-with-user-select-none.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::characterOffsetsInOrder):
        (WebCore::resetNodeAndOffsetForReplacedNode):
        (WebCore::AXObjectCache::rangeForUnorderedCharacterOffsets):
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (+[WebAccessibilityTextMarker textMarkerWithVisiblePosition:cache:]):
        (+[WebAccessibilityTextMarker textMarkerWithCharacterOffset:cache:]):
        (+[WebAccessibilityTextMarker startOrEndTextMarkerForRange:isStart:cache:]):
        (-[WebAccessibilityTextMarker dataRepresentation]):
        (-[WebAccessibilityTextMarker visiblePosition]):
        (-[WebAccessibilityTextMarker characterOffset]):
        (-[WebAccessibilityTextMarker isIgnored]):
        (-[WebAccessibilityTextMarker accessibilityObject]):
        (-[WebAccessibilityTextMarker description]):
        (-[WebAccessibilityObjectWrapper stringForTextMarkers:]):
        (blockquoteLevel):
        (-[WebAccessibilityObjectWrapper textMarkerRange]):
        (-[WebAccessibilityObjectWrapper accessibilityObjectForTextMarker:]):
        (-[WebAccessibilityObjectWrapper nextMarkerForMarker:]):
        (-[WebAccessibilityObjectWrapper previousMarkerForMarker:]):
        (-[WebAccessibilityObjectWrapper textMarkerForPoint:]):
        (-[WebAccessibilityObjectWrapper nextMarkerForCharacterOffset:]):
        (-[WebAccessibilityObjectWrapper previousMarkerForCharacterOffset:]):
        (-[WebAccessibilityObjectWrapper rangeForTextMarkers:]):
        (-[WebAccessibilityObjectWrapper lengthForTextMarkers:]):
        (-[WebAccessibilityObjectWrapper startOrEndTextMarkerForTextMarkers:isStart:]):
        (-[WebAccessibilityObjectWrapper textMarkerRangeForMarkers:]):
        (-[WebAccessibilityObjectWrapper accessibilityIdentifier]):

2016-01-20  Zalan Bujtas  <zalan@apple.com>

        http://victordarras.fr/cssgame/ doesn't work in Safari.
        https://bugs.webkit.org/show_bug.cgi?id=153285
        <rdar://problem/24212369>

        Reviewed by Tim Horton.

        This patch adds support for hittesting ClipPathOperation::Reference.

        Tests: svg/clip-path/hittest-clip-path-reference-miss.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::nodeAtPoint):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::isSVGResourceClipper):
        * rendering/svg/RenderSVGResourceClipper.h:
        (isType):

2016-01-20  David Kilzer  <ddkilzer@apple.com>

        ResourceHandleCFURLConnectionDelegateWithOperationQueue delegate methods don't NULL-check m_handle->client()
        <https://webkit.org/b/152675>
        <rdar://problem/24034044>

        Reviewed by Brent Fulgham.

        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveResponse):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveData):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didFinishLoading):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didFail):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::willCacheResponse):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didSendBodyData):
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveDataArray):
        - Add NULL check for m_handle->client() as is done in the
          WebCoreResourceHandleAsOperationQueueDelegate class in
          WebCoreResourceHandleAsOperationQueueDelegate.mm.  (The NULL
          check for -connection:didReceiveResponse: is currently
          missing, but there are crashes there, too, that are covered by
          Bug 152673.)

2016-01-20  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Use TinyLRUCache in caching the CGColorRef in WebCore::cachedCGColor()
        https://bugs.webkit.org/show_bug.cgi?id=153279

        Reviewed by Dean Jackson.

        Reuse the new template TinyLRUCache in caching the CGColor instead of
        having the same code repeated twice.

        * platform/graphics/cg/ColorCG.cpp:
        (WebCore::leakCGColor):
        (WebCore::RetainPtr<CGColorRef>>::createValueForKey):
        (WebCore::cachedCGColor):

2016-01-20  Timothy Hatcher  <timothy@apple.com>

        Web Inspector: InspectorCSSAgent does not call disable in willDestroyFrontendAndBackend
        https://bugs.webkit.org/show_bug.cgi?id=153289
        <rdar://problem/24242600>

        Reviewed by Joseph Pecoraro.

        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::willDestroyFrontendAndBackend): Call disable().

2016-01-20  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Refactor AtomicStringKeyedMRUCache to be a generic LRU cache
        https://bugs.webkit.org/show_bug.cgi?id=153109

        Reviewed by Darin Adler.

        Replace the template specialization of AtomicStringKeyedMRUCache with
        template derived from TinyLRUCachePolicy. Override the functions which
        are needed for creating the values and the null value. Also replace the
        static function which was returning a NeverDestroyed AtomicStringKeyedMRUCache
        with a singleton function 'cache' inside the derived template.

        * WebCore.xcodeproj/project.pbxproj:
        * platform/text/AtomicStringKeyedMRUCache.h: Removed.
        * platform/text/cf/HyphenationCF.cpp:
        (WebCore::canHyphenate):
        (WebCore::lastHyphenLocation):
        (WebCore::AtomicStringKeyedMRUCache<RetainPtr<CFLocaleRef>>::createValueForNullKey): Deleted.
        (WebCore::AtomicStringKeyedMRUCache<RetainPtr<CFLocaleRef>>::createValueForKey): Deleted.
        (WebCore::cfLocaleCache): Deleted.
        * platform/text/hyphen/HyphenationLibHyphen.cpp:
        (WebCore::countLeadingSpaces):
        (WebCore::lastHyphenLocation):
        (WebCore::AtomicStringKeyedMRUCache<RefPtr<HyphenationDictionary>>::createValueForNullKey): Deleted.
        (WebCore::AtomicStringKeyedMRUCache<RefPtr<HyphenationDictionary>>::createValueForKey): Deleted.
        (WebCore::hyphenDictionaryCache): Deleted.

2016-01-20  Chris Dumez  <cdumez@apple.com>

        Drop support for obsolete Node.isSupported()
        https://bugs.webkit.org/show_bug.cgi?id=153164

        Reviewed by Darin Adler.

        Drop support for obsolete Node.isSupported(). Chrome and Firefox already
        dropped it.

        No new tests, already covered by existing test.

        * dom/Node.cpp:
        (WebCore::Node::isSupportedForBindings):
        * dom/Node.h:
        * dom/Node.idl:

2016-01-20  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix compile warning when building with GTK+ < 3.14.

        * rendering/RenderThemeGtk.cpp:
        (WebCore::loadThemedIcon):

2016-01-20  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac] Speculative cmake buildfix after r195317.

        * PlatformMac.cmake:

2016-01-19  Chris Dumez  <cdumez@apple.com>

        DocumentType.publicId / systemId should never return null
        https://bugs.webkit.org/show_bug.cgi?id=153264

        Reviewed by Ryosuke Niwa.

        DocumentType.publicId / systemId should never return null as these
        attributes are not nullable in the IDL:
        https://dom.spec.whatwg.org/#interface-documenttype

        Instead we should return the empty string. Firefox and Chrome match the
        specification.

        No new tests, already covered by existing tests.

        * dom/DocumentType.idl:

2016-01-19  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195302.
        https://bugs.webkit.org/show_bug.cgi?id=153267

        This change broke the Windows build, rolling out so it isn't
        broken all night before investigation. (Requested by
        ryanhaddad on #webkit).

        Reverted changeset:

        "[EME] Correctly report errors when generating key requests
        from AVContentKeySession."
        https://bugs.webkit.org/show_bug.cgi?id=151963
        http://trac.webkit.org/changeset/195302

2016-01-19  Chris Dumez  <cdumez@apple.com>

        DOMImplementation.createDocument() should treat undefined namespace as null
        https://bugs.webkit.org/show_bug.cgi?id=153252

        Reviewed by Ryosuke Niwa.

        DOMImplementation.createDocument() should treat undefined namespace as null as
        the DOMString parameter is nullable:
        https://dom.spec.whatwg.org/#domimplementation

        Firefox behaves according to the specification, Chrome does not.

        No new tests, already covered by existing test.

        * dom/DOMImplementation.idl:

2016-01-19  Enrica Casucci  <enrica@apple.com>

        Add support for DataDetectors in WK (iOS).
        https://bugs.webkit.org/show_bug.cgi?id=152989
        rdar://problem/22855960

        Reviewed by Tim Horton.

        This is the first step toward implementing Data Detectors support
        in WK2. The patch adds a new memeber to the Settings object
        to retrieve the type of detection desired. The DataDetection files
        have been moved under cocoa, since they are no longer OS X specific.

        * Configurations/FeatureDefines.xcconfig:
        * Configurations/WebCore.xcconfig:
        * WebCore.xcodeproj/project.pbxproj:
        * editing/cocoa/DataDetection.h: Copied from Source/WebCore/editing/mac/DataDetection.h.
        * editing/cocoa/DataDetection.mm: Copied from Source/WebCore/editing/mac/DataDetection.mm.
        (WebCore::detectItemAtPositionWithRange):
        (WebCore::DataDetection::detectItemAroundHitTestResult):
        (WebCore::DataDetection::detectContentInRange):
        * editing/mac/DataDetection.h: Removed.
        * editing/mac/DataDetection.mm: Removed.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        * page/Settings.h:
        * page/Settings.in:
        * platform/spi/mac/DataDetectorsSPI.h:

2016-01-19  Nikos Andronikos  <nikos.andronikos-webkit@cisra.canon.com.au>

        SVG 2 requires a mechanism for restricting enum values exposed through the DOM
        https://bugs.webkit.org/show_bug.cgi?id=152814

        Reviewed by Darin Adler.

        No new tests (No change in functionality, blocked bugs add new tests).
 
        This patch adds a mechanism to restrict the values returned through the
        SVGAnimatedEnumeration interface.
        This is required for SVG 2, which does not expose new enumeration
        values through the IDL.
        See http://www.w3.org/TR/SVG2/types.html#InterfaceSVGAnimatedEnumeration
        Getters:
        SVG 2 does not add numeric type values for new options, new options
        should return UNKNOWN.
        E.g. See the table defining numeric type values for orient at
        http://www.w3.org/TR/SVG2/painting.html#InterfaceSVGMarkerElement
        Setters:
        On setting baseVal, the following steps are run:
        1. ...
        2. If value is 0 or is not the numeric type value for any value of the reflected attribute, then set the reflected attribute to the empty string.

        * svg/properties/SVGAnimatedEnumerationPropertyTearOff.h:
        Override baseVal() and animVal() to perform range checks against
        the highest exposed enum value.
        * svg/properties/SVGAnimatedStaticPropertyTearOff.h:
        (WebCore::SVGAnimatedStaticPropertyTearOff::baseVal): Mark function as virtual as it's over-ridden for enumerations.
        (WebCore::SVGAnimatedStaticPropertyTearOff::animVal): Mark function as virtual as it's over-ridden for enumerations.
        * svg/properties/SVGPropertyTraits.h:
        Add SVGIDLEnumLimits struct that contains function for querying the
        highest exposed enum value.
        (WebCore::SVGIDLEnumLimits::highestExposedEnumValue): New function that returns the highest enum value that should
        be exposed through the DOM. This function should be specialized for enum types that need to restrict the exposed
        values.

2016-01-19  Konstantin Tokarev  <annulen@yandex.ru>

        Fixed compilation of AXObjectCache in case of !HAVE(ACCESSIBILITY).
        https://bugs.webkit.org/show_bug.cgi?id=153243

        Reviewed by Chris Fleizach.

        No new tests needed.

        * accessibility/AXObjectCache.h:
        (WebCore::AXObjectCache::AXObjectCache):
        (WebCore::nodeHasRole): Deleted.

2016-01-19  Antti Koivisto  <antti@apple.com>

        Use references in SelectorChecker
        https://bugs.webkit.org/show_bug.cgi?id=153240

        Reviewed by Andreas Kling.

        Element and selector can't be null in most places.

        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::collectMatchingRules):
        * css/SelectorChecker.cpp:
        (WebCore::attributeValueMatches):
        (WebCore::anyAttributeMatches):
        (WebCore::SelectorChecker::checkOne):
        (WebCore::SelectorChecker::matchSelectorList):
        (WebCore::SelectorChecker::checkScrollbarPseudoClass):
        (WebCore::SelectorChecker::determineLinkMatchType):
        (WebCore::isFrameFocused):
        (WebCore::SelectorChecker::matchesFocusPseudoClass):
        * css/SelectorChecker.h:
        (WebCore::SelectorChecker::isCommonPseudoClassSelector):
        (WebCore::SelectorChecker::checkExactAttribute): Deleted.
        * css/SelectorCheckerTestFunctions.h:
        (WebCore::isAutofilled):
        (WebCore::isDefaultButtonForForm):
        (WebCore::isDisabled):
        (WebCore::isEnabled):
        (WebCore::isMediaDocument):
        (WebCore::isChecked):
        (WebCore::isInRange):
        (WebCore::isOutOfRange):
        (WebCore::isInvalid):
        (WebCore::isOptionalFormControl):
        (WebCore::isRequiredFormControl):
        (WebCore::isValid):
        (WebCore::isWindowInactive):
        (WebCore::containslanguageSubtagMatchingRange):
        (WebCore::matchesLangPseudoClass):
        (WebCore::matchesReadOnlyPseudoClass):
        (WebCore::matchesReadWritePseudoClass):
        (WebCore::shouldAppearIndeterminate):
        (WebCore::scrollbarMatchesEnabledPseudoClass):
        (WebCore::scrollbarMatchesCornerPresentPseudoClass):
        (WebCore::matchesFullScreenPseudoClass):
        (WebCore::matchesFullScreenAnimatingFullScreenTransitionPseudoClass):
        (WebCore::matchesFullScreenAncestorPseudoClass):
        (WebCore::matchesFullScreenDocumentPseudoClass):
        (WebCore::matchesFutureCuePseudoClass):
        (WebCore::matchesPastCuePseudoClass):

2016-01-19  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r195179.

        It relies on r195141 which was rolled out

        Reverted changeset:

        "Allocate style sheet media queries in BumpArena."
        https://bugs.webkit.org/show_bug.cgi?id=153188
        http://trac.webkit.org/changeset/195179

2016-01-19  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r195173.

        It relies on r195141 which was rolled out

        Reverted changeset:

        "Give RuleSet a BumpArena and start using it for
        RuleDataVectors."
        https://bugs.webkit.org/show_bug.cgi?id=153169
        http://trac.webkit.org/changeset/195173

2016-01-19  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195300.
        https://bugs.webkit.org/show_bug.cgi?id=153244

        enrica wants more time to fix Windows (Requested by thorton on
        #webkit).

        Reverted changeset:

        "Add support for DataDetectors in WK (iOS)."
        https://bugs.webkit.org/show_bug.cgi?id=152989
        http://trac.webkit.org/changeset/195300

2016-01-19  Zalan Bujtas  <zalan@apple.com>

        outline-offset does not work for inlines.
        https://bugs.webkit.org/show_bug.cgi?id=153238

        Reviewed by Simon Fraser.

        Adjust outline box width/height with outline-offset.

        Test: fast/inline/inlines-with-outline-offset.html

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::paintOutline):
        (WebCore::RenderInline::paintOutlineForLine):

2016-01-19  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r195141.

        Seems to cause crashes on iOS9 64bit

        Reverted changeset:

        "Fragmentation-free allocator for timeless and/or coupled
        allocations."
        https://bugs.webkit.org/show_bug.cgi?id=152696
        http://trac.webkit.org/changeset/195141

2015-12-07  Jer Noble  <jer.noble@apple.com>

        [EME] Correctly report errors when generating key requests from AVContentKeySession.
        https://bugs.webkit.org/show_bug.cgi?id=151963

        Reviewed by Eric Carlson.

        WebIDL's "unsigned long" is a 32-bit unsigned integer, and C++'s "unsigned long" is (or, can
        be) a 64-bit integer on 64-bit platforms. Casting a negative integer to a 64-bit integer
        results in a number which cannot be accurately stored in a double-length floating point
        number. Previously, the mac CDM code would work around this issue by returning the absolute
        value of NSError code returned by media frameworks. Instead, fix the underlying problem by
        storing the MediaKeyError's systemCode as a uint32_t (which more accurately represents the
        size of a WebIDL "unsigned long" on all platforms.)

        Check the error code issued by -contentKeyRequestDataForApp:contentIdentifier:options:error:.

        * Modules/encryptedmedia/CDM.h:
        * Modules/encryptedmedia/CDMSessionClearKey.cpp:
        (WebCore::CDMSessionClearKey::generateKeyRequest):
        (WebCore::CDMSessionClearKey::update):
        * Modules/encryptedmedia/CDMSessionClearKey.h:
        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::keyRequestTimerFired):
        (WebCore::MediaKeySession::addKeyTimerFired):
        (WebCore::MediaKeySession::sendError):
        * Modules/encryptedmedia/MediaKeySession.h:
        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.handleReadyStateChange):
        * WebCore.xcodeproj/project.pbxproj:
        * html/MediaKeyError.h:
        (WebCore::MediaKeyError::create):
        (WebCore::MediaKeyError::systemCode):
        * html/MediaKeyEvent.h:
        * platform/graphics/CDMSession.h:
        * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.h:
        * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm:
        (WebCore::CDMSessionAVContentKeySession::generateKeyRequest):
        (WebCore::CDMSessionAVContentKeySession::update):
        (WebCore::CDMSessionAVContentKeySession::generateKeyReleaseMessage):
        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm:
        (WebCore::CDMSessionAVFoundationObjC::generateKeyRequest):
        (WebCore::CDMSessionAVFoundationObjC::update):
        * platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.h:
        * platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.mm:
        (WebCore::CDMSessionAVStreamSession::generateKeyRequest):
        (WebCore::CDMSessionAVStreamSession::update):
        (WebCore::CDMSessionAVStreamSession::generateKeyReleaseMessage):
        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.h:
        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm:
        (WebCore::CDMSessionMediaSourceAVFObjC::layerDidReceiveError):
        (WebCore::CDMSessionMediaSourceAVFObjC::rendererDidReceiveError):
        (WebCore::CDMSessionMediaSourceAVFObjC::systemCodeForError): Deleted.
        * testing/MockCDM.cpp:
        (WebCore::MockCDMSession::generateKeyRequest):
        (WebCore::MockCDMSession::update):2016-01-15  Simon Fraser  <simon.fraser@apple.com>

2016-01-19  Enrica Casucci  <enrica@apple.com>

        Add support for DataDetectors in WK (iOS).
        https://bugs.webkit.org/show_bug.cgi?id=152989
        rdar://problem/22855960

        Reviewed by Tim Horton.

        This is the first step toward implementing Data Detectors support
        in WK2. The patch adds a new memeber to the Settings object
        to retrieve the type of detection desired. The DataDetection files
        have been moved under cocoa, since they are no longer OS X specific.

        * Configurations/FeatureDefines.xcconfig:
        * Configurations/WebCore.xcconfig:
        * WebCore.xcodeproj/project.pbxproj:
        * editing/cocoa/DataDetection.h: Copied from Source/WebCore/editing/mac/DataDetection.h.
        * editing/cocoa/DataDetection.mm: Copied from Source/WebCore/editing/mac/DataDetection.mm.
        (WebCore::detectItemAtPositionWithRange):
        (WebCore::DataDetection::detectItemAroundHitTestResult):
        (WebCore::DataDetection::detectContentInRange):
        * editing/mac/DataDetection.h: Removed.
        * editing/mac/DataDetection.mm: Removed.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        * page/Settings.h:
        * page/Settings.in:
        * platform/spi/mac/DataDetectorsSPI.h:

2016-01-19  Chris Dumez  <cdumez@apple.com>

        Unreviewed, fix typo in comment added in r195157.

        * dom/DocumentType.h:

2016-01-18  Antti Koivisto  <antti@apple.com>

        Selector checker should not mutate document and style
        https://bugs.webkit.org/show_bug.cgi?id=153205

        Reviewed by Darin Adler.

        Selector checker currently writes affected-by bits and similar directly to the document and style during selector
        matching. This is confusing, complicated and wrong.

        This patch changes SelectorChecker and SelectorCompiler to collect style relatationship metadata to a separate
        data structure (currently part of SelectorChecker::CheckingContext) instead of changing the document and style
        directly. The mutations are performed later outside selector checker.

        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::ruleMatches):
        (WebCore::ElementRuleCollector::commitStyleRelations):

            Apply the relationship bit to elements and style.

        (WebCore::ElementRuleCollector::collectMatchingRulesForList):
        * css/ElementRuleCollector.h:
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::LocalContext::LocalContext):

            LocalContext is now a separate data structure.

        (WebCore::addStyleRelation):

            Helper for recording new style relations. This is used where code mutated elements or style directly before.

        (WebCore::isFirstChildElement):
        (WebCore::isLastChildElement):
        (WebCore::isFirstOfType):
        (WebCore::isLastOfType):
        (WebCore::countElementsBefore):
        (WebCore::countElementsOfTypeBefore):
        (WebCore::SelectorChecker::SelectorChecker):
        (WebCore::SelectorChecker::match):
        (WebCore::hasScrollbarPseudoElement):
        (WebCore::localContextForParent):
        (WebCore::SelectorChecker::matchRecursively):
        (WebCore::attributeValueMatches):
        (WebCore::anyAttributeMatches):
        (WebCore::canMatchHoverOrActiveInQuirksMode):
        (WebCore::tagMatches):
        (WebCore::SelectorChecker::checkOne):
        (WebCore::SelectorChecker::matchSelectorList):
        (WebCore::SelectorChecker::checkScrollbarPseudoClass):
        (WebCore::SelectorChecker::CheckingContextWithStatus::CheckingContextWithStatus): Deleted.
        (WebCore::checkingContextForParent): Deleted.
        * css/SelectorChecker.h:
        (WebCore::SelectorChecker::CheckingContext::CheckingContext):
        * css/SelectorCheckerTestFunctions.h:
        (WebCore::isEnabled):
        (WebCore::isMediaDocument):
        (WebCore::isChecked):
        (WebCore::isInRange):
        (WebCore::isOutOfRange):
        * css/StyleResolver.h:
        (WebCore::checkRegionSelector):
        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateAddStyleRelationIfResolvingStyle):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateAddStyleRelation):

            Helpers for generating code for recording new style relations. This is used where code mutated elements or style directly before.

        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorCheckerExcludingPseudoElements):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateDirectAdjacentTreeWalker):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateIndirectAdjacentTreeWalker):
        (WebCore::SelectorCompiler::addStyleRelationElementFunction):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::jumpIfNoPreviousAdjacentElement):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::moduloIsZero):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::linkFailures):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatching):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateContextFunctionCallTest):
        (WebCore::SelectorCompiler::elementIsActive):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsActive):
        (WebCore::SelectorCompiler::jumpIfElementIsNotEmpty):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsEmpty):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsFirstChild):
        (WebCore::SelectorCompiler::elementIsHovered):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsHovered):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsInLanguage):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsLastChild):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsOnlyChild):
        (WebCore::SelectorCompiler::makeContextStyleUniqueIfNecessaryAndTestIsPlaceholderShown):
        (WebCore::SelectorCompiler::isPlaceholderShown):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementHasPlaceholderShown):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsLink):
        (WebCore::SelectorCompiler::nthFilterIsAlwaysSatisified):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChild):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChildOf):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthLastChild):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthLastChildOf):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateMarkPseudoStyleForPseudoElement):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::addFlagsToElementStyleFromContext): Deleted.
        (WebCore::SelectorCompiler::setNodeFlag): Deleted.
        (WebCore::SelectorCompiler::SelectorCodeGenerator::markElementIfResolvingStyle): Deleted.
        (WebCore::SelectorCompiler::setFirstChildState): Deleted.
        (WebCore::SelectorCompiler::elementIsActiveForStyleResolution): Deleted.
        (WebCore::SelectorCompiler::setElementStyleIsAffectedByEmpty): Deleted.
        (WebCore::SelectorCompiler::setElementStyleFromContextIsAffectedByEmptyAndUpdateRenderStyleIfNecessary): Deleted.
        (WebCore::SelectorCompiler::elementIsHoveredForStyleResolution): Deleted.
        (WebCore::SelectorCompiler::setLastChildState): Deleted.
        (WebCore::SelectorCompiler::setOnlyChildState): Deleted.
        (WebCore::SelectorCompiler::makeElementStyleUniqueIfNecessaryAndTestIsPlaceholderShown): Deleted.
        (WebCore::SelectorCompiler::setElementChildIndex): Deleted.
        (WebCore::SelectorCompiler::setChildrenAffectedByBackwardPositionalRules): Deleted.
        (WebCore::SelectorCompiler::setParentAffectedByLastChildOf): Deleted.
        * dom/SelectorQuery.cpp:
        (WebCore::SelectorDataList::selectorMatches):
        (WebCore::SelectorDataList::selectorClosest):
        (WebCore::SelectorDataList::matches):
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::buildArrayForMatchedRuleList):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::buildObjectForSelectorHelper):

2016-01-19  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GTK+ build with GTK+ < 3.14.

        Flags GTK_ICON_LOOKUP_DIR_LTR and GTK_ICON_LOOKUP_DIR_RTL were
        added in GTK+ 3.14.

        * rendering/RenderThemeGtk.cpp:
        (WebCore::loadThemedIcon):

2016-01-19  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GObject DOM bindings API break after r195264.

        Add webkit_dom_character_data_set_data to the list of functions
        that used to raise exceptions.

        * bindings/scripts/CodeGeneratorGObject.pm:
        (FunctionUsedToRaiseException):

2016-01-19  Javier Fernandez  <jfernandez@igalia.com>

        [css-grid][css-align] justify-self stretch is not applied for img elements
        https://bugs.webkit.org/show_bug.cgi?id=153206

        Reviewed by Darin Adler.

        When computing the logical height, we check first if there is an override
        height value set as a consequence of the stretching logic, so we use it
        directly for any kind of element. However, in the case of the width
        computation, we don't use such override value because it's the default
        behavior of block-level boxes.

        However, we consider some special cases which have to be treated as
        replaced elements. Theses cases are evaluated first, so we don't let the
        regular width computation logic to be executed, which is what we want
        to implement the stretch behavior.

        In order to let replaced elements, such images, to be stretched as a
        consequence of the CSS alignment properties, we need to exclude grid
        items from the cases to be treated as replaced elements during the width
        computation.

        Test: fast/css-grid-layout/grid-align-stretching-replaced-items.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeLogicalWidthInRegion):
        (WebCore::RenderBox::hasStretchedLogicalWidth):
        (WebCore::RenderBox::sizesLogicalWidthToFitContent):
        * rendering/RenderBox.h:

2016-01-19  Ryosuke Niwa  <rniwa@webkit.org>

        Text::splitText doesn't update Range end points anchored on parent nodes
        https://bugs.webkit.org/show_bug.cgi?id=153227

        Reviewed by Antti Koivisto.

        When a Text node is split into two and there is a Range whose boundary points' container node
        is its parent and offset appears after the Text node, we must update the boundary points as specified
        in step 7 of the concept "split" a Text node at https://dom.spec.whatwg.org/#concept-text-split

        1. Insert new node into parent before node’s next sibling.
        2. For each range whose start node is node and start offset is greater than offset, set its start node
           to new node and decrease its start offset by offset.
        3. For each range whose end node is node and end offset is greater than offset, set its end node to
           new node and decrease its end offset by offset.
        4. For each range whose start node is parent and start offset is equal to the index of node + 1,
           increase its start offset by one.
        5. For each range whose end node is parent and end offset is equal to the index of node + 1, increase
           its end offset by one.

        Fixed the bug by implementing steps 4 and 5 in boundaryTextNodesSplit. New behavior matches the DOM spec
        as well as the behavior of Firefox.

        Test: fast/dom/Range/update-range-in-split-text.html

        * dom/Range.cpp:
        (WebCore::boundaryTextNodesSplit): See above.
        * dom/RangeBoundaryPoint.h:
        (WebCore::RangeBoundaryPoint::setToAfterChild): Added.

2016-01-19  Ryosuke Niwa  <rniwa@webkit.org>

        CharacterData::setData doesn't need ExceptionCode as an out argument
        https://bugs.webkit.org/show_bug.cgi?id=153225

        Reviewed by Antti Koivisto.

        Removed the ExceptionCode out argument from CharacterData::setData since it's never used.

        * dom/CharacterData.cpp:
        (WebCore::CharacterData::setData):
        (WebCore::CharacterData::containsOnlyWhitespace):
        (WebCore::CharacterData::setNodeValue):
        (WebCore::CharacterData::setDataAndUpdate):
        * dom/CharacterData.h:
        (WebCore::CharacterData::data):
        (WebCore::CharacterData::dataMemoryOffset):
        (WebCore::CharacterData::length):
        * dom/CharacterData.idl:
        * dom/Range.cpp:
        (WebCore::Range::processContentsBetweenOffsets):
        * dom/Text.cpp:
        (WebCore::Text::replaceWholeText):
        * editing/markup.cpp:
        (WebCore::replaceChildrenWithFragment):
        (WebCore::replaceChildrenWithText):
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::setText):
        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::setText):
        * html/HTMLTitleElement.cpp:
        (WebCore::HTMLTitleElement::setText):

2016-01-19  Ryosuke Niwa  <rniwa@webkit.org>

        innerHTML should always add a mutation record for removing all children
        https://bugs.webkit.org/show_bug.cgi?id=148782
        <rdar://problem/22571962>

        Reviewed by Antti Koivisto.

        Fixed the bug by disabling WebKit's optimization to avoid the node replacement when the behavior
        is observable to scripts by either:
         - Author scripts has a reference to the node
         - MutationObserver can be observing this subtree
         - Mutation events can be observing this subtree

        Note that no caller of this function exposes fragment to author scripts so it couldn't be referenced.
        It also means that we don't need to check DOMNodeInsertedIntoDocument since it doesn't bubble up
        (it's only relevant if the text node in fragment has its event listener but that's impossible).

        Test: fast/dom/innerHTML-single-text-node.html

        * dom/ChildListMutationScope.h:
        (WebCore::ChildListMutationScope::canObserve): Added.

        * editing/markup.cpp:
        (WebCore::hasMutationEventListeners): Added.
        (WebCore::replaceChildrenWithFragment):

2016-01-18  Ryosuke Niwa  <rniwa@webkit.org>

        createAttribute should lowercase the attribute name in a HTML document
        https://bugs.webkit.org/show_bug.cgi?id=153112

        Reviewed by Darin Adler.

        In a HTML document, we should always lowercase localName in document.createAttribute as specified in
        https://dom.spec.whatwg.org/#dom-document-createattribute:

        1. If localName does not match the Name production in XML, throw an InvalidCharacterError exception.
        2. If the context object is an HTML document, let localName be converted to ASCII lowercase.
        3. Return a new attribute whose local name is localName.

        Change WebKit's behavior to match the spec as well as Firefox. document.createAttributeNS will
        continue to preserve the case as spec'ed.

        No new tests are added since the behavior change is covered by existing tests.

        * dom/Document.cpp:
        (WebCore::Document::createAttribute):

2016-01-18  Brady Eidson  <beidson@apple.com>

        Modern IDB: Add private-browsing variant for many IDB tests, and enable private browsing in Modern IDB.
        https://bugs.webkit.org/show_bug.cgi?id=153179

        Reviewed by Darin Adler.

        Tests: Many private-browsing copies of existing IDB tests.

        * Modules/indexeddb/client/IDBFactoryImpl.cpp:
        (WebCore::IDBClient::shouldThrowSecurityException): Allow IDB access in private browsing.

2016-01-18  Eric Carlson  <eric.carlson@apple.com>

        [iOS Simulator WK1] ASSERT loading Blink layout test imported/web-platform-tests/mediacapture-streams/stream-api/mediastream/mediastream-idl.html
        https://bugs.webkit.org/show_bug.cgi?id=153070
        <rdar://problem/24183105>

        Reviewed by Darin Adler.

        No new tests, this prevents an existing test from crashing.

        * platform/mock/MockRealtimeVideoSource.cpp:
        (WebCore::MockRealtimeVideoSource::MockRealtimeVideoSource): Create the timer with RunLoop::current
          instead of RunLoop::main.

2016-01-18  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Reduce PassRefPtr uses in dom - 3
        https://bugs.webkit.org/show_bug.cgi?id=153055

        Reviewed by Darin Adler.

        Third patch to reduce uses of PassRefPtr in WebCore/dom.

        * dom/MutationObserverInterestGroup.cpp:
        (WebCore::MutationObserverInterestGroup::enqueueMutationRecord):
        * dom/MutationRecord.cpp:
        (WebCore::MutationRecord::createChildList):
        (WebCore::MutationRecord::createAttributes):
        (WebCore::MutationRecord::createCharacterData):
        (WebCore::MutationRecord::createWithNullOldValue):
        * dom/MutationRecord.h:
        * dom/NamedFlowCollection.cpp:
        (WebCore::NamedFlowCollection::createCSSOMSnapshot):
        * dom/NamedFlowCollection.h:
        * dom/PendingScript.cpp:
        (WebCore::PendingScript::releaseElementAndClear):
        * dom/PendingScript.h:
        * dom/ScriptRunner.h:
        * dom/SecurityContext.h:
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::cloneNode):
        * dom/ShadowRoot.h:
        * dom/SpaceSplitString.cpp:
        (WebCore::SpaceSplitStringData::create):
        * dom/SpaceSplitString.h:
        * dom/TreeWalker.cpp:
        (WebCore::TreeWalker::setCurrent):
        (WebCore::TreeWalker::parentNode):
        (WebCore::TreeWalker::previousNode):
        (WebCore::TreeWalker::nextNode):
        * dom/TreeWalker.h:
        * dom/default/PlatformMessagePortChannel.cpp:
        (WebCore::PlatformMessagePortChannel::entangledChannel):
        * dom/default/PlatformMessagePortChannel.h:

2016-01-18  Nan Wang  <n_wang@apple.com>

        AX: [Mac] Implement next/previous text marker functions using TextIterator
        https://bugs.webkit.org/show_bug.cgi?id=152728

        Reviewed by Chris Fleizach.

        The existing AXTextMarker based calls are implemented using visible position, and that introduced
        some bugs which make VoiceOver working incorrectly on Mac sometimes. Since TextIterator uses rendering
        position, we tried to use it to refactor those AXTextMarker based calls.
        In this patch, I implemented functions to navigate to previous/next text marker using Range and TextIterator.
        Also added a conversion between visible position and character offset to make sure unconverted text marker
        related functions are still working correctly.

        Tests: accessibility/mac/previous-next-text-marker.html
               accessibility/mac/text-marker-with-user-select-none.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):
        (WebCore::AXObjectCache::traverseToOffsetInRange):
        (WebCore::AXObjectCache::lengthForRange):
        (WebCore::AXObjectCache::rangeForNodeContents):
        (WebCore::characterOffsetsInOrder):
        (WebCore::AXObjectCache::rangeForUnorderedCharacterOffsets):
        (WebCore::AXObjectCache::setTextMarkerDataWithCharacterOffset):
        (WebCore::AXObjectCache::startOrEndTextMarkerDataForRange):
        (WebCore::AXObjectCache::textMarkerDataForCharacterOffset):
        (WebCore::AXObjectCache::nextNode):
        (WebCore::AXObjectCache::previousNode):
        (WebCore::AXObjectCache::visiblePositionFromCharacterOffset):
        (WebCore::AXObjectCache::characterOffsetFromVisiblePosition):
        (WebCore::AXObjectCache::accessibilityObjectForTextMarkerData):
        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
        * accessibility/AXObjectCache.h:
        (WebCore::CharacterOffset::CharacterOffset):
        (WebCore::CharacterOffset::remaining):
        (WebCore::CharacterOffset::isNull):
        (WebCore::AXObjectCache::setNodeInUse):
        (WebCore::AXObjectCache::removeNodeForUse):
        (WebCore::AXObjectCache::isNodeInUse):
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::selectionRange):
        (WebCore::AccessibilityObject::elementRange):
        (WebCore::AccessibilityObject::selectText):
        (WebCore::AccessibilityObject::lineRangeForPosition):
        (WebCore::AccessibilityObject::replacedNodeNeedsCharacter):
        (WebCore::renderListItemContainerForNode):
        (WebCore::listMarkerTextForNode):
        (WebCore::AccessibilityObject::listMarkerTextForNodeAndPosition):
        (WebCore::AccessibilityObject::stringForRange):
        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
        (WebCore::replacedNodeNeedsCharacter): Deleted.
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::visiblePositionRange):
        (WebCore::AccessibilityObject::visiblePositionRangeForLine):
        (WebCore::AccessibilityObject::boundsForVisiblePositionRange):
        (WebCore::AccessibilityObject::setSelectedVisiblePositionRange):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (isTextMarkerIgnored):
        (-[WebAccessibilityObjectWrapper accessibilityObjectForTextMarker:]):
        (accessibilityObjectForTextMarker):
        (-[WebAccessibilityObjectWrapper textMarkerRangeFromRange:]):
        (textMarkerRangeFromRange):
        (-[WebAccessibilityObjectWrapper startOrEndTextMarkerForRange:isStart:]):
        (startOrEndTextmarkerForRange):
        (-[WebAccessibilityObjectWrapper nextTextMarkerForNode:offset:]):
        (-[WebAccessibilityObjectWrapper previousTextMarkerForNode:offset:]):
        (-[WebAccessibilityObjectWrapper textMarkerForNode:offset:]):
        (textMarkerForCharacterOffset):
        (-[WebAccessibilityObjectWrapper rangeForTextMarkerRange:]):
        (-[WebAccessibilityObjectWrapper characterOffsetForTextMarker:]):
        (textMarkerForVisiblePosition):
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):

2016-01-18  Olivier Blin  <olivier.blin@softathome.com>

        [Mac] Remove unused playerToPrivateMap()
        https://bugs.webkit.org/show_bug.cgi?id=153203

        Reviewed by Darin Adler.

        This was used in previous EME implementations, but is unnecessary
        since r163907.

        No new tests since this removes dead code only.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::globalLoaderDelegateQueue): Deleted.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC): Deleted.

2016-01-18  Simon Fraser  <simon.fraser@apple.com>

        Add TextStream-based logging for Position and VisiblePosition
        https://bugs.webkit.org/show_bug.cgi?id=153195

        Reviewed by Ryosuke Niwa.

        Make it easy to dump Positions and VisiblePositions with a TextStream.

        * dom/Position.cpp:
        (WebCore::operator<<):
        * dom/Position.h:
        * editing/VisiblePosition.cpp:
        (WebCore::operator<<):
        * editing/VisiblePosition.h:

2016-01-18  Zan Dobersek  <zdobersek@igalia.com>

        Sink the Vector<uint8_t> buffer into the SerializedScriptValue constructor
        https://bugs.webkit.org/show_bug.cgi?id=142634

        Reviewed by Darin Adler.

        Have the SerializedScriptValue constructor take in the Vector<uint8_t> buffer
        through an rvalue reference, avoiding the copying into the m_data member. The
        three-parameter constructor now takes in the Vector<String> blob URL object
        via const reference, and the std::unique_ptr<> object via a rvalue reference.

        Adjust all the call sites and affected code to now either move or copy a
        non-movable object into the SerializedScriptValue constructor or the helper
        methods.

        No new tests -- no change in behavior.

        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::deserializeIDBValueDataToJSValue):
        (WebCore::deserializeIDBValueBuffer):
        (WebCore::idbValueDataToJSValue):
        * bindings/js/IDBBindingUtilities.h:
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::SerializedScriptValue::SerializedScriptValue):
        (WebCore::SerializedScriptValue::create):
        (WebCore::SerializedScriptValue::numberValue):
        (WebCore::SerializedScriptValue::undefinedValue):
        (WebCore::SerializedScriptValue::nullValue):
        * bindings/js/SerializedScriptValue.h:
        * testing/Internals.cpp:
        (WebCore::Internals::deserializeBuffer):

2016-01-18  Olivier Blin  <olivier.blin@softathome.com>

        [GStreamer] Remove unused m_endTime
        https://bugs.webkit.org/show_bug.cgi?id=153209

        Reviewed by Michael Catanzaro.

        m_endTime has been unused since r47710 in MediaPlayerPrivateGStreamer.

        No new tests since this is just a member cleanup.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer): Deleted.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:

2016-01-18  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the --minimal build due to missing VM.h include
        https://bugs.webkit.org/show_bug.cgi?id=153128

        Reviewed by Michael Catanzaro.

        * bindings/js/WebCoreJSBuiltinInternals.h:

2016-01-18  Csaba Osztrogonác  <ossy@webkit.org>

        Remove the SKIP_UNUSED_PARAM define
        https://bugs.webkit.org/show_bug.cgi?id=153129

        Reviewed by Michael Catanzaro.

        * bindings/js/WebCoreJSBuiltinInternals.cpp:
        (WebCore::JSBuiltinInternalFunctions::visit):
        (WebCore::JSBuiltinInternalFunctions::initialize):
        * bindings/js/WebCoreJSBuiltinInternals.h:

2016-01-17  Simon Fraser  <simon.fraser@apple.com>

        More displaylist tests, and minor cleanup
        https://bugs.webkit.org/show_bug.cgi?id=153198

        Reviewed by Zalan Bujtas.

        Have the DisplayListRecorder's constructor push the recorder onto the GraphicsContext,
        and remove that code from GraphicsLayerCA.

        Tests: displaylists/extent-includes-shadow.html
               displaylists/extent-includes-transforms.html

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
        * platform/graphics/displaylists/DisplayListRecorder.cpp:
        (WebCore::DisplayList::Recorder::Recorder):

2016-01-16  Myles C. Maxfield  <mmaxfield@apple.com>

        Remove TextRun::allowsRoundingHacks()
        https://bugs.webkit.org/show_bug.cgi?id=153185

        Reviewed by Simon Fraser.

        Rounding hacks are disallowed by default, and are only re-enabled on iOS 4 and
        earlier, which are not supported OSes. Because they are disallowed on all
        supported configurations, remove support for them wholesale.

        No new tests.

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::drawTextInternal):
        * platform/graphics/FontCascade.cpp:
        * platform/graphics/FontCascade.h:
        (WebCore::FontCascade::isRoundingHackCharacter): Deleted.
        * platform/graphics/StringTruncator.cpp:
        (WebCore::stringWidth):
        (WebCore::truncateString):
        (WebCore::StringTruncator::centerTruncate):
        (WebCore::StringTruncator::rightTruncate):
        (WebCore::StringTruncator::width):
        (WebCore::StringTruncator::leftTruncate):
        (WebCore::StringTruncator::rightClipToCharacter):
        (WebCore::StringTruncator::rightClipToWord):
        * platform/graphics/StringTruncator.h:
        * platform/graphics/TextRun.cpp:
        (WebCore::TextRun::setAllowsRoundingHacks): Deleted.
        (WebCore::TextRun::allowsRoundingHacks): Deleted.
        * platform/graphics/TextRun.h:
        (WebCore::TextRun::TextRun):
        (WebCore::TextRun::applyRunRounding): Deleted.
        (WebCore::TextRun::applyWordRounding): Deleted.
        (WebCore::TextRun::disableRoundingHacks): Deleted.
        * platform/graphics/WidthIterator.cpp:
        (WebCore::WidthIterator::advanceInternal):
        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::ComplexTextController::adjustGlyphsAndAdvances):
        * platform/mac/DragImageMac.mm:
        (WebCore::widthWithFont): Deleted.
        (WebCore::drawAtPoint): Deleted.
        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::fileTextValue):
        (WebCore::RenderFileUploadControl::paintObject): Deleted.
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::paintItemForeground):
        (WebCore::RenderListBox::updateFromElement): Deleted.
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::getAverageCharWidth): Deleted.
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::fileListNameForWidth):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::fileListNameForWidth):
        * rendering/svg/SVGInlineTextBox.cpp:
        (WebCore::SVGInlineTextBox::constructTextRun): Deleted.
        * rendering/svg/SVGTextMetrics.cpp:
        (WebCore::SVGTextMetrics::constructTextRun): Deleted.
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState): Deleted.
        (WebCore::Internals::allowRoundingHacks): Deleted.
        * testing/Internals.h:
        * testing/Internals.idl:

2016-01-16  Andreas Kling  <akling@apple.com>

        Allocate style sheet media queries in BumpArena.
        <https://webkit.org/b/153188>

        Reviewed by Antti Koivisto.

        Teach the CSS parser to allocate MediaQuery and MediaQueryExp from BumpArena as well.

        * css/CSSGrammar.y.in:
        * css/MediaQuery.h:
        * css/MediaQueryExp.h:

2016-01-16  Michael Catanzaro  <mcatanzaro@igalia.com>

        [GTK] Add a couple comments to ScrollbarThemeGtk
        https://bugs.webkit.org/show_bug.cgi?id=153184

        Reviewed by Carlos Garcia Campos.

        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::paint):

2016-01-16  Andreas Kling  <akling@apple.com>

        Give RuleSet a BumpArena and start using it for RuleDataVectors.
        <https://webkit.org/b/153169>

        Reviewed by Antti Koivisto.

        Since RuleSet only supports appending rules and doesn't need to worry about removing them,
        it's a great candidate for BumpArena optimizations.

        Give each RuleSet its own BumpArena and teach them how to allocate RuleDataVector objects
        out of them.

        There are more things that can be done here, ideally all the sub-allocations inside RuleSet
        that happen via e.g Vector and HashMap would also come out of the BumpArena.

        * css/RuleSet.cpp:
        (WebCore::RuleSet::RuleSet):
        (WebCore::RuleSet::addToRuleSet):
        (WebCore::RuleSet::copyShadowPseudoElementRulesFrom):
        * css/RuleSet.h:
        (WebCore::RuleSet::RuleDataVector::create):
        (WebCore::RuleSet::RuleSet): Deleted.

2016-01-16  Simon Fraser  <simon.fraser@apple.com>

        Fix flakiness of displaylists/layer-dispay-list.html
        
        When toggling "uses display list drawing" on a GraphicsLayerCA, do
        a repaint.

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::setUsesDisplayListDrawing):

2016-01-15  Simon Fraser  <simon.fraser@apple.com>

        Remove GraphicsContext::drawConvexPolygon() and GraphicsContext::clipConvexPolygon()
        https://bugs.webkit.org/show_bug.cgi?id=153174

        Reviewed by Zalan Bujtas.

        GraphicsContext::drawConvexPolygon() and GraphicsContext::clipConvexPolygon() were
        poorly named (non-convex polygons are allowed), and just syntactic sugar over
        clipPath() and drawPath().
        
        Remove them, but add a convenience function to create a Path from a Vector of 
        points. For CG, we can use the more efficient CGPathAddLines().
        
        Add TextStream dumping for Path.

        * platform/graphics/GraphicsContext.h:
        * platform/graphics/Path.cpp:
        (WebCore::Path::polygonPathFromPoints):
        (WebCore::Path::dump):
        (WebCore::operator<<):
        * platform/graphics/Path.h:
        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::setPlatformShouldAntialias):
        (WebCore::addConvexPolygonToContext): Deleted.
        (WebCore::GraphicsContext::drawConvexPolygon): Deleted.
        (WebCore::GraphicsContext::clipConvexPolygon): Deleted.
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::addConvexPolygonToPath): Deleted.
        (WebCore::GraphicsContext::drawConvexPolygon): Deleted.
        (WebCore::GraphicsContext::clipConvexPolygon): Deleted.
        * platform/graphics/cg/PathCG.cpp:
        (WebCore::Path::polygonPathFromPoints):
        (WebCore::Path::moveTo):
        (WebCore::Path::addLineTo):
        (WebCore::Path::addQuadCurveTo):
        (WebCore::Path::addBezierCurveTo):
        (WebCore::Path::addArcTo):
        * platform/graphics/displaylists/DisplayListItems.cpp:
        (WebCore::DisplayList::Item::sizeInBytes): Deleted.
        (WebCore::DisplayList::ClipConvexPolygon::ClipConvexPolygon): Deleted.
        (WebCore::DisplayList::ClipConvexPolygon::apply): Deleted.
        (WebCore::DisplayList::operator<<): Deleted.
        (WebCore::DisplayList::addConvexPolygonToPath): Deleted.
        (WebCore::DisplayList::DrawConvexPolygon::DrawConvexPolygon): Deleted.
        (WebCore::DisplayList::DrawConvexPolygon::localBounds): Deleted.
        (WebCore::DisplayList::DrawConvexPolygon::apply): Deleted.
        * platform/graphics/displaylists/DisplayListItems.h:
        (WebCore::DisplayList::ClipConvexPolygon::create): Deleted.
        (WebCore::DisplayList::ClipConvexPolygon::points): Deleted.
        (WebCore::DisplayList::ClipConvexPolygon::antialias): Deleted.
        (WebCore::DisplayList::DrawConvexPolygon::create): Deleted.
        (WebCore::DisplayList::DrawConvexPolygon::points): Deleted.
        (WebCore::DisplayList::DrawConvexPolygon::antialiased): Deleted.
        * platform/graphics/displaylists/DisplayListRecorder.cpp:
        (WebCore::DisplayList::Recorder::drawConvexPolygon): Deleted.
        (WebCore::DisplayList::Recorder::clipConvexPolygon): Deleted.
        * platform/graphics/displaylists/DisplayListRecorder.h:
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::clipBorderSidePolygon):
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::drawLineForBoxSide):
        * rendering/RenderThemeIOS.mm:
        (WebCore::RenderThemeIOS::paintMenuListButtonDecorations):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintMenuListButtonDecorations):

2016-01-16  Jeremy Huddleston Sequoia  <jeremyhu@apple.com>

        Add Platform.cpp to ANGLESupport

        https://bugs.webkit.org/show_bug.cgi?id=153120

        Reviewed by Darin Adler.

        No new tests, only addresses a build failure.

        * CMakeLists.txt:

2016-01-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] List box selections stopped working again with GTK+ from current git master
        https://bugs.webkit.org/show_bug.cgi?id=153122

        Reviewed by Michael Catanzaro.

        The problem is that the ListBox selection implementation is
        wrong. We are using a similar implementation to GtkEntry, but
        GtkTreeView doesn't have a child CSS node for selections.

        * rendering/RenderThemeGtk.cpp:
        (WebCore::styleColor): Don't use a child style context for ListBox selections.
        (WebCore::createStyleContext): Remove ListBoxSelection.

2016-01-14  Carlos Garcia Campos  <cgarcia@igalia.com>

        [SOUP] Initialize HTTP version of ResourceResponse
        https://bugs.webkit.org/show_bug.cgi?id=153088

        Reviewed by Michael Catanzaro.

        * platform/network/soup/ResourceResponseSoup.cpp:
        (WebCore::ResourceResponse::updateFromSoupMessage):

2016-01-16  Myles C. Maxfield  <mmaxfield@apple.com>

        Tiny cleanup in FontFaceComparator
        https://bugs.webkit.org/show_bug.cgi?id=153044

        Reviewed by Zalan Bujtas.

        This is a follow-up patch to r194923.

        No new tests because there is no behavior change.

        * css/CSSFontSelector.cpp:
        (WebCore::FontFaceComparator::FontFaceComparator):
        (WebCore::FontFaceComparator::operator()):

2016-01-15  Jiewen Tan  <jiewen_tan@apple.com>

        FrameLoaderClient::didReceiveServerRedirectForProvisionalLoadForFrame() is never called when loading a main resource from the memory cache
        https://bugs.webkit.org/show_bug.cgi?id=152520
        <rdar://problem/23305737>

        Reviewed by Andy Estes.

        Test: http/tests/loading/server-redirect-for-provisional-load-caching.html

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::responseReceived):
        Dispatch message to notify client that a cached resource was redirected. So,
        client can make proper actions to treat server side redirection.
        * loader/cache/CachedRawResource.h:
        Add a method to tell whether the cached resource was redirected.

2016-01-15  Chris Dumez  <cdumez@apple.com>

        Drop obsolete HTMLDocument.width / height attributes
        https://bugs.webkit.org/show_bug.cgi?id=153144

        Reviewed by Ryosuke Niwa.

        Drop obsolete HTMLDocument.width / height attributes as these are
        obsolete and already not supported by other major browsers (tested
        Firefox and Chrome).

        No new tests, already covered by existing tests.

        * html/HTMLDocument.idl:

2016-01-15  Chris Dumez  <cdumez@apple.com>

        Drop obsolete DocumentType.entities / notations
        https://bugs.webkit.org/show_bug.cgi?id=153147

        Reviewed by Ryosuke Niwa.

        Drop obsolete DocumentType.entities / notations attributes.

        Firefox and Chrome already dropped those. We already dropped support for
        entities and notations so these always returned null.

        No new tests, already covered by existing tests.

        * dom/DocumentType.h:
        * dom/DocumentType.idl:

2016-01-10  Simon Fraser  <simon.fraser@apple.com>

        Make a way to test display-list drawing
        https://bugs.webkit.org/show_bug.cgi?id=152956

        Reviewed by Ryosuke Niwa.

        Make it possible to toggle display-list drawing for a given compositing
        layer via internals, as well as getting a textual representation of the display
        list, optionally including items with platform-specific behavior.
        
        Add one test that uses this.

        Test: displaylists/layer-dispay-list.html

        * platform/graphics/GraphicsLayer.h:
        (WebCore::GraphicsLayer::displayListAsText):
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::displayListAsText):
        * platform/graphics/ca/GraphicsLayerCA.h:
        * platform/graphics/displaylists/DisplayList.cpp:
        (WebCore::DisplayList::DisplayList::shouldDumpForFlags):
        (WebCore::DisplayList::DisplayList::asText):
        * platform/graphics/displaylists/DisplayList.h:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::setUsesDisplayListDrawing):
        (WebCore::RenderLayerBacking::displayListAsText):
        * rendering/RenderLayerBacking.h:
        * testing/Internals.cpp:
        (WebCore::Internals::setElementUsesDisplayListDrawing):
        (WebCore::Internals::displayListForElement):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-01-15  Olivier Blin  <olivier.blin@softathome.com>

        Fix audio build with video disabled
        https://bugs.webkit.org/show_bug.cgi?id=153134

        Reviewed by Michael Catanzaro.

        Build fails when WebAudio is enabled but VIDEO disabled.

        No new tests since this is a build fix only.

        * platform/audio/PlatformMediaSession.cpp:
        * platform/audio/PlatformMediaSession.h:
        * platform/audio/PlatformMediaSessionManager.cpp:
        * testing/Internals.cpp:
        (WebCore::Internals::setAudioContextRestrictions):

2016-01-15  Olivier Blin  <olivier.blin@softathome.com>

        [GTK] Fix build of RenderThemeGtk without VIDEO by including HTMLInputElement
        https://bugs.webkit.org/show_bug.cgi?id=153133

        Reviewed by Michael Catanzaro.

        Build was fine with VIDEO enabled, since HTMLInputElement.h was
        included by transitivity through MediaControlElements.h and
        MediaControlElementTypes.h.

        This seems to be broken since r194847.

        No new tests since this is just a build fix.

        * rendering/RenderThemeGtk.cpp:

2016-01-15  Ryosuke Niwa  <rniwa@webkit.org>

        createElementNS and createAttributeNS should treat undefined namespaceURI as null string
        https://bugs.webkit.org/show_bug.cgi?id=153119

        Reviewed by Chris Dumez.

        Treat undefined as null in document.createElementNS and document.createAttributeNS as defined in:
        https://dom.spec.whatwg.org/#document

        Test: fast/dom/Document/createAttributeNS-undefined-namespace.html

        * dom/Document.idl:

2016-01-15  Myles C. Maxfield  <mmaxfield@apple.com>

        [Cocoa] Font features are not applied to the system font
        https://bugs.webkit.org/show_bug.cgi?id=153053

        Reviewed by Dean Jackson.

        We simply need to call preparePlatformFont() on it.

        Test: fast/text/system-font-features.html

        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::fontWithFamily):

2016-01-15  Tim Horton  <timothy_horton@apple.com>

        Data detector yellow highlight location is vertically mirrored in WebKit1
        https://bugs.webkit.org/show_bug.cgi?id=152216
        <rdar://problem/23848003>

        Reviewed by Beth Dakin.

        No new tests, because we currently have no decent mechanism for testing
        where TextIndicator/Lookup/DataDetectors actually make it to the screen,
        nor for synthetic force-click in WebKit1.

        * editing/mac/DictionaryLookup.h:
        * editing/mac/DictionaryLookup.mm:
        (WebCore::showPopupOrCreateAnimationController):
        (WebCore::DictionaryLookup::showPopup):
        (WebCore::DictionaryLookup::animationControllerForPopup):
        Add an optional function for converting between root-FrameView and
        handed-in-NSView coordinates, and use it to convert textBoundingRectInRootViewCoordinates
        into the coordinates of the WebView.

2016-01-15  Joseph Pecoraro  <pecoraro@apple.com>

        Media Query (-webkit-video-playable-inline) is failing as an invalid media query expression
        https://bugs.webkit.org/show_bug.cgi?id=153111

        Reviewed by Dean Jackson.

        Test: fast/media/video-playable-inline-media-query.html

        * css/MediaQueryEvaluator.cpp:
        (WebCore::video_playable_inlineMediaFeatureEval):
        (WebCore::isRunningOnIPhoneOrIPod): Deleted.
        Make the media query work regardless of the platform.
        It should just check the web view's settings.

        * css/MediaQueryExp.cpp:
        (WebCore::featureWithoutValue):
        This media query expects no value, include it in the list
        so it is not treated as invalid.

2016-01-15  Zalan Bujtas  <zalan@apple.com>

        ASSERTION FAILED: canHaveChildren() || canHaveGeneratedChildren() in WebCore::RenderElement::insertChildInternal
        https://bugs.webkit.org/show_bug.cgi?id=123331

        Reviewed by Darin Adler.

        Do not set named flow fragment bit on the flow until after the renderer is attached. Setting/resetting it too early
        could affect the attach/detach process itself (This is similar to attaching a multi column flow thread).

        Test: fast/regions/input-box-with-region-assert.html

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::willBeDestroyed):
        (WebCore::RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded):
        (WebCore::RenderBlockFlow::setRenderNamedFlowFragment):

2016-01-15  Simon Fraser  <simon.fraser@apple.com>

        Add kdebug_trace signposts for a few WebCore operations
        https://bugs.webkit.org/show_bug.cgi?id=153136
        rdar://problem/24208487

        Reviewed by Sam Weinig.

        Add trace points for style recalc, layout, view painting and layer painting.

        * dom/Document.cpp:
        (WebCore::Document::recalcStyle):
        * page/FrameView.cpp:
        (WebCore::FrameView::layout):
        (WebCore::FrameView::paintContents):
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::platformCALayerPaintContents):

2016-01-15  Andreas Kling  <akling@apple.com>

        Use BumpArena for style sheet object tree.
        <https://webkit.org/b/152696>

        Reviewed by Antti Koivisto.

        Give each StyleSheetContents its own BumpArena, and plumb it down through CSSParser
        to allocate StyleRule, StyleProperties and CSSSelectorList's selector arrays there.

        This basically means that most objects that make up a given style sheet will end up
        in one (or a few) contiguous region(s) of memory, instead of being scattered all
        over the malloc heap.

        In the common case (no CSSOM manipulation), the lifetimes of these objects are very
        predictable: everything tends to die when the StyleSheetContents dies.
        This dramatically improves space-efficiency in those cases, and allows us to return
        contiguous chunks of memory to the system once a style sheet is no longer needed.

        One-off CSS parses that don't work within a StyleSheetContents context will have
        their StyleRules & co allocated through FastMalloc just like before.

        Bonus: give SelectorQueryCache a dedicated BumpArena as well, since it has very
        predictable lifetime.

        * css/CSSGrammar.y.in:
        * css/CSSKeyframesRule.h:
        (WebCore::StyleRuleKeyframes::create):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::createStyleProperties):
        (WebCore::CSSParser::createMediaRule):
        (WebCore::CSSParser::createSupportsRule):
        (WebCore::CSSParser::createKeyframesRule):
        (WebCore::CSSParser::setArena):
        (WebCore::CSSParser::arena):
        (WebCore::CSSParser::createStyleRule):
        (WebCore::CSSParser::createFontFaceRule):
        (WebCore::CSSParser::createPageRule):
        (WebCore::CSSParser::createRegionRule):
        (WebCore::CSSParser::createViewportRule):
        * css/CSSParser.h:
        * css/CSSParserValues.cpp:
        (WebCore::CSSParserSelector::parsePseudoElementCueFunctionSelector):
        (WebCore::CSSParserSelector::adoptSelectorVector):
        * css/CSSParserValues.h:
        * css/CSSSelectorList.cpp:
        (WebCore::CSSSelectorList::CSSSelectorList):
        (WebCore::CSSSelectorList::adoptSelectorVector):
        (WebCore::CSSSelectorList::deleteSelectors):
        * css/CSSSelectorList.h:
        * css/StyleProperties.cpp:
        (WebCore::ImmutableStyleProperties::create):
        (WebCore::StyleProperties::immutableCopyIfNeeded):
        * css/StyleProperties.h:
        * css/StyleRule.cpp:
        (WebCore::StyleRule::create):
        (WebCore::StyleRule::splitIntoMultipleRulesWithMaximumSelectorComponentCount):
        (WebCore::StyleRuleRegion::StyleRuleRegion):
        * css/StyleRule.h:
        (WebCore::StyleRule::create):
        (WebCore::StyleRule::parserAdoptSelectorVector):
        (WebCore::StyleRuleFontFace::create):
        (WebCore::StyleRulePage::create):
        (WebCore::StyleRulePage::parserAdoptSelectorVector):
        (WebCore::StyleRuleMedia::create):
        (WebCore::StyleRuleSupports::create):
        (WebCore::StyleRuleRegion::create):
        (WebCore::StyleRuleViewport::create):
        * css/StyleSheetContents.cpp:
        (WebCore::StyleSheetContents::StyleSheetContents):
        (WebCore::StyleSheetContents::parseAuthorStyleSheet):
        (WebCore::StyleSheetContents::parseStringAtPosition):
        * css/StyleSheetContents.h:
        * dom/SelectorQuery.cpp:
        (WebCore::SelectorQueryCache::SelectorQueryCache):
        (WebCore::SelectorQueryCache::add):
        * dom/SelectorQuery.h:
        * svg/SVGFontFaceElement.cpp:
        (WebCore::SVGFontFaceElement::SVGFontFaceElement):

2016-01-15  Dave Hyatt  <hyatt@apple.com>

        Avoid downloading the wrong image for <picture> elements.
        https://bugs.webkit.org/show_bug.cgi?id=153027

        Reviewed by Dean Jackson.

        No tests, since they are always flaky.

        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::HTMLImageElement):
        (WebCore::HTMLImageElement::~HTMLImageElement):
        (WebCore::HTMLImageElement::createForJSConstructor):
        (WebCore::HTMLImageElement::bestFitSourceFromPictureElement):
        (WebCore::HTMLImageElement::insertedInto):
        (WebCore::HTMLImageElement::removedFrom):
        (WebCore::HTMLImageElement::pictureElement):
        (WebCore::HTMLImageElement::setPictureElement):
        (WebCore::HTMLImageElement::width):
        * html/HTMLImageElement.h:
        (WebCore::HTMLImageElement::hasShadowControls):
        * html/HTMLPictureElement.h:
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::createHTMLElement):
        * html/parser/HTMLPreloadScanner.cpp:
        (WebCore::TokenPreloadScanner::StartTagScanner::processAttribute):

        Images that are built underneath a <picture> element are now connected
        to that picture element via a setPictureNode call from the parser. This
        ensures that the correct <source> elements are examined before checking the image.

        This connection between images and their picture owners is handled using a static
        HashMap in HTMLImageElement. This connection is made both from the parser and from
        DOM insertions, and the map is queried now instead of looking directly at the
        image's parentNode().

2016-01-15  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Streams API] Expose ReadableStream and relatives to Worker
        https://bugs.webkit.org/show_bug.cgi?id=152066

        Reviewed by Darin Adler.

        Covered by rebased tests.

        * Modules/streams/ByteLengthQueuingStrategy.idl:
        * Modules/streams/CountQueuingStrategy.idl:
        * Modules/streams/ReadableStream.idl:
        * Modules/streams/ReadableStreamController.idl:
        * Modules/streams/ReadableStreamReader.idl:

2016-01-15  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        CORS: Fix the handling of redirected request containing Origin null.
        https://bugs.webkit.org/show_bug.cgi?id=128816

        Reviewed by Brent Fulgham.

        Merging Blink patch from George Ancil (https://chromiumcodereview.appspot.com/20735002).

        This patch removes the check for securityOrigin->isUnique() in passesAccessControlCheck().
        This check prevented a redirected request with "Origin: null" from being
        successful even when the response contains "Access-Control-Allow-Origin: null"

        Tests: http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow-origin-null.html
               http/tests/xmlhttprequest/redirect-cors-origin-null.html

        * loader/CrossOriginAccessControl.cpp:
        (WebCore::passesAccessControlCheck):

2016-01-14  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195064.
        https://bugs.webkit.org/show_bug.cgi?id=153118

        test fails most of the time (Requested by alexchristensen on
        #webkit).

        Reverted changeset:

        "Avoid downloading the wrong image for <picture> elements."
        https://bugs.webkit.org/show_bug.cgi?id=153027
        http://trac.webkit.org/changeset/195064

2016-01-14  Ryosuke Niwa  <rniwa@webkit.org>

        createElement should not lowercase non-ASCII characters
        https://bugs.webkit.org/show_bug.cgi?id=153114

        Reviewed by Alex Christensen.

        According to step 2 in https://dom.spec.whatwg.org/#dom-document-createelement, document.createElement should not
        lowercase non-ASCII letters, and this is also what Firefox does. Match that behavior by lowercasing the tag name
        by convertToASCIILowercase() instead of lower() in createElement.

        Also merged HTMLDocument::createElement into Document::createElement for simplicity and avoid duplicating
        the call to isValidName and setting a DOM exception.

        No new tests since the behavior change is covered by the existing W3C tests.

        * dom/Document.cpp:
        (WebCore::Document::createElement): Create a HTML element with ASCII-lowercased tag name inside a HTML document.
        * dom/Document.h:
        * html/HTMLDocument.cpp:
        (WebCore::addLocalNameToSet):
        (WebCore::HTMLDocument::createElement): Merged into Document::createElement.
        * html/HTMLDocument.h:

2016-01-14  Brady Eidson  <beidson@apple.com>

        Modern IDB: Support opening and deleting SQLite databases on disk.
        https://bugs.webkit.org/show_bug.cgi?id=153084

        Reviewed by Alex Christensen, Sam Weinig and Andy Estes (oh my!).

        No new tests (Infrastructure, no testable change in behavior).

        * Modules/indexeddb/IDBDatabaseIdentifier.cpp:
        (WebCore::IDBDatabaseIdentifier::databaseDirectoryRelativeToRoot):
        * Modules/indexeddb/IDBDatabaseIdentifier.h:

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::create):
        (WebCore::IDBServer::IDBServer::IDBServer):
        (WebCore::IDBServer::IDBServer::createBackingStore):
        * Modules/indexeddb/server/IDBServer.h:

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::SQLiteIDBBackingStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteBackingStore):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::create):
        (WebCore::InProcessIDBServer::InProcessIDBServer):
        * Modules/indexeddb/shared/InProcessIDBServer.h:

2016-01-14  Myles C. Maxfield  <mmaxfield@apple.com>

        Mixing Content Blocking of fonts and display:none rules causes battery drain
        https://bugs.webkit.org/show_bug.cgi?id=153051
        <rdar://problem/23187709>

        Reviewed by Alex Christensen.

        If we have applied a rule before and we are not applying it again, don't
        resolve the style again.

        Test: http/tests/contentextensions/font-display-none-repeated-layout.html

        * contentextensions/ContentExtensionStyleSheet.cpp:
        (WebCore::ContentExtensions::ContentExtensionStyleSheet::addDisplayNoneSelector):
        * contentextensions/ContentExtensionStyleSheet.h:
        * dom/ExtensionStyleSheets.cpp:
        (WebCore::ExtensionStyleSheets::addDisplayNoneSelector):

2016-01-14  Ryosuke Niwa  <rniwa@webkit.org>

        Add document.defineCustomElement
        https://bugs.webkit.org/show_bug.cgi?id=153092

        Reviewed by Chris Dumez.

        Added document.defineCustomElement and added a constructor to HTMLElement which can be called
        as "super" in a subclass of HTMLElement. This is a prototype of new custom elements API and
        willfully violates the current specification at http://w3c.github.io/webcomponents/spec/custom/

        Each author defined class can define multiple elements using distinct tag names. In such cases,
        the super call must specify the tag name. e.g.

        class SomeCustomElement extends HTMLElement { constructor(name) { super(name); } }
        document.defineCustomElement('some-custom-element', SomeCustomElement);
        document.defineCustomElement('other-custom-element', SomeCustomElement);
        new SomeCustomElement('some-custom-element');

        When a class is associated with exactly one tag name, the argument can be omitted. e.g.

        class AnotherCustomElement extends HTMLElement {}
        document.defineCustomElement('another-custom-element', AnotherCustomElement);
        new AnotherCustomElement();

        We allow only subclassing of HTMLElement and only in (X)HTML namespace.

        Tests: fast/custom-elements/Document-defineCustomElement.html
               fast/custom-elements/HTMLElement-constructor.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        * bindings/js/JSCustomElementInterface.cpp: Added. Abstracts an author-defined class associated
        with a custom element. It's a Active DOM object and lives until the associated document dies.
        (WebCore::JSCustomElementInterface::JSCustomElementInterface):
        (WebCore::JSCustomElementInterface::~JSCustomElementInterface):
        * bindings/js/JSCustomElementInterface.h: Added.
        (WebCore::JSCustomElementInterface::create):
        (WebCore::JSCustomElementInterface::scriptExecutionContext):
        (WebCore::JSCustomElementInterface::constructor):

        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::defineCustomElement): Added. Define a custom element by associating a tag
        name with an author defined JS class after validating arguments.

        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore::constructJSHTMLElement): Added. Look up the tag name based on new.target if one is not
        specified. If a tag name is specified, check that new.target is associated with the tag name.

        * dom/CustomElementDefinitions.cpp: Added.
        (WebCore::CustomElementDefinitions::checkName): Added. Restricts tag names similarly to
        http://w3c.github.io/webcomponents/spec/custom/#dfn-custom-element-type
        (WebCore::CustomElementDefinitions::defineElement): Added. Associates a JS class with a tag name.
        (WebCore::CustomElementDefinitions::findInterface): Added. Finds a JS class by a tag name.
        (WebCore::CustomElementDefinitions::findName): Added. Finds a tag name by a JS class.
        * dom/CustomElementDefinitions.h: Added.
        (WebCore::CustomElementDefinitions::CustomElementInfo): Added.

        * dom/Document.cpp:
        (WebCore::Document::ensureCustomElementDefinitions): Added.
        * dom/Document.h:
        (WebCore::Document::customElementDefinitions): Added.

        * dom/Document.idl:
        * html/HTMLElement.idl:

2016-01-14  Simon Fraser  <simon.fraser@apple.com>

        Remove workaround for rdar://problem/23623670
        https://bugs.webkit.org/show_bug.cgi?id=153107
        rdar://problem/23633319

        Reviewed by Tim Horton.

        Remove the code that uses IOSurfaceAcceleratorTransformSurface() when copying from
        back-to-front buffer, now that CGIOSurfaceContextCreate()-code path works correctly.

        * platform/graphics/cocoa/IOSurface.h:
        * platform/graphics/cocoa/IOSurface.mm:
        (IOSurface::ensurePlatformContext):
        (IOSurface::copyToSurface): Deleted.

2016-01-14  Beth Dakin  <bdakin@apple.com>

        WK1 and WK2 should share more candidate request code
        https://bugs.webkit.org/show_bug.cgi?id=153108

        Reviewed by Simon Fraser.

        requestCandidatesForSelection() does not need to be exposed as an 
        EditorClient function. WK1 can just call invoke this code from the existing 
        respondToChangedSelection EditorClient function, which is what WK2 does.
        * editing/Editor.cpp:
        (WebCore::Editor::respondToChangedSelection):
        * loader/EmptyClients.h:
        * page/EditorClient.h:
        (WebCore::EditorClient::supportsGlobalSelection):

2016-01-14  Beth Dakin  <bdakin@apple.com>

        WK2: Request completion candidates when needed
        https://bugs.webkit.org/show_bug.cgi?id=153040
        -and corresponding-
        rdar://problem/24155631

        Reviewed by Enrica Casucci and Tim Horton.

        Helper functions for stringForCandidateRequest() and 
        handleAcceptedCandidate()
        * editing/Editor.cpp:
        (WebCore::candidateRangeForSelection):
        (WebCore::candidateWouldReplaceText):

        Request candidates for the word that is currently being typed so long as the 
        candidate would replace that word. Otherwise, use String().
        (WebCore::Editor::stringForCandidateRequest):

        When a candidate has been accepted, insert the text.
        (WebCore::Editor::handleAcceptedCandidate):
        * editing/Editor.h:

2016-01-14  Daniel Bates  <dabates@apple.com>

        Disallow use of Geolocation service from unique origins
        https://bugs.webkit.org/show_bug.cgi?id=153102
        <rdar://problem/23055645>

        Reviewed by Alexey Proskuryakov.

        Tests: fast/dom/Geolocation/dataURL-getCurrentPosition.html
               fast/dom/Geolocation/dataURL-watchPosition.html
               fast/dom/Geolocation/srcdoc-getCurrentPosition.html
               fast/dom/Geolocation/srcdoc-watchPosition.html
               http/tests/security/sandboxed-iframe-geolocation-getCurrentPosition.html
               http/tests/security/sandboxed-iframe-geolocation-watchPosition.html

        * Modules/geolocation/Geolocation.cpp:
        (WebCore::Geolocation::securityOrigin): Convenience function to get the SecurityOrigin object
        associated with this script execution context.
        (WebCore::Geolocation::startRequest): Notify requester POSITION_UNAVAILABLE when requested
        from a document with a unique origin.
        * Modules/geolocation/Geolocation.h:
        * page/SecurityOrigin.h:
        (WebCore::SecurityOrigin::canRequestGeolocation): Added.

2016-01-14  Daniel Bates  <dabates@apple.com>

        [XSS Auditor] Extract attribute truncation logic and formalize string canonicalization
        https://bugs.webkit.org/show_bug.cgi?id=152874

        Reviewed by Brent Fulgham.

        Derived from Blink patch (by Tom Sepez <tsepez@chromium.org>):
        <https://src.chromium.org/viewvc/blink?revision=176339&view=revision>

        Extract the src-like and script-like attribute truncation logic into independent functions
        towards making it more straightforward to re-purpose this logic. Additionally, formalize the
        concept of string canonicalization as a member function that consolidates the process of
        decoding URL escape sequences, truncating the decoded string (if applicable), and removing
        characters that are considered noise.

        * html/parser/XSSAuditor.cpp:
        (WebCore::truncateForSrcLikeAttribute): Extracted from XSSAuditor::decodedSnippetForAttribute().
        (WebCore::truncateForScriptLikeAttribute): Ditto.
        (WebCore::XSSAuditor::init): Write in terms of XSSAuditor::canonicalize().
        (WebCore::XSSAuditor::filterCharacterToken): Updated to make use of formalized canonicalization methods.
        (WebCore::XSSAuditor::filterScriptToken): Ditto.
        (WebCore::XSSAuditor::filterObjectToken): Ditto.
        (WebCore::XSSAuditor::filterParamToken): Ditto.
        (WebCore::XSSAuditor::filterEmbedToken): Ditto.
        (WebCore::XSSAuditor::filterAppletToken): Ditto.
        (WebCore::XSSAuditor::filterFrameToken): Ditto.
        (WebCore::XSSAuditor::filterInputToken): Ditto.
        (WebCore::XSSAuditor::filterButtonToken): Ditto.
        (WebCore::XSSAuditor::eraseDangerousAttributesIfInjected): Ditto.
        (WebCore::XSSAuditor::eraseAttributeIfInjected): Updated code to use early return style and avoid an unnecessary string
        comparison when we know that a src attribute was injected.
        (WebCore::XSSAuditor::canonicalizedSnippetForTagName): Renamed; formerly known as XSSAuditor::decodedSnippetForName(). Updated
        to make use of XSSAuditor::canonicalize().
        (WebCore::XSSAuditor::snippetFromAttribute): Renamed; formerly known as XSSAuditor::decodedSnippetForAttribute(). Moved
        truncation logic from here to WebCore::truncateFor{Script, Src}LikeAttribute.
        (WebCore::XSSAuditor::canonicalize): Added.
        (WebCore::XSSAuditor::canonicalizedSnippetForJavaScript): Added.
        (WebCore::canonicalize): Deleted.
        (WebCore::XSSAuditor::decodedSnippetForName): Deleted.
        (WebCore::XSSAuditor::decodedSnippetForAttribute): Deleted.
        (WebCore::XSSAuditor::decodedSnippetForJavaScript): Deleted.
        * html/parser/XSSAuditor.h: Define enum class for the various attribute truncation styles.

2016-01-14  Daniel Bates  <dabates@apple.com>

        [XSS Auditor] Partial bypass when web server collapses path components
        https://bugs.webkit.org/show_bug.cgi?id=152872

        Reviewed by Brent Fulgham.

        Merged from Blink (patch by Tom Sepez <tsepez@chromium.org>):
        <https://src.chromium.org/viewvc/blink?revision=167610&view=revision>

        Test: http/tests/security/xssAuditor/embed-tag-in-path-unterminated.html

        * html/parser/XSSAuditor.cpp:
        (WebCore::isNonCanonicalCharacter):
        (WebCore::XSSAuditor::init):
        (WebCore::XSSAuditor::decodedSnippetForName):
        (WebCore::XSSAuditor::decodedSnippetForAttribute):
        (WebCore::XSSAuditor::decodedSnippetForJavaScript):
        (WebCore::fullyDecodeString): Deleted.

2016-01-14  Beth Dakin  <bdakin@apple.com>

        imported/blink/editing/text-iterator/read-past-cloned-first-letter.html 
        crashes
        https://bugs.webkit.org/show_bug.cgi?id=153104
        -and corresponding-
        rdar://problem/24155631

        Reviewed by Simon Fraser.

        Though we merged the Blink test, we never merged Blink patch that fixed this 
        bug. So this is a merge of https://github.com/ChromiumWebApps/blink/commit/5a0d23d4368c661f621364339fde66b41ef019e5
        * editing/TextIterator.cpp:
        (WebCore::SimplifiedBackwardsTextIterator::handleFirstLetter):

2016-01-14  Zalan Bujtas  <zalan@apple.com>

        ASSERTION FAILED: !newRelayoutRoot.container() || !newRelayoutRoot.container()->needsLayout() in WebCore::FrameView::scheduleRelayoutOfSubtree
        https://bugs.webkit.org/show_bug.cgi?id=151605#c1

        Reviewed by David Hyatt.

        Do not let RenderMultiColumnSet/RenderFlowThread mark ancestors dirty while updating scrollbars
        for overflow content. While updating scrollbars, we only layout descendants so marking parents dirty
        is unnecessary and could lead to an invalid dirty state.

        Test: fast/multicol/body-stuck-with-dirty-bit-with-columns.html

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::layoutSpecialExcludedChild):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::invalidateRegions):
        * rendering/RenderFlowThread.h:
        * rendering/RenderMultiColumnSet.cpp:
        (WebCore::RenderMultiColumnSet::prepareForLayout):

2016-01-14  Dave Hyatt  <hyatt@apple.com>

        Avoid downloading the wrong image for <picture> elements.
        https://bugs.webkit.org/show_bug.cgi?id=153027

        Reviewed by Dean Jackson.

        Added test in fast/picture.

        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::HTMLImageElement):
        (WebCore::HTMLImageElement::~HTMLImageElement):
        (WebCore::HTMLImageElement::createForJSConstructor):
        (WebCore::HTMLImageElement::bestFitSourceFromPictureElement):
        (WebCore::HTMLImageElement::insertedInto):
        (WebCore::HTMLImageElement::removedFrom):
        (WebCore::HTMLImageElement::pictureElement):
        (WebCore::HTMLImageElement::setPictureElement):
        (WebCore::HTMLImageElement::width):
        * html/HTMLImageElement.h:
        (WebCore::HTMLImageElement::hasShadowControls):
        * html/HTMLPictureElement.h:
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::createHTMLElement):
        * html/parser/HTMLPreloadScanner.cpp:
        (WebCore::TokenPreloadScanner::StartTagScanner::processAttribute):

        Images that are built underneath a <picture> element are now connected
        to that picture element via a setPictureNode call from the parser. This
        ensures that the correct <source> elements are examined before checking the image.

        This connection between images and their picture owners is handled using a static
        HashMap in HTMLImageElement. This connection is made both from the parser and from
        DOM insertions, and the map is queried now instead of looking directly at the
        image's parentNode().

2016-01-14  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195002.
        https://bugs.webkit.org/show_bug.cgi?id=153098

        Crashes many/most editing tests (Requested by ap on #webkit).

        Reverted changeset:

        "WK2: Request completion candidates when needed"
        https://bugs.webkit.org/show_bug.cgi?id=153040
        http://trac.webkit.org/changeset/195002

2016-01-14  Martin Robinson  <mrobinson@igalia.com>

        [GTK] [EFL] Hyphenation can never work in practice due to requirements on lang tags
        https://bugs.webkit.org/show_bug.cgi?id=147310

        Reviewed by Michael Catanzaro.

        Test: platform/gtk/fast/text/hyphenate-flexible-locales.html

        * platform/text/hyphen/HyphenationLibHyphen.cpp: Make locale matching for dictionary
        selection a lot looser by matching case insensitively, matching multiple dictionaries
        when only the language is specified, and ignoring the difference between '_' and '-' in
        the locale name.
        (WebCore::scanDirectoryForDicionaries): Now produce HashMap of Vectors instead of a single
        path for each locale. Also add alternate entries to handle different ways of specifying
        the locale.
        (WebCore::scanTestDictionariesDirectoryIfNecessary): Update to handle the difference
        in HashMap type.
        (WebCore::availableLocales): Ditto.
        (WebCore::canHyphenate): Also look for the lowercased version of the locale.
        (WebCore::AtomicStringKeyedMRUCache<RefPtr<HyphenationDictionary>>::createValueForKey):
        Key on the dictionary path now so that we can load more than one dictionary per locale.
        (WebCore::lastHyphenLocation): Iterate through each matched dictionary in turn.

2016-01-14  Per Arne Vollan  <peavo@outlook.com>

        [Win] Remove workarounds for fixed bugs in fmod and pow.
        https://bugs.webkit.org/show_bug.cgi?id=153071

        Reviewed by Brent Fulgham.

        Compile fix, help MSVC pick correct pow overload.

        * rendering/shapes/BoxShape.cpp:
        (WebCore::adjustRadiusForMarginBoxShape):

2016-01-14  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Fix problems with cross-origin redirects
        https://bugs.webkit.org/show_bug.cgi?id=116075

        Reviewed by Daniel Bates.

        Merging https://chromium.googlesource.com/chromium/blink/+/7ea774e478f84f355748108d2aaabca15355d512 by Ken Russell
        Same origin redirect responses leading to cross-origin requests were checked as cross-origin redirect responses.
        Introduced ClientRequestedCredentials to manage whether credentials are needed or not in the cross-origin request.

        In addition to Blink patch, it was needed to update some loaders with the newly introduced ClientRequestedCredentials parameter.
        Added the clearing of "Accept-Encoding" header from cross-origin requests as Mac HTTP network layer is adding it for same-origin requests.

        Test: http/tests/xmlhttprequest/access-control-and-redirects-async-same-origin.html

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource): Added new security parameter (from Blink patch).
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::redirectReceived): Updated checks so that same origin redirections are not treated as cross origin redirections (from Blink patch).
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::start):
        * loader/NetscapePlugInStreamLoader.cpp:
        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader): Added new security parameter.
        * loader/ResourceLoaderOptions.h:
        (WebCore::ResourceLoaderOptions::ResourceLoaderOptions): Added new security parameter (from Blink patch).
        (WebCore::ResourceLoaderOptions::credentialRequest):
        (WebCore::ResourceLoaderOptions::setCredentialRequest):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet): Ditto.
        (WebCore::CachedResourceLoader::defaultCachedResourceOptions): Ditto.
        * loader/icon/IconLoader.cpp:
        (WebCore::IconLoader::startLoading): Added new security parameter.
        * page/EventSource.cpp:
        (WebCore::EventSource::connect): Added new security parameter (from Blink patch).
        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
        (WebCore::WebCoreAVCFResourceLoader::startLoading): Added new security parameter.
        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::startLoading): Ditto.
        * platform/network/ResourceHandleTypes.h: Added new security parameter constants (from Blink patch).
        * platform/network/ResourceRequestBase.cpp:
        (WebCore::ResourceRequestBase::clearHTTPAcceptEncoding): Function to remove "Accept-Encoding" header.
        * platform/network/ResourceRequestBase.h: Ditto.
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::createRequest): Added new security parameter.

2016-01-13  Myles C. Maxfield  <mmaxfield@apple.com>

        Addressing more post-review comments after r194566

        Unreviewed.

        No new tests because there is no behavior change.

        * platform/text/mac/TextBreakIteratorInternalICUMac.mm:
        (WebCore::topLanguagePreference):

2016-01-13  Alex Christensen  <achristensen@webkit.org>

        Implement custom protocols when using NetworkSession
        https://bugs.webkit.org/show_bug.cgi?id=153078

        Reviewed by Andy Estes.

        No new tests, but this makes the WebKit2CustomProtocolsTest api tests pass when using NetworkSession.

        * WebCore.xcodeproj/project.pbxproj:
        Make NSURLConnectionSPI.h private so we can include it from within WebKit2.

2016-01-13  Brent Fulgham  <bfulgham@apple.com>

        Cross-protocol, cross-site scripting (XPSS) using HTML forms
        https://bugs.webkit.org/show_bug.cgi?id=153017
        <rdar://problem/5873254>

        Reviewed by David Kilzer.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::responseReceived): If response HTTP version is 0.9,
        sandbox against script execution and plugins.
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::didReceiveResponse): Ditto.
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::didReceiveResponse): Ditto.
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::adopt): Update for HTTP version.
        (WebCore::ResourceResponseBase::copyData): Ditto.
        (WebCore::ResourceResponseBase::httpVersion): Added.
        (WebCore::ResourceResponseBase::setHTTPVersion): Ditto.
        * platform/network/ResourceResponseBase.h:
        (WebCore::ResourceResponseBase::encode): Update for HTTP version.
        (WebCore::ResourceResponseBase::decode): Ditto.
        * platform/network/cf/ResourceResponseCFNet.cpp:
        (WebCore::ResourceResponse::platformLazyInit): Capture HTTP version.
        * platform/network/cocoa/ResourceResponseCocoa.mm:
        (WebCore::ResourceResponse::platformLazyInit): Ditto.

2016-01-13  Beth Dakin  <bdakin@apple.com>

        WK2: Request completion candidates when needed
        https://bugs.webkit.org/show_bug.cgi?id=153040
        -and corresponding-
        rdar://problem/24155631

        Reviewed by Enrica Casucci.

        Helper functions for stringForCandidateRequest() and 
        handleAcceptedCandidate()
        * editing/Editor.cpp:
        (WebCore::candidateRangeForSelection):
        (WebCore::candidateWouldReplaceText):

        Request candidates for the word that is currently being typed so long as the 
        candidate would replace that word. Otherwise, use String().
        (WebCore::Editor::stringForCandidateRequest):

        When a candidate has been accepted, insert the text.
        (WebCore::Editor::handleAcceptedCandidate):
        * editing/Editor.h:

2016-01-13  Myles C. Maxfield  <mmaxfield@apple.com>

        Addressing post-review comments after r194566

        Unreviewed.

        No new tests because there is no behavior difference.

        * platform/text/mac/TextBreakIteratorInternalICUMac.mm:
        (WebCore::textBreakLocalePreference):
        (WebCore::topLanguagePreference):
        (WebCore::getSearchLocale):
        (WebCore::getTextBreakLocale):
        (WebCore::canonicalLanguageIdentifier): Deleted.

2016-01-12  Ryosuke Niwa  <rniwa@webkit.org>

        formaction must return document's address when formaction is missing
        https://bugs.webkit.org/show_bug.cgi?id=148874

        Reviewed by Chris Dumez.

        Fixed the bug by falling back to document.url() when the attribute is not set or is empty in formAction getter.

        Test: fast/forms/formaction-attribute-with-empty-value.html

        * html/HTMLButtonElement.idl:
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::formAction): Added.
        (WebCore::HTMLFormControlElement::setFormAction): Added.
        * html/HTMLFormControlElement.h:
        * html/HTMLInputElement.idl:

2016-01-13  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r194900.

        Roll back in as this did not actually regress PLT

        Reverted changeset:

        "Unreviewed, rolling out r194826."
        https://bugs.webkit.org/show_bug.cgi?id=153020
        http://trac.webkit.org/changeset/194900

2016-01-13  Konstantin Tokarev  <annulen@yandex.ru>

        Removed empty #if block from Font.h
        https://bugs.webkit.org/show_bug.cgi?id=153067

        Reviewed by Alex Christensen.

        No new tests needed.

        * platform/graphics/Font.h:
        (WebCore::Font::scriptCache): Deleted.

2016-01-13  Michael Catanzaro  <mcatanzaro@igalia.com>

        [GTK] Consistently use virtual and override specifiers in ScrollbarThemeGtk
        https://bugs.webkit.org/show_bug.cgi?id=153076

        Reviewed by Alex Christensen.

        No behavior change.

        * platform/gtk/ScrollbarThemeGtk.h:

2016-01-13  Daniel Bates  <dabates@apple.com>

        Cleanup: XSS Auditor should avoid re-evaluating the parsed script tag
        https://bugs.webkit.org/show_bug.cgi?id=152870

        Reviewed by Brent Fulgham.

        Merged from Blink (patch by Tom Sepez <tsepez@chromium.org>):
        <https://src.chromium.org/viewvc/blink?revision=154354&view=revision>

        Although the XSS Auditor caches the decoded start tag of a script as an optimization to
        avoid decoding it again when filtering the character data of the script, it is sufficient
        to cache whether the HTTP response contains the decoded start tag of a script. This
        avoids both decoding the start tag of a script and determining whether the HTTP response
        contains it again when filtering the character data of the script. Moreover, this removes
        the need to cache a string object.

        * html/parser/XSSAuditor.cpp:
        (WebCore::XSSAuditor::filterCharacterToken):
        (WebCore::XSSAuditor::filterScriptToken):
        * html/parser/XSSAuditor.h:

2016-01-13  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r194963.
        https://bugs.webkit.org/show_bug.cgi?id=153079

        This change causes ASan tests to crash and exit early
        (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "Fragmentation-free allocator for timeless and/or coupled
        allocations."
        https://bugs.webkit.org/show_bug.cgi?id=152696
        http://trac.webkit.org/changeset/194963

2016-01-13  Daniel Bates  <dabates@apple.com>

        [XSS Auditor] Do not include trailing comment characters in JavaScript snippets
        https://bugs.webkit.org/show_bug.cgi?id=152873

        Reviewed by Brent Fulgham.

        Merged from Blink (patch by Tom Sepez <tsepez@chromium.org>):
        <https://src.chromium.org/viewvc/blink?view=rev&revision=169967>

        Test: http/tests/security/xssAuditor/script-tag-with-injected-comment.html

        * html/parser/XSSAuditor.cpp:
        (WebCore::XSSAuditor::decodedSnippetForJavaScript):

2016-01-13  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Add support for RTCRtpSender.replaceTrack()
        https://bugs.webkit.org/show_bug.cgi?id=153063

        Reviewed by Eric Carlson.

        Add the API and infrastructure to support RTCRtpSender.replaceTrack(). The platform is
        reached through the RTCPeerConnection object that created the RTCRtpSender via a client
        interface.

        Test: fast/mediastream/RTCRtpSender-replaceTrack.html

        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::replaceTrack):
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/mediastream/PeerConnectionBackend.h:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::addTrack):
        (WebCore::RTCPeerConnection::removeTrack):
        (WebCore::RTCPeerConnection::replaceTrack):
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/mediastream/RTCRtpSender.cpp:
        (WebCore::RTCRtpSender::RTCRtpSender):
        (WebCore::RTCRtpSender::replaceTrack):
        * Modules/mediastream/RTCRtpSender.h:
        (WebCore::RTCRtpSenderClient::~RTCRtpSenderClient):
        (WebCore::RTCRtpSender::create):
        (WebCore::RTCRtpSender::trackId):
        (WebCore::RTCRtpSender::stop):
        * Modules/mediastream/RTCRtpSender.idl:

2016-01-13  Brady Eidson  <beidson@apple.com>

        Modern IDB: A few cursor tests are flaky because JS wrappers are GC'ed.
        https://bugs.webkit.org/show_bug.cgi?id=153038

        Reviewed by Alex Christensen.

        No new tests (Couldn't write a test that was any more reliable than "flaky", so fixing the existing flaky tests will do).

        And IDBCursor has an associated IDBRequest that is re-used each time the IDBCursor iterates.
        
        The normal ActiveDOMObject approach to prevent the IDBRequest's wrapper from being garbage collected was not good enough
        because, while the IDBRequest may not currently be waiting on any activity, as long as its associated IDBCursor is still
        reachable then the request might be reused in the future.
        
        Fortunately there's an IDL allowance for "one object keeping another alive during GC" and that's JSCustomMarkFunction
        combined with GenerateIsReachable.
        
        Applying those to IDBCursor and IDBRequest fix this handily.
        
        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        * Modules/indexeddb/IDBCursor.h:
        (WebCore::IDBCursor::isModernCursor):
        * Modules/indexeddb/IDBCursor.idl:
        
        * Modules/indexeddb/IDBRequest.idl:
        
        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::advance):
        (WebCore::IDBClient::IDBCursor::continueFunction):
        (WebCore::IDBClient::IDBCursor::uncheckedIterateCursor):
        (WebCore::IDBClient::IDBCursor::uncheckedIteratorCursor): Deleted. Fixed the typo of this name.
        * Modules/indexeddb/client/IDBCursorImpl.h:
        
        * bindings/js/JSIDBCursorCustom.cpp: Added.
        (WebCore::JSIDBCursor::visitAdditionalChildren):

2016-01-13  Zalan Bujtas  <zalan@apple.com>

        Get text drawing working with display lists.
        https://bugs.webkit.org/show_bug.cgi?id=152957

        Reviewed by Simon Fraser.

        This patch enables text drawing for display lists.

        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::drawGlyphBuffer):
        * platform/graphics/FontCascade.h:
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::drawGlyphs):
        (WebCore::GraphicsContext::drawText): Deleted.
        * platform/graphics/cocoa/FontCascadeCocoa.mm:
        (WebCore::FontCascade::drawGlyphs):
        * platform/graphics/displaylists/DisplayListItems.cpp:
        (WebCore::DisplayList::DrawGlyphs::apply):

2016-01-13  Zalan Bujtas  <zalan@apple.com>

        Simple line layout: Add support for word-break property.
        https://bugs.webkit.org/show_bug.cgi?id=153054

        Reviewed by Antti Koivisto.

        This patch enables word-break property for simple line layout.
        (https://drafts.csswg.org/css-text-3/#propdef-word-break)

        word-break: normal and keep-all -> existing, non-(force)breaking behaviour.
                    break-all -> breaks words when needed.

        Covered by existing tests like fast/text/word-break.html

        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::createLineRuns):
        (WebCore::SimpleLineLayout::canUseForStyle): Deleted.
        (WebCore::SimpleLineLayout::printReason): Deleted.
        * rendering/SimpleLineLayoutTextFragmentIterator.cpp:
        (WebCore::SimpleLineLayout::TextFragmentIterator::Style::Style):
        (WebCore::SimpleLineLayout::TextFragmentIterator::findNextTextFragment):
        * rendering/SimpleLineLayoutTextFragmentIterator.h:
        (WebCore::SimpleLineLayout::TextFragmentIterator::TextFragment::TextFragment):
        (WebCore::SimpleLineLayout::TextFragmentIterator::TextFragment::operator==):
        (WebCore::SimpleLineLayout::TextFragmentIterator::TextFragment::isBreakable): Deleted.
        (WebCore::SimpleLineLayout::TextFragmentIterator::TextFragment::split): Deleted.

2016-01-13  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Reference cycle between SVGPathElement and SVGPathSegWithContext leaks Document
        https://bugs.webkit.org/show_bug.cgi?id=151810

        Reviewed by Darin Adler.

        Break the reference cycle between SVGPathElement and SVGPathSegWithContext
        by changing the back-pointer to be a WeakPtr pointer instead of having it
        RefPtr. Make sure the SVGPathSegWithContext derived classes handle correctly
        the case when the SVGPathElement back-pointer is deleted.

        Also change the SVGPathElement argument to the SVGPathSeg creation functions
        and constructors to be a const reference instead of having it as a pointer
        since SVGPathElement is the class factory for all these classes.

