[webkit-changes] [179772] trunk

[said]

Title: [179772] trunk








Revision 179772
Author s...@apple.com
Date 2015-02-06 17:24:48 -0800 (Fri, 06 Feb 2015)


Log Message


Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp
trunk/Source/WebCore/svg/SVGAnimationElement.cpp
trunk/Source/WebCore/svg/SVGAnimationElement.h


Added Paths

trunk/LayoutTests/svg/animations/animate-montion-invalid-attribute-expected.svg
trunk/LayoutTests/svg/animations/animate-montion-invalid-attribute.svg




Diff

Modified: trunk/LayoutTests/ChangeLog (179771 => 179772)

--- trunk/LayoutTests/ChangeLog	2015-02-07 01:11:07 UTC (rev 179771)
+++ trunk/LayoutTests/ChangeLog	2015-02-07 01:24:48 UTC (rev 179772)
@@ -1,3 +1,15 @@
+2015-02-06  Said Abou-Hallawa  sabouhall...@apple.com
+
+Invalid cast in WebCore::SVGAnimateElement::calculateAnimatedValue.
+https://bugs.webkit.org/show_bug.cgi?id=135171.
+
+Reviewed by Dean Jackson.
+
+* svg/animations/animate-montion-invalid-attribute-expected.svg: Added.
+* svg/animations/animate-montion-invalid-attribute.svg: Added.
+Make sure that adding the same attribute to animateMotion and animate, which both
+animate the same target element, will be ignored and we won't crash.
+
 2015-02-06  Simon Fraser  simon.fra...@apple.com
 
 Convert the compositing overlap map to use LayoutRects


Added: trunk/LayoutTests/svg/animations/animate-montion-invalid-attribute-expected.svg (0 => 179772)

--- trunk/LayoutTests/svg/animations/animate-montion-invalid-attribute-expected.svg	(rev 0)
+++ trunk/LayoutTests/svg/animations/animate-montion-invalid-attribute-expected.svg	2015-02-07 01:24:48 UTC (rev 179772)
@@ -0,0 +1,4 @@
+svg xmlns=http://www.w3.org/2000/svg
+  circle cx=60 cy=60 r=50 fill=Lime/
+  circle cx=160 cy=160 r=50 fill=Green/
+/svg


Added: trunk/LayoutTests/svg/animations/animate-montion-invalid-attribute.svg (0 => 179772)

--- trunk/LayoutTests/svg/animations/animate-montion-invalid-attribute.svg	(rev 0)
+++ trunk/LayoutTests/svg/animations/animate-montion-invalid-attribute.svg	2015-02-07 01:24:48 UTC (rev 179772)
@@ -0,0 +1,38 @@
+svg xmlns=http://www.w3.org/2000/svg
+  circle cx=60 cy=60 r=50 fill=DarkRed
+!-- animateMotion should not have animation attribute target attributes --
+animateMotion attributeName=fill
+path=M 0 0 L 100 100
+begin=0ms
+dur=100ms
+fill=freeze/
+animateColor attributeName=fill 
+attributeType=XML
+from=DarkRed
+to=Green
+begin=0ms
+dur=100ms
+fill=freeze/
+  /circle
+  circle cx=160 cy=160 r=50 fill=Red
+!-- animateMotion should not have animation attribute target attributes --
+animateMotion attributeName=fill
+path=M 0 0 L -100 -100
+begin=0ms
+dur=100ms
+fill=freeze/
+animate attributeName=fill 
+attributeType=XML
+from=Red
+to=Lime
+begin=0ms
+dur=100ms
+fill=freeze/
+  /circle
+  script
+if (window.testRunner) {
+  testRunner.waitUntilDone();
+  window.setTimeout(function() { testRunner.notifyDone(); }, 500);
+}
+  /script
+/svg


Modified: trunk/Source/WebCore/ChangeLog (179771 => 179772)

--- trunk/Source/WebCore/ChangeLog	2015-02-07 01:11:07 UTC (rev 179771)
+++ trunk/Source/WebCore/ChangeLog	2015-02-07 01:24:48 UTC (rev 179772)
@@ -1,3 +1,38 @@
+2015-02-06  Said Abou-Hallawa  sabouhall...@apple.com
+
+Invalid cast in WebCore::SVGAnimateElement::calculateAnimatedValue.
+https://bugs.webkit.org/show_bug.cgi?id=135171.
+
+Reviewed by Dean Jackson.
+
+The bug happens when an SVG element is animated by animateMotion followed by an
+animateColor or an animate and the values of the attributeName in both elements
+are the same. The problem is animateMotion should not have an attribute to animate.
+If it does by fuzz or by mistake, then we assume the animateMotion and the animate
+animate the same attribute for the same element target. Therefore we schedule them in
+the same AnimationVector in SMILTimeContainer::schedule(). When we call
+SVGAnimateElementBase::calculateAnimatedValue() for an SVGAnimateColorElement and the
+resultElement is SVGAnimateMotionElement, we fail to cast it to SVGAnimateElementBase
+because SVGAnimateMotionElement is derived from SVGAnimationElement which is the base
+class of all animate elements including SVGAnimateElementBase.
+
+The fix is to nullify setting attributeName of an SVGAnimationElement. By doing so,
+attributeName a

[webkit-changes] [180128] trunk

[said]

Title: [180128] trunk








Revision 180128
Author s...@apple.com
Date 2015-02-15 16:13:16 -0800 (Sun, 15 Feb 2015)


Log Message
Crash when accessing an item in SVGLengthList and then replacing it with a previous item in the list.
https://bugs.webkit.org/show_bug.cgi?id=141552.

Reviewed by Darin Adler.

Source/WebCore:

Tests: LayoutTests/svg/dom/SVGLengthList-basics.xhtml: This test is modified to
include a new test case.

* svg/properties/SVGListPropertyTearOff.h: Commit the removal of the replacing item
before trying to detach the wrapper of the item which going to be replaced.

LayoutTests:

* svg/dom/SVGLengthList-basics-expected.txt:
* svg/dom/SVGLengthList-basics.xhtml: Add a new test case to this test. Have a
reference to an SVGLength in an SVGLengthList and then replace this SVGLength
with another one which comes before it in the SVGLengthList.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/svg/dom/SVGLengthList-basics-expected.txt
trunk/LayoutTests/svg/dom/SVGLengthList-basics.xhtml
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/properties/SVGListPropertyTearOff.h




Diff

Modified: trunk/LayoutTests/ChangeLog (180127 => 180128)

--- trunk/LayoutTests/ChangeLog	2015-02-15 20:44:07 UTC (rev 180127)
+++ trunk/LayoutTests/ChangeLog	2015-02-16 00:13:16 UTC (rev 180128)
@@ -1,3 +1,15 @@
+2015-02-15  Said Abou-Hallawa  sabouhall...@apple.com
+
+Crash when accessing an item in SVGLengthList and then replacing it with a previous item in the list.
+https://bugs.webkit.org/show_bug.cgi?id=141552.
+
+Reviewed by Darin Adler.
+
+* svg/dom/SVGLengthList-basics-expected.txt:
+* svg/dom/SVGLengthList-basics.xhtml: Add a new test case to this test. Have a
+reference to an SVGLength in an SVGLengthList and then replace this SVGLength
+with another one which comes before it in the SVGLengthList.
+
 2015-02-14  Benjamin Poulain  benja...@webkit.org
 
 Add the initial matching implementation for attribute selectors with case-insensitive value


Modified: trunk/LayoutTests/svg/dom/SVGLengthList-basics-expected.txt (180127 => 180128)

--- trunk/LayoutTests/svg/dom/SVGLengthList-basics-expected.txt	2015-02-15 20:44:07 UTC (rev 180127)
+++ trunk/LayoutTests/svg/dom/SVGLengthList-basics-expected.txt	2015-02-16 00:13:16 UTC (rev 180128)
@@ -119,6 +119,22 @@
 Set x='1 2 3 4' for text1
 PASS text1.setAttribute('x', '1 2 3 4') is undefined.
 
+Test overlapping edge cases for replaceItem()
+PASS text1.x.baseVal.replaceItem(text1.x.baseVal.getItem(0), 3) is text1.x.baseVal.getItem(2)
+PASS text1.x.baseVal.numberOfItems is 3
+PASS text1.x.baseVal.getItem(2).value is 2
+PASS text1.x.baseVal.replaceItem(text1.x.baseVal.getItem(0), 2) is text1.x.baseVal.getItem(1)
+PASS text1.x.baseVal.numberOfItems is 2
+PASS text1.x.baseVal.getItem(1).value is 4
+PASS text1.x.baseVal.replaceItem(text1.x.baseVal.getItem(0), 1) is text1.x.baseVal.getItem(0)
+PASS text1.x.baseVal.numberOfItems is 1
+PASS text1.x.baseVal.getItem(0).value is 6
+PASS text1.x.baseVal.replaceItem(text1.x.baseVal.getItem(0), 0) is text1.x.baseVal.getItem(0)
+PASS text1.x.baseVal.numberOfItems is 1
+
+Set x='1 2 3 4' for text1
+PASS text1.setAttribute('x', '1 2 3 4') is undefined.
+
 Test uncommon arguments for removeItem()
 PASS text1.x.baseVal.removeItem(30) threw exception Error: IndexSizeError: DOM Exception 1.
 PASS text1.x.baseVal.removeItem(0).value is 1


Modified: trunk/LayoutTests/svg/dom/SVGLengthList-basics.xhtml (180127 => 180128)

--- trunk/LayoutTests/svg/dom/SVGLengthList-basics.xhtml	2015-02-15 20:44:07 UTC (rev 180127)
+++ trunk/LayoutTests/svg/dom/SVGLengthList-basics.xhtml	2015-02-16 00:13:16 UTC (rev 180128)
@@ -155,6 +155,31 @@
 shouldBeUndefined(text1.setAttribute('x', '1 2 3 4'));
 
 debug();
+debug(Test overlapping edge cases for replaceItem());
+var item = text1.x.baseVal.getItem(3);
+shouldBe(text1.x.baseVal.replaceItem(text1.x.baseVal.getItem(0), 3), text1.x.baseVal.getItem(2));
+shouldBe(text1.x.baseVal.numberOfItems, 3);
+item = text1.x.baseVal.getItem(2);
+item.newValueSpecifiedUnits(item.unitType, item.value * 2);
+shouldBe(text1.x.baseVal.getItem(2).value, 2);
+shouldBe(text1.x.baseVal.replaceItem(text1.x.baseVal.getItem(0), 2), text1.x.baseVal.getItem(1));
+shouldBe(text1.x.baseVal.numberOfItems, 2);
+item = text1.x.baseVal.getItem(1);
+item.newValueSpecifiedUnits(item.unitType, item.value * 2);
+shouldBe(text1.x.baseVal.getItem(1).value, 4);
+shouldBe(text1.x.baseVal.replaceItem(text1.x.baseVal.getItem(0), 1), text1.x.baseVal.getItem(0));
+shouldBe(text1.x.baseVal.numberOfItems, 1);
+item = text1.x.baseVal.getItem(0);
+item.newValueSpecifiedUnits(item.unitType, item.value * 2);
+shouldBe(text1.x.baseVal.getItem(0).value, 6);
+shouldBe(text1.x.baseVal.replaceItem(text1.x.baseVal.getItem(0), 0), text1.x.baseVal.getItem(0));
+shoul

[webkit-changes] [180129] trunk

[said]

Title: [180129] trunk








Revision 180129
Author s...@apple.com
Date 2015-02-15 18:08:39 -0800 (Sun, 15 Feb 2015)


Log Message
Crash when accessing an item in SVGTransformList and then removing a previous item from this list.
https://bugs.webkit.org/show_bug.cgi?id=141550.

Reviewed by Darin Adler.

Source/WebCore:

Tests: LayoutTests/svg/dom/SVGTransformList-basics.xhtml: This test is modified to
include a new test case.

* svg/properties/SVGMatrixTearOff.h: m_value of SVGMatrixTearOff will be a null
pointer. There is no point in having SVGMatrixTearOff points to the parent and
the property of the parent at the same time.

(WebCore::SVGMatrixTearOff::create): SVGMatrixTearOff will hold a pointer to
the parent SVGPropertyTearOffSVGTransform. But it should overrides setValue()
and propertyReference() so it can set and get the SVGMatrix from the SVGTransform
parent.

(WebCore::SVGMatrixTearOff::SVGMatrixTearOff): Pass a nullptr to the base class.
SVGMatrixTearOff will act as a proxy of the parent. It does not hold any data by
itself but it knows what property to set and get from the parent.

* svg/properties/SVGPropertyTearOff.h:
(WebCore::SVGPropertyTearOff::create): Add a create method which can take a pointer value.

(WebCore::SVGPropertyTearOff::propertyReference):
(WebCore::SVGPropertyTearOff::setValue): Make these functions virtual so concrete classes
like SVGMatrixTearOff can override them.

(WebCore::SVGPropertyTearOff::SVGPropertyTearOff): Add a new constructor.

LayoutTests:

* svg/dom/SVGTransformList-basics-expected.txt:
* svg/dom/SVGTransformList-basics.xhtml: Add a new test case to this test. Have a
reference to an SVGMatrix of the last SVGTransform of an SVGTransformList and then
remove the items of this list from the beginning till the end.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/svg/dom/SVGTransformList-basics-expected.txt
trunk/LayoutTests/svg/dom/SVGTransformList-basics.xhtml
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/properties/SVGMatrixTearOff.h
trunk/Source/WebCore/svg/properties/SVGPropertyTearOff.h




Diff

Modified: trunk/LayoutTests/ChangeLog (180128 => 180129)

--- trunk/LayoutTests/ChangeLog	2015-02-16 00:13:16 UTC (rev 180128)
+++ trunk/LayoutTests/ChangeLog	2015-02-16 02:08:39 UTC (rev 180129)
@@ -1,5 +1,17 @@
 2015-02-15  Said Abou-Hallawa  sabouhall...@apple.com
 
+Crash when accessing an item in SVGTransformList and then removing a previous item from this list.
+https://bugs.webkit.org/show_bug.cgi?id=141550.
+
+Reviewed by Darin Adler.
+
+* svg/dom/SVGTransformList-basics-expected.txt:
+* svg/dom/SVGTransformList-basics.xhtml: Add a new test case to this test. Have a
+reference to an SVGMatrix of the last SVGTransform of an SVGTransformList and then
+remove the items of this list from the beginning till the end.
+
+2015-02-15  Said Abou-Hallawa  sabouhall...@apple.com
+
 Crash when accessing an item in SVGLengthList and then replacing it with a previous item in the list.
 https://bugs.webkit.org/show_bug.cgi?id=141552.
 


Modified: trunk/LayoutTests/svg/dom/SVGTransformList-basics-expected.txt (180128 => 180129)

--- trunk/LayoutTests/svg/dom/SVGTransformList-basics-expected.txt	2015-02-16 00:13:16 UTC (rev 180128)
+++ trunk/LayoutTests/svg/dom/SVGTransformList-basics-expected.txt	2015-02-16 02:08:39 UTC (rev 180129)
@@ -51,6 +51,13 @@
 PASS circle1.transform.baseVal.insertItemBefore(circle1, 0) threw exception TypeError: Argument 1 ('item') to SVGTransformList.insertItemBefore must be an instance of SVGTransform.
 PASS circle1.transform.baseVal.insertItemBefore(null, 0) threw exception Error: SVG_WRONG_TYPE_ERR: DOM SVG Exception 0.
 
+Test overlapping edge cases for removeItem()
+PASS circle1.setAttribute('transform', 'scale(2 2) translate(10 10)') is undefined.
+PASS dumpTransform(circle1.transform.baseVal.getItem(1)) is type=SVG_TRANSFORM_MATRIX matrix=[1.0 0.0 0.0 1.0 20.0 20.0]
+PASS dumpTransform(circle1.transform.baseVal.getItem(1)) is type=SVG_TRANSFORM_MATRIX matrix=[1.0 0.0 0.0 1.0 20.0 20.0]
+PASS dumpTransform(circle1.transform.baseVal.getItem(1)) is type=SVG_TRANSFORM_MATRIX matrix=[1.0 0.0 0.0 1.0 40.0 40.0]
+PASS circle1.transform.baseVal.numberOfItems is 0
+
 Set transform='rotate(90) scale(2 2) translate(10 10) skewX(45)' for circle1
 PASS circle1.setAttribute('transform', 'rotate(90) scale(2 2) translate(10 10) skewX(45)') is undefined.
 PASS circle1.transform.baseVal.numberOfItems is 4


Modified: trunk/LayoutTests/svg/dom/SVGTransformList-basics.xhtml (180128 => 180129)

--- trunk/LayoutTests/svg/dom/SVGTransformList-basics.xhtml	2015-02-16 00:13:16 UTC (rev 180128)
+++ trunk/LayoutTests/svg/dom/SVGTransformList-basics.xhtml	2015-02-16 02:08:39 UTC (rev 180129)
@@ -103,6 +103,21 @@
 shouldThrow(circle1.transform.baseVal.insertItemBefore(null, 0));
 
 debug();
+debug(Test overlap

[webkit-changes] [180133] trunk/Source/WebCore

[said]

Title: [180133] trunk/Source/WebCore








Revision 180133
Author s...@apple.com
Date 2015-02-15 18:21:43 -0800 (Sun, 15 Feb 2015)


Log Message
Web Inspector: remove unused XHR replay code
https://bugs.webkit.org/show_bug.cgi?id=141622

Patch by Brian J. Burg b...@cs.washington.edu on 2015-02-15
Reviewed by Timothy Hatcher.

XHR Replay functionality became unused with the last frontend rewrite.
Remove instrumentation and data storage classes only used by this feature.

* inspector/InspectorInstrumentation.cpp:
(WebCore::InspectorInstrumentation::documentThreadableLoaderStartedLoadingForClientImpl): Deleted.
(WebCore::InspectorInstrumentation::willLoadXHRImpl): Deleted.
(WebCore::InspectorInstrumentation::didFailXHRLoadingImpl): Deleted.
* inspector/InspectorInstrumentation.h:
(WebCore::InspectorInstrumentation::documentThreadableLoaderStartedLoadingForClient): Deleted.
(WebCore::InspectorInstrumentation::willLoadXHR): Deleted.
(WebCore::InspectorInstrumentation::didFailXHRLoading): Deleted.
* inspector/InspectorResourceAgent.cpp:
(WebCore::InspectorResourceAgent::didLoadResourceFromMemoryCache):
(WebCore::InspectorResourceAgent::didFinishXHRLoading):
(WebCore::InspectorResourceAgent::documentThreadableLoaderStartedLoadingForClient): Deleted.
(WebCore::InspectorResourceAgent::willLoadXHR): Deleted.
(WebCore::InspectorResourceAgent::didFailXHRLoading): Deleted.
(WebCore::InspectorResourceAgent::replayXHR): Deleted.
* inspector/InspectorResourceAgent.h:
* inspector/NetworkResourcesData.cpp:
(WebCore::NetworkResourcesData::clear):
(WebCore::XHRReplayData::create): Deleted.
(WebCore::XHRReplayData::XHRReplayData): Deleted.
(WebCore::NetworkResourcesData::xhrReplayData): Deleted.
(WebCore::NetworkResourcesData::setXHRReplayData): Deleted.
(WebCore::NetworkResourcesData::reuseXHRReplayData): Deleted.
* inspector/NetworkResourcesData.h:
(WebCore::XHRReplayData::method): Deleted.
(WebCore::XHRReplayData::url): Deleted.
(WebCore::XHRReplayData::async): Deleted.
(WebCore::XHRReplayData::formData): Deleted.
(WebCore::XHRReplayData::headers): Deleted.
(WebCore::XHRReplayData::includeCredentials): Deleted.
(WebCore::NetworkResourcesData::ResourceData::xhrReplayData): Deleted.
(WebCore::NetworkResourcesData::ResourceData::setXHRReplayData): Deleted.
* loader/DocumentThreadableLoader.cpp:
(WebCore::DocumentThreadableLoader::loadRequest):
* xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::createRequest):
(WebCore::XMLHttpRequest::internalAbort):
(WebCore::XMLHttpRequest::sendForInspectorXHRReplay): Deleted.
* xml/XMLHttpRequest.h:

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/properties/SVGMatrixTearOff.h




Diff

Modified: trunk/Source/WebCore/ChangeLog (180132 => 180133)

--- trunk/Source/WebCore/ChangeLog	2015-02-16 02:17:38 UTC (rev 180132)
+++ trunk/Source/WebCore/ChangeLog	2015-02-16 02:21:43 UTC (rev 180133)
@@ -53,6 +53,18 @@
 Crash when accessing an item in SVGTransformList and then removing a previous item from this list.
 https://bugs.webkit.org/show_bug.cgi?id=141550.
 
+Reviewed by David Kilzer.
+
+* svg/properties/SVGMatrixTearOff.h:
+(WebCore::SVGMatrixTearOff::create): Fix a compilation error on the release build.
+The ASSERT() here references a parameter which is not used anywhere else. We need 
+to change it to ASSERT_UNUSED(). 
+
+2015-02-15  Said Abou-Hallawa  sabouhall...@apple.com
+
+Crash when accessing an item in SVGTransformList and then removing a previous item from this list.
+https://bugs.webkit.org/show_bug.cgi?id=141550.
+
 Reviewed by Darin Adler.
 
 Tests: LayoutTests/svg/dom/SVGTransformList-basics.xhtml: This test is modified to


Modified: trunk/Source/WebCore/svg/properties/SVGMatrixTearOff.h (180132 => 180133)

--- trunk/Source/WebCore/svg/properties/SVGMatrixTearOff.h	2015-02-16 02:17:38 UTC (rev 180132)
+++ trunk/Source/WebCore/svg/properties/SVGMatrixTearOff.h	2015-02-16 02:21:43 UTC (rev 180133)
@@ -32,7 +32,7 @@
 // (for example: SVGTransform::matrix).
 static RefSVGMatrixTearOff create(SVGPropertyTearOffSVGTransform parent, SVGMatrix value)
 {
-ASSERT(parent.propertyReference().svgMatrix() == value);
+ASSERT_UNUSED(value, parent.propertyReference().svgMatrix() == value);
 RefSVGMatrixTearOff result = adoptRef(*new SVGMatrixTearOff(parent));
 parent.addChild(result-m_weakFactory.createWeakPtr());
 return result;






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [181401] trunk/LayoutTests

[said]

Title: [181401] trunk/LayoutTests








Revision 181401
Author s...@apple.com
Date 2015-03-11 13:08:26 -0700 (Wed, 11 Mar 2015)


Log Message
svg/animations/smil-leak-*.svg tests are flaky.
https://bugs.webkit.org/show_bug.cgi?id=114280

Unreviewed.

Some svg tests were flaky on mac only but they became flaky on all ports
after r181345. They pass locally and on EWS but not on bots. Mark them to
be flaky on all ports till we figure out the problem with these tests.

* TestExpectations:
* platform/mac/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/TestExpectations
trunk/LayoutTests/platform/mac/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (181400 => 181401)

--- trunk/LayoutTests/ChangeLog	2015-03-11 19:16:20 UTC (rev 181400)
+++ trunk/LayoutTests/ChangeLog	2015-03-11 20:08:26 UTC (rev 181401)
@@ -1,3 +1,17 @@
+2015-03-11  Said Abou-Hallawa  sabouhall...@apple.com
+
+svg/animations/smil-leak-*.svg tests are flaky.
+https://bugs.webkit.org/show_bug.cgi?id=114280
+
+Unreviewed.
+
+Some svg tests were flaky on mac only but they became flaky on all ports
+after r181345. They pass locally and on EWS but not on bots. Mark them to
+be flaky on all ports till we figure out the problem with these tests.
+
+* TestExpectations:
+* platform/mac/TestExpectations:
+
 2015-03-11  Tim Horton  timothy_hor...@apple.com
 
 attachments should be created when dropping files onto contentEditable areas


Modified: trunk/LayoutTests/TestExpectations (181400 => 181401)

--- trunk/LayoutTests/TestExpectations	2015-03-11 19:16:20 UTC (rev 181400)
+++ trunk/LayoutTests/TestExpectations	2015-03-11 20:08:26 UTC (rev 181401)
@@ -492,3 +492,9 @@
 http/tests/contentextensions [ Skip ]
 
 webkit.org/b/142526 contentfiltering/block-after-add-data.html [ Skip ]
+
+# These tests were flaky on Mac only but they became flaky on all ports after r181345
+webkit.org/b/114280 svg/animations/smil-leak-dynamically-added-element-instances.svg [ Pass Failure ]
+webkit.org/b/114280 svg/animations/smil-leak-element-instances-noBaseValRef.svg [ Pass Failure ]
+webkit.org/b/114280 svg/animations/smil-leak-element-instances.svg [ Pass Failure ]
+webkit.org/b/114280 svg/animations/smil-leak-elements.svg [ Pass Failure ]


Modified: trunk/LayoutTests/platform/mac/TestExpectations (181400 => 181401)

--- trunk/LayoutTests/platform/mac/TestExpectations	2015-03-11 19:16:20 UTC (rev 181400)
+++ trunk/LayoutTests/platform/mac/TestExpectations	2015-03-11 20:08:26 UTC (rev 181401)
@@ -735,11 +735,6 @@
 
 webkit.org/b/120923 animations/cross-fade-background-image.html [ ImageOnlyFailure ]
 
-webkit.org/b/114280 svg/animations/smil-leak-dynamically-added-element-instances.svg [ Pass Failure ]
-webkit.org/b/114280 svg/animations/smil-leak-element-instances-noBaseValRef.svg [ Pass Failure ]
-webkit.org/b/114280 svg/animations/smil-leak-element-instances.svg [ Pass Failure ]
-webkit.org/b/114280 svg/animations/smil-leak-elements.svg [ Pass Failure ]
-
 webkit.org/b/131244 svg/as-image/svg-as-image-canvas.html [ Pass ImageOnlyFailure ]
 
 webkit.org/b/117427 compositing/reflections/load-video-in-reflection.html [ Pass Failure Crash Timeout ]






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [180523] trunk/Source/WebCore

[said]

Title: [180523] trunk/Source/WebCore








Revision 180523
Author s...@apple.com
Date 2015-02-23 15:04:53 -0800 (Mon, 23 Feb 2015)


Log Message
Drawing an SVG image into a canvas using drawImage() ignores globalAlpha.
https://bugs.webkit.org/show_bug.cgi?id=141729.

Reviewed by Daniel Bates.

Fix a build break which is caused by http://trac.webkit.org/changeset/180511/trunk.
Two functions of GraphicsContext were made inline but they were kept WEBCORE_EXPORT.

* platform/graphics/GraphicsContext.h:
(WebCore::GraphicsContext::paintingDisabled):
(WebCore::GraphicsContext::updatingControlTints):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/GraphicsContext.h




Diff

Modified: trunk/Source/WebCore/ChangeLog (180522 => 180523)

--- trunk/Source/WebCore/ChangeLog	2015-02-23 23:04:33 UTC (rev 180522)
+++ trunk/Source/WebCore/ChangeLog	2015-02-23 23:04:53 UTC (rev 180523)
@@ -1,3 +1,17 @@
+2015-02-23  Said Abou-Hallawa  sabouhall...@apple.com
+
+Drawing an SVG image into a canvas using drawImage() ignores globalAlpha.
+https://bugs.webkit.org/show_bug.cgi?id=141729.
+
+Reviewed by Daniel Bates.
+
+Fix a build break which is caused by http://trac.webkit.org/changeset/180511/trunk.
+Two functions of GraphicsContext were made inline but they were kept WEBCORE_EXPORT.
+
+* platform/graphics/GraphicsContext.h:
+(WebCore::GraphicsContext::paintingDisabled):
+(WebCore::GraphicsContext::updatingControlTints):
+
 2015-02-22  Dean Jackson  d...@apple.com
 
 [iOS] Max canvas size is lower than expected


Modified: trunk/Source/WebCore/platform/graphics/GraphicsContext.h (180522 => 180523)

--- trunk/Source/WebCore/platform/graphics/GraphicsContext.h	2015-02-23 23:04:33 UTC (rev 180522)
+++ trunk/Source/WebCore/platform/graphics/GraphicsContext.h	2015-02-23 23:04:53 UTC (rev 180523)
@@ -360,10 +360,10 @@
 void drawLineForDocumentMarker(const FloatPoint, float width, DocumentMarkerLineStyle);
 
 void setPaintingDisabled(bool paintingDisabled) { m_state.paintingDisabled = paintingDisabled; }
-WEBCORE_EXPORT bool paintingDisabled() const { return m_state.paintingDisabled; }
+bool paintingDisabled() const { return m_state.paintingDisabled; }
 
 void setUpdatingControlTints(bool);
-WEBCORE_EXPORT bool updatingControlTints() const { return m_updatingControlTints; }
+bool updatingControlTints() const { return m_updatingControlTints; }
 
 WEBCORE_EXPORT void beginTransparencyLayer(float opacity);
 WEBCORE_EXPORT void endTransparencyLayer();






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [180643] trunk

[said]

Title: [180643] trunk








Revision 180643
Author s...@apple.com
Date 2015-02-25 15:05:20 -0800 (Wed, 25 Feb 2015)


Log Message
Horizontal and vertical lines are clipped completely if clip-path is included in the tag but the referenced element is defined later.
https://bugs.webkit.org/show_bug.cgi?id=141776.

Reviewed by Dean Jackson.
Source/WebCore:


Tests: svg/clip-path/clip-path-line-use-before-defined-expected.svg
   svg/clip-path/clip-path-line-use-before-defined.svg

* rendering/svg/RenderSVGResourceClipper.cpp:
(WebCore::RenderSVGResourceClipper::applyClippingToContext): Ensure the renderer
is added to m_clipper if it does not exist. The same renderer might have been 
added to m_clipper in resourceBoundingBox().

(WebCore::RenderSVGResourceClipper::addRendererToClipper): Add the renderer to
m_clipper if it does not exist. Return the associated ClipperData.

(WebCore::RenderSVGResourceClipper::resourceBoundingBox): If the clipper is
referenced before it is defined, add the renderer to m_clipper. While doing the
layout() for the clipper, we can check if m_clipper has values or not. If it does
have, we are going to mark the clipper for client invalidation which is done by
the SVG root.

* rendering/svg/RenderSVGResourceClipper.h:
* rendering/svg/RenderSVGResourceContainer.h:
(WebCore::RenderSVGResourceContainer::selfNeedsClientInvalidation): Define a 
new function selfNeedsClientInvalidation() which controls marking the clipper 
for client invalidation. In RenderSVGResourceClipper, override it so it checks
m_clipper to force clients validation even if it the first time we do layout
for this clipper.

* rendering/svg/RenderSVGResourceContainer.cpp:
(WebCore::RenderSVGResourceContainer::layout): Call the virtual function
selfNeedsClientInvalidation() to check whether we need to mark the clipper for
client invalidation.

* svg/SVGElement.cpp: Delete unneeded header file.

LayoutTests:


New test cases for SVG lines which are clipped to a clipPath. The clipPath
is referenced before it is defined.

* svg/clip-path/clip-path-line-use-before-defined-expected.svg: Added.
* svg/clip-path/clip-path-line-use-before-defined.svg: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp
trunk/Source/WebCore/rendering/svg/RenderSVGResourceClipper.h
trunk/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
trunk/Source/WebCore/rendering/svg/RenderSVGResourceContainer.h
trunk/Source/WebCore/svg/SVGElement.cpp


Added Paths

trunk/LayoutTests/svg/clip-path/clip-path-line-use-before-defined-expected.svg
trunk/LayoutTests/svg/clip-path/clip-path-line-use-before-defined.svg




Diff

Modified: trunk/LayoutTests/ChangeLog (180642 => 180643)

--- trunk/LayoutTests/ChangeLog	2015-02-25 22:37:17 UTC (rev 180642)
+++ trunk/LayoutTests/ChangeLog	2015-02-25 23:05:20 UTC (rev 180643)
@@ -1,3 +1,16 @@
+2015-02-25  Said Abou-Hallawa  sabouhall...@apple.com
+
+Horizontal and vertical lines are clipped completely if clip-path is included in the tag but the referenced element is defined later.
+https://bugs.webkit.org/show_bug.cgi?id=141776.
+
+Reviewed by Dean Jackson.
+
+New test cases for SVG lines which are clipped to a clipPath. The clipPath
+is referenced before it is defined.
+
+* svg/clip-path/clip-path-line-use-before-defined-expected.svg: Added.
+* svg/clip-path/clip-path-line-use-before-defined.svg: Added.
+
 2015-02-25  Myles C. Maxfield  mmaxfi...@apple.com
 
 Test gardening


Added: trunk/LayoutTests/svg/clip-path/clip-path-line-use-before-defined-expected.svg (0 => 180643)

--- trunk/LayoutTests/svg/clip-path/clip-path-line-use-before-defined-expected.svg	(rev 0)
+++ trunk/LayoutTests/svg/clip-path/clip-path-line-use-before-defined-expected.svg	2015-02-25 23:05:20 UTC (rev 180643)
@@ -0,0 +1,33 @@
+svg xmlns=http://www.w3.org/2000/svg xmlns:xlink=http://www.w3.org/1999/xlink width=200 height=200
+  defs
+style
+  line, path {
+stroke: black;
+  }
+/style
+clipPath id=clip-circle
+circle cx=50% cy=50% r=25%/
+/clipPath
+  /defs
+  
+  rect x=0 y=0 width=100% height=100% fill=lime/
+  rect x=0 y=0 width=100% height=100% fill=white clip-path=url(#clip-circle)/
+
+  !-- diagonal --
+  line x1=170 y1=30 x2=30 y2=170 clip-path=url(#clip-circle)/
+  
+  !-- top and left lines --
+  path d=M30 75 L170 75 clip-path=url(#clip-circle)/
+  line x1=75 y1=30 x2=75 y2=170 clip-path=url(#clip-circle)/
+
+  !-- right and bottom lines --
+  g clip-path=url(#clip-circle)
+path d=M30 125 L170 125/
+line x1=125 y1=30 x2=125 y2=170/
+  /g
+  
+  !-- center lines --
+  path d=M30 100 L170 100 clip-path=url(#clip-circle)/
+  line x1=100 y1=30 x2=100 y2=170 clip-path=url(#clip-circle)/
+  
+/svg


Added: trunk/LayoutTests/svg/clip-path/clip-path-li

[webkit-changes] [182750] trunk

[said]

Title: [182750] trunk








Revision 182750
Author s...@apple.com
Date 2015-04-13 12:53:14 -0700 (Mon, 13 Apr 2015)


Log Message
Canvas drawImage() has a security hole when the image isn't yet fully loaded.
https://bugs.webkit.org/show_bug.cgi?id=58681.

Reviewed by Darin Adler.

Source/WebCore:

There is a race condition which may happen if an image from a different
origin is drawn on a canvas before it finishes loading. The check to taint
the canvas comes before drawing it. This check returns false if the image
is not completely loaded because we check the URL of the resource response.
If after this check and before the drawing, the image finishes loading, the
canvas will not be tainted but the image will be drawn.

The fix is to move the check to taint the canvas after drawing the image.
The only problem with this solution is basically the opposite of this bug:
we will become stricter than before with images which are from a different
origin and before they finish loading. The image has not finished loading,
so we do not draw it. Before we check for tainting, the image finishes
loading. So we decide to taint the canvas even the image is not drawn.

But this should not be a security issue anymore. I personally do not know
if it is even a correctness issue or not.

Test: http/tests/canvas/canvas-tainted-after-draw-image.html

* html/canvas/CanvasRenderingContext2D.cpp:
(WebCore::CanvasRenderingContext2D::drawImage):

LayoutTests:

This test confirms when we load an image from a different origin and try
drawing it on a canvas, the canvas is tainted if the image is completely
loaded and drawn. Otherwise the image is not drawn.

* http/tests/canvas/canvas-tainted-after-draw-image-expected.txt: Added.
* http/tests/canvas/canvas-tainted-after-draw-image.html: Added.
* http/tests/canvas/resources: Added.
* http/tests/canvas/resources/100x100-lime-rect.svg: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp


Added Paths

trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image-expected.txt
trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html
trunk/LayoutTests/http/tests/canvas/resources/
trunk/LayoutTests/http/tests/canvas/resources/100x100-lime-rect.svg




Diff

Modified: trunk/LayoutTests/ChangeLog (182749 => 182750)

--- trunk/LayoutTests/ChangeLog	2015-04-13 19:52:11 UTC (rev 182749)
+++ trunk/LayoutTests/ChangeLog	2015-04-13 19:53:14 UTC (rev 182750)
@@ -1,3 +1,19 @@
+2015-04-13  Said Abou-Hallawa  sabouhall...@apple.com
+
+Canvas drawImage() has a security hole when the image isn't yet fully loaded.
+https://bugs.webkit.org/show_bug.cgi?id=58681.
+
+Reviewed by Darin Adler.
+
+This test confirms when we load an image from a different origin and try
+drawing it on a canvas, the canvas is tainted if the image is completely
+loaded and drawn. Otherwise the image is not drawn.
+
+* http/tests/canvas/canvas-tainted-after-draw-image-expected.txt: Added.
+* http/tests/canvas/canvas-tainted-after-draw-image.html: Added.
+* http/tests/canvas/resources: Added.
+* http/tests/canvas/resources/100x100-lime-rect.svg: Added.
+
 2015-04-13  Beth Dakin  bda...@apple.com
 
 Add force property to MouseEvents


Added: trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image-expected.txt (0 => 182750)

--- trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image-expected.txt	(rev 0)
+++ trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image-expected.txt	2015-04-13 19:53:14 UTC (rev 182750)
@@ -0,0 +1,11 @@
+CONSOLE MESSAGE: line 60: Unable to get image data from canvas because the canvas has been tainted by cross-origin data.
+Tainting works correctly.
+Tainting works correctly.
+Tainting works correctly.
+Tainting works correctly.
+Tainting works correctly.
+Tainting works correctly.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+  


Added: trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html (0 => 182750)

--- trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html	(rev 0)
+++ trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html	2015-04-13 19:53:14 UTC (rev 182750)
@@ -0,0 +1,90 @@
+!DOCTYPE html
+html
+head
+  script src=""
+/head
+body
+  canvas id=sourceCanvas width=100 height=100/canvas
+  canvas id=dataURLSynchronousCanvas width=100 height=100/canvas
+  canvas id=dataURLAsynchronousCanvas width=100 height=100/canvas
+  canvas id=sameDomainSynchronousCanvas width=100 height=100/canvas
+  canvas id=sameDomainAsynchronousCanvas width=100 height=100/canvas
+  canvas id=crossDomainSynchronousCanvas width=100 height=100/canvas
+  canvas id=crossDomainAsynchronousCanvas width=100 height=100/canvas
+  script
+function draw

[webkit-changes] [182767] trunk/LayoutTests

[said]

Title: [182767] trunk/LayoutTests








Revision 182767
Author s...@apple.com
Date 2015-04-13 16:51:36 -0700 (Mon, 13 Apr 2015)


Log Message
Fix LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html on all bots
following http://trac.webkit.org/changeset/182750.

Reviewed by Daniel Bates.

* http/tests/canvas/canvas-tainted-after-draw-image-expected.txt:
* http/tests/canvas/canvas-tainted-after-draw-image.html:
Set window.jsTestIsAsync true and call finishJSTest() to make the test 
asynchronous, so the TEST COMPLETE message will be output after all the
test messages. Also delete the synchronous tests for data url image and
same-domain image since they can't be reliably tested.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image-expected.txt
trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html




Diff

Modified: trunk/LayoutTests/ChangeLog (182766 => 182767)

--- trunk/LayoutTests/ChangeLog	2015-04-13 23:41:17 UTC (rev 182766)
+++ trunk/LayoutTests/ChangeLog	2015-04-13 23:51:36 UTC (rev 182767)
@@ -1,3 +1,17 @@
+2015-04-13  Said Abou-Hallawa  sabouhall...@apple.com
+
+Fix LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html on all bots
+following http://trac.webkit.org/changeset/182750.
+
+Reviewed by Daniel Bates.
+
+* http/tests/canvas/canvas-tainted-after-draw-image-expected.txt:
+* http/tests/canvas/canvas-tainted-after-draw-image.html:
+Set window.jsTestIsAsync true and call finishJSTest() to make the test 
+asynchronous, so the TEST COMPLETE message will be output after all the
+test messages. Also delete the synchronous tests for data url image and
+same-domain image since they can't be reliably tested.
+
 2015-04-13  Simon Fraser  simon.fra...@apple.com
 
 Fix compositing/geometry/fixed-transformed.html on Mavericks.


Modified: trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image-expected.txt (182766 => 182767)

--- trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image-expected.txt	2015-04-13 23:41:17 UTC (rev 182766)
+++ trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image-expected.txt	2015-04-13 23:51:36 UTC (rev 182767)
@@ -1,10 +1,8 @@
-CONSOLE MESSAGE: line 60: Unable to get image data from canvas because the canvas has been tainted by cross-origin data.
+CONSOLE MESSAGE: line 58: Unable to get image data from canvas because the canvas has been tainted by cross-origin data.
 Tainting works correctly.
 Tainting works correctly.
 Tainting works correctly.
 Tainting works correctly.
-Tainting works correctly.
-Tainting works correctly.
 PASS successfullyParsed is true
 
 TEST COMPLETE


Modified: trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html (182766 => 182767)

--- trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html	2015-04-13 23:41:17 UTC (rev 182766)
+++ trunk/LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html	2015-04-13 23:51:36 UTC (rev 182767)
@@ -24,14 +24,12 @@
   if (typeof incrementLoadedImagesCount.counter == 'undefined')
 incrementLoadedImagesCount.counter = 0;
 
-  if (++incrementLoadedImagesCount.counter == 6) {
-if (window.testRunner)
-  testRunner.notifyDone();
-  }
+  if (++incrementLoadedImagesCount.counter == 4)
+  finishJSTest();
 }
 
-function drawAndGetImageDataSynchronous(id, color, imageSrc, shouldTaint) {
-  var context = drawCanvasBackground(id, color);
+function drawAndGetImageDataSynchronous(id, imageSrc, shouldTaint) {
+  var context = drawCanvasBackground(id, '#f00'); // red
   var image =  new Image();
   image.src = ""
   context.drawImage(image, 0, 0);
@@ -51,7 +49,7 @@
 }
 
 function drawAndGetImageDataAsynchronous(canvasId, imageSrc, shouldTaint) {
-  var context = drawCanvasBackground(canvasId, '#f00');
+  var context = drawCanvasBackground(canvasId, '#f00'); // red
   var image =  new Image();
 
   image._onload_ = function() {
@@ -69,19 +67,19 @@
   image.src = ""
 }
 
-if (window.testRunner) {
-  testRunner.dumpAsText();
-  testRunner.waitUntilDone();
-}
-
-drawCanvasBackground(sourceCanvas, '#0f0');
-
-drawAndGetImageDataSynchronous(dataURLSynchronousCanvas, sourceCanvas.toDataURL(), false);
-drawAndGetImageDataAsynchronous(dataURLAsynchronousCanvas, sourceCanvas.toDataURL(), false);
+window.jsTestIsAsync = true;
 
-drawAndGetImageDataSynchronous(sameDomainSynchronousCanvas, http://127.0.0.1:8000/canvas/resources/100x100-lime-rect.svg, false);
+drawCanvasBackground(sourceCanvas, '#0f0'); // green
+
+// The dataURL and same-domain images should not be tainted. We should always be
+// able to get the image data regardless whether it is drawn or no

[webkit-changes] [183960] trunk/Source/WebCore

[said]

Title: [183960] trunk/Source/WebCore








Revision 183960
Author s...@apple.com
Date 2015-05-07 16:32:45 -0700 (Thu, 07 May 2015)


Log Message
Applying a filter on an SVG element, which is larger than 4096 pixels, causes this element to be rendered shifted to the left
https://bugs.webkit.org/show_bug.cgi?id=144335

Reviewed by Daniel Bates.

Address comments raised by Darin Adler in review.

* platform/graphics/ImageBuffer.cpp:
(WebCore::ImageBuffer::sizeNeedsClamping):
(WebCore::ImageBuffer::clampedSize):
(WebCore::ImageBuffer::isSizeClamped): Deleted.
* platform/graphics/ImageBuffer.h:
The condition for the negative width/height in isSizeClamped() was wrong. Use
FloatSize::isEmpty() instead and rename the function to sizeNeedsClamping().
The new function should return the opposite of the old function return value.

* platform/graphics/filters/FilterEffect.cpp:
(WebCore::FilterEffect::apply):
(WebCore::FilterEffect::asUnmultipliedImage):
(WebCore::FilterEffect::asPremultipliedImage):
(WebCore::FilterEffect::copyUnmultipliedImage):
(WebCore::FilterEffect::copyPremultipliedImage):
(WebCore::FilterEffect::createUnmultipliedImageResult):
(WebCore::FilterEffect::createPremultipliedImageResult):
* rendering/FilterEffectRenderer.cpp:
(WebCore::FilterEffectRenderer::updateBackingStoreRect):
(WebCore::FilterEffectRendererHelper::beginFilterEffect):
* rendering/svg/RenderSVGResourceFilter.cpp:
(WebCore::RenderSVGResourceFilter::applyResource):
Call the new function and negate the condition for the return value.

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/ImageBuffer.cpp
trunk/Source/WebCore/platform/graphics/ImageBuffer.h
trunk/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
trunk/Source/WebCore/rendering/FilterEffectRenderer.cpp
trunk/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (183959 => 183960)

--- trunk/Source/WebCore/ChangeLog	2015-05-07 23:29:15 UTC (rev 183959)
+++ trunk/Source/WebCore/ChangeLog	2015-05-07 23:32:45 UTC (rev 183960)
@@ -1,3 +1,36 @@
+2015-05-07  Said Abou-Hallawa  sabouhall...@apple.com
+
+Applying a filter on an SVG element, which is larger than 4096 pixels, causes this element to be rendered shifted to the left
+https://bugs.webkit.org/show_bug.cgi?id=144335
+
+Reviewed by Daniel Bates.
+
+Address comments raised by Darin Adler in review.
+
+* platform/graphics/ImageBuffer.cpp:
+(WebCore::ImageBuffer::sizeNeedsClamping):
+(WebCore::ImageBuffer::clampedSize):
+(WebCore::ImageBuffer::isSizeClamped): Deleted.
+* platform/graphics/ImageBuffer.h:
+The condition for the negative width/height in isSizeClamped() was wrong. Use
+FloatSize::isEmpty() instead and rename the function to sizeNeedsClamping().
+The new function should return the opposite of the old function return value.
+
+* platform/graphics/filters/FilterEffect.cpp:
+(WebCore::FilterEffect::apply):
+(WebCore::FilterEffect::asUnmultipliedImage):
+(WebCore::FilterEffect::asPremultipliedImage):
+(WebCore::FilterEffect::copyUnmultipliedImage):
+(WebCore::FilterEffect::copyPremultipliedImage):
+(WebCore::FilterEffect::createUnmultipliedImageResult):
+(WebCore::FilterEffect::createPremultipliedImageResult):
+* rendering/FilterEffectRenderer.cpp:
+(WebCore::FilterEffectRenderer::updateBackingStoreRect):
+(WebCore::FilterEffectRendererHelper::beginFilterEffect):
+* rendering/svg/RenderSVGResourceFilter.cpp:
+(WebCore::RenderSVGResourceFilter::applyResource):
+Call the new function and negate the condition for the return value.
+
 2015-05-07  Anders Carlsson  ander...@apple.com
 
 Build fix.


