Changeset 214713 in webkit


Ignore:
Timestamp:
Apr 1, 2017 12:47:17 AM (7 years ago)
Author:
ap@apple.com
Message:

Rolling back ​http://trac.webkit.org/r214663 - memory corruption

Source/WebCore:

  • Modules/streams/ReadableByteStreamInternals.js:

(cloneArrayBuffer):

  • bindings/js/JSDOMGlobalObject.cpp:

(WebCore::JSDOMGlobalObject::addBuiltinGlobals):

  • bindings/js/StructuredClone.cpp:

(WebCore::structuredCloneArrayBuffer):
(WebCore::cloneArrayBufferImpl): Deleted.
(WebCore::cloneArrayBuffer): Deleted.

  • bindings/js/StructuredClone.h:
  • bindings/js/WebCoreBuiltinNames.h:
  • testing/Internals.cpp:

(WebCore::markerTypeFrom):
(WebCore::Internals::resetToConsistentState):
(WebCore::Internals::isLoadingFromMemoryCache):
(WebCore::Internals::setImageFrameDecodingDuration):
(WebCore::deferredStyleRulesCountForList):
(WebCore::deferredGroupRulesCountForList):
(WebCore::deferredKeyframesRulesCountForList):
(WebCore::Internals::eventThrottlingBehaviorOverride):
(WebCore::Internals::enableMockSpeechSynthesizer):
(WebCore::Internals::rangeForDictionaryLookupAtLocation):
(WebCore::Internals::nodesFromRect):
(WebCore::Internals::layerIDForElement):
(WebCore::Internals::setElementUsesDisplayListDrawing):
(WebCore::Internals::setElementTracksDisplayListReplay):
(WebCore::Internals::styleRecalcCount):
(WebCore::Internals::compositingUpdateCount):
(WebCore::Internals::setCaptionDisplayMode):
(WebCore::Internals::endMediaSessionInterruption):
(WebCore::Internals::postRemoteControlCommand):
(WebCore::appendOffsets):
(WebCore::Internals::scrollSnapOffsets):
(WebCore::Internals::setShowAllPlugins):
(WebCore::Internals::cloneArrayBuffer): Deleted.

  • testing/Internals.h:
  • testing/Internals.idl:

LayoutTests:

  • streams/readable-stream-byob-request-expected.txt:
  • streams/readable-stream-byob-request.js:

(self.importScripts.test): Deleted.

Location:
trunk
Files:
12 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r214712 r214713  
     12017-04-01  Alexey Proskuryakov  <ap@apple.com>
     2
     3        Rolling back http://trac.webkit.org/r214663 - memory corruption
     4
     5        * streams/readable-stream-byob-request-expected.txt:
     6        * streams/readable-stream-byob-request.js:
     7        (self.importScripts.test): Deleted.
     8
    192017-03-31  Zalan Bujtas  <zalan@apple.com>
    210

  • trunk/LayoutTests/streams/readable-stream-byob-request-expected.txt

    r214663 r214713  
    1111PASS Calling respond() with a bytesWritten value greater than autoAllocateChunkSize should fail
    1212PASS Calling respond() with a bytesWritten value lower than autoAllocateChunkSize should succeed
    13 PASS Test cloneArrayBuffer implementation
    1413PASS ReadableStreamBYOBRequest instances should have the correct list of properties
    1514PASS By default, byobRequest should be undefined

  • trunk/LayoutTests/streams/readable-stream-byob-request.js

    r214663 r214713  
    242242// so that more code can be covered.
    243243
    244 if (!self.importScripts) {
    245     // Test only if not Worker.
    246     const CloneArrayBuffer = internals.cloneArrayBuffer.bind(internals);
    247 
    248     test(function() {
    249         const typedArray = new Uint8Array([3, 5, 7]);
    250         const clonedBuffer = CloneArrayBuffer(typedArray.buffer, 1, 1);
    251         const otherArray = new Uint8Array(clonedBuffer);
    252         assert_equals(otherArray.byteLength, 1);
    253         assert_equals(otherArray.byteOffset, 0);
    254         assert_equals(otherArray.buffer.byteLength, 1);
    255         assert_equals(otherArray[0], 5);
    256         // Check that when typedArray is modified, otherArray is not modified.
    257         typedArray[1] = 0;
    258         assert_equals(otherArray[0], 5);
    259     }, "Test cloneArrayBuffer implementation");
    260 }
    261 
    262244done();