        * svg/SVGPathElement.cpp:
        (WebCore::SVGPathElement::SVGPathElement):
        (WebCore::SVGPathElement::createSVGPathSegClosePath):
        (WebCore::SVGPathElement::createSVGPathSegMovetoAbs):
        (WebCore::SVGPathElement::createSVGPathSegMovetoRel):
        (WebCore::SVGPathElement::createSVGPathSegLinetoAbs):
        (WebCore::SVGPathElement::createSVGPathSegLinetoRel):
        (WebCore::SVGPathElement::createSVGPathSegCurvetoCubicAbs):
        (WebCore::SVGPathElement::createSVGPathSegCurvetoCubicRel):
        (WebCore::SVGPathElement::createSVGPathSegCurvetoQuadraticAbs):
        (WebCore::SVGPathElement::createSVGPathSegCurvetoQuadraticRel):
        (WebCore::SVGPathElement::createSVGPathSegArcAbs):
        (WebCore::SVGPathElement::createSVGPathSegArcRel):
        (WebCore::SVGPathElement::createSVGPathSegLinetoHorizontalAbs):
        (WebCore::SVGPathElement::createSVGPathSegLinetoHorizontalRel):
        (WebCore::SVGPathElement::createSVGPathSegLinetoVerticalAbs):
        (WebCore::SVGPathElement::createSVGPathSegLinetoVerticalRel):
        (WebCore::SVGPathElement::createSVGPathSegCurvetoCubicSmoothAbs):
        (WebCore::SVGPathElement::createSVGPathSegCurvetoCubicSmoothRel):
        (WebCore::SVGPathElement::createSVGPathSegCurvetoQuadraticSmoothAbs):
        (WebCore::SVGPathElement::createSVGPathSegCurvetoQuadraticSmoothRel):
        (WebCore::SVGPathElement::isSupportedAttribute):
        * svg/SVGPathElement.h:
        * svg/SVGPathSegArc.h:
        (WebCore::SVGPathSegArc::SVGPathSegArc):
        * svg/SVGPathSegArcAbs.h:
        (WebCore::SVGPathSegArcAbs::create):
        (WebCore::SVGPathSegArcAbs::SVGPathSegArcAbs):
        * svg/SVGPathSegArcRel.h:
        (WebCore::SVGPathSegArcRel::create):
        (WebCore::SVGPathSegArcRel::SVGPathSegArcRel):
        * svg/SVGPathSegClosePath.h:
        (WebCore::SVGPathSegClosePath::create):
        (WebCore::SVGPathSegClosePath::SVGPathSegClosePath):
        * svg/SVGPathSegCurvetoCubic.h:
        (WebCore::SVGPathSegCurvetoCubic::SVGPathSegCurvetoCubic):
        * svg/SVGPathSegCurvetoCubicAbs.h:
        (WebCore::SVGPathSegCurvetoCubicAbs::create):
        (WebCore::SVGPathSegCurvetoCubicAbs::SVGPathSegCurvetoCubicAbs):
        * svg/SVGPathSegCurvetoCubicRel.h:
        (WebCore::SVGPathSegCurvetoCubicRel::create):
        (WebCore::SVGPathSegCurvetoCubicRel::SVGPathSegCurvetoCubicRel):
        * svg/SVGPathSegCurvetoCubicSmooth.h:
        (WebCore::SVGPathSegCurvetoCubicSmooth::SVGPathSegCurvetoCubicSmooth):
        * svg/SVGPathSegCurvetoCubicSmoothAbs.h:
        (WebCore::SVGPathSegCurvetoCubicSmoothAbs::create):
        (WebCore::SVGPathSegCurvetoCubicSmoothAbs::SVGPathSegCurvetoCubicSmoothAbs):
        * svg/SVGPathSegCurvetoCubicSmoothRel.h:
        (WebCore::SVGPathSegCurvetoCubicSmoothRel::create):
        (WebCore::SVGPathSegCurvetoCubicSmoothRel::SVGPathSegCurvetoCubicSmoothRel):
        * svg/SVGPathSegCurvetoQuadratic.h:
        (WebCore::SVGPathSegCurvetoQuadratic::SVGPathSegCurvetoQuadratic):
        * svg/SVGPathSegCurvetoQuadraticAbs.h:
        (WebCore::SVGPathSegCurvetoQuadraticAbs::create):
        (WebCore::SVGPathSegCurvetoQuadraticAbs::SVGPathSegCurvetoQuadraticAbs):
        * svg/SVGPathSegCurvetoQuadraticRel.h:
        (WebCore::SVGPathSegCurvetoQuadraticRel::create):
        (WebCore::SVGPathSegCurvetoQuadraticRel::SVGPathSegCurvetoQuadraticRel):
        * svg/SVGPathSegCurvetoQuadraticSmoothAbs.h:
        (WebCore::SVGPathSegCurvetoQuadraticSmoothAbs::create):
        (WebCore::SVGPathSegCurvetoQuadraticSmoothAbs::SVGPathSegCurvetoQuadraticSmoothAbs):
        * svg/SVGPathSegCurvetoQuadraticSmoothRel.h:
        (WebCore::SVGPathSegCurvetoQuadraticSmoothRel::create):
        (WebCore::SVGPathSegCurvetoQuadraticSmoothRel::SVGPathSegCurvetoQuadraticSmoothRel):
        * svg/SVGPathSegLinetoAbs.h:
        (WebCore::SVGPathSegLinetoAbs::create):
        (WebCore::SVGPathSegLinetoAbs::SVGPathSegLinetoAbs):
        * svg/SVGPathSegLinetoHorizontal.h:
        (WebCore::SVGPathSegLinetoHorizontal::SVGPathSegLinetoHorizontal):
        * svg/SVGPathSegLinetoHorizontalAbs.h:
        (WebCore::SVGPathSegLinetoHorizontalAbs::create):
        (WebCore::SVGPathSegLinetoHorizontalAbs::SVGPathSegLinetoHorizontalAbs):
        * svg/SVGPathSegLinetoHorizontalRel.h:
        (WebCore::SVGPathSegLinetoHorizontalRel::create):
        (WebCore::SVGPathSegLinetoHorizontalRel::SVGPathSegLinetoHorizontalRel):
        * svg/SVGPathSegLinetoRel.h:
        (WebCore::SVGPathSegLinetoRel::create):
        (WebCore::SVGPathSegLinetoRel::SVGPathSegLinetoRel):
        * svg/SVGPathSegLinetoVertical.h:
        (WebCore::SVGPathSegLinetoVertical::SVGPathSegLinetoVertical):
        * svg/SVGPathSegLinetoVerticalAbs.h:
        (WebCore::SVGPathSegLinetoVerticalAbs::create):
        (WebCore::SVGPathSegLinetoVerticalAbs::SVGPathSegLinetoVerticalAbs):
        * svg/SVGPathSegLinetoVerticalRel.h:
        (WebCore::SVGPathSegLinetoVerticalRel::create):
        (WebCore::SVGPathSegLinetoVerticalRel::SVGPathSegLinetoVerticalRel):
        * svg/SVGPathSegMovetoAbs.h:
        (WebCore::SVGPathSegMovetoAbs::create):
        (WebCore::SVGPathSegMovetoAbs::SVGPathSegMovetoAbs):
        * svg/SVGPathSegMovetoRel.h:
        (WebCore::SVGPathSegMovetoRel::create):
        (WebCore::SVGPathSegMovetoRel::SVGPathSegMovetoRel):
        * svg/SVGPathSegWithContext.h:
        (WebCore::SVGPathSegWithContext::SVGPathSegWithContext):
        (WebCore::SVGPathSegWithContext::animatedProperty):
        (WebCore::SVGPathSegWithContext::contextElement):
        (WebCore::SVGPathSegWithContext::setContextAndRole):
        (WebCore::SVGPathSegWithContext::commitChange):
        (WebCore::SVGPathSegSingleCoordinate::setY):
        (WebCore::SVGPathSegSingleCoordinate::SVGPathSegSingleCoordinate):
        * svg/properties/SVGPathSegListPropertyTearOff.cpp:
        (WebCore::SVGPathSegListPropertyTearOff::clearContextAndRoles):
        (WebCore::SVGPathSegListPropertyTearOff::replaceItem):
        (WebCore::SVGPathSegListPropertyTearOff::removeItem):

2016-01-13  Andreas Kling  <akling@apple.com>

        Use BumpArena for style sheet object tree.
        <https://webkit.org/b/152696>

        Reviewed by Antti Koivisto.

        Give each StyleSheetContents its own BumpArena, and plumb it down through CSSParser
        to allocate StyleRule, StyleProperties and CSSSelectorList's selector arrays there.

        This basically means that most objects that make up a given style sheet will end up
        in one (or a few) contiguous region(s) of memory, instead of being scattered all
        over the malloc heap.

        In the common case (no CSSOM manipulation), the lifetimes of these objects are very
        predictable: everything tends to die when the StyleSheetContents dies.
        This dramatically improves space-efficiency in those cases, and allows us to return
        contiguous chunks of memory to the system once a style sheet is no longer needed.

        One-off CSS parses that don't work within a StyleSheetContents context will have
        their StyleRules & co allocated out of the global BumpArena.

        Bonus: give SelectorQueryCache a dedicated BumpArena as well, since it has very
        predictable lifetime.

        * css/CSSGrammar.y.in:
        * css/CSSKeyframesRule.h:
        (WebCore::StyleRuleKeyframes::create):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::createStyleProperties):
        (WebCore::CSSParser::createMediaRule):
        (WebCore::CSSParser::createSupportsRule):
        (WebCore::CSSParser::createKeyframesRule):
        (WebCore::CSSParser::setArena):
        (WebCore::CSSParser::arena):
        (WebCore::CSSParser::createStyleRule):
        (WebCore::CSSParser::createFontFaceRule):
        (WebCore::CSSParser::createPageRule):
        (WebCore::CSSParser::createRegionRule):
        (WebCore::CSSParser::createViewportRule):
        * css/CSSParser.h:
        * css/CSSParserValues.cpp:
        (WebCore::CSSParserSelector::parsePseudoElementCueFunctionSelector):
        (WebCore::CSSParserSelector::adoptSelectorVector):
        * css/CSSParserValues.h:
        * css/CSSSelectorList.cpp:
        (WebCore::CSSSelectorList::CSSSelectorList):
        (WebCore::CSSSelectorList::adoptSelectorVector):
        (WebCore::CSSSelectorList::deleteSelectors):
        * css/CSSSelectorList.h:
        * css/StyleProperties.cpp:
        (WebCore::ImmutableStyleProperties::create):
        (WebCore::StyleProperties::immutableCopyIfNeeded):
        * css/StyleProperties.h:
        * css/StyleRule.cpp:
        (WebCore::StyleRule::create):
        (WebCore::StyleRule::splitIntoMultipleRulesWithMaximumSelectorComponentCount):
        (WebCore::StyleRuleRegion::StyleRuleRegion):
        * css/StyleRule.h:
        (WebCore::StyleRule::create):
        (WebCore::StyleRule::parserAdoptSelectorVector):
        (WebCore::StyleRuleFontFace::create):
        (WebCore::StyleRulePage::create):
        (WebCore::StyleRulePage::parserAdoptSelectorVector):
        (WebCore::StyleRuleMedia::create):
        (WebCore::StyleRuleSupports::create):
        (WebCore::StyleRuleRegion::create):
        (WebCore::StyleRuleViewport::create):
        * css/StyleSheetContents.cpp:
        (WebCore::StyleSheetContents::StyleSheetContents):
        (WebCore::StyleSheetContents::parseAuthorStyleSheet):
        (WebCore::StyleSheetContents::parseStringAtPosition):
        * css/StyleSheetContents.h:
        * dom/SelectorQuery.cpp:
        (WebCore::SelectorQueryCache::SelectorQueryCache):
        (WebCore::SelectorQueryCache::add):
        * dom/SelectorQuery.h:
        * svg/SVGFontFaceElement.cpp:
        (WebCore::SVGFontFaceElement::SVGFontFaceElement):

2016-01-13  YongGeol Jung  <yg48.jung@samsung.com>

        [TexMap] BitmapTextureGL is not released while scene is updated continuously.
        https://bugs.webkit.org/show_bug.cgi?id=152524

        Reviewed by Žan Doberšek.

        This patch fixes two issues.
        First, m_releaseUnusedTexturesTimer is not fired if scene is updated within 0.5s continuously.
        In this case, BitmapTexturePool will not remove texture even if texture is not used for long time.
        Second, m_releaseUnusedTexturesTimer is triggered by acquireTexture function only.
        So, if next scene does not need to use BitmapTexture, remained textures in pool will not removed.

        No new tests needed.

        * platform/graphics/texmap/BitmapTexturePool.cpp:
        (WebCore::BitmapTexturePool::scheduleReleaseUnusedTextures):
        (WebCore::BitmapTexturePool::releaseUnusedTexturesTimerFired):

2016-01-13  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Streams API] Refactor builtin internals to prepare support for streams API in worker
        https://bugs.webkit.org/show_bug.cgi?id=152535

        Reviewed by Darin Adler.

        Moving the code that links internal functions to the GlobalObject in WebCoreJSBuiltinInternals.cpp.
        This file should be generated by the builtin generator once refactoring is done.
        This code is located in JSBuiltinInternalFunctions::initialize.

        Adding private controller and reader constructors to the JS DOM constructor map so that they do not get garbage collected.

        No change in behavior, except that private builtins are usable in workers (but not actually used).

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
        (WebCore::JSDOMGlobalObject::addBuiltinGlobals):
        (WebCore::JSDOMGlobalObject::finishCreation):
        (WebCore::JSDOMGlobalObject::visitChildren):
        * bindings/js/JSDOMGlobalObject.h:
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::finishCreation):
        (WebCore::JSDOMWindowBase::visitChildren):
        * bindings/js/JSDOMWindowBase.h:
        * bindings/js/WebCoreJSBuiltinInternals.cpp: Added.
        (WebCore::JSBuiltinInternalFunctions::JSBuiltinInternalFunctions):
        (WebCore::JSBuiltinInternalFunctions::visit):
        (WebCore::JSBuiltinInternalFunctions::initialize):
        * bindings/js/WebCoreJSBuiltinInternals.h:

2016-01-13  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        [EFL] Fix wrong return value of paintThemePart in RenderThemeEfl
        https://bugs.webkit.org/show_bug.cgi?id=153058

        Reviewed by Carlos Garcia Campos.

        To return false in paint functions in RenderThemeEfl means that it is supported though,
        paintThemePart has returned false even when failing to get image cache of theme.

        * rendering/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::paintThemePart):

2016-01-12  Andy Estes  <aestes@apple.com>

        [Content Filtering] forEachContentFilterUntilBlocked should accept a lambda by rvalue reference
        https://bugs.webkit.org/show_bug.cgi?id=153057

        Reviewed by Dan Bernstein.

        No new tests. No change in behavior.

        Instead of having ContentFilter::forEachContentFilterUntilBlocked() take a std::function, just have it take an
        rvalue reference to the lambda its passed.

        * loader/ContentFilter.cpp:
        (WebCore::ContentFilter::forEachContentFilterUntilBlocked):
        * loader/ContentFilter.h:

2016-01-12  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Fix return value of some paint methods in RenderThemeGtk
        https://bugs.webkit.org/show_bug.cgi?id=153015

        Reviewed by Michael Catanzaro.

        The bool value returned by paint methods in RenderTheme means
        whether the appearance is supported or not, so we should return
        true when not supported (so we didn't paint anything) and false
        when supported (so we actually painted the theme part).

        * rendering/RenderThemeGtk.cpp:
        (WebCore::RenderThemeGtk::paintSearchFieldResultsDecorationPart):
        (WebCore::RenderThemeGtk::paintSearchFieldCancelButton):
        (WebCore::RenderThemeGtk::paintMediaButton):
        (WebCore::RenderThemeGtk::paintMediaMuteButton):
        (WebCore::RenderThemeGtk::paintMediaPlayButton):
        (WebCore::RenderThemeGtk::paintMediaSliderTrack):
        (WebCore::RenderThemeGtk::paintMediaVolumeSliderContainer): Deleted.
        * rendering/RenderThemeGtk.h:

2016-01-12  Andy Estes  <aestes@apple.com>

        [Content Filtering] De-virtualize PlatformContentFilter::{needsMoreData, didBlockData}()
        https://bugs.webkit.org/show_bug.cgi?id=153052

        Reviewed by Andreas Kling.

        No new tests. No change in behavior.

        Instead of having virtual functions that each platform content filter implement in terms of their own state,
        store the state in the base class so that these functions can be non-virtual. Teach each subclass to update the
        base class state appropriately.

        * loader/ContentFilter.h:
        * platform/PlatformContentFilter.h:
        (WebCore::PlatformContentFilter::needsMoreData):
        (WebCore::PlatformContentFilter::didBlockData):
        * platform/cocoa/NetworkExtensionContentFilter.h:
        * platform/cocoa/NetworkExtensionContentFilter.mm:
        (WebCore::NetworkExtensionContentFilter::willSendRequest):
        (WebCore::NetworkExtensionContentFilter::responseReceived):
        (WebCore::NetworkExtensionContentFilter::handleDecision):
        (WebCore::NetworkExtensionContentFilter::NetworkExtensionContentFilter): Deleted.
        (WebCore::NetworkExtensionContentFilter::needsMoreData): Deleted.
        (WebCore::NetworkExtensionContentFilter::didBlockData): Deleted.
        * platform/cocoa/ParentalControlsContentFilter.h:
        * platform/cocoa/ParentalControlsContentFilter.mm:
        (WebCore::ParentalControlsContentFilter::responseReceived):
        (WebCore::ParentalControlsContentFilter::updateFilterState):
        (WebCore::ParentalControlsContentFilter::ParentalControlsContentFilter): Deleted.
        (WebCore::ParentalControlsContentFilter::needsMoreData): Deleted.
        (WebCore::ParentalControlsContentFilter::didBlockData): Deleted.
        * platform/spi/cocoa/NEFilterSourceSPI.h:
        * testing/MockContentFilter.cpp:
        (WebCore::MockContentFilter::willSendRequest):
        (WebCore::MockContentFilter::maybeDetermineStatus):
        (WebCore::MockContentFilter::needsMoreData): Deleted.
        (WebCore::MockContentFilter::didBlockData): Deleted.
        * testing/MockContentFilter.h:

2016-01-12  Andy Estes  <aestes@apple.com>

        Address missed review feedback after r194950.

        * platform/cocoa/NetworkExtensionContentFilter.mm:
        (WebCore::NetworkExtensionContentFilter::initialize): Renamed the NetworkExtension dispatch queue.

2016-01-08  Andy Estes  <aestes@apple.com>

        [Content Filtering] Lazily load platform frameworks
        https://bugs.webkit.org/show_bug.cgi?id=152881
        rdar://problem/23270886

        Reviewed by Brady Eidson.

        On Cocoa platforms, ContentFilter soft-links two frameworks that perform the underlying filtering operations.
        There is a one-time cost associated with the soft-linking, and the current design requires all clients to pay
        this cost whether or not they ever load a resource that is subject to filtering.

        Addressed this by deferring the loading of frameworks until it is known that a resource will require filtering.
        It is rather simple to defer the soft-linking at the PlatformContentFilter level, but doing this alone would
        mean that every CachedRawResourceClient callback would be routed through ContentFilter, even in the very common
        case where both platform content filters are disabled. This is because checking if a platform content filter is
        enabled involves loading its framework, so creating a ContentFilter (which DocumentLoader will add as the
        CachedRawResource client in place of itself) cannot be avoided by checking that all its platform content filters
        are disabled.

        Resolved this by inverting the relationship between ContentFilter and DocumentLoader. Instead of ContentFilter
        being the CachedRawResource's client and forwarding callbacks to DocumentLoader when one or more platform
        filters are enabled, DocumentLoader is now always the client and it forwards callbacks to ContentFilter.
        ContentFilter then returns a boolean value indicating whether or not DocumentLoader should proceed with each
        callback.

        New API test: ContentFiltering.LazilyLoadPlatformFrameworks

        * loader/ContentFilter.cpp:
        (WebCore::ContentFilter::create): Renamed from createIfEnabled(). Since the enabled check causes frameworks to
        be loaded, the check is skipped here and all types are always created.
        (WebCore::ContentFilter::continueAfterWillSendRequest): Renamed from willSendRequest(). Renamed requestCopy to
        originalRequest, and only created it for logging purposes. Since the copy was only used for logging purposes,
        request is now modified directly. Returned false if request is null.
        (WebCore::ContentFilter::continueAfterResponseReceived): Renamed from responseReceived(). Stopped asserting that
        resource is non-null, since it will be null in the case of substitute data loads. Stopped asserting that m_state
        is not Initialized, since that state was removed and the function can now be called in all states. Only logged
        if m_state is Filtering. Returned false if m_state is Blocked.
        (WebCore::ContentFilter::continueAfterDataReceived): Renamed from dataReceived(). Stopped asserting that
        resource is non-null and that m_state is Initialized, and moved the logging, for the same reasons as above.
        Returned false if m_state is Filtering or Blocked.
        (WebCore::ContentFilter::continueAfterNotifyFinished): Renamed from notifyFinished(). Stopped asserting that
        resource is non-null and that m_state is not Initialized, and moved the logging, for the same reasons as above.
        If m_state is not Blocked at this point, set m_state to Allowed in order for deliverResourceData() to not get
        caught in continueAfterDataReceived(). Returned false if m_state is Blocked or Stopped after delivering data.
        (WebCore::ContentFilter::createIfEnabled): Renamed to create().
        (WebCore::ContentFilter::~ContentFilter): Stopped removing ourself as m_mainResource's client.
        (WebCore::ContentFilter::willSendRequest): Renamed to continueAfterWillSendRequest().
        (WebCore::ContentFilter::startFilteringMainResource): Stopped adding ourself as m_mainResource's client. Stopped
        asserting that m_state is not Initialized and instead returned early if m_state is not Stopped.
        (WebCore::ContentFilter::stopFilteringMainResource): Stopped removing ourself as m_mainResource's client.
        (WebCore::ContentFilter::responseReceived): Renamed to continueAfterResponseReceived().
        (WebCore::ContentFilter::dataReceived): Renamed to continueAfterDataReceived().
        (WebCore::ContentFilter::redirectReceived): Removed. DocumentLoader now calls continueAfterWillSendRequest()
        directly on redirects.
        (WebCore::ContentFilter::notifyFinished): Renamed to continueAfterNotifyFinished().
        (WebCore::ContentFilter::didDecide): Instead of calling DocumentLoader::contentFilterDidDecide(), called
        DocumentLoader::contentFilterDidBlock() when m_state is Blocked.
        (WebCore::ContentFilter::deliverResourceData): Asserted that m_state is Allowed.
        * loader/ContentFilter.h: Stopped inheriting from CachedRawResourceClient. Redeclared the
        CachedRawResourceClient virtual functions as the continue* functions mentioned above. Made State enum private
        and removed Initialized. Initialized m_state to Stopped and removed its getter.
        (WebCore::ContentFilter::type): Returned a ContentFilter::Type that does not include an enabled function.
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::notifyFinished): Returned early if ContentFilter::continueAfterNotifyFinished()
        returned false.
        (WebCore::DocumentLoader::willSendRequest): Called ContentFilter::continueAfterWillSendRequest() even for
        redirects, since ContentFilter is no longer a CachedRawResourceClient and so will no longer receive
        redirectReceived(). Returned early if continueAfterWillSendRequest() returns false.
        (WebCore::DocumentLoader::responseReceived): Returned early if ContentFilter::continueAfterResponseReceived()
        returned false.
        (WebCore::DocumentLoader::dataReceived): Ditto for ContentFilter::continueAfterDataReceived().
        (WebCore::DocumentLoader::startLoadingMainResource): Called ContentFilter::create(), not createIfEnabled().
        (WebCore::DocumentLoader::becomeMainResourceClient): Called ContentFilter::startFilteringMainResource() even if
        m_state is not Initialized. Added ourself as a client of m_mainResource unconditionally.
        (WebCore::DocumentLoader::contentFilterDidBlock): Renamed from contentFilterDidDecide. Removed assertions and
        the early return when m_state is Allowed, since the state is guaranteed to be Blocked.
        (WebCore::DocumentLoader::contentFilterDidDecide): Renamed to contentFilterDidBlock.
        * platform/cocoa/NetworkExtensionContentFilter.h: Moved definition of HAVE_NETWORK_EXTENSION to Platform.h so
        that this file doesn't need to become a Private header. Made enabled() private, and declared initialize().
        * platform/cocoa/NetworkExtensionContentFilter.mm:
        (WebCore::NetworkExtensionContentFilter::initialize): Added a function to lazily initialize the object.
        (WebCore::NetworkExtensionContentFilter::willSendRequest): For the modern NEFilterSource, checked if it is
        enabled only after checking if the request is HTTP(S). If both checks pass, then called initialize().
        (WebCore::NetworkExtensionContentFilter::responseReceived): Ditto for the legacy NEFilterSource.
        * platform/cocoa/ParentalControlsContentFilter.h: Made enabled() private.
        * platform/cocoa/ParentalControlsContentFilter.mm:
        (WebCore::ParentalControlsContentFilter::responseReceived): Checked if WebFilterEvaluator is enabled only after
        checking if the response is from a protocol that can be handled.
        * testing/MockContentFilter.cpp:
        (WebCore::MockContentFilter::willSendRequest): Immediately set m_status to Status::Allowed if !enabled().
        * testing/MockContentFilter.h: Made enabled() private.

2016-01-12  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r194926 and r194928.
        https://bugs.webkit.org/show_bug.cgi?id=153048

        This change is causing LayoutTest crashes (Requested by
        ryanhaddad on #webkit).

        Reverted changesets:

        "Avoid downloading the wrong image for <picture> elements."
        https://bugs.webkit.org/show_bug.cgi?id=153027
        http://trac.webkit.org/changeset/194926

        "Avoid downloading the wrong image for <picture> elements."
        https://bugs.webkit.org/show_bug.cgi?id=153027
        http://trac.webkit.org/changeset/194928

2016-01-11  Dean Jackson  <dino@apple.com>

        [iOS] Antialiasing doesn't work in WebGL
        https://bugs.webkit.org/show_bug.cgi?id=153000
        <rdar://problem/9165531>

        Reviewed by Alex Christensen.

        WebGL has supported platform antialiasing since
        the beginning, but we never hooked it up for iOS
        because it used a slightly different extension.

        Test: fast/canvas/webgl/antialiasing-enabled.html

        * platform/graphics/mac/GraphicsContext3DMac.mm:
        (WebCore::GraphicsContext3D::endPaint): Resolve the multisampling
        buffer once we're done painting.
        (WebCore::GraphicsContext3D::~GraphicsContext3D): We never created
        the m_compositorTexture RenderBuffer on iOS, so no point deleting
        it.

        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
        (WebCore::Extensions3DOpenGL::supportsExtension): The iOS extension
        has a slightly different name.
        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
        (WebCore::GraphicsContext3D::reshapeFBOs): Make sure to create the
        multisample buffer with the correct format.
        (WebCore::GraphicsContext3D::resolveMultisamplingIfNecessary): We
        need to remember what our bound frame buffer is when we
        enter this call, and restore it afterwards. In the middle we can
        discard our multisample read buffer once we have resolved it
        into the normal framebuffer.

2016-01-12  Daniel Bates  <dabates@apple.com>

        XSS Auditor should navigate to empty substitute data on full page block
        https://bugs.webkit.org/show_bug.cgi?id=152868
        <rdar://problem/18658448>

        Reviewed by David Kilzer and Andy Estes.

        Derived from Blink patch (by Tom Sepez <tsepez@chromium.org>):
        <https://src.chromium.org/viewvc/blink?view=rev&revision=179240>

        Test: http/tests/security/xssAuditor/block-does-not-leak-that-page-was-blocked-using-empty-data-url.html

        * html/parser/XSSAuditorDelegate.cpp:
        (WebCore::XSSAuditorDelegate::didBlockScript): Modified to call NavigationScheduler::schedulePageBlock().
        * loader/NavigationScheduler.cpp:
        (WebCore::ScheduledPageBlock::ScheduledPageBlock): Added.
        (WebCore::NavigationScheduler::schedulePageBlock): Navigate to empty substitute data with
        the same URL as the originating document.
        * loader/NavigationScheduler.h:

2016-01-12  Dave Hyatt  <hyatt@apple.com>

        Avoid downloading the wrong image for <picture> elements.
        https://bugs.webkit.org/show_bug.cgi?id=153027

        Reviewed by Dean Jackson.

        I was unable to write a reliable test for this feature (I welcome suggestions regarding
        how this could be tested).

        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::HTMLImageElement):
        (WebCore::HTMLImageElement::~HTMLImageElement):
        (WebCore::HTMLImageElement::bestFitSourceFromPictureElement):
        (WebCore::HTMLImageElement::insertedInto):
        (WebCore::HTMLImageElement::removedFrom):
        (WebCore::HTMLImageElement::pictureNode):
        (WebCore::HTMLImageElement::setPictureNode):
        * html/HTMLImageElement.h:
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::createHTMLElement):

        Images that are built underneath a <picture> element are now connected
        to that picture element via a setPictureNode call from the parser. This
        ensures that the correct <source> elements are examined before checking the image.

        This connection between images and their picture owners is handled using a static
        HashMap in HTMLImageElement. This connection is made both from the parser and from
        DOM insertions, and the map is queried now instead of looking directly at the
        image's parentNode().

        Also note the change to pass the document element's computed style in for media
        query evaluation. Just as with the preload scanner, the image's style can't be
        used as it has not been determined yet.

2016-01-12  Myles C. Maxfield  <mmaxfield@apple.com>

        Cleanup in font loading code
        https://bugs.webkit.org/show_bug.cgi?id=153023

        Reviewed by Zalan Bujtas.

        See detailed notes below.

        No new tests because there is no behavior change.

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::isLoaded): Deleted. Never called.
        * css/CSSFontFace.h: Ditto.
        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font): No need to use a helper
        isLoaded() function.
        (WebCore::CSSFontFaceSource::isLoaded): Deleted. Unnecessary.
        * css/CSSFontFaceSource.h:
        * css/CSSFontFaceSrcValue.cpp:
        (WebCore::CSSFontFaceSrcValue::cachedFont): Un-indent code.
        * css/CSSFontSelector.cpp:
        (WebCore::registerLocalFontFacesForFamily): constructFamilyFontFaces()
        always returns an empty Vector. Therefore, the function of this function
        is to perform the ancillary processing related to the case where the Faces
        don't already exist. Renames the function and removes the empty vector
        return.
        (WebCore::CSSFontSelector::addFontFaceRule): Update for
        registerLocalFontFacesForFamily().
        (WebCore::FontFaceComparator::FontFaceComparator): Instead of using a static,
        construct a wrapper class around the comparator.
        (WebCore::FontFaceComparator::operator()): Ditto.
        (WebCore::CSSFontSelector::getFontFace): Un-indent code and update to use
        FontFaceComparator.
        (WebCore::CSSFontSelector::fallbackFontAt): Migrate off PassRefPtr.
        (WebCore::constructFamilyFontFaces): Deleted.
        (WebCore::compareFontFaces): Deleted.
        (WebCore::CSSFontSelector::resolvesFamilyFor): Deleted. Never called.
        * css/CSSFontSelector.h:
        * css/CSSSegmentedFontFace.cpp:
        (WebCore::CSSSegmentedFontFace::isValid): Deleted.
        (WebCore::CSSSegmentedFontFace::fontRanges): Cache negative validity results.
        * css/CSSSegmentedFontFace.h:
        * platform/graphics/FontCascade.h:
        (WebCore::FontCascade::fontSelector): Use nullptr.
        * platform/graphics/FontSelector.h:

2016-01-12  Ryosuke Niwa  <rniwa@webkit.org>

        Add a build flag for custom element
        https://bugs.webkit.org/show_bug.cgi?id=153005

        Reviewed by Alex Christensen.

        Added a build flag for enabling custom elements.

        * Configurations/FeatureDefines.xcconfig:

2016-01-12  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Update RTCPeerConnection.add/removeTrack() and add test
        https://bugs.webkit.org/show_bug.cgi?id=153010

        Reviewed by Eric Carlson.

        RTCPeerConnection.add/removeTrack() are not fully spec compliant yet, since that would
        require support for RTCRtpTransceiver which is a new work-in-progress feature. Use
        Vector, instead of map, for senders and receivers since nothing is removed from these
        sets anymore.

        Test: fast/mediastream/RTCPeerConnection-add-removeTrack.html

        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::addTrack):
        (WebCore::RTCPeerConnection::removeTrack):
        (WebCore::RTCPeerConnection::queuedCreateOffer): Deleted.
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/mediastream/RTCRtpSender.cpp:
        (WebCore::RTCRtpSender::RTCRtpSender):
        * Modules/mediastream/RTCRtpSender.h:
        (WebCore::RTCRtpSender::create):
        (WebCore::RTCRtpSender::mediaStreamIds):

2016-01-12  Brady Eidson  <beidson@apple.com>

        Modern IDB: Check in empty SQLite backing store implementation.
        https://bugs.webkit.org/show_bug.cgi?id=153022

        Reviewed by Alex Christensen.

        No new tests (No change in behavior).

        Just to get the implementation files in the tree, this backing store currently does nothing
        other than return errors for every operation.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp: Added.
        (WebCore::IDBServer::SQLiteIDBBackingStore::SQLiteIDBBackingStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::~SQLiteIDBBackingStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo):
        (WebCore::IDBServer::SQLiteIDBBackingStore::beginTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::abortTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::commitTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::clearObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::keyExistsInObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteRange):
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getIndexRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getCount):
        (WebCore::IDBServer::SQLiteIDBBackingStore::generateKeyNumber):
        (WebCore::IDBServer::SQLiteIDBBackingStore::revertGeneratedKeyNumber):
        (WebCore::IDBServer::SQLiteIDBBackingStore::maybeUpdateKeyGeneratorNumber):
        (WebCore::IDBServer::SQLiteIDBBackingStore::openCursor):
        (WebCore::IDBServer::SQLiteIDBBackingStore::iterateCursor):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteBackingStore):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h: Added.

2016-01-12  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/dont-wedge.html is flaky.
        https://bugs.webkit.org/show_bug.cgi?id=152892

        Reviewed by Alex Christensen.

        No new tests (Reenabled existing test).

        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::abortOpenAndUpgradeNeeded):
        * Modules/indexeddb/client/IDBConnectionToServer.h:
        * Modules/indexeddb/client/IDBConnectionToServerDelegate.h:

        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::requestCompleted): If the database was opened
          or an upgrade transaction was started, but the script execution context is already
          stopped, immediately message back to the server so it doesn't wedge.

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::abortOpenAndUpgradeNeeded):
        * Modules/indexeddb/server/IDBServer.h:

        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::abortWithoutCallback):
        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.h:

        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::abortOpenAndUpgradeNeeded):
        * Modules/indexeddb/shared/InProcessIDBServer.h:

2016-01-12  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r194826.
        https://bugs.webkit.org/show_bug.cgi?id=153020

        Appears to have regressed PLT (Requested by kling on #webkit).

        Reverted changeset:

        "Use NeverDestroyed instead of DEPRECATED_DEFINE_STATIC_LOCAL
        cont'd"
        https://bugs.webkit.org/show_bug.cgi?id=152902
        http://trac.webkit.org/changeset/194826

2016-01-12  Antti Koivisto  <antti@apple.com>

        Don't reuse memory cache entries with different charset
        https://bugs.webkit.org/show_bug.cgi?id=110031
        rdar://problem/13666418

        Reviewed by Andreas Kling.

        Test: fast/loader/cache-encoding.html

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestResource):
        (WebCore::logResourceRevalidationDecision):
        (WebCore::CachedResourceLoader::determineRevalidationPolicy):

            Pass full CachedResourceRequest to the function.
            If charset differs don't reuse the cache entry.

        * loader/cache/CachedResourceLoader.h:

2016-01-12  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Use a pointer instead of PassRefPtr in AbstractView argument of UIEvent class
        https://bugs.webkit.org/show_bug.cgi?id=152829

        Reviewed by Darin Adler.

        As a step to reduce uses of PassRefPtr, UIEvent class doesn't need to use PassRefPtr for AbstractView argument.
        Nobody hands us ownership when making one of these objects.

        * dom/FocusEvent.cpp:
        (WebCore::FocusEvent::FocusEvent):
        * dom/FocusEvent.h:
        * dom/KeyboardEvent.cpp:
        (WebCore::KeyboardEvent::KeyboardEvent):
        * dom/MouseEvent.cpp:
        (WebCore::MouseEvent::create):
        (WebCore::MouseEvent::MouseEvent):
        (WebCore::MouseEvent::initMouseEvent):
        (WebCore::SimulatedMouseEvent::create):
        (WebCore::SimulatedMouseEvent::SimulatedMouseEvent):
        * dom/MouseEvent.h:
        * dom/MouseRelatedEvent.cpp:
        (WebCore::MouseRelatedEvent::MouseRelatedEvent):
        * dom/MouseRelatedEvent.h:
        * dom/TextEvent.cpp:
        (WebCore::TextEvent::create):
        (WebCore::TextEvent::createForPlainTextPaste):
        (WebCore::TextEvent::createForFragmentPaste):
        (WebCore::TextEvent::createForDrop):
        (WebCore::TextEvent::createForDictation):
        (WebCore::TextEvent::TextEvent):
        (WebCore::TextEvent::initTextEvent):
        * dom/TextEvent.h:
        * dom/TouchEvent.cpp:
        (WebCore::TouchEvent::TouchEvent):
        (WebCore::TouchEvent::initTouchEvent):
        * dom/TouchEvent.h:
        * dom/UIEvent.cpp:
        (WebCore::UIEvent::UIEvent):
        (WebCore::UIEvent::initUIEvent):
        * dom/UIEvent.h:
        (WebCore::UIEvent::create):
        (WebCore::UIEvent::view):
        * dom/UIEventWithKeyState.h:
        (WebCore::UIEventWithKeyState::UIEventWithKeyState):

2016-01-12  Csaba Osztrogonác  <ossy@webkit.org>

        Fix unused-private-field warnings in DisplayListItems.h
        https://bugs.webkit.org/show_bug.cgi?id=153012

        Reviewed by Michael Catanzaro.

        * platform/graphics/displaylists/DisplayListItems.cpp:
        (WebCore::DisplayList::DrawNativeImage::DrawNativeImage):
        * platform/graphics/displaylists/DisplayListItems.h:

2016-01-12  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix isRecording condition logic in GraphicsContext::roundToDevicePixels after r194816.

        This looks like a typo introduced in r194816, we want to return early logging
        a message when isRecording() returns true.

        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::roundToDevicePixels):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::roundToDevicePixels):

2016-01-11  Carlos Garcia Campos  <cgarcia@igalia.com>

        Inconsistencies in main resource load delegates when loading from history
        https://bugs.webkit.org/show_bug.cgi?id=150927

        Reviewed by Michael Catanzaro.

        When restoring a page from the page cache, even though there
        isn't an actual load of resources, we are still emitting the load
        delegates to let the API layer know there are contents being
        loaded in the web view. This makes the page cache restoring
        transparent for the API layer. However, when restoring a page from
        the cache, all the delegates are emitted after the load is
        committed. This is not consistent with real loads, where we first
        load the main resource and once we get a response we commit the
        load. This inconsistency is problematic if the API layer expects
        to always have a main resource with a response when the load is
        committed. This is the case of the GTK+ port, for example. So,
        this patch ensures that when a page is restored from the page
        cache, the main resource load delegates that are emitted until a
        response is received in normal loads, are emitted before the load
        is committed.

        Test: http/tests/loading/main-resource-delegates-on-back-navigation.html

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad): When loading from
        the page cache, send delegate messages up to didReceiveResponse
        for the main resource before the load is committed, and the
        remaining messages afterwards.

2016-01-09  Andy Estes  <aestes@apple.com>

        [Cocoa] Add SPI to opt out a URL scheme from the memory cache
        https://bugs.webkit.org/show_bug.cgi?id=152950
        rdar://problem/24066652

        Reviewed by Tim Horton.

        Added a list of schemes to SchemeRegistry whose resources should always be revalidated. Taught CachedResource to
        return a freshness lifetime of 0 for these resources, unless the scheme is one that should be cached indefinitely.

        New API test: WebKit2.AlwaysRevalidatedURLSchemes

        * loader/cache/CachedResource.cpp:
        (WebCore::shouldCacheSchemeIndefinitely): Moved from SchemeRegistry::shouldCacheResponsesFromURLSchemeIndefinitely().
        (WebCore::CachedResource::freshnessLifetime): For a scheme that should not be cached indefinitely, return 0 if
        that scheme should always be revalidated according to SchemeRegistry.
        * platform/SchemeRegistry.cpp:
        (WebCore::alwaysRevalidatedSchemes):
        (WebCore::SchemeRegistry::registerURLSchemeAsAlwaysRevalidated):
        (WebCore::SchemeRegistry::shouldAlwaysRevalidateURLScheme):
        (WebCore::SchemeRegistry::shouldCacheResponsesFromURLSchemeIndefinitely): Moved to WebCore::shouldCacheSchemeIndefinitely().
        There was no reason for this to be in SchemeRegistry.
        * platform/SchemeRegistry.h:

2016-01-11  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/index-multientry.html fails under GuardMalloc/ASAN.
        https://bugs.webkit.org/show_bug.cgi?id=152990

        Reviewed by Alex Christensen.

        No new tests (Covered by re-enabling existing test).

        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::dispatchEvent): Use String::utf8() instead of AtomicString::characters8() for
          the format string, as the latter fails under ASAN.
          
        * Modules/indexeddb/server/IndexValueStore.cpp:
        (WebCore::IDBServer::IndexValueStore::removeEntriesWithValueKey): We can't save off pointers to IDBKeyDatas
          used as keys in the map, because the moment we start mutating the map the keys can be rehashed, invalidating
          our pointers. Save off the IDBKeyDatas by value instead.

2016-01-11  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Migrate Page Timeline recording to ScriptProfiler
        https://bugs.webkit.org/show_bug.cgi?id=152727

        Reviewed by Brian Burg.

        Test: inspector/script-profiler/event-type-Other.html

        This now shares the JavaScript profiling code between JSContext and Page
        inspection. It also moves forward splitting the Page's Timeline domain
        into smaller components that can be turned on/off individually.

        * bindings/js/JSCallbackData.cpp:
        (WebCore::JSCallbackData::invokeCallback):
        * bindings/js/JSErrorHandler.cpp:
        (WebCore::JSErrorHandler::handleEvent):
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::handleEvent):
        * bindings/js/JSMainThreadExecState.h:
        (WebCore::JSMainThreadExecState::profiledCall):
        (WebCore::JSMainThreadExecState::profiledEvaluate):
        * bindings/js/JSMutationCallback.cpp:
        (WebCore::JSMutationCallback::call):
        * bindings/js/ScheduledAction.cpp:
        (WebCore::ScheduledAction::executeFunctionInContext):
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::evaluateInWorld):
        * bindings/objc/WebScriptObject.mm:
        (-[WebScriptObject callWebScriptMethod:withArguments:]):
        (-[WebScriptObject evaluateWebScript:]):
        Identify entry points into JSC that we want to profile for the frontend.
        These were nearly all already classified for the Timeline. We added missing
        support for ErrorHandlers (window.onerror handler functions).

        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::didCallFunction):
        (WebCore::InspectorTimelineAgent::didEvaluateScript):
        (WebCore::startProfiling): Deleted.
        (WebCore::stopProfiling): Deleted.
        (WebCore::InspectorTimelineAgent::willCallFunction): Deleted.
        (WebCore::InspectorTimelineAgent::willEvaluateScript): Deleted.
        * inspector/InspectorTimelineAgent.h:
        TimelineAgent no longer needs to start/stop the Legacy Profiler
        since ScriptProfiler will automatically do that for us. Delete
        all code associated with that. There is still an open question
        regarding `console.profile` and `console.profileEnd` that
        starts/stops the profiler.

2016-01-11  Anders Carlsson  <andersca@apple.com>

        Get rid of CFMakeCollectable, it is a no-op
        https://bugs.webkit.org/show_bug.cgi?id=152988

        Reviewed by Sam Weinig.

        * platform/mac/WebCoreNSURLExtras.mm:
        (WebCore::URLByTruncatingOneCharacterBeforeComponent):
        (WebCore::URLByRemovingComponentAndSubsequentCharacter):

2016-01-11  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r194866.
        https://bugs.webkit.org/show_bug.cgi?id=152986

        This change broke the mac build (Requested by ryanhaddad on
        #webkit).

        Reverted changeset:

        "[Cocoa] Add SPI to opt out a URL scheme from the memory
        cache"
        https://bugs.webkit.org/show_bug.cgi?id=152950
        http://trac.webkit.org/changeset/194866

2016-01-11  Zalan Bujtas  <zalan@apple.com>

        Padding added to table-cell element after font-size change.
        https://bugs.webkit.org/show_bug.cgi?id=152796

        Reviewed by David Hyatt.

        Do not include intrinsicPaddingBefore value while figuring out the height of a row.
        In RenderTableSection::calcRowLogicalHeight() we are interested in the height of the content
        without the additional padding (normal padding is included).

        Test: fast/table/table-baseline-grows.html

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::calcRowLogicalHeight):

2016-01-11  Andy Estes  <aestes@apple.com>

        [Cocoa] Add SPI to opt out a URL scheme from the memory cache
        https://bugs.webkit.org/show_bug.cgi?id=152950
        rdar://problem/24066652

        Reviewed by Tim Horton.

        Added a list of schemes to SchemeRegistry whose resources should always be revalidated. Taught CachedResource to
        return a freshness lifetime of 0 for these resources, unless the scheme is one that should be cached indefinitely.

        New API test: WebKit2.AlwaysRevalidatedURLSchemes

        * loader/cache/CachedResource.cpp:
        (WebCore::shouldCacheSchemeIndefinitely): Moved from SchemeRegistry::shouldCacheResponsesFromURLSchemeIndefinitely().
        (WebCore::CachedResource::freshnessLifetime): For a scheme that should not be cached indefinitely, return 0 if
        that scheme should always be revalidated according to SchemeRegistry.
        * platform/SchemeRegistry.cpp:
        (WebCore::alwaysRevalidatedSchemes):
        (WebCore::SchemeRegistry::registerURLSchemeAsAlwaysRevalidated):
        (WebCore::SchemeRegistry::shouldAlwaysRevalidateURLScheme):
        (WebCore::SchemeRegistry::shouldCacheResponsesFromURLSchemeIndefinitely): Moved to WebCore::shouldCacheSchemeIndefinitely().
        There was no reason for this to be in SchemeRegistry.
        * platform/SchemeRegistry.h:

2016-01-11  Dave Hyatt  <hyatt@apple.com>

        Picture element needs to work with the preload scanner and select the correct
        source element instead of loading the image.
        https://bugs.webkit.org/show_bug.cgi?id=152983

        Reviewed by Dean Jackson.

        Added new tests in http/tests/loading.

        * html/parser/HTMLPreloadScanner.cpp:
        (WebCore::TokenPreloadScanner::tagIdFor):
        (WebCore::TokenPreloadScanner::initiatorFor):
        (WebCore::TokenPreloadScanner::StartTagScanner::StartTagScanner):
        (WebCore::TokenPreloadScanner::StartTagScanner::processAttributes):
        (WebCore::TokenPreloadScanner::StartTagScanner::processImageAndScriptAttribute):
        (WebCore::TokenPreloadScanner::StartTagScanner::processAttribute):
        (WebCore::TokenPreloadScanner::StartTagScanner::resourceType):
        (WebCore::TokenPreloadScanner::scan):
        * html/parser/HTMLPreloadScanner.h:
        (WebCore::TokenPreloadScanner::setPredictedBaseElementURL):
        (WebCore::TokenPreloadScanner::inPicture):

2016-01-11  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/key-generator.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152981

        Reviewed by Alex Christensen.

        No new tests (One failing test now passes, and one test's results get a progression).

        * Modules/indexeddb/server/IDBBackingStore.h:
        
        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::generateKeyNumber): Throw an error if the current
          value is already over 2^53.
        (WebCore::IDBServer::MemoryIDBBackingStore::revertGeneratedKeyNumber):
        (WebCore::IDBServer::MemoryIDBBackingStore::maybeUpdateKeyGeneratorNumber): Handle double -> uint64_t
          conversions properly when calculating the next key.
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::ScopeGuard::ScopeGuard): Add this utility class to call a function 
          any time it goes out of scope.
        (WebCore::IDBServer::ScopeGuard::~ScopeGuard):
        (WebCore::IDBServer::ScopeGuard::enable):
        (WebCore::IDBServer::ScopeGuard::disable):
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd): Revert the key generator value if
          the put/add operation ends in error.

2016-01-11  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/lazy-index-population.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152976

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        We were restoring objectstores/indexes incorrectly on transaction abort.

        * Modules/indexeddb/server/MemoryBackingStoreTransaction.cpp:
        (WebCore::IDBServer::MemoryBackingStoreTransaction::abort):
        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::removeObjectStoreForVersionChangeAbort):

2016-01-11  Brady Eidson  <beidson@apple.com>

        Modern IDB: Make MemoryIndex and MemoryObjectStore RefCounted.
        https://bugs.webkit.org/show_bug.cgi?id=152966

        Reviewed by Alex Christensen.

        No new tests (Refactor, no change in behavior)

        * Modules/indexeddb/server/MemoryBackingStoreTransaction.cpp:
        (WebCore::IDBServer::MemoryBackingStoreTransaction::indexDeleted):
        (WebCore::IDBServer::MemoryBackingStoreTransaction::objectStoreDeleted):
        (WebCore::IDBServer::MemoryBackingStoreTransaction::abort):
        * Modules/indexeddb/server/MemoryBackingStoreTransaction.h:
        
        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::createObjectStore):
        (WebCore::IDBServer::MemoryIDBBackingStore::deleteObjectStore):
        (WebCore::IDBServer::MemoryIDBBackingStore::restoreObjectStoreForVersionChangeAbort):
        (WebCore::IDBServer::MemoryIDBBackingStore::registerObjectStore):
        (WebCore::IDBServer::MemoryIDBBackingStore::takeObjectStoreByName):
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:
        
        * Modules/indexeddb/server/MemoryIndex.cpp:
        (WebCore::IDBServer::MemoryIndex::create):
        * Modules/indexeddb/server/MemoryIndex.h:
        
        * Modules/indexeddb/server/MemoryObjectStore.cpp:
        (WebCore::IDBServer::MemoryObjectStore::create):
        (WebCore::IDBServer::MemoryObjectStore::createIndex):
        (WebCore::IDBServer::MemoryObjectStore::maybeRestoreDeletedIndex):
        (WebCore::IDBServer::MemoryObjectStore::takeIndexByName):
        (WebCore::IDBServer::MemoryObjectStore::deleteIndex):
        (WebCore::IDBServer::MemoryObjectStore::updateIndexesForDeleteRecord):
        (WebCore::IDBServer::MemoryObjectStore::updateIndexesForPutRecord):
        (WebCore::IDBServer::MemoryObjectStore::registerIndex):
        * Modules/indexeddb/server/MemoryObjectStore.h:

2016-01-11  Andreas Kling  <akling@apple.com>

        Fix other builds after my MSVC build fix. :-|

        * css/StyleResolver.cpp:

2016-01-11  Andreas Kling  <akling@apple.com>

        Fix MSVC build after r194848.

        Since MSVC refuses to recognize the friendship between LazyNeverDestroyed
        and some CSS*Value classes, make their constructors public in MSVC builds.

        Added FIXME's to make it look extra gross.

        * css/CSSInheritedValue.h:
        (WebCore::CSSInheritedValue::create): Deleted.
        * css/CSSInitialValue.h:
        * css/CSSPrimitiveValue.h:
        * css/CSSRevertValue.h:
        (WebCore::CSSRevertValue::create): Deleted.
        * css/CSSUnsetValue.h:
        (WebCore::CSSUnsetValue::create): Deleted.
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::applyProperty):

2016-01-11  Andreas Kling  <akling@apple.com>

        CSSValuePool should use nonfragmented storage for eternal caches.
        <https://webkit.org/b/152960>

        Reviewed by Antti Koivisto.

        Store all of the common cached CSS value objects in contiguous arrays
        instead of lazily allocating them on the heap.

        This reduces heap fragmentation (win) and removes indirection (win)

        * css/CSSInheritedValue.h:
        * css/CSSInitialValue.h:
        * css/CSSPrimitiveValue.h:
        * css/CSSRevertValue.h:
        * css/CSSUnsetValue.h:
        * css/CSSValuePool.cpp:
        (WebCore::CSSValuePool::CSSValuePool):
        (WebCore::CSSValuePool::createIdentifierValue):
        (WebCore::CSSValuePool::createColorValue):
        (WebCore::CSSValuePool::createValue):
        (WebCore::CSSValuePool::drain): Deleted.
        * css/CSSValuePool.h:
        (WebCore::CSSValuePool::createInheritedValue):
        (WebCore::CSSValuePool::createImplicitInitialValue):
        (WebCore::CSSValuePool::createExplicitInitialValue):
        (WebCore::CSSValuePool::createUnsetValue):
        (WebCore::CSSValuePool::createRevertValue):

2016-01-11  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Cleanup RenderThemeGtk
        https://bugs.webkit.org/show_bug.cgi?id=152888

        Reviewed by Michael Catanzaro.

        Use a common path for GTK+ 3.19 and previous versions, simplifying
        the code and removing a lot of ifdefs.

         - createStyleContext() now receives a theme part enum value, and
           an optional parent GtkStyleContext. It encapsulates all the
           differences between GTK+ 3.19 and previous version leaving the
           rendering code common and free of ifdefs.
         - Stock icons support have been removed, simplifying the code
           that now always renders symbolic icons, updating the colors
           depending on the current state.
         - Media button and colors have been removed, because they are
           unused now that we render the media controls with CSS.
         - ComboBox separators support has also been removed. In GTK+ 3.19
           combo boxes no longer have separators and most of the GTK+
           themes don't use the either, so it's better to simple not render
           them anymore in WebKit either.
         - Code to paint caps lock indicator has been removed too, since
           caps lock indicator is now shadow dom and automatically
           rendered by WebCore.

        * rendering/RenderThemeGtk.cpp:
        (WebCore::createStyleContext):
        (WebCore::loadThemedIcon):
        (WebCore::gtkIconStateFlags):
        (WebCore::RenderThemeGtk::adjustRepaintRect):
        (WebCore::setToggleSize):
        (WebCore::paintToggle):
        (WebCore::RenderThemeGtk::setCheckboxSize):
        (WebCore::RenderThemeGtk::paintCheckbox):
        (WebCore::RenderThemeGtk::setRadioSize):
        (WebCore::RenderThemeGtk::paintRadio):
        (WebCore::RenderThemeGtk::paintButton):
        (WebCore::getComboBoxMetrics):
        (WebCore::RenderThemeGtk::popupInternalPaddingLeft):
        (WebCore::RenderThemeGtk::popupInternalPaddingRight):
        (WebCore::RenderThemeGtk::popupInternalPaddingTop):
        (WebCore::RenderThemeGtk::popupInternalPaddingBottom):
        (WebCore::RenderThemeGtk::paintMenuList):
        (WebCore::RenderThemeGtk::paintTextField):
        (WebCore::adjustSearchFieldIconStyle):
        (WebCore::RenderThemeGtk::adjustSearchFieldResultsDecorationPartStyle):
        (WebCore::paintIcon):
        (WebCore::paintEntryIcon):
        (WebCore::RenderThemeGtk::paintSearchFieldResultsDecorationPart):
        (WebCore::RenderThemeGtk::adjustSearchFieldCancelButtonStyle):
        (WebCore::RenderThemeGtk::paintSearchFieldCancelButton):
        (WebCore::RenderThemeGtk::shouldHaveCapsLockIndicator):
        (WebCore::RenderThemeGtk::paintSliderTrack):
        (WebCore::RenderThemeGtk::paintSliderThumb):
        (WebCore::RenderThemeGtk::adjustSliderThumbSize):
        (WebCore::RenderThemeGtk::paintProgressBar):
        (WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):
        (WebCore::paintSpinArrowButton):
        (WebCore::RenderThemeGtk::paintInnerSpinButton):
        (WebCore::styleColor):
        (WebCore::RenderThemeGtk::platformActiveSelectionBackgroundColor):
        (WebCore::RenderThemeGtk::platformInactiveSelectionBackgroundColor):
        (WebCore::RenderThemeGtk::platformActiveSelectionForegroundColor):
        (WebCore::RenderThemeGtk::platformInactiveSelectionForegroundColor):
        (WebCore::RenderThemeGtk::platformActiveListBoxSelectionBackgroundColor):
        (WebCore::RenderThemeGtk::platformInactiveListBoxSelectionBackgroundColor):
        (WebCore::RenderThemeGtk::platformActiveListBoxSelectionForegroundColor):
        (WebCore::RenderThemeGtk::platformInactiveListBoxSelectionForegroundColor):
        (WebCore::RenderThemeGtk::systemColor):
        (WebCore::RenderThemeGtk::paintMediaButton):
        (WebCore::RenderThemeGtk::paintMediaFullscreenButton):
        (WebCore::RenderThemeGtk::paintMediaMuteButton):
        (WebCore::RenderThemeGtk::paintMediaPlayButton):
        (WebCore::RenderThemeGtk::paintMediaSeekBackButton):
        (WebCore::RenderThemeGtk::paintMediaSeekForwardButton):
        (WebCore::RenderThemeGtk::paintMediaToggleClosedCaptionsButton):
        * rendering/RenderThemeGtk.h:

2016-01-11  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Cleanup ScrollbarThemeGtk
        https://bugs.webkit.org/show_bug.cgi?id=152830

        Reviewed by Michael Catanzaro.

        Use a common path for GTK+ 3.19 and previous versions, simplifying
        the code and removing a lot of ifdefs. Use always a new
        GtkStyleContext, but when painting cache the newly created one so
        all paint methods use that one. We were also caching some theme
        properties assuming they don't change unless the theme changes,
        but some of them can have different values depending on the state,
        for example, when hovered or pressed. Those properties are now
        only cached when we create a new GtkStyleContext.
        The method updateScrollbarsFrameThickness() has also been removed,
        since the Scrollbar constructor already initializes the frame rect
        using the scrollbarThickness(). This method was not doing anything
        anyway, since that was called on the constructor of the theme,
        when there were no scrollbars registered. This also means we no
        longer need to track registered/unregistered scrollbars.

        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::backButtonRect): Use the cached
        GtkStyleContext and properties or create a new.
        (WebCore::ScrollbarThemeGtk::forwardButtonRect): Ditto.
        (WebCore::ScrollbarThemeGtk::trackRect): Ditto.
        (WebCore::orientationStyleClass):
        (WebCore::ScrollbarThemeGtk::getOrCreateStyleContext): Create a
        new GtkStyleContext for the scrollbar if there isn't a cached
        one. Also initialize the properties that depend on the state.
        (WebCore::createChildStyleContext): Create a new GtkStyleContext
        from a parent one.
        (WebCore::ScrollbarThemeGtk::updateThemeProperties): Get the
        properties that can only change when the theme changes.
        (WebCore::ScrollbarThemeGtk::thumbRect): Use the cached
        GtkStyleContext and properties or create a new.
        (WebCore::adjustRectAccordingToMargin): Use always the
        GtkStyleContext state instead of receiving it and setting it again.
        (WebCore::ScrollbarThemeGtk::paintTrackBackground): Get or create
        a GtkStyleContext for the scrollbar and create a child one for the trough.
        (WebCore::ScrollbarThemeGtk::paintScrollbarBackground): Use the
        cached GtkStyleContext or create a new one.
        (WebCore::ScrollbarThemeGtk::paintThumb): Get or create a
        GtkStyleContext for the scrollbar and create a child ones for
        trough and slider.
        (WebCore::ScrollbarThemeGtk::paintButton): Get or create a
        GtkStyleContext for the scrollbar and create a child one for the button.
        (WebCore::ScrollbarThemeGtk::paint): Create a GtkStyleContext and
        cache it temporarily using TemporaryChange until the method finishes.
        (WebCore::ScrollbarThemeGtk::scrollbarThickness): Use the cached
        GtkStyleContext and properties or create a new.
        (WebCore::ScrollbarThemeGtk::buttonSize): Ditto.
        * platform/gtk/ScrollbarThemeGtk.h:

2016-01-10  Myles C. Maxfield  <mmaxfield@apple.com>

        [SVG -> OTF Converter] Parsing failures cause use of incomplete fonts
        https://bugs.webkit.org/show_bug.cgi?id=152772
        <rdar://problem/24043104>

        Reviewed by Simon Fraser.

        Originally, if we fail to parse a glyph, we would simply skip the glyph. However, this means that
        we will create an incomplete font without all the necessary glyphs. This causes very distressing
        text where all the occurances of a particular letter are missing. Instead, we should treat the
        entire font as invalid.

        Test: fast/text/svg-font-invalid-glyph-path-failure.html

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):
        * loader/cache/CachedSVGFont.cpp:
        (WebCore::CachedSVGFont::ensureCustomFontData):
        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::error):
        (WebCore::SVGToOTFFontConverter::transcodeGlyphPaths):
        (WebCore::SVGToOTFFontConverter::processGlyphElement):
        (WebCore::convertSVGToOTFFont):
        * svg/SVGToOTFFontConversion.h:

2016-01-10  Andreas Kling  <akling@apple.com>

        Use NeverDestroyed instead of DEPRECATED_DEFINE_STATIC_LOCAL cont'd
        <https://webkit.org/b/152902>

        Reviewed by Andy Estes.

        Convert some more of the remaining clients to use NeverDestroyed.

        * html/track/VTTRegion.cpp:
        (WebCore::VTTRegion::textTrackCueContainerShadowPseudoId):
        (WebCore::VTTRegion::textTrackRegionShadowPseudoId):
        * svg/properties/SVGAnimatedPropertyMacros.h:

2016-01-09  Simon Fraser  <simon.fraser@apple.com>

        Hook up display-list drawing in GraphicsLayerCA
        https://bugs.webkit.org/show_bug.cgi?id=152946

        Reviewed by Zalan Bujtas.

        Have GraphicsLayerCA hold a DisplayList. If enabled, do a display-list record
        in GraphicsLayerCA::recursiveCommitChanges(), and a playback in GraphicsLayerCA::platformCALayerPaintContents().
        
        GraphicsLayerCA needs to maintain a m_hasEverPainted flag to know to do a full record
        at first paint (when there are no dirty rects).
        
        Plumb 'isUsingDisplayListDrawing' through to TileGrid via PlatformCALayer{Client}
        so that we can decorate the tile paint counters with an outline.
        
        Have RenderLayerCompositor push the displayListDrawingEnabled state down through
        RenderLayerBackings to GraphicsLayers.
        
        Convert RenderLayerCompositor to use initializers.

        * platform/graphics/GraphicsLayer.cpp:
        (WebCore::GraphicsLayer::GraphicsLayer):
        * platform/graphics/GraphicsLayer.h:
        (WebCore::GraphicsLayer::usesDisplayListDrawing):
        (WebCore::GraphicsLayer::setUsesDisplayListDrawing):
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
        (WebCore::GraphicsLayerCA::setUsesDisplayListDrawing):
        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
        (WebCore::GraphicsLayerCA::platformCALayerPaintContents):
        (WebCore::GraphicsLayerCA::updateDrawsContent):
        (WebCore::GraphicsLayerCA::dumpAdditionalProperties):
        * platform/graphics/ca/GraphicsLayerCA.h:
        * platform/graphics/ca/PlatformCALayer.cpp:
        (WebCore::PlatformCALayer::drawRepaintIndicator):
        * platform/graphics/ca/PlatformCALayerClient.h:
        (WebCore::PlatformCALayerClient::isUsingDisplayListDrawing):
        * platform/graphics/ca/TileGrid.cpp:
        (WebCore::TileGrid::platformCALayerShowRepaintCounter):
        (WebCore::TileGrid::isUsingDisplayListDrawing):
        * platform/graphics/ca/TileGrid.h:
        * platform/graphics/displaylists/DisplayList.h: Sadly need to include DisplayListItems.h
        to get things to compile. I wasn't able to avoid this even when making functions non-inline.
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::createGraphicsLayer):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingFlags):
        * rendering/RenderLayerCompositor.h:

2016-01-09  Zalan Bujtas  <zalan@apple.com>

        REGRESSION (r194426): First email field is not autofilled on amazon.com
        https://bugs.webkit.org/show_bug.cgi?id=152945
        <rdar://problem/24082914>

        Reviewed by Simon Fraser.

        r194426 missed marking the m_layoutRoot for layout while converting to full layout (it only marked the new layout root).

        Test: fast/forms/multiple-subtree-layout-failure.html

        * page/FrameView.cpp:
        (WebCore::FrameView::scheduleRelayoutOfSubtree):

2016-01-09  Dan Bernstein  <mitz@apple.com>

        [Cocoa] Allow overriding the frameworks directory independently of using a staging install path
        https://bugs.webkit.org/show_bug.cgi?id=152926

        Reviewed by Tim Horton.

        Introduce a new build setting, WK_OVERRIDE_FRAMEWORKS_DIR. When not empty, it determines
        where the frameworks are installed. Setting USE_STAGING_INSTALL_PATH to YES sets
        WK_OVERRIDE_FRAMEWORKS_DIR to $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari.

        Account for the possibility of WK_OVERRIDE_FRAMEWORKS_DIR containing spaces.

        * Configurations/WebCore.xcconfig:
        - Replace STAGED_FRAMEWORKS_SEARCH_PATH in FRAMEWORK_SEARCH_PATHS with
          WK_OVERRIDE_FRAMEWORKS_DIR and add quotes to account for spaces.
        - Define WEBCORE_FRAMEWORKS_DIR and PRODUCTION_FRAMEWORKS_DIR based on
          WK_OVERRIDE_FRAMEWORKS_DIR.

        * WebCore.xcodeproj/project.pbxproj: Work around make’s inability to handle spaces in paths
          by creating a symlink to JAVASCRIPTCORE_PRIVATE_HEADERS_DIR under BUILT_PRODUCTS_DIR and
          using the symlink as the value of JavaScriptCore_SCRIPTS_DIR.

2016-01-09  Andreas Kling  <akling@apple.com>

        Use NeverDestroyed instead of DEPRECATED_DEFINE_STATIC_LOCAL
        <https://webkit.org/b/152902>

        Reviewed by Anders Carlsson.

        Mostly mechanical conversion to NeverDestroyed throughout WebCore.

        * Modules/airplay/WebKitPlaybackTargetAvailabilityEvent.cpp:
        (WebCore::stringForPlaybackTargetAvailability):
        * Modules/indexeddb/IDBCursor.cpp:
        (WebCore::IDBCursor::directionNext):
        (WebCore::IDBCursor::directionNextUnique):
        (WebCore::IDBCursor::directionPrev):
        (WebCore::IDBCursor::directionPrevUnique):
        * Modules/indexeddb/IDBTransaction.cpp:
        (WebCore::IDBTransaction::modeReadOnly):
        (WebCore::IDBTransaction::modeReadWrite):
        (WebCore::IDBTransaction::modeVersionChange):
        (WebCore::IDBTransaction::modeReadOnlyLegacy):
        (WebCore::IDBTransaction::modeReadWriteLegacy):
        * Modules/indexeddb/legacy/LegacyRequest.cpp:
        (WebCore::LegacyRequest::readyState):
        * Modules/mediacontrols/MediaControlsHost.cpp:
        (WebCore::MediaControlsHost::automaticKeyword):
        (WebCore::MediaControlsHost::forcedOnlyKeyword):
        (WebCore::MediaControlsHost::alwaysOnKeyword):
        (WebCore::MediaControlsHost::externalDeviceType):
        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::openKeyword):
        (WebCore::MediaSource::closedKeyword):
        (WebCore::MediaSource::endedKeyword):
        (WebCore::MediaSource::streamEndedWithError):
        * Modules/plugins/QuickTimePluginReplacement.mm:
        (WebCore::quickTimePluginReplacementScript):
        (WebCore::QuickTimePluginReplacement::supportsMimeType):
        (WebCore::QuickTimePluginReplacement::supportsFileExtension):
        * Modules/speech/SpeechSynthesis.cpp:
        (WebCore::SpeechSynthesis::boundaryEventOccurred):
        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
        (WebCore::cssPropertyIDForJSCSSPropertyName):
        * bridge/c/c_instance.cpp:
        (JSC::Bindings::globalExceptionString):
        * css/MediaList.cpp:
        (WebCore::addResolutionWarningMessageToConsole):
        * css/StyleSheetContents.cpp:
        (WebCore::StyleSheetContents::parseAuthorStyleSheet):
        * dom/ChildListMutationScope.cpp:
        (WebCore::accumulatorMap):
        * dom/DOMImplementation.cpp:
        (WebCore::isSupportedSVG10Feature):
        (WebCore::isSupportedSVG11Feature):
        * dom/Document.cpp:
        (WebCore::Document::readyState):
        * dom/Element.cpp:
        (WebCore::Element::webkitRegionOverset):
        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::dispatchSimulatedClick):
        * dom/InlineStyleSheetOwner.cpp:
        (WebCore::isValidCSSContentType):
        * dom/MutationObserver.cpp:
        (WebCore::activeMutationObservers):
        (WebCore::suspendedMutationObservers):
        * dom/MutationRecord.cpp:
        * dom/PseudoElement.cpp:
        (WebCore::pseudoElementTagName):
        (WebCore::PseudoElement::pseudoElementNameForEvents):
        * dom/QualifiedName.cpp:
        (WebCore::qualifiedNameCache):
        (WebCore::nullQName):
        * dom/ScriptElement.cpp:
        (WebCore::isLegacySupportedJavaScriptLanguage):
        (WebCore::ScriptElement::notifyFinished):
        * editing/ApplyStyleCommand.cpp:
        (WebCore::styleSpanClassString):
        * editing/MarkupAccumulator.cpp:
        (WebCore::MarkupAccumulator::shouldAddNamespaceElement):
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::isInterchangeNewlineNode):
        (WebCore::isInterchangeConvertedSpaceSpan):
        * editing/htmlediting.cpp:
        (WebCore::nonBreakingSpaceString):
        * editing/markup.cpp:
        (WebCore::StyledMarkupAccumulator::styleNodeCloseTag):
        (WebCore::createMarkupInternal):
        * fileapi/Blob.cpp:
        (WebCore::BlobURLRegistry::registry):
        * html/BaseChooserOnlyDateAndTimeInputType.cpp:
        (WebCore::BaseChooserOnlyDateAndTimeInputType::createShadowSubtree):
        * html/DateInputType.cpp:
        (WebCore::DateInputType::createStepRange):
        * html/DateTimeInputType.cpp:
        (WebCore::DateTimeInputType::createStepRange):
        * html/DateTimeLocalInputType.cpp:
        (WebCore::DateTimeLocalInputType::createStepRange):
        * html/EmailInputType.cpp:
        (WebCore::isValidEmailAddress):
        * html/FormController.cpp:
        (WebCore::FormKeyGenerator::formKey):
        (WebCore::formStateSignature):
        * html/HTMLAnchorElement.cpp:
        (WebCore::rootEditableElementMap):
        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::formControlType):
        * html/HTMLFieldSetElement.cpp:
        (WebCore::HTMLFieldSetElement::formControlType):
        * html/HTMLFrameOwnerElement.h:
        (WebCore::SubframeLoadingDisabler::disabledSubtreeRoots):
        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::formControlType):
        * html/HTMLLinkElement.cpp:
        (WebCore::linkLoadEventSender):
        * html/HTMLMediaElement.cpp:
        (WebCore::documentToElementSetMap):
        * html/HTMLObjectElement.cpp:
        (WebCore::isRecognizedTagName):
        * html/HTMLOptGroupElement.cpp:
        (WebCore::HTMLOptGroupElement::formControlType):
        * html/HTMLOutputElement.cpp:
        (WebCore::HTMLOutputElement::formControlType):
        * html/HTMLPlugInElement.cpp:
        (WebCore::registeredPluginReplacements):
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::titleText):
        (WebCore::subtitleText):
        (WebCore::HTMLPlugInImageElement::partOfSnapshotOverlay):
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::formControlType):
        * html/HTMLStyleElement.cpp:
        (WebCore::styleLoadEventSender):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::formControlType):
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::directionString):
        * html/ImageInputType.cpp:
        (WebCore::ImageInputType::appendFormData):
        * html/InputTypeNames.cpp:
        (WebCore::InputTypeNames::button):
        (WebCore::InputTypeNames::checkbox):
        (WebCore::InputTypeNames::color):
        (WebCore::InputTypeNames::date):
        (WebCore::InputTypeNames::datetime):
        (WebCore::InputTypeNames::datetimelocal):
        (WebCore::InputTypeNames::email):
        (WebCore::InputTypeNames::file):
        (WebCore::InputTypeNames::hidden):
        (WebCore::InputTypeNames::image):
        (WebCore::InputTypeNames::month):
        (WebCore::InputTypeNames::number):
        (WebCore::InputTypeNames::password):
        (WebCore::InputTypeNames::radio):
        (WebCore::InputTypeNames::range):
        (WebCore::InputTypeNames::reset):
        (WebCore::InputTypeNames::search):
        (WebCore::InputTypeNames::submit):
        (WebCore::InputTypeNames::telephone):
        (WebCore::InputTypeNames::text):
        (WebCore::InputTypeNames::time):
        (WebCore::InputTypeNames::url):
        (WebCore::InputTypeNames::week):
        * html/MediaController.cpp:
        (playbackStateWaiting):
        (playbackStatePlaying):
        (playbackStateEnded):
        * html/MonthInputType.cpp:
        (WebCore::MonthInputType::createStepRange):
        * html/NumberInputType.cpp:
        (WebCore::NumberInputType::createStepRange):
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::createStepRange):
        * html/StepRange.cpp:
        (WebCore::StepRange::acceptableError):
        (WebCore::StepRange::alignValueForStep):
        (WebCore::StepRange::stepMismatch):
        * html/TimeInputType.cpp:
        (WebCore::TimeInputType::createStepRange):
        * html/WeekInputType.cpp:
        (WebCore::WeekInputType::createStepRange):
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::getImageData):
        * html/parser/XSSAuditor.cpp:
        (WebCore::XSSAuditor::init):
        (WebCore::XSSAuditor::eraseDangerousAttributesIfInjected):
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlClosedCaptionsTrackListElement::updateDisplay):
        (WebCore::getMediaControlTimeRemainingDisplayElementShadowPseudoId):
        (WebCore::getMediaControlCurrentTimeDisplayElementShadowPseudoId):
        * html/shadow/MeterShadowElement.cpp:
        (WebCore::MeterInnerElement::MeterInnerElement):
        (WebCore::MeterValueElement::valuePseudoId):
        * html/shadow/MeterShadowElement.h:
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::sliderThumbShadowPseudoId):
        (WebCore::mediaSliderThumbShadowPseudoId):
        (WebCore::SliderContainerElement::shadowPseudoId):
        * html/track/AudioTrack.cpp:
        (WebCore::AudioTrack::alternativeKeyword):
        (WebCore::AudioTrack::descriptionKeyword):
        (WebCore::AudioTrack::mainKeyword):
        (WebCore::AudioTrack::mainDescKeyword):
        (WebCore::AudioTrack::translationKeyword):
        (WebCore::AudioTrack::commentaryKeyword):
        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::subtitlesKeyword):
        (WebCore::TextTrack::captionsKeyword):
        (WebCore::TextTrack::descriptionsKeyword):
        (WebCore::TextTrack::chaptersKeyword):
        (WebCore::TextTrack::metadataKeyword):
        (WebCore::TextTrack::forcedKeyword):
        (WebCore::TextTrack::disabledKeyword):
        (WebCore::TextTrack::hiddenKeyword):
        (WebCore::TextTrack::showingKeyword):
        * html/track/TextTrackCue.h:
        (WebCore::TextTrackCue::cueShadowPseudoId):
        * html/track/VTTCue.cpp:
        (WebCore::startKeyword):
        (WebCore::middleKeyword):
        (WebCore::endKeyword):
        (WebCore::leftKeyword):
        (WebCore::rightKeyword):
        (WebCore::verticalGrowingLeftKeyword):
        (WebCore::verticalGrowingRightKeyword):
        (WebCore::VTTCueBox::vttCueBoxShadowPseudoId):
        (WebCore::VTTCue::cueBackdropShadowPseudoId):
        (WebCore::VTTCue::determineTextDirection):
        (WebCore::VTTCue::markFutureAndPastNodes):
        * html/track/VTTRegion.cpp:
        (WebCore::VTTRegion::scroll):
        (WebCore::VTTRegion::setScroll):
        (WebCore::VTTRegion::parseSettingValue):
        (WebCore::VTTRegion::textTrackCueContainerScrollingClass):
        * html/track/VideoTrack.cpp:
        (WebCore::VideoTrack::alternativeKeyword):
        (WebCore::VideoTrack::captionsKeyword):
        (WebCore::VideoTrack::mainKeyword):
        (WebCore::VideoTrack::signKeyword):
        (WebCore::VideoTrack::subtitlesKeyword):
        (WebCore::VideoTrack::commentaryKeyword):
        * html/track/WebVTTElement.cpp:
        (WebCore::nodeTypeToTagName):
        * html/track/WebVTTElement.h:
        * html/track/WebVTTParser.cpp:
        (WebCore::WebVTTParser::collectMetadataHeader):
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::computePseudoClassMask):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::sourceMapURLForResource):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::selectorsFromSource):
        * inspector/PageDebuggerAgent.cpp:
        (WebCore::PageDebuggerAgent::sourceMapURLForScript):
        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::notifyFinished):
        * loader/TextTrackLoader.cpp:
        (WebCore::TextTrackLoader::corsPolicyPreventedLoad):
        * loader/cache/CachedResourceRequest.cpp:
        (WebCore::CachedResourceRequest::initiatorName):
        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::defaultDatabaseFilename):
        * page/CaptionUserPreferences.cpp:
        (WebCore::CaptionUserPreferences::updateCaptionStyleSheetOveride):
        * page/CaptionUserPreferencesMediaAF.cpp:
        (WebCore::CaptionUserPreferencesMediaAF::captionsBackgroundCSS):
        (WebCore::CaptionUserPreferencesMediaAF::captionsTextEdgeCSS):
        * page/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirectiveList::allowJavaScriptURLs):
        (WebCore::CSPDirectiveList::allowInlineEventHandlers):
        (WebCore::CSPDirectiveList::allowInlineScript):
        (WebCore::CSPDirectiveList::allowInlineStyle):
        (WebCore::CSPDirectiveList::allowEval):
        (WebCore::ContentSecurityPolicy::reportUnsupportedDirective):
        * page/DOMWindow.cpp:
        (WebCore::windowsWithUnloadEventListeners):
        (WebCore::windowsWithBeforeUnloadEventListeners):
        * page/EventHandler.cpp:
        (WebCore::EventHandler::dragState):
        (WebCore::focusDirectionForKey):
        * page/Frame.cpp:
        (WebCore::createRegExpForLabels):
        * page/NavigatorBase.cpp:
        (WebCore::NavigatorBase::platform):
        * page/PageVisibilityState.cpp:
        (WebCore::pageVisibilityStateString):
        * page/SecurityPolicy.cpp:
        (WebCore::originAccessMap):
        * page/UserContentURLPattern.cpp:
        (WebCore::UserContentURLPattern::parse):
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::shadowForBlending):
        * page/animation/CompositeAnimation.cpp:
        (WebCore::CompositeAnimation::updateKeyframeAnimations):
        * platform/Cursor.cpp:
        (WebCore::pointerCursor):
        (WebCore::crossCursor):
        (WebCore::handCursor):
        (WebCore::moveCursor):
        (WebCore::verticalTextCursor):
        (WebCore::cellCursor):
        (WebCore::contextMenuCursor):
        (WebCore::aliasCursor):
        (WebCore::zoomInCursor):
        (WebCore::zoomOutCursor):
        (WebCore::copyCursor):
        (WebCore::noneCursor):
        (WebCore::progressCursor):
        (WebCore::noDropCursor):
        (WebCore::notAllowedCursor):
        (WebCore::iBeamCursor):
        (WebCore::waitCursor):
        (WebCore::helpCursor):
        (WebCore::eastResizeCursor):
        (WebCore::northResizeCursor):
        (WebCore::northEastResizeCursor):
        (WebCore::northWestResizeCursor):
        (WebCore::southResizeCursor):
        (WebCore::southEastResizeCursor):
        (WebCore::southWestResizeCursor):
        (WebCore::westResizeCursor):
        (WebCore::northSouthResizeCursor):
        (WebCore::eastWestResizeCursor):
        (WebCore::northEastSouthWestResizeCursor):
        (WebCore::northWestSouthEastResizeCursor):
        (WebCore::columnResizeCursor):
        (WebCore::rowResizeCursor):
        (WebCore::middlePanningCursor):
        (WebCore::eastPanningCursor):
        (WebCore::northPanningCursor):
        (WebCore::northEastPanningCursor):
        (WebCore::northWestPanningCursor):
        (WebCore::southPanningCursor):
        (WebCore::southEastPanningCursor):
        (WebCore::southWestPanningCursor):
        (WebCore::westPanningCursor):
        (WebCore::grabCursor):
        (WebCore::grabbingCursor):
        * platform/Language.cpp:
        (WebCore::preferredLanguagesOverride):
        * platform/LocalizedStrings.cpp:
        (WebCore::truncatedStringForLookupMenuItem):
        * platform/MIMETypeRegistry.cpp:
        (WebCore::mediaMIMETypeMap):
        (WebCore::defaultMIMEType):
        * platform/SchemeRegistry.cpp:
        (WebCore::localURLSchemes):
        (WebCore::displayIsolatedURLSchemes):
        (WebCore::secureSchemes):
        (WebCore::schemesWithUniqueOrigins):
        (WebCore::emptyDocumentSchemes):
        (WebCore::schemesForbiddenFromDomainRelaxation):
        (WebCore::canDisplayOnlyIfCanRequestSchemes):
        (WebCore::notAllowingJavascriptURLsSchemes):
        (WebCore::schemesAllowingLocalStorageAccessInPrivateBrowsing):
        (WebCore::schemesAllowingDatabaseAccessInPrivateBrowsing):
        (WebCore::CORSEnabledSchemes):
        (WebCore::ContentSecurityPolicyBypassingSchemes):
        * platform/ScrollbarTheme.cpp:
        (WebCore::ScrollbarTheme::theme):
        * platform/URL.cpp:
        (WebCore::blankURL):
        * platform/animation/Animation.cpp:
        (WebCore::Animation::initialName):
        * platform/audio/AudioSession.cpp:
        (WebCore::AudioSession::sharedSession):
        * platform/audio/AudioSession.h:
        * platform/audio/HRTFElevation.cpp:
        (WebCore::getConcatenatedImpulseResponsesForSubject):
        * platform/audio/ios/AudioDestinationIOS.cpp:
        (WebCore::audioDestinations):
        * platform/graphics/GraphicsLayer.cpp:
        (WebCore::repaintRectMap):
        * platform/graphics/ImageBuffer.cpp:
        (WebCore::ImageBuffer::transformColorSpace):
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::applicationOctetStream):
        (WebCore::textPlain):
        (WebCore::codecs):
        * platform/graphics/ShadowBlur.cpp:
        (WebCore::ScratchBuffer::singleton):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::playerToPrivateMap):
        * platform/graphics/filters/SourceAlpha.cpp:
        (WebCore::SourceAlpha::effectName):
        * platform/graphics/filters/SourceGraphic.cpp:
        (WebCore::SourceGraphic::effectName):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::mimeCommonTypesCache):
        (WebCore::mimeModernTypesCache):
        * platform/ios/CursorIOS.cpp:
        (WebCore::cursor):
        * platform/ios/TileControllerMemoryHandlerIOS.cpp:
        (WebCore::tileControllerMemoryHandler):
        * platform/ios/WebCoreMotionManager.mm:
        (+[WebCoreMotionManager sharedManager]):
        * platform/ios/WebVideoFullscreenModelVideoElement.mm:
        (WebVideoFullscreenModelVideoElement::updateForEventName):
        * platform/ios/wak/WKContentObservation.cpp:
        (WebThreadGetObservedContentModifiers):
        * platform/mac/DragImageMac.mm:
        (WebCore::fontFromNSFont):
        * platform/mac/ThemeMac.mm:
        (WebCore::platformTheme):
        * platform/mac/ThreadCheck.mm:
        (WebCoreReportThreadViolation):
        * platform/mediastream/mac/AVCaptureDeviceManager.h:
        * platform/mediastream/mac/AVCaptureDeviceManager.mm:
        (WebCore::AVCaptureDeviceManager::singleton):
        * platform/mediastream/mac/RealtimeMediaSourceCenterMac.cpp:
        (WebCore::RealtimeMediaSourceCenter::platformCenter):
        * platform/mock/mediasource/MockBox.cpp:
        (WebCore::MockTrackBox::type):
        (WebCore::MockInitializationBox::type):
        (WebCore::MockSampleBox::type):
        * platform/network/HTTPParsers.cpp:
        (WebCore::parseXSSProtectionHeader):
        * platform/network/ResourceHandle.cpp:
        (WebCore::builtinResourceHandleConstructorMap):
        (WebCore::builtinResourceHandleSynchronousLoaderMap):
        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::allowsAnyHTTPSCertificateHosts):
        (WebCore::clientCerts):
        * platform/text/AtomicStringKeyedMRUCache.h:
        (WebCore::AtomicStringKeyedMRUCache::get):
        * platform/text/cf/HyphenationCF.cpp:
        (WebCore::cfLocaleCache):
        * rendering/RenderBlock.cpp:
        (WebCore::continuationOutlineTable):
        * rendering/RenderCounter.cpp:
        (WebCore::counterMaps):
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::drawPlatformResizerImage):
        * rendering/RenderScrollbarTheme.cpp:
        (WebCore::RenderScrollbarTheme::renderScrollbarTheme):
        * rendering/RenderTheme.cpp:
        (WebCore::customFocusRingColor):
        * rendering/RenderWidget.cpp:
        (WebCore::WidgetHierarchyUpdatesSuspensionScope::widgetNewParentMap):
        * rendering/shapes/ShapeOutsideInfo.h:
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::hyphenString):
        (WebCore::RenderStyle::textEmphasisMarkString):
        (WebCore::RenderStyle::initialDashboardRegions):
        (WebCore::RenderStyle::noneDashboardRegions):
        * rendering/style/RenderStyle.h:
        * rendering/svg/RenderSVGPath.cpp:
        (WebCore::RenderSVGPath::zeroLengthLinecapPath):
        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::nonScalingStrokePath):
        * rendering/svg/SVGRenderingContext.cpp:
        (WebCore::currentContentTransformation):
        * rendering/svg/SVGResources.cpp:
        (WebCore::clipperFilterMaskerTags):
        (WebCore::markerTags):
        (WebCore::fillAndStrokeTags):
        (WebCore::chainableResourceTags):
        * svg/SVGAngle.cpp:
        (WebCore::SVGAngle::valueAsString):
        * svg/SVGAnimateColorElement.cpp:
        (WebCore::attributeValueIsCurrentColor):
        * svg/SVGAnimateMotionElement.cpp:
        (WebCore::SVGAnimateMotionElement::rotateMode):
        * svg/SVGAnimationElement.cpp:
        (WebCore::SVGAnimationElement::setCalcMode):
        (WebCore::SVGAnimationElement::setAttributeType):
        (WebCore::SVGAnimationElement::isAdditive):
        (WebCore::SVGAnimationElement::isAccumulated):
        (WebCore::inheritsFromProperty):
        * svg/SVGFEConvolveMatrixElement.cpp:
        (WebCore::SVGFEConvolveMatrixElement::kernelUnitLengthXIdentifier):
        (WebCore::SVGFEConvolveMatrixElement::kernelUnitLengthYIdentifier):
        (WebCore::SVGFEConvolveMatrixElement::orderXIdentifier):
        (WebCore::SVGFEConvolveMatrixElement::orderYIdentifier):
        * svg/SVGFEDiffuseLightingElement.cpp:
        (WebCore::SVGFEDiffuseLightingElement::kernelUnitLengthXIdentifier):
        (WebCore::SVGFEDiffuseLightingElement::kernelUnitLengthYIdentifier):
        * svg/SVGFEDropShadowElement.cpp:
        (WebCore::SVGFEDropShadowElement::stdDeviationXIdentifier):
        (WebCore::SVGFEDropShadowElement::stdDeviationYIdentifier):
        * svg/SVGFEGaussianBlurElement.cpp:
        (WebCore::SVGFEGaussianBlurElement::stdDeviationXIdentifier):
        (WebCore::SVGFEGaussianBlurElement::stdDeviationYIdentifier):
        * svg/SVGFEMorphologyElement.cpp:
        (WebCore::SVGFEMorphologyElement::radiusXIdentifier):
        (WebCore::SVGFEMorphologyElement::radiusYIdentifier):
        * svg/SVGFESpecularLightingElement.cpp:
        (WebCore::SVGFESpecularLightingElement::kernelUnitLengthXIdentifier):
        (WebCore::SVGFESpecularLightingElement::kernelUnitLengthYIdentifier):
        * svg/SVGFETurbulenceElement.cpp:
        (WebCore::SVGFETurbulenceElement::baseFrequencyXIdentifier):
        (WebCore::SVGFETurbulenceElement::baseFrequencyYIdentifier):
        * svg/SVGFilterElement.cpp:
        (WebCore::SVGFilterElement::filterResXIdentifier):
        (WebCore::SVGFilterElement::filterResYIdentifier):
        * svg/SVGGlyphMap.h:
        (WebCore::SVGGlyphMap::svgGlyphForGlyph):
        * svg/SVGLangSpace.cpp:
        (WebCore::SVGLangSpace::xmlspace):
        (WebCore::SVGLangSpace::addSupportedAttributes):
        * svg/SVGMarkerElement.cpp:
        (WebCore::SVGMarkerElement::orientTypeIdentifier):
        (WebCore::SVGMarkerElement::orientAngleIdentifier):
        (WebCore::SVGMarkerElement::synchronizeOrientType):
        * svg/SVGStyleElement.cpp:
        (WebCore::SVGStyleElement::type):
        (WebCore::SVGStyleElement::media):
        * svg/SVGTransform.cpp:
        (WebCore::SVGTransform::transformTypePrefixForParsing):
        * svg/SVGViewSpec.cpp:
        (WebCore::SVGViewSpec::viewBoxIdentifier):
        (WebCore::SVGViewSpec::preserveAspectRatioIdentifier):
        (WebCore::SVGViewSpec::transformIdentifier):
        * svg/animation/SVGSMILElement.cpp:
        (WebCore::SVGSMILElement::parseClockValue):
        (WebCore::SVGSMILElement::isSupportedAttribute):
        (WebCore::SVGSMILElement::restart):
        (WebCore::SVGSMILElement::fill):
        (WebCore::SVGSMILElement::repeatCount):
        (WebCore::SVGSMILElement::notifyDependentsIntervalChanged):

2016-01-08  Zalan Bujtas  <zalan@apple.com>

        Absolute positioning -webkit-search-cancel-button crashes Safari.
        https://bugs.webkit.org/show_bug.cgi?id=152847
        <rdar://problem/24112087>

        Reviewed by Simon Fraser.

        Do not call offsetFromContainer while resolving the painting position for the search/cancel button renderer.
        It skips the static positioned parent input renderer, when the search/cancel renderer is absolute positioned.
        This patch also fixes a rendering glitch when the margin-right is > 0.

        Test: fast/forms/absolute-positioned-custom-search-cancel-crash.html

        * rendering/RenderTheme.h:
        (WebCore::RenderTheme::paintSearchFieldCancelButton):
        (WebCore::RenderTheme::paintSearchFieldResultsDecorationPart):
        (WebCore::RenderTheme::paintSearchFieldResultsButton):
        * rendering/RenderThemeMac.h:
        * rendering/RenderThemeMac.mm:
        (WebCore::convertToPaintingPosition):
        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
        (WebCore::RenderThemeMac::paintSearchFieldResultsDecorationPart):
        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
        (WebCore::RenderThemeMac::convertToPaintingRect): Deleted.

2016-01-08  Simon Fraser  <simon.fraser@apple.com>

        Add display-list drawing hooks to platform-specific GraphicsContext files
        https://bugs.webkit.org/show_bug.cgi?id=152940

        Reviewed by Zalan Bujtas.

        Call into the display list recorder for top-level entrypoints implemented in platform-specific
        files.
        
        The convention is that if a function begins with "platform", it's not a top-level
        entry point, and should only be called when there's a platform context (i.e. not
        recording, and not paintingDisabled).
        
        A few instances are stubbed out until we have a more complete display list implementation.

        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::drawText):
        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::getCTM):
        (WebCore::GraphicsContext::savePlatformState):
        (WebCore::GraphicsContext::restorePlatformState):
        (WebCore::GraphicsContext::drawRect):
        (WebCore::GraphicsContext::drawNativeImage):
        (WebCore::GraphicsContext::drawLine):
        (WebCore::GraphicsContext::drawEllipse):
        (WebCore::GraphicsContext::drawConvexPolygon):
        (WebCore::GraphicsContext::clipConvexPolygon):
        (WebCore::GraphicsContext::fillPath):
        (WebCore::GraphicsContext::strokePath):
        (WebCore::GraphicsContext::fillRect):
        (WebCore::GraphicsContext::clip):
        (WebCore::GraphicsContext::clipPath):
        (WebCore::GraphicsContext::clipBounds):
        (WebCore::GraphicsContext::drawLinesForText):
        (WebCore::GraphicsContext::roundToDevicePixels):
        (WebCore::GraphicsContext::translate):
        (WebCore::GraphicsContext::setPlatformStrokeThickness):
        (WebCore::GraphicsContext::setPlatformStrokeStyle):
        (WebCore::GraphicsContext::concatCTM):
        (WebCore::GraphicsContext::setCTM):
        (WebCore::GraphicsContext::beginPlatformTransparencyLayer):
        (WebCore::GraphicsContext::endPlatformTransparencyLayer):
        (WebCore::GraphicsContext::clearRect):
        (WebCore::GraphicsContext::strokeRect):
        (WebCore::GraphicsContext::setLineCap):
        (WebCore::GraphicsContext::setLineDash):
        (WebCore::GraphicsContext::setLineJoin):
        (WebCore::GraphicsContext::clipOut):
        (WebCore::GraphicsContext::rotate):
        (WebCore::GraphicsContext::scale):
        (WebCore::GraphicsContext::platformFillRoundedRect):
        (WebCore::GraphicsContext::fillRectWithRoundedHole):
        (WebCore::GraphicsContext::drawPattern):
        (WebCore::GraphicsContext::setPlatformShouldAntialias):
        (WebCore::GraphicsContext::setPlatformImageInterpolationQuality):
        (WebCore::GraphicsContext::isAcceleratedContext):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::savePlatformState):
        (WebCore::GraphicsContext::restorePlatformState):
        (WebCore::GraphicsContext::drawNativeImage):
        (WebCore::GraphicsContext::drawPattern):
        (WebCore::GraphicsContext::drawRect):
        (WebCore::GraphicsContext::drawLine):
        (WebCore::GraphicsContext::drawEllipse):
        (WebCore::GraphicsContext::drawConvexPolygon):
        (WebCore::GraphicsContext::clipConvexPolygon):
        (WebCore::GraphicsContext::applyStrokePattern):
        (WebCore::GraphicsContext::applyFillPattern):
        (WebCore::GraphicsContext::drawPath):
        (WebCore::GraphicsContext::fillPath):
        (WebCore::GraphicsContext::strokePath):
        (WebCore::GraphicsContext::fillRect):
        (WebCore::GraphicsContext::platformFillRoundedRect):
        (WebCore::GraphicsContext::fillRectWithRoundedHole):
        (WebCore::GraphicsContext::clip):
        (WebCore::GraphicsContext::clipOut):
        (WebCore::GraphicsContext::clipPath):
        (WebCore::GraphicsContext::clipBounds):
        (WebCore::GraphicsContext::beginPlatformTransparencyLayer):
        (WebCore::GraphicsContext::endPlatformTransparencyLayer):
        (WebCore::GraphicsContext::setPlatformShadow):
        (WebCore::GraphicsContext::setMiterLimit):
        (WebCore::GraphicsContext::clearRect):
        (WebCore::GraphicsContext::strokeRect):
        (WebCore::GraphicsContext::setLineCap):
        (WebCore::GraphicsContext::setLineDash):
        (WebCore::GraphicsContext::setLineJoin):
        (WebCore::GraphicsContext::scale):
        (WebCore::GraphicsContext::rotate):
        (WebCore::GraphicsContext::translate):
        (WebCore::GraphicsContext::concatCTM):
        (WebCore::GraphicsContext::setCTM):
        (WebCore::GraphicsContext::getCTM):
        (WebCore::GraphicsContext::roundToDevicePixels):
        (WebCore::GraphicsContext::drawLinesForText):
        (WebCore::GraphicsContext::setURLForRect):
        (WebCore::GraphicsContext::setIsCALayerContext):
        (WebCore::GraphicsContext::isCALayerContext):
        (WebCore::GraphicsContext::setIsAcceleratedContext):
        (WebCore::GraphicsContext::isAcceleratedContext):
        (WebCore::GraphicsContext::setPlatformTextDrawingMode):
        (WebCore::GraphicsContext::setPlatformStrokeColor):
        (WebCore::GraphicsContext::setPlatformStrokeThickness):
        (WebCore::GraphicsContext::setPlatformFillColor):
        (WebCore::GraphicsContext::setPlatformShouldAntialias):
        (WebCore::GraphicsContext::setPlatformShouldSmoothFonts):
        (WebCore::GraphicsContext::setPlatformAlpha):
        (WebCore::GraphicsContext::setPlatformCompositeOperation):
        (WebCore::GraphicsContext::platformApplyDeviceScaleFactor):
        (WebCore::GraphicsContext::platformFillEllipse):
        (WebCore::GraphicsContext::platformStrokeEllipse):

2016-01-08  Simon Fraser  <simon.fraser@apple.com>

        Add DisplayList hooks into GraphicsContext
        https://bugs.webkit.org/show_bug.cgi?id=152932

        Reviewed by Zalan Bujtas.

        Add the hooks into GraphicsContext that call into the DisplayListRecorder if there
        is one.
        
        Rename size() to something less ambiguous.
        
        Out-of-line some DisplayList functions so that the header doesn't need to see
        DisplayListItems.h.

