Timeline
Jul 23, 2014:
- 10:30 PM Changeset in webkit [171510] by
-
- 25 edits4 adds in branches/ftlopt/Source/JavaScriptCore
Make improvements to Type Profiling
https://bugs.webkit.org/show_bug.cgi?id=134860
Patch by Saam Barati <sbarati@apple.com> on 2014-07-23
Reviewed by Filip Pizlo.
I improved the API between the inspector and JSC. We no longer send one huge
string to the inspector. We now send structured data that represents the type
information that JSC has collected. I've also created a beginning implementation
of a type lattice that allows us to resolve a display name for a type that
consists of a single word.
I created a data structure that knows which functions have executed. This
solves the bug where types inside an un-executed function will resolve
to the type of the enclosing expression of that function. This data
structure may also be useful later if the inspector chooses to create a UI
around showing which functions have executed.
Better type information is gathered for objects. StructureShape now
represents an object's prototype chain. StructureShape also collects
the constructor name for an object.
Expression ranges are now zero indexed.
Removed some extraneous methods.
- JavaScriptCore.xcodeproj/project.pbxproj:
- bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::scopeDependentProfile):
- bytecode/CodeBlock.h:
- bytecode/TypeLocation.h:
(JSC::TypeLocation::TypeLocation):
- bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
- bytecode/UnlinkedCodeBlock.h:
(JSC::UnlinkedFunctionExecutable::highFidelityTypeProfilingStartOffset):
(JSC::UnlinkedFunctionExecutable::highFidelityTypeProfilingEndOffset):
- bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo):
- bytecompiler/BytecodeGenerator.h:
(JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo): Deleted.
- heap/Heap.cpp:
(JSC::Heap::collect):
- inspector/agents/InspectorRuntimeAgent.cpp:
(Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
(Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableAtOffset): Deleted.
- inspector/agents/InspectorRuntimeAgent.h:
- inspector/protocol/Runtime.json:
- runtime/Executable.cpp:
(JSC::ScriptExecutable::ScriptExecutable):
(JSC::ProgramExecutable::ProgramExecutable):
(JSC::FunctionExecutable::FunctionExecutable):
(JSC::ProgramExecutable::initializeGlobalProperties):
- runtime/Executable.h:
(JSC::ScriptExecutable::highFidelityTypeProfilingStartOffset):
(JSC::ScriptExecutable::highFidelityTypeProfilingEndOffset):
- runtime/FunctionHasExecutedCache.cpp: Added.
(JSC::FunctionHasExecutedCache::hasExecutedAtOffset):
(JSC::FunctionHasExecutedCache::insertUnexecutedRange):
(JSC::FunctionHasExecutedCache::removeUnexecutedRange):
- runtime/FunctionHasExecutedCache.h: Added.
(JSC::FunctionHasExecutedCache::FunctionRange::FunctionRange):
(JSC::FunctionHasExecutedCache::FunctionRange::operator==):
(JSC::FunctionHasExecutedCache::FunctionRange::hash):
- runtime/HighFidelityLog.cpp:
(JSC::HighFidelityLog::processHighFidelityLog):
(JSC::HighFidelityLog::actuallyProcessLogThreadFunction): Deleted.
- runtime/HighFidelityLog.h:
(JSC::HighFidelityLog::recordTypeInformationForLocation):
- runtime/HighFidelityTypeProfiler.cpp:
(JSC::HighFidelityTypeProfiler::logTypesForTypeLocation):
(JSC::HighFidelityTypeProfiler::insertNewLocation):
(JSC::HighFidelityTypeProfiler::getTypesForVariableAtOffsetForInspector):
(JSC::descriptorMatchesTypeLocation):
(JSC::HighFidelityTypeProfiler::findLocation):
(JSC::HighFidelityTypeProfiler::getTypesForVariableInAtOffset): Deleted.
(JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableAtOffset): Deleted.
(JSC::HighFidelityTypeProfiler::getLocalTypesForVariableAtOffset): Deleted.
- runtime/HighFidelityTypeProfiler.h:
(JSC::QueryKey::QueryKey):
(JSC::QueryKey::isHashTableDeletedValue):
(JSC::QueryKey::operator==):
(JSC::QueryKey::hash):
(JSC::QueryKeyHash::hash):
(JSC::QueryKeyHash::equal):
(JSC::HighFidelityTypeProfiler::functionHasExecutedCache):
(JSC::HighFidelityTypeProfiler::typeLocationCache):
- runtime/Structure.cpp:
(JSC::Structure::toStructureShape):
- runtime/Structure.h:
- runtime/TypeLocationCache.cpp: Added.
(JSC::TypeLocationCache::getTypeLocation):
- runtime/TypeLocationCache.h: Added.
(JSC::TypeLocationCache::LocationKey::LocationKey):
(JSC::TypeLocationCache::LocationKey::operator==):
(JSC::TypeLocationCache::LocationKey::hash):
- runtime/TypeSet.cpp:
(JSC::TypeSet::getRuntimeTypeForValue):
(JSC::TypeSet::addTypeForValue):
(JSC::TypeSet::seenTypes):
(JSC::TypeSet::doesTypeConformTo):
(JSC::TypeSet::displayName):
(JSC::TypeSet::allPrimitiveTypeNames):
(JSC::TypeSet::allStructureRepresentations):
(JSC::TypeSet::leastCommonAncestor):
(JSC::StructureShape::StructureShape):
(JSC::StructureShape::addProperty):
(JSC::StructureShape::propertyHash):
(JSC::StructureShape::leastCommonAncestor):
(JSC::StructureShape::stringRepresentation):
(JSC::StructureShape::inspectorRepresentation):
(JSC::StructureShape::leastUpperBound): Deleted.
- runtime/TypeSet.h:
(JSC::StructureShape::setConstructorName):
(JSC::StructureShape::constructorName):
(JSC::StructureShape::setProto):
- runtime/VM.cpp:
(JSC::VM::dumpHighFidelityProfilingTypes):
(JSC::VM::getTypesForVariableAtOffset): Deleted.
(JSC::VM::updateHighFidelityTypeProfileState): Deleted.