  • trunk/Source/WebCore/ChangeLog

    r214712 r214713  
     12017-04-01  Alexey Proskuryakov  <ap@apple.com>
     2
     3        Rolling back http://trac.webkit.org/r214663 - memory corruption
     4
     5        * Modules/streams/ReadableByteStreamInternals.js:
     6        (cloneArrayBuffer):
     7        * bindings/js/JSDOMGlobalObject.cpp:
     8        (WebCore::JSDOMGlobalObject::addBuiltinGlobals):
     9        * bindings/js/StructuredClone.cpp:
     10        (WebCore::structuredCloneArrayBuffer):
     11        (WebCore::cloneArrayBufferImpl): Deleted.
     12        (WebCore::cloneArrayBuffer): Deleted.
     13        * bindings/js/StructuredClone.h:
     14        * bindings/js/WebCoreBuiltinNames.h:
     15        * testing/Internals.cpp:
     16        (WebCore::markerTypeFrom):
     17        (WebCore::Internals::resetToConsistentState):
     18        (WebCore::Internals::isLoadingFromMemoryCache):
     19        (WebCore::Internals::setImageFrameDecodingDuration):
     20        (WebCore::deferredStyleRulesCountForList):
     21        (WebCore::deferredGroupRulesCountForList):
     22        (WebCore::deferredKeyframesRulesCountForList):
     23        (WebCore::Internals::eventThrottlingBehaviorOverride):
     24        (WebCore::Internals::enableMockSpeechSynthesizer):
     25        (WebCore::Internals::rangeForDictionaryLookupAtLocation):
     26        (WebCore::Internals::nodesFromRect):
     27        (WebCore::Internals::layerIDForElement):
     28        (WebCore::Internals::setElementUsesDisplayListDrawing):
     29        (WebCore::Internals::setElementTracksDisplayListReplay):
     30        (WebCore::Internals::styleRecalcCount):
     31        (WebCore::Internals::compositingUpdateCount):
     32        (WebCore::Internals::setCaptionDisplayMode):
     33        (WebCore::Internals::endMediaSessionInterruption):
     34        (WebCore::Internals::postRemoteControlCommand):
     35        (WebCore::appendOffsets):
     36        (WebCore::Internals::scrollSnapOffsets):
     37        (WebCore::Internals::setShowAllPlugins):
     38        (WebCore::Internals::cloneArrayBuffer): Deleted.
     39        * testing/Internals.h:
     40        * testing/Internals.idl:
     41
    1422017-03-31  Zalan Bujtas  <zalan@apple.com>
    243

  • trunk/Source/WebCore/Modules/streams/ReadableByteStreamInternals.js

    r214663 r214713  
    379379}
    380380
     381function cloneArrayBuffer(srcBuffer, srcByteOffset, srcLength)
     382{
     383    "use strict";
     384
     385    // FIXME: Below implementation returns the appropriate data but does not perform
     386    // exactly what is described by ECMAScript CloneArrayBuffer operation. This should
     387    // be fixed in a follow up patch implementing cloneArrayBuffer in JSC (similarly to
     388    // structuredCloneArrayBuffer implementation).
     389    return srcBuffer.slice(srcByteOffset, srcByteOffset + srcLength);
     390}
     391
    381392function readableByteStreamControllerRespondInReadableState(controller, bytesWritten, pullIntoDescriptor)
    382393{