        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::save):
        (WebCore::GraphicsContext::restore):
        (WebCore::GraphicsContext::setStrokeThickness):
        (WebCore::GraphicsContext::setStrokeStyle):
        (WebCore::GraphicsContext::setStrokeColor):
        (WebCore::GraphicsContext::setShadow):
        (WebCore::GraphicsContext::setLegacyShadow):
        (WebCore::GraphicsContext::clearShadow):
        (WebCore::GraphicsContext::setFillColor):
        (WebCore::GraphicsContext::setShadowsIgnoreTransforms):
        (WebCore::GraphicsContext::setShouldAntialias):
        (WebCore::GraphicsContext::setShouldSmoothFonts):
        (WebCore::GraphicsContext::setShouldSubpixelQuantizeFonts):
        (WebCore::GraphicsContext::setImageInterpolationQuality):
        (WebCore::GraphicsContext::setAntialiasedFontDilationEnabled):
        (WebCore::GraphicsContext::setStrokePattern):
        (WebCore::GraphicsContext::setFillPattern):
        (WebCore::GraphicsContext::setStrokeGradient):
        (WebCore::GraphicsContext::setFillRule):
        (WebCore::GraphicsContext::setFillGradient):
        (WebCore::GraphicsContext::beginTransparencyLayer):
        (WebCore::GraphicsContext::endTransparencyLayer):
        (WebCore::GraphicsContext::drawGlyphs):
        (WebCore::GraphicsContext::drawImage):
        (WebCore::GraphicsContext::drawTiledImage):
        (WebCore::GraphicsContext::setTextDrawingMode):
        (WebCore::GraphicsContext::fillRect):
        (WebCore::GraphicsContext::fillRoundedRect):
        (WebCore::GraphicsContext::setAlpha):
        (WebCore::GraphicsContext::setCompositeOperation):
        (WebCore::GraphicsContext::setDrawLuminanceMask):
        (WebCore::GraphicsContext::applyDeviceScaleFactor):
        (WebCore::GraphicsContext::applyState):
        * platform/graphics/GraphicsContext.h:
        (WebCore::GraphicsContext::setDisplayListRecorder):
        (WebCore::GraphicsContext::isRecording):
        (WebCore::GraphicsContext::setFillRule): Deleted.
        (WebCore::GraphicsContext::setShadowsIgnoreTransforms): Deleted.
        (WebCore::GraphicsContext::setShouldSubpixelQuantizeFonts): Deleted.
        (WebCore::GraphicsContext::setDrawLuminanceMask): Deleted.
        * platform/graphics/displaylists/DisplayList.cpp:
        (WebCore::DisplayList::DisplayList::clear):
        (WebCore::DisplayList::DisplayList::removeItemsFromIndex):
        * platform/graphics/displaylists/DisplayList.h:
        (WebCore::DisplayList::DisplayList::itemCount):
        (WebCore::DisplayList::DisplayList::clear): Deleted.
        (WebCore::DisplayList::DisplayList::size): Deleted.
        (WebCore::DisplayList::DisplayList::removeItemsFromIndex): Deleted.
        * platform/graphics/displaylists/DisplayListRecorder.cpp:
        (WebCore::DisplayList::Recorder::save):
        (WebCore::DisplayList::Recorder::restore):
        * platform/graphics/displaylists/DisplayListRecorder.h:
        (WebCore::DisplayList::Recorder::itemCount):
        (WebCore::DisplayList::Recorder::size): Deleted.
        * platform/graphics/displaylists/DisplayListReplayer.cpp:
        (WebCore::DisplayList::Replayer::replay):

2016-01-08  Brady Eidson  <beidson@apple.com>

        Modern IDB: imported/w3c/indexeddb/keyorder.htm times out.
        https://bugs.webkit.org/show_bug.cgi?id=152929

        Reviewed by Alex Christensen.

        No new tests (Existing test now runs in the test harness).

        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::setGetResult):

2016-01-08  Simon Fraser  <simon.fraser@apple.com>

        Consider painting to be disabled on a GraphicsContext with no platform data, and make updatingControlTints() immutable state
        https://bugs.webkit.org/show_bug.cgi?id=152927

        Reviewed by Tim Horton.

        GraphicsContext had setters for paintingDisabled and updatingControlTints, but neither
        were changed dynamically.
        
        We can eliminate paintingDisabled by simply considering a GraphicsContext that was
        created with no platform context to be paint-disabled.
        
        We make updatingControlTints immutable state by providing a constructor that takes
        a "NonPaintingReasons" enum, and doesn't create platform data.
        
        More functions in platform code were protected by if (paintingDisabled())...

        * page/FrameView.cpp:
        (WebCore::FrameView::paintControlTints):
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::GraphicsContext):
        (WebCore::GraphicsContext::fillRoundedRect):
        (WebCore::GraphicsContext::setUpdatingControlTints): Deleted.
        (WebCore::GraphicsContext::clip): Deleted.
        * platform/graphics/GraphicsContext.h:
        (WebCore::GraphicsContext::paintingDisabled):
        (WebCore::GraphicsContext::updatingControlTints):
        (WebCore::GraphicsContextState::GraphicsContextState): Deleted.
        (WebCore::GraphicsContext::setPaintingDisabled): Deleted.
        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::GraphicsContext):
        (WebCore::GraphicsContext::platformInit):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::platformInit):
        (WebCore::GraphicsContext::savePlatformState):
        (WebCore::GraphicsContext::restorePlatformState):
        (WebCore::GraphicsContext::drawNativeImage):
        (WebCore::GraphicsContext::drawPattern):
        (WebCore::GraphicsContext::drawRect):
        (WebCore::GraphicsContext::applyStrokePattern):
        (WebCore::GraphicsContext::applyFillPattern):
        (WebCore::GraphicsContext::clip):
        (WebCore::GraphicsContext::clipBounds):
        (WebCore::GraphicsContext::setLineDash):
        (WebCore::GraphicsContext::roundToDevicePixels):
        (WebCore::GraphicsContext::setPlatformImageInterpolationQuality):
        (WebCore::GraphicsContext::setIsCALayerContext):
        (WebCore::GraphicsContext::isCALayerContext):
        (WebCore::GraphicsContext::setIsAcceleratedContext):
        (WebCore::GraphicsContext::isAcceleratedContext):
        (WebCore::GraphicsContext::platformApplyDeviceScaleFactor):
        * platform/graphics/win/GraphicsContextCGWin.cpp:
        (WebCore::GraphicsContext::platformInit):
        (WebCore::GraphicsContext::GraphicsContext): Deleted.
        * platform/graphics/win/GraphicsContextCairoWin.cpp:
        (WebCore::GraphicsContext::platformInit):
        (WebCore::GraphicsContext::GraphicsContext): Deleted.

2016-01-08  Anders Carlsson  <andersca@apple.com>

        InputType::findClosestTickMarkValue should return an Optional<Decimal>
        https://bugs.webkit.org/show_bug.cgi?id=152931

        Reviewed by Andreas Kling.

        This will make it possible to get rid of the notion of infinity from Decimal, allowing for more code simplification.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::findClosestTickMarkValue):
        * html/HTMLInputElement.h:
        * html/InputType.cpp:
        (WebCore::InputType::findClosestTickMarkValue):
        * html/InputType.h:
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::findClosestTickMarkValue):
        * html/RangeInputType.h:
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::setPositionFromPoint):

2016-01-08  Brady Eidson  <beidson@apple.com>

        Modern IDB: IDBBindingUtilities chokes on unicode strings for get/set.
        https://bugs.webkit.org/show_bug.cgi?id=152921

        Reviewed by Alex Christensen.

        No new tests (Covered by existing tests).

        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::get): Don't do a potentially lossy utf8() conversion on the string.
        (WebCore::set): Ditto.

2016-01-08  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo] Support more video formats.
        https://bugs.webkit.org/show_bug.cgi?id=152890

        Reviewed by Alex Christensen.

        Use MediaFoundation api to detect all supported video/audio formats.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::getSupportedTypes):
        (WebCore::MediaPlayerPrivateMediaFoundation::supportsType):

2016-01-08  Brady Eidson  <beidson@apple.com>

        Modern IDB: Blocked event can fire on a delete request even after the last open connection has closed.
        https://bugs.webkit.org/show_bug.cgi?id=152896

        Reviewed by Alex Christensen.

        No new tests (Progression in many tests).

        * Modules/indexeddb/client/IDBFactoryImpl.cpp:
        (WebCore::IDBClient::IDBFactory::deleteDatabase):
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation): Allow for handling 2+ delete operations in a row.
        (WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore): Ditto.
        (WebCore::IDBServer::UniqueIDBDatabase::connectionClosedFromClient): Call "notifyCurrentRequestConnectionClosedOrFiredVersionChangeEvent"
          after the connection is actually removed from the set of open connections.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2016-01-08  Zalan Bujtas  <zalan@apple.com>

        Hovering link on http://help.apple.com/appletv/#/ does not show text underline.
        https://bugs.webkit.org/show_bug.cgi?id=152906
        <rdar://problem/23339617>

        Reviewed by Simon Fraser.

        GraphicsContext::computeLineBoundsAndAntialiasingModeForText() always integral ceils the origin y position to offset underline text.
        This additional visual overflow offset is not taken into account by visualOverflowForDecorations().
        Unfortunately we can't compute the exact same offset value while collecting repaint rects, because
        computeLineBoundsAndAntialiasingModeForText() uses CTM scaling before adjusting the offset position.
        Use 1px (css) bottom offset to cover this underling overflow.

        Test: fast/css3-text/css3-text-decoration/text-underline-position/underline-visual-overflow-with-subpixel-position.html

        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::computeLineBoundsAndAntialiasingModeForText):
        * rendering/SimpleLineLayoutResolver.cpp: Add visual overflow to simple line layout.
        (WebCore::SimpleLineLayout::RunResolver::Run::rect):
        (WebCore::SimpleLineLayout::RunResolver::RunResolver):
        * rendering/SimpleLineLayoutResolver.h:
        * style/InlineTextBoxStyle.cpp:
        (WebCore::visualOverflowForDecorations):

2016-01-08  Brady Eidson  <beidson@apple.com>

        Modern IDB: imported/w3c/indexeddb/idbobjectstore_createIndex6-event_order.htm fails.
        https://bugs.webkit.org/show_bug.cgi?id=152891

        Reviewed by Alex Christensen.

        No new tests (At least two failing tests now pass).

        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::dispatchEvent): Whenever we add the IDBTransaction as an event target,
          also add the IDBDatabase.

2016-01-07  Antti Koivisto  <antti@apple.com>

        Enable selector filtering for shadow trees
        https://bugs.webkit.org/show_bug.cgi?id=152831

        Reviewed by Simon Fraser.

        Selector filtering doesn't currently work in shadow trees making style resolve for them slow.
        This is because SelectorFilter is not in "consistent" state.

        This patch moves SelectorFilter ownership from StyleResolver to TreeResolver and guarantees
        it is always upadated consistently. It eliminates a bunch of now unnecessary consistency checks
        and special cases.

        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::ElementRuleCollector):

            Assert for consistency instead of testing for it.

        (WebCore::ElementRuleCollector::matchedResult):
        (WebCore::ElementRuleCollector::collectMatchingRulesForList):

            Selector filter can now be used if it exists.

        * css/ElementRuleCollector.h:
        (WebCore::ElementRuleCollector::ElementRuleCollector): Deleted.
        * css/RuleSet.cpp:
        (WebCore::RuleSet::addRule):

            Disable selector filtering for custom shadow pseudo rules. They are resolved by shadow DOM resolver
            but may contain components matching the normal DOM.

        * css/RuleSet.h:
        (WebCore::RuleData::descendantSelectorIdentifierHashes):
        (WebCore::RuleData::disableSelectorFiltering):
        (WebCore::RuleData::compilationStatus):
        (WebCore::RuleData::compiledSelectorCodeRef):
        * css/SelectorFilter.cpp:
        (WebCore::collectElementIdentifierHashes):
        (WebCore::SelectorFilter::parentStackIsConsistent):

            New consistency conditions. This is now used for asserts only.

        (WebCore::SelectorFilter::pushParentStackFrame):
        (WebCore::SelectorFilter::popParentStackFrame):

            Selector filter only filters the current tree context, replace parentOrShadowHostElement with parentElement.

        (WebCore::SelectorFilter::setupParentStack): Deleted.

            No longer needed.

        (WebCore::SelectorFilter::pushParent):

            Remove consistency check. These cases no longer happen.

        * css/SelectorFilter.h:
        (WebCore::SelectorFilter::popParent):
        (WebCore::SelectorFilter::parentStackIsEmpty):
        (WebCore::SelectorFilter::fastRejectSelector):
        (WebCore::SelectorFilter::parentStackIsConsistent): Deleted.
        * css/StyleInvalidationAnalysis.cpp:
        (WebCore::StyleInvalidationAnalysis::invalidateIfNeeded):
        (WebCore::StyleInvalidationAnalysis::invalidateStyle):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::appendAuthorStyleSheets):
        (WebCore::StyleResolver::addKeyframeStyle):
        (WebCore::StyleResolver::initElement):
        (WebCore::StyleResolver::State::initForStyleResolve):

            We no longer owner the selector filter. Move it to State.

        (WebCore::StyleResolver::styleSharingCandidateMatchesRuleSet):
        (WebCore::isAtShadowBoundary):
        (WebCore::StyleResolver::styleForElement):
        (WebCore::StyleResolver::pseudoStyleForElement):
        (WebCore::StyleResolver::pseudoStyleRulesForElement):
        (WebCore::StyleResolver::pushParentElement): Deleted.
        (WebCore::StyleResolver::popParentElement): Deleted.

            No need for this logic.

        * css/StyleResolver.h:
        (WebCore::StyleResolver::ruleSets):
        (WebCore::StyleResolver::mediaQueryEvaluator):
        (WebCore::StyleResolver::State::document):
        (WebCore::StyleResolver::State::setAuthorRollback):
        (WebCore::StyleResolver::State::setUserRollback):
        (WebCore::StyleResolver::State::selectorFilter):
        (WebCore::StyleResolver::state):
        (WebCore::checkRegionSelector):
        (WebCore::StyleResolver::selectorFilter): Deleted.
        (WebCore::StyleResolverParentPusher::StyleResolverParentPusher): Deleted.
        (WebCore::StyleResolverParentPusher::push): Deleted.
        (WebCore::StyleResolverParentPusher::~StyleResolverParentPusher): Deleted.
        * style/StyleTreeResolver.cpp:

            This now owns the selector filter for a tree context.

        (WebCore::Style::SelectorFilterPusher::SelectorFilterPusher):
        (WebCore::Style::SelectorFilterPusher::push):
        (WebCore::Style::SelectorFilterPusher::~SelectorFilterPusher):
        (WebCore::Style::TreeResolver::TreeResolver):
        (WebCore::Style::TreeResolver::styleForElement):
        (WebCore::Style::TreeResolver::createRenderTreeForSlotAssignees):
        (WebCore::Style::TreeResolver::createRenderTreeRecursively):
        (WebCore::Style::TreeResolver::resolveChildren):
        (WebCore::Style::TreeResolver::resolveRecursively):

            Push the filter in a few more places to keep it consistent in shadow trees.

        * style/StyleTreeResolver.h:

2016-01-07  Zalan Bujtas  <zalan@apple.com>

        Move computeLineBoundsForText from GraphicsContext* to GraphicsContext.
        https://bugs.webkit.org/show_bug.cgi?id=152882

        Reviewed by Simon Fraser.

        There is nothing platform specific about it.

        No change in functionality.

        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::computeUnderlineBoundsForText): Rename to reflect its usage.
        * platform/graphics/GraphicsContext.h:
        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::computeLineBoundsForText): Deleted.
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::drawLinesForText):
        (WebCore::GraphicsContext::computeLineBoundsForText): Deleted.
        * rendering/TextDecorationPainter.cpp:
        (WebCore::drawSkipInkUnderline):

2016-01-07  Brady Eidson  <beidson@apple.com>

        Modern IDB: Success-after-open event should only have the IDBOpenDBRequest as its target.
        https://bugs.webkit.org/show_bug.cgi?id=152875

        Reviewed by Alex Christensen.

        No new tests (At least 2 failing tests now pass).

        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::fireSuccessAfterVersionChangeCommit):

        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::dispatchEvent): Only add the transaction and database as potential
          targets for this event if it is *not* the success-after-open event.
        * Modules/indexeddb/client/IDBRequestImpl.h:

2016-01-07  Brent Fulgham  <bfulgham@apple.com>

        Correct missing EXT_sRGB Format Handling
        https://bugs.webkit.org/show_bug.cgi?id=152876
        <rdar://problem/23284389>

        Reviewed by Alex Christensen.

        Tested by WebGL 1.0.4 suite.

        * platform/graphics/GraphicsContext3D.cpp:
        (getDataFormat): Handle missing SRGB and SRGB_ALPHA cases.
        * platform/graphics/GraphicsContext3D.h: Add missing SRGB_ALPHA value from the Khronos standard.
        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
        (WebCore::GraphicsContext3D::texImage2D): Add an assertion that we are not being handed
        an internal format to a method that works with normal formats.

2016-01-07  Simon Fraser  <simon.fraser@apple.com>

        Use an appropriate buffer format for swipe snapshots
        https://bugs.webkit.org/show_bug.cgi?id=152880
        rdar://problem/23728299

        Reviewed by Tim Horton.

        Choose an appropriate buffer format for swipe snapshots, and avoid converting
        them to YUV422.

        * platform/graphics/cocoa/IOSurface.h:
        * platform/graphics/cocoa/IOSurface.mm:
        (IOSurface::allowConversionFromFormatToFormat):

2016-01-07  Jer Noble  <jer.noble@apple.com>

        [EME] Secure stop information not written to disk
        https://bugs.webkit.org/show_bug.cgi?id=152855

        Reviewed by Eric Carlson.

        Two separate bugs for the two APIs provided by AVFoundation. For the AVStreamSession path,
        we were not calling the lazy-creation function which creates the AVStreamSession, and were
        rather accessing the ivar directly. For the AVContentKeySession, we were not creating the
        intermediate paths containing the secure stop database.

        * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm:
        (WebCore::CDMSessionAVContentKeySession::contentKeySession):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setCDMSession):

2016-01-07  Zalan Bujtas  <zalan@apple.com>

        Use wavy offset for decoration painting when line style is TextDecorationStyleWavy.
        https://bugs.webkit.org/show_bug.cgi?id=152856

        Reviewed by Simon Fraser.

        No change in functionality.

        * rendering/TextDecorationPainter.cpp:
        (WebCore::TextDecorationPainter::paintTextDecoration):

2016-01-07  Brady Eidson  <beidson@apple.com>

        Modern IDB: Various imported/w3c/indexeddb tests fail due to expecting the wrong exception.
        https://bugs.webkit.org/show_bug.cgi?id=152866

        Reviewed by Alex Christensen.

        No new tests (5 skipped tests now pass).

        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::putOrAdd): Reorder the exceptions, violating the spec but matching
          a vast majority of browsers.
        (WebCore::IDBClient::IDBObjectStore::deleteFunction): Ditto.
        (WebCore::IDBClient::IDBObjectStore::clear): Ditto.
        (WebCore::IDBClient::IDBObjectStore::doCount): Ditto.

2016-01-07  Zalan Bujtas  <zalan@apple.com>

        Remove unused shouldAntialias parameter from GraphicsContext::computeLineBoundsAndAntialiasingModeForText()
        https://bugs.webkit.org/show_bug.cgi?id=152859

        Reviewed by Simon Fraser.

        No change in functionality.

        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::computeLineBoundsAndAntialiasingModeForText):
        * platform/graphics/GraphicsContext.h:
        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::computeLineBoundsForText):
        (WebCore::GraphicsContext::drawLinesForText):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::computeLineBoundsForText):
        (WebCore::GraphicsContext::drawLinesForText):

2016-01-07  Brady Eidson  <beidson@apple.com>

        Modern IDB: imported/w3c/indexeddb/idbcursor-continue.htm fails.
        https://bugs.webkit.org/show_bug.cgi?id=152849

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/server/MemoryIndexCursor.cpp:
        (WebCore::IDBServer::MemoryIndexCursor::iterate): Don't allow returning an iterator outside of
          the cursor's assigned range.

2016-01-07  Zalan Bujtas  <zalan@apple.com>

        Incorrect position: fixed; rendering when child of position:relative/sticky.
        https://bugs.webkit.org/show_bug.cgi?id=147284

        Reviewed by Simon Fraser and David Hyatt.

        Computing logical left for positioned objects should take the relative positioned ancestors' offset
        into account.

        Tests: fast/block/positioning/fixed-container-with-relative-parent.html
               fast/block/positioning/fixed-container-with-sticky-parent.html

        * rendering/RenderBox.cpp:
        (WebCore::computeInlineStaticDistance):

2016-01-06  Simon Fraser  <simon.fraser@apple.com>

        Initial implementation files for display-list recording and playback
        https://bugs.webkit.org/show_bug.cgi?id=152816

        Reviewed by Zalan Bujtas.

        Add files for:
        - DisplayList, a class that holds a vector of display items, and in the future will hold metadata
          on the list for optimizations etc.
        - DisplayList::Recorder, the outward-facing recording API which GraphicsContext will
          call into.
        - DisplayList::Replayer, which plays back a DisplayList, possibly applying optimizations.
        - Various DisplayList::Items, one type for each display list operation. They cover most of the
          GraphicsContext functionality, other than clipping to an image buffer. Text drawing is stubbed
          out for now.

        Added a "DisplayLists" log channel.

        Added GraphicsContextState functions for tracking state deltas with change bits. It may
        make sense to combine GraphicsContextStateChange and GraphicsContextState, and use the
        dirty bits in non-display-list drawing as well.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/Logging.h:
        * platform/graphics/GraphicsContext.h:
        * platform/graphics/displaylists/DisplayList.cpp: Added.
        (WebCore::DisplayList::DisplayList::description):
        (WebCore::DisplayList::DisplayList::dump):
        (WebCore::operator<<):
        * platform/graphics/displaylists/DisplayListItems.cpp: Added.
        * platform/graphics/displaylists/DisplayListItems.h: Added.
        * platform/graphics/displaylists/DisplayListRecorder.cpp: Added.
        * platform/graphics/displaylists/DisplayListRecorder.h: Added.
        * platform/graphics/displaylists/DisplayListReplayer.cpp: Added.
        (WebCore::DisplayList::Replayer::Replayer):
        (WebCore::DisplayList::Replayer::~Replayer):
        (WebCore::DisplayList::Replayer::replay):
        * platform/graphics/displaylists/DisplayListReplayer.h: Added.

2016-01-07  Chris Dumez  <cdumez@apple.com>

        Directly-composited animated GIFs never resume once scrolled offscreen
        https://bugs.webkit.org/show_bug.cgi?id=152817
        <rdar://problem/19982020>

        Reviewed by Daniel Bates.

        Directly-composited animated GIFs would never resume once scrolled
        offscreen. This is because calling repaint() in this case would not
        cause BitmapImage::draw() to be called and the animation would thus
        not be resumed. To address the problem,
        repaintForPausedImageAnimationsIfNeeded() now calls
        RenderBoxModelObject::contentChanged(ImageChanged) in addition to
        repaint() to make sure the animation actually gets resumed, even in
        the directly-composited animated GIF case.

        Test: fast/images/composited-animated-gif-outside-viewport.html

        * platform/graphics/BitmapImage.h:
        Make currentFrame() public so it can be exposed via Internals for the
        purpose of testing.

        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::repaintForPausedImageAnimationsIfNeeded):
        Call RenderBoxModelObject::contentChanged(ImageChanged) in addition to
        calling repaint() to make sure the animation actually gets resumed in
        the directly-composited animated GIFs case.

        * testing/Internals.cpp:
        (WebCore::Internals::imageFrameIndex):
        * testing/Internals.h:
        * testing/Internals.idl:
        Expose new "unsigned long imageFrameIndex(Element)" operation on
        Internals so layout tests can better check if an image is actually
        animating. Previously, we would rely on the output of
        internals.hasPausedImageAnimations(Element) but this is not sufficient
        to cover this bug as our rendering code believed it has resumed the
        animations but the GIF was not actually animating due to it being
        directly-composited.

2016-01-07  Michael Catanzaro  <mcatanzaro@igalia.com>

        [SOUP] Consider reducing max simultaneous connections
        https://bugs.webkit.org/show_bug.cgi?id=137282

        Reviewed by Carlos Garcia Campos.

        Reduce max simultaneous connections from 35 to 17, because (a) all major browsers except
        Chrome use 17, and (b) Chrome uses 10. The only reason we previously used 35 was that other
        browsers were using 35 at the time.

        * platform/network/soup/SoupNetworkSession.cpp:
        (WebCore::SoupNetworkSession::SoupNetworkSession):

2016-01-06  Antti Koivisto  <antti@apple.com>

        Factor free standing tree style resolve functions into a class
        https://bugs.webkit.org/show_bug.cgi?id=152786

        Reviewed by Simon Fraser.

        Factor the free standing tree style resolve functions into a class that can keep state.
        Style::TreeResolver instances resolve a single tree scope. It is instantiated for resolving
        the document style and then recursively for each encountered shadow tree.

        This will enable new features and optimizations later.

        * dom/Document.cpp:
        (WebCore::Document::recalcStyle):

            Move the root style computation code back to Document. It fits better here and avoid some
            awkwardness with style resolver construction order.

        * style/StyleResolveTree.cpp:
        (WebCore::Style::TreeResolver::TreeResolver):

            TreeResolver knows the current tree context and the StyleResolver to use for it.
            Switch the functions to use these instead of recomputing them repeatedly.

        (WebCore::Style::shouldCreateRenderer):
        (WebCore::Style::TreeResolver::styleForElement):
        (WebCore::Style::moveToFlowThreadIfNeeded):
        (WebCore::Style::TreeResolver::createRenderer):
        (WebCore::Style::updateTextRendererAfterContentChange):
        (WebCore::Style::TreeResolver::createRenderTreeForChildren):
        (WebCore::Style::TreeResolver::createRenderTreeForShadowRoot):
        (WebCore::Style::needsPseudoElement):
        (WebCore::Style::TreeResolver::createRenderTreeForBeforeOrAfterPseudoElement):
        (WebCore::Style::TreeResolver::createRenderTreeForSlotAssignees):
        (WebCore::Style::TreeResolver::createRenderTreeRecursively):

            Rename to reduce the use of confusing "attach" terminology.

        (WebCore::Style::pseudoStyleCacheIsInvalid):
        (WebCore::Style::TreeResolver::resolveLocally):
        (WebCore::Style::resolveTextNode):
        (WebCore::Style::TreeResolver::resolveChildAtShadowBoundary):
        (WebCore::Style::TreeResolver::resolveShadowTree):
        (WebCore::Style::TreeResolver::resolveBeforeOrAfterPseudoElement):
        (WebCore::Style::TreeResolver::resolveChildren):
        (WebCore::Style::TreeResolver::resolveSlotAssignees):
        (WebCore::Style::TreeResolver::resolveRecursively):
        (WebCore::Style::TreeResolver::resolve):
        (WebCore::Style::detachRenderTree):
        (WebCore::Style::styleForElement): Deleted.
        (WebCore::Style::createRendererIfNeeded): Deleted.
        (WebCore::Style::attachChildren): Deleted.
        (WebCore::Style::attachShadowRoot): Deleted.
        (WebCore::Style::attachBeforeOrAfterPseudoElementIfNeeded): Deleted.
        (WebCore::Style::attachSlotAssignees): Deleted.
        (WebCore::Style::attachRenderTree): Deleted.
        (WebCore::Style::resolveLocal): Deleted.
        (WebCore::Style::resolveChildAtShadowBoundary): Deleted.
        (WebCore::Style::resolveShadowTree): Deleted.
        (WebCore::Style::updateBeforeOrAfterPseudoElement): Deleted.
        (WebCore::Style::resolveChildren): Deleted.
        (WebCore::Style::resolveSlotAssignees): Deleted.
        (WebCore::Style::resolveTree): Deleted.
        * style/StyleResolveTree.h:

2016-01-07  Doug Russell  <d_russell@apple.com>

        AX: AXObjectCacheMac is passing WebCore enum values directly to VoiceOver
        https://bugs.webkit.org/show_bug.cgi?id=151755

        Reviewed by Chris Fleizach.

        No new tests, covered by existing tests.

        * accessibility/mac/AXObjectCacheMac.mm:
        (platformChangeTypeForWebCoreChangeType):
        (platformEditTypeForWebCoreEditType):
        (platformDirectionForWebCoreDirection):
        (platformGranularityForWebCoreGranularity):
        (WebCore::AXObjectCache::postTextStateChangePlatformNotification):
        (WebCore::textReplacementChangeDictionary):
        (WebCore::AXObjectCache::postTextReplacementPlatformNotification):

2016-01-06  Brady Eidson  <beidson@apple.com>

        Modern IDB: Fix up IDBDatabaseIdentifier hash issues.
        https://bugs.webkit.org/show_bug.cgi?id=152822

        Reviewed by Alex Christensen.

        No new tests (No explicitly testable behavior change, existing tests pass, flakiness will be reduced).

        * Modules/indexeddb/IDBDatabaseIdentifier.h:
        (WebCore::IDBDatabaseIdentifier::IDBDatabaseIdentifier):
        (WebCore::IDBDatabaseIdentifier::isEmpty):
        (WebCore::IDBDatabaseIdentifierHashTraits::isEmptyValue):
        * page/SecurityOriginData.h:

2016-01-06  Simon Fraser  <simon.fraser@apple.com>

        Sort the project file.

        * WebCore.xcodeproj/project.pbxproj:

2016-01-06  Simon Fraser  <simon.fraser@apple.com>

        Add a setting and preferences to enable display-list drawing. Does nothing yet.
        https://bugs.webkit.org/show_bug.cgi?id=152807

        Reviewed by Zalan Bujtas.

        Setting for display-list drawing.

        * page/Settings.in:

2016-01-06  Eric Carlson  <eric.carlson@apple.com>

        AirPlay route availability event not always sent
        https://bugs.webkit.org/show_bug.cgi?id=152802

        Reviewed by Jer Noble.

        Test: media/airplay-target-availability.html

        * Modules/mediasession/WebMediaSessionManager.cpp:
        (WebCore::mediaProducerStateString): Log the new flags.
        (WebCore::WebMediaSessionManager::clientStateDidChange): Schedule a client reconfiguration if
          the 'requires monitoring', 'has listener', or 'has audio or video' flags have changed.
        (WebCore::WebMediaSessionManager::configurePlaybackTargetMonitoring): Start monitoring if
          at least one client has a listener and at least one has audio/video.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaState): Set new flags.
        * html/HTMLMediaElement.h:

        * page/MediaProducer.h: Define new flags. Add new state enum.

        * platform/graphics/MediaPlaybackTargetContext.h: Initial state is "Unknown".

        * platform/mock/MediaPlaybackTargetMock.h:
        * platform/mock/MediaPlaybackTargetPickerMock.cpp:
        (WebCore::MediaPlaybackTargetPickerMock::externalOutputDeviceAvailable): Enums not bitfields.
        (WebCore::MediaPlaybackTargetPickerMock::startingMonitoringPlaybackTargets): Ditto. Don't make
          device change callback if the device state is "Unknown".
        (WebCore::MediaPlaybackTargetPickerMock::setState): Ditto.
        * platform/mock/MediaPlaybackTargetPickerMock.h:

        * testing/Internals.cpp:
        (WebCore::Internals::setMockMediaPlaybackTargetPickerState): Support new state.

2016-01-06  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/odd-strings.html is flaky.
        https://bugs.webkit.org/show_bug.cgi?id=152800

        Reviewed by Alex Christensen.

        No new tests (Existing flaky test is now rock solid and unskipped).

        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::IDBDatabase):
        (WebCore::IDBClient::IDBDatabase::maybeCloseInServer): Only refuse to close in the server if there
          are active transactions. In the case of page navigation where stop() has been called on active DOM objects,
          there will never be any active transactions.
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::commitTransaction):

2016-01-06  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/intversion-gated-on-delete.html is flaky.
        https://bugs.webkit.org/show_bug.cgi?id=152795

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        Change the HashSet of open connection into a ListHashSet.
        
        This enforces a reliable order of event delivery, which this test relies on, 
        and which seems better in general.

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::connectionClosedFromClient):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2016-01-06  Simon Fraser  <simon.fraser@apple.com>

        [iOS] Revert overflow:hidden on the body affecting viewport scale (r186786)
        https://bugs.webkit.org/show_bug.cgi?id=152803
        rdar://problem/22242515

        Reviewed by Tim Horton.

        You can't assume that if an author uses overflow:hidden on the body, they have no
        content outside the body that is important. Sites like Google Translate put
        abspos elements outside the body.
        
        So revert the change.

        * page/FrameView.cpp:
        (WebCore::FrameView::contentsSizeRespectingOverflow): Deleted.
        * page/FrameView.h:

2016-01-06  Brent Fulgham  <bfulgham@apple.com>

        Port blocking bypass issue using 307 redirect
        https://bugs.webkit.org/show_bug.cgi?id=152801
        <rdar://problem/24048554>

        Reviewed by Anders Carlsson.

        Tested by http/tests/security/blocked-on-redirect.html.

        Make sure that 307 redirects check the requested URL via 'portAllowed'. 

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::willSendRequest): Confirm that the requested port
        is valid, and block load if it is not.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::reportBlockedPortFailed): Added.
        (WebCore::FrameLoader::blockedError): Added.
        * loader/FrameLoader.h:

2016-01-06  Myles C. Maxfield  <mmaxfield@apple.com>

        [Cocoa] Tiny cleanup in FontPlatformData::ctFont()
        https://bugs.webkit.org/show_bug.cgi?id=152793

        Reviewed by Zalan Bujtas.

        No new tests because there is no behavior change.

        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore::FontPlatformData::ctFont):

2016-01-06  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/transaction-scope-sequencing.html fails
        https://bugs.webkit.org/show_bug.cgi?id=152775

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes, plus changes to another existing test).
        
        Any transaction enqueued after a read-write transaction whose scope overlaps with
        that read-write transaction cannot run until after that read-write transaction runs.
        
        Additionally, read-only transactions were actually sometimes running even though their scopes
        overlapped with a running read-write transaction.
        
        This patch fixes both of those issues.
    
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::operationAndTransactionTimerFired):
        (WebCore::IDBServer::UniqueIDBDatabase::takeNextRunnableTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::inProgressTransactionCompleted):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2016-01-06  Zalan Bujtas  <zalan@apple.com>

        Float with media query positioned incorrectly after window resize.
        https://bugs.webkit.org/show_bug.cgi?id=152558

        Reviewed by Simon Fraser and David Hyatt.

        This patch ensures that when a renderer becomes floated, it is moved
        to the right containing block.
        When this floated renderer's previous sibling is an anonymous block, it needs
        to be reparented so that the float is positioned as if there was no anonymous block at all.

        Test: fast/block/float/float-with-anonymous-previous-sibling.html

        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::styleDidChange):

2016-01-06  Zalan Bujtas  <zalan@apple.com>

        isAnonymousInlineBlock() should exclude any ruby content.
        https://bugs.webkit.org/show_bug.cgi?id=152648
        <rdar://problem/23872549>

        Reviewed by David Hyatt.

        isAnonymousInlineBlock is designed for the new Block-Inside-Inline Model
        and all other anonymous inline-block renderers (including Ruby) should bail out of it.
        (see webkit.org/b/143145)

        Test: fast/ruby/ruby-inline-margin-collapse-crash.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::isAnonymousInlineBlock):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::isAnonymousInlineBlock): Deleted.

2016-01-05  Zalan Bujtas  <zalan@apple.com>

        showRenderTree: add inline-block/inline/block column.
        https://bugs.webkit.org/show_bug.cgi?id=152771

        Reviewed by Simon Fraser.

        The name of the renderer (RenderBlock etc) does not always reflect the associated display type.

        No change in functionality.

        * rendering/RenderObject.cpp:
        (WebCore::showRenderTreeLegend):
        (WebCore::RenderObject::showRenderObject):

2016-01-05  Simon Fraser  <simon.fraser@apple.com>

        Move ImageBuffer::clip() code into GraphicsContext
        https://bugs.webkit.org/show_bug.cgi?id=152769

        Reviewed by Zalan Bujtas.

        For CG, GraphicsContext had clipToNativeImage(PassNativeImagePtr...), which
        was ugly and platform-specific.
        
        Fix by moving code from ImageBuffer::clip() for CG and Cairo into the platform-specific
        GraphicsContext implementations. This required some minor refactoring of scaleSizeToUserSpace()
        in ImageBufferCG.

        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::clipToImageBuffer): Deleted.
        * platform/graphics/ImageBuffer.cpp:
        (WebCore::ImageBuffer::sizeForDestinationSize):
        * platform/graphics/ImageBuffer.h:
        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::clipToImageBuffer):
        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBuffer::clip): Deleted.
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::clipToImageBuffer):
        (WebCore::GraphicsContext::clipToNativeImage): Deleted.
        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::ImageBuffer::ImageBuffer):
        (WebCore::ImageBuffer::sizeForDestinationSize):
        (WebCore::ImageBuffer::putByteArray):
        (WebCore::ImageBuffer::toDataURL):
        (WebCore::ImageBuffer::clip): Deleted.

2016-01-05  Simon Fraser  <simon.fraser@apple.com>

        Remove GraphicsContext::drawJoinedLines()
        https://bugs.webkit.org/show_bug.cgi?id=152764

        Reviewed by Zalan Bujtas.

        GraphicsContext::drawJoinedLines() was only used by iOS form-control drawing
        and polluted GraphicsContext with platform-specific types.

        Rewrite RenderThemeIOS::paintCheckboxDecorations() to use the CGContextRef directly.

        * platform/graphics/GraphicsContext.h:
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::drawJoinedLines): Deleted.
        * rendering/RenderThemeIOS.mm:
        (WebCore::drawJoinedLines):
        (WebCore::RenderThemeIOS::paintCheckboxDecorations):

2016-01-05  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/structured-clone.html crashes.
        https://bugs.webkit.org/show_bug.cgi?id=152763

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).
        
        A lot of SerializedScriptValue code incorrectly assumed the global object is a JSDOMGlobalObject,
        which doesn't have to be true for native Javascript types like typed arrays.
        
        Fixing that fixes the test.

        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::putOrAdd): If serializing the script value caused an exception,
          clear that exception and return a better IDB specific exception.

        * bindings/js/JSDOMBinding.h:
        (WebCore::toJS): Add a ArrayBufferView specialization for toJS that skips the need for a JSDOMGlobalObject.
        
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneDeserializer::readArrayBufferView): Call toJS directly instead of getJSValue, which 
          incorrectly assumes the existence of a JSDOMGlobalObject (vs a JSGlobalObject)
        (WebCore::CloneDeserializer::readTerminal): Instead of getJSValue, call JSArrayBuffer::create directly.

2016-01-05  Pranjal Jumde  <pjumde@apple.com>

        Image should not be re-registered if m_form already exists. This leads to an assertion failure.
        https://bugs.webkit.org/show_bug.cgi?id=152741
        <rdar://problem/24030778>

        Reviewed by Brent Fulgham.

        * Source/WebCore/html/HTMLImageElement.cpp:
          Node::InsertionNotificationRequest HTMLImageElement::insertedInto(ContainerNode& insertionPoint)

2016-01-05  Simon Fraser  <simon.fraser@apple.com>

        Adjust tile coverage with margin tiles, and tidy up the indicator
        https://bugs.webkit.org/show_bug.cgi?id=152742

        Reviewed by Beth Dakin.

        The tile coverage rect was unfeasibly large when margin tiles are present, and
        could be bigger than the layer itself, making the indicator look odd.

        Fix by improving the logic in TileController::adjustTileCoverageRect(): this
        now first extends the visible rect for scrolling, and then constrains it
        within the bounds with margin padding. It also unites with the passed-in
        coverageRect, ensuring that we don't lose information about overhang for
        margin tile coverage.

        Second, update the tiled scrolling indicator when the visible rect changes,
        and coalesce the map updates on a timer.

        * platform/graphics/TiledBacking.h:
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::adjustCoverageRect):
        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::setVisibleRect):
        (WebCore::TileController::setTiledScrollingIndicatorPosition):
        (WebCore::expandRectWithinRect):
        (WebCore::TileController::adjustTileCoverageRect):
        (WebCore::TileController::updateTileCoverageMap):
        (WebCore::TileController::computeTileCoverageRect): Deleted.
        * platform/graphics/ca/TileController.h:
        * platform/graphics/ca/TileCoverageMap.cpp:
        (WebCore::TileCoverageMap::TileCoverageMap):
        (WebCore::TileCoverageMap::setNeedsUpdate):
        (WebCore::TileCoverageMap::updateTimerFired):
        * platform/graphics/ca/TileCoverageMap.h:

2016-01-05  Antti Koivisto  <antti@apple.com>

        Remove selector filter update calls from Element child parsing callbacks
        https://bugs.webkit.org/show_bug.cgi?id=152749

        Reviewed by Andreas Kling.

        We haven't done style resolve during parsing for a while now. These calls do nothing useful.

        * dom/Element.cpp:
        (WebCore::Element::beginParsingChildren):
        (WebCore::Element::finishParsingChildren):

2016-01-05  Brady Eidson  <beidson@apple.com>

        Modern IDB: Error message updates for two failing tests.
        https://bugs.webkit.org/show_bug.cgi?id=152735

        Reviewed by Alex Christensen.

        No new tests (Covered by existing tests).

        Add error messages for various operations on deleted objects.
        
        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::update):
        (WebCore::IDBClient::IDBCursor::advance):
        (WebCore::IDBClient::IDBCursor::continueFunction):
        (WebCore::IDBClient::IDBCursor::deleteFunction):
        
        * Modules/indexeddb/client/IDBIndexImpl.cpp:
        (WebCore::IDBClient::IDBIndex::openCursor):
        (WebCore::IDBClient::IDBIndex::doCount):
        (WebCore::IDBClient::IDBIndex::openKeyCursor):
        (WebCore::IDBClient::IDBIndex::doGet):
        (WebCore::IDBClient::IDBIndex::doGetKey):
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::openCursor):
        (WebCore::IDBClient::IDBObjectStore::get):
        (WebCore::IDBClient::IDBObjectStore::putOrAdd):
        (WebCore::IDBClient::IDBObjectStore::deleteFunction):
        (WebCore::IDBClient::IDBObjectStore::clear):
        (WebCore::IDBClient::IDBObjectStore::createIndex):
        (WebCore::IDBClient::IDBObjectStore::index):
        (WebCore::IDBClient::IDBObjectStore::deleteIndex):
        (WebCore::IDBClient::IDBObjectStore::doCount):

        * bindings/js/JSIDBObjectStoreCustom.cpp:
        (WebCore::JSIDBObjectStore::createIndex):

2016-01-05  Eric Carlson  <eric.carlson@apple.com>

        Avoid NULL deference in Page::updateIsPlayingMedia
        https://bugs.webkit.org/show_bug.cgi?id=152732

        No new tests, this fixes a rare crash that I am unable to reproduce.

        Reviewed by David Kilzer.

        * page/Page.cpp:
        (WebCore::Page::updateIsPlayingMedia): frame->document() can return NULL.

2016-01-05  Brady Eidson  <beidson@apple.com>

        Modern IDB: Transactions from a previous page can leak forward to the next.
        https://bugs.webkit.org/show_bug.cgi?id=152698

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/transactions-stop-on-navigation.html

        This patch is mostly about actually implementing IDBDatabase::stop and IDBTransaction::stop.
        Most of the rest of the scattered changes are about cleaning up now-incorrect ASSERTs.

        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::close):
        (WebCore::IDBClient::IDBDatabase::maybeCloseInServer):
        (WebCore::IDBClient::IDBDatabase::stop):
        (WebCore::IDBClient::IDBDatabase::startVersionChangeTransaction):
        (WebCore::IDBClient::IDBDatabase::didAbortTransaction):
        * Modules/indexeddb/client/IDBDatabaseImpl.h:
        
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::requestCompleted):
        
        * Modules/indexeddb/client/IDBRequestImpl.h:
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::IDBTransaction):
        (WebCore::IDBClient::IDBTransaction::stop):
        (WebCore::IDBClient::IDBTransaction::abortOnServerAndCancelRequests):
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformAbortTransaction):

2016-01-05  Zan Dobersek  <zdobersek@igalia.com>

        Unreviewed. Attempting to fix the AppleWin build after r194577.

        Add the ClipStack.cpp build target alongside the TextureMapperGL.cpp
        one, since both include GraphicsContext3D.h and ANGLEWebKitBridge.h
        indirectly, the latter requiring specific include flags.

        * CMakeLists.txt:
        * PlatformEfl.cmake:
        * PlatformGTK.cmake:
        * PlatformWinCairo.cmake:

2016-01-05  Antti Koivisto  <antti@apple.com>

        Move StyleChange enum into a separate file
        https://bugs.webkit.org/show_bug.cgi?id=152730

        Reviewed by Andreas Kling.

        Fewer whole-world rebuilds.

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/CharacterData.cpp:
        * dom/ContainerNode.cpp:
        * dom/Document.cpp:
        * dom/Document.h:
        * dom/Element.cpp:
        * dom/Element.h:
        * style/StyleChange.h: Added.
        * style/StyleResolveTree.cpp:
        (WebCore::Style::shouldCreateRenderer):
        (WebCore::Style::determineChange): Deleted.
        * style/StyleResolveTree.h:

2016-01-04  Zan Dobersek  <zdobersek@igalia.com>

        [PerformanceTiming] Don't expose the restrictedKeyMap() HashMap
        https://bugs.webkit.org/show_bug.cgi?id=147366

        Reviewed by Sam Weinig.

        Instead of the callers looking up in the HashMap that's returned by restrictedKeyMap(),
        keep the HashMap local in the static restrictedMarkFunction(). This function accepts
        a String reference and performs the lookup, returning the pointer to a PerformanceTiming
        method that corresponds to the passed-in mark or returns nullptr otherwise.

        The HashMap is now wrapped in a NeverDestroyed object and is populated when the first
        mark function is looked for.

        * page/PerformanceUserTiming.cpp:
        (WebCore::UserTiming::mark):
        (WebCore::UserTiming::findExistingMarkStartTime):

2016-01-04  Zan Dobersek  <zdobersek@igalia.com>

        [TextureMapper] Move ClipStack into its own file
        https://bugs.webkit.org/show_bug.cgi?id=152661

        Reviewed by Michael Catanzaro.

        Move TextureMapperGL::ClipStack into its own file and clean it up a bit.
        Move ClipState under the ClipStack class, and simply name it State.

        Move the ClipState methods into a more sensible order. Remove the inline
        specifiers, these aren't really needed for the methods defined in the header.
        apply() and applyIfNeeded() now accept a reference to the GraphicsContext3D
        object, not a pointer.

        Turn YAxisMode enum into an enum class, update the uses to properly specify
        the scope of the enum value.

        Reorder the ClipStack member variables into a more efficient order.

        No new tests -- no change in behavior.

        * CMakeLists.txt:
        * platform/graphics/texmap/BitmapTextureGL.cpp:
        (WebCore::BitmapTextureGL::clearIfNeeded):
        (WebCore::BitmapTextureGL::bindAsSurface):
        * platform/graphics/texmap/BitmapTextureGL.h:
        (WebCore::BitmapTextureGL::clipStack):
        * platform/graphics/texmap/ClipStack.cpp: Added.
        (WebCore::ClipStack::push):
        (WebCore::ClipStack::pop):
        (WebCore::ClipStack::reset):
        (WebCore::ClipStack::intersect):
        (WebCore::ClipStack::setStencilIndex):
        (WebCore::ClipStack::apply):
        (WebCore::ClipStack::applyIfNeeded):
        * platform/graphics/texmap/ClipStack.h: Added.
        (WebCore::ClipStack::State::State):
        (WebCore::ClipStack::current):
        (WebCore::ClipStack::getStencilIndex):
        (WebCore::ClipStack::isCurrentScissorBoxEmpty):
        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::clipStack):
        (WebCore::TextureMapperGL::beginPainting):
        (WebCore::TextureMapperGL::bindDefaultSurface):
        (WebCore::TextureMapperGL::beginScissorClip):
        (WebCore::TextureMapperGL::beginClip):
        (WebCore::TextureMapperGL::endClip):
        (WebCore::TextureMapperGL::ClipStack::reset): Deleted.
        (WebCore::TextureMapperGL::ClipStack::intersect): Deleted.
        (WebCore::TextureMapperGL::ClipStack::setStencilIndex): Deleted.
        (WebCore::TextureMapperGL::ClipStack::push): Deleted.
        (WebCore::TextureMapperGL::ClipStack::pop): Deleted.
        (WebCore::TextureMapperGL::ClipStack::apply): Deleted.
        (WebCore::TextureMapperGL::ClipStack::applyIfNeeded): Deleted.
        * platform/graphics/texmap/TextureMapperGL.h:
        (WebCore::TextureMapperGL::ClipState::ClipState): Deleted.
        (WebCore::TextureMapperGL::ClipStack::ClipStack): Deleted.
        (WebCore::TextureMapperGL::ClipStack::current): Deleted.
        (WebCore::TextureMapperGL::ClipStack::getStencilIndex): Deleted.
        (WebCore::TextureMapperGL::ClipStack::isCurrentScissorBoxEmpty): Deleted.

2016-01-04  Zan Dobersek  <zdobersek@igalia.com>

        Shave off a TransformationMatrix copy if RenderLayer's transparencyClipBox()
        https://bugs.webkit.org/show_bug.cgi?id=152119

        Reviewed by Simon Fraser.

        * rendering/RenderLayer.cpp:
        (WebCore::transparencyClipBox): Multiply the transformation matrix returned by
        layer.transform() directly into the transform object, instead of first
        multiplying them and then copying the result back into the transform object.

2016-01-04  Myles C. Maxfield  <mmaxfield@apple.com>

        TextBreakIterator uses an internal implementation detail of NSLocale
        https://bugs.webkit.org/show_bug.cgi?id=152715
        <rdar://problem/23775121>

        Reviewed by Tim Horton.

        Instead of directly querying AppleLanguages, we should use [NSLocale preferredLanguages].

        No new tests because there is no behavior change.

        * platform/text/mac/TextBreakIteratorInternalICUMac.mm:
        (WebCore::topLanguagePreference):

2016-01-04  Joseph Pecoraro  <pecoraro@apple.com>

        JSCustomXPathNSResolver::lookupNamespaceURI Console Message should render with a column number
        https://bugs.webkit.org/show_bug.cgi?id=114312

        Reviewed by Brent Fulgham.

        * bindings/js/JSCustomXPathNSResolver.cpp:
        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI): Deleted.
        This now behaves as expected.

2016-01-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: Memory indexes aren't deleted when their owning memory object stores are deleted.
        https://bugs.webkit.org/show_bug.cgi?id=152717

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/memory-index-not-deleted-with-objectstore.html

        * Modules/indexeddb/server/MemoryBackingStoreTransaction.cpp:
        (WebCore::IDBServer::MemoryBackingStoreTransaction::objectStoreDeleted):
        * Modules/indexeddb/server/MemoryObjectStore.cpp:
        (WebCore::IDBServer::MemoryObjectStore::deleteAllIndexes):
        * Modules/indexeddb/server/MemoryObjectStore.h:

2016-01-04  Tim Horton  <timothy_horton@apple.com>

        Turn on gesture events when building for Yosemite
        https://bugs.webkit.org/show_bug.cgi?id=152704
        rdar://problem/24042472

        Reviewed by Anders Carlsson.

        * Configurations/FeatureDefines.xcconfig:

2016-01-04  Sergio Villar Senin  <svillar@igalia.com>

        REGRESSION(r194143): Float width incorrectly calculated on Wikipedia
        https://bugs.webkit.org/show_bug.cgi?id=152644

        Reviewed by Myles C. Maxfield.

        The min/max-content contribution computation for non replaced
        blocks changed in r194143. The implementation was actually
        more complex than it should be and actually incomplete as it
        was not considering the case of out of flow elements (because
        it was directly calling computeLogicalWidthInRegion()).

        This new implementation simplifies a lot the code and makes it
        more complete as it relies on min|maxPreferredLogicalWidth()
        calls which already consider all the different types of boxes.

        Test: fast/css-intrinsic-dimensions/inlinesize-contribution-floats.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeBlockPreferredLogicalWidths):

2016-01-04  David Hyatt  <hyatt@apple.com>

        word-wrap: break-word broken inside a flexbox
        https://bugs.webkit.org/show_bug.cgi?id=152321

        Reviewed by Simon Fraser.

        Added fast/text/word-break-on-flexbox-child.html

        * rendering/RenderText.cpp:
        (WebCore::RenderText::computePreferredLogicalWidths):

        At some point word-wrap:break-word was mapped to CSS overflow-wrap, but the code
        in RenderText was never updated to use the breakWords() RenderStyle function that
        checks overflow-wrap's value.

        This means all uses of word-wrap:break-word were broken when measuring the
        intrinsic width of a RenderText.

2016-01-04  John Wilander  <wilander@apple.com>

        webkitGetUserMedia built-in should use @then and not then
        https://bugs.webkit.org/show_bug.cgi?id=152296

        Reviewed by Brent Fulgham.

        Test: streams/webkitGetUserMedia-shadowing-then.html

        * Modules/mediastream/NavigatorUserMedia.js:
        (webkitGetUserMedia): Modified to use @then syntax.

2016-01-04  Myles C. Maxfield  <mmaxfield@apple.com>

        Post-commit update for r193484.
        https://bugs.webkit.org/show_bug.cgi?id=151884

        Unreviwed.

        The same null check needs to be applied in fontHasVerticalGlyphs() as well.

        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::fontHasVerticalGlyphs):

2016-01-04  David Hyatt  <hyatt@apple.com>

        Video/audio-related cleanup after changes to the source element for picture support.
        https://bugs.webkit.org/show_bug.cgi?id=152090

        Reviewed by Darin Adler.

         * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::selectNextSourceChild):
        Use the parsed MediaQueryList for video/audio, since we now cache that on the source elements for picture.

        * html/HTMLSourceElement.cpp:
        (WebCore::HTMLSourceElement::insertedInto):
        (WebCore::HTMLSourceElement::removedFrom):
        Add guards to fix the build when video is not enabled.

2016-01-04  Brent Fulgham  <bfulgham@apple.com>

        [Win] Clean up some Windows WebCore files
        https://bugs.webkit.org/show_bug.cgi?id=148275

        Reviewed by Dean Jackson.

        No new tests because there is no behavior change.

        Update a handful of Windows-specific WebCore files to use
        the proper method signatures for our updated interfaces,
        get rid of cruft in the COM bindings, and use proper C++14
        initializers.

        * accessibility/win/AccessibilityObjectWrapperWin.h:
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:
        * platform/win/PopupMenuWin.cpp:
        * platform/win/PopupMenuWin.h:
        * platform/win/WCDataObject.cpp:
        * platform/win/WCDataObject.h:

2016-01-04  Andreas Kling  <akling@apple.com>

        Simplify the CachedScript ASCII optimization.
        <https://webkit.org/b/152596>

        Reviewed by Antti Koivisto.

        There's actually no need to keep a non-copying StringImpl around for the
        CachedScript's internal SharedBuffer. Get rid of that so we don't need
        to fidget with that string when the SharedBuffer changes underneath.

        Renamed CachedScript::ASCIIOptimizationState to DecodingState to better
        reflect what it's used for. Also added explicit caching of the string
        hash since we can't rely on a StringImpl to keep that around now.

        Bonus: Implement Darin's suggestion to let TextEncoding answer whether
        an encoding is byte-based and thus eligible for the ASCII optimization.

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::tryReplaceEncodedData): Deleted.
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::didReplaceSharedBufferContents): Deleted.
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::script):
        (WebCore::CachedScript::scriptHash):
        (WebCore::encodingMayBeAllASCII): Deleted.
        (WebCore::CachedScript::didReplaceSharedBufferContents): Deleted.
        * loader/cache/CachedScript.h:
        * platform/text/TextEncoding.h:
        (WebCore::TextEncoding::isByteBasedEncoding):

2016-01-04  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] A video element isn't drawn onto the canvas.
        https://bugs.webkit.org/show_bug.cgi?id=132671

        Reviewed by Michael Catanzaro.

        When both cairo-gl and gst-gl are available the texture coming
        from glimagesink can be used to create a cairo-gl surface that can
        be used for video rendering within a canvas element.

        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::drawImage): Use NativeImage
        drawing if both cairo-gl and gst-gl are available.
        * platform/graphics/GraphicsContext.h: Implement drawNativeImage
        for Cairo GraphicsContext.
        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::drawNativeImage): Ditto.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        Implement nativeImageForCurrentTime(), this method is used by the
        canvas rendering context.
        (WebCore::MediaPlayerPrivateGStreamerBase::nativeImageForCurrentTime):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:

2016-01-03  Michael Catanzaro  <mcatanzaro@igalia.com>

        [GTK] Fix -Wpessimizing-move warnings after switch to WTFMove
        https://bugs.webkit.org/show_bug.cgi?id=152677

        Reviewed by Andy Estes.

        * platform/glib/KeyedDecoderGlib.cpp:
        (WebCore::KeyedDecoderGlib::dictionaryFromGVariant):
        * platform/graphics/egl/GLContextEGL.cpp:
        (WebCore::GLContextEGL::createContext):
        * platform/graphics/glx/GLContextGLX.cpp:
        (WebCore::GLContextGLX::createContext):

2016-01-03  David Kilzer  <ddkilzer@apple.com>

        -[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:] is missing an m_handle->client() NULL check
        <https://webkit.org/b/152673>
        <rdar://problem/23560530>

        Reviewed by Daniel Bates.

        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.mm:
        (-[WebCoreResourceHandleAsOperationQueueDelegate connection:didReceiveResponse:]):
        Add NULL check for m_handle->client() so we don't crash due to a
        NULL dereference inside the dispatch_async() block.

2016-01-03  Michael Catanzaro  <mcatanzaro@igalia.com>

        Unreviewed, turn off temporary scrolling logging on GTK
        https://bugs.webkit.org/show_bug.cgi?id=152649

        * platform/Logging.cpp:
        (WebCore::initializeLoggingChannelsIfNecessary): Deleted.

2016-01-03  Simon Fraser  <simon.fraser@apple.com>

        Fix Windows build after r194515.

        * platform/win/PopupMenuWin.cpp:
        (WebCore::PopupMenuWin::scrollOffset):
        (WebCore::PopupMenuWin::scrollPosition): Renamed.
        * platform/win/PopupMenuWin.h:

2016-01-03  Khem Raj  <raj.khem@gmail.com>

        WebKit fails to build with musl libc library
        https://bugs.webkit.org/show_bug.cgi?id=152625

        Reviewed by Daniel Bates and Alexey Proskuryakov.

        malloc_trim is glibc specific API so guard it with __GLIBC__.

        * platform/linux/MemoryPressureHandlerLinux.cpp:
        (MemoryPressureHandler::platformReleaseMemory): Guard malloc_trim()
        call with __GLIBC_.

2016-01-03  Simon Fraser  <simon.fraser@apple.com>

        Minor cleanup in ScrollAnimator
        https://bugs.webkit.org/show_bug.cgi?id=152656

        Reviewed by Dan Bernstein.

        Hide the fact that ScrollAnimator's m_currentPosX/m_currentPosY is not a FloatPoint
        as much as possible.
        
        Do offset -> position conversion in ScrollAnimator::scrollToOffsetWithoutAnimation().
        This is a behavior change, but I could never hit this code on Mac.

        * platform/ScrollAnimator.cpp:
        (WebCore::ScrollAnimator::scroll):
        (WebCore::ScrollAnimator::scrollToOffsetWithoutAnimation):
        (WebCore::ScrollAnimator::setCurrentPosition):
        (WebCore::ScrollAnimator::updateActiveScrollSnapIndexForOffset):
        (WebCore::ScrollAnimator::notifyPositionChanged):
        (WebCore::ScrollAnimator::immediateScrollOnAxis):
        (WebCore::ScrollAnimator::ScrollAnimator): Deleted.
        (WebCore::ScrollAnimator::currentPosition): Deleted.
        * platform/ScrollAnimator.h:
        (WebCore::ScrollAnimator::ScrollAnimator::currentPosition):
        (WebCore::ScrollAnimator::ScrollAnimator::setCurrentPositionInternal):
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::scroll):
        (WebCore::ScrollAnimatorMac::immediateScrollToPosition):
        (WebCore::ScrollAnimatorMac::immediateScrollBy):

2016-01-03  Simon Fraser  <simon.fraser@apple.com>

        Rename scrollPosition(Scrollbar*) to scrollOffset(ScrollbarOrientation)
        https://bugs.webkit.org/show_bug.cgi?id=152666

        Reviewed by Dan Bernstein.

        Scrollbar values take offsets (zero-based), so rename the accessor used
        by scrollbars to set their value, and pass in an orientation, rather than
        a pointer to the scrollbar.

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::scrollOffset): Use scrollOffsetFromPosition rather than
        manually adding scrollOrigin.
        (WebCore::ScrollView::scrollPosition): Renamed.
        * platform/ScrollView.h:
        (WebCore::ScrollView::cachedScrollPosition):
        * platform/ScrollableArea.h:
        * platform/Scrollbar.cpp:
        (WebCore::Scrollbar::Scrollbar):
        (WebCore::Scrollbar::offsetDidChange):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollOffset):
        (WebCore::RenderLayer::scrollPosition): Renamed.
        * rendering/RenderLayer.h:
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::scrollOffset):
        (WebCore::RenderListBox::scrollPosition): Renamed.
        * rendering/RenderListBox.h:

2016-01-03  Simon Fraser  <simon.fraser@apple.com>

        scrollLeft returns different values for viewport and non-viewport scrolling with rtl
        https://bugs.webkit.org/show_bug.cgi?id=94405
        rdar://problem/21829754

        Reviewed by Zalan Bujtas.
        
        Use scrollPosition for DOM-exposed scroll* values on overflow scroll elements,
        matching the CSS OM View spec, and Gecko behavior.

        Test: fast/scrolling/programmatic-overflow-rtl-scrollIntoView.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::scrollLeft):
        (WebCore::RenderBox::scrollTop):
        (WebCore::RenderBox::setScrollLeft):
        (WebCore::RenderBox::setScrollTop):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollToXPosition):
        (WebCore::RenderLayer::scrollToYPosition):
        * rendering/RenderLayer.h:

2016-01-03  Simon Fraser  <simon.fraser@apple.com>

        Some cleanup in ScrollAnimator
        https://bugs.webkit.org/show_bug.cgi?id=152649

        Try to fix GTK scroll position errors in RTL.
        
        ScrollAnimatorNone::scrollToOffsetWithoutAnimation() was failing to map from
        offset to position.
        
        Also add logging in ScrollableArea::scrollToOffsetWithoutAnimation().

        * platform/ScrollAnimatorNone.cpp:
        (WebCore::ScrollAnimatorNone::scrollToOffsetWithoutAnimation):
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::scrollToOffsetWithoutAnimation):

2016-01-02  Simon Fraser  <simon.fraser@apple.com>

        Temporarily turn on Scrolling logging on GTK, to investigate
        GTK failures from https://bugs.webkit.org/show_bug.cgi?id=152649.
        
        * platform/Logging.cpp:
        (WebCore::initializeLoggingChannelsIfNecessary):

2016-01-02  Simon Fraser  <simon.fraser@apple.com>

        Some cleanup in ScrollAnimator
        https://bugs.webkit.org/show_bug.cgi?id=152649

        Try to fix GTK test failures. ScrollAnimatorNone needs to map correctly between
        min and max scroll positions.

        * platform/ScrollAnimatorNone.cpp:
        (WebCore::ScrollAnimatorNone::PerAxisData::updateDataFromParameters):
        (WebCore::ScrollAnimatorNone::scroll):
        * platform/ScrollAnimatorNone.h:

2016-01-02  Max Stepin  <maxstepin@gmail.com>

        APNG decoder: only decode the frames up to haltAtFrame
        https://bugs.webkit.org/show_bug.cgi?id=146205

        Reviewed by Michael Catanzaro.

        No new tests, already covered by existing tests.

        * platform/image-decoders/png/PNGImageDecoder.cpp:
        (WebCore::PNGImageReader::close):
        (WebCore::PNGImageReader::decode):
        (WebCore::PNGImageDecoder::isSizeAvailable):
        (WebCore::PNGImageDecoder::frameBufferAtIndex):
        (WebCore::PNGImageDecoder::pngComplete):
        (WebCore::PNGImageDecoder::decode):
        * platform/image-decoders/png/PNGImageDecoder.h:
        (WebCore::PNGImageDecoder::isComplete):
        (WebCore::PNGImageDecoder::isCompleteAtIndex):

2016-01-02  Simon Fraser  <simon.fraser@apple.com>

        Some cleanup in ScrollAnimator
        https://bugs.webkit.org/show_bug.cgi?id=152649

        Reviewed by Zalan Bujtas.

        Change ScrollAnimatorMac::adjustScrollPositionIfNecessary() and similar code in
        ScrollingTreeFrameScrollingNodeMac::adjustScrollPositionToBoundsIfNecessary() to
        constrain between minimumScrollPosition() and maximumScrollPosition(), rather than
        rolling their own code.
        
        This revealed several issues. First, RenderLayer::maximumScrollPosition() is
        wrong when the layer has borders, because RenderLayer::visibleContentRectInternal()
        seems to have incorrect logic. However, we can just remove it, and use the ScrollableArea
        implementation.
        
        Second, ScrollAnimatorMac::scrollToOffsetWithoutAnimation() was failing to do a
        position/offset conversion, so do one. We're converting too much, and should probably
        just change ScrollAnimator to do everything in terms of positions.
        
        Third, ScrollAnimator::scroll() was clamping a scroll position as an offset
        (detected by scrollbars/scroll-rtl-or-bt-layer.html), so fix that.
        
        Remove ScrollController::absoluteScrollPosition() and overrides, since this was
        confusingly named, and could just be removed.
        
        Remove ScrollController::m_origOrigin which was assigned to, but never read.

        Test: fast/scrolling/arrow-key-scroll-in-rtl-document.html: new
              fast/dom/horizontal-scrollbar-in-rtl.html: progressed with these changes.

        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h:
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeMac::adjustScrollPositionToBoundsIfNecessary):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::absoluteScrollPosition): Deleted.
        * platform/ScrollAnimator.cpp:
        (WebCore::ScrollAnimator::scroll):
        (WebCore::ScrollAnimator::notifyPositionChanged):
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::constrainScrollPosition):
        * platform/cocoa/ScrollController.h:
        * platform/cocoa/ScrollController.mm:
        (WebCore::ScrollController::snapRubberBandTimerFired): Deleted.
        (WebCore::ScrollController::snapRubberBand): Deleted.
        * platform/mac/ScrollAnimatorMac.h:
        * platform/mac/ScrollAnimatorMac.mm:
        (-[WebScrollAnimationHelperDelegate _immediateScrollToPoint:]):
        (WebCore::ScrollAnimatorMac::scroll):
        (WebCore::ScrollAnimatorMac::scrollToOffsetWithoutAnimation):
        (WebCore::ScrollAnimatorMac::adjustScrollPositionIfNecessary):
        (WebCore::ScrollAnimatorMac::adjustScrollPositionToBoundsIfNecessary):
        (WebCore::ScrollAnimatorMac::immediateScrollToPosition):
        (WebCore::ScrollAnimatorMac::immediateScrollToPositionForScrollAnimation):
        (WebCore::ScrollAnimatorMac::immediateScrollTo): Deleted.
        (WebCore::ScrollAnimatorMac::immediateScrollToPointForScrollAnimation): Deleted.
        (WebCore::ScrollAnimatorMac::absoluteScrollPosition): Deleted.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::visibleContentRectInternal):
        (WebCore::RenderLayer::overhangAmount):
        (WebCore::RenderLayer::maximumScrollPosition): Deleted.
        * rendering/RenderLayer.h:
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::minimumScrollPosition):
        (WebCore::RenderListBox::maximumScrollPosition): RenderListBox scrolls by lines,
        so it needs a custom implementation of this.
        * rendering/RenderListBox.h:

2016-01-02  Zalan Bujtas  <zalan@apple.com>

        Simple line layout:: Add text-decoration support.
        https://bugs.webkit.org/show_bug.cgi?id=152623

        Reviewed by Antti Koivisto.

        This patch enables text-decoration for simple line layout.
        -webkit-text-underline-position: under requires normal line layout context, skip it for now.

        Test: fast/css3-text/css3-text-decoration/simple-line-layout-text-decoration.html

        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::canUseForStyle):
        (WebCore::SimpleLineLayout::printReason):
        * rendering/SimpleLineLayoutFunctions.cpp:
        (WebCore::SimpleLineLayout::paintFlow): In case of multiple RenderText renderers (long text), it's ok
        to pass the first text renderer as they all share the same set of decorations. 

2015-12-31  Andy Estes  <aestes@apple.com>

        Replace WTF::move with WTFMove
        https://bugs.webkit.org/show_bug.cgi?id=152601

        Reviewed by Brady Eidson.