- runtime/VM.h:
(JSC::VM::isProfilingTypesWithHighFidelity):
(JSC::VM::highFidelityTypeProfiler):
- 10:17 PM Changeset in webkit [171509] by
-
- 2 edits in trunk/Source/WebKit2
[iOS WK2] Some help.apple.com pages not scrollable
https://bugs.webkit.org/show_bug.cgi?id=135228
<rdar://problem/17790792>
Reviewed by Benjamin Poulain.
On pages which size their document to the device size, the WKContentView size
never changes after it's created. In this situation, we never set a bounds
on the _rootContentView, so it remains zero-sized which breaks hit testing
on all enclosed UIScrollViews for overflow:scroll.
Fix by making the _rootContentView and the _inspectorIndicationView use autosizing
so they are always the size of their parent view, and remove the explicit setting
of their bounds.
- UIProcess/ios/WKContentView.mm:
(-[WKContentView initWithFrame:context:configuration:webView:]):
(-[WKContentView setShowingInspectorIndication:]):
(-[WKContentView _didCommitLayerTree:]):
- 10:16 PM Changeset in webkit [171508] by
-
- 2 edits in branches/ftlopt/Source/JavaScriptCore
Fix debug build.
- bytecode/CallLinkStatus.h:
(JSC::CallLinkStatus::CallLinkStatus):
- 10:02 PM Changeset in webkit [171507] by
-
- 2 edits in trunk/Source/WebKit2
[iOS][WK2] r171124 is incorrect when the virtual keyboard is up
https://bugs.webkit.org/show_bug.cgi?id=135187
Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-07-23
Reviewed by Simon Fraser.
Unfortunately, restricting the input into the document rect does not work.
When the keyboard is up, the keyboard bounds can overlap the WKWebView, and
the valid range should account for that.
Instead of playing with the keyboard rect, we can limit the scroll position
inside the valid range of UIScrollView. The keyboard always adjusts the UIScrollView
range as needed to give access to the content. Using that range is a bit more permissive
because the page could scroll to reveal content in the content inset defined by the client
of the API (this could actually be quite useful for hybrid apps).
There was already a function to change the content offset in the valid scrollview
range: changeContentOffsetBoundedInValidRange(), I extracted the range check
to contentOffsetBoundedInValidRange() for the needs of -[WKWebView _scrollToContentOffset:].
So...contentOffsetBoundedInValidRange() is cool, but it is not in the right coordinate
system. The scroll position we get from the WebProcess is in document coordinates, while
contentOffsetBoundedInValidRange() works with the UIScrollView coordinates.
To fix that, we scale the input position to get to the same scale as UIScrollView, then
apply the insets with the weirdly named [WKWebView _adjustedContentOffset:].
- UIProcess/API/Cocoa/WKWebView.mm:
(contentOffsetBoundedInValidRange):
(changeContentOffsetBoundedInValidRange):
(-[WKWebView _scrollToContentOffset:]):
- 9:38 PM Changeset in webkit [171506] by
-
- 2 edits in trunk/Source/WebCore
Transparent fullscreen background when video is not present.
https://bugs.webkit.org/show_bug.cgi?id=135226
Patch by Jeremy Jones <jeremyj@apple.com> on 2014-07-23
Reviewed by Simon Fraser.
Set background to black just before beginning the animation to fullscreen.
- platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
(WebVideoFullscreenInterfaceAVKit::enterFullscreen): set background color black.
- 7:39 PM Changeset in webkit [171505] by
-
- 4 edits in trunk/Source/WebCore
ScriptController::updateDocument ASSERT mutating map while iterating map
https://bugs.webkit.org/show_bug.cgi?id=135211
Patch by Joseph Pecoraro <Joseph Pecoraro> on 2014-07-23
Reviewed by Oliver Hunt.
Avoid iterating over m_windowShells in more places. This prevents
the possibility of a collection during JSC allocation which might
cause a mutation to m_windowShells (HTMLMediaElement destruction).
Have ScriptController defriend ScriptCachedFrameData by providing
a getter for the list of window shells.
- bindings/js/ScriptCachedFrameData.cpp:
(WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
(WebCore::ScriptCachedFrameData::restore):
- bindings/js/ScriptController.cpp:
(WebCore::ScriptController::windowShells):
(WebCore::ScriptController::clearWindowShell):
(WebCore::ScriptController::attachDebugger):
(WebCore::ScriptController::updateDocument):
- bindings/js/ScriptController.h:
- 6:13 PM Changeset in webkit [171504] by
-
- 8 edits in trunk/Source
Unreviewed, rolling out r171498.
https://bugs.webkit.org/show_bug.cgi?id=135223
It will regress some scroll position restoration on navigation
(r167916). (Requested by smfr on #webkit).
Reverted changeset:
"[iOS WK2] Header bar on nytimes articles lands in the wrong
place after rubberbanding"
https://bugs.webkit.org/show_bug.cgi?id=135221
http://trac.webkit.org/changeset/171498
- 6:00 PM Changeset in webkit [171503] by
-
- 2 edits in branches/safari-600.1-branch/Source/JavaScriptCore
Merged r171474. <rdar://problem/17041912>
- 5:57 PM Changeset in webkit [171502] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merged r171490. <rdar://problem/17739108>
- 5:54 PM Changeset in webkit [171501] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebCore
Merge r171499. <rdar://problem/17783423>
- 5:52 PM Changeset in webkit [171500] by
-
- 2 edits in tags/Safari-600.1.2/Source/WebCore
Merge r171499. <rdar://problem/17783423>
- 5:24 PM Changeset in webkit [171499] by
-
- 2 edits in trunk/Source/WebCore
REGRESSION (r171376): Sometimes we detect less than the whole phone number
https://bugs.webkit.org/show_bug.cgi?id=135220
<rdar://problem/17783423>
Reviewed by Brady Eidson.
- editing/Editor.cpp:
(WebCore::Editor::scanSelectionForTelephoneNumbers):
Use the visible selection's start and end instead of base and extent, because they'll
always be in the right order in the case of a directional selection (base can be *after* extent
if you select from right to left). This fixes the code that expands the selection.
Pass the *entire* expanded selection to DataDetectors, instead of using TextIterator.
This way, we will find each number only once, and will never get part of a phone number once
and then the whole phone number later.
- 5:23 PM Changeset in webkit [171498] by
-
- 8 edits in trunk/Source
[iOS WK2] Header bar on nytimes articles lands in the wrong place after rubberbanding
https://bugs.webkit.org/show_bug.cgi?id=135221
Reviewed by Tim Horton.
