2022-04-19 Alan Coon Cherry-pick r292079. rdar://problem/88512506 Don't mutate children during RenderGrid::computeIntrinsicLogicalWidths unless we're about to re-layout. https://bugs.webkit.org/show_bug.cgi?id=237732 Reviewed by Dean Jackson. Source/WebCore: Test: fast/css-grid-layout/compute-intrinsic-logical-widths-should-not-mutate-children.html * rendering/GridTrackSizingAlgorithm.cpp: (WebCore::GridTrackSizingAlgorithm::gridAreaBreadthForChild const): (WebCore::GridTrackSizingAlgorithm::advanceNextState): (WebCore::GridTrackSizingAlgorithm::isValidTransition const): * rendering/GridTrackSizingAlgorithm.h: * rendering/RenderGrid.cpp: (WebCore::RenderGrid::layoutBlock): (WebCore::RenderGrid::computeIntrinsicLogicalWidths const): * rendering/RenderGrid.h: computeIntrinsicLogicalWidths can re-layout children (via performGridItemsPreLayout, as well as during the track sizing algorithm), and does so using the estimated track sizes. This can be incorrect, and if we're not about to do a full layout on this RenderGrid, it can leave the children in an invalid state. This caches the intrinsic sizes when we do a full layout, so that we can use these values instead when we just want to query the RenderGrid without mutating anything. LayoutTests: Don't mutate children during computeIntrinsicWidth * TestExpectations: * fast/css-grid-layout/compute-intrinsic-logical-widths-should-not-mutate-children-expected.html: Added. * fast/css-grid-layout/compute-intrinsic-logical-widths-should-not-mutate-children.html: Added. * platform/ios/TestExpectations: Marked existing WPT as passing on MacOS (since we run layout multiple times there). Added new test for this implementation-specific bug. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@292079 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-29 Matt Woodrow Don't mutate children during RenderGrid::computeIntrinsicLogicalWidths unless we're about to re-layout. https://bugs.webkit.org/show_bug.cgi?id=237732 Reviewed by Dean Jackson. Don't mutate children during computeIntrinsicWidth * TestExpectations: * fast/css-grid-layout/compute-intrinsic-logical-widths-should-not-mutate-children-expected.html: Added. * fast/css-grid-layout/compute-intrinsic-logical-widths-should-not-mutate-children.html: Added. * platform/ios/TestExpectations: Marked existing WPT as passing on MacOS (since we run layout multiple times there). Added new test for this implementation-specific bug. 2022-04-19 Alan Coon Cherry-pick r291759. rdar://problem/89589891 [iOS] WebKit app is sometimes not "Now Playing" during initial playback https://bugs.webkit.org/show_bug.cgi?id=236993 Reviewed by Eric Carlson. Source/WebCore: Test: media/audio-session-category-at-most-recent-playback.html Recently, we have added the concept of "preparingToPlay" to PlatformMediaSession to allow the correct category to be set if updateSessionState() is called after playback is allowed by the MediaSessionManager, but before playback is actually started by the media element. However, this depends on updateSessionState() being called synchronously during playback. We disabled this synchronous update in r269077 due to the large runtime cost when a large number of media elements are created (but not used) at once. Relax this asynchronous update in the case where the state is moving to "Playing", which ensures that the correct AudioSessionCategory is set before playback starts, rather than immediately afterward. To support testing that the category was correctly set before playback started, add an ivar to HTMLMediaElement that is set to the current AudioSessionCategory immediately before the media element instructs the MediaPlayer to start playback. Expose this ivar to Internals. Drive-by fixes: AudioSession::CategoryType cannot be forward declared, as it is a public member of a class. Allow the enum to be forward declared by moving the declaration outside the class, but allow current uses of the enum to continue by typedefing it inside the class to the original enum name. Add an IDL enumeration matching the AudioSession one in Interals.idl and convert the existing audioSessionCategory() call to use the new enumeration. (Unforunately in the case where USE_AUDIO_SESSION is not set, the enumeration must be re- declared. This can be removed and the entire implementation wrapped in a USE() check, once the bindings generator is extended to allow "Conditional="-style attributes for USE checks.) The added test is flakey due to a previous change which would keep the MediaSession category in "MediaPlayback" for up to 2s after playback ends. To counteract this flakiness, reset the state of the PlatformMediaSessionManager between tests. * html/HTMLMediaElement.cpp: (WebCore::m_categoryAtMostRecentPlayback): (WebCore::HTMLMediaElement::playPlayer): (WebCore::m_logIdentifier): Deleted. * html/HTMLMediaElement.h: (WebCore::HTMLMediaElement::categoryAtMostRecentPlayback const): * platform/audio/AudioSession.h: * platform/audio/PlatformMediaSessionManager.cpp: (WebCore::PlatformMediaSessionManager::sessionStateChanged): * platform/audio/PlatformMediaSessionManager.h: (WebCore::PlatformMediaSessionManager::resetSessionState): * platform/audio/cocoa/MediaSessionManagerCocoa.h: * platform/audio/cocoa/MediaSessionManagerCocoa.mm: (WebCore::MediaSessionManagerCocoa::resetSessionState): * testing/Internals.cpp: (WebCore::Internals::resetToConsistentState): * testing/Internals.cpp: (WebCore::Internals::audioSessionCategory const): (WebCore::Internals::categoryAtMostRecentPlayback const): * testing/Internals.h: * testing/Internals.idl: LayoutTests: Fix the audio-session-category test. Creating the oscilator actually does change the AudioSession category to "Ambient", but (previously) only in the next run loop, so a synchronous test that the AudioSession category is "None" succeeds. Now that starting playback (as happens when creating an audio node) changes the AudioSession synchronously, the test begins failing. * media/audio-session-category-at-most-recent-playback-expected.txt: Added. * media/audio-session-category-at-most-recent-playback.html: Added. * media/audio-session-category-expected.txt: * media/audio-session-category.html: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291759 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-23 Jer Noble [iOS] WebKit app is sometimes not "Now Playing" during initial playback https://bugs.webkit.org/show_bug.cgi?id=236993 Reviewed by Eric Carlson. Fix the audio-session-category test. Creating the oscilator actually does change the AudioSession category to "Ambient", but (previously) only in the next run loop, so a synchronous test that the AudioSession category is "None" succeeds. Now that starting playback (as happens when creating an audio node) changes the AudioSession synchronously, the test begins failing. * media/audio-session-category-at-most-recent-playback-expected.txt: Added. * media/audio-session-category-at-most-recent-playback.html: Added. * media/audio-session-category-expected.txt: * media/audio-session-category.html: 2022-04-19 Alan Coon Cherry-pick r292049. rdar://problem/89104216 [macOS] Muted video is sometimes paused when entering fullscreen https://bugs.webkit.org/show_bug.cgi?id=238462 rdar://89104216 Reviewed by Jer Noble. Source/WebCore: Test: media/fullscreen-when-muted.html * html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::didMoveToNewDocument): Add logging. (WebCore::HTMLMediaElement::elementIsHidden const): Consider both element fullscreen and video fullscreen. (WebCore::HTMLMediaElement::visibilityStateChanged): Use elementIsHidden. (WebCore::HTMLMediaElement::shouldOverrideBackgroundPlaybackRestriction const): Add logging for the one case that didn't have it. (WebCore::HTMLMediaElement::updateMediaPlayer): New, wrap MediaPlayer functions that are called frequently by RenderVideo so we can only call them when necessary. * html/HTMLMediaElement.h: (WebCore::HTMLMediaElement::elementIsHidden const): Deleted. * html/MediaElementSession.cpp: (WebCore::MediaElementSession::visibilityChanged): Just use elementIsHidden, it already accounts for fullscreen. * platform/graphics/MediaPlayer.cpp: (WebCore::MediaPlayer::setVisibleInViewport): Do nothing when visibility is not changing. * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm: (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::setPageIsVisible): Add logging. * rendering/RenderVideo.cpp: (WebCore::RenderVideo::updatePlayer): Call HTMLMediaElement::updateMediaPlayer instead of calling MediaPlayer directly. Source/WebKit: * WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp: (WebKit::MediaPlayerPrivateRemote::setPageIsVisible): Track visibility and do nothing when it doesn't change. (WebKit::MediaPlayerPrivateRemote::setShouldMaintainAspectRatio): Ditto for aspect ratio. * WebProcess/GPU/media/MediaPlayerPrivateRemote.h: LayoutTests: * media/fullscreen-when-muted-expected.txt: Added. * media/fullscreen-when-muted.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@292049 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-29 Eric Carlson [macOS] Muted video is sometimes paused when entering fullscreen https://bugs.webkit.org/show_bug.cgi?id=238462 rdar://89104216 Reviewed by Jer Noble. * media/fullscreen-when-muted-expected.txt: Added. * media/fullscreen-when-muted.html: Added. 2022-04-19 Alan Coon Cherry-pick r291689. rdar://problem/88461772 REGRESSION (iOS 15.1 / r280824) QuickLook - model not loading when passing extra parameters https://bugs.webkit.org/show_bug.cgi?id=236069 Reviewed by Darin Adler. Source/WebCore: To extend the lifetime of Blob objects while loading/downloading is pending, we rely to BlobURLHandle objects, which tell the NetworkProcess that we still need this blob data, even if the corresponding Blob object gets GC'd by JS. The issue here is that the load was not using the vanilla blob URL but was intead appending a fragment to the URL. As a result, BlobRegistryImpl::registerBlobURLHandle() would fail to look up the corresponding blob data and would fail to extend its lifetime. To address the issue, BlobRegistryImpl::registerBlobURLHandle() / unregisterBlobURLHandle() now strip fragments from the blob URL, similarly to what was already done inside BlobRegistryImpl::getBlobDataFromURL(). Test: fast/files/blob-with-fragment-as-frame-url.html * platform/network/BlobRegistryImpl.cpp: (WebCore::blobURLWithoutFragment): (WebCore::BlobRegistryImpl::registerBlobURLHandle): (WebCore::BlobRegistryImpl::unregisterBlobURLHandle): Source/WebKit: Fix theoretical blob data leak. A WebContent process could create several BlobURLHandles for the same blob URL. This would result in several calls to NetworkConnectionToWebProcess::registerBlobURLHandle() for the same URL and several calls to to BlobRegistryImpl::registerBlobURLHandle() for the same URL as well. BlobRegistryImpl is using a HashCountedSet for m_blobReferences in order to deal with this fact. However, NetworkConnectionToWebProcess was using a simple HashSet for m_blobURLHandles. As a result, if the WebContent process would exit and didClose() would get called, the NetworkConnectionToWebProcess may call BlobRegistryImpl::unregisterBlobURLHandle() only once even though the WebContent process had several handles for this URL, which would not fully remove the URL from BlobRegistryImpl's HashCountedSet. To address the issue, NetworkConnectionToWebProcess::m_blobURLHandles is now a HashCountedSet too and we call BlobRegistryImpl::unregisterBlobURLHandle() as many times as needed in didClose(). * NetworkProcess/NetworkConnectionToWebProcess.cpp: (WebKit::NetworkConnectionToWebProcess::didClose): * NetworkProcess/NetworkConnectionToWebProcess.h: LayoutTests: Add layout test coverage. * fast/files/blob-with-fragment-as-frame-url-expected.txt: Added. * fast/files/blob-with-fragment-as-frame-url.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291689 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-22 Chris Dumez REGRESSION (iOS 15.1 / r280824) QuickLook - model not loading when passing extra parameters https://bugs.webkit.org/show_bug.cgi?id=236069 Reviewed by Darin Adler. Add layout test coverage. * fast/files/blob-with-fragment-as-frame-url-expected.txt: Added. * fast/files/blob-with-fragment-as-frame-url.html: Added. 2022-04-18 Kocsen Chung Cherry-pick r292858. rdar://problem/90699078 [web-animations] REGRESSION(r291527): assertion hit during teardown of document with CSS Animations https://bugs.webkit.org/show_bug.cgi?id=239291 rdar://90699078 Reviewed by Dean Jackson. Source/WebCore: When a CSS Animation is not considered to be relevant anymore, it is removed from both AnimationTimeline::m_animations and Styleable::animations(). However, if that animation becomes relevant again, it will be added back to the associated effect stack as well as AnimationTimeline::m_animations but not to Styleable::animations(). This causes a problem because when eventually that CSS Animation's target is removed from the tree, such as during document teardown, Styleable::cancelDeclarativeAnimations() will be called an iterate over Styleable::animations() to find declarative animations to cancel. Since the CSS animation was not added to Styleable::animations(), it will not be canceled and the associated effect will not be removed from the effect stack. Later in Styleable::cancelDeclarativeAnimations(), the list of associated CSS Animation names is cleared. If during that teardown an animation resolution is performed, such as within a "beforeunload" event listener as shown in the new test, we will get into a state where there are effects left in the effect stack of the element being torn down but no associated CSS Animation names and we will hit the RELEASE_ASSERT_NOT_REACHED() at the end of compareCSSAnimations(). To fix this, we simply ensure that we add animations back to Styleable::animations() within AnimationTimeline::animationTimingDidChange() the same way we add the animations back to AnimationTimeline::m_animations. Test: webanimations/css-animation-resolution-during-teardown.html * animation/AnimationTimeline.cpp: (WebCore::AnimationTimeline::animationTimingDidChange): LayoutTests: Add a new test that would have asserted prior to the source change. * webanimations/css-animation-resolution-during-teardown-expected.txt: Added. * webanimations/css-animation-resolution-during-teardown.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@292858 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-04-13 Antoine Quint [web-animations] REGRESSION(r291527): assertion hit during teardown of document with CSS Animations https://bugs.webkit.org/show_bug.cgi?id=239291 rdar://90699078 Reviewed by Dean Jackson. Add a new test that would have asserted prior to the source change. * webanimations/css-animation-resolution-during-teardown-expected.txt: Added. * webanimations/css-animation-resolution-during-teardown.html: Added. 2022-04-18 Kocsen Chung Cherry-pick r292522. rdar://problem/91130503 NBSP characters drawn in fonts that don't support the space character turn into boxes https://bugs.webkit.org/show_bug.cgi?id=238836 Reviewed by Alan Bujtas. Source/WebCore: We have some historical code in WebKit where we swap out the non-breaking space glyph for the space glyphs when rendering. This is not what the other browsers do; they will faithfully render the non-breaking space glyph. This patch aligns with the other browsers. This patch also fixes a similar problem with tab characters. Other browsers never render any visible tab glyphs, even if the font has a visible glyph for the tab character. This patch implements this. This patch also only clobbers the glyphs used for carriageReturn and newlineCharacter if the replacement glyph exists. Test: fast/text/nbsp-no-space.html * platform/graphics/WidthIterator.cpp: (WebCore::WidthIterator::applyCSSVisibilityRules): LayoutTests: * fast/text/nbsp-no-space-expected.html: Added. * fast/text/nbsp-no-space.html: Added. * fast/text/resources/Ahem-nbsp-no-space.ttf: Added. Supports NBSP but not space. * fast/text/resources/Ahem-visible-tab-and-space.ttf: Added. Has visible glyphs for tab and space. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@292522 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-04-06 Myles C. Maxfield NBSP characters drawn in fonts that don't support the space character turn into boxes https://bugs.webkit.org/show_bug.cgi?id=238836 Reviewed by Alan Bujtas. * fast/text/nbsp-no-space-expected.html: Added. * fast/text/nbsp-no-space.html: Added. * fast/text/resources/Ahem-nbsp-no-space.ttf: Added. Supports NBSP but not space. * fast/text/resources/Ahem-visible-tab-and-space.ttf: Added. Has visible glyphs for tab and space. 2022-04-18 Kocsen Chung Cherry-pick r291852. rdar://problem/83235846 Improve rebuilding of ruby subtrees https://bugs.webkit.org/show_bug.cgi?id=238365 Source/WebCore: Patch by Frédéric Wang on 2022-03-25 Reviewed by Alan Bujtas. Don't collapse generated Ruby subtree when tearing down children and take into account the fact that anonymous before/after node can belong to a display: content child. * rendering/updating/RenderTreeBuilder.cpp: (WebCore::RenderTreeBuilder::destroyAndCleanUpAnonymousWrappers): Don't collapse. * rendering/updating/RenderTreeBuilderRuby.cpp: (WebCore::lastRubyRun): Child can be also be an anonymous after content. (WebCore::RenderTreeBuilder::Ruby::findOrCreateParentForChild): When beforeChild is an anonymous before/after, just fallback to appending to the last ruby run. LayoutTests: Patch by Frederic Wang on 2022-03-25 Reviewed by Alan Bujtas. Expectation for rubyDOM-remove-text2.html is updated now that we don't collapse anonymous RenderRubyBase nodes. * platform/gtk/fast/ruby/rubyDOM-remove-text2-expected.txt: Updated. * platform/ios/fast/ruby/rubyDOM-remove-text2-expected.txt: Updated. * platform/mac/fast/ruby/rubyDOM-remove-text2-expected.txt: Updated. * platform/win/fast/ruby/rubyDOM-remove-text2-expected.txt: Updated. * platform/wincairo/fast/ruby/rubyDOM-remove-text2-expected.txt: Updated. * platform/wpe/fast/ruby/rubyDOM-remove-text2-expected.txt: Updated. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291852 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-25 Frederic Wang Improve rebuilding of ruby subtrees https://bugs.webkit.org/show_bug.cgi?id=238365 Reviewed by Alan Bujtas. Expectation for rubyDOM-remove-text2.html is updated now that we don't collapse anonymous RenderRubyBase nodes. * platform/gtk/fast/ruby/rubyDOM-remove-text2-expected.txt: Updated. * platform/ios/fast/ruby/rubyDOM-remove-text2-expected.txt: Updated. * platform/mac/fast/ruby/rubyDOM-remove-text2-expected.txt: Updated. * platform/win/fast/ruby/rubyDOM-remove-text2-expected.txt: Updated. * platform/wincairo/fast/ruby/rubyDOM-remove-text2-expected.txt: Updated. * platform/wpe/fast/ruby/rubyDOM-remove-text2-expected.txt: Updated. 2022-04-18 Kocsen Chung Cherry-pick r290622. rdar://problem/90454629 REBASELINE [ iOS15 ] fast/text/khmer-lao-font.html is a constant text failure Unreviewed test gardening. Rebaseline for iOS15. * platform/ios-wk2/TestExpectations: * platform/ios-wk2/fast/text/khmer-lao-font-expected.txt: * platform/ios/fast/text/khmer-lao-font-expected.txt: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290622 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-28 Robert Jenner REBASELINE [ iOS15 ] fast/text/khmer-lao-font.html is a constant text failure Unreviewed test gardening. Rebaseline for iOS15. * platform/ios-wk2/TestExpectations: * platform/ios-wk2/fast/text/khmer-lao-font-expected.txt: * platform/ios/fast/text/khmer-lao-font-expected.txt: 2022-04-18 Kocsen Chung Cherry-pick r289834. rdar://problem/90455347 Rebaslining fonts/monospace.html for Monterey. https://bugs.webkit.org/show_bug.cgi?id=236619 Unreviewed test gardening. Patch by Matteo Flores on 2022-02-15 * platform/mac-catalina/fonts/monospace-expected.txt: Copied from LayoutTests/platform/mac/fonts/monospace-expected.txt. * platform/mac/fonts/monospace-expected.txt: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289834 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-15 Matteo Flores Rebaslining fonts/monospace.html for Monterey. https://bugs.webkit.org/show_bug.cgi?id=236619 Unreviewed test gardening. * platform/mac-catalina/fonts/monospace-expected.txt: Copied from LayoutTests/platform/mac/fonts/monospace-expected.txt. * platform/mac/fonts/monospace-expected.txt: 2022-04-07 Alan Coon Cherry-pick r291629. rdar://problem/91446360 YouTube.com - Clicking anywhere on the progress bar pauses the video https://bugs.webkit.org/show_bug.cgi?id=237750 Reviewed by Eric Carlson. Source/WebCore: Test: media/media-source/media-source-unexpected-pause.html When calling play() or pause() on a MediaPlayerPrivateMediaSourceAVFObjC, the object will respond by calling m_player->playbackStateChanged(), which will in turn call HTMLMediaElement::mediaPlayerPlaybackStateChanged() with the new state. However, HTMLMediaElement expects this to be called only for unanticipated state changes, not expected state changes. And when that method is called and the reported state does not match the element's own expected state, the element calls its own play() or pause() function to update its own state to match the player's. And because MediaPlayerPrivateMediaSourceAVFObjC calls this method on the next run loop, there is an opportunity for those states to get out of sync, which happens when YouTube responds to a tap in its timeline. Remove the unnecessary "call on next run loop" behavior of MediaPlayerPrivateMediaSourceAVFObjC:: play() and ::pause(). Also, remove the unnecessary notification that the play state has changed. In the future, this can be accomplished by adding a callback parameter to MediaPlayer::play() rather than relying on a state change notification. * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm: (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::play): (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::playInternal): (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::pause): (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::pauseInternal): (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::playAtHostTime): (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::pauseAtHostTime): LayoutTests: * media/media-source/media-source-unexpected-pause-expected.txt: Added. * media/media-source/media-source-unexpected-pause.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291629 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-22 Jer Noble YouTube.com - Clicking anywhere on the progress bar pauses the video https://bugs.webkit.org/show_bug.cgi?id=237750 Reviewed by Eric Carlson. * media/media-source/media-source-unexpected-pause-expected.txt: Added. * media/media-source/media-source-unexpected-pause.html: Added. 2022-04-07 Alan Coon Cherry-pick r291493. rdar://problem/91446052 REGRESSION (r290628): Scrubber makes a visual trail when scrubbing on tv.youtube.com https://bugs.webkit.org/show_bug.cgi?id=238047 Reviewed by Alan Bujtas. Source/WebCore: In r290628 I added a call to clearRepaintRects() when changing the backing sharing target layer for a RenderLayer. However, for a layer using backing sharing, this gets called twice during a normal compositing update, which has the effect of clearing the cached repaint rects so that a layer repaint always computes new rects. Thus, if a layer moved, we'd fail to repaint the old rect. RenderLayerBacking::setBackingSharingLayers() already has logic to update repaint rects when state changes, so we don't need this clearing. Test: compositing/repaint/move-backing-sharing-layer.html * rendering/RenderLayer.cpp: (WebCore::RenderLayer::setBackingProviderLayer): LayoutTests: * compositing/repaint/move-backing-sharing-layer-expected.txt: Added. * compositing/repaint/move-backing-sharing-layer.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291493 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-18 Simon Fraser REGRESSION (r290628): Scrubber makes a visual trail when scrubbing on tv.youtube.com https://bugs.webkit.org/show_bug.cgi?id=238047 Reviewed by Alan Bujtas. * compositing/repaint/move-backing-sharing-layer-expected.txt: Added. * compositing/repaint/move-backing-sharing-layer.html: Added. 2022-04-07 Alan Coon Cherry-pick r291118. rdar://problem/91446071 [iOS] Netflix.com fails to resume after moving app to background during playback https://bugs.webkit.org/show_bug.cgi?id=237659 Reviewed by Eric Carlson. Source/WebCore: Test: media/media-source/media-source-interruption-with-resume-allowing-play.html When the MediaPlayerPrivateMediaSourceAVFObjC player is asked to play or pause, it notifies the client (HTMLMediaElement) that its playback state has changed. HTMLMediaElement will in response call playInternal() or pauseInternal() to ensure that a state change driven by the MediaPlayer is reflected up to the DOM. However, when an interruption causes the media element to suspend and pause playback, this results in an additional call to pauseInternal(), which updates the "state to resume" after an interruption ends to "Paused". In mediaPlayerPlaybackStateChanged(), only call pauseInternal() or playInternal() if the reported player state does not match the HTMLMediaElement's own state. * html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::mediaPlayerPlaybackStateChanged): LayoutTests: * media/media-source/media-source-interruption-with-resume-allowing-play-expected.txt: Added. * media/media-source/media-source-interruption-with-resume-allowing-play.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291118 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-10 Jer Noble [iOS] Netflix.com fails to resume after moving app to background during playback https://bugs.webkit.org/show_bug.cgi?id=237659 Reviewed by Eric Carlson. * media/media-source/media-source-interruption-with-resume-allowing-play-expected.txt: Added. * media/media-source/media-source-interruption-with-resume-allowing-play.html: Added. 