  • trunk/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp

    r214663 r214713  
    143143        JSDOMGlobalObject::GlobalPropertyInfo(clientData.builtinNames().makeGetterTypeErrorPrivateName(),
    144144            JSFunction::create(vm, this, 2, String(), makeGetterTypeErrorForBuiltins), DontDelete | ReadOnly),
    145         JSDOMGlobalObject::GlobalPropertyInfo(clientData.builtinNames().cloneArrayBufferPrivateName(),
    146             JSFunction::create(vm, this, 3, String(), cloneArrayBuffer), DontDelete | ReadOnly),
    147145        JSDOMGlobalObject::GlobalPropertyInfo(clientData.builtinNames().structuredCloneArrayBufferPrivateName(),
    148146            JSFunction::create(vm, this, 1, String(), structuredCloneArrayBuffer), DontDelete | ReadOnly),

  • trunk/Source/WebCore/bindings/js/StructuredClone.cpp

    r214663 r214713  
    3636namespace WebCore {
    3737
    38 EncodedJSValue JSC_HOST_CALL cloneArrayBufferImpl(ExecState*, bool);
    39 
    40 EncodedJSValue JSC_HOST_CALL cloneArrayBufferImpl(ExecState* state, bool isPartialClone)
     38EncodedJSValue JSC_HOST_CALL structuredCloneArrayBuffer(ExecState* state)
    4139{
    4240    ASSERT(state);
    … …  
    5149        return { };
    5250    }
    53     if (isPartialClone) {
    54         ASSERT(state->argumentCount() == 3);
    55         int srcByteOffset = static_cast<int>(state->uncheckedArgument(1).toNumber(state));
    56         int srcLength = static_cast<int>(state->uncheckedArgument(2).toNumber(state));
    57         buffer = buffer->slice(srcByteOffset, srcByteOffset + srcLength).get();
    58     }
    5951    return JSValue::encode(JSArrayBuffer::create(state->vm(), state->lexicalGlobalObject()->arrayBufferStructure(ArrayBufferSharingMode::Default), ArrayBuffer::tryCreate(buffer->data(), buffer->byteLength())));
    60 }
    61 
    62 EncodedJSValue JSC_HOST_CALL cloneArrayBuffer(ExecState* state)
    63 {
    64     return cloneArrayBufferImpl(state, true);
    65 }
    66 
    67 EncodedJSValue JSC_HOST_CALL structuredCloneArrayBuffer(ExecState* state)
    68 {
    69     return cloneArrayBufferImpl(state, false);
    7052}
    7153

  • trunk/Source/WebCore/bindings/js/StructuredClone.h

    r214663 r214713  
    3232namespace WebCore {
    3333
    34 JSC::EncodedJSValue JSC_HOST_CALL cloneArrayBuffer(JSC::ExecState*);
    3534JSC::EncodedJSValue JSC_HOST_CALL structuredCloneArrayBuffer(JSC::ExecState*);
    3635JSC::EncodedJSValue JSC_HOST_CALL structuredCloneArrayBufferView(JSC::ExecState*);

  • trunk/Source/WebCore/bindings/js/WebCoreBuiltinNames.h

    r214663 r214713  
    4040    macro(byobRequest) \
    4141    macro(cancel) \
    42     macro(cloneArrayBuffer) \
    4342    macro(cloneForJS) \
    4443    macro(closeRequested) \