        * Modules/battery/NavigatorBattery.cpp:
        (WebCore::NavigatorBattery::from):
        * Modules/encryptedmedia/CDMSessionClearKey.cpp:
        (WebCore::CDMSessionClearKey::update):
        * Modules/encryptedmedia/MediaKeys.cpp:
        (WebCore::MediaKeys::create):
        (WebCore::MediaKeys::MediaKeys):
        * Modules/gamepad/NavigatorGamepad.cpp:
        (WebCore::NavigatorGamepad::from):
        * Modules/gamepad/deprecated/NavigatorGamepad.cpp:
        (WebCore::NavigatorGamepad::from):
        * Modules/geolocation/GeoNotifier.cpp:
        (WebCore::GeoNotifier::GeoNotifier):
        (WebCore::GeoNotifier::setFatalError):
        * Modules/geolocation/GeoNotifier.h:
        (WebCore::GeoNotifier::create):
        * Modules/geolocation/Geolocation.cpp:
        (WebCore::Geolocation::Watchers::add):
        (WebCore::Geolocation::getCurrentPosition):
        (WebCore::Geolocation::watchPosition):
        * Modules/geolocation/GeolocationController.cpp:
        (WebCore::GeolocationController::viewStateDidChange):
        * Modules/geolocation/Geoposition.h:
        (WebCore::Geoposition::create):
        (WebCore::Geoposition::Geoposition):
        * Modules/geolocation/NavigatorGeolocation.cpp:
        (WebCore::NavigatorGeolocation::from):
        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
        (WebCore::DOMWindowIndexedDatabase::from):
        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.cpp:
        (WebCore::WorkerGlobalScopeIndexedDatabase::from):
        * Modules/indexeddb/client/IDBAnyImpl.cpp:
        (WebCore::IDBClient::IDBAny::IDBAny):
        * Modules/indexeddb/client/IDBAnyImpl.h:
        (WebCore::IDBClient::IDBAny::create):
        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::willCommitTransaction):
        (WebCore::IDBClient::IDBDatabase::willAbortTransaction):
        (WebCore::IDBClient::IDBDatabase::fireVersionChangeEvent):
        * Modules/indexeddb/client/IDBIndexImpl.cpp:
        (WebCore::IDBClient::IDBIndex::openCursor):
        (WebCore::IDBClient::IDBIndex::openKeyCursor):
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::openCursor):
        (WebCore::IDBClient::IDBObjectStore::get):
        (WebCore::IDBClient::IDBObjectStore::deleteFunction):
        (WebCore::IDBClient::IDBObjectStore::createIndex):
        (WebCore::IDBClient::IDBObjectStore::index):
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::onSuccess):
        (WebCore::IDBClient::IDBOpenDBRequest::onUpgradeNeeded):
        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::enqueueEvent):
        (WebCore::IDBClient::IDBRequest::setResult):
        (WebCore::IDBClient::IDBRequest::setResultToStructuredClone):
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::abort):
        (WebCore::IDBClient::IDBTransaction::scheduleOperation):
        (WebCore::IDBClient::IDBTransaction::commit):
        (WebCore::IDBClient::IDBTransaction::enqueueEvent):
        (WebCore::IDBClient::IDBTransaction::createObjectStore):
        (WebCore::IDBClient::IDBTransaction::createIndex):
        (WebCore::IDBClient::IDBTransaction::doRequestOpenCursor):
        (WebCore::IDBClient::IDBTransaction::iterateCursor):
        (WebCore::IDBClient::IDBTransaction::requestGetRecord):
        (WebCore::IDBClient::IDBTransaction::requestIndexRecord):
        (WebCore::IDBClient::IDBTransaction::requestClearObjectStore):
        (WebCore::IDBClient::IDBTransaction::requestPutOrAdd):
        (WebCore::IDBClient::IDBTransaction::deleteObjectStore):
        (WebCore::IDBClient::IDBTransaction::deleteIndex):
        * Modules/indexeddb/legacy/IDBDatabaseBackend.cpp:
        (WebCore::IDBDatabaseBackend::processPendingOpenCalls):
        * Modules/indexeddb/legacy/IDBDatabaseBackend.h:
        (WebCore::IDBDatabaseBackend::setPendingSecondHalfOpen):
        * Modules/indexeddb/legacy/LegacyAny.h:
        (WebCore::LegacyAny::create):
        * Modules/indexeddb/legacy/LegacyDatabase.cpp:
        (WebCore::LegacyDatabase::enqueueEvent):
        * Modules/indexeddb/legacy/LegacyRequest.cpp:
        (WebCore::LegacyRequest::enqueueEvent):
        * Modules/indexeddb/legacy/LegacyTransaction.cpp:
        (WebCore::LegacyTransaction::enqueueEvent):
        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::postDatabaseTask):
        (WebCore::IDBServer::IDBServer::postDatabaseTaskReply):
        * Modules/indexeddb/server/MemoryBackingStoreTransaction.cpp:
        (WebCore::IDBServer::MemoryBackingStoreTransaction::indexDeleted):
        (WebCore::IDBServer::MemoryBackingStoreTransaction::objectStoreDeleted):
        (WebCore::IDBServer::MemoryBackingStoreTransaction::objectStoreCleared):
        (WebCore::IDBServer::MemoryBackingStoreTransaction::indexCleared):
        (WebCore::IDBServer::MemoryBackingStoreTransaction::abort):
        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::beginTransaction):
        (WebCore::IDBServer::MemoryIDBBackingStore::createObjectStore):
        (WebCore::IDBServer::MemoryIDBBackingStore::deleteObjectStore):
        (WebCore::IDBServer::MemoryIDBBackingStore::restoreObjectStoreForVersionChangeAbort):
        (WebCore::IDBServer::MemoryIDBBackingStore::registerObjectStore):
        * Modules/indexeddb/server/MemoryIndex.cpp:
        (WebCore::IDBServer::MemoryIndex::objectStoreCleared):
        (WebCore::IDBServer::MemoryIndex::replaceIndexValueStore):
        * Modules/indexeddb/server/MemoryObjectStore.cpp:
        (WebCore::IDBServer::MemoryObjectStore::createIndex):
        (WebCore::IDBServer::MemoryObjectStore::maybeRestoreDeletedIndex):
        (WebCore::IDBServer::MemoryObjectStore::deleteIndex):
        (WebCore::IDBServer::MemoryObjectStore::clear):
        (WebCore::IDBServer::MemoryObjectStore::replaceKeyValueStore):
        (WebCore::IDBServer::MemoryObjectStore::registerIndex):
        * Modules/indexeddb/server/ServerOpenDBRequest.cpp:
        (WebCore::IDBServer::ServerOpenDBRequest::notifiedConnectionsOfVersionChange):
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::openDatabaseConnection):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::startVersionChangeTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::maybeNotifyConnectionsOfVersionChange):
        (WebCore::IDBServer::UniqueIDBDatabase::connectionClosedFromClient):
        (WebCore::IDBServer::UniqueIDBDatabase::enqueueTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::takeNextRunnableTransaction):
        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::establishTransaction):
        * Modules/indexeddb/shared/IndexKey.cpp:
        (WebCore::IndexKey::isolatedCopy):
        * Modules/mediasession/WebMediaSessionManager.cpp:
        (WebCore::WebMediaSessionManager::setPlaybackTarget):
        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::setPrivateAndOpen):
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::create):
        (WebCore::SourceBuffer::SourceBuffer):
        * Modules/mediastream/MediaDevices.cpp:
        (WebCore::MediaDevices::getUserMedia):
        (WebCore::MediaDevices::enumerateDevices):
        * Modules/mediastream/MediaDevicesRequest.cpp:
        (WebCore::MediaDevicesRequest::create):
        (WebCore::MediaDevicesRequest::MediaDevicesRequest):
        * Modules/mediastream/MediaStream.cpp:
        (WebCore::MediaStream::create):
        (WebCore::MediaStream::MediaStream):
        (WebCore::MediaStream::addTrack):
        (WebCore::MediaStream::didRemoveTrack):
        (WebCore::MediaStream::internalAddTrack):
        (WebCore::MediaStream::internalRemoveTrack):
        * Modules/mediastream/NavigatorMediaDevices.cpp:
        (WebCore::NavigatorMediaDevices::from):
        * Modules/mediastream/RTCConfiguration.cpp:
        (WebCore::RTCConfiguration::initialize):
        * Modules/mediastream/RTCDTMFSender.cpp:
        (WebCore::RTCDTMFSender::create):
        (WebCore::RTCDTMFSender::RTCDTMFSender):
        (WebCore::RTCDTMFSender::scheduleDispatchEvent):
        * Modules/mediastream/RTCDataChannel.cpp:
        (WebCore::RTCDataChannel::create):
        (WebCore::RTCDataChannel::RTCDataChannel):
        (WebCore::RTCDataChannel::scheduleDispatchEvent):
        * Modules/mediastream/RTCIceCandidateEvent.cpp:
        (WebCore::RTCIceCandidateEvent::create):
        (WebCore::RTCIceCandidateEvent::RTCIceCandidateEvent):
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::create):
        (WebCore::RTCPeerConnection::RTCPeerConnection):
        (WebCore::RTCPeerConnection::addTrack):
        (WebCore::RTCPeerConnection::queuedCreateOffer):
        (WebCore::RTCPeerConnection::queuedCreateAnswer):
        (WebCore::RTCPeerConnection::queuedSetLocalDescription):
        (WebCore::RTCPeerConnection::queuedSetRemoteDescription):
        (WebCore::RTCPeerConnection::queuedAddIceCandidate):
        (WebCore::RTCPeerConnection::setConfiguration):
        (WebCore::RTCPeerConnection::privateGetStats):
        * Modules/mediastream/RTCRtpReceiver.cpp:
        (WebCore::RTCRtpReceiver::RTCRtpReceiver):
        * Modules/mediastream/RTCRtpReceiver.h:
        (WebCore::RTCRtpReceiver::create):
        * Modules/mediastream/RTCRtpSender.cpp:
        (WebCore::RTCRtpSender::RTCRtpSender):
        * Modules/mediastream/RTCRtpSender.h:
        (WebCore::RTCRtpSender::create):
        * Modules/mediastream/RTCTrackEvent.cpp:
        (WebCore::RTCTrackEvent::create):
        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::start):
        (WebCore::UserMediaRequest::UserMediaRequest):
        * Modules/navigatorcontentutils/NavigatorContentUtils.cpp:
        (WebCore::provideNavigatorContentUtilsTo):
        * Modules/navigatorcontentutils/NavigatorContentUtils.h:
        * Modules/notifications/DOMWindowNotifications.cpp:
        (WebCore::DOMWindowNotifications::from):
        * Modules/notifications/NotificationCenter.cpp:
        (WebCore::NotificationCenter::timerFired):
        * Modules/notifications/WorkerGlobalScopeNotifications.cpp:
        (WebCore::WorkerGlobalScopeNotifications::from):
        * Modules/plugins/QuickTimePluginReplacement.mm:
        (WebCore::QuickTimePluginReplacement::createElementRenderer):
        * Modules/plugins/YouTubePluginReplacement.cpp:
        (WebCore::YouTubePluginReplacement::createElementRenderer):
        (WebCore::YouTubePluginReplacement::installReplacement):
        * Modules/quota/DOMWindowQuota.cpp:
        (WebCore::DOMWindowQuota::from):
        * Modules/quota/NavigatorStorageQuota.cpp:
        (WebCore::NavigatorStorageQuota::from):
        * Modules/quota/WorkerNavigatorStorageQuota.cpp:
        (WebCore::WorkerNavigatorStorageQuota::from):
        * Modules/speech/DOMWindowSpeechSynthesis.cpp:
        (WebCore::DOMWindowSpeechSynthesis::from):
        * Modules/speech/SpeechSynthesis.cpp:
        (WebCore::SpeechSynthesis::setPlatformSynthesizer):
        * Modules/webaudio/AsyncAudioDecoder.cpp:
        (WebCore::AsyncAudioDecoder::decodeAsync):
        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::addReaction):
        (WebCore::AudioContext::suspend):
        (WebCore::AudioContext::resume):
        (WebCore::AudioContext::close):
        * Modules/webaudio/AudioNode.cpp:
        (WebCore::AudioNode::addInput):
        (WebCore::AudioNode::addOutput):
        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        (WebCore::AudioScheduledSourceNode::addEventListener):
        * Modules/webaudio/ConvolverNode.cpp:
        (WebCore::ConvolverNode::setBuffer):
        * Modules/webaudio/MediaStreamAudioDestinationNode.cpp:
        (WebCore::MediaStreamAudioDestinationNode::MediaStreamAudioDestinationNode):
        * Modules/webaudio/ScriptProcessorNode.cpp:
        (WebCore::ScriptProcessorNode::addEventListener):
        * Modules/webdatabase/Database.cpp:
        (WebCore::Database::openAndVerifyVersion):
        (WebCore::Database::scheduleTransaction):
        (WebCore::Database::scheduleTransactionStep):
        (WebCore::Database::markAsDeletedAndClose):
        (WebCore::Database::runTransaction):
        (WebCore::Database::tableNames):
        * Modules/webdatabase/DatabaseThread.cpp:
        (WebCore::DatabaseThread::scheduleTask):
        (WebCore::DatabaseThread::scheduleImmediateTask):
        * Modules/webdatabase/SQLTransaction.cpp:
        (WebCore::SQLTransaction::create):
        (WebCore::SQLTransaction::SQLTransaction):
        (WebCore::SQLTransaction::executeSQL):
        * Modules/webdatabase/SQLTransactionBackend.cpp:
        (WebCore::SQLTransactionBackend::enqueueStatementBackend):
        (WebCore::SQLTransactionBackend::executeSQL):
        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
        (WebCore::ThreadableWebSocketChannelClientWrapper::didReceiveBinaryData):
        (WebCore::ThreadableWebSocketChannelClientWrapper::processPendingTasks):
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::didReceiveBinaryData):
        (WebCore::WebSocket::dispatchOrQueueEvent):
        * Modules/websockets/WebSocketChannel.cpp:
        (WebCore::WebSocketChannel::processFrame):
        * Modules/websockets/WebSocketExtensionDispatcher.cpp:
        (WebCore::WebSocketExtensionDispatcher::addProcessor):
        * Modules/websockets/WebSocketHandshake.cpp:
        (WebCore::WebSocketHandshake::addExtensionProcessor):
        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
        (WebCore::WorkerThreadableWebSocketChannel::Peer::didReceiveBinaryData):
        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::notificationPostTimerFired):
        (WebCore::AXObjectCache::passwordNotificationPostTimerFired):
        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::ariaLabeledByText):
        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::selectText):
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityText::AccessibilityText):
        * bindings/gobject/DOMObjectCache.cpp:
        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::maybeCreateIDBKeyFromScriptValueAndKeyPath):
        (WebCore::generateIndexKeyForValue):
        * bindings/js/JSCryptoAlgorithmDictionary.cpp:
        (WebCore::createAesCbcParams):
        (WebCore::createAesKeyGenParams):
        (WebCore::createHmacParams):
        (WebCore::createHmacKeyParams):
        (WebCore::createRsaKeyGenParams):
        (WebCore::createRsaOaepParams):
        (WebCore::createRsaSsaParams):
        * bindings/js/JSCryptoKeySerializationJWK.cpp:
        (WebCore::createHMACParameters):
        (WebCore::createRSAKeyParametersWithHash):
        (WebCore::JSCryptoKeySerializationJWK::reconcileAlgorithm):
        * bindings/js/JSDOMPromise.h:
        (WebCore::DOMPromise::DOMPromise):
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::queueTaskToEventLoop):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::setTimeout):
        (WebCore::JSDOMWindow::setInterval):
        * bindings/js/JSDOMWrapper.h:
        (WebCore::JSDOMWrapper::JSDOMWrapper):
        * bindings/js/JSMessageEventCustom.cpp:
        (WebCore::handleInitMessageEvent):
        * bindings/js/JSSubtleCryptoCustom.cpp:
        (WebCore::JSSubtleCrypto::encrypt):
        (WebCore::JSSubtleCrypto::decrypt):
        (WebCore::JSSubtleCrypto::sign):
        (WebCore::JSSubtleCrypto::verify):
        (WebCore::JSSubtleCrypto::digest):
        (WebCore::JSSubtleCrypto::generateKey):
        (WebCore::importKey):
        (WebCore::JSSubtleCrypto::importKey):
        (WebCore::JSSubtleCrypto::exportKey):
        (WebCore::JSSubtleCrypto::wrapKey):
        (WebCore::JSSubtleCrypto::unwrapKey):
        * bindings/js/JSWorkerGlobalScopeCustom.cpp:
        (WebCore::JSWorkerGlobalScope::setTimeout):
        (WebCore::JSWorkerGlobalScope::setInterval):
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneDeserializer::readRSAKey):
        (WebCore::CloneDeserializer::readTerminal):
        (WebCore::SerializedScriptValue::SerializedScriptValue):
        (WebCore::SerializedScriptValue::create):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::JSTestActiveDOMObject::JSTestActiveDOMObject):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
        (WebCore::JSTestActiveDOMObject::create):
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::JSTestClassWithJSBuiltinConstructor::JSTestClassWithJSBuiltinConstructor):
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:
        (WebCore::JSTestClassWithJSBuiltinConstructor::create):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::JSTestCustomConstructorWithNoInterfaceObject):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::create):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::JSTestCustomNamedGetter::JSTestCustomNamedGetter):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
        (WebCore::JSTestCustomNamedGetter::create):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructor::JSTestEventConstructor):
        * bindings/scripts/test/JS/JSTestEventConstructor.h:
        (WebCore::JSTestEventConstructor::create):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::JSTestEventTarget::JSTestEventTarget):
        * bindings/scripts/test/JS/JSTestEventTarget.h:
        (WebCore::JSTestEventTarget::create):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::JSTestException::JSTestException):
        * bindings/scripts/test/JS/JSTestException.h:
        (WebCore::JSTestException::create):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::JSTestGenerateIsReachable::JSTestGenerateIsReachable):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
        (WebCore::JSTestGenerateIsReachable::create):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterface::JSTestInterface):
        * bindings/scripts/test/JS/JSTestInterface.h:
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::JSTestMediaQueryListListener::JSTestMediaQueryListListener):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
        (WebCore::JSTestMediaQueryListListener::create):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::JSTestNamedConstructor::JSTestNamedConstructor):
        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
        (WebCore::JSTestNamedConstructor::create):
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::JSTestNode::JSTestNode):
        * bindings/scripts/test/JS/JSTestNode.h:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::JSTestNondeterministic::JSTestNondeterministic):
        * bindings/scripts/test/JS/JSTestNondeterministic.h:
        (WebCore::JSTestNondeterministic::create):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObj::JSTestObj):
        * bindings/scripts/test/JS/JSTestObj.h:
        (WebCore::JSTestObj::create):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::JSTestOverloadedConstructors::JSTestOverloadedConstructors):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
        (WebCore::JSTestOverloadedConstructors::create):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::JSTestOverrideBuiltins::JSTestOverrideBuiltins):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
        (WebCore::JSTestOverrideBuiltins::create):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::JSTestSerializedScriptValueInterface::JSTestSerializedScriptValueInterface):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
        (WebCore::JSTestSerializedScriptValueInterface::create):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::JSTestTypedefs::JSTestTypedefs):
        * bindings/scripts/test/JS/JSTestTypedefs.h:
        (WebCore::JSTestTypedefs::create):
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::JSattribute::JSattribute):
        * bindings/scripts/test/JS/JSattribute.h:
        (WebCore::JSattribute::create):
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::JSreadonly::JSreadonly):
        * bindings/scripts/test/JS/JSreadonly.h:
        (WebCore::JSreadonly::create):
        * bridge/c/CRuntimeObject.cpp:
        (JSC::Bindings::CRuntimeObject::CRuntimeObject):
        * bridge/c/CRuntimeObject.h:
        (JSC::Bindings::CRuntimeObject::create):
        * bridge/c/c_class.cpp:
        (JSC::Bindings::CClass::methodNamed):
        (JSC::Bindings::CClass::fieldNamed):
        * bridge/c/c_instance.cpp:
        (JSC::Bindings::CInstance::CInstance):
        * bridge/c/c_instance.h:
        (JSC::Bindings::CInstance::create):
        * bridge/jsc/BridgeJSC.cpp:
        (JSC::Bindings::Array::Array):
        (JSC::Bindings::Instance::Instance):
        * bridge/objc/ObjCRuntimeObject.h:
        (JSC::Bindings::ObjCRuntimeObject::create):
        * bridge/objc/objc_class.mm:
        (JSC::Bindings::ObjcClass::methodNamed):
        (JSC::Bindings::ObjcClass::fieldNamed):
        * bridge/objc/objc_instance.mm:
        (ObjcInstance::ObjcInstance):
        (ObjcInstance::create):
        * bridge/objc/objc_runtime.mm:
        (JSC::Bindings::ObjcArray::ObjcArray):
        * bridge/runtime_object.cpp:
        (JSC::Bindings::RuntimeObject::RuntimeObject):
        * bridge/runtime_object.h:
        * contentextensions/CombinedFiltersAlphabet.cpp:
        (WebCore::ContentExtensions::TermCreatorTranslator::translate):
        * contentextensions/CombinedURLFilters.cpp:
        (WebCore::ContentExtensions::ActiveSubtree::ActiveSubtree):
        (WebCore::ContentExtensions::generateSuffixWithReverseSuffixTree):
        (WebCore::ContentExtensions::generateNFAForSubtree):
        (WebCore::ContentExtensions::CombinedURLFilters::processNFAs):
        * contentextensions/ContentExtension.cpp:
        (WebCore::ContentExtensions::ContentExtension::create):
        (WebCore::ContentExtensions::ContentExtension::ContentExtension):
        * contentextensions/ContentExtensionCompiler.cpp:
        (WebCore::ContentExtensions::compileRuleList):
        * contentextensions/ContentExtensionParser.cpp:
        (WebCore::ContentExtensions::loadEncodedRules):
        * contentextensions/ContentExtensionsBackend.cpp:
        (WebCore::ContentExtensions::ContentExtensionsBackend::addContentExtension):
        * contentextensions/DFACombiner.cpp:
        (WebCore::ContentExtensions::DFACombiner::combineDFAs):
        * contentextensions/DFACombiner.h:
        (WebCore::ContentExtensions::DFACombiner::addDFA):
        * contentextensions/ImmutableNFANodeBuilder.h:
        (WebCore::ContentExtensions::ImmutableNFANodeBuilder::ImmutableNFANodeBuilder):
        (WebCore::ContentExtensions::ImmutableNFANodeBuilder::operator=):
        * contentextensions/MutableRange.h:
        (WebCore::ContentExtensions::MutableRange::MutableRange):
        (WebCore::ContentExtensions::MutableRange::operator=):
        * contentextensions/MutableRangeList.h:
        (WebCore::ContentExtensions::MutableRangeList::extend):
        (WebCore::ContentExtensions::MutableRangeList::insertBetween):
        * contentextensions/Term.h:
        (WebCore::ContentExtensions::Term::Term):
        (WebCore::ContentExtensions::Term::operator=):
        (WebCore::ContentExtensions::Term::generateSubgraphForAtom):
        * crypto/CryptoAlgorithm.cpp:
        (WebCore::CryptoAlgorithm::encryptForWrapKey):
        (WebCore::CryptoAlgorithm::decryptForUnwrapKey):
        * crypto/CryptoKeyPair.cpp:
        (WebCore::CryptoKeyPair::CryptoKeyPair):
        * crypto/CryptoKeyPair.h:
        (WebCore::CryptoKeyPair::create):
        * crypto/algorithms/CryptoAlgorithmAES_CBC.cpp:
        (WebCore::CryptoAlgorithmAES_CBC::encrypt):
        (WebCore::CryptoAlgorithmAES_CBC::decrypt):
        * crypto/algorithms/CryptoAlgorithmAES_KW.cpp:
        (WebCore::CryptoAlgorithmAES_KW::encryptForWrapKey):
        (WebCore::CryptoAlgorithmAES_KW::decryptForUnwrapKey):
        * crypto/algorithms/CryptoAlgorithmHMAC.cpp:
        (WebCore::CryptoAlgorithmHMAC::sign):
        (WebCore::CryptoAlgorithmHMAC::verify):
        * crypto/algorithms/CryptoAlgorithmRSAES_PKCS1_v1_5.cpp:
        (WebCore::CryptoAlgorithmRSAES_PKCS1_v1_5::encrypt):
        (WebCore::CryptoAlgorithmRSAES_PKCS1_v1_5::decrypt):
        (WebCore::CryptoAlgorithmRSAES_PKCS1_v1_5::generateKey):
        * crypto/algorithms/CryptoAlgorithmRSASSA_PKCS1_v1_5.cpp:
        (WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::sign):
        (WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::verify):
        (WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::generateKey):
        * crypto/algorithms/CryptoAlgorithmRSA_OAEP.cpp:
        (WebCore::CryptoAlgorithmRSA_OAEP::encrypt):
        (WebCore::CryptoAlgorithmRSA_OAEP::decrypt):
        (WebCore::CryptoAlgorithmRSA_OAEP::generateKey):
        * crypto/mac/CryptoAlgorithmAES_CBCMac.cpp:
        (WebCore::CryptoAlgorithmAES_CBC::platformEncrypt):
        (WebCore::CryptoAlgorithmAES_CBC::platformDecrypt):
        * crypto/mac/CryptoKeyRSAMac.cpp:
        (WebCore::CryptoKeyRSA::generatePair):
        * css/BasicShapeFunctions.cpp:
        (WebCore::valueForBasicShape):
        (WebCore::basicShapeForValue):
        * css/CSSBasicShapes.cpp:
        (WebCore::CSSBasicShapePath::CSSBasicShapePath):
        * css/CSSBasicShapes.h:
        * css/CSSBorderImage.cpp:
        (WebCore::createBorderImageValue):
        * css/CSSCalculationValue.cpp:
        * css/CSSCalculationValue.h:
        (WebCore::CSSCalcValue::CSSCalcValue):
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::valueForNinePieceImageSlice):
        (WebCore::valueForNinePieceImageQuad):
        (WebCore::computedTransform):
        (WebCore::ComputedStyleExtractor::valueForShadow):
        (WebCore::ComputedStyleExtractor::valueForFilter):
        (WebCore::valueForGridTrackList):
        (WebCore::valueForGridPosition):
        (WebCore::scrollSnapPoints):
        (WebCore::scrollSnapCoordinates):
        (WebCore::getWillChangePropertyValue):
        (WebCore::fontVariantLigaturesPropertyValue):
        (WebCore::fontVariantNumericPropertyValue):
        (WebCore::fontVariantEastAsianPropertyValue):
        (WebCore::fillRepeatToCSSValue):
        (WebCore::fillSizeToCSSValue):
        (WebCore::fontVariantFromStyle):
        (WebCore::ComputedStyleExtractor::propertyValue):
        * css/CSSCrossfadeValue.cpp:
        (WebCore::CSSCrossfadeValue::blend):
        * css/CSSCursorImageValue.cpp:
        (WebCore::CSSCursorImageValue::CSSCursorImageValue):
        * css/CSSCursorImageValue.h:
        (WebCore::CSSCursorImageValue::create):
        * css/CSSFilterImageValue.cpp:
        (WebCore::CSSFilterImageValue::image):
        * css/CSSFilterImageValue.h:
        (WebCore::CSSFilterImageValue::create):
        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::addSource):
        * css/CSSFontFace.h:
        (WebCore::CSSFontFace::create):
        (WebCore::CSSFontFace::insertFeature):
        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):
        * css/CSSFontFeatureValue.cpp:
        (WebCore::CSSFontFeatureValue::CSSFontFeatureValue):
        * css/CSSFontFeatureValue.h:
        (WebCore::CSSFontFeatureValue::create):
        * css/CSSFontSelector.cpp:
        (WebCore::createFontFace):
        (WebCore::constructFamilyFontFaces):
        * css/CSSGrammar.y.in:
        * css/CSSImageValue.cpp:
        (WebCore::CSSImageValue::cloneForCSSOM):
        * css/CSSKeyframeRule.cpp:
        (WebCore::StyleKeyframe::StyleKeyframe):
        * css/CSSKeyframeRule.h:
        (WebCore::StyleKeyframe::create):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFontFaceValue):
        (WebCore::CSSParser::parseMediaQuery):
        (WebCore::CSSParser::parseSizesAttribute):
        (WebCore::CSSParser::SourceSize::SourceSize):
        (WebCore::CSSParser::sourceSize):
        (WebCore::CSSParser::addFillValue):
        (WebCore::CSSParser::addAnimationValue):
        (WebCore::CSSParser::parse4ValuesFillPosition):
        (WebCore::CSSParser::parse3ValuesFillPosition):
        (WebCore::CSSParser::parseFillPosition):
        (WebCore::CSSParser::parseFillSize):
        (WebCore::CSSParser::parseDashboardRegions):
        (WebCore::CSSParser::parseClipShape):
        (WebCore::CSSParser::parseBasicShapePath):
        (WebCore::CSSParser::parseSystemFont):
        (WebCore::CSSParser::parseBorderImageRepeat):
        (WebCore::BorderImageSliceParseContext::commitBorderImageSlice):
        (WebCore::BorderImageQuadParseContext::commitBorderImageQuad):
        (WebCore::CSSParser::parseBuiltinFilterArguments):
        (WebCore::CSSParser::parseFontFeatureTag):
        (WebCore::CSSParser::parseFontVariantLigatures):
        (WebCore::CSSParser::parseFontVariantNumeric):
        (WebCore::CSSParser::parseFontVariantEastAsian):
        (WebCore::CSSParser::createKeyframesRule):
        (WebCore::CSSParser::rewriteSpecifiers):
        (WebCore::CSSParser::createPageRule):
        (WebCore::CSSParser::createSelectorVector):
        (WebCore::CSSParser::recycleSelectorVector):
        * css/CSSParserValues.cpp:
        (WebCore::CSSParserSelector::~CSSParserSelector):
        (WebCore::CSSParserSelector::adoptSelectorVector):
        (WebCore::CSSParserSelector::setLangArgumentList):
        (WebCore::CSSParserSelector::insertTagHistory):
        (WebCore::CSSParserSelector::appendTagHistory):
        (WebCore::CSSParserSelector::prependTagSelector):
        * css/CSSParserValues.h:
        (WebCore::CSSParserSelector::releaseSelector):
        (WebCore::CSSParserSelector::setTagHistory):
        * css/CSSPrimitiveValue.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        * css/CSSProperty.cpp:
        (WebCore::CSSProperty::wrapValueInCommaSeparatedList):
        * css/CSSSegmentedFontFace.cpp:
        (WebCore::CSSSegmentedFontFace::appendFontFace):
        (WebCore::appendFontWithInvalidUnicodeRangeIfLoading):
        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::setLangArgumentList):
        (WebCore::CSSSelector::setSelectorList):
        * css/CSSStyleSheet.cpp:
        (WebCore::CSSStyleSheet::create):
        (WebCore::CSSStyleSheet::CSSStyleSheet):
        * css/CSSValueList.h:
        (WebCore::CSSValueList::append):
        (WebCore::CSSValueList::prepend):
        * css/DocumentRuleSets.cpp:
        (WebCore::DocumentRuleSets::initUserStyle):
        * css/FontLoader.cpp:
        (WebCore::FontLoader::scheduleEvent):
        * css/MediaList.cpp:
        (WebCore::MediaQuerySet::parse):
        (WebCore::MediaQuerySet::add):
        (WebCore::MediaQuerySet::addMediaQuery):
        * css/MediaQuery.cpp:
        (WebCore::MediaQuery::MediaQuery):
        * css/Pair.h:
        (WebCore::Pair::create):
        (WebCore::Pair::Pair):
        * css/RuleSet.cpp:
        (WebCore::RuleSet::addRegionRule):
        * css/RuleSet.h:
        (WebCore::RuleSet::RuleSetSelectorPair::RuleSetSelectorPair):
        * css/SVGCSSComputedStyleDeclaration.cpp:
        (WebCore::paintOrder):
        * css/SourceSizeList.cpp:
        (WebCore::match):
        (WebCore::parseSizesAttribute):
        * css/StyleBuilderCustom.h:
        (WebCore::StyleBuilderCustom::applyTextOrBoxShadowValue):
        (WebCore::StyleBuilderCustom::applyValueContent):
        (WebCore::StyleBuilderCustom::applyValueWillChange):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::State::setStyle):
        (WebCore::StyleResolver::addToMatchedPropertiesCache):
        * css/StyleResolver.h:
        (WebCore::StyleResolver::State::setParentStyle):
        (WebCore::StyleResolver::State::setAuthorRollback):
        (WebCore::StyleResolver::State::setUserRollback):
        * css/StyleRule.cpp:
        (WebCore::StyleRule::StyleRule):
        (WebCore::StyleRule::create):
        (WebCore::StyleRulePage::StyleRulePage):
        (WebCore::StyleRuleFontFace::StyleRuleFontFace):
        (WebCore::StyleRuleGroup::wrapperInsertRule):
        (WebCore::StyleRuleViewport::StyleRuleViewport):
        * css/StyleRule.h:
        (WebCore::StyleRule::create):
        (WebCore::StyleRule::wrapperAdoptSelectorList):
        (WebCore::StyleRuleFontFace::create):
        (WebCore::StyleRulePage::create):
        (WebCore::StyleRulePage::wrapperAdoptSelectorList):
        (WebCore::StyleRuleViewport::create):
        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorChecker):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementMatchesSelectorList):
        * dom/ActiveDOMCallbackMicrotask.cpp:
        (WebCore::ActiveDOMCallbackMicrotask::ActiveDOMCallbackMicrotask):
        * dom/Attr.cpp:
        (WebCore::Attr::cloneNodeInternal):
        * dom/ChildListMutationScope.cpp:
        (WebCore::ChildListMutationAccumulator::ChildListMutationAccumulator):
        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::insertBefore):
        (WebCore::ContainerNode::append):
        (WebCore::ContainerNode::prepend):
        * dom/DataTransfer.cpp:
        (WebCore::DataTransfer::DataTransfer):
        * dom/Document.cpp:
        (WebCore::Document::createNodeIterator):
        (WebCore::Document::createTreeWalker):
        (WebCore::Document::logExceptionToConsole):
        (WebCore::Document::cloneNodeInternal):
        (WebCore::Document::enqueueWindowEvent):
        (WebCore::Document::enqueueDocumentEvent):
        (WebCore::Document::enqueueOverflowEvent):
        (WebCore::Document::setTransformSource):
        (WebCore::Document::addMessage):
        (WebCore::Document::postTask):
        (WebCore::Document::pendingTasksTimerFired):
        (WebCore::Document::sendWillRevealEdgeEventsIfNeeded):
        * dom/DocumentEventQueue.cpp:
        (WebCore::DocumentEventQueue::enqueueOrDispatchScrollEvent):
        * dom/DocumentFragment.cpp:
        (WebCore::DocumentFragment::cloneNodeInternal):
        * dom/Element.cpp:
        (WebCore::Element::createElementRenderer):
        (WebCore::Element::addShadowRoot):
        (WebCore::Element::dispatchFocusInEvent):
        (WebCore::Element::dispatchFocusOutEvent):
        (WebCore::Element::dispatchFocusEvent):
        (WebCore::Element::dispatchBlurEvent):
        (WebCore::Element::resolveComputedStyle):
        (WebCore::Element::setBeforePseudoElement):
        (WebCore::Element::setAfterPseudoElement):
        * dom/ElementRareData.h:
        (WebCore::ElementRareData::setShadowRoot):
        (WebCore::ElementRareData::setAttributeMap):
        (WebCore::ElementRareData::setComputedStyle):
        (WebCore::ElementRareData::setClassList):
        (WebCore::ElementRareData::setDataset):
        (WebCore::ElementRareData::setBeforePseudoElement):
        (WebCore::ElementRareData::setAfterPseudoElement):
        * dom/Event.cpp:
        (WebCore::Event::setTarget):
        * dom/EventTarget.cpp:
        (WebCore::EventTarget::addEventListener):
        * dom/ExtensionStyleSheets.cpp:
        (WebCore::ExtensionStyleSheets::addUserStyleSheet):
        (WebCore::ExtensionStyleSheets::addAuthorStyleSheetForTesting):
        * dom/FocusEvent.cpp:
        (WebCore::FocusEvent::FocusEvent):
        * dom/FocusEvent.h:
        * dom/MessageEvent.cpp:
        (WebCore::MessageEvent::MessageEvent):
        (WebCore::MessageEvent::initMessageEvent):
        * dom/MessageEvent.h:
        * dom/MessagePort.cpp:
        (WebCore::MessagePort::postMessage):
        (WebCore::MessagePort::disentangle):
        (WebCore::MessagePort::entangle):
        (WebCore::MessagePort::dispatchMessages):
        (WebCore::MessagePort::disentanglePorts):
        (WebCore::MessagePort::entanglePorts):
        (WebCore::MessagePort::addEventListener):
        * dom/Microtasks.cpp:
        (WebCore::MicrotaskQueue::append):
        (WebCore::MicrotaskQueue::performMicrotaskCheckpoint):
        * dom/MutationObserver.cpp:
        (WebCore::queueMutationObserverCompoundMicrotask):
        * dom/NativeNodeFilter.h:
        * dom/Node.cpp:
        (WebCore::Node::before):
        (WebCore::Node::after):
        (WebCore::Node::replaceWith):
        (WebCore::Document::invalidateNodeListAndCollectionCaches):
        (WebCore::tryAddEventListener):
        (WebCore::Node::addEventListener):
        * dom/NodeIterator.cpp:
        (WebCore::NodeIterator::NodeIterator):
        * dom/NodeIterator.h:
        (WebCore::NodeIterator::create):
        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::setCSSStyleSheet):
        * dom/PseudoElement.cpp:
        (WebCore::PseudoElement::didRecalcStyle):
        * dom/ScopedEventQueue.cpp:
        (WebCore::ScopedEventQueue::enqueueEvent):
        (WebCore::ScopedEventQueue::dispatchAllEvents):
        * dom/ScriptExecutionContext.cpp:
        (WebCore::ScriptExecutionContext::reportException):
        * dom/ScriptExecutionContext.h:
        (WebCore::ScriptExecutionContext::Task::Task):
        * dom/SecurityContext.cpp:
        (WebCore::SecurityContext::setSecurityOriginPolicy):
        (WebCore::SecurityContext::setContentSecurityPolicy):
        * dom/SecurityOriginPolicy.cpp:
        (WebCore::SecurityOriginPolicy::create):
        (WebCore::SecurityOriginPolicy::SecurityOriginPolicy):
        * dom/SelectorQuery.cpp:
        (WebCore::SelectorQuery::SelectorQuery):
        (WebCore::SelectorQueryCache::add):
        * dom/ShadowRoot.cpp:
        (WebCore::ShadowRoot::ShadowRoot):
        * dom/ShadowRoot.h:
        * dom/SlotAssignment.cpp:
        (WebCore::SlotAssignment::SlotAssignment):
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::rebuildPresentationAttributeStyle):
        * dom/Text.cpp:
        (WebCore::Text::splitText):
        (WebCore::Text::replaceWholeText):
        * dom/Traversal.cpp:
        (WebCore::NodeIteratorBase::NodeIteratorBase):
        * dom/TreeWalker.cpp:
        (WebCore::TreeWalker::TreeWalker):
        (WebCore::TreeWalker::traverseSiblings):
        * dom/TreeWalker.h:
        (WebCore::TreeWalker::create):
        * dom/TypedElementDescendantIterator.h:
        (WebCore::DoubleTypedElementDescendantIteratorAdapter<ElementType>::DoubleTypedElementDescendantIteratorAdapter):
        (WebCore::DoubleTypedElementDescendantIterator<ElementType>::DoubleTypedElementDescendantIterator):
        * dom/default/PlatformMessagePortChannel.cpp:
        (WebCore::PlatformMessagePortChannel::EventData::EventData):
        (WebCore::MessagePortChannel::createChannel):
        (WebCore::MessagePortChannel::postMessageToRemote):
        * dom/default/PlatformMessagePortChannel.h:
        (WebCore::PlatformMessagePortChannel::EventData::channels):
        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
        * editing/AppendNodeCommand.cpp:
        (WebCore::AppendNodeCommand::AppendNodeCommand):
        * editing/AppendNodeCommand.h:
        (WebCore::AppendNodeCommand::create):
        * editing/CompositeEditCommand.cpp:
        (WebCore::CompositeEditCommand::replaceTextInNode):
        (WebCore::CompositeEditCommand::moveParagraphs):
        * editing/DeleteFromTextNodeCommand.h:
        (WebCore::DeleteFromTextNodeCommand::create):
        * editing/EditingStyle.cpp:
        (WebCore::applyTextDecorationChangeToValueList):
        (WebCore::EditingStyle::overrideTypingStyleAt):
        (WebCore::EditingStyle::conflictsWithInlineStyleOfElement):
        (WebCore::mergeTextDecorationValues):
        (WebCore::StyleChange::StyleChange):
        * editing/Editor.cpp:
        (WebCore::Editor::insertDictationPhrases):
        (WebCore::Editor::setTextAsChildOfElement):
        (WebCore::Editor::applyStyleToSelection):
        * editing/EditorCommand.cpp:
        (WebCore::applyCommandToFrame):
        (WebCore::executeInsertNode):
        (WebCore::executeInsertHorizontalRule):
        (WebCore::executeInsertImage):
        (WebCore::executeStrikethrough):
        (WebCore::executeUnderline):
        * editing/InsertIntoTextNodeCommand.h:
        (WebCore::InsertIntoTextNodeCommand::create):
        * editing/InsertNodeBeforeCommand.h:
        (WebCore::InsertNodeBeforeCommand::create):
        * editing/MergeIdenticalElementsCommand.cpp:
        (WebCore::MergeIdenticalElementsCommand::doApply):
        (WebCore::MergeIdenticalElementsCommand::doUnapply):
        * editing/MoveSelectionCommand.cpp:
        (WebCore::MoveSelectionCommand::doApply):
        * editing/RemoveNodeCommand.cpp:
        (WebCore::RemoveNodeCommand::RemoveNodeCommand):
        * editing/RemoveNodeCommand.h:
        (WebCore::RemoveNodeCommand::create):
        * editing/ReplaceDeleteFromTextNodeCommand.cpp:
        (WebCore::ReplaceDeleteFromTextNodeCommand::ReplaceDeleteFromTextNodeCommand):
        * editing/ReplaceDeleteFromTextNodeCommand.h:
        * editing/ReplaceInsertIntoTextNodeCommand.cpp:
        (WebCore::ReplaceInsertIntoTextNodeCommand::ReplaceInsertIntoTextNodeCommand):
        * editing/ReplaceInsertIntoTextNodeCommand.h:
        * editing/ReplaceNodeWithSpanCommand.cpp:
        (WebCore::swapInNodePreservingAttributesAndChildren):
        * editing/ReplaceSelectionCommand.h:
        (WebCore::ReplaceSelectionCommand::create):
        * editing/SplitElementCommand.cpp:
        (WebCore::SplitElementCommand::executeApply):
        (WebCore::SplitElementCommand::doUnapply):
        * editing/TextCheckingHelper.cpp:
        (WebCore::findGrammaticalErrors):
        (WebCore::checkTextOfParagraph):
        * editing/TextIterator.cpp:
        (WebCore::TextIteratorCopyableText::set):
        (WebCore::TextIterator::handleReplacedElement):
        (WebCore::TextIterator::emitText):
        (WebCore::SimplifiedBackwardsTextIterator::handleTextNode):
        (WebCore::TextIterator::rangeFromLocationAndLength):
        * editing/WrapContentsInDummySpanCommand.cpp:
        (WebCore::WrapContentsInDummySpanCommand::executeApply):
        (WebCore::WrapContentsInDummySpanCommand::doUnapply):
        * editing/ios/DictationCommandIOS.cpp:
        (WebCore::DictationCommandIOS::DictationCommandIOS):
        * editing/ios/DictationCommandIOS.h:
        (WebCore::DictationCommandIOS::create):
        * editing/ios/EditorIOS.mm:
        (WebCore::Editor::WebContentReader::readURL):
        (WebCore::Editor::createFragmentForImageResourceAndAddResource):
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::WebContentReader::readFilenames):
        (WebCore::Editor::WebContentReader::readURL):
        (WebCore::Editor::createFragmentForImageResourceAndAddResource):
        * editing/markup.cpp:
        (WebCore::fillContainerFromString):
        (WebCore::createFragmentFromText):
        (WebCore::replaceChildrenWithFragment):
        (WebCore::replaceChildrenWithText):
        * fileapi/AsyncFileStream.cpp:
        (WebCore::callOnFileThread):
        * fileapi/Blob.cpp:
        (WebCore::Blob::Blob):
        * fileapi/Blob.h:
        (WebCore::Blob::create):
        * fileapi/FileList.h:
        (WebCore::FileList::create):
        (WebCore::FileList::FileList):
        (WebCore::FileList::append):
        * fileapi/ThreadableBlobRegistry.cpp:
        (WebCore::BlobRegistryContext::BlobRegistryContext):
        (WebCore::ThreadableBlobRegistry::registerBlobURL):
        * fileapi/WebKitBlobBuilder.cpp:
        (WebCore::BlobBuilder::append):
        (WebCore::BlobBuilder::finalize):
        * history/BackForwardController.cpp:
        (WebCore::BackForwardController::BackForwardController):
        (WebCore::BackForwardController::addItem):
        * history/BackForwardList.cpp:
        (WebCore::BackForwardList::addItem):
        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::setCachedFramePlatformData):
        * history/HistoryItem.cpp:
        (WebCore::HistoryItem::setStateObject):
        (WebCore::HistoryItem::addChildItem):
        (WebCore::HistoryItem::setChildItem):
        (WebCore::HistoryItem::setFormData):
        (WebCore::HistoryItem::setRedirectURLs):
        * history/PageCache.cpp:
        (WebCore::PageCache::take):
        * html/BaseButtonInputType.cpp:
        (WebCore::BaseButtonInputType::createInputRenderer):
        * html/BaseChooserOnlyDateAndTimeInputType.cpp:
        (WebCore::BaseChooserOnlyDateAndTimeInputType::createShadowSubtree):
        * html/ColorInputType.cpp:
        (WebCore::ColorInputType::createShadowSubtree):
        * html/FTPDirectoryDocument.cpp:
        (WebCore::FTPDirectoryDocumentParser::appendEntry):
        (WebCore::FTPDirectoryDocumentParser::createTDForFilename):
        (WebCore::FTPDirectoryDocumentParser::createBasicDocument):
        (WebCore::FTPDirectoryDocumentParser::append):
        * html/FileInputType.cpp:
        (WebCore::FileInputType::createInputRenderer):
        (WebCore::FileInputType::createFileList):
        * html/FormController.cpp:
        (WebCore::FormController::formStatesFromStateVector):
        * html/HTMLAppletElement.cpp:
        (WebCore::HTMLAppletElement::createElementRenderer):
        * html/HTMLAttachmentElement.cpp:
        (WebCore::HTMLAttachmentElement::createElementRenderer):
        * html/HTMLBRElement.cpp:
        (WebCore::HTMLBRElement::createElementRenderer):
        * html/HTMLBodyElement.cpp:
        (WebCore::HTMLBodyElement::collectStyleForPresentationAttribute):
        * html/HTMLButtonElement.cpp:
        (WebCore::HTMLButtonElement::createElementRenderer):
        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::createElementRenderer):
        (WebCore::HTMLCanvasElement::setImageBuffer):
        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollection::updateNamedElementCache):
        * html/HTMLCollection.h:
        (WebCore::HTMLCollection::setNamedItemCache):
        * html/HTMLDetailsElement.cpp:
        (WebCore::HTMLDetailsElement::createElementRenderer):
        (WebCore::HTMLDetailsElement::didAddUserAgentShadowRoot):
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::populateEventHandlerNameMap):
        (WebCore::HTMLElement::setInnerText):
        (WebCore::HTMLElement::createElementRenderer):
        * html/HTMLFieldSetElement.cpp:
        (WebCore::HTMLFieldSetElement::createElementRenderer):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::dispatchBlurEvent):
        * html/HTMLFormControlsCollection.cpp:
        (WebCore::HTMLFormControlsCollection::updateNamedElementCache):
        * html/HTMLFrameElement.cpp:
        (WebCore::HTMLFrameElement::createElementRenderer):
        * html/HTMLFrameSetElement.cpp:
        (WebCore::HTMLFrameSetElement::createElementRenderer):
        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::createElementRenderer):
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::createElementRenderer):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::updateType):
        (WebCore::HTMLInputElement::createElementRenderer):
        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::setCSSStyleSheet):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::createElementRenderer):
        (WebCore::HTMLMediaElement::addEventListener):
        (WebCore::HTMLMediaElement::setWirelessPlaybackTarget):
        (WebCore::HTMLMediaElement::mediaPlayerCreateResourceLoader):
        * html/HTMLMeterElement.cpp:
        (WebCore::HTMLMeterElement::createElementRenderer):
        (WebCore::HTMLMeterElement::didAddUserAgentShadowRoot):
        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::createForJSConstructor):
        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::createElementRenderer):
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::createElementRenderer):
        * html/HTMLProgressElement.cpp:
        (WebCore::HTMLProgressElement::createElementRenderer):
        (WebCore::HTMLProgressElement::didAddUserAgentShadowRoot):
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::createElementRenderer):
        (WebCore::HTMLSelectElement::dispatchFocusEvent):
        (WebCore::HTMLSelectElement::dispatchBlurEvent):
        * html/HTMLSummaryElement.cpp:
        (WebCore::HTMLSummaryElement::createElementRenderer):
        * html/HTMLTableElement.cpp:
        (WebCore::HTMLTableElement::insertRow):
        * html/HTMLTableRowElement.cpp:
        (WebCore::HTMLTableRowElement::insertCell):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::createElementRenderer):
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::dispatchFocusEvent):
        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent):
        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::createElementRenderer):
        * html/HTMLWBRElement.cpp:
        (WebCore::HTMLWBRElement::createElementRenderer):
        * html/ImageDocument.cpp:
        (WebCore::ImageDocument::createDocumentStructure):
        * html/ImageInputType.cpp:
        (WebCore::ImageInputType::createInputRenderer):
        * html/InputType.cpp:
        (WebCore::InputType::createInputRenderer):
        * html/MediaDocument.cpp:
        (WebCore::MediaDocumentParser::createDocumentStructure):
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::setPlaybackTarget):
        * html/PluginDocument.cpp:
        (WebCore::PluginDocumentParser::createDocumentStructure):
        * html/RangeInputType.cpp:
        (WebCore::RangeInputType::createShadowSubtree):
        (WebCore::RangeInputType::createInputRenderer):
        * html/RubyElement.cpp:
        (WebCore::RubyElement::createElementRenderer):
        * html/RubyTextElement.cpp:
        (WebCore::RubyTextElement::createElementRenderer):
        * html/SearchInputType.cpp:
        (WebCore::SearchInputType::createInputRenderer):
        (WebCore::SearchInputType::createShadowSubtree):
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::createInputRenderer):
        * html/ValidationMessage.cpp:
        (WebCore::ValidationMessage::buildBubbleTree):
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::createLinearGradient):
        (WebCore::CanvasRenderingContext2D::createRadialGradient):
        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::LRUImageBufferCache::imageBuffer):
        * html/parser/AtomicHTMLToken.h:
        (WebCore::AtomicHTMLToken::AtomicHTMLToken):
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::executeQueuedTasks):
        (WebCore::HTMLConstructionSite::insertTextNode):
        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::append):
        * html/parser/HTMLElementStack.cpp:
        (WebCore::HTMLElementStack::ElementRecord::ElementRecord):
        (WebCore::HTMLElementStack::pushCommon):
        * html/parser/HTMLElementStack.h:
        (WebCore::HTMLElementStack::ElementRecord::releaseNext):
        (WebCore::HTMLElementStack::ElementRecord::setNext):
        * html/parser/HTMLPreloadScanner.cpp:
        (WebCore::TokenPreloadScanner::scan):
        (WebCore::HTMLPreloadScanner::scan):
        * html/parser/HTMLResourcePreloader.cpp:
        (WebCore::HTMLResourcePreloader::preload):
        * html/parser/HTMLStackItem.h:
        (WebCore::HTMLStackItem::HTMLStackItem):
        (WebCore::HTMLStackItem::create):
        * html/parser/HTMLToken.h:
        (WebCore::HTMLToken::releaseDoctypeData):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::takeScriptToProcess):
        (WebCore::HTMLTreeBuilder::processFakeStartTag):
        (WebCore::HTMLTreeBuilder::insertPhoneNumberLink):
        * html/parser/TextDocumentParser.cpp:
        (WebCore::TextDocumentParser::append):
        (WebCore::TextDocumentParser::insertFakePreElement):
        * html/parser/XSSAuditorDelegate.cpp:
        (WebCore::XSSAuditorDelegate::generateViolationReport):
        * html/shadow/DetailsMarkerControl.cpp:
        (WebCore::DetailsMarkerControl::createElementRenderer):
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlTimelineContainerElement::createElementRenderer):
        (WebCore::MediaControlVolumeSliderContainerElement::createElementRenderer):
        (WebCore::MediaControlClosedCaptionsTrackListElement::rebuildTrackListMenu):
        (WebCore::MediaControlTextTrackContainerElement::createElementRenderer):
        (WebCore::MediaControlTextTrackContainerElement::createTextTrackRepresentationImage):
        * html/shadow/MediaControls.cpp:
        (WebCore::MediaControls::createTextTrackDisplay):
        * html/shadow/MediaControlsApple.cpp:
        (WebCore::MediaControlsApple::createControls):
        (WebCore::MediaControlsApple::showClosedCaptionTrackList):
        * html/shadow/MeterShadowElement.cpp:
        (WebCore::MeterInnerElement::createElementRenderer):
        * html/shadow/ProgressShadowElement.cpp:
        (WebCore::ProgressInnerElement::createElementRenderer):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::RenderSliderThumb::RenderSliderThumb):
        (WebCore::SliderThumbElement::createElementRenderer):
        (WebCore::SliderContainerElement::createElementRenderer):
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::TextControlInnerContainer::createElementRenderer):
        (WebCore::TextControlInnerTextElement::createElementRenderer):
        * html/shadow/mac/ImageControlsButtonElementMac.cpp:
        (WebCore::RenderImageControlsButton::RenderImageControlsButton):
        (WebCore::ImageControlsButtonElementMac::createElementRenderer):
        * html/shadow/mac/ImageControlsRootElementMac.cpp:
        (WebCore::RenderImageControls::RenderImageControls):
        (WebCore::ImageControlsRootElement::maybeCreate):
        (WebCore::ImageControlsRootElementMac::createElementRenderer):
        * html/track/VTTCue.cpp:
        (WebCore::VTTCueBox::createElementRenderer):
        * html/track/WebVTTElement.cpp:
        (WebCore::WebVTTElement::cloneElementWithoutAttributesAndChildren):
        * html/track/WebVTTParser.cpp:
        (WebCore::WebVTTTreeBuilder::constructTreeFromToken):
        * inspector/CommandLineAPIHost.cpp:
        (WebCore::CommandLineAPIHost::inspectImpl):
        (WebCore::CommandLineAPIHost::addInspectedObject):
        * inspector/DOMEditor.cpp:
        (WebCore::DOMEditor::InsertBeforeAction::InsertBeforeAction):
        (WebCore::DOMEditor::ReplaceChildNodeAction::ReplaceChildNodeAction):
        (WebCore::DOMEditor::insertBefore):
        (WebCore::DOMEditor::setOuterHTML):
        (WebCore::DOMEditor::replaceChild):
        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::createDigest):
        (WebCore::DOMPatchSupport::removeChildAndMoveToNew):
        * inspector/InspectorApplicationCacheAgent.cpp:
        (WebCore::InspectorApplicationCacheAgent::getFramesWithManifests):
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::getMatchedStylesForNode):
        (WebCore::InspectorCSSAgent::addRule):
        (WebCore::InspectorCSSAgent::getSupportedCSSProperties):
        (WebCore::InspectorCSSAgent::getSupportedSystemFontFamilyNames):
        (WebCore::InspectorCSSAgent::getNamedFlowCollection):
        (WebCore::InspectorCSSAgent::buildArrayForMatchedRuleList):
        (WebCore::InspectorCSSAgent::buildArrayForRegions):
        (WebCore::InspectorCSSAgent::buildObjectForNamedFlow):
        * inspector/InspectorConsoleInstrumentation.h:
        (WebCore::InspectorInstrumentation::addMessageToConsole):
        (WebCore::InspectorInstrumentation::consoleCount):
        (WebCore::InspectorInstrumentation::stopConsoleTiming):
        (WebCore::InspectorInstrumentation::consoleTimeStamp):
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
        (WebCore::InspectorDOMAgent::highlightRect):
        (WebCore::InspectorDOMAgent::highlightQuad):
        (WebCore::InspectorDOMAgent::innerHighlightQuad):
        (WebCore::InspectorDOMAgent::highlightSelector):
        (WebCore::InspectorDOMAgent::buildObjectForNode):
        (WebCore::InspectorDOMAgent::buildArrayForPseudoElements):
        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
        (WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):
        (WebCore::InspectorDOMAgent::didCommitLoad):
        (WebCore::InspectorDOMAgent::didInsertDOMNode):
        (WebCore::InspectorDOMAgent::styleAttributeInvalidated):
        * inspector/InspectorDOMDebuggerAgent.cpp:
        (WebCore::InspectorDOMDebuggerAgent::didInvalidateStyleAttr):
        (WebCore::InspectorDOMDebuggerAgent::willInsertDOMNode):
        (WebCore::InspectorDOMDebuggerAgent::willRemoveDOMNode):
        (WebCore::InspectorDOMDebuggerAgent::willModifyDOMAttr):
        (WebCore::InspectorDOMDebuggerAgent::pauseOnNativeEventIfNeeded):
        (WebCore::InspectorDOMDebuggerAgent::willSendXMLHttpRequest):
        * inspector/InspectorDOMStorageAgent.cpp:
        (WebCore::InspectorDOMStorageAgent::getDOMStorageItems):
        * inspector/InspectorDatabaseAgent.cpp:
        (WebCore::InspectorDatabaseAgent::didOpenDatabase):
        (WebCore::InspectorDatabaseAgent::executeSQL):
        * inspector/InspectorDatabaseResource.cpp:
        (WebCore::InspectorDatabaseResource::create):
        (WebCore::InspectorDatabaseResource::bind):
        * inspector/InspectorDatabaseResource.h:
        (WebCore::InspectorDatabaseResource::setDatabase):
        * inspector/InspectorFrontendClientLocal.cpp:
        (WebCore::InspectorFrontendClientLocal::InspectorFrontendClientLocal):
        * inspector/InspectorHistory.cpp:
        (WebCore::InspectorHistory::perform):
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore::InspectorIndexedDBAgent::requestDatabaseNames):
        (WebCore::InspectorIndexedDBAgent::requestDatabase):
        (WebCore::InspectorIndexedDBAgent::requestData):
        (WebCore::ClearObjectStoreListener::create):
        (WebCore::ClearObjectStoreListener::ClearObjectStoreListener):
        (WebCore::ClearObjectStore::create):
        (WebCore::ClearObjectStore::ClearObjectStore):
        (WebCore::InspectorIndexedDBAgent::clearObjectStore):
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::addMessageToConsoleImpl):
        (WebCore::InspectorInstrumentation::didOpenDatabaseImpl):
        (WebCore::InspectorInstrumentation::sessionCreatedImpl):
        (WebCore::InspectorInstrumentation::sessionLoadedImpl):
        (WebCore::InspectorInstrumentation::sessionModifiedImpl):
        (WebCore::InspectorInstrumentation::segmentCreatedImpl):
        (WebCore::InspectorInstrumentation::segmentCompletedImpl):
        (WebCore::InspectorInstrumentation::segmentLoadedImpl):
        * inspector/InspectorInstrumentation.h:
        (WebCore::InspectorInstrumentation::didOpenDatabase):
        (WebCore::InspectorInstrumentation::sessionCreated):
        (WebCore::InspectorInstrumentation::sessionLoaded):
        (WebCore::InspectorInstrumentation::sessionModified):
        (WebCore::InspectorInstrumentation::segmentCreated):
        (WebCore::InspectorInstrumentation::segmentCompleted):
        (WebCore::InspectorInstrumentation::segmentLoaded):
        * inspector/InspectorLayerTreeAgent.cpp:
        (WebCore::InspectorLayerTreeAgent::reasonsForCompositingLayer):
        * inspector/InspectorNetworkAgent.cpp:
        (WebCore::buildObjectForResourceResponse):
        (WebCore::buildObjectForCachedResource):
        (WebCore::InspectorNetworkAgent::buildInitiatorObject):
        (WebCore::InspectorNetworkAgent::willSendWebSocketHandshakeRequest):
        (WebCore::InspectorNetworkAgent::didReceiveWebSocketHandshakeResponse):
        (WebCore::InspectorNetworkAgent::didReceiveWebSocketFrame):
        (WebCore::InspectorNetworkAgent::didSendWebSocketFrame):
        * inspector/InspectorOverlay.cpp:
        (WebCore::InspectorOverlay::highlightNodeList):
        (WebCore::InspectorOverlay::highlightQuad):
        (WebCore::buildObjectForHighlight):
        (WebCore::buildObjectForFlowRegions):
        (WebCore::InspectorOverlay::drawPaintRects):
        (WebCore::buildArrayForRendererFragments):
        (WebCore::buildObjectForShapeOutside):
        (WebCore::buildObjectForElementData):
        (WebCore::InspectorOverlay::buildHighlightObjectForNode):
        (WebCore::InspectorOverlay::buildObjectForHighlightedNodes):
        (WebCore::InspectorOverlay::reset):
        (WebCore::InspectorOverlay::evaluateInOverlay):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::buildObjectForFrameTree):
        * inspector/InspectorReplayAgent.cpp:
        (WebCore::buildInspectorObjectForSession):
        (WebCore::SerializeInputToJSONFunctor::operator()):
        (WebCore::SerializeInputToJSONFunctor::returnValue):
        (WebCore::buildInspectorObjectForSegment):
        (WebCore::InspectorReplayAgent::switchSession):
        (WebCore::InspectorReplayAgent::insertSessionSegment):
        (WebCore::InspectorReplayAgent::removeSessionSegment):
        (WebCore::InspectorReplayAgent::getSessionData):
        (WebCore::InspectorReplayAgent::getSegmentData):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::asCSSRuleList):
        (WebCore::InspectorStyle::create):
        (WebCore::InspectorStyle::buildObjectForStyle):
        (WebCore::InspectorStyle::buildArrayForComputedStyle):
        (WebCore::InspectorStyle::styleWithProperties):
        (WebCore::InspectorStyleSheet::create):
        (WebCore::InspectorStyleSheet::InspectorStyleSheet):
        (WebCore::InspectorStyleSheet::buildObjectForStyleSheet):
        (WebCore::buildObjectForSelectorHelper):
        (WebCore::InspectorStyleSheet::buildObjectForRule):
        (WebCore::InspectorStyleSheet::ensureSourceData):
        (WebCore::InspectorStyleSheet::buildArrayForRuleList):
        (WebCore::InspectorStyleSheet::collectFlatRules):
        (WebCore::InspectorStyleSheetForInlineStyle::create):
        (WebCore::InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::startProfiling):
        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
        (WebCore::InspectorTimelineAgent::appendRecord):
        (WebCore::InspectorTimelineAgent::sendEvent):
        (WebCore::InspectorTimelineAgent::createRecordEntry):
        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
        * inspector/InspectorTimelineAgent.h:
        * inspector/NetworkResourcesData.cpp:
        (WebCore::NetworkResourcesData::addResourceSharedBuffer):
        * inspector/NetworkResourcesData.h:
        (WebCore::NetworkResourcesData::ResourceData::setDecoder):
        (WebCore::NetworkResourcesData::ResourceData::setBuffer):
        * inspector/TimelineRecordFactory.cpp:
        (WebCore::buildInspectorObject):
        (WebCore::buildProfileInspectorObject):
        * inspector/WebInjectedScriptManager.cpp:
        (WebCore::WebInjectedScriptManager::WebInjectedScriptManager):
        * loader/ContentFilter.cpp:
        (WebCore::ContentFilter::createIfEnabled):
        (WebCore::ContentFilter::ContentFilter):
        * loader/CrossOriginPreflightResultCache.cpp:
        (WebCore::CrossOriginPreflightResultCache::appendEntry):
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::subresources):
        (WebCore::DocumentLoader::installContentFilterUnblockHandler):
        * loader/DocumentLoader.h:
        (WebCore::DocumentLoader::setQuickLookHandle):
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequest):
        (WebCore::DocumentThreadableLoader::didReceiveResponse):
        * loader/HistoryController.cpp:
        (WebCore::HistoryController::updateBackForwardListClippedAtTarget):
        (WebCore::HistoryController::pushState):
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::MediaResourceLoader):
        * loader/NavigationScheduler.cpp:
        (WebCore::NavigationScheduler::timerFired):
        (WebCore::NavigationScheduler::schedule):
        (WebCore::NavigationScheduler::cancel):
        * loader/NetscapePlugInStreamLoader.cpp:
        (WebCore::NetscapePlugInStreamLoader::willSendRequest):
        * loader/PolicyCallback.cpp:
        (WebCore::PolicyCallback::set):
        * loader/PolicyChecker.cpp:
        (WebCore::PolicyChecker::checkNavigationPolicy):
        (WebCore::PolicyChecker::checkNewWindowPolicy):
        (WebCore::PolicyChecker::checkContentPolicy):
        * loader/PolicyChecker.h:
        (WebCore::PolicyChecker::setContentFilterUnblockHandler):
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::willSendRequest):
        * loader/ThreadableLoader.cpp:
        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions):
        (WebCore::ThreadableLoaderOptions::isolatedCopy):
        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::ApplicationCacheGroup):
        * loader/archive/cf/LegacyWebArchive.cpp:
        (WebCore::LegacyWebArchive::create):
        * loader/cache/CachedCSSStyleSheet.cpp:
        (WebCore::CachedCSSStyleSheet::saveParsedStyleSheet):
        * loader/icon/IconDatabase.cpp:
        (WebCore::IconDatabase::syncThreadMainLoop):
        * mathml/MathMLInlineContainerElement.cpp:
        (WebCore::MathMLInlineContainerElement::createElementRenderer):
        * mathml/MathMLMathElement.cpp:
        (WebCore::MathMLMathElement::createElementRenderer):
        * mathml/MathMLMencloseElement.cpp:
        (WebCore::MathMLMencloseElement::createElementRenderer):
        * mathml/MathMLSelectElement.cpp:
        (WebCore::MathMLSelectElement::createElementRenderer):
        * mathml/MathMLTextElement.cpp:
        (WebCore::MathMLTextElement::createElementRenderer):
        * page/CaptionUserPreferences.cpp:
        (WebCore::CaptionUserPreferences::updateCaptionStyleSheetOveride):
        * page/DOMTimer.cpp:
        (WebCore::DOMTimer::DOMTimer):
        (WebCore::DOMTimer::install):
        * page/DOMWindow.cpp:
        (WebCore::PostMessageTimer::PostMessageTimer):
        (WebCore::PostMessageTimer::event):
        (WebCore::DOMWindow::postMessage):
        (WebCore::DOMWindow::setTimeout):
        (WebCore::DOMWindow::setInterval):
        (WebCore::DOMWindow::addEventListener):
        (WebCore::DOMWindow::showModalDialog):
        * page/DebugPageOverlays.cpp:
        (WebCore::MouseWheelRegionOverlay::updateRegion):
        (WebCore::NonFastScrollableRegionOverlay::updateRegion):
        (WebCore::DebugPageOverlays::ensureRegionOverlayForFrame):
        * page/DragController.cpp:
        (WebCore::documentFragmentFromDragData):
        (WebCore::DragController::concludeEditDrag):
        * page/Frame.cpp:
        (WebCore::Frame::setView):
        * page/FrameView.cpp:
        (WebCore::FrameView::sendResizeEventIfNeeded):
        (WebCore::FrameView::updateOverflowStatus):
        * page/Page.cpp:
        (WebCore::Page::Page):
        (WebCore::Page::setSessionStorage):
        (WebCore::Page::setStorageNamespaceProvider):
        (WebCore::Page::setVisitedLinkStore):
        * page/PageConsoleClient.cpp:
        (WebCore::PageConsoleClient::addMessage):
        (WebCore::PageConsoleClient::messageWithTypeAndLevel):
        (WebCore::PageConsoleClient::count):
        (WebCore::PageConsoleClient::profileEnd):
        (WebCore::PageConsoleClient::timeEnd):
        (WebCore::PageConsoleClient::timeStamp):
        * page/PageOverlayController.cpp:
        (WebCore::PageOverlayController::installPageOverlay):
        * page/TextIndicator.cpp:
        (WebCore::takeSnapshot):
        * page/UserContentController.cpp:
        (WebCore::UserContentController::addUserScript):
        (WebCore::UserContentController::addUserStyleSheet):
        * page/UserScript.h:
        (WebCore::UserScript::UserScript):
        * page/UserStyleSheet.h:
        (WebCore::UserStyleSheet::UserStyleSheet):
        * page/WheelEventTestTrigger.cpp:
        (WebCore::WheelEventTestTrigger::setTestCallbackAndStartNotificationTimer):
        (WebCore::WheelEventTestTrigger::triggerTestTimerFired):
        * page/animation/AnimationController.cpp:
        (WebCore::AnimationControllerPrivate::fireEventsAndUpdateStyle):
        (WebCore::AnimationControllerPrivate::addElementChangeToDispatch):
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::blendFilter):
        (WebCore::crossfadeBlend):
        (WebCore::PropertyWrapperShadow::blendSimpleOrMatchedShadowLists):
        (WebCore::PropertyWrapperShadow::blendMismatchedShadowLists):
        (WebCore::ShorthandPropertyWrapper::ShorthandPropertyWrapper):
        (WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap):
        * page/cocoa/ResourceUsageOverlayCocoa.mm:
        (WebCore::RingBuffer::append):
        (WebCore::MemoryCategoryInfo::MemoryCategoryInfo):
        * page/mac/TextIndicatorWindow.mm:
        (WebCore::TextIndicatorWindow::clearTextIndicator):
        * page/scrolling/AxisScrollSnapOffsets.cpp:
        (WebCore::updateSnapOffsetsForScrollableArea):
        * page/scrolling/ScrollingStateTree.cpp:
        (WebCore::ScrollingStateTree::setRemovedNodes):
        * page/scrolling/ScrollingThread.cpp:
        (WebCore::ScrollingThread::dispatchBarrier):
        (WebCore::ScrollingThread::dispatchFunctionsFromScrollingThread):
        * page/scrolling/ThreadedScrollingTree.cpp:
        (WebCore::ThreadedScrollingTree::commitNewTreeState):
        * page/scrolling/ios/ScrollingTreeIOS.cpp:
        (WebCore::ScrollingTreeIOS::commitNewTreeState):
        * page/scrolling/mac/ScrollingCoordinatorMac.mm:
        (WebCore::ScrollingCoordinatorMac::commitTreeState):
        * platform/CalculationValue.cpp:
        (WebCore::CalculationValue::create):
        * platform/CalculationValue.h:
        (WebCore::CalculationValue::CalculationValue):
        (WebCore::CalcExpressionBinaryOperation::CalcExpressionBinaryOperation):
        * platform/DragImage.cpp:
        (WebCore::createDragImageFromSnapshot):
        * platform/KeyedCoding.h:
        (WebCore::KeyedDecoder::decodeObjects):
        * platform/Length.cpp:
        (WebCore::Length::Length):
        (WebCore::Length::blendMixedTypes):
        * platform/LengthSize.h:
        (WebCore::LengthSize::LengthSize):
        (WebCore::LengthSize::setWidth):
        (WebCore::LengthSize::setHeight):
        * platform/MainThreadSharedTimer.cpp:
        (WebCore::MainThreadSharedTimer::setFiredFunction):
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::setHorizontalSnapOffsets):
        (WebCore::ScrollableArea::setVerticalSnapOffsets):
        * platform/SharedBuffer.cpp:
        (WebCore::SharedBuffer::SharedBuffer):
        (WebCore::SharedBuffer::createWithContentsOfFile):
        (WebCore::SharedBuffer::maybeTransferMappedFileData):
        * platform/Supplementable.h:
        (WebCore::Supplement::provideTo):
        (WebCore::Supplementable::provideSupplement):
        * platform/Timer.h:
        (WebCore::Timer::Timer):
        (WebCore::DeferrableOneShotTimer::DeferrableOneShotTimer):
        * platform/URL.h:
        (WebCore::URLCapture::releaseURL):
        * platform/audio/AudioBus.cpp:
        (WebCore::AudioBus::AudioBus):
        * platform/audio/HRTFDatabase.cpp:
        (WebCore::HRTFDatabase::HRTFDatabase):
        * platform/audio/HRTFElevation.cpp:
        (WebCore::HRTFElevation::createForSubject):
        (WebCore::HRTFElevation::createByInterpolatingSlices):
        * platform/audio/HRTFElevation.h:
        (WebCore::HRTFElevation::HRTFElevation):
        * platform/audio/HRTFKernel.cpp:
        (WebCore::HRTFKernel::createInterpolatedKernel):
        * platform/audio/HRTFKernel.h:
        (WebCore::HRTFKernel::create):
        (WebCore::HRTFKernel::HRTFKernel):
        * platform/audio/ReverbConvolver.cpp:
        (WebCore::ReverbConvolver::ReverbConvolver):
        * platform/audio/ios/MediaSessionManagerIOS.mm:
        (-[WebMediaSessionHelper dealloc]):
        * platform/cf/KeyedDecoderCF.cpp:
        (WebCore::KeyedDecoderCF::KeyedDecoderCF):
        * platform/cocoa/ContentFilterUnblockHandlerCocoa.mm:
        (WebCore::ContentFilterUnblockHandler::ContentFilterUnblockHandler):
        * platform/glib/KeyedDecoderGlib.cpp:
        (WebCore::KeyedDecoderGlib::dictionaryFromGVariant):
        * platform/graphics/FloatPolygon.cpp:
        (WebCore::FloatPolygon::FloatPolygon):
        * platform/graphics/Font.cpp:
        (WebCore::Font::Font):
        (WebCore::createAndFillGlyphPage):
        (WebCore::Font::systemFallbackFontForCharacter):
        * platform/graphics/Font.h:
        (WebCore::Font::create):
        * platform/graphics/FontCache.cpp:
        (WebCore::FontCache::purgeInactiveFontData):
        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascadeCacheEntry::FontCascadeCacheEntry):
        (WebCore::retrieveOrAddCachedFonts):
        (WebCore::FontCascade::update):
        * platform/graphics/FontCascadeFonts.cpp:
        (WebCore::realizeNextFallback):
        * platform/graphics/FontCascadeFonts.h:
        (WebCore::FontCascadeFonts::create):
        * platform/graphics/FontDescription.h:
        (WebCore::FontDescription::setFeatureSettings):
        * platform/graphics/FontFeatureSettings.cpp:
        (WebCore::FontFeature::FontFeature):
        (WebCore::FontFeatureSettings::insert):
        * platform/graphics/FontRanges.h:
        (WebCore::FontRanges::Range::Range):
        * platform/graphics/GLContext.cpp:
        (WebCore::GLContext::createContextForWindow):
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::setStrokePattern):
        (WebCore::GraphicsContext::setFillPattern):
        (WebCore::GraphicsContext::setStrokeGradient):
        (WebCore::GraphicsContext::setFillGradient):
        (WebCore::GraphicsContext::drawConsumingImageBuffer):
        * platform/graphics/GraphicsLayer.cpp:
        (WebCore::KeyframeValueList::insert):
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::setWirelessPlaybackTarget):
        (WebCore::MediaPlayer::createResourceLoader):
        * platform/graphics/PlatformMediaResourceLoader.h:
        (WebCore::PlatformMediaResourceLoader::PlatformMediaResourceLoader):
        * platform/graphics/avfoundation/CDMPrivateMediaSourceAVFObjC.mm:
        (WebCore::CDMPrivateMediaSourceAVFObjC::createSession):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setWirelessPlaybackTarget):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setWirelessPlaybackTarget):
        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::setContentsScale):
        * platform/graphics/cg/IOSurfacePool.cpp:
        (WebCore::IOSurfacePool::takeSurface):
        (WebCore::IOSurfacePool::addSurface):
        (WebCore::IOSurfacePool::insertSurfaceIntoPool):
        (WebCore::IOSurfacePool::collectInUseSurfaces):
        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::ImageBuffer::copyImage):
        (WebCore::ImageBuffer::sinkIntoImage):
        (WebCore::ImageBuffer::sinkIntoNativeImage):
        (WebCore::ImageBuffer::drawConsuming):
        * platform/graphics/cocoa/IOSurface.mm:
        (IOSurface::moveToPool):
        (IOSurface::createFromImageBuffer):
        (IOSurface::convertToFormat):
        * platform/graphics/efl/CairoUtilitiesEfl.cpp:
        (WebCore::evasObjectFromCairoImageSurface):
        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
        (WebCore::GraphicsContext3D::setContextLostCallback):
        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
        (WebCore::GraphicsContext3DPrivate::setContextLostCallback):
        * platform/graphics/egl/GLContextEGL.cpp:
        (WebCore::GLContextEGL::createWindowContext):
        (WebCore::GLContextEGL::createPixmapContext):
        (WebCore::GLContextEGL::createContext):
        (WebCore::GLContextEGL::GLContextEGL):
        * platform/graphics/filters/FETile.cpp:
        (WebCore::FETile::platformApplySoftware):
        * platform/graphics/filters/Filter.h:
        (WebCore::Filter::setSourceImage):
        * platform/graphics/filters/FilterOperation.h:
        * platform/graphics/glx/GLContextGLX.cpp:
        (WebCore::GLContextGLX::createWindowContext):
        (WebCore::GLContextGLX::createPbufferContext):
        (WebCore::GLContextGLX::createPixmapContext):
        (WebCore::GLContextGLX::createContext):
        (WebCore::GLContextGLX::GLContextGLX):
        * platform/graphics/gpu/Texture.cpp:
        (WebCore::Texture::Texture):
        (WebCore::Texture::create):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::pushTextureToCompositor):
        * platform/graphics/gstreamer/MediaPlayerRequestInstallMissingPluginsCallback.h:
        (WebCore::MediaPlayerRequestInstallMissingPluginsCallback::create):
        (WebCore::MediaPlayerRequestInstallMissingPluginsCallback::MediaPlayerRequestInstallMissingPluginsCallback):
        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
        (VideoRenderRequestScheduler::render):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::setWirelessPlaybackTarget):
        * platform/graphics/opengl/Extensions3DOpenGLES.cpp:
        (WebCore::Extensions3DOpenGLES::setEXTContextLostCallback):
        * platform/graphics/surfaces/GLTransportSurface.cpp:
        (WebCore::GLTransportSurface::createTransportSurface):
        (WebCore::GLTransportSurfaceClient::createTransportSurfaceClient):
        * platform/graphics/surfaces/egl/EGLSurface.cpp:
        (WebCore::EGLTransportSurface::createTransportSurface):
        (WebCore::EGLTransportSurface::createTransportSurfaceClient):
        * platform/graphics/texmap/BitmapTexturePool.cpp:
        (WebCore::BitmapTexturePool::BitmapTexturePool):
        * platform/graphics/texmap/BitmapTexturePool.h:
        (WebCore::BitmapTexturePool::Entry::Entry):
        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::removeAllChildren):
        * platform/graphics/texmap/TextureMapperPlatformLayerBuffer.cpp:
        (WebCore::TextureMapperPlatformLayerBuffer::TextureMapperPlatformLayerBuffer):
        * platform/graphics/texmap/TextureMapperPlatformLayerBuffer.h:
        (WebCore::TextureMapperPlatformLayerBuffer::setUnmanagedBufferDataHolder):
        * platform/graphics/texmap/TextureMapperPlatformLayerProxy.cpp:
        (WebCore::TextureMapperPlatformLayerProxy::pushNextBuffer):
        (WebCore::TextureMapperPlatformLayerProxy::getAvailableBuffer):
        (WebCore::TextureMapperPlatformLayerProxy::releaseUnusedBuffersTimerFired):
        (WebCore::TextureMapperPlatformLayerProxy::swapBuffer):
        (WebCore::TextureMapperPlatformLayerProxy::scheduleUpdateOnCompositorThread):
        (WebCore::TextureMapperPlatformLayerProxy::compositorThreadUpdateTimerFired):
        * platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:
        (WebCore::CompositingCoordinator::releaseInactiveAtlasesTimerFired):
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
        (WebCore::CoordinatedGraphicsLayer::adjustContentsScale):
        * platform/graphics/wayland/PlatformDisplayWayland.cpp:
        (WebCore::PlatformDisplayWayland::createSharingGLContext):
        * platform/graphics/win/FontCacheWin.cpp:
        (WebCore::FontCache::createFontPlatformData):
        * platform/graphics/win/FontCustomPlatformData.cpp:
        (WebCore::FontCustomPlatformData::fontPlatformData):
        * platform/graphics/win/FontCustomPlatformDataCairo.cpp:
        (WebCore::FontCustomPlatformData::fontPlatformData):
        * platform/graphics/win/FontPlatformDataCGWin.cpp:
        (WebCore::FontPlatformData::FontPlatformData):
        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
        (WebCore::FontPlatformData::FontPlatformData):
        * platform/graphics/win/FontPlatformDataWin.cpp:
        (WebCore::FontPlatformData::FontPlatformData):
        * platform/graphics/win/SharedGDIObject.h:
        (WebCore::SharedGDIObject::create):
        (WebCore::SharedGDIObject::SharedGDIObject):
        * platform/graphics/win/SimpleFontDataWin.cpp:
        (WebCore::Font::platformCreateScaledFont):
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (WebVideoFullscreenInterfaceAVKit::preparedToReturnToInline):
        * platform/mac/HIDGamepadProvider.cpp:
        (WebCore::HIDGamepadProvider::deviceAdded):
        * platform/mac/ThemeMac.mm:
        (WebCore::ThemeMac::drawCellOrFocusRingWithViewIntoContext):
        * platform/mediastream/MediaStreamPrivate.cpp:
        (WebCore::MediaStreamPrivate::create):
        * platform/mediastream/MediaStreamTrackPrivate.cpp:
        (WebCore::MediaStreamTrackPrivate::create):
        * platform/mediastream/mac/AVVideoCaptureSource.mm:
        (WebCore::AVVideoCaptureSource::currentFrameImage):
        * platform/network/BlobData.h:
        (WebCore::RawData::create):
        (WebCore::RawData::RawData):
        * platform/network/BlobPart.h:
        (WebCore::BlobPart::BlobPart):
        (WebCore::BlobPart::moveData):
        * platform/network/DataURLDecoder.cpp:
        (WebCore::DataURLDecoder::DecodingResultDispatcher::dispatch):
        (WebCore::DataURLDecoder::DecodingResultDispatcher::DecodingResultDispatcher):
        (WebCore::DataURLDecoder::DecodingResultDispatcher::timerFired):
        (WebCore::DataURLDecoder::createDecodeTask):
        (WebCore::DataURLDecoder::decode):
        * platform/network/HTTPHeaderMap.cpp:
        (WebCore::HTTPHeaderMap::adopt):
        * platform/network/NetworkStateNotifier.cpp:
        (WebCore::NetworkStateNotifier::addNetworkStateChangeListener):
        * platform/network/ResourceHandle.h:
        (WebCore::ResourceHandle::setQuickLookHandle):
        * platform/network/ResourceRequestBase.cpp:
        (WebCore::ResourceRequestBase::adopt):
        (WebCore::ResourceRequestBase::copyData):
        (WebCore::ResourceRequestBase::setHTTPHeaderFields):
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::adopt):
        (WebCore::ResourceResponseBase::copyData):
        * platform/network/cf/FormDataStreamCFNet.cpp:
        (WebCore::advanceCurrentStream):
        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::ResourceHandle::releaseConnectionForDownload):
        * platform/network/curl/CurlCacheManager.cpp:
        (WebCore::CurlCacheManager::loadIndex):
        (WebCore::CurlCacheManager::didReceiveResponse):
        * platform/network/curl/SocketStreamHandle.h:
        (WebCore::SocketStreamHandle::SocketData::SocketData):
        * platform/network/curl/SocketStreamHandleCurl.cpp:
        (WebCore::SocketStreamHandle::platformSend):
        (WebCore::SocketStreamHandle::readData):
        (WebCore::SocketStreamHandle::sendData):
        (WebCore::SocketStreamHandle::didReceiveData):
        (WebCore::SocketStreamHandle::createCopy):
        * platform/network/soup/NetworkStorageSessionSoup.cpp:
        (WebCore::NetworkStorageSession::NetworkStorageSession):
        (WebCore::NetworkStorageSession::setSoupNetworkSession):
        * platform/text/LocaleICU.cpp:
        (WebCore::LocaleICU::createLabelVector):
        (WebCore::createFallbackMonthLabels):
        (WebCore::createFallbackAMPMLabels):
        * platform/win/WCDataObject.cpp:
        (WebCore::WCDataObject::SetData):
        * plugins/DOMMimeType.cpp:
        (WebCore::DOMMimeType::DOMMimeType):
        * plugins/DOMMimeType.h:
        (WebCore::DOMMimeType::create):
        * plugins/DOMPlugin.cpp:
        (WebCore::DOMPlugin::DOMPlugin):
        * plugins/DOMPlugin.h:
        (WebCore::DOMPlugin::create):
        * plugins/PluginData.cpp:
        (WebCore::PluginData::publiclyVisiblePlugins):
        * rendering/ClipPathOperation.h:
        * rendering/FloatingObjects.cpp:
        (WebCore::FloatingObjects::moveAllToFloatInfoMap):
        (WebCore::FloatingObjects::add):
        * rendering/LayoutState.cpp:
        (WebCore::LayoutState::LayoutState):
        * rendering/RenderAttachment.cpp:
        (WebCore::RenderAttachment::RenderAttachment):
        * rendering/RenderBlock.cpp:
        (WebCore::OverflowEventDispatcher::~OverflowEventDispatcher):
        (WebCore::RenderBlock::RenderBlock):
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::RenderBlockFlow):
        (WebCore::RenderBlockFlow::layoutLineGridBox):
        (WebCore::RenderBlockFlow::insertFloatingObject):
        * rendering/RenderBlockFlow.h:
        (WebCore::RenderBlockFlow::setLineGridBox):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::createAndAppendRootInlineBox):
        (WebCore::constructBidiRunsForSegment):
        (WebCore::RenderBlockFlow::linkToEndLineIfNeeded):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::RenderBox):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::RenderBoxModelObject):
        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
        * rendering/RenderButton.cpp:
        (WebCore::RenderButton::RenderButton):
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::RenderDeprecatedFlexibleBox):
        * rendering/RenderDetailsMarker.cpp:
        (WebCore::RenderDetailsMarker::RenderDetailsMarker):
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::RenderElement):
        (WebCore::RenderElement::createFor):
        (WebCore::RenderElement::setStyle):
        (WebCore::RenderElement::propagateStyleToAnonymousChildren):
        * rendering/RenderElement.h:
        (WebCore::RenderElement::setStyleInternal):
        (WebCore::RenderElement::setAnimatableStyle):
        * rendering/RenderEmbeddedObject.cpp:
        (WebCore::RenderEmbeddedObject::RenderEmbeddedObject):
        (WebCore::RenderEmbeddedObject::createForApplet):
        * rendering/RenderFieldset.cpp:
        (WebCore::RenderFieldset::RenderFieldset):
        * rendering/RenderFileUploadControl.cpp:
        (WebCore::RenderFileUploadControl::RenderFileUploadControl):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::RenderFlexibleBox::RenderFlexibleBox):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::RenderFlowThread):
        * rendering/RenderFrame.cpp:
        (WebCore::RenderFrame::RenderFrame):
        * rendering/RenderFrameBase.cpp:
        (WebCore::RenderFrameBase::RenderFrameBase):
        * rendering/RenderFrameSet.cpp:
        (WebCore::RenderFrameSet::RenderFrameSet):
        * rendering/RenderFullScreen.cpp:
        (WebCore::RenderFullScreen::RenderFullScreen):
        (WebCore::RenderFullScreen::createPlaceholder):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::RenderGrid):
        (WebCore::RenderGrid::computeFlexFactorUnitSize):
        * rendering/RenderHTMLCanvas.cpp:
        (WebCore::RenderHTMLCanvas::RenderHTMLCanvas):
        * rendering/RenderIFrame.cpp:
        (WebCore::RenderIFrame::RenderIFrame):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::RenderImage):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::RenderInline):
        (WebCore::updateStyleOfAnonymousBlockContinuations):
        (WebCore::RenderInline::addChildIgnoringContinuation):
        (WebCore::RenderInline::splitInlines):
        (WebCore::RenderInline::createAndAppendInlineFlowBox):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::registerAllViewportConstrainedLayers):
        * rendering/RenderLayerModelObject.cpp:
        (WebCore::RenderLayerModelObject::RenderLayerModelObject):
        * rendering/RenderLineBreak.cpp:
        (WebCore::RenderLineBreak::RenderLineBreak):
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::RenderListBox):
        * rendering/RenderListItem.cpp:
        (WebCore::RenderListItem::RenderListItem):
        (WebCore::RenderListItem::styleDidChange):
        * rendering/RenderListMarker.cpp:
        (WebCore::RenderListMarker::RenderListMarker):
        * rendering/RenderMedia.cpp:
        (WebCore::RenderMedia::RenderMedia):
        * rendering/RenderMediaControlElements.cpp:
        (WebCore::RenderMediaVolumeSliderContainer::RenderMediaVolumeSliderContainer):
        (WebCore::RenderMediaControlTimelineContainer::RenderMediaControlTimelineContainer):
        (WebCore::RenderTextTrackContainerElement::RenderTextTrackContainerElement):
        * rendering/RenderMenuList.cpp:
        (WebCore::RenderMenuList::RenderMenuList):
        * rendering/RenderMeter.cpp:
        (WebCore::RenderMeter::RenderMeter):
        * rendering/RenderMultiColumnFlowThread.cpp:
        (WebCore::RenderMultiColumnFlowThread::RenderMultiColumnFlowThread):
        * rendering/RenderMultiColumnSet.cpp:
        (WebCore::RenderMultiColumnSet::RenderMultiColumnSet):
        * rendering/RenderMultiColumnSpannerPlaceholder.cpp:
        (WebCore::RenderMultiColumnSpannerPlaceholder::RenderMultiColumnSpannerPlaceholder):
        * rendering/RenderNamedFlowFragment.cpp:
        (WebCore::RenderNamedFlowFragment::RenderNamedFlowFragment):
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::RenderNamedFlowThread):
        (WebCore::RenderNamedFlowThread::updateWritingMode):
        * rendering/RenderProgress.cpp:
        (WebCore::RenderProgress::RenderProgress):
        * rendering/RenderPtr.h:
        * rendering/RenderQuote.cpp:
        (WebCore::RenderQuote::RenderQuote):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::RenderRegion):
        * rendering/RenderRegionSet.cpp:
        (WebCore::RenderRegionSet::RenderRegionSet):
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::RenderReplaced):
        * rendering/RenderReplica.cpp:
        (WebCore::RenderReplica::RenderReplica):
        * rendering/RenderRuby.cpp:
        (WebCore::RenderRubyAsInline::RenderRubyAsInline):
        (WebCore::RenderRubyAsBlock::RenderRubyAsBlock):
        * rendering/RenderRubyBase.cpp:
        (WebCore::RenderRubyBase::RenderRubyBase):
        * rendering/RenderRubyRun.cpp:
        (WebCore::RenderRubyRun::RenderRubyRun):
        (WebCore::RenderRubyRun::createRubyBase):
        * rendering/RenderRubyText.cpp:
        (WebCore::RenderRubyText::RenderRubyText):
        * rendering/RenderScrollbarPart.cpp:
        (WebCore::RenderScrollbarPart::RenderScrollbarPart):
        * rendering/RenderSearchField.cpp:
        (WebCore::RenderSearchField::RenderSearchField):
        (WebCore::RenderSearchField::updateCancelButtonVisibility):
        * rendering/RenderSlider.cpp:
        (WebCore::RenderSlider::RenderSlider):
        * rendering/RenderSnapshottedPlugIn.cpp:
        (WebCore::RenderSnapshottedPlugIn::RenderSnapshottedPlugIn):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::RenderTable):
        * rendering/RenderTableCaption.cpp:
        (WebCore::RenderTableCaption::RenderTableCaption):
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::RenderTableCell):
        * rendering/RenderTableCol.cpp:
        (WebCore::RenderTableCol::RenderTableCol):
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::RenderTableRow):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::RenderTableSection):
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::RenderTextControl):
        * rendering/RenderTextControl.h:
        * rendering/RenderTextControlMultiLine.cpp:
        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
        * rendering/RenderTextControlSingleLine.h:
        * rendering/RenderThemeEfl.cpp:
        (WebCore::RenderThemeEfl::getThemePartFromCache):
        (WebCore::RenderThemeEfl::loadTheme):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintProgressBar):
        * rendering/RenderVTTCue.cpp:
        (WebCore::RenderVTTCue::RenderVTTCue):
        * rendering/RenderVideo.cpp:
        (WebCore::RenderVideo::RenderVideo):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::RenderView):
        (WebCore::RenderView::updateSelectionForSubtrees):
        (WebCore::RenderView::applySubtreeSelection):
        * rendering/RenderView.h:
        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::RenderWidget):
        * rendering/RootInlineBox.cpp:
        (WebCore::RootInlineBox::placeEllipsis):
        * rendering/mathml/RenderMathMLBlock.cpp:
        (WebCore::RenderMathMLBlock::RenderMathMLBlock):
        * rendering/mathml/RenderMathMLBlock.h:
        * rendering/mathml/RenderMathMLFenced.cpp:
        (WebCore::RenderMathMLFenced::RenderMathMLFenced):
        * rendering/mathml/RenderMathMLFraction.cpp:
        (WebCore::RenderMathMLFraction::RenderMathMLFraction):
        * rendering/mathml/RenderMathMLMath.cpp:
        (WebCore::RenderMathMLMath::RenderMathMLMath):
        * rendering/mathml/RenderMathMLMenclose.cpp:
        (WebCore::RenderMathMLMenclose::RenderMathMLMenclose):
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::RenderMathMLOperator):
        (WebCore::RenderMathMLOperator::updateStyle):
        * rendering/mathml/RenderMathMLRadicalOperator.cpp:
        (WebCore::RenderMathMLRadicalOperator::RenderMathMLRadicalOperator):
        * rendering/mathml/RenderMathMLRoot.cpp:
        (WebCore::RenderMathMLRoot::RenderMathMLRoot):
        (WebCore::RenderMathMLRoot::updateStyle):
        * rendering/mathml/RenderMathMLRoot.h:
        * rendering/mathml/RenderMathMLRow.cpp:
        (WebCore::RenderMathMLRow::RenderMathMLRow):
        * rendering/mathml/RenderMathMLScripts.cpp:
        (WebCore::RenderMathMLScripts::RenderMathMLScripts):
        * rendering/mathml/RenderMathMLScripts.h:
        * rendering/mathml/RenderMathMLSpace.cpp:
        (WebCore::RenderMathMLSpace::RenderMathMLSpace):
        * rendering/mathml/RenderMathMLSquareRoot.cpp:
        (WebCore::RenderMathMLSquareRoot::RenderMathMLSquareRoot):
        * rendering/mathml/RenderMathMLToken.cpp:
        (WebCore::RenderMathMLToken::RenderMathMLToken):
        (WebCore::RenderMathMLToken::updateStyle):
        * rendering/mathml/RenderMathMLUnderOver.cpp:
        (WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver):
        * rendering/shapes/PolygonShape.h:
        (WebCore::PolygonShape::PolygonShape):
        * rendering/shapes/RasterShape.h:
        * rendering/shapes/Shape.cpp:
        (WebCore::createPolygonShape):
        (WebCore::Shape::createShape):
        (WebCore::Shape::createRasterShape):
        (WebCore::Shape::createBoxShape):
        * rendering/style/BasicShapes.cpp:
        (WebCore::BasicShapeCenterCoordinate::updateComputedLength):
        (WebCore::BasicShapeCircle::blend):
        (WebCore::BasicShapeEllipse::blend):
        (WebCore::BasicShapePolygon::blend):
        (WebCore::BasicShapePath::BasicShapePath):
        (WebCore::BasicShapePath::blend):
        (WebCore::BasicShapeInset::blend):
        * rendering/style/BasicShapes.h:
        * rendering/style/ContentData.cpp:
        (WebCore::ContentData::clone):
        (WebCore::ImageContentData::createContentRenderer):
        (WebCore::TextContentData::createContentRenderer):
        (WebCore::QuoteContentData::createContentRenderer):
        * rendering/style/ContentData.h:
        (WebCore::ContentData::setNext):
        * rendering/style/DataRef.h:
        (WebCore::DataRef::DataRef):
        * rendering/style/FillLayer.cpp:
        (WebCore::FillLayer::~FillLayer):
        * rendering/style/FillLayer.h:
        (WebCore::FillLayer::setXPosition):
        (WebCore::FillLayer::setYPosition):
        (WebCore::FillLayer::setNext):
        * rendering/style/NinePieceImage.cpp:
        (WebCore::NinePieceImage::NinePieceImage):
        * rendering/style/NinePieceImage.h:
        (WebCore::NinePieceImage::setImageSlices):
        (WebCore::NinePieceImage::setBorderSlices):
        (WebCore::NinePieceImage::setOutset):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::setWillChange):
        (WebCore::RenderStyle::appendContent):
        (WebCore::RenderStyle::setContent):
        (WebCore::RenderStyle::setTextShadow):
        (WebCore::RenderStyle::setBoxShadow):
        (WebCore::RenderStyle::setWordSpacing):
        (WebCore::RenderStyle::setScrollSnapPointsX):
        (WebCore::RenderStyle::setScrollSnapPointsY):
        (WebCore::RenderStyle::setScrollSnapDestination):
        (WebCore::RenderStyle::setScrollSnapCoordinates):
        * rendering/style/RenderStyle.h:
        * rendering/style/SVGRenderStyle.h:
        (WebCore::SVGRenderStyle::setShadow):
        * rendering/style/ShadowData.h:
        (WebCore::ShadowData::setNext):
        * rendering/style/StyleGeneratedImage.cpp:
        (WebCore::StyleGeneratedImage::StyleGeneratedImage):
        * rendering/style/StyleGeneratedImage.h:
        * rendering/style/StyleReflection.h:
        (WebCore::StyleReflection::setOffset):
        * rendering/svg/RenderSVGBlock.cpp:
        (WebCore::RenderSVGBlock::RenderSVGBlock):
        * rendering/svg/RenderSVGContainer.cpp:
        (WebCore::RenderSVGContainer::RenderSVGContainer):
        * rendering/svg/RenderSVGEllipse.cpp:
        (WebCore::RenderSVGEllipse::RenderSVGEllipse):
        * rendering/svg/RenderSVGForeignObject.cpp:
        (WebCore::RenderSVGForeignObject::RenderSVGForeignObject):
        * rendering/svg/RenderSVGGradientStop.cpp:
        (WebCore::RenderSVGGradientStop::RenderSVGGradientStop):
        * rendering/svg/RenderSVGHiddenContainer.cpp:
        (WebCore::RenderSVGHiddenContainer::RenderSVGHiddenContainer):
        * rendering/svg/RenderSVGImage.cpp:
        (WebCore::RenderSVGImage::RenderSVGImage):
        * rendering/svg/RenderSVGInline.cpp:
        (WebCore::RenderSVGInline::RenderSVGInline):
        (WebCore::RenderSVGInline::createInlineFlowBox):
        * rendering/svg/RenderSVGInlineText.cpp:
        (WebCore::RenderSVGInlineText::createTextBox):
        * rendering/svg/RenderSVGModelObject.cpp:
        (WebCore::RenderSVGModelObject::RenderSVGModelObject):
        * rendering/svg/RenderSVGPath.cpp:
        (WebCore::RenderSVGPath::RenderSVGPath):
        * rendering/svg/RenderSVGRect.cpp:
        (WebCore::RenderSVGRect::RenderSVGRect):
        * rendering/svg/RenderSVGResourceClipper.cpp:
        (WebCore::RenderSVGResourceClipper::RenderSVGResourceClipper):
        * rendering/svg/RenderSVGResourceContainer.cpp:
        (WebCore::RenderSVGResourceContainer::RenderSVGResourceContainer):
        * rendering/svg/RenderSVGResourceFilter.cpp:
        (WebCore::RenderSVGResourceFilter::RenderSVGResourceFilter):
        (WebCore::RenderSVGResourceFilter::buildPrimitives):
        (WebCore::RenderSVGResourceFilter::applyResource):
        (WebCore::RenderSVGResourceFilter::postApplyResource):
        * rendering/svg/RenderSVGResourceFilterPrimitive.cpp:
        (WebCore::RenderSVGResourceFilterPrimitive::RenderSVGResourceFilterPrimitive):
        * rendering/svg/RenderSVGResourceGradient.cpp:
        (WebCore::RenderSVGResourceGradient::RenderSVGResourceGradient):
        (WebCore::createMaskAndSwapContextForTextGradient):
        * rendering/svg/RenderSVGResourceLinearGradient.cpp:
        (WebCore::RenderSVGResourceLinearGradient::RenderSVGResourceLinearGradient):
        * rendering/svg/RenderSVGResourceMarker.cpp:
        (WebCore::RenderSVGResourceMarker::RenderSVGResourceMarker):
        * rendering/svg/RenderSVGResourceMasker.cpp:
        (WebCore::RenderSVGResourceMasker::RenderSVGResourceMasker):
        * rendering/svg/RenderSVGResourcePattern.cpp:
        (WebCore::RenderSVGResourcePattern::RenderSVGResourcePattern):
        (WebCore::RenderSVGResourcePattern::buildPattern):
        * rendering/svg/RenderSVGResourceRadialGradient.cpp:
        (WebCore::RenderSVGResourceRadialGradient::RenderSVGResourceRadialGradient):
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::RenderSVGRoot):
        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::RenderSVGShape):
        * rendering/svg/RenderSVGTSpan.h:
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::RenderSVGText):
        (WebCore::RenderSVGText::createRootInlineBox):
        * rendering/svg/RenderSVGTextPath.cpp:
        (WebCore::RenderSVGTextPath::RenderSVGTextPath):
        * rendering/svg/RenderSVGTransformableContainer.cpp:
        (WebCore::RenderSVGTransformableContainer::RenderSVGTransformableContainer):
        * rendering/svg/RenderSVGViewportContainer.cpp:
        (WebCore::RenderSVGViewportContainer::RenderSVGViewportContainer):
        * rendering/svg/SVGResourcesCache.cpp:
        (WebCore::SVGResourcesCache::addResourcesFromRenderer):
        * replay/CapturingInputCursor.cpp:
        (WebCore::CapturingInputCursor::CapturingInputCursor):
        (WebCore::CapturingInputCursor::create):
        (WebCore::CapturingInputCursor::storeInput):
        * replay/FunctorInputCursor.h:
        (WebCore::FunctorInputCursor::FunctorInputCursor):
        * replay/MemoizedDOMResult.cpp:
        (JSC::InputTraits<MemoizedDOMResultBase>::decode):
        * replay/ReplayController.cpp:
        (WebCore::ReplayController::createSegment):
        * replay/ReplayInputCreationMethods.cpp:
        (WebCore::InitialNavigation::createFromPage):
        * replay/ReplaySession.cpp:
        (WebCore::ReplaySession::appendSegment):
        (WebCore::ReplaySession::insertSegment):
        * replay/ReplayingInputCursor.cpp:
        (WebCore::ReplayingInputCursor::ReplayingInputCursor):
        (WebCore::ReplayingInputCursor::create):
        * replay/SegmentedInputStorage.cpp:
        (WebCore::SegmentedInputStorage::store):
        * replay/SerializationMethods.cpp:
        (JSC::EncodingTraits<NondeterministicInputBase>::decodeValue):
        * replay/UserInputBridge.cpp:
        (WebCore::UserInputBridge::handleMousePressEvent):
        (WebCore::UserInputBridge::handleMouseReleaseEvent):
        (WebCore::UserInputBridge::handleMouseMoveEvent):
        (WebCore::UserInputBridge::handleMouseMoveOnScrollbarEvent):
        (WebCore::UserInputBridge::handleKeyEvent):
        (WebCore::UserInputBridge::handleWheelEvent):
        * storage/Storage.cpp:
        (WebCore::Storage::create):
        (WebCore::Storage::Storage):
        * style/StyleResolveForDocument.cpp:
        (WebCore::Style::resolveForDocument):
        * style/StyleResolveTree.cpp:
        (WebCore::Style::createRendererIfNeeded):
        (WebCore::Style::setBeforeOrAfterPseudoElement):
        (WebCore::Style::resolveTree):
        * svg/SVGAElement.cpp:
        (WebCore::SVGAElement::createElementRenderer):
        * svg/SVGAltGlyphElement.cpp:
        (WebCore::SVGAltGlyphElement::createElementRenderer):
        * svg/SVGAnimatedPath.cpp:
        (WebCore::SVGAnimatedPathAnimator::constructFromString):
        (WebCore::SVGAnimatedPathAnimator::startAnimValAnimation):
        * svg/SVGAnimatedTypeAnimator.cpp:
        (WebCore::SVGAnimatedTypeAnimator::findAnimatedPropertiesForAttributeName):
        * svg/SVGCircleElement.cpp:
        (WebCore::SVGCircleElement::createElementRenderer):
        * svg/SVGClipPathElement.cpp:
        (WebCore::SVGClipPathElement::createElementRenderer):
        * svg/SVGDefsElement.cpp:
        (WebCore::SVGDefsElement::createElementRenderer):
        * svg/SVGDocumentExtensions.cpp:
        (WebCore::SVGDocumentExtensions::markPendingResourcesForRemoval):
        (WebCore::SVGDocumentExtensions::addElementReferencingTarget):
        (WebCore::SVGDocumentExtensions::rebuildElements):
        * svg/SVGEllipseElement.cpp:
        (WebCore::SVGEllipseElement::createElementRenderer):
        * svg/SVGFilterElement.cpp:
        (WebCore::SVGFilterElement::createElementRenderer):
        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
        (WebCore::SVGFilterPrimitiveStandardAttributes::createElementRenderer):
        * svg/SVGFontElement.cpp:
        (WebCore::SVGKerningMap::insert):
        * svg/SVGForeignObjectElement.cpp:
        (WebCore::SVGForeignObjectElement::createElementRenderer):
        * svg/SVGGElement.cpp:
        (WebCore::SVGGElement::createElementRenderer):
        * svg/SVGGraphicsElement.cpp:
        (WebCore::SVGGraphicsElement::createElementRenderer):
        * svg/SVGImageElement.cpp:
        (WebCore::SVGImageElement::createElementRenderer):
        * svg/SVGLinearGradientElement.cpp:
        (WebCore::SVGLinearGradientElement::createElementRenderer):
        * svg/SVGMarkerElement.cpp:
        (WebCore::SVGMarkerElement::createElementRenderer):
        * svg/SVGMaskElement.cpp:
        (WebCore::SVGMaskElement::createElementRenderer):
        * svg/SVGPathElement.cpp:
        (WebCore::SVGPathElement::createElementRenderer):
        * svg/SVGPathUtilities.cpp:
        (WebCore::appendSVGPathByteStreamFromSVGPathSeg):
        * svg/SVGPatternElement.cpp:
        (WebCore::SVGPatternElement::createElementRenderer):
        * svg/SVGRadialGradientElement.cpp:
        (WebCore::SVGRadialGradientElement::createElementRenderer):
        * svg/SVGRectElement.cpp:
        (WebCore::SVGRectElement::createElementRenderer):
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::createElementRenderer):
        * svg/SVGStopElement.cpp:
        (WebCore::SVGStopElement::createElementRenderer):
        * svg/SVGSwitchElement.cpp:
        (WebCore::SVGSwitchElement::createElementRenderer):
        * svg/SVGSymbolElement.cpp:
        (WebCore::SVGSymbolElement::createElementRenderer):
        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefTargetEventListener::attach):
        (WebCore::SVGTRefElement::createElementRenderer):
        * svg/SVGTSpanElement.cpp:
        (WebCore::SVGTSpanElement::createElementRenderer):
        * svg/SVGTextElement.cpp:
        (WebCore::SVGTextElement::createElementRenderer):
        * svg/SVGTextPathElement.cpp:
        (WebCore::SVGTextPathElement::createElementRenderer):
        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::releaseResult):
        (WebCore::SVGToOTFFontConverter::appendKERNSubtable):
        (WebCore::SVGToOTFFontConverter::processGlyphElement):
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::createElementRenderer):
        (WebCore::SVGUseElement::cloneTarget):
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::~SVGImage):
        (WebCore::SVGImage::drawPatternForContainer):
        * testing/Internals.cpp:
        (WebCore::Internals::insertAuthorCSS):
        (WebCore::Internals::insertUserCSS):
        (WebCore::Internals::queueMicroTask):
        * workers/DedicatedWorkerGlobalScope.cpp:
        (WebCore::DedicatedWorkerGlobalScope::postMessage):
        * workers/Worker.cpp:
        (WebCore::Worker::create):
        (WebCore::Worker::postMessage):
        * workers/WorkerEventQueue.cpp:
        (WebCore::WorkerEventQueue::EventDispatcher::EventDispatcher):
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::postTask):
        (WebCore::WorkerGlobalScope::setTimeout):
        (WebCore::WorkerGlobalScope::setInterval):
        (WebCore::WorkerGlobalScope::importScripts):
        (WebCore::WorkerGlobalScope::addMessage):
        (WebCore::WorkerGlobalScope::addMessageToWorkerConsole):
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
        (WebCore::WorkerMessagingProxy::postMessageToWorkerGlobalScope):
        (WebCore::WorkerMessagingProxy::postTaskToLoader):
        (WebCore::WorkerMessagingProxy::postTaskForModeToWorkerGlobalScope):
        (WebCore::WorkerMessagingProxy::workerThreadCreated):
        * workers/WorkerRunLoop.cpp:
        (WebCore::WorkerRunLoop::postTask):
        (WebCore::WorkerRunLoop::postTaskAndTerminate):
        (WebCore::WorkerRunLoop::postTaskForMode):
        (WebCore::WorkerRunLoop::Task::Task):
        * xml/DOMParser.cpp:
        (WebCore::DOMParser::parseFromString):
        * xml/NativeXPathNSResolver.cpp:
        (WebCore::NativeXPathNSResolver::NativeXPathNSResolver):
        * xml/NativeXPathNSResolver.h:
        (WebCore::NativeXPathNSResolver::create):
        * xml/XMLErrors.cpp:
        (WebCore::XMLErrors::insertErrorMessageBlock):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::responseBlob):
        * xml/XMLHttpRequestProgressEventThrottle.cpp:
        (WebCore::XMLHttpRequestProgressEventThrottle::flushProgressEvent):
        (WebCore::XMLHttpRequestProgressEventThrottle::dispatchDeferredEvents):
        * xml/XMLTreeViewer.cpp:
        (WebCore::XMLTreeViewer::transformDocumentToTreeView):
        * xml/XPathExpression.cpp:
        (WebCore::XPathExpression::XPathExpression):
        (WebCore::XPathExpression::createExpression):
        * xml/XPathExpressionNode.cpp:
        (WebCore::XPath::Expression::setSubexpressions):
        * xml/XPathExpressionNode.h:
        (WebCore::XPath::Expression::addSubexpression):
        * xml/XPathFunctions.cpp:
        (WebCore::XPath::Function::setArguments):
        (WebCore::XPath::FunId::evaluate):
        (WebCore::XPath::Function::create):
        * xml/XPathGrammar.y:
        * xml/XPathNodeSet.cpp:
        (WebCore::XPath::NodeSet::sort):
        (WebCore::XPath::NodeSet::traversalSort):
        * xml/XPathNodeSet.h:
        (WebCore::XPath::NodeSet::NodeSet):
        (WebCore::XPath::NodeSet::append):
        * xml/XPathParser.cpp:
        (WebCore::XPath::Parser::parseStatement):
        * xml/XPathParser.h:
        (WebCore::XPath::Parser::setParseResult):
        * xml/XPathPath.cpp:
        (WebCore::XPath::Filter::Filter):
        (WebCore::XPath::Filter::evaluate):
        (WebCore::XPath::LocationPath::evaluate):
        (WebCore::XPath::LocationPath::appendStep):
        (WebCore::XPath::LocationPath::prependStep):
        (WebCore::XPath::Path::Path):
        * xml/XPathPredicate.cpp:
        (WebCore::XPath::StringExpression::StringExpression):
        (WebCore::XPath::Negative::Negative):
        (WebCore::XPath::NumericOp::NumericOp):
        (WebCore::XPath::EqTestOp::EqTestOp):
        (WebCore::XPath::LogicalOp::LogicalOp):
        (WebCore::XPath::Union::Union):
        * xml/XPathStep.cpp:
        (WebCore::XPath::Step::Step):
        (WebCore::XPath::Step::optimize):
        (WebCore::XPath::optimizeStepPair):
        (WebCore::XPath::Step::evaluate):
        * xml/XPathStep.h:
        (WebCore::XPath::Step::NodeTest::NodeTest):
        (WebCore::XPath::Step::NodeTest::operator=):
        * xml/XPathValue.h:
        (WebCore::XPath::Value::Value):
        (WebCore::XPath::Value::Data::create):
        (WebCore::XPath::Value::Data::Data):
        * xml/XSLTProcessor.h:
        (WebCore::XSLTProcessor::setXSLStyleSheet):
        (WebCore::XSLTProcessor::importStylesheet):
        * xml/parser/XMLDocumentParser.cpp:
        (WebCore::XMLDocumentParser::append):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::PendingCallbacks::appendStartElementNSCallback):
        (WebCore::PendingCallbacks::appendCharactersCallback):
        (WebCore::PendingCallbacks::appendProcessingInstructionCallback):
        (WebCore::PendingCallbacks::appendCDATABlockCallback):
        (WebCore::PendingCallbacks::appendCommentCallback):
        (WebCore::PendingCallbacks::appendInternalSubsetCallback):
        (WebCore::PendingCallbacks::appendErrorCallback):
        (WebCore::OffsetBuffer::OffsetBuffer):
        (WebCore::openFunc):
        (WebCore::XMLDocumentParser::cdataBlock):
        (WebCore::XMLDocumentParser::comment):
        (WebCore::parseAttributes):

2016-01-01  Simon Fraser  <simon.fraser@apple.com>

        Fix naming in HistoryItem to refer to scrollPositions
        https://bugs.webkit.org/show_bug.cgi?id=152646

        Reviewed by Zalan Bujtas.

        HistoryItem stores a scrollPosition, so call it that.

        No behavior change.

        * history/HistoryItem.cpp:
        (WebCore::HistoryItem::HistoryItem):
        (WebCore::HistoryItem::scrollPosition):
        (WebCore::HistoryItem::setScrollPosition):
        (WebCore::HistoryItem::clearScrollPosition):
        (WebCore::HistoryItem::scrollPoint): Deleted.
        (WebCore::HistoryItem::setScrollPoint): Deleted.
        (WebCore::HistoryItem::clearScrollPoint): Deleted.
        * history/HistoryItem.h:
        * loader/HistoryController.cpp:
        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
        (WebCore::HistoryController::clearScrollPositionAndViewState):
        (WebCore::HistoryController::restoreScrollPositionAndViewState):
        (WebCore::HistoryController::updateForClientRedirect):

2016-01-01  Zalan Bujtas  <zalan@apple.com>

        Simple line layout: Add support for toggling simple line layout from command line.
        https://bugs.webkit.org/show_bug.cgi?id=152636

        Reviewed by Simon Fraser.

        No change in functionality.

        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::canUseForWithReason):
        (WebCore::SimpleLineLayout::toggleSimpleLineLayout):

2016-01-01  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/database-deletepending-flag.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152600

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes, and at least 2 crashing tests now timeout).

        * Modules/indexeddb/server/IDBBackingStore.h:
        
        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::deleteBackingStore):
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::deleteBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2016-01-01  Simon Fraser  <simon.fraser@apple.com>

        Fix reload and programmatic scrolling in RTL documents
        https://bugs.webkit.org/show_bug.cgi?id=152639

        Reviewed by Zalan Bujtas.
        
        Reloading a left-scrolled RTL document would cause the content to appear
        at an odd offset, and programmatic sideways scrolls in RTL documents also
        jumped to the wrong location.
        
        Fix by resolving offset/position confusion in ScrollableArea::scrollPositionChanged()
        and the scrolling tree.
        
        ScrollableArea::scrollPositionChanged() was erroneously passing a scrollPosition
        to setScrollOffset(). 
        
        ScrollingTreeFrameScrollingNode* were confused about offsets and positions. It
        turns out that the layer position is just -scrollPosition, but minimumScrollPosition()
        and maximumScrollPosition() need fixing to return positions, not offsets.
        
        ScrollingTreeFrameScrollingNode::viewToContentsOffset() was also doing incorrect
        math with scrollOrigin, which was detected by a failing test.
        
        Add more logging to the Scrolling channel.

        Tests: fast/scrolling/programmatic-document-rtl-scroll.html
               fast/scrolling/programmatic-document-rtl-scrollIntoView.html
               fast/scrolling/scroll-position-on-reload-rtl.html

        * page/FrameView.cpp:
        (WebCore::FrameView::requestScrollPositionUpdate):
        * page/scrolling/ScrollingTree.cpp:
        (WebCore::ScrollingTree::shouldHandleWheelEventSynchronously):
        * page/scrolling/ScrollingTreeFrameScrollingNode.cpp:
        (WebCore::ScrollingTreeFrameScrollingNode::scrollBy):
        (WebCore::ScrollingTreeFrameScrollingNode::viewToContentsOffset):
        * page/scrolling/ScrollingTreeFrameScrollingNode.h:
        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeIOS::scrollPosition):
        (WebCore::ScrollingTreeFrameScrollingNodeIOS::setScrollLayerPosition):
        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateChildNodesAfterScroll):
        (WebCore::ScrollingTreeFrameScrollingNodeIOS::minimumScrollPosition):
        (WebCore::ScrollingTreeFrameScrollingNodeIOS::maximumScrollPosition):
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeMac::immediateScrollBy):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::scrollPosition):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollPosition):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollLayerPosition):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::minimumScrollPosition):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::maximumScrollPosition):
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::setScrollOffset):
        (WebCore::ScrollView::scrollTo):
        (WebCore::ScrollView::setScrollPosition):
        (WebCore::ScrollView::updateScrollbars):
        * platform/ScrollView.h:
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::scrollPositionChanged):
        (WebCore::ScrollableArea::setScrollOffsetFromAnimation):
        (WebCore::ScrollableArea::scrollPositionFromOffset):
        (WebCore::ScrollableArea::scrollOffsetFromPosition):
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::scrollPositionFromOffset):
        (WebCore::ScrollableArea::scrollOffsetFromPosition):
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::setScrollOffset):
        * rendering/RenderListBox.h:

2016-01-01  Simon Fraser  <simon.fraser@apple.com>

        REGRESSION (r194448): Scrolling overflow:scroll goes too far
        https://bugs.webkit.org/show_bug.cgi?id=152645

        Reviewed by Zalan Bujtas.
        
        Fix a bug introduced in r194448: use the scrollPosition, not the scrollOrigin
        to compute the overhang amount.

        Test: fast/scrolling/overflow-scroll-past-max.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::overhangAmount):

2015-12-22  Brent Fulgham  <bfulgham@apple.com>

        [WebGL] Blacklisted OpenGL contexts are not safe to use
        https://bugs.webkit.org/show_bug.cgi?id=152513
        <rdar://problem/23127838>

        Reviewed by Zalan Bujtas.

        When the GPU has blacklisted an OpenGL context, it is not safe to use -- even to
        attempt to release GL resources. Instead, our only correct behavior is to terminate
        the WebProcess.

        * platform/graphics/mac/GraphicsContext3DMac.mm:
        (WebCore::GraphicsContext3D::checkGPUStatusIfNecessary): If the context was lost
        because the GPU blacklisted it, terminate the process.

2016-01-01  Jeff Miller  <jeffm@apple.com>

        Update user-visible copyright strings to include 2016
        https://bugs.webkit.org/show_bug.cgi?id=152531

        Reviewed by Alexey Proskuryakov.

        * Info.plist:

2015-12-31  Simon Fraser  <simon.fraser@apple.com>

        Change RenderLayer::scrollTo() to take a ScrollPosition
        https://bugs.webkit.org/show_bug.cgi?id=152633

        Reviewed by Zalan Bujtas.
        
        RenderLayer::scrollTo() took x and y offsets. Change this to take a position,
        like ScrollView::scrollTo() and fix the one caller.
        
        Preserve the dubious behavior of the adjustForIOSCaretWhenScrolling() code by converting
        to and from offsets, even though testing suggests that this code can just be removed,
        even with an extra wide caret for testing.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollTo):
        (WebCore::RenderLayer::setScrollOffset):
        * rendering/RenderLayer.h:

2015-12-31  Simon Fraser  <simon.fraser@apple.com>

        Rename documentScrollOffsetRelativeTo* functions
        https://bugs.webkit.org/show_bug.cgi?id=152632

        Reviewed by Zalan Bujtas.

        ScrollView::documentScrollOffsetRelativeTo* functions return scroll positions,
        not offsets, so rename them and fix their return types, and fix callers. Make
        their code more similar.

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::documentScrollPositionRelativeToViewOrigin):
        (WebCore::ScrollView::documentScrollPositionRelativeToScrollableAreaOrigin):
        (WebCore::ScrollView::viewToContents):
        (WebCore::ScrollView::contentsToView):
        (WebCore::ScrollView::documentScrollOffsetRelativeToViewOrigin): Deleted.
        (WebCore::ScrollView::documentScrollOffsetRelativeToScrollableAreaOrigin): Deleted.
        * platform/ScrollView.h:
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollRectToVisible):

2015-12-31  Simon Fraser  <simon.fraser@apple.com>

        [iOS WK2] Fix incorrect scrollPosition handling
        https://bugs.webkit.org/show_bug.cgi?id=152630

        Reviewed by Zalan Bujtas.

        WebPage::updateVisibleContentRects() was setting the ScrollView's scroll position
        to a scrollOffset, which was counteracted by ScrollView::unobscuredContentRect()
        adding the scrollOrigin to the scrollPosition, which resulted in the correct
        rects, but an incorrect scrollPosition. Fix.

        * platform/ios/ScrollViewIOS.mm:
        (WebCore::ScrollView::unobscuredContentRect):

2015-12-31  David Kilzer  <ddkilzer@apple.com>

        Fix typo in FIXME comment

        * dom/make_event_factory.pl:
        (generateImplementation): FIXEME => FIXME.

2015-12-31  David Kilzer  <ddkilzer@apple.com>

        Stop using USE(CFNETWORK) path on iOS
        https://bugs.webkit.org/show_bug.cgi?id=142540

        Step 1/2: Do everything but turn off USE(CFNETWORK) internally.

        Original patch by Antti Koivisto <antti@apple.com> on 2015-03-10
        Reviewed by Daniel Bates.

        Unify OS X and iOS code paths.

        This patch just fixes the NSURLConnection code path on iOS. It
        doesn't yet delete any unnecessary code.

        Changes covered by most existing tests.

        * loader/DocumentLoader.h:
        * loader/ResourceLoader.cpp:
        * loader/ResourceLoader.h:
        * loader/mac/DocumentLoaderMac.cpp:
        - Update for iOS to use NSURLConnection loader.

        * page/mac/PageMac.mm:
        (WebCore::Page::platformInitialize): Always use the correct
        runloop on iOS regardless of which thread this was called on.
        (WebCore::Page::addSchedulePair): Update for iOS to use
        NSURLConnection loader.
        (WebCore::Page::removeSchedulePair): Ditto.

        * platform/ios/wak/WebCoreThread.h:
        (WebThreadRunLoop): No longer needs to be exported.
        (WebThreadNSRunLoop): Export for WebKitLegacy.

        * platform/network/ios/QuickLook.mm: Fix header order.
        (WebQuickLookHandleAsDelegate): Make delegate objects implement
        WebCoreResourceLoaderDelegate protocol.  This unifies the
        -clearHandle and -detachHandle methods that were used on iOS and
        OS X, respectively.
        (-[WebQuickLookHandleAsDelegate clearHandle]): Deleted.
        (-[WebQuickLookHandleAsDelegate detachHandle]): Renamed from
        -clearHandle.
        (WebResourceLoaderQuickLookDelegate): Make delegate objects
        implement WebCoreResourceLoaderDelegate protocol.
        (-[WebResourceLoaderQuickLookDelegate clearHandle]): Deleted.
        (-[WebResourceLoaderQuickLookDelegate detachHandle]): Renamed from
        -clearHandle.
        (WebCore::QuickLookHandle::~QuickLookHandle): Call
        -detachHandle instead of -clearHandle.

        * platform/network/mac/ResourceHandleMac.mm:
        - Update for iOS to use NSURLConnection loader.

        * platform/network/mac/WebCoreResourceHandleAsDelegate.h:
        (WebCoreResourceLoaderDelegate): Define new protocol.

        * platform/network/mac/WebCoreResourceHandleAsDelegate.mm:
        (-[WebCoreResourceHandleAsDelegate detachHandle]): Gratuitous
        nullptr fix.

        * platform/network/mac/WebCoreResourceHandleAsOperationQueueDelegate.h:
        (WebCoreResourceHandleAsOperationQueueDelegate): Implement
        WebCoreResourceLoaderDelegate protocol.

        * platform/spi/cocoa/NSURLDownloadSPI.h: Declare more
        NSURDownload SPI to clean up other source files and make
        source compile on iOS with NSURLConnection code path.

2015-12-31  Andy Estes  <aestes@apple.com>

        Fix warnings uncovered by migrating to WTF_MOVE
        https://bugs.webkit.org/show_bug.cgi?id=152601

        Reviewed by Daniel Bates.

        * Modules/encryptedmedia/MediaKeys.cpp:
        (WebCore::MediaKeys::createSession): Moving a return value prevented copy elision.