2022-04-07 Alan Coon Cherry-pick r288622. rdar://problem/91446028 [WebAuthn] Add authenticator attachment used during authentication to credential payload https://bugs.webkit.org/show_bug.cgi?id=235621 rdar://86538235 Reviewed by Dean Jackson. Source/WebCore: This patch adds the authenticator attachment used to the credential response in get/create webauthn calls as described in the merged PR to the spec: https://github.com/w3c/webauthn/pull/1668/files Modified layout tests to check for authenticator attachment = (cross-platform/platform) where appropriate and verified response in manual calls. * Modules/webauthn/PublicKeyCredential.cpp: (WebCore::PublicKeyCredential::authenticatorAttachment const): * Modules/webauthn/PublicKeyCredential.h: * Modules/webauthn/PublicKeyCredential.idl: LayoutTests: Modify webauthn layout tests to check for new authenticatorAttachment field. * http/wpt/webauthn/public-key-credential-get-success-local.https.html: * http/wpt/webauthn/resources/util.js: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288622 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-26 J Pascoe [WebAuthn] Add authenticator attachment used during authentication to credential payload https://bugs.webkit.org/show_bug.cgi?id=235621 rdar://86538235 Reviewed by Dean Jackson. Modify webauthn layout tests to check for new authenticatorAttachment field. * http/wpt/webauthn/public-key-credential-get-success-local.https.html: * http/wpt/webauthn/resources/util.js: 2022-04-07 Alan Coon Cherry-pick r292229. rdar://problem/90778752 CSP: WASM fails to execute after window.open https://bugs.webkit.org/show_bug.cgi?id=238562 Reviewed by Brent Fulgham. Source/WebCore: Test: http/tests/security/contentSecurityPolicy/allow-wasm-after-window-open.html Reset WASM enabled value after a window.open() call. This patch simplifies eval and wasm setters by removing the distinct enable/disable functions and using one consistent setter. * bindings/js/ScriptController.cpp: (WebCore::ScriptController::setEvalEnabled): (WebCore::ScriptController::setWebAssemblyEnabled): (WebCore::ScriptController::enableEval): Deleted. (WebCore::ScriptController::enableWebAssembly): Deleted. (WebCore::ScriptController::disableEval): Deleted. (WebCore::ScriptController::disableWebAssembly): Deleted. * bindings/js/ScriptController.h: * dom/Document.cpp: (WebCore::Document::disableEval): (WebCore::Document::disableWebAssembly): * loader/FrameLoader.cpp: (WebCore::FrameLoader::clear): * page/csp/ContentSecurityPolicy.h: (WebCore::ContentSecurityPolicy::webAssemblyErrorMessage const): LayoutTests: Layout test coverage. Copy some wasm helper scripts into the http directory. * platform/win/TestExpectations: We don't support wasm on win. * http/tests/security/contentSecurityPolicy/allow-wasm-after-window-open-expected.txt: Added. * http/tests/security/contentSecurityPolicy/allow-wasm-after-window-open.html: Added. * http/tests/security/contentSecurityPolicy/resources/load_wasm.js: Added. (createWasmModule): * http/tests/security/contentSecurityPolicy/resources/run-web-assembly.html: Added. * http/tests/security/contentSecurityPolicy/resources/wasm-builder.js: Added. (const._fail): (const.isNotA.assert.isNotA): (const): (switch.typeof): (Builder): (Builder.prototype.setChecked): (Builder.prototype.setPreamble): (Builder.prototype._functionIndexSpaceKeyHash): (Builder.prototype._registerFunctionToIndexSpace): (Builder.prototype._getFunctionFromIndexSpace): (Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section): (Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.const.codeBuilder.End.switch.case.string_appeared_here.e): (Builder.prototype._registerSectionBuilders.this.Unknown): git-svn-id: https://svn.webkit.org/repository/webkit/trunk@292229 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-04-01 Kate Cheney CSP: WASM fails to execute after window.open https://bugs.webkit.org/show_bug.cgi?id=238562 Reviewed by Brent Fulgham. Layout test coverage. Copy some wasm helper scripts into the http directory. * platform/win/TestExpectations: We don't support wasm on win. * http/tests/security/contentSecurityPolicy/allow-wasm-after-window-open-expected.txt: Added. * http/tests/security/contentSecurityPolicy/allow-wasm-after-window-open.html: Added. * http/tests/security/contentSecurityPolicy/resources/load_wasm.js: Added. (createWasmModule): * http/tests/security/contentSecurityPolicy/resources/run-web-assembly.html: Added. * http/tests/security/contentSecurityPolicy/resources/wasm-builder.js: Added. (const._fail): (const.isNotA.assert.isNotA): (const): (switch.typeof): (Builder): (Builder.prototype.setChecked): (Builder.prototype.setPreamble): (Builder.prototype._functionIndexSpaceKeyHash): (Builder.prototype._registerFunctionToIndexSpace): (Builder.prototype._getFunctionFromIndexSpace): (Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section): (Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.const.codeBuilder.End.switch.case.string_appeared_here.e): (Builder.prototype._registerSectionBuilders.this.Unknown): 2022-04-07 Alan Coon Cherry-pick r292028. rdar://problem/90977255 Re-import inert and WPT https://bugs.webkit.org/show_bug.cgi?id=238502 Reviewed by Antti Koivisto. Upstream commit: https://github.com/web-platform-tests/wpt/commit/46e50fc357127c76c898675cd30ae34090a2268d Main changes: - Removes .tentative.html suffix from inert tests - Adds default-color.html test for LayoutTests/imported/w3c: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/default-color-expected.txt: Added. * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/default-color.html: Added. * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-inert-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-inert.tentative-expected.txt. * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-inert.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-inert.tentative.html. * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/modal-dialog-selection-expected.txt: Added. * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/modal-dialog-selection.html: Added. * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/w3c-import.log: * web-platform-tests/inert/dynamic-inert-on-focused-element-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/dynamic-inert-on-focused-element.tentative-expected.txt. * web-platform-tests/inert/dynamic-inert-on-focused-element.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/dynamic-inert-on-focused-element.tentative.html. * web-platform-tests/inert/inert-and-contenteditable-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-and-contenteditable.tentative-expected.txt. * web-platform-tests/inert/inert-and-contenteditable.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-and-contenteditable.tentative.html. * web-platform-tests/inert/inert-canvas-fallback-content-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-canvas-fallback-content.tentative-expected.txt. * web-platform-tests/inert/inert-canvas-fallback-content.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-canvas-fallback-content.tentative.html. * web-platform-tests/inert/inert-does-not-match-disabled-selector-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-does-not-match-disabled-selector.tentative-expected.txt. * web-platform-tests/inert/inert-does-not-match-disabled-selector.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-does-not-match-disabled-selector.tentative.html. * web-platform-tests/inert/inert-iframe-hittest-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-iframe-hittest.tentative-expected.txt. * web-platform-tests/inert/inert-iframe-hittest.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-iframe-hittest.tentative.html. * web-platform-tests/inert/inert-iframe-tabbing-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-iframe-tabbing.tentative-expected.txt. * web-platform-tests/inert/inert-iframe-tabbing.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-iframe-tabbing.tentative.html. * web-platform-tests/inert/inert-in-shadow-dom-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-in-shadow-dom.tentative-expected.txt. * web-platform-tests/inert/inert-in-shadow-dom.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-in-shadow-dom.tentative.html. * web-platform-tests/inert/inert-inlines-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-inlines.tentative-expected.txt. * web-platform-tests/inert/inert-inlines.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-inlines.tentative.html. * web-platform-tests/inert/inert-label-focus-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-label-focus.tentative-expected.txt. * web-platform-tests/inert/inert-label-focus.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-label-focus.tentative.html. * web-platform-tests/inert/inert-node-is-uneditable-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-node-is-uneditable.tentative-expected.txt. * web-platform-tests/inert/inert-node-is-uneditable.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-node-is-uneditable.tentative.html. * web-platform-tests/inert/inert-node-is-unfocusable-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-node-is-unfocusable.tentative-expected.txt. * web-platform-tests/inert/inert-node-is-unfocusable.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-node-is-unfocusable.tentative.html. * web-platform-tests/inert/inert-node-is-unselectable-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-node-is-unselectable.tentative-expected.txt. * web-platform-tests/inert/inert-node-is-unselectable.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-node-is-unselectable.tentative.html. * web-platform-tests/inert/inert-on-non-html-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-on-non-html.tentative-expected.txt. * web-platform-tests/inert/inert-on-non-html.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-on-non-html.tentative.html. * web-platform-tests/inert/inert-on-slots-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-on-slots.tentative-expected.txt. * web-platform-tests/inert/inert-on-slots.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-on-slots.tentative.html. * web-platform-tests/inert/inert-svg-hittest-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-svg-hittest.tentative-expected.txt. * web-platform-tests/inert/inert-svg-hittest.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-svg-hittest.tentative.html. * web-platform-tests/inert/inert-with-modal-dialog-001-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-with-modal-dialog-001.tentative-expected.txt. * web-platform-tests/inert/inert-with-modal-dialog-001.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-with-modal-dialog-001.tentative.html. * web-platform-tests/inert/inert-with-modal-dialog-002-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-with-modal-dialog-002.tentative-expected.txt. * web-platform-tests/inert/inert-with-modal-dialog-002.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/inert/inert-with-modal-dialog-002.tentative.html. * web-platform-tests/inert/w3c-import.log: LayoutTests: * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-hittest-expected.txt: Renamed from LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-hittest.tentative-expected.txt. * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-tabbing-expected.txt: Renamed from LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-tabbing.tentative-expected.txt. * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-node-is-uneditable-expected.txt: Renamed from LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-node-is-uneditable.tentative-expected.txt. * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-svg-hittest-expected.txt: Renamed from LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-svg-hittest.tentative-expected.txt. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@292028 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-29 Tim Nguyen Re-import inert and WPT https://bugs.webkit.org/show_bug.cgi?id=238502 Reviewed by Antti Koivisto. Upstream commit: https://github.com/web-platform-tests/wpt/commit/46e50fc357127c76c898675cd30ae34090a2268d Main changes: - Removes .tentative.html suffix from inert tests - Adds default-color.html test for * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-hittest-expected.txt: Renamed from LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-hittest.tentative-expected.txt. * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-tabbing-expected.txt: Renamed from LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-tabbing.tentative-expected.txt. * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-node-is-uneditable-expected.txt: Renamed from LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-node-is-uneditable.tentative-expected.txt. * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-svg-hittest-expected.txt: Renamed from LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-svg-hittest.tentative-expected.txt. 2022-04-07 Alan Coon Cherry-pick r291886. rdar://problem/72814440 `PointerEvent.movementX` always 0 (breaks https://noisecraft.app/) https://bugs.webkit.org/show_bug.cgi?id=220194 Reviewed by Simon Fraser. LayoutTests/imported/w3c: * web-platform-tests/pointerevents/pointerlock/pointerevent_movementxy_with_pointerlock-expected.txt: This change causes the test to progress further than before, but there still appear to be other issues elsewhere, so adjust the expected output to reflect that. Source/WebCore: Test: pointer-lock/pointermove-movement-delta.html * dom/PointerEvent.cpp: (WebCore::PointerEvent::PointerEvent): Also pass along the movement delta in the constructor that takes a `MouseEvent`. * dom/MouseEvent.h: * dom/MouseEvent.cpp: (WebCore::MouseEvent::create): (WebCore::MouseEvent::MouseEvent): Require that all constructors that aren't invoked from JS always provide a movement delta. * dom/MouseRelatedEvent.h: (WebCore::MouseRelatedEvent::movementX const): (WebCore::MouseRelatedEvent::movementY const): Expose these methods even when `!ENABLE(POINTER_LOCK)` so that they can be called without the callsite having to also have a `#if`. * page/EventHandler.cpp: (WebCore::EventHandler::dispatchDragEvent): Pass along the movement delta even when `!ENABLE(POINTER_LOCK)`. Tools: * DumpRenderTree/mac/EventSendingController.mm: (-[EventSendingController mouseMoveToX:Y:]): * WebKitTestRunner/mac/EventSenderProxy.mm: (WTR::EventSenderProxy::mouseMoveTo): On macOS, the screen's origin is the bottom-left corner, so we need to flip the `deltaY`. LayoutTests: * pointer-lock/pointermove-movement-delta.html: Added. * pointer-lock/pointermove-movement-delta-expected.txt: Added. * pointer-lock/mouse-event-delivery-expected.txt: Added. On macOS, the screen's origin is the bottom-left corner, so we need to flip the `deltaY`. * platform/gtk/imported/w3c/web-platform-tests/pointerevents/pointerlock/pointerevent_movementxy_with_pointerlock-expected.txt: Added. This change causes the test to progress further than before, but there still appear to be other issues elsewhere, so adjust the expected output to reflect that. * platform/mac-wk1/TestExpectations: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291886 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-25 Devin Rousso `PointerEvent.movementX` always 0 (breaks https://noisecraft.app/) https://bugs.webkit.org/show_bug.cgi?id=220194 Reviewed by Simon Fraser. * pointer-lock/pointermove-movement-delta.html: Added. * pointer-lock/pointermove-movement-delta-expected.txt: Added. * pointer-lock/mouse-event-delivery-expected.txt: Added. On macOS, the screen's origin is the bottom-left corner, so we need to flip the `deltaY`. * platform/gtk/imported/w3c/web-platform-tests/pointerevents/pointerlock/pointerevent_movementxy_with_pointerlock-expected.txt: Added. This change causes the test to progress further than before, but there still appear to be other issues elsewhere, so adjust the expected output to reflect that. * platform/mac-wk1/TestExpectations: 2022-04-07 Alan Coon Cherry-pick r291816. rdar://problem/90599352 REGRESSION (Safari 15.4): Nonce from link isn't used when loading style sheet https://bugs.webkit.org/show_bug.cgi?id=238014 Reviewed by Brent Fulgham. Source/WebCore: In https://bugs.webkit.org/show_bug.cgi?id=179728 we implemented nonce hiding from the DOM. It seems we missed once location where we need to reference the element.nonce() instead of the nonce attribute. * html/HTMLLinkElement.cpp: (WebCore::HTMLLinkElement::process): LayoutTests: * http/tests/security/contentSecurityPolicy/stylesheet-allowed-with-nonce-expected.txt: Added. * http/tests/security/contentSecurityPolicy/stylesheet-allowed-with-nonce.py: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291816 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-24 Kate Cheney REGRESSION (Safari 15.4): Nonce from link isn't used when loading style sheet https://bugs.webkit.org/show_bug.cgi?id=238014 Reviewed by Brent Fulgham. * http/tests/security/contentSecurityPolicy/stylesheet-allowed-with-nonce-expected.txt: Added. * http/tests/security/contentSecurityPolicy/stylesheet-allowed-with-nonce.py: Added. 2022-04-07 Alan Coon Cherry-pick r291813. rdar://problem/88761053 Safari can't play video completely at bilibili.com https://bugs.webkit.org/show_bug.cgi?id=236440 rdar://88761053 Reviewed by Jer Noble. Source/WebCore: Video frames were incorrectly evicted during a call to appendBuffer as the Source Buffer incorrectly assumed a discontinuity was present. When appending data to a source buffer, the MSE specs describe a method to detect discontinuities in the Coded Frame Processing algorithm (https://www.w3.org/TR/media-source/#sourcebuffer-coded-frame-processing) step 6: " - If last decode timestamp for track buffer is set and decode timestamp is less than last decode timestamp: OR - If last decode timestamp for track buffer is set and the difference between decode timestamp and last decode timestamp is greater than 2 times last frame duration. " The issue being what defines the last frame duration. Is it the frame last seen in the coded frame processing loop or the frame whose presentation timestamp is just before the one we are currently processing. H264 and HEVC have a concept of b-frames: that is a frame that depends on a future frame to be decoded. Those frames are found in the container and can be identified by their presentation timestamp higher than the frame following in decode order. Those present a challenge as the frame prior the current one in presentation order, may actually only be found several frames back in decode order. Bug 181891 attempted to fix a similar issue, and used the longest "decode duration" as a workaround to detect discontinuity in the content. It mentioned adopting the same technique as in Mozilla's MSE implementation, but Mozilla also skip discontinuity detection within a media segment (https://www.w3.org/TR/media-source/#media-segment which for fMP4 is a single moof box) an approach that can't be achieved with CoreMedia's AVStreamDataParser. As mentioned in bug 181891, CoreMedia ignore the decode timestamps' delta and juggles with the sample's duration so that there's no discontinuity in the demuxed samples' presentation time, causing false positive in the gap detection algorithm. Bilibili uses HEVC content, and uses an encoding that generate lots of b-frames, with a very wide sliding window (seen up to 12 frames). By using the longest frame duration found in either presentation or decode duration as threshold to identify a discontinuity, we can properly parse the content and not incorrectly evict appended frames. (As a side note, the use of HEVC with B-Frames is peculiar as not all hardware support it.) It is difficult to identify here if the issue is within the bilibili's content or CoreMedia's output, though the responsibility more than likely lies with bilibili. Test: media/media-source/media-mp4-hevc-bframes.html * platform/graphics/SourceBufferPrivate.cpp: (WebCore::SourceBufferPrivate::TrackBuffer::TrackBuffer): (WebCore::SourceBufferPrivate::resetTrackBuffers): (WebCore::SourceBufferPrivate::didReceiveSample): * platform/graphics/SourceBufferPrivate.h: LayoutTests: * media/media-source/content/test-bframes-hevc-manifest.json: Added. * media/media-source/content/test-bframes-hevc.mp4: Added. * media/media-source/media-mp4-hevc-bframes-expected.txt: Added. * media/media-source/media-mp4-hevc-bframes.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291813 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-24 Jean-Yves Avenard Safari can't play video completely at bilibili.com https://bugs.webkit.org/show_bug.cgi?id=236440 rdar://88761053 Reviewed by Jer Noble. * media/media-source/content/test-bframes-hevc-manifest.json: Added. * media/media-source/content/test-bframes-hevc.mp4: Added. * media/media-source/media-mp4-hevc-bframes-expected.txt: Added. * media/media-source/media-mp4-hevc-bframes.html: Added. 2022-04-07 Alan Coon Cherry-pick r291791. rdar://problem/90694727 REGRESSION (r287807): WEBGL_multi_draw validation rejecting valid arguments https://bugs.webkit.org/show_bug.cgi?id=238239 Patch by Kimmo Kinnunen on 2022-03-24 Reviewed by Darin Adler. Source/WebCore: Fix off-by-one error causing full buffer multidraws to be marked as invalid. Enable the newer WebGL conformance tests that test this. * html/canvas/WebGLMultiDraw.cpp: (WebCore::WebGLMultiDraw::validateOffset): LayoutTests: Enable the newer WebGL conformance tests that test this, marked Slow as they take a while to run. * TestExpectations: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291791 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-24 Kimmo Kinnunen REGRESSION (r287807): WEBGL_multi_draw validation rejecting valid arguments https://bugs.webkit.org/show_bug.cgi?id=238239 Reviewed by Darin Adler. Enable the newer WebGL conformance tests that test this, marked Slow as they take a while to run. * TestExpectations: 2022-04-07 Alan Coon Cherry-pick r291741. rdar://problem/88979099 Computation of Document siteForCookies is buggy in case document is created by window.open https://bugs.webkit.org/show_bug.cgi?id=238202 Reviewed by John Wilander. Source/WebCore: For top level navigations, we need to use the security origin to compute siteForCookies as the document may have the opener security origin. Add a Document routine to handle this case. Tests: http/tests/cookies/same-site/popup-from-iframe-same-site-with-post-form.html http/tests/cookies/same-site/popup-same-site-with-post-form.html * dom/Document.cpp: * dom/Document.h: * loader/FrameLoader.cpp: LayoutTests: * http/tests/cookies/resources/testharness-helpers.js: * http/tests/cookies/same-site/popup-from-iframe-same-site-with-post-form-expected.txt: Added. * http/tests/cookies/same-site/popup-from-iframe-same-site-with-post-form.html: Added. * http/tests/cookies/same-site/popup-same-site-with-post-form-expected.txt: Added. * http/tests/cookies/same-site/popup-same-site-with-post-form.html: Added. * http/tests/cookies/same-site/resources/popup-iframe.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291741 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-23 Youenn Fablet Computation of Document siteForCookies is buggy in case document is created by window.open https://bugs.webkit.org/show_bug.cgi?id=238202 Reviewed by John Wilander. * http/tests/cookies/resources/testharness-helpers.js: * http/tests/cookies/same-site/popup-from-iframe-same-site-with-post-form-expected.txt: Added. * http/tests/cookies/same-site/popup-from-iframe-same-site-with-post-form.html: Added. * http/tests/cookies/same-site/popup-same-site-with-post-form-expected.txt: Added. * http/tests/cookies/same-site/popup-same-site-with-post-form.html: Added. * http/tests/cookies/same-site/resources/popup-iframe.html: Added. 2022-04-07 Alan Coon Cherry-pick r291526. rdar://problem/90385586 REGRESSION (r285529): Flash of missing text when content on https://ahumanfuture.co animates https://bugs.webkit.org/show_bug.cgi?id=237972 rdar://90385586 Reviewed by Simon Fraser. Source/WebCore: Accelerated animations are added to a CALayer in two different ways. Transform-related animations are added in a CAAnimationGroup so that we can have control of the way they interact with each other. We added this system when we added support for individual CSS transform properties on top of the existing "transform" property. All CAAnimationGroup animations are timed to start at 1s and thus we subtract that same 1s value from all animations contained within such groups. All other animations, such as "opacity" animations, are added as simple leaf animations and their begin time is not subject to that 1s subtraction. In r285529, when we introduced leaf animations for transform properties other than transform-related properties, we took an unfortunate approach to deal with that 1s subtraction. We would *always* subtract 1s for all animations, and for leaf animation add that 1s back when we added them in the addLeafAnimation() lambda. However, we *did not* check whether that animation was newly started or if we were merely adding it again. This meant that every time GraphicsLayerCA::updateAnimations() was called, any leaf animation would have 1s added to their begin time. So, if for instance a page ran on a given element a "scale" animation for 1s and an "opacity" animation for 2s, when the "scale" animation would complete, GraphicsLayerCA::updateAnimations() would be called to remove that animation, and add 1s to the "opacity" animation begin time. We now set the begin time, if not already set, in two places: in the addLeafAnimation() lambda for leaf animations, and in the addAnimationsForProperty() lambda for animations added to groups. We only ever set the begin time if not already set during a previous update and only subtract the parent group begin time for animations contained within a group. Additionally, this means we set the begin times when we iterate over remaining animations after culling finished animations. As such, we no longer need to iterate over *all* known animations to set their begin time if needed prior to adding them. Test: webanimations/accelerated-animation-opacity-animation-begin-time-after-scale-animation-ends.html * platform/graphics/ca/GraphicsLayerCA.cpp: (WebCore::GraphicsLayerCA::updateAnimations): LayoutTests: Add a new test which would fail prior to the source change. In this test we start two animations: a "scale" animation which lasts for 100ms, and an "opacity" animation which lasts much longer but only visually updates for the duration of the "scale" animation. When the "scale" animation completes, we stop the test and ensure that the reference test shows that the "opacity" animation is at the state it should be in at at that time, and was not rewound due to the bug being fixed. * webanimations/accelerated-animation-opacity-animation-begin-time-after-scale-animation-ends-expected.html: Added. * webanimations/accelerated-animation-opacity-animation-begin-time-after-scale-animation-ends.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291526 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-19 Antoine Quint REGRESSION (r285529): Flash of missing text when content on https://ahumanfuture.co animates https://bugs.webkit.org/show_bug.cgi?id=237972 rdar://90385586 Reviewed by Simon Fraser. Add a new test which would fail prior to the source change. In this test we start two animations: a "scale" animation which lasts for 100ms, and an "opacity" animation which lasts much longer but only visually updates for the duration of the "scale" animation. When the "scale" animation completes, we stop the test and ensure that the reference test shows that the "opacity" animation is at the state it should be in at at that time, and was not rewound due to the bug being fixed. * webanimations/accelerated-animation-opacity-animation-begin-time-after-scale-animation-ends-expected.html: Added. * webanimations/accelerated-animation-opacity-animation-begin-time-after-scale-animation-ends.html: Added. 2022-04-07 Alan Coon Cherry-pick r290628. rdar://problem/85814854 Compositing/paint invalidation with transforms https://bugs.webkit.org/show_bug.cgi?id=233421 Reviewed by Alan Bujtas. Source/WebCore: When changing transform from something like `translate(0)` to `translate3d(0, 0, 0) scale(0.5, 0.5)`, we trigger compositing, and thus need to repaint the previous rect of the layer in its old repaint container. However, the existing code would take the new transform into account when computing that rect, thus dirtying a rect that is too small. To fix this, we need to use the cached repaint rects on RenderLayer for this repaint. However, doing so revealed a bug (via compositing/shared-backing/repaint-into-shared-backing.html) in how we compute repaint cached repaint rects in the presence of shared backing. During a compositing update, if a layer's composited state changed, we'd call computeRepaintRectsIncludingDescendants(), which computes rect relative to the layer's repaint container. But at this time, the state of backing sharing in BackingSharingState is in flux (we essentially don't know yet if a layer can use shared backing). So we may compute and cache repaint rects relative to the wrong container. To fix this, leverage the existing m_layersPendingRepaint logic, and delay computing the repaint rects until we've established our final backing sharing configuration. Tests: compositing/repaint/composite-and-scale-change.html compositing/shared-backing/repaint-into-shared-backing-become-composited.html * rendering/RenderLayer.cpp: (WebCore::RenderLayer::setBackingProviderLayer): (WebCore::RenderLayer::calculateClipRects const): * rendering/RenderLayerCompositor.cpp: (WebCore::RenderLayerCompositor::BackingSharingState::issuePendingRepaints): (WebCore::RenderLayerCompositor::updateBacking): LayoutTests: * compositing/repaint/composite-and-scale-change-expected.txt: Added. * compositing/repaint/composite-and-scale-change.html: Added. Test that dumps repaint rects. * compositing/shared-backing/repaint-into-shared-backing-become-composited-expected.html: Added. * compositing/shared-backing/repaint-into-shared-backing-become-composited.html: Added. Companion to repaint-into-shared-backing.html but toggles compositing in the other direction. * platform/gtk/compositing/repaint/composite-and-scale-change-actual.txt: Added. * platform/mac-wk1/compositing/repaint/composite-and-scale-change-expected.txt: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290628 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-28 Simon Fraser Compositing/paint invalidation with transforms https://bugs.webkit.org/show_bug.cgi?id=233421 Reviewed by Alan Bujtas. * compositing/repaint/composite-and-scale-change-expected.txt: Added. * compositing/repaint/composite-and-scale-change.html: Added. Test that dumps repaint rects. * compositing/shared-backing/repaint-into-shared-backing-become-composited-expected.html: Added. * compositing/shared-backing/repaint-into-shared-backing-become-composited.html: Added. Companion to repaint-into-shared-backing.html but toggles compositing in the other direction. * platform/gtk/compositing/repaint/composite-and-scale-change-actual.txt: Added. * platform/mac-wk1/compositing/repaint/composite-and-scale-change-expected.txt: Added. 