  • trunk/Source/WebCore/testing/Internals.cpp

    r214663 r214713  
    352352    else
    353353        return false;
    354 
     354   
    355355    return true;
    356356}
    … …  
    392392
    393393    page.setDefersLoading(false);
    394 
     394   
    395395    page.mainFrame().setTextZoomFactor(1.0f);
    396 
     396   
    397397    FrameView* mainFrameView = page.mainFrame().view();
    398398    if (mainFrameView) {
    … …  
    597597    ResourceRequest request(contextDocument()->completeURL(url));
    598598    request.setDomainForCachePartition(contextDocument()->topOrigin().domainForCachePartition());
    599 
     599   
    600600    CachedResource* resource = MemoryCache::singleton().resourceForRequest(request, contextDocument()->page()->sessionID());
    601601    return resource && resource->status() == CachedResource::Cached;
    … …  
    725725    if (!cachedImage)
    726726        return;
    727 
     727   
    728728    auto* image = cachedImage->image();
    729729    if (!is<BitmapImage>(image))
    730730        return;
    731 
     731   
    732732    downcast<BitmapImage>(*image).setFrameDecodingDurationForTesting(duration);
    733733}
    … …  
    989989            continue;
    990990        }
    991 
     991       
    992992        StyleRuleGroup* groupRule = nullptr;
    993993        if (is<StyleRuleMedia>(rule.get()))
    … …  
    997997        if (!groupRule)
    998998            continue;
    999 
     999       
    10001000        auto* groupChildRules = groupRule->childRulesWithoutDeferredParsing();
    10011001        if (!groupChildRules)
    10021002            continue;
    1003 
     1003       
    10041004        count += deferredStyleRulesCountForList(*groupChildRules);
    10051005    }
    … …  
    10241024        if (!groupRule)
    10251025            continue;
    1026 
     1026       
    10271027        auto* groupChildRules = groupRule->childRulesWithoutDeferredParsing();
    10281028        if (!groupChildRules)
    … …  
    10491049            continue;
    10501050        }
    1051 
     1051       
    10521052        StyleRuleGroup* groupRule = nullptr;
    10531053        if (is<StyleRuleMedia>(rule.get()))
    … …  
    10571057        if (!groupRule)
    10581058            continue;
    1059 
     1059       
    10601060        auto* groupChildRules = groupRule->childRulesWithoutDeferredParsing();
    10611061        if (!groupChildRules)
    10621062            continue;
    1063 
     1063       
    10641064        count += deferredKeyframesRulesCountForList(*groupChildRules);
    10651065    }
    1066 
     1066   
    10671067    return count;
    10681068}
    … …  
    11371137    if (!behavior)
    11381138        return std::nullopt;
    1139 
     1139   
    11401140    switch (behavior.value()) {
    11411141    case WebCore::EventThrottlingBehavior::Responsive:
    … …  
    12021202    if (!synthesis)
    12031203        return;
    1204 
     1204   
    12051205    synthesis->setPlatformSynthesizer(std::make_unique<PlatformSpeechSynthesizerMock>(synthesis));
    12061206}
    … …  
    16341634
    16351635    document->updateLayoutIgnorePendingStylesheets();
    1636 
     1636   
    16371637    HitTestResult result = document->frame()->mainFrame().eventHandler().hitTestResultAtPoint(IntPoint(x, y));
    16381638    NSDictionary *options = nullptr;
    … …  
    17901790        HitTestResult result(point, topPadding, rightPadding, bottomPadding, leftPadding);
    17911791        renderView->hitTest(request, result);
    1792 
     1792       
    17931793        const HitTestResult::NodeSet& nodeSet = result.rectBasedTestResult();
    17941794        matches.reserveInitialCapacity(nodeSet.size());
    … …  
    19111911    return document->frame()->editor().selectionStartHasMarkerFor(DocumentMarker::Spelling, from, length);
    19121912}
    1913 
     1913   
    19141914bool Internals::hasAutocorrectedMarker(int from, int length)
    19151915{
    … …  
    21642164    return count;
    21652165}
    2166 
     2166   
    21672167ExceptionOr<bool> Internals::isPageBoxVisible(int pageNumber)
    21682168{
    … …  
    22172217    if (!layerModelObject.layer()->isComposited())
    22182218        return Exception { NOT_FOUND_ERR };
    2219 
     2219   
    22202220    auto* backing = layerModelObject.layer()->backing();
    22212221    return backing->graphicsLayer()->primaryLayerID();
    … …  
    22862286    if (!element.renderer()->hasLayer())
    22872287        return Exception { INVALID_ACCESS_ERR };
    2288 
     2288   
    22892289    RenderLayer* layer = downcast<RenderLayerModelObject>(element.renderer())->layer();
    22902290    if (!layer->isComposited())
    22912291        return Exception { INVALID_ACCESS_ERR };
    2292 
     2292   
    22932293    layer->backing()->setUsesDisplayListDrawing(usesDisplayListDrawing);
    22942294    return { };
    … …  
    23152315    if (!layer->isComposited())
    23162316        return Exception { INVALID_ACCESS_ERR };