Modified: trunk/Source/WebCore/platform/graphics/ImageBuffer.cpp (183959 => 183960)

--- trunk/Source/WebCore/platform/graphics/ImageBuffer.cpp	2015-05-07 23:29:15 UTC (rev 183959)
+++ trunk/Source/WebCore/platform/graphics/ImageBuffer.cpp	2015-05-07 23:32:45 UTC (rev 183960)
@@ -36,29 +36,26 @@
 static const float MaxClampedLength = 4096;
 static const float MaxClampedArea = MaxClampedLength * MaxClampedLength;
 
-bool ImageBuffer::isSizeClamped(const FloatSize size)
+bool ImageBuffer::sizeNeedsClamping(const FloatSize size)
 {
-if (size.width()  0  size.height()  0)
+if (size.isEmpty())
 return false;
 
-if (size.isEmpty())
-return true;
-
-return floorf(size.height()) * floorf(size.width()) = MaxClampedArea;
+return floorf(size.height()) * floorf(size.width())  MaxClampedArea;
 }
 
-bool ImageBuffer::isSizeClamped(const FloatSize size, FloatSize scale)
+bool ImageBuffer::sizeNeedsClamping(const FloatSize size, FloatSize scale)
 {
 FloatSize scaledSize(size);
 scaledSize.scale(scale.width(), scale.height());
 
-if (isSizeClamped(scaledSize))
-

[webkit-changes] [183968] trunk/Source/WebKit/mac

[said]

Title: [183968] trunk/Source/WebKit/mac








Revision 183968
Author s...@apple.com
Date 2015-05-07 18:08:54 -0700 (Thu, 07 May 2015)


Log Message
Fix iPhone 6 iOS simulator Build.
following http://trac.webkit.org/changeset/183954.

Reviewed by Daniel Bates.

* WebView/WebHTMLView.mm:
(-[WebHTMLView pressureChangeWithEvent:]):

Modified Paths

trunk/Source/WebKit/mac/ChangeLog
trunk/Source/WebKit/mac/WebView/WebHTMLView.mm




Diff

Modified: trunk/Source/WebKit/mac/ChangeLog (183967 => 183968)

--- trunk/Source/WebKit/mac/ChangeLog	2015-05-08 00:59:01 UTC (rev 183967)
+++ trunk/Source/WebKit/mac/ChangeLog	2015-05-08 01:08:54 UTC (rev 183968)
@@ -1,3 +1,13 @@
+2015-05-07  Said Abou-Hallawa  sabouhall...@apple.com
+
+Fix iPhone 6 iOS simulator Build.
+following http://trac.webkit.org/changeset/183954.
+
+Reviewed by Daniel Bates.
+
+* WebView/WebHTMLView.mm:
+(-[WebHTMLView pressureChangeWithEvent:]):
+
 2015-05-07  Timothy Horton  timothy_hor...@apple.com
 
 Occasional null deref in WebImmediateActionController


Modified: trunk/Source/WebKit/mac/WebView/WebHTMLView.mm (183967 => 183968)

--- trunk/Source/WebKit/mac/WebView/WebHTMLView.mm	2015-05-08 00:59:01 UTC (rev 183967)
+++ trunk/Source/WebKit/mac/WebView/WebHTMLView.mm	2015-05-08 01:08:54 UTC (rev 183968)
@@ -4087,7 +4087,7 @@
 
 - (void)pressureChangeWithEvent:(NSEvent *)event
 {
-#if defined(__LP64__)  __MAC_OS_X_VERSION_MAX_ALLOWED = 101003
+#if PLATFORM(MAC)  defined(__LP64__)  __MAC_OS_X_VERSION_MAX_ALLOWED = 101003
 NSEvent *lastPressureEvent = [[self _webView] _pressureEvent];
 if (event.phase != NSEventPhaseChanged  event.phase != NSEventPhaseBegan  event.phase != NSEventPhaseEnded)
 return;






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [182876] trunk

[said]

Title: [182876] trunk








Revision 182876
Author s...@apple.com
Date 2015-04-15 19:50:29 -0700 (Wed, 15 Apr 2015)


Log Message
Minimum font size pref breaks SVG text very badly.
https://bugs.webkit.org/show_bug.cgi?id=143590.

Reviewed by Simon Fraser.

Source/WebCore:

When enabling the minimum font size perf, the computed font size is set
to the minimum font size if the computed value is smaller than the minimum.
The bug happens because the SVG text element applies its scaling on the
computed value after applying the minimum fort size rule. This means the
final computed value for the font size will be the scaling of the minimum
font size and not minimum font size itself. What we need is to postpone
applying the minimum font size rules, till the SVG scaling is applied.

Tests: svg/text/font-small-enlarged-minimum-larger.svg
   svg/text/font-small-enlarged-minimum-smaller.svg

* rendering/svg/RenderSVGInlineText.cpp:
(WebCore::RenderSVGInlineText::computeNewScaledFontForStyle): Call
computedFontSizeFromSpecifiedSizeForSVGInlineText() even if scalingFactor
is 1. We need to make sure the minimum font size rules are applied. This
function was assuming the mininum font size rule was applied when resolving
the style. This is not true anymore for the SVG text.

* style/StyleFontSizeFunctions.cpp:
(WebCore::Style::computedFontSizeFromSpecifiedSize): Do not apply the
minimum size rules for the SVG element until it applies its scaling to
the font size.

LayoutTests:

When enabling the minimum font size perf, the SVG text element should
apply the minimum font size rules on the scaled font.

* svg/text/font-small-enlarged-minimum-larger-expected.svg: Added.
* svg/text/font-small-enlarged-minimum-larger.svg: Added.
Minimum font size is larger than the scaled font size. Also the expected
file makes sure the minimum font size rules are still applied if no scaling
is applied.

* svg/text/font-small-enlarged-minimum-smaller-expected.svg: Added.
* svg/text/font-small-enlarged-minimum-smaller.svg: Added.
Minimum font size is smaller than the scaled font size. So the minimim font
size rule should not have any effect on the final computed font size.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp
trunk/Source/WebCore/style/StyleFontSizeFunctions.cpp


Added Paths

trunk/LayoutTests/svg/text/font-small-enlarged-minimum-larger-expected.svg
trunk/LayoutTests/svg/text/font-small-enlarged-minimum-larger.svg
trunk/LayoutTests/svg/text/font-small-enlarged-minimum-smaller-expected.svg
trunk/LayoutTests/svg/text/font-small-enlarged-minimum-smaller.svg




Diff

Modified: trunk/LayoutTests/ChangeLog (182875 => 182876)

--- trunk/LayoutTests/ChangeLog	2015-04-16 02:25:28 UTC (rev 182875)
+++ trunk/LayoutTests/ChangeLog	2015-04-16 02:50:29 UTC (rev 182876)
@@ -1,3 +1,24 @@
+2015-04-15  Said Abou-Hallawa  s...@apple.com
+
+Minimum font size pref breaks SVG text very badly.
+https://bugs.webkit.org/show_bug.cgi?id=143590.
+
+Reviewed by Simon Fraser.
+
+When enabling the minimum font size perf, the SVG text element should
+apply the minimum font size rules on the scaled font. 
+
+* svg/text/font-small-enlarged-minimum-larger-expected.svg: Added.
+* svg/text/font-small-enlarged-minimum-larger.svg: Added.
+Minimum font size is larger than the scaled font size. Also the expected
+file makes sure the minimum font size rules are still applied if no scaling
+is applied.
+
+* svg/text/font-small-enlarged-minimum-smaller-expected.svg: Added.
+* svg/text/font-small-enlarged-minimum-smaller.svg: Added.
+Minimum font size is smaller than the scaled font size. So the minimim font
+size rule should not have any effect on the final computed font size.
+
 2015-04-15  Jordan Harband  ljh...@gmail.com
 
 String.prototype.startsWith/endsWith/includes have wrong length in r182673


Added: trunk/LayoutTests/svg/text/font-small-enlarged-minimum-larger-expected.svg (0 => 182876)

--- trunk/LayoutTests/svg/text/font-small-enlarged-minimum-larger-expected.svg	(rev 0)
+++ trunk/LayoutTests/svg/text/font-small-enlarged-minimum-larger-expected.svg	2015-04-16 02:50:29 UTC (rev 182876)
@@ -0,0 +1,7 @@
+svg xmlns=http://www.w3.org/2000/svg style=width: 400px; height: 400px;
+  script
+internals.settings.setMinimumFontSize(80.0);
+  /script
+  rect x=40 y=40 width=320 height=320 stroke=green fill=none stroke-width=2/
+  text x=200 y=200 font-size=40.0 fill=black1/text
+/svg


Added: trunk/LayoutTests/svg/text/font-small-enlarged-minimum-larger.svg (0 => 182876)

--- trunk/LayoutTests/svg/text/font-small-enlarged-minimum-larger.svg	(rev 0)
+++ trunk/LayoutTests/svg/text/font-small-enlarged-minimum-larger.svg	2015-04-16 02:50:29 UTC (rev 182876)
@@ -0,0 +1,8 @@
+svg xmlns=http://www.w3.org/2000/svg 

[webkit-changes] [182955] trunk/Source/WebCore

[said]

Title: [182955] trunk/Source/WebCore








Revision 182955
Author s...@apple.com
Date 2015-04-17 10:30:43 -0700 (Fri, 17 Apr 2015)


Log Message
Fix review comments for https://bugs.webkit.org/show_bug.cgi?id=143590
following http://trac.webkit.org/changeset/182876.

Reviewed by Daniel Bates.

* ChangeLog:
Fixed typo.

* style/StyleFontSizeFunctions.cpp:
(WebCore::Style::computedFontSizeFromSpecifiedSize):
Fixed a typo in an enum definition and changed the name of an argument.

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/style/StyleFontSizeFunctions.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (182954 => 182955)

--- trunk/Source/WebCore/ChangeLog	2015-04-17 17:07:18 UTC (rev 182954)
+++ trunk/Source/WebCore/ChangeLog	2015-04-17 17:30:43 UTC (rev 182955)
@@ -1,3 +1,17 @@
+2015-04-17  Said Abou-Hallawa  sabouhall...@apple.com
+
+Fix review comments for https://bugs.webkit.org/show_bug.cgi?id=143590
+following http://trac.webkit.org/changeset/182876.
+
+Reviewed by Daniel Bates.
+
+* ChangeLog:
+Fixed typo.
+
+* style/StyleFontSizeFunctions.cpp:
+(WebCore::Style::computedFontSizeFromSpecifiedSize):
+Fixed a typo in an enum definition and changed the name of an argument.
+
 2015-04-17  Philippe Normand  pnorm...@igalia.com
 
 [GStreamer] Silent WebAudio buffers support
@@ -489,7 +503,7 @@
 When enabling the minimum font size perf, the computed font size is set
 to the minimum font size if the computed value is smaller than the minimum.
 The bug happens because the SVG text element applies its scaling on the
-computed value after applying the minimum fort size rule. This means the
+computed value after applying the minimum font size rule. This means the
 final computed value for the font size will be the scaling of the minimum
 font size and not minimum font size itself. What we need is to postpone
 applying the minimum font size rules, till the SVG scaling is applied.


Modified: trunk/Source/WebCore/style/StyleFontSizeFunctions.cpp (182954 => 182955)

--- trunk/Source/WebCore/style/StyleFontSizeFunctions.cpp	2015-04-17 17:07:18 UTC (rev 182954)
+++ trunk/Source/WebCore/style/StyleFontSizeFunctions.cpp	2015-04-17 17:30:43 UTC (rev 182955)
@@ -40,12 +40,12 @@
 namespace Style {
 
 enum MinimumFontSizeRule {
-DonNotApplyMinimumFontSize,
+DoNotApplyMinimumFontSize,
 DoNotUseSmartMinimumForFontSize,
 UseSmartMinimumForFontFize
 };
 
-static float computedFontSizeFromSpecifiedSize(float specifiedSize, bool isAbsoluteSize, float zoomFactor, MinimumFontSizeRule minimumForFontSizeRule, const Settings* settings)
+static float computedFontSizeFromSpecifiedSize(float specifiedSize, bool isAbsoluteSize, float zoomFactor, MinimumFontSizeRule minimumSizeRule, const Settings* settings)
 {
 // Text with a 0px font size should not be visible and therefore needs to be
 // exempt from minimum font size rules. Acid3 relies on this for pixel-perfect
@@ -67,7 +67,7 @@
 if (!settings)
 return 1.0f;
 
-if (minimumForFontSizeRule == DonNotApplyMinimumFontSize)
+if (minimumSizeRule == DoNotApplyMinimumFontSize)
 return specifiedSize;
 
 int minSize = settings-minimumFontSize();
@@ -82,7 +82,7 @@
 // after zooming. The font size must either be relative to the user default or the original size
 // must have been acceptable. In other words, we only apply the smart minimum whenever we're positive
 // doing so won't disrupt the layout.
-if (minimumForFontSizeRule ==  UseSmartMinimumForFontFize  zoomedSize  minLogicalSize  (specifiedSize = minLogicalSize || !isAbsoluteSize))
+if (minimumSizeRule ==  UseSmartMinimumForFontFize  zoomedSize  minLogicalSize  (specifiedSize = minLogicalSize || !isAbsoluteSize))
 zoomedSize = minLogicalSize;
 
 // Also clamp to a reasonable maximum to prevent insane font sizes from causing crashes on various
@@ -98,7 +98,7 @@
 if (Frame* frame = document.frame())
 zoomFactor *= frame-textZoomFactor();
 }
-return computedFontSizeFromSpecifiedSize(specifiedSize, isAbsoluteSize, zoomFactor, useSVGZoomRules ? DonNotApplyMinimumFontSize : UseSmartMinimumForFontFize, document.settings());
+return computedFontSizeFromSpecifiedSize(specifiedSize, isAbsoluteSize, zoomFactor, useSVGZoomRules ? DoNotApplyMinimumFontSize : UseSmartMinimumForFontFize, document.settings());
 }
 
 float computedFontSizeFromSpecifiedSizeForSVGInlineText(float specifiedSize, bool isAbsoluteSize, float zoomFactor, const Document document)






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [185228] trunk/LayoutTests

[said]

Title: [185228] trunk/LayoutTests








Revision 185228
Author s...@apple.com
Date 2015-06-04 17:12:53 -0700 (Thu, 04 Jun 2015)


Log Message
Skip failed layout tests following http://trac.webkit.org/changeset/185207
and https://trac.webkit.org/changeset/185220
(https://bugs.webkit.org/show_bug.cgi?id=145620)

Unreviewed.

* TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (185227 => 185228)

--- trunk/LayoutTests/ChangeLog	2015-06-05 00:03:09 UTC (rev 185227)
+++ trunk/LayoutTests/ChangeLog	2015-06-05 00:12:53 UTC (rev 185228)
@@ -1,3 +1,13 @@
+2015-06-04  Said Abou-Hallawa  sabouhall...@apple.com
+
+Skip failed layout tests following http://trac.webkit.org/changeset/185207
+and https://trac.webkit.org/changeset/185220
+(https://bugs.webkit.org/show_bug.cgi?id=145620)
+
+Unreviewed.
+
+* TestExpectations:
+
 2015-06-04  Commit Queue  commit-qu...@webkit.org
 
 Unreviewed, rolling out r185211.


Modified: trunk/LayoutTests/TestExpectations (185227 => 185228)

--- trunk/LayoutTests/TestExpectations	2015-06-05 00:03:09 UTC (rev 185227)
+++ trunk/LayoutTests/TestExpectations	2015-06-05 00:12:53 UTC (rev 185228)
@@ -525,3 +525,6 @@
 webkit.org/b/145007 js/regress-141098.html [ Skip ]
 
 webkit.org/b/145390 storage/indexeddb/deleteIndex-bug110792.html [ Pass Failure ]
+
+webkit.org/b/145675 fullscreen/video-controls-drag.html [ Skip ]
+webkit.org/b/145675 media/video-fullscreeen-only-controls.html [ Skip ]






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [185181] trunk/LayoutTests

[said]

Title: [185181] trunk/LayoutTests








Revision 185181
Author s...@apple.com
Date 2015-06-03 17:07:38 -0700 (Wed, 03 Jun 2015)


Log Message
Skip webgl/useWhilePending.html on WebKit 1 following:
http://trac.webkit.org/changeset/185172

Unreviewed.

* platform/mac-wk1/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/mac-wk1/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (185180 => 185181)

--- trunk/LayoutTests/ChangeLog	2015-06-04 00:03:35 UTC (rev 185180)
+++ trunk/LayoutTests/ChangeLog	2015-06-04 00:07:38 UTC (rev 185181)
@@ -1,5 +1,14 @@
 2015-06-03  Said Abou-Hallawa  sabouhall...@apple.com
 
+Skip webgl/useWhilePending.html on WebKit 1 following:
+http://trac.webkit.org/changeset/185172
+
+Unreviewed.
+
+* platform/mac-wk1/TestExpectations:
+
+2015-06-03  Said Abou-Hallawa  sabouhall...@apple.com
+
 Add missing expected result files for ios-simulator port following
 http://trac.webkit.org/changeset/185095
 http://trac.webkit.org/changeset/185096


Modified: trunk/LayoutTests/platform/mac-wk1/TestExpectations (185180 => 185181)

--- trunk/LayoutTests/platform/mac-wk1/TestExpectations	2015-06-04 00:03:35 UTC (rev 185180)
+++ trunk/LayoutTests/platform/mac-wk1/TestExpectations	2015-06-04 00:07:38 UTC (rev 185181)
@@ -67,6 +67,9 @@
 # Disable snapshotting tests on WK1 only
 plugins/snapshotting
 
+# WK1 doesn't do pending WebGL policies 
+fast/canvas/webgl/useWhilePending.html [ Skip ]
+
 # Animated image throttling behaves differently on WK1.
 fast/images/animated-gif-body-outside-viewport.html [ Skip ]
 fast/images/animated-gif-window-resizing.html [ Skip ]






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [185254] trunk/LayoutTests

[said]

Title: [185254] trunk/LayoutTests








Revision 185254
Author s...@apple.com
Date 2015-06-05 11:09:58 -0700 (Fri, 05 Jun 2015)


Log Message
Layout test http/tests/misc/acid3.html times out on Yosemite WK2 Debug.
https://bugs.webkit.org/show_bug.cgi?id=145702

* platform/mac-wk2/TestExpectations: Marking as flaky for now.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/mac-wk2/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (185253 => 185254)

--- trunk/LayoutTests/ChangeLog	2015-06-05 17:41:55 UTC (rev 185253)
+++ trunk/LayoutTests/ChangeLog	2015-06-05 18:09:58 UTC (rev 185254)
@@ -1,5 +1,12 @@
 2015-06-05  Said Abou-Hallawa  sabouhall...@apple.com
 
+Layout test http/tests/misc/acid3.html times out on Yosemite WK2 Debug.
+https://bugs.webkit.org/show_bug.cgi?id=145702
+
+* platform/mac-wk2/TestExpectations: Marking as flaky for now.
+
+2015-06-05  Said Abou-Hallawa  sabouhall...@apple.com
+
 [iOS] Rebaseline expected results for svg font tests
 
 Reviewed by Daniel Bates.


Modified: trunk/LayoutTests/platform/mac-wk2/TestExpectations (185253 => 185254)

--- trunk/LayoutTests/platform/mac-wk2/TestExpectations	2015-06-05 17:41:55 UTC (rev 185253)
+++ trunk/LayoutTests/platform/mac-wk2/TestExpectations	2015-06-05 18:09:58 UTC (rev 185254)
@@ -528,6 +528,8 @@
 
 webkit.org/b/141085 [ Yosemite ] http/tests/media/video-query-url.html [ Pass Timeout ]
 
+webkit.org/b/145702 [ Debug Yosemite ] http/tests/misc/acid3.html [ Pass Timeout ]
+
 ### END OF (7) New WebKit2-only failures in Yosemite
 
 






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [185253] trunk/LayoutTests

[said]

Title: [185253] trunk/LayoutTests








Revision 185253
Author s...@apple.com
Date 2015-06-05 10:41:55 -0700 (Fri, 05 Jun 2015)


Log Message
[iOS] Rebaseline expected results for svg font tests

Reviewed by Daniel Bates.

* platform/ios-simulator/svg/custom/svg-fonts-no-latin-glyph-expected.txt: Added.
* platform/ios-simulator/svg/custom/svg-fonts-segmented-expected.txt:
* platform/ios-simulator/svg/custom/svg-fonts-with-no-element-reference-expected.txt: Added.
* platform/ios-simulator/svg/text/text-overflow-ellipsis-svgfont-expected.txt:
* platform/ios-simulator/svg/text/text-overflow-ellipsis-svgfont-kerning-ligatures-expected.txt:
* svg/custom/svg-fonts-no-latin-glyph-expected.txt:
* svg/custom/svg-fonts-no-latin-glyph.html:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/ios-simulator/svg/custom/svg-fonts-segmented-expected.txt
trunk/LayoutTests/platform/ios-simulator/svg/text/text-overflow-ellipsis-svgfont-expected.txt
trunk/LayoutTests/platform/ios-simulator/svg/text/text-overflow-ellipsis-svgfont-kerning-ligatures-expected.txt
trunk/LayoutTests/svg/custom/svg-fonts-no-latin-glyph-expected.txt
trunk/LayoutTests/svg/custom/svg-fonts-no-latin-glyph.html


Added Paths

trunk/LayoutTests/platform/ios-simulator/svg/custom/svg-fonts-no-latin-glyph-expected.txt
trunk/LayoutTests/platform/ios-simulator/svg/custom/svg-fonts-with-no-element-reference-expected.txt




Diff

Modified: trunk/LayoutTests/ChangeLog (185252 => 185253)

--- trunk/LayoutTests/ChangeLog	2015-06-05 17:19:47 UTC (rev 185252)
+++ trunk/LayoutTests/ChangeLog	2015-06-05 17:41:55 UTC (rev 185253)
@@ -1,3 +1,17 @@
+2015-06-05  Said Abou-Hallawa  sabouhall...@apple.com
+
+[iOS] Rebaseline expected results for svg font tests
+
+Reviewed by Daniel Bates.
+
+* platform/ios-simulator/svg/custom/svg-fonts-no-latin-glyph-expected.txt: Added.
+* platform/ios-simulator/svg/custom/svg-fonts-segmented-expected.txt:
+* platform/ios-simulator/svg/custom/svg-fonts-with-no-element-reference-expected.txt: Added.
+* platform/ios-simulator/svg/text/text-overflow-ellipsis-svgfont-expected.txt:
+* platform/ios-simulator/svg/text/text-overflow-ellipsis-svgfont-kerning-ligatures-expected.txt:
+* svg/custom/svg-fonts-no-latin-glyph-expected.txt:
+* svg/custom/svg-fonts-no-latin-glyph.html:
+
 2015-06-05  Zalan Bujtas  za...@apple.com
 
 [iOS] Mask layer now is part of the layer tree output.


Added: trunk/LayoutTests/platform/ios-simulator/svg/custom/svg-fonts-no-latin-glyph-expected.txt (0 => 185253)

--- trunk/LayoutTests/platform/ios-simulator/svg/custom/svg-fonts-no-latin-glyph-expected.txt	(rev 0)
+++ trunk/LayoutTests/platform/ios-simulator/svg/custom/svg-fonts-no-latin-glyph-expected.txt	2015-06-05 17:41:55 UTC (rev 185253)
@@ -0,0 +1,4 @@
+Following character should be rendered as an exlamation.
+
+あ
+character height is 17


Modified: trunk/LayoutTests/platform/ios-simulator/svg/custom/svg-fonts-segmented-expected.txt (185252 => 185253)

--- trunk/LayoutTests/platform/ios-simulator/svg/custom/svg-fonts-segmented-expected.txt	2015-06-05 17:19:47 UTC (rev 185252)
+++ trunk/LayoutTests/platform/ios-simulator/svg/custom/svg-fonts-segmented-expected.txt	2015-06-05 17:41:55 UTC (rev 185253)
@@ -4,5 +4,5 @@
   RenderBlock {html} at (0,0) size 800x137
 RenderBody {body} at (8,40) size 784x57
   RenderBlock {p} at (0,0) size 784x57
-RenderText {#text} at (0,2) size 256x52
+RenderText {#text} at (0,2) size 256x53
   text run at (0,2) width 256: ABCdefoooO


Added: trunk/LayoutTests/platform/ios-simulator/svg/custom/svg-fonts-with-no-element-reference-expected.txt (0 => 185253)

--- trunk/LayoutTests/platform/ios-simulator/svg/custom/svg-fonts-with-no-element-reference-expected.txt	(rev 0)
+++ trunk/LayoutTests/platform/ios-simulator/svg/custom/svg-fonts-with-no-element-reference-expected.txt	2015-06-05 17:41:55 UTC (rev 185253)
@@ -0,0 +1,11 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x101
+  RenderBlock {HTML} at (0,0) size 800x101
+RenderBody {BODY} at (8,18) size 784x64
+  RenderBlock {P} at (0,0) size 784x22
+RenderText {#text} at (0,1) size 277x20
+  text run at (0,1) width 277: This text should be rendered with a first font.
+  RenderBlock {P} at (0,40) size 784x23
+RenderText {#text} at (0,1) size 285x20
+  text run at (0,1) width 285: This text should be rendered with a second font.


Modified: trunk/LayoutTests/platform/ios-simulator/svg/text/text-overflow-ellipsis-svgfont-expected.txt (185252 => 185253)

--- trunk/LayoutTests/platform/ios-simulator/svg/text/text-overflow-ellipsis-svgfont-expected.txt	2015-06-05 17:19:47 UTC (rev 185252)
+++ trunk/LayoutTests/platform/ios-simulator/svg/text/text-overflow-ellipsis-svgfont-expected.txt	2015-06-05 17:41:55 UTC (rev 

[webkit-changes] [185119] trunk/LayoutTests

[said]

Title: [185119] trunk/LayoutTests








Revision 185119
Author s...@apple.com
Date 2015-06-02 13:22:15 -0700 (Tue, 02 Jun 2015)


Log Message
Fix Mac Mavericks layout test failure following http://trac.webkit.org/changeset/185096
(https://bugs.webkit.org/show_bug.cgi?id=145478)

Move fast/text/font-weights-zh.html out of the platform directory. The
webkit test runner is not smart enough to ignore the expected results 
in the mac directory and get it from the Mavericks directory, if it exists,
when running on Mavericks.

Reviewed by Alexey Proskuryakov.

* fast/text/font-weights-zh.html: Added.
* platform/efl/TestExpectations:
* platform/gtk/TestExpectations:
* platform/mac/fast/text/font-weights-zh.html: Removed.
* platform/win/TestExpectations:
* platform/win-xp/TestExpectations:
* platform/wincairo/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/efl/TestExpectations
trunk/LayoutTests/platform/gtk/TestExpectations
trunk/LayoutTests/platform/win/TestExpectations
trunk/LayoutTests/platform/wincairo/TestExpectations


Added Paths

trunk/LayoutTests/fast/text/font-weights-zh.html


Removed Paths

trunk/LayoutTests/platform/mac/fast/text/font-weights-zh.html




Diff

Modified: trunk/LayoutTests/ChangeLog (185118 => 185119)

--- trunk/LayoutTests/ChangeLog	2015-06-02 20:20:41 UTC (rev 185118)
+++ trunk/LayoutTests/ChangeLog	2015-06-02 20:22:15 UTC (rev 185119)
@@ -1,3 +1,23 @@
+2015-06-02  Said Abou-Hallawa  sabouhall...@apple.com
+
+Fix Mac Mavericks layout test failure following http://trac.webkit.org/changeset/185096
+(https://bugs.webkit.org/show_bug.cgi?id=145478)
+
+Move fast/text/font-weights-zh.html out of the platform directory. The
+webkit test runner is not smart enough to ignore the expected results 
+in the mac directory and get it from the Mavericks directory, if it exists,
+when running on Mavericks.
+
+Reviewed by Alexey Proskuryakov.
+
+* fast/text/font-weights-zh.html: Added.
+* platform/efl/TestExpectations:
+* platform/gtk/TestExpectations:
+* platform/mac/fast/text/font-weights-zh.html: Removed.
+* platform/win/TestExpectations:
+* platform/win-xp/TestExpectations:
+* platform/wincairo/TestExpectations:
+
 2015-06-02  Brady Eidson  beid...@apple.com
 
 Add more tests for should open external urls flag.


Added: trunk/LayoutTests/fast/text/font-weights-zh.html (0 => 185119)

--- trunk/LayoutTests/fast/text/font-weights-zh.html	(rev 0)
+++ trunk/LayoutTests/fast/text/font-weights-zh.html	2015-06-02 20:22:15 UTC (rev 185119)
@@ -0,0 +1,36 @@
+!DOCTYPE html
+html
+head
+meta charset=UTF-8
+/head
+body
+This test is designed to test the interaction between font-family and font-weight. In particular, our implementation of font-family accepts PostScript names, which may name a font with a particular weight. However, there is another CSS property, font-weight, in which the author may also name a particular weight. Our font selection algorithm takes both of these signals into account when choosing fonts.brbrThere is currently no good way in _javascript_ to find the actual font chosen for some text. Therefore, the best way to test this aspect of the font selection algorithm is to dump the render tree, therefore testing glyph advances (which are a property of font weight).
+script
+function generateElements(fontNames) {
+[normal, italic].forEach(function(fontStyle) {
+fontNames.forEach(function(fontName) {
+for (var fontWeight = 100; fontWeight  1000; fontWeight += 100) {
+var d = document.createElement(div);
+d.innerText = Font:  + fontName +  Weight:  + fontWeight +  Style:  + fontStyle;
+document.body.appendChild(d);
+d = document.createElement(div);
+d.style.fontFamily = fontName;
+d.style.fontWeight = fontWeight;
+d.style.fontStyle = fontStyle;
+d.innerText = 果城的美譽。中国古;
+document.body.appendChild(d);
+}
+});
+});
+}
+var heitiFonts = [Heiti SC, STHeitiSC-Light, STHeitiSC-Medium];
+var songtiFonts = [Songti SC, STSongti-SC-Regular, STSongti-SC-Light, STSongti-SC-Bold, STSongti-SC-Black];
+var hiraginoFonts = [Hiragino Kaku Gothic ProN, HiraKakuProN-W3, HiraKakuProN-W6];
+var appleSDGothicNeoFonts = [Apple SD Gothic Neo, AppleSDGothicNeo-Regular, AppleSDGothicNeo-Medium, AppleSDGothicNeo-Light, AppleSDGothicNeo-UltraLight, AppleSDGothicNeo-Thin, AppleSDGothicNeo-SemiBold, AppleSDGothicNeo-Bold, AppleSDGothicNeo-ExtraBold, AppleSDGothicNeo-Heavy];
+generateElements(heitiFonts);
+generateElements(songtiFonts);
+generateElements(hiraginoFonts);
+generateElements(appleSDGothicNeoFonts);
+/script
+/body
+/html


Modified: trunk/LayoutTests/platform/efl/TestExpectations (185118 => 185119)

--- trunk/La

[webkit-changes] [185125] trunk/LayoutTests

[said]

Title: [185125] trunk/LayoutTests








Revision 185125
Author s...@apple.com
Date 2015-06-02 14:37:36 -0700 (Tue, 02 Jun 2015)


Log Message
Fix Windows layout test failure following http://trac.webkit.org/changeset/185095
(https://bugs.webkit.org/show_bug.cgi?id=145537)

Unreviewed.

* platform/win/fast/text/crash-complex-text-surrogate-expected.txt: Added.

Modified Paths

trunk/LayoutTests/ChangeLog


Added Paths

trunk/LayoutTests/platform/win/fast/text/crash-complex-text-surrogate-expected.txt




Diff

Modified: trunk/LayoutTests/ChangeLog (185124 => 185125)

--- trunk/LayoutTests/ChangeLog	2015-06-02 21:35:24 UTC (rev 185124)
+++ trunk/LayoutTests/ChangeLog	2015-06-02 21:37:36 UTC (rev 185125)
@@ -1,3 +1,12 @@
+2015-06-02  Said Abou-Hallawa  sabouhall...@apple.com
+
+Fix Windows layout test failure following http://trac.webkit.org/changeset/185095
+(https://bugs.webkit.org/show_bug.cgi?id=145537)
+
+Unreviewed.
+
+* platform/win/fast/text/crash-complex-text-surrogate-expected.txt: Added.
+
 2015-06-02  Zalan Bujtas  za...@apple.com
 
 Backdrop filter is pulling in content from behind the window.


Added: trunk/LayoutTests/platform/win/fast/text/crash-complex-text-surrogate-expected.txt (0 => 185125)

--- trunk/LayoutTests/platform/win/fast/text/crash-complex-text-surrogate-expected.txt	(rev 0)
+++ trunk/LayoutTests/platform/win/fast/text/crash-complex-text-surrogate-expected.txt	2015-06-02 21:37:36 UTC (rev 185125)
@@ -0,0 +1,60 @@
+CONSOLE MESSAGE: line 35: TypeError: undefined is not an object (evaluating 'document.forms[0].outerHTML')
+layer at (0,0) size 785x693
+  RenderView at (0,0) size 785x600
+layer at (0,0) size 785x693
+  RenderBlock {HTML} at (0,0) size 785x693
+RenderBody {BODY} at (8,8) size 80x677
+  RenderText {#text} at (0,0) size 72x120
+text run at (0,0) width 36: This
+text run at (0,15) width 36: test
+text run at (0,30) width 54: passes
+text run at (0,45) width 54: if you
+text run at (0,60) width 72: can open
+text run at (0,75) width 72: the file
+text run at (0,90) width 63: without
+text run at (0,105) width 72: a crash.
+  RenderBlock (floating) {DIV} at (72,120) size 8x182 [bgcolor=#ADD8E6]
+  RenderText {#text} at (0,120) size 9x15
+text run at (0,120) width 9: Y
+  RenderText {#text} at (9,120) size 45x15
+text run at (9,120) width 45: a bcd
+  RenderInline {SPAN} at (0,0) size 9x15
+RenderText {#text} at (54,120) size 9x15
+  text run at (54,120) width 9: \x{202B}X
+  RenderText {#text} at (0,0) size 0x0
+  RenderText {#text} at (0,135) size 279x287
+text run at (0,135) width 54: Errlog
+text run at (0,302) width 117: webtest_fn_1:
+text run at (0,317) width 90: TypeError:
+text run at (0,332) width 81: undefined
+text run at (0,347) width 54: is not
+text run at (0,362) width 18: an
+text run at (0,377) width 54: object
+text run at (0,392) width 99: (evaluating
+text run at (0,407) width 279: 'document.scripts[3].toString')
+  RenderBR {BR} at (0,0) size 0x0
+  RenderInline {ACRONYM} at (0,0) size 0x0
+  RenderText {#text} at (0,0) size 0x0
+  RenderText {#text} at (0,422) size 108x45
+text run at (0,422) width 45: s is:
+text run at (0,437) width 27: {,}
+text run at (0,452) width 108: \x{A888}{0}P{P}\\7H\\8
+  RenderBR {BR} at (0,0) size 0x0
+  RenderText {#text} at (0,467) size 72x15
+text run at (0,467) width 72: f is: gi
+  RenderBR {BR} at (72,467) size 0x15
+  RenderText {#text} at (0,482) size 369x195
+text run at (0,482) width 54: Errlog
+text run at (0,497) width 117: webtest_fn_4:
+text run at (0,512) width 90: TypeError:
+text run at (0,527) width 63: null is
+text run at (0,542) width 54: not an
+text run at (0,557) width 54: object
+text run at (0,572) width 99: (evaluating
+text run at (0,587) width 369: 'document.querySelector(\plaintext:first-
+text run at (0,602) width 63: of-type
+text run at (0,617) width 9: ~
+text run at (0,632) width 63: *|:out-
+text run at (0,647) width 27: of-
+text run at (0,662) width 198: range\).insertBefore')
+  RenderBR {BR} at (0,0) size 0x0






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [185157] trunk/LayoutTests

[said]

Title: [185157] trunk/LayoutTests








Revision 185157
Author s...@apple.com
Date 2015-06-03 11:44:57 -0700 (Wed, 03 Jun 2015)


Log Message
Add missing expected result files for GTK and EFL ports following
http://trac.webkit.org/changeset/185095
http://trac.webkit.org/changeset/181351

Unreviewed.

* platform/efl/fast/text/crash-complex-text-surrogate-expected.txt: Added.
* platform/gtk/editing/selection/extend-by-character-007-expected.txt: Added.
* platform/gtk/fast/text/crash-complex-text-surrogate-expected.txt: Added.

Modified Paths

trunk/LayoutTests/ChangeLog


Added Paths

trunk/LayoutTests/platform/efl/fast/text/crash-complex-text-surrogate-expected.txt
trunk/LayoutTests/platform/gtk/editing/selection/extend-by-character-007-expected.txt
trunk/LayoutTests/platform/gtk/fast/text/crash-complex-text-surrogate-expected.txt




Diff

Modified: trunk/LayoutTests/ChangeLog (185156 => 185157)

--- trunk/LayoutTests/ChangeLog	2015-06-03 18:37:23 UTC (rev 185156)
+++ trunk/LayoutTests/ChangeLog	2015-06-03 18:44:57 UTC (rev 185157)
@@ -1,3 +1,15 @@
+2015-06-03  Said Abou-Hallawa  sabouhall...@apple.com
+
+Add missing expected result files for GTK and EFL ports following
+http://trac.webkit.org/changeset/185095
+http://trac.webkit.org/changeset/181351
+
+Unreviewed.
+
+* platform/efl/fast/text/crash-complex-text-surrogate-expected.txt: Added.
+* platform/gtk/editing/selection/extend-by-character-007-expected.txt: Added.
+* platform/gtk/fast/text/crash-complex-text-surrogate-expected.txt: Added.
+
 2015-06-03  Brent Fulgham  bfulg...@apple.com
 
 REGRESSION: (r181879): Scrolling in select/option region in iFrame scrolls both select and iframe


Added: trunk/LayoutTests/platform/efl/fast/text/crash-complex-text-surrogate-expected.txt (0 => 185157)

--- trunk/LayoutTests/platform/efl/fast/text/crash-complex-text-surrogate-expected.txt	(rev 0)
+++ trunk/LayoutTests/platform/efl/fast/text/crash-complex-text-surrogate-expected.txt	2015-06-03 18:44:57 UTC (rev 185157)
@@ -0,0 +1,60 @@
+CONSOLE MESSAGE: line 35: TypeError: undefined is not an object (evaluating 'document.forms[0].outerHTML')
+layer at (0,0) size 785x693
+  RenderView at (0,0) size 785x600
+layer at (0,0) size 785x693
+  RenderBlock {HTML} at (0,0) size 785x693
+RenderBody {BODY} at (8,8) size 80x677
+  RenderText {#text} at (0,0) size 72x120
+text run at (0,0) width 36: This
+text run at (0,15) width 36: test
+text run at (0,30) width 54: passes
+text run at (0,45) width 54: if you
+text run at (0,60) width 72: can open
+text run at (0,75) width 72: the file
+text run at (0,90) width 63: without
+text run at (0,105) width 72: a crash.
+  RenderBlock (floating) {DIV} at (72,120) size 8x182 [bgcolor=#ADD8E6]
+  RenderText {#text} at (0,120) size 9x15
+text run at (0,120) width 9: Y
+  RenderText {#text} at (9,120) size 45x15
+text run at (9,120) width 45: a bcd
+  RenderInline {SPAN} at (0,0) size 9x15
+RenderText {#text} at (54,120) size 9x15
+  text run at (54,120) width 9: \x{202B}X
+  RenderText {#text} at (0,0) size 0x0
+  RenderText {#text} at (0,135) size 279x287
+text run at (0,135) width 54: Errlog
+text run at (0,302) width 117: webtest_fn_1:
+text run at (0,317) width 90: TypeError:
+text run at (0,332) width 81: undefined
+text run at (0,347) width 54: is not
+text run at (0,362) width 18: an
+text run at (0,377) width 54: object
+text run at (0,392) width 99: (evaluating
+text run at (0,407) width 279: 'document.scripts[3].toString')
+  RenderBR {BR} at (0,0) size 0x0
+  RenderInline {ACRONYM} at (0,0) size 0x0
+  RenderText {#text} at (0,0) size 0x0
+  RenderText {#text} at (0,422) size 117x45
+text run at (0,422) width 45: s is:
+text run at (0,437) width 27: {,}
+text run at (0,452) width 117: \x{A888}{0}P{P}\\7H\\8
+  RenderBR {BR} at (0,0) size 0x0
+  RenderText {#text} at (0,467) size 72x15
+text run at (0,467) width 72: f is: gi
+  RenderBR {BR} at (72,467) size 0x15
+  RenderText {#text} at (0,482) size 369x195
+text run at (0,482) width 54: Errlog
+text run at (0,497) width 117: webtest_fn_4:
+text run at (0,512) width 90: TypeError:
+text run at (0,527) width 63: null is
+text run at (0,542) width 54: not an
+text run at (0,557) width 54: object
+text run at (0,572) width 99: (evaluating
+text run at (0,587) width 369: 'document.querySelector(\plaintext:first-
+text run at (0,602) width 63: of-type
+text run at (0,617) width 9: ~
+text run at (0,632) width 63: *|:out-
+text run at (0,647) width 27: of-
+text run at (0,662) width 198: range\).insertBefore')
+  Render

[webkit-changes] [187504] trunk

[said]

Title: [187504] trunk








Revision 187504
Author s...@apple.com
Date 2015-07-28 13:10:03 -0700 (Tue, 28 Jul 2015)


Log Message
Crash happens when calling removeEventListener for an SVG element which has an instance inside a defs element of shadow tree
https://bugs.webkit.org/show_bug.cgi?id=147290

Reviewed by Daniel Bates.

Source/WebCore:

When the shadow tree is built for a use element, all the SVG elements
are allowed to be cloned in the shadow tree but later some of the elements
are disallowed and removed. Make sure, when disallowing an element in the
shadow tree, to reset the correspondingElement relationship between all
the disallowed descendant SVG elements and all their original elements.

Test: svg/custom/remove-event-listener-shadow-disallowed-element.svg

*svg/SVGElement.cpp:
(WebCore::SVGElement::setCorrespondingElement)
* svg/SVGUseElement.cpp:
(WebCore::removeDisallowedElementsFromSubtree):

LayoutTests:

Make sure we do not crash when when calling removeEventListener() for an
element which is cloned under a disallowed parent inside the shadow tree
of another use element.

* svg/custom/remove-event-listener-shadow-disallowed-element-expected.txt: Added.
* svg/custom/remove-event-listener-shadow-disallowed-element.svg: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGElement.cpp
trunk/Source/WebCore/svg/SVGUseElement.cpp


Added Paths

trunk/LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element-expected.txt
trunk/LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element.svg




Diff

Modified: trunk/LayoutTests/ChangeLog (187503 => 187504)

--- trunk/LayoutTests/ChangeLog	2015-07-28 19:48:03 UTC (rev 187503)
+++ trunk/LayoutTests/ChangeLog	2015-07-28 20:10:03 UTC (rev 187504)
@@ -1,3 +1,17 @@
+2015-07-28  Said Abou-Hallawa  sabouhall...@apple.com
+
+Crash happens when calling removeEventListener for an SVG element which has an instance inside a defs element of shadow tree
+https://bugs.webkit.org/show_bug.cgi?id=147290
+
+Reviewed by Daniel Bates.
+
+Make sure we do not crash when when calling removeEventListener() for an
+element which is cloned under a disallowed parent inside the shadow tree
+of another use element.
+
+* svg/custom/remove-event-listener-shadow-disallowed-element-expected.txt: Added.
+* svg/custom/remove-event-listener-shadow-disallowed-element.svg: Added.
+
 2015-07-27  David Hyatt  hy...@apple.com
 
 ASSERTION FAILED: !currBox-needsLayout() loading bing maps (and apple.com/music and nytimes)


Added: trunk/LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element-expected.txt (0 => 187504)

--- trunk/LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element-expected.txt	2015-07-28 20:10:03 UTC (rev 187504)
@@ -0,0 +1 @@
+Pass.


Added: trunk/LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element.svg (0 => 187504)

--- trunk/LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element.svg	(rev 0)
+++ trunk/LayoutTests/svg/custom/remove-event-listener-shadow-disallowed-element.svg	2015-07-28 20:10:03 UTC (rev 187504)
@@ -0,0 +1,37 @@
+svg version=1.1 xmlns=http://www.w3.org/2000/svg xmlns:xlink=http://www.w3.org/1999/xlink
+
+  defs
+svg id=green-svg width=100 height=100
+  defs
+ rect id=green-rect fill=green width=100 height=100/
+  /defs
+  use id=use-green-rect xlink:href=""
+/svg
+  /defs  
+
+  use id=use-green-svg x=10 y=10 xlink:href=""
+  textPass./text
+
+  script
+   if (window.testRunner)
+  testRunner.dumpAsText();
+
+var _onAlert_ = function() {
+  alert(test);
+}
+
+// This removeEventListener() has to be called before the onload fires. Before
+// onload fires, the shadow tree of the SVGUseElement is not built. So this
+// call should affect the original element only. Once the shadow tree is built,
+// the SVGUseElement calls updateShadowTree() and this is where we want to make
+// sure the eventListeners of all the cloned elements in the shadow tree are
+// updated correctly and the disallowed cloned elements and their descendants
+// are disconnected from their corresponding elements.
+document.getElementById(green-rect).addEventListener(click, onAlert);
+
+window.addEventListener(load, function () {
+  document.getElementById(green-rect).removeEventListener(click, onAlert);
+}, false);
+  /script
+
+/svg
\ No newline at end of file


Modified: trunk/Source/WebCore/ChangeLog (187503 => 187504)

--- trunk/Source/WebCore/ChangeLog	2015-07-28 19:48:03 UTC (rev 187503)
+++ trunk/Source/WebCore/ChangeLog	2015-07-28 20:10:03 UTC (rev 187504)
@@ -1,3 +1,23 @

[webkit-changes] [191731] trunk

[said]

Title: [191731] trunk








Revision 191731
Author s...@apple.com
Date 2015-10-29 10:12:43 -0700 (Thu, 29 Oct 2015)


Log Message
Exploitable crash happens when an SVG contains an indirect resource inheritance cycle
https://bugs.webkit.org/show_bug.cgi?id=150203

Reviewed by Brent Fulgham.