2022-03-31 Alan Coon Apply patch. rdar://problem/90957317 2022-03-08 J Pascoe [WebAuthn] Using WebAuthn within cross-origin iframe elements https://bugs.webkit.org/show_bug.cgi?id=222240 rdar://problem/74830748 Reviewed by Brent Fulgham. Update existing tests and create new test for cross-origin, non same-site i-frames. * http/wpt/webauthn/public-key-credential-cross-origin.https-expected.txt: Added. * http/wpt/webauthn/public-key-credential-cross-origin.https.html: Added. * http/wpt/webauthn/public-key-credential-same-origin-with-ancestors.https-expected.txt: * http/wpt/webauthn/public-key-credential-same-origin-with-ancestors.https.html: * http/wpt/webauthn/resources/public-key-credential-cross-origin.https.html: Added. 2022-03-29 Russell Epstein Cherry-pick r290392. rdar://problem/90957261 [WebAuthn] Improve error message for missing pubKeyCredParams https://bugs.webkit.org/show_bug.cgi?id=235421 rdar://87884875 Reviewed by Brent Fulgham. Source/WebCore: We have seen confusion from library authors around the language used in this error not indicating enough information about what the problem is. This patch adds additional information, useful to developers seeing this error. * Modules/webauthn/AuthenticatorCoordinator.cpp: (WebCore::AuthenticatorCoordinator::create const): LayoutTests: Update test to reflect new error message. * http/wpt/webauthn/public-key-credential-create-failure.https.html: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290392 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-23 J Pascoe [WebAuthn] Improve error message for missing pubKeyCredParams https://bugs.webkit.org/show_bug.cgi?id=235421 rdar://87884875 Reviewed by Brent Fulgham. Update test to reflect new error message. * http/wpt/webauthn/public-key-credential-create-failure.https.html: 2022-03-28 Alan Coon Cherry-pick r291622. rdar://problem/90935942 Fetching a Blob URL with an unbounded Range header do not generate a Content-Range response header https://bugs.webkit.org/show_bug.cgi?id=238170 Reviewed by Eric Carlson. Source/WebCore: Test: fetch/fetch-blob-unbounded-range.html Handle the case where the request contains an unbounded range, and property calculate the rangeEnd to pass into ParsedContentRange. * platform/network/BlobResourceHandle.cpp: (WebCore::BlobResourceHandle::notifyResponseOnSuccess): Source/WebKit: Handle the case where the request contains an unbounded range, and property calculate the rangeEnd to pass into ParsedContentRange. * NetworkProcess/NetworkDataTaskBlob.cpp: (WebKit::NetworkDataTaskBlob::dispatchDidReceiveResponse): LayoutTests: * fetch/fetch-blob-unbounded-range-expected.txt: Added. * fetch/fetch-blob-unbounded-range.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291622 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-22 Jer Noble Fetching a Blob URL with an unbounded Range header do not generate a Content-Range response header https://bugs.webkit.org/show_bug.cgi?id=238170 Reviewed by Eric Carlson. * fetch/fetch-blob-unbounded-range-expected.txt: Added. * fetch/fetch-blob-unbounded-range.html: Added. 2022-03-23 Alan Coon Revert r285998. rdar://problem/85612240 2022-03-23 Alan Coon Cherry-pick r290985. rdar://problem/78421282 Add a preference to mute video capture in case audio capture gets interrupted https://bugs.webkit.org/show_bug.cgi?id=237524 Reviewed by Eric Carlson. Source/WebCore: In case we detect that a microphone track source gets muted due to interruption, we mute capture video tracks based if allowed by the new MuteCameraOnMicrophoneInterruptionEnabled setting. Add support for mock microphone interruption and remove previous in process internals API. Test: fast/mediastream/media-stream-video-track-interrupted-from-audio.html * Modules/mediastream/MediaStreamTrack.cpp: * Modules/mediastream/MediaStreamTrack.h: * platform/mediastream/mac/CoreAudioCaptureSource.cpp: * platform/mediastream/mac/CoreAudioCaptureSource.h: * platform/mock/MockRealtimeAudioSource.cpp: (WebCore::MockRealtimeAudioSource::setIsInterrupted): * platform/mock/MockRealtimeAudioSource.h: * platform/mock/MockRealtimeMediaSourceCenter.cpp: (WebCore::MockRealtimeMediaSourceCenter::setMockCaptureDevicesInterrupted): (WebCore::MockRealtimeMediaSourceCenter::setMockCameraIsInterrupted): Deleted. * platform/mock/MockRealtimeMediaSourceCenter.h: Source/WebKit: Add support for interrupt mock microphone devices. Send to WebProcess sources whether sources are interrupted each time the source muted value changes. Store that value in remote sources. * GPUProcess/GPUProcess.cpp: * GPUProcess/GPUProcess.h: * GPUProcess/GPUProcess.messages.in: * UIProcess/API/C/WKPage.cpp: * UIProcess/API/C/WKPagePrivate.h: * UIProcess/Cocoa/UserMediaCaptureManagerProxy.cpp: * UIProcess/GPU/GPUProcessProxy.cpp: * UIProcess/GPU/GPUProcessProxy.h: * UIProcess/WebPageProxy.cpp: * UIProcess/WebPageProxy.h: * WebProcess/WebPage/WebPage.cpp: * WebProcess/WebPage/WebPage.h: * WebProcess/WebPage/WebPage.messages.in: * WebProcess/cocoa/RemoteRealtimeAudioSource.h: * WebProcess/cocoa/RemoteRealtimeDisplaySource.h: * WebProcess/cocoa/RemoteRealtimeMediaSourceProxy.cpp: * WebProcess/cocoa/RemoteRealtimeMediaSourceProxy.h: * WebProcess/cocoa/RemoteRealtimeVideoSource.h: * WebProcess/cocoa/UserMediaCaptureManager.cpp: * WebProcess/cocoa/UserMediaCaptureManager.h: * WebProcess/cocoa/UserMediaCaptureManager.messages.in: Source/WTF: * Scripts/Preferences/WebPreferencesInternal.yaml: Tools: Add support for interrupt mock microphone devices. * WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl: * WebKitTestRunner/InjectedBundle/TestRunner.cpp: * WebKitTestRunner/InjectedBundle/TestRunner.h: * WebKitTestRunner/TestController.cpp: * WebKitTestRunner/TestController.h: * WebKitTestRunner/TestInvocation.cpp: LayoutTests: * fast/mediastream/media-stream-video-track-interrupted-from-audio-expected.txt: Added. * fast/mediastream/media-stream-video-track-interrupted-from-audio.html: Added. * fast/mediastream/media-stream-video-track-interrupted.html: Migrated to testRunner API. * fast/mediastream/track-ended-while-muted.html: * platform/glib/TestExpectations: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290985 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-08 Youenn Fablet Add a preference to mute video capture in case audio capture gets interrupted https://bugs.webkit.org/show_bug.cgi?id=237524 Reviewed by Eric Carlson. * fast/mediastream/media-stream-video-track-interrupted-from-audio-expected.txt: Added. * fast/mediastream/media-stream-video-track-interrupted-from-audio.html: Added. * fast/mediastream/media-stream-video-track-interrupted.html: Migrated to testRunner API. * fast/mediastream/track-ended-while-muted.html: * platform/glib/TestExpectations: 2022-03-23 Alan Coon Cherry-pick r290745. rdar://problem/80335706 [Cocoa] The behavior of navigator-language-ru changed in Monterey / iOS 15 https://bugs.webkit.org/show_bug.cgi?id=237384 Unreviewed test gardening. Add a new test for the new behavior, but keep the old one too for older OSes. * fast/text/international/system-language/navigator-language/navigator-language-ru-2-expected.txt: Added. * fast/text/international/system-language/navigator-language/navigator-language-ru-2.html: Added. * platform/ios-14/TestExpectations: * platform/ios/TestExpectations: * platform/mac-wk2/TestExpectations: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290745 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-02 Myles C. Maxfield [Cocoa] The behavior of navigator-language-ru changed in Monterey / iOS 15 https://bugs.webkit.org/show_bug.cgi?id=237384 Unreviewed test gardening. Add a new test for the new behavior, but keep the old one too for older OSes. * fast/text/international/system-language/navigator-language/navigator-language-ru-2-expected.txt: Added. * fast/text/international/system-language/navigator-language/navigator-language-ru-2.html: Added. * platform/ios-14/TestExpectations: * platform/ios/TestExpectations: * platform/mac-wk2/TestExpectations: 2022-03-23 Alan Coon Cherry-pick r290550. rdar://problem/88675827 Update CSP handling of javascript URLs https://bugs.webkit.org/show_bug.cgi?id=236351 Reviewed by Brent Fulgham. LayoutTests/imported/w3c: * web-platform-tests/content-security-policy/navigation/to-javascript-parent-initiated-parent-csp-disallow-expected.txt: * web-platform-tests/content-security-policy/navigation/to-javascript-url-script-src-expected.txt: Source/WebCore: * bindings/js/ScriptController.cpp: (WebCore::ScriptController::executeJavaScriptURL): * loader/FrameLoader.cpp: (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy): (WebCore::createWindow): * loader/SubframeLoader.cpp: (WebCore::FrameLoader::SubframeLoader::requestFrame): * page/DOMWindow.cpp: (WebCore::DOMWindow::setLocation): * page/csp/ContentSecurityPolicy.cpp: (WebCore::ContentSecurityPolicy::allowJavaScriptURLs const): * page/csp/ContentSecurityPolicy.h: LayoutTests: * TestExpectations: * http/tests/security/contentSecurityPolicy/inline-script-blocked-javascript-url-expected.txt: * http/tests/security/contentSecurityPolicy/javascript-url-blocked-by-default-src-star-expected.txt: * http/tests/security/contentSecurityPolicy/javascript-url-blocked-expected.txt: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290550 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-26 Kate Cheney Update CSP handling of javascript URLs https://bugs.webkit.org/show_bug.cgi?id=236351 Reviewed by Brent Fulgham. * TestExpectations: * http/tests/security/contentSecurityPolicy/inline-script-blocked-javascript-url-expected.txt: * http/tests/security/contentSecurityPolicy/javascript-url-blocked-by-default-src-star-expected.txt: * http/tests/security/contentSecurityPolicy/javascript-url-blocked-expected.txt: 2022-03-23 Alan Coon Cherry-pick r290443. rdar://problem/89322580 Update CSP console logging https://bugs.webkit.org/show_bug.cgi?id=232216 Reviewed by Brent Fulgham. Source/WebCore: * loader/SubresourceLoader.cpp: (WebCore::SubresourceLoader::willSendRequestInternal): (WebCore::SubresourceLoader::originalHeaders const): * page/csp/ContentSecurityPolicy.cpp: (WebCore::ContentSecurityPolicy::allowResourceFromSource const): (WebCore::ContentSecurityPolicy::allowWorkerFromSource const): (WebCore::ContentSecurityPolicy::allowScriptFromSource const): (WebCore::ContentSecurityPolicy::allowStyleFromSource const): Source/WebKit: * NetworkProcess/NetworkLoadChecker.cpp: (WebKit::NetworkLoadChecker::check): (WebKit::NetworkLoadChecker::checkRedirection): (WebKit::NetworkLoadChecker::checkRequest): (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy): * NetworkProcess/NetworkLoadChecker.h: LayoutTests: * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/audio-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/font-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/image-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/script-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/track-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/video-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290443 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-24 Kate Cheney Update CSP console logging https://bugs.webkit.org/show_bug.cgi?id=232216 Reviewed by Brent Fulgham. * http/tests/security/contentSecurityPolicy/audio-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/audio-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/font-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/font-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/image-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/image-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/report-blocked-uri-after-multiple-redirects-expected.txt: * http/tests/security/contentSecurityPolicy/script-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/script-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/stylesheet-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/svg-font-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/svg-image-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/track-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/video-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/video-redirect-blocked.html: * http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt: 2022-03-22 Alan Coon Cherry-pick r288792. rdar://problem/88227274 CSP: Properly block image content in object elements https://bugs.webkit.org/show_bug.cgi?id=235837 Reviewed by Kate Cheney. LayoutTests/imported/w3c: Update expectations with more passes. * web-platform-tests/content-security-policy/object-src/object-src-url-blocked-expected.txt: * web-platform-tests/content-security-policy/object-src/object-src-url-embed-blocked-expected.txt: * web-platform-tests/content-security-policy/object-src/object-src-url-redirect-blocked.sub-expected.txt: Source/WebCore: When an image is loaded through an object element it now passes through the object-src directive check as the spec documents: https://www.w3.org/TR/CSP3/#directive-object-src * loader/ImageLoader.cpp: (WebCore::ImageLoader::updateFromElement): * loader/ResourceLoaderOptions.h: (WebCore::ResourceLoaderOptions::loadedFromPluginElement): (WebCore::ResourceLoaderOptions::ResourceLoaderOptions): (WebCore::ResourceLoaderOptions::loadedFromOpaqueSource): Deleted. * loader/cache/CachedResourceLoader.cpp: (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const): * page/csp/ContentSecurityPolicy.cpp: (WebCore::ContentSecurityPolicy::allowObjectFromSource const): * page/csp/ContentSecurityPolicy.h: LayoutTests: * http/tests/security/contentSecurityPolicy/userAgentShadowDOM/default-src-object-data-url-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/userAgentShadowDOM/default-src-object-data-url-blocked2-expected.txt: * http/tests/security/contentSecurityPolicy/userAgentShadowDOM/default-src-object-data-url-blocked3-expected.txt: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288792 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-29 Patrick Griffis CSP: Properly block image content in object elements https://bugs.webkit.org/show_bug.cgi?id=235837 Reviewed by Kate Cheney. * http/tests/security/contentSecurityPolicy/userAgentShadowDOM/default-src-object-data-url-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/userAgentShadowDOM/default-src-object-data-url-blocked2-expected.txt: * http/tests/security/contentSecurityPolicy/userAgentShadowDOM/default-src-object-data-url-blocked3-expected.txt: 2022-03-22 Alan Coon Revert r290708. rdar://problem/90113314 2022-03-21 Alan Coon Cherry-pick r291330. rdar://problem/90320701 REGRESSION (r282737): `text-shadow` is clipped https://bugs.webkit.org/show_bug.cgi?id=237898 Reviewed by Darin Adler. Source/WebCore: Inflate the ink overflow rect with the text shadow values (note that here, in the display builder we work with physical coordinates). Test: fast/text/text-shadow-ink-overflow-missing.html * layout/formattingContexts/inline/display/InlineDisplayContentBuilder.cpp: (WebCore::Layout::InlineDisplayContentBuilder::appendTextDisplayBox): * rendering/style/RenderStyle.h: (WebCore::RenderStyle::getTextShadowHorizontalExtent const): (WebCore::RenderStyle::getTextShadowVerticalExtent const): LayoutTests: * fast/text/text-shadow-ink-overflow-missing-expected.html: Added. * fast/text/text-shadow-ink-overflow-missing.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291330 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-15 Alan Bujtas REGRESSION (r282737): `text-shadow` is clipped https://bugs.webkit.org/show_bug.cgi?id=237898 Reviewed by Darin Adler. * fast/text/text-shadow-ink-overflow-missing-expected.html: Added. * fast/text/text-shadow-ink-overflow-missing.html: Added. 2022-03-21 Alan Coon Cherry-pick r291141. rdar://problem/90035071 Main document is leaking on haaretz.co.il due to lazy image loading https://bugs.webkit.org/show_bug.cgi?id=237660 Reviewed by Geoffrey Garen. Source/WebCore: When an HTML image uses `loading=lazy`, ImageLoader::updateFromElement() may get called twice. If the image is outside the viewport, the first time ImageLoader::updateFromElement() is called, we'll request a CachedImage but we'll set m_lazyImageLoadState to LazyImageLoadState::Deferred and not ask the CachedImage to load. Then, later on, if the HTML image approaches the viewport, ImageLoader::loadDeferredImage() will get called. It will set m_lazyImageLoadState to LazyImageLoadState::LoadImmediately and call updateFromElement() again. This time however, updateFromElement() will actually ask the CachedImage to load. The issue was that the first time ImageLoader::updateFromElement(), we would set m_lazyImageLoadState to Deferred and not ask the CachedImage to load but still set m_hasPendingLoadEvent to true. This is problematic if the CachedImage is not already loaded since no was was started and thus no load event is coming (and no load event may ever come if the image never approaches the viewport). When updatedHasPendingEvent() is called, it will protect the HTMLImageElement if m_hasPendingLoadEvent is true, to make sure the image element stays alive long enough for us to dispatch the load event. With lazy loading, this meant that we would protect the HTMLImageElement right away and undefinitely since no load event may ever come. This meant that when navigating away from a page with images that are lazily loaded (and not loaded yet), we would leak the HTMLImageElements (and ImageLoaders), which in turn would keep the Document alive too. To address the issue, we now make sure that m_hasPendingLoadEvent is no longer set to true when updateFromElement() is called but the CachedImage is not already loaded and not loading (lazy loading case). When updateFromElement() gets called the second time (when the lazily loaded image approaches the viewport), we make sure that the m_hasPendingLoadEvent flag gets set to true then. Test: fast/dom/lazy-image-loading-document-leak.html * loader/ImageLoader.cpp: (WebCore::ImageLoader::ImageLoader): (WebCore::ImageLoader::updateFromElement): (WebCore::ImageLoader::didUpdateCachedImage): (WebCore::ImageLoader::didStartLoading): * loader/ImageLoader.h: * loader/cache/CachedImage.cpp: (WebCore::CachedImage::load): * loader/cache/CachedImageClient.h: (WebCore::CachedImageClient::didStartLoading): LayoutTests: Add layout test coverage. * fast/dom/lazy-image-loading-document-leak-expected.txt: Added. * fast/dom/lazy-image-loading-document-leak.html: Added. * fast/dom/resources/lazy-image-loading-document-leak-popup.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291141 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-10 Chris Dumez Main document is leaking on haaretz.co.il due to lazy image loading https://bugs.webkit.org/show_bug.cgi?id=237660 Reviewed by Geoffrey Garen. Add layout test coverage. * fast/dom/lazy-image-loading-document-leak-expected.txt: Added. * fast/dom/lazy-image-loading-document-leak.html: Added. * fast/dom/resources/lazy-image-loading-document-leak-popup.html: Added. 2022-03-21 Alan Coon Cherry-pick r291030. rdar://problem/89989815 IntersectionObserver is causing massive document leaks on haaretz.co.il https://bugs.webkit.org/show_bug.cgi?id=237619 Reviewed by Simon Fraser. Source/WebCore: On haaretz.co.il, many of the iframe documents (for Google ad frames) were leaking due to IntersectionObserver. In particular, IntersectionObserver::isReachableFromOpaqueRoots() was returning true because m_targetsWaitingForFirstObservation was non-empty. This indicates that the IntersectionObserver is waiting for its first observation since that target was added. However, the observation is not coming because we navigated away from the document. To address the issue, I updated Document::commonTeardown() to disconnect all IntersectionObservers (and the very similar ResizeObservers), right after stopping all ActiveDOMObject. Test: fast/dom/intersection-observer-document-leak.html * dom/Document.cpp: (WebCore::Document::commonTeardown): * dom/Document.h: * page/IntersectionObserver.cpp: (WebCore::IntersectionObserver::disconnect): No longer return early if hasObservationTargets() returns false. This is because LayoutTests: Add layout test coverage. * fast/dom/intersection-observer-document-leak-expected.txt: Added. * fast/dom/intersection-observer-document-leak.html: Added. * fast/dom/resources/intersection-observer-document-leak-popup.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291030 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-08 Chris Dumez IntersectionObserver is causing massive document leaks on haaretz.co.il https://bugs.webkit.org/show_bug.cgi?id=237619 Reviewed by Simon Fraser. Add layout test coverage. * fast/dom/intersection-observer-document-leak-expected.txt: Added. * fast/dom/intersection-observer-document-leak.html: Added. * fast/dom/resources/intersection-observer-document-leak-popup.html: Added. 2022-03-21 Alan Coon Cherry-pick r291029. rdar://problem/88690874 [Cocoa] metadata cue endTime may not be updated https://bugs.webkit.org/show_bug.cgi?id=237630 rdar://88690874 Reviewed by Jer Noble. Source/WebCore: Data cues have a start time but not an explicit duration, a data cue ends when the next data cue from the same track starts. This means we don’t know the duration of cue #1 until cue #2 is delivered, so when cue #1 is delivered it is given the end time of the media file’s duration and the actual end time is updated when cue #2 arrives. http://webkit.org/b/229924 refactored text, audio, and video tracks to not depend on HTMLMediaElement. Because InbandDataTextTrack could no longer access the HTMLMediaElement to get its duration, a duration property was added to TextTrackList that InbandDataTextTrack uses to set the duration of temporary cues. TextTrackList.duration is set when it is created and updated when the media player reports a duration change. This means that if the media file’s duration is not known when the text track list is created, and the file's duration never changes, the text track list never has a valid duration and data cues were not added to the temporary list. Fix this by updating TextTrackList.duration when a HTMLMediaElement reaches HAVE_METADATA. Test: http/tests/media/hls/track-in-band-hls-metadata-cue-duration.html * html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::durationChanged): Update m_textTracks.duration and post the 'durationchange' event. (WebCore::HTMLMediaElement::setReadyState): Call durationChanged. (WebCore::HTMLMediaElement::mediaPlayerDurationChanged): Ditto. * html/HTMLMediaElement.h: * html/track/InbandDataTextTrack.cpp: (WebCore::InbandDataTextTrack::addDataCue): Add cues to the incomplete cue map even if the track list doesn't have duration. LayoutTests: * http/tests/media/hls/track-in-band-hls-metadata-cue-duration-expected.txt: Added. * http/tests/media/hls/track-in-band-hls-metadata-cue-duration.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291029 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-08 Eric Carlson [Cocoa] metadata cue endTime may not be updated https://bugs.webkit.org/show_bug.cgi?id=237630 rdar://88690874 Reviewed by Jer Noble. * http/tests/media/hls/track-in-band-hls-metadata-cue-duration-expected.txt: Added. * http/tests/media/hls/track-in-band-hls-metadata-cue-duration.html: Added. 2022-03-21 Alan Coon Cherry-pick r291009. rdar://problem/89952347 AX: Speech Synthesis no longer returning list of voices in macOS 12.3 https://bugs.webkit.org/show_bug.cgi?id=237584 Reviewed by Andres Gonzalez. Source/WTF: The minimum macOS version was meant to be 13 and above, but we started including 12.x releases inadvertently. * wtf/PlatformHave.h: LayoutTests: * fast/speechsynthesis/voices-non-mock-expected.txt: Added. * fast/speechsynthesis/voices-non-mock.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@291009 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-08 Chris Fleizach AX: Speech Synthesis no longer returning list of voices in macOS 12.3 https://bugs.webkit.org/show_bug.cgi?id=237584 Reviewed by Andres Gonzalez. * fast/speechsynthesis/voices-non-mock-expected.txt: Added. * fast/speechsynthesis/voices-non-mock.html: Added. 2022-03-21 Alan Coon Cherry-pick r290830. rdar://problem/89081463 CSP report does not get sent to the document in the case of a detached element https://bugs.webkit.org/show_bug.cgi?id=237440 Reviewed by Chris Dumez. Source/WebCore: Test: http/tests/security/contentSecurityPolicy/report-violation-to-document-after-element-has-been-detached.html Only send a violation report to the element if it is connected. Check right before dispatching in case the element gets detached after the security policy violation has been created. If the element is not connected in this case, we send the report to the document. * dom/Element.cpp: (WebCore::Element::enqueueSecurityPolicyViolationEvent): * page/csp/ContentSecurityPolicy.cpp: (WebCore::ContentSecurityPolicy::reportViolation const): Also sets the composed value on the violation event as per the spec. LayoutTests: * http/tests/security/contentSecurityPolicy/report-violation-to-document-after-element-has-been-detached-expected.txt: Added. * http/tests/security/contentSecurityPolicy/report-violation-to-document-after-element-has-been-detached.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290830 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-04 Kate Cheney CSP report does not get sent to the document in the case of a detached element https://bugs.webkit.org/show_bug.cgi?id=237440 Reviewed by Chris Dumez. * http/tests/security/contentSecurityPolicy/report-violation-to-document-after-element-has-been-detached-expected.txt: Added. * http/tests/security/contentSecurityPolicy/report-violation-to-document-after-element-has-been-detached.html: Added. 2022-03-21 Alan Coon Cherry-pick r290676. rdar://problem/83831093 [Cocoa] HLS stream currentTime sometimes jumps backwards https://bugs.webkit.org/show_bug.cgi?id=235087 rdar://83831093 Reviewed by Dean Jackson. Source/WebCore: Test: http/tests/media/hls/hls-non-zero-start-time.html * html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::updateActiveTextTrackCues): Drive-by: pass log identifier to lambda so the method name will be logged correctly. (WebCore::HTMLMediaElement::currentMediaTime const): Remove LOG_CACHED_TIME_WARNINGS build flag, always log time drift warnings when log level is DEBUG. * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h: * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm: (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer): Log when periodic time observer is passed unexpected values. (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerItem): Use NSKeyValueObservingOptionInitial KVO option for "@duration" property because we sometimes don't get a duration changed event for HLS streams, so m_cachedDuration remains invalid. (WebCore::MediaPlayerPrivateAVFoundationObjC::currentMediaTimeDidChange const): Drive-by: fix use-after-move. Source/WebKit: * WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp: (WebKit::MediaPlayerPrivateRemote::currentTimeChanged): Always notify player when time jumps backwards. LayoutTests: * http/tests/media/hls/hls-non-zero-start-time-expected.txt: Added. * http/tests/media/hls/hls-non-zero-start-time.html: Added. * http/tests/media/resources/hls/bip-bop-live.m3u8: Added. * http/tests/media/resources/hls/bipbop/start-offset.m3u8: Added. * http/tests/media/resources/hls/bipbop/start-offset.ts: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290676 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-01 Eric Carlson [Cocoa] HLS stream currentTime sometimes jumps backwards https://bugs.webkit.org/show_bug.cgi?id=235087 rdar://83831093 Reviewed by Dean Jackson. * http/tests/media/hls/hls-non-zero-start-time-expected.txt: Added. * http/tests/media/hls/hls-non-zero-start-time.html: Added. * http/tests/media/resources/hls/bip-bop-live.m3u8: Added. * http/tests/media/resources/hls/bipbop/start-offset.m3u8: Added. * http/tests/media/resources/hls/bipbop/start-offset.ts: Added. 