2015-12-31  Brady Eidson  <beidson@apple.com>

        Review feedback followup for:
        Modern IDB: Only fire blocked events after all open connections have handled their versionchange events.
        https://bugs.webkit.org/show_bug.cgi?id=152593

        Suggested by Andy Estes.

        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::dispatchEvent): Use downcast instead of static_cast.

        Add traits to support downcast<>:
        * Modules/indexeddb/client/IDBVersionChangeEventImpl.h:
        (isType):

2015-12-31  Zalan Bujtas  <zalan@apple.com>

        Move decoration context setup calls to InlineTextBox::paintDecoration.
        https://bugs.webkit.org/show_bug.cgi?id=152622

        Reviewed by Simon Fraser.

        No change in functionality.

        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::paint):
        (WebCore::InlineTextBox::paintDecoration):
        * rendering/InlineTextBox.h:

2015-12-31  Simon Fraser  <simon.fraser@apple.com>

        More scrollOffset/scrollPosition disambiguation, in RenderLayer
        https://bugs.webkit.org/show_bug.cgi?id=152617

        Reviewed by Zalan Bujtas.
        
        Change RenderLayer's m_scrollOffset to be m_scrollPosition, since it stores
        scroll positions (negative in RTL overflow). scrollOffset() was accurately
        named already, but fix the return type, and remove the unnecessary scrollXOffset()/
        scrollYOffset() variants, fixing callers to use .x() and .y().
        
        scrollToOffset() was also accurately named, but fix its argument.
        
        Fix functions related to saving scroll positions on Element to refer to scroll positions.

        No behavior change.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::scrollTo):
        * dom/Element.cpp:
        (WebCore::Element::removedFrom):
        (WebCore::Element::savedLayerScrollPosition):
        (WebCore::Element::setSavedLayerScrollPosition):
        (WebCore::Element::savedLayerScrollOffset): Deleted.
        (WebCore::Element::setSavedLayerScrollOffset): Deleted.
        * dom/Element.h:
        * dom/ElementRareData.h:
        (WebCore::ElementRareData::savedLayerScrollPosition):
        (WebCore::ElementRareData::setSavedLayerScrollPosition):
        (WebCore::ElementRareData::savedLayerScrollOffset): Deleted.
        (WebCore::ElementRareData::setSavedLayerScrollOffset): Deleted.
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::forwardEvent):
        * platform/graphics/IntPoint.h:
        (WebCore::IntPoint::isZero):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::baselinePosition):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::styleDidChange):
        (WebCore::RenderBox::scrollLeft):
        (WebCore::RenderBox::scrollTop):
        (WebCore::RenderBox::scrolledContentOffset):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::RenderLayer):
        (WebCore::RenderLayer::~RenderLayer):
        (WebCore::RenderLayer::scrollByRecursively):
        (WebCore::RenderLayer::clampScrollOffset):
        (WebCore::RenderLayer::scrollToOffset):
        (WebCore::RenderLayer::scrollTo):
        (WebCore::RenderLayer::scrollRectToVisible):
        (WebCore::RenderLayer::scrollPosition):
        (WebCore::RenderLayer::maximumScrollPosition):
        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
        * rendering/RenderLayer.h:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateGeometry):
        * rendering/RenderMarquee.cpp:
        (WebCore::RenderMarquee::start):
        (WebCore::RenderMarquee::timerFired):
        * rendering/RenderTreeAsText.cpp:
        (WebCore::write):

2015-12-31  Zalan Bujtas  <zalan@apple.com>

        text-decoration: line-through is mispositioned when text has overline/underline too.
        https://bugs.webkit.org/show_bug.cgi?id=152619

        Reviewed by Simon Fraser.

        Line-through painting was mistakenly calling drawLineForText with overline/underline positioning.

        Test: fast/css3-text/css3-text-decoration/text-decoration-line-through-mispositioned.html

        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::paintDecoration): Deleted.
        * rendering/TextDecorationPainter.cpp:
        (WebCore::TextDecorationPainter::paintTextDecoration):

2015-12-31  Simon Fraser  <simon.fraser@apple.com>

        Clarify that scrollPositionChangedViaPlatformWidget takes offsets
        https://bugs.webkit.org/show_bug.cgi?id=152606

        Reviewed by Zalan Bujtas.

        scrollPositionChangedViaPlatformWidget actually gets scroll offsets, since the
        values we get from AppKit are zero-based, so rename to scrollOffsetChangedViaPlatformWidget().
        
        Change ScrollableArea's setScrollPosition() and requestScrollPositionUpdate() to take
        ScrollPositions.
        
        Add a FIXME noting that willRevealEdge events are probably broken in RTL documents.

        * dom/Document.cpp:
        (WebCore::Document::sendWillRevealEdgeEventsIfNeeded):
        * page/FrameView.cpp:
        (WebCore::FrameView::setScrollPosition):
        (WebCore::FrameView::scrollOffsetChangedViaPlatformWidgetImpl):
        (WebCore::FrameView::scrollPositionChanged):
        (WebCore::FrameView::requestScrollPositionUpdate):
        (WebCore::FrameView::scrollPositionChangedViaPlatformWidgetImpl): Deleted.
        * page/FrameView.h:
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::scrollOffsetChangedViaPlatformWidget):
        (WebCore::ScrollView::handleDeferredScrollUpdateAfterContentSizeChange):
        (WebCore::ScrollView::scrollTo):
        (WebCore::ScrollView::setScrollPosition):
        (WebCore::ScrollView::scrollPositionChangedViaPlatformWidget): Deleted.
        * platform/ScrollView.h:
        (WebCore::ScrollView::scrollOffsetChangedViaPlatformWidgetImpl):
        (WebCore::ScrollView::scrollPositionChangedViaPlatformWidgetImpl): Deleted.
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::notifyScrollPositionChanged):
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::requestScrollPositionUpdate):

2015-12-31  Zalan Bujtas  <zalan@apple.com>

        Simple line layout: Text with stroke width is not positioned correctly.
        https://bugs.webkit.org/show_bug.cgi?id=152614

        Reviewed by Simon Fraser.

        Visual overflow should not affect text position.

        Test: fast/text/simple-line-layout-text-position-with-stroke.html

        * rendering/SimpleLineLayoutFunctions.cpp:
        (WebCore::SimpleLineLayout::paintFlow):

2015-12-31  Zalan Bujtas  <zalan@apple.com>

        Simple line layout: Nested block with pseudo first-line parent should bail out of simple line layout.
        https://bugs.webkit.org/show_bug.cgi?id=152599

        Reviewed by Simon Fraser.

        We should bail out of simple line layout if any of the ancestors have pseudo first-line style.
        (see RenderBlock::firstLineBlock()) 

        Test: fast/block/line-layout/first-line-should-bail-out-of-simple-line-layout.html

        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::canUseForWithReason):

2015-12-30  Simon Fraser  <simon.fraser@apple.com>

        Change ScrollView::scrollTo() to take a ScrollPosition
        https://bugs.webkit.org/show_bug.cgi?id=152607

        Reviewed by Zalan Bujtas.

        Make it more explicit that ScrollView::scrollTo() takes a ScrollPosition, and
        change the name and type of the m_scrollOffset member variable.

        * page/FrameView.cpp:
        (WebCore::FrameView::scrollTo):
        (WebCore::FrameView::wheelEvent):
        * page/FrameView.h:
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::unobscuredContentRectInternal):
        (WebCore::ScrollView::setScrollOffset):
        (WebCore::ScrollView::scrollTo):
        * platform/ScrollView.h:

2015-12-30  Brady Eidson  <beidson@apple.com>

        Modern IDB: Only fire blocked events after all open connections have handled their versionchange events.
        https://bugs.webkit.org/show_bug.cgi?id=152593

        Reviewed by Andy Estes.

        No new tests (At least two previously timing-out tests now pass, others are now closer to passing).

        Before this patch, whenever we sent all open connections the versionchange event, we would immediately 
        fire the blocked event on the request.

        That's not right, as those event handlers can close the connections, rendering the request unblocked.

        So this patch implements the behavior of waiting for each open connection to either close or positively
        message back "I finished firing my versionchange event handler"
        
        This behavior is explicitly denoted in the spec and is covered by existing tests.

        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::fireVersionChangeEvent):
        (WebCore::IDBClient::IDBConnectionToServer::didFireVersionChangeEvent):
        * Modules/indexeddb/client/IDBConnectionToServer.h:
        * Modules/indexeddb/client/IDBConnectionToServerDelegate.h:
        
        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::fireVersionChangeEvent):
        (WebCore::IDBClient::IDBDatabase::dispatchEvent):
        * Modules/indexeddb/client/IDBDatabaseImpl.h:
        
        * Modules/indexeddb/client/IDBVersionChangeEventImpl.cpp:
        (WebCore::IDBClient::IDBVersionChangeEvent::IDBVersionChangeEvent):
        * Modules/indexeddb/client/IDBVersionChangeEventImpl.h:
        
        * Modules/indexeddb/server/IDBConnectionToClient.cpp:
        (WebCore::IDBServer::IDBConnectionToClient::fireVersionChangeEvent):
        * Modules/indexeddb/server/IDBConnectionToClient.h:
        * Modules/indexeddb/server/IDBConnectionToClientDelegate.h:
        
        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::didFireVersionChangeEvent):
        * Modules/indexeddb/server/IDBServer.h:
        
        * Modules/indexeddb/server/ServerOpenDBRequest.cpp:
        (WebCore::IDBServer::ServerOpenDBRequest::notifyRequestBlocked):
        (WebCore::IDBServer::ServerOpenDBRequest::notifiedConnectionsOfVersionChange):
        (WebCore::IDBServer::ServerOpenDBRequest::connectionClosedOrFiredVersionChangeEvent):
        (WebCore::IDBServer::ServerOpenDBRequest::notifyDeleteRequestBlocked): Deleted.
        * Modules/indexeddb/server/ServerOpenDBRequest.h:
        (WebCore::IDBServer::ServerOpenDBRequest::hasNotifiedBlocked):
        (WebCore::IDBServer::ServerOpenDBRequest::hasConnectionsPendingVersionChangeEvent):
        (WebCore::IDBServer::ServerOpenDBRequest::hasNotifiedConnectionsOfVersionChange):
        (WebCore::IDBServer::ServerOpenDBRequest::hasNotifiedDeleteRequestBlocked): Deleted.

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::maybeNotifyConnectionsOfVersionChange):
        (WebCore::IDBServer::UniqueIDBDatabase::notifyCurrentRequestConnectionClosedOrFiredVersionChangeEvent):
        (WebCore::IDBServer::UniqueIDBDatabase::didFireVersionChangeEvent):
        (WebCore::IDBServer::UniqueIDBDatabase::connectionClosedFromClient):
        (WebCore::IDBServer::UniqueIDBDatabase::notifyConnectionsOfVersionChangeForUpgrade): Deleted.
        (WebCore::IDBServer::UniqueIDBDatabase::notifyConnectionsOfVersionChange): Deleted.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::connectionClosedFromClient):
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::didFireVersionChangeEvent):
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::fireVersionChangeEvent):
        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.h:
        
        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::fireVersionChangeEvent):
        (WebCore::InProcessIDBServer::didFireVersionChangeEvent):
        * Modules/indexeddb/shared/InProcessIDBServer.h:
        
        * dom/Event.h:
        (WebCore::Event::isVersionChangeEvent):

2015-12-30  Simon Fraser  <simon.fraser@apple.com>

        Add explicit conversions between scrollOffset and scrollPostion, and use them in a few places
        https://bugs.webkit.org/show_bug.cgi?id=152594

        Reviewed by Sam Weinig.

        Add functions to ScrollableArea to convert between scrollPosition and scrollOffset,
        and use them in places where code did the math with scrollOrigin.

        * page/FrameView.cpp:
        (WebCore::FrameView::minimumScrollPosition):
        (WebCore::FrameView::maximumScrollPosition): totalContentsSize().width() == contentsWidth(),
        so we can use the base class maximumScrollPosition(), which also clamps.
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::maximumScrollPosition):
        (WebCore::ScrollView::setScrollOffset):
        (WebCore::ScrollView::overhangAmount):
        (WebCore::ScrollView::updateScrollbars):
        (WebCore::ScrollView::calculateOverhangAreasForPainting):
        (WebCore::ScrollView::minimumScrollPosition): Deleted. Can use base class implementation.
        * platform/ScrollView.h:
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::minimumScrollPosition):
        (WebCore::ScrollableArea::maximumScrollPosition):
        (WebCore::ScrollableArea::maximumScrollOffset):
        (WebCore::ScrollableArea::scrollPositionFromOffset):
        (WebCore::ScrollableArea::scrollOffsetFromPosition):
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::scrollOrigin):
        (WebCore::ScrollableArea::scrollOriginChanged):
        * platform/ios/ScrollViewIOS.mm:
        (WebCore::ScrollView::unobscuredContentRect):
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::pinnedInDirection):
        (WebCore::ScrollAnimatorMac::absoluteScrollPosition):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollPosition):
        (WebCore::RenderLayer::maximumScrollPosition):
        (WebCore::RenderLayer::overhangAmount):
        (WebCore::RenderLayer::minimumScrollPosition): Deleted.
        * rendering/RenderLayer.h:

2015-12-30  Zalan Bujtas  <zalan@apple.com>

        Move InlineTextBox's text decoration painting to its own class.
        https://bugs.webkit.org/show_bug.cgi?id=152587

        Reviewed by Myles C. Maxfield.

        This is in preparation for adding text decoration support for simple line layout.

        No change in functionality.

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::paintDecoration):
        (WebCore::compareTuples): Deleted.
        (WebCore::translateIntersectionPointsToSkipInkBoundaries): Deleted.
        (WebCore::drawSkipInkUnderline): Deleted.
        (WebCore::textDecorationStyleToStrokeStyle): Deleted.
        (WebCore::adjustStepToDecorationLength): Deleted.
        (WebCore::strokeWavyTextDecoration): Deleted.
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::getTextDecorationColorsAndStyles):
        * rendering/RenderObject.h:
        * rendering/RenderingAllInOne.cpp:
        * rendering/TextDecorationPainter.cpp: Added.
        (WebCore::adjustStepToDecorationLength):
        (WebCore::strokeWavyTextDecoration):
        (WebCore::compareTuples):
        (WebCore::translateIntersectionPointsToSkipInkBoundaries):
        (WebCore::drawSkipInkUnderline):
        (WebCore::textDecorationStyleToStrokeStyle):
        (WebCore::TextDecorationPainter::TextDecorationPainter):
        (WebCore::TextDecorationPainter::paintTextDecoration):
        * rendering/TextDecorationPainter.h: Added.
        (WebCore::TextDecorationPainter::setInlineTextBox):
        (WebCore::TextDecorationPainter::setFont):
        (WebCore::TextDecorationPainter::setIsHorizontal):
        (WebCore::TextDecorationPainter::setWidth):
        (WebCore::TextDecorationPainter::setBaseline):
        (WebCore::TextDecorationPainter::addTextShadow):
        * style/InlineTextBoxStyle.cpp:
        (WebCore::computeUnderlineOffset):
        (WebCore::visualOverflowForDecorations):
        * style/InlineTextBoxStyle.h:

2015-12-30  Zan Dobersek  <zdobersek@igalia.com>

        [CoordinatedGraphics] VideoRenderRequestScheduler shouldn't dispatch to main thread in threaded compositor
        https://bugs.webkit.org/show_bug.cgi?id=152584

        Reviewed by Carlos Garcia Campos.

        The VideoRenderRequestScheduler class should only send the repaint-requested
        signal dispatch to the main thread when not using the threaded compositor.
        In case that is used (guarded via WTF_USE_COORDINATED_GRAPHICS_THREADED), the
        signal dispatch can be done on the current thread (normally a GStreamer thread)
        since the actual GL texture update will be then dispatched to the compositor
        thread (unlike when gstreamer-gl is used, when the update can be done on the
        very same thread).

        When that is the case we don't need the RunLoop::Timer, Condition and the
        video sink GRefPtr protector that are otherwise used by this class, so these
        can just be guarded with the USE(...) flag.

        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
        (VideoRenderRequestScheduler::VideoRenderRequestScheduler):
        (VideoRenderRequestScheduler::stop):
        (VideoRenderRequestScheduler::requestRender):

2015-12-30  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] Clean up TextureMapperAnimation, TextureMapperAnimations
        https://bugs.webkit.org/show_bug.cgi?id=152112

        Reviewed by Darin Adler.

        Clean up the TextureMapperAnimation class. Turn AnimationState into an enum
        class. Use references for non-null pointer parameters to one version of the
        constructor and the apply() and applyInternal() methods. Remove unnecessary
        public methods and reorder the remaining ones into something more sensible.
        In terms of the implementation of this class, the methods are moved around to
        follow the order of declarations, along with some small cleanups and improvements
        applied.

        TextureMapperAnimations class is also refreshed. The constructor is defaulted,
        and the method implementations are reordered a bit and also adjusted to use the
        range-based for-loops and some STL utilities.

        Static functions in the implementation file are also updated to use range-based
        for-loops, references and nullptrs where possible.

        There's no change in behavior as this is just a refactoring.

        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::addAnimation):
        * platform/graphics/texmap/TextureMapperAnimation.cpp:
        (WebCore::blendFunc):
        (WebCore::applyFilterAnimation):
        (WebCore::shouldReverseAnimationValue):
        (WebCore::applyTransformAnimation):
        (WebCore::TextureMapperAnimation::TextureMapperAnimation):
        (WebCore::TextureMapperAnimation::apply):
        (WebCore::TextureMapperAnimation::pause):
        (WebCore::TextureMapperAnimation::resume):
        (WebCore::TextureMapperAnimation::computeTotalRunningTime):
        (WebCore::TextureMapperAnimation::isActive):
        (WebCore::TextureMapperAnimation::applyInternal):
        (WebCore::TextureMapperAnimations::add):
        (WebCore::TextureMapperAnimations::remove):
        (WebCore::TextureMapperAnimations::pause):
        (WebCore::TextureMapperAnimations::suspend):
        (WebCore::TextureMapperAnimations::resume):
        (WebCore::TextureMapperAnimations::apply):
        (WebCore::TextureMapperAnimations::hasActiveAnimationsOfType):
        (WebCore::TextureMapperAnimations::hasRunningAnimations):
        (WebCore::TextureMapperAnimations::getActiveAnimations):
        * platform/graphics/texmap/TextureMapperAnimation.h:
        (WebCore::TextureMapperAnimation::name):
        (WebCore::TextureMapperAnimation::boxSize):
        (WebCore::TextureMapperAnimation::animation):
        (WebCore::TextureMapperAnimation::startTime):
        (WebCore::TextureMapperAnimation::pauseTime):
        (WebCore::TextureMapperAnimation::state):
        (WebCore::TextureMapperAnimation::setState): Deleted.
        (WebCore::TextureMapperAnimation::property): Deleted.
        (WebCore::TextureMapperAnimations::TextureMapperAnimations): Deleted.
        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::syncAnimations):
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
        (WebCore::CoordinatedGraphicsLayer::addAnimation):

2015-12-29  Simon Fraser  <simon.fraser@apple.com>

        Rename "scrollOffsetForFixedPosition" and related functions to refer to scrollPosition
        https://bugs.webkit.org/show_bug.cgi?id=152590

        Reviewed by Zalan Bujtas.

        FrameView::scrollOffsetForFixedPosition() actually returned a scroll position
        (possibly negative for RTL content), not a scroll offset, so rename it and related
        functions.

        * page/FrameView.cpp:
        (WebCore::FrameView::fixedScrollableAreaBoundsInflatedForScrolling):
        (WebCore::FrameView::scrollPositionRespectingCustomFixedPosition):
        (WebCore::FrameView::viewportConstrainedVisibleContentRect):
        (WebCore::FrameView::scrollPositionForFixedPosition):
        (WebCore::FrameView::scrollOffsetRespectingCustomFixedPosition): Deleted.
        (WebCore::FrameView::scrollOffsetForFixedPosition): Deleted.
        * page/FrameView.h:
        * page/animation/AnimationBase.cpp:
        (WebCore::AnimationBase::timeToNextService):
        * page/animation/AnimationController.cpp:
        (WebCore::AnimationControllerPrivate::scrollWasUpdated):
        * page/scrolling/AsyncScrollingCoordinator.cpp:
        (WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll):
        * page/scrolling/ios/ScrollingTreeFrameScrollingNodeIOS.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeIOS::updateChildNodesAfterScroll):
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeMac::setScrollLayerPosition):
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::setSize):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateGeometry):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::updateScrollLayerPosition):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::mapLocalToContainer):
        (WebCore::RenderView::pushMappingToContainer):
        (WebCore::RenderView::mapAbsoluteToLocalPoint):
        (WebCore::RenderView::computeRectForRepaint):

2015-12-29  Simon Fraser  <simon.fraser@apple.com>

        Fix the Windows build.

        * page/win/FrameCGWin.cpp:
        (WebCore::drawRectIntoContext):

2015-12-29  Simon Fraser  <simon.fraser@apple.com>

        Remove ScrollView::scrollOffset() in preparation for scrollOffset vs. scrollPosition clarification
        https://bugs.webkit.org/show_bug.cgi?id=152589

        Reviewed by Sam Weinig.

        Current code uses scrollOffset vs. scrollPosition interchangeably, and confusingly.
        Longer term, I plan to make "scrollPosition" be the value that is relative to the 
        contents, i.e. affected by scrollOrigin, and "scrollOffset" be the zero-based value
        that's used to set scrollbar values.
        
        To prepare for this, remove ScrollView::scrollOffset(), which is just the
        scrollPosition as an IntSize.
        
        Add some typedefs in ScrollableArea, which will slowly propagate through the
        code as position vs. offset is clarified.

        * inspector/InspectorOverlay.cpp:
        (WebCore::contentsQuadToCoordinateSystem):
        (WebCore::InspectorOverlay::highlightQuad):
        (WebCore::localPointToRoot):
        * page/FrameView.cpp:
        (WebCore::FrameView::scrollOffsetRespectingCustomFixedPosition):
        (WebCore::FrameView::topContentInsetDidChange):
        (WebCore::FrameView::addTrackedRepaintRect):
        (WebCore::FrameView::scrollTo):
        (WebCore::FrameView::wheelEvent):
        (WebCore::FrameView::setScrollPinningBehavior):
        * page/FrameView.h:
        * page/SpatialNavigation.cpp:
        (WebCore::canScrollInDirection):
        (WebCore::rectToAbsoluteCoordinates):
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::setScrollbarModes):
        (WebCore::ScrollView::availableContentSizeChanged):
        (WebCore::ScrollView::setContentsSize):
        (WebCore::ScrollView::maximumScrollPosition):
        (WebCore::ScrollView::minimumScrollPosition):
        (WebCore::ScrollView::adjustScrollPositionWithinRange):
        (WebCore::ScrollView::documentScrollOffsetRelativeToViewOrigin):
        (WebCore::ScrollView::documentScrollOffsetRelativeToScrollableAreaOrigin):
        (WebCore::ScrollView::setScrollPosition):
        (WebCore::ScrollView::updateScrollbars):
        (WebCore::ScrollView::rootViewToTotalContents):
        (WebCore::ScrollView::setFrameRect):
        (WebCore::ScrollView::scrollbarStyleChanged):
        (WebCore::ScrollView::setScrollOrigin):
        * platform/ScrollView.h:
        (WebCore::ScrollView::convertChildToSelf):
        (WebCore::ScrollView::convertSelfToChild):
        (WebCore::ScrollView::scrollOffset): Deleted.
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::scrollbarIntrusion):
        (WebCore::ScrollableArea::scrollPosition):
        (WebCore::ScrollableArea::minimumScrollPosition):
        (WebCore::ScrollableArea::maximumScrollPosition):
        * platform/ScrollableArea.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::calculateAutoscrollDirection):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollPosition):
        (WebCore::RenderLayer::minimumScrollPosition):
        (WebCore::RenderLayer::maximumScrollPosition):
        * rendering/RenderLayer.h:
        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::nodeAtPoint):
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::localCoordinateSpaceTransform):

2015-12-28  Alex Christensen  <achristensen@webkit.org>

        Fix Windows build, ostensibly after r194424.

        * CMakeLists.txt:
        * PlatformWin.cmake:
        ml.exe was given too many unneeded parameters (/Idir1 /Idir2 etc.), and it was failing sometimes with long directories.
        Instead of compiling makesafeseh.asm as a normal source file, we now put only the parameters that are needed to assemble
        the object file, then link with the object file.

2015-12-28  Brady Eidson  <beidson@apple.com>

        Modern IDB: Rename IDBServerOperation to ServerOpenDBRequest.
        https://bugs.webkit.org/show_bug.cgi?id=152577

        Reviewed by Andy Estes.

        No new tests (Refactor, no behavior change)

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        * Modules/indexeddb/server/ServerOpenDBRequest.cpp: Renamed from Source/WebCore/Modules/indexeddb/server/IDBServerOperation.cpp.
        (WebCore::IDBServer::ServerOpenDBRequest::create):
        (WebCore::IDBServer::ServerOpenDBRequest::ServerOpenDBRequest):
        (WebCore::IDBServer::ServerOpenDBRequest::isOpenRequest):
        (WebCore::IDBServer::ServerOpenDBRequest::isDeleteRequest):
        (WebCore::IDBServer::ServerOpenDBRequest::notifyDeleteRequestBlocked):
        (WebCore::IDBServer::ServerOpenDBRequest::notifyDidDeleteDatabase):
        
        * Modules/indexeddb/server/ServerOpenDBRequest.h: Renamed from Source/WebCore/Modules/indexeddb/server/IDBServerOperation.h.
        (WebCore::IDBServer::ServerOpenDBRequest::connection):
        (WebCore::IDBServer::ServerOpenDBRequest::requestData):
        (WebCore::IDBServer::ServerOpenDBRequest::hasNotifiedDeleteRequestBlocked):
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::openDatabaseConnection):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::handleDatabaseOperations):
        (WebCore::IDBServer::UniqueIDBDatabase::handleCurrentOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::handleDelete):
        (WebCore::IDBServer::UniqueIDBDatabase::startVersionChangeTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::notifyConnectionsOfVersionChangeForUpgrade):
        (WebCore::IDBServer::UniqueIDBDatabase::operationAndTransactionTimerFired):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        
2015-12-28  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        [CMake][EFL] Fix build breaks when enabling GAMEPAD
        https://bugs.webkit.org/show_bug.cgi?id=152573

        Reviewed by Alex Christensen.

        When enabling GAMEPAD feature on EFL and GTK, there are build breaks.
        Fixed all.

        * CMakeLists.txt:

2015-12-25  Andy Estes  <aestes@apple.com>

        Stop moving local objects in return statements
        https://bugs.webkit.org/show_bug.cgi?id=152557

        Reviewed by Brady Eidson.

        Calling std::move() on a local object in a return statement prevents the compiler from applying the return value optimization.

        Clang can warn about these mistakes with -Wpessimizing-move, although only when std::move() is called directly.
        I found these issues by temporarily replacing WTF::move with std::move and recompiling.

        * Modules/indexeddb/IDBDatabaseIdentifier.cpp:
        (WebCore::IDBDatabaseIdentifier::isolatedCopy):
        * Modules/indexeddb/IDBKeyData.cpp:
        (WebCore::IDBKeyData::deletedValue):
        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::objectStoreNames):
        (WebCore::IDBClient::IDBDatabase::startVersionChangeTransaction):
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::createObjectStore):
        (WebCore::IDBClient::IDBTransaction::createIndex):
        (WebCore::IDBClient::IDBTransaction::doRequestOpenCursor):
        (WebCore::IDBClient::IDBTransaction::requestGetRecord):
        (WebCore::IDBClient::IDBTransaction::requestIndexRecord):
        (WebCore::IDBClient::IDBTransaction::requestClearObjectStore):
        (WebCore::IDBClient::IDBTransaction::requestPutOrAdd):
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::takeNextRunnableTransaction):
        * Modules/indexeddb/shared/IDBDatabaseInfo.cpp:
        (WebCore::IDBDatabaseInfo::isolatedCopy):
        (WebCore::IDBDatabaseInfo::objectStoreNames):
        * Modules/indexeddb/shared/IDBResultData.cpp:
        (WebCore::IDBResultData::error):
        (WebCore::IDBResultData::openDatabaseSuccess):
        (WebCore::IDBResultData::openDatabaseUpgradeNeeded):
        * Modules/indexeddb/shared/IDBTransactionInfo.cpp:
        (WebCore::IDBTransactionInfo::versionChange):
        (WebCore::IDBTransactionInfo::isolatedCopy):
        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::create):
        * Modules/webaudio/OfflineAudioContext.cpp:
        (WebCore::OfflineAudioContext::create):
        * Modules/webdatabase/DatabaseTracker.cpp:
        (WebCore::DatabaseTracker::originLockFor):
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::create):
        * css/CSSPrimitiveValue.cpp:
        (WebCore::CSSPrimitiveValue::formatNumberValue):
        * dom/NodeOrString.cpp:
        (WebCore::convertNodesOrStringsIntoNode):
        * inspector/InspectorApplicationCacheAgent.cpp:
        (WebCore::InspectorApplicationCacheAgent::buildArrayForApplicationCacheResources):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::buildObjectForNode):
        (WebCore::InspectorDOMAgent::buildArrayForElementAttributes):
        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
        * inspector/InspectorIndexedDBAgent.cpp:
        * inspector/InspectorLayerTreeAgent.cpp:
        (WebCore::InspectorLayerTreeAgent::buildObjectForLayer):
        * inspector/InspectorNetworkAgent.cpp:
        (WebCore::buildObjectForHeaders):
        (WebCore::buildObjectForResourceRequest):
        (WebCore::buildObjectForCachedResource):
        * inspector/InspectorOverlay.cpp:
        (WebCore::buildArrayForQuad):
        (WebCore::buildObjectForFlowRegions):
        (WebCore::InspectorOverlay::buildObjectForHighlightedNodes):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::createXHRTextDecoder):
        (WebCore::buildArrayForCookies):
        (WebCore::InspectorPageAgent::buildObjectForFrame):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::buildMediaObject):
        (WebCore::InspectorStyle::buildArrayForComputedStyle):
        (WebCore::buildObjectForSelectorHelper):
        (WebCore::selectorsFromSource):
        (WebCore::InspectorStyleSheet::buildObjectForSelectorList):
        (WebCore::InspectorStyleSheet::buildObjectForStyle):
        (WebCore::InspectorStyleSheet::buildArrayForRuleList):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::stopFromConsole):
        * inspector/TimelineRecordFactory.cpp:
        (WebCore::TimelineRecordFactory::createGenericRecord):
        (WebCore::TimelineRecordFactory::createFunctionCallData):
        (WebCore::TimelineRecordFactory::createConsoleProfileData):
        (WebCore::TimelineRecordFactory::createProbeSampleData):
        (WebCore::TimelineRecordFactory::createEventDispatchData):
        (WebCore::TimelineRecordFactory::createGenericTimerData):
        (WebCore::TimelineRecordFactory::createTimerInstallData):
        (WebCore::TimelineRecordFactory::createEvaluateScriptData):
        (WebCore::TimelineRecordFactory::createTimeStampData):
        (WebCore::TimelineRecordFactory::createAnimationFrameData):
        (WebCore::createQuad):
        (WebCore::TimelineRecordFactory::createPaintData):
        (WebCore::buildInspectorObject):
        * loader/FrameLoader.cpp:
        (WebCore::createWindow):
        * loader/NavigationAction.cpp:
        (WebCore::NavigationAction::copyWithShouldOpenExternalURLsPolicy):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::createWindow):
        * platform/network/ios/QuickLook.mm:
        (WebCore::QuickLookHandle::create):
        * testing/Internals.cpp:
        (WebCore::Internals::openDummyInspectorFrontend):
        * workers/WorkerScriptLoader.cpp:
        (WebCore::WorkerScriptLoader::createResourceRequest):
        * xml/XPathExpression.cpp:
        (WebCore::XPathExpression::evaluate):

2015-12-27  Zalan Bujtas  <zalan@apple.com>

        Should never be reached failure in WebCore::RenderElement::clearLayoutRootIfNeeded
        https://bugs.webkit.org/show_bug.cgi?id=151590

        Reviewed by Simon Fraser.

        We should always set the layoutroot when a new subtree layout is requested (and convert it
        to a full layout when needed). It ensures that renderers are detached cleanly even when
        they are set as layoutroot.

        Test: fast/block/assert-when-layout-root-is-not-cleared.html

        * page/FrameView.cpp:
        (WebCore::FrameView::scheduleRelayoutOfSubtree):

2015-12-26  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        [CMake] Rearrange new gamepad files with deprecated files
        https://bugs.webkit.org/show_bug.cgi?id=152564

        Reviewed by Alex Christensen.

        New gamepad files have been commented out in CMakeLists.txt so far. This patch
        rearrange the files with deprecated files using ENABLE_GAMEPAD.

        * CMakeLists.txt:

2015-12-26  Per Arne Vollan  <peavo@outlook.com>

        [Curl] Compile errors.
        https://bugs.webkit.org/show_bug.cgi?id=152563

        Reviewed by Alex Christensen.

        The ResourceError constructor has changed signature.

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::ResourceHandleManager::downloadTimerCallback):
        (WebCore::ResourceHandleManager::dispatchSynchronousJob):

2015-12-25  Zalan Bujtas  <zalan@apple.com>

        Subpixel rendering: Add subpixel support for outline.
        https://bugs.webkit.org/show_bug.cgi?id=152560

        Reviewed by Simon Fraser.

        This patch adds support for subpixel outline-width/outline-offset.

        Test: fast/borders/hidpi-outline-hairline-painting.html

        * css/CSSPropertyNames.in:
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap):
        * platform/graphics/GraphicsContext.h:
        * platform/graphics/mac/GraphicsContextMac.mm:
        (WebCore::GraphicsContext::drawFocusRing):
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::computeMaxOutlineSize):
        (WebCore::RenderElement::paintOutline):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::paintAreaElementFocusRing):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::paintOutlineForLine):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::adjustRectForOutlineAndShadow):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::setMaximalOutlineSize):
        * rendering/RenderView.h:
        * rendering/style/OutlineValue.h:
        (WebCore::OutlineValue::offset):
        (WebCore::OutlineValue::OutlineValue): Deleted.
        * rendering/style/RenderStyle.h:

2015-12-25  Alexey Proskuryakov  <ap@apple.com>

        ASSERT(m_nsResponse) in ResourceResponse::platformCertificateInfo() when running tests in iOS simulator
        https://bugs.webkit.org/show_bug.cgi?id=152559

        Reviewed by Andy Estes.

        Fix a regression from r194378.

        * platform/network/cocoa/ResourceResponseCocoa.mm:
        (WebCore::ResourceResponse::platformCertificateInfo):

2015-12-25  David Kilzer  <ddkilzer@apple.com>

        ResourceError should store failingURL as URL instead of String to avoid reparsing and to address FIXME comments in ResourceErrorCF.cpp and ResourceErrorMac.mm
        <http://webkit.org/b/146391>

        Reviewed by Antti Koivisto.

        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
        (WebCore::DocumentThreadableLoader::didReceiveResponse):
        (WebCore::DocumentThreadableLoader::preflightFailure):
        * loader/DocumentThreadableLoader.h:
        (WebCore::DocumentThreadableLoader::preflightFailure):
        - Switch type of 'url' argument of preflightFailure() from
          String to URL.
        - Update for type change of 'failingURL' argument to
          ResourceError().

        * loader/EmptyClients.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadResourceSynchronously):
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::responseReceived):
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::loadDataURL):
        * loader/WorkerThreadableLoader.cpp:
        (WebCore::WorkerThreadableLoader::MainThreadBridge::cancel):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestResource):
        - Update for type change of 'failingURL' argument to
          ResourceError().

        * page/EventSource.cpp:
        (WebCore::EventSource::didFailAccessControlCheck):
        - Convert failingURL() to String explicitly.

        * platform/efl/ErrorsEfl.cpp:
        (WebCore::cancelledError):
        (WebCore::blockedError):
        (WebCore::blockedByContentBlockerError):
        (WebCore::cannotShowURLError):
        (WebCore::interruptedForPolicyChangeError):
        (WebCore::cannotShowMIMETypeError):
        (WebCore::fileDoesNotExistError):
        (WebCore::pluginWillHandleLoadError):
        (WebCore::downloadCancelledByUserError):
        (WebCore::downloadDestinationError):
        * platform/gtk/ErrorsGtk.cpp:
        (WebCore::cancelledError):
        (WebCore::blockedError):
        (WebCore::blockedByContentBlockerError):
        (WebCore::cannotShowURLError):
        (WebCore::interruptedForPolicyChangeError):
        (WebCore::cannotShowMIMETypeError):
        (WebCore::fileDoesNotExistError):
        (WebCore::pluginWillHandleLoadError):
        (WebCore::downloadCancelledByUserError):
        (WebCore::downloadDestinationError):
        - Update for type change of 'failingURL' argument to
          ResourceError().

        * platform/network/ResourceErrorBase.h:
        (WebCore::ResourceErrorBase::failingURL):
        - Change return type from String to URL.
        (WebCore::ResourceErrorBase::ResourceErrorBase):
        * platform/network/cf/ResourceError.h:
        (WebCore::ResourceError::ResourceError):
        - Change type of 'failingURL' from String to URL.

        * platform/network/cf/ResourceErrorCF.cpp:
        (WebCore::ResourceError::ResourceError):
        - Change type of 'failingURL' from String to URL.
        (WebCore::ResourceError::platformLazyInit):
        - Clean up code and address FIXME by parsing CFURLRef using
          URL() constructor.
        (WebCore::ResourceError::cfError):
        - Clean up code and address FIXME after switching type of
          m_failingURL.

        * platform/network/curl/ResourceError.h:
        (WebCore::ResourceError::ResourceError):
        - Change type of 'failingURL' from String to URL.

        * platform/network/mac/ResourceErrorMac.mm:
        (WebCore::createNSErrorFromResourceErrorBase):
        (WebCore::ResourceError::platformLazyInit):
        - Clean up code and address FIXME after switching type of
          m_failingURL.

        * platform/network/soup/ResourceError.h:
        (WebCore::ResourceError::ResourceError):
        (WebCore::ResourceError::timeoutError):
        * platform/network/soup/ResourceErrorSoup.cpp:
        (WebCore::failingURI):
        (WebCore::ResourceError::timeoutError):
        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::ResourceHandle::timeoutFired):
        - Change type of 'failingURL' from String to URL.

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::didFail):
        - Convert failingURL() to String explicitly.
        - Also switch to using makeString().

2015-12-24  Zalan Bujtas  <zalan@apple.com>

        ASSERTION FAILED: x2 >= x1 in WebCore::RenderElement::drawLineForBoxSide
        https://bugs.webkit.org/show_bug.cgi?id=151210

        Reviewed by Simon Fraser.

        "IntRect outer = snappedIntRect(inner)" explicitly converts inner to LayoutRect first and
        returns a snapped IntRect. When inner (after the inflate) overflows LayoutUnit,
        the snapped rect might become smaller than the inner rect.

        This patch also enables outline painting on subpixel positions.

        Tests: fast/borders/hidpi-outline-on-subpixel-position.html
               fast/borders/outline-offset-overflow.html

        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::paintOutline):

2015-12-24  Simon Fraser  <simon.fraser@apple.com>

        Use an enum for RenderElement's baseTypeFlags
        https://bugs.webkit.org/show_bug.cgi?id=152553

        Reviewed by Zalan Bujtas.

        Use an enum, rather than unsigned, for the BaseTypeFlags bit mask.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::RenderBlock):
        * rendering/RenderBlock.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::RenderBox):
        * rendering/RenderBox.h:
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::RenderBoxModelObject):
        * rendering/RenderBoxModelObject.h:
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::RenderElement):
        * rendering/RenderElement.h:
        * rendering/RenderLayerModelObject.cpp:
        (WebCore::RenderLayerModelObject::RenderLayerModelObject):
        * rendering/RenderLayerModelObject.h:

2015-12-24  Simon Fraser  <simon.fraser@apple.com>

        Remove the unused #define _USE_MATH_DEFINES
        https://bugs.webkit.org/show_bug.cgi?id=152034

        Reviewed by Tim Horton.
        
        _USE_MATH_DEFINES was added in r123968 but no longer does anything.

        * platform/graphics/cg/GraphicsContextCG.cpp:
        * platform/graphics/cg/PDFDocumentImage.cpp:
        * rendering/mathml/RenderMathMLMenclose.cpp:
        * rendering/mathml/RenderMathMLOperator.cpp:

2015-12-23  Brady Eidson  <beidson@apple.com>

        Modern IDB: Don't open any new connections until after version change transactions are completely handled.
        https://bugs.webkit.org/show_bug.cgi?id=152441

        Reviewed by Alex Christensen.

        No new tests (At least 4 failing tests now pass).
        
        When a version change transaction is in progress for a database, the server should not open any new connections
        to that database until the version change transaction has been 100% completed.
        
        This means *all* events related to finishing the transaction must fire.
        
        To support this, a new message from client -> server is added.

        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::didFinishHandlingVersionChangeTransaction):
        * Modules/indexeddb/client/IDBConnectionToServer.h:
        * Modules/indexeddb/client/IDBConnectionToServerDelegate.h:
        
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::dispatchEvent):
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.h:
        * Modules/indexeddb/client/IDBRequestImpl.h:
        
        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::didFinishHandlingVersionChangeTransaction):
        * Modules/indexeddb/server/IDBServer.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::handleDatabaseOperations):
        (WebCore::IDBServer::UniqueIDBDatabase::didFinishHandlingVersionChange):
        (WebCore::IDBServer::UniqueIDBDatabase::commitTransaction): Deleted.
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformAbortTransaction): Deleted.
        (WebCore::IDBServer::UniqueIDBDatabase::inProgressTransactionCompleted): Deleted.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::didFinishHandlingVersionChange):
        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.h:
        
        * Modules/indexeddb/shared/IDBTransactionInfo.cpp:
        (WebCore::IDBTransactionInfo::loggingString):
        * Modules/indexeddb/shared/IDBTransactionInfo.h:
        
        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::didFinishHandlingVersionChangeTransaction):
        * Modules/indexeddb/shared/InProcessIDBServer.h:

2015-12-23  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/transaction-basics.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152481

        Reviewed by Alex Christensen.

        No new tests (Failing test now passes).

        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::transaction): Include the invalid string argument
          in the error message.

2015-12-23  Simon Fraser  <simon.fraser@apple.com>

        Use "constrainedBetween" in more places
        https://bugs.webkit.org/show_bug.cgi?id=152543

        Reviewed by Zalan Bujtas.

        Replace code that contrains points via shrunkTo/expandedTo() with calls
        to constrainedBetween(), and implement constrainedBetween() on IntPoint,
        FloatPoint and LayoutPoint.

        Convert some functions that return points to more modern syntax.

        * page/scrolling/ScrollingTreeFrameScrollingNode.cpp:
        (WebCore::ScrollingTreeFrameScrollingNode::setScrollPosition):
        * page/scrolling/ScrollingTreeScrollingNode.cpp:
        (WebCore::ScrollingTreeScrollingNode::setScrollPosition):
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::adjustScrollPositionWithinRange):
        * platform/graphics/FloatPoint.cpp:
        (WebCore::FloatPoint::constrainedBetween):
        * platform/graphics/FloatPoint.h:
        (WebCore::FloatPoint::shrunkTo):
        (WebCore::FloatPoint::expandedTo):
        (WebCore::FloatPoint::transposedPoint):
        * platform/graphics/IntPoint.cpp:
        * platform/graphics/LayoutPoint.cpp:
        (WebCore::LayoutPoint::constrainedBetween):
        * platform/graphics/LayoutPoint.h:
        (WebCore::LayoutPoint::expandedTo):
        (WebCore::LayoutPoint::shrunkTo):
        (WebCore::LayoutPoint::transposedPoint):
        (WebCore::LayoutPoint::fraction):
        (WebCore::LayoutPoint::operator FloatPoint):

2015-12-23  Simon Fraser  <simon.fraser@apple.com>

        REGRESSION (r187593): Scroll position jumps when selecting text in an iframe
        https://bugs.webkit.org/show_bug.cgi?id=152541
        rdar://problem/23886181

        Reviewed by Tim Horton.
        
        r154382 added code that modifies parentLayer traversal, looking for ancestor
        scrollable layers. However, it confusingly added another code path in which
        the ancestor layer traversal cross a frame boundary, when RenderLayer::scrollRectToVisible()
        already has one. I fixed this new location to adjust the rect coordinates in r187593,
        but then code that hit both crossing points double-mapped the coordinates, causing
        autoscroll jumping.
        
        Fix by reverting r154382 and r187593, going back to doing the ancestor walk in
        one place. Re-fix r154382 by implementing RenderLayer::allowsCurrentScroll(),
        which contains the logic for line clamp, autoscroll and ensuring that overflow:hidden
        can be programmatically scrolled.
        
        Form controls are special; they can have overflow:hidden but still be user-scrollable
        during autoscroll; this is handled via the confusingly-named canBeProgramaticallyScrolled().
        RenderTextControlSingleLine implements this to ensure that readonly text inputs
        autoscroll (which is exercised by a test).
        
        The frame-to-parent-frame rect mapping in RenderLayer::scrollRectToVisible() is
        fixed to use the coordinate mapping functions from Widget/ScrollView, with the
        addition of a new utility function contentsToContainingViewContents().
        
        A "Scrolling" logging channel is added with a few log points.

        Test: fast/events/autoscroll-in-iframe-body.html

        * page/scrolling/ScrollingCoordinator.cpp:
        (WebCore::ScrollingCoordinator::absoluteNonFastScrollableRegionForFrame):
        use contentsToContainingViewContents().
        * platform/Logging.h:
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::contentsToContainingViewContents):
        * platform/ScrollView.h:
        * platform/graphics/IntPoint.cpp:
        (WebCore::IntPoint::constrainedBetween): New helper to constrain a point between
        two other points.
        * platform/graphics/IntPoint.h:
        (WebCore::IntPoint::expandedTo):
        (WebCore::IntPoint::shrunkTo):
        * rendering/RenderBox.cpp:
        * rendering/RenderLayer.cpp:
        (WebCore::parentLayerCrossFrame):
        (WebCore::RenderLayer::enclosingScrollableLayer):
        (WebCore::frameElementAndViewPermitScroll):
        (WebCore::RenderLayer::allowsCurrentScroll):
        (WebCore::RenderLayer::scrollRectToVisible):
        * rendering/RenderLayer.h:
        * rendering/RenderTextControlSingleLine.h:

2015-12-22  Simon Fraser  <simon.fraser@apple.com>

        Minor cleanup in RenderBox::canBeProgramaticallyScrolled()
        https://bugs.webkit.org/show_bug.cgi?id=152515

        Reviewed by Tim Horton.

        Remove the scrollsOverflow() check in RenderBox::canBeProgramaticallyScrolled(),
        since if hasScrollableOverflow is true, scrollsOverflow() must also be true.
        
        Factor clientWidth/Height vs. scrollWidth/Height checks into separate functions,
        and call them from two places.
        
        Added a test which is not affected by this particular change, but will verify
        that a later change doesn't break anything.

        Test: fast/overflow/overflow-hidden-scroll-into-view.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::canBeScrolledAndHasScrollableArea):
        (WebCore::RenderBox::canBeProgramaticallyScrolled):
        * rendering/RenderBox.h:
        (WebCore::RenderBox::hasHorizontalOverflow):
        (WebCore::RenderBox::hasVerticalOverflow):
        (WebCore::RenderBox::hasScrollableOverflowX):
        (WebCore::RenderBox::hasScrollableOverflowY):

2015-12-23  Pranjal Jumde  <pjumde@apple.com>

        Avoids stack recursion when indexed propertyNames defined using Object.defineProperty are deleted.
        https://bugs.webkit.org/show_bug.cgi?id=149179
        <rdar://problem/22708019>.

        Reviewed by Filip Pizlo.

        * runtime/JSObject.cpp:
        (JSStorage::deletePropertyByIndex was invoking Base::deleteProperty for indexed propertyNames instead of Base::deletePropertyByIndex leading to a stack recursion)

2015-12-23  Eric Carlson  <eric.carlson@apple.com>

        [MediaStream] MediaDeviceInfo.label must be empty in some situations
        https://bugs.webkit.org/show_bug.cgi?id=152000

        Reviewed by Brent Fulgham.

        No new tests, updated fast/mediastream/MediaDevices-enumerateDevices.html.

        * Modules/mediastream/CaptureDeviceManager.cpp:
        (CaptureDeviceManager::getSourcesInfo): TrackSourceInfo constructor takes persistent ID.

        * Modules/mediastream/MediaDevicesRequest.cpp:
        (WebCore::MediaDevicesRequest::start): If Document had an active stream track, don't bother
          checking for a persistent permission to access devices.
        (WebCore::MediaDevicesRequest::didCompleteCheck): m_hasUserMediaPermission -> m_canShowLabels.
        (WebCore::MediaDevicesRequest::getTrackSources): New, factored out of didCompleteCheck so it
          can be called when we don't need to check permissions.
        (WebCore::MediaDevicesRequest::didCompleteRequest): m_hasUserMediaPermission -> m_canShowLabels.
        * Modules/mediastream/MediaDevicesRequest.h:

        * Modules/mediastream/MediaStream.cpp:
        (WebCore::MediaStream::MediaStream): Call setIsActive. Register new stream with MediaStreamRegistry.
        (WebCore::MediaStream::~MediaStream): Unregister stream with MediaStreamRegistry.
        (WebCore::MediaStream::setIsActive): New. Set m_isActive and call Document if stream is active.
        (WebCore::MediaStream::scheduleActiveStateChange): Call setIsActive.
        (WebCore::MediaStream::registry): MediaStreamRegistry::registry -> MediaStreamRegistry::shared.
        (WebCore::mediaStreams): Deleted. Drive-by cleanup: moved list of all streams to MediaStreamRegistry.
        (WebCore::registerMediaStream): Ditto.
        (WebCore::unRegisterMediaStream): Ditto.
        (WebCore::MediaStream::lookUp): Ditto.
        (WebCore::MediaStream::setRegistry): Ditto.
        * Modules/mediastream/MediaStream.h:

        * Modules/mediastream/MediaStreamRegistry.cpp:
        (WebCore::MediaStreamRegistry::shared): Renamed from "registry".
        (WebCore::MediaStreamRegistry::MediaStreamRegistry):
        (WebCore::MediaStreamRegistry::lookUp): Moved here from MediaStream.
        (WebCore::mediaStreams): Ditto.
        (WebCore::MediaStreamRegistry::registerStream): Ditto.
        (WebCore::MediaStreamRegistry::unregisterStream): Ditto.
        (WebCore::MediaStreamRegistry::registry): Deleted.
        * Modules/mediastream/MediaStreamRegistry.h:

        * dom/Document.h:
        (WebCore::Document::setHasActiveMediaStreamTrack): New, set m_hasHadActiveMediaStreamTrack.
        (WebCore::Document::hasHadActiveMediaStreamTrack): New, return m_hasHadActiveMediaStreamTrack.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::loadResource): MediaStream::lookUp -> MediaStreamRegistry::shared().lookUp.

        * platform/mediastream/MediaStreamTrackSourcesRequestClient.h:
        (WebCore::TrackSourceInfo::create): Take track persistent ID.
        (WebCore::TrackSourceInfo::persistentId): New.
        (WebCore::TrackSourceInfo::TrackSourceInfo): Take track persistent ID.

        * platform/mediastream/mac/RealtimeMediaSourceCenterMac.cpp:
        (WebCore::RealtimeMediaSourceCenterMac::sourceWithUID): TrackSourceInfo::create takes persistent ID.

        * platform/mock/MockRealtimeMediaSource.cpp:
        (WebCore::MockRealtimeMediaSource::trackSourceWithUID): Ditto.

        * platform/mediastream/openwebrtc/RealtimeMediaSourceOwr.cpp:
        (WebCore::RealtimeMediaSourceCenterMac::sourceWithUID): TrackSourceInfo::create takes persistent ID.

2015-12-23  Xabier Rodriguez Calvar  <calvaris@igalia.com>

        [Streams API] In RS during enqueuing error should be reported only if readable
        https://bugs.webkit.org/show_bug.cgi?id=152505

        Reviewed by Youenn Fablet.

        This commit fixes last spec change done in
        https://github.com/whatwg/streams/commit/4ba861e6f60c248060811830e11271c84b439cc3.

        Test: imported/w3c/web-platform-tests/streams-api/readable-streams/bad-strategies.html

        * Modules/streams/ReadableStreamInternals.js:
        (enqueueInReadableStream): Call @errorReadableStream only if state is readable.

2015-12-23  Chris Aljoudi <chris@chrismatic.io> and Alex Christensen <achristensen@webkit.org>

        Content blockers should be able to promote http to https
        https://bugs.webkit.org/show_bug.cgi?id=148966

        Reviewed by Benjamin Poulain.

        Test: http/tests/contentextensions/make-https.html

        * contentextensions/ContentExtensionActions.h:
        * contentextensions/ContentExtensionCompiler.cpp:
        (WebCore::ContentExtensions::serializeActions):
        * contentextensions/ContentExtensionParser.cpp:
        (WebCore::ContentExtensions::loadAction):
        * contentextensions/ContentExtensionRule.cpp:
        (WebCore::ContentExtensions::Action::deserialize):
        (WebCore::ContentExtensions::Action::deserializeType):
        (WebCore::ContentExtensions::Action::serializedLength):
        * contentextensions/ContentExtensionsBackend.cpp:
        (WebCore::ContentExtensions::ContentExtensionsBackend::processContentExtensionRulesForLoad):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestResource):
        * platform/URL.cpp:
        (WebCore::URL::isBlankURL):
        (WebCore::defaultPortsMap):
        (WebCore::defaultPortForProtocol):
        (WebCore::isDefaultPortForProtocol):
        (WebCore::portAllowed):
        * platform/URL.h:

2015-12-22  Andy Estes  <aestes@apple.com>

        Try to fix the iOS build after r194378

        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:

2015-12-22  Andy Estes  <aestes@apple.com>

        [CF] Replace CFNetwork-related WebKitSystemInterface calls with SPI
        https://bugs.webkit.org/show_bug.cgi?id=152463

        Reviewed by Alexey Proskuryakov.

        Replaced WebkitSystemInterface calls that wrapped CFNetwork SPI with direct calls to SPI that is now forward
        declared in CFNetworkSPI.h.

        Also removed some unused declarations and renamed ResourceResponseMac.mm to ResourceResponseCocoa.mm.

        * PlatformMac.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/ios/WebCoreSystemInterfaceIOS.mm:
        * platform/mac/WebCoreSystemInterface.h:
        * platform/mac/WebCoreSystemInterface.mm:
        * platform/network/NetworkStorageSession.h:
        * platform/network/cf/CredentialStorageCFNet.cpp:
        (WebCore::copyCredentialFromProtectionSpace):
        (WebCore::CredentialStorage::getFromPersistentStorage):
        * platform/network/cf/NetworkStorageSessionCFNet.cpp:
        (WebCore::NetworkStorageSession::cookieStorage):
        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::ResourceHandle::createCFURLConnection):
        * platform/network/cf/ResourceHandleCFURLConnectionDelegate.cpp:
        (WebCore::ResourceHandleCFURLConnectionDelegate::createResourceRequest):
        * platform/network/cf/ResourceHandleCFURLConnectionDelegateWithOperationQueue.cpp:
        (WebCore::ResourceHandleCFURLConnectionDelegateWithOperationQueue::didReceiveResponse):
        * platform/network/cf/ResourceRequestCFNet.cpp:
        (WebCore::ResourceRequest::doUpdatePlatformRequest):
        (WebCore::ResourceRequest::doUpdateResourceRequest):
        (WebCore::ResourceRequest::setStorageSession):
        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
        (WebCore::initializeHTTPConnectionSettingsOnStartup):
        * platform/network/cf/ResourceRequestCFNet.h:
        (WebCore::toResourceLoadPriority):
        (WebCore::toPlatformRequestPriority):
        * platform/network/cf/ResourceResponse.h:
        * platform/network/cf/ResourceResponseCFNet.cpp:
        (WebCore::ResourceResponse::platformCertificateInfo):
        * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.cpp:
        (WebCore::SynchronousResourceHandleCFURLConnectionDelegate::didReceiveResponse):
        * platform/network/cocoa/ResourceRequestCocoa.mm:
        (WebCore::ResourceRequest::doUpdateResourceRequest):
        (WebCore::ResourceRequest::doUpdatePlatformRequest):
        * platform/network/cocoa/ResourceResponseCocoa.mm: Renamed from Source/WebCore/platform/network/mac/ResourceResponseMac.mm.
        (WebCore::ResourceResponse::platformCertificateInfo):
        (WebCore::copyNSURLResponseStatusLine):
        (WebCore::ResourceResponse::platformLazyInit):
        * platform/network/ios/QuickLook.h:
        * platform/network/ios/QuickLook.mm:
        * platform/network/ios/WebCoreURLResponseIOS.mm:
        (WebCore::adjustMIMETypeIfNecessary):
        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::createNSURLConnection):
        * platform/network/mac/WebCoreURLResponse.h:
        * platform/network/mac/WebCoreURLResponse.mm:
        (WebCore::adjustMIMETypeIfNecessary):
        * platform/spi/cf/CFNetworkConnectionCacheSPI.h:
        * platform/spi/cf/CFNetworkSPI.h:

2015-12-22  Michael Catanzaro  <mcatanzaro@igalia.com>

        [GTK] Everything broken in GTK+ 3.19
        https://bugs.webkit.org/show_bug.cgi?id=150550

        Reviewed by Carlos Garcia Campos.

        Port RenderThemeGtk and ScrollbarThemeGtk to use CSS nodes. This makes it possible to render
        stuff with modern GTK+.

        No new tests. We already have tons of tests for this functionality, but we're running them
        with GTK+ 3.16, so they cannot have detected this breakage. These fixes require unreleased
        GTK+, and GTK+ rendering is currently in a state of flux; once things settle down, we can
        consider upgrading the GTK+ used for our layout tests.

        * platform/gtk/GRefPtrGtk.cpp:
        (WTF::refGPtr):
        (WTF::derefGPtr):
        * platform/gtk/GRefPtrGtk.h:
        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::themeChanged):
        (WebCore::ScrollbarThemeGtk::updateThemeProperties):
        (WebCore::orientationStyleClass):
        (WebCore::applyScrollbarStyleContextClasses):
        (WebCore::ScrollbarThemeGtk::paintTrackBackground):
        (WebCore::ScrollbarThemeGtk::paintScrollbarBackground):
        (WebCore::ScrollbarThemeGtk::paintThumb):
        (WebCore::ScrollbarThemeGtk::paintButton):
        * rendering/RenderThemeGtk.cpp:
        (WebCore::createStyleContext):
        (WebCore::setToggleSize):
        (WebCore::paintToggle):
        (WebCore::RenderThemeGtk::paintButton):
        (WebCore::getComboBoxMetrics):
        (WebCore::RenderThemeGtk::paintMenuList):
        (WebCore::RenderThemeGtk::paintTextField):
        (WebCore::applySliderStyleContextClasses):
        (WebCore::RenderThemeGtk::paintSliderTrack):
        (WebCore::RenderThemeGtk::paintSliderThumb):
        (WebCore::RenderThemeGtk::paintProgressBar):
        (WebCore::paintSpinArrowButton):
        (WebCore::styleColor):

2015-12-22  Eric Carlson  <eric.carlson@apple.com>

        [MediaStream] MediaStreamTrackPrivate.source should be a reference
        https://bugs.webkit.org/show_bug.cgi?id=152509

        Reviewed by Tim Horton.

        No new tests, no functional change.

        * Modules/mediastream/MediaStream.cpp:
        (WebCore::MediaStream::trackVectorForType):
        * Modules/mediastream/MediaStreamTrack.h:
        * Modules/mediastream/RTCDTMFSender.cpp:
        (WebCore::RTCDTMFSender::create):
        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::didCreateStream):
        * platform/mediastream/MediaStreamPrivate.cpp:
        (WebCore::MediaStreamPrivate::platformLayer):
        (WebCore::MediaStreamPrivate::currentFrameImage):
        * platform/mediastream/MediaStreamTrackPrivate.cpp:
        (WebCore::MediaStreamTrackPrivate::MediaStreamTrackPrivate):
        * platform/mediastream/MediaStreamTrackPrivate.h:
        (WebCore::MediaStreamTrackPrivate::source):

2015-12-22  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r194362.
        https://bugs.webkit.org/show_bug.cgi?id=152508

        crashes release bot (Requested by mcatanzaro on #webkit).

        Reverted changeset:

        "[GTK] Everything broken in GTK+ 3.19"
        https://bugs.webkit.org/show_bug.cgi?id=150550
        http://trac.webkit.org/changeset/194362

2015-12-22  Keith Miller  <keith_miller@apple.com>

        Remove OverridesHasInstance from TypeInfoFlags
        https://bugs.webkit.org/show_bug.cgi?id=152005

        Reviewed by Saam Barati.

        Currently, we have three TypeInfo flags associated with instanceof behavior,
        ImplementsHasInstance, ImplementDefaultHasInstance, and OverridesHasInstance. This patch
        removes the third and moves the first to the out of line flags. In theory, we should only
        need one flag but removing ImplementsHasInstance is more involved and should be done in a
        separate patch.

        * bindings/js/JSDOMBinding.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):

2015-12-22  Brent Fulgham  <bfulgham@apple.com>

        Allow JavaScript to iterate over plugins for local SecurityOrigins
        https://bugs.webkit.org/show_bug.cgi?id=152489

        Reviewed by Alexey Proskuryakov.

        Instead of calling 'isLocalFile' on the URL, we check the Document's SecurityOrigin. If
        no origin exists, we construct a SecurityOrigin from the URL, and check whether it
        satisfies 'isLocal'.

        * page/Page.cpp:
        (WebCore::Page::showAllPlugins): Revised to use SecurityOrigin.

2015-12-22  Michael Catanzaro  <mcatanzaro@igalia.com>

        [GTK] Everything broken in GTK+ 3.19
        https://bugs.webkit.org/show_bug.cgi?id=150550

        Reviewed by Carlos Garcia Campos.

        Port RenderThemeGtk and ScrollbarThemeGtk to use CSS nodes. This makes it possible to render
        stuff with modern GTK+.

        No new tests. We already have tons of tests for this functionality, but we're running them
        with GTK+ 3.16, so they cannot have detected this breakage. These fixes require unreleased
        GTK+, and GTK+ rendering is currently in a state of flux; once things settle down, we can
        consider upgrading the GTK+ used for our layout tests.

        * platform/gtk/GRefPtrGtk.cpp:
        (WTF::refGPtr):
        (WTF::derefGPtr):
        * platform/gtk/GRefPtrGtk.h:
        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::themeChanged):
        (WebCore::ScrollbarThemeGtk::updateThemeProperties):
        (WebCore::orientationStyleClass):
        (WebCore::applyScrollbarStyleContextClasses):
        (WebCore::ScrollbarThemeGtk::paintTrackBackground):
        (WebCore::ScrollbarThemeGtk::paintScrollbarBackground):
        (WebCore::ScrollbarThemeGtk::paintThumb):
        (WebCore::ScrollbarThemeGtk::paintButton):
        * rendering/RenderThemeGtk.cpp:
        (WebCore::createStyleContext):
        (WebCore::setToggleSize):
        (WebCore::paintToggle):
        (WebCore::RenderThemeGtk::paintButton):
        (WebCore::getComboBoxMetrics):
        (WebCore::RenderThemeGtk::paintMenuList):
        (WebCore::RenderThemeGtk::paintTextField):
        (WebCore::applySliderStyleContextClasses):
        (WebCore::RenderThemeGtk::paintSliderTrack):
        (WebCore::RenderThemeGtk::paintSliderThumb):
        (WebCore::RenderThemeGtk::paintProgressBar):
        (WebCore::paintSpinArrowButton):
        (WebCore::styleColor):

2015-12-20  Jeremy Zerfas  <WebKit@JeremyZerfas.com>

        Don't allocate a NSImage and skip unneeded call to TIFFRepresentation when copying image to clipboard.
        https://bugs.webkit.org/show_bug.cgi?id=152374

        Reviewed by Darin Adler.

        When copying an image to the clipboard, don't bother allocating a
        NSImage and skip the unneeded call to TIFFRepresentation since the data
        from the previous getTIFFRepresentation call can be used instead. This
        considerably reduces the amount of memory and CPU time used for large
        images/animations.

        Test: fast/images/image-copy-memory-usage.html

        * platform/mac/PasteboardMac.mm:
        (WebCore::Pasteboard::write):

2015-12-20  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Reduce PassRefPtr uses in dom - 2
        https://bugs.webkit.org/show_bug.cgi?id=151936

        Reviewed by Darin Adler.

        Change PassRefPtr with RefPtr<Foo>&&, WTF::move(), Foo*, and Foo&.

        * dom/ScopedEventQueue.h:
        * dom/ScriptedAnimationController.cpp:
        (WebCore::ScriptedAnimationController::registerCallback):
        * dom/ScriptedAnimationController.h:
        * dom/StaticNodeList.h:
        * dom/Traversal.cpp:
        (WebCore::NodeIteratorBase::NodeIteratorBase):
        * dom/Traversal.h:
        * dom/TreeWalker.cpp:
        (WebCore::TreeWalker::TreeWalker):
        (WebCore::TreeWalker::setCurrentNode):
        * dom/TreeWalker.h:
        (WebCore::TreeWalker::create):
        * dom/UserActionElementSet.h:
        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::WebKitNamedFlow):
        (WebCore::WebKitNamedFlow::create):
        (WebCore::WebKitNamedFlow::getRegionsByContent):
        (WebCore::WebKitNamedFlow::getRegions):
        (WebCore::WebKitNamedFlow::getContent):
        * dom/WebKitNamedFlow.h:
        * dom/WheelEvent.cpp:
        (WebCore::WheelEvent::WheelEvent):
        (WebCore::WheelEvent::initWheelEvent):
        (WebCore::WheelEvent::initWebKitWheelEvent):
        * dom/WheelEvent.h:

2015-12-20  Michael Catanzaro  <mcatanzaro@igalia.com>

        [SOUP] Performs DNS prefetch when a proxy is configured (information leak)
        https://bugs.webkit.org/show_bug.cgi?id=145542

        Reviewed by Darin Adler.

        Perform DNS prefetch only when no proxy is configured.

        No new tests. Test this manually with Wireshark. Run the simple-proxy example program found
        in libsoup's examples directory, set that as your system HTTP proxy, and see if DNS queries
        show up in Wireshark when refreshing a page sent over HTTP. They should appear only when the
        proxy is not configured.

        * platform/network/DNSResolveQueue.cpp:
        (WebCore::DNSResolveQueue::DNSResolveQueue):
        (WebCore::DNSResolveQueue::isUsingProxy):
        * platform/network/DNSResolveQueue.h:
        * platform/network/cf/DNSCFNet.cpp:
        (WebCore::DNSResolveQueue::updateIsUsingProxy):
        (WebCore::DNSResolveQueue::platformProxyIsEnabledInSystemPreferences): Deleted.
        * platform/network/soup/DNSSoup.cpp:
        (WebCore::didResolveProxy):
        (WebCore::proxyResolvedForHttpUriCallback):
        (WebCore::proxyResolvedForHttpsUriCallback):
        (WebCore::DNSResolveQueue::updateIsUsingProxy):
        (WebCore::DNSResolveQueue::platformProxyIsEnabledInSystemPreferences): Deleted.

2015-12-20  Dan Bernstein  <mitz@apple.com>

        Remove unused setToolbarHeight
        https://bugs.webkit.org/show_bug.cgi?id=152466

        Reviewed by Darin Adler.

        * inspector/InspectorFrontendClient.h:
        * inspector/InspectorFrontendHost.cpp:
        (WebCore::InspectorFrontendHost::setToolbarHeight): Deleted.
        * inspector/InspectorFrontendHost.h:
        * inspector/InspectorFrontendHost.idl:
        * testing/Internals.cpp:

2015-12-20  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r194033 and r194267.
        https://bugs.webkit.org/show_bug.cgi?id=152465

        Caused crashes on Mac WK1 bots (Requested by youenn on
        #webkit).

        Reverted changesets:

        "[Streams API] Expose ReadableStream and relatives to Worker"
        https://bugs.webkit.org/show_bug.cgi?id=152066
        http://trac.webkit.org/changeset/194033

        "[Streams API] imported/w3c/web-platform-tests/streams-api
        /readable-streams/cancel.html has a flaky test"
        https://bugs.webkit.org/show_bug.cgi?id=152065
        http://trac.webkit.org/changeset/194267

2015-12-19  Dan Bernstein  <mitz@apple.com>

        [Mac] WebKit contains dead source code for OS X Mavericks and earlier
        https://bugs.webkit.org/show_bug.cgi?id=152462

        Reviewed by Alexey Proskuryakov.

        - Removed build setting definitions for OS X 10.9 and earlier, and simplified defintions
          that became uniform across all OS X versions as a result:

        * Configurations/DebugRelease.xcconfig:
        * Configurations/FeatureDefines.xcconfig:
        * Configurations/Version.xcconfig:

        - Removed support for animating default buttons:

        * rendering/RenderButton.cpp:
        (WebCore::RenderButton::RenderButton): Removed m_default initialization.
        (WebCore::RenderButton::styleDidChange): Removed checking for animating default button and
          starting the animation timer.
        (WebCore::RenderButton::timerFired): Deleted.
        * rendering/RenderButton.h: Removed m_timer and m_default member variables
        * rendering/RenderTheme.h:
        (WebCore::RenderTheme::defaultButtonHasAnimation): Deleted.
        * rendering/RenderThemeMac.h: Deleted override.
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::defaultButtonHasAnimation): Deleted.

        - Simplified expressions involving __MAC_OS_X_VERSION_MIN_REQUIRED and removed code that was
          never getting compiled:

        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        * editing/mac/DictionaryLookup.h:
        * editing/mac/DictionaryLookup.mm:
        * html/canvas/WebGLDrawBuffers.cpp:
        * loader/DocumentLoader.cpp:
        * loader/cache/CachedFont.cpp:
        * loader/cocoa/DiskCacheMonitorCocoa.h:
        * page/cocoa/SettingsCocoa.mm:
        * platform/Scrollbar.cpp:
        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        * platform/cocoa/NetworkExtensionContentFilter.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        * platform/graphics/cg/ImageSourceCG.cpp:
        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        * platform/graphics/cocoa/FontCascadeCocoa.mm:
        * platform/graphics/mac/GraphicsContext3DMac.mm:
        * platform/mac/NSScrollerImpDetails.h:
        * platform/mac/ScrollAnimatorMac.mm:
        * platform/mac/ScrollViewMac.mm:
        * platform/mac/ScrollbarThemeMac.mm:
        * platform/mac/ThemeMac.mm:
        * platform/mac/WebCoreFullScreenPlaceholderView.h:
        * platform/mac/WebCoreFullScreenPlaceholderView.mm:
        * platform/network/cf/CookieJarCFNet.cpp:
        * platform/network/cf/ResourceRequest.h:
        * platform/spi/cf/CFNetworkSPI.h:
        * platform/spi/cocoa/CoreTextSPI.h:
        * platform/spi/cocoa/NSButtonCellSPI.h:
        * platform/spi/cocoa/NSColorSPI.h:
        * platform/spi/cocoa/QuartzCoreSPI.h:
        * platform/spi/mac/LookupSPI.h:
        * platform/spi/mac/NSFontSPI.h:
        * platform/spi/mac/NSImmediateActionGestureRecognizerSPI.h:
        * platform/spi/mac/NSPopoverSPI.h:
        * platform/spi/mac/NSSharingServicePickerSPI.h:
        * platform/spi/mac/NSSharingServiceSPI.h:
        * platform/spi/mac/TUCallSPI.h:
        * platform/sql/SQLiteDatabase.cpp:

2015-12-18  Antti Koivisto  <antti@apple.com>

        Cache redirects as separate entries
        https://bugs.webkit.org/show_bug.cgi?id=152424

        Reviewed by Alex Christensen.

        Test: http/tests/cache/disk-cache/disk-cache-redirect.html

        * platform/network/ResourceRequestBase.h:

2015-12-18  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo] Empty context menu item.
        https://bugs.webkit.org/show_bug.cgi?id=152423

        Reviewed by Alex Christensen.

        The context menu contains a submenu item with no text.

        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::populate):

2015-12-18  Michael Catanzaro  <mcatanzaro@igalia.com>

        Avoid triggering clang's -Wundefined-bool-conversion
        https://bugs.webkit.org/show_bug.cgi?id=152408

        Reviewed by Mark Lam.

        Remove use of ASSERT(this).

        * dom/TreeScope.cpp:
        (WebCore::TreeScope::adoptIfNeeded):
        * page/Frame.cpp:
        (WebCore::Frame::createView):

2015-12-18  Simon Fraser  <simon.fraser@apple.com>

        Remove the 'ignoreViewportScalingConstraints' Setting, which was unused
        https://bugs.webkit.org/show_bug.cgi?id=152435

        Reviewed by Tim Horton.

        r177110 added a WebCore setting called ignoreViewportScalingConstraints,
        but it was never used, so remove it.

        * page/Settings.in:

2015-12-18  Brent Fulgham  <bfulgham@apple.com>

        Place an upper bound on canvas pixel count
        https://bugs.webkit.org/show_bug.cgi?id=151825
        <rdar://problem/23324916>

        Reviewed by Simon Fraser (Relanded by Brent Fulgham)

        Malformed JavaScript can attempt to create lots of canvas contexts. Limit the amount of memory
        we will use for this purpose to some percentage of system RAM.

        * html/HTMLCanvasElement.cpp:
        (WebCore::removeFromActivePixelMemory): Added helper function
        (WebCore::HTMLCanvasElement::~HTMLCanvasElement): Call new 'releaseImageBufferAndContext' method
        to ensure ImageBuffer and graphics context state are properly cleaned up.
        (WebCore::maxActivePixels): Use one quarter of the system RAM, or 2 GB (whichever is more) as
        an upper bound on active pixel memory.
        (WebCore::HTMLCanvasElement::getContext): If we are attempting to create a context that will cause
        us to exceed the allowed active pixel count, fail.
        (WebCore::HTMLCanvasElement::releaseImageBufferAndContext): Added helper function
        (WebCore::HTMLCanvasElement::setSurfaceSize): Use the new 'releaseImageBufferAndContext' method
        to handle active pixel memory counts.
        (WebCore::HTMLCanvasElement::createImageBuffer): Refuse to create a backing buffer if it will
        exceed our available pixel memory.

2015-12-18  Olivier Blin  <olivier.blin@softathome.com>

        Fix the !ENABLE(VIDEO) build after r192953 for <picture> element introduction
        https://bugs.webkit.org/show_bug.cgi?id=152431

        Since r192953, HTMLSourceElement is built even if video is disabled,
        since it is used by the picture element.

        But build was broken with -no-video, since HTMLMediaElement usage
        should be guarded by VIDEO guards, and its JS bindings were still
        under a video conditional.

        Reviewed by Alex Christensen.

        No new tests, build fix only.

        * html/HTMLSourceElement.cpp:
        (WebCore::HTMLSourceElement::insertedInto):
        (WebCore::HTMLSourceElement::removedFrom):
        * html/HTMLSourceElement.idl:

2015-12-18  Brady Eidson  <beidson@apple.com>

        Modern IDB: Refactor when opening the backing store takes place.
        https://bugs.webkit.org/show_bug.cgi?id=152405

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::openDatabaseConnection): Move the "open backing store" logic
          from here to performCurrentOpenOperation.
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation): If the database backing store is
          not open yet, kick off opening it here.
        (WebCore::IDBServer::UniqueIDBDatabase::handleDatabaseOperations): Rework this stuff to be better.

2015-12-17  Brady Eidson  <beidson@apple.com>

        Modern IDB: Refactor open/delete requests to exist in the same queue.
        https://bugs.webkit.org/show_bug.cgi?id=152397

        Reviewed by Alex Christensen.

        No new tests (Refactor, all existing tests continue to pass).

        The order between incoming open and delete requests matters, and each request
        needs to be handled individually.
        
        This patch does the above without changing behavior on existing passing tests,
        while moving many currently skipped tests closer to passing.
    
        * Modules/indexeddb/server/IDBServerOperation.cpp:
        (WebCore::IDBServer::IDBServerOperation::notifyDeleteRequestBlocked):
        (WebCore::IDBServer::IDBServerOperation::notifyDidDeleteDatabase):
        * Modules/indexeddb/server/IDBServerOperation.h:
        (WebCore::IDBServer::IDBServerOperation::hasNotifiedDeleteRequestBlocked):

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::~UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::openDatabaseConnection):
        (WebCore::IDBServer::UniqueIDBDatabase::isVersionChangeInProgress):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::handleDatabaseOperations):
        (WebCore::IDBServer::UniqueIDBDatabase::handleCurrentOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::handleDelete):
        (WebCore::IDBServer::UniqueIDBDatabase::invokeOperationAndTransactionTimer):
        (WebCore::IDBServer::UniqueIDBDatabase::operationAndTransactionTimerFired):
        (WebCore::IDBServer::UniqueIDBDatabase::maybeDeleteDatabase): Deleted.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2015-12-17  Csaba Osztrogonác  <ossy@webkit.org>

        [EFL] edje shouldn't have verbose output
        https://bugs.webkit.org/show_bug.cgi?id=152381

        Reviewed by Gyuyoung Kim.

        * platform/efl/DefaultTheme/CMakeLists.txt:

2015-12-17  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r194241 and r194252.
        https://bugs.webkit.org/show_bug.cgi?id=152415

        Caused crashes on GuardMalloc (Requested by ap on #webkit).

        Reverted changesets:

        "Modern IDB: Refactor open/delete requests to exist in the
        same queue."
        https://bugs.webkit.org/show_bug.cgi?id=152397
        http://trac.webkit.org/changeset/194241

        "Modern IDB: Refactor when opening the backing store takes
        place."
        https://bugs.webkit.org/show_bug.cgi?id=152405
        http://trac.webkit.org/changeset/194252

2015-12-17  Brady Eidson  <beidson@apple.com>

        Modern IDB: Refactor when opening the backing store takes place.
        https://bugs.webkit.org/show_bug.cgi?id=152405

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::openDatabaseConnection): Move the "open backing store" logic
          from here to performCurrentOpenOperation.
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation): If the database backing store is
          not open yet, kick off opening it here.
        (WebCore::IDBServer::UniqueIDBDatabase::handleDatabaseOperations): Rework this stuff to be better.

2015-12-16  Simon Fraser  <simon.fraser@apple.com>

        ViewportConfiguration functions should return a bool to say if anything changed
        https://bugs.webkit.org/show_bug.cgi?id=152353

        Reviewed by Tim Horton.

        Rather than callers all checking whether setting ViewportConfiguration values
        changes state, have its functions return a bool if the values change.

        * page/ViewportConfiguration.cpp:
        (WebCore::ViewportConfiguration::setContentsSize):
        (WebCore::ViewportConfiguration::setMinimumLayoutSize):
        (WebCore::ViewportConfiguration::setViewportArguments):
        (WebCore::ViewportConfiguration::setCanIgnoreScalingConstraints):
        * page/ViewportConfiguration.h:
        (WebCore::ViewportConfiguration::setCanIgnoreScalingConstraints): Deleted.

2015-12-16  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Add JSContext Script Profiling
        https://bugs.webkit.org/show_bug.cgi?id=151899

        Reviewed by Brian Burg.

        Tests: inspector/script-profiler/event-type-API.html
               inspector/script-profiler/event-type-Microtask.html
               inspector/script-profiler/tracking.html

        * ForwardingHeaders/inspector/agents/InspectorScriptProfilerAgent.h: Added.

        * inspector/InspectorController.h:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        Create the new agent, even if we don't use it yet for Page inspection.

        (WebCore::InspectorController::willCallInjectedScriptFunction): Deleted.
        (WebCore::InspectorController::didCallInjectedScriptFunction): Deleted.
        No longer needed, implementation was pushed up into InjectedScriptBase.

        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::buildArrayForMatchedRuleList):
        * inspector/InspectorReplayAgent.cpp:
        (WebCore::buildInspectorObjectForSession):
        Disambiguate types.

2015-12-17  Brady Eidson  <beidson@apple.com>

        Modern IDB: Refactor open/delete requests to exist in the same queue.
        https://bugs.webkit.org/show_bug.cgi?id=152397

        Reviewed by Alex Christensen.

        No new tests (Refactor, all existing tests continue to pass).

        The order between incoming open and delete requests matters, and each request
        needs to be handled individually.
        
        This patch does the above without changing behavior on existing passing tests,
        while moving many currently skipped tests closer to passing.
    
        * Modules/indexeddb/server/IDBServerOperation.cpp:
        (WebCore::IDBServer::IDBServerOperation::notifyDeleteRequestBlocked):
        (WebCore::IDBServer::IDBServerOperation::notifyDidDeleteDatabase):
        * Modules/indexeddb/server/IDBServerOperation.h:
        (WebCore::IDBServer::IDBServerOperation::hasNotifiedDeleteRequestBlocked):

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::~UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::openDatabaseConnection):
        (WebCore::IDBServer::UniqueIDBDatabase::isVersionChangeInProgress):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::handleDatabaseOperations):
        (WebCore::IDBServer::UniqueIDBDatabase::handleCurrentOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::handleDelete):
        (WebCore::IDBServer::UniqueIDBDatabase::invokeOperationAndTransactionTimer):
        (WebCore::IDBServer::UniqueIDBDatabase::operationAndTransactionTimerFired):
        (WebCore::IDBServer::UniqueIDBDatabase::maybeDeleteDatabase): Deleted.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2015-12-17  Brent Fulgham  <bfulgham@apple.com>

        [Win] Prevent flashing/strobing repaints on certain hardware
        https://bugs.webkit.org/show_bug.cgi?id=152394
        <rdar://problem/23875302>

        Reviewed by Simon Fraser.

        This patch reverts a change I made in r192166, where I always set the
        m_viewNeedsUpdate flag to true when a 'flushContext' call was made. Instead,
        we should go back to letting the view decide when it needs to paint.

        * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp:
        (WebCore::WKCACFViewLayerTreeHost::flushContext): Don't just claim that
        the view needs to be updated any time we are asked to flush. 

2015-12-17  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo][MediaFoundation] Release Direct3D swap chain object earlier.
        https://bugs.webkit.org/show_bug.cgi?id=152392

        Reviewed by Alex Christensen.

        Since we don't use the swap chain object to render the video to a window,
        but render frames to Cairo bitmaps, we can let go of the swap chain object
        earlier than we currently do. 

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::clearDesiredSampleTime):
        (WebCore::MediaPlayerPrivateMediaFoundation::Direct3DPresenter::createVideoSamples):

2015-12-17  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r194201.
        https://bugs.webkit.org/show_bug.cgi?id=152391

        Caused crashes with GuardMalloc (Requested by ap|away on
        #webkit).

        Reverted changeset:

        "Reduce PassRefPtr uses in dom - 2"
        https://bugs.webkit.org/show_bug.cgi?id=151936
        http://trac.webkit.org/changeset/194201

2015-12-17  Csaba Osztrogonác  <ossy@webkit.org>

        Fix unused parameter handling in WebGLRenderingContextBase.cp
        https://bugs.webkit.org/show_bug.cgi?id=152387

        Reviewed by Alex Christensen.

        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::activeTexture):
        (WebCore::WebGLRenderingContextBase::attachShader):
        (WebCore::WebGLRenderingContextBase::bindAttribLocation):
        (WebCore::WebGLRenderingContextBase::bindBuffer):
        (WebCore::WebGLRenderingContextBase::bindFramebuffer):
        (WebCore::WebGLRenderingContextBase::bindRenderbuffer):
        (WebCore::WebGLRenderingContextBase::bindTexture):
        (WebCore::WebGLRenderingContextBase::bufferData):
        (WebCore::WebGLRenderingContextBase::bufferSubData):
        (WebCore::WebGLRenderingContextBase::compileShader):
        (WebCore::WebGLRenderingContextBase::createShader):
        (WebCore::WebGLRenderingContextBase::detachShader):
        (WebCore::WebGLRenderingContextBase::disableVertexAttribArray):
        (WebCore::WebGLRenderingContextBase::drawArrays):
        (WebCore::WebGLRenderingContextBase::drawElements):
        (WebCore::WebGLRenderingContextBase::enableVertexAttribArray):
        (WebCore::WebGLRenderingContextBase::framebufferRenderbuffer):
        (WebCore::WebGLRenderingContextBase::framebufferTexture2D):
        (WebCore::WebGLRenderingContextBase::getActiveAttrib):
        (WebCore::WebGLRenderingContextBase::getActiveUniform):
        (WebCore::WebGLRenderingContextBase::getAttachedShaders):
        (WebCore::WebGLRenderingContextBase::getBufferParameter):
        (WebCore::WebGLRenderingContextBase::getProgramParameter):
        (WebCore::WebGLRenderingContextBase::getProgramInfoLog):
        (WebCore::WebGLRenderingContextBase::getRenderbufferParameter):
        (WebCore::WebGLRenderingContextBase::getShaderParameter):
        (WebCore::WebGLRenderingContextBase::getShaderInfoLog):
        (WebCore::WebGLRenderingContextBase::getShaderPrecisionFormat):
        (WebCore::WebGLRenderingContextBase::getShaderSource):
        (WebCore::WebGLRenderingContextBase::getTexParameter):
        (WebCore::WebGLRenderingContextBase::getUniform):
        (WebCore::WebGLRenderingContextBase::getUniformLocation):
        (WebCore::WebGLRenderingContextBase::getVertexAttrib):
        (WebCore::WebGLRenderingContextBase::linkProgram):
        (WebCore::WebGLRenderingContextBase::shaderSource):
        (WebCore::WebGLRenderingContextBase::uniform1f):
        (WebCore::WebGLRenderingContextBase::uniform1fv):
        (WebCore::WebGLRenderingContextBase::uniform1i):
        (WebCore::WebGLRenderingContextBase::uniform1iv):
        (WebCore::WebGLRenderingContextBase::uniform2f):
        (WebCore::WebGLRenderingContextBase::uniform2fv):
        (WebCore::WebGLRenderingContextBase::uniform2i):
        (WebCore::WebGLRenderingContextBase::uniform2iv):
        (WebCore::WebGLRenderingContextBase::uniform3f):
        (WebCore::WebGLRenderingContextBase::uniform3fv):
        (WebCore::WebGLRenderingContextBase::uniform3i):
        (WebCore::WebGLRenderingContextBase::uniform3iv):
        (WebCore::WebGLRenderingContextBase::uniform4f):
        (WebCore::WebGLRenderingContextBase::uniform4fv):
        (WebCore::WebGLRenderingContextBase::uniform4i):
        (WebCore::WebGLRenderingContextBase::uniform4iv):
        (WebCore::WebGLRenderingContextBase::uniformMatrix2fv):
        (WebCore::WebGLRenderingContextBase::uniformMatrix3fv):
        (WebCore::WebGLRenderingContextBase::uniformMatrix4fv):
        (WebCore::WebGLRenderingContextBase::useProgram):
        (WebCore::WebGLRenderingContextBase::validateProgram):
        (WebCore::WebGLRenderingContextBase::vertexAttribPointer):

2015-12-16  Alex Christensen  <achristensen@webkit.org>

        Make SessionID use intHash
        https://bugs.webkit.org/show_bug.cgi?id=152356

        Reviewed by Darin Adler.

        * page/SessionID.h:
        (WTF::SessionIDHash::hash):
        (WTF::SessionIDHash::equal):
        (WTF::HashTraits<WebCore::SessionID>::emptyValue):
        (WTF::HashTraits<WebCore::SessionID>::constructDeletedValue):
        (WTF::HashTraits<WebCore::SessionID>::isDeletedValue):
        Use intHash instead of just casting a uint64_t to an unsigned.
        This reduces hash collisions in HashTables that are usually quite small so it isn't much of a problem.
        Also, needsDestruction hasn't been in HashTraits since r156507.

2015-12-16  Simon Fraser  <simon.fraser@apple.com>

        Fix the debug region overlays for RTL documents
        https://bugs.webkit.org/show_bug.cgi?id=152372

        Reviewed by Darin Adler.
        
        Fix document overlays to use document coordinates when painting, which requires
        translating the CTM, and counter-translating the dirtyRect by the scroll origin.
        This is only non-zero for RTL documents.
        
        While doing this, I noticed that the scroll origin was misplaced by the scrollbar
        width when using overlay scrollbars. Fix by using occupiedWidth/Height() in
        ScrollView::updateScrollbars(). I was not able to make a test for this change.

        * page/FrameView.cpp:
        (WebCore::FrameView::adjustViewSize):
        * page/PageOverlay.cpp:
        (WebCore::PageOverlay::drawRect):
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::updateScrollbars):

2015-12-16  Andy Estes  <aestes@apple.com>

        [iOS] Block loading external stylesheets in the Content-Disposition: attachment sandbox
        https://bugs.webkit.org/show_bug.cgi?id=152375
        <rdar://problem/22020902>

        Reviewed by Darin Adler.

        Tests: http/tests/contentdispositionattachmentsandbox/at-import-stylesheets-disabled.html
               http/tests/contentdispositionattachmentsandbox/external-stylesheets-disabled.html
               http/tests/contentdispositionattachmentsandbox/xml-stylesheet-processing-instructions-disabled.html

        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::canRequest): Moved handling of CachedResource::MainResource to canRequestInContentDispositionAttachmentSandbox().
        (WebCore::CachedResourceLoader::canRequestInContentDispositionAttachmentSandbox): In addition to handling CachedResource::MainResource,
        added handling for CachedResource::CSSStyleSheet. Added a FIXME asking whether we should handle other types of resources, too.
        * loader/cache/CachedResourceLoader.h:

2015-12-16  Simon Fraser  <simon.fraser@apple.com>

        ViewportConfiguration functions should return a bool to say if anything changed
        https://bugs.webkit.org/show_bug.cgi?id=152353

        Reviewed by Tim Horton.

        Rather than callers all checking whether setting ViewportConfiguration values
        changes state, have its functions return a bool if the values change.

        * page/ViewportConfiguration.cpp:
        (WebCore::ViewportConfiguration::setContentsSize):
        (WebCore::ViewportConfiguration::setMinimumLayoutSize):
        (WebCore::ViewportConfiguration::setViewportArguments):
        (WebCore::ViewportConfiguration::setCanIgnoreScalingConstraints):
        * page/ViewportConfiguration.h:
        (WebCore::ViewportConfiguration::setCanIgnoreScalingConstraints): Deleted.

2015-12-16  Andreas Kling  <akling@apple.com>

        Give kernel VM some hints about non-live memory-cached resources.
        <https://webkit.org/b/152362>

        Reviewed by Geoffrey Garen.

        When a file-backed CachedResource has no live clients left, and is only being kept alive
        because it's cached in the MemoryCache, give the OS a hint that we probably won't need
        that memory very soon.

        Normally this doesn't do anything, but in case the system comes under memory pressure,
        the kernel can prioritize eviction of such clean-but-unneeded pages, which prevents us
        from throwing other processes under the bus too soon.

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::deleteIfPossible):
        * platform/SharedBuffer.cpp:
        (WebCore::SharedBuffer::hintMemoryNotNeededSoon):
        * platform/SharedBuffer.h:
        * platform/cf/SharedBufferCF.cpp:
        (WebCore::SharedBuffer::hintMemoryNotNeededSoon):

2015-12-16  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Reduce PassRefPtr uses in dom - 2
        https://bugs.webkit.org/show_bug.cgi?id=151936

        Reviewed by Darin Adler.

        Change PassRefPtr with RefPtr<Foo>&&, WTF::move(), Foo*, and Foo&.

        * dom/ScopedEventQueue.h:
        * dom/ScriptedAnimationController.cpp:
        (WebCore::ScriptedAnimationController::registerCallback):
        * dom/ScriptedAnimationController.h:
        * dom/StaticNodeList.h:
        * dom/Traversal.cpp:
        (WebCore::NodeIteratorBase::NodeIteratorBase):
        * dom/Traversal.h:
        * dom/TreeWalker.cpp:
        (WebCore::TreeWalker::TreeWalker):
        (WebCore::TreeWalker::setCurrentNode):
        * dom/TreeWalker.h:
        (WebCore::TreeWalker::create):
        * dom/UserActionElementSet.h:
        * dom/WebKitNamedFlow.cpp:
        (WebCore::WebKitNamedFlow::WebKitNamedFlow):
        (WebCore::WebKitNamedFlow::create):
        (WebCore::WebKitNamedFlow::getRegionsByContent):
        (WebCore::WebKitNamedFlow::getRegions):
        (WebCore::WebKitNamedFlow::getContent):
        * dom/WebKitNamedFlow.h:
        * dom/WheelEvent.cpp:
        (WebCore::WheelEvent::WheelEvent):
        (WebCore::WheelEvent::initWheelEvent):
        (WebCore::WheelEvent::initWebKitWheelEvent):
        * dom/WheelEvent.h:

2015-12-16  Simon Fraser  <simon.fraser@apple.com>

        Simplify isOverlayScrollbar() logic
        https://bugs.webkit.org/show_bug.cgi?id=152357

        Reviewed by Beth Dakin.

        Replace code that checks for isOverlayScrollbar() explicitly with calls to new
        occupiedWidth()/occupiedHeight() functions on Scrollbar, which do the overlay
        scrollbar check internally.
        
        Add ScrollableArea::scrollbarIntrusion() which returns an IntSize with the occupiedWidth
        and occupiedHeight of any scrollbars, and use it in a few places.

        * page/FrameView.cpp:
        (WebCore::FrameView::autoSizeIfEnabled):
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::unscaledVisibleContentSizeIncludingObscuredArea):
        (WebCore::ScrollView::calculateOverhangAreasForPainting):
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::scrollbarIntrusion):
        (WebCore::ScrollableArea::visibleContentRectInternal):
        * platform/ScrollableArea.h:
        * platform/Scrollbar.cpp:
        (WebCore::Scrollbar::occupiedWidth):
        (WebCore::Scrollbar::occupiedHeight):
        * platform/Scrollbar.h:
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::visibleContentRectInternal):
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::verticalScrollbarWidth):

2015-12-16  Alex Christensen  <achristensen@webkit.org>

        Fix internal Windows build
        https://bugs.webkit.org/show_bug.cgi?id=152364
        rdar://problem/23928759

        Reviewed by Tim Horton.

        * WebCore.vcxproj/WebCore.proj:

2015-12-16  Brady Eidson  <beidson@apple.com>

        Modern IDB: Refactor UniqueIDBDatabase in preparation for consolidation open and delete requests.
        https://bugs.webkit.org/show_bug.cgi?id=152355

        Reviewed by Alex Christensen.

        No new tests (Refactor, existing tests pass).

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::openDatabaseConnection):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::handleDatabaseOperations):
        (WebCore::IDBServer::UniqueIDBDatabase::didOpenBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::operationAndTransactionTimerFired):
        (WebCore::IDBServer::UniqueIDBDatabase::handleOpenDatabaseOperations): Deleted.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2015-12-16  Brady Eidson  <beidson@apple.com>

        Modern IDB: Have IDBServerOperations know whether they represent an open or delete request.
        https://bugs.webkit.org/show_bug.cgi?id=152351

        Reviewed by Alex Christensen.

        No new tests (Refactor, existing tests pass).

        * Modules/indexeddb/IndexedDB.h:
        
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::createDeleteRequest):
        (WebCore::IDBClient::IDBOpenDBRequest::createOpenRequest):
        (WebCore::IDBClient::IDBOpenDBRequest::IDBOpenDBRequest):
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.h:
        
        * Modules/indexeddb/client/IDBRequestImpl.h:
        (WebCore::IDBClient::IDBRequest::requestType):
        
        * Modules/indexeddb/server/IDBServerOperation.cpp:
        (WebCore::IDBServer::IDBServerOperation::isOpenRequest):
        (WebCore::IDBServer::IDBServerOperation::isDeleteRequest):
        * Modules/indexeddb/server/IDBServerOperation.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::maybeDeleteDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::handleOpenDatabaseOperations):
        (WebCore::IDBServer::UniqueIDBDatabase::startVersionChangeTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::notifyConnectionsOfVersionChangeForUpgrade):
        (WebCore::IDBServer::UniqueIDBDatabase::operationAndTransactionTimerFired):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        
        * Modules/indexeddb/shared/IDBRequestData.cpp:
        (WebCore::IDBRequestData::IDBRequestData):
        * Modules/indexeddb/shared/IDBRequestData.h:
        (WebCore::IDBRequestData::isOpenRequest):
        (WebCore::IDBRequestData::isDeleteRequest):

2015-12-16  Alex Christensen  <achristensen@webkit.org>

        Build fix after r194156.

        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::ResourceHandle::createCFURLConnection):

2015-12-16  Brady Eidson  <beidson@apple.com>

        Modern IDB: Combine handling open requests, delete requests, and transactions into one timer.
        https://bugs.webkit.org/show_bug.cgi?id=152344

        Reviewed by Alex Christensen.

        No new tests (Refactor, existing tests pass).

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::commitTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::connectionClosedFromClient):
        (WebCore::IDBServer::UniqueIDBDatabase::enqueueTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::invokeOperationAndTransactionTimer):
        (WebCore::IDBServer::UniqueIDBDatabase::operationAndTransactionTimerFired):
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformActivateTransactionInBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::inProgressTransactionCompleted):
        (WebCore::IDBServer::UniqueIDBDatabase::invokeDeleteOrRunTransactionTimer): Deleted.
        (WebCore::IDBServer::UniqueIDBDatabase::deleteOrRunTransactionsTimerFired): Deleted.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2015-12-16  Alex Christensen  <achristensen@webkit.org>

        Build fix after r194156.