Source/WebCore:

Detecting cycles in SVG resource references happens in two places.
1. In SVGResourcesCycleSolver::resolveCycles() which it is called from 
   SVGResourcesCache::addResourcesFromRenderer(). When a cycle is deleted,
   SVGResourcesCycleSolver::breakCycle() is called to break the link. In
   the case of a cyclic resource inheritance, SVGResources::resetLinkedResource()
   is called to break this cycle.
2. SVGPatternElement::collectPatternAttributes() which is called from
   RenderSVGResourcePattern::buildPattern(). The purpose is to resolve
   the pattern attributes and to build a tile image which can be used to
   fill the SVG element renderer. Detecting the cyclic resource reference
   in this function is not sufficient and can detect simple cycles like





Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/rendering/svg/RenderSVGResourcePattern.cpp
trunk/Source/WebCore/rendering/svg/RenderSVGResourcePattern.h
trunk/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
trunk/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp
trunk/Source/WebCore/svg/SVGPatternElement.cpp


Added Paths

trunk/LayoutTests/svg/custom/pattern-content-inheritance-cycle-expected.svg
trunk/LayoutTests/svg/custom/pattern-content-inheritance-cycle.svg




Diff

Modified: trunk/LayoutTests/ChangeLog (191730 => 191731)

--- trunk/LayoutTests/ChangeLog	2015-10-29 16:51:41 UTC (rev 191730)
+++ trunk/LayoutTests/ChangeLog	2015-10-29 17:12:43 UTC (rev 191731)
@@ -1,3 +1,17 @@
+2015-10-29  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Exploitable crash happens when an SVG contains an indirect resource inheritance cycle
+https://bugs.webkit.org/show_bug.cgi?id=150203
+
+Reviewed by Brent Fulgham.
+
+Ensure that we do not crash when an SVG has an indirect cyclic resource
+inheritance. Make sure the cyclic resource was just ignored as if it did
+not exist.
+
+* svg/custom/pattern-content-inheritance-cycle-expected.svg: Added.
+* svg/custom/pattern-content-inheritance-cycle.svg: Added.
+
 2015-10-29  Carlos Garcia Campos  <cgar...@igalia.com>
 
 Unreviewed. GTK+ gardening: rebaseline more tests after r191623.


Added: trunk/LayoutTests/svg/custom/pattern-content-inheritance-cycle-expected.svg (0 => 191731)

--- trunk/LayoutTests/svg/custom/pattern-content-inheritance-cycle-expected.svg	(rev 0)
+++ trunk/LayoutTests/svg/custom/pattern-content-inheritance-cycle-expected.svg	2015-10-29 17:12:43 UTC (rev 191731)
@@ -0,0 +1,16 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+


Added: trunk/LayoutTests/svg/custom/pattern-content-inheritance-cycle.svg (0 => 191731)

--- trunk/LayoutTests/svg/custom/pattern-content-inheritance-cycle.svg	(rev 0)
+++ trunk/LayoutTests/svg/custom/pattern-content-inheritance-cycle.svg	2015-10-29 17:12:43 UTC (rev 191731)
@@ -0,0 +1,56 @@
+
+
+
+
+
+
+
+ m => n => l -->
+
+
+
+
+ q -->
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+// Add q => p to get p => q => p
+document.getElementById("q").setAttributeNS("http://www.w3.org/1999/xlink", "href", "#p");
+
+// Add s => t to get s => t => s
+document.getElementById("r").setAttribute("fill", "url(#t)");
+
+// Force layout
+document.documentElement.removeAttribute("class");
+
+


Modified: trunk/Source/WebCore/ChangeLog (191730 => 191731)

--- trunk/Source/WebCore/ChangeLog	2015-10-29 16:51:41 UTC (rev 191730)
+++ trunk/Source/WebCore/ChangeLog	2015-10-29 17:12:43 UTC (rev 191731)
@@ -1,3 +1,65 @@
+2015-10-29  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Exploitable crash happens when an SVG contains an indirect resource inheritance cycle
+https://bugs.webkit.org/show_bug.cgi?id=150203
+
+Reviewed by Brent Fulgham.
+
+Detecting cycles in SVG resource references happens in two places.
+1. In SVGResourcesCycleSolver::resolveCycles() which it is called from 
+   SVGResourcesCache::addResourcesFromRenderer(). When a cycle is deleted,
+

[webkit-changes] [191975] trunk/Tools

[said]

Title: [191975] trunk/Tools








Revision 191975
Author s...@apple.com
Date 2015-11-03 13:52:42 -0800 (Tue, 03 Nov 2015)


Log Message
Unreviewed, add myself to the SVG watchlist.

* Scripts/webkitpy/common/config/watchlist:

Modified Paths

trunk/Tools/ChangeLog
trunk/Tools/Scripts/webkitpy/common/config/watchlist




Diff

Modified: trunk/Tools/ChangeLog (191974 => 191975)

--- trunk/Tools/ChangeLog	2015-11-03 21:40:20 UTC (rev 191974)
+++ trunk/Tools/ChangeLog	2015-11-03 21:52:42 UTC (rev 191975)
@@ -1,3 +1,9 @@
+2015-11-03  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Unreviewed, add myself to the SVG watchlist.
+
+* Scripts/webkitpy/common/config/watchlist:
+
 2015-11-03  Wenson Hsieh  <wenson_hs...@apple.com>
 
 Fix touch event sending crash in WebKitTestRunner


Modified: trunk/Tools/Scripts/webkitpy/common/config/watchlist (191974 => 191975)

--- trunk/Tools/Scripts/webkitpy/common/config/watchlist	2015-11-03 21:40:20 UTC (rev 191974)
+++ trunk/Tools/Scripts/webkitpy/common/config/watchlist	2015-11-03 21:52:42 UTC (rev 191975)
@@ -374,7 +374,7 @@
 "RegionsDevelopment|RegionsExpectationsMore|RegionsExpectationsLess|RegionsUsage": [ "webkitbugtrac...@adobe.com" ],
 "Rendering": [ "esprehn+aut...@chromium.org", "gl...@skynav.com", "kondapallykal...@gmail.com" ],
 "RenderLayers" : [ "simon.fra...@apple.com", "kondapallykal...@gmail.com" ],
-"SVG": ["schen...@chromium.org", "p...@google.com", "fmal...@chromium.org", "gyuyoung@webkit.org", "sergio.corr...@openbossa.org" ],
+"SVG": ["schen...@chromium.org", "p...@google.com", "fmal...@chromium.org", "gyuyoung@webkit.org", "sergio.corr...@openbossa.org", "sabouhall...@apple.com" ],
 "SVNScripts": [ "dba...@webkit.org" ],
 "ScrollingCoordinator": [ "jam...@chromium.org", "toniki...@webkit.org", "cmarc...@webkit.org", "l...@webkit.org" ],
 "Selectors": [ "allan.jen...@digia.com" ],






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [192550] trunk/PerformanceTests

[said]

(rev 192549)
+++ trunk/PerformanceTests/ChangeLog	2015-11-18 00:16:56 UTC (rev 192550)
@@ -1,5 +1,22 @@
 2015-11-17  Said Abou-Hallawa  <sabouhall...@apple.com>
 
+Disable flattening the stage iframe of the graphics benchmark when running on iOS
+https://bugs.webkit.org/show_bug.cgi?id=151361
+
+Reviewed by Simon Fraser.
+
+Use fixed size for stage iframe of the graphics benchmark to disable
+flattening the iframe while animating the particles. Also ensure the
+bouncing particles do not go outside the iframe's boundaries.
+
+* Animometer/runner/resources/animometer.css:
+(section#running > #running-test > iframe):
+(@media screen and (min-device-width: 1800px)):
+* Animometer/tests/bouncing-particles/resources/bouncing-particles.js:
+(BouncingParticle.prototype.animate):
+
+2015-11-17  Said Abou-Hallawa  <sabouhall...@apple.com>
+
 Use the media queries to dynamically set the stage for the graphics benchmark
 https://bugs.webkit.org/show_bug.cgi?id=151327
 






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [189741] trunk/LayoutTests

[said]

Title: [189741] trunk/LayoutTests








Revision 189741
Author s...@apple.com
Date 2015-09-14 10:38:48 -0700 (Mon, 14 Sep 2015)


Log Message
Unreviewed, expect css3/flexbox/image-percent-max-height.html to fail on iOS.
The test is already expected to fail on mac, windows and gtk.

* platform/ios-simulator/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/ios-simulator/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (189740 => 189741)

--- trunk/LayoutTests/ChangeLog	2015-09-14 17:31:24 UTC (rev 189740)
+++ trunk/LayoutTests/ChangeLog	2015-09-14 17:38:48 UTC (rev 189741)
@@ -1,3 +1,10 @@
+2015-09-14  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Unreviewed, expect css3/flexbox/image-percent-max-height.html to fail on iOS.
+The test is already expected to fail on mac, windows and gtk.
+
+* platform/ios-simulator/TestExpectations:
+
 2015-09-14  Chris Dumez  <cdu...@apple.com>
 
 Unreviewed, rebaseline imported/w3c/web-platform-tests/html/dom/interfaces.html on iOS.


Modified: trunk/LayoutTests/platform/ios-simulator/TestExpectations (189740 => 189741)

--- trunk/LayoutTests/platform/ios-simulator/TestExpectations	2015-09-14 17:31:24 UTC (rev 189740)
+++ trunk/LayoutTests/platform/ios-simulator/TestExpectations	2015-09-14 17:38:48 UTC (rev 189741)
@@ -2812,3 +2812,6 @@
 http/tests/navigation/page-cache-pending-image-load-cache-partition.html [ Skip ]
 http/tests/security/mixedContent/websocket/insecure-websocket-in-iframe.html [ Skip ]
 http/tests/security/mixedContent/websocket/insecure-websocket-in-main-frame.html [ Skip ]
+
+# -webkit-flex off-by-one px
+webkit.org/b/126898 css3/flexbox/image-percent-max-height.html [ ImageOnlyFailure ]






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [189742] trunk/LayoutTests

[said]

Title: [189742] trunk/LayoutTests








Revision 189742
Author s...@apple.com
Date 2015-09-14 10:57:27 -0700 (Mon, 14 Sep 2015)


Log Message
Unreviewed, skip fast/text/international/system-language for now.
WebKitTestRunner declarative language setting is broken for iOS.

* platform/ios-simulator/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/ios-simulator/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (189741 => 189742)

--- trunk/LayoutTests/ChangeLog	2015-09-14 17:38:48 UTC (rev 189741)
+++ trunk/LayoutTests/ChangeLog	2015-09-14 17:57:27 UTC (rev 189742)
@@ -1,5 +1,12 @@
 2015-09-14  Said Abou-Hallawa  <sabouhall...@apple.com>
 
+Unreviewed, skip fast/text/international/system-language for now.
+WebKitTestRunner declarative language setting is broken for iOS.
+
+* platform/ios-simulator/TestExpectations:
+
+2015-09-14  Said Abou-Hallawa  <sabouhall...@apple.com>
+
 Unreviewed, expect css3/flexbox/image-percent-max-height.html to fail on iOS.
 The test is already expected to fail on mac, windows and gtk.
 


Modified: trunk/LayoutTests/platform/ios-simulator/TestExpectations (189741 => 189742)

--- trunk/LayoutTests/platform/ios-simulator/TestExpectations	2015-09-14 17:38:48 UTC (rev 189741)
+++ trunk/LayoutTests/platform/ios-simulator/TestExpectations	2015-09-14 17:57:27 UTC (rev 189742)
@@ -2815,3 +2815,6 @@
 
 # -webkit-flex off-by-one px
 webkit.org/b/126898 css3/flexbox/image-percent-max-height.html [ ImageOnlyFailure ]
+
+# WebKitTestRunner declarative language setting is broken for iOS
+webkit.org/b/149119 fast/text/international/system-language [ Skip ]






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [190273] trunk/Source/WebCore

[said]

Title: [190273] trunk/Source/WebCore








Revision 190273
Author s...@apple.com
Date 2015-09-27 20:43:00 -0700 (Sun, 27 Sep 2015)


Log Message
Rename all the variables and parameters of type HTMLImageElement in CanvasRenderingContext2D.cpp from 'image' to 'imageElement'

Patch by Said Abou-Hallawa <sabouhall...@apple.com> on 2015-09-27
Reviewed by Darin Adler.

This does not change functionality in this file. It is a preparation for
the fix of the https://bugs.webkit.org/show_bug.cgi?id=148845.

* html/canvas/CanvasRenderingContext2D.cpp:
(WebCore::size):
(WebCore::normalizeRect):
(WebCore::CanvasRenderingContext2D::drawImageFromRect):
(WebCore::CanvasRenderingContext2D::setAlpha):
(WebCore::CanvasRenderingContext2D::createRadialGradient):
(WebCore::CanvasRenderingContext2D::createPattern):
(WebCore::CanvasRenderingContext2D::drawImage):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (190272 => 190273)

--- trunk/Source/WebCore/ChangeLog	2015-09-27 22:24:18 UTC (rev 190272)
+++ trunk/Source/WebCore/ChangeLog	2015-09-28 03:43:00 UTC (rev 190273)
@@ -1,3 +1,21 @@
+2015-09-27  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Rename all the variables and parameters of type HTMLImageElement in CanvasRenderingContext2D.cpp from 'image' to 'imageElement'
+
+Reviewed by Darin Adler.
+
+This does not change functionality in this file. It is a preparation for
+the fix of the https://bugs.webkit.org/show_bug.cgi?id=148845.
+
+* html/canvas/CanvasRenderingContext2D.cpp:
+(WebCore::size):
+(WebCore::normalizeRect):
+(WebCore::CanvasRenderingContext2D::drawImageFromRect):
+(WebCore::CanvasRenderingContext2D::setAlpha):
+(WebCore::CanvasRenderingContext2D::createRadialGradient):
+(WebCore::CanvasRenderingContext2D::createPattern):
+(WebCore::CanvasRenderingContext2D::drawImage):
+
 2015-09-27  Yusuke Suzuki  <utatane@gmail.com>
 
 [ES6] Implement ES6 Module loader hook stubs in WebCore


Modified: trunk/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp (190272 => 190273)

--- trunk/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp	2015-09-27 22:24:18 UTC (rev 190272)
+++ trunk/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp	2015-09-28 03:43:00 UTC (rev 190273)
@@ -1326,14 +1326,14 @@
 ImageSizeBeforeDevicePixelRatio
 };
 
-static LayoutSize size(HTMLImageElement* image, ImageSizeType sizeType)
+static LayoutSize size(HTMLImageElement* imageElement, ImageSizeType sizeType)
 {
 LayoutSize size;
-if (CachedImage* cachedImage = image->cachedImage()) {
-size = cachedImage->imageSizeForRenderer(image->renderer(), 1.0f); // FIXME: Not sure about this.
+if (CachedImage* cachedImage = imageElement->cachedImage()) {
+size = cachedImage->imageSizeForRenderer(imageElement->renderer(), 1.0f); // FIXME: Not sure about this.
 
-if (sizeType == ImageSizeAfterDevicePixelRatio && is(image->renderer()) && cachedImage->image() && !cachedImage->image()->hasRelativeWidth())
-size.scale(downcast(*image->renderer()).imageDevicePixelRatio());
+if (sizeType == ImageSizeAfterDevicePixelRatio && is(imageElement->renderer()) && cachedImage->image() && !cachedImage->image()->hasRelativeWidth())
+size.scale(downcast(*imageElement->renderer()).imageDevicePixelRatio());
 }
 return size;
 }
@@ -1355,42 +1355,42 @@
 std::max(rect.height(), -rect.height()));
 }
 
-void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, float x, float y, ExceptionCode& ec)
+void CanvasRenderingContext2D::drawImage(HTMLImageElement* imageElement, float x, float y, ExceptionCode& ec)
 {
-if (!image) {
+if (!imageElement) {
 ec = TYPE_MISMATCH_ERR;
 return;
 }
-LayoutSize destRectSize = size(image, ImageSizeAfterDevicePixelRatio);
-drawImage(image, x, y, destRectSize.width(), destRectSize.height(), ec);
+LayoutSize destRectSize = size(imageElement, ImageSizeAfterDevicePixelRatio);
+drawImage(imageElement, x, y, destRectSize.width(), destRectSize.height(), ec);
 }
 
-void CanvasRenderingContext2D::drawImage(HTMLImageElement* image,
+void CanvasRenderingContext2D::drawImage(HTMLImageElement* imageElement,
 float x, float y, float width, float height, ExceptionCode& ec)
 {
-if (!image) {
+if (!imageElement) {
 ec = TYPE_MISMATCH_ERR;
 return;
 }
-LayoutSize sourceRectSize = size(image, ImageSizeBeforeDevicePixelRatio);
-drawImage(image, FloatRect(0, 0, sourceRectSize.width(), sourceRectSize.height()), FloatRect(x, y, width, height), ec);
+LayoutSize sourceRectSize = size(imageElement, ImageSizeBeforeDevicePixelRatio

[webkit-changes] [189548] trunk/LayoutTests

[said]

Title: [189548] trunk/LayoutTests








Revision 189548
Author s...@apple.com
Date 2015-09-09 13:58:44 -0700 (Wed, 09 Sep 2015)


Log Message
Mark http/tests/css/link-css-disabled-value-with-slow-loading-sheet.html as flaky on Windows

This test is marked as flaky on gtk and mak-wk2. It fails on Windows more
than it fails on any other platform.

* platform/win/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/win/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (189547 => 189548)

--- trunk/LayoutTests/ChangeLog	2015-09-09 20:57:22 UTC (rev 189547)
+++ trunk/LayoutTests/ChangeLog	2015-09-09 20:58:44 UTC (rev 189548)
@@ -1,3 +1,12 @@
+2015-09-09  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Mark http/tests/css/link-css-disabled-value-with-slow-loading-sheet.html as flaky on Windows
+
+This test is marked as flaky on gtk and mak-wk2. It fails on Windows more
+than it fails on any other platform.
+
+* platform/win/TestExpectations:
+
 2015-09-09  Alexey Proskuryakov  <a...@apple.com>
 
 fast/dom/rtl-scroll-to-leftmost-and-resize.html is a flaky timeout - IPC drops messages


Modified: trunk/LayoutTests/platform/win/TestExpectations (189547 => 189548)

--- trunk/LayoutTests/platform/win/TestExpectations	2015-09-09 20:57:22 UTC (rev 189547)
+++ trunk/LayoutTests/platform/win/TestExpectations	2015-09-09 20:58:44 UTC (rev 189548)
@@ -726,6 +726,7 @@
 
 # Sensitive to load timing or PHP behavior
 webkit.org/b/44873 http/tests/css/css-image-loading.html [ Skip ]
+webkit.org/b/149007 http/tests/css/link-css-disabled-value-with-slow-loading-sheet.html [ Pass Failure ]
 http/tests/css/link-css-disabled-value-with-slow-loading-sheet-in-error.html [ Pass Failure ] # Flaky
 
 # Assertion failure in replaySavedEvents http://webkit.org/b/21796






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [192714] trunk/Tools

[said]

Title: [192714] trunk/Tools








Revision 192714
Author s...@apple.com
Date 2015-11-20 18:51:51 -0800 (Fri, 20 Nov 2015)


Log Message
Unreviewed, add watchlist for PerformanceTests/Animometer and add myself.
 
* Scripts/webkitpy/common/config/watchlist:

Modified Paths

trunk/Tools/ChangeLog
trunk/Tools/Scripts/webkitpy/common/config/watchlist




Diff

Modified: trunk/Tools/ChangeLog (192713 => 192714)

--- trunk/Tools/ChangeLog	2015-11-21 02:29:23 UTC (rev 192713)
+++ trunk/Tools/ChangeLog	2015-11-21 02:51:51 UTC (rev 192714)
@@ -1,3 +1,9 @@
+2015-11-20  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Unreviewed, add watchlist for PerformanceTests/Animometer and add myself.
+ 
+* Scripts/webkitpy/common/config/watchlist:
+
 2015-11-20  Alexey Proskuryakov  <a...@apple.com>
 
 Went a bit too far, revert part of the previous patch.


Modified: trunk/Tools/Scripts/webkitpy/common/config/watchlist (192713 => 192714)

--- trunk/Tools/Scripts/webkitpy/common/config/watchlist	2015-11-21 02:29:23 UTC (rev 192713)
+++ trunk/Tools/Scripts/webkitpy/common/config/watchlist	2015-11-21 02:51:51 UTC (rev 192714)
@@ -236,6 +236,9 @@
 "filename": r"PerformanceTests"
 r"|Tools/Scripts/webkitpy/performance_tests",
 },
+"Animometer": {
+"filename": r"PerformanceTests/Animometer",
+},
 "ConsoleUsage": {
 "more": r"[Aa]ddConsoleMessage|reportException|logExceptionToConsole|addMessage|printErrorMessage"
 },
@@ -339,6 +342,7 @@
 # two different accounts as far as bugzilla is concerned.
 "Accessibility": [ "cfleiz...@apple.com", "dmazz...@google.com", "apinhe...@igalia.com", "jdi...@igalia.com", "aboxh...@chromium.org", "ma...@webkit.org", "samuel_wh...@apple.com", "jcr...@apple.com" ],
 "Animation" : [ "simon.fra...@apple.com", "d...@apple.com", "dstockw...@chromium.org" ],
+"Animometer" : [ "sabouhall...@apple.com" ],
 "AppleMacPublicApi": [ "timo...@apple.com" ],
 "Battery": [ "gyuyoung@webkit.org" ],
 "BindingsScripts": [ "cdu...@apple.com", "cgar...@igalia.com" ],






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [196381] trunk/PerformanceTests

[said]

ter", Stage.randomStyleFilter());
+
 this._move();
 }, {
 


Modified: trunk/PerformanceTests/Animometer/tests/bouncing-particles/resources/bouncing-particles.js (196380 => 196381)

--- trunk/PerformanceTests/Animometer/tests/bouncing-particles/resources/bouncing-particles.js	2016-02-10 20:33:20 UTC (rev 196380)
+++ trunk/PerformanceTests/Animometer/tests/bouncing-particles/resources/bouncing-particles.js	2016-02-10 20:45:01 UTC (rev 196381)
@@ -84,6 +84,8 @@
 this.shape = options["shape"] || "circle";
 this.fill = options["fill"] || "solid";
 this.clip = options["clip"] || "";
+this.blend = options["blend"] || false;
+this.filter = options["filter"] || false;
 },
 
 animate: function(timeDelta)


Modified: trunk/PerformanceTests/Animometer/tests/resources/main.js (196380 => 196381)

--- trunk/PerformanceTests/Animometer/tests/resources/main.js	2016-02-10 20:33:20 UTC (rev 196380)
+++ trunk/PerformanceTests/Animometer/tests/resources/main.js	2016-02-10 20:45:01 UTC (rev 196381)
@@ -766,6 +766,48 @@
 + this.randomInt(min, max).toString(16);
 },
 
+randomStyleMixBlendMode: function()
+{
+var mixBlendModeList = [
+  'normal',
+  'multiply',
+  'screen',
+  'overlay',
+  'darken',
+  'lighten',
+  'color-dodge',
+  'color-burn',
+  'hard-light',
+  'soft-light',
+  'difference',
+  'exclusion',
+  'hue',
+  'saturation',
+  'color',
+  'luminosity'
+];
+
+return mixBlendModeList[this.randomInt(0, mixBlendModeList.length)];
+},
+
+randomStyleFilter: function()
+{
+var filterList = [
+'grayscale(50%)',
+'sepia(50%)',
+'saturate(50%)',
+'hue-rotate(180)',
+'invert(50%)',
+'opacity(50%)',
+'brightness(50%)',
+'contrast(50%)',
+'blur(10px)',
+'drop-shadow(10px 10px 10px gray)'
+];
+
+return filterList[this.randomInt(0, filterList.length)];
+},
+
 rotatingColor: function(cycleLengthMs, saturation, lightness)
 {
 return "hsl("


Modified: trunk/PerformanceTests/ChangeLog (196380 => 196381)

--- trunk/PerformanceTests/ChangeLog	2016-02-10 20:33:20 UTC (rev 196380)
+++ trunk/PerformanceTests/ChangeLog	2016-02-10 20:45:01 UTC (rev 196381)
@@ -1,3 +1,30 @@
+2016-02-09  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Add internal benchmark tests for CSS mix-blend-modes and filters
+https://bugs.webkit.org/show_bug.cgi?id=154058
+
+Provisionally reviewed by Jon Lee.
+
+* Animometer/resources/debug-runner/tests.js: Include the new tests in the
+"HTML suite" of the debug runner.
+
+* Animometer/resources/extensions.js:
+(Utilities.browserPrefix):
+(Utilities.setElementPrefixedProperty): Utility functions to allow setting
+prefixed style properties.
+
+* Animometer/tests/bouncing-particles/resources/bouncing-css-shapes.js:
+Set the mix-blend-mode and the filter to some random values if the options
+of the test requested that.
+
+* Animometer/tests/bouncing-particles/resources/bouncing-particles.js:
+(parseShapeParameters): Parse the url options "blend" and "filter" and set
+the corresponding flags.
+
+* Animometer/tests/resources/main.js:
+(randomStyleMixBlendMode):
+(randomStyleFilter): Return random mix-blend-mode and filter.
+
 2016-02-08  Jon Lee  <jon...@apple.com>
 
 Add a ramp controller






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [197125] trunk/Source/WebCore

[said]

Title: [197125] trunk/Source/WebCore








Revision 197125
Author s...@apple.com
Date 2016-02-25 11:55:55 -0800 (Thu, 25 Feb 2016)


Log Message
REGRESSION (r196268): Many assertion failures and crashes on SVG path animation tests when JS garbage collection happens quickly
https://bugs.webkit.org/show_bug.cgi?id=154331

Reviewed by Darin Adler.

This is not an actual regression. The bug did exist before r196268 but
the whole document was leaking once an SVGAnimatedProperty was created
so there was no way to produce this bug. After fixing the leak, one crash
and one assert got uncovered. Both of them happen because of the fact:
"if an SVGAnimatedProperty is not referenced it will be deleted."

* svg/SVGPathElement.cpp:
(WebCore::SVGPathElement::lookupOrCreateDWrapper):
The code in this function was assuming that the wrapper will be created
only once which happens when SVGAnimatedProperty::lookupOrCreateWrapper()
is called. Before making this single call, lookupOrCreateDWrapper() was
building an initial SVGPathSegList from byte stream. But now
SVGAnimatedProperty::lookupWrapper() can return false even after creating
the SVGAnimatedProperty because it was deleted later. Calling
buildSVGPathSegListFromByteStream() more than once was causing
SVGAnimatedListPropertyTearOff::animationStarted() to fire the assertion
ASSERT(m_values.size() == m_wrappers.size()) because the path segments were
appended twice to m_values which is in fact SVGPathElement::m_pathSegList.value.
The fix is to build the initial SVGPathSegList only once which should happen
when m_pathSegList.value.isEmpty().

(WebCore::SVGPathElement::animatedPropertyWillBeDeleted):
* svg/SVGPathElement.h:
* svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
(WebCore::SVGAnimatedPathSegListPropertyTearOff::~SVGAnimatedPathSegListPropertyTearOff):
SVGPathElement is assuming the following equivalence relation:
m_pathSegList.shouldSynchronize ~ SVGAnimatedProperty_is_created_and_not_null.
SVGPathElement::animatedPathSegList() and animatedNormalizedPathSegList()
set m_pathSegList.shouldSynchronize to true when SVGAnimatedProperty is
created but nothing sets m_pathSegList.shouldSynchronize back to false.
This was not a problem when the SVGAnimatedProperty was leaking but after
ensuring it is deleted when it is not referenced this equivalence relation
becomes untrue sometimes. This caused SVGPathElement::svgAttributeChanged()
to crash when we check m_pathSegList.shouldSynchronize and if it is true we
assume that SVGAnimatedProperty::lookupWrapper() will return a non-null pointer
and therefore we deference this pointer and call SVGAnimatedProperty::isAnimating().
To fix this crash we need to set m_pathSegList.shouldSynchronize back to false
when the associated SVGAnimatedProperty is deleted.

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGPathElement.cpp
trunk/Source/WebCore/svg/SVGPathElement.h
trunk/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h




Diff

Modified: trunk/Source/WebCore/ChangeLog (197124 => 197125)

--- trunk/Source/WebCore/ChangeLog	2016-02-25 19:36:52 UTC (rev 197124)
+++ trunk/Source/WebCore/ChangeLog	2016-02-25 19:55:55 UTC (rev 197125)
@@ -1,3 +1,49 @@
+2016-02-25  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+REGRESSION (r196268): Many assertion failures and crashes on SVG path animation tests when JS garbage collection happens quickly
+https://bugs.webkit.org/show_bug.cgi?id=154331
+
+Reviewed by Darin Adler.
+
+This is not an actual regression. The bug did exist before r196268 but
+the whole document was leaking once an SVGAnimatedProperty was created
+so there was no way to produce this bug. After fixing the leak, one crash
+and one assert got uncovered. Both of them happen because of the fact:
+"if an SVGAnimatedProperty is not referenced it will be deleted."
+
+* svg/SVGPathElement.cpp:
+(WebCore::SVGPathElement::lookupOrCreateDWrapper):
+The code in this function was assuming that the wrapper will be created
+only once which happens when SVGAnimatedProperty::lookupOrCreateWrapper()
+is called. Before making this single call, lookupOrCreateDWrapper() was
+building an initial SVGPathSegList from byte stream. But now
+SVGAnimatedProperty::lookupWrapper() can return false even after creating
+the SVGAnimatedProperty because it was deleted later. Calling
+buildSVGPathSegListFromByteStream() more than once was causing
+SVGAnimatedListPropertyTearOff::animationStarted() to fire the assertion
+ASSERT(m_values.size() == m_wrappers.size()) because the path segments were
+appended twice to m_values which is in fact SVGPathElement::m_pathSegList.value.
+The fix is to build the initial SVGPathSegList only once which should happen
+when m_pathSegList.value.isEmpty().
+
+   

[webkit-changes] [196669] trunk

[said]

Title: [196669] trunk








Revision 196669
Author s...@apple.com
Date 2016-02-16 15:59:25 -0800 (Tue, 16 Feb 2016)


Log Message
REGRESSION (r190430): WTFCrashWithSecurityImplication in:void SVGRootInlineBox::layoutCharactersInTextBoxes()
https://bugs.webkit.org/show_bug.cgi?id=154185

Reviewed by Ryosuke Niwa.
Source/WebCore:


This is a regression caused by adding support for HTMLSlotElement. The
crash happens when adding an HTMLSlotElement to anther element which should
not have it as a child like SVGTextElement for example. In this case, we
were creating a RenderText which should not be happen inside an SVG document.
The RenderText::createTextBox() was creating InlineTextBox for the slot's
text and attach it to the SVGRootInlineBox. In layoutCharactersInTextBoxes(),
the assumption is the inline box is either SVGInlineTextBox or SVGInlineFlowBox.
But since we have an InlineTextBox instead, the crash happens when casting
the InlineTextBox to SVGInlineFlowBox.

The fix is for createRenderTreeForSlotAssignees() to not create a renderer
when the parent element should not have a renderer for the this element.
This is the same thing we do for createRenderer() which handles the non
HTMLSlotElement case and which is called also from createRenderTreeRecursively().

Test: fast/shadow-dom/text-slot-child-crash.svg

* style/StyleTreeResolver.cpp:
(WebCore::Style::moveToFlowThreadIfNeeded):
(WebCore::Style::TreeResolver::createRenderer): Delete the check for
shouldCreateRenderer() and handling the case when resolvedStyle is null
since these are handled by the caller createRenderTreeRecursively().

(WebCore::Style::TreeResolver::createRenderTreeForSlotAssignees):
Assert shouldCreateRenderer() is true for this element.

(WebCore::Style::TreeResolver::createRenderTreeRecursively): Don't create
the renderer if shouldCreateRenderer() returns false. Also handle the case
when resolvedStyle is null and pass the new style to createRenderer().

* style/StyleTreeResolver.h:

LayoutTests:


Ensure that adding an HTMLSlotElement with text to an SVGTextElement will
not create a renderer and we won't crash.

* fast/shadow-dom/text-slot-child-crash-expected.txt: Added.
* fast/shadow-dom/text-slot-child-crash.svg: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/style/StyleTreeResolver.cpp
trunk/Source/WebCore/style/StyleTreeResolver.h


Added Paths

trunk/LayoutTests/fast/shadow-dom/text-slot-child-crash-expected.txt
trunk/LayoutTests/fast/shadow-dom/text-slot-child-crash.svg




Diff

Modified: trunk/LayoutTests/ChangeLog (196668 => 196669)

--- trunk/LayoutTests/ChangeLog	2016-02-16 23:47:06 UTC (rev 196668)
+++ trunk/LayoutTests/ChangeLog	2016-02-16 23:59:25 UTC (rev 196669)
@@ -1,3 +1,16 @@
+2016-02-16  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+REGRESSION (r190430): WTFCrashWithSecurityImplication in:void SVGRootInlineBox::layoutCharactersInTextBoxes()
+https://bugs.webkit.org/show_bug.cgi?id=154185
+
+Reviewed by Ryosuke Niwa.
+
+Ensure that adding an HTMLSlotElement with text to an SVGTextElement will
+not create a renderer and we won't crash.
+
+* fast/shadow-dom/text-slot-child-crash-expected.txt: Added.
+* fast/shadow-dom/text-slot-child-crash.svg: Added.
+
 2016-02-16  Simon Fraser  <simon.fra...@apple.com>
 
 Add tests for iframe and overflow scrollability after navigating back


Added: trunk/LayoutTests/fast/shadow-dom/text-slot-child-crash-expected.txt (0 => 196669)

--- trunk/LayoutTests/fast/shadow-dom/text-slot-child-crash-expected.txt	(rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/text-slot-child-crash-expected.txt	2016-02-16 23:59:25 UTC (rev 196669)
@@ -0,0 +1 @@
+PASS


Added: trunk/LayoutTests/fast/shadow-dom/text-slot-child-crash.svg (0 => 196669)

--- trunk/LayoutTests/fast/shadow-dom/text-slot-child-crash.svg	(rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/text-slot-child-crash.svg	2016-02-16 23:59:25 UTC (rev 196669)
@@ -0,0 +1,13 @@
+
+
+PASS
+
+
+if (window.testRunner)
+testRunner.dumpAsText();
+var slotElement = document.createElementNS("http://www.w3.org/1999/xhtml", "slot");
+slotElement.innerHTML = "Some text";
+var parent = document.getElementById("text");
+parent.appendChild(slotElement);
+
+


Modified: trunk/Source/WebCore/ChangeLog (196668 => 196669)

--- trunk/Source/WebCore/ChangeLog	2016-02-16 23:47:06 UTC (rev 196668)
+++ trunk/Source/WebCore/ChangeLog	2016-02-16 23:59:25 UTC (rev 196669)
@@ -1,3 +1,42 @@
+2016-02-16  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+REGRESSION (r190430): WTFCrashWithSecurityImplication in:void SVGRootInlineBox::layoutCharactersInTextBoxes()
+https://bugs

[webkit-changes] [196670] trunk/Source/WebCore

[said]

Title: [196670] trunk/Source/WebCore








Revision 196670
Author s...@apple.com
Date 2016-02-16 16:00:54 -0800 (Tue, 16 Feb 2016)


Log Message
REGRESSION(r196268): WTFCrashWithSecurityImplication on SVG path animation tests
https://bugs.webkit.org/show_bug.cgi?id=154221

Reviewed by Brent Fulgham.

In r196268, a destructor was added to SVGListPropertyTearOff that notifies
its wrapper (the SVGAnimatedListPropertyTearoff) about its deletion. This
allows the wrapper to nullify any references to the wrapped content.

We needed to do the same thing for SVGPathSegListPropertyTearOff. Both
SVGPathSegListPropertyTearOff and SVGListPropertyTearOff inherit from
SVGListProperty and both hold pointers to SVGAnimatedListPropertyTearOff
which needs to be notified.

Tests: exiting svg path animation tests should not crash.

* svg/properties/SVGPathSegListPropertyTearOff.h:
(WebCore::SVGPathSegListPropertyTearOff::~SVGPathSegListPropertyTearOff):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.h




Diff

Modified: trunk/Source/WebCore/ChangeLog (196669 => 196670)

--- trunk/Source/WebCore/ChangeLog	2016-02-16 23:59:25 UTC (rev 196669)
+++ trunk/Source/WebCore/ChangeLog	2016-02-17 00:00:54 UTC (rev 196670)
@@ -1,5 +1,26 @@
 2016-02-16  Said Abou-Hallawa  <sabouhall...@apple.com>
 
+REGRESSION(r196268): WTFCrashWithSecurityImplication on SVG path animation tests
+https://bugs.webkit.org/show_bug.cgi?id=154221
+
+Reviewed by Brent Fulgham.
+
+In r196268, a destructor was added to SVGListPropertyTearOff that notifies
+its wrapper (the SVGAnimatedListPropertyTearoff) about its deletion. This
+allows the wrapper to nullify any references to the wrapped content.
+
+We needed to do the same thing for SVGPathSegListPropertyTearOff. Both
+SVGPathSegListPropertyTearOff and SVGListPropertyTearOff inherit from
+SVGListProperty and both hold pointers to SVGAnimatedListPropertyTearOff
+which needs to be notified.
+
+Tests: exiting svg path animation tests should not crash.
+
+* svg/properties/SVGPathSegListPropertyTearOff.h:
+(WebCore::SVGPathSegListPropertyTearOff::~SVGPathSegListPropertyTearOff):
+
+2016-02-16  Said Abou-Hallawa  <sabouhall...@apple.com>
+
 REGRESSION (r190430): WTFCrashWithSecurityImplication in:void SVGRootInlineBox::layoutCharactersInTextBoxes()
 https://bugs.webkit.org/show_bug.cgi?id=154185
 


Modified: trunk/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.h (196669 => 196670)

--- trunk/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.h	2016-02-16 23:59:25 UTC (rev 196669)
+++ trunk/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.h	2016-02-17 00:00:54 UTC (rev 196670)
@@ -115,6 +115,12 @@
 {
 }
 
+virtual ~SVGPathSegListPropertyTearOff()
+{
+if (m_animatedProperty)
+m_animatedProperty->propertyWillBeDeleted(*this);
+}
+
 SVGPathElement* contextElement() const;
 
 void clearContextAndRoles();






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [197967] trunk/Source/WebCore

[said]

Title: [197967] trunk/Source/WebCore








Revision 197967
Author s...@apple.com
Date 2016-03-10 16:32:51 -0800 (Thu, 10 Mar 2016)


Log Message
REGRESSION: GuardMallloc crash in SVGListPropertyTearOff::processIncomingListItemWrapper
https://bugs.webkit.org/show_bug.cgi?id=154969

Patch by Said Abou-Hallawa <sabouhall...@apple.com> on 2016-03-10
Reviewed by Darin Adler.

The life cycle of the SVGAnimatedPropertyTearOff::m_baseVal and m_animVal
was not correct. Like what was done in SVGAnimatedListPropertyTearOff,
m_baseVal and m_animVal have to be raw RefCounted pointers. When requested
through, SVGAnimatedPropertyTearOff::baseVal() and animVal() they are
encapsulated in a RefPtr to ensure they existence as long as they are
referenced. When the animated property object (which is stored in either
m_baseVal or m_animVal) is not referenced by anyone, it is going to be
deleted. In the destructor of their class, SVGAnimatedPropertyTearOff
will be notified of this deletion through propertyWillBeDeleted() to clean
its member m_baseVal or m_animVal.

* bindings/scripts/CodeGeneratorJS.pm:
(NativeToJSValue): Now all the SVG animated property return RefPtrs. In
addition to that, SVGViewSpec.transform also returns
RefPtr.

* svg/properties/SVGAnimatedListPropertyTearOff.h:
(WebCore::SVGAnimatedListPropertyTearOff::animVal):
(WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
(WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
(WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
(WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
(WebCore::SVGAnimatedListPropertyTearOff::isAnimating):
(WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
Change propertyWillBeDeleted() to be virtual and make it takes an SVGProperty*.
Rename m_animatingAnimVal to be m_animatedProperty. Add isAnimating() which
returns true if m_animatedProperty is not null. Use isAnimating() instead of
m_isAnimating because it's deleted from the base class.

* svg/properties/SVGAnimatedProperty.cpp:
(WebCore::SVGAnimatedProperty::SVGAnimatedProperty):
(WebCore::SVGAnimatedProperty::~SVGAnimatedProperty):
* svg/properties/SVGAnimatedProperty.h:
(WebCore::SVGAnimatedProperty::isAnimating):
(WebCore::SVGAnimatedProperty::propertyWillBeDeleted):
Delete m_isAnimating since its value can be deduced from the value of
m_animatedProperty in the derived class. Add propertyWillBeDeleted() and
isAnimating() as virtual functions with the default behavior.

* svg/properties/SVGAnimatedPropertyTearOff.h:
(WebCore::SVGAnimatedPropertyTearOff::baseVal):
(WebCore::SVGAnimatedPropertyTearOff::animVal):
Like SVGAnimatedListPropertyTearOff::baseVal() and animVal() create the
value if it does not exist. Keep a raw RefCounted pointer but return a
RefPtr.

(WebCore::SVGAnimatedPropertyTearOff::isAnimating):
(WebCore::SVGAnimatedPropertyTearOff::propertyWillBeDeleted):
Override virtual functions.

(WebCore::SVGAnimatedPropertyTearOff::currentAnimatedValue):
(WebCore::SVGAnimatedPropertyTearOff::animationStarted):
(WebCore::SVGAnimatedPropertyTearOff::animationEnded):
(WebCore::SVGAnimatedPropertyTearOff::animValWillChange):
(WebCore::SVGAnimatedPropertyTearOff::animValDidChange):
Replace m_isAnimating with isAnimating(). Ensure that we get a new animated
property through animVal() and store it in a RefPtr to ensure it will not
go away while animating.

* svg/properties/SVGAnimatedStaticPropertyTearOff.h:
(WebCore::SVGAnimatedStaticPropertyTearOff::isAnimating):
(WebCore::SVGAnimatedStaticPropertyTearOff::currentAnimatedValue):
(WebCore::SVGAnimatedStaticPropertyTearOff::animationStarted):
(WebCore::SVGAnimatedStaticPropertyTearOff::animationEnded):
(WebCore::SVGAnimatedStaticPropertyTearOff::animValWillChange):
(WebCore::SVGAnimatedStaticPropertyTearOff::animValDidChange):
Add isAnimating() and replace all the instances of m_isAnimating with calls
to isAnimating().

* svg/properties/SVGPropertyTearOff.h:
(WebCore::SVGPropertyTearOff::animatedProperty):
(WebCore::SVGPropertyTearOff::setAnimatedProperty):
(WebCore::SVGPropertyTearOff::contextElement):
(WebCore::SVGPropertyTearOff::SVGPropertyTearOff):
(WebCore::SVGPropertyTearOff::~SVGPropertyTearOff):
SVGPropertyTearOff is what SVGAnimatedPropertyTearOff creates for its
baseVal() and animVal() values. These values can be null anytime once
they are not referenced. The SVGAnimatedPropertyTearOff holds only raw
RefCounted pointer for them. So (1) SVGPropertyTearOff needs to hold a
RefPtr for its SVGAnimatedProperty and (2) it needs to notify its
SVGAnimatedProperty when it's deleted by calling propertyWillBeDeleted()
from the destructor. Also there is no need to get the contextElement()
and save it in class member, m_contextElement since it can be always be
retrieved from SVGAnimatedProperty::contextElement().

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
trunk/Source/WebCore/svg/prop

[webkit-changes] [199243] trunk/Source/WebCore

[said]

Title: [199243] trunk/Source/WebCore








Revision 199243
Author s...@apple.com
Date 2016-04-08 13:07:51 -0700 (Fri, 08 Apr 2016)


Log Message
Timing attack on SVG feComposite filter circumvents same-origin policy
https://bugs.webkit.org/show_bug.cgi?id=154338

Patch by Said Abou-Hallawa <sabouhallawa@apple,com> on 2016-04-08
Reviewed by Oliver Hunt.

Ensure the FEComposite arithmetic filter is clamping the resulted color
components in a constant time.

* platform/graphics/filters/FEComposite.cpp:
(WebCore::clampByte):
(WebCore::computeArithmeticPixels):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/filters/FEComposite.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (199242 => 199243)

--- trunk/Source/WebCore/ChangeLog	2016-04-08 19:59:25 UTC (rev 199242)
+++ trunk/Source/WebCore/ChangeLog	2016-04-08 20:07:51 UTC (rev 199243)
@@ -1,3 +1,17 @@
+2016-04-08  Said Abou-Hallawa  <sabouhallawa@apple,com>
+
+Timing attack on SVG feComposite filter circumvents same-origin policy
+https://bugs.webkit.org/show_bug.cgi?id=154338
+
+Reviewed by Oliver Hunt.
+
+Ensure the FEComposite arithmetic filter is clamping the resulted color
+components in a constant time.
+
+* platform/graphics/filters/FEComposite.cpp:
+(WebCore::clampByte):
+(WebCore::computeArithmeticPixels):
+
 2016-04-08  Brian Burg  <bb...@apple.com>
 
 Web Inspector: get rid of InspectorBasicValue and InspectorString subclasses


Modified: trunk/Source/WebCore/platform/graphics/filters/FEComposite.cpp (199242 => 199243)

--- trunk/Source/WebCore/platform/graphics/filters/FEComposite.cpp	2016-04-08 19:59:25 UTC (rev 199242)
+++ trunk/Source/WebCore/platform/graphics/filters/FEComposite.cpp	2016-04-08 20:07:51 UTC (rev 199243)
@@ -120,6 +120,13 @@
 
 forceValidPreMultipliedPixels();
 }
+
+static unsigned char clampByte(int c)
+{
+unsigned char buff[] = { static_cast(c), 255, 0 };
+unsigned uc = static_cast(c);
+return buff[!!(uc & ~0xff) + !!(uc & ~(~0u >> 1))];
+}
 
 template 
 static inline void computeArithmeticPixels(unsigned char* source, unsigned char* destination, int pixelArrayLength,
@@ -141,12 +148,7 @@
 if (b4)
 result += scaledK4;
 
-if (result <= 0)
-*destination = 0;
-else if (result >= 255)
-*destination = 255;
-else
-*destination = result;
+*destination = clampByte(result);
 ++source;
 ++destination;
 }






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [206635] trunk

[said]

Title: [206635] trunk








Revision 206635
Author s...@apple.com
Date 2016-09-30 09:01:36 -0700 (Fri, 30 Sep 2016)


Log Message
Change the MemoryCache and CachedResource adjustSize functions to take a long argument
https://bugs.webkit.org/show_bug.cgi?id=162708


Reviewed by Brent Fulgham.

Source/WebCore:

Because the MemoryCache stores the size of the cached memory in unsigned,
two problems my happen when reporting a change in the size of the memory:

1. Signed integer overflow -- which can happen because MemoryCache::adjustSize()
   takes a signed integer argument. If the allocated or the freed memory size is
   larger than the maximum of a signed integer, an overflow will happen.
   For the image caching code, this can be seen where the unsigned decodedSize
   is casted to an integer before passing it to ImageObserver::decodedSizeChanged().

2. Unsigned integer overflow -- which can happen if the new allocated memory
   size plus the currentSize exceeds the maximum of unsigned.
   This can be seen in MemoryCache::adjustSize() where we add delta to m_liveSize
   or m_deadSize without checking whether this addition will overflow or not. We
   do not assert for overflow although we assert for underflow.
   