2022-03-21 Alan Coon Cherry-pick r290645. rdar://problem/89180092 REGRESSION (r273129): Text contents in with opacity not repainting/updating when sibling element has "will-change: transform" https://bugs.webkit.org/show_bug.cgi?id=236876 Reviewed by Simon Fraser. Source/WebCore: This patch implements a slightly naive repaint for inline boxes with self painting layers. 1. Mark the line when it gains an inline box (RenderInline) with self painting layer (e.g. this has dedicated layer) 2. Issue repaint at the end of the line layout on such renderers. Test: fast/repaint/inline-box-with-self-paint-layer.html * rendering/LegacyInlineFlowBox.cpp: (WebCore::LegacyInlineFlowBox::addToLine): * rendering/LegacyInlineFlowBox.h: (WebCore::LegacyInlineFlowBox::LegacyInlineFlowBox): (WebCore::LegacyInlineFlowBox::hasSelfPaintInlineBox const): * rendering/LegacyLineLayout.cpp: (WebCore::repaintSelfPaintInlineBoxes): (WebCore::LegacyLineLayout::layoutRunsAndFloats): * rendering/RenderInline.cpp: (WebCore::RenderInline::clippedOverflowRect const): expand the ASSERT to enclsing inline boxes too. LayoutTests: * fast/repaint/inline-box-with-self-paint-layer-expected.html: Added. * fast/repaint/inline-box-with-self-paint-layer.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290645 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-01 Alan Bujtas REGRESSION (r273129): Text contents in with opacity not repainting/updating when sibling element has "will-change: transform" https://bugs.webkit.org/show_bug.cgi?id=236876 Reviewed by Simon Fraser. * fast/repaint/inline-box-with-self-paint-layer-expected.html: Added. * fast/repaint/inline-box-with-self-paint-layer.html: Added. 2022-03-21 Alan Coon Cherry-pick r290615. rdar://problem/87919197 Handle widow relayout differently https://bugs.webkit.org/show_bug.cgi?id=235519 Patch by Rob Buis on 2022-02-28 Reviewed by Alan Bujtas. Source/WebCore: Handle widow relayout differently to prevent function call recursion. Test: fast/multicol/widow-many-relayouts-crash.html * rendering/RenderBlockFlow.cpp: (WebCore::RenderBlockFlow::layoutBlock): (WebCore::RenderBlockFlow::relayoutToAvoidWidows): Deleted. * rendering/RenderBlockFlow.h: (WebCore::RenderBlockFlow::didBreakAtLineToAvoidWidow const): LayoutTests: * fast/multicol/widow-many-relayouts-crash-expected.txt: Added. * fast/multicol/widow-many-relayouts-crash.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290615 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-28 Rob Buis Handle widow relayout differently https://bugs.webkit.org/show_bug.cgi?id=235519 Reviewed by Alan Bujtas. * fast/multicol/widow-many-relayouts-crash-expected.txt: Added. * fast/multicol/widow-many-relayouts-crash.html: Added. 2022-03-21 Alan Coon Cherry-pick r290519. rdar://problem/89148022 Re-add YouTubePluginReplacement, removed in r285252 https://bugs.webkit.org/show_bug.cgi?id=237182 Source/WebCore: Patch by Alex Christensen on 2022-02-25 Reviewed by Chris Dumez. Tests: security/contentSecurityPolicy/object-src-none-blocks-youtube-plugin-replacement.html security/contentSecurityPolicy/plugins-types-allows-youtube-plugin-replacement.html security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement-without-mime-type.html security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement.html Its removal broke webpages that work in Chrome and Firefox, so back it comes. * Headers.cmake: * Modules/plugins: Copied from Source/WebCore/Modules/plugins. * SourcesCocoa.txt: * WebCore.xcodeproj/project.pbxproj: * bindings/js/JSPluginElementFunctions.cpp: (WebCore::pluginScriptObject): * bindings/scripts/CodeGeneratorJS.pm: (GenerateImplementation): * bindings/scripts/test/JS/JSTestPluginInterface.cpp: (WebCore::JSTestPluginInterface::visitChildrenImpl): * html/HTMLPlugInElement.cpp: (WebCore::HTMLPlugInElement::createElementRenderer): (WebCore::HTMLPlugInElement::didAddUserAgentShadowRoot): (WebCore::registrar): (WebCore::pluginReplacementForType): (WebCore::HTMLPlugInElement::requestObject): (WebCore::HTMLPlugInElement::scriptObjectForPluginReplacement): * html/HTMLPlugInElement.h: (WebCore::HTMLPlugInElement::pluginReplacementScriptObject): * html/shadow/ShadowPseudoIds.cpp: (WebCore::ShadowPseudoIds::webkitPluginReplacement): * html/shadow/ShadowPseudoIds.h: * html/shadow/YouTubeEmbedShadowElement.cpp: * html/shadow/YouTubeEmbedShadowElement.h: * page/Settings.yaml: Tools: Patch by Alex Christensen on 2022-02-25 Reviewed by Chris Dumez. * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: * TestWebKitAPI/Tests/WebCore/YouTubePluginReplacement.cpp: LayoutTests: Patch by Alex Christensen on 2022-02-25 Reviewed by Chris Dumez. * TestExpectations: * platform/ios-wk2/TestExpectations: * platform/win/TestExpectations: * security/contentSecurityPolicy/object-src-none-blocks-youtube-plugin-replacement-expected.txt: Copied from LayoutTests/security/contentSecurityPolicy/object-src-none-blocks-youtube-plugin-replacement-expected.txt. * security/contentSecurityPolicy/object-src-none-blocks-youtube-plugin-replacement.html: Copied from LayoutTests/security/contentSecurityPolicy/object-src-none-blocks-youtube-plugin-replacement.html. * security/contentSecurityPolicy/plugins-types-allows-youtube-plugin-replacement-expected.txt: Copied from LayoutTests/security/contentSecurityPolicy/plugins-types-allows-youtube-plugin-replacement-expected.txt. * security/contentSecurityPolicy/plugins-types-allows-youtube-plugin-replacement.html: Copied from LayoutTests/security/contentSecurityPolicy/plugins-types-allows-youtube-plugin-replacement.html. * security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement-expected.txt: Copied from LayoutTests/security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement-expected.txt. * security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement-without-mime-type-expected.txt: Copied from LayoutTests/security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement-without-mime-type-expected.txt. * security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement-without-mime-type.html: Copied from LayoutTests/security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement-without-mime-type.html. * security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement.html: Copied from LayoutTests/security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement.html. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290519 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-25 Alex Christensen Re-add YouTubePluginReplacement, removed in r285252 https://bugs.webkit.org/show_bug.cgi?id=237182 Reviewed by Chris Dumez. * TestExpectations: * platform/ios-wk2/TestExpectations: * platform/win/TestExpectations: * security/contentSecurityPolicy/object-src-none-blocks-youtube-plugin-replacement-expected.txt: Copied from LayoutTests/security/contentSecurityPolicy/object-src-none-blocks-youtube-plugin-replacement-expected.txt. * security/contentSecurityPolicy/object-src-none-blocks-youtube-plugin-replacement.html: Copied from LayoutTests/security/contentSecurityPolicy/object-src-none-blocks-youtube-plugin-replacement.html. * security/contentSecurityPolicy/plugins-types-allows-youtube-plugin-replacement-expected.txt: Copied from LayoutTests/security/contentSecurityPolicy/plugins-types-allows-youtube-plugin-replacement-expected.txt. * security/contentSecurityPolicy/plugins-types-allows-youtube-plugin-replacement.html: Copied from LayoutTests/security/contentSecurityPolicy/plugins-types-allows-youtube-plugin-replacement.html. * security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement-expected.txt: Copied from LayoutTests/security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement-expected.txt. * security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement-without-mime-type-expected.txt: Copied from LayoutTests/security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement-without-mime-type-expected.txt. * security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement-without-mime-type.html: Copied from LayoutTests/security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement-without-mime-type.html. * security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement.html: Copied from LayoutTests/security/contentSecurityPolicy/plugins-types-blocks-youtube-plugin-replacement.html. 2022-03-09 Russell Epstein Cherry-pick r290515. rdar://problem/89376484 [WebAuthn] Use default pubKeyCredParams if empty in makeCredential https://bugs.webkit.org/show_bug.cgi?id=237109 rdar://problem/89376484 Reviewed by Brent Fulgham. Source/WebCore: The Web Authentication level 2 spec was updated to clarify that a set of default pubKeyCredParams should be used if the list supplied by the RP is empty. This patch starts using the default and updates associated tests. * Modules/webauthn/AuthenticatorCoordinator.cpp: (WebCore::AuthenticatorCoordinator::create const): * Modules/webauthn/PublicKeyCredentialCreationOptions.h: * Modules/webauthn/WebAuthenticationConstants.h: LayoutTests: Update tests to take in account using default pubKeyCredParams. * http/wpt/webauthn/public-key-credential-create-failure.https-expected.txt: * http/wpt/webauthn/public-key-credential-create-failure.https.html: * http/wpt/webauthn/public-key-credential-create-success-hid.https-expected.txt: * http/wpt/webauthn/public-key-credential-create-success-hid.https.html: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290515 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-25 J Pascoe [WebAuthn] Use default pubKeyCredParams if empty in makeCredential https://bugs.webkit.org/show_bug.cgi?id=237109 rdar://problem/89376484 Reviewed by Brent Fulgham. Update tests to take in account using default pubKeyCredParams. * http/wpt/webauthn/public-key-credential-create-failure.https-expected.txt: * http/wpt/webauthn/public-key-credential-create-failure.https.html: * http/wpt/webauthn/public-key-credential-create-success-hid.https-expected.txt: * http/wpt/webauthn/public-key-credential-create-success-hid.https.html: 2022-03-09 Russell Epstein Cherry-pick r290760. rdar://problem/83745510 Rendering issues with many dynamically-added sticky elements inside overflow scroll https://bugs.webkit.org/show_bug.cgi?id=237378 Reviewed by Cameron McCormack. Source/WebCore: A bug was filed describing a symptom where position:sticky elements would eventually fail to render when many of them were dynamically added inside a non-stacking context overflow scroll. Debugging showed that CALayers were accumulating, causing us to hit per-process IOSurface limits, at which point content fails to render (this is being fixed via rdar://89640915). Further debugging showed that these layers were unparented, and being entrained by ScrollingStateStickyNodes, which were accumulating in ScrollingStateTree's m_unparentedNodes. This happened because with this scrolling configuration, each ScrollingStateStickyNode is parented via a ScrollingStateOverflowScrollProxyNode which is referenced by entries in RenderLayerBacking's m_ancestorClippingStack. On cleanup, the ScrollingStateOverflowScrollProxyNode was unparented first, leaving the ScrollingStateStickyNode in m_unparentedNodes. The fix is to have ScrollingStateTree::unparentChildrenAndDestroyNode() remove nodes from m_unparentedNodes. To test, add a m_unparentedNodes count to scrollingStateTreeAsText output, which means having scrollingStateTreeAsText() as a member function on ScrollingStateTree. Test: scrollingcoordinator/scrolling-tree/accumulated-unparented-sticky-nodes.html * page/scrolling/AsyncScrollingCoordinator.cpp: (WebCore::AsyncScrollingCoordinator::scrollingStateTreeAsText const): * page/scrolling/ScrollingStateTree.cpp: (WebCore::ScrollingStateTree::unparentChildrenAndDestroyNode): (WebCore::ScrollingStateTree::scrollingStateTreeAsText const): * page/scrolling/ScrollingStateTree.h: LayoutTests: * scrollingcoordinator/scrolling-tree/accumulated-unparented-sticky-nodes-expected.txt: Added. * scrollingcoordinator/scrolling-tree/accumulated-unparented-sticky-nodes.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290760 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-02 Simon Fraser Rendering issues with many dynamically-added sticky elements inside overflow scroll https://bugs.webkit.org/show_bug.cgi?id=237378 Reviewed by Cameron McCormack. * scrollingcoordinator/scrolling-tree/accumulated-unparented-sticky-nodes-expected.txt: Added. * scrollingcoordinator/scrolling-tree/accumulated-unparented-sticky-nodes.html: Added. 2022-03-09 Russell Epstein Cherry-pick r290646. rdar://problem/88911184 focus({preventScroll: true}) does not prevent scrolling on iOS https://bugs.webkit.org/show_bug.cgi?id=236584 rdar://88911184 Reviewed by Simon Fraser. Source/WebCore: Plumb `FocusOptions` through `Element::dispatchFocusEvent()` as well as the chrome client hooks for `elementDidRefocus` and `elementDidFocus`, instead of just a `FocusDirection` flag. * dom/Document.cpp: (WebCore::Document::setFocusedElement): * dom/Element.cpp: (WebCore::Element::focus): (WebCore::Element::dispatchFocusEvent): * dom/Element.h: * html/HTMLSelectElement.cpp: (WebCore::HTMLSelectElement::dispatchFocusEvent): * html/HTMLSelectElement.h: * html/HTMLTextFormControlElement.cpp: (WebCore::HTMLTextFormControlElement::dispatchFocusEvent): * html/HTMLTextFormControlElement.h: * loader/EmptyClients.h: * page/ChromeClient.h: (WebCore::ChromeClient::elementDidFocus): (WebCore::ChromeClient::elementDidRefocus): * page/FocusController.cpp: (WebCore::dispatchEventsOnWindowAndFocusedElement): (WebCore::FocusController::setFocusedElement): Source/WebKit: Add support for `preventScroll` on iOS by avoiding UI-side zooming/scrolling to reveal the focused element if it was focused with `preventScroll: true`. See below for more details. Tests: fast/forms/select-focus-prevent-scroll.html fast/forms/text-field-focus-prevent-scroll.html * Shared/FocusedElementInformation.cpp: (WebKit::FocusedElementInformation::encode const): (WebKit::FocusedElementInformation::decode): * Shared/FocusedElementInformation.h: Add a boolean flag to `FocusedElementInformation` to indicate whether or not scrolling to reveal the focused element should be prevented. * UIProcess/ios/WKContentViewInteraction.mm: (-[WKContentView _zoomToRevealFocusedElement]): Only zoom to reveal the focused element if the focused element information's `preventScroll` flag is `NO`. (-[WKContentView _elementDidBlur]): * WebProcess/WebCoreSupport/WebChromeClient.cpp: (WebKit::WebChromeClient::elementDidFocus): (WebKit::WebChromeClient::elementDidRefocus): * WebProcess/WebCoreSupport/WebChromeClient.h: * WebProcess/WebPage/WebPage.cpp: (WebKit::WebPage::elementDidRefocus): (WebKit::WebPage::elementDidFocus): Use `FocusOptions` to set the `preventScroll` flag when propagating `FocusedElementInformation`. * WebProcess/WebPage/WebPage.h: Source/WebKitLegacy/ios: Adjust the method signature of elementDidFocus. See WebCore ChangeLog for more information. * WebCoreSupport/WebChromeClientIOS.h: * WebCoreSupport/WebChromeClientIOS.mm: (WebChromeClientIOS::elementDidFocus): Source/WebKitLegacy/mac: Adjust the method signature of elementDidFocus. See WebCore ChangeLog for more information. * WebCoreSupport/WebChromeClient.h: * WebCoreSupport/WebChromeClient.mm: (WebChromeClient::elementDidFocus): LayoutTests: Add a couple of new layout tests to verify that passing in `{ preventScroll: true }` for focus options causes us to avoid scrolling to reveal focused select elements and text fields. * fast/forms/select-focus-prevent-scroll-expected.txt: Added. * fast/forms/select-focus-prevent-scroll.html: Added. * fast/forms/text-field-focus-prevent-scroll-expected.txt: Added. * fast/forms/text-field-focus-prevent-scroll.html: Added. * resources/ui-helper.js: Also make it safe to call `waitForInputSessionToDismiss()` in a platform-agnostic test, by bailing early if we're not on iOS, using WebKit2. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290646 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-01 Wenson Hsieh focus({preventScroll: true}) does not prevent scrolling on iOS https://bugs.webkit.org/show_bug.cgi?id=236584 rdar://88911184 Reviewed by Simon Fraser. Add a couple of new layout tests to verify that passing in `{ preventScroll: true }` for focus options causes us to avoid scrolling to reveal focused select elements and text fields. * fast/forms/select-focus-prevent-scroll-expected.txt: Added. * fast/forms/select-focus-prevent-scroll.html: Added. * fast/forms/text-field-focus-prevent-scroll-expected.txt: Added. * fast/forms/text-field-focus-prevent-scroll.html: Added. * resources/ui-helper.js: Also make it safe to call `waitForInputSessionToDismiss()` in a platform-agnostic test, by bailing early if we're not on iOS, using WebKit2. 2022-03-09 Russell Epstein Cherry-pick r290556. rdar://problem/89525864 Re-import inert and WPT https://bugs.webkit.org/show_bug.cgi?id=237243 Reviewed by Youenn Fablet. Upstream commit: https://github.com/web-platform-tests/wpt/commit/9261ca87db106c1f31f1ab4f54b8f4a2617cbc24 LayoutTests/imported/w3c: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/modal-dialog-in-replaced-renderer-expected.html: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/modal-dialog-in-replaced-renderer-ref.html: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/modal-dialog-in-replaced-renderer.html: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/modal-dialog-in-table-column-expected.html: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/modal-dialog-in-table-column-ref.html: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/modal-dialog-in-table-column.html: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/w3c-import.log: * web-platform-tests/inert/inert-and-contenteditable.tentative-expected.txt: Added. * web-platform-tests/inert/inert-and-contenteditable.tentative.html: Added. * web-platform-tests/inert/inert-iframe-hittest.tentative-expected.txt: * web-platform-tests/inert/inert-iframe-hittest.tentative.html: * web-platform-tests/inert/inert-iframe-tabbing.tentative-expected.txt: * web-platform-tests/inert/inert-iframe-tabbing.tentative.html: * web-platform-tests/inert/w3c-import.log: LayoutTests: * TestExpectations: * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-hittest.tentative-expected.txt: * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-tabbing.tentative-expected.txt: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290556 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-27 Tim Nguyen Re-import inert and WPT https://bugs.webkit.org/show_bug.cgi?id=237243 Reviewed by Youenn Fablet. Upstream commit: https://github.com/web-platform-tests/wpt/commit/9261ca87db106c1f31f1ab4f54b8f4a2617cbc24 * TestExpectations: * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-hittest.tentative-expected.txt: * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-tabbing.tentative-expected.txt: 2022-03-09 Russell Epstein Cherry-pick r289071. rdar://problem/89997434 ANGLE Metal and ANGLE OpenGL cannot be initialised one after the other https://bugs.webkit.org/show_bug.cgi?id=236030 Patch by Kimmo Kinnunen on 2022-02-03 Reviewed by Dean Jackson. Source/WebCore: Test: webgl/pending/conformance2/misc/webgl2-after-webgl1-bug.html Remove the power-preference specific native displays. Add a native display for opengl, and use the default one for Metal. After the recent ANGLE roll, ANGLE uses (native display, power preference) as the key to look up EGLDisplays. * platform/graphics/angle/GraphicsContextGLANGLE.cpp: (WebCore::GraphicsContextGLANGLE::releaseThreadResources): * platform/graphics/angle/GraphicsContextGLANGLE.h: * platform/graphics/cocoa/GraphicsContextGLCocoa.mm: (WebCore::initializeEGLDisplay): LayoutTests: * webgl/pending/conformance2/misc/webgl2-after-webgl1-bug-expected.txt: Added. * webgl/pending/conformance2/misc/webgl2-after-webgl1-bug.html: Added. * webgl/resources/pending_webgl_test_files/conformance2/misc/webgl2-after-webgl1-bug.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289071 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-03 Kimmo Kinnunen ANGLE Metal and ANGLE OpenGL cannot be initialised one after the other https://bugs.webkit.org/show_bug.cgi?id=236030 Reviewed by Dean Jackson. * webgl/pending/conformance2/misc/webgl2-after-webgl1-bug-expected.txt: Added. * webgl/pending/conformance2/misc/webgl2-after-webgl1-bug.html: Added. * webgl/resources/pending_webgl_test_files/conformance2/misc/webgl2-after-webgl1-bug.html: Added. 2022-03-08 Russell Epstein Cherry-pick r288701. rdar://problem/83734079 "Unrecognized Content-Security-Policy directive 'worker-src'." https://bugs.webkit.org/show_bug.cgi?id=235260 Reviewed by Brent Fulgham. LayoutTests/imported/w3c: * web-platform-tests/content-security-policy/child-src/child-src-cross-origin-load.sub-expected.txt: * web-platform-tests/content-security-policy/child-src/child-src-worker-blocked.sub-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/script-src-self/sharedworker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/script-src-self/sharedworker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/script-src-self/worker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/script-src-self/worker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/script-src-wildcard/sharedworker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/script-src-wildcard/sharedworker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/script-src-wildcard/worker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/script-src-wildcard/worker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-classic.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-classic.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-import.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-import.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-module.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/sharedworker-module.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-classic.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-classic.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-import.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-import.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-module.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-none/worker-module.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/sharedworker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/sharedworker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/sharedworker-import.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/sharedworker-import.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/worker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/worker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-wildcard/sharedworker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-wildcard/sharedworker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-wildcard/worker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-wildcard/worker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/script-src-self/sharedworker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/script-src-self/sharedworker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/script-src-self/worker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/script-src-self/worker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/script-src-wildcard/sharedworker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/script-src-wildcard/sharedworker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/script-src-wildcard/worker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/script-src-wildcard/worker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/worker-src/dedicated-fallback.sub-expected.txt: * web-platform-tests/content-security-policy/worker-src/dedicated-none.sub-expected.txt: * web-platform-tests/content-security-policy/worker-src/dedicated-worker-src-child-fallback-blocked.sub-expected.txt: * web-platform-tests/content-security-policy/worker-src/dedicated-worker-src-script-fallback.sub-expected.txt: * web-platform-tests/content-security-policy/worker-src/dedicated-worker-src-self-fallback.sub-expected.txt: * web-platform-tests/content-security-policy/worker-src/service-none.https.sub-expected.txt: * web-platform-tests/content-security-policy/worker-src/service-worker-src-child-fallback-blocked.https.sub-expected.txt: * web-platform-tests/content-security-policy/worker-src/shared-child.sub-expected.txt: Added. * web-platform-tests/content-security-policy/worker-src/shared-fallback.sub-expected.txt: Added. * web-platform-tests/content-security-policy/worker-src/shared-list.sub-expected.txt: Added. * web-platform-tests/content-security-policy/worker-src/shared-none.sub-expected.txt: Added. * web-platform-tests/content-security-policy/worker-src/shared-self.sub-expected.txt: Added. * web-platform-tests/content-security-policy/worker-src/shared-worker-src-child-fallback-blocked.sub-expected.txt: Added. * web-platform-tests/content-security-policy/worker-src/shared-worker-src-child-fallback.sub-expected.txt: Added. * web-platform-tests/content-security-policy/worker-src/shared-worker-src-default-fallback.sub-expected.txt: Added. * web-platform-tests/content-security-policy/worker-src/shared-worker-src-script-fallback.sub-expected.txt: Added. * web-platform-tests/content-security-policy/worker-src/shared-worker-src-self-fallback.sub-expected.txt: Added. * web-platform-tests/content-security-policy/blob/self-doesnt-match-blob.sub-expected.txt: * web-platform-tests/content-security-policy/blob/star-doesnt-match-blob.sub-expected.txt: * web-platform-tests/content-security-policy/gen/top.http-rp/worker-src-self/worker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/sharedworker-classic.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/sharedworker-classic.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/sharedworker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/sharedworker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/sharedworker-module.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/sharedworker-module.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-classic.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-classic.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-import.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-import.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-module.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-none/worker-module.