    2317 
     2317   
    23182318    layer->backing()->setIsTrackingDisplayListReplay(isTrackingReplay);
    23192319    return { };
    … …  
    25552555    document->view()->setFooterHeight(height);
    25562556}
    2557 
     2557   
    25582558void Internals::setTopContentInset(float contentInset)
    25592559{
    … …  
    26992699    if (!document)
    27002700        return Exception { INVALID_ACCESS_ERR };
    2701 
     2701   
    27022702    return document->styleRecalcCount();
    27032703}
    … …  
    27262726    if (!document || !document->renderView())
    27272727        return Exception { INVALID_ACCESS_ERR };
    2728 
     2728   
    27292729    return document->renderView()->compositor().compositingUpdateCount();
    27302730}
    … …  
    30183018    if (!document || !document->page())
    30193019        return Exception { INVALID_ACCESS_ERR };
    3020 
     3020   
    30213021#if ENABLE(VIDEO_TRACK)
    30223022    auto& captionPreferences = document->page()->group().captionPreferences();
    3023 
     3023   
    30243024    if (equalLettersIgnoringASCIICase(mode, "automatic"))
    30253025        captionPreferences.setCaptionDisplayMode(CaptionUserPreferences::Automatic);
    … …  
    30863086    return downcast<RenderEmbeddedObject>(*renderer).isReplacementObscured();
    30873087}
    3088 
     3088   
    30893089bool Internals::isPluginSnapshotted(Element& element)
    30903090{
    30913091    return is<HTMLPlugInElement>(element) && downcast<HTMLPlugInElement>(element).displayState() <= HTMLPlugInElement::DisplayingSnapshot;
    30923092}
    3093 
     3093   
    30943094#if ENABLE(MEDIA_SOURCE)
    30953095
    … …  
    31093109    return buffer.bufferedSamplesForTrackID(trackID);
    31103110}
    3111 
     3111   
    31123112Vector<String> Internals::enqueuedSamplesForTrackID(SourceBuffer& buffer, const AtomicString& trackID)
    31133113{
    … …  
    31493149    if (equalLettersIgnoringASCIICase(flagsString, "mayresumeplaying"))
    31503150        flags = PlatformMediaSession::MayResumePlaying;
    3151 
     3151   
    31523152    PlatformMediaSessionManager::sharedManager().endInterruption(flags);
    31533153}
    … …  
    33023302    else
    33033303        return Exception { INVALID_ACCESS_ERR };
    3304 
     3304   
    33053305    PlatformMediaSessionManager::sharedManager().didReceiveRemoteControlCommand(command, &parameter);
    33063306    return { };
    … …  
    35733573        else
    35743574            justStarting = false;
    3575 
     3575       
    35763576        builder.append(String::number(coordinate.toUnsigned()));
    35773577    }
    35783578    builder.appendLiteral(" }");
    35793579}
    3580 
     3580   
    35813581void Internals::setPlatformMomentumScrollingPredictionEnabled(bool enabled)
    35823582{
    … …  
    35933593    RenderBox& box = *element.renderBox();
    35943594    ScrollableArea* scrollableArea;
    3595 
     3595   
    35963596    if (box.isBody()) {
    35973597        FrameView* frameView = box.frame().mainFrame().view();
    … …  
    35993599            return Exception { INVALID_ACCESS_ERR };
    36003600        scrollableArea = frameView;
    3601 
     3601       
    36023602    } else {
    36033603        if (!box.canBeScrolledAndHasScrollableArea())
    … …  
    36083608    if (!scrollableArea)
    36093609        return String();
    3610 
     3610   
    36113611    StringBuilder result;
    36123612
    … …  
    36973697    if (!document)
    36983698        return;
    3699 
     3699   
    37003700    Page* page = document->page();
    37013701    if (!page)
    … …  
    37303730}
    37313731
    3732 #if ENABLE(READABLE_BYTE_STREAM_API)
    3733 
    3734 JSValue Internals::cloneArrayBuffer(JSC::ExecState& state, JSValue buffer, JSValue srcByteOffset, JSValue srcLength)
    3735 {
    3736     JSGlobalObject* globalObject = state.vmEntryGlobalObject();
    3737     JSVMClientData* clientData = static_cast<JSVMClientData*>(state.vm().clientData);
    3738     const Identifier& privateName = clientData->builtinNames().cloneArrayBufferPrivateName();
    3739     JSValue value;
    3740     PropertySlot propertySlot(value, PropertySlot::InternalMethodType::Get);
    3741     globalObject->methodTable()->getOwnPropertySlot(globalObject, &state, privateName, propertySlot);
    3742     value = propertySlot.getValue(&state, privateName);
    3743     ASSERT(value.isFunction());
    3744 
    3745     JSObject* function = value.getObject();
    3746     CallData callData;
    3747     CallType callType = JSC::getCallData(function, callData);
    3748     ASSERT(callType != JSC::CallType::None);
    3749     MarkedArgumentBuffer arguments;
    3750     arguments.append(buffer);
    3751     arguments.append(srcByteOffset);
    3752     arguments.append(srcLength);
    3753 
    3754     return JSC::call(&state, function, callType, callData, JSC::jsUndefined(), arguments);
    3755 }
    3756 
    3757 #endif
    37583732#endif
    37593733