The fix for these two problems can be the following:

1. Make all the adjustSize functions all the way till MemoryCache::adjustSize()
   take a signed long integer argument.
   
2. Do not create a NativeImagePtr for an ImageFrame if its frameBytes plus the
   ImageFrameCache::decodedSize() will exceed the maximum of an unsigned integer.

* loader/cache/CachedImage.cpp:
(WebCore::CachedImage::decodedSizeChanged): Change the argument to be long. No overflow will happen when casting the argument from unsigned to long.
* loader/cache/CachedImage.h:
* loader/cache/CachedResource.cpp: 
(WebCore::CachedResource::setDecodedSize): Use long integer casting when calling MemoryCache::adjustSize().
(WebCore::CachedResource::setEncodedSize): Ditto.
* loader/cache/MemoryCache.cpp:
(WebCore::MemoryCache::MemoryCache): Add as static assert to ensure sizeof(long long) can hold any unsigned or its negation.
(WebCore::MemoryCache::revalidationSucceeded): Use long integer casting when calling MemoryCache::adjustSize().
(WebCore::MemoryCache::remove): Ditto.
(WebCore::MemoryCache::adjustSize): Change the function argument to long integer. No overflow will happen when casting the argument from unsigned to long.
* loader/cache/MemoryCache.h:
* platform/graphics/ImageFrameCache.cpp:
(WebCore::ImageFrameCache::destroyIncompleteDecodedData): Call a function with its new name.
(WebCore::ImageFrameCache::decodedSizeChanged): Change the function argument to long integer. No overflow will happen when casting the argument from unsigned to long.
(WebCore::ImageFrameCache::decodedSizeIncreased): Use long integer casting when calling decodedSizeChanged().
(WebCore::ImageFrameCache::decodedSizeDecreased): Ditto.
(WebCore::ImageFrameCache::decodedSizeReset): Ditto.
(WebCore::ImageFrameCache::didDecodeProperties): Ditto.
(WebCore::ImageFrameCache::frameAtIndex): Do not create the NativeImage if adding its frameByes to the MemoryCache will cause numerical overflow.
(WebCore::ImageFrameCache::decodedSizeIncremented): Deleted. This function is renamed decodedSizeIncreased().
(WebCore::ImageFrameCache::decodedSizeDecremented): Deleted. This function is renamed decodedSizeDecreased().
* platform/graphics/ImageFrameCache.h:
* platform/graphics/ImageObserver.h:
* platform/graphics/IntSize.h:
(WebCore::IntSize::unclampedArea): Returns the area of an IntSize in size_t.
* platform/graphics/cg/PDFDocumentImage.cpp:
(WebCore::PDFDocumentImage::decodedSizeChanged): Use long integer casting when calling ImageObserver::decodedSizeChanged().

LayoutTests:

* TestExpectations: Remove failed tests.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/TestExpectations
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/loader/cache/CachedImage.cpp
trunk/Source/WebCore/loader/cache/CachedImage.h
trunk/Source/WebCore/loader/cache/CachedResource.cpp
trunk/Source/WebCore/loader/cache/MemoryCache.cpp
trunk/Source/WebCore/loader/cache/MemoryCache.h
trunk/Source/WebCore/platform/graphics/ImageFrameCache.cpp
trunk/Source/WebCore/platform/graphics/ImageFrameCache.h
trunk/Source/WebCore/platform/graphics/ImageObserver.h
trunk/Source/WebCore/platform/graphics/IntSize.h
trunk/Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp




Diff

Modified: trunk/LayoutTests/ChangeLog (206634 => 206635)

--- trunk/LayoutTests/ChangeLog	2016-09-30 14:20:25 UTC (rev 206634)
+++ trunk/LayoutTests/ChangeLog	2016-09-30 16:01:36 UTC (rev 206635)
@@ -1,3 +1,13 @@
+2016-09-30  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Change the MemoryCache and CachedResource adjustSize functions to take a long argument
+https://bugs.webkit.org/show_bug.cgi?id=162708
+
+
+Reviewed by Bren

[webkit-changes] [206637] trunk/Source/WebCore

[said]

Title: [206637] trunk/Source/WebCore








Revision 206637
Author s...@apple.com
Date 2016-09-30 09:18:25 -0700 (Fri, 30 Sep 2016)


Log Message
Unreviewed, fix 32-bit build.

* loader/cache/CachedImage.cpp:
(WebCore::CachedImage::decodedSizeChanged):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/loader/cache/CachedImage.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (206636 => 206637)

--- trunk/Source/WebCore/ChangeLog	2016-09-30 16:08:30 UTC (rev 206636)
+++ trunk/Source/WebCore/ChangeLog	2016-09-30 16:18:25 UTC (rev 206637)
@@ -1,3 +1,10 @@
+2016-09-30  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Unreviewed, fix 32-bit build.
+
+* loader/cache/CachedImage.cpp:
+(WebCore::CachedImage::decodedSizeChanged):
+
 2016-09-30  Youenn Fablet  <you...@apple.com>
 
 FetchBody should use UTF8Encoding to encode text data


Modified: trunk/Source/WebCore/loader/cache/CachedImage.cpp (206636 => 206637)

--- trunk/Source/WebCore/loader/cache/CachedImage.cpp	2016-09-30 16:08:30 UTC (rev 206636)
+++ trunk/Source/WebCore/loader/cache/CachedImage.cpp	2016-09-30 16:18:25 UTC (rev 206637)
@@ -456,7 +456,7 @@
 return;
 
 ASSERT(delta >= 0 || decodedSize() + delta >= 0);
-setDecodedSize(decodedSize() + delta);
+setDecodedSize(static_cast(decodedSize() + delta));
 }
 
 void CachedImage::didDraw(const Image* image)






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [207471] trunk

[said]

Title: [207471] trunk








Revision 207471
Author s...@apple.com
Date 2016-10-18 10:41:14 -0700 (Tue, 18 Oct 2016)


Log Message
SVGCSSParser: m_implicitShorthand value is not reset after adding the shorthand property
https://bugs.webkit.org/show_bug.cgi?id=116470

Reviewed by Simon Fraser.

Source/WebCore:

When we encounter a shorthand css property, we set m_implicitShorthand
to true to tell addProperty() later that the individual properties are
all set through a short hand one. We need to make sure that setting 
m_implicitShorthand to true will not be leaked after finishing parsing
the short hand property.

Test: fast/css/implicit-property-restore.html

* css/parser/CSSParser.cpp:
(WebCore::CSSParser::parseValue):
(WebCore::CSSParser::parseFillShorthand):
(WebCore::CSSParser::parseShorthand):
(WebCore::CSSParser::parse4Values):
(WebCore::CSSParser::parseBorderRadius):
(WTF::ImplicitScope::ImplicitScope): Deleted.
(WTF::ImplicitScope::~ImplicitScope): Deleted.
Get rid of ImplicitScope and replace its calls by TemporaryChange.

* css/parser/SVGCSSParser.cpp:
(WebCore::CSSParser::parseSVGValue):
Restore m_implicitShorthand value after setting it temporarily to true.

Source/WTF:

* wtf/TemporaryChange.h:
(WTF::TemporaryChange::TemporaryChange):
Add a new constructor to make TemporaryChange work as a restorer. The
temporary change will happen after we construct the object.

LayoutTests:

* fast/css/implicit-property-restore-expected.txt: Added.
* fast/css/implicit-property-restore.html: Added.

* fast/css/remove-shorthand-expected.txt:
Rebase-line the test expected results because of fixing the leak of
m_implicitShorthand. The bug was happening because "background: ..." property
comes immediately before the "list-style: " property.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/fast/css/remove-shorthand-expected.txt
trunk/Source/WTF/ChangeLog
trunk/Source/WTF/wtf/TemporaryChange.h
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/css/parser/CSSParser.cpp
trunk/Source/WebCore/css/parser/SVGCSSParser.cpp


Added Paths

trunk/LayoutTests/fast/css/implicit-property-restore-expected.txt
trunk/LayoutTests/fast/css/implicit-property-restore.html




Diff

Modified: trunk/LayoutTests/ChangeLog (207470 => 207471)

--- trunk/LayoutTests/ChangeLog	2016-10-18 17:39:47 UTC (rev 207470)
+++ trunk/LayoutTests/ChangeLog	2016-10-18 17:41:14 UTC (rev 207471)
@@ -1,3 +1,18 @@
+2016-10-18  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+SVGCSSParser: m_implicitShorthand value is not reset after adding the shorthand property
+https://bugs.webkit.org/show_bug.cgi?id=116470
+
+Reviewed by Simon Fraser.
+
+* fast/css/implicit-property-restore-expected.txt: Added.
+* fast/css/implicit-property-restore.html: Added.
+
+* fast/css/remove-shorthand-expected.txt:
+Rebase-line the test expected results because of fixing the leak of
+m_implicitShorthand. The bug was happening because "background: ..." property
+comes immediately before the "list-style: " property.
+
 2016-10-18  Ryan Haddad  <ryanhad...@apple.com>
 
 Marking inspector/debugger/breakpoint-action-eval.html as a flaky timeout on mac-wk2.


Added: trunk/LayoutTests/fast/css/implicit-property-restore-expected.txt (0 => 207471)

--- trunk/LayoutTests/fast/css/implicit-property-restore-expected.txt	(rev 0)
+++ trunk/LayoutTests/fast/css/implicit-property-restore-expected.txt	2016-10-18 17:41:14 UTC (rev 207471)
@@ -0,0 +1,12 @@
+This test verifies the property implicit flag is reset after adding any css property.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS element1.style.isPropertyImplicit('padding-top') is false
+PASS removedProperties.length is 1
+PASS removedProperties[0] is "list-style"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+


Added: trunk/LayoutTests/fast/css/implicit-property-restore.html (0 => 207471)

--- trunk/LayoutTests/fast/css/implicit-property-restore.html	(rev 0)
+++ trunk/LayoutTests/fast/css/implicit-property-restore.html	2016-10-18 17:41:14 UTC (rev 207471)
@@ -0,0 +1,33 @@
+
+
+
+
+<body>
+<div id="element-1" style="background:url() 100% 100% repeat-y; padding-top: 0px;"></div>
+<div id="element-2" style="background:url() 100% 100% repeat-y; list-style:square outside url();"></div>
+<script>
+description("This test verifies the property implicit flag is reset after adding any css property.");
+
+var element1 = document.getElementById("element-1");
+var element2 = document.getElementById("element-2");
+
+shouldBe("element1.style.isPropertyImplicit('padding-top')"

[webkit-changes] [208156] trunk/Tools

[said]

Title: [208156] trunk/Tools








Revision 208156
Author s...@apple.com
Date 2016-10-31 10:07:39 -0700 (Mon, 31 Oct 2016)


Log Message
Unreviewed, change my status to be a WebKit reviewer

* Scripts/webkitpy/common/config/contributors.json:

Modified Paths

trunk/Tools/ChangeLog
trunk/Tools/Scripts/webkitpy/common/config/contributors.json




Diff

Modified: trunk/Tools/ChangeLog (208155 => 208156)

--- trunk/Tools/ChangeLog	2016-10-31 16:58:47 UTC (rev 208155)
+++ trunk/Tools/ChangeLog	2016-10-31 17:07:39 UTC (rev 208156)
@@ -1,3 +1,9 @@
+2016-10-31  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Unreviewed, change my status to be a WebKit reviewer
+
+* Scripts/webkitpy/common/config/contributors.json:
+
 2016-10-31  Carlos Garcia Campos  <cgar...@igalia.com>
 
 NetworkSession: Network process crash when converting main resource to download


Modified: trunk/Tools/Scripts/webkitpy/common/config/contributors.json (208155 => 208156)

--- trunk/Tools/Scripts/webkitpy/common/config/contributors.json	2016-10-31 16:58:47 UTC (rev 208155)
+++ trunk/Tools/Scripts/webkitpy/common/config/contributors.json	2016-10-31 17:07:39 UTC (rev 208156)
@@ -4779,10 +4779,11 @@
  "sabouhall...@apple.com",
  "s...@apple.com"
   ],
+  "expertise" : "SVG/Graphics, Image Decoders",
   "nicks" : [
  "sabouhallawa"
   ],
-  "status" : "committer"
+  "status" : "reviewer"
},
"Sam Weinig" : {
   "emails" : [






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [207216] trunk/Source/WebCore

[said]

Title: [207216] trunk/Source/WebCore








Revision 207216
Author s...@apple.com
Date 2016-10-12 09:24:55 -0700 (Wed, 12 Oct 2016)


Log Message
Unreviewed, fix Windows build break after r207182.

* platform/graphics/cg/ImageDecoderCG.cpp:

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (207215 => 207216)

--- trunk/Source/WebCore/ChangeLog	2016-10-12 16:23:00 UTC (rev 207215)
+++ trunk/Source/WebCore/ChangeLog	2016-10-12 16:24:55 UTC (rev 207216)
@@ -1,3 +1,9 @@
+2016-10-12  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Unreviewed, fix Windows build break after r207182.
+
+* platform/graphics/cg/ImageDecoderCG.cpp:
+
 2016-10-12  Chris Dumez  <cdu...@apple.com>
 
 Update remaining DOM events to stop using legacy [ConstructorTemplate=Event]


Modified: trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp (207215 => 207216)

--- trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp	2016-10-12 16:23:00 UTC (rev 207215)
+++ trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp	2016-10-12 16:24:55 UTC (rev 207216)
@@ -46,6 +46,7 @@
 #import 
 #else
 const CFStringRef kCGImageSourceSubsampleFactor = CFSTR("kCGImageSourceSubsampleFactor");
+const CFStringRef kCGImageSourceShouldCacheImmediately = CFSTR("kCGImageSourceShouldCacheImmediately");
 #endif
 
 namespace WebCore {






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [214125] trunk/Source

[said]

Title: [214125] trunk/Source








Revision 214125
Author s...@apple.com
Date 2017-03-17 14:51:03 -0700 (Fri, 17 Mar 2017)


Log Message
Time channel attack on SVG Filters
https://bugs.webkit.org/show_bug.cgi?id=118689

Reviewed by Simon Fraser.

Source/WebCore:

The time channel attack can happen if the attacker applies FEColorMatrix
or FEConvolveMatrix and provides a matrix which is filled with subnormal
floating point values. Performing floating-point operations on subnormals
is very expensive unless the pixel in the source graphics is black (or
zero). By measuring the time a filter takes to be applied, the attacker
can know whether the pixel he wants to steal from  an iframe is black or
white. By repeating the same process on all the pixels in the iframe, the
attacker can reconstruct the whole page of the iframe.

To fix this issue, the values in the matrices of these filters will clamped
to FLT_MIN. We do not want to consume too much time calculating filtered
pixels because of such tiny values. The difference between applying FLT_MIN
and applying a subnormal should not be even noticeable. Normalizing the
floating-point matrices should happen only at the beginning of the filter
platformApplySoftware().

* platform/graphics/filters/FEColorMatrix.cpp:
(WebCore::FEColorMatrix::platformApplySoftware):
* platform/graphics/filters/FEConvolveMatrix.cpp:
(WebCore::FEConvolveMatrix::fastSetInteriorPixels):
(WebCore::FEConvolveMatrix::fastSetOuterPixels):
(WebCore::FEConvolveMatrix::platformApplySoftware):
* platform/graphics/filters/FEConvolveMatrix.h:
* platform/graphics/filters/FilterEffect.h:
(WebCore::FilterEffect::normalizedFloats):

Source/WTF:

Performing arithmetic operations on subnormal floating-point numbers is
very expensive. Normalizing the floating-point number to the minimum normal
value should accelerate the calculations and there won't be a noticeable
difference in the result since all the subnormal values and the minimum
normal value are all very close to zero.

* wtf/MathExtras.h:
(normalizedFloat):

Modified Paths

trunk/Source/WTF/ChangeLog
trunk/Source/WTF/wtf/MathExtras.h
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/filters/FEColorMatrix.cpp
trunk/Source/WebCore/platform/graphics/filters/FEConvolveMatrix.cpp
trunk/Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h
trunk/Source/WebCore/platform/graphics/filters/FilterEffect.h




Diff

Modified: trunk/Source/WTF/ChangeLog (214124 => 214125)

--- trunk/Source/WTF/ChangeLog	2017-03-17 21:31:49 UTC (rev 214124)
+++ trunk/Source/WTF/ChangeLog	2017-03-17 21:51:03 UTC (rev 214125)
@@ -1,3 +1,19 @@
+2017-03-17  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Time channel attack on SVG Filters
+https://bugs.webkit.org/show_bug.cgi?id=118689
+
+Reviewed by Simon Fraser.
+
+Performing arithmetic operations on subnormal floating-point numbers is
+very expensive. Normalizing the floating-point number to the minimum normal
+value should accelerate the calculations and there won't be a noticeable
+difference in the result since all the subnormal values and the minimum
+normal value are all very close to zero.
+
+* wtf/MathExtras.h:
+(normalizedFloat):
+
 2017-03-11  Filip Pizlo  <fpi...@apple.com>
 
 Air should be powerful enough to support Tmp-splitting


Modified: trunk/Source/WTF/wtf/MathExtras.h (214124 => 214125)

--- trunk/Source/WTF/wtf/MathExtras.h	2017-03-17 21:31:49 UTC (rev 214124)
+++ trunk/Source/WTF/wtf/MathExtras.h	2017-03-17 21:51:03 UTC (rev 214125)
@@ -209,6 +209,15 @@
 return x > static_cast(std::numeric_limits::min()) && x < static_cast(std::numeric_limits::max());
 }
 
+inline float normalizedFloat(float value)
+{
+if (value > 0 && value < std::numeric_limits::min())
+return std::numeric_limits::min();
+if (value < 0 && value > -std::numeric_limits::min())
+return -std::numeric_limits::min();
+return value;
+}
+
 template inline bool hasOneBitSet(T value)
 {
 return !((value - 1) & value) && value;


Modified: trunk/Source/WebCore/ChangeLog (214124 => 214125)

--- trunk/Source/WebCore/ChangeLog	2017-03-17 21:31:49 UTC (rev 214124)
+++ trunk/Source/WebCore/ChangeLog	2017-03-17 21:51:03 UTC (rev 214125)
@@ -1,3 +1,36 @@
+2017-03-17  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Time channel attack on SVG Filters
+https://bugs.webkit.org/show_bug.cgi?id=118689
+
+Reviewed by Simon Fraser.
+
+The time channel attack can happen if the attacker applies FEColorMatrix
+or FEConvolveMatrix and provides a matrix which is filled with subnormal
+floating point values. Performing floating-point operations on subnormals
+is very expensive unless the pixel in the source graphics is black (or
+zero). By measuring the time a filter takes to be

[webkit-changes] [219125] trunk/Source/WebCore

[said]

Title: [219125] trunk/Source/WebCore








Revision 219125
Author s...@apple.com
Date 2017-07-04 21:44:26 -0700 (Tue, 04 Jul 2017)


Log Message
Unreviewed, review follow-up after r218961

* platform/graphics/BitmapImage.cpp:
(WebCore::BitmapImage::updateFromSettings):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/BitmapImage.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (219124 => 219125)

--- trunk/Source/WebCore/ChangeLog	2017-07-05 00:59:11 UTC (rev 219124)
+++ trunk/Source/WebCore/ChangeLog	2017-07-05 04:44:26 UTC (rev 219125)
@@ -1,3 +1,10 @@
+2017-07-04  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Unreviewed, review follow-up after r218961
+
+* platform/graphics/BitmapImage.cpp:
+(WebCore::BitmapImage::updateFromSettings):
+
 2017-07-04  Antti Koivisto  <an...@apple.com>
 
 RenderThemeCocoa::mediaControlsFormattedStringForDuration is leaking NSDateComponentsFormatters


Modified: trunk/Source/WebCore/platform/graphics/BitmapImage.cpp (219124 => 219125)

--- trunk/Source/WebCore/platform/graphics/BitmapImage.cpp	2017-07-05 00:59:11 UTC (rev 219124)
+++ trunk/Source/WebCore/platform/graphics/BitmapImage.cpp	2017-07-05 04:44:26 UTC (rev 219125)
@@ -70,7 +70,9 @@
 {
 m_allowSubsampling = settings.imageSubsamplingEnabled();
 #if PLATFORM(IOS)
-if (!IOSApplication::isIBooks())
+if (IOSApplication::isIBooks())
+m_allowLargeImageAsyncDecoding = false;
+else
 #endif
 m_allowLargeImageAsyncDecoding = settings.largeImageAsyncDecodingEnabled();
 m_allowAnimatedImageAsyncDecoding = settings.animatedImageAsyncDecodingEnabled();






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [215804] trunk/Source/WebCore

[said]

Title: [215804] trunk/Source/WebCore








Revision 215804
Author s...@apple.com
Date 2017-04-26 09:24:34 -0700 (Wed, 26 Apr 2017)


Log Message
Attempt to fix a PLT regression.

Unreviewed.

Disable async decoding for large images till the flickering bug wk170640
is fixed.

* platform/graphics/BitmapImage.cpp:
(WebCore::BitmapImage::shouldUseAsyncDecodingForLargeImages):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/BitmapImage.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (215803 => 215804)

--- trunk/Source/WebCore/ChangeLog	2017-04-26 16:13:02 UTC (rev 215803)
+++ trunk/Source/WebCore/ChangeLog	2017-04-26 16:24:34 UTC (rev 215804)
@@ -1,3 +1,15 @@
+2017-04-26  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Attempt to fix a PLT regression.
+
+Unreviewed.
+
+Disable async decoding for large images till the flickering bug wk170640
+is fixed.
+
+* platform/graphics/BitmapImage.cpp:
+(WebCore::BitmapImage::shouldUseAsyncDecodingForLargeImages):
+
 2017-04-26  Ryan Haddad  <ryanhad...@apple.com>
 
 Unreviewed, rolling out r215767.


Modified: trunk/Source/WebCore/platform/graphics/BitmapImage.cpp (215803 => 215804)

--- trunk/Source/WebCore/platform/graphics/BitmapImage.cpp	2017-04-26 16:13:02 UTC (rev 215803)
+++ trunk/Source/WebCore/platform/graphics/BitmapImage.cpp	2017-04-26 16:24:34 UTC (rev 215804)
@@ -273,7 +273,9 @@
 
 bool BitmapImage::shouldUseAsyncDecodingForLargeImages()
 {
-return !canAnimate() && allowLargeImageAsyncDecoding() && m_source.shouldUseAsyncDecoding();
+// FIXME: enable async image decoding after the flickering bug wk170640 is fixed.
+// return !canAnimate() && allowLargeImageAsyncDecoding() && m_source.shouldUseAsyncDecoding();
+return false;
 }
 
 bool BitmapImage::shouldUseAsyncDecodingForAnimatedImages()






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [215851] trunk/Source/WebCore

[said]

Title: [215851] trunk/Source/WebCore








Revision 215851
Author s...@apple.com
Date 2017-04-26 18:26:08 -0700 (Wed, 26 Apr 2017)


Log Message
Attempt to fix a PLT regression.


Unreviewed.

Disable passing the TypeIdentifierHint to CGImageSourceCreateIncremental()
on iOS for now.

* platform/graphics/cg/ImageDecoderCG.cpp:
(WebCore::ImageDecoder::ImageDecoder):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (215850 => 215851)

--- trunk/Source/WebCore/ChangeLog	2017-04-27 01:17:01 UTC (rev 215850)
+++ trunk/Source/WebCore/ChangeLog	2017-04-27 01:26:08 UTC (rev 215851)
@@ -1,3 +1,16 @@
+2017-04-26  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Attempt to fix a PLT regression.
+
+
+Unreviewed.
+
+Disable passing the TypeIdentifierHint to CGImageSourceCreateIncremental()
+on iOS for now.
+
+* platform/graphics/cg/ImageDecoderCG.cpp:
+(WebCore::ImageDecoder::ImageDecoder):
+
 2017-04-26  Joanmarie Diggs  <jdi...@igalia.com>
 
 [ATK] ARIA buttons which have a popup should be ATK_ROLE_PUSH_BUTTON; not ATK_ROLE_COMBO_BOX
@@ -492,7 +505,8 @@
 
 2017-04-26  Said Abou-Hallawa  <sabouhall...@apple.com>
 
-Attempt to fix a PLT regression.
+Attempt to fix a JetStream regression.
+
 
 Unreviewed.
 


Modified: trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp (215850 => 215851)

--- trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp	2017-04-27 01:17:01 UTC (rev 215850)
+++ trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp	2017-04-27 01:26:08 UTC (rev 215851)
@@ -154,7 +154,7 @@
 
 ImageDecoder::ImageDecoder(const URL& sourceURL, AlphaOption, GammaAndColorProfileOption)
 {
-#if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300) || (PLATFORM(IOS) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 11)
+#if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300)
 RetainPtr url = ""
 RetainPtr utiHint = adoptCF(CGImageSourceGetTypeWithURL(url.get(), nullptr));
 






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [215905] trunk/Source/WebCore

[said]

Title: [215905] trunk/Source/WebCore








Revision 215905
Author s...@apple.com
Date 2017-04-27 16:36:45 -0700 (Thu, 27 Apr 2017)


Log Message
Attempt to fix a PLT regression on Mac


Unreviewed.

Disable passing the TypeIdentifierHint to CGImageSourceCreateIncremental()
on Mac for now.

* platform/graphics/cg/ImageDecoderCG.cpp:
(WebCore::ImageDecoder::ImageDecoder):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (215904 => 215905)

--- trunk/Source/WebCore/ChangeLog	2017-04-27 23:24:58 UTC (rev 215904)
+++ trunk/Source/WebCore/ChangeLog	2017-04-27 23:36:45 UTC (rev 215905)
@@ -1,3 +1,16 @@
+2017-04-27  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Attempt to fix a PLT regression on Mac
+
+
+Unreviewed.
+
+Disable passing the TypeIdentifierHint to CGImageSourceCreateIncremental()
+on Mac for now.
+
+* platform/graphics/cg/ImageDecoderCG.cpp:
+(WebCore::ImageDecoder::ImageDecoder):
+
 2017-04-27  Daniel Bates  <daba...@apple.com>
 
 Rename callerDOMWindow()/CallerDocument to incumbentDOMWindow()/IncumbentDocument


Modified: trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp (215904 => 215905)

--- trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp	2017-04-27 23:24:58 UTC (rev 215904)
+++ trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp	2017-04-27 23:36:45 UTC (rev 215905)
@@ -154,7 +154,7 @@
 
 ImageDecoder::ImageDecoder(const URL& sourceURL, AlphaOption, GammaAndColorProfileOption)
 {
-#if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300)
+#if 0
 RetainPtr url = ""
 RetainPtr utiHint = adoptCF(CGImageSourceGetTypeWithURL(url.get(), nullptr));
 






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [217316] trunk/Source/WebCore

[said]

Title: [217316] trunk/Source/WebCore








Revision 217316
Author s...@apple.com
Date 2017-05-23 18:06:25 -0700 (Tue, 23 May 2017)


Log Message
[iOS] Speculative fix for a PLT regression


Unreviewed.

Make sure CGImageSourceGetTypeWithData() is called with a buffer which is
32 bytes or more.

* platform/graphics/cg/ImageDecoderCG.cpp:
(WebCore::ImageDecoder::ImageDecoder):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (217315 => 217316)

--- trunk/Source/WebCore/ChangeLog	2017-05-24 00:33:23 UTC (rev 217315)
+++ trunk/Source/WebCore/ChangeLog	2017-05-24 01:06:25 UTC (rev 217316)
@@ -1,3 +1,16 @@
+2017-05-23  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+[iOS] Speculative fix for a PLT regression
+
+
+Unreviewed.
+
+Make sure CGImageSourceGetTypeWithData() is called with a buffer which is
+32 bytes or more.
+
+* platform/graphics/cg/ImageDecoderCG.cpp:
+(WebCore::ImageDecoder::ImageDecoder):
+
 2017-05-22  Jiewen Tan  <jiewen_...@apple.com>
 
 [WebCrypto] Support RSA-PSS


Modified: trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp (217315 => 217316)

--- trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp	2017-05-24 00:33:23 UTC (rev 217315)
+++ trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp	2017-05-24 01:06:25 UTC (rev 217316)
@@ -150,7 +150,9 @@
 
 ImageDecoder::ImageDecoder(SharedBuffer& data, AlphaOption, GammaAndColorProfileOption)
 {
-RetainPtr utiHint = adoptCF(CGImageSourceGetTypeWithData(data.createCFData().get(), nullptr, nullptr));
+RetainPtr utiHint;
+if (data.size() >= 32)
+utiHint = adoptCF(CGImageSourceGetTypeWithData(data.createCFData().get(), nullptr, nullptr));
 
 if (utiHint) {
 const void* key = kCGImageSourceTypeIdentifierHint;






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [216273] trunk/Source/WebCore

[said]

Title: [216273] trunk/Source/WebCore








Revision 216273
Author s...@apple.com
Date 2017-05-05 14:35:54 -0700 (Fri, 05 May 2017)


Log Message
Crash in ImageFrameCache::decodedSizeChanged() after image load cancellation
https://bugs.webkit.org/show_bug.cgi?id=171736

Reviewed by Tim Horton.

Tests: Covered by run-webkit-tests fast/images/image-formats-support.html
--guard-malloc.

Because an image format is not supported, the ImageObserver of the Image
is deleted then the Image itself is deleted. In BitmapImage destructor,
we make a call which ends up accessing the deleted ImageObserver.

To fix this, we need to setImageObsever of the Image to-be-deleted to 
nullptr. So the Image can avoid accessing its ImageObserver, while it is
being deleted. Also we can change the BitImage destructor to avoid calling 
ImageFrameCache::decodedSizeChanged() since it is not really needed.

* loader/cache/CachedImage.cpp:
(WebCore::CachedImage::clearImage):
* platform/graphics/BitmapImage.cpp:
(WebCore::BitmapImage::~BitmapImage):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/loader/cache/CachedImage.cpp
trunk/Source/WebCore/platform/graphics/BitmapImage.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (216272 => 216273)

--- trunk/Source/WebCore/ChangeLog	2017-05-05 21:15:51 UTC (rev 216272)
+++ trunk/Source/WebCore/ChangeLog	2017-05-05 21:35:54 UTC (rev 216273)
@@ -1,3 +1,27 @@
+2017-05-05  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Crash in ImageFrameCache::decodedSizeChanged() after image load cancellation
+https://bugs.webkit.org/show_bug.cgi?id=171736
+
+Reviewed by Tim Horton.
+
+Tests: Covered by run-webkit-tests fast/images/image-formats-support.html
+--guard-malloc.
+
+Because an image format is not supported, the ImageObserver of the Image
+is deleted then the Image itself is deleted. In BitmapImage destructor,
+we make a call which ends up accessing the deleted ImageObserver.
+
+To fix this, we need to setImageObsever of the Image to-be-deleted to 
+nullptr. So the Image can avoid accessing its ImageObserver, while it is
+being deleted. Also we can change the BitImage destructor to avoid calling 
+ImageFrameCache::decodedSizeChanged() since it is not really needed.
+
+* loader/cache/CachedImage.cpp:
+(WebCore::CachedImage::clearImage):
+* platform/graphics/BitmapImage.cpp:
+(WebCore::BitmapImage::~BitmapImage):
+
 2017-05-05  Brian Burg  <bb...@apple.com>
 
 CrashTracer: [USER] com.apple.WebKit.WebContent.Development at com.apple.WebCore: WebCore::commonVMSlow + 57


Modified: trunk/Source/WebCore/loader/cache/CachedImage.cpp (216272 => 216273)

--- trunk/Source/WebCore/loader/cache/CachedImage.cpp	2017-05-05 21:15:51 UTC (rev 216272)
+++ trunk/Source/WebCore/loader/cache/CachedImage.cpp	2017-05-05 21:35:54 UTC (rev 216273)
@@ -360,7 +360,10 @@
 m_imageObserver->remove(*this);
 m_imageObserver = nullptr;
 }
-m_image = nullptr;
+if (m_image) {
+m_image->setImageObserver(nullptr);
+m_image = nullptr;
+}
 }
 
 void CachedImage::addIncrementalDataBuffer(SharedBuffer& data)


Modified: trunk/Source/WebCore/platform/graphics/BitmapImage.cpp (216272 => 216273)

--- trunk/Source/WebCore/platform/graphics/BitmapImage.cpp	2017-05-05 21:15:51 UTC (rev 216272)
+++ trunk/Source/WebCore/platform/graphics/BitmapImage.cpp	2017-05-05 21:35:54 UTC (rev 216273)
@@ -61,7 +61,8 @@
 BitmapImage::~BitmapImage()
 {
 invalidatePlatformData();
-stopAnimation();
+clearTimer();
+m_source.stopAsyncDecodingQueue();
 }
 
 void BitmapImage::updateFromSettings(const Settings& settings)






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [216305] trunk/Source/WebCore

[said]

Title: [216305] trunk/Source/WebCore








Revision 216305
Author s...@apple.com
Date 2017-05-05 20:27:16 -0700 (Fri, 05 May 2017)


Log Message
Crash in ImageFrameCache::decodedSizeChanged() after image load cancellation
https://bugs.webkit.org/show_bug.cgi?id=171736

Reviewed by Tim Horton.

Tests: Covered by run-webkit-tests fast/images/image-formats-support.html
--guard-malloc.

Because an image format is not supported, the ImageObserver of the Image
is deleted then the Image itself is deleted. In BitmapImage destructor,
we make a call which ends up accessing the deleted ImageObserver.

To fix this, we need to change the BitImage destructor to avoid calling 
ImageFrameCache::decodedSizeChanged() since it is not really needed.

* platform/graphics/BitmapImage.cpp:
(WebCore::BitmapImage::~BitmapImage):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/BitmapImage.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (216304 => 216305)

--- trunk/Source/WebCore/ChangeLog	2017-05-06 01:59:14 UTC (rev 216304)
+++ trunk/Source/WebCore/ChangeLog	2017-05-06 03:27:16 UTC (rev 216305)
@@ -1,3 +1,23 @@
+2017-05-05  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Crash in ImageFrameCache::decodedSizeChanged() after image load cancellation
+https://bugs.webkit.org/show_bug.cgi?id=171736
+
+Reviewed by Tim Horton.
+
+Tests: Covered by run-webkit-tests fast/images/image-formats-support.html
+--guard-malloc.
+
+Because an image format is not supported, the ImageObserver of the Image
+is deleted then the Image itself is deleted. In BitmapImage destructor,
+we make a call which ends up accessing the deleted ImageObserver.
+
+To fix this, we need to change the BitImage destructor to avoid calling 
+ImageFrameCache::decodedSizeChanged() since it is not really needed.
+
+* platform/graphics/BitmapImage.cpp:
+(WebCore::BitmapImage::~BitmapImage):
+
 2017-05-05  Timothy Horton  <timothy_hor...@apple.com>
 
 [Mac] Adjust cursor position for dragged link (and stop it from moving based on how fast you are dragging)


Modified: trunk/Source/WebCore/platform/graphics/BitmapImage.cpp (216304 => 216305)

--- trunk/Source/WebCore/platform/graphics/BitmapImage.cpp	2017-05-06 01:59:14 UTC (rev 216304)
+++ trunk/Source/WebCore/platform/graphics/BitmapImage.cpp	2017-05-06 03:27:16 UTC (rev 216305)
@@ -61,7 +61,8 @@
 BitmapImage::~BitmapImage()
 {
 invalidatePlatformData();
-stopAnimation();
+clearTimer();
+m_source.stopAsyncDecodingQueue();
 }
 
 void BitmapImage::updateFromSettings(const Settings& settings)






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [216192] trunk/LayoutTests

[said]

Title: [216192] trunk/LayoutTests








Revision 216192
Author s...@apple.com
Date 2017-05-04 10:44:44 -0700 (Thu, 04 May 2017)


Log Message
Unreviewed: Replace Windows line ending (CRLF) by Unix line ending (CR).

* compositing/video/video-with-invalid-source.html:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/compositing/video/video-with-invalid-source.html




Diff

Modified: trunk/LayoutTests/ChangeLog (216191 => 216192)

--- trunk/LayoutTests/ChangeLog	2017-05-04 17:19:24 UTC (rev 216191)
+++ trunk/LayoutTests/ChangeLog	2017-05-04 17:44:44 UTC (rev 216192)
@@ -1,3 +1,9 @@
+2017-05-04  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Unreviewed: Replace Windows line ending (CRLF) by Unix line ending (CR).
+
+* compositing/video/video-with-invalid-source.html:
+
 2017-05-04  Ryan Haddad  <ryanhad...@apple.com>
 
 Skip media/modern-media-controls/pip-support/pip-support-click.html on mac-wk1.


Modified: trunk/LayoutTests/compositing/video/video-with-invalid-source.html (216191 => 216192)

--- trunk/LayoutTests/compositing/video/video-with-invalid-source.html	2017-05-04 17:19:24 UTC (rev 216191)
+++ trunk/LayoutTests/compositing/video/video-with-invalid-source.html	2017-05-04 17:44:44 UTC (rev 216192)
@@ -1,25 +1,25 @@
-
-
-if (window.testRunner) {
-testRunner.waitUntilDone();
-testRunner.dumpAsText();
-}
-
-function test() {
-var v = document.createElement("video");
-document.body.appendChild(v);
-var src = ""
-src.src = ""
-v.appendChild(src);
-src.addEventListener("error", function() {
-   if (window.testRunner) {
-testRunner.display();
-// If we didn't crash here, yay!  Test is a success
-document.body.appendChild(document.createTextNode("PASS"));
-testRunner.notifyDone();
-}
-}, false);
-}
-
-
-
+
+
+if (window.testRunner) {
+testRunner.waitUntilDone();
+testRunner.dumpAsText();
+}
+
+function test() {
+var v = document.createElement("video");
+document.body.appendChild(v);
+var src = ""
+src.src = ""
+v.appendChild(src);
+src.addEventListener("error", function() {
+if (window.testRunner) {
+testRunner.display();
+// If we didn't crash here, yay!  Test is a success
+document.body.appendChild(document.createTextNode("PASS"));
+testRunner.notifyDone();
+}
+}, false);
+}
+
+
+






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [216194] trunk/LayoutTests

[said]

Title: [216194] trunk/LayoutTests








Revision 216194
Author s...@apple.com
Date 2017-05-04 11:02:46 -0700 (Thu, 04 May 2017)


Log Message
Unreviewed: Replace Windows line ending (CRLF) by Unix line ending (CR).

* plugins/windowless_plugin_paint_test.html:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/plugins/windowless_plugin_paint_test.html




Diff

Modified: trunk/LayoutTests/ChangeLog (216193 => 216194)

--- trunk/LayoutTests/ChangeLog	2017-05-04 17:46:59 UTC (rev 216193)
+++ trunk/LayoutTests/ChangeLog	2017-05-04 18:02:46 UTC (rev 216194)
@@ -2,6 +2,12 @@
 
 Unreviewed: Replace Windows line ending (CRLF) by Unix line ending (CR).
 
+* plugins/windowless_plugin_paint_test.html:
+
+2017-05-04  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Unreviewed: Replace Windows line ending (CRLF) by Unix line ending (CR).
+
 * compositing/video/video-with-invalid-source.html:
 
 2017-05-04  Ryan Haddad  <ryanhad...@apple.com>


Modified: trunk/LayoutTests/plugins/windowless_plugin_paint_test.html (216193 => 216194)

--- trunk/LayoutTests/plugins/windowless_plugin_paint_test.html	2017-05-04 17:46:59 UTC (rev 216193)
+++ trunk/LayoutTests/plugins/windowless_plugin_paint_test.html	2017-05-04 18:02:46 UTC (rev 216194)
@@ -1,41 +1,40 @@
 
-
 
-
-  
-if (window.testRunner) {
-testRunner.dumpAsText();
-testRunner.waitUntilDone();
-}
</del><ins>+<head>
+<script>
+if (window.testRunner) {
+testRunner.dumpAsText();
+testRunner.waitUntilDone();
+}
</ins><span class="cx"> 
</span><del>-var paintCount = 0;
-
-function onLoad() {
-var pluginDiv = document.getElementById("pluginDiv");
-// Create the plugin in the middle of the page.
-pluginDiv.innerHTML = "<embed id=\"testPlugin\" type=\"application/x-webkit-test-netscape\" width=\"200\" height=\"200\" _onpaintevent_=\"didPaint()\" windowedPlugin=\"false\"></embed>";
-if (window.internals)
-internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks();
-testRunner.displayInvalidatedRegion();
-  }
-
-function notifyDone() {
-document.getElementById('result').innerHTML = "SUCCESS";
-testRunner.notifyDone();
-}
-  
-function didPaint() {
-paintCount++;
-setTimeout("notifyDone();", 50);
-}
-  
-
-
-  This tests that dynamically added windowless plugins receive paint events on creation.
+var paintCount = 0;
 
-  FAILURE
+function onLoad() {
+var pluginDiv = document.getElementById("pluginDiv");
+// Create the plugin in the middle of the page.
+pluginDiv.innerHTML = "";
+if (window.internals)
+internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks();
+testRunner.displayInvalidatedRegion();
+}
 
-  
-  
-
+function notifyDone() {
+document.getElementById('result').innerHTML = "SUCCESS";
+testRunner.notifyDone();
+}
+
+function didPaint() {
+paintCount++;
+setTimeout("notifyDone();", 50);
+}
+
+
+
+This tests that dynamically added windowless plugins receive paint events on creation.
+
+FAILURE
+
+
+
+
 






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [216471] trunk/Source/WebCore

[said]

Title: [216471] trunk/Source/WebCore








Revision 216471
Author s...@apple.com
Date 2017-05-08 18:53:54 -0700 (Mon, 08 May 2017)


Log Message
The Incomplete asynchronously decoded image frame should be decoded every time it's drawn
https://bugs.webkit.org/show_bug.cgi?id=170836

Reviewed by Tim Horton.

The asynchronously decoded image frames has to be cached to prevent flickering,
but we have to keep requesting new decoding for the incomplete frame every time
it's drawn. This is to avoid drawing an incomplete image frame even after all
its encoded data is received.

* platform/graphics/BitmapImage.cpp:
(WebCore::BitmapImage::draw):
* platform/graphics/ImageFrameCache.cpp:
(WebCore::ImageFrameCache::cacheAsyncFrameNativeImageAtIndex):
(WebCore::ImageFrameCache::requestFrameAsyncDecodingAtIndex):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/BitmapImage.cpp
trunk/Source/WebCore/platform/graphics/ImageFrameCache.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (216470 => 216471)

--- trunk/Source/WebCore/ChangeLog	2017-05-09 01:45:20 UTC (rev 216470)
+++ trunk/Source/WebCore/ChangeLog	2017-05-09 01:53:54 UTC (rev 216471)
@@ -1,3 +1,21 @@
+2017-05-08  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+The Incomplete asynchronously decoded image frame should be decoded every time it's drawn
+https://bugs.webkit.org/show_bug.cgi?id=170836
+
+Reviewed by Tim Horton.
+
+The asynchronously decoded image frames has to be cached to prevent flickering,
+but we have to keep requesting new decoding for the incomplete frame every time
+it's drawn. This is to avoid drawing an incomplete image frame even after all
+its encoded data is received.
+
+* platform/graphics/BitmapImage.cpp:
+(WebCore::BitmapImage::draw):
+* platform/graphics/ImageFrameCache.cpp:
+(WebCore::ImageFrameCache::cacheAsyncFrameNativeImageAtIndex):
+(WebCore::ImageFrameCache::requestFrameAsyncDecodingAtIndex):
+
 2017-05-08  Wenson Hsieh  <wenson_hs...@apple.com>
 
 Guard DragController::cleanupAfterSystemDrag to only clear drag state on Mac


Modified: trunk/Source/WebCore/platform/graphics/BitmapImage.cpp (216470 => 216471)

--- trunk/Source/WebCore/platform/graphics/BitmapImage.cpp	2017-05-09 01:45:20 UTC (rev 216470)
+++ trunk/Source/WebCore/platform/graphics/BitmapImage.cpp	2017-05-09 01:53:54 UTC (rev 216471)
@@ -183,10 +183,15 @@
 if (decodingMode == DecodingMode::Asynchronous && shouldUseAsyncDecodingForLargeImages()) {
 ASSERT(!canAnimate() && !m_currentFrame);
 
-if (!frameHasDecodedNativeImageCompatibleWithOptionsAtIndex(m_currentFrame, m_currentSubsamplingLevel, DecodingOptions(sizeForDrawing))
-&& !frameIsBeingDecodedAndIsCompatibleWithOptionsAtIndex(m_currentFrame, DecodingOptions(sizeForDrawing))) {
+bool frameIsCompatible = frameHasDecodedNativeImageCompatibleWithOptionsAtIndex(m_currentFrame, m_currentSubsamplingLevel, DecodingOptions(sizeForDrawing));
+bool frameIsBeingDecoded = frameIsBeingDecodedAndIsCompatibleWithOptionsAtIndex(m_currentFrame, DecodingOptions(sizeForDrawing));
+bool frameIsComplete = frameIsCompleteAtIndex(m_currentFrame);
+
+// If the current frame is incomplete, a new request for decoding this frame has to be made even if
+// it is currently being decoded. New data may have been received since the previous request was made.
+if ((!frameIsCompatible && !frameIsBeingDecoded) || !frameIsComplete) {
 LOG(Images, "BitmapImage::%s - %p - url: %s [requesting large async decoding]", __FUNCTION__, this, sourceURL().string().utf8().data());
-m_source.requestFrameAsyncDecodingAtIndex(0, m_currentSubsamplingLevel, sizeForDrawing);
+frameIsBeingDecoded = m_source.requestFrameAsyncDecodingAtIndex(0, m_currentSubsamplingLevel, sizeForDrawing);
 }
 
 if (!frameHasDecodedNativeImageCompatibleWithOptionsAtIndex(m_currentFrame, m_currentSubsamplingLevel, DecodingMode::Asynchronous)) {
@@ -196,6 +201,7 @@
 }
 
 image = frameImageAtIndex(m_currentFrame);
+ASSERT_IMPLIES(encodedDataStatus() == EncodedDataStatus::Complete, frameIsBeingDecoded || frameIsComplete);
 LOG(Images, "BitmapImage::%s - %p - url: %s [a decoded image frame is available for drawing]", __FUNCTION__, this, sourceURL().string().utf8().data());
 } else {
 StartAnimationStatus status = internalStartAnimation();


Modified: trunk/Source/WebCore/platform/graphics/ImageFrameCache.cpp (216470 => 216471)

--- trunk/Source/WebCore/platform/graphics/ImageFrameCache.cpp	2017-05-09 01:45:20 UTC (rev 216470)
+++ trunk/Source/WebCore/platform/graphics/ImageFrameCache.cpp	2017-05-09 01:53:54 UTC (rev 216471)
@@ -247,7 +247,7 @@
 return;
 
 ASSERT(index < m_frames.size()

[webkit-changes] [222304] trunk

[said]

Title: [222304] trunk








Revision 222304
Author s...@apple.com
Date 2017-09-20 17:35:41 -0700 (Wed, 20 Sep 2017)


Log Message
REGRESSION(r191731): SVGPatternElement can only reference another SVGPatternElement in the same SVG document
https://bugs.webkit.org/show_bug.cgi?id=176221

Reviewed by Tim Horton.