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-self/sharedworker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-self/sharedworker-import-data.https-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-self/worker-import-data.http-expected.txt: * web-platform-tests/content-security-policy/gen/top.meta/worker-src-self/worker-import-data.https-expected.txt: Source/WebCore: Implementation of worker-src directive. According to https://www.w3.org/TR/CSP3/#changes-from-level-2 the worker-src directive now restricts URLs that can be loaded by workers, and defers to child-src if not specified. * bindings/js/WorkerModuleScriptLoader.cpp: (WebCore::WorkerModuleScriptLoader::load): Check worker-src instead of child-src for worker loads. * loader/DocumentThreadableLoader.cpp: (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy): * loader/ThreadableLoader.h: Check worker-src instead of child-src for worker loads. * page/csp/ContentSecurityPolicy.cpp: We can remove allowChildContextFromSource which is now fully replaced by allowWorkerFromSource. (WebCore::ContentSecurityPolicy::allowWorkerFromSource const): (WebCore::ContentSecurityPolicy::allowChildContextFromSource const): Deleted. * page/csp/ContentSecurityPolicy.h: * page/csp/ContentSecurityPolicyDirectiveList.cpp: (WebCore::ContentSecurityPolicyDirectiveList::operativeDirectiveForWorkerSrc const): worker-src defers to child-src, then script-src, then default-src. (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForWorker): (WebCore::ContentSecurityPolicyDirectiveList::addDirective): * page/csp/ContentSecurityPolicyDirectiveList.h: * page/csp/ContentSecurityPolicyDirectiveNames.cpp: * page/csp/ContentSecurityPolicyDirectiveNames.h: * workers/AbstractWorker.cpp: (WebCore::AbstractWorker::resolveURL): * workers/AbstractWorker.h: We check LegacySchemeRegistry::schemeShouldBypassContentSecurityPolicy in allowWorkerFromSource, so we don't need to check in in AbstractWorker::resolveURL anymore. We can also replace the child-src checks with worker-src ones. * workers/Worker.cpp: (WebCore::Worker::create): * workers/WorkerFontLoadRequest.cpp: (WebCore::WorkerFontLoadRequest::load): * workers/service/ServiceWorkerContainer.cpp: (WebCore::ServiceWorkerContainer::addRegistration): Block service worker registrations not specified by worker-src. * workers/shared/SharedWorker.cpp: (WebCore::SharedWorker::create): Block shared worker urls not specified by worker-src. * workers/shared/SharedWorkerScriptLoader.cpp: (WebCore::SharedWorkerScriptLoader::SharedWorkerScriptLoader): Source/WebKit: * NetworkProcess/NetworkLoadChecker.cpp: (WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy): LayoutTests: Update tests now that worker-src defaults eventually to script-src. Since this was not the case with child-src, legacy CSP tests do not expect script-src policies to affect workers. We can fix this by specifying a separate worker-src policy for these tests to maintain behavior. * TestExpectations: Some wpt tests log random URL strings that change for every test iteration. For now we can't unskip those. * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-blocks-eval.html: * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports.html: * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked.html: * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp.html: * http/tests/security/contentSecurityPolicy/worker-script-src.html: * http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-eval.html: * http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-importScript-redirect-cross-origin.html: * http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-xhr.html: * http/tests/security/isolatedWorld/bypass-main-world-csp-worker.html: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288701 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-27 Kate Cheney "Unrecognized Content-Security-Policy directive 'worker-src'." https://bugs.webkit.org/show_bug.cgi?id=235260 Reviewed by Brent Fulgham. Update tests now that worker-src defaults eventually to script-src. Since this was not the case with child-src, legacy CSP tests do not expect script-src policies to affect workers. We can fix this by specifying a separate worker-src policy for these tests to maintain behavior. * TestExpectations: Some wpt tests log random URL strings that change for every test iteration. For now we can't unskip those. * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-blocks-eval.html: * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports.html: * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked.html: * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp.html: * http/tests/security/contentSecurityPolicy/worker-script-src.html: * http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-eval.html: * http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-importScript-redirect-cross-origin.html: * http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-xhr.html: * http/tests/security/isolatedWorld/bypass-main-world-csp-worker.html: 2022-03-07 Russell Epstein Cherry-pick r290853. rdar://problem/88669147 about:blank iframes do not always inherit parent CSP https://bugs.webkit.org/show_bug.cgi?id=236347 Reviewed by Brent Fulgham. Source/WebCore: Test: http/tests/security/contentSecurityPolicy/block-eval-onload-in-nested-about-blank-iframe.html Usually we initialize CSP for window when we create a jsWindowProxy for that frame. In this case, we load an about:blank iframe that attempts to run eval() in the onload function of its own nested iframe. Since we never run script in frame, we don't initialize a jsWindowProxy and thus never propogate its CSP. This fix checks the document's CSP in FrameLoader::clear when we initialize a new JSGlobalObject and sets the eval value in the window accordingly to properly enforce CSP. * bindings/js/ScriptController.cpp: (WebCore::ScriptController::enableEval): * bindings/js/ScriptController.h: * loader/FrameLoader.cpp: (WebCore::FrameLoader::clear): * page/csp/ContentSecurityPolicy.h: (WebCore::ContentSecurityPolicy::evalErrorMessage const): LayoutTests: * http/tests/security/contentSecurityPolicy/block-eval-onload-in-nested-about-blank-iframe-expected.txt: Added. * http/tests/security/contentSecurityPolicy/block-eval-onload-in-nested-about-blank-iframe.html: Added We can't use modern js-test.js and related functions because js-test.js uses eval() and loading it makes the test time out when the eval is blocked by the document's CSP. We can't specify unsafe-eval because the whole point of this test is to block eval. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290853 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-04 Kate Cheney about:blank iframes do not always inherit parent CSP https://bugs.webkit.org/show_bug.cgi?id=236347 Reviewed by Brent Fulgham. * http/tests/security/contentSecurityPolicy/block-eval-onload-in-nested-about-blank-iframe-expected.txt: Added. * http/tests/security/contentSecurityPolicy/block-eval-onload-in-nested-about-blank-iframe.html: Added We can't use modern js-test.js and related functions because js-test.js uses eval() and loading it makes the test time out when the eval is blocked by the document's CSP. We can't specify unsafe-eval because the whole point of this test is to block eval. 2022-03-07 Russell Epstein Cherry-pick r290812. rdar://problem/84662329 Element with position: sticky after sticking, starts to move incorrectly when scrolling https://bugs.webkit.org/show_bug.cgi?id=231953 Reviewed by Sam Weinig. Source/WebCore: Sometimes we'd fail to push new StickyPositionViewportConstraints to the scrolling tree, because operator== failed to compare m_constrainingRectAtLastLayout. This breaks the requirement that the "last committed scroll position" for the overflow scrolling node has to be updated in the same commit as the "constraining-rect-at-last-layout" on the sticky node. Test: scrollingcoordinator/scrolling-tree/sticky-in-overflow-stale-constraints.html * page/scrolling/ScrollingConstraints.cpp: (WebCore::operator<<): * page/scrolling/ScrollingConstraints.h: (WebCore::StickyPositionViewportConstraints::operator== const): LayoutTests: * platform/ios-wk2/scrollingcoordinator/scrolling-tree/sticky-in-overflow-stale-constraints-expected.txt: Added. * scrollingcoordinator/scrolling-tree/sticky-in-overflow-stale-constraints-expected.txt: Added. * scrollingcoordinator/scrolling-tree/sticky-in-overflow-stale-constraints.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290812 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-03 Simon Fraser Element with position: sticky after sticking, starts to move incorrectly when scrolling https://bugs.webkit.org/show_bug.cgi?id=231953 Reviewed by Sam Weinig. * platform/ios-wk2/scrollingcoordinator/scrolling-tree/sticky-in-overflow-stale-constraints-expected.txt: Added. * scrollingcoordinator/scrolling-tree/sticky-in-overflow-stale-constraints-expected.txt: Added. * scrollingcoordinator/scrolling-tree/sticky-in-overflow-stale-constraints.html: Added. 2022-03-07 Russell Epstein Cherry-pick r290785. rdar://problem/66568551 nasa.gov page with fixed backgrounds paints incorrectly on scroll https://bugs.webkit.org/show_bug.cgi?id=237405 Reviewed by Antti Koivisto. Source/WebCore: https://www.nasa.gov/specials/artemis/ shows an issue where elements with background-attachment:fixed don't repaint on scroll. This page has scrollable and , and the elements with fixed backgrounds are composited, so this reveals that we fail to repaint composited children of an overflow scroll in this case. Fix by having RenderLayerScrollableArea::scrollTo() do repaints on slow repaint objects which are scrolled by the current scroller. Do some unrelated cleanup in code that I was going to use in this patch but turned out not to need: rename hasFixedBackgroundImage() to hasAnyFixedBackground() for clarity, and share the implementation with hasAnyLocalBackground(). Test: fast/repaint/background-attachment-fixed-in-composited-scroll.html * rendering/RenderElement.cpp: (WebCore::RenderElement::styleWillChange): (WebCore::RenderElement::willBeDestroyed): * rendering/RenderLayer.cpp: * rendering/RenderLayerScrollableArea.cpp: (WebCore::RenderLayerScrollableArea::scrollTo): * rendering/style/FillLayer.cpp: (WebCore::FillLayer::hasImageWithAttachment const): (WebCore::FillLayer::hasFixedImage const): Deleted. * rendering/style/FillLayer.h: * rendering/style/RenderStyle.cpp: (WebCore::RenderStyle::hasAnyLocalBackground const): Deleted. * rendering/style/RenderStyle.h: (WebCore::RenderStyle::hasBackgroundImage const): (WebCore::RenderStyle::hasAnyFixedBackground const): (WebCore::RenderStyle::hasAnyLocalBackground const): (WebCore::RenderStyle::hasFixedBackgroundImage const): Deleted. LayoutTests: Repaint test which is only valid for mac-wk2 (iOS does not support background-attachment:fixed). * TestExpectations: * fast/repaint/background-attachment-fixed-in-composited-scroll-expected.txt: Added. * fast/repaint/background-attachment-fixed-in-composited-scroll.html: Added. * platform/mac-wk2/TestExpectations: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290785 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-03 Simon Fraser nasa.gov page with fixed backgrounds paints incorrectly on scroll https://bugs.webkit.org/show_bug.cgi?id=237405 Reviewed by Antti Koivisto. Repaint test which is only valid for mac-wk2 (iOS does not support background-attachment:fixed). * TestExpectations: * fast/repaint/background-attachment-fixed-in-composited-scroll-expected.txt: Added. * fast/repaint/background-attachment-fixed-in-composited-scroll.html: Added. * platform/mac-wk2/TestExpectations: 2022-03-07 Russell Epstein Cherry-pick r290778. rdar://problem/88297045 macOS Safari 15.2 Audio Echo Issue after camera pause/unpause https://bugs.webkit.org/show_bug.cgi?id=235544 Reviewed by Eric Carlson. Source/WebCore: After https://commits.webkit.org/r275600, the muted state of MediaPlayer would be set to the page muted state without taking into consideration HTMLMediaElement.muted. Update the call site to use effectiveMuted instead. Add internals API to write a corresponding layout test. Test: fast/mediastream/mediastreamtrack-audiovideo-mutepage.html * html/HTMLMediaElement.cpp: * testing/Internals.cpp: * testing/Internals.h: * testing/Internals.idl: LayoutTests: * fast/mediastream/mediastreamtrack-audiovideo-mutepage-expected.txt: Added. * fast/mediastream/mediastreamtrack-audiovideo-mutepage.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290778 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-03 Youenn Fablet macOS Safari 15.2 Audio Echo Issue after camera pause/unpause https://bugs.webkit.org/show_bug.cgi?id=235544 Reviewed by Eric Carlson. * fast/mediastream/mediastreamtrack-audiovideo-mutepage-expected.txt: Added. * fast/mediastream/mediastreamtrack-audiovideo-mutepage.html: Added. 2022-03-07 Russell Epstein Cherry-pick r290765. rdar://problem/89232969 Throw proper exception on failed removeEntry() calls https://bugs.webkit.org/show_bug.cgi?id=237382 Reviewed by Chris Dumez. LayoutTests/imported/w3c: * web-platform-tests/file-system-access/sandboxed_FileSystemDirectoryHandle-getDirectoryHandle.https.any-expected.txt: * web-platform-tests/file-system-access/sandboxed_FileSystemDirectoryHandle-getDirectoryHandle.https.any.worker-expected.txt: * web-platform-tests/file-system-access/sandboxed_FileSystemDirectoryHandle-getFileHandle.https.any-expected.txt: * web-platform-tests/file-system-access/sandboxed_FileSystemDirectoryHandle-getFileHandle.https.any.worker-expected.txt: * web-platform-tests/file-system-access/sandboxed_FileSystemDirectoryHandle-removeEntry.https.any-expected.txt: * web-platform-tests/file-system-access/sandboxed_FileSystemDirectoryHandle-removeEntry.https.any.worker-expected.txt: Source/WebKit: Updated existing tests. * NetworkProcess/storage/FileSystemStorageError.h: (WebKit::convertToException): * NetworkProcess/storage/FileSystemStorageHandle.cpp: (WebKit::FileSystemStorageHandle::removeEntry): LayoutTests: * storage/filesystemaccess/handle-move-expected.txt: * storage/filesystemaccess/handle-move-worker-expected.txt: * storage/filesystemaccess/resources/handle-move.js: (async test): git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290765 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-02 Sihui Liu Throw proper exception on failed removeEntry() calls https://bugs.webkit.org/show_bug.cgi?id=237382 Reviewed by Chris Dumez. * storage/filesystemaccess/handle-move-expected.txt: * storage/filesystemaccess/handle-move-worker-expected.txt: * storage/filesystemaccess/resources/handle-move.js: (async test): 2022-03-07 Russell Epstein Cherry-pick r290706. rdar://problem/89566459 REGRESSION(r285232) https://alvaromontoro.github.io/almond.css/demo/ looks wrong in Safari, ok in Chrome and Firefox https://bugs.webkit.org/show_bug.cgi?id=237276 Reviewed by Simon Fraser. Source/WebCore: r285232 introduced the isFixed() check as a resolvable preferred width type, but percent values are also resolvable as block layout gets the horizontal constraint from the containing block chain (unlike the height percent values) -i.e. 'width: 50%' can be resolved during preferred width computation. Test: fast/css-grid-layout/ascpect-ratio-with-percent-width.html * rendering/RenderBlock.cpp: (WebCore::RenderBlock::availableLogicalHeightForPercentageComputation const): LayoutTests: * fast/css-grid-layout/ascpect-ratio-with-percent-width-expected.html: Added. * fast/css-grid-layout/ascpect-ratio-with-percent-width.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290706 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-01 Alan Bujtas REGRESSION(r285232) https://alvaromontoro.github.io/almond.css/demo/ looks wrong in Safari, ok in Chrome and Firefox https://bugs.webkit.org/show_bug.cgi?id=237276 Reviewed by Simon Fraser. * fast/css-grid-layout/ascpect-ratio-with-percent-width-expected.html: Added. * fast/css-grid-layout/ascpect-ratio-with-percent-width.html: Added. 2022-03-07 Russell Epstein Cherry-pick r290606. rdar://problem/89482882 [macOS] Unable to upload ".pages" files to file inputs accepting ".pages" and ".jpeg" files https://bugs.webkit.org/show_bug.cgi?id=237219 rdar://89482882 Reviewed by Tim Horton and Said Abou-Hallawa. Source/WebCore: In r264286, WebKit began transcoding images of an unsupported format to a supported format, for file inputs that accepted image types. For example, selecting a HEIF image in an input that accepts JPEG images would transcode the selected image to a JPEG image. In order to determine when attempt transcoding, the logic added in r264286 obtains the MIME type corresponding to the selected file's extension, and compares that to the list of accepted MIME types. If there is a mismatch, transcoding is attempted. The ".pages" extension does not have a well-defined MIME type in NSURLFileTypeMappings. This is due to the fact that a the extension maps to both a file and a package type. Consequently, the retrieved MIME type for ".pages" files is an empty string. Following r227051, when the file input also accepts an image type, WebKit attempts to transcode these files, and any others that do not have a well-defined MIME type. While the aforementioned behavior can be considered strange, it is not an issue in practice, since WebKit will attempt to transcode the image, fail to do so, and upload the original file. The failure is detected in CGImageDestinationFinalize, which returns false if an image was not successfully written. However, a recent regression in the ImageIO framework is causing CGImageDestinationFinalize to return true, even if image transcoding fails. This results in WebKit uploading a zero byte JPEG file, when a user attempts to upload ".pages" files to file inputs accepting ".pages" and ".jpeg" files. Ideally, the described issue would be resolved by a fix in ImageIO. However, a more immediate solution exists in WebKit: only attempt to transcode files to an accepted image type, if the file selected is image. ".pages" files are not images, and WebKit should not attempt to transcode them. See below for further explanation of the solution. Test: fast/forms/file/entries-api/pages-jpeg-open-panel.html * platform/graphics/cg/ImageUtilitiesCG.cpp: (WebCore::transcodeImage): Prior to using ImageIO to perform transcoding, WebKit obtains a Uniform Type Identifier for the selected file using CGImageSourceCreateWithURL and CGImageSourceGetType. If the file is not an image, a null string is returned. WebKit can use this information to avoid the transcoding attempt, and avoid calls to ImageIO methods further down this method. Specifically, this solution works around the ImageIO bug by avoiding the call to CGImageDestinationFinalize for non-images. The solution is also an overall improvement, as WebKit now avoids unnecessary calls to multiple ImageIO methods, in cases where we know transcoding will fail. LayoutTests: Add a layout test that contains a file input that accepts ".pages" and ".jpeg" files, and attempts to upload a ".pages" file. * TestExpectations: * fast/forms/file/entries-api/pages-jpeg-open-panel-expected.txt: Added. * fast/forms/file/entries-api/pages-jpeg-open-panel.html: Added. * fast/forms/file/entries-api/pdf-jpeg-open-panel-expected.txt: Added. * fast/forms/file/entries-api/pdf-jpeg-open-panel.html: Added. * fast/forms/file/entries-api/resources/documents/document.pages: Added. * fast/forms/file/entries-api/resources/documents/document.pdf: Added. * platform/mac-wk2/TestExpectations: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290606 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-28 Aditya Keerthi [macOS] Unable to upload ".pages" files to file inputs accepting ".pages" and ".jpeg" files https://bugs.webkit.org/show_bug.cgi?id=237219 rdar://89482882 Reviewed by Tim Horton and Said Abou-Hallawa. Add a layout test that contains a file input that accepts ".pages" and ".jpeg" files, and attempts to upload a ".pages" file. * TestExpectations: * fast/forms/file/entries-api/pages-jpeg-open-panel-expected.txt: Added. * fast/forms/file/entries-api/pages-jpeg-open-panel.html: Added. * fast/forms/file/entries-api/pdf-jpeg-open-panel-expected.txt: Added. * fast/forms/file/entries-api/pdf-jpeg-open-panel.html: Added. * fast/forms/file/entries-api/resources/documents/document.pages: Added. * fast/forms/file/entries-api/resources/documents/document.pdf: Added. * platform/mac-wk2/TestExpectations: 2022-03-07 Russell Epstein Cherry-pick r290559. rdar://problem/89510628 Optimize StyleSharingResolver inert checks https://bugs.webkit.org/show_bug.cgi?id=237235 Reviewed by Youenn Fablet. Source/WebCore: inert is an boolean attribute, the only thing that matters for the StyleAdjuster inertness adjustment is the presence of the attribute, not its value. E.g. `inert=false` is the same as `inert=inert` or `inert=true`. This saves getting and comparing values for those attributes, and also allows `inert=inert` and `inert=true` or `inert=false` to start sharing style. * style/StyleSharingResolver.cpp: (WebCore::Style::SharingResolver::canShareStyleWithElement const): LayoutTests: Add small test that style sharing is not wrongly applied. * fast/css/inert-style-sharing-expected.html: Added. * fast/css/inert-style-sharing.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290559 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-27 Tim Nguyen Optimize StyleSharingResolver inert checks https://bugs.webkit.org/show_bug.cgi?id=237235 Reviewed by Youenn Fablet. Add small test that style sharing is not wrongly applied. * fast/css/inert-style-sharing-expected.html: Added. * fast/css/inert-style-sharing.html: Added. 2022-03-07 Russell Epstein Cherry-pick r290554. rdar://problem/83757966 Remove Node::deprecatedIsInert https://bugs.webkit.org/show_bug.cgi?id=230845 Reviewed by Antti Koivisto. LayoutTests/imported/w3c: This change unfortunately regresses focusability state when dynamically setting inert, due to a cached computed style invalidation bug. This is minor in practice, since focusability usually gets queried in user-initiated ways, when style already has fully been updated. However, making this change will improve performance by avoiding a full DOM ancestor walk when there is no inert attribute on the page, since we will only check a style bit after this patch. * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/remove-dialog-should-unblock-document-expected.txt: * web-platform-tests/inert/inert-canvas-fallback-content.tentative-expected.txt: * web-platform-tests/inert/inert-node-is-unfocusable.tentative-expected.txt: Source/WebCore: This change unfortunately regresses focusability state when dynamically setting inert, due to a cached computed style invalidation bug. This is minor in practice, since focusability usually gets queried in user-initiated ways, when style already has fully been updated. However, making this change will improve performance by avoiding a full DOM ancestor walk when there is no inert attribute on the page, since we will only check a style bit after this patch. * dom/Element.cpp: (WebCore::Element::isFocusable const): (WebCore::Element::isFocusableWithoutResolvingFullStyle const): (WebCore::Element::isVisibleWithoutResolvingFullStyle const): Deleted. * dom/Element.h: * dom/Node.cpp: (WebCore::Node::deprecatedIsInert const): Deleted. * dom/Node.h: * html/HTMLAreaElement.cpp: (WebCore::HTMLAreaElement::isFocusable const): LayoutTests: * platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focusing-steps-inert-expected.txt: Added. * platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-showModal-expected.txt: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290554 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-26 Tim Nguyen Remove Node::deprecatedIsInert https://bugs.webkit.org/show_bug.cgi?id=230845 Reviewed by Antti Koivisto. * platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focusing-steps-inert-expected.txt: Added. * platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-showModal-expected.txt: Added. 2022-03-07 Russell Epstein Cherry-pick r290430. rdar://problem/87713597 RELEASE_ASSERT(!renderer()); in WebCore::Node::~Node() + 479 (Node.cpp:366) https://bugs.webkit.org/show_bug.cgi?id=235380 Patch by Frédéric Wang on 2022-02-24 Reviewed by Ryosuke Niwa. Source/WebCore: RenderTreeUpdater::tearDownRenderers() browse the composed tree to tear down descendants. However, element with a shadow root are handled specially in ComposedTreeIterator::ComposedTreeIterator(), they have to be handled specially by calling a tearDownLeftoverShadowHostChildren(). This patch does the same for slot elements which are also handled specially in ComposedTreeIterator(). It also makes names within tearDownLeftoverShadowHostChildren() more generic. This in particular fixes a release assert when a slot with pseudo elements children is torn down. Test: fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html * rendering/updating/RenderTreeUpdater.cpp: (WebCore::RenderTreeUpdater::tearDownRenderers): Also call tearDownLeftoverShadowHostChildren for a slot element and add a comment pointing to the method corresponding to these special cases. (WebCore::RenderTreeUpdater::tearDownLeftoverChildrenOfComposedTree): Renamed to remove "shadow host". * rendering/updating/RenderTreeUpdater.h: Ditto. LayoutTests: Add non-regression test. * fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown-expected.txt: Added. * fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290430 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-24 Frédéric Wang RELEASE_ASSERT(!renderer()); in WebCore::Node::~Node() + 479 (Node.cpp:366) https://bugs.webkit.org/show_bug.cgi?id=235380 Reviewed by Ryosuke Niwa. Add non-regression test. * fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown-expected.txt: Added. * fast/shadow-dom/slot-with-pseudo-element-children-renderer-teardown.html: Added. 2022-03-07 Russell Epstein Cherry-pick r290385. rdar://problem/70464703 [Subpixel] imported/w3c/web-platform-tests/css/css-flexbox/auto-margins-001.html fails at certain font sizes https://bugs.webkit.org/show_bug.cgi?id=217643 Unreviewed gardening. * platform/ios-simulator-wk2/TestExpectations: It must have progressed at some point. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290385 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-23 Alan Bujtas [Subpixel] imported/w3c/web-platform-tests/css/css-flexbox/auto-margins-001.html fails at certain font sizes https://bugs.webkit.org/show_bug.cgi?id=217643 Unreviewed gardening. * platform/ios-simulator-wk2/TestExpectations: It must have progressed at some point. 2022-03-07 Russell Epstein Cherry-pick r290356. rdar://problem/85765536 Crash when calling WEBGL_lose_context.loseContext() after the context has been lost https://bugs.webkit.org/show_bug.cgi?id=236966 Patch by Kimmo Kinnunen on 2022-02-23 Reviewed by Dean Jackson. Source/WebCore: WebGLRenderingContextBase::forceLostContext() would try to synthesize a GL error to the underlying m_context. However, m_context is cleared when a real context loss happens. This happens for example when we simulate a GPU status failure or when we create too many contexts. The m_context is not currently cleared when the page simulates context lost via WEBGL_lose_contexts.loseContext(). Test: webgl/lose-context-after-context-lost.html * html/canvas/WebGLRenderingContextBase.cpp: (WebCore::WebGLRenderingContextBase::synthesizeGLError): LayoutTests: * webgl/lose-context-after-context-lost-expected.txt: Added. * webgl/lose-context-after-context-lost.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290356 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-23 Kimmo Kinnunen Crash when calling WEBGL_lose_context.loseContext() after the context has been lost https://bugs.webkit.org/show_bug.cgi?id=236966 Reviewed by Dean Jackson. * webgl/lose-context-after-context-lost-expected.txt: Added. * webgl/lose-context-after-context-lost.html: Added. 