        * platform/network/cf/ResourceHandleCFNet.cpp:
        * platform/network/mac/ResourceHandleMac.mm:
        Include definition of _TimingDataOptionsEnableW3CNavigationTiming

2015-12-16  Alex Christensen  <achristensen@webkit.org>

        Implement Web Timing when using NETWORK_SESSION
        https://bugs.webkit.org/show_bug.cgi?id=152285

        Reviewed by Darin Adler.

        Covered by existing tests.

        * WebCore.xcodeproj/project.pbxproj:
        * platform/network/ResourceHandle.h:
        * platform/network/ResourceLoadTiming.h:
        (WebCore::ResourceLoadTiming::encode):
        Moved setCollectsTimingData from ResourceHandle to ResourceLoadTiming.h to be shared 
        with WebKit2 when using NETWORK_SESSION, which does not use ResourceHandle.
        Also moved getConnectionTimingData to copyTimingData in ResourceLoadTiming for the same reason.
        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::ResourceHandle::createCFURLConnection):
        (WebCore::ResourceHandle::start):
        Use the proper definition of _TimingDataOptionsEnableW3CNavigationTiming.
        * platform/network/cocoa/ResourceLoadTiming.mm: Added.
        (WebCore::timingValue):
        (WebCore::copyTimingData):
        Moved from getConnectionTimingData, and use objectForKey instead of valueForKey,
        and check to see if there is no object in the dictionary with the given key.
        This should never happen with the current CFNetwork implementation, but it's good to check dictionaries.
        (WebCore::setCollectsTimingData):
        Use _collectTimingDataWithOptions, which should be a slight performance improvement on Mavericks
        because we are not collecting unused timing data. Hooray!
        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::createNSURLConnection):
        (WebCore::ResourceHandle::getConnectionTimingData):
        (WebCore::ResourceHandle::setCollectsTimingData): Deleted.
        * platform/spi/cf/CFNetworkSPI.h:
        * platform/spi/cocoa/NSURLConnectionSPI.h:
        Moved definitions of SPI to proper SPI headers.

2015-12-16  Beth Dakin  <bdakin@apple.com>

        Legacy style scrollbars do not change color when you mouse over them if you 
        are scrolled
        https://bugs.webkit.org/show_bug.cgi?id=152319
        -and corresponding-
        rdar://problem/23317668

        Reviewed by Darin Adler.

        The scrollbar’s frameRect is in window coordinates, so we need to compare a 
        point in window coordinates when we test this.

        The call to convertFromContainingWindow does not return a point in view 
        coordinates, so we should not call the variable viewPoint. We do still need 
        to call it for subframes. convertFromContainingWindow doesn’t do anything for 
        the root ScrollView (for Mac WK2 at least).
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::scrollbarAtPoint):

        HitTestLocation is in contents coordinates. It needs to be converted to 
        window coordinates
        * rendering/RenderView.cpp:
        (WebCore::RenderView::hitTest):

2015-12-08  Sergio Villar Senin  <svillar@igalia.com>

        Fix computation of min|max-content contribution of non-replaced blocks
        https://bugs.webkit.org/show_bug.cgi?id=152004

        Reviewed by Darin Adler.

        WebKit currently always returns the min preferred logical
        width for the min-content contribution (and the max preferred
        logical width for the max-content contribution) for
        non-replaced blocks. That is not correct according to specs
        https://drafts.csswg.org/css-sizing/#block-intrinsic.

        The min-content and max-content contributions actually depend
        on the computed inline size of the block:
        * for min-content,max-content or definite sizes: min-content
        and max-content contributions are the inline size plus border,
        margin and padding.
        * otherwise: min-content contribution is the min-content size
        and max-content contribution is the max-content size (in both
        cases plus border, padding and margin).

        Tests: fast/css-intrinsic-dimensions/auto-maxcontent-inlinesize-contribution-nonreplaced-blocks.html
               fast/css-intrinsic-dimensions/auto-mincontent-inlinesize-contribution-nonreplaced-blocks.html
               fast/css-intrinsic-dimensions/fillavailable-maxcontent-inlinesize-contribution-nonreplaced-blocks.html
               fast/css-intrinsic-dimensions/fillavailable-mincontent-inlinesize-contribution-nonreplaced-blocks.html
               fast/css-intrinsic-dimensions/fitcontent-maxcontent-inlinesize-contribution-nonreplaced-blocks.html
               fast/css-intrinsic-dimensions/fitcontent-mincontent-inlinesize-contribution-nonreplaced-blocks.html
               fast/css-intrinsic-dimensions/fixed-inlinesize-contribution-nonreplaced-blocks-1.html
               fast/css-intrinsic-dimensions/fixed-inlinesize-contribution-nonreplaced-blocks-2.html
               fast/css-intrinsic-dimensions/indefinite-percent-maxcontent-inlinesize-contribution-nonreplaced-blocks.html
               fast/css-intrinsic-dimensions/indefinite-percent-mincontent-inlinesize-contribution-nonreplaced-blocks.html
               fast/css-intrinsic-dimensions/maxcontent-maxcontent-inlinesize-contribution-nonreplaced-blocks.html
               fast/css-intrinsic-dimensions/maxcontent-mincontent-inlinesize-contribution-nonreplaced-blocks.html
               fast/css-intrinsic-dimensions/mincontent-maxcontent-inlinesize-contribution-nonreplaced-blocks.html
               fast/css-intrinsic-dimensions/mincontent-mincontent-inlinesize-contribution-nonreplaced-blocks.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeBlockPreferredLogicalWidths):

2015-12-16  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Add fetch API compile time flag
        https://bugs.webkit.org/show_bug.cgi?id=152254

        Reviewed by Darin Adler.

        * Configurations/FeatureDefines.xcconfig:

2015-12-15  Zalan Bujtas  <zalan@apple.com>

        FontCascade cleanup: Remove ::drawSimpleText and ::drawComplexText.
        https://bugs.webkit.org/show_bug.cgi?id=152323

        Reviewed by Myles C. Maxfield.

        Platform code for ::drawComplexText() is redundant and has 
        no platform dependent logic. Move it all to ::drawText()

        No change in functionality.

        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::glyphBufferForTextRun):
        (WebCore::FontCascade::drawText):
        (WebCore::FontCascade::drawSimpleText): Deleted.
        * platform/graphics/FontCascade.h:
        * platform/graphics/cairo/FontCairoHarfbuzzNG.cpp:
        (WebCore::FontCascade::drawComplexText): Deleted.
        * platform/graphics/cocoa/FontCascadeCocoa.mm:
        (WebCore::FontCascade::drawComplexText): Deleted.
        * platform/graphics/win/FontWin.cpp:
        (WebCore::FontCascade::drawComplexText): Deleted.

2015-12-15  Tim Horton  <timothy_horton@apple.com>

        [Mac] Gesture Events should not have negative scale
        https://bugs.webkit.org/show_bug.cgi?id=151065
        <rdar://problem/23474123>

        Reviewed by Anders Carlsson.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::clear):
        * page/EventHandler.h:
        Make it possible to use m_gestureInitialDiameter for Mac gesture events too.

2015-12-15  Timothy Horton  <timothy_horton@apple.com>

        Try to fix the CMake build

        * CMakeLists.txt:

2015-12-15  Timothy Horton  <timothy_horton@apple.com>

        Try to fix the CMake build

        * CMakeLists.txt:

2015-12-15  Tim Horton  <timothy_horton@apple.com>

        REGRESSION (r191849): There's no yellow bouncy highlight when using Find on Page on iOS
        https://bugs.webkit.org/show_bug.cgi?id=152241
        <rdar://problem/23642574>

        Reviewed by Simon Fraser.

        Tests: pageoverlay/overlay-small-frame-mouse-events.html
               pageoverlay/overlay-small-frame-paints.html

        * page/PageOverlay.cpp:
        (WebCore::PageOverlay::bounds):
        Revert r191849's change that made bounds() actually return the frame()
        if we frame is manually overriden.

        (WebCore::PageOverlay::mouseEvent):
        Convert the mouse event the rest of the way into overlay coordinates (by
        applying the overlay's frame origin) before deciding whether to handle
        the event.

        * page/PageOverlay.h:

        * DerivedSources.make:
        * WebCore.xcodeproj/project.pbxproj:
        * testing/Internals.cpp:
        (WebCore::Internals::installMockPageOverlay):
        * testing/Internals.h:
        * testing/Internals.idl:
        * testing/MockPageOverlay.cpp: Added.
        (WebCore::MockPageOverlay::create):
        (WebCore::MockPageOverlay::MockPageOverlay):
        (WebCore::MockPageOverlay::setFrame):
        * testing/MockPageOverlay.h: Added.
        (WebCore::MockPageOverlay::overlay):
        * testing/MockPageOverlay.idl: Added.
        * testing/MockPageOverlayClient.cpp:
        (WebCore::MockPageOverlayClient::installOverlay):
        (WebCore::MockPageOverlayClient::uninstallAllOverlays):
        (WebCore::MockPageOverlayClient::pageOverlayDestroyed):
        (WebCore::MockPageOverlayClient::drawRect):
        (WebCore::MockPageOverlayClient::mouseEvent):
        * testing/MockPageOverlayClient.h:
        Make internals.installMockPageOverlay return a MockPageOverlay object so
        tests can manipulate their overlay. For now, expose setFrame.
        Also, log when MockPageOverlayClient gets asked to paint or receives a mouse event,
        which will show up in test output. Slightly unconventional, but very convenient.

2015-12-15  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Features] TrueType fonts trigger real features even when synthesis is applied
        https://bugs.webkit.org/show_bug.cgi?id=152287

        Reviewed by Darin Adler.

        When using a font feature that is synthesizable, and synthesis is triggered,
        we should make sure to turn off the original font feature. Otherwise, the
        feature will be applied twice on top of itself.

        This worked for OpenType fonts, but not for TrueType fonts.

        Tests: css3/font-variant-petite-caps-synthesis.html
               css3/font-variant-small-caps-synthesis.html
               css3/font-variant-petite-caps-synthesis-coverage.html
               css3/font-variant-small-caps-synthesis-coverage.html

        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::defaultSelectorForTrueTypeFeature):
        (WebCore::removedFeature):
        (WebCore::createCTFontWithoutSynthesizableFeatures):

2015-12-15  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo][MediaFoundation] Full screen mode is not supported.
        https://bugs.webkit.org/show_bug.cgi?id=152300

        Reviewed by Darin Adler.

        We need to let WebCore know MediaFoundation supports full screen mode.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::pause):
        (WebCore::MediaPlayerPrivateMediaFoundation::supportsFullscreen):
        (WebCore::MediaPlayerPrivateMediaFoundation::naturalSize):
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:

2015-12-15  Javier Fernandez  <jfernandez@igalia.com>

        [css-align][css-grid] Overflow alignment value 'true' renamed to 'unsafe'
        https://bugs.webkit.org/show_bug.cgi?id=152251

        Reviewed by Darin Adler.

        The 'True' Overflow Alignment keyword is now defined in the Box Alignment
        specification as 'Unsafe'.

        This patch applies the required changes in the CSS parsing logic, as well
        Grid Layout specific codebase, so it complies with the last version of the
        spec.

        No new tests, no change in functionality.

        * css/CSSParser.cpp:
        (WebCore::isAlignmentOverflowKeyword):
        (WebCore::CSSParser::parseItemPositionOverflowPosition):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator OverflowAlignment):
        * css/CSSValueKeywords.in:
        * rendering/RenderGrid.cpp:
        (WebCore::computeOverflowAlignmentOffset):
        * rendering/style/RenderStyleConstants.h:

2015-12-15  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] Operate with a reference to the TextureMapper wherever possible
        https://bugs.webkit.org/show_bug.cgi?id=152118

        Reviewed by Martin Robinson.

        In most cases where used, the pointer to the TextureMapper is non-null, so it
        should really be a reference. The pointer is still used for the
        TextureMapperLayer member variable which is null until the TextureMapper object
        is created and set on the root layer.

        * platform/graphics/GraphicsContext3DPrivate.cpp:
        (WebCore::GraphicsContext3DPrivate::paintToTextureMapper):
        * platform/graphics/GraphicsContext3DPrivate.h:
        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBufferData::paintToTextureMapper):
        * platform/graphics/cairo/ImageBufferDataCairo.h:
        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
        (WebCore::GraphicsContext3DPrivate::paintToTextureMapper):
        * platform/graphics/efl/GraphicsContext3DPrivate.h:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::paintToTextureMapper):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
        * platform/graphics/surfaces/GraphicsSurface.cpp:
        (WebCore::GraphicsSurface::paintToTextureMapper):
        * platform/graphics/surfaces/GraphicsSurface.h:
        * platform/graphics/surfaces/efl/GraphicsSurfaceCommon.cpp:
        (WebCore::GraphicsSurface::platformPaintToTextureMapper):
        * platform/graphics/texmap/BitmapTexture.cpp:
        (WebCore::BitmapTexture::updateContents):
        * platform/graphics/texmap/BitmapTexture.h:
        (WebCore::BitmapTexture::applyFilters):
        * platform/graphics/texmap/BitmapTextureGL.cpp:
        (WebCore::BitmapTextureGL::applyFilters):
        * platform/graphics/texmap/BitmapTextureGL.h:
        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::updateBackingStoreIfNeeded):
        * platform/graphics/texmap/TextureMapperBackingStore.h:
        (WebCore::TextureMapperBackingStore::drawRepaintCounter):
        * platform/graphics/texmap/TextureMapperFPSCounter.cpp:
        (WebCore::TextureMapperFPSCounter::updateFPSAndDisplay):
        * platform/graphics/texmap/TextureMapperFPSCounter.h:
        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperPaintOptions::TextureMapperPaintOptions):
        (WebCore::TextureMapperLayer::paint):
        (WebCore::TextureMapperLayer::paintSelf):
        (WebCore::TextureMapperLayer::paintSelfAndChildren):
        (WebCore::TextureMapperLayer::paintUsingOverlapRegions):
        (WebCore::TextureMapperLayer::applyMask):
        (WebCore::TextureMapperLayer::paintIntoSurface):
        (WebCore::commitSurface):
        (WebCore::TextureMapperLayer::paintWithIntermediateSurface):
        * platform/graphics/texmap/TextureMapperPlatformLayer.h:
        (WebCore::TextureMapperPlatformLayer::drawBorder):
        * platform/graphics/texmap/TextureMapperPlatformLayerBuffer.cpp:
        (WebCore::TextureMapperPlatformLayerBuffer::paintToTextureMapper):
        * platform/graphics/texmap/TextureMapperPlatformLayerBuffer.h:
        * platform/graphics/texmap/TextureMapperSurfaceBackingStore.cpp:
        (WebCore::TextureMapperSurfaceBackingStore::paintToTextureMapper):
        * platform/graphics/texmap/TextureMapperSurfaceBackingStore.h:
        * platform/graphics/texmap/TextureMapperTile.cpp:
        (WebCore::TextureMapperTile::updateContents):
        (WebCore::TextureMapperTile::paint):
        * platform/graphics/texmap/TextureMapperTile.h:
        * platform/graphics/texmap/TextureMapperTiledBackingStore.cpp:
        (WebCore::TextureMapperTiledBackingStore::updateContentsFromImageIfNeeded):
        (WebCore::TextureMapperTiledBackingStore::paintToTextureMapper):
        (WebCore::TextureMapperTiledBackingStore::drawBorder):
        (WebCore::TextureMapperTiledBackingStore::drawRepaintCounter):
        (WebCore::TextureMapperTiledBackingStore::updateContents):
        * platform/graphics/texmap/TextureMapperTiledBackingStore.h:

2015-12-15  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        WebIDL generator should support the possibility for C++ classes to have a JS Builtin constructor
        https://bugs.webkit.org/show_bug.cgi?id=152171

        Reviewed by Darin Adler.

        Reintroducing JSBuiltinConstructor keyword as a way to run automatically a JS builtin initialization function
        to process the arguments passed to the DOM C++ constructor.

        Specialized createJSObject for those classes.

        Fixing typo in TestCustomConstructor.idl.

        Covered by binding tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition):
        (IsConstructable):
        (IsJSBuiltinConstructor):
        (AddJSBuiltinIncludesIfNeeded):
        * bindings/scripts/test/GObject/WebKitDOMTestClassWithJSBuiltinConstructor.cpp: Added.
        * bindings/scripts/test/GObject/WebKitDOMTestClassWithJSBuiltinConstructor.h: Added.
        * bindings/scripts/test/GObject/WebKitDOMTestClassWithJSBuiltinConstructorPrivate.h: Added.
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp: Added.
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h: Added.
        * bindings/scripts/test/ObjC/DOMTestClassWithJSBuiltinConstructor.h: Added.
        * bindings/scripts/test/ObjC/DOMTestClassWithJSBuiltinConstructor.mm: Added.
        * bindings/scripts/test/ObjC/DOMTestClassWithJSBuiltinConstructorInternal.h: Added.
        * bindings/scripts/test/TestClassWithJSBuiltinConstructor.idl: Copied from Source/WebCore/bindings/scripts/test/TestCustomConstructor.idl.
        * bindings/scripts/test/TestCustomConstructor.idl:

2015-12-14  Andreas Kling  <akling@apple.com>

        ResourceUsageOverlay should show GC timers.
        <https://webkit.org/b/152151>

        Reviewed by Darin Adler.

        Add countdowns until next Eden and Full GC to the overlay. It also shows if there
        is no garbage collection scheduled. This will be helpful in understanding why GC
        sometimes takes a very long time to happen.

        * page/ResourceUsageOverlay.h:
        * page/cocoa/ResourceUsageOverlayCocoa.mm:
        (WebCore::formatByteNumber): Drive-by silly math fix. :|
        (WebCore::gcTimerString):
        (WebCore::ResourceUsageOverlay::platformDraw):
        (WebCore::nextFireTimeForGCTimer):
        (WebCore::runSamplerThread):

2015-12-14  Chris Fleizach  <cfleizach@apple.com>

        AX: iOS: Text field variations do not have the correct traits
        https://bugs.webkit.org/show_bug.cgi?id=152237

        Reviewed by Mario Sanchez Prada.

        Make search fields and text areas use the appropriate iOS traits to 
        distinguish them.

        Test: accessibility/ios-simulator/textentry-traits.html

        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper _accessibilityTraitsFromAncestors]):
        (-[WebAccessibilityObjectWrapper _accessibilityTextEntryTraits]):
        (-[WebAccessibilityObjectWrapper accessibilityTraits]):

2015-12-14  Tim Horton  <timothy_horton@apple.com>

        Remove some Mavericks guards in ServicesOverlayController
        https://bugs.webkit.org/show_bug.cgi?id=152238

        Reviewed by Darin Adler.

        * page/mac/ServicesOverlayController.mm:
        (WebCore::ServicesOverlayController::selectionRectsDidChange): Deleted.
        (WebCore::ServicesOverlayController::selectedTelephoneNumberRangesChanged): Deleted.
        The whole file is already PLATFORM(MAC) guarded, and the 10.9 guards
        are no longer necessary.

2015-12-14  Daniel Bates  <dabates@apple.com>

        [iOS] DOM click event may not be dispatched when page has :active style and <input type="search">
        https://bugs.webkit.org/show_bug.cgi?id=144451
        <rdar://problem/23099482>

        Reviewed by Simon Fraser.

        Fixes an issue where a DOM click event is not dispatched to an element in a subframe on a page
        that has a <input type="search"> and defines a CSS :active pseudo-class for the HTML body element.

        On iOS we only dispatch a DOM click event if the content of the page does not change as part of
        dispatching a DOM mousemove event at the tapped element as a means of providing a good user
        experience on web pages that reveal or hide content based on mouse hover. Currently we consider
        the content of the page to have changed if the visibility of any element on the page changes.
        In particular we consider the content of the page to have changed if the visibility of a user
        agent shadow DOM element changes (e.g. the search field cancel button). Instead we should only
        consider visibility changes to the actual web page content and ignore visibility changes to
        user agent shadow DOM elements.

        Tests: fast/events/can-click-element-on-page-with-active-pseudo-class-and-search-field.html
               fast/forms/search/search-cancel-button-visible-when-input-becomes-disabled.html
               fast/forms/search/search-cancel-button-visible-when-input-becomes-readonly.html
               fast/forms/search/search-cancel-in-formerly-invisible-element.html
               fast/forms/search/search-cancel-toggle-visibility-initially-hidden.html
               fast/forms/search/search-cancel-toggle-visibility-initially-visible.html

        * style/StyleResolveTree.cpp:
        (WebCore::Style::CheckForVisibilityChangeOnRecalcStyle::~CheckForVisibilityChangeOnRecalcStyle):
        Ignore visibility changes to user agent shadow DOM elements.

2015-12-14  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Streams API] Directly use @then as much as possible
        https://bugs.webkit.org/show_bug.cgi?id=151631

        Reviewed by Darin Adler.

        Moved from @Promise.prototype.@then.@call(promise,...) to promise.@then.(...)
        for promise objects that are not exposed to user scripts.

        Updated promiseInvokeXX stream utility functions to ensure that returned promise always has a @then.
        This allows improving the readability of code calling promiseInvokeXX functions.
        Changed invokeOrNoop to promiseInvokeOrNoopNoCatch as invokeOrNoop
        result is always wrapped as a promise using Promise.resolve.

        No change in behavior.

        * Modules/streams/ReadableStream.js:
        (initializeReadableStream):
        * Modules/streams/ReadableStreamInternals.js:
        (teeReadableStream):
        (teeReadableStreamBranch2CancelFunction):
        (cancelReadableStream):
        * Modules/streams/StreamInternals.js:
        (shieldingPromiseResolve): introduced this routine to ensure the returned promise has a @then property.
        (promiseInvokeOrNoopNoCatch):
        (promiseInvokeOrNoop):
        (promiseInvokeOrFallbackOrNoop):
        * Modules/streams/WritableStream.js:
        (initializeWritableStream):
        (abort):
        * Modules/streams/WritableStreamInternals.js:
        (callOrScheduleWritableStreamAdvanceQueue):

2015-12-14  Xabier Rodriguez Calvar  <calvaris@igalia.com> and Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Streams API] Expose ReadableStream and relatives to Worker
        https://bugs.webkit.org/show_bug.cgi?id=152066

        Reviewed by Darin Adler.

        Moving the code that links internal functions to the GlobalObject in WebCoreJSBuiltinInternals.cpp.
        This file should be generated by the builtin generator once refactoring is done.
        This code is located in JSBuiltinFunctions::initialize.

        Moving ReadableStream private constructors and constants code from JSDOMWindowBase to JSDOMGlobalObject.
        Calling JSBuiltinInternalFunctions::initialize in JSDOMGlobalObject so that internals are also available in Worker.

        Made ReadableStream and relatives exposed in Worker.

        Patch by Youenn Fablet.
        Rebased and fixed style by Xabier Rodriguez Calvar.

        Covered by rebased tests.

        * CMakeLists.txt:
        * Modules/streams/ByteLengthQueuingStrategy.idl:
        * Modules/streams/CountQueuingStrategy.idl:
        * Modules/streams/ReadableStream.idl:
        * Modules/streams/ReadableStreamController.idl:
        * Modules/streams/ReadableStreamReader.idl:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
        (WebCore::JSDOMGlobalObject::addBuiltinGlobals):
        (WebCore::JSDOMGlobalObject::finishCreation):
        (WebCore::JSDOMGlobalObject::visitChildren):
        * bindings/js/JSDOMGlobalObject.h:
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::finishCreation): Deleted.
        (WebCore::JSDOMWindowBase::visitChildren): Deleted.
        * bindings/js/JSDOMWindowBase.h:
        * bindings/js/WebCoreJSBuiltinInternals.cpp: Added.
        (WebCore::JSBuiltinInternalFunctions::JSBuiltinInternalFunctions):
        (WebCore::JSBuiltinInternalFunctions::visit):
        (WebCore::JSBuiltinInternalFunctions::initialize):
        * bindings/js/WebCoreJSBuiltinInternals.h:
        * bindings/js/WebCoreJSBuiltins.h:

2015-12-14  Frederic Wang  <fred.wang@free.fr>

        Move MathMLOperatorDictionary features into a separate module.
        https://bugs.webkit.org/show_bug.cgi?id=152242

        Reviewed by Martin Robinson.

        The definitions, properties and search of the MathML operator dictionary are really independent of the renderer object for math operators.
        This patch moves them in a separate module/file to make them more manageable and readable.
        No new tests. We already have sufficient test coverage.

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * rendering/mathml/MathMLOperatorDictionary.cpp:
        (WebCore::ExtractKey):
        (WebCore::ExtractChar):
        (WebCore::ExtractKeyHorizontal):
        (WebCore::MathMLOperatorDictionary::getEntry):
        (WebCore::MathMLOperatorDictionary::isVertical):
        * rendering/mathml/MathMLOperatorDictionary.h: Added.
        * rendering/mathml/RenderMathMLOperator.cpp:
        (WebCore::RenderMathMLOperator::setOperatorProperties):
        (WebCore::MathMLOperatorDictionary::ExtractKey): Deleted.
        (WebCore::MathMLOperatorDictionary::ExtractChar): Deleted.
        (WebCore::MathMLOperatorDictionary::ExtractKeyHorizontal): Deleted.
        * rendering/mathml/RenderMathMLOperator.h:

2015-12-14  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Fix height computation of grid items with borders
        https://bugs.webkit.org/show_bug.cgi?id=151800

        Reviewed by Darin Adler.

        When computing the logical height of grid items for the
        default "min-height: auto;" case we were constraning the
        min-content size using constrainLogicalHeightByMinMax()
        instead of constrainContentLogicalHeightByMinMax(). The
        problem of using the former is that we were adding the borders
        twice.

        Test: fast/css-grid-layout/grid-item-with-border-in-intrinsic.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::computeLogicalHeight):

2015-12-13  Tim Horton  <timothy_horton@apple.com>

        Adopt CGIOSurfaceContextCreateImageReference to avoid unnecessary readback
        https://bugs.webkit.org/show_bug.cgi?id=150988
        <rdar://problem/18993594>

        Reviewed by Darin Adler.

        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::drawConsumingImageBuffer):
        * platform/graphics/GraphicsContext.h:
        * platform/graphics/ImageBuffer.h:
        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::createBitmapImageAfterScalingIfNeeded):
        (WebCore::ImageBuffer::copyImage):
        (WebCore::ImageBuffer::sinkIntoImage):
        (WebCore::ImageBuffer::sinkIntoNativeImage):
        (WebCore::ImageBuffer::drawConsuming):
        * platform/graphics/cocoa/IOSurface.h:
        * platform/graphics/cocoa/IOSurface.mm:
        (IOSurface::createFromImageBuffer):
        (IOSurface::sinkIntoImage):
        Add sinkIntoImage, sinkIntoNativeImage, and drawConsuming to ImageBuffer,
        which all consume the ImageBuffer and allow us to tell the system to
        make a CGImage that references the IOSurface, which is in many cases
        more efficient than making an image with a "copy" of the IOSurface.
        (The copy is done lazily, but we often hit a corner case that causes
        it to happen unnecessarily.)

        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlTextTrackContainerElement::createTextTrackRepresentationImage):
        * page/TextIndicator.cpp:
        (WebCore::takeSnapshot):
        * platform/DragImage.cpp:
        (WebCore::createDragImageFromSnapshot):
        * platform/graphics/filters/FETile.cpp:
        (WebCore::FETile::platformApplySoftware):
        * platform/mac/ThemeMac.mm:
        (WebCore::ThemeMac::drawCellOrFocusRingWithViewIntoContext):
        * platform/mediastream/mac/AVVideoCaptureSource.mm:
        (WebCore::AVVideoCaptureSource::currentFrameImage):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintProgressBar):
        * rendering/svg/RenderSVGResourcePattern.cpp:
        (WebCore::RenderSVGResourcePattern::buildPattern):
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::drawPatternForContainer):
        Adopt sinkIntoImage and drawConsumingImageBuffer in a few places.

2015-12-13  Andreas Kling  <akling@apple.com>

        CachedScript could have a copy-free path for all-ASCII scripts.
        <https://webkit.org/b/152203>

        Reviewed by ANtti Koivisto.

        Many (if not most) of script resources on the web contain nothing but ASCII characters.
        Such resources, when streamed through a text decoder, will yield the exact same byte
        sequence, except in anonymous heap memory instead of delicious file-backed pages.

        Care is taken to ensure that the wrapper StringImpl is updated to target newly cached
        resource data if an asynchronous caching notification comes in.

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::tryReplaceEncodedData):
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::didReplaceSharedBufferContents):
        * loader/cache/CachedScript.cpp:
        (WebCore::encodingMayBeAllASCII):
        (WebCore::CachedScript::script):
        (WebCore::CachedScript::didReplaceSharedBufferContents):
        * loader/cache/CachedScript.h:
        * platform/SharedBuffer.h:
        * platform/cf/SharedBufferCF.cpp:
        (WebCore::SharedBuffer::tryReplaceContentsWithPlatformBuffer):

2015-12-13  Zalan Bujtas  <zalan@apple.com>

        Clean up absolute positioned map properly.
        https://bugs.webkit.org/show_bug.cgi?id=152219
        rdar://problem/23861165

        Reviewed by Simon Fraser.

        We insert positioned renderers into a static map (RenderBlock::gPositionedDescendantsMap) to keep track of them.
        Since this static map is at block level, (positioned)inline renderers use their containing block to store
        their positioned descendants.
        This patch ensures that when an inline element can no longer hold positioned children, we remove them from
        the inline's containing block's map. -unless the container itself can hold positioned renderers(see RenderElement::canContainAbsolutelyPositionedObjects).

        Test: fast/block/positioning/crash-when-positioned-inline-has-positioned-child.html

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::styleWillChange):
        * rendering/RenderInline.h:

2015-12-13  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: [EFL] Anonymous render block flow elements should be exposed as ATK_ROLE_SECTION; not ATK_ROLE_PANEL
        https://bugs.webkit.org/show_bug.cgi?id=152079

        Reviewed by Chris Fleizach.

        Map the element to WebCore AccessibilityRole DivRole for EFL. As with GTK, this
        is being done in the shared layer rather than in the platform layer because we
        want all subsequent logic to treat anonymous render block flow elements as divs.

        No new tests. We already have sufficient test coverage. The expectations
        been updated accordingly.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):

2015-12-12  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/index-duplicate-keypaths.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152201

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).
        
        The spec states that if an object store uses a key generator, and then a record is stored whose
        key was an explicitly set number, then the key generator value should be bumped to the next
        integer higher than the explicit number.
        
        We didn't do that.
        
        Now we do.

        * Modules/indexeddb/IndexedDB.h: Add an "OverwriteForCursor" option for overwrite mode.
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::putForCursorUpdate): Use the "OverwriteForCursor" mode.
                
        * Modules/indexeddb/server/IDBBackingStore.h: Add maybeUpdateKeyGeneratorNumber

        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::maybeUpdateKeyGeneratorNumber): If the number value
          from the provided key should bump the key generator value, do so now.
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd): After successfully adding the new record,
          possibly bump the key generator value.

2015-12-12  Katlyn Graff  <kgraff@apple.com>

        Safari background tabs should be fully suspended where possible.
        https://bugs.webkit.org/show_bug.cgi?id=150515

        Reviewed by Ryosuke Niwa.

        Support for tab suspension for Mac, enabled by defaults writing to WebKitTabSuspension.
        Page-down suspension consolidated with PageCache suspension code in Document::
        suspend and Document::resume. Pages canTabSuspend if cacheable, nonvisible, nonprerender,
        and nonactive.

        * dom/Document.cpp: moved scrollbar handling from setInPageCache to suspend/resume
        (WebCore::Document::suspend): moved scrollbar, dom, animation, timer, and visual update suspending into here
        (WebCore::Document::resume): moved scrollbar, dom, animation, timer, and visual update resuming into here
        * dom/Document.h: added m_isSuspended to prevent repeat calls from PageCache/Tab Suspension contention
        * history/CachedFrame.cpp: moved dom, animation, and timer suspension into Document::suspend
        (WebCore::CachedFrame::CachedFrame):
       * history/PageCache.cpp: Added a few nullchecks to prevent crashes if canCacheFrame is called but document is null
        (WebCore::PageCache::canCacheFrame):
        * page/Page.cpp:
        (WebCore::Page::Page): Added timer to fire delayed suspension
        (WebCore::Page::setPageActivityState): Added a call to schedule tab suspension
        (WebCore::Page::setIsVisibleInternal): Added a call to schedule tab suspension
        (WebCore::Page::canTabSuspend): Added support for suspending if cacheable, nonvisible, nonprerender, and nonactive
        (WebCore::Page::setIsTabSuspended): Added a function to suspend or resume tabs
        (WebCore::Page::setTabSuspensionEnabled): Added support for a defaults write enable
        (WebCore::Page::scheduleTabSuspension): Added ability to schedule the suspension timer to fire or resume
        (WebCore::Page::timerFired): Added a suspension timer
        * page/Page.h:
        * page/PageThrottler.h:
        (WebCore::PageThrottler::activityState): Added access to m_activityState for canTabSuspend

2015-12-11  Simon Fraser  <simon.fraser@apple.com>

        Mousewheel events don't work in iframes in RTL documents
        https://bugs.webkit.org/show_bug.cgi?id=152200

        Reviewed by Beth Dakin.
        
        When dispatching wheel events, the testing of the event point against the
        non-fast scrollable region was broken in an RTL document. Fix by taking
        the scrollOrigin into account in ScrollingTreeFrameScrollingNode::viewToContentsOffset().

        Test: fast/scrolling/rtl-point-in-iframe.html

        * page/scrolling/ScrollingTreeFrameScrollingNode.cpp:
        (WebCore::ScrollingTreeFrameScrollingNode::viewToContentsOffset):

2015-12-11  Zalan Bujtas  <zalan@apple.com>

        ASSERTION FAILED: !rect.isEmpty() in WebCore::GraphicsContext::drawRect
        https://bugs.webkit.org/show_bug.cgi?id=151201

        Reviewed by Simon Fraser.

        Drawing empty rect is a waste.

        Test: fast/borders/empty-drawrect-assert-after-pixelsnap.html

        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::drawLineForBoxSide):

2015-12-11  Jiewen Tan  <jiewen_tan@apple.com>

        Strip out Referer header when requesting subresources or following links for documents with "Content-Disposition: attachment"
        https://bugs.webkit.org/show_bug.cgi?id=152102
        <rdar://problem/22124230>

        Reviewed by Andy Estes.

        Keep the ReferrerPolicy for a document as ReferrerPolicyNever if the document is loaded with
        "Content-Disposition: attachment".

        Test: http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header.html

        * dom/Document.cpp:
        (WebCore::Document::processReferrerPolicy):
        (WebCore::Document::applyContentDispositionAttachmentSandbox):

2015-12-11  Eric Carlson  <eric.carlson@apple.com>

        [MediaStream] Add a setting to allow the mock media capture devices to be enabled and disabled
        https://bugs.webkit.org/show_bug.cgi?id=152197

        Reviewed by Dean Jackson.

        Test: fast/mediastream/mock-media-source.html

        * page/Settings.cpp:
        (WebCore::Settings::mockCaptureDevicesEnabled):
        (WebCore::Settings::setMockCaptureDevicesEnabled):
        * page/Settings.h:

        * platform/mediastream/RealtimeMediaSourceCenter.cpp:
        (WebCore::RealtimeMediaSourceCenter::setSharedStreamCenterOverride): Renamed.
        (WebCore::RealtimeMediaSourceCenter::setSharedStreamCenter): Deleted.
        * platform/mediastream/RealtimeMediaSourceCenter.h:

        * platform/mock/MockRealtimeMediaSourceCenter.cpp:
        (WebCore::MockRealtimeMediaSourceCenter::setMockRealtimeMediaSourceCenterEnabled): Renamed. Allow
          it to be enabled and disabled.
        (WebCore::MockRealtimeMediaSourceCenter::registerMockRealtimeMediaSourceCenter): Deleted.
        * platform/mock/MockRealtimeMediaSourceCenter.h:

        * testing/Internals.cpp:
        (WebCore::Internals::Internals):
        (WebCore::Internals::setMockMediaCaptureDevicesEnabled):
        * testing/Internals.h:
        * testing/Internals.idl:

2015-12-11  Jer Noble  <jer.noble@apple.com>

        [EME] Do not pass in the initialization data to AVContentKeyRequest as the contentIdentifier.
        https://bugs.webkit.org/show_bug.cgi?id=152204
        rdar://problem/23867877

        Reviewed by Eric Carlson.

        The AVContentKeyRequest API has been updated to no longer require a contentId parameter if the
        ID can be derived from the initialization data.

        * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm:
        (WebCore::CDMSessionAVContentKeySession::update):

2015-12-11  Alexey Proskuryakov  <ap@apple.com>

        Roll out http://trac.webkit.org/r193984, because the new test is timing out.

        Was: Strip out Referer header when requesting subresources or following links for documents with "Content-Disposition: attachment"
        https://bugs.webkit.org/show_bug.cgi?id=152102
        <rdar://problem/22124230>

        * dom/Document.cpp:
        (WebCore::Document::processReferrerPolicy):
        (WebCore::Document::applyContentDispositionAttachmentSandbox):

2015-12-11  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/optional-arguments.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152194

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::continueFunction): Allow 'undefined' for the key.
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::add): Ditto.
        (WebCore::IDBClient::IDBObjectStore::put): Ditto.

2015-12-11  Brady Eidson  <beidson@apple.com>

        Followup to:
        Modern IDB: storage/indexeddb/index-count.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152175

        Noticed by Darin Adler.

        * Modules/indexeddb/client/IDBIndexImpl.cpp:
        (WebCore::IDBClient::IDBIndex::count): Replace a curly brace to its proper place.

2015-12-11  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/cursor-continue.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152192

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::continueFunction): Check against the current key, not the current primary key.
        (WebCore::IDBClient::IDBCursor::setGetResult): Also save off the current IDBKeyData.
        * Modules/indexeddb/client/IDBCursorImpl.h:

2015-12-11  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/index-basics.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152190

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        * bindings/js/JSIDBObjectStoreCustom.cpp:
        (WebCore::JSIDBObjectStore::createIndex): Custom error message for the TypeError

2015-12-11  Jiewen Tan  <jiewen_tan@apple.com>

        Strip out Referer header when requesting subresources or following links for documents with "Content-Disposition: attachment"
        https://bugs.webkit.org/show_bug.cgi?id=152102
        <rdar://problem/22124230>

        Reviewed by Andy Estes.

        Keep the ReferrerPolicy for a document as ReferrerPolicyNever if the document is loaded with
        "Content-Disposition: attachment".

        Test: http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header.html

        * dom/Document.cpp:
        (WebCore::Document::processReferrerPolicy):
        (WebCore::Document::applyContentDispositionAttachmentSandbox):

2015-12-11  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/key-type-array.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152187

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::putOrAdd): Perform the correct validity check on array keys.

2015-12-11  Joseph Pecoraro  <pecoraro@apple.com>

        check-for-inappropriate-objc-class-names should check all class names, not just externally visible ones
        https://bugs.webkit.org/show_bug.cgi?id=152156

        Reviewed by Dan Bernstein.

        * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.h:
        * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm:
        (WebCore::CDMSessionAVContentKeySession::CDMSessionAVContentKeySession):
        * platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.h:
        * platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.mm:
        (WebCore::CDMSessionAVStreamSession::CDMSessionAVStreamSession):
        Rename classes with a "Web" prefix.

2015-12-11  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/intversion-abort-in-initial-upgradeneeded.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152177

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::versionChangeTransactionDidFinish): Renamed from below.
        (WebCore::IDBClient::IDBOpenDBRequest::versionChangeTransactionWillFinish): Deleted.
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.h:
        
        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::setVersionChangeTransaction): OpenDBRequests usually don't have transactions, 
          unless they end up being upgrade requests.
        * Modules/indexeddb/client/IDBRequestImpl.h:
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::IDBTransaction): Call setVersionChangeTransaction on the request if appropriate.
        (WebCore::IDBClient::IDBTransaction::dispatchEvent): Call versionChangeTransactionDidFinish after the 
          abort/complete events fire.
        (WebCore::IDBClient::IDBTransaction::abort): Deleted.
        (WebCore::IDBClient::IDBTransaction::commit): Deleted.

2015-12-11  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/index-count.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152175

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/client/IDBIndexImpl.cpp:
        (WebCore::IDBClient::IDBIndex::count): If the passed in IDBKeyRange* is nullptr, use IDBKeyRangeData::allKeys.
        (WebCore::IDBClient::IDBIndex::doCount): Change an isNull check to a more correct !isValid() check.

2015-12-11  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo][MediaFoundation] Setting playback rate does not work.
        https://bugs.webkit.org/show_bug.cgi?id=152172

        Reviewed by Brent Fulgham.

        Implement method to set playback rate.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::seekDouble):
        (WebCore::MediaPlayerPrivateMediaFoundation::setRateDouble):
        (WebCore::MediaPlayerPrivateMediaFoundation::durationDouble):
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:

2015-12-11  Darin Adler  <darin@apple.com>

        Reduce the number of events that can be created by Document.createEvent
        https://bugs.webkit.org/show_bug.cgi?id=151931

        Reviewed by Alex Christensen.

        Document.createEvent is intended for use only with a certain set of legacy events.
        Ideally it should only be the ones mentioned in the DOM specification.

        For now, at least remove all the events that can't usefully be created and initialized
        this way. Later, we should cut it down even smaller. And stop automatically generating
        this, which was causing everyone who made an event IDL file to get supported here!

        The modern alternative is to use event class constructors instead.

        * CMakeLists.txt: Don't compile EventFactory.cpp. For now, we still generate
        EventFactory.cpp but we do not use it.
        * DerivedSources.make: Ditto.
        * WebCore.vcxproj/WebCore.vcxproj: Ditto.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto. Also don't include EventFactory.h in the
        project file.

        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::hasFeature): Added a comment about the SVGZoomEvents feature.

        * dom/Document.cpp: Re-sorted includes and added the new ones needed for createEvent.
        (WebCore::Document::createEvent): Moved all the logic here from EventFactory, and
        took a crack at comments that explain what this should and should not be used for.

        * dom/EventFactory.h: Removed.

2015-12-10  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/objectstore-count.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152167

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/IDBKeyRangeData.h:
        (WebCore::IDBKeyRangeData::allKeys):
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::count): If the passed in IDBKeyRange* is nullptr, use IDBKeyRangeData::allKeys.
        (WebCore::IDBClient::IDBObjectStore::doCount): Change an isNull check to a more correct !isValid() check.

2015-12-10  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Binding and builtin generators should lowercase RTCXX as rtcXX and not rTCXX
        https://bugs.webkit.org/show_bug.cgi?id=152121

        Reviewed by Darin Adler.

        No change in behavior.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::finishCreation): Using rtcXX in lieu of rTCXX.
        * bindings/js/WebCoreJSBuiltinInternals.h:
        (WebCore::JSBuiltinInternalFunctions::JSBuiltinInternalFunctions): Ditto.
        (WebCore::JSBuiltinInternalFunctions::rtcPeerConnectionInternals): Added.
        (WebCore::JSBuiltinInternalFunctions::visit): Ditto.
        (WebCore::JSBuiltinInternalFunctions::init): Ditto.
        (WebCore::JSBuiltinInternalFunctions::rTCPeerConnectionInternals): Deleted.
        * bindings/js/WebCoreJSBuiltins.h:
        (WebCore::JSBuiltinFunctions::JSBuiltinFunctions): Using rtcXX in lieu of rTCXX.
        (WebCore::JSBuiltinFunctions::rtcPeerConnectionBuiltins): Added.
        (WebCore::JSBuiltinFunctions::rtcPeerConnectionInternalsBuiltins): Added.
        (WebCore::JSBuiltinFunctions::rTCPeerConnectionBuiltins): Deleted.
        (WebCore::JSBuiltinFunctions::rTCPeerConnectionInternalsBuiltins): Deleted.
        * bindings/scripts/CodeGenerator.pm:
        (WK_lcfirst): Added RTC special rule.

2015-12-10  Zalan Bujtas  <zalan@apple.com>

        ASSERTION FAILED: !simpleLineLayout() in WebCore::RenderText::collectSelectionRectsForLineBoxes
        https://bugs.webkit.org/show_bug.cgi?id=152115

        Reviewed by Simon Fraser.

        document.execCommand("indent") generates a blockquote wrapper and moves the indented content inside.
        If the indented content is already inside a selection, we need to make sure that newly created flow uses
        normal line layout.
        This patch fixes the generic case as re-parenting an already selected renderer is not specific to document.execCommand("indent").

        Test: fast/block/selection-inside-simple-line-layout.html

        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::canUseForWithReason):
        (WebCore::SimpleLineLayout::printReason):

2015-12-10  Eric Carlson  <eric.carlson@apple.com>

        [MediaStream] Expose media capture devices persistent permissions to WebCore
        https://bugs.webkit.org/show_bug.cgi?id=152087

        Reviewed by Chris Dumez.

        No new tests, an existing test was updated to test the change.

        * CMakeLists.txt: Add UserMediaPermissionCheck.cpp.

        * Modules/mediastream/MediaDevicesRequest.cpp:
        (WebCore::MediaDevicesRequest::~MediaDevicesRequest): Clear the permission checker client.
        (WebCore::MediaDevicesRequest::contextDestroyed): Ditto.
        (WebCore::MediaDevicesRequest::start): Create a permission checker and start it running.
        (WebCore::MediaDevicesRequest::didCompleteCheck): Start the media source checker.
        (WebCore::MediaDevicesRequest::didCompleteRequest): Only include a track's label if the
          page has permission to use a capture device.
        * Modules/mediastream/MediaDevicesRequest.h:

        * Modules/mediastream/UserMediaClient.h: Include prototypes for permission checker.
        (WebCore::UserMediaClient::~UserMediaClient):
        
        * Modules/mediastream/MediaStreamTrackSourcesRequest.cpp: Removed, not longer used.
        * Modules/mediastream/MediaStreamTrackSourcesRequest.h:

        * Modules/mediastream/UserMediaController.h:
        (WebCore::UserMediaController::checkUserMediaPermission): New.
        (WebCore::UserMediaController::cancelUserMediaPermissionCheck): Ditto.

        * Modules/mediastream/UserMediaPermissionCheck.cpp: Added.
        (WebCore::UserMediaPermissionCheck::create):
        (WebCore::UserMediaPermissionCheck::UserMediaPermissionCheck):
        (WebCore::UserMediaPermissionCheck::~UserMediaPermissionCheck):
        (WebCore::UserMediaPermissionCheck::securityOrigin):
        (WebCore::UserMediaPermissionCheck::contextDestroyed):
        (WebCore::UserMediaPermissionCheck::start):
        (WebCore::UserMediaPermissionCheck::setDeviceAccessMode):
        * Modules/mediastream/UserMediaPermissionCheck.h: Added.
        (WebCore::UserMediaPermissionCheckClient::~UserMediaPermissionCheckClient):
        (WebCore::UserMediaPermissionCheck::setClient):

        * WebCore.xcodeproj/project.pbxproj: Add UserMediaPermissionCheck.cpp|.h

        * platform/mock/UserMediaClientMock.h: Removed, it is no longer used.

        * testing/Internals.cpp: Remove UserMediaClientMock.h include, it is gone.

2015-12-10  Myles C. Maxfield  <mmaxfield@apple.com>

        Build fix

        Unreviewed.

        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::smallCapsTrueTypeDictionary):

2015-12-10  Simon Fraser  <simon.fraser@apple.com>

        Mordernize viewport dumping
        https://bugs.webkit.org/show_bug.cgi?id=152159

        Reviewed by Zalan Bujtas.

        Use groupings to simplify the viewport configuration dumping code.

        * page/ViewportConfiguration.cpp:
        (WebCore::operator<<):
        (WebCore::ViewportConfiguration::description):

2015-12-10  Joseph Pecoraro  <pecoraro@apple.com>

        Remote Inspector: Verify the identity of the other side of XPC connections
        https://bugs.webkit.org/show_bug.cgi?id=152153

        Reviewed by Brian Burg.

        * WebCore.xcodeproj/project.pbxproj:
        * platform/network/mac/CertificateInfoMac.mm:
        Use the new header.

2015-12-10  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/delete-in-upgradeneeded-close-in-versionchange.html fails
        https://bugs.webkit.org/show_bug.cgi?id=152144

        Reviewed by Alex Christensen.

        No new tests (At least two failing tests now pass, and other incorrect tests updated to be more correct).

        - An IDBOpenDBRequest resulting in a versionchange transaction should not have the onsuccess event fire if 
          the database connection was closed during the versionchange transaction. onerror should fire instead.
        - When firing an event at an IDBRequest, it should not have the transaction as an additional target if the
          transaction has finished.
        - When firing an event at an IDBRequest, it should not have the database as an additional target if the
          database is closed or is closing.

        * Modules/indexeddb/client/IDBDatabaseImpl.h:
        (WebCore::IDBClient::IDBDatabase::isClosingOrClosed):
        
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::fireErrorAfterVersionChangeCompletion):
        (WebCore::IDBClient::IDBOpenDBRequest::fireErrorAfterVersionChangeAbort): Deleted.
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.h:
        
        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::dispatchEvent): Don't add finished transactions or closed databases as event targets.
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::notifyDidAbort):
        (WebCore::IDBClient::IDBTransaction::dispatchEvent): If this was a versionchange transaction completing, possibly fire
          the error event on the OpenDBRequest instead of the success event.
        * Modules/indexeddb/client/IDBTransactionImpl.h:
        (WebCore::IDBClient::IDBTransaction::isFinished):

2015-12-10  Zalan Bujtas  <zalan@apple.com>

        Simple line layout: Use TextPainter to draw simple line text.
        https://bugs.webkit.org/show_bug.cgi?id=152150

        Reviewed by Simon Fraser.

        No change in functionality.

        * rendering/SimpleLineLayoutFunctions.cpp:
        (WebCore::SimpleLineLayout::paintFlow):
        * rendering/TextPainter.h:

2015-12-10  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Features] r193894 introduces leaks
        https://bugs.webkit.org/show_bug.cgi?id=152154

        Reviewed by Joe Pecoraro.

        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::smallCapsTrueTypeDictionary):
        (WebCore::createCTFontWithoutSynthesizableFeatures):

2015-12-10  Myles C. Maxfield  <mmaxfield@apple.com>

        Build fix

        Unreviewed.

        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::Font::variantCapsSupportsCharacterForSynthesis):

2015-12-10  Zalan Bujtas  <zalan@apple.com>

        TextPainter: Add support for painting multiple text runs.
        https://bugs.webkit.org/show_bug.cgi?id=152148

        Reviewed by Simon Fraser.

        This is in preparation for adding simple line layout as a client.

        No change in functionality.

        * rendering/InlineTextBox.cpp:
        (WebCore::drawSkipInkUnderline): Decouple underline skipping intersection calculation and text painter.
        (WebCore::InlineTextBox::paint):
        (WebCore::InlineTextBox::paintDecoration):
        * rendering/InlineTextBox.h:
        * rendering/TextPainter.cpp:
        (WebCore::TextPainter::TextPainter):
        (WebCore::TextPainter::paintTextWithShadows):
        (WebCore::TextPainter::paintTextAndEmphasisMarksIfNeeded):
        (WebCore::TextPainter::paintText):
        (WebCore::TextPainter::dashesForIntersectionsWithRect): Deleted.
        * rendering/TextPainter.h:
        (WebCore::TextPainter::setTextPaintStyle):
        (WebCore::TextPainter::setSelectionPaintStyle):
        (WebCore::TextPainter::setIsHorizontal):
        (WebCore::TextPainter::setFont):
        (WebCore::TextPainter::addEmphasis):
        (WebCore::TextPainter::addTextShadow):

2015-12-10  Enrica Casucci  <enrica@apple.com>

        Change skin tone support for two emoji.
        https://bugs.webkit.org/show_bug.cgi?id=152147
        rdar://problem/23716993
        rdar://problem/23716344

        Reviewed by Darin Adler.

        Horse race emoji (1F3C7) should no longer have skin tone variation.
        Sleuth/Spy emoji (!F575) should instead have skin tone variation.

        * platform/text/TextBreakIterator.cpp:
        (WebCore::cursorMovementIterator):

2015-12-10  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r193500.
        https://bugs.webkit.org/show_bug.cgi?id=152143

        do not want to have to disable canvas-to-large-to-draw test
        (Requested by bfulgham on #webkit).

        Reverted changeset:

        "Place an upper bound on canvas pixel count"
        https://bugs.webkit.org/show_bug.cgi?id=151825
        http://trac.webkit.org/changeset/193500

2015-12-10  Brady Eidson  <beidson@apple.com>

        Followup for:
        Modern IDB: storage/indexeddb/intversion-close-between-events.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152096

        Implementing Darin Adler's review feedback that came after the patch landed.

        * bindings/js/JSIDBDatabaseCustom.cpp:
        (WebCore::JSIDBDatabase::transaction): No need to explicitly cast to Vector<String>.

2015-12-10  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        JSC Builtins should use safe array methods
        https://bugs.webkit.org/show_bug.cgi?id=151501

        Reviewed by Darin Adler.

        Using @push and @shift in internal arrays in lieu of push and shift.
        This cannot be disrupted by user scripts except if arrays are also made accessible to user scripts.

        Covered by added tests for ReadableStream constructs.

        * Modules/mediastream/RTCPeerConnectionInternals.js:
        (runNext):
        (enqueueOperation):
        * Modules/streams/ReadableStreamInternals.js:
        (enqueueInReadableStream):
        (readFromReadableStreamReader):
        * Modules/streams/StreamInternals.js:
        (dequeueValue):
        (enqueueValueWithSize):

2015-12-10  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] pixel coverage multiplication in TiledBackingStore can overflow
        https://bugs.webkit.org/show_bug.cgi?id=152055

        Reviewed by Carlos Garcia Campos.

        The computation of the pixel coverage in TiledBackingStore can easily overflow
        when the candidate size is relatively large (for instance when the backed
        layer is transformed in a way that increases its perceived size). This can result
        in missing tiles for this specific backing store, at least until the layer in
        question is transformed again into a shape that produces a smaller candidate size.

        To avoid the integer overflow, the multiplication is done in a safe manner,
        defaulting to the max positive value an integer can hold in case the overflow
        is detected.

        * platform/graphics/texmap/coordinated/TiledBackingStore.cpp:
        (WebCore::TiledBackingStore::adjustForContentsRect):

2015-12-10  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] Clean up BitmapTexturePool
        https://bugs.webkit.org/show_bug.cgi?id=152073

        Reviewed by Daniel Bates.

        Move BitmapTexturePoolEntry class under the BitmapTexturePool class, renaming
        it to simply Entry and keeping it private. Have the constructor take in an
        rvalue reference to the RefPtr<BitmapTexture> object. Remove the static
        compareTimeLastUsed() function and use a lambda directly in its place.

        Remove the default BitmapTexturePool constructor, which isn't used anywhere.
        Have the constructor and some methods accept or return RefPtr objects, possibly
        via rvalue references. Clean up the header file by removing a few unnecessary
        header includes and using forward declarations where possible.

        In the BitmapTexturePool implementation file, mark the two const variables as
        static. The ::acquireTexture() method now uses the std::find_if() algorithm
        to find a fitting Entry object in the Vector. The same method is also moved
        upwards so we follow the order of declaration in the header. ::createTexture()
        inlines the return of the new expression into the adoptRef() call in the return
        statement.

        TextureMapperGL constructor is updated to pass a copied RefPtr object into the
        BitmapTexturePool constructor.

        * platform/graphics/texmap/BitmapTexturePool.cpp:
        (WebCore::BitmapTexturePool::BitmapTexturePool):
        (WebCore::BitmapTexturePool::acquireTexture):
        (WebCore::BitmapTexturePool::releaseUnusedTexturesTimerFired):
        (WebCore::BitmapTexturePool::createTexture):
        * platform/graphics/texmap/BitmapTexturePool.h:
        (WebCore::BitmapTexturePool::Entry::Entry):
        (WebCore::BitmapTexturePool::Entry::markUsed):
        (WebCore::BitmapTexturePoolEntry::BitmapTexturePoolEntry): Deleted.
        (WebCore::BitmapTexturePoolEntry::markUsed): Deleted.
        (WebCore::BitmapTexturePoolEntry::compareTimeLastUsed): Deleted.
        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::TextureMapperGL):

2015-12-10  Michael Catanzaro  <mcatanzaro@igalia.com>

        [GTK] RenderThemeGtk::platformActiveSelectionBackgroundColor, et. al. should not clobber state of cached GtkStyleContexts
        https://bugs.webkit.org/show_bug.cgi?id=151533

        Reviewed by Carlos Garcia Campos.

        Remove the style context cache to simplify the code, drastically reduce the number of
        expensive save/restore operations performed on style contexts, and avoid unwanted
        side-effects in RenderThemeGtk::styleColor. This is also a speculative fix for improper
        button rendering with certain custom themes, and a simplification that will make it easier
        to fix bug #150550.

        This change does have performance implications, which I intend to check on the perf bot
        after landing to ensure that removing the cache does not have a significant negative impact
        on performance; I have no clue whether this will be a net performance win or loss. However,
        this is a bit tricky, because the bot is running GTK+ 3.16, whereas I expect save/restore
        might be much more expensive in GTK+ 3.20, and I do not want to make performance decisions
        except based on the latest GTK+ due to large changes in the implementation of
        GtkStyleContext.

        * rendering/RenderThemeGtk.cpp:
        (WebCore::createStyleContext):
        (WebCore::getStockIconForWidgetType):
        (WebCore::getStockSymbolicIconForWidgetType):
        (WebCore::RenderThemeGtk::initMediaColors):
        (WebCore::RenderThemeGtk::adjustRepaintRect):
        (WebCore::setToggleSize):
        (WebCore::paintToggle):
        (WebCore::RenderThemeGtk::setCheckboxSize):
        (WebCore::RenderThemeGtk::setRadioSize):
        (WebCore::RenderThemeGtk::paintButton):
        (WebCore::getComboBoxMetrics):
        (WebCore::RenderThemeGtk::paintMenuList):
        (WebCore::RenderThemeGtk::paintTextField):
        (WebCore::RenderThemeGtk::paintSliderTrack):
        (WebCore::RenderThemeGtk::paintSliderThumb):
        (WebCore::RenderThemeGtk::adjustSliderThumbSize):
        (WebCore::RenderThemeGtk::paintProgressBar):
        (WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):
        (WebCore::RenderThemeGtk::paintInnerSpinButton):
        (WebCore::styleColor):
        (WebCore::gtkStyleChangedCallback): Deleted.
        (WebCore::styleContextMap): Deleted.
        (WebCore::getStyleContext): Deleted.

2015-12-10  Myles C. Maxfield  <mmaxfield@apple.com>

        font-variant-caps does not work if the font does not support font features
        https://bugs.webkit.org/show_bug.cgi?id=149774

        Reviewed by Antti Koivisto.

        This test implements synthesis for small-caps and all-small-caps. It does so by
        moving font variant selection into a higher level (ComplexTextController).
        In general, the approach is to use the pure font feature until we encounter
        a character which needs to be uppercased, and which the font feature does not
        support uppercasing. In this situation, we try again with synthesis. In this
        case, synthesis means artificially uppercasing letters and rendering them with
        a smaller font.

        We require system support to know which glyphs a particular font feature supports.
        Therefore, on operating systems which do not include this support, we will simply
        say that the font feature does not support any glyphs.

        Test: css3/font-variant-small-caps-synthesis.html
              css3/font-variant-petite-caps-synthesis.html

        * platform/graphics/Font.cpp:
        (WebCore::Font::noSmallCapsFont): Return the same font, but without smcp or c2sc.
        This function utilizes a cache.
        * platform/graphics/Font.h:
        (WebCore::Font::variantFont): Small caps should never go through this function
        anymore.
        * platform/graphics/FontCascade.h: Because we're moving variant selection into
        a higher level, we remove the FontVariant argument from the lower-level call.
        * platform/graphics/FontCascadeFonts.cpp:
        (WebCore::FontCascadeFonts::glyphDataForVariant): Use early-return style.
        (WebCore::FontCascadeFonts::glyphDataForNormalVariant): Ditto.
        * platform/graphics/cocoa/FontCascadeCocoa.mm:
        (WebCore::FontCascade::fontForCombiningCharacterSequence): Because we're moving
        variant selection into a higher level, we remove the FontVariant argument from
        the lower-level call.
        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::Font::smallCapsSupportsCharacter):
        (WebCore::Font::allSmallCapsSupportsCharacter):
        (WebCore::smallCapsOpenTypeDictionary): Helper function for
        smallCapsSupportsCharacter().
        (WebCore::smallCapsTrueTypeDictionary): Ditto.
        (WebCore::unionBitVectors):
        (WebCore::Font::glyphsSupportedBySmallCaps): Compute a bit vector of supported
        glyphs.
        (WebCore::Font::glyphsSupportedByAllSmallCaps): Ditto.
        (WebCore::createDerivativeFont): Moving common code into its own helper function.
        (WebCore::Font::createFontWithoutSmallCaps):
        (WebCore::Font::platformCreateScaledFont): Use the common code.
        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::capitalized): What is the capitalized form of a character?
        (WebCore::ComplexTextController::collectComplexTextRuns): Implement the core
        logic of this patch. This includes the retry when we encounter a character which
        is not supported by the font feature.
        * platform/spi/cocoa/CoreTextSPI.h:

2015-12-10  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] Remove the TEXMAP_OPENGL_ES_2 define
        https://bugs.webkit.org/show_bug.cgi?id=152069

        Reviewed by Alex Christensen.

        Remove the TEXMAP_OPENGL_ES_2 macro define and clean up the code
        that it was (not) guarding.

        * platform/graphics/texmap/BitmapTexture.h:
        * platform/graphics/texmap/BitmapTextureGL.cpp: Remove the TEXMAP_OPENGL_ES_2
        guard. Keep the GL_UNSIGNED_INT_8_8_8_8_REV define for OS(DARWIN), but use
        the GraphicsContext3D constants for other values.
        (WebCore::BitmapTextureGL::updateContentsNoSwizzle):
        (WebCore::BitmapTextureGL::initializeStencil): Remove the TEXMAP_OPENGL_ES_2
        guard and default to calling the renderbufferStorage() function with the
        GraphicsContext3D::STENCIL_INDEX8 argument.
        * platform/graphics/texmap/BitmapTexturePool.h:
        * platform/graphics/texmap/TextureMapper.h:
        * platform/graphics/texmap/TextureMapperGL.cpp: Remove both the TEXMAP_OPENGL_ES_2
        guard and the code it guarded. Because we were defining TEXMAP_OPENGL_ES_2 and not
        USE_TEXMAP_OPENGL_ES_2, the guarded defines were always enforced, but they're never
        actually used in this file anyway.

2015-12-09  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/objectstore-basics.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152101

        Reviewed by Alex Christensen.

        No new tests (Multiple tests updated to the new error messaging cover it).

        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::putOrAdd): Add plenty of detailed error messaging.

2015-12-09  Zalan Bujtas  <zalan@apple.com>

        TextPainter: Make before and after selection painting more explicit.
        https://bugs.webkit.org/show_bug.cgi?id=152104

        Reviewed by Myles C. Maxfield.

        Instead of swapping start end end positions and expecting TextPainter::drawTextOrEmphasisMarks()
        to recognize it, we call painting with 0 - startPosition and endPosition - length.

        No change in functionality.

        * rendering/TextPainter.cpp:
        (WebCore::TextPainter::drawTextOrEmphasisMarks):
        (WebCore::TextPainter::paintTextAndEmphasisMarksIfNeeded):
        (WebCore::TextPainter::paintText):
        (WebCore::TextPainter::paintEmphasisMarksIfNeeded): Deleted.
        (WebCore::TextPainter::paintTextWithStyle): Deleted.
        * rendering/TextPainter.h:

2015-12-09  Daniel Bates  <dabates@apple.com>

        [iOS] Suspend and resume device motion and device orientation updates when page is hidden and visible, respectively
        https://bugs.webkit.org/show_bug.cgi?id=151840
        <rdar://problem/23753931>

        Reviewed by Simon Fraser.

        * dom/Document.cpp:
        (WebCore::Document::suspendDeviceMotionAndOrientationUpdates): Added.
        (WebCore::Document::resumeDeviceMotionAndOrientationUpdates): Added.
        (WebCore::Document::platformSuspendOrStopActiveDOMObjects): Moved logic to suspend device motion and
        orientation updates from here to Document::suspendDeviceMotionAndOrientationUpdates().
        (WebCore::Document::suspendActiveDOMObjects): Modified to call Document::suspendDeviceMotionAndOrientationUpdates().
        (WebCore::Document::resumeActiveDOMObjects): Modified to call Document::resumeDeviceMotionAndOrientationUpdates().
        * dom/Document.h:
        * page/Page.cpp:
        (WebCore::Page::setIsVisibleInternal): Suspend device motion and orientation updates when the page is hidden and
        resume updates when the page is visible.
        (WebCore::Page::suspendDeviceMotionAndOrientationUpdates): Added.
        (WebCore::Page::resumeDeviceMotionAndOrientationUpdates): Added.
        * page/Page.h:

2015-12-09  Daniel Bates  <dabates@apple.com>

        Unify iOS Frame::setTimersPaused() logic and Frame::{suspend, resume}ActiveDOMObjectsAndAnimations()
        https://bugs.webkit.org/show_bug.cgi?id=152006

        Reviewed by Simon Fraser.

        Currently we have almost identical logic to suspend and resume a web page for iOS and non-iOS ports.
        We should unify this logic instead of duplicating it.

        * dom/ActiveDOMObject.h: Remove iOS-specific enumeration DocumentWillBePaused and standardize on
        enumerator PageWillBeSuspended.
        * dom/Document.cpp:
        (WebCore::Document::didBecomeCurrentDocumentInFrame): Unify iOS and non-iOS-specific code.
        (WebCore::Document::suspendScheduledTasks): Ignore subsequent calls to this function so long as the reason for
        the first invocation was ActiveDOMObject::PageWillBeSuspended. Such a subsequent call may occur as part of
        handling a scroll or zoom gesture.
        * dom/ScriptExecutionContext.cpp:
        (WebCore::ScriptExecutionContext::suspendActiveDOMObjects): Ignore subsequent calls to this function
        so long as the reason for the first invocation was ActiveDOMObject::PageWillBeSuspended. Such a subsequent
        call may occur as part of the process of a page being added to the page cache.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::suspend): Remove case for ActiveDOMObject::DocumentWillBePaused as this
        enumerator is being removed.
        * page/DOMTimer.cpp:
        (WebCore::DOMTimer::install): Write logic that used Frame::timersPaused() terms of
        ScriptExecutionContext::activeDOMObjectsAreSuspended() as we are removing Frame::timersPaused().
        (WebCore::DOMTimer::fired): Remove iOS-specific assertion with respect to Frame::timersPaused().
        This function already asserts the equivalent condition that ScriptExecutionContext::activeDOMObjectsAreSuspended()
        evaluates to false. Clean up iOS-specific code that depends on the ScriptExecutionContext being a
        Document object by taking advantage of the fact that this assumption is true when shouldBeginObservingChanges
        evaluates to true.
        * page/Frame.cpp:
        (WebCore::Frame::Frame): Remove instance variable m_timersPausedCount and unify the iOS and non-iOS logic.
        (WebCore::Frame::suspendActiveDOMObjectsAndAnimations): Standardize on the iOS logic for suspending
        DOM objects and animations because it is more comprehensive on what it suspends and works with the deferred
        loading machinery (Page::setDefersLoading() - see remarks in Frame::resumeActiveDOMObjectsAndAnimations() for
        more details). Specifically, make use of Frame::clearTimers() to suspend non-scripted animations (i.e. non-requestAnimationFrame()
        animations), auto-scroll timer, and pending relayouts. And use Document::suspendScheduledTasks() to suspend
        all other tasks, including WebSQL database callbacks, active DOM objects, scripted animations and execution of
        <script async>/<script defer> JavaScript scripts.
        (WebCore::Frame::resumeActiveDOMObjectsAndAnimations): Standardize on the iOS logic for resuming
        DOM objects and animations for symmetry and because it works with the deferred loading machinery. We call
        Document::resumeScheduledTasks() (which calls Document::resumeActiveDOMObjects()) instead of calling
        Document::resumeActiveDOMObjects() directly because the former will ultimately process the queue of pending
        tasks (Document::m_pendingTasks).
        * page/Frame.h: Remove instance variable m_timersPausedCount.
        (WebCore::Frame::timersPaused): Deleted.
        * page/ios/FrameIOS.mm:
        (WebCore::Frame::setTimersPaused): Write this function in terms of Page::{suspend, resume}ActiveDOMObjectsAndAnimations().
        We need to keep this function for Legacy WebKit on iOS.
        (WebCore::Frame::setTimersPausedInternal): Deleted.
        * rendering/RenderElement.cpp:
        (WebCore::shouldRepaintForImageAnimation): Remove iOS-specific code to early return when Frame::timersPaused()
        evaluates to true. This function already has the equivalent code to early return when Document::activeDOMObjectsAreSuspended()
        evaluates to true.

2015-12-09  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/metadata.html fails
        https://bugs.webkit.org/show_bug.cgi?id=152099

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/abort-objectstore-info.html
              And at least one existing failure now passes.

        We did not properly reset object store info when version change transactions aborted.

        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::IDBObjectStore):
        (WebCore::IDBClient::IDBObjectStore::rollbackInfoForVersionChangeAbort):
        * Modules/indexeddb/client/IDBObjectStoreImpl.h:
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::abort):

2015-12-09  Simon Fraser  <simon.fraser@apple.com>

        Adjust layer backing store format
        https://bugs.webkit.org/show_bug.cgi?id=152097
        rdar://problem/23305376

        Reviewed by Tim Horton.
        
        Call setBackingStoreFormat() on UIWebView tile grid layers, and on compositing
        layers which can allocate backing store.

        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (WebCore::setBackingStoreFormat):
        (PlatformCALayerCocoa::commonInit):
        * platform/ios/LegacyTileGridTile.mm:
        (WebCore::setBackingStoreFormat):
        (WebCore::LegacyTileGridTile::LegacyTileGridTile):

2015-12-09  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/intversion-close-between-events.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152096

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        * bindings/js/JSIDBDatabaseCustom.cpp:
        (WebCore::JSIDBDatabase::transaction): In addition to JSArrays, treat DOMStringLists as a valid string sequence.
    
2015-12-09  Andreas Kling  <akling@apple.com>

        [iOS] ResourceUsageOverlay should work on iOS.
        <https://webkit.org/b/152021>

        Reviewed by Antti Koivisto.

        Make ResourceUsageOverlay work on iOS and on Mac desktops with UI-side compositing.

        * page/ResourceUsageOverlay.cpp:
        (WebCore::ResourceUsageOverlay::initialize): Move the overlay to the top of the view on iOS for now.
        * page/ResourceUsageOverlay.h:
        * page/cocoa/ResourceUsageOverlayCocoa.mm:
        (WebCore::createColor): Make a custom CGColor factory since we can't use CGColorCreateGenericRGB on iOS.
        (WebCore::MemoryCategoryInfo::MemoryCategoryInfo):
        (WebCore::ResourceUsageOverlay::platformInitialize): Put the overlay CALayer into a container layer and
        hook it up with GraphicsLayer::setContentsToPlatformLayer so it works with all compositing modes.
        (WebCore::showText): Move CGContextSaveGState call to the top of the function to preserve everything.
        (WebCore::drawGraphLabel):
        (WebCore::drawCpuHistory):
        (WebCore::drawGCHistory):
        (WebCore::ResourceUsageOverlay::platformDraw): Flip the CGContext if needed.
        (WebCore::runSamplerThread): Update the layer rects on each thread iteration. This shouldn't be
        necessary but it papers over an issue where the containing layer would shrink down to 0x0 and
        disappear. Added a FIXME for this.
        * platform/spi/cocoa/MachVMSPI.h: Add purgeable VM SPI.

2015-12-09  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/database-closepending-flag.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152095

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).
        
        The server-side checks the closepending flag before dispatching the event to the client, 
        but due to the inherent asynchronous race between server and client, the client needs to 
        check its closePending flag as well.

        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::fireVersionChangeEvent): Don't fire if m_closePending is set.

2015-12-09  David Hyatt  <hyatt@apple.com>

        Picture element needs to respond to dynamic viewport changes.
        https://bugs.webkit.org/show_bug.cgi?id=152013
        <rdar://problem/23766375>

        Reviewed by Dean Jackson.

        Added new tests in fast/picture.

        * css/MediaQueryEvaluator.cpp:
        (WebCore::MediaQueryEvaluator::evalCheckingViewportDependentResults):
        Add new evaluation method that adds viewport dependent results to a vector. A follow-up patch
        will refactor the style resolver code to use this function instead of the special style resolver one, in order to
        get rid of the code duplication. Tracked by https://bugs.webkit.org/show_bug.cgi?id=152089.

        * css/MediaQueryEvaluator.h:
        (WebCore::MediaQueryResult::MediaQueryResult):
        * css/StyleResolver.h:
        (WebCore::MediaQueryResult::MediaQueryResult): Deleted.
        Move MediaQueryResult into a header since it is used in multiple places now and not just by the style
        resolver.

        * dom/Document.cpp:
        (WebCore::Document::evaluateMediaQueryList):
        (WebCore::Document::checkViewportDependentPictures):
        (WebCore::Document::optimizedStyleSheetUpdateTimerFired):
        (WebCore::Document::applyContentDispositionAttachmentSandbox):
        (WebCore::Document::addViewportDependentPicture):
        (WebCore::Document::removeViewportDependentPicture):
        * dom/Document.h:
        The document now maintains a HashSet of viewport-dependent pictures, and it checks them whenever the
        viewport changes. If their media queries stay the same, then nothing happens. If they change, then
        the <picture> will go back and re-check all its <source> elements to see what the new best candidate is.

        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::bestFitSourceFromPictureElement):
        Revised to check for viewport dependencies and to cache viewport-dependent results on the <picture> elements.
        When a <picture> is found to be viewport-dependent (or not) it is also added to or removed from the document's
        set of tracked pictures.

        * html/HTMLPictureElement.cpp:
        (WebCore::HTMLPictureElement::HTMLPictureElement):
        (WebCore::HTMLPictureElement::~HTMLPictureElement):
        (WebCore::HTMLPictureElement::didMoveToNewDocument):
        (WebCore::HTMLPictureElement::create):
        (WebCore::HTMLPictureElement::sourcesChanged):
        (WebCore::HTMLPictureElement::viewportChangeAffectedPicture):
        * html/HTMLPictureElement.h:
        New caching of results and updating of the document HashSet when the picture gets destroyed or moves to
        a different document.

        * html/HTMLSourceElement.cpp:
        (WebCore::HTMLSourceElement::parseAttribute):
        * html/HTMLSourceElement.h:
        Cache the media attribute in a parsed form. A follow-up patch will improve the <video>/<audio>
        code to make use of this parsed result. Tracked by https://bugs.webkit.org/show_bug.cgi?id=152090.

2015-12-09  Zalan Bujtas  <zalan@apple.com>

        TextPainter: Rename start and end position to selectionStart and selectionEnd.
        https://bugs.webkit.org/show_bug.cgi?id=152088

        Reviewed by Myles C. Maxfield.

        They actually mean selection start/end.

        No change in functionality.

        * rendering/InlineTextBox.cpp:
        (WebCore::InlineTextBox::paint):
        * rendering/TextPainter.cpp:
        (WebCore::TextPainter::TextPainter):
        (WebCore::TextPainter::paintText):
        * rendering/TextPainter.h:

2015-12-09  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: [GTK] Anonymous render block flow elements should be exposed as ATK_ROLE_SECTION; not ATK_ROLE_PANEL
        https://bugs.webkit.org/show_bug.cgi?id=152070

        Reviewed by Mario Sanchez Prada.

        Map the element to WebCore AccessibilityRole DivRole for GTK. This is being
        done in the shared layer rather than in the platform layer because we want all
        subsequent logic to treat anonymous render block flow elements as divs.

        No new tests. We already have sufficient test coverage. The expectations
        been updated accordingly.

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):

2015-12-09  Keith Rollin  <krollin@apple.com>

        form.elements should reflect the element ordering after the HTML tree builder algorithm
        https://bugs.webkit.org/show_bug.cgi?id=148870
        rdar://problem/22589879

        Reviewed by Ryosuke Niwa.

        form.elements should return form-associated elements in tree order.
        However, when presented with an HTML fragment like the following,
        forms.elements is not built in tree order. Instead, the elements
        appear in forms.element in the same order they appear in the HTML --
        that is in the same order as they are parsed.

        <form id=form>
            <table>
                <tr>
                    <td><input type="radio" name="radio1" id="r1" value=1></td>
                    <td><input type="radio" name="radio2" id="r2" value=2></td>
                    <input type="radio" name="radio0" id="r0" value=0>
                </tr>
            </table>
        </form>

        The reason why elements appear in forms.elements in parse order is
        because they register themselves with the designated form when they
        are created. At this time, they are not in the DOM tree, so the form
        can only assume that the element will be appended to the DOM tree,
        with the result that it records the elements in the HTML fragment
        above as [r1, r2, r0].

        However, it's not always the case that the newly-created element will
        be appended to the current tree. In the HTML fragment above, the r0
        input element is hoised out of the table element. It ends up being the
        preceding sibling of the table element, with the result that the
        actual tree-order of the input elements is [r0, r1, r2].

        Because the problem is due to registering form-associated elements
        with the form *before* the elements are added to the DOM tree, the
        solution is to defer that registration until afterwards. With the new
        element in the tree, the form can now use its current location in the
        tree to correctly place the element in form.elements.

        Existing tests now pass:
        - imported/w3c/web-platform-tests/html/semantics/forms/the-form-element/form-elements-nameditem-02-html

        * html/FormAssociatedElement.cpp:
        (WebCore::FormAssociatedElement::FormAssociatedElement):
        (WebCore::FormAssociatedElement::insertedInto):
        (WebCore::FormAssociatedElement::removedFrom):
        (WebCore::FormAssociatedElement::formRemovedFromTree):
        (WebCore::FormAssociatedElement::formWillBeDestroyed):
        * html/FormAssociatedElement.h:
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::HTMLImageElement):
        (WebCore::HTMLImageElement::insertedInto):
        (WebCore::HTMLImageElement::removedFrom):
        * html/HTMLImageElement.h:
        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::HTMLObjectElement):

2015-12-09  Gwang Yoon Hwang  <yoon@igalia.com>

        [ThreadedCompositor] Support HTML5 Video
        https://bugs.webkit.org/show_bug.cgi?id=143301

        Reviewed by Žan Doberšek.

        This patch implements HTML5 Video supports in Threaded Compositor.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::GstVideoFrameHolder::GstVideoFrameHolder):
        Added to support GStreamer GL by ensuring unmapping of the swapped
        GstVideoFrame performed at GStreamer GL's gl thread.
        (WebCore::MediaPlayerPrivateGStreamerBase::updateTexture):
        Modified to upload decoded frame to the given texture instead of
        creating a texture itself because we should use a texture from the
        proxy when we are using the threaded compositor.
        (WebCore::MediaPlayerPrivateGStreamerBase::pushTextureToCompositor):
        Implements two ways to send a texture from GStreamer to the compositor.
        1. If we are not using GStreamer GL, we are going to acquire a free texture
        from a TextureMapperPlatformLayerProxy and upload the decoded frame to the
        texture. This should be done at the compositing thread because we
        don't have a Gst's GL thread.
        2. If we are using GStreamer GL, we map a texture for the given frame
        and passes it to the compositing thread. The mapped frame will be
        freed if it is swapped out or the layer is removed.

        (WebCore::MediaPlayerPrivateGStreamerBase::paintToTextureMapper):
        Modified to aquire a new texture itself.

        * platform/graphics/texmap/TextureMapperPlatformLayerProxy.cpp:
        Adds a way to pass a function to the compositing thread to allocate /
        upload textures at the compositing thread.


2015-12-09  Xabier Rodriguez Calvar  <calvaris@igalia.com>

        [Streams API] pipeThrough test failing
        https://bugs.webkit.org/show_bug.cgi?id=152061

        Reviewed by Youenn Fablet.

        Test: imported/w3c/web-platform-tests/streams-api/readable-streams/pipe-through.html

        * Modules/streams/ReadableStream.js:
        (pipeThrough): Mimic destructuring for the streams parameter.

2015-12-09  Frederic Wang  <fred.wang@free.fr>

        Bad position of large operators inside an munderover element
        https://bugs.webkit.org/show_bug.cgi?id=151916

        Reviewed by Alejandro G. Castro.

        Test: mathml/opentype/large-operators-munderover.html

        * rendering/mathml/RenderMathMLOperator.h:
        (WebCore::RenderMathMLOperator::isVertical): Expose the direction of the operator.
        * rendering/mathml/RenderMathMLUnderOver.cpp:
        (WebCore::RenderMathMLUnderOver::layout): Remove call to horizontal stretching for vertical operators.

2015-12-09  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] TextureMapperTiledBackingStore should notify the ImageObserver of the data access
        https://bugs.webkit.org/show_bug.cgi?id=152053

        Reviewed by Martin Robinson.

        TextureMapperTiledBackingStore should call ImageObserver::didDraw() on the Image's
        observer after updating the tile with the Image's data. This way the CachedImage
        (i.e. the observer) can mark the data access with the current timestamp, avoiding
        removing the decoded data in the very near future during a cache purge.

        * platform/graphics/texmap/TextureMapperTiledBackingStore.cpp:
        (WebCore::TextureMapperTiledBackingStore::updateContentsFromImageIfNeeded):

2015-12-09  Zan Dobersek  <zdobersek@igalia.com>

        Make MainThreadSharedTimerGtk implementation GLib-specific
        https://bugs.webkit.org/show_bug.cgi?id=152044

        Reviewed by Carlos Garcia Campos.

        MainThreadSharedTimerGtk has implementation that only directly depends
        on GLib, and not GTK+. Because of that it can be moved under
        Source/WebCore/platform/glib and slightly renamed.

        * PlatformGTK.cmake:
        * platform/glib/MainThreadSharedTimerGLib.cpp: Renamed from Source/WebCore/platform/gtk/MainThreadSharedTimerGtk.cpp.
        (WebCore::MainThreadSharedTimer::MainThreadSharedTimer):
        (WebCore::MainThreadSharedTimer::setFireInterval):
        (WebCore::MainThreadSharedTimer::stop):
        (WebCore::MainThreadSharedTimer::invalidate):
        * platform/gtk/MainThreadSharedTimerGtk.cpp:
        (WebCore::MainThreadSharedTimer::MainThreadSharedTimer): Deleted.
        (WebCore::MainThreadSharedTimer::setFireInterval): Deleted.
        (WebCore::MainThreadSharedTimer::stop): Deleted.
        (WebCore::MainThreadSharedTimer::invalidate): Deleted.

2015-12-09  Zan Dobersek  <zdobersek@igalia.com>

        [TextureMapper] TextureMapperShaderProgram::setMatrix() should use TransformationMatrix::FloatMatrix4
        https://bugs.webkit.org/show_bug.cgi?id=152042

        Reviewed by Martin Robinson.

        * platform/graphics/texmap/TextureMapperShaderProgram.cpp:
        (WebCore::TextureMapperShaderProgram::setMatrix): Instead of manually writing out
        the complete matrix in a C array, simply use TransformationMatrix::FloatMatrix4
        and fill that via the TransformationMatrix::toColumnMajorFloatArray() method
        called on the passed-in TransformationMatrix.

2015-12-09  Zan Dobersek  <zdobersek@igalia.com>

        [Soup] Attach the SocketStreamHandleSoup write-ready source to the thread-default context
        https://bugs.webkit.org/show_bug.cgi?id=152041

        Reviewed by Carlos Garcia Campos.

        * platform/network/soup/SocketStreamHandleSoup.cpp:
        (WebCore::SocketStreamHandle::beginWaitingForSocketWritability): Attach the
        write-ready source to the thread-default context, instead of implicitly
        relying on the default context for dispatching.

2015-12-09  Zan Dobersek  <zdobersek@igalia.com>

        [Soup] SocketStreamHandle should call g_source_destroy() on the write-ready source
        https://bugs.webkit.org/show_bug.cgi?id=152040

        Reviewed by Carlos Garcia Campos.

        * platform/network/soup/SocketStreamHandleSoup.cpp:
        (WebCore::SocketStreamHandle::stopWaitingForSocketWritability): Instead of
        calling the g_source_get_id()-g_source_remove() pair, destroy the source via
        the g_source_destroy() call. Also use nullptr to clear out the pointer
        variable.

2015-12-09  Zan Dobersek  <zdobersek@igalia.com>

        Make AudioBusGtk implementation GLib-specific
        https://bugs.webkit.org/show_bug.cgi?id=152049

        Reviewed by Philippe Normand.

        AudioBusGtk only depends on GLib, so it should be moved to
        Source/WebCore/platform/audio/glib and the implementation file
        renamed to AudioBusGLib.cpp.

        The hard-coded webkitgtk path component can be addressed later.

        * PlatformGTK.cmake: Update the build target.
        * platform/audio/glib/AudioBusGLib.cpp: Renamed from Source/WebCore/platform/audio/gtk/AudioBusGtk.cpp.
        (WebCore::AudioBus::loadPlatformResource):
        * platform/audio/gtk/AudioBusGtk.cpp:
        (WebCore::AudioBus::loadPlatformResource): Deleted.

2015-12-09  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: [EFL] Consider deferring to WebCore Accessibility for table exposure
        https://bugs.webkit.org/show_bug.cgi?id=144898

        Reviewed by Darin Adler.

        Stop unconditionally exposing all HTMLTableElement nodes as AccessibilityTables
        for WebKitEfl.

        No new tests. Several existing tests already cover table exposure. They have
        been updated accordingly.

        * accessibility/AccessibilityTable.cpp:
        (WebCore::AccessibilityTable::computeIsTableExposableThroughAccessibility):

2015-12-08  Simon Fraser  <simon.fraser@apple.com>

        Convert resetAnimValToBaseVal take a reference to a SVGAnimatedType
        https://bugs.webkit.org/show_bug.cgi?id=152036

        Reviewed by Zalan Bujtas.
        
        Change resetAnimValToBaseVal() to take a reference at the last argument.

        * svg/SVGAnimateElementBase.cpp:
        (WebCore::SVGAnimateElementBase::resetAnimatedType):
        * svg/SVGAnimatedAngle.cpp:
        (WebCore::SVGAnimatedAngleAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedAngle.h:
        * svg/SVGAnimatedBoolean.cpp:
        (WebCore::SVGAnimatedBooleanAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedBoolean.h:
        * svg/SVGAnimatedColor.h:
        * svg/SVGAnimatedEnumeration.cpp:
        (WebCore::SVGAnimatedEnumerationAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedEnumeration.h:
        * svg/SVGAnimatedInteger.cpp:
        (WebCore::SVGAnimatedIntegerAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedInteger.h:
        * svg/SVGAnimatedIntegerOptionalInteger.cpp:
        (WebCore::SVGAnimatedIntegerOptionalIntegerAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedIntegerOptionalInteger.h:
        * svg/SVGAnimatedLength.cpp:
        (WebCore::SVGAnimatedLengthAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedLength.h:
        * svg/SVGAnimatedLengthList.cpp:
        (WebCore::SVGAnimatedLengthListAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedLengthList.h:
        * svg/SVGAnimatedNumber.cpp:
        (WebCore::SVGAnimatedNumberAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedNumber.h:
        * svg/SVGAnimatedNumberList.cpp:
        (WebCore::SVGAnimatedNumberListAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedNumberList.h:
        * svg/SVGAnimatedNumberOptionalNumber.cpp:
        (WebCore::SVGAnimatedNumberOptionalNumberAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedNumberOptionalNumber.h:
        * svg/SVGAnimatedPath.cpp:
        (WebCore::SVGAnimatedPathAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedPath.h:
        * svg/SVGAnimatedPointList.cpp:
        (WebCore::SVGAnimatedPointListAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedPointList.h:
        * svg/SVGAnimatedPreserveAspectRatio.cpp:
        (WebCore::SVGAnimatedPreserveAspectRatioAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedPreserveAspectRatio.h:
        * svg/SVGAnimatedRect.cpp:
        (WebCore::SVGAnimatedRectAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedRect.h:
        * svg/SVGAnimatedString.cpp:
        (WebCore::SVGAnimatedStringAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedString.h:
        * svg/SVGAnimatedTransformList.cpp:
        (WebCore::SVGAnimatedTransformListAnimator::resetAnimValToBaseVal):
        * svg/SVGAnimatedTransformList.h:
        * svg/SVGAnimatedTypeAnimator.h:
        (WebCore::SVGAnimatedTypeAnimator::resetFromBaseValue):
        (WebCore::SVGAnimatedTypeAnimator::resetFromBaseValues):

2015-12-08  Myles C. Maxfield  <mmaxfield@apple.com>

        Remove Mavericks-specific code from FontCacheMac
        https://bugs.webkit.org/show_bug.cgi?id=152030

        Reviewed by Simon Fraser.

        Mavericks is no longer a supported platform.

        No new tests because there is no behavior change.

        * platform/graphics/mac/FontCacheMac.mm:
        (WebCore::platformLookupFallbackFont):
        (WebCore::platformFontWithFamilySpecialCase): Deleted.

2015-12-08  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/objectstore-cursor.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=152023

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/server/MemoryObjectStoreCursor.cpp:
        (WebCore::IDBServer::MemoryObjectStoreCursor::MemoryObjectStoreCursor):
        (WebCore::IDBServer::MemoryObjectStoreCursor::setReverseIteratorFromRemainingRange): Make sure the
          found iterator is actually in the target range.

2015-12-08  Jer Noble  <jer.noble@apple.com>

        Changing <video> src during 'ended' event can leave screen sleep disabled
        https://bugs.webkit.org/show_bug.cgi?id=152018

        Reviewed by Eric Carlson.

        Resetting a HTMLMediaElement's src during 'ended' introduces a race condition: whether
        the 'mediaPlayerRateChanged()' notification will fire before createMediaPlayer() destroys
        the old MediaPlayer firing said notification.

        To break the race condition, always update the sleep disabling assertion after destroying
        the media player (by creating a new one).

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::createMediaPlayer):

2015-12-08  Brady Eidson  <beidson@apple.com>

        Modern IDB: Fire blocked events for delete requests that are blocked.
        https://bugs.webkit.org/show_bug.cgi?id=152015

        Reviewed by Alex Christensen.

        No new tests (Previous failing tests now pass, and previously timing-out tests now complete).

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::maybeDeleteDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::handleDelete):
        (WebCore::IDBServer::UniqueIDBDatabase::deleteOrRunTransactionsTimerFired):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2015-12-08  Brady Eidson  <beidson@apple.com>

        Modern IDB: Fire blocked events for upgrade requests that are blocked.
        https://bugs.webkit.org/show_bug.cgi?id=152007

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/blocked-open-db-requests.html
              And some that used to fail now pass.
              And some that used to timeout now complete.

        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::notifyOpenDBRequestBlocked):
        * Modules/indexeddb/client/IDBConnectionToServer.h:

        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::IDBDatabase):

        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::requestBlocked):
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.h:

        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::dispatchEvent):

        * Modules/indexeddb/server/IDBConnectionToClient.cpp:
        (WebCore::IDBServer::IDBConnectionToClient::notifyOpenDBRequestBlocked):
        * Modules/indexeddb/server/IDBConnectionToClient.h:
        * Modules/indexeddb/server/IDBConnectionToClientDelegate.h:

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::handleOpenDatabaseOperations): When a request that would
          result in a version change transaction is blocked by open connections, notify it.

        * Modules/indexeddb/shared/InProcessIDBServer.cpp:
        (WebCore::InProcessIDBServer::notifyOpenDBRequestBlocked):
        * Modules/indexeddb/shared/InProcessIDBServer.h:

2015-12-08  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo] Compile error.
        https://bugs.webkit.org/show_bug.cgi?id=152008

        Reviewed by Brent Fulgham.

        GLuint is undefined.

        * platform/graphics/GraphicsContext3D.h:

2015-12-08  Zalan Bujtas  <zalan@apple.com>

        Light cleanup in TextPainter.
        https://bugs.webkit.org/show_bug.cgi?id=151994

        Reviewed by Darin Adler.

        No change in functionality.

        * rendering/TextPainter.cpp:
        (WebCore::TextPainter::TextPainter):
        * rendering/TextPainter.h: Address post review comment.
        (WebCore::ShadowApplier::isLastShadowIteration):
        (WebCore::ShadowApplier::shadowIsCompletelyCoveredByText):

2015-12-08  Zalan Bujtas  <zalan@apple.com>

        Do not insert positioned renderers to multiple gPositionedDescendantsMap.
        https://bugs.webkit.org/show_bug.cgi?id=151878
        rdar://problem/22229889

        Reviewed by Simon Fraser.

        We insert positioned renderers into a static map (RenderBlock::gPositionedDescendantsMap) to keep track of them.
        This static map is at block level. A particular absolute positioned object is added to its closest ancestor that
        returns true for RenderElement::canContainAbsolutelyPositionedObjects().
        canContainAbsolutelyPositionedObjects() returns true if the ancestor is either positioned or has transform.
        If this container's style changes so that it's no longer positioned and it has no transform anymore,
        we need to clear its static map of positioned objects (they'll get re-inserted to another ancestor at next layout).

        This patch addresses the case when the renderer does not have transforms anymore.

        Test: fast/block/positioning/crash-when-transform-is-removed.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::styleWillChange):

2015-12-08  Eric Carlson  <eric.carlson@apple.com>

        [MediaStream] Rename UserMediaClient and UserMediaController methods
        https://bugs.webkit.org/show_bug.cgi?id=152001

        Reviewed by Brady Eidson.

        No new tests, no behavior change.

        * Modules/mediastream/UserMediaClient.h:
        (WebCore::UserMediaClient::~UserMediaClient):
        * Modules/mediastream/UserMediaController.h:
        (WebCore::UserMediaController::client):
        (WebCore::UserMediaController::from):
        (WebCore::UserMediaController::requestUserMediaAccess):
        (WebCore::UserMediaController::cancelUserMediaAccessRequest):
        (WebCore::UserMediaController::requestPermission): Deleted.
        (WebCore::UserMediaController::cancelRequest): Deleted.
        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::constraintsValidated):
        (WebCore::UserMediaRequest::contextDestroyed):
        * platform/mock/UserMediaClientMock.h:

2015-12-08  Jer Noble  <jer.noble@apple.com>

        [iOS] Do not exit fullscreen mode during auto-PiP.
        https://bugs.webkit.org/show_bug.cgi?id=151889

        Reviewed by Darin Adler.

        When auto-PiPing, do not exit fullscreen mode, as that causes a two-step animation upon returing from auto-PiP.

        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (WebVideoFullscreenInterfaceAVKit::applicationDidBecomeActive): Handle the case where we open Safari after an
            auto-PiP by clicking on a link; if so, hide the fullscreen window.
        (WebVideoFullscreenInterfaceAVKit::didStartPictureInPicture): Do not exit fullscreen during auto-PiP.
        (WebVideoFullscreenInterfaceAVKit::shouldExitFullscreenWithReason): Ditto.

2015-12-08  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo] Remove unneeded function.
        https://bugs.webkit.org/show_bug.cgi?id=151989

        Reviewed by Brent Fulgham.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::CustomVideoPresenter::createOptimalVideoType):
        (MFCreateMediaType): Deleted.

2015-12-08  Jer Noble  <jer.noble@apple.com>

        [iOS] Adopt WebFullScreenVideoRootViewController.
        https://bugs.webkit.org/show_bug.cgi?id=151996

        Reviewed by Dan Bernstein.

        Adopt WebFullScreenVideoRootViewController from WebKitAdditions. If it is not available, create and use
        a generic UIViewController subclass.

        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (createFullScreenVideoRootViewControllerClass):
        (allocWebFullScreenVideoRootViewControllerInstance):
        (WebVideoFullscreenInterfaceAVKit::setupFullscreen):

2015-12-08  Andy Estes  <aestes@apple.com>

        ImmutableNFANodeBuilder's move constructor moves an uninitialized member variable into itself
        https://bugs.webkit.org/show_bug.cgi?id=151982

        Reviewed by Darin Adler.

        * contentextensions/ImmutableNFANodeBuilder.h:
        (WebCore::ContentExtensions::ImmutableNFANodeBuilder::ImmutableNFANodeBuilder):

2015-12-08  Andreas Kling  <akling@apple.com>

        [Cocoa] ResourceUsageOverlay should query kernel for VM page size.
        <https://webkit.org/b/151920>

        Reviewed by Andy Estes.

        Read the vm.pagesize sysctl to find the correct page size for memory usage calculations.
        This fixes broken math on systems that have different hw.pagesize and vm.pagesize.

        * page/cocoa/ResourceUsageOverlayCocoa.mm:
        (WebCore::vmPageSize):
        (WebCore::pagesPerVMTag):
        (WebCore::runSamplerThread):

2015-12-08  Chris Dumez  <cdumez@apple.com>

        Add diagnostic logging to measure speculative revalidation accuracy
        https://bugs.webkit.org/show_bug.cgi?id=151953
        <rdar://problem/23092196>

        Reviewed by Darin Adler.

        Add diagnostic logging to measure speculative revalidation accuracy.