Source/WebCore:

According to the specs:

https://www.w3.org/TR/SVG11/filters.html#FilterElementHrefAttribute
https://www.w3.org/TR/SVG11/pservers.html#LinearGradientElementHrefAttribute
https://www.w3.org/TR/SVG11/pservers.html#RadialGradientElementHrefAttribute
https://www.w3.org/TR/SVG11/pservers.html#PatternElementHrefAttribute

The xlink:href attribute of the SVG filter, gradient and pattern elements
must reference another element within the current SVG of the same type.

In r191731, the code of SVGPatternElement::collectPatternAttributes() was
removed and replaced by RenderSVGResourcePattern::collectPatternAttributes()
to avoid cyclic reference in the pattern element. The problem is the old
code used to check whether the referenced element is
before casting it. This code was not copied to the new function. So we
now allow the SVGPatternElement to reference any SVG resource element.

To fix this issue, we need to prevent SVGResources from chaining an incorrect
type of element to the SVG filter, gradient and pattern elements.

We also need to use the SVGResources for getting the referenced element
when collecting the attributes for the gradient elements. SVGResources solves
the cyclic referencing issue so there is no need to repeat the same code
in many places. Also, from now on the SVGResources will have valid linked
resource only. So casting the referenced element should always be valid.

Tests: svg/custom/pattern-invalid-content-inheritance.svg

* rendering/svg/RenderSVGResourcePattern.cpp:
(WebCore::RenderSVGResourcePattern::collectPatternAttributes const): Asserts
the linkedResource is of type RenderSVGResourcePattern.
* rendering/svg/SVGResources.cpp:
(WebCore::SVGResources::SVGResources):
(WebCore::isChainableResource): Ensure that an SVG resource can reference
only an SVG resource with the valid type.
(WebCore::SVGResources::buildCachedResources):
* rendering/svg/SVGResources.h:

LayoutTests:

* svg/custom/pattern-invalid-content-inheritance-expected.svg: Added.
* svg/custom/pattern-invalid-content-inheritance.svg: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/rendering/svg/RenderSVGResourcePattern.cpp
trunk/Source/WebCore/rendering/svg/SVGResources.cpp
trunk/Source/WebCore/rendering/svg/SVGResources.h


Added Paths

trunk/LayoutTests/svg/custom/pattern-invalid-content-inheritance-expected.svg
trunk/LayoutTests/svg/custom/pattern-invalid-content-inheritance.svg




Diff

Modified: trunk/LayoutTests/ChangeLog (222303 => 222304)

--- trunk/LayoutTests/ChangeLog	2017-09-21 00:30:17 UTC (rev 222303)
+++ trunk/LayoutTests/ChangeLog	2017-09-21 00:35:41 UTC (rev 222304)
@@ -1,3 +1,13 @@
+2017-09-20  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+REGRESSION(r191731): SVGPatternElement can only reference another SVGPatternElement in the same SVG document
+https://bugs.webkit.org/show_bug.cgi?id=176221
+
+Reviewed by Tim Horton.
+
+* svg/custom/pattern-invalid-content-inheritance-expected.svg: Added.
+* svg/custom/pattern-invalid-content-inheritance.svg: Added.
+
 2017-09-20  Per Arne Vollan  <pvol...@apple.com>
 
 Mark transitions/transition-display-property.html as flaky on Windows.


Added: trunk/LayoutTests/svg/custom/pattern-invalid-content-inheritance-expected.svg (0 => 222304)

--- trunk/LayoutTests/svg/custom/pattern-invalid-content-inheritance-expected.svg	(rev 0)
+++ trunk/LayoutTests/svg/custom/pattern-invalid-content-inheritance-expected.svg	2017-09-21 00:35:41 UTC (rev 222304)
@@ -0,0 +1,3 @@
+
+
+


Added: trunk/LayoutTests/svg/custom/pattern-invalid-content-inheritance.svg (0 => 222304)

--- trunk/LayoutTests/svg/custom/pattern-invalid-content-inheritance.svg	(rev 0)
+++ trunk/LayoutTests/svg/custom/pattern-invalid-content-inheritance.svg	2017-09-21 00:35:41 UTC (rev 222304)
@@ -0,0 +1,9 @@
+
+
+
+
+
+
+


Modified: trunk/Source/WebCore/ChangeLog (222303 => 222304)

--- trunk/Source/WebCore/ChangeLog	2017-09-21 00:30:17 UTC (rev 222303)
+++ trunk/Source/WebCore/ChangeLog	2017-09-21 00:35:41 UTC (rev 222304)
@@ -1,3 +1,48 @@
+2017-09-20  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+REGRESSION(r191731): SVGPatternElement can only reference another SVGPatternElement in the same SVG document
+https://bugs.webkit.org/show_bug.cgi?id=176221
+
+Reviewed by Tim Horton.
+
+According to the specs:
+
+https://www.w3.org/TR/SVG11/filters.html#FilterElementHrefAttribute
+https://www.w3.org/TR/SVG11/pservers.html#LinearGradientElementHrefAtt

[webkit-changes] [225586] trunk/Source/WebCore/ChangeLog

[said]

Title: [225586] trunk/Source/WebCore/ChangeLog








Revision 225586
Author s...@apple.com
Date 2017-12-06 11:56:13 -0800 (Wed, 06 Dec 2017)


Log Message
Storage Access API: Make document.hasStorageAccess a function and always allow access for same-origin iframes
https://bugs.webkit.org/show_bug.cgi?id=176944


Patch by John Wilander  on 2017-12-06
Reviewed by Brent Fulgham.

Test: http/tests/storageAccess/request-storage-access-cross-origin-sandboxed-iframe-without-user-gesture.html

This change introduces document.hasStorageAccess() as a function which
returns a promise instead of being a property. Since cookie access can
be due to both a granted request and recent user interaction as first
party, the WebKit::WebResourceLoadStatisticsStore needs to be consulted.

* dom/Document.cpp:
(WebCore::Document::hasStorageAccess):
(WebCore::Document::requestStorageAccess):
Removed check of the previous m_hasStorageAccess member.
Same-origin check done earlier. This was a request/suggestion
from Mozilla.
* dom/Document.h:
(WebCore::Document::hasStorageAccess const): Deleted.
Now uses a promise.
* dom/Document.idl:
* page/ChromeClient.h:

Modified Paths

trunk/Source/WebCore/ChangeLog




Diff

Modified: trunk/Source/WebCore/ChangeLog (225585 => 225586)

--- trunk/Source/WebCore/ChangeLog	2017-12-06 19:45:55 UTC (rev 225585)
+++ trunk/Source/WebCore/ChangeLog	2017-12-06 19:56:13 UTC (rev 225586)
@@ -86,7 +86,9 @@
 
 Disable using CGContextDrawPathDirect() for macOS High Sierra or earlier.
 This API has a bug when drawing a path with a shadow on Retina display.
+This bug is tracked internally by .
 
+
 * platform/graphics/cg/GraphicsContextCG.cpp:
 
 2017-12-06  Youenn Fablet  






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [232941] trunk

[said]

Title: [232941] trunk








Revision 232941
Author s...@apple.com
Date 2018-06-18 12:28:33 -0700 (Mon, 18 Jun 2018)


Log Message
Document should not be mutated under SMILTimeContainer::updateAnimations()
https://bugs.webkit.org/show_bug.cgi?id=186658

Reviewed by Simon Fraser.

Source/WebCore:

To update the animation of an SVG  element, we call
SVGAnimateElementBase::resetAnimatedType(). It ensures the pointer m_animator
is valid. If it animates a css property, it calls computeCSSPropertyValue()
which calls resolveStyle() via other calls. resolveStyle() may call delayed
callbacks through the destructor of PostResolutionCallbackDisabler. These
callbacks may fire events. These events may execute JS event handlers.
If one of these event handlers deletes the same SVG  we animate,
we will end up calling SVGAnimateElementBase::resetAnimatedPropertyType()
of the same  element. This function  will delete the same m_animator
which resetAnimatedType() still holds and will use later. This code
re-entrance is unexpected and unwanted.

The fix is to disable mutating the DOM while updating the SVG animations.

Test: svg/dom/css-animate-input-foucs-crash.html

* svg/animation/SMILTimeContainer.cpp:
(WebCore::SMILTimeContainer::updateAnimations):

LayoutTests:

* svg/dom/css-animate-input-foucs-crash-expected.txt: Added.
* svg/dom/css-animate-input-foucs-crash.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/animation/SMILTimeContainer.cpp


Added Paths

trunk/LayoutTests/svg/dom/css-animate-input-foucs-crash-expected.txt
trunk/LayoutTests/svg/dom/css-animate-input-foucs-crash.html




Diff

Modified: trunk/LayoutTests/ChangeLog (232940 => 232941)

--- trunk/LayoutTests/ChangeLog	2018-06-18 19:13:19 UTC (rev 232940)
+++ trunk/LayoutTests/ChangeLog	2018-06-18 19:28:33 UTC (rev 232941)
@@ -1,3 +1,13 @@
+2018-06-18  Said Abou-Hallawa  
+
+Document should not be mutated under SMILTimeContainer::updateAnimations()
+https://bugs.webkit.org/show_bug.cgi?id=186658
+
+Reviewed by Simon Fraser.
+
+* svg/dom/css-animate-input-foucs-crash-expected.txt: Added.
+* svg/dom/css-animate-input-foucs-crash.html: Added.
+
 2018-06-18  Wenson Hsieh  
 
 fast/forms/button-set-display-flex-justifyContent-center.html is failing on macOS Mojave


Added: trunk/LayoutTests/svg/dom/css-animate-input-foucs-crash-expected.txt (0 => 232941)

--- trunk/LayoutTests/svg/dom/css-animate-input-foucs-crash-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/dom/css-animate-input-foucs-crash-expected.txt	2018-06-18 19:28:33 UTC (rev 232941)
@@ -0,0 +1,4 @@
+This test passes if it doesn't crash.
+
+ 
+


Added: trunk/LayoutTests/svg/dom/css-animate-input-foucs-crash.html (0 => 232941)

--- trunk/LayoutTests/svg/dom/css-animate-input-foucs-crash.html	(rev 0)
+++ trunk/LayoutTests/svg/dom/css-animate-input-foucs-crash.html	2018-06-18 19:28:33 UTC (rev 232941)
@@ -0,0 +1,23 @@
+
+This test passes if it doesn't crash.
+
+
+
+
+
+
+
+
+if (window.testRunner)
+testRunner.dumpAsText();
+
+function onFoucsIn() {
+svgRoot.remove();
+}
+
+function onToggle() {
+input.autofocus = true;
+inputParent.after(inputParent);
+}
+
+


Modified: trunk/Source/WebCore/ChangeLog (232940 => 232941)

--- trunk/Source/WebCore/ChangeLog	2018-06-18 19:13:19 UTC (rev 232940)
+++ trunk/Source/WebCore/ChangeLog	2018-06-18 19:28:33 UTC (rev 232941)
@@ -1,3 +1,29 @@
+2018-06-18  Said Abou-Hallawa  
+
+Document should not be mutated under SMILTimeContainer::updateAnimations()
+https://bugs.webkit.org/show_bug.cgi?id=186658
+
+Reviewed by Simon Fraser.
+
+To update the animation of an SVG  element, we call
+SVGAnimateElementBase::resetAnimatedType(). It ensures the pointer m_animator
+is valid. If it animates a css property, it calls computeCSSPropertyValue()
+which calls resolveStyle() via other calls. resolveStyle() may call delayed
+callbacks through the destructor of PostResolutionCallbackDisabler. These
+callbacks may fire events. These events may execute JS event handlers.
+If one of these event handlers deletes the same SVG  we animate,
+we will end up calling SVGAnimateElementBase::resetAnimatedPropertyType()
+of the same  element. This function  will delete the same m_animator
+which resetAnimatedType() still holds and will use later. This code
+re-entrance is unexpected and unwanted.
+
+The fix is to disable mutating the DOM while updating the SVG animations.
+
+Test: svg/dom/css-animate-input-foucs-crash.html
+
+* svg/animation/SMILTimeContainer.cpp:
+(WebCore::SMILTimeContainer::updateAnimations):
+
 2018-06-18  Commit Queue  
 
   

[webkit-changes] [232780] trunk/LayoutTests

[said]

Title: [232780] trunk/LayoutTests








Revision 232780
Author s...@apple.com
Date 2018-06-12 15:28:25 -0700 (Tue, 12 Jun 2018)


Log Message
Unreviewed followup for r232736
https://bugs.webkit.org/show_bug.cgi?id=185698

Consider the case when the SVG animation starts before requestAnimationFrame()
is called. Store the value of animItem and compare it later with the value
of animItem after detaching it from the animated animList.

* svg/dom/animated-tearoff-list-remove-target.html:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/svg/dom/animated-tearoff-list-remove-target.html




Diff

Modified: trunk/LayoutTests/ChangeLog (232779 => 232780)

--- trunk/LayoutTests/ChangeLog	2018-06-12 22:10:01 UTC (rev 232779)
+++ trunk/LayoutTests/ChangeLog	2018-06-12 22:28:25 UTC (rev 232780)
@@ -1,3 +1,14 @@
+2018-06-12  Said Abou-Hallawa  
+
+Unreviewed followup for r232736
+https://bugs.webkit.org/show_bug.cgi?id=185698
+
+Consider the case when the SVG animation starts before requestAnimationFrame()
+is called. Store the value of animItem and compare it later with the value
+of animItem after detaching it from the animated animList.
+
+* svg/dom/animated-tearoff-list-remove-target.html:
+
 2018-06-12  Ryan Haddad  
 
 Mark inspector/console/webcore-logging.html as flaky on mac-wk2 debug.


Modified: trunk/LayoutTests/svg/dom/animated-tearoff-list-remove-target.html (232779 => 232780)

--- trunk/LayoutTests/svg/dom/animated-tearoff-list-remove-target.html	2018-06-12 22:10:01 UTC (rev 232779)
+++ trunk/LayoutTests/svg/dom/animated-tearoff-list-remove-target.html	2018-06-12 22:28:25 UTC (rev 232780)
@@ -33,6 +33,7 @@
 // animItem is a reference (not a copy) to the first item in the x animated list.
 var animList = tspanElement.x.animVal;
 var animItem = animList.getItem(0);
+var originalValue = animItem.valueAsString;
 
 // Now change the target of the  element to be the "second-tspan".
 var animateElement = document.getElementById("animate");
@@ -42,7 +43,7 @@
 // of an SVGLength. animItem should not be affected if garbage collection is forced.
 gc();
 window.requestAnimationFrame(() => {
-if (animItem.valueAsString == "0") {
+if (animItem.valueAsString == originalValue) {
 document.querySelector("div").innerHTML += "PASS."
 document.querySelector("svg").remove();
 }






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [233366] trunk

[said]

Title: [233366] trunk








Revision 233366
Author s...@apple.com
Date 2018-06-29 12:24:45 -0700 (Fri, 29 Jun 2018)


Log Message
Infinite loop if a  element references its ancestor and the DOMNodeInserted event handler of one its ancestor's descents updates the document style
https://bugs.webkit.org/show_bug.cgi?id=186925

Reviewed by Antti Koivisto.

Source/WebCore:

This patches fixes two issues:
-- SVGTRefTargetEventListener should not assume it has to be attached to
target when its handleEvent() is called.
Because SVGTRefTargetEventListener::handleEvent() references the target
element, we just return if the listener is detached.

-- The  element should not clone its shadow tree if it references one
of its ancestors. The DOMNodeInserted of any node in the target element
tree may issue a document command. This document command will cause the 
shadow tree to be re-cloned so this will cause infinite loop to happen.

Test: svg/dom/svg-use-infinite-loop-cloning.html

* svg/SVGTRefElement.cpp:
(WebCore::SVGTRefTargetEventListener::handleEvent):
* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::updateShadowTree):

LayoutTests:

* svg/dom/svg-use-infinite-loop-cloning-expected.txt: Added.
* svg/dom/svg-use-infinite-loop-cloning.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGTRefElement.cpp
trunk/Source/WebCore/svg/SVGUseElement.cpp


Added Paths

trunk/LayoutTests/svg/dom/svg-use-infinite-loop-cloning-expected.txt
trunk/LayoutTests/svg/dom/svg-use-infinite-loop-cloning.html




Diff

Modified: trunk/LayoutTests/ChangeLog (233365 => 233366)

--- trunk/LayoutTests/ChangeLog	2018-06-29 18:54:41 UTC (rev 233365)
+++ trunk/LayoutTests/ChangeLog	2018-06-29 19:24:45 UTC (rev 233366)
@@ -1,3 +1,13 @@
+2018-06-25  Said Abou-Hallawa  
+
+Infinite loop if a  element references its ancestor and the DOMNodeInserted event handler of one its ancestor's descents updates the document style
+https://bugs.webkit.org/show_bug.cgi?id=186925
+
+Reviewed by Antti Koivisto.
+
+* svg/dom/svg-use-infinite-loop-cloning-expected.txt: Added.
+* svg/dom/svg-use-infinite-loop-cloning.html: Added.
+
 2018-06-29  Manuel Rego Casasnovas  
 
 [WPE] Three CSS Grid Layout tests crash due to valueless std::optional access


Added: trunk/LayoutTests/svg/dom/svg-use-infinite-loop-cloning-expected.txt (0 => 233366)

--- trunk/LayoutTests/svg/dom/svg-use-infinite-loop-cloning-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/dom/svg-use-infinite-loop-cloning-expected.txt	2018-06-29 19:24:45 UTC (rev 233366)
@@ -0,0 +1,3 @@
+This test passes if it doesn't crash.
+
+


Added: trunk/LayoutTests/svg/dom/svg-use-infinite-loop-cloning.html (0 => 233366)

--- trunk/LayoutTests/svg/dom/svg-use-infinite-loop-cloning.html	(rev 0)
+++ trunk/LayoutTests/svg/dom/svg-use-infinite-loop-cloning.html	2018-06-29 19:24:45 UTC (rev 233366)
@@ -0,0 +1,36 @@
+
+if (window.testRunner)
+testRunner.dumpAsText();
+
+function gc() {
+if (window.GCController)
+return GCController.collect();
+
+// Force garbage collection.
+for(var i=0;i<100;i++)
+a = new Uint8Array(1024*1024);
+}
+
+function onNodeInsertedTspan() {
+switchElement.setAttribute("y", "0 1 100");
+document.execCommand("justifyCenter", false);
+gc();
+}
+
+function onLoadUseElement() {
+tspanElement.addEventListener("DOMNodeInserted", onNodeInsertedTspan);
+document.execCommand("hiliteColor", false, "red");
+}
+
+
+This test passes if it doesn't crash.
+
+
+
+
+
+
+
+
+
+


Modified: trunk/Source/WebCore/ChangeLog (233365 => 233366)

--- trunk/Source/WebCore/ChangeLog	2018-06-29 18:54:41 UTC (rev 233365)
+++ trunk/Source/WebCore/ChangeLog	2018-06-29 19:24:45 UTC (rev 233366)
@@ -1,3 +1,28 @@
+2018-06-25  Said Abou-Hallawa  
+
+Infinite loop if a  element references its ancestor and the DOMNodeInserted event handler of one its ancestor's descents updates the document style
+https://bugs.webkit.org/show_bug.cgi?id=186925
+
+Reviewed by Antti Koivisto.
+
+This patches fixes two issues:
+-- SVGTRefTargetEventListener should not assume it has to be attached to
+target when its handleEvent() is called.
+Because SVGTRefTargetEventListener::handleEvent() references the target
+element, we just return if the listener is detached.
+
+-- The  element should not clone its shadow tree if it references one
+of its ancestors. The DOMNodeInserted of any node in the target element
+tree may issue a document command. This document command will cause the 
+shadow tree to be re-cloned s

[webkit-changes] [228256] trunk/LayoutTests

[said]

Title: [228256] trunk/LayoutTests








Revision 228256
Author s...@apple.com
Date 2018-02-07 18:32:38 -0800 (Wed, 07 Feb 2018)


Log Message
[iOS] Skip webgl/webgl-texture-image-buffer-reuse.html
https://bugs.webkit.org/show_bug.cgi?id=182592

Unreviewed test gardening.

* platform/ios/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/ios/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (228255 => 228256)

--- trunk/LayoutTests/ChangeLog	2018-02-08 02:29:57 UTC (rev 228255)
+++ trunk/LayoutTests/ChangeLog	2018-02-08 02:32:38 UTC (rev 228256)
@@ -1,3 +1,12 @@
+2018-02-07  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+[iOS] Skip webgl/webgl-texture-image-buffer-reuse.html
+https://bugs.webkit.org/show_bug.cgi?id=182592
+
+Unreviewed test gardening.
+
+* platform/ios/TestExpectations:
+
 2018-02-07  Youenn Fablet  <you...@apple.com>
 
 Remove www1/www2 URLs from service worker tests


Modified: trunk/LayoutTests/platform/ios/TestExpectations (228255 => 228256)

--- trunk/LayoutTests/platform/ios/TestExpectations	2018-02-08 02:29:57 UTC (rev 228255)
+++ trunk/LayoutTests/platform/ios/TestExpectations	2018-02-08 02:32:38 UTC (rev 228256)
@@ -3284,3 +3284,5 @@
 webkit.org/b/181838 js/slow-stress/Int32Array-alloc-huge-long-lived.html [ Slow ]
 
 webkit.org/b/182422 imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-origin.sub.html [ Skip ]
+
+webkit.org/b/182592 webgl/webgl-texture-image-buffer-reuse.html [ Skip ]






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [233056] trunk

[said]

Title: [233056] trunk








Revision 233056
Author s...@apple.com
Date 2018-06-21 13:54:32 -0700 (Thu, 21 Jun 2018)


Log Message
RenderSVGInline has to be inline always regardless of its css display value
https://bugs.webkit.org/show_bug.cgi?id=186656

Reviewed by Zalan Bujtas.

Source/WebCore:

According to https://www.w3.org/TR/SVG2/text.html#TextLayout, the 
element has to be laid out as if it were a block element and any ,
,  and  descendants were inline elements.

If a css rule, which contains the property "display: block;", is applied
to any of children of a  element, this property has to be ignored.

We currently ignore this property in RenderSVGInline::updateFromStyle()
by forcing setInline(true). But we do not do the same thing in 
RenderTreeBuilder::normalizeTreeAfterStyleChange(). In fact we allow
making the children of the  element to be non-inline. This puts
the render tree in weired state and causes many assertions to fire while
laying out RenderSVGText. 

Test: svg/dom/svg-inline-text-display-block-crash.html

* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::normalizeTreeAfterStyleChange):

LayoutTests:

* svg/dom/svg-inline-text-display-block-crash-expected.txt: Added.
* svg/dom/svg-inline-text-display-block-crash.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp


Added Paths

trunk/LayoutTests/svg/dom/svg-inline-text-display-block-crash-expected.txt
trunk/LayoutTests/svg/dom/svg-inline-text-display-block-crash.html




Diff

Modified: trunk/LayoutTests/ChangeLog (233055 => 233056)

--- trunk/LayoutTests/ChangeLog	2018-06-21 20:34:14 UTC (rev 233055)
+++ trunk/LayoutTests/ChangeLog	2018-06-21 20:54:32 UTC (rev 233056)
@@ -1,3 +1,13 @@
+2018-06-20  Said Abou-Hallawa  
+
+RenderSVGInline has to be inline always regardless of its css display value
+https://bugs.webkit.org/show_bug.cgi?id=186656
+
+Reviewed by Zalan Bujtas.
+
+* svg/dom/svg-inline-text-display-block-crash-expected.txt: Added.
+* svg/dom/svg-inline-text-display-block-crash.html: Added.
+
 2018-06-20  Zalan Bujtas  
 
 Do not reuse generated inline renderer for the first letter.


Added: trunk/LayoutTests/svg/dom/svg-inline-text-display-block-crash-expected.txt (0 => 233056)

--- trunk/LayoutTests/svg/dom/svg-inline-text-display-block-crash-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/dom/svg-inline-text-display-block-crash-expected.txt	2018-06-21 20:54:32 UTC (rev 233056)
@@ -0,0 +1,4 @@
+This test passes if it doesn't crash.
+
+ 
+


Added: trunk/LayoutTests/svg/dom/svg-inline-text-display-block-crash.html (0 => 233056)

--- trunk/LayoutTests/svg/dom/svg-inline-text-display-block-crash.html	(rev 0)
+++ trunk/LayoutTests/svg/dom/svg-inline-text-display-block-crash.html	2018-06-21 20:54:32 UTC (rev 233056)
@@ -0,0 +1,21 @@
+
+ tspan {
+float: right;
+display: block;
+}
+
+
+This test passes if it doesn't crash.
+
+
+
+
+
+
+
+if (window.testRunner)
+testRunner.dumpAsText();
+input.setSelectionRange(0, 1);
+tspan.style.float = "none";
+
+


Modified: trunk/Source/WebCore/ChangeLog (233055 => 233056)

--- trunk/Source/WebCore/ChangeLog	2018-06-21 20:34:14 UTC (rev 233055)
+++ trunk/Source/WebCore/ChangeLog	2018-06-21 20:54:32 UTC (rev 233056)
@@ -1,3 +1,29 @@
+2018-06-20  Said Abou-Hallawa  
+
+RenderSVGInline has to be inline always regardless of its css display value
+https://bugs.webkit.org/show_bug.cgi?id=186656
+
+Reviewed by Zalan Bujtas.
+
+According to https://www.w3.org/TR/SVG2/text.html#TextLayout, the 
+element has to be laid out as if it were a block element and any ,
+,  and  descendants were inline elements.
+
+If a css rule, which contains the property "display: block;", is applied
+to any of children of a  element, this property has to be ignored.
+
+We currently ignore this property in RenderSVGInline::updateFromStyle()
+by forcing setInline(true). But we do not do the same thing in 
+RenderTreeBuilder::normalizeTreeAfterStyleChange(). In fact we allow
+making the children of the  element to be non-inline. This puts
+the render tree in weired state and causes many assertions to fire while
+laying out RenderSVGText. 
+
+Test: svg/dom/svg-inline-text-display-block-crash.html
+
+* rendering/updating/RenderTreeBuilder.cpp:
+(WebCore::RenderTreeBuilder::normalizeTreeAfterStyleChange):
+
 2018-06-20  Zalan Bujtas  
 
 Do not reuse generated inline renderer for the first letter.


Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp (233055 => 233056)

--- trunk/Source/WebCore/render

[webkit-changes] [230552] trunk/Source/WTF

[said]

Title: [230552] trunk/Source/WTF








Revision 230552
Author s...@apple.com
Date 2018-04-11 18:09:15 -0700 (Wed, 11 Apr 2018)


Log Message
Unreviewed, rolling out r230523.

Introduced MotionMark regression

Reverted changeset:

"Deactivate the WindowServer connection for the WebContent
process."
https://bugs.webkit.org/show_bug.cgi?id=184451
https://trac.webkit.org/changeset/230523

Modified Paths

trunk/Source/WTF/ChangeLog
trunk/Source/WTF/wtf/FeatureDefines.h




Diff

Modified: trunk/Source/WTF/ChangeLog (230551 => 230552)

--- trunk/Source/WTF/ChangeLog	2018-04-12 00:53:26 UTC (rev 230551)
+++ trunk/Source/WTF/ChangeLog	2018-04-12 01:09:15 UTC (rev 230552)
@@ -1,3 +1,16 @@
+2018-04-11  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Unreviewed, rolling out r230523.
+
+Introduced MotionMark regression
+
+Reverted changeset:
+
+"Deactivate the WindowServer connection for the WebContent
+process."
+https://bugs.webkit.org/show_bug.cgi?id=184451
+https://trac.webkit.org/changeset/230523
+
 2018-04-11  Per Arne Vollan  <pvol...@apple.com>
 
 Deactivate the WindowServer connection for the WebContent process.


Modified: trunk/Source/WTF/wtf/FeatureDefines.h (230551 => 230552)

--- trunk/Source/WTF/wtf/FeatureDefines.h	2018-04-12 00:53:26 UTC (rev 230551)
+++ trunk/Source/WTF/wtf/FeatureDefines.h	2018-04-12 01:09:15 UTC (rev 230552)
@@ -238,7 +238,7 @@
 #endif
 
 #if !defined(ENABLE_WEBPROCESS_WINDOWSERVER_BLOCKING)
-#define ENABLE_WEBPROCESS_WINDOWSERVER_BLOCKING __MAC_OS_X_VERSION_MIN_REQUIRED >= 101400
+#define ENABLE_WEBPROCESS_WINDOWSERVER_BLOCKING 0
 #endif
 
 #endif /* PLATFORM(MAC) */






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [230063] trunk/Source/WebCore

[said]

Title: [230063] trunk/Source/WebCore








Revision 230063
Author s...@apple.com
Date 2018-03-28 18:10:13 -0700 (Wed, 28 Mar 2018)


Log Message
The SVGAnimatedProperty wrappers have to be detached from the referenced values before the SVGAnimatedType is deleted
https://bugs.webkit.org/show_bug.cgi?id=183972

Reviewed by Daniel Bates.

If the SVGAnimatedType is a list type, e.g. SVGLengthListValues, the wrappers
of the animated properties have to be detached from the items in the list
before it's deleted.

* svg/SVGAnimateElementBase.cpp:
(WebCore::SVGAnimateElementBase::clearAnimatedType):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (230062 => 230063)

--- trunk/Source/WebCore/ChangeLog	2018-03-29 00:47:57 UTC (rev 230062)
+++ trunk/Source/WebCore/ChangeLog	2018-03-29 01:10:13 UTC (rev 230063)
@@ -1,3 +1,17 @@
+2018-03-28  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+The SVGAnimatedProperty wrappers have to be detached from the referenced values before the SVGAnimatedType is deleted
+https://bugs.webkit.org/show_bug.cgi?id=183972
+
+Reviewed by Daniel Bates.
+
+If the SVGAnimatedType is a list type, e.g. SVGLengthListValues, the wrappers
+of the animated properties have to be detached from the items in the list
+before it's deleted.
+
+* svg/SVGAnimateElementBase.cpp:
+(WebCore::SVGAnimateElementBase::clearAnimatedType):
+
 2018-03-28  Ross Kirsling  <ross.kirsl...@sony.com>
 
 MSVC __forceinline slows down JSC release build fivefold after r229391


Modified: trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp (230062 => 230063)

--- trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp	2018-03-29 00:47:57 UTC (rev 230062)
+++ trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp	2018-03-29 01:10:13 UTC (rev 230063)
@@ -303,6 +303,11 @@
 if (!m_animatedType)
 return;
 
+// If the SVGAnimatedType is a list type, e.g. SVGLengthListValues, the wrappers of the
+// animated properties have to be detached from the items in the list before it's deleted.
+if (!m_animatedProperties.isEmpty())
+m_animator->animValWillChange(m_animatedProperties);
+
 if (!targetElement) {
 m_animatedType = nullptr;
 return;






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [230172] trunk/LayoutTests

[said]

Title: [230172] trunk/LayoutTests








Revision 230172
Author s...@apple.com
Date 2018-04-02 12:42:18 -0700 (Mon, 02 Apr 2018)


Log Message
Followup(r230063): Add test a layout test for https://bugs.webkit.org/show_bug.cgi?id=183972
https://bugs.webkit.org/show_bug.cgi?id=184162

Reviewed by Daniel Bates.

Without r230063, running run-webkit-tests -g for this test will crash.

* svg/dom/animated-tearoff-list-remove-target-expected.txt: Added.
* svg/dom/animated-tearoff-list-remove-target.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog


Added Paths

trunk/LayoutTests/svg/dom/animated-tearoff-list-remove-target-expected.txt
trunk/LayoutTests/svg/dom/animated-tearoff-list-remove-target.html




Diff

Modified: trunk/LayoutTests/ChangeLog (230171 => 230172)

--- trunk/LayoutTests/ChangeLog	2018-04-02 19:06:44 UTC (rev 230171)
+++ trunk/LayoutTests/ChangeLog	2018-04-02 19:42:18 UTC (rev 230172)
@@ -1,3 +1,15 @@
+2018-04-02  Said Abou-Hallawa  <sabouhall...@apple.com>
+
+Followup(r230063): Add test a layout test for https://bugs.webkit.org/show_bug.cgi?id=183972
+https://bugs.webkit.org/show_bug.cgi?id=184162
+
+Reviewed by Daniel Bates.
+
+Without r230063, running run-webkit-tests -g for this test will crash.
+
+* svg/dom/animated-tearoff-list-remove-target-expected.txt: Added.
+* svg/dom/animated-tearoff-list-remove-target.html: Added.
+
 2018-04-02  Jer Noble  <jer.no...@apple.com>
 
 AudioBufferSourceNode start method causes OfflineAudioContext to start running


Added: trunk/LayoutTests/svg/dom/animated-tearoff-list-remove-target-expected.txt (0 => 230172)

--- trunk/LayoutTests/svg/dom/animated-tearoff-list-remove-target-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/dom/animated-tearoff-list-remove-target-expected.txt	2018-04-02 19:42:18 UTC (rev 230172)
@@ -0,0 +1,4 @@
+Removing the target of an animate element should detach the wrappers of the attributes from their animated properties.
+
+PASS.
+


Added: trunk/LayoutTests/svg/dom/animated-tearoff-list-remove-target.html (0 => 230172)

--- trunk/LayoutTests/svg/dom/animated-tearoff-list-remove-target.html	(rev 0)
+++ trunk/LayoutTests/svg/dom/animated-tearoff-list-remove-target.html	2018-04-02 19:42:18 UTC (rev 230172)
@@ -0,0 +1,54 @@
+
+
+Removing the target of an animate element should detach the wrappers of the attributes from their animated properties.
+
+
+First tspan. 
+
+
+Second tspan 
+
+
+
+
+function gc() {
+if (window.GCController)
+return GCController.collect();
+
+// Force garbage collection.
+for (var i = 0; i < 1; i++)
+var s = new String("abc");
+}
+
+(function() {
+if (window.testRunner)  {
+testRunner.dumpAsText();
+testRunner.waitUntilDone();
+}
+
+setTimeout(() => {
+// The target of the <animate> element is the "first-tspan".
+var tspanElement = document.getElementById("first-tspan");
+
+// animItem is a reference (not a copy) to the first item in the x animated list.
+var animList = tspanElement.x.animVal;
+var animItem = animList.getItem(0);
+
+// Now change the target of the <animate> element to be the "second-tspan".
+var animateElement = document.getElementById("animate");
+animateElement.setAttributeNS("http://www.w3.org/1999/xlink", "href", "second-tspan");
+
+// By now animItem should be detached from the animated animList and has its own copy
+// of an SVGLength. animItem should not be affected if garbage collection is forced.
+gc();
+if (animItem.valueAsString == "0") {
+document.querySelector("div").innerHTML += "<br><br>PASS."
+document.querySelector("svg").remove();
+}
+
+if (window.testRunner)
+testRunner.notifyDone();
+}, 0);
+})();
+
+






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [236991] trunk

[said]

Title: [236991] trunk








Revision 236991
Author s...@apple.com
Date 2018-10-09 16:59:52 -0700 (Tue, 09 Oct 2018)


Log Message
REGRESSION(r234620): SVGLangSpace::svgAttributeChanged() should invalidate the renderer of the SVGGeometryElement descendant only
https://bugs.webkit.org/show_bug.cgi?id=190411

Reviewed by Simon Fraser.

Source/WebCore:

Test: svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr.html

When changing the attributes of the SVGLangSpace, we should invalidate
the renderer of the SVGGeometryElement descendant only. Renderer of other
elements, like SVGStopElement, should not be invalidated because they do
not have geometry and they can be used as resources for drawing another
SVGGeometryElement.

* svg/SVGElement.h:
(WebCore::SVGElement::isSVGGeometryElement const):
* svg/SVGGeometryElement.h:
(isType):
* svg/SVGLangSpace.cpp:
(WebCore::SVGLangSpace::svgAttributeChanged):

LayoutTests:

* svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr-expected.txt: Added.
* svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGElement.h
trunk/Source/WebCore/svg/SVGGeometryElement.h
trunk/Source/WebCore/svg/SVGLangSpace.cpp


Added Paths

trunk/LayoutTests/svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr-expected.txt
trunk/LayoutTests/svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr.html




Diff

Modified: trunk/LayoutTests/ChangeLog (236990 => 236991)

--- trunk/LayoutTests/ChangeLog	2018-10-09 23:46:12 UTC (rev 236990)
+++ trunk/LayoutTests/ChangeLog	2018-10-09 23:59:52 UTC (rev 236991)
@@ -1,3 +1,13 @@
+2018-10-09  Said Abou-Hallawa  
+
+REGRESSION(r234620): SVGLangSpace::svgAttributeChanged() should invalidate the renderer of the SVGGeometryElement descendant only
+https://bugs.webkit.org/show_bug.cgi?id=190411
+
+Reviewed by Simon Fraser.
+
+* svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr-expected.txt: Added.
+* svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr.html: Added.
+
 2018-10-09  Chris Dumez  
 
 Anchor target should be ignored on activation when the download attribute is set


Added: trunk/LayoutTests/svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr-expected.txt (0 => 236991)

--- trunk/LayoutTests/svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr-expected.txt	2018-10-09 23:59:52 UTC (rev 236991)
@@ -0,0 +1,3 @@
+Passes if no crash happens.
+
+


Added: trunk/LayoutTests/svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr.html (0 => 236991)

--- trunk/LayoutTests/svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr.html	(rev 0)
+++ trunk/LayoutTests/svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr.html	2018-10-09 23:59:52 UTC (rev 236991)
@@ -0,0 +1,21 @@
+
+Passes if no crash happens.
+
+
+
+
+
+
+
+
+if (window.testRunner) {
+testRunner.dumpAsText();
+testRunner.waitUntilDone();
+}
+setTimeout(function(){ 
+stop1.setAttributeNS("http://www.w3.org/XML/1998/namespace", "xml:lang", "jw");
+if (window.testRunner)
+testRunner.notifyDone();
+}, 0);
+
+


Modified: trunk/Source/WebCore/ChangeLog (236990 => 236991)

--- trunk/Source/WebCore/ChangeLog	2018-10-09 23:46:12 UTC (rev 236990)
+++ trunk/Source/WebCore/ChangeLog	2018-10-09 23:59:52 UTC (rev 236991)
@@ -1,3 +1,25 @@
+2018-10-09  Said Abou-Hallawa  
+
+REGRESSION(r234620): SVGLangSpace::svgAttributeChanged() should invalidate the renderer of the SVGGeometryElement descendant only
+https://bugs.webkit.org/show_bug.cgi?id=190411
+
+Reviewed by Simon Fraser.
+
+Test: svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr.html
+
+When changing the attributes of the SVGLangSpace, we should invalidate
+the renderer of the SVGGeometryElement descendant only. Renderer of other
+elements, like SVGStopElement, should not be invalidated because they do
+not have geometry and they can be used as resources for drawing another
+SVGGeometryElement.
+
+* svg/SVGElement.h:
+(WebCore::SVGElement::isSVGGeometryElement const):
+* svg/SVGGeometryElement.h:
+(isType):
+* svg/SVGLangSpace.cpp:
+(WebCore::SVGLangSpace::svgAttributeChanged):
+
 2018-10-09  Chris Dumez  
 
 Anchor target should be ignored on activation when the download attribute is set


Modified: trunk/Source/WebCore/svg/SVGElement.h (236990 => 236991)

--- trunk/Source/WebCore/svg/SVGElement.h	2018-10-09 23:46:12 UTC (rev 236990)
+++ trunk/Source/WebCore/svg/SVGElement.h	2018-10-09 23:59:52 UTC (rev 236991)
@

[webkit-changes] [239873] trunk/Source/WTF

[said]

Title: [239873] trunk/Source/WTF








Revision 239873
Author s...@apple.com
Date 2019-01-11 14:01:07 -0800 (Fri, 11 Jan 2019)


Log Message
WorkQueue::concurrentApply() passes a raw pointer to a temporary String to Thread::create().
https://bugs.webkit.org/show_bug.cgi?id=191350

Reviewed by Brent Fulgham.

The non COCOA version of WorkQueue::concurrentApply() creates a temporary
String for the threadName and passes the raw pointer of this String to
Thread::create(). After freeing this String, Thread::entryPoint() uses
the raw char pointer to internally initialize the thread.

The fix is to use a single literal string for all the threads' names since
they are created for a thread-pool.

* wtf/WorkQueue.cpp:
(WTF::WorkQueue::concurrentApply):

Modified Paths

trunk/Source/WTF/ChangeLog
trunk/Source/WTF/wtf/WorkQueue.cpp




Diff

Modified: trunk/Source/WTF/ChangeLog (239872 => 239873)

--- trunk/Source/WTF/ChangeLog	2019-01-11 21:57:46 UTC (rev 239872)
+++ trunk/Source/WTF/ChangeLog	2019-01-11 22:01:07 UTC (rev 239873)
@@ -1,3 +1,21 @@
+2019-01-11  Said Abou-Hallawa  
+
+WorkQueue::concurrentApply() passes a raw pointer to a temporary String to Thread::create().
+https://bugs.webkit.org/show_bug.cgi?id=191350
+
+Reviewed by Brent Fulgham.
+
+The non COCOA version of WorkQueue::concurrentApply() creates a temporary
+String for the threadName and passes the raw pointer of this String to
+Thread::create(). After freeing this String, Thread::entryPoint() uses
+the raw char pointer to internally initialize the thread.
+
+The fix is to use a single literal string for all the threads' names since
+they are created for a thread-pool.
+
+* wtf/WorkQueue.cpp:
+(WTF::WorkQueue::concurrentApply):
+
 2019-01-11  Dominik Infuehr  
 
 Enable DFG on ARM/Linux again


Modified: trunk/Source/WTF/wtf/WorkQueue.cpp (239872 => 239873)

--- trunk/Source/WTF/wtf/WorkQueue.cpp	2019-01-11 21:57:46 UTC (rev 239872)
+++ trunk/Source/WTF/wtf/WorkQueue.cpp	2019-01-11 22:01:07 UTC (rev 239873)
@@ -75,7 +75,7 @@
 
 m_workers.reserveInitialCapacity(threadCount);
 for (unsigned i = 0; i < threadCount; ++i) {
-m_workers.append(Thread::create(String::format("ThreadPool Worker %u", i).utf8().data(), [this] {
+m_workers.append(Thread::create

[webkit-changes] [243259] trunk/Source/WebCore

[said]

r):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/Sources.txt
trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj
trunk/Source/WebCore/svg/SVGAnimateColorElement.cpp
trunk/Source/WebCore/svg/SVGAnimateColorElement.h
trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp
trunk/Source/WebCore/svg/SVGAnimatorFactory.h
trunk/Source/WebCore/svg/SVGAttributeAnimationController.cpp
trunk/Source/WebCore/svg/SVGAttributeAnimationController.h
trunk/Source/WebCore/svg/SVGElement.cpp
trunk/Source/WebCore/svg/SVGElement.h
trunk/Source/WebCore/svg/SVGFitToViewBox.h
trunk/Source/WebCore/svg/SVGMPathElement.cpp
trunk/Source/WebCore/svg/graphics/filters/SVGFEImage.h
trunk/Source/WebCore/svg/properties/SVGAnimationAdditiveValueFunctionImpl.h
trunk/Source/WebCore/svg/properties/SVGAnimationFunction.h
trunk/Source/WebCore/svg/properties/SVGAttributeAnimator.cpp
trunk/Source/WebCore/svg/properties/SVGAttributeAnimator.h


Added Paths

trunk/Source/WebCore/svg/properties/SVGAnimationAdditiveValueFunctionImpl.cpp
trunk/Source/WebCore/svg/properties/SVGPrimitivePropertyAnimator.h
trunk/Source/WebCore/svg/properties/SVGPrimitivePropertyAnimatorImpl.h
trunk/Source/WebCore/svg/properties/SVGPropertyAnimator.h
trunk/Source/WebCore/svg/properties/SVGPropertyAnimatorFactory.h


Removed Paths

trunk/Source/WebCore/svg/SVGAnimatedColor.cpp
trunk/Source/WebCore/svg/SVGAnimatedColor.h




Diff

Modified: trunk/Source/WebCore/ChangeLog (243258 => 243259)

--- trunk/Source/WebCore/ChangeLog	2019-03-20 23:37:54 UTC (rev 243258)
+++ trunk/Source/WebCore/ChangeLog	2019-03-20 23:51:47 UTC (rev 243259)
@@ -1,3 +1,110 @@
+2019-03-20  Said Abou-Hallawa  
+
+Remove the SVG tear off objects for SVGColorAnimator
+https://bugs.webkit.org/show_bug.cgi?id=196025
+
+Reviewed by Simon Fraser.
+
+SVG attributes like "fill" and "stroke" do not have reflecting properties
+in SVGElement but they are animatable by SMIL. Animating such attributes
+is different from animating the SVG animated properties. These new classes
+will be added to handle the first type of this kind of attribute: the Color:
+
+-- SVGPropertyAnimatorCreator is added to SVGElement. It is responsible 
+   for creating SVGPropertyAnimators for the attribute which do not have
+   reflecting animated properties stored by SVGElement. It will maintain
+   a HashMap for the animated values for these attributes which is indexed
+   by the attribute name. The animated values has to be RefCounted because
+   the same attribute can be animated by multiple animators. So the values
+   of this HashMap will be of type Ref, e.g.
+
+
+
+
+
+-- SVGPropertyAnimator is the a new type which animates an attribute with
+   no reflecting animated property.
+
+-- SVGPrimitivePropertyAnimator is a template class which is responsible
+   for animating attributes with primitive types, e.g. Color, string and 
+   float. It is derived form SVGPropertyAnimator and it is initialized 
+   with a Ref> which is created and maintained
+   by SVGPropertyAnimatorFactory.
+
+-- SVGAnimationColorFunction is the animation function that animates the
+   attributes whose type are Color. Note the conversion form String to 
+   Color in this class has to handle the case when its value is "attributeName="
+   e.g. 
+
+-- SVGColorAnimator will be defined to be
+   SVGPrimitivePropertyAnimator.
+
+The life cycle of the RefCounted properties can be explained as follows:
+
+-- SVGPropertyAnimatorFactory checks whether its HashMap has an entry
+   for the given attribute name. If it does not have, it will create a
+   new value through the value creation method for this attribute.
+
+-- SVGPropertyAnimatorFactory passes the shared animated value to the
+   animator creation method. So multiple animators will be accessing the
+   same value through their RefCounted pointers.
+
+-- When the animator is about to be deleted, it will notify the target
+   SVGElement which will notify its SVGPropertyAnimatorFactory.
+   SVGPropertyAnimatorFactory will check its HashMap and retrieves the
+   entry for the given attribute name. If the refCount is 2, it is going
+   to remove the entry form the HashMap.
+
+* Sources.txt:
+* WebCore.xcodeproj/project.pbxproj:
+* svg/SVGAnimateColorElement.cpp:
+(WebCore::attributeValueIsCurrentColor): Deleted.
+(WebCore::SVGAnimateColorElement::determinePropertyValueTypes): Deleted.
+* svg/SVGAnimateColorElement.h:
+* svg/SVGAnimateElementBase.cpp:
+(WebCore::SVGAnimateElementBase::attributeAnimationController):
+* svg/SVGA

[webkit-changes] [243532] trunk/Source/WebCore

[said]

Title: [243532] trunk/Source/WebCore








Revision 243532
Author s...@apple.com
Date 2019-03-26 18:05:32 -0700 (Tue, 26 Mar 2019)


Log Message
Unreviewed Windows build fix
https://bugs.webkit.org/show_bug.cgi?id=196083


* svg/SVGAnimatorFactory.h:
(WebCore::SVGAnimatorFactory::isSupportedAttributeType):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGAnimatorFactory.h




Diff

Modified: trunk/Source/WebCore/ChangeLog (243531 => 243532)

--- trunk/Source/WebCore/ChangeLog	2019-03-27 00:55:19 UTC (rev 243531)
+++ trunk/Source/WebCore/ChangeLog	2019-03-27 01:05:32 UTC (rev 243532)
@@ -1,3 +1,12 @@
+2019-03-26  Said Abou-Hallawa  
+
+Unreviewed Windows build fix
+https://bugs.webkit.org/show_bug.cgi?id=196083
+
+
+* svg/SVGAnimatorFactory.h:
+(WebCore::SVGAnimatorFactory::isSupportedAttributeType):
+
 2019-03-26  Wenson Hsieh  
 
 [Cocoa] Refactor some helper functions for building UserAgent strings


Modified: trunk/Source/WebCore/svg/SVGAnimatorFactory.h (243531 => 243532)

--- trunk/Source/WebCore/svg/SVGAnimatorFactory.h	2019-03-27 00:55:19 UTC (rev 243531)
+++ trunk/Source/WebCore/svg/SVGAnimatorFactory.h	2019-03-27 01:05:32 UTC (rev 243532)
@@ -47,12 +47,14 @@
 case AnimatedRect:
 case AnimatedString:
 case AnimatedUnknown:
-return false;
+break;
 
 case AnimatedPath:
 case AnimatedTransformList:
 return true;
 }
+
+return false;
 }
 
 static std::unique_ptr create(SVGAnimationElement* animationElement, SVGElement* contextElement, AnimatedPropertyType attributeType)






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [242515] trunk

[said]

Title: [242515] trunk








Revision 242515
Author s...@apple.com
Date 2019-03-05 15:12:51 -0800 (Tue, 05 Mar 2019)


Log Message
SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
https://bugs.webkit.org/show_bug.cgi?id=195333


Reviewed by Simon Fraser.