2022-03-07 Russell Epstein Cherry-pick r290306. rdar://problem/88352589 Make pointer-events checks for SVG take in account inert subtrees https://bugs.webkit.org/show_bug.cgi?id=235836 Reviewed by Antti Koivisto. LayoutTests/imported/w3c: Added tests for both inert attribute & modal dialog cases. * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-svg-hittest-expected.txt: Added. * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-svg-hittest.html: Added. * web-platform-tests/inert/inert-svg-hittest.tentative-expected.txt: Added. * web-platform-tests/inert/inert-svg-hittest.tentative.html: Added. Source/WebCore: Re-using visibleToHitTesting in SVG code isn't possible, because visibleToHitTesting removes visibility: hidden; content from hit-testing, which we do not want to here, since pointer-events has values for SVG which still allow clicking content regardless of their visibility value (pointer-events: painted/fill/stroke/all). Instead, we add an inert-aware effectivePointerEvents, similar to effectiveUserSelect and re-use that across the codebase. Tests: imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-svg-hittest.html imported/w3c/web-platform-tests/inert/inert-svg-hittest.tentative.html * rendering/RenderElement.cpp: (WebCore::RenderElement::styleWillChange): * rendering/RenderElement.h: (WebCore::RenderElement::visibleToHitTesting const): * rendering/RenderLayerCompositor.cpp: (WebCore::RenderLayerCompositor::layerStyleChanged): * rendering/style/RenderStyle.h: (WebCore::RenderStyle::effectivePointerEvents const): * rendering/svg/LegacyRenderSVGModelObject.cpp: (WebCore::LegacyRenderSVGModelObject::checkIntersection): (WebCore::LegacyRenderSVGModelObject::checkEnclosure): * rendering/svg/LegacyRenderSVGShape.cpp: (WebCore::LegacyRenderSVGShape::nodeAtFloatPoint): * rendering/svg/RenderSVGImage.cpp: (WebCore::RenderSVGImage::nodeAtFloatPoint): * rendering/svg/RenderSVGModelObject.cpp: (WebCore::RenderSVGModelObject::checkIntersection): (WebCore::RenderSVGModelObject::checkEnclosure): * rendering/svg/RenderSVGShape.cpp: (WebCore::RenderSVGShape::nodeAtPoint): * rendering/svg/RenderSVGText.cpp: (WebCore::RenderSVGText::nodeAtFloatPoint): * rendering/svg/SVGInlineTextBox.cpp: (WebCore::SVGInlineTextBox::nodeAtPoint): LayoutTests: iOS doesn't support test_actions, so it needs different baselines. * platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-svg-hittest-expected.txt: Added. * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-svg-hittest.tentative-expected.txt: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290306 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-22 Tim Nguyen Make pointer-events checks for SVG take in account inert subtrees https://bugs.webkit.org/show_bug.cgi?id=235836 Reviewed by Antti Koivisto. iOS doesn't support test_actions, so it needs different baselines. * platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-svg-hittest-expected.txt: Added. * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-svg-hittest.tentative-expected.txt: Added. 2022-03-07 Russell Epstein Cherry-pick r290164. rdar://problem/89162532 Re-import inert and WPT https://bugs.webkit.org/show_bug.cgi?id=236808 Reviewed by Simon Fraser. Commit: https://github.com/web-platform-tests/wpt/commit/0d483a3bea340a2c60cb7a4add49eb63cbba2a64 LayoutTests/imported/w3c: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focus-shadow-double-nested-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focus-shadow-delegatesfocus-expected.txt. * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focus-shadow-double-nested.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focus-shadow-delegatesfocus.html. * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focus-shadow-expected.txt: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focus-shadow.html: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-focus-in-frames-expected.txt: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-focus-in-frames.html: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-label-focus.html: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inertness-with-modal-dialogs-and-iframes-expected.txt: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inertness-with-modal-dialogs-and-iframes.html: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/modal-dialog-scroll-height.html: * web-platform-tests/html/semantics/interactive-elements/the-dialog-element/w3c-import.log: * web-platform-tests/inert/dynamic-inert-on-focused-element.tentative-expected.txt: Added. * web-platform-tests/inert/dynamic-inert-on-focused-element.tentative.html: Added. * web-platform-tests/inert/inert-canvas-fallback-content.tentative-expected.txt: Added. * web-platform-tests/inert/inert-canvas-fallback-content.tentative.html: Added. * web-platform-tests/inert/inert-iframe-hittest.tentative-expected.txt: Added. * web-platform-tests/inert/inert-iframe-hittest.tentative.html: Added. * web-platform-tests/inert/inert-iframe-tabbing.tentative-expected.txt: Added. * web-platform-tests/inert/inert-iframe-tabbing.tentative.html: Added. * web-platform-tests/inert/inert-node-is-uneditable.tentative.html: * web-platform-tests/inert/inert-with-modal-dialog-001.tentative-expected.txt: Added. * web-platform-tests/inert/inert-with-modal-dialog-001.tentative.html: Added. * web-platform-tests/inert/inert-with-modal-dialog-002.tentative-expected.txt: Added. * web-platform-tests/inert/inert-with-modal-dialog-002.tentative.html: Added. * web-platform-tests/inert/w3c-import.log: LayoutTests: * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-hittest.tentative-expected.txt: Added. * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-tabbing.tentative-expected.txt: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290164 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-18 Tim Nguyen Re-import inert and WPT https://bugs.webkit.org/show_bug.cgi?id=236808 Reviewed by Simon Fraser. Commit: https://github.com/web-platform-tests/wpt/commit/0d483a3bea340a2c60cb7a4add49eb63cbba2a64 * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-hittest.tentative-expected.txt: Added. * platform/ios-wk2/imported/w3c/web-platform-tests/inert/inert-iframe-tabbing.tentative-expected.txt: Added. 2022-03-07 Russell Epstein Cherry-pick r289700. rdar://problem/85249360 WebGL2 AllowShared TypedArray should be accepted https://bugs.webkit.org/show_bug.cgi?id=232662 Reviewed by Dean Jackson. Source/WebCore: Test: webgl/webgl-allow-shared-typed-array.html TypedArray with [AllowShared] annotation is not handled properly, which results in handling it as Sequence, invoking iteration protocol to copy them. This patch adds that as the same to [AllowShared] ArrayBuffer / ArrayBufferView. * bindings/IDLTypes.h: * bindings/js/JSDOMConvertUnion.h: LayoutTests: * webgl/webgl-allow-shared-typed-array-expected.txt: Added. * webgl/webgl-allow-shared-typed-array.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289700 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-12 Yusuke Suzuki WebGL2 AllowShared TypedArray should be accepted https://bugs.webkit.org/show_bug.cgi?id=232662 Reviewed by Dean Jackson. * webgl/webgl-allow-shared-typed-array-expected.txt: Added. * webgl/webgl-allow-shared-typed-array.html: Added. 2022-03-07 Russell Epstein Cherry-pick r289533. rdar://problem/88452971 Settling of a fetch promise should be delayed in case page is entering page cache https://bugs.webkit.org/show_bug.cgi?id=236292 Reviewed by Chris Dumez. Source/WebCore: Make sure to enqueue a task before resolving fetch promise as otherwise, page might continue running JavaScript. Do this for worker as well for good measure. We move signal aborted checks to two clients to handle rejecting fetch promise synchronously. Test: http/tests/navigation/fetch-pagecache.html * Modules/cache/DOMCache.cpp: * Modules/fetch/FetchResponse.cpp: * Modules/fetch/FetchResponse.h: * Modules/fetch/WindowOrWorkerGlobalScopeFetch.cpp: * workers/service/FetchEvent.cpp: LayoutTests: * http/tests/navigation/fetch-pagecache-expected.txt: Added. * http/tests/navigation/fetch-pagecache.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289533 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-10 Youenn Fablet Settling of a fetch promise should be delayed in case page is entering page cache https://bugs.webkit.org/show_bug.cgi?id=236292 Reviewed by Chris Dumez. * http/tests/navigation/fetch-pagecache-expected.txt: Added. * http/tests/navigation/fetch-pagecache.html: Added. 2022-03-07 Russell Epstein Cherry-pick r289121. rdar://problem/88492251 Fix App Privacy Report redirect attribution https://bugs.webkit.org/show_bug.cgi?id=236111 Reviewed by Brent Fulgham. Source/WebCore: Test: http/tests/app-privacy-report/user-attribution-redirect.html Test: http/tests/app-privacy-report/app-attribution-redirect.html * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::ResourceRequest::updateFromDelegatePreservingOldProperties): Source/WebKit: * NetworkProcess/cocoa/NetworkSessionCocoa.mm: (-[WKNetworkSessionDelegate URLSession:task:willPerformHTTPRedirection:newRequest:completionHandler:]): LayoutTests: * http/tests/app-privacy-report/resources/redirect.js: Added. * http/tests/app-privacy-report/app-attribution-redirect-expected.txt: Added. * http/tests/app-privacy-report/app-attribution-redirect.html: Added. * http/tests/app-privacy-report/user-attribution-redirect-expected.txt: Added. * http/tests/app-privacy-report/user-attribution-redirect.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289121 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-04 Kate Cheney Fix App Privacy Report redirect attribution https://bugs.webkit.org/show_bug.cgi?id=236111 Reviewed by Brent Fulgham. * http/tests/app-privacy-report/resources/redirect.js: Added. * http/tests/app-privacy-report/app-attribution-redirect-expected.txt: Added. * http/tests/app-privacy-report/app-attribution-redirect.html: Added. * http/tests/app-privacy-report/user-attribution-redirect-expected.txt: Added. * http/tests/app-privacy-report/user-attribution-redirect.html: Added. 2022-03-07 Russell Epstein Cherry-pick r289101. rdar://problem/87625596 Two bopomofo tone marks are not moved to the correct place in vertical text with a particular bopomofo font https://bugs.webkit.org/show_bug.cgi?id=235257 Reviewed by Darin Adler. .: Thank you so much to Bobby Tung and But Ko for reporting this bug and providing a test font for it!!! * metadata/contributors.json: Source/WebCore: Turns out one of our character data tables was missing some characters. I really dislike these kinds of fixes, because it's just perpetuating the fact that WebKit has big tables of characters in its source code. A long-term fix would be a systemic replacement of this entire table with either Unicode property lookup, or more ideally, removing the need for it in the first place. Unfortunately, at this point in the release cycle, this fix probably needs to be smaller and more targetted. Tests: fast/text/bopomofo-tone-marks-2.html fast/text/bopomofo-tone-marks.html * platform/graphics/FontCascade.cpp: (WebCore::FontCascade::isCJKIdeographOrSymbol): LayoutTests: This can't be a WPT test because we only have permission to add the test font to the WebKit repository. Thank you so much to Bobby Tung and But Ko for reporting this bug and providing a test font for it!!! * fast/text/bopomofo-tone-marks-2-expected-mismatch.html: Added. * fast/text/bopomofo-tone-marks-2.html: Added. * fast/text/bopomofo-tone-marks-expected-mismatch.html: Added. * fast/text/bopomofo-tone-marks.html: Added. * fast/text/resources/BopomofoGposSubset-Regular/BopomofoGposSubset-Regular.ttf: Added. * fast/text/resources/BopomofoGposSubset-Regular/LICENSE: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289101 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-03 Myles C. Maxfield Two bopomofo tone marks are not moved to the correct place in vertical text with a particular bopomofo font https://bugs.webkit.org/show_bug.cgi?id=235257 Reviewed by Darin Adler. This can't be a WPT test because we only have permission to add the test font to the WebKit repository. Thank you so much to Bobby Tung and But Ko for reporting this bug and providing a test font for it!!! * fast/text/bopomofo-tone-marks-2-expected-mismatch.html: Added. * fast/text/bopomofo-tone-marks-2.html: Added. * fast/text/bopomofo-tone-marks-expected-mismatch.html: Added. * fast/text/bopomofo-tone-marks.html: Added. * fast/text/resources/BopomofoGposSubset-Regular/BopomofoGposSubset-Regular.ttf: Added. * fast/text/resources/BopomofoGposSubset-Regular/LICENSE: Added. 2022-03-07 Russell Epstein Cherry-pick r287898. rdar://problem/86035420 Rewrite touch and drag tests to be more robust. https://bugs.webkit.org/show_bug.cgi?id=235057 rdar://86035420 Reviewed by Wenson Hsieh. Rewrite the touch-and-drag tests to check for selection changes, not specific text selections. Specific selections and subject to small changes in font and layout, and all that is actually important is that there have been selection changes based off of dragged touches. The touch-event-radius test has been updated to use the screen size directly, since the radius is scaled by the screen size internally. The output has been changed to not need to be updated when the test phone changes. * fast/events/touch/ios/double-tap-on-editable-content-for-selection-then-drag-down-to-change-selected-text-expected.txt: * fast/events/touch/ios/double-tap-on-editable-content-for-selection-then-drag-down-to-change-selected-text.html: * fast/events/touch/ios/double-tap-on-editable-content-for-selection-then-drag-up-to-change-selected-text-expected.txt: * fast/events/touch/ios/double-tap-on-editable-content-for-selection-then-drag-up-to-change-selected-text.html: * fast/events/touch/ios/long-press-on-editable-content-then-drag-up-to-change-selected-text.html: * fast/events/touch/ios/long-press-then-drag-down-to-change-selected-text-expected.txt: * fast/events/touch/ios/long-press-then-drag-down-to-change-selected-text.html: * fast/events/touch/ios/long-press-then-drag-to-select-text-expected.txt: * fast/events/touch/ios/long-press-then-drag-to-select-text.html: * fast/events/touch/ios/long-press-then-drag-up-to-change-selected-text-expected.txt: * fast/events/touch/ios/long-press-then-drag-up-to-change-selected-text.html: * fast/events/touch/ios/touch-event-radius-expected.txt: * fast/events/touch/ios/touch-event-radius.html: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@287898 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-11 Megan Gardner Rewrite touch and drag tests to be more robust. https://bugs.webkit.org/show_bug.cgi?id=235057 rdar://86035420 Reviewed by Wenson Hsieh. Rewrite the touch-and-drag tests to check for selection changes, not specific text selections. Specific selections and subject to small changes in font and layout, and all that is actually important is that there have been selection changes based off of dragged touches. The touch-event-radius test has been updated to use the screen size directly, since the radius is scaled by the screen size internally. The output has been changed to not need to be updated when the test phone changes. * fast/events/touch/ios/double-tap-on-editable-content-for-selection-then-drag-down-to-change-selected-text-expected.txt: * fast/events/touch/ios/double-tap-on-editable-content-for-selection-then-drag-down-to-change-selected-text.html: * fast/events/touch/ios/double-tap-on-editable-content-for-selection-then-drag-up-to-change-selected-text-expected.txt: * fast/events/touch/ios/double-tap-on-editable-content-for-selection-then-drag-up-to-change-selected-text.html: * fast/events/touch/ios/long-press-on-editable-content-then-drag-up-to-change-selected-text.html: * fast/events/touch/ios/long-press-then-drag-down-to-change-selected-text-expected.txt: * fast/events/touch/ios/long-press-then-drag-down-to-change-selected-text.html: * fast/events/touch/ios/long-press-then-drag-to-select-text-expected.txt: * fast/events/touch/ios/long-press-then-drag-to-select-text.html: * fast/events/touch/ios/long-press-then-drag-up-to-change-selected-text-expected.txt: * fast/events/touch/ios/long-press-then-drag-up-to-change-selected-text.html: * fast/events/touch/ios/touch-event-radius-expected.txt: * fast/events/touch/ios/touch-event-radius.html: 2022-03-01 Russell Epstein Revert r289282. rdar://problem/88876661 2022-03-01 Russell Epstein Cherry-pick r290087. rdar://problem/88713302 Source/ThirdParty/ANGLE: Metal ANGLE: vertex array does not correctly observe contents of data buffers https://bugs.webkit.org/show_bug.cgi?id=236733 Patch by Kyle Piddington on 2022-02-17 Reviewed by Dean Jackson. Similar to previous bug (236427), we were not correctly observing changes to the vertex buffer data. This caused us to miss rebinding vertex buffers when data was updated without causing conversion * src/libANGLE/renderer/metal/VertexArrayMtl.h: * src/libANGLE/renderer/metal/VertexArrayMtl.mm: (rx::VertexArrayMtl::syncState): (rx::VertexArrayMtl::setupDraw): (rx::VertexArrayMtl::syncDirtyAttrib): git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290087 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-03-01 Russell Epstein Cherry-pick r290512. rdar://problem/86582214 [Tables] Incorrect table sizing when colgroup comes after tbody https://bugs.webkit.org/show_bug.cgi?id=237205 Reviewed by Antti Koivisto. Source/WebCore: Let's use the colgroup for table sizing even when it comes after any thead, tbody, tfoot, and tr elements. This makes WebKit match other rendering engines (see https://src.chromium.org/viewvc/blink?revision=159442&view=revision) Test: fast/table/table-sizing-fails-when-colgroup-comes-after-content.html * rendering/RenderTable.cpp: (WebCore::RenderTable::firstColumn const): * rendering/RenderTableCol.cpp: (WebCore::RenderTableCol::nextColumn const): LayoutTests: * fast/table/table-sizing-fails-when-colgroup-comes-after-content-expected.html: Added. * fast/table/table-sizing-fails-when-colgroup-comes-after-content.html: Added. * platform/mac/tables/mozilla_expected_failures/dom/appendCol1-expected.txt: Progression. 2022-02-17 Kyle Piddington Metal ANGLE: vertex array does not correctly observe contents of data buffers https://bugs.webkit.org/show_bug.cgi?id=236733 Reviewed by Dean Jackson. Similar to previous bug (236427), we were not correctly observing changes to the vertex buffer data. This caused us to miss rebinding vertex buffers when data was updated without causing conversion * fast/canvas/webgl/buffer-data-subdata-dynamic-buffer.html: Added. * fast/canvas/webgl/buffer-data-subdata-dynamic-buffer-expected.txt: Added. * platform/mac/tables/mozilla_expected_failures/dom/appendColGroup1-expected.txt: Progression. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290512 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-25 Alan Bujtas [Tables] Incorrect table sizing when colgroup comes after tbody https://bugs.webkit.org/show_bug.cgi?id=237205 Reviewed by Antti Koivisto. * fast/table/table-sizing-fails-when-colgroup-comes-after-content-expected.html: Added. * fast/table/table-sizing-fails-when-colgroup-comes-after-content.html: Added. * platform/mac/tables/mozilla_expected_failures/dom/appendCol1-expected.txt: Progression. * platform/mac/tables/mozilla_expected_failures/dom/appendColGroup1-expected.txt: Progression. 2022-03-01 Russell Epstein Cherry-pick r290156. rdar://problem/89154452 ServiceWorkerGlobalScope+PushAPI requires PushAPIEnabled https://bugs.webkit.org/show_bug.cgi?id=236846 Patch by Sam Sneddon on 2022-02-18 Reviewed by Chris Dumez. Source/WebCore: Tests: http/wpt/push-api/onpush-disabled.html http/wpt/push-api/onpush-enabled.html * Modules/push-api/ServiceWorkerGlobalScope+PushAPI.idl: LayoutTests: * http/wpt/push-api/onpush-disabled-expected.txt: Added. * http/wpt/push-api/onpush-disabled.html: Added. * http/wpt/push-api/onpush-disabled.js: Added. (test): * http/wpt/push-api/onpush-enabled-expected.txt: Added. * http/wpt/push-api/onpush-enabled.html: Added. * http/wpt/push-api/onpush-enabled.js: Added. (test): git-svn-id: https://svn.webkit.org/repository/webkit/trunk@290156 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-18 Sam Sneddon ServiceWorkerGlobalScope+PushAPI requires PushAPIEnabled https://bugs.webkit.org/show_bug.cgi?id=236846 Reviewed by Chris Dumez. * http/wpt/push-api/onpush-disabled-expected.txt: Added. * http/wpt/push-api/onpush-disabled.html: Added. * http/wpt/push-api/onpush-disabled.js: Added. (test): * http/wpt/push-api/onpush-enabled-expected.txt: Added. * http/wpt/push-api/onpush-enabled.html: Added. * http/wpt/push-api/onpush-enabled.js: Added. (test): 2022-03-01 Russell Epstein Cherry-pick r289995. rdar://problem/87462825 REGRESSION(r285885) Unable to exit Trip Details in Amtrak app https://bugs.webkit.org/show_bug.cgi?id=236732 Reviewed by Simon Fraser. Source/WebCore: Starting from r285885 an (effective)”overflow: clip” value is set on any block box with “contain: paint”. It is supposed to ensure we don’t paint outside of the box’s border box (note that "contain: paint", as the name implies, should only affect painting). However this effective value trickles in to layout affecting certain layout constraints. In case of flex, it makes the flex layout think that the box is really a clipped box and it starts flexing it accordingly producing incorrect size. What it means is that the minimum preferred size ends up being 0px because now with "let's clip all the overflow content" 0px is indeed the smallest size a box could take that does not produce overflow (while with the initial, “overflow: visible” value, its minimum width would likely be > 0px -provided it has some content. Also note that setting “overflow: clip” on the box in the markup (so it becomes an explicit clip value and not just an “effective” implicit clip through “contain: paint”) produces the exact same rendering meaning that this effective property value does affect layout). This is a partial revert of r285885 (focusing on where the flex algorithm consults with the flex items' overflow values). Test: fast/flexbox/incorrect-min-size-with-paint-contain.html * rendering/RenderFlexibleBox.cpp: (WebCore::RenderFlexibleBox::mainAxisOverflowForChild const): (WebCore::RenderFlexibleBox::crossAxisOverflowForChild const): LayoutTests: * fast/flexbox/incorrect-min-size-with-paint-contain-expected.html: Added. * fast/flexbox/incorrect-min-size-with-paint-contain.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289995 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-16 Alan Bujtas REGRESSION(r285885) Unable to exit Trip Details in Amtrak app https://bugs.webkit.org/show_bug.cgi?id=236732 Reviewed by Simon Fraser. * fast/flexbox/incorrect-min-size-with-paint-contain-expected.html: Added. * fast/flexbox/incorrect-min-size-with-paint-contain.html: Added. 2022-03-01 Russell Epstein Cherry-pick r289693. rdar://problem/88264857 Suppress style invalidation when matching :checked https://bugs.webkit.org/show_bug.cgi?id=235910 Patch by Rob Buis on 2022-02-12 Reviewed by Antti Koivisto. Source/WebCore: Suppress style invalidation when matching :checked for option elements. Test: fast/selectors/has-select-option-crash.html * css/SelectorCheckerTestFunctions.h: (WebCore::isChecked): * html/HTMLOptionElement.cpp: (WebCore::HTMLOptionElement::selected const): (WebCore::HTMLOptionElement::setSelectedState): * html/HTMLOptionElement.h: * html/HTMLSelectElement.cpp: (WebCore::HTMLSelectElement::updateListItemSelectedStates): (WebCore::HTMLSelectElement::recalcListItems const): * html/HTMLSelectElement.h: LayoutTests: * fast/selectors/has-select-option-crash-expected.txt: Added. * fast/selectors/has-select-option-crash.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289693 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-12 Rob Buis Suppress style invalidation when matching :checked https://bugs.webkit.org/show_bug.cgi?id=235910 Reviewed by Antti Koivisto. * fast/selectors/has-select-option-crash-expected.txt: Added. * fast/selectors/has-select-option-crash.html: Added. 2022-02-28 Russell Epstein Cherry-pick r289526. rdar://problem/87061239 [:has() pseudo-class] Nullptr crash with non-function :has https://bugs.webkit.org/show_bug.cgi?id=236431 rdar://87061239 Reviewed by Cameron McCormack. LayoutTests/imported/w3c: * web-platform-tests/css/selectors/parsing/parse-has-expected.txt: * web-platform-tests/css/selectors/parsing/parse-has.html: Source/WebCore: Test: fast/selectors/malformed-has.html * css/parser/CSSSelectorParser.cpp: (WebCore::isOnlyPseudoClassFunction): :has() is legal, plain :has is not. LayoutTests: * fast/selectors/malformed-has-expected.txt: Added. * fast/selectors/malformed-has.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289526 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-10 Antti Koivisto [:has() pseudo-class] Nullptr crash with non-function :has https://bugs.webkit.org/show_bug.cgi?id=236431 rdar://87061239 Reviewed by Cameron McCormack. * fast/selectors/malformed-has-expected.txt: Added. * fast/selectors/malformed-has.html: Added. 2022-02-28 Russell Epstein Cherry-pick r289462. rdar://problem/88580935 Don't return an empty value from AbortController.signal.reason and make it harder to return empty values from JSValueInWrappedObject https://bugs.webkit.org/show_bug.cgi?id=236318 Reviewed by Mark Lam. Source/WebCore: This patch makes it so we might not accidentally return the empty value to JavaScript code from JSValueInWrappedObject. Previously, JSValueInWrappedObject had an "operator JSValue()" method. This patch removes that, adds a new conversion method for converting between JSValueInWrappedObject and JSValue, and makes JSValueInWrappedObject return undefined inside this method when it used to return the empty value. This fixes a crash where we'd return the empty value to JS JIT code, and crash dereferencing a nullptr. It's never valid for a JS function call (or getter, etc) to return the empty value. Test: fast/dom/AbortSignal-reason-crash-2.html * Modules/webaudio/AudioBuffer.cpp: (WebCore::AudioBuffer::getChannelData): * Modules/webaudio/AudioWorkletProcessor.cpp: (WebCore::toJSArray): (WebCore::toJSObject): (WebCore::AudioWorkletProcessor::buildJSArguments): * bindings/js/JSCustomEventCustom.cpp: (WebCore::JSCustomEvent::detail const): * bindings/js/JSDOMConvertAny.h: (WebCore::JSConverter::convert): * bindings/js/JSMessageEventCustom.cpp: (WebCore::JSMessageEvent::data const): * bindings/js/JSPaymentMethodChangeEventCustom.cpp: (WebCore::JSPaymentMethodChangeEvent::methodDetails const): * bindings/js/JSPopStateEventCustom.cpp: (WebCore::JSPopStateEvent::state const): * bindings/js/JSValueInWrappedObject.h: (WebCore::JSValueInWrappedObject::getValue const): (WebCore::JSValueInWrappedObject::operator bool const): (WebCore::cachedPropertyValue): (WebCore::JSValueInWrappedObject::operator JSC::JSValue const): Deleted. * dom/AbortSignal.cpp: (WebCore::AbortSignal::signalFollow): (WebCore::AbortSignal::throwIfAborted): * dom/ErrorEvent.cpp: (WebCore::ErrorEvent::error): (WebCore::ErrorEvent::trySerializeError): * dom/PopStateEvent.cpp: (WebCore::PopStateEvent::trySerializeState): * page/History.cpp: (WebCore::History::cachedState): LayoutTests: * fast/dom/AbortSignal-reason-crash-2-expected.txt: Added. * fast/dom/AbortSignal-reason-crash-2.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289462 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-09 Saam Barati Don't return an empty value from AbortController.signal.reason and make it harder to return empty values from JSValueInWrappedObject https://bugs.webkit.org/show_bug.cgi?id=236318 Reviewed by Mark Lam. * fast/dom/AbortSignal-reason-crash-2-expected.txt: Added. * fast/dom/AbortSignal-reason-crash-2.html: Added. 2022-02-28 Russell Epstein Cherry-pick r289377. rdar://problem/88178304 Return 'none' for the computed style of mask when there are no mask images https://bugs.webkit.org/show_bug.cgi?id=236265 Patch by Matt Woodrow on 2022-02-08 Reviewed by Dean Jackson. Source/WebCore: Rather than returning all the longhand properties, return 'none' if there are no mask images. This no longer matches the behaviour of the 'background' property, but better matches what other UAs do. Ideally we'd return the smallest possible canonical representation of the non-initial property values, but this is a much simpler change to fix a compat regression. Test: fast/masking/parsing-mask.html Updates expected results to match new behavior. * css/CSSComputedStyleDeclaration.cpp: (WebCore::ComputedStyleExtractor::getLayerCount): (WebCore::ComputedStyleExtractor::getFillLayerPropertyShorthandValue): (WebCore::ComputedStyleExtractor::getBackgroundShorthandValue): (WebCore::ComputedStyleExtractor::getMaskShorthandValue): * css/CSSComputedStyleDeclaration.h: LayoutTests: * fast/masking/parsing-mask-expected.txt: * fast/masking/parsing-mask.html: Updated expected results to expect 'none' for all cases where there isn't an actual mask image. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289377 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-08 Matt Woodrow Return 'none' for the computed style of mask when there are no mask images https://bugs.webkit.org/show_bug.cgi?id=236265 Reviewed by Dean Jackson. * fast/masking/parsing-mask-expected.txt: * fast/masking/parsing-mask.html: Updated expected results to expect 'none' for all cases where there isn't an actual mask image. 2022-02-15 Russell Epstein Cherry-pick r289776. rdar://problem/88656665 Fix crash with deeply nested async overflow scroll https://bugs.webkit.org/show_bug.cgi?id=236599 Source/WebCore: rdar://88656665 Reviewed by Alan Bujtas. mergeClippingScopesRecursive() already does the append of the rects; doing so before calling recursing triggers double appends, hence exponentially growing rect lists. Test: compositing/layer-creation/clipping-scope/deeply-nested-overflow.html * rendering/LayerOverlapMap.cpp: (WebCore::OverlapMapContainer::mergeClippingScopesRecursive): LayoutTests: Reviewed by Alan Bujtas. * compositing/layer-creation/clipping-scope/deeply-nested-overflow-expected.txt: Added. * compositing/layer-creation/clipping-scope/deeply-nested-overflow.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289776 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-14 Simon Fraser Fix crash with deeply nested async overflow scroll https://bugs.webkit.org/show_bug.cgi?id=236599 Reviewed by Alan Bujtas. * compositing/layer-creation/clipping-scope/deeply-nested-overflow-expected.txt: Added. * compositing/layer-creation/clipping-scope/deeply-nested-overflow.html: Added. 2022-02-14 Russell Epstein Cherry-pick r289686. rdar://problem/88689388 `contain:content` breaks fullscreen https://bugs.webkit.org/show_bug.cgi?id=236470 Reviewed by Simon Fraser. Source/WebCore: Paint/layout containment forms a containing block for fixed positioned block boxes. It makes all fixed positioned descendants anchored (contained) to this layout container. This patch enables fullscreen boxes break out of this non-ICB based layout scope (this is similar to what we do for other, "layout scope changing" properties, see canContainFixedPositionObjects). Test: fullscreen/fullscreen-prevented-by-containment.html * css/fullscreen.css: (:-webkit-full-screen-ancestor:not(iframe)): * css/parser/CSSParserContext.cpp: (WebCore::CSSParserContext::CSSParserContext): LayoutTests: * fullscreen/fullscreen-prevented-by-containment-expected.txt: Added. * fullscreen/fullscreen-prevented-by-containment.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289686 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-11 Alan Bujtas `contain:content` breaks fullscreen https://bugs.webkit.org/show_bug.cgi?id=236470 Reviewed by Simon Fraser. * fullscreen/fullscreen-prevented-by-containment-expected.txt: Added. * fullscreen/fullscreen-prevented-by-containment.html: Added. 2022-02-10 Alan Coon Cherry-pick r288434. rdar://problem/56436745 texImage2d fails to set same video frame to multiple textures https://bugs.webkit.org/show_bug.cgi?id=203148 Patch by Kimmo Kinnunen on 2022-01-24 Reviewed by Darin Adler. Source/WebCore: WebGL optimizes repeated video uploads to same texture, due to this being usual practice among pages. Reason is that there are no API to know when the video frame updates. The algorithm was: - If the IOSurface is the same as in the last call - If the texture contents has not changed since we last modified this texture then skip the upload. However, this logic skips errorneously if the "last call" updates some other texture. Fix and test the above. There are other issues for the current algorithm. This patch fixes some other theoretical ones: - If the texture is deleted and new one gets assigned the same texture id and the content seed would clash - Video was uploaded to a different level The previous implementation was keeping per-texture seed value map in the context (GraphicsContextGLANGLE) and per-teture seed value map in the texture upload helper (GraphicsContextGLCVCocoa) and last uploaded IOSurface seed in the upload helper (not per texture). The implementation in this patch keeps per-texture known content description in the texture upload helper and invalidates this when each texture changes. The known content description is the parameter list of the texture upload call. Test: webgl/pending/conformance/textures/misc/tex-image-video-repeated.html * platform/graphics/GraphicsContextGLState.h: (WebCore::GraphicsContextGLState::setBoundTexture): * platform/graphics/angle/GraphicsContextGLANGLE.cpp: (WebCore::GraphicsContextGLANGLE::texImage2D): (WebCore::GraphicsContextGLANGLE::texSubImage2D): (WebCore::GraphicsContextGLANGLE::compressedTexImage2D): (WebCore::GraphicsContextGLANGLE::compressedTexSubImage2D): (WebCore::GraphicsContextGLANGLE::texStorage2D): (WebCore::GraphicsContextGLANGLE::texStorage3D): (WebCore::GraphicsContextGLANGLE::texImage2DDirect): (WebCore::GraphicsContextGLANGLE::framebufferTexture2D): (WebCore::GraphicsContextGLANGLE::createTexture): (WebCore::GraphicsContextGLANGLE::deleteTexture): (WebCore::GraphicsContextGLANGLE::invalidateKnownTextureContent): (WebCore::GraphicsContextGLANGLE::textureSeed): Deleted. * platform/graphics/angle/GraphicsContextGLANGLE.h: * platform/graphics/cocoa/GraphicsContextGLCocoa.h: * platform/graphics/cocoa/GraphicsContextGLCocoa.mm: (WebCore::GraphicsContextGLCocoa::invalidateKnownTextureContent): * platform/graphics/cv/GraphicsContextGLCVCocoa.cpp: (WebCore::GraphicsContextGLCVCocoa::TextureContent::operator== const): (WebCore::GraphicsContextGLCVCocoa::copyVideoSampleToTexture): (WebCore::GraphicsContextGLCVCocoa::invalidateKnownTextureContent): * platform/graphics/cv/GraphicsContextGLCVCocoa.h: LayoutTests: Add a test for testing the bug in which some video texture uploads were skipped errorneously. * webgl/pending/conformance/textures/misc/tex-image-video-repeated.html: Added. * webgl/pending/conformance/textures/misc/tex-image-video-repeated-expected.txt: Added. * webgl/pending/resources/webgl_test_files/conformance/textures/misc/tex-image-video-repeated.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288434 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-24 Kimmo Kinnunen texImage2d fails to set same video frame to multiple textures https://bugs.webkit.org/show_bug.cgi?id=203148 Reviewed by Darin Adler. Add a test for testing the bug in which some video texture uploads were skipped errorneously. * webgl/pending/conformance/textures/misc/tex-image-video-repeated.html: Added. * webgl/pending/conformance/textures/misc/tex-image-video-repeated-expected.txt: Added. * webgl/pending/resources/webgl_test_files/conformance/textures/misc/tex-image-video-repeated.html: Added. 2022-02-08 Russell Epstein Cherry-pick r287055. rdar://problem/86488039 REGRESSION (r286982): ASSERTION FAILED: clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType] https://bugs.webkit.org/show_bug.cgi?id=234315 Unreviewed test gardening. * TestExpectations: Skip the test. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@287055 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2021-12-14 Ryan Haddad REGRESSION (r286982): ASSERTION FAILED: clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType] https://bugs.webkit.org/show_bug.cgi?id=234315 Unreviewed test gardening. * TestExpectations: Skip the test. 2022-02-07 Russell Epstein Cherry-pick r289108. rdar://problem/88599722 HTMLMediaElement should dispatch the resize event asynchronously https://bugs.webkit.org/show_bug.cgi?id=230895 Reviewed by Darin Adler. Source/WebCore: The HTMLMediaElement is currently queueing a task to dispatch the resize event in the post layout phase. There is no need to run it synchronously and we could move it to another queue were it will be run asynchronously as it was done for other similar tasks in the past. * html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::layoutSizeChanged): LayoutTests: * media/modern-media-controls/media-controller/media-controller-resize.html: Remove the event listener to avoid an extra notification. * platform/mac/TestExpectations: Unskipped tests that pass now. * platform/wincairo/TestExpectations: Ditto. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289108 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-04 Sergio Villar Senin HTMLMediaElement should dispatch the resize event asynchronously https://bugs.webkit.org/show_bug.cgi?id=230895 Reviewed by Darin Adler. * media/modern-media-controls/media-controller/media-controller-resize.html: Remove the event listener to avoid an extra notification. * platform/mac/TestExpectations: Unskipped tests that pass now. * platform/wincairo/TestExpectations: Ditto. 2022-02-07 Russell Epstein Cherry-pick r289060. rdar://problem/86337125 null ptr deref in RenderTreeBuilder::Block::attachIgnoringContinuation https://bugs.webkit.org/show_bug.cgi?id=234170 Patch by Frédéric Wang on 2022-02-03 Reviewed by Antti Koivisto. Source/WebCore: When an element with "display: contents" is put into the top layer, its computed style for the display property becomes "block" [1]. However, RenderTreeUpdater::updateElementRenderer does not manage well this transition. In particular, a null ptr deref happens for some special configuration involving a . To work around that issue, always force tearing down renderers when updating an element in the top layer. [1] https://fullscreen.spec.whatwg.org/#new-stacking-layer Test: fast/layers/top-layer-display-contents-crash.html * rendering/updating/RenderTreeUpdater.cpp: (WebCore::RenderTreeUpdater::updateElementRenderer): Always force tearing down renderers for top layer element. LayoutTests: Add regression test. * fast/css/top-layer-display-contents-crash-expected.txt: Added. * fast/css/top-layer-display-contents-crash.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289060 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-03 Frédéric Wang null ptr deref in RenderTreeBuilder::Block::attachIgnoringContinuation https://bugs.webkit.org/show_bug.cgi?id=234170 Reviewed by Antti Koivisto. Add regression test. * fast/css/top-layer-display-contents-crash-expected.txt: Added. * fast/css/top-layer-display-contents-crash.html: Added. 2022-02-07 Russell Epstein Cherry-pick r289021. rdar://problem/88599774 CSP: Fix matching wildcard hosts https://bugs.webkit.org/show_bug.cgi?id=235992 Reviewed by Kate Cheney. LayoutTests/imported/w3c: Update expectations. * web-platform-tests/content-security-policy/img-src/img-src-full-host-wildcard-blocked.sub-expected.txt: Source/WebCore: As per the spec wildcard hosts must include the leading '.' for matches: https://www.w3.org/TR/CSP3/#match-hosts. Test: http/tests/security/contentSecurityPolicy/image-full-host-wildcard-blocked.html * page/csp/ContentSecurityPolicySource.cpp: (WebCore::ContentSecurityPolicySource::hostMatches const): LayoutTests: Rewrite test to expect CSP3 compliant behavior. * http/tests/security/contentSecurityPolicy/image-full-host-wildcard-allowed-expected.txt: Removed. * http/tests/security/contentSecurityPolicy/image-full-host-wildcard-blocked-expected.txt: Added. * http/tests/security/contentSecurityPolicy/image-full-host-wildcard-blocked.html: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/image-full-host-wildcard-allowed.html. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289021 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-02 Patrick Griffis CSP: Fix matching wildcard hosts https://bugs.webkit.org/show_bug.cgi?id=235992 Reviewed by Kate Cheney. Rewrite test to expect CSP3 compliant behavior. * http/tests/security/contentSecurityPolicy/image-full-host-wildcard-allowed-expected.txt: Removed. * http/tests/security/contentSecurityPolicy/image-full-host-wildcard-blocked-expected.txt: Added. * http/tests/security/contentSecurityPolicy/image-full-host-wildcard-blocked.html: Renamed from LayoutTests/http/tests/security/contentSecurityPolicy/image-full-host-wildcard-allowed.html. 2022-02-07 Russell Epstein Cherry-pick r288949. rdar://problem/88226432 ServiceWorkerNavigationPreloader should only be used once https://bugs.webkit.org/show_bug.cgi?id=235882 Reviewed by Chris Dumez. Source/WebKit: In case service worker preload is being used and related service worker context crashes (or service worker context sends bad messages), We can end up in a bad state where we will ask the preload twice for the same response (once for good, and the next one as we go to didNotHandle case). To prevent this, we add checks in loadResponseFromPreloader and loadBodyFromPreloader. As part of this investigation, I found out that ServiceWorkerNavigationPreloader is not correctly handling the case of preload responses coming from cache. In particular, no body will be given since we return early in waitForBody in case the preload network load is null. Prevent this by making sure waitForBody calls the response completion handler if available, even if the preload network load is null. And update the response body callback before executing the response completion handler to make sure data received synchronously from the preload is given to the service worker fetch task. Test: http/wpt/service-workers/fetch-service-worker-preload-cache.https.html * NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.cpp: * NetworkProcess/ServiceWorker/ServiceWorkerNavigationPreloader.cpp: LayoutTests: * http/wpt/service-workers/fetch-service-worker-preload-cache.https-expected.txt: Added. * http/wpt/service-workers/fetch-service-worker-preload-cache.https.html: Added. * http/wpt/service-workers/resources/fetch-service-worker-preload-script.py: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288949 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-02 Youenn Fablet ServiceWorkerNavigationPreloader should only be used once https://bugs.webkit.org/show_bug.cgi?id=235882 Reviewed by Chris Dumez. * http/wpt/service-workers/fetch-service-worker-preload-cache.https-expected.txt: Added. * http/wpt/service-workers/fetch-service-worker-preload-cache.https.html: Added. * http/wpt/service-workers/resources/fetch-service-worker-preload-script.py: 2022-02-07 Russell Epstein Cherry-pick r288881. rdar://problem/80246192 Animation from scale(0) has missing backing store https://bugs.webkit.org/show_bug.cgi?id=227733 Reviewed by Simon Fraser. Source/WebCore: Use the style recorded before we applied animations to this element the last time we resolved style for keyframes that don't set a value for the "transform" property. * animation/KeyframeEffect.cpp: (WebCore::KeyframeEffect::computeExtentOfTransformAnimation const): LayoutTests: Add a new test which animates two squares, one on top of each other. The bottom square uses an animation that has an explicit "from" value of scale(0) and an explicit "to" value of scale(1) and is black. The top square uses an animation that has an explicit "from" value of scale(0) but no explicit "to" value, thus animating to scale(1) as well, and is white, matching the background color. The bug we are fixing is that the square with an implicit "to" value would not yield a visible animation since we wouldn't account for the scale(1) target value and assuming we're never animating to a non-0 value. This test assumes that both animations run at the same time and thus the white square will always cover the black square (which is smaller to ensure no issues at the edges) and yield a completely white page. * webanimations/accelerated-transform-animation-from-scale-zero-and-implicit-to-kefyrame-expected.html: Added. * webanimations/accelerated-transform-animation-from-scale-zero-and-implicit-to-kefyrame.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288881 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-02-01 Antoine Quint Animation from scale(0) has missing backing store https://bugs.webkit.org/show_bug.cgi?id=227733 Reviewed by Simon Fraser. Add a new test which animates two squares, one on top of each other. The bottom square uses an animation that has an explicit "from" value of scale(0) and an explicit "to" value of scale(1) and is black. The top square uses an animation that has an explicit "from" value of scale(0) but no explicit "to" value, thus animating to scale(1) as well, and is white, matching the background color. The bug we are fixing is that the square with an implicit "to" value would not yield a visible animation since we wouldn't account for the scale(1) target value and assuming we're never animating to a non-0 value. This test assumes that both animations run at the same time and thus the white square will always cover the black square (which is smaller to ensure no issues at the edges) and yield a completely white page. * webanimations/accelerated-transform-animation-from-scale-zero-and-implicit-to-kefyrame-expected.html: Added. * webanimations/accelerated-transform-animation-from-scale-zero-and-implicit-to-kefyrame.html: Added. 2022-02-07 Russell Epstein Cherry-pick r288827. rdar://problem/87815745 Source/WebCore: Changed playbackRate and defaultPlaybackRate from unrestricted double to double. https://bugs.webkit.org/show_bug.cgi?id=235174 rdar://problem/87815745 Patch by Takeshi Sone on 2022-01-31 Reviewed by Eric Carlson. Test: media/video-playbackrate-undefined.html * html/HTMLMediaElement.idl: LayoutTests: Added a test to verify that setting undefined to video.playbackRate raises an exception. https://bugs.webkit.org/show_bug.cgi?id=235174 rdar://problem/87815745 Patch by Takeshi Sone on 2022-01-31 Reviewed by Eric Carlson. * media/video-playbackrate-undefined-expected.txt: Added. * media/video-playbackrate-undefined.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288827 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-31 Takeshi Sone Added a test to verify that setting undefined to video.playbackRate raises an exception. https://bugs.webkit.org/show_bug.cgi?id=235174 rdar://problem/87815745 Reviewed by Eric Carlson. * media/video-playbackrate-undefined-expected.txt: Added. * media/video-playbackrate-undefined.html: Added. 2022-02-07 Russell Epstein Cherry-pick r288801. rdar://problem/88186663 (REGRESSION)[IFC][RTL] wpt/css/css-text/white-space/trailing-space-and-text-alignment-rtl-003.html https://bugs.webkit.org/show_bug.cgi?id=235823 Reviewed by Antti Koivisto. Source/WebCore: Reset the trailing whitespace bidi level before handing them over to visual reordering. see https://unicode.org/reports/tr9/#L1 "L1. On each line, reset the embedding level of the following characters to the paragraph embedding level: ... Any sequence of whitespace characters ... at the end of the line." It ensures that
AB C
and
AB
both have the trailing whitespace positioned _visually_ as trailing (and not leading) content. After the bidi paragraph processing "AB C" gets a uniform bidi level of 2, while "AB " is split into "AB" and " " with bidi levels of 2 and 1 respectively. In the latter case, the difference in bidi levels makes the runs flip visually at reordering. It makes the trailing whitespace "pushed" to the left side of the "AB" making it _visually_ trailing (the content renders as " AB"). However in case of "AB C" with the line breaking position after " ", we would end up with a single run of "AB " with the bidi level of 2. This run would render as "AB " turning the trailing whitespace into a _visually_ leading whitespace. In this patch we ensure that the trailing (non-collapsible) whitespace runs 1. are detached from their adjoining non-whitespace text runs and 2. they get their bidi levels reset Test: fast/text/rtl-pre-wrap-hanging-offset.html * layout/formattingContexts/inline/display/InlineDisplayLineBuilder.cpp: (WebCore::Layout::InlineDisplayLineBuilder::build const): LayoutTests: * fast/text/rtl-pre-wrap-hanging-offset-expected.html: Added. * fast/text/rtl-pre-wrap-hanging-offset.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288801 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-30 Alan Bujtas (REGRESSION)[IFC][RTL] wpt/css/css-text/white-space/trailing-space-and-text-alignment-rtl-003.html https://bugs.webkit.org/show_bug.cgi?id=235823 Reviewed by Antti Koivisto. * fast/text/rtl-pre-wrap-hanging-offset-expected.html: Added. * fast/text/rtl-pre-wrap-hanging-offset.html: Added. 2022-02-07 Russell Epstein Cherry-pick r288800. rdar://problem/88241513 [LFC][IFC] Do not break content at an inline box boundary https://bugs.webkit.org/show_bug.cgi?id=235868 Reviewed by Antti Koivisto. Source/WebCore: Handle nested inline boxes, when the breaking position is between at an inline box boundary. e.g.
this_content_overflow
while the breaking position is between the 3rd and the letter 't', we should not let the first line have all the content only, but instead find a more reasonable breaking position by looking at the previous runs. This patch expands "findTrailingRunIndex" to find multiple, subsequent (nested) inline boxes. Test: fast/inline/nested-inline-box-with-word-break.html * layout/formattingContexts/inline/InlineContentBreaker.cpp: (WebCore::Layout::findTrailingRunIndex): LayoutTests: * fast/inline/nested-inline-box-with-word-break-expected.html: Added. * fast/inline/nested-inline-box-with-word-break.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288800 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-30 Alan Bujtas [LFC][IFC] Do not break content at an inline box boundary https://bugs.webkit.org/show_bug.cgi?id=235868 Reviewed by Antti Koivisto. * fast/inline/nested-inline-box-with-word-break-expected.html: Added. * fast/inline/nested-inline-box-with-word-break.html: Added. 2022-02-07 Russell Epstein Cherry-pick r288789. rdar://problem/88043325 Capturing WebGL canvas through peer connection shows the image flipped https://bugs.webkit.org/show_bug.cgi?id=235600 Patch by Kimmo Kinnunen on 2022-01-29 Reviewed by Dean Jackson. Source/WebCore: Mirror and rotate the WebGL image at the source since WebRTC does not support mirroring. Test: webrtc/canvas-to-peer-connection.html * platform/graphics/cocoa/GraphicsContextGLCocoa.h: * platform/graphics/cocoa/GraphicsContextGLCocoa.mm: (WebCore::GraphicsContextGLCocoa::paintCompositedResultsToMediaSample): * platform/graphics/cocoa/IOSurface.h: * platform/graphics/cocoa/IOSurface.mm: (WebCore::IOSurface::setOwnershipIdentity): * platform/graphics/cv/CVUtilities.h: * platform/graphics/cv/CVUtilities.mm: (WebCore::setOwnershipIdentityForCVPixelBuffer): LayoutTests: Test sending WebGL image through a peer connection to a local video and assert that the image is as drawn. * platform/glib/TestExpectations: * webrtc/canvas-to-peer-connection-expected.txt: Added. * webrtc/canvas-to-peer-connection.html: Added. * webrtc/routines.js: * webrtc/video-replace-track.html: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288789 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-29 Kimmo Kinnunen Capturing WebGL canvas through peer connection shows the image flipped https://bugs.webkit.org/show_bug.cgi?id=235600 Reviewed by Dean Jackson. Test sending WebGL image through a peer connection to a local video and assert that the image is as drawn. * platform/glib/TestExpectations: * webrtc/canvas-to-peer-connection-expected.txt: Added. * webrtc/canvas-to-peer-connection.html: Added. * webrtc/routines.js: * webrtc/video-replace-track.html: 2022-02-07 Russell Epstein Cherry-pick r288783. rdar://problem/88052073 REGRESSION(r281687): Space widths have synthetic bold applied to them in the fast text codepath but not the complex text codepath https://bugs.webkit.org/show_bug.cgi?id=235755 Reviewed by Simon Fraser. LayoutTests/imported/w3c: * web-platform-tests/css/css-fonts/synthetic-bold-space-width-expected.html: Added. * web-platform-tests/css/css-fonts/synthetic-bold-space-width.html: Added. Source/WebCore: r281687 made Font::widthForGlyph() return the non-synthetically-expanded width, instead of the synthetically-expanded width. I think this is philosophically correct, because Font::widthForGlyph() is called before shaping, and shaping requires the original width. If some custom code is asking for the width of specific characters without going through WidthIterator or ComplexTextController, that code needs to determine whether or not it's going to run shaping, and thus when it should be adding in the synthetic offset. adjustGlyphsAndAdvances() used to subtract out the synthetic offset because it was expecting Font::widthForGlyph() to return the already-expanded width. So, the solution is just stop subtracting the offset, because it hasn't been applied in the first place. Test: imported/w3c/web-platform-tests/css/css-fonts/synthetic-bold-space-width.html * platform/graphics/ComplexTextController.cpp: (WebCore::ComplexTextController::adjustGlyphsAndAdvances): * platform/graphics/Font.h: LayoutTests: * platform/mac/fast/text/atsui-multiple-renderers-expected.txt: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288783 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-28 Myles C. Maxfield REGRESSION(r281687): Space widths have synthetic bold applied to them in the fast text codepath but not the complex text codepath https://bugs.webkit.org/show_bug.cgi?id=235755 Reviewed by Simon Fraser. * platform/mac/fast/text/atsui-multiple-renderers-expected.txt: 2022-02-07 Russell Epstein Cherry-pick r288631. rdar://problem/88020080 Unreviewed, revert r286855 as it caused form submission issues https://bugs.webkit.org/show_bug.cgi?id=235645 LayoutTests/imported/w3c: * web-platform-tests/html/semantics/forms/constraints/form-validation-validity-valid-expected.txt: * web-platform-tests/html/semantics/forms/constraints/form-validation-validity-valueMissing-expected.txt: * web-platform-tests/html/semantics/forms/the-input-element/radio-expected.txt: Source/WebCore: * html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::setChecked): (WebCore::HTMLInputElement::didChangeForm): (WebCore::HTMLInputElement::insertedIntoAncestor): (WebCore::HTMLInputElement::removedFromAncestor): (WebCore::HTMLInputElement::checkedRadioButtonForGroup const): * html/InputType.h: (WebCore::InputType::willUpdateCheckedness): Deleted. * html/RadioInputType.cpp: (WebCore::RadioInputType::valueMissing const): (WebCore::RadioInputType::willUpdateCheckedness): Deleted. * html/RadioInputType.h: LayoutTests: * fast/forms/radio/ValidityState-valueMissing-radio-expected.txt: * fast/forms/radio/ValidityState-valueMissing-radio.html: * fast/forms/radio/radio-live-validation-style-expected.txt: * fast/forms/radio/radio-live-validation-style.html: * platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/forms/constraints/form-validation-validity-valid-expected.txt: * platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/forms/constraints/form-validation-validity-valueMissing-expected.txt: * platform/mac-wk2/imported/w3c/web-platform-tests/html/semantics/forms/constraints/form-validation-validity-valid-expected.txt: * platform/mac-wk2/imported/w3c/web-platform-tests/html/semantics/forms/constraints/form-validation-validity-valueMissing-expected.txt: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288631 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-26 Chris Dumez Unreviewed, revert r286855 as it caused form submission issues https://bugs.webkit.org/show_bug.cgi?id=235645 * fast/forms/radio/ValidityState-valueMissing-radio-expected.txt: * fast/forms/radio/ValidityState-valueMissing-radio.html: * fast/forms/radio/radio-live-validation-style-expected.txt: * fast/forms/radio/radio-live-validation-style.html: * platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/forms/constraints/form-validation-validity-valid-expected.txt: * platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/forms/constraints/form-validation-validity-valueMissing-expected.txt: * platform/mac-wk2/imported/w3c/web-platform-tests/html/semantics/forms/constraints/form-validation-validity-valid-expected.txt: * platform/mac-wk2/imported/w3c/web-platform-tests/html/semantics/forms/constraints/form-validation-validity-valueMissing-expected.txt: 2022-02-07 Russell Epstein Cherry-pick r288590. rdar://problem/87984277 Disable input-security CSS property https://bugs.webkit.org/show_bug.cgi?id=235557 rdar://87984277 Reviewed by Dean Jackson. Source/WebCore: CSSWG is planning to remove input-security from CSS UI 4 (https://github.com/w3c/csswg-drafts/issues/6788). Keep the property around as an experimental feature, so that it can be used in the UA stylesheet, and easily turned on if the resolution is not finalized. * css/CSSComputedStyleDeclaration.cpp: (WebCore::ComputedStyleExtractor::valueForPropertyInStyle): * css/CSSProperties.json: * css/parser/CSSParserContext.cpp: (WebCore::CSSParserContext::CSSParserContext): Enable input-security when parsing the UA stylesheet, as it is used to obscure text in password inputs. (WebCore::operator==): (WebCore::add): (WebCore::CSSParserContext::isPropertyRuntimeDisabled const): * css/parser/CSSParserContext.h: * css/parser/CSSParserFastPaths.cpp: (WebCore::CSSParserFastPaths::isValidKeywordPropertyAndValue): Source/WebKitLegacy/win: Add support for tests enabling the CSSInputSecurityEnabled preference. * WebPreferences.cpp: (WebPreferences::cssInputSecurityEnabled): * WebPreferences.h: * WebView.cpp: (WebView::notifyPreferencesChanged): Source/WTF: * Scripts/Preferences/WebPreferencesExperimental.yaml: Make input-security a disabled-by-default experimental feature. Tools: * DumpRenderTree/TestOptions.cpp: (WTR::TestOptions::defaults): Add default for WebKitLegacy on Windows. LayoutTests: * fast/css/computed-text-security-for-input-security.html: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288590 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-25 Aditya Keerthi Disable input-security CSS property https://bugs.webkit.org/show_bug.cgi?id=235557 rdar://87984277 Reviewed by Dean Jackson. * fast/css/computed-text-security-for-input-security.html: 2022-02-07 Russell Epstein Cherry-pick r288547. rdar://problem/87824766 (REGRESSION r287485) [LFC][IFC] Incorrect RTL content position when intrusive float is present https://bugs.webkit.org/show_bug.cgi?id=235547 Reviewed by Antti Koivisto. Source/WebCore: The float box coordinates are always visual. They need to be converted to logical to be able to properly constrain the available space on the current line. Test: fast/inline/intrusive-float-with-rtl-content.html * layout/formattingContexts/inline/InlineLineBuilder.cpp: (WebCore::Layout::LineBuilder::floatConstraints const): LayoutTests: * fast/inline/intrusive-float-with-rtl-content-expected.html: Added. * fast/inline/intrusive-float-with-rtl-content.