  • trunk/Source/WebCore/testing/Internals.h

    r214663 r214713  
    189189    void invalidateFontCache();
    190190    void setFontSmoothingEnabled(bool);
    191 
     191   
    192192    ExceptionOr<void> setLowPowerModeEnabled(bool);
    193193
    194194    ExceptionOr<void> setScrollViewPosition(int x, int y);
    195 
     195   
    196196    ExceptionOr<Ref<ClientRect>> layoutViewportRect();
    197197    ExceptionOr<Ref<ClientRect>> visualViewportRect();
    198 
     198   
    199199    ExceptionOr<void> setViewBaseBackgroundColor(const String& colorValue);
    200200
    … …  
    369369    ExceptionOr<void> startTrackingLayerFlushes();
    370370    ExceptionOr<unsigned> layerFlushCount();
    371 
     371   
    372372    ExceptionOr<void> startTrackingStyleRecalcs();
    373373    ExceptionOr<unsigned> styleRecalcCount();
    … …  
    524524#if ENABLE(READABLE_STREAM_API)
    525525    bool isReadableStreamDisturbed(JSC::ExecState&, JSC::JSValue);
    526 #if ENABLE(READABLE_BYTE_STREAM_API)
    527     JSC::JSValue cloneArrayBuffer(JSC::ExecState&, JSC::JSValue, JSC::JSValue, JSC::JSValue);
    528 #endif
    529526#endif
    530527
    531528    String composedTreeAsText(Node&);
    532 
     529   
    533530    bool isProcessingUserGesture();
    534531
    … …  
    539536
    540537    bool userPrefersReducedMotion() const;
    541 
     538   
    542539    void reportBacktrace();
    543540

  • trunk/Source/WebCore/testing/Internals.idl

    r214663 r214713  
    491491    void setShowAllPlugins(boolean showAll);
    492492
    493     [Conditional=READABLE_STREAM_API&READABLE_BYTE_STREAM_API, CallWith=ScriptState] any cloneArrayBuffer(any buffer, any srcByteOffset, any byteLength);
    494493    [Conditional=READABLE_STREAM_API, CallWith=ScriptState] boolean isReadableStreamDisturbed(any stream);
    495494
Note: See TracChangeset for help on using the changeset viewer.