Source/WebCore:

Because the SVG1.1 specs states that the newItem should be removed from
its original list before adding it to another list,
SVGPathSegList.insertItemBefore() should fail if the new item belongs to
an animating animPathSegList since it is read-only.

Test: svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg

* svg/SVGPathSegList.cpp:
(WebCore::SVGPathSegList::processIncomingListItemValue):

LayoutTests:

* svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt: Added.
* svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGPathSegList.cpp


Added Paths

trunk/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt
trunk/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg




Diff

Modified: trunk/LayoutTests/ChangeLog (242514 => 242515)

--- trunk/LayoutTests/ChangeLog	2019-03-05 22:19:59 UTC (rev 242514)
+++ trunk/LayoutTests/ChangeLog	2019-03-05 23:12:51 UTC (rev 242515)
@@ -1,3 +1,14 @@
+2019-03-05  Said Abou-Hallawa  
+
+SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
+https://bugs.webkit.org/show_bug.cgi?id=195333
+
+
+Reviewed by Simon Fraser.
+
+* svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt: Added.
+* svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg: Added.
+
 2019-03-05  Ryan Haddad  
 
 Unreviewed, rolling out r242403.


Added: trunk/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt (0 => 242515)

--- trunk/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt	2019-03-05 23:12:51 UTC (rev 242515)
@@ -0,0 +1 @@
+PASS: did not assert in debug.


Added: trunk/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg (0 => 242515)

--- trunk/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg	(rev 0)
+++ trunk/LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg	2019-03-05 23:12:51 UTC (rev 242515)
@@ -0,0 +1,29 @@
+
+
+
+
+
+PASS: did not assert in debug.
+
+if (window.testRunner) {
+testRunner.dumpAsText();
+testRunner.waitUntilDone();
+}
+
+var animate = document.getElementById("animate");
+animate.addEventListener('beginEvent' , function () {
+var path1 = document.getElementById("path1");
+var path2 = document.getElementById("path2");
+
+var path1_pathSegList = path1.pathSegList;
+var path2_animPathSegList = path2.animatedPathSegList;  
+
+document.documentElement.setCurrentTime(1);
+
+var pathseg = path2_animPathSegList.getItem(0); 
+path1_pathSegList.insertItemBefore(pathseg, 0);
+if (window.testRunner)
+testRunner.notifyDone();
+}, { once: true});
+
+


Modified: trunk/Source/WebCore/ChangeLog (242514 => 242515)

--- trunk/Source/WebCore/ChangeLog	2019-03-05 22:19:59 UTC (rev 242514)
+++ trunk/Source/WebCore/ChangeLog	2019-03-05 23:12:51 UTC (rev 242515)
@@ -1,3 +1,21 @@
+2019-03-05  Said Abou-Hallawa  
+
+SVGPathSegList.insertItemBefore() should fail if the newItem belongs to an animating animPathSegList
+https://bugs.webkit.org/show_bug.cgi?id=195333
+
+
+Reviewed by Simon Fraser.
+
+Because the SVG1.1 specs states that the newItem should be removed from
+its original list before adding it to another list,
+SVGPathSegList.insertItemBefore() should fail if the new item belongs to
+an animating animPathSegList since it is read-only.
+
+Test: svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg
+
+* svg/SVGPathSegList.cpp:
+(WebCore::SVGPathSegList::processIncomingListItemValue):
+
 2019-03-05  Zalan Bujtas  
 
 [ContentChangeObserver] Send content change notification through adjustObservedState


Modified: trunk/Source/WebCore/svg/SVGPathSegList.cpp (242514 => 242515)

--- trunk/Source/WebCore/svg/SVGPathSegList.cpp	2019-03-05 22:19:59 UTC (rev 242514)
+++ trunk/Source/WebCore/svg/SVGPathSegList.cpp	2019-03-05 23:12:51 UTC (rev 242515)
@@ -85,8 +85,15 @@
 b

[webkit-changes] [243336] trunk

[said]

Title: [243336] trunk








Revision 243336
Author s...@apple.com
Date 2019-03-21 15:21:58 -0700 (Thu, 21 Mar 2019)


Log Message
Remove the SVG tear off objects for SVGPoint, SVGPointList and SVGAnimatedPointList
https://bugs.webkit.org/show_bug.cgi?id=195905

Source/WebCore:

Patch by Said Abou-Hallawa  on 2019-03-21
Reviewed by Simon Fraser.

To remove the SVG tear off objects for SVGPoint, SVGPointList and 
SVGAnimatedPointList, these changes are needed:

-- Define SVGPoint to be a superclass of SVGValueProperty.

-- Define SVGAnimatedPointList to be a superclass of SVGAnimatedPropertyList

-- Add SVGPropertyList which is a superclass of SVGList. Its items are
   defined to RefCounted. It is the base class of SVGValuePropertyList
   and it will be  the base class of SVGPathSegList in a later patch.

-- Add SVGValuePropertyList which is the base class of all the lists whose
   items are backed by a value objects like SVGPoint. The difference between
   SVGPropertyList and SVGValuePropertyList is the former class can store
   a Ref pointer of the base class like SVGPathSeg while the later type
   has to store the same type for all the items.

-- Add SVGAnimatedPropertyList which is the base class for all the animated
   lists. Note that:
   1) SVGElement owns SVGAnimatedPropertyList
   2) SVGAnimatedPropertyList owns m_baseVal whose type is SVGList
   3) m_baseVal owns the items whose type is a superclass of SVGProperty.
   When changing an item, it calls its owner which is an SVGList.
   SVGList calls its owner which is SVGAnimatedPropertyList.
   SVGAnimatedPropertyList calls its owner which SVGElement to commit
   the change. Later SVGAnimatedPropertyList::synchronize() is called 
   which returns the property valueAsString() to update the reflecting
   attribute.

-- New accessor, animator and animation function are added to access
   and animate a member of type SVGAnimatedPropertyList.

* Sources.txt:
* WebCore.xcodeproj/project.pbxproj:
* rendering/svg/SVGPathData.cpp:
(WebCore::pathFromCircleElement):
(WebCore::pathFromEllipseElement):
(WebCore::pathFromLineElement):
(WebCore::pathFromPathElement):
(WebCore::pathFromPolygonElement):
(WebCore::pathFromPolylineElement):
(WebCore::pathFromRectElement):
(WebCore::pathFromGraphicsElement):
* rendering/svg/SVGPathData.h:
The IDL of SVGPolyElement interface requires the following attribute:
readonly attribute SVGPointList points;
For which we return:
SVGPointList& points() { return m_points->baseVal(); }
But for all the other properties we return the currentValue(). So to have
the two functions with the same name, the following function is added:
const SVGPointList& points() const { return m_points->currentValue(); }
This definition requires changing all callers to be const.

* rendering/svg/SVGRenderTreeAsText.cpp:
(WebCore::operator<<):
* svg/SVGAnimatedPointList.cpp: Removed.
* svg/SVGAnimatedPointList.h: Removed.
* svg/SVGAnimatedType.h:
(WebCore::SVGAnimatedType::type const):
This function had a bad design. It was designed to use the index of the
variant as the AnimatedPropertyType. But when some of the types are removed
from SVGValueVariant, this broke things. This fix is temporary till the 
class SVGValueVariant is removed.

* svg/SVGAnimatorFactory.h:
(WebCore::SVGAnimatorFactory::create):
* svg/SVGExternalResourcesRequired.cpp:
* svg/SVGParserUtilities.cpp:
(WebCore::pointsListFromSVGData): Deleted.
* svg/SVGParserUtilities.h:
* svg/SVGPoint.h:
(WebCore::SVGPoint::create):
(WebCore::SVGPoint::clone const):
(WebCore::SVGPoint::x):
(WebCore::SVGPoint::setX):
(WebCore::SVGPoint::y):
(WebCore::SVGPoint::setY):
(WebCore::SVGPoint::matrixTransform const):
(WebCore::SVGPoint::matrixTransform): Deleted.
(WebCore::SVGPoint::SVGPoint): Deleted.
* svg/SVGPoint.idl:
matrixTransform() should not throw an exception.

* svg/SVGPointList.h:
(WebCore::SVGPointList::create):
(WebCore::SVGPointList::parse):
(WebCore::SVGPointList::SVGPointList): Deleted.
Move the parse() and valueAsString() methods to SVGPointList. It is now
a superclass of SVGValuePropertyList. Its items are of type Ref.

* svg/SVGPointListValues.cpp: Removed.
* svg/SVGPointListValues.h: Removed.
* svg/SVGPolyElement.cpp:
(WebCore::SVGPolyElement::SVGPolyElement):
(WebCore::SVGPolyElement::parseAttribute):
(WebCore::SVGPolyElement::approximateMemoryCost const):
(WebCore::SVGPolyElement::registerAttributes): Deleted.
(WebCore::SVGPolyElement::points): Deleted.
(WebCore::SVGPolyElement::animatedPoints): Deleted.
* svg/SVGPolyElement.h:
(WebCore::SVGPolyElement::points const):
(WebCore::SVGPolyElement::points):
(WebCore::SVGPolyElement::animatedPoints):
(WebCore::SVGPolyElement::pointList const): Deleted.
(WebCore::SVGPolyElement::attributeRegistry): Deleted.
* svg/SVGSVGElement.cpp:
(WebCore::SVGSVGElement::setCurrentTranslate):
(WebCore::SVGSVGElement::currentTranslate): Deleted.
* svg/SVGSVGElement.h:
* svg/SVGSVGElement.idl:
Define currentTranslate proper

[webkit-changes] [240949] trunk

[said]

Title: [240949] trunk








Revision 240949
Author s...@apple.com
Date 2019-02-04 16:47:17 -0800 (Mon, 04 Feb 2019)


Log Message
[CG] Enable setAdditionalSupportedImageTypes for WK1
https://bugs.webkit.org/show_bug.cgi?id=194190

Reviewed by Tim Horton.

Source/WebCore:

Move the function webCoreStringVectorFromNSStringArray from WebKit to
WebCore so it can be used by both WebKit and WebKitLegacy.

* platform/mac/StringUtilities.h:
* platform/mac/StringUtilities.mm:
(WebCore::webCoreStringVectorFromNSStringArray):

Source/WebKit:

Move the function webCoreStringVectorFromNSStringArray from WebKit to
WebCore so it can be used by both WebKit and WebKitLegacy.

* Platform/mac/StringUtilities.h:
* Platform/mac/StringUtilities.mm:
(WebKit::webCoreStringVectorFromNSStringArray): Deleted.
* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _initializeWithConfiguration:]):

Source/WebKitLegacy/mac:

1. Define the preferences key AdditionalSupportedImageTypes.
2. Add additionalSupportedImageTypes as a private preference property.
3. Define the setter and the getter of the property.
4. Add function to convert from an id to an array of strings.
5. Call WebCore::setAdditionalSupportedImageTypes when preferences change.

* WebView/WebPreferenceKeysPrivate.h:
* WebView/WebPreferences.mm:
(-[WebPreferences _stringArrayValueForKey:]):
(-[WebPreferences _setStringArrayValueForKey:forKey:]):
(-[WebPreferences setAdditionalSupportedImageTypes:]):
(-[WebPreferences additionalSupportedImageTypes]):
* WebView/WebPreferencesPrivate.h:
* WebView/WebView.mm:
(-[WebView _preferencesChanged:]):

Tools:

Add a test similar to the one under WebKit Cocoa but make it create a
WebView instead of a WKWebView.

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/mac/100x100-red.tga: Added.
* TestWebKitAPI/Tests/mac/AdditionalSupportedImageTypes.html: Added.
* TestWebKitAPI/Tests/mac/AdditionalSupportedImageTypes.mm: Added.
(-[AdditionalSupportedImageTypesTest webView:didFinishLoadForFrame:]):
(TestWebKitAPI::runTest):
(TestWebKitAPI::TEST):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/mac/StringUtilities.h
trunk/Source/WebCore/platform/mac/StringUtilities.mm
trunk/Source/WebKit/ChangeLog
trunk/Source/WebKit/Platform/mac/StringUtilities.h
trunk/Source/WebKit/Platform/mac/StringUtilities.mm
trunk/Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm
trunk/Source/WebKitLegacy/mac/ChangeLog
trunk/Source/WebKitLegacy/mac/WebView/WebPreferenceKeysPrivate.h
trunk/Source/WebKitLegacy/mac/WebView/WebPreferences.mm
trunk/Source/WebKitLegacy/mac/WebView/WebPreferencesPrivate.h
trunk/Source/WebKitLegacy/mac/WebView/WebView.mm
trunk/Tools/ChangeLog
trunk/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj


Added Paths

trunk/Tools/TestWebKitAPI/Tests/mac/100x100-red.tga
trunk/Tools/TestWebKitAPI/Tests/mac/AdditionalSupportedImageTypes.html
trunk/Tools/TestWebKitAPI/Tests/mac/AdditionalSupportedImageTypes.mm




Diff

Modified: trunk/Source/WebCore/ChangeLog (240948 => 240949)

--- trunk/Source/WebCore/ChangeLog	2019-02-05 00:28:24 UTC (rev 240948)
+++ trunk/Source/WebCore/ChangeLog	2019-02-05 00:47:17 UTC (rev 240949)
@@ -1,3 +1,17 @@
+2019-02-04  Said Abou-Hallawa  
+
+[CG] Enable setAdditionalSupportedImageTypes for WK1
+https://bugs.webkit.org/show_bug.cgi?id=194190
+
+Reviewed by Tim Horton.
+
+Move the function webCoreStringVectorFromNSStringArray from WebKit to
+WebCore so it can be used by both WebKit and WebKitLegacy.
+
+* platform/mac/StringUtilities.h:
+* platform/mac/StringUtilities.mm:
+(WebCore::webCoreStringVectorFromNSStringArray):
+
 2019-02-04  Justin Fan  
 
 [Web GPU] Code clean-up for RenderPipeline backend


Modified: trunk/Source/WebCore/platform/mac/StringUtilities.h (240948 => 240949)

--- trunk/Source/WebCore/platform/mac/StringUtilities.h	2019-02-05 00:28:24 UTC (rev 240948)
+++ trunk/Source/WebCore/platform/mac/StringUtilities.h	2019-02-05 00:47:17 UTC (rev 240949)
@@ -29,5 +29,11 @@
 #import 
 
 namespace WebCore {
+
 WEBCORE_EXPORT bool stringMatchesWildcardString(const String& stringToBeMatched, const String& wildcardString);
+
+#ifdef __OBJC__
+WEBCORE_EXPORT Vector webCoreStringVectorFromNSStringArray(NSArray *);
+#endif // defined(__OBJC__)
+
 }


Modified: trunk/Source/WebCore/platform/mac/StringUtilities.mm (240948 => 240949)

--- trunk/Source/WebCore/platform/mac/StringUtilities.mm	2019-02-05 00:28:24 UTC (rev 240948)
+++ trunk/Source/WebCore/platform/mac/StringUtilities.mm	2019-02-05 00:47:17 UTC (rev 240949)
@@ -59,4 +59,15 @@
 return JSC::Yarr::RegularExpression(wildcardRegexPatternString(wildcardString), JSC::Yarr::TextCaseInsensitive).match(string) != -1;
 }
 
+Vector webCoreStringVectorFromNSStringArray(NSArray *nsStringArray)
+{
+Vector stringVector;
+stringVector.reserveInitialCapacity([nsStringArray count]);
+
+for (NSString *nsString

[webkit-changes] [244276] trunk

[said]

Title: [244276] trunk








Revision 244276
Author s...@apple.com
Date 2019-04-15 11:54:21 -0700 (Mon, 15 Apr 2019)


Log Message
ASSERT fires when removing a disallowed clone from the shadow tree without reseting its corresponding element
https://bugs.webkit.org/show_bug.cgi?id=196895

Reviewed by Darin Adler.

Source/WebCore:

When cloning elements to the shadow tree of an SVGUseElement, the
corresponding element links are set from the clones to the originals.
Later some of the elements may be disallowed to exist in the shadow tree.
For example the SVGPatternElement is disallowed and has to be removed
even after cloning. The problem is the corresponding elements are not
reset to null. Usually this is not a problem because the removed elements
will be deleted and the destructor of SVGElement will reset the corresponding
element links. However in some cases, the cloned element is referenced
from another SVGElement, for example the target of a SVGTRefElement. In
this case the clone won't be deleted but it will be linked to the original
and the event listeners won't be copied from the original. When the
original is deleted, its event listeners have to be removed. The event
listeners of the clones also ave to be removed. But because the event
listeners of the original were not copied when cloning, the assertion in
SVGElement::removeEventListener() fires.

Test: svg/custom/use-disallowed-element-clear-corresponding-element.html

* svg/SVGUseElement.cpp:
(WebCore::disassociateAndRemoveClones):

LayoutTests:

* svg/custom/use-disallowed-element-clear-corresponding-element-expected.txt: Added.
* svg/custom/use-disallowed-element-clear-corresponding-element.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGUseElement.cpp


Added Paths

trunk/LayoutTests/svg/custom/use-disallowed-element-clear-corresponding-element-expected.txt
trunk/LayoutTests/svg/custom/use-disallowed-element-clear-corresponding-element.html




Diff

Modified: trunk/LayoutTests/ChangeLog (244275 => 244276)

--- trunk/LayoutTests/ChangeLog	2019-04-15 18:47:38 UTC (rev 244275)
+++ trunk/LayoutTests/ChangeLog	2019-04-15 18:54:21 UTC (rev 244276)
@@ -1,3 +1,13 @@
+2019-04-15  Said Abou-Hallawa  
+
+ASSERT fires when removing a disallowed clone from the shadow tree without reseting its corresponding element
+https://bugs.webkit.org/show_bug.cgi?id=196895
+
+Reviewed by Darin Adler.
+
+* svg/custom/use-disallowed-element-clear-corresponding-element-expected.txt: Added.
+* svg/custom/use-disallowed-element-clear-corresponding-element.html: Added.
+
 2019-04-15  Devin Rousso  
 
 Web Inspector: DOMDebugger: "Attribute Modified" breakpoints pause after the modification occurs for the style attribute


Added: trunk/LayoutTests/svg/custom/use-disallowed-element-clear-corresponding-element-expected.txt (0 => 244276)

--- trunk/LayoutTests/svg/custom/use-disallowed-element-clear-corresponding-element-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/custom/use-disallowed-element-clear-corresponding-element-expected.txt	2019-04-15 18:54:21 UTC (rev 244276)
@@ -0,0 +1,3 @@
+Test passes if it does not assert in debug builds.
+
+


Added: trunk/LayoutTests/svg/custom/use-disallowed-element-clear-corresponding-element.html (0 => 244276)

--- trunk/LayoutTests/svg/custom/use-disallowed-element-clear-corresponding-element.html	(rev 0)
+++ trunk/LayoutTests/svg/custom/use-disallowed-element-clear-corresponding-element.html	2019-04-15 18:54:21 UTC (rev 244276)
@@ -0,0 +1,25 @@
+
+Test passes if it does not assert in debug builds.
+
+
+
+
+
+
+
+
+
+
+if (window.testRunner)
+testRunner.dumpAsText();
+window.addEventListener('load', function() {
+var svgPattern2 = document.getElementById("svg-pattern-2");
+var shadow = document.getElementById("shadow");
+svgPattern2.after(shadow);
+}, false);
+
+


Modified: trunk/Source/WebCore/ChangeLog (244275 => 244276)

--- trunk/Source/WebCore/ChangeLog	2019-04-15 18:47:38 UTC (rev 244275)
+++ trunk/Source/WebCore/ChangeLog	2019-04-15 18:54:21 UTC (rev 244276)
@@ -1,3 +1,31 @@
+2019-04-15  Said Abou-Hallawa  
+
+ASSERT fires when removing a disallowed clone from the shadow tree without reseting its corresponding element
+https://bugs.webkit.org/show_bug.cgi?id=196895
+
+Reviewed by Darin Adler.
+
+When cloning elements to the shadow tree of an SVGUseElement, the
+corresponding element links are set from the clones to the originals.
+Later some of the elements may be disallowed to exist in the shadow tree.
+For example the SVGPatternElement is disallowed and has to be removed 
+even after cloning. The problem is the cor

[webkit-changes] [245469] trunk

[said]

Title: [245469] trunk








Revision 245469
Author s...@apple.com
Date 2019-05-17 10:26:05 -0700 (Fri, 17 May 2019)


Log Message
SVGElement should detach itself from all its properties before it is deleted
https://bugs.webkit.org/show_bug.cgi?id=197954

Reviewed by Simon Fraser.

Source/WebCore:

Before deleting the SVGElement node, SVGElement::detachAllProperties()
needs to be called. This will make the properties be detached objects
which means no change will be committed unless these properties are
attached to another owner.

Test: svg/dom/svg-properties-detach-change.html

* dom/Node.cpp:
(WebCore::Node::removedLastRef):
* svg/SVGElement.h:
(WebCore::SVGElement::detachAllProperties):

LayoutTests:

* svg/dom/svg-properties-detach-change-expected.txt: Added.
* svg/dom/svg-properties-detach-change.html : Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/dom/Node.cpp
trunk/Source/WebCore/svg/SVGElement.h


Added Paths

trunk/LayoutTests/svg/dom/svg-properties-detach-change-expected.txt
trunk/LayoutTests/svg/dom/svg-properties-detach-change.html




Diff

Modified: trunk/LayoutTests/ChangeLog (245468 => 245469)

--- trunk/LayoutTests/ChangeLog	2019-05-17 17:22:40 UTC (rev 245468)
+++ trunk/LayoutTests/ChangeLog	2019-05-17 17:26:05 UTC (rev 245469)
@@ -1,3 +1,13 @@
+2019-05-16  Said Abou-Hallawa  
+
+SVGElement should detach itself from all its properties before it is deleted
+https://bugs.webkit.org/show_bug.cgi?id=197954
+
+Reviewed by Simon Fraser.
+
+* svg/dom/svg-properties-detach-change-expected.txt: Added.
+* svg/dom/svg-properties-detach-change.html : Added.
+
 2019-05-17  Eric Carlson  
 
 Allow sequential playback of media files when initial playback started with a user gesture


Added: trunk/LayoutTests/svg/dom/svg-properties-detach-change-expected.txt (0 => 245469)

--- trunk/LayoutTests/svg/dom/svg-properties-detach-change-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/dom/svg-properties-detach-change-expected.txt	2019-05-17 17:26:05 UTC (rev 245469)
@@ -0,0 +1,38 @@
+This test verifying changing the values of detached properties - utilizing the properties of SVGRectElement and SVGTextElement
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+Check the SVGLength properties
+PASS x.value is 10
+PASS y.value is 20
+PASS width.value is 100
+PASS height.value is 200
+
+Check the items of the SVGLengthList properties
+PASS xList.getItem(0).value is 10
+PASS yList.getItem(0).value is 20
+PASS dxList.getItem(0).value is 100
+PASS dyList.getItem(0).value is 200
+
+Check the items of the SVGLengthList properties of the SVGTextElement
+PASS text.x.baseVal.getItem(0).value is 100
+PASS text.y.baseVal.getItem(0).value is 200
+PASS text.dx.baseVal.getItem(0).value is 1000
+PASS text.dy.baseVal.getItem(0).value is 2000
+
+Check the SVGLength properties after removing the SVGTextElement
+PASS x.value is 100
+PASS y.value is 200
+PASS width.value is 1000
+PASS height.value is 2000
+
+Check the SVGLength properties after resetting their values
+PASS x.value is 10
+PASS y.value is 20
+PASS width.value is 100
+PASS height.value is 200
+PASS successfullyParsed is true
+
+TEST COMPLETE
+


Added: trunk/LayoutTests/svg/dom/svg-properties-detach-change.html (0 => 245469)

--- trunk/LayoutTests/svg/dom/svg-properties-detach-change.html	(rev 0)
+++ trunk/LayoutTests/svg/dom/svg-properties-detach-change.html	2019-05-17 17:26:05 UTC (rev 245469)
@@ -0,0 +1,94 @@
+
+
+
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("This test verifying changing the values of detached properties - utilizing the properties of SVGRectElement and SVGTextElement");
+
+var x = document.createElementNS("http://www.w3.org/2000/svg", "rect").x.baseVal;
+var y = document.createElementNS("http://www.w3.org/2000/svg", "rect").y.baseVal;
+var width = document.createElementNS("http://www.w3.org/2000/svg", "rect").width.baseVal;
+var height = document.createElementNS("http://www.w3.org/2000/svg", "rect").height.baseVal;
+
+var xList = document.createElementNS("http://www.w3.org/2000/svg", "text").x.baseVal;
+var yList = document.createElementNS("http://www.w3.org/2000/svg", "text").y.baseVal;
+var dxList = document.createElementNS("http://www.w3.org/2000/svg", "text").dx.baseVal;
+var dyList = document.createElementNS("http://www.w3.org/2000/svg", "text").dy.baseVal;
+
+var text = document.createElementNS("http://www.w3.org/2000/svg", "text");
+
+x.newValueSpecifiedUnits(SVGLength.SVG_LENGTHTYPE_NUMBER, 10);
+y.newValueSpecifiedUnits(

[webkit-changes] [246170] trunk

[said]

Title: [246170] trunk








Revision 246170
Author s...@apple.com
Date 2019-06-06 14:56:55 -0700 (Thu, 06 Jun 2019)


Log Message
REGRESSION (r243121): Load event should not be fired while animating the 'externalResourcesRequired' attribute 
https://bugs.webkit.org/show_bug.cgi?id=198576

Reviewed by Simon Fraser.

Source/WebCore:

Firing the load event should only happen when dynamic update changes the
attribute 'externalResourcesRequired'. Animating this attribute should
not fire the load event.

When stopping the animations, applyAnimatedPropertyChange() should be
called first then stopAnimation() is called second. The target element
should know that its svgAttributeChanged() is called because of animating
the attribute. So it can differentiate this case from the dynamic update.

Test: svg/animations/animate-externalResourcesRequired-no-load-event.html

* svg/SVGExternalResourcesRequired.cpp:
(WebCore::SVGExternalResourcesRequired::svgAttributeChanged):
* svg/properties/SVGAnimatedPropertyAnimator.h:

LayoutTests:

* svg/animations/animate-externalResourcesRequired-no-load-event-expected.txt: Added.
* svg/animations/animate-externalResourcesRequired-no-load-event.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGExternalResourcesRequired.cpp
trunk/Source/WebCore/svg/properties/SVGAnimatedPropertyAnimator.h


Added Paths

trunk/LayoutTests/svg/animations/animate-externalResourcesRequired-no-load-event-expected.txt
trunk/LayoutTests/svg/animations/animate-externalResourcesRequired-no-load-event.html




Diff

Modified: trunk/LayoutTests/ChangeLog (246169 => 246170)

--- trunk/LayoutTests/ChangeLog	2019-06-06 20:23:51 UTC (rev 246169)
+++ trunk/LayoutTests/ChangeLog	2019-06-06 21:56:55 UTC (rev 246170)
@@ -1,3 +1,14 @@
+2019-06-05  Said Abou-Hallawa  
+
+REGRESSION (r243121): Load event should not be fired while animating the 'externalResourcesRequired' attribute 
+https://bugs.webkit.org/show_bug.cgi?id=198576
+
+Reviewed by Simon Fraser.
+
+* svg/animations/animate-externalResourcesRequired-no-load-event-expected.txt: Added.
+* svg/animations/animate-externalResourcesRequired-no-load-event.html: Added.
+
+2019-06-04  Takashi Komori  
 2019-06-06  Antoine Quint  
 
 Restrict fast clicks everywhere to desktop content mode


Added: trunk/LayoutTests/svg/animations/animate-externalResourcesRequired-no-load-event-expected.txt (0 => 246170)

--- trunk/LayoutTests/svg/animations/animate-externalResourcesRequired-no-load-event-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/animations/animate-externalResourcesRequired-no-load-event-expected.txt	2019-06-06 21:56:55 UTC (rev 246170)
@@ -0,0 +1,3 @@
+Test passes if it does not assert in debug builds.
+
+


Added: trunk/LayoutTests/svg/animations/animate-externalResourcesRequired-no-load-event.html (0 => 246170)

--- trunk/LayoutTests/svg/animations/animate-externalResourcesRequired-no-load-event.html	(rev 0)
+++ trunk/LayoutTests/svg/animations/animate-externalResourcesRequired-no-load-event.html	2019-06-06 21:56:55 UTC (rev 246170)
@@ -0,0 +1,24 @@
+
+Test passes if it does not assert in debug builds.
+
+
+
+
+
+
+
+if (window.testRunner) {
+testRunner.dumpAsText();
+testRunner.waitUntilDone();
+}
+
+svg.addEventListener("load", () => {
+select.add(option);
+});
+
+set.addEventListener("endEvent", () => {
+if (window.testRunner)
+testRunner.notifyDone();
+});
+
+


Modified: trunk/Source/WebCore/ChangeLog (246169 => 246170)

--- trunk/Source/WebCore/ChangeLog	2019-06-06 20:23:51 UTC (rev 246169)
+++ trunk/Source/WebCore/ChangeLog	2019-06-06 21:56:55 UTC (rev 246170)
@@ -1,3 +1,26 @@
+2019-06-05  Said Abou-Hallawa  
+
+REGRESSION (r243121): Load event should not be fired while animating the 'externalResourcesRequired' attribute 
+https://bugs.webkit.org/show_bug.cgi?id=198576
+
+Reviewed by Simon Fraser.
+
+Firing the load event should only happen when dynamic update changes the
+attribute 'externalResourcesRequired'. Animating this attribute should
+not fire the load event.
+
+When stopping the animations, applyAnimatedPropertyChange() should be
+called first then stopAnimation() is called second. The target element
+should know that its svgAttributeChanged() is called because of animating
+the attribute. So it can differentiate this case from the dynamic update.
+
+Test: svg/animations/animate-externalResourcesRequired-no-load-event.html
+
+* svg/SVGExternalResourcesRequired.cpp:
+(WebCore::SVGExternalResourcesRequired::svgAttributeChanged):
+* svg/properties/SVGAnimatedPropertyAnimator.h:
+

[webkit-changes] [245292] trunk/LayoutTests

[said]

Title: [245292] trunk/LayoutTests








Revision 245292
Author s...@apple.com
Date 2019-05-14 11:27:14 -0700 (Tue, 14 May 2019)


Log Message
Unreviewed: fix test failures after r245280.

* platform/mac-wk2/TestExpectations:
Animating HEICS images is supported only on post macOS Mojave. So these
tests should be skipped in WebKit for now.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/mac-wk2/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (245291 => 245292)

--- trunk/LayoutTests/ChangeLog	2019-05-14 18:11:38 UTC (rev 245291)
+++ trunk/LayoutTests/ChangeLog	2019-05-14 18:27:14 UTC (rev 245292)
@@ -1,3 +1,11 @@
+2019-05-14  Said Abou-Hallawa  
+
+Unreviewed: fix test failures after r245280.
+
+* platform/mac-wk2/TestExpectations:
+Animating HEICS images is supported only on post macOS Mojave. So these
+tests should be skipped in WebKit for now.
+
 2019-05-14  Youenn Fablet  
 
 Video frame resizing should be using Trim


Modified: trunk/LayoutTests/platform/mac-wk2/TestExpectations (245291 => 245292)

--- trunk/LayoutTests/platform/mac-wk2/TestExpectations	2019-05-14 18:11:38 UTC (rev 245291)
+++ trunk/LayoutTests/platform/mac-wk2/TestExpectations	2019-05-14 18:27:14 UTC (rev 245292)
@@ -83,9 +83,6 @@
 
 fast/animation/request-animation-frame-in-two-pages.html [ Pass ]
 
-[ Mojave+ ] fast/images/animated-heics-draw.html [ Pass ]
-[ Mojave+ ] fast/images/animated-heics-verify.html [ Pass ]
-
 #//
 # End platform-specific directories.
 #//






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [247121] trunk/Source/WebCore

[said]

Title: [247121] trunk/Source/WebCore








Revision 247121
Author s...@apple.com
Date 2019-07-03 17:49:01 -0700 (Wed, 03 Jul 2019)


Log Message
The destructor of CSSAnimationControllerPrivate must explicitly clear the composite animations
https://bugs.webkit.org/show_bug.cgi?id=199415

Reviewed by Simon Fraser.

After the destructor of CSSAnimationControllerPrivate exists, the non
static members are deleted. When the HashMap m_compositeAnimations is
deleted, its entries are deleted. The destructor of CompositeAnimation
calls the method CSSAnimationControllerPrivate::animationWillBeRemoved()
back through its back reference m_animationController. The non static
members of CSSAnimationControllerPrivate are being deleted and it is
incorrect to try to use any of these members after exiting the destructor.

We need to explicitly clear the composite animations before exiting the 
destructor of CSSAnimationControllerPrivate.

* page/animation/CSSAnimationController.cpp:
(WebCore::CSSAnimationControllerPrivate::~CSSAnimationControllerPrivate):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/page/animation/CSSAnimationController.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (247120 => 247121)

--- trunk/Source/WebCore/ChangeLog	2019-07-04 00:42:30 UTC (rev 247120)
+++ trunk/Source/WebCore/ChangeLog	2019-07-04 00:49:01 UTC (rev 247121)
@@ -1,3 +1,24 @@
+2019-07-03  Said Abou-Hallawa  
+
+The destructor of CSSAnimationControllerPrivate must explicitly clear the composite animations
+https://bugs.webkit.org/show_bug.cgi?id=199415
+
+Reviewed by Simon Fraser.
+
+After the destructor of CSSAnimationControllerPrivate exists, the non
+static members are deleted. When the HashMap m_compositeAnimations is
+deleted, its entries are deleted. The destructor of CompositeAnimation
+calls the method CSSAnimationControllerPrivate::animationWillBeRemoved()
+back through its back reference m_animationController. The non static
+members of CSSAnimationControllerPrivate are being deleted and it is
+incorrect to try to use any of these members after exiting the destructor.
+
+We need to explicitly clear the composite animations before exiting the 
+destructor of CSSAnimationControllerPrivate.
+
+* page/animation/CSSAnimationController.cpp:
+(WebCore::CSSAnimationControllerPrivate::~CSSAnimationControllerPrivate):
+
 2019-07-03  Jer Noble  
 
 HTMLMediaElement can hold onto display sleep assertion while process is suspended.


Modified: trunk/Source/WebCore/page/animation/CSSAnimationController.cpp (247120 => 247121)

--- trunk/Source/WebCore/page/animation/CSSAnimationController.cpp	2019-07-04 00:42:30 UTC (rev 247120)
+++ trunk/Source/WebCore/page/animation/CSSAnimationController.cpp	2019-07-04 00:49:01 UTC (rev 247121)
@@ -78,7 +78,12 @@
 {
 }
 
-CSSAnimationControllerPrivate::~CSSAnimationControllerPrivate() = default;
+CSSAnimationControllerPrivate::~CSSAnimationControllerPrivate()
+{
+// We need to explicitly clear the composite animations here because the
+// destructor of CompositeAnimation will call members of this class back.
+m_compositeAnimations.clear();
+}
 
 CompositeAnimation& CSSAnimationControllerPrivate::ensureCompositeAnimation(Element& element)
 {






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [244491] trunk

[said]

Title: [244491] trunk








Revision 244491
Author s...@apple.com
Date 2019-04-20 17:03:44 -0700 (Sat, 20 Apr 2019)


Log Message
REGRESSION (r243137): SVGViewElement.viewTarget should not return a new object
https://bugs.webkit.org/show_bug.cgi?id=197137

Reviewed by Darin Adler.

Source/WebCore:

All the DOM objects accessing the viewTarget of the same SVGViewElement
should hold a Ref pointer to the same SVGStringList property.

Test: svg/dom/SVGViewElement-viewTarget.html

* svg/SVGViewElement.idl:

LayoutTests:

* svg/dom/SVGViewElement-viewTarget-expected.txt: Added.
* svg/dom/SVGViewElement-viewTarget.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGViewElement.idl


Added Paths

trunk/LayoutTests/svg/dom/SVGViewElement-viewTarget-expected.txt
trunk/LayoutTests/svg/dom/SVGViewElement-viewTarget.html




Diff

Modified: trunk/LayoutTests/ChangeLog (244490 => 244491)

--- trunk/LayoutTests/ChangeLog	2019-04-20 23:46:25 UTC (rev 244490)
+++ trunk/LayoutTests/ChangeLog	2019-04-21 00:03:44 UTC (rev 244491)
@@ -1,3 +1,13 @@
+2019-04-20  Said Abou-Hallawa  
+
+REGRESSION (r243137): SVGViewElement.viewTarget should not return a new object
+https://bugs.webkit.org/show_bug.cgi?id=197137
+
+Reviewed by Darin Adler.
+
+* svg/dom/SVGViewElement-viewTarget-expected.txt: Added.
+* svg/dom/SVGViewElement-viewTarget.html: Added.
+
 2019-04-19  Megan Gardner  
 
 Fix Long Press Image Test


Added: trunk/LayoutTests/svg/dom/SVGViewElement-viewTarget-expected.txt (0 => 244491)

--- trunk/LayoutTests/svg/dom/SVGViewElement-viewTarget-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/dom/SVGViewElement-viewTarget-expected.txt	2019-04-21 00:03:44 UTC (rev 244491)
@@ -0,0 +1,23 @@
+This test checks the SVGStringList API - utilizing the viewTarget property of SVGViewElement
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+
+Check initial viewTarget value
+PASS viewElement.viewTarget.toString() is "[object SVGStringList]"
+PASS viewElement.viewTarget.numberOfItems is 1
+PASS viewElement.viewTarget.getItem(0) is "rect-view"
+
+Check the uniqueness of viewTarget per SVGViewElement
+PASS viewElement.viewTarget is viewTarget
+PASS viewTarget.getItem(0) is "rect-view"
+
+Check modifying viewTarget
+PASS viewTarget.replaceItem('circle-view', 0) is "circle-view"
+PASS viewElement.viewTarget.getItem(0) is "circle-view"
+PASS viewElement.getAttribute('viewTarget') is "circle-view"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+


Added: trunk/LayoutTests/svg/dom/SVGViewElement-viewTarget.html (0 => 244491)

--- trunk/LayoutTests/svg/dom/SVGViewElement-viewTarget.html	(rev 0)
+++ trunk/LayoutTests/svg/dom/SVGViewElement-viewTarget.html	2019-04-21 00:03:44 UTC (rev 244491)
@@ -0,0 +1,36 @@
+
+
+
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("This test checks the SVGStringList API - utilizing the viewTarget property of SVGViewElement");
+
+var viewElement = document.createElementNS("http://www.w3.org/2000/svg", "view");
+viewElement.setAttribute("viewTarget", "rect-view");
+
+debug("");
+debug("Check initial viewTarget value");
+shouldBeEqualToString("viewElement.viewTarget.toString()", "[object SVGStringList]");
+shouldBe("viewElement.viewTarget.numberOfItems", "1");
+shouldBeEqualToString("viewElement.viewTarget.getItem(0)", "rect-view");
+
+var viewTarget = viewElement.viewTarget;
+debug("");
+debug("Check the uniqueness of viewTarget per SVGViewElement");
+shouldBe("viewElement.viewTarget", "viewTarget");
+shouldBeEqualToString("viewTarget.getItem(0)", "rect-view");
+
+debug("");
+debug("Check modifying viewTarget");
+shouldBeEqualToString("viewTarget.replaceItem('circle-view', 0)", "circle-view");
+shouldBeEqualToString("viewElement.viewTarget.getItem(0)", "circle-view");
+shouldBeEqualToString("viewElement.getAttribute('viewTarget')", "circle-view");
+
+successfullyParsed = true;
+
+

[webkit-changes] [244503] trunk/Source/WebCore

[said]

Title: [244503] trunk/Source/WebCore








Revision 244503
Author s...@apple.com
Date 2019-04-22 11:17:33 -0700 (Mon, 22 Apr 2019)


Log Message
Mark SVGStringList properties '[SameObject]' in the IDL files
Followup to https://bugs.webkit.org/show_bug.cgi?id=197137

Patch by Said Abou-Hallawa  on 2019-04-22
Reviewed by Darin Adler.

The SVG elements do not create tear-off wrappers for SVGStrigList DOM
objects anymore. Instead they return Ref pointers to the same RefCounted
objects. So they should be marked '[SameObject]' in their IDL files.

* svg/SVGTests.idl:
* svg/SVGViewElement.idl:

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGTests.idl
trunk/Source/WebCore/svg/SVGViewElement.idl




Diff

Modified: trunk/Source/WebCore/ChangeLog (244502 => 244503)

--- trunk/Source/WebCore/ChangeLog	2019-04-22 18:03:47 UTC (rev 244502)
+++ trunk/Source/WebCore/ChangeLog	2019-04-22 18:17:33 UTC (rev 244503)
@@ -1,3 +1,17 @@
+2019-04-22  Said Abou-Hallawa  
+
+Mark SVGStringList properties '[SameObject]' in the IDL files
+Followup to https://bugs.webkit.org/show_bug.cgi?id=197137
+
+Reviewed by Darin Adler.
+
+The SVG elements do not create tear-off wrappers for SVGStrigList DOM
+objects anymore. Instead they return Ref pointers to the same RefCounted
+objects. So they should be marked '[SameObject]' in their IDL files.
+
+* svg/SVGTests.idl:
+* svg/SVGViewElement.idl:
+
 2019-04-22  Commit Queue  
 
 Unreviewed, rolling out r244495.


Modified: trunk/Source/WebCore/svg/SVGTests.idl (244502 => 244503)

--- trunk/Source/WebCore/svg/SVGTests.idl	2019-04-22 18:03:47 UTC (rev 244502)
+++ trunk/Source/WebCore/svg/SVGTests.idl	2019-04-22 18:17:33 UTC (rev 244503)
@@ -28,9 +28,9 @@
 NoInterfaceObject,
 SuppressToJSObject,
 ] interface SVGTests {
-readonly attribute SVGStringList requiredFeatures;
-readonly attribute SVGStringList requiredExtensions;
-readonly attribute SVGStringList systemLanguage;
+[SameObject] readonly attribute SVGStringList requiredFeatures;
+[SameObject] readonly attribute SVGStringList requiredExtensions;
+[SameObject] readonly attribute SVGStringList systemLanguage;
 
 // FIXME: Using "undefined" as default parameter value is wrong.
 boolean hasExtension(optional DOMString extension = "undefined");


Modified: trunk/Source/WebCore/svg/SVGViewElement.idl (244502 => 244503)

--- trunk/Source/WebCore/svg/SVGViewElement.idl	2019-04-22 18:03:47 UTC (rev 244502)
+++ trunk/Source/WebCore/svg/SVGViewElement.idl	2019-04-22 18:17:33 UTC (rev 244503)
@@ -24,7 +24,7 @@
  */
 
 interface SVGViewElement : SVGElement {
-readonly attribute SVGStringList viewTarget;
+[SameObject] readonly attribute SVGStringList viewTarget;
 };
 
 SVGViewElement implements SVGExternalResourcesRequired;






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [249187] trunk/Source/WebCore

[said]

Title: [249187] trunk/Source/WebCore








Revision 249187
Author s...@apple.com
Date 2019-08-27 18:22:37 -0700 (Tue, 27 Aug 2019)


Log Message
Unreviewed. Build fix after r249175.

Fix the condition which generates the declaration of vm in
GenerateGetOwnPropertySlotByIndex.

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateGetOwnPropertySlotByIndex):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm




Diff

Modified: trunk/Source/WebCore/ChangeLog (249186 => 249187)

--- trunk/Source/WebCore/ChangeLog	2019-08-28 00:53:07 UTC (rev 249186)
+++ trunk/Source/WebCore/ChangeLog	2019-08-28 01:22:37 UTC (rev 249187)
@@ -1,3 +1,13 @@
+2019-08-27  Said Abou-Hallawa  
+
+Unreviewed. Build fix after r249175.
+
+Fix the condition which generates the declaration of vm in
+GenerateGetOwnPropertySlotByIndex.
+
+* bindings/scripts/CodeGeneratorJS.pm:
+(GenerateGetOwnPropertySlotByIndex):
+
 2019-08-27  Justin Fan  
 
 [WebGPU] Implement GPUErrors for and relax GPUBuffer validation rules


Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (249186 => 249187)

--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	2019-08-28 00:53:07 UTC (rev 249186)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	2019-08-28 01:22:37 UTC (rev 249187)
@@ -736,7 +736,7 @@
 
 push(@$outputArray, "bool ${className}::getOwnPropertySlotByIndex(JSObject* object, ExecState* state, unsigned index, PropertySlot& slot)\n");
 push(@$outputArray, "{\n");
-if ($namedGetterOperation || $interface->extendedAttributes->{Plugin}) {
+if ($namedGetterOperation || $interface->extendedAttributes->{Plugin} || ($indexedGetterOperation && $indexedGetterOperation->extendedAttributes->{MayThrowException})) {
 push(@$outputArray, "VM& vm = state->vm();\n");
 }
 push(@$outputArray, "auto* thisObject = jsCast<${className}*>(object);\n");






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [249026] trunk

[said]

Title: [249026] trunk








Revision 249026
Author s...@apple.com
Date 2019-08-22 14:13:38 -0700 (Thu, 22 Aug 2019)


Log Message
Crash may happen when an SVG  element references the root  element
https://bugs.webkit.org/show_bug.cgi?id=201014

Reviewed by Ryosuke Niwa.