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288547 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-25 Alan Bujtas (REGRESSION r287485) [LFC][IFC] Incorrect RTL content position when intrusive float is present https://bugs.webkit.org/show_bug.cgi?id=235547 Reviewed by Antti Koivisto. * fast/inline/intrusive-float-with-rtl-content-expected.html: Added. * fast/inline/intrusive-float-with-rtl-content.html: Added. 2022-02-07 Russell Epstein Cherry-pick r288543. rdar://problem/84958961 REGRESSION(r282320): [Cocoa] User-installed fonts don't work in the GPU Process (in WKWebView) https://bugs.webkit.org/show_bug.cgi?id=235449 Reviewed by Darin Adler. Source/WebCore/PAL: * pal/spi/cf/CoreTextSPI.h: Source/WebKit: The reason for this bug was I was misusing kCTFontOptionsSystemUIFont. I thought this flag just meant "allow the creation of system fonts" but it turns out it means something more subtle than that. Instead of unconditionally specifying this flag, we should just pull out the options field from the source font (which will include that flag if the font was a system font) and use that instead. Test: fast/text/user-installed-canvas.html * Shared/Cocoa/WebCoreArgumentCodersCocoa.mm: (IPC::ArgumentCoder>::encodePlatformData): (IPC::createCTFont): (IPC::ArgumentCoder>::decodePlatformData): LayoutTests: * fast/text/user-installed-canvas-expected.html: Added. * fast/text/user-installed-canvas.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288543 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-24 Myles C. Maxfield REGRESSION(r282320): [Cocoa] User-installed fonts don't work in the GPU Process (in WKWebView) https://bugs.webkit.org/show_bug.cgi?id=235449 Reviewed by Darin Adler. * fast/text/user-installed-canvas-expected.html: Added. * fast/text/user-installed-canvas.html: Added. 2022-02-07 Russell Epstein Cherry-pick r288466. rdar://problem/82554226 REGRESSION (iOS 15): HTMLAudioElement fails to load new audio when device is locked or safari is in background https://bugs.webkit.org/show_bug.cgi?id=229688 Reviewed by Jer Noble. Source/WebCore: An iOS application loses its NowPlaying status as soon as the AudioSession category is set to Ambient, and it can only get it back again by changing the category to Playback *and* starting playback. When an application is in the background, however, it can't start playback unless it *already* has NowPlaying status. So, ipso facto, background playback will always fail once the category is set to Ambient. If an AudioSession's category is set to Playback when it is activated, it will interrupt another application playing audio, activate Bluetooth routes, etc. This means WebKit has to relinquish Playback when a page is unable to produce audio because AVFoundation automatically activates the audio session when playback starts - even if the AVPlayer is muted or has no audio. To allow pages that were playing audio when WebKit went into the background to continue to play after switching urls or activating another media element, add a grace period when switch from Playback to Ambient. Test: media/audio-session-category.html * platform/audio/cocoa/MediaSessionManagerCocoa.mm: (WebCore::MediaSessionManagerCocoa::updateSessionState): Source/WebKit: * WebProcess/GPU/media/RemoteAudioSession.cpp: (WebKit::RemoteAudioSession::category const): Return the most recently set category on all platforms so it is possible to test. LayoutTests: * fast/mediasession/metadata/audio-track-enabled.html: Wait longer for the audio session category to be reset. * media/audio-session-category-expected.txt: Added. * media/audio-session-category.html: Added. * platform/gtk/TestExpectations: Skip new test. * platform/mac-wk1/TestExpectations: Skip new test, MediaStream isn't supported on WK1. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288466 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-24 Eric Carlson REGRESSION (iOS 15): HTMLAudioElement fails to load new audio when device is locked or safari is in background https://bugs.webkit.org/show_bug.cgi?id=229688 Reviewed by Jer Noble. * fast/mediasession/metadata/audio-track-enabled.html: Wait longer for the audio session category to be reset. * media/audio-session-category-expected.txt: Added. * media/audio-session-category.html: Added. * platform/gtk/TestExpectations: Skip new test. * platform/mac-wk1/TestExpectations: Skip new test, MediaStream isn't supported on WK1. 2022-02-07 Russell Epstein Cherry-pick r288362. rdar://problem/87832940 WPT version of css/css-cascade/parsing/layer-import-parsing.html crashes with nullptr https://bugs.webkit.org/show_bug.cgi?id=235434 rdar://87832940 Reviewed by Alan Bujtas. LayoutTests/imported/w3c: * web-platform-tests/css/css-cascade/parsing/layer-import-parsing.html: Update to WPT version. Source/WebCore: Test: fast/css/insert-import-rule-crash.html * css/StyleRuleImport.cpp: (WebCore::StyleRuleImport::setCSSStyleSheet): Null check the parent stylesheet. It can be null if the rule has been removed. * dom/InlineStyleSheetOwner.cpp: (WebCore::InlineStyleSheetOwner::startLoadingDynamicSheet): Also fix a debug assert in addPendingSheet, this can get called multiple times. LayoutTests: * fast/css/insert-import-rule-crash-expected.txt: Added. * fast/css/insert-import-rule-crash.html: Added. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288362 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-21 Antti Koivisto WPT version of css/css-cascade/parsing/layer-import-parsing.html crashes with nullptr https://bugs.webkit.org/show_bug.cgi?id=235434 rdar://87832940 Reviewed by Alan Bujtas. * fast/css/insert-import-rule-crash-expected.txt: Added. * fast/css/insert-import-rule-crash.html: Added. 2022-02-07 Russell Epstein Cherry-pick r288178. rdar://problem/79296770 REGRESSION (r264352): Mail compose body field does not avoid the keyboard when scrolling after focus https://bugs.webkit.org/show_bug.cgi?id=235331 rdar://79296770 Reviewed by Tim Horton. Source/WebKit: After r264352 added the call to `_page->scheduleFullEditorStateUpdate();` during element focus, scrolling to reveal the selection in the focused body field in Mail stopped working. This is because Mail: 1. Sets `firstResponderKeyboardAvoidanceEnabled` to NO on the WKScrollView, which prevents automatic inset adjustment logic in UIKit from taking effect and adding the keyboard height to the bottom system content inset. 2. Manually sets `-contentScrollInset` on the WKScrollView during a UIKeyboardDidShowNotification, which occurs after we've already attempted to zoom to the selection. ...combined with the fact that without the call to `scheduleFullEditorStateUpdate()`, the next EditorState would've arrived only after the keyboard animation finished. The end result is that we don't end up avoiding the keyboard at all when focusing the body field in Mail compose. While rdar://87733414 tracks refactoring logic in WebKit2 Mail compose to ensure that the content scroll insets on WKScrollView are applied during UIKeyboardWillShowNotification instead of after the keyboard has finished animating in, this patch provides a short-term workaround by restoring pre-r264352 behavior, with respect to when the element is scrolled into view. Test: editing/selection/ios/scroll-to-reveal-selection-with-keyboard-avoidance-disabled.html * Platform/spi/ios/UIKitSPI.h: Add a declaration for the `-firstResponderKeyboardAvoidanceEnabled` SPI property on non-internal iOS SDKs. * UIProcess/API/ios/WKWebViewIOS.mm: (-[WKWebView _keyboardDidShow:]): Plumb this through to the WKContentView, so we can zoom/scroll to the focused element if needed. * UIProcess/WebPageProxy.h: * UIProcess/ios/WKContentViewInteraction.h: * UIProcess/ios/WKContentViewInteraction.mm: (-[WKContentView cleanUpInteraction]): (-[WKContentView _keyboardDidShow]): If we previously deferred the call to `-_zoomToRevealFocusedElement` due to the keyboard still animating in, schedule a call to it now on a 0-delay timer; this delay is necessary to ensure that this zoom occurs *after* Mail has already set the content inset, which also happens underneath a "KeyboardDidShow" notification. (-[WKContentView _zoomToRevealFocusedElement]): In the case where the (presumably internal) client has set `firstResponderKeyboardAvoidanceEnabled` to NO and the keyboard is animating in, defer the actual call into the web view to `-_zoomToRevealFocusedElement` until after the keyboard animation is finished. This ensures compatibility with existant logic in Mail for manually setting the content scroll inset on the WKScrollView after the keyboard animation is complete. (-[WKContentView resetShouldZoomToFocusRectAfterShowingKeyboard]): (-[WKContentView _elementDidBlur]): Tools: Add support for a UIScriptController hook to override `firstResponderKeyboardAvoidanceEnabled` on WKScrollView. See LayoutTests for more details. * TestRunnerShared/UIScriptContext/Bindings/UIScriptController.idl: * TestRunnerShared/UIScriptContext/UIScriptController.h: (WTR::UIScriptController::setScrollViewKeyboardAvoidanceEnabled): * WebKitTestRunner/ios/TestControllerIOS.mm: (WTR::TestController::platformResetStateToConsistentValues): * WebKitTestRunner/ios/UIScriptControllerIOS.h: * WebKitTestRunner/ios/UIScriptControllerIOS.mm: (WTR::UIScriptControllerIOS::setScrollViewKeyboardAvoidanceEnabled): LayoutTests: Add a layout test that (at least) exercises the newly added codepath, where focusing an editor when the scroll view has `firstResponderKeyboardAvoidanceEnabled` set to NO will still allow us to scroll to the selection. * editing/selection/ios/scroll-to-reveal-selection-with-keyboard-avoidance-disabled-expected.txt: Added. * editing/selection/ios/scroll-to-reveal-selection-with-keyboard-avoidance-disabled.html: Added. * resources/ui-helper.js: (window.UIHelper.setScrollViewKeyboardAvoidanceEnabled): git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288178 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-18 Wenson Hsieh REGRESSION (r264352): Mail compose body field does not avoid the keyboard when scrolling after focus https://bugs.webkit.org/show_bug.cgi?id=235331 rdar://79296770 Reviewed by Tim Horton. Add a layout test that (at least) exercises the newly added codepath, where focusing an editor when the scroll view has `firstResponderKeyboardAvoidanceEnabled` set to NO will still allow us to scroll to the selection. * editing/selection/ios/scroll-to-reveal-selection-with-keyboard-avoidance-disabled-expected.txt: Added. * editing/selection/ios/scroll-to-reveal-selection-with-keyboard-avoidance-disabled.html: Added. * resources/ui-helper.js: (window.UIHelper.setScrollViewKeyboardAvoidanceEnabled): 2022-02-07 Russell Epstein Cherry-pick r288132. rdar://problem/87569029 CSP: Improve handling of multiple policies https://bugs.webkit.org/show_bug.cgi?id=235199 Reviewed by Kate Cheney. LayoutTests/imported/w3c: Add new test expectations with more passes. * web-platform-tests/content-security-policy/script-src/script-src-multiple-policies-one-using-hashing-algorithms-expected.txt: * web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted-expected.txt: * web-platform-tests/content-security-policy/style-src/style-src-error-event-fires-expected.txt: * web-platform-tests/content-security-policy/style-src/style-src-inline-style-nonce-blocked-error-event-expected.txt: * web-platform-tests/content-security-policy/style-src/style-src-multiple-policies-multiple-hashing-algorithms-expected.txt: Added. Source/WebCore: This fixes many issues with multiple CSP policies. To quote the spec for script-src: > Their behavior will be blocked unless every policy allows inline script, either implicitly by not specifying a script-src (or default-src) directive, or explicitly, by specifying "unsafe-inline", a nonce-source or a hash-source that matches the inline block. The previous structure was many distinct calls to check if there was a nonce in any policy, then if there was a hash in any policy, etc, rather than actually checking the policies as a whole to know if they allow or block a behavior. This lead to various issues where polices were not properly respected and where reports were inaccurate. The allScriptPoliciesAllow() function did try to consider all policies but was not very flexible and had buggy behavior like for each policy it would call findHashOfContentInPolicies() meaning hashes from other policies incorrectly applied to the current policy, plus general inefficiency of hashing the same content many times over. The new behavior relies more on passing all required information in a single function call to verify all policies in a single pass. * bindings/js/CachedScriptFetcher.cpp: (WebCore::CachedScriptFetcher::requestScriptWithCache const): * dom/InlineStyleSheetOwner.cpp: (WebCore::InlineStyleSheetOwner::createSheet): * dom/ScriptElement.cpp: (WebCore::ScriptElement::requestModuleScript): (WebCore::ScriptElement::executeClassicScript): * dom/StyledElement.cpp: (WebCore::StyledElement::styleAttributeChanged): * html/HTMLLinkElement.cpp: (WebCore::HTMLLinkElement::process): * loader/DocumentThreadableLoader.cpp: (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy): * loader/ResourceLoaderOptions.h: * loader/cache/CachedResourceLoader.cpp: (WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const): * page/csp/ContentSecurityPolicy.cpp: (WebCore::parseSubResourceIntegrityIntoDigests): (WebCore::generateHashesForContent): (WebCore::ContentSecurityPolicy::allowJavaScriptURLs const): (WebCore::ContentSecurityPolicy::allowInlineEventHandlers const): (WebCore::ContentSecurityPolicy::allowNonParserInsertedScripts const): (WebCore::ContentSecurityPolicy::allowInlineScript const): (WebCore::ContentSecurityPolicy::allowInlineStyle const): (WebCore::ContentSecurityPolicy::allowScriptFromSource const): (WebCore::ContentSecurityPolicy::allowStyleFromSource const): (WebCore::ContentSecurityPolicy::allScriptPoliciesAllow const): Deleted. (WebCore::ContentSecurityPolicy::findHashOfContentInPolicies const): Deleted. (WebCore::ContentSecurityPolicy::checkHashAndReportViolation const): Deleted. * page/csp/ContentSecurityPolicy.h: * page/csp/ContentSecurityPolicyDirectiveList.cpp: (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptElement const): (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForInlineJavascriptURL const): (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForInlineEventHandlers const): (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForNonParserInsertedScripts const): (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleElement const): (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineStyleAttribute const): (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForScript const): (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForStyle const): (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeHashScript const): Deleted. (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeHashStyle const): Deleted. (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForParserInsertedScript const): Deleted. (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForUnsafeInlineScriptAttribute const): Deleted. (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForScriptHash const): Deleted. (WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForStyleHash const): Deleted. * page/csp/ContentSecurityPolicyDirectiveList.h: LayoutTests: Update test expectations, Some newly passing tests are no longer skipped and some have new reports. * TestExpectations: * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-in-enforced-policy-and-not-in-report-only-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-multiple-policies-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scripthash-in-enforced-policy-and-not-in-report-only-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scripthash-multiple-policies-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-enforced-policy-and-blocked-by-report-policy-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-enforced-policy-and-blocked-by-report-policy2-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy2-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-in-enforced-policy-and-not-in-report-only-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-multiple-policies-expected.txt: * http/tests/security/contentSecurityPolicy/inline-script-blocked-javascript-url-expected.txt: * http/tests/security/contentSecurityPolicy/javascript-url-blocked-by-default-src-star-expected.txt: * http/tests/security/contentSecurityPolicy/javascript-url-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/window-open-javascript-url-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/window-open-javascript-url-with-target-blocked-expected.txt: * platform/glib/TestExpectations: * platform/wk2/http/tests/security/contentSecurityPolicy/block-all-mixed-content/insecure-css-in-iframe-report-only-expected.txt: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288132 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-18 Patrick Griffis CSP: Improve handling of multiple policies https://bugs.webkit.org/show_bug.cgi?id=235199 Reviewed by Kate Cheney. Update test expectations, Some newly passing tests are no longer skipped and some have new reports. * TestExpectations: * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-in-enforced-policy-and-not-in-report-only-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/module-scriptnonce-multiple-policies-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scripthash-in-enforced-policy-and-not-in-report-only-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scripthash-multiple-policies-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-enforced-policy-and-blocked-by-report-policy-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-enforced-policy-and-blocked-by-report-policy2-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy2-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-in-enforced-policy-and-not-in-report-only-expected.txt: * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-multiple-policies-expected.txt: * http/tests/security/contentSecurityPolicy/inline-script-blocked-javascript-url-expected.txt: * http/tests/security/contentSecurityPolicy/javascript-url-blocked-by-default-src-star-expected.txt: * http/tests/security/contentSecurityPolicy/javascript-url-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/window-open-javascript-url-blocked-expected.txt: * http/tests/security/contentSecurityPolicy/window-open-javascript-url-with-target-blocked-expected.txt: * platform/glib/TestExpectations: * platform/wk2/http/tests/security/contentSecurityPolicy/block-all-mixed-content/insecure-css-in-iframe-report-only-expected.txt: 2022-02-07 Russell Epstein Cherry-pick r288031. rdar://problem/82997136 [Cocoa] rVFC() isn't called for initial video load https://bugs.webkit.org/show_bug.cgi?id=235006 Reviewed by Eric Carlson. Source/WebCore: Tests: media/request-video-frame-loadstart.html media/request-video-frame-seek.html Add a new utility class, QueuedVideoOutput, which will pull pixel buffers out of an AVPlayerItemVideoOutput pre-emptively. Once those pixel buffers are enqueued locally, their associated timing information can be used to fire a callback for that buffer's display time. Previously, paints were blocked from pulling new pixel buffers from the video output. With the QueuedVideoOutput class, this is no longer necessary. The QueuedVideoOutput will notify its client when the image for currentTime changes, and other clients can freely ask for the currentTime's image. To curb runaway memory growth, frames are purged as soon as a new image for the current time is available, and when the video output signals that its own queues were purged. * WebCore.xcodeproj/project.pbxproj: * html/HTMLVideoElement.cpp: (WebCore::HTMLVideoElement::cancelVideoFrameCallback): (WebCore::HTMLVideoElement::serviceRequestVideoFrameCallbacks): * html/HTMLVideoElement.h: * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h: * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm: (WebCore::MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC): (WebCore::MediaPlayerPrivateAVFoundationObjC::hasAvailableVideoFrame const): (WebCore::MediaPlayerPrivateAVFoundationObjC::updateVideoFullscreenInlineImage): (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenLayer): (WebCore::MediaPlayerPrivateAVFoundationObjC::startVideoFrameMetadataGathering): (WebCore::MediaPlayerPrivateAVFoundationObjC::checkNewVideoFrameMetadata): (WebCore::MediaPlayerPrivateAVFoundationObjC::updateVideoTracks): (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoOutput): (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoOutput): (WebCore::MediaPlayerPrivateAVFoundationObjC::updateLastPixelBuffer): (WebCore::MediaPlayerPrivateAVFoundationObjC::videoOutputHasAvailableFrame): (WebCore::MediaPlayerPrivateAVFoundationObjC::updateLastImage): (WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithVideoOutput): (WebCore::MediaPlayerPrivateAVFoundationObjC::pixelBufferForCurrentTime): (WebCore::MediaPlayerPrivateAVFoundationObjC::nativeImageForCurrentTime): (WebCore::MediaPlayerPrivateAVFoundationObjC::colorSpace): (WebCore::MediaPlayerPrivateAVFoundationObjC::outputMediaDataWillChange): (WebCore::globalPullDelegateQueue): Deleted. (WebCore::MediaPlayerPrivateAVFoundationObjC::waitForVideoOutputMediaDataWillChange): Deleted. (-[WebCoreAVFPullDelegate initWithPlayer:]): Deleted. (-[WebCoreAVFPullDelegate outputMediaDataWillChange:]): Deleted. (-[WebCoreAVFPullDelegate outputSequenceWasFlushed:]): Deleted. * platform/graphics/avfoundation/objc/QueuedVideoOutput.h: Added. * platform/graphics/avfoundation/objc/QueuedVideoOutput.mm: Added. (-[WebQueuedVideoOutputDelegate initWithParent:]): (-[WebQueuedVideoOutputDelegate outputMediaDataWillChange:]): (-[WebQueuedVideoOutputDelegate outputSequenceWasFlushed:]): (-[WebQueuedVideoOutputDelegate observeValueForKeyPath:ofObject:change:context:]): (WebCore::globalOutputDelegateQueue): (WebCore::QueuedVideoOutput::create): (WebCore::QueuedVideoOutput::QueuedVideoOutput): (WebCore::QueuedVideoOutput::~QueuedVideoOutput): (WebCore::QueuedVideoOutput::invalidate): (WebCore::decltype): (WebCore::QueuedVideoOutput::hasImageForTime const): (WebCore::QueuedVideoOutput::takeVideoFrameEntryForTime): (WebCore::QueuedVideoOutput::addCurrentImageChangedObserver): (WebCore::QueuedVideoOutput::configureNextImageObserver): (WebCore::QueuedVideoOutput::imageForCurrentTimeChanged): (WebCore::QueuedVideoOutput::addVideoFrameEntries): (WebCore::QueuedVideoOutput::purgeVideoFrameEntries): (WebCore::QueuedVideoOutput::purgeImagesBeforeTime): (WebCore::QueuedVideoOutput::rateChanged): Source/WebCore/PAL: * pal/spi/cocoa/AVFoundationSPI.h: LayoutTests: * media/request-video-frame-loadstart-expected.txt: Added. * media/request-video-frame-loadstart.html: Added. * media/request-video-frame-seek-expected.txt: Added. * media/request-video-frame-seek.html: Added. * platform/ios-wk2/TestExpectations: * platform/mac-wk1/TestExpectations: * platform/mac-wk2/TestExpectations: git-svn-id: https://svn.webkit.org/repository/webkit/trunk@288031 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2022-01-14 Jer Noble [Cocoa] rVFC() isn't called for initial video load https://bugs.webkit.org/show_bug.cgi?id=235006 Reviewed by Eric Carlson. * media/request-video-frame-loadstart-expected.txt: Added. * media/request-video-frame-loadstart.html: Added. * media/request-video-frame-seek-expected.txt: Added. * media/request-video-frame-seek.html: Added. * platform/ios-wk2/TestExpectations: * platform/mac-wk1/TestExpectations: * platform/mac-wk2/TestExpectations: 2022-02-07 Russell Epstein Cherry-pick r288003. rdar://problem/85505101 Only apply automatic minimum block-size aspect-ratio rules to non-replaced elements https://bugs.webkit.org/show_bug.cgi?id=235058 Reviewed by Alan Bujtas. Source/WebCore: The rules in https://www.w3.org/TR/css-sizing-4/#aspect-ratio-minimum that define the automatic minimum size of an element subject to an aspect-ratio only apply if the element is non-replaced. In constrainLogicalHeightByMinMax specifically, when min-height is auto, after applying the aspect-ratio to produce an automatic minimum height, we bump it up to the content height if the element has children. This, presumably, is to account for the way the height of a block is computed in CSS 2.2. (As CSS 2.2 doesn't have an auto value for min-height, and a CSS Block Layout module has not been written in terms of CSS Sizing concepts, there is no clear definition of automatic minimum sizing for blocks at the moment.) If we erroneously apply this to a replaced element, such as an image or video, it can get a computed min-height equal to the intrinsic height of the image, which may be much larger than expected. This commit adds an is() check for both automatic minimum logical width and height calculations, although I was unable to produce a test to exercise the logical width case (which does not take the intrinsic size into account when computing the automatic minimum). Test: fast/css/aspect-ratio-min-height-replaced.html * rendering/RenderBox.cpp: (WebCore::RenderBox::constrainLogicalWidthInFragmentByMinMax const): (WebCore::RenderBox::constrainLogicalHeightByMinMax const): LayoutTests: Test that replaced elements with child content (in this case, a