Source/WebCore:
Add a function on GraphicsLayer to force a flush of the layer position
to the underlying graphics system, so that when layers cease being
scroll-coordinated, we can ensure that their layers are repositioned
in the correct location.
- WebCore.exp.in:
- platform/graphics/GraphicsLayer.h:
(WebCore::GraphicsLayer::forcePositionUpdate):
- platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::forcePositionUpdate):
- platform/graphics/ca/GraphicsLayerCA.h:
- rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::detachScrollCoordinatedLayer):
Source/WebKit2:
The call to didCommitLayerTree() can cause one or two visible rect updates,
via changes to the UIScrollView contentSize and contentOffset. As a result, we
would notify the scrolling tree about a viewport change, but using the old
scrolling tree rather than the new one, so we could move layers around for
nodes which are about to be removed from the tree.
Fix by m_webPageProxy->didCommitLayerTree() after the scrolling tree has been
committed.
- UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm:
(WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree):
- 5:08 PM Changeset in webkit [171497] by
-
- 5 edits in trunk/Source/WebCore
Get rid of SharedBuffer::NSDataRetainPtrWithoutImplicitConversionOperator
https://bugs.webkit.org/show_bug.cgi?id=135219
Reviewed by Anders Carlsson.
No new tests because no functional changes.
- loader/ResourceBuffer.h:
- loader/mac/ResourceBuffer.mm:
(WebCore::ResourceBuffer::createNSData):
- platform/SharedBuffer.h:
(WebCore::SharedBuffer::NSDataRetainPtrWithoutImplicitConversionOperator::NSDataRetainPtrWithoutImplicitConversionOperator): Deleted.
- platform/mac/SharedBufferMac.mm:
(WebCore::SharedBuffer::createNSData):
- 4:20 PM Changeset in webkit [171496] by
-
- 2 edits in trunk/Websites/perf.webkit.org
Build fix after r171361.
- public/js/helper-classes.js:
(.this.formattedBuildTime):
- 4:06 PM Changeset in webkit [171495] by
-
- 18 edits2 adds in branches/ftlopt/Source/JavaScriptCore
[ftlopt] Phantoms in SSA form should be aggressively hoisted
https://bugs.webkit.org/show_bug.cgi?id=135111
Reviewed by Oliver Hunt.
In CPS form, Phantom means three things: (1) that the children should be kept alive so long
as they are relevant to OSR (due to a MovHint), (2) that the children are live-in-bytecode
at the point of the Phantom, and (3) that some checks should be performed. In SSA, the
second meaning is not used but the other two stay.
The fact that a Phantom that is used to keep a node alive could be anywhere in the graph,
even in a totally different basic block, complicates some SSA transformations. It's not
possible to just jettison some successor, since tha successor could have a Phantom that we
care about.
This change rationalizes how Phantoms work so that:
1) Phantoms keep children alive so long as those children are relevant to OSR. This is true
in both CPS and SSA. This was true before and it's true now.
2) Phantoms are used for live-in-bytecode only in CPS. This was true before and it's true
now, except that now we also don't bother preserving the live-in-bytecode information
that Phantoms convey, when we are in SSA.
3) Phantoms may incidentally have checks, but in cases where we only want checks, we now
use Check instead of Phantom. Notably, DCE phase has dead nodes decay to Check, not
Phantom.
The biggest part of this change is that in SSA, we canonicalize Phantoms:
- All Phantoms are replaced with Check nodes that include only those edges that have checks.
- Nodes that were the children of any Phantoms have a Phantom right after them.
For example, the following code:
5: ArithAdd(@1, @2)
6: ArithSub(@5, @3)
7: Phantom(Int32:@5)
would be turned into the following:
5: ArithAdd(@1, @2)
8: Phantom(@5) @5 was the child of a Phantom, so we create a new Phantom right after
@5. This is the only Phantom we will have for @5.
6: ArithSub(@5, @3)
7: Check(Int32:@5) We replace the Phantom with a Check; in this case since Int32: is
a checking edge, we leave it.
This is a slight speed-up across the board, presumably because we now do a better job of
reducing the size of the graph during compilation. It could also be a fluke, though. The
main purpose of this is to unlock some other work (like CFG simplification in SSA). It will
become a requirement to run phantom canonicalization prior to some SSA phases. None of the
current phases need it, but future phases probably will.
- CMakeLists.txt:
- JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
- JavaScriptCore.xcodeproj/project.pbxproj:
- dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
- dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
- dfg/DFGDCEPhase.cpp:
(JSC::DFG::DCEPhase::run):
(JSC::DFG::DCEPhase::findTypeCheckRoot):
(JSC::DFG::DCEPhase::countEdge):
(JSC::DFG::DCEPhase::fixupBlock):
(JSC::DFG::DCEPhase::eliminateIrrelevantPhantomChildren):
- dfg/DFGEdge.cpp:
(JSC::DFG::Edge::dump):
- dfg/DFGEdge.h:
(JSC::DFG::Edge::isProved):
(JSC::DFG::Edge::needsCheck): Deleted.
- dfg/DFGNodeFlags.h:
- dfg/DFGPhantomCanonicalizationPhase.cpp: Added.
(JSC::DFG::PhantomCanonicalizationPhase::PhantomCanonicalizationPhase):
(JSC::DFG::PhantomCanonicalizationPhase::run):
(JSC::DFG::performPhantomCanonicalization):
- dfg/DFGPhantomCanonicalizationPhase.h: Added.
- dfg/DFGPhantomRemovalPhase.cpp:
(JSC::DFG::PhantomRemovalPhase::run):
- dfg/DFGPhantomRemovalPhase.h:
- dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
- ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::lowJSValue):
(JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
- 3:55 PM Changeset in webkit [171494] by
-
- 3 edits in trunk/Source/WebCore
Subpixel rendering: Cleanup RenderLayerCompositor::deviceScaleFactor()
https://bugs.webkit.org/show_bug.cgi?id=135208
Reviewed by Simon Fraser.
Use m_renderView.document() to retrieve device scale factor value. m_renderView.document()
is always available while this->page() is not.
No change in behavior.
- rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::updateTransform):
(WebCore::RenderLayerBacking::computeTransformOriginForPainting):
- rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::deviceScaleFactor):
- 3:03 PM Changeset in webkit [171493] by
-
- 2 edits in trunk/Source/WebKit2
Add a pseudo target to create sandbox override roots
https://bugs.webkit.org/show_bug.cgi?id=135216
<rdar://17785560>
Reviewed by Alexey Proskuryakov.
Just a duplicate of the standard ios sandbox target, targetting
the profile overrides directory. This means we can make roots
that "Just Work".
- WebKit2.xcodeproj/project.pbxproj:
- 2:56 PM Changeset in webkit [171492] by
-
- 2 edits in trunk/Source/WebCore
[WinCairo] Gstreamer rendering is not working.
https://bugs.webkit.org/show_bug.cgi?id=135201
Patch by peavo@outlook.com <peavo@outlook.com> on 2014-07-23
Reviewed by Alex Christensen.
WinCairo does not support accelerated rendering yet.
- platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
(WebCore::MediaPlayerPrivateGStreamerBase::supportsAcceleratedRendering):
- 2:51 PM Changeset in webkit [171491] by
-
- 2 edits in tags/Safari-600.1.2/Source/WebKit2
Merged r171490. <rdar://problem/17739108>
- 2:43 PM Changeset in webkit [171490] by
-
- 2 edits in trunk/Source/WebKit2
Incorrect commit for sandbox profile
https://bugs.webkit.org/show_bug.cgi?id=135214
<rdar://17739108>
Reviewed by Anders Carlsson.
- Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
- 2:16 PM Changeset in webkit [171489] by
-
- 7 edits in trunk
Web Inspector: InspectorBackend's promise-based agent API does not support multiple return values
https://bugs.webkit.org/show_bug.cgi?id=135207
Reviewed by Joseph Pecoraro.
Source/WebInspectorUI:
The promise wrapper implementation assumed that the protocol callback supplies a single 'payload'
return value, but InspectorBackend will actually unpack multiple return values as multiple
callback arguments. Set a special flag so it will not try to apply multiple return values.
It would read better if multiple return values could be spread to the resolve callback, but
multiple argument support are not required by the Promises specification, so we won't use them.
- UserInterface/Controllers/ReplayManager.js: Fix uses of promise return values.
(WebInspector.ReplayManager):
- UserInterface/Models/ReplaySession.js:
- UserInterface/Models/ReplaySessionSegment.js:
(WebInspector.ReplaySessionSegment):
- UserInterface/Protocol/InspectorBackend.js:
(InspectorBackend.Command.prototype.promise):
LayoutTests:
- http/tests/inspector/replay/replay-test.js: fix uses of promise API return values.
- 1:59 PM Changeset in webkit [171488] by
-
- 9 edits2 deletes in trunk
Unreviewed, rolling out r171455.
https://bugs.webkit.org/show_bug.cgi?id=135209
completely broke selection highlight invalidation (Requested
by thorton on #webkit).
Reverted changeset:
"REGRESSION (r169105): Crash in selection"
https://bugs.webkit.org/show_bug.cgi?id=134303
http://trac.webkit.org/changeset/171455
- 1:34 PM Changeset in webkit [171487] by
-
- 2 edits in trunk/Tools
Unreviewed iOS build fix after r171355.
- TestWebKitAPI/Configurations/Base.xcconfig:
Since all the Tests/WebKit2Cocoa tests are already explicitly skipped on iOS,
simplify to skipping all the tests in the directory. PlatformUtilities are not
building on iOS, which means we are missing necessary Util functions.
- 1:19 PM Changeset in webkit [171486] by
-
- 4 edits in trunk/Source/WebCore
Compile window-inactive and fullscreen pseudoclasses in css selectors.
https://bugs.webkit.org/show_bug.cgi?id=135200
Reviewed by Benjamin Poulain.
- css/SelectorChecker.cpp:
(WebCore::SelectorChecker::checkOne):
Removed the check of context.hasSelectionPseudo for a window-inactive pseudoclass.
Moved logic to SelectorCheckerTestFunctions.h to share with the selector compiler.
- css/SelectorCheckerTestFunctions.h:
(WebCore::isWindowInactive):
(WebCore::matchesFullScreenAnimatingFullScreenTransitionPseudoClass):
(WebCore::matchesFullScreenAncestorPseudoClass):
(WebCore::matchesFullScreenDocumentPseudoClass):
Added from SelectorChecker.cpp.
- cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::addPseudoClassType):
Added unoptimized pseudoclass cases for window-inactive and fullscreen pseudoclasses.
Explicitly listed uncompiled pseudoclasses for future work instead of using a default.
- 1:18 PM Changeset in webkit [171485] by
-
- 2 edits in trunk/Source/WebKit2
<rdar://problem/17782623> [iOS] Client-certificate authentication isn’t working with some certificates
https://bugs.webkit.org/show_bug.cgi?id=135206
Reviewed by Anders Carlsson.
- Shared/cf/ArgumentCodersCF.cpp:
(IPC::copyPersistentRef): Added this helper function. It differs from
SecKeyCopyPersistentRef in that if multiple copies of the key exist in the keychain, it
ensures that we get a reference to the copy that is in the keychain access group that the
Networking process can use.
(IPC::encode): Use copyPersistentRef.
- 12:49 PM Changeset in webkit [171484] by
-
- 2 edits in tags/Safari-600.1.2/Source/JavaScriptCore
Merged r171474. <rdar://problem/17041912>
- 11:39 AM Changeset in webkit [171483] by
-
- 2 edits in trunk/Source/JavaScriptCore
Build fix after r171482.
Rubberstamped by Joe Pecoraro.
- runtime/Identifier.h: Make header declarations match
implementation file.
- 11:18 AM Changeset in webkit [171482] by
-
- 8 edits in trunk/Source
../JavaScriptCore: [Win] Use NO_RETURN_DUE_TO_CRASH on Windows
https://bugs.webkit.org/show_bug.cgi?id=135199
Reviewed by Mark Lam.
- jsc.cpp:
(WTF::RuntimeArray::deleteProperty): Stop using ugly
compiler work-around on Windows; use NO_RETURN_DUE_TO_CRASH
codepath instead.
- runtime/Identifier.h: Add NO_RETURN_DUE_TO_CRASH
to header so function declaration matches implementation.