Source/WebCore:

When an  references an  element as its target image but
this  element is also one of the ancestors of the , the
parent  should not be applied.

Test: svg/filters/filter-image-ref-root.html

* svg/SVGFEImageElement.cpp:
(WebCore::SVGFEImageElement::build const):

LayoutTests:

Ensure the cyclic reference between the  renderer and its
ancestor  root renderer is broken.

* svg/filters/filter-image-ref-root-expected.txt: Added.
* svg/filters/filter-image-ref-root.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGFEImageElement.cpp


Added Paths

trunk/LayoutTests/svg/filters/filter-image-ref-root-expected.txt
trunk/LayoutTests/svg/filters/filter-image-ref-root.html




Diff

Modified: trunk/LayoutTests/ChangeLog (249025 => 249026)

--- trunk/LayoutTests/ChangeLog	2019-08-22 19:25:48 UTC (rev 249025)
+++ trunk/LayoutTests/ChangeLog	2019-08-22 21:13:38 UTC (rev 249026)
@@ -1,3 +1,16 @@
+2019-08-22  Said Abou-Hallawa  
+
+Crash may happen when an SVG  element references the root  element
+https://bugs.webkit.org/show_bug.cgi?id=201014
+
+Reviewed by Ryosuke Niwa.
+
+Ensure the cyclic reference between the  renderer and its
+ancestor  root renderer is broken.
+
+* svg/filters/filter-image-ref-root-expected.txt: Added.
+* svg/filters/filter-image-ref-root.html: Added.
+
 2019-08-22  Tim Horton  
 
 Rebaseline some editing tests after r248974


Added: trunk/LayoutTests/svg/filters/filter-image-ref-root-expected.txt (0 => 249026)

--- trunk/LayoutTests/svg/filters/filter-image-ref-root-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/filters/filter-image-ref-root-expected.txt	2019-08-22 21:13:38 UTC (rev 249026)
@@ -0,0 +1,2 @@
+This test passes if it does not crash.
+


Added: trunk/LayoutTests/svg/filters/filter-image-ref-root.html (0 => 249026)

--- trunk/LayoutTests/svg/filters/filter-image-ref-root.html	(rev 0)
+++ trunk/LayoutTests/svg/filters/filter-image-ref-root.html	2019-08-22 21:13:38 UTC (rev 249026)
@@ -0,0 +1,21 @@
+
+
+::selection {
+background-color: lime;
+}
+
+
+
+
+
+This test passes if it does not crash.
+
+
+if (window.testRunner)
+testRunner.dumpAsText(true);
+window.addEventListener('load', (event) => {
+document.getSelection().setBaseAndExtent(text, 0, text, 1);
+});
+
+


Modified: trunk/Source/WebCore/ChangeLog (249025 => 249026)

--- trunk/Source/WebCore/ChangeLog	2019-08-22 19:25:48 UTC (rev 249025)
+++ trunk/Source/WebCore/ChangeLog	2019-08-22 21:13:38 UTC (rev 249026)
@@ -1,3 +1,19 @@
+2019-08-22  Said Abou-Hallawa  
+
+Crash may happen when an SVG  element references the root  element
+https://bugs.webkit.org/show_bug.cgi?id=201014
+
+Reviewed by Ryosuke Niwa.
+
+When an  references an  element as its target image but
+this  element is also one of the ancestors of the , the
+parent  should not be applied.
+
+Test: svg/filters/filter-image-ref-root.html
+
+* svg/SVGFEImageElement.cpp:
+(WebCore::SVGFEImageElement::build const):
+
 2019-08-22  Ryosuke Niwa  
 
 Make ImageBuffer and SVG's FilterData isoheap'ed


Modified: trunk/Source/WebCore/svg/SVGFEImageElement.cpp (249025 => 249026)

--- trunk/Source/WebCore/svg/SVGFEImageElement.cpp	2019-08-22 19:25:48 UTC (rev 249025)
+++ trunk/Source/WebCore/svg/SVGFEImageElement.cpp	2019-08-22 21:13:38 UTC (rev 249026)
@@ -185,6 +185,11 @@
 {
 if (m_cachedImage)
 return FEImage::createWithImage(filter, m_cachedImage->imageForRenderer(renderer()), preserveAspectRatio());
+
+auto target = SVGURIReference::targetElementFromIRIString(href(), treeScope());
+if (isDescendantOrShadowDescendantOf(target.element.get()))
+return nullptr;
+
 return FEImage::createWithIRIReference(filter, treeScope(), href(), preserveAspectRatio());
 }
 






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [249579] trunk/LayoutTests

[said]

Title: [249579] trunk/LayoutTests








Revision 249579
Author s...@apple.com
Date 2019-09-06 10:16:27 -0700 (Fri, 06 Sep 2019)


Log Message
Unreviewed, fix typo in r249216

Also change the  element to be  element so the purpose of 
the test is visible once it is opened.

* svg/custom/href-svg-namespace-animate-target-expected.svg:
* svg/custom/href-svg-namespace-animate-target.svg:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/svg/custom/href-svg-namespace-animate-target-expected.svg
trunk/LayoutTests/svg/custom/href-svg-namespace-animate-target.svg




Diff

Modified: trunk/LayoutTests/ChangeLog (249578 => 249579)

--- trunk/LayoutTests/ChangeLog	2019-09-06 17:04:13 UTC (rev 249578)
+++ trunk/LayoutTests/ChangeLog	2019-09-06 17:16:27 UTC (rev 249579)
@@ -1,3 +1,13 @@
+2019-09-06  Said Abou-Hallawa  
+
+Unreviewed, fix typo in r249216
+
+Also change the  element to be  element so the purpose of 
+the test is visible once it is opened.
+
+* svg/custom/href-svg-namespace-animate-target-expected.svg:
+* svg/custom/href-svg-namespace-animate-target.svg:
+
 2019-09-06  Ryan Haddad  
 
 Unreviewed, rolling out r249566.


Modified: trunk/LayoutTests/svg/custom/href-svg-namespace-animate-target-expected.svg (249578 => 249579)

--- trunk/LayoutTests/svg/custom/href-svg-namespace-animate-target-expected.svg	2019-09-06 17:04:13 UTC (rev 249578)
+++ trunk/LayoutTests/svg/custom/href-svg-namespace-animate-target-expected.svg	2019-09-06 17:16:27 UTC (rev 249579)
@@ -1,4 +1,5 @@
 
-
-
+Verify the XLinkNames namespace is not required before the 'href' attribute of the SVG animate elements.	
+
+
 


Modified: trunk/LayoutTests/svg/custom/href-svg-namespace-animate-target.svg (249578 => 249579)

--- trunk/LayoutTests/svg/custom/href-svg-namespace-animate-target.svg	2019-09-06 17:04:13 UTC (rev 249578)
+++ trunk/LayoutTests/svg/custom/href-svg-namespace-animate-target.svg	2019-09-06 17:16:27 UTC (rev 249579)
@@ -1,7 +1,7 @@
 
-Verify the XLinkNames namespace is not requried before the 'href' attribute of the SVG animate elements.
-
+Verify the XLinkNames namespace is not required before the 'href' attribute of the SVG animate elements.
+
  
-
+
  
 






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [250488] trunk

[said]

Title: [250488] trunk








Revision 250488
Author s...@apple.com
Date 2019-09-28 22:16:58 -0700 (Sat, 28 Sep 2019)


Log Message
Crash when removing the target element while animating its attributes
https://bugs.webkit.org/show_bug.cgi?id=202247

Reviewed by Darin Adler.

Source/WebCore:

If SMIL is animating a CSS attribute, there is a chance the animation is
ended while it is being started or progressed. For that reason, the member
SVGAnimateElementBase::m_animator has to be made RefPtr and it has to be
be protected in resetAnimatedType() and calculateAnimatedValue().

While SMILTimeContainer::updateAnimations() is calling progress() for the
scheduled animation elements, SMILTimeContainer::unschedule() might get
called if processing an animation causes events to be dispatched. For that
reason we need to copy the scheduled animations Vector before processing
them so we avoid changing the Vector while looping through its items.

Remove the guard SMILTimeContainer::m_preventScheduledAnimationsChanges
which was added in r129670 for debugging purposes. In some situations, 
the scheduled animations map could be modified out from under some of the
functions of SMILTimeContainer.

Test: svg/animations/animate-and-remove-target-element.html

* svg/SVGAnimateElementBase.cpp:
(WebCore::SVGAnimateElementBase::resetAnimatedType):
(WebCore::SVGAnimateElementBase::calculateAnimatedValue):
* svg/SVGAnimateElementBase.h:
* svg/SVGElement.cpp:
(WebCore::SVGElement::createAnimator):
* svg/SVGElement.h:
* svg/animation/SMILTimeContainer.cpp:
(WebCore::SMILTimeContainer::schedule):
(WebCore::SMILTimeContainer::unschedule):
(WebCore::SMILTimeContainer::setElapsed):
(WebCore::SMILTimeContainer::sortByPriority):
(WebCore::SMILTimeContainer::processAnimations):
(WebCore::SMILTimeContainer::processScheduledAnimations):
(WebCore::SMILTimeContainer::updateAnimations):
(WebCore::SMILTimeContainer::~SMILTimeContainer): Deleted.
* svg/animation/SMILTimeContainer.h:
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::calculateNextProgressTime const):
* svg/properties/SVGAnimatedPropertyAccessorImpl.h:
* svg/properties/SVGAnimatedPropertyAnimatorImpl.h:
* svg/properties/SVGAnimatedPropertyPairAccessorImpl.h:
* svg/properties/SVGAnimatedPropertyPairAnimator.h:
* svg/properties/SVGAnimatedPropertyPairAnimatorImpl.h:
* svg/properties/SVGAttributeAnimator.h:
* svg/properties/SVGMemberAccessor.h:
(WebCore::SVGMemberAccessor::createAnimator const):
* svg/properties/SVGPrimitivePropertyAnimator.h:
(WebCore::SVGPrimitivePropertyAnimator::create):
* svg/properties/SVGPropertyAnimatorFactory.h:
(WebCore::SVGPropertyAnimatorFactory::createAnimator):
* svg/properties/SVGPropertyOwnerRegistry.h:
* svg/properties/SVGPropertyRegistry.h:
* svg/properties/SVGValuePropertyAnimatorImpl.h:
* svg/properties/SVGValuePropertyListAnimatorImpl.h:

LayoutTests:

* svg/animations/animate-and-remove-target-element-expected.txt: Added.
* svg/animations/animate-and-remove-target-element.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGAnimateElementBase.cpp
trunk/Source/WebCore/svg/SVGAnimateElementBase.h
trunk/Source/WebCore/svg/SVGElement.cpp
trunk/Source/WebCore/svg/SVGElement.h
trunk/Source/WebCore/svg/animation/SMILTimeContainer.cpp
trunk/Source/WebCore/svg/animation/SMILTimeContainer.h
trunk/Source/WebCore/svg/animation/SVGSMILElement.cpp
trunk/Source/WebCore/svg/properties/SVGAnimatedPropertyAccessorImpl.h
trunk/Source/WebCore/svg/properties/SVGAnimatedPropertyAnimatorImpl.h
trunk/Source/WebCore/svg/properties/SVGAnimatedPropertyPairAccessorImpl.h
trunk/Source/WebCore/svg/properties/SVGAnimatedPropertyPairAnimator.h
trunk/Source/WebCore/svg/properties/SVGAnimatedPropertyPairAnimatorImpl.h
trunk/Source/WebCore/svg/properties/SVGAttributeAnimator.h
trunk/Source/WebCore/svg/properties/SVGMemberAccessor.h
trunk/Source/WebCore/svg/properties/SVGPrimitivePropertyAnimator.h
trunk/Source/WebCore/svg/properties/SVGPropertyAnimatorFactory.h
trunk/Source/WebCore/svg/properties/SVGPropertyOwnerRegistry.h
trunk/Source/WebCore/svg/properties/SVGPropertyRegistry.h
trunk/Source/WebCore/svg/properties/SVGValuePropertyAnimatorImpl.h
trunk/Source/WebCore/svg/properties/SVGValuePropertyListAnimatorImpl.h


Added Paths

trunk/LayoutTests/svg/animations/animate-and-remove-target-element-expected.txt
trunk/LayoutTests/svg/animations/animate-and-remove-target-element.html




Diff

Modified: trunk/LayoutTests/ChangeLog (250487 => 250488)

--- trunk/LayoutTests/ChangeLog	2019-09-29 01:59:27 UTC (rev 250487)
+++ trunk/LayoutTests/ChangeLog	2019-09-29 05:16:58 UTC (rev 250488)
@@ -1,3 +1,13 @@
+2019-09-28  Said Abou-Hallawa  
+
+Crash when removing the target element while animating its attributes
+https://bugs.webkit.org/show_bug.cgi?id=202247
+
+Reviewed by Darin Adler.
+
+* svg/animations/animate-and-remove-target-element-expected.txt: Added.
+* svg/animati

[webkit-changes] [251994] trunk/LayoutTests

[said]

Title: [251994] trunk/LayoutTests








Revision 251994
Author s...@apple.com
Date 2019-11-04 09:23:44 -0800 (Mon, 04 Nov 2019)


Log Message
Flaky Test: imported/w3c/web-platform-tests/svg/text/visualtests/text-inline-size-003-visual.svg
https://bugs.webkit.org/show_bug.cgi?id=203172

Unreviewed Test Gardening.

* TestExpectations:
Mark the test as flaky.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (251993 => 251994)

--- trunk/LayoutTests/ChangeLog	2019-11-04 16:51:22 UTC (rev 251993)
+++ trunk/LayoutTests/ChangeLog	2019-11-04 17:23:44 UTC (rev 251994)
@@ -1,3 +1,13 @@
+2019-11-04  Said Abou-Hallawa  
+
+Flaky Test: imported/w3c/web-platform-tests/svg/text/visualtests/text-inline-size-003-visual.svg
+https://bugs.webkit.org/show_bug.cgi?id=203172
+
+Unreviewed Test Gardening.
+
+* TestExpectations:
+Mark the test as flaky.
+
 2019-11-04  Chris Dumez  
 
 MediaKeySession / WebKitMediaKeySession should not prevent entering the back/forward cache


Modified: trunk/LayoutTests/TestExpectations (251993 => 251994)

--- trunk/LayoutTests/TestExpectations	2019-11-04 16:51:22 UTC (rev 251993)
+++ trunk/LayoutTests/TestExpectations	2019-11-04 17:23:44 UTC (rev 251994)
@@ -1538,6 +1538,8 @@
 webkit.org/b/173154 imported/w3c/web-platform-tests/svg/linking/reftests/use-keyframes.html [ Skip ]
 webkit.org/b/201992 imported/w3c/web-platform-tests/svg/linking/reftests/href-filter-element.html [ Skip ]
 
+webkit.org/b/203172 imported/w3c/web-platform-tests/svg/text/visualtests/text-inline-size-003-visual.svg [ Pass Timeout ]
+
 webkit.org/b/139595 http/tests/xmlhttprequest/workers/abort-exception-assert.html [ Pass Failure Timeout ]
 
 # Debug assertions are tracked as .






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [251957] trunk

[said]

Title: [251957] trunk








Revision 251957
Author s...@apple.com
Date 2019-11-01 17:14:40 -0700 (Fri, 01 Nov 2019)


Log Message
SVG pair properties must be detached from their owner before it's deleted
https://bugs.webkit.org/show_bug.cgi?id=203545

Reviewed by Simon Fraser.

Source/WebCore:

SVGAnimatedPropertyPairAccessor needs to override its detach() method so
each of its pair properties detaches itself from the owner.
SVGPointerMemberAccessor does the same thing but for a single property
which covers all the list properties as well.

Test: svg/custom/pair-properties-detach.html

* svg/properties/SVGAnimatedPropertyPairAccessor.h:

LayoutTests:

* svg/custom/pair-properties-detach-expected.txt: Added.
* svg/custom/pair-properties-detach.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/properties/SVGAnimatedPropertyPairAccessor.h


Added Paths

trunk/LayoutTests/svg/custom/pair-properties-detach-expected.txt
trunk/LayoutTests/svg/custom/pair-properties-detach.html




Diff

Modified: trunk/LayoutTests/ChangeLog (251956 => 251957)

--- trunk/LayoutTests/ChangeLog	2019-11-02 00:13:04 UTC (rev 251956)
+++ trunk/LayoutTests/ChangeLog	2019-11-02 00:14:40 UTC (rev 251957)
@@ -1,3 +1,13 @@
+2019-11-01  Said Abou-Hallawa  
+
+SVG pair properties must be detached from their owner before it's deleted
+https://bugs.webkit.org/show_bug.cgi?id=203545
+
+Reviewed by Simon Fraser.
+
+* svg/custom/pair-properties-detach-expected.txt: Added.
+* svg/custom/pair-properties-detach.html: Added.
+
 2019-11-01  Eric Carlson  
 
 Add experimental TextTrackCue API


Added: trunk/LayoutTests/svg/custom/pair-properties-detach-expected.txt (0 => 251957)

--- trunk/LayoutTests/svg/custom/pair-properties-detach-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/custom/pair-properties-detach-expected.txt	2019-11-02 00:14:40 UTC (rev 251957)
@@ -0,0 +1,13 @@
+This test checks detaching the SVG pair properties from the owner element.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS angle.baseVal.value = 100 is 100
+PASS type.baseVal = SVGMarkerElement.SVG_MARKER_ORIENT_AUTO is SVGMarkerElement.SVG_MARKER_ORIENT_AUTO
+PASS radiusX.baseVal = 100 is 100
+PASS orderX.baseVal = 100 is 100
+PASS successfullyParsed is true
+
+TEST COMPLETE
+


Added: trunk/LayoutTests/svg/custom/pair-properties-detach.html (0 => 251957)

--- trunk/LayoutTests/svg/custom/pair-properties-detach.html	(rev 0)
+++ trunk/LayoutTests/svg/custom/pair-properties-detach.html	2019-11-02 00:14:40 UTC (rev 251957)
@@ -0,0 +1,33 @@
+
+
+
+
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("This test checks detaching the SVG pair properties from the owner element.");
+
+if (window.testRunner) {
+gc = function() { window.GCController.collect() };
+} else if (!window.gc)
+gc = function() { };
+
+var angle = document.createElementNS("http://www.w3.org/2000/svg", "marker").orientAngle;
+var type = document.createElementNS("http://www.w3.org/2000/svg", "marker").orientType;
+var radiusX = document.createElementNS("http://www.w3.org/2000/svg", "feMorphology").radiusX;
+var orderX = document.createElementNS("http://www.w3.org/2000/svg", "feConvolveMatrix").orderX;
+
+gc();
+
+shouldBe("angle.baseVal.value = 100", "100");
+shouldBe("type.baseVal = SVGMarkerElement.SVG_MARKER_ORIENT_AUTO", "SVGMarkerElement.SVG_MARKER_ORIENT_AUTO");
+shouldBe("radiusX.baseVal = 100", "100");
+shouldBe("orderX.baseVal = 100", "100");
+
+successfullyParsed = true;
+
+

[webkit-changes] [256512] trunk

[said]

Title: [256512] trunk








Revision 256512
Author s...@apple.com
Date 2020-02-13 09:11:28 -0800 (Thu, 13 Feb 2020)


Log Message
Unreviewed, rolling out r255158, 255405 and r255486

Caused test flakiness and PLT regression.

Patch by Said Abou-Hallawa  on 2020-02-13

Source/WebCore:

* Headers.cmake:
* WebCore.xcodeproj/project.pbxproj:
* animation/DocumentTimeline.cpp:
(WebCore::DocumentTimeline::updateThrottlingState):
(WebCore::DocumentTimeline::animationInterval const):
* animation/DocumentTimeline.h:
* dom/Document.cpp:
(WebCore::Document::requestAnimationFrame):
(WebCore::Document::updateLastHandledUserGestureTimestamp):
* dom/ScriptedAnimationController.cpp:
(WebCore::ScriptedAnimationController::ScriptedAnimationController):
(WebCore::throttlingReasonToString):
(WebCore::throttlingReasonsToString):
(WebCore::ScriptedAnimationController::addThrottlingReason):
(WebCore::ScriptedAnimationController::removeThrottlingReason):
(WebCore::ScriptedAnimationController::isThrottled const):
(WebCore::ScriptedAnimationController::registerCallback):
(WebCore::ScriptedAnimationController::cancelCallback):
(WebCore::ScriptedAnimationController::serviceRequestAnimationFrameCallbacks):
(WebCore::ScriptedAnimationController::interval const):
(WebCore::ScriptedAnimationController::page const):
(WebCore::ScriptedAnimationController::scheduleAnimation):
(WebCore::ScriptedAnimationController::animationTimerFired):
(WebCore::ScriptedAnimationController::preferredScriptedAnimationInterval const): Deleted.
(WebCore::ScriptedAnimationController::isThrottledRelativeToPage const): Deleted.
(WebCore::ScriptedAnimationController::shouldRescheduleRequestAnimationFrame const): Deleted.
* dom/ScriptedAnimationController.h:
(WebCore::ScriptedAnimationController::addThrottlingReason): Deleted.
(WebCore::ScriptedAnimationController::removeThrottlingReason): Deleted.
* page/FrameView.cpp:
(WebCore::FrameView::updateScriptedAnimationsAndTimersThrottlingState):
* page/Page.cpp:
(WebCore::m_deviceOrientationUpdateProvider):
(WebCore::Page::isLowPowerModeEnabled const):
(WebCore::Page::setLowPowerModeEnabledOverrideForTesting):
(WebCore::updateScriptedAnimationsThrottlingReason):
(WebCore::Page::setIsVisuallyIdleInternal):
(WebCore::Page::handleLowModePowerChange):
(WebCore::Page::renderingUpdateThrottlingEnabled const): Deleted.
(WebCore::Page::renderingUpdateThrottlingEnabledChanged): Deleted.
(WebCore::Page::isRenderingUpdateThrottled const): Deleted.
(WebCore::Page::preferredRenderingUpdateInterval const): Deleted.
* page/Page.h:
(WebCore::Page::isLowPowerModeEnabled const): Deleted.
(WebCore::Page::canUpdateThrottlingReason const): Deleted.
* page/RenderingUpdateScheduler.cpp:
(WebCore::RenderingUpdateScheduler::scheduleTimedRenderingUpdate):
(WebCore::RenderingUpdateScheduler::startTimer):
(WebCore::RenderingUpdateScheduler::adjustFramesPerSecond): Deleted.
(WebCore::RenderingUpdateScheduler::adjustRenderingUpdateFrequency): Deleted.
* page/RenderingUpdateScheduler.h:
* page/Settings.yaml:
* page/SettingsBase.cpp:
(WebCore::SettingsBase::renderingUpdateThrottlingEnabledChanged): Deleted.
* page/SettingsBase.h:
* platform/graphics/AnimationFrameRate.h: Removed.
* platform/graphics/DisplayRefreshMonitor.h:
(WebCore::DisplayRefreshMonitor::setPreferredFramesPerSecond): Deleted.
* platform/graphics/DisplayRefreshMonitorManager.cpp:
(WebCore::DisplayRefreshMonitorManager::createMonitorForClient):
(WebCore::DisplayRefreshMonitorManager::registerClient):
(WebCore::DisplayRefreshMonitorManager::scheduleAnimation):
(WebCore::DisplayRefreshMonitorManager::windowScreenDidChange):
(WebCore::DisplayRefreshMonitorManager::monitorForClient): Deleted.
(WebCore::DisplayRefreshMonitorManager::setPreferredFramesPerSecond): Deleted.
* platform/graphics/DisplayRefreshMonitorManager.h:
(WebCore::DisplayRefreshMonitorManager::DisplayRefreshMonitorManager):
* platform/graphics/GraphicsLayerUpdater.cpp:
(WebCore::GraphicsLayerUpdater::GraphicsLayerUpdater):
* platform/graphics/ios/DisplayRefreshMonitorIOS.mm:
(-[WebDisplayLinkHandler setPreferredFramesPerSecond:]): Deleted.

Source/WebKit:

* Shared/WebPreferences.yaml:
* UIProcess/API/C/WKPreferences.cpp:
(WKPreferencesSetRenderingUpdateThrottlingEnabled): Deleted.
(WKPreferencesGetRenderingUpdateThrottlingEnabled): Deleted.
* UIProcess/API/C/WKPreferencesRefPrivate.h:
* UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.h:
* UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.messages.in:
* UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm:
(-[WKOneShotDisplayLinkHandler setPreferredFramesPerSecond:]): Deleted.
(WebKit::RemoteLayerTreeDrawingAreaProxy::setPreferredFramesPerSecond): Deleted.
* WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDisplayRefreshMonitor.h:
* WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDisplayRefreshMonitor.mm:
(WebKit::RemoteLayerTreeDisplayRefreshMonitor::setPreferredFramesPerSecond): Deleted.
* WebProcess/WebPage/RemoteLayerTree

[webkit-changes] [256463] trunk

[said]

Title: [256463] trunk








Revision 256463
Author s...@apple.com
Date 2020-02-12 11:31:11 -0800 (Wed, 12 Feb 2020)


Log Message
REGRESSION (r255158): http/tests/frame-throttling/raf-throttle-in-cross-origin-subframe.html is a flaky failure
https://bugs.webkit.org/show_bug.cgi?id=206839

Reviewed by Simon Fraser.

Source/WebCore:

Remove the setting 'RenderingUpdateThrottling'. We will disable the
RenderingUpdateThrottling till the first layout happens. Then it will be
enabled for the rest of the page's life. This ensures VisuallyIdle won't
throttle the RenderingUpdate steps before the first paint.

* page/Page.cpp:
(WebCore::Page::renderingUpdateThrottlingEnabled const):
(WebCore::Page::addLayoutMilestones):
(WebCore::Page::renderingUpdateThrottlingEnabledChanged): Deleted.
* page/Page.h:
* page/Settings.yaml:
* page/SettingsBase.cpp:
(WebCore::SettingsBase::renderingUpdateThrottlingEnabledChanged): Deleted.
* page/SettingsBase.h:

Source/WebKit:

Remove the WKPreference key 'RenderingUpdateThrottlingEnabled'.

* Shared/WebPreferences.yaml:
* UIProcess/API/C/WKPreferences.cpp:
(WKPreferencesSetRenderingUpdateThrottlingEnabled): Deleted.
(WKPreferencesGetRenderingUpdateThrottlingEnabled): Deleted.
* UIProcess/API/C/WKPreferencesRefPrivate.h:

Source/WebKitLegacy/mac:

Remove the WKPreference key 'RenderingUpdateThrottlingEnabled'.

* WebView/WebPreferenceKeysPrivate.h:
* WebView/WebPreferences.mm:
(+[WebPreferences initialize]):
(-[WebPreferences renderingUpdateThrottlingEnabled]): Deleted.
(-[WebPreferences setRenderingUpdateThrottlingEnabled:]): Deleted.
* WebView/WebPreferencesPrivate.h:
* WebView/WebView.mm:
(-[WebView _preferencesChanged:]):

Source/WebKitLegacy/win:

Remove the WKPreference key 'RenderingUpdateThrottlingEnabled'.

* Interfaces/IWebPreferencesPrivate.idl:
* WebPreferenceKeysPrivate.h:
* WebPreferences.cpp:
(WebPreferences::initializeDefaultSettings):
(WebPreferences::renderingUpdateThrottlingEnabled): Deleted.
(WebPreferences::setRenderingUpdateThrottlingEnabled): Deleted.
* WebPreferences.h:
* WebView.cpp:
(WebView::notifyPreferencesChanged):

Tools:

Remove the WKPreference key 'RenderingUpdateThrottlingEnabled'.

* DumpRenderTree/mac/DumpRenderTree.mm:
(resetWebPreferencesToConsistentValues):
* DumpRenderTree/win/DumpRenderTree.cpp:
(enableExperimentalFeatures):
* WebKitTestRunner/TestController.cpp:
(WTR::TestController::resetPreferencesToConsistentValues):

LayoutTests:

Remove the setting 'RenderingUpdateThrottling'.

* fast/animation/css-animation-throttling-lowPowerMode.html:
* fast/animation/request-animation-frame-throttle-subframe.html:
* fast/animation/request-animation-frame-throttling-detached-iframe.html:
* fast/animation/request-animation-frame-throttling-lowPowerMode.html:
* fast/animation/request-animation-frame-throttling-outside-viewport.html:
* http/tests/frame-throttling/raf-throttle-in-cross-origin-subframe.html:
* platform/mac-wk2/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/fast/animation/css-animation-throttling-lowPowerMode.html
trunk/LayoutTests/fast/animation/request-animation-frame-throttle-subframe.html
trunk/LayoutTests/fast/animation/request-animation-frame-throttling-detached-iframe.html
trunk/LayoutTests/fast/animation/request-animation-frame-throttling-lowPowerMode.html
trunk/LayoutTests/fast/animation/request-animation-frame-throttling-outside-viewport.html
trunk/LayoutTests/http/tests/frame-throttling/raf-throttle-in-cross-origin-subframe.html
trunk/LayoutTests/platform/mac-wk2/TestExpectations
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/page/Page.cpp
trunk/Source/WebCore/page/Page.h
trunk/Source/WebCore/page/Settings.yaml
trunk/Source/WebCore/page/SettingsBase.cpp
trunk/Source/WebCore/page/SettingsBase.h
trunk/Source/WebKit/ChangeLog
trunk/Source/WebKit/Shared/WebPreferences.yaml
trunk/Source/WebKit/UIProcess/API/C/WKPreferences.cpp
trunk/Source/WebKit/UIProcess/API/C/WKPreferencesRefPrivate.h
trunk/Source/WebKitLegacy/mac/ChangeLog
trunk/Source/WebKitLegacy/mac/WebView/WebPreferenceKeysPrivate.h
trunk/Source/WebKitLegacy/mac/WebView/WebPreferences.mm
trunk/Source/WebKitLegacy/mac/WebView/WebPreferencesPrivate.h
trunk/Source/WebKitLegacy/mac/WebView/WebView.mm
trunk/Source/WebKitLegacy/win/ChangeLog
trunk/Source/WebKitLegacy/win/Interfaces/IWebPreferencesPrivate.idl
trunk/Source/WebKitLegacy/win/WebPreferenceKeysPrivate.h
trunk/Source/WebKitLegacy/win/WebPreferences.cpp
trunk/Source/WebKitLegacy/win/WebPreferences.h
trunk/Source/WebKitLegacy/win/WebView.cpp
trunk/Tools/ChangeLog
trunk/Tools/DumpRenderTree/mac/DumpRenderTree.mm
trunk/Tools/DumpRenderTree/win/DumpRenderTree.cpp
trunk/Tools/WebKitTestRunner/TestController.cpp




Diff

Modified: trunk/LayoutTests/ChangeLog (256462 => 256463)

--- trunk/LayoutTests/ChangeLog	2020-02-12 19:27:04 UTC (rev 256462)
+++ trunk/LayoutTests/ChangeLog	2020-02-12 19:31:11 UTC (rev 256463)
@@ -1,3 +1,20 @@
+2020-02-12  Said Abou-Hallawa  
+
+REGRESS

[webkit-changes] [256526] trunk/LayoutTests

[said]

Title: [256526] trunk/LayoutTests








Revision 256526
Author s...@apple.com
Date 2020-02-13 11:16:41 -0800 (Thu, 13 Feb 2020)


Log Message
WebP image format is not supported
https://bugs.webkit.org/show_bug.cgi?id=192672

Unreviewed test gardening

* platform/mac/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/mac/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (256525 => 256526)

--- trunk/LayoutTests/ChangeLog	2020-02-13 19:10:27 UTC (rev 256525)
+++ trunk/LayoutTests/ChangeLog	2020-02-13 19:16:41 UTC (rev 256526)
@@ -1,3 +1,12 @@
+2020-02-13  Said Abou-Hallawa  
+
+WebP image format is not supported
+https://bugs.webkit.org/show_bug.cgi?id=192672
+
+Unreviewed test gardening
+
+* platform/mac/TestExpectations:
+
 2020-02-13  Jacob Uphoff  
 
 [ iOS ] imported/w3c/IndexedDB-private-browsing/close-in-upgradeneeded.html is flaky timing out


Modified: trunk/LayoutTests/platform/mac/TestExpectations (256525 => 256526)

--- trunk/LayoutTests/platform/mac/TestExpectations	2020-02-13 19:10:27 UTC (rev 256525)
+++ trunk/LayoutTests/platform/mac/TestExpectations	2020-02-13 19:16:41 UTC (rev 256526)
@@ -1789,13 +1789,6 @@
 [ Catalina+ ] fast/images/animated-heics-draw.html [ Pass ]
 [ Catalina+ ] fast/images/animated-heics-verify.html [ Pass ]
 
-# 
-[ Catalina+ ] fast/images/webp-as-image.html [ Pass ]
-[ Catalina+ ] fast/images/animated-webp-as-image.html [ Pass ]
-
-# 
-[ Catalina+ ] fast/images/animated-webp.html [ ImageOnlyFailure ]
-
 # 
 [ Catalina+ ] fast/text/font-collection.html [ ImageOnlyFailure ]
 [ Catalina+ ] fast/text/woff2.html [ ImageOnlyFailure ]






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [256192] trunk

[said]

Title: [256192] trunk








Revision 256192
Author s...@apple.com
Date 2020-02-10 10:21:56 -0800 (Mon, 10 Feb 2020)


Log Message
Unreachable code hit in WebCore::Shape::createShape
https://bugs.webkit.org/show_bug.cgi?id=207399

Reviewed by Darin Adler.

Source/WebCore:

CSS parser should not consume the 'shape-outside' property with type 'path' 
since it has not been implemented yet. This will prevent an assertion in
the debug build and null dref in the release build.

Test: css3/shapes/shape-outside-path-no-crash.html

* css/parser/CSSPropertyParser.cpp:
(WebCore::consumeBasicShape):
(WebCore::consumeShapeOutside):

LayoutTests:

* css3/shapes/shape-outside-path-no-crash-expected.txt: Added.
* css3/shapes/shape-outside-path-no-crash.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/css/parser/CSSPropertyParser.cpp


Added Paths

trunk/LayoutTests/css3/shapes/shape-outside-path-no-crash-expected.txt
trunk/LayoutTests/css3/shapes/shape-outside-path-no-crash.html




Diff

Modified: trunk/LayoutTests/ChangeLog (256191 => 256192)

--- trunk/LayoutTests/ChangeLog	2020-02-10 18:16:49 UTC (rev 256191)
+++ trunk/LayoutTests/ChangeLog	2020-02-10 18:21:56 UTC (rev 256192)
@@ -1,3 +1,13 @@
+2020-02-10  Said Abou-Hallawa  
+
+Unreachable code hit in WebCore::Shape::createShape
+https://bugs.webkit.org/show_bug.cgi?id=207399
+
+Reviewed by Darin Adler.
+
+* css3/shapes/shape-outside-path-no-crash-expected.txt: Added.
+* css3/shapes/shape-outside-path-no-crash.html: Added.
+
 2020-02-10  Daniel Bates  
 
 Disallow setting base URL to a data or _javascript_ URL


Added: trunk/LayoutTests/css3/shapes/shape-outside-path-no-crash-expected.txt (0 => 256192)

--- trunk/LayoutTests/css3/shapes/shape-outside-path-no-crash-expected.txt	(rev 0)
+++ trunk/LayoutTests/css3/shapes/shape-outside-path-no-crash-expected.txt	2020-02-10 18:21:56 UTC (rev 256192)
@@ -0,0 +1 @@
+Pass if there is no crash or assert.


Added: trunk/LayoutTests/css3/shapes/shape-outside-path-no-crash.html (0 => 256192)

--- trunk/LayoutTests/css3/shapes/shape-outside-path-no-crash.html	(rev 0)
+++ trunk/LayoutTests/css3/shapes/shape-outside-path-no-crash.html	2020-02-10 18:21:56 UTC (rev 256192)
@@ -0,0 +1,13 @@
+
+.box { 
+shape-outside: path("M 0 0 L 200 200 0 200 z");
+float: left;
+}
+
+
+Pass if there is no crash or assert.
+
+if (window.testRunner)
+testRunner.dumpAsText();
+
+


Modified: trunk/Source/WebCore/ChangeLog (256191 => 256192)

--- trunk/Source/WebCore/ChangeLog	2020-02-10 18:16:49 UTC (rev 256191)
+++ trunk/Source/WebCore/ChangeLog	2020-02-10 18:21:56 UTC (rev 256192)
@@ -1,3 +1,20 @@
+2020-02-10  Said Abou-Hallawa  
+
+Unreachable code hit in WebCore::Shape::createShape
+https://bugs.webkit.org/show_bug.cgi?id=207399
+
+Reviewed by Darin Adler.
+
+CSS parser should not consume the 'shape-outside' property with type 'path' 
+since it has not been implemented yet. This will prevent an assertion in
+the debug build and null dref in the release build.
+
+Test: css3/shapes/shape-outside-path-no-crash.html
+
+* css/parser/CSSPropertyParser.cpp:
+(WebCore::consumeBasicShape):
+(WebCore::consumeShapeOutside):
+
 2020-02-10  Daniel Bates  
 
 Disallow setting base URL to a data or _javascript_ URL


Modified: trunk/Source/WebCore/css/parser/CSSPropertyParser.cpp (256191 => 256192)

--- trunk/Source/WebCore/css/parser/CSSPropertyParser.cpp	2020-02-10 18:16:49 UTC (rev 256191)
+++ trunk/Source/WebCore/css/parser/CSSPropertyParser.cpp	2020-02-10 18:21:56 UTC (rev 256192)
@@ -2544,9 +2544,8 @@
 return shape;
 }
 
-static RefPtr consumeBasicShape(CSSParserTokenRange& range, const CSSParserContext& context)
+static RefPtr consumeBasicShape(CSSParserTokenRange& range, const CSSParserContext& context)
 {
-RefPtr result;
 if (range.peek().type() != FunctionToken)
 return nullptr;
 CSSValueID id = range.peek().functionId();
@@ -2616,7 +2615,9 @@
 RefPtr list = CSSValueList::createSpaceSeparated();
 if (RefPtr boxValue = consumeIdent(range))
 list->append(boxValue.releaseNonNull());
-if (RefPtr shapeValue = consumeBasicShape(range, context)) {
+if (RefPtr shapeValue = consumeBasicShape(range, context)) {
+if (shapeValue->shapeValue()->type() == CSSBasicShapeCircle::CSSBasicShapePathType)
+return nullptr;
 list->append(shapeValue.releaseNonNull());
 if (list->length() < 2) {
 if (RefPtr boxValue = consumeIdent(range))






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [260120] trunk/Source/WebKit

[said]

Title: [260120] trunk/Source/WebKit








Revision 260120
Author s...@apple.com
Date 2020-04-15 01:53:39 -0700 (Wed, 15 Apr 2020)


Log Message
Unreviewed, reverting r259891.

Causes significant iOS MotionMark regression

Reverted changeset:

"Switch unused IOKit classes from allow-with-report to deny-
with-report"
https://bugs.webkit.org/show_bug.cgi?id=210136
https://trac.webkit.org/changeset/259891

Modified Paths

trunk/Source/WebKit/ChangeLog
trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb
trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in




Diff

Modified: trunk/Source/WebKit/ChangeLog (260119 => 260120)

--- trunk/Source/WebKit/ChangeLog	2020-04-15 07:02:55 UTC (rev 260119)
+++ trunk/Source/WebKit/ChangeLog	2020-04-15 08:53:39 UTC (rev 260120)
@@ -1,3 +1,16 @@
+2020-04-15  Said Abou-Hallawa  
+
+Unreviewed, reverting r259891.
+
+Causes significant iOS MotionMark regression
+
+Reverted changeset:
+
+"Switch unused IOKit classes from allow-with-report to deny-
+with-report"
+https://bugs.webkit.org/show_bug.cgi?id=210136
+https://trac.webkit.org/changeset/259891
+
 2020-04-14  Megan Gardner  
 
 File Upload Menus presented from odd locations.


Modified: trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb (260119 => 260120)

--- trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb	2020-04-15 07:02:55 UTC (rev 260119)
+++ trunk/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb	2020-04-15 08:53:39 UTC (rev 260120)
@@ -214,7 +214,7 @@
 ;;;
 (define-once (opengl)
 ;; Items not seen in testing
-(deny iokit-open (with telemetry-backtrace)
+(allow iokit-open (with report) (with telemetry)
(iokit-connection "IOGPU")
(iokit-user-client-class
 "AGXCommandQueue"
@@ -374,7 +374,9 @@
 (allow mach-lookup
 (global-name "com.apple.CARenderServer"))
 
-(deny iokit-open (with telemetry-backtrace)
+; UIKit-required IOKit nodes.
+(allow iokit-open  (with report) (with telemetry)
+(iokit-user-client-class "AppleJPEGDriverUserClient")
 (iokit-user-client-class "IOSurfaceSendRight")
 )
 


Modified: trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in (260119 => 260120)

--- trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in	2020-04-15 07:02:55 UTC (rev 260119)
+++ trunk/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in	2020-04-15 08:53:39 UTC (rev 260120)
@@ -120,13 +120,17 @@
 (iokit-registry-entry-class "IOAccelerationUserClient")
 (iokit-registry-entry-class "IOSurfaceRootUserClient")
 (iokit-registry-entry-class "IOSurfaceSendRight"))
-#if __MAC_OS_X_VERSION_MIN_REQUIRED < 101600
 ;; CoreVideo CVCGDisplayLink
 (allow iokit-open
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101500
+(with report) (with telemetry)
+#endif
 (iokit-registry-entry-class "IOFramebufferSharedUserClient"))
-#endif
 ;; H.264 Acceleration
 (allow iokit-open
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101500
+(with report) (with telemetry)
+#endif
 (iokit-registry-entry-class "AppleIntelMEUserClient")
 (iokit-registry-entry-class "AppleSNBFBUserClient"))
 ;; QuartzCore
@@ -600,30 +604,20 @@
 (allow-read-write-directory-and-issue-read-write-extensions (param "DARWIN_USER_TEMP_DIR")))
 
 ;; IOKit user clients
-#if __MAC_OS_X_VERSION_MIN_REQUIRED < 101600
 (allow iokit-open
-(iokit-user-client-class "AppleMultitouchDeviceUserClient")
-(iokit-user-client-class "IOHIDParamUserClient")
-(iokit-user-client-class "IOAudioControlUserClient")
-(iokit-user-client-class "IOAudioEngineUserClient")
-)
+#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101500
+(with report) (with telemetry)
 #endif
-
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101600
-(deny iokit-open
-(with send-signal SIGKILL)
 (iokit-user-client-class "AppleMultitouchDeviceUserClient")
 (iokit-user-client-class "IOHIDParamUserClient")
 (iokit-user-client-class "IOAudioControlUserClient")
 (iokit-user-client-class "IOAudioEngineUserClient")
-(iokit-registry-entry-class "IOFramebufferSharedUserClient")
-)
-#endif
+;; Following is needed due to  && 
+(iokit-user-client-class "AudioAUUC"))
 
 (allow iokit-open
 (iokit-user-client-class "AppleUpstreamUserClient")
 (iokit-user-client-class "RootDomainUserClient") ;; Needed by WebCore::PerformanceMonitor
-(iokit-user-client-class "AudioAUUC") ;;  && 
 )
 
 ;; cookied.
@@ -723,9 +717,6 @@
 
 ;; Needed to support e

[webkit-changes] [258459] trunk

[said]

Title: [258459] trunk








Revision 258459
Author s...@apple.com
Date 2020-03-13 20:11:34 -0700 (Fri, 13 Mar 2020)


Log Message
SVGMatrix should have the access right of its owner SVGTransform always
https://bugs.webkit.org/show_bug.cgi?id=207462

Reviewed by Simon Fraser.

Source/WebCore:

The SVGMatrix needs to be reattached to its owner SVGTransform when the
access right of this owner changes. The access right of the owner changes
when it gets attached to or detached from a higher level owner.

Test: svg/dom/SVGTransformList-anim-read-only.html

* svg/SVGTransform.h:
* svg/properties/SVGProperty.h:
(WebCore::SVGProperty::attach):
(WebCore::SVGProperty::detach):
(WebCore::SVGProperty::reattach):

LayoutTests:

* svg/dom/SVGTransformList-anim-read-only-expected.txt: Added.
* svg/dom/SVGTransformList-anim-read-only.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/svg/SVGTransform.h
trunk/Source/WebCore/svg/properties/SVGProperty.h


Added Paths

trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only-expected.txt
trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only.html




Diff

Modified: trunk/LayoutTests/ChangeLog (258458 => 258459)

--- trunk/LayoutTests/ChangeLog	2020-03-14 02:10:54 UTC (rev 258458)
+++ trunk/LayoutTests/ChangeLog	2020-03-14 03:11:34 UTC (rev 258459)
@@ -1,3 +1,13 @@
+2020-03-13  Said Abou-Hallawa  
+
+SVGMatrix should have the access right of its owner SVGTransform always
+https://bugs.webkit.org/show_bug.cgi?id=207462
+
+Reviewed by Simon Fraser.
+
+* svg/dom/SVGTransformList-anim-read-only-expected.txt: Added.
+* svg/dom/SVGTransformList-anim-read-only.html: Added.
+
 2020-03-13  Zalan Bujtas  
 
 [Tree building] Block::attachIgnoringContinuation should allow inline tables as before child container


Added: trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only-expected.txt (0 => 258459)

--- trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only-expected.txt	(rev 0)
+++ trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only-expected.txt	2020-03-14 03:11:34 UTC (rev 258459)
@@ -0,0 +1,28 @@
+This test checks the read-only property of SVGTransformList.animVal
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+
+Check SVGAnimatedTransformList.animVal is a readonly SVGTransformList
+PASS transformAnim.appendItem(t) threw exception NoModificationAllowedError: The object can not be modified..
+PASS transformAnim.clear() threw exception NoModificationAllowedError: The object can not be modified..
+PASS transformAnim.initialize(t) threw exception NoModificationAllowedError: The object can not be modified..
+PASS transformAnim.insertItemBefore(t, 0) threw exception NoModificationAllowedError: The object can not be modified..
+PASS transformAnim.replaceItem(t, 0) threw exception NoModificationAllowedError: The object can not be modified..
+PASS transformAnim.removeItem(0) threw exception NoModificationAllowedError: The object can not be modified..
+PASS transformAnim(0) = t threw exception ReferenceError: Left side of assignment is not a reference..
+
+Check items of SVGAnimatedTransformList.animVal are readonly SVGTransform
+PASS t.setScale(2, 2) threw exception NoModificationAllowedError: The object can not be modified..
+PASS t.setMatrix(m) threw exception NoModificationAllowedError: The object can not be modified..
+PASS m.b = 2 threw exception NoModificationAllowedError: The object can not be modified..
+
+Check detached items from SVGAnimatedTransformList.animVal are not readonly SVGTransform
+PASS t.setScale(2, 2) did not throw exception.
+PASS t.setMatrix(m) did not throw exception.
+PASS m.b = 2 did not throw exception.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+


Added: trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only.html (0 => 258459)

--- trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only.html	(rev 0)
+++ trunk/LayoutTests/svg/dom/SVGTransformList-anim-read-only.html	2020-03-14 03:11:34 UTC (rev 258459)
@@ -0,0 +1,53 @@
+
+
+
+
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("This test checks the read-only property of SVGTransformList.animVal");
+
+var svgElement = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+var rectElement = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+var transformBase = rectElement.transform.baseVal;
+var transformAnim = rectElement.transform.animVal;
+var t = transformBase.createSVGTransformFromMatrix();
+var m = svgElement.createSVGMatrix();
+
+debug("");
+debug("Check SVGAnimatedTransformList.animVal is a readonly SVGTransformList");
+shouldThrow("transformAnim.appendI

[webkit-changes] [258993] trunk/LayoutTests

[said]

Title: [258993] trunk/LayoutTests








Revision 258993
Author s...@apple.com
Date 2020-03-25 10:15:12 -0700 (Wed, 25 Mar 2020)


Log Message
Layout Test fast/images/async-image-multiple-clients-repaint.html is flaky
https://bugs.webkit.org/show_bug.cgi?id=202328


Unreviewed test gardening.