        * page/DiagnosticLoggingKeys.cpp:
        (WebCore::DiagnosticLoggingKeys::entryRightlyNotWarmedUpKey):
        (WebCore::DiagnosticLoggingKeys::entryWronglyNotWarmedUpKey):
        (WebCore::DiagnosticLoggingKeys::successfulSpeculativeWarmupWithRevalidationKey):
        (WebCore::DiagnosticLoggingKeys::successfulSpeculativeWarmupWithoutRevalidationKey):
        (WebCore::DiagnosticLoggingKeys::unknownEntryRequestKey):
        (WebCore::DiagnosticLoggingKeys::wastedSpeculativeWarmupWithRevalidationKey):
        (WebCore::DiagnosticLoggingKeys::wastedSpeculativeWarmupWithoutRevalidationKey):
        * page/DiagnosticLoggingKeys.h:

2015-12-08  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/index-cursor.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=151973

        Reviewed by Darin Adler.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/server/MemoryIndexCursor.cpp:
        (WebCore::IDBServer::MemoryIndexCursor::MemoryIndexCursor): When the initial cursor creation
          generates an iterator outside of the cursor's IDBKeyRange, invalidate the iterator.
          
2015-12-08  Joanmarie Diggs  <jdiggs@igalia.com>

        [EFL] some ax tests have been failed since r186692
        https://bugs.webkit.org/show_bug.cgi?id=146887

        Reviewed by Mario Sanchez Prada.

        The tests were failing because there are now two WebCore accessibility
        roles which need to implement the AtkTable interface: TableRole and
        GridRole. Because the latter was not added in r186692, any tests with
        ARIA role grid that accessed cells via coordinates stopped working.

        No new tests; instead unskipped all the broken table tests which now pass.

        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (getInterfaceMaskFromObject):

2015-12-08  Gwang Yoon Hwang  <yoon@igalia.com>

        [ThreadedCompositor] Add support for Cairo GL-backed ImageBuffer.
        https://bugs.webkit.org/show_bug.cgi?id=151986

        Reviewed by Žan Doberšek.

        This patch adds a support for accelerated 2d canvas which uses cairo-gl as its
        backend to the threaded compositor. Basically, it applies same way to support
        WebGL for the threaded compositor.

        Unfortunately, we cannot swap the buffer for the accelerated 2d canvas because
        it should preserve the buffer of the previous frame when drawing new contents.
        Because of that, the surface of the accelerated 2d canvas will be copied for
        each frame.

        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBufferData::ImageBufferData):
        (WebCore::ImageBufferData::createCompositorBuffer): Prepare a texture
        surface to push the rendered result to the compositing thread.
        (WebCore::ImageBufferData::swapBuffersIfNeeded): Copies the contents
        of the canvas's surface to the compositing texture.
        (WebCore::ImageBufferData::createCairoGLSurface): Moved to the inside
        of ImageBufferData.

2015-12-08  Joanmarie Diggs  <jdiggs@igalia.com>

        [GTK] 15 accessibility tests fail since r186692.
        https://bugs.webkit.org/show_bug.cgi?id=148938

        Reviewed by Mario Sanchez Prada.

        Failing tests rebaselined.

        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (atkRole): Treat GridCellRole and CellRole the same.
        (roleIsTextType): Treat GridCellRole and CellRole the same.

2015-12-08  Frederic Wang  <fred.wang@free.fr>

        [cairo] Solid stroke of lines with thickness less than 1 pixel broken after r191658
        https://bugs.webkit.org/show_bug.cgi?id=151947

        Reviewed by Martin Robinson.

        Test: mathml/presentation/radical-bar-visibility.html

        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::drawLine): Force a minimal thickness of 1px

2015-12-08  Gwang Yoon Hwang  <yoon@igalia.com>

        [ThreadedCompositor] Support WebGL for OpenGL.
        https://bugs.webkit.org/show_bug.cgi?id=143300

        Reviewed by Žan Doberšek.

        To remove pixel transfer operation, this patch adds m_compositorFBO which uses same depth and stencil
        buffer with m_fbo but uses m_compositorTexture as a color attachment in GraphicsContext3D.
        Because switching target framebuffer is cheaper than pixel transfer operation and switching color
        attachment of m_fbo. In Threaded Compositor, when WebGL renders a scene, prepareTexture swaps
        m_fbo with m_compositorFBO and send the color attachment to the compositor thread.
        This patch only supports WebGL for OpenGL. OpenGLES will be covered in following-up patches.

        No new tests needed.

        * platform/graphics/GraphicsContext3D.h:
        * platform/graphics/GraphicsContext3DPrivate.cpp:
        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
        (WebCore::GraphicsContext3DPrivate::proxy):
        (WebCore::GraphicsContext3DPrivate::swapBuffersIfNeeded):
        Implement interfaces to pass a rendered texture to the compositing
        thread.
        * platform/graphics/GraphicsContext3DPrivate.h:
        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
        (WebCore::GraphicsContext3D::GraphicsContext3D):
        (WebCore::GraphicsContext3D::~GraphicsContext3D):
        Create additional compositing texture and FBO to swaping buffers for
        threaded compositor.
        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
        (WebCore::GraphicsContext3D::reshapeFBOs):
        (WebCore::GraphicsContext3D::attachDepthAndStencilBufferIfNeeded):
        Split attaching depth and stencil buffer codes from reshapeFBOs
        to make complete framebuffer with not only m_fbo but m_compositorFBO also.
        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
        (WebCore::GraphicsContext3D::prepareTexture):
        If we are in the threaded compositor, we will swap m_fbo with
        m_compositorFBO instead of copying it.

2015-12-07  Zalan Bujtas  <zalan@apple.com>

        Make paintTextWithShadows a member function (TextPainter).
        https://bugs.webkit.org/show_bug.cgi?id=151979

        Reviewed by Simon Fraser.

        This patch also simplifies paintTextWithShadows and
        rearranges some of the functions' arguments. 

        No change in functionality.

        * rendering/TextPainter.cpp:
        (WebCore::TextPainter::drawTextOrEmphasisMarks):
        (WebCore::TextPainter::paintTextWithShadows):
        (WebCore::TextPainter::paintEmphasisMarksIfNeeded):
        (WebCore::TextPainter::paintTextWithStyle):
        (WebCore::TextPainter::paintText):
        (WebCore::drawTextOrEmphasisMarks): Deleted.
        (WebCore::paintTextWithShadows): Deleted.
        * rendering/TextPainter.h:

2015-12-07  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/factory-deletedatabase.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=151966

        Reviewed by Sam Weinig.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::onDeleteDatabaseSuccess): The spec says that the result of
          deleteDatabase should be undefined. Without explicitly making it undefined, it's incorrectly null.

2015-12-07  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/cursor-continue-validity.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=151961

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        When an index cursor's iterator was invalidated, there were some cases where it did 
        not correctly find the next iterator to pick up where it left off.

        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::update):
        (WebCore::IDBClient::IDBCursor::deleteFunction):
        
        * Modules/indexeddb/server/IndexValueStore.cpp:
        (WebCore::IDBServer::IndexValueStore::find):
        (WebCore::IDBServer::IndexValueStore::loggingString):
        * Modules/indexeddb/server/IndexValueStore.h:

2015-12-07  Zalan Bujtas  <zalan@apple.com>

        Refactor TextPainter::paintText() into sub methods.
        https://bugs.webkit.org/show_bug.cgi?id=151962

        Reviewed by Myles C. Maxfield.

        No change in functionality.

        * rendering/TextPainter.cpp:
        (WebCore::TextPainter::paintTextWithEmphasisIfNeeded):
        (WebCore::TextPainter::paintTextWithStyle):
        (WebCore::TextPainter::paintText):
        * rendering/TextPainter.h:

2015-12-07  Gwang Yoon Hwang  <yoon@igalia.com>

        [GTK] Clean up virtual functions in MediaPlayerPrivateGStreamerBase
        https://bugs.webkit.org/show_bug.cgi?id=151940

        Reviewed by Carlos Garcia Campos.

        - Using 'override' when appropriate
        - Explicitly marking methods as virtual when they are inherently virtual

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:

2015-12-07  Saam barati  <sbarati@apple.com>

        Add op_watchdog opcode that is generated when VM has a watchdog
        https://bugs.webkit.org/show_bug.cgi?id=151954

        Reviewed by Mark Lam.

        No new tests because JSC already has tests for this.

        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::scheduleExecutionTermination):
        (WebCore::WorkerScriptController::isTerminatingExecution):

2015-12-07  Brian Burg  <bburg@apple.com>

        Web Inspector: Uncaught Exception page should have better styles and handle more error cases
        https://bugs.webkit.org/show_bug.cgi?id=151923

        Reviewed by Timothy Hatcher.

        Add a check for InspectorFrontendAPI before calling it. This can fail
        easily if an uncaught exception stalls initial loading, or whenever
        the Inspector frontend is reloaded.

        * inspector/InspectorFrontendClientLocal.cpp:
        (WebCore::InspectorFrontendClientLocal::evaluateOnLoad):

2015-12-07  Beth Dakin  <bdakin@apple.com>

        Hook up request and show for typing candidates in WK1
        https://bugs.webkit.org/show_bug.cgi?id=151831
        -and corresponding-
        <rdar://problem/23751214>

        Reviewed by Enrica Casucci.

        New SPI that is needed.
        * WebCore.xcodeproj/project.pbxproj:
        * platform/spi/mac/NSSpellCheckerSPI.h: Added.

        Request candidates for editable content whenever selection changes.
        * editing/Editor.cpp:
        (WebCore::Editor::respondToChangedSelection):

        Implement requestCandidatesForSelection on the EditorClient.
        * loader/EmptyClients.h:
        * page/EditorClient.h:
        (WebCore::EditorClient::requestCandidatesForSelection):

2015-12-07  Brady Eidson  <beidson@apple.com>

        Modern IDB: Fix "old versions" when upgrading databases.
        https://bugs.webkit.org/show_bug.cgi?id=151948

        Reviewed by Alex Christensen.

        No new tests (5 failing tests now pass, and updated results for a 6th test).

        This includes the old version on the IDBVersionChangeEvent, as well as the version the 
        IDBDatabase is left with if the version change transaction is aborted.

        Primary mechanism of the fix is to include the original IDBDatabaseInfo along with 
        IDBTransactionInfos that represent version change transactions.

        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::willAbortTransaction):
        (WebCore::IDBClient::IDBDatabase::didAbortTransaction):

        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::onUpgradeNeeded):

        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::IDBTransaction): Deleted.
        (WebCore::IDBClient::IDBTransaction::finishAbortOrCommit): Deleted.
        * Modules/indexeddb/client/IDBTransactionImpl.h:
        (WebCore::IDBClient::IDBTransaction::info):
        (WebCore::IDBClient::IDBTransaction::originalDatabaseInfo):

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::startVersionChangeTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::commitTransaction):
        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::createVersionChangeTransaction):

        * Modules/indexeddb/shared/IDBTransactionInfo.cpp:
        (WebCore::IDBTransactionInfo::versionChange):
        (WebCore::IDBTransactionInfo::IDBTransactionInfo):
        (WebCore::IDBTransactionInfo::isolatedCopy):
        * Modules/indexeddb/shared/IDBTransactionInfo.h:
        (WebCore::IDBTransactionInfo::originalDatabaseInfo):

2015-12-07  Nikos Andronikos  <nikos.andronikos-webkit@cisra.canon.com.au>

        Update Objective-C code generator to pass a reference to calling object for partial interfaces
        https://bugs.webkit.org/show_bug.cgi?id=151739

        Reviewed by Darin Adler.

        The fix updates the Objective-C code generator to pass a reference to calling object for partial interfaces.
        The change from pass by pointer to pass by reference was introduced in r192849.

        * bindings/scripts/CodeGeneratorObjC.pm:
        (GenerateImplementation):
        * bindings/scripts/test/ObjC/DOMTestInterface.mm:
        (-[DOMTestInterface supplementalStr1]):
        (-[DOMTestInterface supplementalStr2]):
        (-[DOMTestInterface setSupplementalStr2:]):
        (-[DOMTestInterface supplementalStr3]):
        (-[DOMTestInterface setSupplementalStr3:]):
        (-[DOMTestInterface supplementalNode]):
        (-[DOMTestInterface setSupplementalNode:]):
        (-[DOMTestInterface builtinAttribute]):
        (-[DOMTestInterface setBuiltinAttribute:]):
        (-[DOMTestInterface supplementalMethod1]):
        (-[DOMTestInterface supplementalMethod2:objArg:]):
        (-[DOMTestInterface supplementalMethod3]):
        (-[DOMTestInterface supplementalMethod4]):
        (-[DOMTestInterface builtinFunction]):

2015-12-07  Chris Dumez  <cdumez@apple.com>

        Crash in MemoryCache::pruneDeadResourcesToSize()
        https://bugs.webkit.org/show_bug.cgi?id=151833
        <rdar://problem/22392235>

        Reviewed by David Kilzer.

        MemoryCache::pruneDeadResourcesToSize() is iterating over m_allResources
        (which is a vector of LRUList). It first destroys decoded data for each
        resource in the LRUList. Then, if it does not suffice to reach the
        target size, and starts actually removing resources from the cache.

        The issue is that this code alters m_allResources (and its LRULists) as
        it is iterating over it. We tried to deal with this in various ways:
        1. Increment the iterator before removing the resource pointed by the
          iterator.
        2. Protect the next resource in the LRUList and abort early if it is no
          longer in the cache.

        This adds code complexity and apparently does not correctly handle all
        the edge cases as we still see crashes in this code. In particular, I
        suspect that 2. may not be sufficient if it is possible for the next
        resource to be moved to another LRUList (in which case, next->inCache()
        would still return true but the iterator would however become invalid).

        To make the code simpler and more robust, this patch copies the LRUList
        (and refs the CachedResources) before iterating over it. This is a lot
        safer and should hopefully fix the crashes we see in this function.

        No new tests, no reproduction case.

        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::pruneDeadResourcesToSize):

2015-12-07  Brady Eidson  <beidson@apple.com>

        Modern IDB: Add some more custom exception messages, passing some more tests..
        https://bugs.webkit.org/show_bug.cgi?id=151912

        Reviewed by Andy Estes.

        No new tests (Covered by existing tests).

        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::index):
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::objectStore):

2015-12-07  Gwang Yoon Hwang  <yoon@igalia.com>

        [ThreadedCompositor] Add support for PlatformLayer.
        https://bugs.webkit.org/show_bug.cgi?id=143299

        Reviewed by Žan Doberšek.

        This patch implements TextureMapperPlatformLayerProxy and TextureMapperPlatformLayerBuffer to
        send a texture (actual texture or BitmapTexture) to the compositing thread directly.
        Platform layer renderers should implement TextureMapperPlatformLayerProxyProvider to establish
        a connection to the compositing thread. After the connection has been established, the renderer
        can render its contents to the TextureMapperPlatformLayerBuffer and pass it to the compositing thread
        via TextureMapperPlatformLayer proxy.
        The buffer can be an unmanaged texture (a.k.a. platform texture) or BitmapTexture.
        For the unmanaged texture, the renderer should manage its life cycle itself. For the BitmapTexture,
        it will be managed by TextureMapperPlatformLayerProxy. In that case, used (swapped) buffer will be
        recycled because the renderer will use same size and format until it changes its size.

        No new tests needed.

        * PlatformGTK.cmake:
        Adds TextureMapperPlatformLayerBuffer and TextureMapperPlaytformLayerProxy.

        * platform/graphics/GraphicsContext3DPrivate.cpp:
        * platform/graphics/GraphicsContext3DPrivate.h:
        * platform/graphics/cairo/ImageBufferCairo.cpp:
        * platform/graphics/cairo/ImageBufferDataCairo.h:
        Adds mock implementation.

        * platform/graphics/PlatformLayer.h:
        Adds TextureMapperPlatformLayerProxyProvider as a PlatformLayer for the Threaded Compositor

        * platform/graphics/texmap/BitmapTextureGL.h:
        (WebCore::BitmapTextureGL::internalFormat): Adds a getter to check the
        internal format of texture to check reusability.

        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
        * platform/graphics/texmap/TextureMapperLayer.cpp:
        * platform/graphics/texmap/TextureMapperLayer.h:
        Exclude GraphicsLayerTextureMapper from build when we are using Coordinated Graphics.

        * platform/graphics/texmap/TextureMapperPlatformLayerBuffer.cpp: Added.
        * platform/graphics/texmap/TextureMapperPlatformLayerBuffer.h: Added.
        * platform/graphics/texmap/TextureMapperPlatformLayerProxy.cpp: Added.
        * platform/graphics/texmap/TextureMapperPlatformLayerProxy.h: Added.

        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
        (WebCore::GraphicsLayer::create):
        Because we removed GraphicsLayerTextureMapper from build, we need to add own factory function.

        (WebCore::CoordinatedGraphicsLayer::setContentsToPlatformLayer):
        (WebCore::CoordinatedGraphicsLayer::syncPlatformLayer):
        (WebCore::CoordinatedGraphicsLayer::platformLayerWillBeDestroyed):
        (WebCore::CoordinatedGraphicsLayer::setPlatformLayerNeedsDisplay):
        Implements sync operations for TextureMapperPlatformLayerProxy

2015-12-07  Gwang Yoon Hwang  <yoon@igalia.com>

        Fix GTK+ build with GStreamer GL
        https://bugs.webkit.org/show_bug.cgi?id=151939

        Reviewed by Žan Doberšek.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
        (WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
        (WebCore::MediaPlayerPrivateGStreamerBase::drawCallback):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:

2015-12-06  Simon Fraser  <simon.fraser@apple.com>

        Show more information about SVG renderers in showLayerTree() output
        https://bugs.webkit.org/show_bug.cgi?id=151930

        Reviewed by Zalan Bujtas.
        
        In showLayerTree() output, for SVG renderers show:
        - visual and layout overflow, for boxes
        - frame rect, for boxes
        - layout state
        - class and id

        * rendering/RenderLayer.cpp:
        (WebCore::showLayerTree):
        * rendering/RenderTreeAsText.cpp:
        (WebCore::RenderTreeAsText::writeRenderObject):
        (WebCore::writeDebugInfo): New function to share dumping with svg output.
        (WebCore::write):
        * rendering/RenderTreeAsText.h:
        * rendering/svg/SVGRenderTreeAsText.cpp:
        (WebCore::writePositionAndStyle): Show the frameRect for boxes (e.g. RenderSVGRoot).
        Much more useful that showing the clippedOverflowRect.
        (WebCore::writeStandardPrefix):
        (WebCore::writeChildren):
        (WebCore::writeSVGResourceContainer):
        (WebCore::writeSVGContainer):
        (WebCore::write):
        (WebCore::writeSVGText):
        (WebCore::writeSVGInlineText):
        (WebCore::writeSVGImage):
        (WebCore::writeSVGGradientStop):
        (WebCore::writeResources):
        (WebCore::operator<<): Deleted.
        * rendering/svg/SVGRenderTreeAsText.h:

2015-12-06  Simon Fraser  <simon.fraser@apple.com>

        Clipping along compositing borders in svg-edit
        https://bugs.webkit.org/show_bug.cgi?id=151791

        Reviewed by Zalan Bujtas.
        
        RenderSVGRoot::layout() failed to clear overflow before recomputing
        visual overflow, which could cause it to get stuck with stale overflow.
        This would cause underpainting if its size went from small to large.

        Test: svg/overflow/visual-overflow-change.html

        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::layout):

2015-12-06  Simon Fraser  <simon.fraser@apple.com>

        REGRESSION (r187121): Can't get to the main content of the page at https://theintercept.com/drone-papers/
        https://bugs.webkit.org/show_bug.cgi?id=151849
        rdar://problem/23132828

        Reviewed by Zalan Bujtas.
        
        This page uses a fill-forwards animation where the last keyframe has height: auto.
        After r187121, we tried to blend the height Length value from the last keyframe to the
        first keyframe with progress=0 (which should pick up the 'auto' from the last keyframe).
        
        However, Length::blend() just considered both 0 and 'auto' to be zero, and returned
        the 0 length.
        
        So fix Length::blend() to return the "from" length if progress is zero.

        Test: animations/fill-forwards-auto-height.html

        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::blendFunc): Length::blend takes a double, so don't narrow to float.
        * page/animation/KeyframeAnimation.cpp:
        (WebCore::KeyframeAnimation::fetchIntervalEndpointsForProperty): Declare two variables
        at first use.
        * platform/Length.h:
        (WebCore::Length::blend):

2015-12-06  Simon Fraser  <simon.fraser@apple.com>

        Give SVGTransformList some inline vector capacity
        https://bugs.webkit.org/show_bug.cgi?id=151644

        Reviewed by Andreas Kling.

        Giving SVGTransformList inline capacity of one drops time under SVGTransformList::parse() by
        about 1% on http://animateplus.com/demos/stress-test/

        * svg/SVGTransformList.h:

2015-12-06  Zalan Bujtas  <zalan@apple.com>

        Addressing post-review comments on r193374.

        Reviewed by Antti Koivisto.

        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::canUseForText):
        (WebCore::SimpleLineLayout::canUseForFontAndText):
        (WebCore::SimpleLineLayout::canUseForStyle):
        (WebCore::SimpleLineLayout::canUseForWithReason):
        (WebCore::SimpleLineLayout::canUseFor):
        (WebCore::SimpleLineLayout::printSimpleLineLayoutBlockList):
        (WebCore::SimpleLineLayout::printSimpleLineLayoutCoverage):

2015-12-04  Myles C. Maxfield  <mmaxfield@apple.com>

        Remove CORETEXT_WEB_FONTS
        https://bugs.webkit.org/show_bug.cgi?id=151891

        Reviewed by Simon Fraser.

        The only platform where this was turned off (Mavericks) is no longer supported.

        No new tests because there is no behavior difference.

        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::Font::platformCreateScaledFont): Deleted.
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore::FontPlatformData::registeredFont):
        (WebCore::FontPlatformData::ctFont):
        * platform/graphics/mac/FontCustomPlatformData.cpp:
        (WebCore::FontCustomPlatformData::fontPlatformData): Deleted.
        (WebCore::createFontCustomPlatformData): Deleted.
        * platform/graphics/mac/FontCustomPlatformData.h:
        (WebCore::FontCustomPlatformData::FontCustomPlatformData): Deleted.
        * platform/text/TextFlags.h:

2015-12-04  Zalan Bujtas  <zalan@apple.com>

        Garbage in page tiles when document is too long.
        https://bugs.webkit.org/show_bug.cgi?id=151906
        rdar://problem/23695858

        Reviewed by Simon Fraser.

        This patch partially fixes the broken concept(webkit.org/b/151908) of having a nearlyMax/2 sized rectangle to define infiniteness.
        (see LayoutRect::infiniteRect() and ClipRect::isInfinite())

        Covered by existing test.

        * rendering/ClipRect.h: Branch for infinite clipping.
        (WebCore::ClipRect::intersect):
        (WebCore::ClipRect::intersects):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::clipToRect): Do not clip when clipping is infinite.
        (WebCore::RenderLayer::restoreClip):
        (WebCore::RenderLayer::calculateClipRects):

2015-12-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: Add some more custom exception messages, passing some more tests.
        https://bugs.webkit.org/show_bug.cgi?id=151898

        Reviewed by Alex Christensen.

        No new tests (Some failing tests now pass).

        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::objectStore):

2015-12-04  Brent Fulgham  <bfulgham@apple.com>

        Place an upper bound on canvas pixel count
        https://bugs.webkit.org/show_bug.cgi?id=151825
        <rdar://problem/23324916>

        Reviewed by Simon Fraser.

        Malformed JavaScript can attempt to create lots of canvas contexts. Limit the amount of memory
        we will use for this purpose to some percentage of system RAM.

        * html/HTMLCanvasElement.cpp:
        (WebCore::removeFromActivePixelMemory): Added helper function
        (WebCore::HTMLCanvasElement::~HTMLCanvasElement): Call new 'releaseImageBufferAndContext' method
        to ensure ImageBuffer and graphics context state are properly cleaned up.
        (WebCore::maxActivePixels): Use one quarter of the system RAM, or 1 GB (whichever is more) as
        an upper bound on active pixel memory.
        (WebCore::HTMLCanvasElement::getContext): If we are attempting to create a context that will cause
        us to exceed the allowed active pixel count, fail.
        (WebCore::HTMLCanvasElement::releaseImageBufferAndContext): Added helper function
        (WebCore::HTMLCanvasElement::setSurfaceSize): Use the new 'releaseImageBufferAndContext' method
        to handle active pixel memory counts.
        (WebCore::HTMLCanvasElement::createImageBuffer): Refuse to create a backing buffer if it will
        exceed our available pixel memory.

2015-12-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: Add some more custom exception messages, passing some more tests.
        https://bugs.webkit.org/show_bug.cgi?id=151895

        Reviewed by Alex Christensen.

        No new tests (Some failing tests now pass).

        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::transaction):

        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::deleteIndex):

2015-12-04  Jonathan Davis  <jond@apple.com>

        Update feature status for up-to-date status information.
        https://bugs.webkit.org/show_bug.cgi?id=151821

        Reviewed by Timothy Hatcher.

        * features.json:

2015-12-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: Flip test expectations around so we only list failures.
        https://bugs.webkit.org/show_bug.cgi?id=151880

        Reviewed by Alex Christensen.

        No new tests (Covered by all existing tests).

        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::stop):
        (WebCore::IDBClient::IDBRequest::enqueueEvent):
        (WebCore::IDBClient::IDBRequest::dispatchEvent):
        * Modules/indexeddb/client/IDBRequestImpl.h:
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::abortDueToFailedRequest):
        (WebCore::IDBClient::IDBTransaction::hasPendingActivity):
        (WebCore::IDBClient::IDBTransaction::stop):
        (WebCore::IDBClient::IDBTransaction::enqueueEvent):
        (WebCore::IDBClient::IDBTransaction::dispatchEvent):
        * Modules/indexeddb/client/IDBTransactionImpl.h:
        
        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::idbKeyToScriptValue): Protection against a ScriptExecutionContext that no longer has an ExecState.
          A full reworking on the binding utilities to prevent this through is covered by b/151890

2015-12-04  Myles C. Maxfield  <mmaxfield@apple.com>

        [Cocoa] Some fonts cause CTFontCopyAvailableTables() to return nullptr
        https://bugs.webkit.org/show_bug.cgi?id=151884
        <rdar://problem/23752253>

        Reviewed by Brian Burg.

        No new tests.

        * platform/graphics/opentype/OpenTypeCG.cpp:
        (WebCore::OpenType::fontHasMathTable):

2015-12-04  Jer Noble  <jer.noble@apple.com>

        Unreviewed build-fix; Add new parameter to overloaded createSession() method in MediaPlayerPrivateAVFoundationCF.

        * platform/graphics/avfoundation/cf/CDMSessionAVFoundationCF.cpp:
        (WebCore::CDMSessionAVFoundationCF::CDMSessionAVFoundationCF):
        * platform/graphics/avfoundation/cf/CDMSessionAVFoundationCF.h:
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::MediaPlayerPrivateAVFoundationCF::createSession):
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:

2015-12-01  Jer Noble  <jer.noble@apple.com>

        Adopt AVContentKeySession
        https://bugs.webkit.org/show_bug.cgi?id=151221

        Reviewed by Eric Carlson.

        Adopt a new API for managing key state, AVContentKeySession. Because this necessitates a change
        in both the initialization data returned by the needkey event, and passed into the createSession()
        method, bump the protocol version number (to 3), and keep supporting the old key management API
        for legacy content.

        To do so, move most of the implementation of CDMPrivateMediaSourceAVFObjC into a new subclass,
        CDMSessionAVStreamSession, and add a new subclass, CDMSessionAVContentKeySession, to support the
        new API.

        * platform/graphics/avfoundation/CDMPrivateMediaSourceAVFObjC.h:
        (WebCore::CDMPrivateMediaSourceAVFObjC::CDMPrivateMediaSourceAVFObjC): Moved to implementation file.
        * platform/graphics/avfoundation/CDMPrivateMediaSourceAVFObjC.mm:
        (WebCore::validKeySystemRE): Support "com.apple.fps.3_x".
        (WebCore::CDMPrivateMediaSourceAVFObjC::~CDMPrivateMediaSourceAVFObjC): Invalidate all outstanding sessions.
        (WebCore::CDMPrivateMediaSourceAVFObjC::supportsKeySystem): Only support "com.apple.fps.3_x" if the AVContentKeySession class is available.
        (WebCore::CDMPrivateMediaSourceAVFObjC::createSession): Create an instance of CDMSessionAVContentKeySession if "com.apple.fps.3_x" is specified and AVContentKeySession is available.
        (WebCore::CDMPrivateMediaSourceAVFObjC::invalidateSession): Remove session from the list of outstanding sessions.
        (WebCore::CDMPrivateMediaSourceAVFObjC::supportsMIMEType): Deleted.
        * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.h: Copied from Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.h.
        (WebCore::CDMSessionAVContentKeySession::hasContentKeySession): Simple accessor.
        (WebCore::toCDMSessionAVContentKeySession): Safe casting.
        * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm: Added.
        (-[CDMSessionAVContentKeySessionDelegate initWithParent:]): Simple constructor.
        (-[CDMSessionAVContentKeySessionDelegate invalidate]): Remove reference to parent.
        (-[CDMSessionAVContentKeySessionDelegate contentKeySession:willProvideKeyRequestInitializationDataForTrackID:]): Pass to parent.
        (-[CDMSessionAVContentKeySessionDelegate contentKeySession:didProvideKeyRequestInitializationData:requestHandling:]): Ditto.
        (-[CDMSessionAVContentKeySessionDelegate contentKeySessionContentProtectionSessionIdentifierDidChange:]): Ditto.
        (WebCore::CDMSessionAVContentKeySession::CDMSessionAVContentKeySession): Create the delegate.
        (WebCore::CDMSessionAVContentKeySession::~CDMSessionAVContentKeySession): Invalidate the delegate and remove all parsers.
        (WebCore::CDMSessionAVContentKeySession::isAvailable): Return true if AVContentKeySession class is available.
        (WebCore::CDMSessionAVContentKeySession::generateKeyRequest): Support "keyrelease" message, setting of the certificate, and creating key request object. 
        (WebCore::CDMSessionAVContentKeySession::releaseKeys): Retrieve keys from storage location.
        (WebCore::isEqual): Compares a Uint8Array to a char*.
        (WebCore::CDMSessionAVContentKeySession::update): Support "acknowledged" message, "renew" message, and key addition.
        (WebCore::CDMSessionAVContentKeySession::addParser): Add the parser to the AVContentKeySession.
        (WebCore::CDMSessionAVContentKeySession::removeParser): Remove parser from same.
        (WebCore::CDMSessionAVContentKeySession::generateKeyReleaseMessage): Retrieve key release message from AVContentKeySession.
        (WebCore::CDMSessionAVContentKeySession::didProvideContentKeyRequest): Simple setter.
        (WebCore::CDMSessionAVContentKeySession::contentKeySession): Lazily create the AVContentKeySession.
        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm:
        (WebCore::CDMSessionAVFoundationObjC::CDMSessionAVFoundationObjC):
        * platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.h: Copied from Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.h.
        (WebCore::toCDMSessionAVStreamSession):
        * platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.mm: Copied from Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm.
        (-[CDMSessionAVStreamSessionObserver initWithParent:]): Moved from CDMSessionMediaSourceAVFObjcObserver.
        (-[CDMSessionAVStreamSessionObserver contentProtectionSessionIdentifierChanged:]): Ditto.
        (WebCore::CDMSessionAVStreamSession::CDMSessionAVStreamSession): Ditto.
        (WebCore::CDMSessionAVStreamSession::~CDMSessionAVStreamSession): Ditto.
        (WebCore::CDMSessionAVStreamSession::generateKeyRequest): Ditto.
        (WebCore::CDMSessionAVStreamSession::releaseKeys): Ditto.
        (WebCore::isEqual): Ditto.
        (WebCore::CDMSessionAVStreamSession::update): Ditto.
        (WebCore::CDMSessionAVStreamSession::setStreamSession): Ditto.
        (WebCore::CDMSessionAVStreamSession::addParser): Ditto.
        (WebCore::CDMSessionAVStreamSession::removeParser): Ditto.
        (WebCore::CDMSessionAVStreamSession::generateKeyReleaseMessage): Ditto.
        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.h:
        (WebCore::CDMSessionMediaSourceAVFObjC::invalidateCDM): Clear the m_cdm.
        (WebCore::toCDMSessionMediaSourceAVFObjC):
        * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm:
        (WebCore::CDMSessionMediaSourceAVFObjC::CDMSessionMediaSourceAVFObjC):
        (WebCore::CDMSessionMediaSourceAVFObjC::~CDMSessionMediaSourceAVFObjC): Instruct our CDM to invalidate their references to us.
        (WebCore::CDMSessionMediaSourceAVFObjC::addSourceBuffer): Call addParser().
        (WebCore::CDMSessionMediaSourceAVFObjC::removeSourceBuffer): Call removeParser().
        (WebCore::CDMSessionMediaSourceAVFObjC::layerDidReceiveError): Deleted.
        (WebCore::CDMSessionMediaSourceAVFObjC::rendererDidReceiveError): Deleted.
        
        To give us a chance to create a CDMPrivate before we continue decoding media data, "block" further decoding
        on the background thread by creating a semaphore and passing it to the main thread, to be triggered when
        a CDM is created and attached to this source buffer.

        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
        (-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]):
        (WebCore::SourceBufferPrivateAVFObjC::~SourceBufferPrivateAVFObjC):
        (WebCore::SourceBufferPrivateAVFObjC::willProvideContentKeyRequestInitializationDataForTrackID):
        (WebCore::SourceBufferPrivateAVFObjC::didProvideContentKeyRequestInitializationDataForTrackID):
        (WebCore::SourceBufferPrivateAVFObjC::setCDMSession):
        (-[WebAVStreamDataParserListener streamDataParserWillProvideContentKeyRequestInitializationData:forTrackID:]): Deleted.
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:

        Drive-by fix: Only throw an error from keyRequestTimerFired() if the underlying call to
        generateKeyRequest() returned an error, rather than just failed to create a message.

        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::keyRequestTimerFired):

        Drive-by fix: Pass the CDMSessionClient into CDM::createSession() so that it is immediately available
        in the CDMSessionPrivate constructor, rather than setting the client immediately after construction.

        * Modules/encryptedmedia/CDM.cpp:
        (WebCore::CDM::createSession):
        * Modules/encryptedmedia/CDM.h:
        * Modules/encryptedmedia/CDMPrivate.h:
        * Modules/encryptedmedia/CDMPrivateClearKey.cpp:
        (WebCore::CDMPrivateClearKey::createSession):
        * Modules/encryptedmedia/CDMPrivateClearKey.h:
        * Modules/encryptedmedia/CDMPrivateMediaPlayer.cpp:
        (WebCore::CDMPrivateMediaPlayer::createSession):
        * Modules/encryptedmedia/CDMPrivateMediaPlayer.h:
        * Modules/encryptedmedia/CDMSessionClearKey.cpp:
        (WebCore::CDMSessionClearKey::CDMSessionClearKey):
        * Modules/encryptedmedia/CDMSessionClearKey.h:
        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::MediaKeySession):
        * platform/graphics/CDMSession.h:
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::createSession):
        * platform/graphics/MediaPlayer.h:
        * platform/graphics/MediaPlayerPrivate.h:
        (WebCore::MediaPlayerPrivateInterface::createSession):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createSession):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::cdmSession):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setCDMSession):
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::keyNeeded): Deleted.
        * testing/MockCDM.cpp:
        (WebCore::MockCDM::createSession):
        (WebCore::MockCDMSession::MockCDMSession):
        * testing/MockCDM.h:

        Add new files to the project:

        * WebCore.xcodeproj/project.pbxproj:


2015-12-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/cursor-update.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=151879

        Reviewed by Oliver Hunt.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::IDBRequest):

2015-12-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/version-change-exclusive.html fails
        https://bugs.webkit.org/show_bug.cgi?id=151870

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/double-open.html
              storage/indexeddb/version-change-exclusive.html

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::openDatabaseConnection): Delay handling open operations
          while the first is still in progress.
        (WebCore::IDBServer::UniqueIDBDatabase::didOpenBackingStore):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2015-12-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/exceptions.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=151732

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        - Lots of customized exception messages for IDB code to match the text expectations.
        - Updates to the test expectations where we can't/won't match them exactly.
        - And a couple of little required behavior changes exposed by the test

        * Modules/indexeddb/IDBCursor.h:
        * Modules/indexeddb/IDBCursor.idl:
        * Modules/indexeddb/IDBDatabase.h:
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBDatabaseException.cpp:
        (WebCore::IDBDatabaseException::initializeDescription):
        * Modules/indexeddb/IDBFactory.h:
        * Modules/indexeddb/IDBFactory.idl:
        * Modules/indexeddb/IDBIndex.h:
        * Modules/indexeddb/IDBIndex.idl:
        * Modules/indexeddb/IDBObjectStore.h:
        * Modules/indexeddb/IDBObjectStore.idl:
        * Modules/indexeddb/IDBRequest.h:
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.h:
        * Modules/indexeddb/IDBTransaction.idl:
        
        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::update):
        (WebCore::IDBClient::IDBCursor::advance):
        (WebCore::IDBClient::IDBCursor::continueFunction):
        (WebCore::IDBClient::IDBCursor::deleteFunction):
        * Modules/indexeddb/client/IDBCursorImpl.h:
        
        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::createObjectStore):
        (WebCore::IDBClient::IDBDatabase::transaction):
        (WebCore::IDBClient::IDBDatabase::deleteObjectStore):
        * Modules/indexeddb/client/IDBDatabaseImpl.h:
        
        * Modules/indexeddb/client/IDBFactoryImpl.cpp:
        (WebCore::IDBClient::IDBFactory::cmp):
        * Modules/indexeddb/client/IDBFactoryImpl.h:
        
        * Modules/indexeddb/client/IDBIndexImpl.cpp:
        (WebCore::IDBClient::IDBIndex::openCursor):
        (WebCore::IDBClient::IDBIndex::count):
        (WebCore::IDBClient::IDBIndex::doCount):
        (WebCore::IDBClient::IDBIndex::openKeyCursor):
        (WebCore::IDBClient::IDBIndex::get):
        (WebCore::IDBClient::IDBIndex::doGet):
        (WebCore::IDBClient::IDBIndex::getKey):
        (WebCore::IDBClient::IDBIndex::doGetKey):
        * Modules/indexeddb/client/IDBIndexImpl.h:
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::openCursor):
        (WebCore::IDBClient::IDBObjectStore::get):
        (WebCore::IDBClient::IDBObjectStore::add):
        (WebCore::IDBClient::IDBObjectStore::put):
        (WebCore::IDBClient::IDBObjectStore::putForCursorUpdate):
        (WebCore::IDBClient::IDBObjectStore::putOrAdd):
        (WebCore::IDBClient::IDBObjectStore::deleteFunction):
        (WebCore::IDBClient::IDBObjectStore::clear):
        (WebCore::IDBClient::IDBObjectStore::createIndex):
        (WebCore::IDBClient::IDBObjectStore::index):
        (WebCore::IDBClient::IDBObjectStore::deleteIndex):
        (WebCore::IDBClient::IDBObjectStore::count):
        (WebCore::IDBClient::IDBObjectStore::doCount):
        * Modules/indexeddb/client/IDBObjectStoreImpl.h:

        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::result):
        (WebCore::IDBClient::IDBRequest::error):
        * Modules/indexeddb/client/IDBRequestImpl.h:

        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::objectStore):
        (WebCore::IDBClient::IDBTransaction::abortDueToFailedRequest):
        (WebCore::IDBClient::IDBTransaction::abort):
        * Modules/indexeddb/client/IDBTransactionImpl.h:

        * Modules/indexeddb/legacy/LegacyCursor.cpp:
        (WebCore::LegacyCursor::update):
        (WebCore::LegacyCursor::continueFunction):
        (WebCore::LegacyCursor::deleteFunction):
        * Modules/indexeddb/legacy/LegacyCursor.h:

        * Modules/indexeddb/legacy/LegacyDatabase.cpp:
        (WebCore::LegacyDatabase::createObjectStore):
        (WebCore::LegacyDatabase::deleteObjectStore):
        (WebCore::LegacyDatabase::transaction):
        (WebCore::LegacyDatabase::forceClose):
        * Modules/indexeddb/legacy/LegacyDatabase.h:

        * Modules/indexeddb/legacy/LegacyFactory.cpp:
        (WebCore::LegacyFactory::cmp):
        * Modules/indexeddb/legacy/LegacyFactory.h:

        * Modules/indexeddb/legacy/LegacyIndex.cpp:
        (WebCore::LegacyIndex::openCursor):
        (WebCore::LegacyIndex::count):
        (WebCore::LegacyIndex::openKeyCursor):
        (WebCore::LegacyIndex::get):
        (WebCore::LegacyIndex::getKey):
        * Modules/indexeddb/legacy/LegacyIndex.h:

        * Modules/indexeddb/legacy/LegacyObjectStore.cpp:
        (WebCore::LegacyObjectStore::get):
        (WebCore::LegacyObjectStore::add):
        (WebCore::LegacyObjectStore::put):
        (WebCore::LegacyObjectStore::deleteFunction):
        (WebCore::LegacyObjectStore::clear):
        (WebCore::LegacyObjectStore::createIndex):
        (WebCore::LegacyObjectStore::index):
        (WebCore::LegacyObjectStore::deleteIndex):
        (WebCore::LegacyObjectStore::openCursor):
        (WebCore::LegacyObjectStore::count):
        * Modules/indexeddb/legacy/LegacyObjectStore.h:
        (WebCore::LegacyObjectStore::createIndex):
        (WebCore::LegacyObjectStore::count):

        * Modules/indexeddb/legacy/LegacyRequest.cpp:
        (WebCore::LegacyRequest::result):
        (WebCore::LegacyRequest::error):
        (WebCore::LegacyRequest::dispatchEvent):
        (WebCore::LegacyRequest::uncaughtExceptionInEventHandler):
        * Modules/indexeddb/legacy/LegacyRequest.h:

        * Modules/indexeddb/legacy/LegacyTransaction.cpp:
        (WebCore::LegacyTransaction::objectStore):
        (WebCore::LegacyTransaction::abort):
        (WebCore::LegacyTransaction::stop):
        * Modules/indexeddb/legacy/LegacyTransaction.h:

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::createDOMException): For IDBDatabase exceptions, use createWithDescriptionAsMessage

        * bindings/js/JSIDBDatabaseCustom.cpp:
        (WebCore::JSIDBDatabase::createObjectStore):
        (WebCore::JSIDBDatabase::transaction):

        * bindings/js/JSIDBObjectStoreCustom.cpp:
        (WebCore::putOrAdd):
        (WebCore::JSIDBObjectStore::createIndex):

        * dom/DOMCoreException.h:
        (WebCore::DOMCoreException::createWithDescriptionAsMessage): Create an exception whose message
          is the description.
        (WebCore::DOMCoreException::DOMCoreException):

        * dom/ExceptionBase.cpp:
        (WebCore::ExceptionBase::ExceptionBase): Add a flag to determine where the message comes from
        * dom/ExceptionBase.h:

        * dom/make_dom_exceptions.pl:
        (generateHeader): Add an IDBDatabaseException type

        * inspector/InspectorIndexedDBAgent.cpp:

2015-12-04  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Remove untested and unused Worker inspection
        https://bugs.webkit.org/show_bug.cgi?id=151848

        Reviewed by Brian Burg.

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/WorkerScriptController.cpp:
        * bindings/js/WorkerScriptDebugServer.cpp: Removed.
        * bindings/js/WorkerScriptDebugServer.h: Removed.
        * inspector/InspectorAllInOne.cpp:
        * inspector/InspectorConsoleInstrumentation.h:
        (WebCore::InspectorInstrumentation::addMessageToConsole):
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController): Deleted.
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::shouldPauseDedicatedWorkerOnStartImpl): Deleted.
        (WebCore::InspectorInstrumentation::didStartWorkerGlobalScopeImpl): Deleted.
        (WebCore::InspectorInstrumentation::willEvaluateWorkerScript): Deleted.
        (WebCore::InspectorInstrumentation::workerGlobalScopeTerminatedImpl): Deleted.
        (WebCore::InspectorInstrumentation::instrumentingAgentsForWorkerGlobalScope): Deleted.
        (WebCore::InspectorInstrumentation::instrumentingAgentsForNonDocumentContext): Deleted.
        * inspector/InspectorInstrumentation.h:
        (WebCore::InspectorInstrumentation::instrumentingAgentsForContext):
        (WebCore::InspectorInstrumentation::shouldPauseDedicatedWorkerOnStart): Deleted.
        (WebCore::InspectorInstrumentation::didStartWorkerGlobalScope): Deleted.
        (WebCore::InspectorInstrumentation::workerGlobalScopeTerminated): Deleted.
        * inspector/InspectorTimelineAgent.h:
        * inspector/InspectorWebAgentBase.h:
        (WebCore::WorkerAgentContext::WorkerAgentContext): Deleted.
        * inspector/InspectorWorkerAgent.cpp: Removed.
        * inspector/InspectorWorkerAgent.h: Removed.
        * inspector/InspectorWorkerResource.h: Removed.
        * inspector/InstrumentingAgents.cpp:
        (WebCore::InstrumentingAgents::reset): Deleted.
        * inspector/InstrumentingAgents.h:
        (WebCore::InstrumentingAgents::workerRuntimeAgent): Deleted.
        (WebCore::InstrumentingAgents::setWorkerRuntimeAgent): Deleted.
        (WebCore::InstrumentingAgents::inspectorWorkerAgent): Deleted.
        (WebCore::InstrumentingAgents::setInspectorWorkerAgent): Deleted.
        * inspector/PageConsoleAgent.h:
        * inspector/PageScriptDebugServer.cpp:
        (WebCore::PageScriptDebugServer::PageScriptDebugServer):
        * inspector/WorkerConsoleAgent.cpp: Removed.
        * inspector/WorkerConsoleAgent.h: Removed.
        * inspector/WorkerDebuggerAgent.cpp: Removed.
        * inspector/WorkerDebuggerAgent.h: Removed.
        * inspector/WorkerInspectorController.cpp: Removed.
        * inspector/WorkerInspectorController.h: Removed.
        * inspector/WorkerRuntimeAgent.cpp: Removed.
        * inspector/WorkerRuntimeAgent.h: Removed.
        * workers/Worker.cpp:
        (WebCore::Worker::notifyFinished): Deleted.
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::WorkerGlobalScope): Deleted.
        (WebCore::WorkerGlobalScope::~WorkerGlobalScope): Deleted.
        * workers/WorkerGlobalScope.h:
        (WebCore::WorkerGlobalScope::workerInspectorController): Deleted.
        * workers/WorkerGlobalScopeProxy.h:
        (WebCore::WorkerGlobalScopeProxy::PageInspector::~PageInspector): Deleted.
        (WebCore::WorkerGlobalScopeProxy::connectToInspector): Deleted.
        (WebCore::WorkerGlobalScopeProxy::disconnectFromInspector): Deleted.
        (WebCore::WorkerGlobalScopeProxy::sendMessageToInspector): Deleted.
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::WorkerMessagingProxy): Deleted.
        (WebCore::WorkerMessagingProxy::startWorkerGlobalScope): Deleted.
        (WebCore::WorkerMessagingProxy::connectToInspector): Deleted.
        (WebCore::WorkerMessagingProxy::disconnectFromInspector): Deleted.
        (WebCore::WorkerMessagingProxy::sendMessageToInspector): Deleted.
        (WebCore::WorkerMessagingProxy::workerGlobalScopeDestroyedInternal): Deleted.
        (WebCore::WorkerMessagingProxy::terminateWorkerGlobalScope): Deleted.
        (WebCore::WorkerMessagingProxy::postMessageToPageInspector): Deleted.
        * workers/WorkerMessagingProxy.h:
        * workers/WorkerReportingProxy.h:
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThread::workerThread): Deleted.

2015-12-03  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Fix height computation of grid items with borders inside fr tracks
        https://bugs.webkit.org/show_bug.cgi?id=151798

        Reviewed by Zalan Bujtas.

        Since r192154 we run a second pass of the track sizing
        algorithm whenever the height of the grid is indefinite in
        order to properly compute row sizes. The available space
        passed to the track sizing algorithm must not contain neither
        borders nor paddings, otherwise it will think that it has more
        space available than the existing one. We should use the
        height of the content box instead.

        Test: fast/css-grid-layout/grid-item-with-border-in-fr.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::layoutBlock):

2015-12-03  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/cursor-index-delete.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=151847

        Reviewed by Andy Estes.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/server/MemoryIndexCursor.cpp:
        (WebCore::IDBServer::MemoryIndexCursor::MemoryIndexCursor):
        (WebCore::IDBServer::MemoryIndexCursor::currentData):

2015-12-03  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Reduce uses of PassRefPtr in DOM - 1
        https://bugs.webkit.org/show_bug.cgi?id=149788

        Reviewed by Darin Adler.

        As a step to purge PassRefPtr, this patch reduces the uses in WebCore/dom.

        * dom/ChildListMutationScope.cpp:
        (WebCore::ChildListMutationAccumulator::getOrCreate):
        * dom/ChildListMutationScope.h:
        * dom/ClipboardEvent.cpp:
        (WebCore::ClipboardEvent::ClipboardEvent):
        * dom/ClipboardEvent.h:
        * dom/CompositionEvent.cpp:
        (WebCore::CompositionEvent::CompositionEvent):
        (WebCore::CompositionEvent::initCompositionEvent):
        * dom/CompositionEvent.h:
        * dom/DOMNamedFlowCollection.cpp:
        (WebCore::DOMNamedFlowCollection::item):
        * dom/DOMNamedFlowCollection.h:
        * dom/DOMStringList.h:
        * dom/DeviceMotionController.cpp:
        (WebCore::DeviceMotionController::getLastEvent):
        * dom/DeviceMotionController.h:
        * dom/DeviceOrientationController.cpp:
        (WebCore::DeviceOrientationController::getLastEvent):
        * dom/DeviceOrientationController.h:
        * editing/Editor.cpp:
        (WebCore::Editor::dispatchCPPEvent):
        * page/DeviceController.h:
        (WebCore::DeviceController::getLastEvent):

2015-12-03  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Remove the use of GraphicsContextStateSaver from RenderLayer::paintLayerByApplyingTransform
        https://bugs.webkit.org/show_bug.cgi?id=151829

        Reviewed by Simon Fraser.

        Set the CTM of the GraphicsContext to its original value before changing
        it. This is a lot cheaper than using GraphicsContextStateSaver to save the
        whole state of the GraphicsContext and restore it back;

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::paintLayerByApplyingTransform):

2015-12-03  Eric Carlson  <eric.carlson@apple.com>

        [MediaStream] Update MediaStreamTrack.getCapabilities
        https://bugs.webkit.org/show_bug.cgi?id=151728

        Reviewed by Jer Noble.

        Test: fast/mediastream/MediaStreamTrack-getCapabilities.html

        * CMakeLists.txt: Remove files deleted from the repository.

        * DerivedSources.make: Ditto.

        * Modules/mediastream/AllAudioCapabilities.h: Removed.
        * Modules/mediastream/AllAudioCapabilities.idl: Removed.
        * Modules/mediastream/AllVideoCapabilities.h: Removed.
        * Modules/mediastream/AllVideoCapabilities.idl: Removed.
        * Modules/mediastream/CapabilityRange.cpp: Removed.
        * Modules/mediastream/CapabilityRange.h: Removed.
        * Modules/mediastream/CapabilityRange.idl: Removed.

        * Modules/mediastream/MediaSourceSettings.h:
        (WebCore::MediaSourceSettings::supportsVolume): Volume is a double.
        (WebCore::MediaSourceSettings::volume): Double.

        * Modules/mediastream/MediaStreamCapabilities.cpp: Removed.
        * Modules/mediastream/MediaStreamCapabilities.h: Removed.
        * Modules/mediastream/MediaStreamCapabilities.idl: Removed.

        * Modules/mediastream/MediaStreamTrack.cpp:
        (WebCore::MediaStreamTrack::getCapabilities): MediaStreamCapabilities is gone, return a RealtimeMediaSourceCapabilities.
        * Modules/mediastream/MediaStreamTrack.h:
        * Modules/mediastream/MediaStreamTrack.idl:

        * WebCore.xcodeproj/project.pbxproj: Remove files deleted from the repository.
        * bindings/js/JSMediaStreamTrackCustom.cpp:
        (WebCore::capabilityValue):
        (WebCore::JSMediaStreamTrack::getCapabilities): Create and return a dictionary of capatilities.

        * platform/mediastream/RealtimeMediaSourceCapabilities.h:
        (WebCore::CapabilityValueOrRange::type):
        (WebCore::CapabilityValueOrRange::CapabilityValueOrRange):
        (WebCore::CapabilityValueOrRange::rangeMin):
        (WebCore::CapabilityValueOrRange::rangeMax):
        (WebCore::CapabilityValueOrRange::value):
        (WebCore::RealtimeMediaSourceCapabilities::create):
        (WebCore::RealtimeMediaSourceCapabilities::~RealtimeMediaSourceCapabilities):
        (WebCore::RealtimeMediaSourceCapabilities::supportsWidth):
        (WebCore::RealtimeMediaSourceCapabilities::width):
        (WebCore::RealtimeMediaSourceCapabilities::setWidth):
        (WebCore::RealtimeMediaSourceCapabilities::supportsHeight):
        (WebCore::RealtimeMediaSourceCapabilities::height):
        (WebCore::RealtimeMediaSourceCapabilities::setHeight):
        (WebCore::RealtimeMediaSourceCapabilities::supportsFrameRate):
        (WebCore::RealtimeMediaSourceCapabilities::frameRate):
        (WebCore::RealtimeMediaSourceCapabilities::setFrameRate):
        (WebCore::RealtimeMediaSourceCapabilities::supportsFacingMode):
        (WebCore::RealtimeMediaSourceCapabilities::facingMode):
        (WebCore::RealtimeMediaSourceCapabilities::addFacingMode):
        (WebCore::RealtimeMediaSourceCapabilities::supportsAspectRatio):
        (WebCore::RealtimeMediaSourceCapabilities::aspectRatio):
        (WebCore::RealtimeMediaSourceCapabilities::setAspectRatio):
        (WebCore::RealtimeMediaSourceCapabilities::supportsVolume):
        (WebCore::RealtimeMediaSourceCapabilities::volume):
        (WebCore::RealtimeMediaSourceCapabilities::setVolume):
        (WebCore::RealtimeMediaSourceCapabilities::supportsSampleRate):
        (WebCore::RealtimeMediaSourceCapabilities::sampleRate):
        (WebCore::RealtimeMediaSourceCapabilities::setSampleRate):
        (WebCore::RealtimeMediaSourceCapabilities::supportsSampleSize):
        (WebCore::RealtimeMediaSourceCapabilities::sampleSize):
        (WebCore::RealtimeMediaSourceCapabilities::setSampleSize):
        (WebCore::RealtimeMediaSourceCapabilities::supportsEchoCancellation):
        (WebCore::RealtimeMediaSourceCapabilities::echoCancellation):
        (WebCore::RealtimeMediaSourceCapabilities::setEchoCancellation):
        (WebCore::RealtimeMediaSourceCapabilities::supportsDeviceId):
        (WebCore::RealtimeMediaSourceCapabilities::deviceId):
        (WebCore::RealtimeMediaSourceCapabilities::setDeviceId):
        (WebCore::RealtimeMediaSourceCapabilities::supportsGroupId):
        (WebCore::RealtimeMediaSourceCapabilities::groupId):
        (WebCore::RealtimeMediaSourceCapabilities::setGroupId):
        (WebCore::RealtimeMediaSourceCapabilities::RealtimeMediaSourceCapabilities):
        (WebCore::RealtimeMediaSourceCapabilityRange::RealtimeMediaSourceCapabilityRange): Deleted.
        (WebCore::RealtimeMediaSourceCapabilityRange::min): Deleted.
        (WebCore::RealtimeMediaSourceCapabilityRange::max): Deleted.
        (WebCore::RealtimeMediaSourceCapabilityRange::type): Deleted.
        (WebCore::RealtimeMediaSourceCapabilityRange::supported): Deleted.
        (WebCore::RealtimeMediaSourceCapabilities::sourceId): Deleted.
        (WebCore::RealtimeMediaSourceCapabilities::setSourceId): Deleted.
        (WebCore::RealtimeMediaSourceCapabilities::facingModes): Deleted.
        (WebCore::RealtimeMediaSourceCapabilities::setWidthRange): Deleted.
        (WebCore::RealtimeMediaSourceCapabilities::setHeightRange): Deleted.
        (WebCore::RealtimeMediaSourceCapabilities::setFrameRateRange): Deleted.
        (WebCore::RealtimeMediaSourceCapabilities::setAspectRatioRange): Deleted.
        (WebCore::RealtimeMediaSourceCapabilities::setVolumeRange): Deleted.
        (WebCore::RealtimeMediaSourceCapabilities::hasVideoSource): Deleted.
        (WebCore::RealtimeMediaSourceCapabilities::setHasVideoSource): Deleted.

        * platform/mediastream/RealtimeMediaSourceSettings.h:
        (WebCore::RealtimeMediaSourceSettings::volume): Volume is a double.
        (WebCore::RealtimeMediaSourceSettings::setVolume): Ditt.

        * platform/mediastream/mac/AVAudioCaptureSource.mm:
        (WebCore::AVAudioCaptureSource::initializeCapabilities): Initialize volume capability.

        * platform/mediastream/mac/AVMediaCaptureSource.mm:
        (WebCore::AVMediaCaptureSource::capabilities): RealtimeMediaSourceCapabilities constructor takes
          supportedConstraints. sourceId -> deviceId.

        * platform/mediastream/mac/AVVideoCaptureSource.mm:
        (WebCore::AVVideoCaptureSource::initializeCapabilities): DeviceId is set by the base class.

        * platform/mediastream/mac/WebAudioSourceProviderAVFObjC.mm: Drive-by cleanup, remove unused code.

        * platform/mock/MockRealtimeAudioSource.cpp:
        (WebCore::MockRealtimeAudioSource::initializeCapabilities): Updated.
        (WebCore::MockRealtimeAudioSource::initializeSupportedConstraints): Ditto.

        * platform/mock/MockRealtimeMediaSource.cpp:
        (WebCore::MockRealtimeMediaSource::capabilities): sourceId -> deviceId.

        * platform/mock/MockRealtimeVideoSource.cpp:
        (WebCore::MockRealtimeVideoSource::initializeCapabilities): Updated.
        (WebCore::MockRealtimeVideoSource::initializeSupportedConstraints): Ditto.

2015-12-03  Simon Fraser  <simon.fraser@apple.com>

        Have layer memory use consult the backing store format
        https://bugs.webkit.org/show_bug.cgi?id=151827
        rdar://problem/23746497

        Reviewed by Dean Jackson.
        
        When computing the backing store memory size, take the pixel format into account,
        rather than assuming 4 bytes per pixel.

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        * platform/graphics/ca/PlatformCALayer.h:

2015-12-03  Anders Carlsson  <andersca@apple.com>

        Remove Objective-C GC support
        https://bugs.webkit.org/show_bug.cgi?id=151819
        rdar://problem/23746991

        Reviewed by Dan Bernstein.

        * Configurations/Base.xcconfig:
        * bindings/objc/WebScriptObject.mm:
        (+[WebScriptObject initialize]): Deleted.
        (-[WebScriptObject finalize]): Deleted.
        * bindings/scripts/CodeGeneratorObjC.pm:
        (GenerateImplementation):
        * bindings/scripts/test/ObjC/DOMTestActiveDOMObject.mm:
        (-[DOMTestActiveDOMObject finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestCallback.mm:
        (-[DOMTestCallback finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestCallbackFunction.mm:
        (-[DOMTestCallbackFunction finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestCustomConstructorWithNoInterfaceObject.mm:
        (-[DOMTestCustomConstructorWithNoInterfaceObject finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestCustomNamedGetter.mm:
        (-[DOMTestCustomNamedGetter finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestEventConstructor.mm:
        (-[DOMTestEventConstructor finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestEventTarget.mm:
        (-[DOMTestEventTarget finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestException.mm:
        (-[DOMTestException finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestGenerateIsReachable.mm:
        (-[DOMTestGenerateIsReachable finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestInterface.mm:
        (-[DOMTestInterface finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestJSBuiltinConstructor.mm:
        (-[DOMTestJSBuiltinConstructor finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestMediaQueryListListener.mm:
        (-[DOMTestMediaQueryListListener finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestNamedConstructor.mm:
        (-[DOMTestNamedConstructor finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestNondeterministic.mm:
        (-[DOMTestNondeterministic finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestOverloadedConstructors.mm:
        (-[DOMTestOverloadedConstructors finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestOverrideBuiltins.mm:
        (-[DOMTestOverrideBuiltins finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestSerializedScriptValueInterface.mm:
        (-[DOMTestSerializedScriptValueInterface finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMTestTypedefs.mm:
        (-[DOMTestTypedefs finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMattribute.mm:
        (-[DOMattribute finalize]): Deleted.
        * bindings/scripts/test/ObjC/DOMreadonly.mm:
        (-[DOMreadonly finalize]): Deleted.
        * bridge/objc/objc_instance.mm:
        (ObjcInstance::virtualBegin):
        (allocateAutoReleasePool): Deleted.
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        * platform/mac/SharedBufferMac.mm:
        (+[WebCoreSharedBufferData initialize]): Deleted.
        (-[WebCoreSharedBufferData finalize]): Deleted.
        * platform/mac/WebCoreObjCExtras.h:
        (WebCoreObjCFinalizeOnMainThread): Deleted.

2015-12-03  Zalan Bujtas  <zalan@apple.com>

        Simple line layout: Print out simple line layout statistics for the current page from command line.
        https://bugs.webkit.org/show_bug.cgi?id=151806

        Reviewed Simon Fraser.

        com.apple.WebKit.showSimpleLineLayoutCoverage prints out a coverage summary of the current page,
        while com.apple.WebKit.showSimpleLineLayoutReasons lists the non-simple line layout blocks including the reasons why
        they are not covered.

        No change in functionality.

        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::canUseForText):
        (WebCore::SimpleLineLayout::canUseForFontAndText):
        (WebCore::SimpleLineLayout::canUseForStyle):
        (WebCore::SimpleLineLayout::canUseForWithReason):
        (WebCore::SimpleLineLayout::canUseFor):
        (WebCore::SimpleLineLayout::printReason):
        (WebCore::SimpleLineLayout::printReasons):
        (WebCore::SimpleLineLayout::printTextForSubtree):
        (WebCore::SimpleLineLayout::textLengthForSubtree):
        (WebCore::SimpleLineLayout::collectNonEmptyLeafRenderBlockFlows):
        (WebCore::SimpleLineLayout::collectNonEmptyLeafRenderBlockFlowsForCurrentPage):
        (WebCore::SimpleLineLayout::printSimpleLineLayoutBlockList):
        (WebCore::SimpleLineLayout::printSimpleLineLayoutCoverage):

2015-12-03  Jonathan Davis  <jond@apple.com>

        Add WebCrypto to status page
        https://bugs.webkit.org/show_bug.cgi?id=151760

        Reviewed by Timothy Hatcher.

        * features.json:

2015-12-03  Keith Rollin  <krollin@apple.com>

        [Win] fast/forms/HTMLOptionElement_label03.html failing on win7
        https://bugs.webkit.org/show_bug.cgi?id=150909
        rdar://problem/23539673

        Reviewed by Darin Adler.

        When returning text to be displayed, an <option> element will return
        the value of a label attribute if it exists, or the text content as a
        fallback. The failing test concerned the display of a <select>
        element when it contained a sole <option> element that had a label
        attribute set to a single space. When displayed, various
        platform-specific bits of code will strip off the leading and trailing
        whitespace. However, when WebKit would use this text to measure how
        wide the <select> popup menu button should be, it would not strip off
        spaces, leading to the calculated width being wider than necessary.
        The approach taken to fix this is to strip whitespace in the label
        attribute before it is returned from the <option> element.

        No new tests. fast/forms/HTMLOptionElement_label03.html had been
        marked as being expected to fail in TestExpectations; that test now
        succeeds.

        * html/HTMLOptionElement.cpp:
        (WebCore::HTMLOptionElement::label):

2015-12-03  Sam Weinig  <sam@webkit.org>

        Try to fix the Windows build.

        * bindings/js/JSWorkerGlobalScopeBase.cpp:
        (WebCore::JSWorkerGlobalScopeBase::javaScriptRuntimeFlags):
        (WebCore::JSWorkerGlobalScopeBase::queueTaskToEventLoop):

2015-12-03  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/cursor-advance.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=151731

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/IDBCursor.h:
        * Modules/indexeddb/IDBCursor.idl:
        
        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::advance): Return a custom exception message for TypeError.
        * Modules/indexeddb/client/IDBCursorImpl.h:
        
        * Modules/indexeddb/legacy/LegacyCursor.cpp:
        (WebCore::LegacyCursor::advance):
        * Modules/indexeddb/legacy/LegacyCursor.h:
        
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::createDOMException):
        (WebCore::setDOMException):
        * bindings/js/JSDOMBinding.h:
        
        * bindings/scripts/IDLAttributes.txt:
        
        * inspector/InspectorIndexedDBAgent.cpp:

2015-12-03  Brent Fulgham  <bfulgham@apple.com>

        Allow JavaScript to iterate over plugins for local files
        https://bugs.webkit.org/show_bug.cgi?id=151783
        <rdar://problem/23692113>

        Reviewed by Alexey Proskuryakov.

        Test: http/tests/plugins/plugin-javascript-access.html
              plugins/plugin-javascript-access.html

        * page/Page.cpp:
        (WebCore::Page::showAllPlugins): True if we set the debugging flag to show
        all plugins, or if the document's origin is from a local file.
        * page/Page.h:

2015-12-03  Jer Noble  <jer.noble@apple.com>

        Unreviewed build-fix; missing include.

        * html/HTMLVideoElement.cpp:

2015-12-03  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/cursor-skip-deleted.html crashes.
        https://bugs.webkit.org/show_bug.cgi?id=151794

        Reviewed by Alex Christensen.

        STL reverse_iterators are a tricky beast.
        
        They are implemented in terms of a normal forward iterator (called the "base" iterator),
        and they decrement a copy of that iterator when dereferenced.
            
        So when monitoring deletes from  a std::set to check if we should invalidate our current 
        reverse_iterator, we were incorrectly comparing the deleted key to the value pointed by the
        reverse_iterator instead of its base iterator.
        
        Since the iterators in question are bidirectional, anyways, we can just use a single iterator
        and either increment or decrement it as needed.
        
        No new tests (At least one failing (crashing) test now passes).

        * Modules/indexeddb/server/MemoryObjectStoreCursor.cpp:
        (WebCore::IDBServer::MemoryObjectStoreCursor::objectStoreCleared):
        (WebCore::IDBServer::MemoryObjectStoreCursor::keyDeleted):
        (WebCore::IDBServer::MemoryObjectStoreCursor::keyAdded):
        (WebCore::IDBServer::MemoryObjectStoreCursor::setFirstInRemainingRange):
        (WebCore::IDBServer::MemoryObjectStoreCursor::setForwardIteratorFromRemainingRange):
        (WebCore::IDBServer::MemoryObjectStoreCursor::setReverseIteratorFromRemainingRange):
        (WebCore::IDBServer::MemoryObjectStoreCursor::currentData):
        (WebCore::IDBServer::MemoryObjectStoreCursor::incrementForwardIterator):
        (WebCore::IDBServer::MemoryObjectStoreCursor::incrementReverseIterator):
        (WebCore::IDBServer::MemoryObjectStoreCursor::iterate):
        (WebCore::IDBServer::MemoryObjectStoreCursor::firstForwardIteratorInRemainingRange): Deleted.
        (WebCore::IDBServer::MemoryObjectStoreCursor::firstReverseIteratorInRemainingRange): Deleted.
        (WebCore::IDBServer::MemoryObjectStoreCursor::hasIterators): Deleted.
        (WebCore::IDBServer::MemoryObjectStoreCursor::hasValidPosition): Deleted.
        (WebCore::IDBServer::MemoryObjectStoreCursor::clearIterators): Deleted.
        * Modules/indexeddb/server/MemoryObjectStoreCursor.h:

2015-12-03  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo][MediaFoundation] Main thread can block when session is destroyed.
        https://bugs.webkit.org/show_bug.cgi?id=151803

        Reviewed by Alex Christensen.

        Set flag to make sure that the scheduler thread stops when the session ends.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::VideoScheduler::stopScheduler):
        (WebCore::MediaPlayerPrivateMediaFoundation::VideoScheduler::processSamplesInQueue):
        (WebCore::MediaPlayerPrivateMediaFoundation::VideoScheduler::schedulerThreadProcPrivate):
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:
        (WebCore::MediaPlayerPrivateMediaFoundation::VideoScheduler::stopThread):

2015-12-03  Jer Noble  <jer.noble@apple.com>

        [iOS] Fullscreen -> PiP should resume to Fullscreen, not inline
        https://bugs.webkit.org/show_bug.cgi?id=150906

        Reviewed by Simon Fraser.

        When restoring the user interface when exiting PiP, we should return to Fullscreen if that
        is where fullscreen was initiated from. Additionally, when we "auto-PiP" by backgrounding the
        app in Fullscreen mode, we should "auto-un-PiP" when restoring the application to foreground.

        Rather than have a separate method to request exiting fullscreen, entering standard fullscreen,
        and switching to & from PiP, add a new method setFullscreenMode() which does all three.

        * html/HTMLVideoElement.cpp:
        (WebCore::presentationModeToFullscreenMode):
        (WebCore::HTMLVideoElement::webkitSetPresentationMode):
        (WebCore::HTMLVideoElement::setFullscreenMode):
        * html/HTMLVideoElement.h:

        Add methods to for clients to request a specific fullscreen mode, and to query whether
        the page is currently visible.

        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        (WebVideoFullscreenControllerContext::requestFullscreenMode):
        (WebVideoFullscreenControllerContext::isVisible):
        (WebVideoFullscreenControllerContext::requestExitFullscreen): Deleted.
        * platform/ios/WebVideoFullscreenModel.h:
        * platform/ios/WebVideoFullscreenModelVideoElement.h:
        * platform/ios/WebVideoFullscreenModelVideoElement.mm:
        (WebVideoFullscreenModelVideoElement::requestFullscreenMode):
        (WebVideoFullscreenModelVideoElement::isVisible):
        (WebVideoFullscreenModelVideoElement::requestExitFullscreen): Deleted.

        Track whether returning from PiP should enter fullscreen, or whether foregrounding the app
        should cause PiP to return to fullscreen.

        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (-[WebAVPlayerLayer layoutSublayers]): Renamed from -setBounds:. -layoutSublayers is called
            more consistently than -setBounds:, including when a sublayer is added to the layer.
        (WebAVPlayerLayerView_stopRoutingVideoToPictureInPicturePlayerLayerView): The PiP WebAVPlayerLayer's
            modelVideoLayerFrame property may have been modified, so pass it back up to the fullscreen
            layer when exiting PiP.
        (WebVideoFullscreenInterfaceAVKit::applicationDidBecomeActive): Request fullscreen if we auto-PiPed.
        (WebVideoFullscreenInterfaceAVKit::setupFullscreen): Only recreate owned objects if they did not already exist.
        (WebVideoFullscreenInterfaceAVKit::enterFullscreenStandard): If we are in PiP mode, enter fullscreen by stopping PiP.
        (WebVideoFullscreenInterfaceAVKit::requestHideAndExitFullscreen): requestExitFullscreen() -> requestFullscreenMode().
        (WebVideoFullscreenInterfaceAVKit::willStartPictureInPicture): Animate out the fullscreen window, if exiting Fullscreen -> PiP.
        (WebVideoFullscreenInterfaceAVKit::didStartPictureInPicture): Set m_shouldReturnToFullscreenAfterEnteringForeground if we auto-PiPed.
        (WebVideoFullscreenInterfaceAVKit::failedToStartPictureInPicture): requestExitFullscreen() -> requestFullscreenMode().
        (WebVideoFullscreenInterfaceAVKit::willStopPictureInPicture): If we are returning from PiP -> Fullscreen, do not hide the fullscreen window.
        (WebVideoFullscreenInterfaceAVKit::didStopPictureInPicture): If we are returning from PiP -> Fullscreen, show the controls and notify clients.
        (WebVideoFullscreenInterfaceAVKit::prepareForPictureInPictureStopWithCompletionHandler): Animate in the fullscreen window, if returning from PiP -> Fullscreen.
        (WebVideoFullscreenInterfaceAVKit::shouldExitFullscreenWithReason): Set m_shouldReturnToFullscreenWhenStoppingPiP if we are entering PiP from Fullscreen.
        * platform/spi/cocoa/AVKitSPI.h:

2015-12-02  Sam Weinig  <sam@webkit.org>

        Promise callbacks should be called at microtask checkpoints
        https://bugs.webkit.org/show_bug.cgi?id=147933

        Reviewed by Chris Dumez.

        - Re-names MicroTaskQueue and MicroTask to MicrotaskQueue and Microtask to match the spec language.
        - Re-implements MicrotaskQueue and Microtask support suspended Microtasks (via the new KeepInQueue
          result value a Microtask can have when running) and correct behavior when Microtasks are added to
          the queue during a Microtask checkpoint.
        - MicrotaskQueue now has a mainThreadQueue() static function, replacing the old singleton() function,
          which can be used for the Document (non-Worker) Microtasks. For Workers, the a MicrotaskQueue 
          can be separately allocated for each WorkerGlobalScope (though this was not done in this change).
        - Adds a helper subclass of Microtask, ActiveDOMCallbackMicrotask, for Microtasks that are
          per-ScriptExecutationContext, and need to act as ActiveDOMCallbacks.
        - Re-implement Document (non-Worker) Promises on top of ActiveDOMCallbackMicrotask.
        - Re-implement MutationObserver delivery on top of Microtask.

        Layout Test:
            fast/dom/microtask-promise-mutation-observer-order.html

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/DOMAllInOne.cpp:
        Add new files.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::queueTaskToEventLoop):
        Switch to using ActiveDOMCallbackMicrotask/MicrotaskQueue rather than ScriptExecutionContext's Task mechanism
        for JavaScriptCore tasks.

        * bindings/js/JSMainThreadExecState.cpp:
        (WebCore::JSMainThreadExecState::didLeaveScriptContext):
        Perform a microtask checkpoint rather than calling MutationObserver code explicitly now that mutation observers
        use microtasks.

        * dom/ActiveDOMCallbackMicrotask.cpp: Added.
        (WebCore::ActiveDOMCallbackMicrotask::ActiveDOMCallbackMicrotask):
        (WebCore::ActiveDOMCallbackMicrotask::~ActiveDOMCallbackMicrotask):
        (WebCore::ActiveDOMCallbackMicrotask::run):
        (WebCore::ActiveDOMCallbackMicrotask::contextDestroyed):
        * dom/ActiveDOMCallbackMicrotask.h: Added.
        Add a helper subclass of Microtask which behaves like a ActiveDOMCallback (e.g. supports suspension
        and context destruction).

        * dom/MicroTask.cpp: Renamed to Microtasks.cpp.
        * dom/MicroTask.h: Renamed to Microtasks.h.
        * dom/Microtasks.cpp: Renamed from Source/WebCore/dom/MicroTask.cpp.
        (WebCore::Microtask::removeSelfFromQueue):
        (WebCore::MicrotaskQueue::mainThreadQueue):
        (WebCore::MicrotaskQueue::append):
        (WebCore::MicrotaskQueue::remove):
        (WebCore::MicrotaskQueue::performMicrotaskCheckpoint):
        (WebCore::MicroTaskQueue::singleton): Deleted.
        (WebCore::MicroTaskQueue::queueMicroTask): Deleted.
        (WebCore::MicroTaskQueue::runMicroTasks): Deleted.
        * dom/Microtasks.h: Renamed from Source/WebCore/dom/MicroTask.h.
        (WebCore::Microtask::~Microtask):
        (WebCore::MicrotaskQueue::MicrotaskQueue):
        (WebCore::MicrotaskQueue::~MicrotaskQueue):
        (WebCore::MicroTask::~MicroTask): Deleted.
        (WebCore::MicroTaskQueue::~MicroTaskQueue): Deleted.
        (WebCore::MicroTaskQueue::MicroTaskQueue): Deleted.
        Re-implement MicrotaskQueue and Microtask to support Microtask suspension (via the KeepInQueue result
        value) and correct behavior when Microtasks are queued during checkpoints.

        * dom/MutationObserver.cpp:
        (WebCore::suspendedMutationObservers):
        (WebCore::MutationObserverMicrotask::MutationObserverMicrotask):
        (WebCore::MutationObserverMicrotask::~MutationObserverMicrotask):
        (WebCore::MutationObserverMicrotask::run):
        (WebCore::queueMutationObserverCompoundMicrotask):
        (WebCore::MutationObserver::enqueueMutationRecord):
        (WebCore::MutationObserver::setHasTransientRegistration):
        * dom/MutationObserver.h:
        Re-implement MutationObserver delivery on top of Microtasks.

        * dom/ScriptRunner.cpp:
        (WebCore::ScriptRunner::timerFired):
        Remove unnecessary call to runMicroTasks().

        * html/parser/HTMLScriptRunner.cpp:
        (WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent):
        (WebCore::HTMLScriptRunner::runScript):
        Remove calls to MutationObserver::deliverAllMutations() now that the MicrotaskQueue will take care of it.

        (WebCore::HTMLScriptRunner::executeScriptsWaitingForParsing):
        Remove unnecessary call to runMicroTasks().

        * testing/Internals.cpp:
        (WebCore::Internals::queueMicroTask):
        Use ActiveDOMCallbackMicrotask rather than a custom test subclass.

        * testing/MicroTaskTest.cpp: Removed.
        * testing/MicroTaskTest.h: Removed.
        Remove custom test subclass of Microtask, just use ActiveDOMCallbackMicrotask directly.

2015-12-03  Brady Eidson  <beidson@apple.com>

        Add GetterRaisesExceptionWithMessage and SetterRaisesExceptionWithMessage to the code generator.
        https://bugs.webkit.org/show_bug.cgi?id=151807

        Reviewed by Alex Christensen.

        No new tests (Covered by changes to existing bindings tests).

        While we're at it, rework the existing 'RaisesExceptionWithMessage' concept to use a struct instead of
        two separate variables to reduce complexity.
        
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        (GenerateImplementationFunctionCall):
        (GenerateConstructorDefinition):
        (GenerateParametersCheck): Deleted.
        (GenerateReturnParameters): Deleted.
        
        * bindings/scripts/IDLAttributes.txt:
        
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_set_property):
        (webkit_dom_test_obj_get_property):
        (webkit_dom_test_obj_class_init):
        (webkit_dom_test_obj_get_attr_with_getter_exception_with_message):
        (webkit_dom_test_obj_set_attr_with_getter_exception_with_message):
        (webkit_dom_test_obj_get_attr_with_setter_exception_with_message):
        (webkit_dom_test_obj_set_attr_with_setter_exception_with_message):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjAttrWithGetterExceptionWithMessage):
        (WebCore::jsTestObjAttrWithSetterExceptionWithMessage):
        (WebCore::setJSTestObjAttrWithGetterExceptionWithMessage):
        (WebCore::setJSTestObjAttrWithSetterExceptionWithMessage):
        (WebCore::jsTestObjPrototypeFunctionMethodWithExceptionWithMessage):
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj attrWithGetterExceptionWithMessage]):
        (-[DOMTestObj setAttrWithGetterExceptionWithMessage:]):
        (-[DOMTestObj attrWithSetterExceptionWithMessage]):
        (-[DOMTestObj setAttrWithSetterExceptionWithMessage:]):
        
        * bindings/scripts/test/TestObj.idl:
        
        * dom/ExceptionCode.h:

2015-12-03  Javier Fernandez  <jfernandez@igalia.com>

        [css-grid] margin-left:auto and margin-top:auto discards the margin on opposite side
        https://bugs.webkit.org/show_bug.cgi?id=151802

        Reviewed by Sergio Villar Senin.

        When resolving auto margins so that they use the available space, in the
        corresponding axis, we must consider that there might be other specified
        margins. Such margins must account to determine the actual available space.

        Test: fast/css-grid-layout/grid-item-auto-margins-must-respect-specified-margins.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::updateAutoMarginsInRowAxisIfNeeded):
        (WebCore::RenderGrid::updateAutoMarginsInColumnAxisIfNeeded):

2015-12-02  Antti Koivisto  <antti@apple.com>

        Move ResourceLoadScheduler to WebKit1
        https://bugs.webkit.org/show_bug.cgi?id=151743

        Reviewed by Alex Christensen.

        It is no longer used by WebKit2. Simplify the WebKit/WebCore interface.

        * WebCore.xcodeproj/project.pbxproj:
        * dom/ContainerNode.cpp:
        * dom/Document.cpp:
        (WebCore::Document::styleForElementIgnoringPendingStylesheets):
        * dom/Document.h:
        * loader/DocumentLoader.h:
        * loader/LoaderStrategy.cpp:
        (WebCore::LoaderStrategy::~LoaderStrategy):
        (WebCore::ResourceLoadSuspender::ResourceLoadSuspender):
        (WebCore::ResourceLoadSuspender::~ResourceLoadSuspender):
        (WebCore::LoaderStrategy::resourceLoadScheduler): Deleted.
        (WebCore::LoaderStrategy::loadResourceSynchronously): Deleted.
        (WebCore::LoaderStrategy::createBlobRegistry): Deleted.
        (WebCore::LoaderStrategy::createPingHandle): Deleted.
        * loader/LoaderStrategy.h:

            Loading functions implemented on WebKit side move to pure virtual LoaderStrategy.

        * loader/ResourceLoadScheduler.cpp: Removed.
        * loader/ResourceLoadScheduler.h: Removed.

            ResourceLoadScheduler moves to WebKit1 as WebResourceLoadScheduler.

        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::finishNetworkLoad):
        (WebCore::ResourceLoader::setDefersLoading):
        (WebCore::ResourceLoader::frameLoader):
        (WebCore::ResourceLoader::willSwitchToSubstituteResource):
        (WebCore::ResourceLoader::willSendRequestInternal):
        * loader/archive/ArchiveResourceCollection.h:
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::load):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::performPostLoadActions):
        (WebCore::CachedResourceLoader::incrementRequestCount):
        * platform/PlatformStrategies.h:
        (WebCore::PlatformStrategies::pluginStrategy):
        (WebCore::PlatformStrategies::blobRegistry):

            Move BlobRegistry factory function here from LoaderStrategy as this allows network process to have null loaderStrategy.
            (it could be renamed BlobStrategy for consistency later).

        (WebCore::PlatformStrategies::PlatformStrategies):
        * platform/network/BlobRegistry.cpp:
        (WebCore::blobRegistry):
        (WebCore::BlobRegistry::~BlobRegistry):
        * platform/network/ResourceRequestBase.h:
        * style/StyleResolveTree.cpp:
        (WebCore::Style::PostResolutionCallbackDisabler::PostResolutionCallbackDisabler):
        (WebCore::Style::PostResolutionCallbackDisabler::~PostResolutionCallbackDisabler):

2015-12-02  Myles C. Maxfield  <mmaxfield@apple.com>

        Unify font-variant-* with font-variant shorthand
        https://bugs.webkit.org/show_bug.cgi?id=149773

        Reviewed by Darin Adler.

        This patch makes font-variant a shorthand for the following properties:
        font-variant-ligatures
        font-variant-position
        font-variant-caps
        font-variant-numeric
        font-variant-alternates
        font-variant-east-asian

        This is consistent with the CSS Fonts Level 3 spec.

        This patch also migrates the "font" longhand to use the font-variant-caps
        property.

        Test: fast/text/font-variant-shorthand.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::fontVariantEastAsianPropertyValue): Rename FontVariantEastAsian values.
        (WebCore::fontVariantFromStyle): We must consult with the longhand properties to determine
        font-variant computed style.
        (WebCore::ComputedStyleExtractor::propertyValue): Don't put any-old font-variant-caps inside
        the font shorthand.
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::addFontFaceRule): Guard against incorrect downcasts (due to inherit
        of the new shorthand property).
        * css/CSSParser.cpp: Parse font-variant as a shorthand. Also implement its "normal" and "none" values.
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseFont):
        (WebCore::CSSParser::parseSystemFont):
        (WebCore::CSSParser::parseFontVariantLigatures):
        (WebCore::CSSParser::parseFontVariantNumeric):
        (WebCore::CSSParser::parseFontVariantEastAsian):
        (WebCore::CSSParser::parseFontVariant):
        (WebCore::isValidKeywordPropertyAndValue): Deleted.
        (WebCore::isKeywordPropertyID): Deleted.
        * css/CSSParser.h:
        * css/CSSPropertyNames.in: Turn font-variant into a shorthand property.
        * css/FontVariantBuilder.h: Guard against incorrect downcasts. Also update for renamed
        FontVariantEastAsian type.
        (WebCore::applyValueFontVariantLigatures):
        (WebCore::applyValueFontVariantNumeric):
        (WebCore::applyValueFontVariantEastAsian):
        * css/StyleProperties.cpp: Update to use the more specific property.
        (WebCore::StyleProperties::appendFontLonghandValueIfExplicit):
        (WebCore::StyleProperties::fontValue):
        (WebCore::StyleProperties::asText):
        * css/StyleResolver.cpp: Ditto.
        (WebCore::StyleResolver::isValidCueStyleProperty):
        * editing/EditingStyle.cpp: Ditto.
        * editing/cocoa/HTMLConverter.mm: Ditto.
        (HTMLConverterCaches::propertyValueForNode):
        (HTMLConverter::computedAttributesForElement):
        * editing/ios/EditorIOS.mm: Ditto.
        (WebCore::Editor::removeUnchangeableStyles):
        * html/canvas/CanvasRenderingContext2D.cpp: Ditto.
        (WebCore::CanvasRenderingContext2D::font):
        (WebCore::CanvasRenderingContext2D::setFont):
        * platform/graphics/FontCache.h: Removing duplicate cache key value.
        (WebCore::FontDescriptionKey::makeFlagsKey):
        * platform/graphics/FontCascade.cpp: Migrate to the new font-variant-caps from the old member variable.
        (WebCore::FontCascade::glyphDataForCharacter):
        * platform/graphics/FontCascade.h: Ditto.
        (WebCore::FontCascade::isSmallCaps):
        * platform/graphics/FontDescription.cpp: Ditto.
        (WebCore::FontDescription::FontDescription):
        * platform/graphics/FontDescription.h: Ditto.
        (WebCore::FontCascadeDescription::equalForTextAutoSizing):
        (WebCore::FontDescription::smallCaps): Deleted.
        (WebCore::FontDescription::setSmallCaps): Deleted.
        (WebCore::FontDescription::setIsSmallCaps): Deleted.
        (WebCore::FontDescription::operator==): Deleted.
        * platform/graphics/cocoa/FontCacheCoreText.cpp: Rename FontVariantEastAsianWidth.
        (WebCore::computeFeatureSettingsFromVariants):
        * platform/text/TextFlags.h: Ditto.
        (WebCore::FontVariantSettings::operator==):
        * rendering/RenderText.cpp: Migrage to the new font-variant-caps from the old member variable.
        (WebCore::RenderText::widthFromCache):

2015-12-02  Alex Christensen  <achristensen@webkit.org>

        Reduce size of ScriptElement
        https://bugs.webkit.org/show_bug.cgi?id=151786

        Reviewed by Andreas Kling.

        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::ScriptElement):
        (WebCore::ScriptElement::requestScript):
        * dom/ScriptElement.h:
        Use callOnMainThread instead of a Timer to save memory on a timer that is rarely used.
        Use bit fields for the boolean values to save another 8 bytes per ScriptElement.
        This reduces sizeof(ScriptElement) from 168 to 48 bytes.

2015-12-02  Alex Christensen  <achristensen@webkit.org>

        Asynchronously call onerror when a content blocker blocks ascript element's load
        https://bugs.webkit.org/show_bug.cgi?id=151649

        Reviewed by Brady Eidson.

        Test: http/tests/contentextensions/script-onerror.html

        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::ScriptElement):
        (WebCore::ScriptElement::requestScript):
        * dom/ScriptElement.h:

2015-12-02  Jer Noble  <jer.noble@apple.com>

        [iOS] Abrupt transition between Fullscreen -> PiP
        https://bugs.webkit.org/show_bug.cgi?id=151719

        Reviewed by Eric Carlson.

        Follow-up to r192922: When moving from inline -> PiP, don't forget to hide the fullscreen
        window once the PiP transition completes.

        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (WebVideoFullscreenInterfaceAVKit::didStartPictureInPicture):

2015-12-02  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r192955.
        https://bugs.webkit.org/show_bug.cgi?id=151776

        A large number of the tests added with this change are failing
        on Windows (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "[css border] border-image doesn't honor border-style"
        https://bugs.webkit.org/show_bug.cgi?id=99922
        http://trac.webkit.org/changeset/192955

2015-12-02  Yoav Weiss  <yoav@yoav.ws>

        Fix preloader issue with srcdoc documents.
        https://bugs.webkit.org/show_bug.cgi?id=151744

        Reviewed by Ryosuke Niwa.

        Make sure that PreloadRequest is resolving URLs based on the document's
        baseURL() rather than using url() as the base URL, which is not how URLs
        are resolved by the parser, and fails when document->url() diverges from
        the document's base URL (e.g. in the case of srcdoc based documents).

        Test: fast/preloader/iframe-srcdoc.html

        * html/parser/HTMLResourcePreloader.cpp:
        (WebCore::PreloadRequest::completeURL):

2015-12-02  Jer Noble  <jer.noble@apple.com>

        Add a setting and restriction which will pause invisible autoplaying video
        https://bugs.webkit.org/show_bug.cgi?id=151412

        Reviewed by Eric Carlson.

        Test: media/video-restricted-invisible-autoplay-not-allowed.html

        Drive-by fix: m_autoplaying is reset in many places by calling pause() or play(), where those
        calls did not originate from an explicit request to pause or play, e.g., during an interruption.
        This causes m_autoplaying to be set to false, thus breaking resumption of autoplaying when the
        interruption ends. Update PlatformMediaSession to remember its client's "autoplaying" state and
        restore it when an interruption ends.

        Add a means to register for viewport visibility notifications to FrameView, RenderView,
        and RenderElement. Elements who wish to recieve these notifications must do so through their
        renderer, and thus will have to re-register whenever a new renderer is attached.

        Add a restriction to HTMLMediaElement which will pause autoplaying video when that video scrolls
        out of the viewport, or is hidden with CSS.

        Add a setting which controls whether that new restriction is set.

        * dom/Element.h:
        (WebCore::Element::isVisibleInViewportChanged): Add default empty virtual method.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::didMoveToNewDocument):
        (WebCore::HTMLMediaElement::documentDidResumeFromPageCache):
        (WebCore::HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture):
        (WebCore::HTMLMediaElement::resumeAutoplaying):
        (WebCore::mediaElementIsAllowedToAutoplay):
        (WebCore::HTMLMediaElement::isVisibleInViewportChanged):
        (WebCore::HTMLMediaElement::updateShouldAutoplay):
        (WebCore::HTMLMediaElement::HTMLMediaElement): Set the new restriction based on the current Settings.
        (WebCore::HTMLMediaElement::resumeAutoplaying): Continue autoplay, or begin playback.
        (WebCore::HTMLMediaElement::didMoveToNewDocument): Update our autoplay state.
        (WebCore::HTMLMediaElement::documentDidResumeFromPageCache): Ditto.
        (WebCore::HTMLMediaElement::removedFrom): Ditto.
        (WebCore::HTMLMediaElement::didAttachRenderers): Ditto.
        (WebCore::HTMLMediaElement::didDetachRenderers): Ditto.
        (WebCore::HTMLMediaElement::visibilityDidChange): Ditto.
        (WebCore::HTMLMediaElement::willDetachRenderers): Unregister for visibility callbacks.
        (WebCore::HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture): Clear new restriction.
        (WebCore::mediaElementIsAllowedToAutoplay): Check for autoplay requirements.
        (WebCore::HTMLMediaElement::isVisibleInViewportChanged): Added, update our autoplay state.
        (WebCore::HTMLMediaElement::updateShouldAutoplay): Set interruption if necessary, clear otherwise.
        * html/HTMLMediaElement.h:
        * html/MediaElementSession.cpp:
        (WebCore::restrictionName): Added support for new restriction.
        * html/MediaElementSession.h:
        * page/FrameView.cpp:
        (WebCore::FrameView::viewportContentsChanged): Update clients of viewport visibility.
        * page/Settings.in:
        * platform/audio/PlatformMediaSession.cpp:
        (WebCore::stateName): Add new "Autoplay" state.
        (WebCore::interruptionName): Added new interruption type.
        (WebCore::PlatformMediaSession::beginInterruption): Set the m_interruptionType.
        (WebCore::PlatformMediaSession::clientWillBeginAutoplaying): Set the m_state to Autoplaying.
        * platform/audio/PlatformMediaSession.h:
        (WebCore::PlatformMediaSession::interruptionType): Added getter.
        (WebCore::PlatformMediaSessionClient::resumeAutoplaying): Added default.
        * platform/audio/PlatformMediaSessionManager.cpp:
        (WebCore::PlatformMediaSessionManager::sessionWillBeginPlayback): Only pause session if its state is playing.
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::RenderElement): Set new ivars.
        (WebCore::RenderElement::~RenderElement): Unregister for callbacks if necessary.
        (WebCore::RenderElement::registerForVisibleInViewportCallback): Register for callbacks from RenderView.
        (WebCore::RenderElement::unregisterForVisibleInViewportCallback): Unregister from same.
        (WebCore::RenderElement::visibleInViewportStateChanged): Notify Element if value has changed.
        * rendering/RenderElement.h:
        * rendering/RenderView.cpp:
        (WebCore::RenderView::registerForVisibleInViewportCallback): Add renderer to list of callbacks.
        (WebCore::RenderView::unregisterForVisibleInViewportCallback): Remove renderer from same.
        (WebCore::RenderView::updateVisibleViewportRect): Walk renderers setting their visiblility based on the viewport visible rect.
        * rendering/RenderView.h:
        * testing/Internals.cpp:
        (WebCore::Internals::setMediaElementRestrictions): Support new restriction.

2015-12-02  Brady Eidson  <beidson@apple.com>

        Modern IDB: IDBTransaction::error is not exposed.
        https://bugs.webkit.org/show_bug.cgi?id=151752

        Reviewed by Alex Christensen.

        No new tests (At least 3 failing tests now pass, plus changes to other faulty tests).

        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::dispatchEvent):
        (WebCore::IDBClient::IDBRequest::uncaughtExceptionInEventHandler):
        * Modules/indexeddb/client/IDBRequestImpl.h:
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::error):
        (WebCore::IDBClient::IDBTransaction::abortDueToFailedRequest):
        (WebCore::IDBClient::IDBTransaction::abort):
        (WebCore::IDBClient::IDBTransaction::didCreateIndexOnServer):
        * Modules/indexeddb/client/IDBTransactionImpl.h:

2015-12-02  Adenilson Cavalcanti  <cavalcantii@gmail.com>

        [css border] border-image doesn't honor border-style
        https://bugs.webkit.org/show_bug.cgi?id=99922

        Reviewed by Simon Fraser.

        Ensure that WebKit will be compliant to css-backgrounds spec where a
        border with an image will only be rendered if there is a style defined.

        Quote: "None: No border. Color and width are ignored (i.e., the border has width 0)".
        Reference: http://www.w3.org/TR/css3-background/#border-style

        From W3C discussion: "The fact that these properties set the style of the border is
        normative". Reference: https://lists.w3.org/Archives/Public/www-style/2015Nov/0260.html

        Test: fast/borders/border-image-should-not-display.html

        * rendering/style/BorderData.h:
        (WebCore::BorderData::hasBorder):
        (WebCore::BorderData::borderLeftWidth):
        (WebCore::BorderData::borderRightWidth):
        (WebCore::BorderData::borderTopWidth):
        (WebCore::BorderData::borderBottomWidth):
        * rendering/style/BorderValue.h:
        (WebCore::BorderValue::nonZero):
        (WebCore::BorderValue::isVisible):

2015-12-02  Eric Carlson  <eric.carlson@apple.com>

        [MediaStream] Implement MediaStreamTrack.getSettings()
        https://bugs.webkit.org/show_bug.cgi?id=151727

        Reviewed by Jer Noble.

        MediaStreamTrack.getStates has been replaced by MediaStreamTrack.getSettings. 

        Test: fast/mediastream/MediaStreamTrack-getSettings.html

        * CMakeLists.txt: MediaSourceStates.* -> MediaSourceSettings.*.
        * DerivedSources.make: No more MediaSourceStates.idl.
        * Modules/mediastream/CapabilityRange.cpp: MediaSourceStates.* -> MediaSourceSettings.*.
        * Modules/mediastream/MediaSourceSettings.cpp: Copied from Source/WebCore/Modules/mediastream/MediaSourceStates.cpp.
        (WebCore::MediaSourceSettings::create):
        (WebCore::MediaSourceSettings::MediaSourceSettings):
        (WebCore::MediaSourceSettings::facingMode):
        (WebCore::MediaSourceStates::create): Deleted.
        (WebCore::MediaSourceStates::MediaSourceStates): Deleted.
        (WebCore::MediaSourceStates::sourceType): Deleted.
        (WebCore::MediaSourceStates::facingMode): Deleted.
        * Modules/mediastream/MediaSourceSettings.h: Copied from Source/WebCore/Modules/mediastream/MediaSourceStates.h.

        MediaSourceStates.* renamed to MediaSourceSettings.* and updated to new API.
        * Modules/mediastream/MediaSourceStates.cpp: Removed.
        * Modules/mediastream/MediaSourceStates.h: Removed.
        * Modules/mediastream/MediaSourceStates.idl: Removed.