../WebCore: [Win] Use NO_RETURN_DUE_TO_CRASH on Windows.
https://bugs.webkit.org/show_bug.cgi?id=13519
Reviewed by Mark Lam.
- svg/SVGZoomAndPan.h: Add NO_RETURN_DUE_TO_CRASH to
header so function declarations match implementation.
../WTF: [Win] Use NO_RETURN_DUE_TO_CRASH on Windows.
https://bugs.webkit.org/show_bug.cgi?id=13519
Reviewed by Mark Lam.
- wtf/Assertions.h: Add MSVC to list of compilers supporting this macro.
- wtf/FastMalloc.cpp: Correct function declaration for NO_RETURN_DUE_TO_CRASH.
- 10:57 AM Changeset in webkit [171481] by
-
- 3 edits in trunk/Source/WebCore
JSDOMWindowShell leaks on pages with media elements
https://bugs.webkit.org/show_bug.cgi?id=135178
Patch by Joseph Pecoraro <Joseph Pecoraro> on 2014-07-23
Reviewed by Oliver Hunt.
The DOMWindowWorld for HTMLMediaElements with MEDIA_CONTROLS_SCRIPT
was not getting cleared and removed.
- bindings/js/ScriptController.cpp:
(WebCore::ScriptController::clearWindowShell):
Iterate over a copy of the values. A sweep / garbage collection caused by
any JSC allocation during iteration could trigger a mutation of the m_windowShells
table that was being iterating. So instead iterate a list that won't mutate.
- html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::~HTMLMediaElement):
If we had an isolated world, release as much memory as possible.
- 10:56 AM Changeset in webkit [171480] by
-
- 4 edits8 adds in trunk
Ensure we compute the min and max height of replaced elements to 'none' or 0 when appropriate.
https://bugs.webkit.org/show_bug.cgi?id=135181
Reviewed by David Hyatt.
Source/WebCore:
If a replaced element has a percentage min or max height specified then that height value should
compute to 'none' for max-height and 0 for min-height when its containing block
does not have a height 'specified explicitly'.
This is based on a Blink patch by Robert Hogan.
Tests: css2.1/20110323/max-height-percentage-003.html
fast/replaced/max-height-percentage-quirks.html
fast/replaced/min-height-percentage-quirks.html
fast/replaced/min-height-percentage.html
- rendering/RenderBox.cpp:
(WebCore::RenderBox::logicalHeightComputesAsNone):
(WebCore::RenderBox::computeReplacedLogicalHeightRespectingMinMaxHeight):
- rendering/RenderBox.h:
LayoutTests:
- css2.1/20110323/max-height-percentage-003-expected.html: Added.
- css2.1/20110323/max-height-percentage-003.html: Added.
- fast/replaced/max-height-percentage-quirks-expected.html: Added.
- fast/replaced/max-height-percentage-quirks.html: Added.
- fast/replaced/min-height-percentage-expected.html: Added.
- fast/replaced/min-height-percentage-quirks-expected.html: Added.
- fast/replaced/min-height-percentage-quirks.html: Added.
- fast/replaced/min-height-percentage.html: Added.
- 10:35 AM Changeset in webkit [171479] by
-
- 19 edits in trunk
Remove CSS_EXCLUSIONS compile flag and leftover code
https://bugs.webkit.org/show_bug.cgi?id=135175
Reviewed by Zoltan Horvath.
At this point, the CSS_EXCLUSIONS flag guards nothing but some useless
stubs. This removes the flag and the useless code.
.:
- Source/cmake/WebKitFeatures.cmake:
- Source/cmakeconfig.h.cmake:
Source/JavaScriptCore:
- Configurations/FeatureDefines.xcconfig:
Source/WebCore:
No new tests, just removing code.
- Configurations/FeatureDefines.xcconfig:
- bindings/generic/RuntimeEnabledFeatures.cpp:
(WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
- bindings/generic/RuntimeEnabledFeatures.h:
(WebCore::RuntimeEnabledFeatures::setCSSExclusionsEnabled): Deleted.
(WebCore::RuntimeEnabledFeatures::cssExclusionsEnabled): Deleted.
- testing/InternalSettings.cpp:
(WebCore::InternalSettings::Backup::Backup):
(WebCore::InternalSettings::Backup::restoreTo):
(WebCore::InternalSettings::setCSSExclusionsEnabled): Deleted.
- testing/InternalSettings.h:
- testing/InternalSettings.idl:
Source/WebKit/mac:
- Configurations/FeatureDefines.xcconfig:
Source/WebKit2:
- Configurations/FeatureDefines.xcconfig:
WebKitLibraries:
- win/tools/vsprops/FeatureDefines.props:
- win/tools/vsprops/FeatureDefinesCairo.props:
- 9:20 AM Changeset in webkit [171478] by
-
- 2 edits in trunk/Source/WebCore
[MSE][Mac] Support abort() in SourceBufferPrivateAVFObjC.
https://bugs.webkit.org/show_bug.cgi?id=135163
Reviewed by Brent Fulgham.
Recreate the parser when asked to abort().
- platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
(WebCore::SourceBufferPrivateAVFObjC::abort):
- 7:57 AM Changeset in webkit [171477] by
-
- 30 edits in trunk/Source/WebCore
Migrate accessibility/ to using nullptr instead of 0
https://bugs.webkit.org/show_bug.cgi?id=135185
Reviewed by Simon Fraser.
No new tests because there is no behavior change.
- accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::focusedImageMapUIElement):
(WebCore::AXObjectCache::focusedUIElementForPage):
(WebCore::AXObjectCache::get):
(WebCore::AXObjectCache::getOrCreate):
(WebCore::AXObjectCache::rootObject):
(WebCore::AXObjectCache::rootObjectForFrame):
- accessibility/AXObjectCache.h:
(WebCore::AXObjectCache::focusedUIElementForPage):
(WebCore::AXObjectCache::get):
(WebCore::AXObjectCache::getOrCreate):
(WebCore::AXObjectCache::rootObject):
(WebCore::AXObjectCache::rootObjectForFrame):
(WebCore::AXObjectCache::rootAXEditableElement):
- accessibility/AccessibilityARIAGridRow.cpp:
(WebCore::AccessibilityARIAGridRow::disclosedByRow):
- accessibility/AccessibilityImageMapLink.cpp:
(WebCore::AccessibilityImageMapLink::AccessibilityImageMapLink):
(WebCore::AccessibilityImageMapLink::parentObject):
- accessibility/AccessibilityListBox.cpp:
(WebCore::AccessibilityListBox::listBoxOptionAccessibilityObject):
(WebCore::AccessibilityListBox::elementAccessibilityHitTest):
- accessibility/AccessibilityListBoxOption.cpp:
(WebCore::AccessibilityListBoxOption::AccessibilityListBoxOption):
(WebCore::AccessibilityListBoxOption::parentObject):
(WebCore::AccessibilityListBoxOption::listBoxOptionParentNode):
- accessibility/AccessibilityMenuListPopup.cpp:
(WebCore::AccessibilityMenuListPopup::menuListOptionAccessibilityObject):
- accessibility/AccessibilityMockObject.cpp:
(WebCore::AccessibilityMockObject::AccessibilityMockObject):
- accessibility/AccessibilityMockObject.h:
- accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::detach):
(WebCore::AccessibilityNodeObject::firstChild):
(WebCore::AccessibilityNodeObject::lastChild):
(WebCore::AccessibilityNodeObject::previousSibling):
(WebCore::AccessibilityNodeObject::nextSibling):
(WebCore::AccessibilityNodeObject::parentObject):
(WebCore::AccessibilityNodeObject::document):
(WebCore::AccessibilityNodeObject::anchorElement):
(WebCore::nativeActionElement):
(WebCore::AccessibilityNodeObject::actionElement):
(WebCore::AccessibilityNodeObject::mouseButtonListener):
(WebCore::AccessibilityNodeObject::labelForElement):
(WebCore::AccessibilityNodeObject::menuItemElementForMenu):
(WebCore::AccessibilityNodeObject::menuButtonForMenu):
- accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::AccessibilityObject):
(WebCore::AccessibilityObject::detach):
(WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
(WebCore::AccessibilityObject::findMatchingObjects):
(WebCore::renderListItemContainerForNode):
(WebCore::AccessibilityObject::accessibilityObjectForPosition):
(WebCore::AccessibilityObject::document):
(WebCore::AccessibilityObject::page):
(WebCore::AccessibilityObject::documentFrameView):
(WebCore::AccessibilityObject::anchorElementForNode):
(WebCore::AccessibilityObject::headingElementForNode):
(WebCore::AccessibilityObject::firstAnonymousBlockChild):
(WebCore::AccessibilityObject::element):
(WebCore::AccessibilityObject::focusedUIElement):
(WebCore::AccessibilityObject::scrollToMakeVisibleWithSubFocus):
- accessibility/AccessibilityObject.h:
(WebCore::AccessibilityObject::node):
(WebCore::AccessibilityObject::renderer):
(WebCore::AccessibilityObject::selectedRadioButton):
(WebCore::AccessibilityObject::selectedTabItem):
(WebCore::AccessibilityObject::accessibilityHitTest):
(WebCore::AccessibilityObject::firstChild):
(WebCore::AccessibilityObject::lastChild):
(WebCore::AccessibilityObject::previousSibling):
(WebCore::AccessibilityObject::nextSibling):
(WebCore::AccessibilityObject::parentObjectIfExists):
(WebCore::AccessibilityObject::observableObject):
(WebCore::AccessibilityObject::titleUIElement):
(WebCore::AccessibilityObject::correspondingLabelForControlElement):
(WebCore::AccessibilityObject::correspondingControlForLabelElement):
(WebCore::AccessibilityObject::scrollBar):
(WebCore::AccessibilityObject::anchorElement):
(WebCore::AccessibilityObject::actionElement):
(WebCore::AccessibilityObject::widget):
(WebCore::AccessibilityObject::widgetForAttachmentView):
(WebCore::AccessibilityObject::activeDescendant):
(WebCore::AccessibilityObject::mathRadicandObject):
(WebCore::AccessibilityObject::mathRootIndexObject):
(WebCore::AccessibilityObject::mathUnderObject):
(WebCore::AccessibilityObject::mathOverObject):
(WebCore::AccessibilityObject::mathNumeratorObject):
(WebCore::AccessibilityObject::mathDenominatorObject):
(WebCore::AccessibilityObject::mathBaseObject):
(WebCore::AccessibilityObject::mathSubscriptObject):
(WebCore::AccessibilityObject::mathSuperscriptObject):
(WebCore::AccessibilityObject::getScrollableAreaIfScrollable):
- accessibility/AccessibilityProgressIndicator.cpp:
(WebCore::AccessibilityProgressIndicator::progressElement):
(WebCore::AccessibilityProgressIndicator::meterElement):
- accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::detach):
(WebCore::AccessibilityRenderObject::renderBoxModelObject):
(WebCore::AccessibilityRenderObject::firstChild):
(WebCore::AccessibilityRenderObject::lastChild):
(WebCore::startOfContinuations):
(WebCore::childBeforeConsideringContinuations):
(WebCore::AccessibilityRenderObject::previousSibling):
(WebCore::AccessibilityRenderObject::nextSibling):
(WebCore::nextContinuation):
(WebCore::AccessibilityRenderObject::renderParentObject):
(WebCore::AccessibilityRenderObject::parentObject):
(WebCore::AccessibilityRenderObject::anchorElement):
(WebCore::AccessibilityRenderObject::textUnderElement):
(WebCore::AccessibilityRenderObject::node):
(WebCore::AccessibilityRenderObject::labelElementContainer):
(WebCore::AccessibilityRenderObject::internalLinkElement):
(WebCore::AccessibilityRenderObject::titleUIElement):
(WebCore::AccessibilityRenderObject::setFocused):
(WebCore::AccessibilityRenderObject::topRenderer):
(WebCore::AccessibilityRenderObject::document):
(WebCore::AccessibilityRenderObject::widget):
(WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
(WebCore::AccessibilityRenderObject::documentFrameView):
(WebCore::AccessibilityRenderObject::widgetForAttachmentView):