Remove flaky expectation for this test since it has been passing on all
Mac and iOS platforms. Make the iOS expected result the same for the 
device and for the simulator.

* platform/ios-simulator/fast/images: Removed.
* platform/ios/TestExpectations:
* platform/ios/fast/images/async-image-multiple-clients-repaint-expected.txt: Added.
* platform/mac-wk1/TestExpectations:
* platform/mac/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/ios/TestExpectations
trunk/LayoutTests/platform/mac/TestExpectations
trunk/LayoutTests/platform/mac-wk1/TestExpectations


Added Paths

trunk/LayoutTests/platform/ios/fast/images/async-image-multiple-clients-repaint-expected.txt


Removed Paths

trunk/LayoutTests/platform/ios-simulator/fast/images/




Diff

Modified: trunk/LayoutTests/ChangeLog (258992 => 258993)

--- trunk/LayoutTests/ChangeLog	2020-03-25 17:07:35 UTC (rev 258992)
+++ trunk/LayoutTests/ChangeLog	2020-03-25 17:15:12 UTC (rev 258993)
@@ -1,3 +1,21 @@
+2020-03-25  Said Abou-Hallawa  
+
+Layout Test fast/images/async-image-multiple-clients-repaint.html is flaky
+https://bugs.webkit.org/show_bug.cgi?id=202328
+
+
+Unreviewed test gardening.
+
+Remove flaky expectation for this test since it has been passing on all
+Mac and iOS platforms. Make the iOS expected result the same for the 
+device and for the simulator.
+
+* platform/ios-simulator/fast/images: Removed.
+* platform/ios/TestExpectations:
+* platform/ios/fast/images/async-image-multiple-clients-repaint-expected.txt: Added.
+* platform/mac-wk1/TestExpectations:
+* platform/mac/TestExpectations:
+
 2020-03-25  Frank Yang  
 
 WebKit uses Alphabetic Baseline when "-webkit-text-orientation" is "mixed" in Vertical Writing Mode


Modified: trunk/LayoutTests/platform/ios/TestExpectations (258992 => 258993)

--- trunk/LayoutTests/platform/ios/TestExpectations	2020-03-25 17:07:35 UTC (rev 258992)
+++ trunk/LayoutTests/platform/ios/TestExpectations	2020-03-25 17:15:12 UTC (rev 258993)
@@ -3301,8 +3301,6 @@
 #  fast/scrolling/ios/body-overflow-hidden.html is an Image failure
 fast/scrolling/ios/body-overflow-hidden.html [ Pass ImageOnlyFailure ]
 
-webkit.org/b/202328 fast/images/async-image-multiple-clients-repaint.html [ Pass Failure ]
-
 # drawFocusRing without keyboard enabled does nothing
 imported/w3c/web-platform-tests/2dcontext/drawing-paths-to-the-canvas/drawFocusIfNeeded_001.html [ Skip ]
 imported/w3c/web-platform-tests/2dcontext/drawing-paths-to-the-canvas/drawFocusIfNeeded_002.html [ Skip ]


Added: trunk/LayoutTests/platform/ios/fast/images/async-image-multiple-clients-repaint-expected.txt (0 => 258993)

--- trunk/LayoutTests/platform/ios/fast/images/async-image-multiple-clients-repaint-expected.txt	(rev 0)
+++ trunk/LayoutTests/platform/ios/fast/images/async-image-multiple-clients-repaint-expected.txt	2020-03-25 17:15:12 UTC (rev 258993)
@@ -0,0 +1,10 @@
+
+
+(repaint rects
+  (rect 8 348 200 100)
+  (rect 8 348 200 100)
+  (rect 8 348 200 100)
+  (rect 8 348 200 100)
+  (rect 8 348 200 100)
+)
+


Modified: trunk/LayoutTests/platform/mac/TestExpectations (258992 => 258993)

--- trunk/LayoutTests/platform/mac/TestExpectations	2020-03-25 17:07:35 UTC (rev 258992)
+++ trunk/LayoutTests/platform/mac/TestExpectations	2020-03-25 17:15:12 UTC (rev 258993)
@@ -1833,9 +1833,6 @@
 # The test runner is failing in an unrelated, unexplained, invisible to the human eye, 2 pixels difference.
 webkit.org/b/201401 imported/w3c/web-platform-tests/media-source/mediasource-video-is-visible.html [ Skip ]
 
-# rdar://55484256 (REGRESSION: (Catalina) fast/images/async-image-multiple-clients-repaint.html is a flakey failure)
-[ Catalina+ ] fast/images/async-image-multiple-clients-repaint.html [ Pass Failure ]
-
 # Two canvas tests fail with small antialiasing diffs
 imported/w3c/web-platform-tests/2dcontext/building-paths/canvas_complexshapes_arcto_001.htm [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/2dcontext/building-paths/canvas_complexshapes_beziercurveto_001.htm [ ImageOnlyFailure ]


Modified: trunk/LayoutTests/platform/mac-wk1/TestExpectations (258992 => 258993)

--- trunk/LayoutTests/platform/mac-wk1/TestExpectations	2020-03-25 17:07:35 UTC (rev 258992)
+++ trunk/LayoutTests/platform/mac-wk1/TestExpectations	2020-03-25 17:15:12 UTC (rev 258993)
@@ -733,7 +733,6 @@
 [ Mojave+ ] fast/images/animated-gif-paint-after-animation.html [ Skip ]
 [ Mojave+ ] fast/images/async-image-background-image-repeated.html [ Skip ]
 [ Mojave+ ] fast/images/async-image-background-im

[webkit-changes] [259003] trunk/LayoutTests

[said]

Title: [259003] trunk/LayoutTests








Revision 259003
Author s...@apple.com
Date 2020-03-25 12:29:30 -0700 (Wed, 25 Mar 2020)


Log Message
Layout Test fast/images/async-image-multiple-clients-repaint.html is flaky
https://bugs.webkit.org/show_bug.cgi?id=202328


Unreviewed test gardening.

Put the skip statement for this test back in mac-wk1/TestExpectations 
since  has not been fixed yet.

* platform/mac-wk1/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/mac-wk1/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (259002 => 259003)

--- trunk/LayoutTests/ChangeLog	2020-03-25 19:16:09 UTC (rev 259002)
+++ trunk/LayoutTests/ChangeLog	2020-03-25 19:29:30 UTC (rev 259003)
@@ -1,3 +1,16 @@
+2020-03-25  Said Abou-Hallawa  
+
+Layout Test fast/images/async-image-multiple-clients-repaint.html is flaky
+https://bugs.webkit.org/show_bug.cgi?id=202328
+
+
+Unreviewed test gardening.
+
+Put the skip statement for this test back in mac-wk1/TestExpectations 
+since  has not been fixed yet.
+
+* platform/mac-wk1/TestExpectations:
+
 2020-03-25  Jacob Uphoff  
 
 [ iOS ] http/tests/cache-storage/page-cache-domcache-pending-promise.html is flaky timing out


Modified: trunk/LayoutTests/platform/mac-wk1/TestExpectations (259002 => 259003)

--- trunk/LayoutTests/platform/mac-wk1/TestExpectations	2020-03-25 19:16:09 UTC (rev 259002)
+++ trunk/LayoutTests/platform/mac-wk1/TestExpectations	2020-03-25 19:29:30 UTC (rev 259003)
@@ -733,6 +733,7 @@
 [ Mojave+ ] fast/images/animated-gif-paint-after-animation.html [ Skip ]
 [ Mojave+ ] fast/images/async-image-background-image-repeated.html [ Skip ]
 [ Mojave+ ] fast/images/async-image-background-image.html [ Skip ]
+[ Mojave+ ] fast/images/async-image-multiple-clients-repaint.html [ Skip ]
 [ Mojave+ ] fast/images/composited-animated-gif-outside-viewport.html [ Skip ]
 [ Mojave+ ] fast/images/decode-render-animated-image.html [ Skip ]
 [ Mojave+ ] fast/images/decode-render-static-image.html [ Skip ]






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [259434] trunk/LayoutTests

[said]

Title: [259434] trunk/LayoutTests








Revision 259434
Author s...@apple.com
Date 2020-04-02 17:19:20 -0700 (Thu, 02 Apr 2020)


Log Message
[ iOS wk2 ] fast/images/exif-orientation-background-image-repeat.html is flaky failing.


Unreviewed test gardening.

Add "image-rendering: pixelated;" to the elements which render images to avoid unintended anti-aliasing.

* fast/images/exif-orientation-background-image-repeat-expected.html:
* fast/images/exif-orientation-background-image-repeat.html:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/fast/images/exif-orientation-background-image-repeat-expected.html
trunk/LayoutTests/fast/images/exif-orientation-background-image-repeat.html




Diff

Modified: trunk/LayoutTests/ChangeLog (259433 => 259434)

--- trunk/LayoutTests/ChangeLog	2020-04-03 00:18:24 UTC (rev 259433)
+++ trunk/LayoutTests/ChangeLog	2020-04-03 00:19:20 UTC (rev 259434)
@@ -1,3 +1,15 @@
+2020-04-02  Said Abou-Hallawa  
+
+[ iOS wk2 ] fast/images/exif-orientation-background-image-repeat.html is flaky failing.
+
+
+Unreviewed test gardening.
+
+Add "image-rendering: pixelated;" to the elements which render images to avoid unintended anti-aliasing.
+
+* fast/images/exif-orientation-background-image-repeat-expected.html:
+* fast/images/exif-orientation-background-image-repeat.html:
+
 2020-04-02  Ryosuke Niwa  
 
 [iOS wk2 Debug] imported/w3c/web-platform-tests/mathml/presentation-markup/scripts/cramped-001.html is failing


Modified: trunk/LayoutTests/fast/images/exif-orientation-background-image-repeat-expected.html (259433 => 259434)

--- trunk/LayoutTests/fast/images/exif-orientation-background-image-repeat-expected.html	2020-04-03 00:18:24 UTC (rev 259433)
+++ trunk/LayoutTests/fast/images/exif-orientation-background-image-repeat-expected.html	2020-04-03 00:19:20 UTC (rev 259434)
@@ -14,6 +14,7 @@
 }
 img {
 display: block;
+image-rendering: pixelated;
 }
 
 


Modified: trunk/LayoutTests/fast/images/exif-orientation-background-image-repeat.html (259433 => 259434)

--- trunk/LayoutTests/fast/images/exif-orientation-background-image-repeat.html	2020-04-03 00:18:24 UTC (rev 259433)
+++ trunk/LayoutTests/fast/images/exif-orientation-background-image-repeat.html	2020-04-03 00:19:20 UTC (rev 259434)
@@ -11,6 +11,7 @@
 border: 1px solid black;
 background-size: contain;
 background-repeat: repeat;
+image-rendering: pixelated;
 }
 div.horizontal {
 width: 100px;






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [260870] trunk/Source/WebCore

[said]

Title: [260870] trunk/Source/WebCore








Revision 260870
Author s...@apple.com
Date 2020-04-28 22:36:17 -0700 (Tue, 28 Apr 2020)


Log Message
Rendering update steps should use Seconds for the timestamps
https://bugs.webkit.org/show_bug.cgi?id=210990

Unreviewed.

serviceRequestAnimationFrameCallbacks() should return rounded milliseconds.
This rounding was removed in r260736. So put it back.

* dom/ScriptedAnimationController.cpp:
(WebCore::ScriptedAnimationController::serviceRequestAnimationFrameCallbacks):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/dom/ScriptedAnimationController.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (260869 => 260870)

--- trunk/Source/WebCore/ChangeLog	2020-04-29 05:29:28 UTC (rev 260869)
+++ trunk/Source/WebCore/ChangeLog	2020-04-29 05:36:17 UTC (rev 260870)
@@ -1,3 +1,16 @@
+2020-04-28  Said Abou-Hallawa  
+
+Rendering update steps should use Seconds for the timestamps
+https://bugs.webkit.org/show_bug.cgi?id=210990
+
+Unreviewed.
+
+serviceRequestAnimationFrameCallbacks() should return rounded milliseconds.
+This rounding was removed in r260736. So put it back.
+
+* dom/ScriptedAnimationController.cpp:
+(WebCore::ScriptedAnimationController::serviceRequestAnimationFrameCallbacks):
+
 2020-04-28  Carlos Garcia Campos  
 
 [GTK4] Add support for key events


Modified: trunk/Source/WebCore/dom/ScriptedAnimationController.cpp (260869 => 260870)

--- trunk/Source/WebCore/dom/ScriptedAnimationController.cpp	2020-04-29 05:29:28 UTC (rev 260869)
+++ trunk/Source/WebCore/dom/ScriptedAnimationController.cpp	2020-04-29 05:36:17 UTC (rev 260870)
@@ -200,7 +200,7 @@
 
 TraceScope tracingScope(RAFCallbackStart, RAFCallbackEnd);
 
-auto highResNowMs = timestamp.milliseconds();
+auto highResNowMs = std::round(1000 * timestamp.seconds());
 if (m_document && m_document->quirks().needsMillisecondResolutionForHighResTimeStamp())
 highResNowMs += 0.1;
 






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [261732] trunk/Source/WebCore

[said]

Title: [261732] trunk/Source/WebCore








Revision 261732
Author s...@apple.com
Date 2020-05-15 00:00:19 -0700 (Fri, 15 May 2020)


Log Message
Unreviewed. Fix build warning after r261113

Remove unused variable.

* dom/ScriptedAnimationController.cpp:
(WebCore::ScriptedAnimationController::preferredScriptedAnimationInterval const):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/dom/ScriptedAnimationController.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (261731 => 261732)

--- trunk/Source/WebCore/ChangeLog	2020-05-15 06:55:08 UTC (rev 261731)
+++ trunk/Source/WebCore/ChangeLog	2020-05-15 07:00:19 UTC (rev 261732)
@@ -1,3 +1,12 @@
+2020-05-14  Said Abou-Hallawa  
+
+Unreviewed. Fix build warning after r261113
+
+Remove unused variable.
+
+* dom/ScriptedAnimationController.cpp:
+(WebCore::ScriptedAnimationController::preferredScriptedAnimationInterval const):
+
 2020-05-14  Andres Gonzalez  
 
 Expose isColumnHeaderCell and isRowHeaderCell through AXCoreObject.


Modified: trunk/Source/WebCore/dom/ScriptedAnimationController.cpp (261731 => 261732)

--- trunk/Source/WebCore/dom/ScriptedAnimationController.cpp	2020-05-15 06:55:08 UTC (rev 261731)
+++ trunk/Source/WebCore/dom/ScriptedAnimationController.cpp	2020-05-15 07:00:19 UTC (rev 261732)
@@ -79,9 +79,7 @@
 
 Seconds ScriptedAnimationController::preferredScriptedAnimationInterval() const
 {
-if (auto* page = this->page())
-return preferredFrameInterval(m_throttlingReasons);
-return FullSpeedAnimationInterval;
+return preferredFrameInterval(m_throttlingReasons);
 }
 
 OptionSet ScriptedAnimationController::throttlingReasons() const






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [258895] trunk/LayoutTests

[said]

Title: [258895] trunk/LayoutTests








Revision 258895
Author s...@apple.com
Date 2020-03-23 18:40:53 -0700 (Mon, 23 Mar 2020)


Log Message
Layout Test imported/w3c/web-platform-tests/hr-time/test_cross_frame_start.html is a flaky failure
https://bugs.webkit.org/show_bug.cgi?id=196944

Unreviewed test gardening.

* platform/ios-simulator-wk2/TestExpectations:
Remove flaky expectation for the test.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (258894 => 258895)

--- trunk/LayoutTests/ChangeLog	2020-03-24 01:31:38 UTC (rev 258894)
+++ trunk/LayoutTests/ChangeLog	2020-03-24 01:40:53 UTC (rev 258895)
@@ -1,3 +1,13 @@
+2020-03-23  Said Abou-Hallawa  
+
+Layout Test imported/w3c/web-platform-tests/hr-time/test_cross_frame_start.html is a flaky failure
+https://bugs.webkit.org/show_bug.cgi?id=196944
+
+Unreviewed test gardening.
+
+* platform/ios-simulator-wk2/TestExpectations:
+Remove flaky expectation for the test.
+
 2020-03-23  Commit Queue  
 
 Unreviewed, reverting r258891.


Modified: trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations (258894 => 258895)

--- trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations	2020-03-24 01:31:38 UTC (rev 258894)
+++ trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations	2020-03-24 01:40:53 UTC (rev 258895)
@@ -61,8 +61,6 @@
 
 webkit.org/b/186581 [ Debug ] fast/parser/xml-error-adopted.xml [ Pass Timeout ]
 
-webkit.org/b/196944 imported/w3c/web-platform-tests/hr-time/test_cross_frame_start.html [ Pass Failure ]
-
 webkit.org/b/197207 http/wpt/resource-timing/rt-resources-per-frame.html [ Pass Failure ]
 
 imported/w3c/web-platform-tests/IndexedDB/keypath-special-identifiers.htm [ Slow ]






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [258960] trunk/LayoutTests

[said]

Title: [258960] trunk/LayoutTests








Revision 258960
Author s...@apple.com
Date 2020-03-24 17:02:05 -0700 (Tue, 24 Mar 2020)


Log Message
[ macOS ] fast/images/slower-decoding-than-animation-image.html is flaky failing
https://bugs.webkit.org/show_bug.cgi?id=207859

Unreviewed tiny follow-up to make the test more reliable on slow bots.

* fast/images/slower-decoding-than-animation-image-expected.txt:
* fast/images/slower-decoding-than-animation-image.html:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/fast/images/slower-decoding-than-animation-image-expected.txt
trunk/LayoutTests/fast/images/slower-decoding-than-animation-image.html




Diff

Modified: trunk/LayoutTests/ChangeLog (258959 => 258960)

--- trunk/LayoutTests/ChangeLog	2020-03-25 00:01:27 UTC (rev 258959)
+++ trunk/LayoutTests/ChangeLog	2020-03-25 00:02:05 UTC (rev 258960)
@@ -1,3 +1,13 @@
+2020-03-24  Said Abou-Hallawa  
+
+[ macOS ] fast/images/slower-decoding-than-animation-image.html is flaky failing
+https://bugs.webkit.org/show_bug.cgi?id=207859
+
+Unreviewed tiny follow-up to make the test more reliable on slow bots.
+
+* fast/images/slower-decoding-than-animation-image-expected.txt:
+* fast/images/slower-decoding-than-animation-image.html:
+
 2020-03-24  Jacob Uphoff  
 
 [ iOS ] http/tests/security/cookies/third-party-cookie-blocking.html is flaky timing out


Modified: trunk/LayoutTests/fast/images/slower-decoding-than-animation-image-expected.txt (258959 => 258960)

--- trunk/LayoutTests/fast/images/slower-decoding-than-animation-image-expected.txt	2020-03-25 00:01:27 UTC (rev 258959)
+++ trunk/LayoutTests/fast/images/slower-decoding-than-animation-image-expected.txt	2020-03-25 00:02:05 UTC (rev 258960)
@@ -3,9 +3,9 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS internals.imageFrameIndex(image) is 0
-PASS internals.imageFrameIndex(image) is 1
-PASS internals.imageFrameIndex(image) is 2
+PASS internals.imageFrameIndex(image) is >= 0
+PASS internals.imageFrameIndex(image) is >= 1
+PASS internals.imageFrameIndex(image) is >= 2
 PASS successfullyParsed is true
 
 TEST COMPLETE


Modified: trunk/LayoutTests/fast/images/slower-decoding-than-animation-image.html (258959 => 258960)

--- trunk/LayoutTests/fast/images/slower-decoding-than-animation-image.html	2020-03-25 00:01:27 UTC (rev 258959)
+++ trunk/LayoutTests/fast/images/slower-decoding-than-animation-image.html	2020-03-25 00:02:05 UTC (rev 258960)
@@ -13,7 +13,7 @@
 context.drawImage(image, 0, 0, 100, 100, 0, 0, canvas.width, canvas.height);
 
 if (window.internals) {
-shouldBe("internals.imageFrameIndex(image)", frameIndex.toString());
+shouldBeGreaterThanOrEqual("internals.imageFrameIndex(image)", frameIndex.toString());
 image.addEventListener("webkitImageFrameReady", function() {
 resolve();
 }, false);






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [266452] trunk/Source

[said]

Title: [266452] trunk/Source








Revision 266452
Author s...@apple.com
Date 2020-09-02 01:04:12 -0700 (Wed, 02 Sep 2020)


Log Message
Unreviewed, reverting r266449.

Underlying frameworks do not work correctly for loopCount >=
1.

Reverted changeset:

"[CG] REGRESSION (Big Sur): A GIF image with a finite
loopCount loops an extra cycle"
https://bugs.webkit.org/show_bug.cgi?id=216018
https://trac.webkit.org/changeset/266449

Modified Paths

trunk/Source/WTF/ChangeLog
trunk/Source/WTF/wtf/PlatformHave.h
trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp




Diff

Modified: trunk/Source/WTF/ChangeLog (266451 => 266452)

--- trunk/Source/WTF/ChangeLog	2020-09-02 06:57:07 UTC (rev 266451)
+++ trunk/Source/WTF/ChangeLog	2020-09-02 08:04:12 UTC (rev 266452)
@@ -1,3 +1,17 @@
+2020-09-02  Said Abou-Hallawa  
+
+Unreviewed, reverting r266449.
+
+Underlying frameworks do not work correctly for loopCount >=
+1.
+
+Reverted changeset:
+
+"[CG] REGRESSION (Big Sur): A GIF image with a finite
+loopCount loops an extra cycle"
+https://bugs.webkit.org/show_bug.cgi?id=216018
+https://trac.webkit.org/changeset/266449
+
 2020-09-01  Said Abou-Hallawa  
 
 [CG] REGRESSION (Big Sur): A GIF image with a finite loopCount loops an extra cycle


Modified: trunk/Source/WTF/wtf/PlatformHave.h (266451 => 266452)

--- trunk/Source/WTF/wtf/PlatformHave.h	2020-09-02 06:57:07 UTC (rev 266451)
+++ trunk/Source/WTF/wtf/PlatformHave.h	2020-09-02 08:04:12 UTC (rev 266452)
@@ -380,6 +380,14 @@
 #define HAVE_ACCESSIBILITY_BUNDLES_PATH 1
 #endif
 
+#if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 11) \
+|| (PLATFORM(IOS) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 14) \
+|| (PLATFORM(WATCHOS) && __WATCH_OS_VERSION_MIN_REQUIRED >= 7) \
+|| (PLATFORM(APPLETV) && __TV_OS_VERSION_MIN_REQUIRED >= 14) \
+|| (PLATFORM(MACCATALYST) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 14)
+#define HAVE_PRECONNECT_PING 1
+#endif
+
 #if PLATFORM(COCOA) && !(PLATFORM(MAC) && !(__MAC_OS_X_VERSION_MIN_REQUIRED >= 101400 && __MAC_OS_X_VERSION_MAX_ALLOWED >= 101404))
 #define HAVE_CFNETWORK_OVERRIDE_SESSION_COOKIE_ACCEPT_POLICY 1
 #endif
@@ -407,6 +415,14 @@
 #define HAVE_BROKEN_DOWNLOAD_RESUME_UNLINK 1
 #endif
 
+#if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 11) \
+|| ((PLATFORM(IOS) || PLATFORM(MACCATALYST)) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 14) \
+|| (PLATFORM(WATCHOS) && __WATCH_OS_VERSION_MIN_REQUIRED >= 7) \
+|| (PLATFORM(APPLETV) && __TV_OS_VERSION_MIN_REQUIRED >= 14) \
+|| PLATFORM(MACCATALYST)
+#define HAVE_HSTS_STORAGE 1
+#endif
+
 #if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 11) || (PLATFORM(IOS_FAMILY) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 14)
 #define HAVE_CFNETWORK_METRICS_APIS_V4 1
 #endif
@@ -582,6 +598,10 @@
 #define HAVE_GCCONTROLLER_HID_DEVICE_CHECK 1
 #endif
 
+#if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 11) || (PLATFORM(IOS_FAMILY) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 14)
+#define HAVE_WEBP 1
+#endif
+
 #if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 11)
 #define HAVE_INCREMENTAL_PDF_APIS 1
 #endif
@@ -659,6 +679,13 @@
 #define HAVE_LOGGING_PRIVACY_LEVEL 1
 #endif
 
+#if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 11) \
+|| ((PLATFORM(IOS) || PLATFORM(MACCATALYST)) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 14) \
+|| (PLATFORM(WATCHOS) && __WATCH_OS_VERSION_MIN_REQUIRED >= 7) \
+|| (PLATFORM(APPLETV) && __TV_OS_VERSION_MIN_REQUIRED >= 14)
+#define HAVE_CF_PREFS_SET_READ_ONLY 1
+#endif
+
 #if PLATFORM(IOS_FAMILY) && !PLATFORM(MACCATALYST)
 #define HAVE_FRONTBOARD_SYSTEM_APP_SERVICES 1
 #endif
@@ -667,10 +694,24 @@
 #define HAVE_CPU_TRANSLATION_CAPABILITY 1
 #endif
 
+#if (((PLATFORM(IOS) || PLATFORM(MACCATALYST)) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 14) \
+|| (PLATFORM(WATCHOS) && __WATCH_OS_VERSION_MIN_REQUIRED >= 7) \
+|| (PLATFORM(APPLETV) && __TV_OS_VERSION_MIN_REQUIRED >= 14) \
+|| (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 11))
+#define HAVE_PTHREAD_JIT_PERMISSIONS_API 1
+#endif
+
 #if PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 11
 #define HAVE_APP_ACCENT_COLORS 1
 #endif
 
+#if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 11) \
+|| ((PLATFORM(IOS) || PLATFORM(MACCATALYST)) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 14) \
+|| (PLATFORM(WATCHOS) && __WATCH_OS_VERSION_MIN_REQUIRED >= 7) \
+|| (PLATFORM(APPLETV) && __TV_OS_V

[webkit-changes] [269084] trunk/Source

[said]

Title: [269084] trunk/Source








Revision 269084
Author s...@apple.com
Date 2020-10-27 18:36:51 -0700 (Tue, 27 Oct 2020)


Log Message
Make RenderingMode a bool enum and remove ShouldAccelerate
https://bugs.webkit.org/show_bug.cgi?id=218264

Reviewed by Tim Horton.

Source/WebCore:

Convert RenderingMode back to be a bool enum. ShouldAccelerate will be
removed so no conversion from RenderingMode to ShouldAccelerate and vice
versa is needed anymore. Only one instance of ImageBuffer::create() will
be handling creating the remote and display list ImageBuffers.

-- Remove unused createImageBuffer() method in HostWindow and ChromeClient.
-- Remove unused argument 'ShouldUseDisplayList' from createImageBuffer()
   of HostWindow, ChromeClient and WebChromeClient.

* html/HTMLCanvasElement.cpp:
(WebCore::HTMLCanvasElement::createImageBuffer const):
* html/HTMLVideoElement.cpp:
(WebCore::HTMLVideoElement::createBufferForPainting const):
* html/HTMLVideoElement.h:
* html/ImageBitmap.cpp:
(WebCore::ImageBitmap::createPromise):
* html/canvas/CanvasRenderingContext2DBase.cpp:
(WebCore::CanvasRenderingContext2DBase::createPattern):
* page/Chrome.cpp:
(WebCore::Chrome::createImageBuffer const):
* page/Chrome.h:
* page/ChromeClient.h:
(WebCore::ChromeClient::createImageBuffer const):
* platform/HostWindow.h:
* platform/graphics/ImageBuffer.cpp:
(WebCore::ImageBuffer::create):
* platform/graphics/ImageBuffer.h:
* platform/graphics/RenderingMode.h:

Source/WebKit:

When creating a remote ImageBuffer in WebKit, all we need to know is whether
the backend is accelerated or not. RemoteImageBufferProxy has to be backed
by a DisplayList. RemoteImageBuffer has to own the real backend. Two enum
values for RenderingMode is sufficient for creating the remote ImageBuffer.

* GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::RemoteRenderingBackend::createImageBuffer):
* GPUProcess/graphics/RemoteRenderingBackend.h:
* Shared/WebCoreArgumentCoders.h:
* WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:
(WebKit::RemoteRenderingBackendProxy::createImageBuffer):
* WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h:
* WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::createImageBuffer const):
* WebProcess/WebCoreSupport/WebChromeClient.h:

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/html/HTMLCanvasElement.cpp
trunk/Source/WebCore/html/HTMLVideoElement.cpp
trunk/Source/WebCore/html/HTMLVideoElement.h
trunk/Source/WebCore/html/ImageBitmap.cpp
trunk/Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
trunk/Source/WebCore/page/Chrome.cpp
trunk/Source/WebCore/page/Chrome.h
trunk/Source/WebCore/page/ChromeClient.h
trunk/Source/WebCore/platform/HostWindow.h
trunk/Source/WebCore/platform/graphics/ImageBuffer.cpp
trunk/Source/WebCore/platform/graphics/ImageBuffer.h
trunk/Source/WebCore/platform/graphics/RenderingMode.h
trunk/Source/WebKit/ChangeLog
trunk/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
trunk/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h
trunk/Source/WebKit/Shared/WebCoreArgumentCoders.h
trunk/Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp
trunk/Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h
trunk/Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
trunk/Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h




Diff

Modified: trunk/Source/WebCore/ChangeLog (269083 => 269084)

--- trunk/Source/WebCore/ChangeLog	2020-10-28 01:00:35 UTC (rev 269083)
+++ trunk/Source/WebCore/ChangeLog	2020-10-28 01:36:51 UTC (rev 269084)
@@ -1,3 +1,39 @@
+2020-10-27  Said Abou-Hallawa  
+
+Make RenderingMode a bool enum and remove ShouldAccelerate
+https://bugs.webkit.org/show_bug.cgi?id=218264
+
+Reviewed by Tim Horton.
+
+Convert RenderingMode back to be a bool enum. ShouldAccelerate will be
+removed so no conversion from RenderingMode to ShouldAccelerate and vice
+versa is needed anymore. Only one instance of ImageBuffer::create() will
+be handling creating the remote and display list ImageBuffers.
+
+-- Remove unused createImageBuffer() method in HostWindow and ChromeClient.
+-- Remove unused argument 'ShouldUseDisplayList' from createImageBuffer()
+   of HostWindow, ChromeClient and WebChromeClient.
+
+* html/HTMLCanvasElement.cpp:
+(WebCore::HTMLCanvasElement::createImageBuffer const):
+* html/HTMLVideoElement.cpp:
+(WebCore::HTMLVideoElement::createBufferForPainting const):
+* html/HTMLVideoElement.h:
+* html/ImageBitmap.cpp:
+(WebCore::ImageBitmap::createPromise):
+* html/canvas/CanvasRenderingContext2DBase.cpp:
+(WebCore::CanvasRenderingContext2DBase::createPattern):
+* page/Chrome.cpp:
+(WebCore::Chrome::createImageBuffer const):
+* page/Chrome.h:
+* page/ChromeClient.h:
+(WebCore::ChromeCli

[webkit-changes] [269123] trunk/Source/WebKit

[said]

Title: [269123] trunk/Source/WebKit








Revision 269123
Author s...@apple.com
Date 2020-10-28 14:09:12 -0700 (Wed, 28 Oct 2020)


Log Message
[GPU Process] Eagerly flush the PutImageData item to the GPU Process
https://bugs.webkit.org/show_bug.cgi?id=218116

Reviewed by Simon Fraser.

Flush the DrawingContext of the RemoteImageBufferProxy once the PutImageData
item is recorded. So no expensive operation is going to block the painting.

* WebProcess/GPU/graphics/RemoteImageBufferProxy.h:

Modified Paths

trunk/Source/WebKit/ChangeLog
trunk/Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.h




Diff

Modified: trunk/Source/WebKit/ChangeLog (269122 => 269123)

--- trunk/Source/WebKit/ChangeLog	2020-10-28 21:04:10 UTC (rev 269122)
+++ trunk/Source/WebKit/ChangeLog	2020-10-28 21:09:12 UTC (rev 269123)
@@ -1,3 +1,15 @@
+2020-10-28  Said Abou-Hallawa  
+
+[GPU Process] Eagerly flush the PutImageData item to the GPU Process
+https://bugs.webkit.org/show_bug.cgi?id=218116
+
+Reviewed by Simon Fraser.
+
+Flush the DrawingContext of the RemoteImageBufferProxy once the PutImageData
+item is recorded. So no expensive operation is going to block the painting.
+
+* WebProcess/GPU/graphics/RemoteImageBufferProxy.h:
+
 2020-10-28  Tim Horton  
 
 macCatalyst WebGL on Apple Silicon devices is using a software renderer


Modified: trunk/Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.h (269122 => 269123)

--- trunk/Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.h	2020-10-28 21:04:10 UTC (rev 269122)
+++ trunk/Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.h	2020-10-28 21:09:12 UTC (rev 269123)
@@ -120,6 +120,7 @@
 // This means that putImageData() is only called when m_resolutionScale == 1.
 ASSERT(m_backend->resolutionScale() == 1);
 m_drawingContext.recorder().putImageData(inputFormat, imageData, srcRect, destPoint, destFormat);
+flushDrawingContextAndCommit();
 }
 
 void flushContext() override






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [270479] trunk/Source/WebCore

[said]

Title: [270479] trunk/Source/WebCore








Revision 270479
Author s...@apple.com
Date 2020-12-05 16:22:09 -0800 (Sat, 05 Dec 2020)


Log Message
REGRESSION(r270458): Crash loading https://browserbench.org/JetStream/
https://bugs.webkit.org/show_bug.cgi?id=219568

Reviewed by Tim Horton.

Get the backendSize before sinking it into a NativeImage.

* platform/graphics/cg/ImageBufferIOSurfaceBackend.cpp:
(WebCore::ImageBufferIOSurfaceBackend::drawConsuming):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/cg/ImageBufferIOSurfaceBackend.cpp




Diff

Modified: trunk/Source/WebCore/ChangeLog (270478 => 270479)

--- trunk/Source/WebCore/ChangeLog	2020-12-05 22:17:10 UTC (rev 270478)
+++ trunk/Source/WebCore/ChangeLog	2020-12-06 00:22:09 UTC (rev 270479)
@@ -1,3 +1,15 @@
+2020-12-05  Said Abou-Hallawa  
+
+REGRESSION(r270458): Crash loading https://browserbench.org/JetStream/
+https://bugs.webkit.org/show_bug.cgi?id=219568
+
+Reviewed by Tim Horton.
+
+Get the backendSize before sinking it into a NativeImage.
+
+* platform/graphics/cg/ImageBufferIOSurfaceBackend.cpp:
+(WebCore::ImageBufferIOSurfaceBackend::drawConsuming):
+
 2020-12-04  Wenson Hsieh  
 
 [Concurrent display lists] Synchronize display list rendering across remote image buffers


Modified: trunk/Source/WebCore/platform/graphics/cg/ImageBufferIOSurfaceBackend.cpp (270478 => 270479)

--- trunk/Source/WebCore/platform/graphics/cg/ImageBufferIOSurfaceBackend.cpp	2020-12-05 22:17:10 UTC (rev 270478)
+++ trunk/Source/WebCore/platform/graphics/cg/ImageBufferIOSurfaceBackend.cpp	2020-12-06 00:22:09 UTC (rev 270479)
@@ -155,8 +155,9 @@
 FloatRect adjustedSrcRect = srcRect;
 adjustedSrcRect.scale(resolutionScale());
 
+auto backendSize = this->backendSize();
 if (auto image = sinkIntoNativeImage())
-destContext.drawNativeImage(*image, backendSize(), destRect, adjustedSrcRect, options);
+destContext.drawNativeImage(*image, backendSize, destRect, adjustedSrcRect, options);
 }
 
 RetainPtr ImageBufferIOSurfaceBackend::toCFData(const String& mimeType, Optional quality, PreserveResolution preserveResolution) const






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [270444] trunk/Source

[said]

Title: [270444] trunk/Source








Revision 270444
Author s...@apple.com
Date 2020-12-04 11:47:56 -0800 (Fri, 04 Dec 2020)


Log Message
[GPU Process] Share the NativeImage with GPU Process through a ShareableBitmap
https://bugs.webkit.org/show_bug.cgi?id=218934

Reviewed by Tim Horton.

Source/WebCore:

Delete a NativeImage constructor and a create method which were used by
the deleted IPC coders of the NativeImage.

* Headers.cmake:
* WebCore.xcodeproj/project.pbxproj:
* platform/graphics/NativeImage.cpp:
(WebCore::NativeImage::create):
(WebCore::NativeImage::NativeImage):
* platform/graphics/NativeImage.h:
* platform/graphics/NativeImageReference.h: Removed.

Source/WebKit:

Instead of relying on the IPC coders to transfer the NativeImage to the
GPUP, we are going to move this logic to RemoteResourceCacheProxy and
RemoteRenderingBackend. The NativeImage will be transfered as a handle of
ShareableBitamp and a renderingResourceIdentifier.

* GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::RemoteRenderingBackend::cacheNativeImage):
* GPUProcess/graphics/RemoteRenderingBackend.h:
* GPUProcess/graphics/RemoteRenderingBackend.messages.in:
* Shared/ShareableBitmap.h:
(WebKit::ShareableBitmap::createPlatformImage):
Add this helper function and avoid adding directive code in many places.

* Shared/WebCoreArgumentCoders.cpp:
(IPC::ArgumentCoder>::encode): Deleted.
(IPC::ArgumentCoder>::decode): Deleted.
* Shared/WebCoreArgumentCoders.h:
* WebProcess/GPU/graphics/ImageBufferShareableBitmapBackend.cpp:
(WebKit::ImageBufferShareableBitmapBackend::copyNativeImage const):
* WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:
(WebKit::RemoteRenderingBackendProxy::cacheNativeImage):
* WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h:
* WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp:
(WebKit::createShareableBitmapFromNativeImage):
(WebKit::RemoteResourceCacheProxy::cacheNativeImage):

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/Headers.cmake
trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj
trunk/Source/WebCore/platform/graphics/NativeImage.cpp
trunk/Source/WebCore/platform/graphics/NativeImage.h
trunk/Source/WebKit/ChangeLog
trunk/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
trunk/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h
trunk/Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.messages.in
trunk/Source/WebKit/Shared/ShareableBitmap.h
trunk/Source/WebKit/Shared/WebCoreArgumentCoders.cpp
trunk/Source/WebKit/Shared/WebCoreArgumentCoders.h
trunk/Source/WebKit/WebProcess/GPU/graphics/ImageBufferShareableBitmapBackend.cpp
trunk/Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp
trunk/Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h
trunk/Source/WebKit/WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp


Removed Paths

trunk/Source/WebCore/platform/graphics/NativeImageReference.h




Diff

Modified: trunk/Source/WebCore/ChangeLog (270443 => 270444)

--- trunk/Source/WebCore/ChangeLog	2020-12-04 19:44:52 UTC (rev 270443)
+++ trunk/Source/WebCore/ChangeLog	2020-12-04 19:47:56 UTC (rev 270444)
@@ -1,3 +1,21 @@
+2020-12-04  Said Abou-Hallawa  
+
+[GPU Process] Share the NativeImage with GPU Process through a ShareableBitmap
+https://bugs.webkit.org/show_bug.cgi?id=218934
+
+Reviewed by Tim Horton.
+
+Delete a NativeImage constructor and a create method which were used by
+the deleted IPC coders of the NativeImage.
+
+* Headers.cmake:
+* WebCore.xcodeproj/project.pbxproj:
+* platform/graphics/NativeImage.cpp:
+(WebCore::NativeImage::create):
+(WebCore::NativeImage::NativeImage):
+* platform/graphics/NativeImage.h:
+* platform/graphics/NativeImageReference.h: Removed.
+
 2020-12-04  Peng Liu  
 
 [MSE] Move track buffer management from SourceBuffer to SourceBufferPrivate


Modified: trunk/Source/WebCore/Headers.cmake (270443 => 270444)

--- trunk/Source/WebCore/Headers.cmake	2020-12-04 19:44:52 UTC (rev 270443)
+++ trunk/Source/WebCore/Headers.cmake	2020-12-04 19:47:56 UTC (rev 270444)
@@ -1236,7 +1236,6 @@
 platform/graphics/MediaSourcePrivateClient.h
 platform/graphics/MediaUsageInfo.h
 platform/graphics/NativeImage.h
-platform/graphics/NativeImageReference.h
 platform/graphics/OpenGLESShims.h
 platform/graphics/OpenGLShims.h
 platform/graphics/Path.h


Modified: trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj (270443 => 270444)

--- trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj	2020-12-04 19:44:52 UTC (rev 270443)
+++ trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj	2020-12-04 19:47:56 UTC (rev 270444)
@@ -2192,7 +2192,6 @@
 		7299BC6823D6A53E00CC6883 /* RenderingMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 7299BC6623D686C600CC6883 /* RenderingMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		729D05302

[webkit-changes] [270470] trunk/Source/WebKit

[said]

Title: [270470] trunk/Source/WebKit








Revision 270470
Author s...@apple.com
Date 2020-12-04 21:59:55 -0800 (Fri, 04 Dec 2020)


Log Message
[GPU Process] Remove ConcreteShareableImageBuffer
https://bugs.webkit.org/show_bug.cgi?id=219563

Reviewed by Simon Fraser.

Delete this class since the only function it implements:
'createImageBufferBackendHandle()' is not used.

* Shared/ConcreteShareableImageBuffer.h: Removed.
* Shared/RemoteLayerTree/RemoteLayerBackingStore.mm:
(WebKit::RemoteLayerBackingStore::swapToValidFrontBuffer):

Modified Paths

trunk/Source/WebKit/ChangeLog
trunk/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm


Removed Paths

trunk/Source/WebKit/Shared/ConcreteShareableImageBuffer.h




Diff

Modified: trunk/Source/WebKit/ChangeLog (270469 => 270470)

--- trunk/Source/WebKit/ChangeLog	2020-12-05 05:49:30 UTC (rev 270469)
+++ trunk/Source/WebKit/ChangeLog	2020-12-05 05:59:55 UTC (rev 270470)
@@ -1,3 +1,17 @@
+2020-12-04  Said Abou-Hallawa  
+
+[GPU Process] Remove ConcreteShareableImageBuffer
+https://bugs.webkit.org/show_bug.cgi?id=219563
+
+Reviewed by Simon Fraser.
+
+Delete this class since the only function it implements: 
+'createImageBufferBackendHandle()' is not used.
+
+* Shared/ConcreteShareableImageBuffer.h: Removed.
+* Shared/RemoteLayerTree/RemoteLayerBackingStore.mm:
+(WebKit::RemoteLayerBackingStore::swapToValidFrontBuffer):
+
 2020-12-04  Wenson Hsieh  
 
 [iOS] Cancel image extraction when navigating


Deleted: trunk/Source/WebKit/Shared/ConcreteShareableImageBuffer.h (270469 => 270470)

--- trunk/Source/WebKit/Shared/ConcreteShareableImageBuffer.h	2020-12-05 05:49:30 UTC (rev 270469)
+++ trunk/Source/WebKit/Shared/ConcreteShareableImageBuffer.h	2020-12-05 05:59:55 UTC (rev 270470)
@@ -1,52 +0,0 @@
-/*
- * Copyright (C) 2020 Apple Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *notice, this list of conditions and the following disclaimer in the
- *documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#pragma once
-
-#include "ImageBufferBackendHandle.h"
-#include 
-
-namespace WebKit {
-
-template
-class ConcreteShareableImageBuffer : public WebCore::ConcreteImageBuffer {
-using BaseConcreteImageBuffer = WebCore::ConcreteImageBuffer;
-using BaseConcreteImageBuffer::m_backend;
-
-public:
-static auto create(const WebCore::FloatSize& size, float resolutionScale, WebCore::ColorSpace colorSpace, WebCore::PixelFormat pixelFormat)
-{
-return BaseConcreteImageBuffer::template create(size, resolutionScale, colorSpace, pixelFormat, nullptr);
-}
-
-using BaseConcreteImageBuffer::BaseConcreteImageBuffer;
-
-ImageBufferBackendHandle createImageBufferBackendHandle()
-{
-return m_backend->createImageBufferBackendHandle();
-}
-};
-
-} // namespace WebKit


Modified: trunk/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm (270469 => 270470)

--- trunk/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm	2020-12-05 05:49:30 UTC (rev 270469)
+++ trunk/Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm	2020-12-05 05:59:55 UTC (rev 270470)
@@ -27,7 +27,6 @@
 #import "RemoteLayerBackingStore.h"
 
 #import "ArgumentCoders.h"
-#import "ConcreteShareableImageBuffer.h"
 #import "MachPort.h"
 #import "PlatformCALayerRemote.h"
 #import "PlatformRemoteImageBufferProxy.h"
@@ -181,15 +180,14 @@
 if (m_frontBuffer.imageBuffer)
 return;
 
-if (WebProcess::singleton().shouldUseRemoteRenderingFor(WebCore::RenderingPurpose::DOM)) {
-m_frontBuffer.imageBuffer = m_layer->context()->ensureRemoteRenderingBackendProxy().createImageBuffer(backingStoreSize(), m_acceleratesDrawing ? WebCore