        * Modules/mediastream/MediaStreamCapabilities.cpp:
        (WebCore::MediaStreamCapabilities::sourceType): Return an empty vector for now, will be fixed
          by the changes for https://bugs.webkit.org/show_bug.cgi?id=151728.
        (WebCore::MediaStreamCapabilities::sourceId): RealtimeMediaSourceStates -> MediaSourceSettings.
        (WebCore::MediaStreamCapabilities::facingMode): Ditto.

        * Modules/mediastream/MediaStreamTrack.cpp:
        (WebCore::MediaStreamTrack::getSettings): New.
        (WebCore::MediaStreamTrack::getCapabilities): Don't modify states, just pass through whatever
          private track returns.
        (WebCore::MediaStreamTrack::trackSettingsChanged):
        (WebCore::MediaStreamTrack::states): Deleted.
        (WebCore::MediaStreamTrack::trackStatesChanged): Deleted.
        * Modules/mediastream/MediaStreamTrack.h:
        * Modules/mediastream/MediaStreamTrack.idl: MediaSourceStates -> MediaSourceSettings.

        * Modules/webaudio/MediaStreamAudioSource.cpp:
        (WebCore::MediaStreamAudioSource::settings):
        (WebCore::MediaStreamAudioSource::states): Deleted.
        * Modules/webaudio/MediaStreamAudioSource.h: MediaSourceStates -> MediaSourceSettings.

        * WebCore.xcodeproj/project.pbxproj: MediaSourceStates.* -> MediaSourceSettings.*.

        * bindings/js/JSMediaSourceStatesCustom.cpp: Removed.
        * bindings/js/JSMediaStreamTrackCustom.cpp: Added.
        (WebCore::JSMediaStreamTrack::getSettings): MediaSourceSettings is a generic dictionary so 
          it has to be generated manually.

        * platform/mediastream/MediaStreamPrivate.cpp:
        (WebCore::MediaStreamPrivate::intrinsicSize): states -> settings.
        (WebCore::MediaStreamPrivate::trackStatesChanged): Deleted.
        * platform/mediastream/MediaStreamPrivate.h:

        * platform/mediastream/MediaStreamTrackPrivate.cpp:
        (WebCore::MediaStreamTrackPrivate::settings):
        (WebCore::MediaStreamTrackPrivate::sourceSettingsChanged):
        (WebCore::MediaStreamTrackPrivate::states): Deleted.
        (WebCore::MediaStreamTrackPrivate::sourceStatesChanged): Deleted.
        * platform/mediastream/MediaStreamTrackPrivate.h:

        * platform/mediastream/RealtimeMediaSource.cpp:
        (WebCore::RealtimeMediaSource::settingsDidChanged):
        (WebCore::RealtimeMediaSource::statesDidChanged): Deleted.
        * platform/mediastream/RealtimeMediaSource.h:

        * platform/mediastream/RealtimeMediaSourceCapabilities.h:
        (WebCore::RealtimeMediaSourceCapabilities::facingModes): States -> Settings.
        (WebCore::RealtimeMediaSourceCapabilities::addFacingMode): Ditto.
        (WebCore::RealtimeMediaSourceCapabilities::sourceTypes): Deleted.
        (WebCore::RealtimeMediaSourceCapabilities::setSourceType): Deleted.
        (WebCore::RealtimeMediaSourceCapabilities::addSourceType): Deleted.

        * platform/mediastream/RealtimeMediaSourceCenter.h: States -> Settings.
        * platform/mediastream/RealtimeMediaSourceSettings.cpp: Copied from Source/WebCore/platform/mediastream/RealtimeMediaSourceStates.cpp.
        (WebCore::RealtimeMediaSourceSettings::facingMode):
        (WebCore::RealtimeMediaSourceStates::facingMode): Deleted.
        (WebCore::RealtimeMediaSourceStates::sourceType): Deleted.

        * platform/mediastream/RealtimeMediaSourceSettings.h: Copied from Source/WebCore/platform/mediastream/RealtimeMediaSourceStates.h.
        * platform/mediastream/RealtimeMediaSourceStates.cpp: Removed.

        * platform/mediastream/RealtimeMediaSourceStates.h: Removed.
        * platform/mediastream/mac/AVAudioCaptureSource.h:
        * platform/mediastream/mac/AVAudioCaptureSource.mm:
        (WebCore::AVAudioCaptureSource::updateStates): Deleted.

        * platform/mediastream/mac/AVCaptureDeviceManager.h:
        * platform/mediastream/mac/AVCaptureDeviceManager.mm:

        * platform/mediastream/mac/AVMediaCaptureSource.h:
        * platform/mediastream/mac/AVMediaCaptureSource.mm:
        (WebCore::AVMediaCaptureSource::states): Deleted.

        * platform/mediastream/mac/AVVideoCaptureSource.h:
        * platform/mediastream/mac/AVVideoCaptureSource.mm:
        (WebCore::AVVideoCaptureSource::updateStates): Deleted.

        * platform/mediastream/mac/MockRealtimeVideoSourceMac.mm:

        * platform/mediastream/openwebrtc/RealtimeMediaSourceOwr.h:

        * platform/mock/MockRealtimeAudioSource.cpp:
        (WebCore::MockRealtimeAudioSource::initializeSupportedConstraints):
        (WebCore::MockRealtimeAudioSource::updateStates): Deleted.
        * platform/mock/MockRealtimeAudioSource.h:

        * platform/mock/MockRealtimeMediaSource.cpp:
        (WebCore::MockRealtimeMediaSource::capabilities): Minor cleanup.
        (WebCore::MockRealtimeMediaSource::settings):
        (WebCore::MockRealtimeMediaSource::supportedConstraints):
        (WebCore::MockRealtimeMediaSource::states): Deleted.
        * platform/mock/MockRealtimeMediaSource.h:
        (WebCore::MockRealtimeMediaSource::constraints):
        (WebCore::MockRealtimeMediaSource::currentStates): Deleted.

        * platform/mock/MockRealtimeVideoSource.cpp:
        (WebCore::MockRealtimeVideoSource::updateSettings):
        (WebCore::MockRealtimeVideoSource::initializeCapabilities):
        (WebCore::MockRealtimeVideoSource::initializeSupportedConstraints):
        (WebCore::MockRealtimeVideoSource::setFrameRate): states -> settings.
        (WebCore::MockRealtimeVideoSource::setSize): Ditto.
        (WebCore::MockRealtimeVideoSource::drawAnimation): Ditto.
        (WebCore::MockRealtimeVideoSource::drawText): Ditto.
        (WebCore::MockRealtimeVideoSource::updateStates): Deleted.
        (WebCore::MockRealtimeVideoSource::setFacingMode): Deleted.
        * platform/mock/MockRealtimeVideoSource.h:

2015-11-30  David Hyatt  <hyatt@apple.com>

        Implement the picture element.
        https://bugs.webkit.org/show_bug.cgi?id=116963

        Reviewed by Dean Jackson.

        Added fast/picture tests.

        * WebCore.xcodeproj/project.pbxproj:
        Add HTMLPictureElement.* to the project.

        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::setBestFitURLAndDPRFromImageCandidate):
        Remove the CURRENT_SRC ifdef.

        (WebCore::HTMLImageElement::bestFitSourceFromPictureElement):
        New helper function that checks the <source> elements of a <picture> parent
        for the best match.

        (WebCore::HTMLImageElement::selectImageSource):
        Pull out the process of image selection into its own function so that this can
        be called from many places (to ensure that dynamic changes are reflected as elements
        get changed, added or removed).

        (WebCore::HTMLImageElement::parseAttribute):
        Call selectImageSource when attributes change.

        (WebCore::HTMLImageElement::insertedInto):
        If inserted into a picture element, make sure to update the source.

        * html/HTMLImageElement.h:
        (WebCore::HTMLImageElement::currentSrc):
        Remove the CURRENT_SRC ifdef.

        * html/HTMLImageElement.idl:
        Remove the CURRENT_SRC ifdef.

        * html/HTMLPictureElement.cpp: Added.
        (WebCore::HTMLPictureElement::HTMLPictureElement):
        (WebCore::HTMLPictureElement::create):
        (WebCore::HTMLPictureElement::sourcesChanged):
        * html/HTMLPictureElement.h: Added.
        The new picture element. Has a sourcesChanged() function that is invoked whenever anything
        about the <source> elements changes.

        * html/HTMLSourceElement.cpp:
        (WebCore::HTMLSourceElement::insertedInto):
        (WebCore::HTMLSourceElement::removedFrom):
        (WebCore::HTMLSourceElement::parseAttribute):
        Make sure to call sourcesChanged when new sources come and go or when attributes on
        source elements change.

        * html/HTMLSourceElement.h:
        Added parseAttribute function so we can see when attributes change that force us to
        do a dynamic update.

        * html/HTMLTagNames.in:
        Add the picture element.

        * html/parser/HTMLSrcsetParser.h:
        (WebCore::ImageCandidate::srcOrigin):
        (WebCore::ImageCandidate::isEmpty):
        Some helpers for picture parsing.

2015-12-02  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo][MediaFoundation] Video is not rendered correctly on some graphics cards.
        https://bugs.webkit.org/show_bug.cgi?id=151757

        Reviewed by Alex Christensen.

        We need to make sure we use the same bitmap format as in the Direct3D surface
        in video memory when copying surface data and rendering with Cairo.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::Direct3DPresenter::presentSample):
        (WebCore::MediaPlayerPrivateMediaFoundation::Direct3DPresenter::paintCurrentFrame):

2015-12-02  Brady Eidson  <beidson@apple.com>

        Modern IDB: Get rid of IDBExceptionCode.
        https://bugs.webkit.org/show_bug.cgi?id=151753

        Reviewed by Alex Christensen.

        No new tests (No change in behavior).

        * Modules/indexeddb/client/IDBIndexImpl.cpp:
        (WebCore::IDBClient::IDBIndex::count):
        (WebCore::IDBClient::IDBIndex::doCount):
        (WebCore::IDBClient::IDBIndex::get):
        (WebCore::IDBClient::IDBIndex::doGet):
        (WebCore::IDBClient::IDBIndex::getKey):
        (WebCore::IDBClient::IDBIndex::doGetKey):
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::get):
        (WebCore::IDBClient::IDBObjectStore::deleteFunction):
        (WebCore::IDBClient::IDBObjectStore::clear):
        (WebCore::IDBClient::IDBObjectStore::createIndex):
        (WebCore::IDBClient::IDBObjectStore::index):
        (WebCore::IDBClient::IDBObjectStore::deleteIndex):
        (WebCore::IDBClient::IDBObjectStore::count):
        (WebCore::IDBClient::IDBObjectStore::doCount):
        
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::fireErrorAfterVersionChangeAbort):
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::abortOnServerAndCancelRequests):
        
        * Modules/indexeddb/server/IndexValueStore.cpp:
        (WebCore::IDBServer::IndexValueStore::addRecord):
        
        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::beginTransaction):
        (WebCore::IDBServer::MemoryIDBBackingStore::abortTransaction):
        (WebCore::IDBServer::MemoryIDBBackingStore::commitTransaction):
        (WebCore::IDBServer::MemoryIDBBackingStore::createObjectStore):
        (WebCore::IDBServer::MemoryIDBBackingStore::deleteObjectStore):
        (WebCore::IDBServer::MemoryIDBBackingStore::clearObjectStore):
        (WebCore::IDBServer::MemoryIDBBackingStore::createIndex):
        (WebCore::IDBServer::MemoryIDBBackingStore::deleteIndex):
        (WebCore::IDBServer::MemoryIDBBackingStore::deleteRange):
        (WebCore::IDBServer::MemoryIDBBackingStore::addRecord):
        (WebCore::IDBServer::MemoryIDBBackingStore::getRecord):
        (WebCore::IDBServer::MemoryIDBBackingStore::getIndexRecord):
        (WebCore::IDBServer::MemoryIDBBackingStore::getCount):
        (WebCore::IDBServer::MemoryIDBBackingStore::openCursor):
        (WebCore::IDBServer::MemoryIDBBackingStore::iterateCursor):
        
        * Modules/indexeddb/server/MemoryIndex.cpp:
        (WebCore::IDBServer::MemoryIndex::putIndexKey):
        
        * Modules/indexeddb/server/MemoryObjectStore.cpp:
        (WebCore::IDBServer::MemoryObjectStore::createIndex):
        (WebCore::IDBServer::MemoryObjectStore::deleteIndex):
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::handleOpenDatabaseOperations):
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd):
        
        * Modules/indexeddb/shared/IDBError.cpp:
        (WebCore::IDBError::IDBError):
        (WebCore::IDBError::name):
        (WebCore::IDBError::message):
        (WebCore::idbErrorName): Deleted.
        (WebCore::idbErrorDescription): Deleted.
        
        * Modules/indexeddb/shared/IDBError.h:
        (WebCore::IDBError::code):
        (WebCore::IDBError::isNull):

2015-12-02  Jiewen Tan  <jiewen_tan@apple.com>

        Null dereference loading Blink layout test fast/loader/unload-mutation-crash.html
        https://bugs.webkit.org/show_bug.cgi?id=149305
        <rdar://problem/22747892>

        Reviewed by Brent Fulgham.

        Add an extra guard to replaceDocument() against rude JS in unload event handlers.

        Test: fast/loader/unload-mutation-crash.html

        * loader/DocumentWriter.cpp:
        (WebCore::DocumentWriter::replaceDocument):
        (WebCore::DocumentWriter::begin):

2015-12-02  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo] Compile error.
        https://bugs.webkit.org/show_bug.cgi?id=151742

        Reviewed by Csaba Osztrogonác.

        System font flag has moved from Font class to FontData class.

        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
        (WebCore::Font::platformInit):

2015-12-01  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r192894 and r192904.
        https://bugs.webkit.org/show_bug.cgi?id=151738

        Crashes sometimes on Windows (Requested by litherum on
        #webkit).

        Reverted changesets:

        "[Win] Web fonts with small caps have excess whitespace with
        the complex text codepath"
        https://bugs.webkit.org/show_bug.cgi?id=151698
        http://trac.webkit.org/changeset/192894

        "Test gardening after r192894"
        http://trac.webkit.org/changeset/192904

2015-12-01  Yusuke Suzuki  <utatane.tea@gmail.com>

        [ES6] Implement LLInt/Baseline Support for ES6 Generators and enable this feature
        https://bugs.webkit.org/show_bug.cgi?id=150792

        Reviewed by Saam Barati.

        * Configurations/FeatureDefines.xcconfig:

2015-12-01  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r192914.
        https://bugs.webkit.org/show_bug.cgi?id=151734

        JSC tests for this change are failing on 32 and 64-bit bots
        (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "[ES6] Implement LLInt/Baseline Support for ES6 Generators and
        enable this feature"
        https://bugs.webkit.org/show_bug.cgi?id=150792
        http://trac.webkit.org/changeset/192914

2015-12-01  Myles C. Maxfield  <mmaxfield@apple.com>

        [SVG -> OTF Converter] Force UnitsPerEm to 1000
        https://bugs.webkit.org/show_bug.cgi?id=151650

        Reviewed by Antti Koivisto.

        According to the Adobe Type 1 Font Format:

        "Type 1 font programs generally use a 1000 to 1 scaling matrix
        for the definition of the relationship of character space unites
        to user space units."

        Windows actually disregards the "unitsPerEm" value in the "head"
        table for some calculations, and hardcodes 1000 instead. In order
        to have consistent renderings on Windows and OS X, this patch
        forces all generated fonts to have a unitsPerEm of 1000, and
        appropriately scales all necessary values.

        Test: svg/W3C-SVG-1.1/fonts-elem-03-b.svg

        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::scaleUnitsPerEm):
        (WebCore::SVGToOTFFontConverter::appendHEADTable):
        (WebCore::SVGToOTFFontConverter::appendOS2Table):
        (WebCore::SVGToOTFFontConverter::appendVORGTable):
        (WebCore::SVGToOTFFontConverter::appendVHEATable):
        (WebCore::SVGToOTFFontConverter::appendVMTXTable):
        (WebCore::SVGToOTFFontConverter::addKerningPair):
        (WebCore::CFFBuilder::CFFBuilder):
        (WebCore::CFFBuilder::boundingBox):
        (WebCore::CFFBuilder::updateBoundingBox):
        (WebCore::CFFBuilder::unscaledLineTo):
        (WebCore::SVGToOTFFontConverter::transcodeGlyphPaths):
        (WebCore::SVGToOTFFontConverter::processGlyphElement):
        (WebCore::SVGToOTFFontConverter::appendLigatureGlyphs):
        (WebCore::SVGToOTFFontConverter::SVGToOTFFontConverter):

2015-12-01  Brady Eidson  <beidson@apple.com>

        Give a more detailed message for TypeErrors that result from EnforceRange.
        https://bugs.webkit.org/show_bug.cgi?id=151725

        Reviewed by Tim Horton.

        No new tests (Covered by changes to existing tests).

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::rangeErrorString):
        (WebCore::enforceRange):

2015-12-01  Jer Noble  <jer.noble@apple.com>

        [iOS] Abrupt transition between Fullscreen -> PiP
        https://bugs.webkit.org/show_bug.cgi?id=151719

        Reviewed by Eric Carlson.

        Rather than abruptly hiding the fullscreen window, explicitly exit fullscreen mode upon entering PiP.

        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (WebVideoFullscreenInterfaceAVKit::didStartPictureInPicture):

2015-12-01  Myles C. Maxfield  <mmaxfield@apple.com>

        Give String and AtomicString an existingHash() function
        https://bugs.webkit.org/show_bug.cgi?id=151717

        Reviewed by Andreas Kling.

        No new tests because there is no behavior change.

        * platform/graphics/Font.cpp:
        (WebCore::CharacterFallbackMapKeyHash::hash):

2015-12-01  Myles C. Maxfield  <mmaxfield@apple.com>

        [Win] Build fix after r192895

        Unreviewed.

        * platform/graphics/FontPlatformData.h:
        (WebCore::FontPlatformData::isSystemFont):
        (WebCore::FontPlatformData::setIsSystemFont):
        * platform/graphics/win/SimpleFontDataCGWin.cpp:
        (WebCore::Font::platformInit):
        (WebCore::Font::platformWidthForGlyph):

2015-12-01  Alexey Proskuryakov  <ap@apple.com>

        Update bindings test results after r192903.

        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructorConstructor::construct):

2015-12-01  Yusuke Suzuki  <utatane.tea@gmail.com>

        [ES6] Implement LLInt/Baseline Support for ES6 Generators and enable this feature
        https://bugs.webkit.org/show_bug.cgi?id=150792

        Reviewed by Saam Barati.

        * Configurations/FeatureDefines.xcconfig:

2015-12-01  Brady Eidson  <beidson@apple.com>

        Add "RaisesExceptionWithMessage" IDL attribute.
        https://bugs.webkit.org/show_bug.cgi?id=151720

        Reviewed by Alex Christensen.

        No new tests (Covered by changes to existing bindings tests).

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        (GenerateParametersCheck):
        (GenerateReturnParameters):
        (GenerateImplementationFunctionCall):
        (GenerateConstructorDefinition):
        
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_method_with_exception_with_message):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionMethodWithExceptionWithMessage):
        
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj methodWithExceptionWithMessage]):
        
        * bindings/scripts/test/TestObj.idl:

2015-12-01  Darin Adler  <darin@apple.com>

        Fix anomaly where isMouseEvent returns false for wheel events
        https://bugs.webkit.org/show_bug.cgi?id=151685

        Reviewed by Alexey Proskuryakov.

        Back three years ago when we made WheelEvent inherit from MouseEvent,
        someone decided that isMouseEvent should return false for the wheel events.
        An audit of all the callers of isMouseEvent indicated that in almost every
        case, it's better to return true, so this patch does that.

        All the other call sites that were checking isMouseEvent, here and in the
        higher levels of WebKit, benefit from getting true even for wheel events.

        * bindings/objc/DOMEvents.mm:
        (kitClass): Use eventInterface instead of isMouseEvent to create the appropriate
        wrapper class.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition): Eliminated a peculiar search and replace
        mistake; "stateution" instead of "execution".

        * dom/Node.cpp:
        (WebCore::Node::handleLocalEvents): Add an isWheelEvent check here so that we
        will not ignore wheel events. This preserves behavior. A FIXME questions whether
        that is the behavior we want.

        * dom/WheelEvent.cpp:
        (WebCore::WheelEvent::isMouseEvent): Deleted. No need to override and return false.
        * dom/WheelEvent.h: Ditto.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::defaultEventHandler): Removed unneeded checks for
        drag events and wheel events; both are types of mouse event, and so a single
        isMouseEvent check takes care of all three of these.
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::forwardEvent): Ditto.

2015-12-01  Alex Christensen  <achristensen@webkit.org>

        Use Optional for matrix inverses
        https://bugs.webkit.org/show_bug.cgi?id=151575

        Reviewed by Myles C. Maxfield.

        This patch should have no change in behavior.  Some unnecessary checks are removed.
        There are a few places where we are no longer multiplying by the identity matrix.
        This should remind future coders that not all matrices are invertible.

        * css/WebKitCSSMatrix.cpp:
        (WebCore::WebKitCSSMatrix::inverse):
        (WebCore::WebKitCSSMatrix::translate):
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::restore):
        (WebCore::CanvasRenderingContext2D::scale):
        (WebCore::CanvasRenderingContext2D::rotate):
        (WebCore::CanvasRenderingContext2D::translate):
        (WebCore::CanvasRenderingContext2D::transform):
        (WebCore::CanvasRenderingContext2D::setTransform):
        (WebCore::CanvasRenderingContext2D::isPointInPathInternal):
        (WebCore::CanvasRenderingContext2D::isPointInStrokeInternal):
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::computeLineBoundsAndAntialiasingModeForText):
        * platform/graphics/ShadowBlur.cpp:
        (WebCore::ShadowBlur::calculateLayerBoundingRect):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithVideoOutput):
        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::ImageBuffer::putByteArray):
        * platform/graphics/filters/Filter.h:
        (WebCore::Filter::setFilterScale):
        (WebCore::Filter::absoluteTransform):
        (WebCore::Filter::mapAbsolutePointToLocalPoint):
        (WebCore::Filter::renderingMode):
        (WebCore::Filter::setRenderingMode):
        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::paintSelfAndChildrenWithReplica):
        (WebCore::TextureMapperLayer::replicaTransform):
        (WebCore::TextureMapperLayer::setAnimatedFilters):
        (WebCore::TextureMapperLayer::mapScrollOffset):
        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
        (WebCore::CoordinatedGraphicsLayer::transformedVisibleRect):
        (WebCore::CoordinatedGraphicsLayer::computeTransformedVisibleRect):
        * platform/graphics/transforms/AffineTransform.cpp:
        (WebCore::AffineTransform::yScale):
        (WebCore::det):
        (WebCore::AffineTransform::isInvertible):
        (WebCore::AffineTransform::inverse):
        (WebCore::AffineTransform::det): Deleted.
        * platform/graphics/transforms/AffineTransform.h:
        * platform/graphics/transforms/TransformState.cpp:
        (WebCore::TransformState::mappedPoint):
        (WebCore::TransformState::mappedQuad):
        (WebCore::TransformState::mapQuad):
        (WebCore::TransformState::flattenWithTransform):
        * platform/graphics/transforms/TransformationMatrix.cpp:
        (WebCore::TransformationMatrix::isInvertible):
        (WebCore::TransformationMatrix::inverse):
        * platform/graphics/transforms/TransformationMatrix.h:
        * rendering/HitTestingTransformState.cpp:
        (WebCore::HitTestingTransformState::flattenWithTransform):
        (WebCore::HitTestingTransformState::mappedPoint):
        (WebCore::HitTestingTransformState::mappedQuad):
        (WebCore::HitTestingTransformState::mappedArea):
        (WebCore::HitTestingTransformState::boundsOfMappedArea):
        * rendering/PaintInfo.h:
        (WebCore::PaintInfo::applyTransform):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::paintLayerByApplyingTransform):
        (WebCore::RenderLayer::hitTestLayer):
        * rendering/svg/RenderSVGContainer.cpp:
        (WebCore::RenderSVGContainer::nodeAtFloatPoint):
        * rendering/svg/RenderSVGForeignObject.cpp:
        (WebCore::RenderSVGForeignObject::nodeAtFloatPoint):
        * rendering/svg/RenderSVGImage.cpp:
        (WebCore::RenderSVGImage::nodeAtFloatPoint):
        * rendering/svg/RenderSVGResourceClipper.cpp:
        (WebCore::RenderSVGResourceClipper::hitTestClipContent):
        * rendering/svg/RenderSVGResourceFilter.cpp:
        (WebCore::RenderSVGResourceFilter::postApplyResource):
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::nodeAtPoint):
        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::setupNonScalingStrokeContext):
        (WebCore::RenderSVGShape::nodeAtFloatPoint):
        (WebCore::RenderSVGShape::calculateStrokeBoundingBox):
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::nodeAtFloatPoint):
        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::intersectRepaintRectWithShadows):
        * rendering/svg/SVGRenderingContext.cpp:
        (WebCore::SVGRenderingContext::clipToImageBuffer):
        * svg/SVGLocatable.cpp:
        (WebCore::SVGLocatable::getTransformToElement):
        * svg/SVGMatrix.h:
        (WebCore::SVGMatrix::inverse):
        (WebCore::SVGMatrix::rotateFromVector):

2015-12-01  Tim Horton  <timothy_horton@apple.com>

        Remove swipe snapshot before main document load if scroll position is already restored
        https://bugs.webkit.org/show_bug.cgi?id=151224

        Reviewed by Darin Adler.

        * loader/FrameLoaderClient.h:
        * loader/HistoryController.cpp:
        (WebCore::HistoryController::restoreScrollPositionAndViewState):
        Each time we try to restore the scroll position, see if the requested
        scroll position is something we can scroll to by going through ScrollView's
        scroll position constraint logic. If we can scroll there, tell our client
        (and eventually ViewGestureController) that we successfully restored the
        scroll position!

2015-12-01  Myles C. Maxfield  <mmaxfield@apple.com>

        [iOS] Adjacent emoji overlap each other
        https://bugs.webkit.org/show_bug.cgi?id=151690
        <rdar://problem/23430453>

        Reviewed by Simon Fraser.

        This is a partial revert of r188737. It turns out that only CoreText gives correct
        glyph advances for emoji. In r188737, I reverted the special iOS emoji processing,
        but also removed the logic of using CoreText for emoji advances. This patch adds
        the m_isEmoji boolean back, so we can tell if we need to force
        platformWidthForGlyph() to use CoreText.

        This patch also performs a little bit of cleanup by moving Font's m_isSystemFont
        to FontPlatformData where it belongs.

        Test: fast/text/emoji-overlap.html

        * platform/graphics/Font.cpp:
        (WebCore::fillGlyphPage): Removed unnecessary argument.
        (WebCore::Font::Font): Deleted.
        * platform/graphics/Font.h: Moved getters and booleans to FontPlatformData.
        (WebCore::Font::hasCustomTracking): Deleted.
        (WebCore::Font::isSystemFont): Deleted.
        * platform/graphics/FontPlatformData.cpp:
        (WebCore::FontPlatformData::FontPlatformData): Initialize new booleans.
        (WebCore::FontPlatformData::operator=): Ditto.
        * platform/graphics/FontPlatformData.h: Getters for new booleans.
        (WebCore::FontPlatformData::isSystemFont):
        (WebCore::FontPlatformData::hasCustomTracking):
        (WebCore::FontPlatformData::isEmoji):
        * platform/graphics/GlyphPage.h: Remove unnecessary argument.
        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::advanceForColorBitmapFont): Return an Optional instead of using an out
        argument.
        (WebCore::canUseFastGlyphAdvanceGetter): Make sure that we use CoreText if we are
        using the Emoji font.
        (WebCore::Font::platformWidthForGlyph):
        (WebCore::Font::platformInit): Deleted.
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm: Deal with the new booleans.
        (WebCore::FontPlatformData::FontPlatformData):
        (WebCore::FontPlatformData::platformDataInit):
        (WebCore::FontPlatformData::platformDataAssign):
        (WebCore::FontPlatformData::setFont):
        * platform/graphics/freetype/GlyphPageTreeNodeFreeType.cpp:
        (WebCore::GlyphPage::fill): Removed unnecessary argument.
        * platform/graphics/mac/GlyphPageMac.cpp:
        (WebCore::shouldUseCoreText): Use a reference instead of a pointer.
        (WebCore::GlyphPage::fill): Removed unnecessary argument.
        * platform/graphics/win/FontCGWin.cpp:
        (WebCore::FontCascade::drawGlyphs): Update for new location of booleans.
        * platform/graphics/win/GlyphPageTreeNodeCGWin.cpp:
        (WebCore::GlyphPage::fill): Removed unnecessary argument.
        * platform/graphics/win/GlyphPageTreeNodeCairoWin.cpp:
        (WebCore::GlyphPage::fill): Removed unnecessary argument.
        * platform/graphics/win/UniscribeController.cpp:
        (WebCore::UniscribeController::shapeAndPlaceItem): Update for new location of
        booleans.

2015-12-01  Myles C. Maxfield  <mmaxfield@apple.com>

        [Win] Web fonts with small caps have excess whitespace with the complex text codepath
        https://bugs.webkit.org/show_bug.cgi?id=151698

        Reviewed by Darin Adler.

        When performing small-caps on OS X, we bake in the smaller font size into the platform's native font
        object. On Windows, we currently don't do that; instead, we just change some ancillary data inside
        the FontPlatformData, and our advance & drawing calculations are sensitive to this ancillary data.
        However, in the complex text codepath, Uniscribe only takes the native font object as input, and
        therefore operates with the wrong font size.

        The solution is to bake the smaller font size into the native platform font on Windows, similar to
        OS X. It isn't clear why we didn't do this previously, but it seems like we weren't sure that
        Windows would select the correct font when we provide new selection criteria. However, for web fonts,
        we already use the same mechanism (CreateFontIndirect()) when we create the font in the first place;
        therefore, this scaled font request will always work as well.

        Test: fast/text/small-caps-complex.html

        * platform/graphics/win/SimpleFontDataWin.cpp:
        (WebCore::Font::platformCreateScaledFont): Deleted.

2015-12-01  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/create-and-remove-object-store.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=151704

        Reviewed by Alex Christensen.

        No new tests (At least one previously failing test now passes).

        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::deleteObjectStore):

2015-12-01  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/basics.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=151694

        Reviewed by Alex Christensen.

        No new tests (At least one failing test now passes, and covered by changes to 3 previously incorrect tests).

        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::versionChangeTransactionWillFinish): Set the flag determining whether
          or not the request's transaction should be exposed to the DOM.
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.h:
        
        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::result): Throw an exception if the request is not done.
        (WebCore::IDBClient::IDBRequest::error): Ditto.
        (WebCore::IDBClient::IDBRequest::transaction): Only return the transaction to the DOM if the flag says so.
        * Modules/indexeddb/client/IDBRequestImpl.h:
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::abort):
        (WebCore::IDBClient::IDBTransaction::commit):

2015-12-01  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] ASSERTION FAILED: m_table running /webkit2/BackForwardList/navigation in Debug build
        https://bugs.webkit.org/show_bug.cgi?id=151700

        Reviewed by Martin Robinson.

        This happens when the frame notifies its observers that the page
        will be detached. The m_table that asserts is the
        FrameDestructionObserver HashSet. It happens when clearing the
        GObject DOM cache wrappers during frame destruction, and there's a
        Document object wrapped whose last reference is held by the DOM
        wrapper. In that case, the Document object is destroyed while the
        frame is being destroyed. Deleting the wrapper objects after the
        frame destruction fixes the crash.

        * bindings/gobject/DOMObjectCache.cpp:

2015-12-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Streams API] pull function of tee should call readFromReadableStreamReader directly
        https://bugs.webkit.org/show_bug.cgi?id=151497

        Reviewed by Darin Adler.

        Covered by added test.

        * Modules/streams/ReadableStreamInternals.js:
        (teeReadableStreamPullFunction): directly calling readFromReadableStreamReader.

2015-12-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Streams API] Clean-up JS built-in code using arrow functions
        https://bugs.webkit.org/show_bug.cgi?id=151489

        Reviewed by Darin Adler.

        Using arrow functions to remove need for _this.
        Made errorWritableStream take two parameters to simplify code and align it with the spec.

        No change in behavior.

        * Modules/streams/ReadableStream.js:
        (initializeReadableStream):
        * Modules/streams/WritableStream.js:
        (initializeWritableStream):
        (abort):
        (write):
        * Modules/streams/WritableStreamInternals.js:
        (errorWritableStream):
        (writableStreamAdvanceQueue):
        (closeWritableStream):

2015-12-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Streams API] teeReadableStream should not directly use stream.getReader()
        https://bugs.webkit.org/show_bug.cgi?id=151487

        Reviewed by Darin Adler.

        Covered by added test.

        * Modules/streams/ReadableStreamInternals.js:
        (teeReadableStream): Create a @ReadableStreamReader instead of calling getReader() which may be disrupted by user scripts.

2015-12-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Streams API] streams should not directly use Number and related methods
        https://bugs.webkit.org/show_bug.cgi?id=151499

        Reviewed by Darin Adler.

        Covered by updated test.

        Using @Number, @isFinite and @isNaN in place of Number, Number.isFinite and Number.isNaN.

        * Modules/streams/ReadableStreamInternals.js:
        (enqueueInReadableStream):
        * Modules/streams/StreamInternals.js:
        (validateAndNormalizeQueuingStrategy):
        (enqueueValueWithSize):

2015-12-01  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GTK+ build after r192849.

        * bindings/scripts/CodeGeneratorGObject.pm:
        (GenerateFunction):
        * bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp:
        (webkit_dom_test_interface_supplemental_method1):
        (webkit_dom_test_interface_supplemental_method2):
        (webkit_dom_test_interface_set_supplemental_str2):
        (webkit_dom_test_interface_get_supplemental_node):
        (webkit_dom_test_interface_set_supplemental_node):

2015-12-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Streams API] Remove use of @catch for exposed promises
        https://bugs.webkit.org/show_bug.cgi?id=151625

        Reviewed by Darin Adler.

        Promise @catch is calling "then" which may be controlled by user scripts.
        This patch simply replaces @catch by calling @then directly.

        Covered by modified tests.

        * Modules/streams/ReadableStream.js:
        (pipeTo):
        * Modules/streams/ReadableStreamInternals.js:
        (teeReadableStream):

2015-11-30  Jaehun Lim  <ljaehun.lim@samsung.com>

        Unreviewed, fix build after r192848 and r192849

        - Rename canSuspendForPageCache to canSuspendForDocumentSuspension
        - Use references instead of pointers

        * Modules/battery/BatteryManager.cpp:
        (WebCore::BatteryManager::canSuspendForDocumentSuspension):
        (WebCore::BatteryManager::canSuspendForPageCache): Deleted.
        * Modules/battery/BatteryManager.h:
        * Modules/battery/NavigatorBattery.cpp:
        (WebCore::NavigatorBattery::webkitBattery):
        * Modules/battery/NavigatorBattery.h:
        * Modules/gamepad/deprecated/NavigatorGamepad.cpp:
        (WebCore::NavigatorGamepad::webkitGetGamepads):
        * Modules/gamepad/deprecated/NavigatorGamepad.h:
        * Modules/navigatorcontentutils/NavigatorContentUtils.cpp:
        (WebCore::NavigatorContentUtils::registerProtocolHandler):
        (WebCore::NavigatorContentUtils::isProtocolHandlerRegistered):
        (WebCore::NavigatorContentUtils::unregisterProtocolHandler):
        * Modules/navigatorcontentutils/NavigatorContentUtils.h:
        * Modules/vibration/NavigatorVibration.cpp:
        (WebCore::NavigatorVibration::vibrate):
        * Modules/vibration/NavigatorVibration.h:

2015-11-30  Jiewen Tan  <jiewen_tan@apple.com>

        Amazon.com Additional Information links aren't clickable
        https://bugs.webkit.org/show_bug.cgi?id=151401
        <rdar://problem/23454261>

        Reviewed by Darin Adler.

        The cause of this issue is that the painting order is different from the hittest order so we can end up
        with visible but unreachable content. To fix this, the executation flow of hittest has been reordered.
        According to the paint system, which renders the webpage from the bottom RenderLayer to the top, contents
        are rendered before floats. Hence, for the hittest, which determines the hitted location from top RenderLayer
        to the bottom, should do it reversedly. Now, hittest will first test floats then contents.

        Test: fast/block/float/hit-test-on-overlapping-floats.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::nodeAtPoint):

2015-11-30  Simon Fraser  <simon.fraser@apple.com>

        Fix possible crash with animated layers in reflections
        https://bugs.webkit.org/show_bug.cgi?id=151689
        rdar://problem/23018612

        Reviewed by Darin Adler.

        Reflections create additional PlatformCALayers whose owner is set to the GraphicsLayerCA.
        Those PlatformCALayers need their owner pointer cleared out when the GraphicsLayerCA
        is destroyed.
        
        Tested by compositing/reflections/nested-reflection-transition.html

        * platform/graphics/ca/GraphicsLayerCA.cpp:
        * platform/graphics/ca/GraphicsLayerCA.h:

2015-11-30  Brady Eidson  <beidson@apple.com>

        Modern IDB: Iterating index cursors to a specific key is busted.
        https://bugs.webkit.org/show_bug.cgi?id=151684

        Reviewed by Darin Adler.

        No new tests (At least one failing test now passes).

        * Modules/indexeddb/server/MemoryIndexCursor.cpp:
        (WebCore::IDBServer::MemoryIndexCursor::iterate):

2015-11-30  Brady Eidson  <beidson@apple.com>

        Modern IDB: ObjectStore cursors should not be able to iterate out of their range.
        https://bugs.webkit.org/show_bug.cgi?id=151683

        Reviewed by Darin Adler.

        No new tests (Covered by at least one failing test that now passes).

        * Modules/indexeddb/server/MemoryObjectStoreCursor.cpp:
        (WebCore::IDBServer::MemoryObjectStoreCursor::incrementForwardIterator):
        (WebCore::IDBServer::MemoryObjectStoreCursor::incrementReverseIterator):

2015-11-30  Anders Carlsson  <andersca@apple.com>

        CTTE autogenerated bindings code
        https://bugs.webkit.org/show_bug.cgi?id=151682

        Reviewed by Darin Adler.

        Make sure that JS bindings pass a reference to the object when calling static member functions.

        * Modules/gamepad/NavigatorGamepad.cpp:
        (WebCore::NavigatorGamepad::getGamepads):
        * Modules/gamepad/NavigatorGamepad.h:
        * Modules/geolocation/NavigatorGeolocation.cpp:
        (WebCore::NavigatorGeolocation::geolocation):
        * Modules/geolocation/NavigatorGeolocation.h:
        * Modules/mediasource/AudioTrackMediaSource.h:
        (WebCore::AudioTrackMediaSource::sourceBuffer):
        * Modules/mediasource/TextTrackMediaSource.h:
        (WebCore::TextTrackMediaSource::sourceBuffer):
        * Modules/mediasource/VideoTrackMediaSource.h:
        (WebCore::VideoTrackMediaSource::sourceBuffer):
        * Modules/mediastream/HTMLMediaElementMediaStream.cpp:
        (WebCore::HTMLMediaElementMediaStream::srcObject):
        (WebCore::HTMLMediaElementMediaStream::setSrcObject):
        * Modules/mediastream/HTMLMediaElementMediaStream.h:
        * Modules/mediastream/NavigatorMediaDevices.cpp:
        (WebCore::NavigatorMediaDevices::mediaDevices):
        * Modules/mediastream/NavigatorMediaDevices.h:
        * Modules/notifications/DOMWindowNotifications.cpp:
        (WebCore::DOMWindowNotifications::webkitNotifications):
        * Modules/notifications/DOMWindowNotifications.h:
        * Modules/notifications/Notification.cpp:
        (WebCore::Notification::Notification):
        * Modules/notifications/WorkerGlobalScopeNotifications.cpp:
        (WebCore::WorkerGlobalScopeNotifications::webkitNotifications):
        * Modules/notifications/WorkerGlobalScopeNotifications.h:
        * Modules/speech/DOMWindowSpeechSynthesis.cpp:
        (WebCore::DOMWindowSpeechSynthesis::speechSynthesis):
        * Modules/speech/DOMWindowSpeechSynthesis.h:
        * Modules/webdatabase/DOMWindowWebDatabase.cpp:
        (WebCore::DOMWindowWebDatabase::openDatabase):
        * Modules/webdatabase/DOMWindowWebDatabase.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        (GenerateParametersCheck):
        * testing/Internals.cpp:
        (WebCore::Internals::enableMockSpeechSynthesizer):

2015-11-30  Katlyn Graff  <kgraff@apple.com>

        Rename ActiveDOMObject/DOMWindow PageCacheSuspension code to support more reasons for suspension
        https://bugs.webkit.org/show_bug.cgi?id=151677

        Reviewed by Ryosuke Niwa.

        Simply a refactoring patch, so no new tests.

        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::canSuspendForDocumentSuspension):
        (WebCore::MediaKeySession::canSuspendForPageCache): Deleted.
        * Modules/encryptedmedia/MediaKeySession.h:
        * Modules/geolocation/Geolocation.cpp:
        (WebCore::Geolocation::canSuspendForDocumentSuspension):
        (WebCore::Geolocation::canSuspendForPageCache): Deleted.
        * Modules/geolocation/Geolocation.h:
        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
        (WebCore::DOMWindowIndexedDatabase::disconnectFrameForDocumentSuspension):
        (WebCore::DOMWindowIndexedDatabase::reconnectFrameFromDocumentSuspension):
        (WebCore::DOMWindowIndexedDatabase::disconnectFrameForPageCache): Deleted.
        (WebCore::DOMWindowIndexedDatabase::reconnectFrameFromPageCache): Deleted.
        * Modules/indexeddb/DOMWindowIndexedDatabase.h:
        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::canSuspendForDocumentSuspension):
        (WebCore::IDBClient::IDBDatabase::canSuspendForPageCache): Deleted.
        * Modules/indexeddb/client/IDBDatabaseImpl.h:
        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::canSuspendForDocumentSuspension):
        (WebCore::IDBClient::IDBRequest::canSuspendForPageCache): Deleted.
        * Modules/indexeddb/client/IDBRequestImpl.h:
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::canSuspendForDocumentSuspension):
        (WebCore::IDBClient::IDBTransaction::canSuspendForPageCache): Deleted.
        * Modules/indexeddb/client/IDBTransactionImpl.h:
        * Modules/indexeddb/legacy/LegacyDatabase.cpp:
        (WebCore::LegacyDatabase::canSuspendForDocumentSuspension):
        (WebCore::LegacyDatabase::canSuspendForPageCache): Deleted.
        * Modules/indexeddb/legacy/LegacyDatabase.h:
        * Modules/indexeddb/legacy/LegacyRequest.cpp:
        (WebCore::LegacyRequest::canSuspendForDocumentSuspension):
        (WebCore::LegacyRequest::canSuspendForPageCache): Deleted.
        * Modules/indexeddb/legacy/LegacyRequest.h:
        * Modules/indexeddb/legacy/LegacyTransaction.cpp:
        (WebCore::LegacyTransaction::canSuspendForDocumentSuspension):
        (WebCore::LegacyTransaction::canSuspendForPageCache): Deleted.
        * Modules/indexeddb/legacy/LegacyTransaction.h:
        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::canSuspendForDocumentSuspension):
        (WebCore::MediaSource::canSuspendForPageCache): Deleted.
        * Modules/mediasource/MediaSource.h:
        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::canSuspendForDocumentSuspension):
        (WebCore::SourceBuffer::canSuspendForPageCache): Deleted.
        * Modules/mediasource/SourceBuffer.h:
        * Modules/mediastream/MediaStreamTrack.cpp:
        (WebCore::MediaStreamTrack::canSuspendForDocumentSuspension):
        (WebCore::MediaStreamTrack::canSuspendForPageCache): Deleted.
        * Modules/mediastream/MediaStreamTrack.h:
        * Modules/mediastream/RTCDTMFSender.cpp:
        (WebCore::RTCDTMFSender::canSuspendForDocumentSuspension):
        (WebCore::RTCDTMFSender::canSuspendForPageCache): Deleted.
        * Modules/mediastream/RTCDTMFSender.h:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::canSuspendForDocumentSuspension):
        (WebCore::RTCPeerConnection::canSuspendForPageCache): Deleted.
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/notifications/DOMWindowNotifications.cpp:
        (WebCore::DOMWindowNotifications::disconnectFrameForDocumentSuspension):
        (WebCore::DOMWindowNotifications::reconnectFrameFromDocumentSuspension):
        (WebCore::DOMWindowNotifications::disconnectFrameForPageCache): Deleted.
        (WebCore::DOMWindowNotifications::reconnectFrameFromPageCache): Deleted.
        * Modules/notifications/DOMWindowNotifications.h:
        * Modules/notifications/Notification.cpp:
        (WebCore::Notification::canSuspendForDocumentSuspension):
        (WebCore::Notification::canSuspendForPageCache): Deleted.
        * Modules/notifications/Notification.h:
        * Modules/notifications/NotificationCenter.cpp:
        (WebCore::NotificationCenter::canSuspendForDocumentSuspension):
        (WebCore::NotificationCenter::canSuspendForPageCache): Deleted.
        * Modules/notifications/NotificationCenter.h:
        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::canSuspendForDocumentSuspension):
        (WebCore::AudioContext::canSuspendForPageCache): Deleted.
        * Modules/webaudio/AudioContext.h:
        * Modules/webdatabase/DatabaseContext.cpp:
        (WebCore::DatabaseContext::canSuspendForDocumentSuspension):
        (WebCore::DatabaseContext::canSuspendForPageCache): Deleted.
        * Modules/webdatabase/DatabaseContext.h:
        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::canSuspendForDocumentSuspension):
        (WebCore::WebSocket::canSuspendForPageCache): Deleted.
        * Modules/websockets/WebSocket.h:
        * css/FontLoader.cpp:
        (WebCore::FontLoader::canSuspendForDocumentSuspension):
        (WebCore::FontLoader::canSuspendForPageCache): Deleted.
        * css/FontLoader.h:
        * dom/ActiveDOMObject.cpp:
        (WebCore::ActiveDOMObject::canSuspendForDocumentSuspension):
        (WebCore::ActiveDOMObject::canSuspendForPageCache): Deleted.
        * dom/ActiveDOMObject.h:
        * dom/Document.cpp:
        (WebCore::Document::~Document):
        * dom/ScriptExecutionContext.cpp:
        (WebCore::ScriptExecutionContext::canSuspendActiveDOMObjectsForTabSuspension):
        (WebCore::ScriptExecutionContext::canSuspendActiveDOMObjectsForPageCache): Deleted.
        * dom/ScriptExecutionContext.h:
        * fileapi/FileReader.cpp:
        (WebCore::FileReader::canSuspendForDocumentSuspension):
        (WebCore::FileReader::canSuspendForPageCache): Deleted.
        * fileapi/FileReader.h:
        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::CachedFrame):
        * history/PageCache.cpp:
        (WebCore::canCacheFrame):
        * html/HTMLMarqueeElement.cpp:
        (WebCore::HTMLMarqueeElement::canSuspendForDocumentSuspension):
        (WebCore::HTMLMarqueeElement::canSuspendForPageCache): Deleted.
        * html/HTMLMarqueeElement.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::canSuspendForDocumentSuspension):
        (WebCore::HTMLMediaElement::canSuspendForPageCache): Deleted.
        * html/HTMLMediaElement.h:
        * html/HTMLSourceElement.cpp:
        (WebCore::HTMLSourceElement::canSuspendForDocumentSuspension):
        (WebCore::HTMLSourceElement::canSuspendForPageCache): Deleted.
        * html/HTMLSourceElement.h:
        * html/PublicURLManager.cpp:
        (WebCore::PublicURLManager::canSuspendForDocumentSuspension):
        (WebCore::PublicURLManager::canSuspendForPageCache): Deleted.
        * html/PublicURLManager.h:
        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::canSuspendForDocumentSuspension):
        (WebCore::WebGLRenderingContextBase::canSuspendForPageCache): Deleted.
        * html/canvas/WebGLRenderingContextBase.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::clear):
        (WebCore::FrameLoader::open):
        * loader/appcache/DOMApplicationCache.cpp:
        (WebCore::DOMApplicationCache::disconnectFrameForDocumentSuspension):
        (WebCore::DOMApplicationCache::reconnectFrameFromDocumentSuspension):
        (WebCore::DOMApplicationCache::disconnectFrameForPageCache): Deleted.
        (WebCore::DOMApplicationCache::reconnectFrameFromPageCache): Deleted.
        * loader/appcache/DOMApplicationCache.h:
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::DOMWindow):
        (WebCore::DOMWindow::~DOMWindow):
        (WebCore::DOMWindow::resetUnlessSuspendedForDocumentSuspension):
        (WebCore::DOMWindow::suspendForDocumentSuspension):
        (WebCore::DOMWindow::resumeFromDocumentSuspension):
        (WebCore::DOMWindow::disconnectDOMWindowProperties):
        (WebCore::DOMWindow::reconnectDOMWindowProperties):
        (WebCore::DOMWindow::resetUnlessSuspendedForPageCache): Deleted.
        (WebCore::DOMWindow::suspendForPageCache): Deleted.
        (WebCore::DOMWindow::resumeFromPageCache): Deleted.
        * page/DOMWindow.h:
        * page/DOMWindowExtension.cpp:
        (WebCore::DOMWindowExtension::disconnectFrameForDocumentSuspension):
        (WebCore::DOMWindowExtension::reconnectFrameFromDocumentSuspension):
        (WebCore::DOMWindowExtension::disconnectFrameForPageCache): Deleted.
        (WebCore::DOMWindowExtension::reconnectFrameFromPageCache): Deleted.
        * page/DOMWindowExtension.h:
        * page/DOMWindowProperty.cpp:
        (WebCore::DOMWindowProperty::disconnectFrameForDocumentSuspension):
        (WebCore::DOMWindowProperty::reconnectFrameFromDocumentSuspension):
        (WebCore::DOMWindowProperty::disconnectFrameForPageCache): Deleted.
        (WebCore::DOMWindowProperty::reconnectFrameFromPageCache): Deleted.
        * page/DOMWindowProperty.h:
        * page/EventSource.cpp:
        (WebCore::EventSource::canSuspendForDocumentSuspension):
        (WebCore::EventSource::canSuspendForPageCache): Deleted.
        * page/EventSource.h:
        * page/SuspendableTimer.cpp:
        (WebCore::SuspendableTimer::canSuspendForDocumentSuspension):
        (WebCore::SuspendableTimer::canSuspendForPageCache): Deleted.
        * page/SuspendableTimer.h:
        * workers/Worker.cpp:
        (WebCore::Worker::canSuspendForDocumentSuspension):
        (WebCore::Worker::canSuspendForPageCache): Deleted.
        * workers/Worker.h:
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::canSuspendForDocumentSuspension):
        (WebCore::XMLHttpRequest::canSuspendForPageCache): Deleted.
        * xml/XMLHttpRequest.h:

2015-11-30  Brady Eidson  <beidson@apple.com>

        Modern IDB: "prevunique" cursors should point at the lowest primary key that matches, not the highest.
        https://bugs.webkit.org/show_bug.cgi?id=151675.

        Reviewed by Darin Adler.

        No new tests (Covered by at least one failing test that now passes, and updates to previously incorrect tests).

        * Modules/indexeddb/server/IndexValueEntry.cpp:
        (WebCore::IDBServer::IndexValueEntry::reverseBegin): If CursorDuplicity is NoDuplicates, start at the lowest
          entry instead of the highest.
        (WebCore::IDBServer::IndexValueEntry::reverseFind):
        * Modules/indexeddb/server/IndexValueEntry.h:
        
        * Modules/indexeddb/server/IndexValueStore.cpp:
        (WebCore::IDBServer::IndexValueStore::reverseFind):
        (WebCore::IDBServer::IndexValueStore::Iterator::Iterator):
        (WebCore::IDBServer::IndexValueStore::Iterator::nextIndexEntry):
        * Modules/indexeddb/server/IndexValueStore.h:
        
        * Modules/indexeddb/server/MemoryIndexCursor.cpp:
        (WebCore::IDBServer::MemoryIndexCursor::MemoryIndexCursor):
        (WebCore::IDBServer::MemoryIndexCursor::iterate):
        
        * Modules/indexeddb/shared/IDBCursorInfo.cpp:
        (WebCore::IDBCursorInfo::duplicity):
        (WebCore::IDBCursorInfo::isDirectionNoDuplicate): Deleted.
        * Modules/indexeddb/shared/IDBCursorInfo.h:

2015-11-30  Jiewen Tan  <jiewen_tan@apple.com>

        Null dereference loading Blink layout test http/tests/misc/detach-during-notifyDone.html
        https://bugs.webkit.org/show_bug.cgi?id=149309
        <rdar://problem/22748363>

        Reviewed by Brent Fulgham.

        A weird order of event execution introduced by the test case will kill the webpage in a
        subframe of the page while executing its |frame.loader().checkLoadCompleteForThisFrame()|.
        Therefore, any frames comes after the failing subframe will have no page. Check it before
        calling to those frames' |frame.loader().checkLoadCompleteForThisFrame()|, otherwise the
        assertion in |frame.loader().checkLoadCompleteForThisFrame()| will fail.

        Test: http/tests/misc/detach-during-notifyDone.html

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkLoadComplete):

2015-11-30  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r192819.
        https://bugs.webkit.org/show_bug.cgi?id=151681

        This change broke existing layout tests on Windows (Requested
        by ryanhaddad on #webkit).

        Reverted changeset:

        "Unify font-variant-* with font-variant shorthand"
        https://bugs.webkit.org/show_bug.cgi?id=149773
        http://trac.webkit.org/changeset/192819

2015-11-30  Darin Adler  <darin@apple.com>

        Use Optional instead of isNull out argument for nullable getters
        https://bugs.webkit.org/show_bug.cgi?id=151676

        Reviewed by Anders Carlsson.

        No behavior change, just cleaner code.

        * Modules/geolocation/Coordinates.cpp:
        (WebCore::Coordinates::altitude): Return an Optional.
        (WebCore::Coordinates::altitudeAccuracy): Ditto.
        (WebCore::Coordinates::heading): Ditto.
        (WebCore::Coordinates::speed): Ditto.
        * Modules/geolocation/Coordinates.h: Ditto.

        * Modules/indexeddb/IDBVersionChangeEvent.cpp:
        (WebCore::IDBVersionChangeEvent::create): Added. The code before was calling
        through to Event::create, which is clearly not what was wanted. Also removed
        unneeded explicit destructor.
        * Modules/indexeddb/IDBVersionChangeEvent.h: Changed return type of newVersion
        to Optional and updated for above change.

        * Modules/indexeddb/client/IDBVersionChangeEventImpl.cpp:
        (WebCore::IDBClient::IDBVersionChangeEvent::newVersion): Changed to return
        an Optional.
        * Modules/indexeddb/client/IDBVersionChangeEventImpl.h: Removed unused
        default argument values; the event type one, at least, was clearly incorrect.
        Made more things private, got rid of unneeded destructor, marked class final
        instead of marking all functions final.

        * Modules/indexeddb/legacy/LegacyVersionChangeEvent.cpp:
        (WebCore::LegacyVersionChangeEvent::newVersion): Same as above.
        * Modules/indexeddb/legacy/LegacyVersionChangeEvent.h: Ditto.

        * Modules/mediastream/MediaTrackConstraints.cpp:
        (WebCore::MediaTrackConstraints::optional): Removed bogus bool value. If we
        come back to finish later we will have to implement optional return values
        for arrays in the JavaScript bindings generator, which should be straightforward.
        * Modules/mediastream/MediaTrackConstraints.h: Ditto.

        * bindings/js/JSDOMBinding.h:
        (WebCore::toNullableJSNumber): Added. This function template is used for
        return values that are nullable numbers.

        * bindings/scripts/CodeGeneratorGObject.pm:
        (GenerateFunction): Replaced some existing bogus code to handle nullables with
        new equally-bogus code that should be no worse and will compile.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation): Removed old support for nullables.
        (NativeToJSValue): Added new support for nullable numbers.

        * bindings/scripts/CodeGeneratorObjC.pm:
        (GenerateImplementation): Removed support for nullables. We almost certainly
        won't need it for Objective-C bindings.

        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp: Updated.
        * bindings/scripts/test/JS/JSTestObj.cpp: Updated.
        * bindings/scripts/test/ObjC/DOMTestObj.mm: Updated.

2015-11-30  Wenson Hsieh  <wenson_hsieh@apple.com>

        Split platform-independent logic in AVCaptureDeviceManager out into a new class
        https://bugs.webkit.org/show_bug.cgi?id=151388
        <rdar://problem/23593980>

        Reviewed by Eric Carlson.

        To prepare for creating a MockCaptureDeviceManager to be able to test
        MediaDevices.getUserMedia, we create a platform-independent capture device manager
        which all platforms should extend and add platform-specific logic to.

        The methods CaptureDeviceManager::createMediaSourceForCaptureDeviceWithConstraints and
        CaptureDeviceManager::captureDeviceList should be overridden by each platform
        CaptureDeviceManager to respectively create a RealtimeMediaSource and return a list of
        capture devices. createMediaSourceForCaptureDeviceWithConstraints attempts to create
        a media source for a given device with some constraints; if the contraints cannot be
        satisfied, this returns null.

        The refactored capture device manager also introduces the notion of a platform-
        independent capture session which may be extended by platform device managers for
        determining whether a given constraint name, value and media type is valid.

        A platform-independent CaptureDeviceInfo now represents either the video or audio
        component of a capture device, but not both at once. This means a capture device that
        supports both video and audio will emit two separate capture devices.

        No new tests, since there should be no behavior change.

        * Modules/mediastream/CaptureDeviceInfo.h: Added.
        (WebCore::CaptureSessionInfo::~CaptureSessionInfo):
        (WebCore::CaptureSessionInfo::supportsVideoSize):
        (WebCore::CaptureSessionInfo::bestSessionPresetForVideoDimensions):
        * Modules/mediastream/CaptureDeviceManager.cpp: Added.
        (CaptureDeviceManager::~CaptureDeviceManager):
        (CaptureDeviceManager::getSourcesInfo):
        (CaptureDeviceManager::captureDeviceFromDeviceID):
        (CaptureDeviceManager::verifyConstraintsForMediaType):
        (CaptureDeviceManager::bestSourcesForTypeAndConstraints):
        (CaptureDeviceManager::sourceWithUID):
        (CaptureDeviceManager::bestDeviceForFacingMode):
        (facingModeFromString):
        (CaptureDeviceManager::sessionSupportsConstraint):
        (CaptureDeviceManager::isSupportedFrameRate):
        * Modules/mediastream/CaptureDeviceManager.h: Added.
        (WebCore::CaptureDeviceManager::refreshCaptureDeviceList):
        (WebCore::CaptureDeviceManager::defaultCaptureSession):
        * WebCore.xcodeproj/project.pbxproj:
        * platform/mediastream/RealtimeMediaSourceSupportedConstraints.cpp: Added.
        (WebCore::RealtimeMediaSourceSupportedConstraints::nameForConstraint):
        (WebCore::RealtimeMediaSourceSupportedConstraints::constraintFromName):
        (WebCore::RealtimeMediaSourceSupportedConstraints::supportsConstraint):
        * platform/mediastream/RealtimeMediaSourceSupportedConstraints.h:
        * platform/mediastream/mac/AVCaptureDeviceManager.h:
        * platform/mediastream/mac/AVCaptureDeviceManager.mm:
        (WebCore::AVCaptureSessionInfo::AVCaptureSessionInfo):
        (WebCore::AVCaptureSessionInfo::supportsVideoSize):
        (WebCore::AVCaptureSessionInfo::bestSessionPresetForVideoDimensions):
        (WebCore::AVCaptureDeviceManager::captureDeviceList):
        (WebCore::shouldConsiderDeviceInDeviceList):
        (WebCore::AVCaptureDeviceManager::refreshCaptureDeviceList):
        (WebCore::AVCaptureDeviceManager::AVCaptureDeviceManager):
        (WebCore::AVCaptureDeviceManager::bestSourcesForTypeAndConstraints):
        (WebCore::AVCaptureDeviceManager::sourceWithUID):
        (WebCore::AVCaptureDeviceManager::getSourcesInfo):
        (WebCore::AVCaptureDeviceManager::verifyConstraintsForMediaType):
        (WebCore::AVCaptureDeviceManager::defaultCaptureSession):
        (WebCore::AVCaptureDeviceManager::sessionSupportsConstraint):
        (WebCore::AVCaptureDeviceManager::createMediaSourceForCaptureDeviceWithConstraints):
        (WebCore::AVCaptureDeviceManager::deviceDisconnected):
        (WebCore::AVCaptureDeviceManager::isSupportedFrameRate):
        (WebCore::CaptureDevice:::m_enabled): Deleted.
        (WebCore::captureDeviceList): Deleted.
        (WebCore::captureDeviceFromDeviceID): Deleted.
        (WebCore::refreshCaptureDeviceList): Deleted.
        (WebCore::AVCaptureDeviceManager::bestSessionPresetForVideoSize): Deleted.
        (WebCore::AVCaptureDeviceManager::deviceSupportsFacingMode): Deleted.
        (WebCore::AVCaptureDeviceManager::bestDeviceForFacingMode): Deleted.
        (WebCore::AVCaptureDeviceManager::isValidConstraint): Deleted.
        (WebCore::AVCaptureDeviceManager::validConstraintNames): Deleted.
        (WebCore::AVCaptureDeviceManager::validFacingModes): Deleted.
        * platform/mediastream/mac/AVVideoCaptureSource.mm:
        (WebCore::AVVideoCaptureSource::applyConstraints):
        * platform/mediastream/mac/RealtimeMediaSourceCenterMac.cpp:
        (WebCore::RealtimeMediaSourceCenterMac::validateRequestConstraints):
        (WebCore::RealtimeMediaSourceCenterMac::createMediaStream):

2015-11-30  Brady Eidson  <beidson@apple.com>

        Modern IDB: Set the correct source on the IDBRequest for cursor updates
        https://bugs.webkit.org/show_bug.cgi?id=151665

        Reviewed by Andy Estes.

        No new tests (At least one existing failing test now passes).

        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::update):
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::putForCursorUpdate):
        (WebCore::IDBClient::IDBObjectStore::putOrAdd):
        * Modules/indexeddb/client/IDBObjectStoreImpl.h:
        
        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::IDBRequest):
        (WebCore::IDBClient::IDBRequest::setSource):
        * Modules/indexeddb/client/IDBRequestImpl.h:

2015-11-30  Tim Horton  <timothy_horton@apple.com>

        Get rid of the legacy TextIndicatorWindow style
        https://bugs.webkit.org/show_bug.cgi?id=151674

        Reviewed by Anders Carlsson.

        * page/TextIndicator.h:
        * page/mac/TextIndicatorWindow.mm:
        (-[WebTextIndicatorView initWithFrame:textIndicator:margin:offset:]): Deleted.

2015-11-30  Brady Eidson  <beidson@apple.com>

        Modern IDB: Correct handling of cursors finishing iteration.
        https://bugs.webkit.org/show_bug.cgi?id=151664

        Reviewed by Andy Estes.

        No new tests (At least one previously failing test now passes).

        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::setGetResult):
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::putOrAdd):

2015-11-30  Myles C. Maxfield  <mmaxfield@apple.com>

        Unify font-variant-* with font-variant shorthand
        https://bugs.webkit.org/show_bug.cgi?id=149773

        Reviewed by Darin Adler.

        This patch makes font-variant a shorthand for the following properties:
        font-variant-ligatures
        font-variant-position
        font-variant-caps
        font-variant-numeric
        font-variant-alternates
        font-variant-east-asian

        This is consistent with the CSS Fonts Level 3 spec.

        This patch also migrates the "font" longhand to use the font-variant-caps
        property.

        Test: fast/text/font-variant-shorthand.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::fontVariantEastAsianPropertyValue): Rename FontVariantEastAsian values.
        (WebCore::fontVariantFromStyle): We must consult with the longhand properties to determine
        font-variant computed style.
        (WebCore::ComputedStyleExtractor::propertyValue): Don't put any-old font-variant-caps inside
        the font shorthand.
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::addFontFaceRule): Guard against incorrect downcasts (due to inherit
        of the new shorthand property).
        * css/CSSParser.cpp: Parse font-variant as a shorthand. Also implement its "normal" and "none" values.
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseFont):
        (WebCore::CSSParser::parseSystemFont):
        (WebCore::CSSParser::parseFontVariantLigatures):
        (WebCore::CSSParser::parseFontVariantNumeric):
        (WebCore::CSSParser::parseFontVariantEastAsian):
        (WebCore::CSSParser::parseFontVariant):
        (WebCore::isValidKeywordPropertyAndValue): Deleted.
        (WebCore::isKeywordPropertyID): Deleted.
        * css/CSSParser.h:
        * css/CSSPropertyNames.in: Turn font-variant into a shorthand property.
        * css/FontVariantBuilder.h: Guard against incorrect downcasts. Also update for renamed
        FontVariantEastAsian type.
        (WebCore::applyValueFontVariantLigatures):
        (WebCore::applyValueFontVariantNumeric):
        (WebCore::applyValueFontVariantEastAsian):
        * css/StyleProperties.cpp: Update to use the more specific property.
        (WebCore::StyleProperties::appendFontLonghandValueIfExplicit):
        (WebCore::StyleProperties::fontValue):
        (WebCore::StyleProperties::asText):
        * css/StyleResolver.cpp: Ditto.
        (WebCore::StyleResolver::isValidCueStyleProperty):
        * editing/EditingStyle.cpp: Ditto.
        * editing/cocoa/HTMLConverter.mm: Ditto.
        (HTMLConverterCaches::propertyValueForNode):
        (HTMLConverter::computedAttributesForElement):
        * editing/ios/EditorIOS.mm: Ditto.
        (WebCore::Editor::removeUnchangeableStyles):
        * html/canvas/CanvasRenderingContext2D.cpp: Ditto.
        (WebCore::CanvasRenderingContext2D::font):
        (WebCore::CanvasRenderingContext2D::setFont):
        * platform/graphics/FontCache.h: Removing duplicate cache key value.
        (WebCore::FontDescriptionKey::makeFlagsKey):
        * platform/graphics/FontCascade.cpp: Migrate to the new font-variant-caps from the old member variable.
        (WebCore::FontCascade::glyphDataForCharacter):
        * platform/graphics/FontCascade.h: Ditto.
        (WebCore::FontCascade::isSmallCaps):
        * platform/graphics/FontDescription.cpp: Ditto.
        (WebCore::FontDescription::FontDescription):
        * platform/graphics/FontDescription.h: Ditto.
        (WebCore::FontCascadeDescription::equalForTextAutoSizing):
        (WebCore::FontDescription::smallCaps): Deleted.
        (WebCore::FontDescription::setSmallCaps): Deleted.
        (WebCore::FontDescription::setIsSmallCaps): Deleted.
        (WebCore::FontDescription::operator==): Deleted.
        * platform/graphics/cocoa/FontCacheCoreText.cpp: Rename FontVariantEastAsianWidth.
        (WebCore::computeFeatureSettingsFromVariants):
        * platform/text/TextFlags.h: Ditto.
        (WebCore::FontVariantSettings::operator==):
        * rendering/RenderText.cpp: Migrage to the new font-variant-caps from the old member variable.
        (WebCore::RenderText::widthFromCache):

2015-11-30  Brady Eidson  <beidson@apple.com>

        Modern IDB: After versionchange transactions abort, fire onerror on the original IDBOpenDBRequest.
        https://bugs.webkit.org/show_bug.cgi?id=151648

        Reviewed by Andy Estes.

        No new tests. Covered by at least one existing failing test which now passes, and many
        other tests updated to fix their incorrect behavior.

        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::transaction):
        (WebCore::IDBClient::IDBDatabase::willAbortTransaction):
        (WebCore::IDBClient::IDBDatabase::didAbortTransaction):
        
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::fireErrorAfterVersionChangeAbort):
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.h:
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::notifyDidAbort):
        (WebCore::IDBClient::IDBTransaction::didAbort):
        (WebCore::IDBClient::IDBTransaction::didCommit):
        * Modules/indexeddb/client/IDBTransactionImpl.h:

2015-11-30  Chris Dumez  <cdumez@apple.com>

        location.origin is undefined in a web worker
        https://bugs.webkit.org/show_bug.cgi?id=151614

        Reviewed by Darin Adler.

        Expose location.origin to web workers, as per:
        https://html.spec.whatwg.org/multipage/workers.html#workerlocation

        This behavior is consistent with the behavior of Firefox and Chrome.

        Test: fast/workers/worker-location.html

        * workers/WorkerLocation.cpp:
        (WebCore::WorkerLocation::origin):
        * workers/WorkerLocation.h:
        * workers/WorkerLocation.idl:

2015-11-30  Brady Eidson  <beidson@apple.com>

        Modern IDB: Support updating cursor values when the object store uses inline keys.
        https://bugs.webkit.org/show_bug.cgi?id=151647

        Reviewed by Andy Estes.

        No new tests (At least two previously failing tests now pass and are unskipped).

        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::update): Use putForCursorUpdate() instead of put()
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::add):
        (WebCore::IDBClient::IDBObjectStore::put):
        (WebCore::IDBClient::IDBObjectStore::putForCursorUpdate): Use the flag to skip the inline-key check.
        (WebCore::IDBClient::IDBObjectStore::putOrAdd): Add a flag to skip the inline-key check.
        * Modules/indexeddb/client/IDBObjectStoreImpl.h:

2015-11-30  Brady Eidson  <beidson@apple.com>

        Modern IDB: Resolve flaky GC-vs-wrapper issue with IDBOpenDBRequest.
        https://bugs.webkit.org/show_bug.cgi?id=151645

        Reviewed by Andy Estes.

        No new tests (Resolves flakiness with hundreds of existing IDB tests).

        Do to improper management of the m_hasPendingActivity flag on IDBRequestImpl,
        the request wrapper for an IDBOpenDBRequest might be garbage collected in between the
        onUpgradeNeeded event and onSuccess event.
        
        This manifested as flakiness in many tests, some more than others.
        
        I tried to write a targeted 100% reproducible case manually forcing GC, but could not get
        the timing right.
        
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::fireSuccessAfterVersionChangeCommit):
        * Modules/indexeddb/client/IDBOpenDBRequestImpl.h:
        
        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::dispatchEvent):
        (WebCore::IDBClient::IDBRequest::willIterateCursor):
        * Modules/indexeddb/client/IDBRequestImpl.h:
        (WebCore::IDBClient::IDBRequest::isOpenDBRequest):

2015-11-30  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo][MediaFoundation] Implement seek.
        https://bugs.webkit.org/show_bug.cgi?id=151609

        Reviewed by Alex Christensen.

        The methods maxTimeSeekable() and buffered() needs to be implemented.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::seekDouble):
        (WebCore::MediaPlayerPrivateMediaFoundation::durationDouble):
        (WebCore::MediaPlayerPrivateMediaFoundation::readyState):
        (WebCore::MediaPlayerPrivateMediaFoundation::maxTimeSeekable):
        (WebCore::MediaPlayerPrivateMediaFoundation::buffered):
        (WebCore::MediaPlayerPrivateMediaFoundation::didLoadingProgress):
        (WebCore::MediaPlayerPrivateMediaFoundation::CustomVideoPresenter::currentTime):
        (WebCore::MediaPlayerPrivateMediaFoundation::CustomVideoPresenter::isActive):
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:
        (WebCore::MediaPlayerPrivateMediaFoundation::CustomVideoPresenter::maxTimeLoaded):

2015-11-30  Brady Eidson  <beidson@apple.com>

        Modern IDB: openCursor() fix resulting in at least 4 more passing tests.
        https://bugs.webkit.org/show_bug.cgi?id=151630

        Reviewed by Andy Estes.

        No new tests (At least 4 failing tests now pass, and 9 other incorrect tests updated).

        * Modules/indexeddb/IDBGetResult.cpp:
        (WebCore::IDBGetResult::isolatedCopy):
        * Modules/indexeddb/IDBGetResult.h:
        (WebCore::IDBGetResult::IDBGetResult):
        (WebCore::IDBGetResult::isDefined):

        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::didOpenOrIterateCursor): If the IDBGetResult is undefined,
          do not expose the cursor as the result property of the IDBRequest.

2015-11-30  Brady Eidson  <beidson@apple.com>

        Modern IDB: Support keyPath injection into object store records.
        https://bugs.webkit.org/show_bug.cgi?id=151640

        Reviewed by Andy Estes.

        No new tests (At least one existing failure now passes and is unskipped,
        while many other existing failures are now closer to passing).

        * Modules/indexeddb/server/MemoryObjectStore.cpp:
        (WebCore::IDBServer::MemoryObjectStore::updateIndexesForPutRecord): Use the new UniqueIDBDatabase VM/ExecState.
        (WebCore::IDBServer::MemoryObjectStore::populateIndexWithExistingRecords): Ditto
        (WebCore::IDBServer::indexVM): Deleted.
        (WebCore::IDBServer::indexGlobalExec): Deleted.
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::databaseThreadVM):
        (WebCore::IDBServer::UniqueIDBDatabase::databaseThreadExecState):
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd): If appropriate, inject the key that will be used into
          the value before storing the record.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

        Add modern JSValue/ExecState& version of some binding utilities, for use today and in preparation of getting 
        rid of the DOMRequestState and Deprecated::ScriptValue versions later:
        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::idbKeyToJSValue):
        (WebCore::injectIDBKeyIntoScriptValue):
        (WebCore::deserializeIDBValueData):
        (WebCore::deserializeIDBValueDataToJSValue):
        * bindings/js/IDBBindingUtilities.h:

2015-11-25  Andy Estes  <aestes@apple.com>

        [Content Filtering] Avoid creating a ContentFilter when loading the empty document
        https://bugs.webkit.org/show_bug.cgi?id=151615

        Reviewed by Daniel Bates.

        It's expensive to create the first ContentFilter since two frameworks must be soft-linked. There's no reason to
        pay this cost if we're just loading the empty document.

        No new tests. It's not possible to write a test that would fail without this change since ContentFilter is not
        notified of empty document loads.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource): Don't initialize m_contentFilter until we know we aren't
        loading the empty document.
        (WebCore::DocumentLoader::DocumentLoader):

2015-11-29  Antoine Quint  <graouts@apple.com>

        Browser does not fall back to SVG attribute value when CSS style value is invalid or not supported
        https://bugs.webkit.org/show_bug.cgi?id=147932

        Reviewed by Dean Jackson.

        Instead of returning an SVGPaint object of type SVG_PAINTTYPE_UNKNOWN when we encounter an SVG paint
        value that cannot be parsed, we now return `nullptr` which will cause that value to be ignored and
        let another paint value in the cascade be used instead. This is the same approach used for SVGColor.
        Since we're removing the only call site for `SVGPaint::createUnknown()`, we remove that function entirely.

        Tests: svg/css/invalid-color-cascade.svg
               svg/css/invalid-paint-cascade.svg

        * css/SVGCSSParser.cpp:
        (WebCore::CSSParser::parseSVGPaint):
        * svg/SVGPaint.h:
        (WebCore::SVGPaint::createUnknown): Deleted.

2015-11-29  Simon Fraser  <simon.fraser@apple.com>

        Use SVGTransform::SVGTransformType instead of an unsigned short
        https://bugs.webkit.org/show_bug.cgi?id=151637

        Reviewed by Brady Eidson.

        Make 'type' more strongly typed.

        * svg/SVGTransformable.cpp:
        (WebCore::SVGTransformable::parseTransformValue):
        (WebCore::parseAndSkipType):
        (WebCore::SVGTransformable::parseTransformType):
        (WebCore::SVGTransformable::parseTransformAttribute):
        * svg/SVGTransformable.h:

2015-11-27  Brady Eidson  <beidson@apple.com>

        Modern IDB: Class-ify IDBGetResult making it impossible to get the data members wrong.
        https://bugs.webkit.org/show_bug.cgi?id=151627

        Reviewed by Alexey Proskuryakov.

        No new tests (No change in behavior).

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        * Modules/indexeddb/IDBGetResult.cpp: Added.
        (WebCore::IDBGetResult::dataFromBuffer):
        (WebCore::IDBGetResult::isolatedCopy):
        * Modules/indexeddb/IDBGetResult.h:
        (WebCore::IDBGetResult::IDBGetResult):
        (WebCore::IDBGetResult::valueBuffer):
        (WebCore::IDBGetResult::keyData):
        (WebCore::IDBGetResult::primaryKeyData):
        (WebCore::IDBGetResult::keyPath):
        (WebCore::IDBGetResult::setValueBuffer):
        (WebCore::IDBGetResult::setKeyData):
        (WebCore::IDBGetResult::setPrimaryKeyData):
        (WebCore::IDBGetResult::setKeyPath):
        (WebCore::IDBGetResult::dataFromBuffer): Deleted.
        (WebCore::IDBGetResult::isolatedCopy): Deleted.

        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::setGetResult):
        * Modules/indexeddb/client/IDBCursorImpl.h:

        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::didGetRecordOnServer):

        * Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp:
        (WebCore::GetOperation::perform):

        * Modules/indexeddb/server/IDBBackingStore.h:

        * Modules/indexeddb/server/MemoryCursor.h:

        * Modules/indexeddb/server/MemoryIndexCursor.cpp:
        (WebCore::IDBServer::MemoryIndexCursor::currentData):

        * Modules/indexeddb/server/MemoryObjectStoreCursor.cpp:
        (WebCore::IDBServer::MemoryObjectStoreCursor::currentData):

        * platform/CrossThreadCopier.h:

2015-11-27  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Do not use the WebCore garbage collector timer
        https://bugs.webkit.org/show_bug.cgi?id=151623

        Reviewed by Martin Robinson.

        Now that garbage collector timers have been implemented in
        JavaScriptCore for glib, we don't need to use another Timer in WebCore.

        * bindings/js/GCController.cpp:
        (WebCore::GCController::garbageCollectSoon):
        (WebCore::GCController::garbageCollectNowIfNotDoneRecently):

2015-11-18  Andy Estes  <aestes@apple.com>

        [Content Filtering] Crash in DocumentLoader::notifyFinished() when allowing a media document to load
        https://bugs.webkit.org/show_bug.cgi?id=151433
        rdar://problem/23506594

        Reviewed by Alexey Proskuryakov.

        When the main resource of a media document commits, WebKit cancels its load since the plug-in or media engine
        will do its own loading. If content filtering is enabled, and the filter waits allow the load until the entire
        resource is downloaded, then ContentFilter will attempt to call DocumentLoader::notifyFinished() immediately
        after delivering the buffered resource data to DocumentLoader. However, delivering the data will have nulled out
        DocumentLoader's m_mainResource when the load was cancelled, leading to a crash in notifyFinished().

        To resolve this, add a new Stopped state to ContentFilter. Set this state if DocumentLoader clears its main
        resource or detaches from its frame. If ContentFilter is in the Stopped state after calling
        DocumentLoader::dataReceived(), do not proceed to call DocumentLoader::notifyFinished().

        Test: contentfiltering/allow-media-document.html

        * loader/ContentFilter.cpp:
        (WebCore::ContentFilter::stopFilteringMainResource): Set m_state to Stopped. If m_mainResource is non-null,
        removed ContentFilter as a client and set m_mainResource to null.
        (WebCore::ContentFilter::notifyFinished): Stopped calling DocumentLoader::notifyFinished() if m_state is Stopped
        after calling DocumentLoader::dataReceived().
        * loader/ContentFilter.h:
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::detachFromFrame): Called ContentFilter::stopFilteringMainResource() instead of setting
        m_contentFilter to null.
        (WebCore::DocumentLoader::clearMainResource): Ditto.

2015-11-25  Pranjal Jumde  <pjumde@apple.com>

        Checks for buffer-overflows when reading characters from textRun
        https://bugs.webkit.org/show_bug.cgi?id=151055
        <rdar://problem/23251789>

        Reviewed by Myles C. Maxfield.

        Prevents an off by one error when adding the last font data to the GlyphBuffer.

        * Source/WebCore/platform/graphics/WidthIterator.cpp:
        * Source/WebCore/platform/graphics/FontCascade.cpp:

2015-11-24  Xabier Rodriguez Calvar  <calvaris@igalia.com>

        [Streams API] Implement pipeTo method in readable Stream
        https://bugs.webkit.org/show_bug.cgi?id=151588

        Reviewed by Darin Adler.

        Implemented pipeTo method according to the reference implementation in the spec as the spec is not written
        yet. It can be found at https://github.com/whatwg/streams/blob/632b26a05f3106650b1ec91239ad5b012e6c64af/reference-implementation/lib/readable-stream.js#L75.

        Tests: streams/pipe-to.html
               streams/reference-implementation/brand-checks.html
               streams/reference-implementation/pipe-through.html
               streams/reference-implementation/pipe-to.html
               streams/reference-implementation/pipe-to-options.html
               streams/reference-implementation/readable-stream-templated

        * Modules/streams/ReadableStream.js:
        (doPipe): Internal function of pipeTo.
        (closeDest): Internal function of pipeTo.
        (abortDest): Internal function of pipeTo.
        (pipeTo): Implemented as per spec with some other internal functions as helpers.

2015-11-24  Antti Koivisto  <antti@apple.com>

        REGRESSION (r190983): Non-element, non-text nodes should not be distributed to slots
        https://bugs.webkit.org/show_bug.cgi?id=151566
        rdar://problem/23430177

        Reviewed by Zalan Bujtas.

        We don't invalidate slot assignments except for text or element children. Fix by not
        not assigning other nodes to slots as it is not useful.

        Test: fast/html/details-comment-crash.html

        * dom/SlotAssignment.cpp:
        (WebCore::slotNameFromSlotAttribute):
        (WebCore::SlotAssignment::findAssignedSlot):
        (WebCore::SlotAssignment::assignSlots):

2015-11-23  David Kilzer  <ddkilzer@apple.com>

        Hardening against CSSSelector double frees
        <http://webkit.org/b/56124>
        <rdar://problem/9119036>

        Reviewed by Antti Koivisto.

        Add some security assertions to catch this issue if it ever
        happens in Debug builds, and make changes in
        CSSSelector::~CSSSelector() and
        CSSSelectorList::deleteSelectors() to prevent obvious issues if
        they're ever called twice in Release builds.

        No new tests because we don't know how to reproduce this.

        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::CSSSelector): Initialize
        m_destructorHasBeenCalled.
        * css/CSSSelector.h:
        (WebCore::CSSSelector::m_destructorHasBeenCalled): Add bitfield.
        (WebCore::CSSSelector::CSSSelector): Initialize
        m_destructorHasBeenCalled.
        (WebCore::CSSSelector::~CSSSelector): Add security assertion
        that this is never called twice.  Clear out any fields that
        would have caused us to dereference an object twice.

        * css/CSSSelectorList.cpp:
        (WebCore::CSSSelectorList::deleteSelectors): Clear
        m_selectorArray when freeing the memory to which it was
        pointing.  This prevents re-entrancy issues or calling this
        method twice on the same thread.  Also restructure the for()
        loop to prevent calling CSSSelector::isLastInSelectorList()
        after CSSSelector::~CSSSelector() has been called (via CRBug
        241892).

2015-11-23  Brian Burg  <bburg@apple.com>

        Web Inspector: inspector settings should not be shared between different inspection levels
        https://bugs.webkit.org/show_bug.cgi?id=151151

        Reviewed by Timothy Hatcher.

        InspectorController and InspectorFrontendClient should know how to compute their
        inspection levels, so that this level can be exposed to the Inspector frontend for
        preference disambiguation by inspection level.

         - A Page with normal web content has an inspection level of 0.
         - The first Web Inspector has an inspection level of 1.
         - The second Web Inspector that inspects the Inspector has an inspection level of 2.
         - And so forth...

        For local frontend clients (WK1 and the ProtocolTestStub), the inspection level of
        a Page computed as follows:

        - If the page's inspector controller has no frontend client, then the Page
        is normal web content (level 0).
        - If the page's inspector controller has a frontend client, ask for its inspection level.
        A frontend client looks at the inspection level reported by inspected page's inspector
        controller and increments by one to account for the crossed inspection boundary.

        No new tests, this is blocked by test infrastructure fixes (https://webkit.org/b/151573).

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::inspectionLevel): Added.
        (WebCore::InspectorController::hasInspectorFrontendClient): Deleted.
        * inspector/InspectorController.h:
        * inspector/InspectorFrontendClient.h:
        * inspector/InspectorFrontendClientLocal.cpp:
        (WebCore::InspectorFrontendClientLocal::canAttachWindow): Check inspectionLevel().
        (WebCore::InspectorFrontendClientLocal::inspectionLevel): Added.
        * inspector/InspectorFrontendClientLocal.h:
        * inspector/InspectorFrontendHost.cpp:
        (WebCore::InspectorFrontendHost::inspectionLevel): Added.
        * inspector/InspectorFrontendHost.h:
        * inspector/InspectorFrontendHost.idl:
        * page/ContextMenuController.cpp:
        (WebCore::ContextMenuController::populate): Check inspectionLevel().

2015-11-20  Brian Burg  <bburg@apple.com>

        Web Inspector: RemoteInspector should track targets and connections for remote automation
        https://bugs.webkit.org/show_bug.cgi?id=151042

        Reviewed by Joseph Pecoraro.

        Use the new RemoteControllableTarget API method names.

        No new tests, no behavior change.

        * page/PageDebuggable.cpp:
        (WebCore::PageDebuggable::connect):
        (WebCore::PageDebuggable::dispatchMessageFromRemote):
        (WebCore::PageDebuggable::dispatchMessageFromRemoteFrontend): Deleted.
        * page/PageDebuggable.h:

2015-11-23  Brady Eidson  <beidson@apple.com>

        Modern IDB: Unskip all indexeddb/mozilla tests that pass.
        https://bugs.webkit.org/show_bug.cgi?id=151568
        
        Reviewed by Alex Christensen.

        No new tests (Lots of skipped existing tests now pass).

        * Modules/indexeddb/shared/IDBError.h:

2015-11-23  Nikos Andronikos <nikos.andronikos-webkit@cisra.canon.com.au>

        Add WebCore namespace for generated bindings for supplemental method calls
        https://bugs.webkit.org/show_bug.cgi?id=151431

        Reviewed by Alex Christensen.

        Address build failures for generated supplemental method calls which are in the WebCore namespace. 
        The bindings are outside the WebCore namespace - so add WebCore namespace specifier where required.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        (GenerateParametersCheck):
        * bindings/scripts/CodeGeneratorObjC.pm:
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
        (WebCore::jsTestInterfaceSupplementalStr1):
        (WebCore::jsTestInterfaceSupplementalStr2):
        (WebCore::jsTestInterfaceSupplementalNode):
        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
        (WebCore::setJSTestInterfaceSupplementalStr2):
        (WebCore::setJSTestInterfaceSupplementalNode):
        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod1):
        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
        (WebCore::jsTestInterfaceConstructorFunctionSupplementalMethod4):
        * bindings/scripts/test/ObjC/DOMTestInterface.mm:
        (-[DOMTestInterface supplementalStr1]):
        (-[DOMTestInterface supplementalStr2]):
        (-[DOMTestInterface setSupplementalStr2:]):
        (-[DOMTestInterface supplementalStr3]):
        (-[DOMTestInterface setSupplementalStr3:]):
        (-[DOMTestInterface supplementalNode]):
        (-[DOMTestInterface setSupplementalNode:]):
        (-[DOMTestInterface builtinAttribute]):
        (-[DOMTestInterface setBuiltinAttribute:]):
        (-[DOMTestInterface supplementalMethod1]):
        (-[DOMTestInterface supplementalMethod2:objArg:]):
        (-[DOMTestInterface supplementalMethod3]):
        (-[DOMTestInterface supplementalMethod4]):
        (-[DOMTestInterface builtinFunction]):

2015-11-23  Brady Eidson  <beidson@apple.com>

        Modern IDB: When a transaction is aborted, call onerror handlers for all in-progress requests.
        https://bugs.webkit.org/show_bug.cgi?id=151550

        Reviewed by Alex Christensen.

        Test: storage/indexeddb/modern/abort-requests-cancelled.html
              storage/indexeddb/modern/idbtransaction-objectstore-failures.html (with changes)
              storage/indexeddb/modern/index-5.html (with changes)
              Various (currently skipped) legacy IDB tests.

        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::transaction):
        (WebCore::IDBClient::IDBDatabase::startVersionChangeTransaction):
        (WebCore::IDBClient::IDBDatabase::didStartTransaction):
        (WebCore::IDBClient::IDBDatabase::willCommitTransaction):
        (WebCore::IDBClient::IDBDatabase::didCommitTransaction):
        (WebCore::IDBClient::IDBDatabase::willAbortTransaction):
        (WebCore::IDBClient::IDBDatabase::didAbortTransaction):
        (WebCore::IDBClient::IDBDatabase::didCommitOrAbortTransaction):
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::abort):
        (WebCore::IDBClient::IDBTransaction::abortOnServerAndCancelRequests):
        (WebCore::IDBClient::IDBTransaction::didCreateObjectStoreOnServer):
        (WebCore::IDBClient::IDBTransaction::didCreateIndexOnServer):
        (WebCore::IDBClient::IDBTransaction::didGetRecordOnServer):
        (WebCore::IDBClient::IDBTransaction::didDeleteObjectStoreOnServer):
        (WebCore::IDBClient::IDBTransaction::didDeleteIndexOnServer):
        (WebCore::IDBClient::IDBTransaction::immediateAbort): Deleted.
        (WebCore::IDBClient::IDBTransaction::abortOnServer): Deleted.
        * Modules/indexeddb/client/IDBTransactionImpl.h:
        
        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::abortTransaction):
        (WebCore::IDBServer::MemoryIDBBackingStore::commitTransaction):
        
        * Modules/indexeddb/shared/IDBError.cpp:
        (WebCore::idbErrorName):
        (WebCore::idbErrorDescription):
        * Modules/indexeddb/shared/IDBError.h:
        
        * Modules/indexeddb/shared/IDBResourceIdentifier.cpp:
        (WebCore::IDBResourceIdentifier::loggingString):
        * Modules/indexeddb/shared/IDBResourceIdentifier.h:

2015-11-23  Brady Eidson  <beidson@apple.com>

        Modern IDB: Unskip storage/indexeddb/mozilla/global-data.html.
        https://bugs.webkit.org/show_bug.cgi?id=151557

        Reviewed by Alex Christensen.

        No new tests (Unskipping existing test storage/indexeddb/mozilla/global-data.html).

        - Reworking some invalid ASSERTS
        - Actually opening pending open-database-requests after a version change transaction completes
        - Allow starting new transactions when the version change transaction has *started* finishing, 
          but before it finishes finishing.

        * Modules/indexeddb/client/IDBDatabaseImpl.cpp:
        (WebCore::IDBClient::IDBDatabase::transaction):
        
        * Modules/indexeddb/client/IDBTransactionImpl.h:
        
        * Modules/indexeddb/server/MemoryObjectStore.cpp:
        (WebCore::IDBServer::MemoryObjectStore::~MemoryObjectStore):
        
        * Modules/indexeddb/server/MemoryObjectStoreCursor.cpp:
        (WebCore::IDBServer::MemoryObjectStoreCursor::keyAdded): Deleted.
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::handleOpenDatabaseOperations):
        (WebCore::IDBServer::UniqueIDBDatabase::commitTransaction):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2015-11-23  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove DOMPromiseWithCallback
        https://bugs.webkit.org/show_bug.cgi?id=151565

        Reviewed by Eric Carlson.

        DOMPromiseWithCallback is no longer used as WebCore JS built-ins are used to the cases where DOMPromiseWithCallback made sense.

        No change in behavior.

        * Modules/mediastream/MediaDevices.h: Moved from DOMPromiseWithCallback to DOMPromise since the API is now called by JS built-ins.
        * bindings/js/JSDOMPromise.h:
        (WebCore::DOMPromiseWithCallback::DOMPromiseWithCallback): Deleted.
        (WebCore::DOMPromiseIteratorWithCallback::DOMPromiseIteratorWithCallback): Deleted.
        (WebCore::Error>::resolve): Deleted.
        (WebCore::Error>::reject): Deleted.
        (WebCore::Error>::resolveEnd): Deleted.

2015-11-23  Brian Burg  <bburg@apple.com>

        Web Inspector: when inspecting the inspector, add the inspection level to the title bar
        https://bugs.webkit.org/show_bug.cgi?id=151555

        Reviewed by Timothy Hatcher.

        * English.lproj/Localizable.strings: add new localized string for alternate inspector title.

2015-11-23  Zan Dobersek  <zdobersek@igalia.com>

        [GStreamer] No need to assert the pipeline's bus presence in MediaPlayerPrivateGStreamerBase dtor
        https://bugs.webkit.org/show_bug.cgi?id=151558

        Reviewed by Carlos Garcia Campos.

        In the MediaPlayerPrivateGStreamerBase destructor, there's some leftover code
        that acquires a reference to the GStreamer pipeline's bus object and then
        just asserts that it's not null. Not very useful, so remove it.

        Also use nullptr to null out the m_player member.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):

2015-11-17  Sergio Villar Senin  <svillar@igalia.com>

        ASSERTION FAILED: freeSpace >= 0 in WebCore::RenderGrid::computeTrackSizesForDirection
        https://bugs.webkit.org/show_bug.cgi?id=151254

        Reviewed by Darin Adler.

        When in quirks mode, abnormally huge margins could lead to
        negative computations of available logical sizes. We could add
        an !document.inQuirksMode() check in the assertion but since
        negative freeSpace values are valid (i.e. the condition is not
        really part of the contract and everything will work as
        expected) I've decided to simply remove it.

        Test: fast/css-grid-layout/grid-quirks-mode-huge-margin-crash.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computeTrackSizesForDirection): Deleted.

2015-11-22  Myles C. Maxfield  <mmaxfield@apple.com>

        Font selection should not consult font-variant property
        https://bugs.webkit.org/show_bug.cgi?id=151537

        Reviewed by Simon Fraser.

        In section 4.7 of the CSS Fonts Level 3 spec, it says "[The font-variant and
        font-feature-settings] do not affect font selection."

        All the other browsers (Chrome, Firefox, and Edge) all obey the spec here. We
        are the only one who misbehaves. This patch aligns our behavior with the other
        browsers.

        Test: fast/text/font-selection-font-variant.html

        * css/CSSFontSelector.cpp:
        (WebCore::computeTraitsMask): Deleted.
        (WebCore::compareFontFaces): Deleted.
        (WebCore::CSSFontSelector::getFontFace): Deleted.
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::createFontFaceRule):
        (WebCore::CSSParser::CSSParser): Deleted.
        (WebCore::CSSParser::parseValue): Deleted.
        (WebCore::CSSParser::parseDeclaration): Deleted.
        (WebCore::CSSParser::clearProperties): Deleted.
        (WebCore::CSSParser::parseFontVariant): Deleted.
        (WebCore::CSSParser::createStyleRule): Deleted.
        (WebCore::CSSParser::deleteFontFaceOnlyValues): Deleted.
        * css/CSSParser.h:
        * platform/graphics/FontDescription.cpp:
        (WebCore::FontDescription::traitsMask): Deleted.
        * platform/graphics/win/FontCacheWin.cpp:
        (WebCore::traitsInFamilyEnumProc):
        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::toTraitsMask):
        * platform/text/TextFlags.h:

2015-11-22  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed, rolling out r192727.

        It made the selections transparent again and broke
        /webkit2/WebKitWebView/snapshot

        Reverted changeset:

        "[GTK] RenderThemeGtk::platformActiveSelectionBackgroundColor,
        et. al. should not clobber state of cached GtkStyleContexts"
        https://bugs.webkit.org/show_bug.cgi?id=151533
        http://trac.webkit.org/changeset/192727

2015-11-22  Michael Catanzaro  <mcatanzaro@igalia.com>

        [GTK] RenderThemeGtk::platformActiveSelectionBackgroundColor, et. al. should not clobber state of cached GtkStyleContexts
        https://bugs.webkit.org/show_bug.cgi?id=151533

        Reviewed by Carlos Garcia Campos.

        platformActiveSelectionBackgroundColor(), platformInactiveSelectionBackgroundColor(), etc.
        are const functions intended only to return a color used for painting, but since r174929
        they also change the state of the cached style contexts we use for GTK_TYPE_ENTRY and
        GTK_TYPE_TREE_VIEW. That's wrong; those style contexts should not have any state set. This
        could cause theme colors returned by those GtkStyleContexts to change unexpectedly,
        depending on whether the state is explicitly set before each use, or whether the theme
        actually uses the states.

        This didn't cause any regression only because every place using these style contexts
        explicitly sets the state of the style contexts before use. In fact, the GtkTreeView style
        context is not used anywhere else, and the GtkEntry style context is only used in
        paintTextField, which does set the state before use (and then reverts it using
        save/restore), so this cannot have broken anything in practice. But it's a landmine waiting
        for the next programmer to trip it.

        Fix this with a gtk_style_context_save()/gtk_style_context_restore() pair.

        * rendering/RenderThemeGtk.cpp:
        (WebCore::styleColor):

2015-11-21  Myles C. Maxfield  <mmaxfield@apple.com>

        Tiny cleanup in ComplexTextController::collectComplexTextRuns()
        https://bugs.webkit.org/show_bug.cgi?id=151534

        Reviewed by Zalan Bujtas.

        The isMissingGlyph boolean is completely unnecessary. Its entire
        responsiblity is duplicated by the "font" pointer.

        No new tests because there is no behavior change.

        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::ComplexTextController::collectComplexTextRuns):

== Rolled over to ChangeLog-2015-11-21 ==