(WebCore::AccessibilityRenderObject::rootEditableElementForPosition):
(WebCore::AccessibilityRenderObject::visiblePositionForPoint):
(WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):
(WebCore::AccessibilityRenderObject::remoteSVGElementHitTest):
(WebCore::AccessibilityRenderObject::accessibilityHitTest):
(WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
(WebCore::AccessibilityRenderObject::correspondingLabelForControlElement):
(WebCore::AccessibilityRenderObject::observableObject):
(WebCore::AccessibilityRenderObject::inheritsPresentationalRole):
(WebCore::AccessibilityRenderObject::detachRemoteSVGRoot):
(WebCore::AccessibilityRenderObject::addHiddenChildren):
(WebCore::AccessibilityRenderObject::setAccessibleName):
(WebCore::AccessibilityRenderObject::getScrollableAreaIfScrollable):
(WebCore::AccessibilityRenderObject::mathRadicandObject):
(WebCore::AccessibilityRenderObject::mathRootIndexObject):
(WebCore::AccessibilityRenderObject::mathNumeratorObject):
(WebCore::AccessibilityRenderObject::mathDenominatorObject):
(WebCore::AccessibilityRenderObject::mathUnderObject):
(WebCore::AccessibilityRenderObject::mathOverObject):
(WebCore::AccessibilityRenderObject::mathBaseObject):
(WebCore::AccessibilityRenderObject::mathSubscriptObject):
(WebCore::AccessibilityRenderObject::mathSuperscriptObject):
- accessibility/AccessibilitySVGRoot.cpp:
(WebCore::AccessibilitySVGRoot::AccessibilitySVGRoot):
- accessibility/AccessibilityScrollView.cpp:
(WebCore::AccessibilityScrollView::detach):
(WebCore::AccessibilityScrollView::scrollBar):
(WebCore::AccessibilityScrollView::updateScrollbars):
(WebCore::AccessibilityScrollView::addChildScrollbar):
(WebCore::AccessibilityScrollView::clearChildren):
(WebCore::AccessibilityScrollView::webAreaObject):
(WebCore::AccessibilityScrollView::accessibilityHitTest):
(WebCore::AccessibilityScrollView::documentFrameView):
(WebCore::AccessibilityScrollView::parentObject):
(WebCore::AccessibilityScrollView::parentObjectIfExists):
- accessibility/AccessibilityScrollbar.cpp:
(WebCore::AccessibilityScrollbar::document):
- accessibility/AccessibilitySpinButton.cpp:
(WebCore::AccessibilitySpinButton::AccessibilitySpinButton):
- accessibility/AccessibilityTable.cpp:
(WebCore::AccessibilityTable::AccessibilityTable):
(WebCore::AccessibilityTable::clearChildren):
(WebCore::AccessibilityTable::cellForColumnAndRow):
- accessibility/AccessibilityTableCell.cpp:
(WebCore::AccessibilityTableCell::parentTable):
(WebCore::AccessibilityTableCell::titleUIElement):
- accessibility/AccessibilityTableColumn.cpp:
(WebCore::AccessibilityTableColumn::headerObject):
(WebCore::AccessibilityTableColumn::headerObjectForSection):
- accessibility/AccessibilityTableRow.cpp:
(WebCore::AccessibilityTableRow::parentTable):
(WebCore::AccessibilityTableRow::headerObject):
- accessibility/ios/AXObjectCacheIOS.mm:
(WebCore::AXObjectCache::detachWrapper):
- accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
(-[WebAccessibilityObjectWrapper detach]):
(-[WebAccessibilityObjectWrapper tableCellParent]):
(-[WebAccessibilityObjectWrapper tableParent]):
(-[WebAccessibilityObjectWrapper convertPointToScreenSpace:]):
(-[WebAccessibilityObjectWrapper convertRectToScreenSpace:]):
(rendererForView):
(-[WebAccessibilityObjectWrapper _convertToDOMRange:]):
- accessibility/mac/AXObjectCacheMac.mm:
(WebCore::AXObjectCache::detachWrapper):
- accessibility/mac/AccessibilityObjectMac.mm:
(WebCore::AccessibilityObject::detachFromParent):
(WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
- accessibility/mac/WebAccessibilityObjectWrapperBase.mm:
(-[WebAccessibilityObjectWrapperBase detach]):
- accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(CreateCGColorIfDifferent):
(-[WebAccessibilityObjectWrapper convertPointToScreenSpace:]):
(rendererForView):
(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
- accessibility/win/AccessibilityObjectWrapperWin.h:
(WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper):
- 5:12 AM Changeset in webkit [171476] by
-
- 3 edits2 adds in trunk
ASSERTION FAILED: generatingElement() in WebCore::RenderNamedFlowFragment::regionOversetState
https://bugs.webkit.org/show_bug.cgi?id=135153
Reviewed by David Hyatt.
Source/WebCore:
Even though the CSSRegions spec defines the behaviour of a multicolumn region,
we currently do not support this functionality. This patch ensures that a multicolumn
element does not become a region. In the future, when we will implement the multicolumn
as region functionality, http://dev.w3.org/csswg/css-regions/#multi-column-regions, we
will remove this restriction.
Test: fast/regions/multicol-as-region-prevented.html
- rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded):
LayoutTests:
- fast/regions/multicol-as-region-prevented-expected.html: Added.
- fast/regions/multicol-as-region-prevented.html: Added.
- 4:30 AM Changeset in webkit [171475] by
-
- 2 edits in trunk/Source/WebCore
[CMake] Avoid building WebCore with ANGLE's OpenGL/EGL headers
https://bugs.webkit.org/show_bug.cgi?id=135167
Reviewed by Martin Robinson.
- CMakeLists.txt: Don't add ANGLE/include to the WebCore_INCLUDE_DIRECTORIES list
as this results in ANGLE's OpenGL and EGL headers being included, instead of the
headers that are provided by the system. Only the ANGLESupport library should be built
with that specific header inclusion path.
- 3:31 AM Changeset in webkit [171474] by
-
- 2 edits in trunk/Source/JavaScriptCore
Unreviewed, rolling out r171367.
https://bugs.webkit.org/show_bug.cgi?id=135192
broke three API tests (Requested by thorton on #webkit).
Reverted changeset:
"JSLock release should only modify the AtomicStringTable if it
modified in acquire"
https://bugs.webkit.org/show_bug.cgi?id=135143
http://trac.webkit.org/changeset/171367
- 3:27 AM Changeset in webkit [171473] by
-
- 5 edits in branches/safari-600.1-branch/Source
Versioning.
- 3:25 AM Changeset in webkit [171472] by
-
- 1 copy in tags/Safari-600.1.2
New Tag.
- 3:24 AM Changeset in webkit [171471] by
-
- 7 edits in trunk/Source/WebKit2
REGRESSION (r171239): Much more time spent taking snapshots during the PLT
https://bugs.webkit.org/show_bug.cgi?id=135177
<rdar://problem/17764847>
Reviewed by Dan Bernstein.
- UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::willChangeCurrentHistoryItemForMainFrame):
(WebKit::WebPageProxy::willChangeCurrentHistoryItem): Deleted.
- UIProcess/WebPageProxy.h:
- UIProcess/WebPageProxy.messages.in:
- WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::willChangeCurrentHistoryItem):
- WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::willChangeCurrentHistoryItemForMainFrame):
(WebKit::WebPage::willChangeCurrentHistoryItem): Deleted.
- WebProcess/WebPage/WebPage.h:
Rename WillChangeCurrentHistoryItem to WillChangeCurrentHistoryItemForMainFrame.
Only send it when the current history item for the main frame changes.
- 2:59 AM Changeset in webkit [171470] by
-
- 2 edits in trunk/Tools
[EFL] Fix build after r171454
https://bugs.webkit.org/show_bug.cgi?id=135191
Reviewed by Csaba Osztrogonác.
- MiniBrowser/efl/CMakeLists.txt: Add path to new EWebKit2.h location .
- 1:47 AM Changeset in webkit [171469] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merged r171384. <rdar://problem/17739108>
- 1:44 AM Changeset in webkit [171468] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit/win
Merged r171403. <rdar://problem/16721055>
- 1:42 AM Changeset in webkit [171467] by
-
- 24 edits in branches/safari-600.1-branch/Source
Merged r171370. <rdar://problem/16721055>
- 1:36 AM Changeset in webkit [171466] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merged r171368. <rdar://problem/17740149>
- 1:32 AM Changeset in webkit [171465] by
-
- 2 edits in branches/safari-600.1-branch/Source/JavaScriptCore
Merged r171367. <rdar://problem/17041912>
- 1:29 AM Changeset in webkit [171464] by
-
- 3 edits in branches/safari-600.1-branch/Source/WebKit2
Merged r171363. <rdar://problem/17755931>
- 1:26 AM Changeset in webkit [171463] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merged r171373. <rdar://problem/17654369>
- 1:23 AM Changeset in webkit [171462] by
-
- 9 edits in branches/safari-600.1-branch/Source/WebKit2
Merged r171356. <rdar://problem/17654369>
- 1:20 AM Changeset in webkit [171461] by
-
- 7 edits1 copy in branches/safari-600.1-branch
Merged r171355. <rdar://problem/17735912>
- 1:10 AM Changeset in webkit [171460] by
-
- 2 edits1 copy in branches/safari-600.1-branch/Source/JavaScriptCore
Merged r171354. <rdar://problem/17763909>
- 1:07 AM Changeset in webkit [171459] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebCore
Merged r171353. <rdar://problem/17770227>
- 1:03 AM Changeset in webkit [171458] by
-
- 3 edits in branches/safari-600.1-branch/Source/WebKit2
Merged r171352. <rdar://problem/17754921>
- 12:58 AM Changeset in webkit [171457] by
-
- 3 edits2 copies in branches/safari-600.1-branch
Merged r171347. <rdar://problem/16826229>
- 12:54 AM Changeset in webkit [171456] by
-
- 11 edits in branches/safari-600.1-branch/Source
Merged r171345. <rdar://problem/17001716>
- 12:52 AM Changeset in webkit [171455] by
-
- 9 edits2 adds in trunk
REGRESSION (r169105): Crash in selection
https://bugs.webkit.org/show_bug.cgi?id=134303
Reviewed by David Hyatt.
Source/WebCore:
When splitting the selection between different subtrees, all subtrees must have their selection cleared before
starting to apply the new selection. Otherwise, when selecting objects in a named flow thread and going up
its containing block chain, we can end up in the view's selection root, which has not yet been updated and so
we get inconsistent data.
To achieve this goal, the selection update was split into a "clear" and an "apply" method. The updateSelectionForSubtrees
method first iterates through all subtrees and performs the "clear" method and then starts all over again
and performs the "apply" method.
Also, the selectionStart/End members in RenderView have been renamed to fix problems caused by the fact that
RenderView inherits SelectionSubtreeRoot, which also has the same selectionStart/End members.
Test: fast/regions/selection/crash-deselect.html
- WebCore.xcodeproj/project.pbxproj:
- rendering/RenderBlock.cpp:
(WebCore::RenderBlock::isSelectionRoot):
- rendering/RenderSelectionInfo.h:
- rendering/RenderView.cpp:
(WebCore::RenderView::RenderView):
(WebCore::RenderView::setSelection): Renamed m_selectionStart/End to m_unsplitSelectionStart/End
(WebCore::RenderView::splitSelectionBetweenSubtrees):
(WebCore::RenderView::updateSelectionForSubtrees): Added, clears and re-applies selection for all selection subtrees.
(WebCore::RenderView::clearSubtreeSelection): Added, clears selection and returns previously selected information.
(WebCore::RenderView::applySubtreeSelection): Added, updates the selection status of all objects inside the selection tree, compares old and new data and repaints accordingly.
(WebCore::RenderView::getSelection): Renamed m_selectionStart/End to m_unsplitSelectionStart/End
(WebCore::RenderView::setSubtreeSelection): Deleted.
- rendering/RenderView.h:
- rendering/SelectionSubtreeRoot.cpp:
(WebCore::SelectionSubtreeRoot::SelectionSubtreeRoot):
- rendering/SelectionSubtreeRoot.h:
(WebCore::SelectionSubtreeRoot::OldSelectionData::OldSelectionData):
LayoutTests:
Added test for the crash that occurred in some cases when selecting.
- fast/regions/selection/crash-deselect-expected.txt: Added.
- fast/regions/selection/crash-deselect.html: Added.
- 12:21 AM Changeset in webkit [171454] by
-
- 2 edits1 move in trunk/Source/WebKit2
[EFL] EWebKit2.h should contain version information
https://bugs.webkit.org/show_bug.cgi?id=135189
Reviewed by Gyuyoung Kim.
Generate EWebKit2.h to contain the version information.
- PlatformEfl.cmake:
- UIProcess/API/efl/EWebKit2.h.in: Renamed from Source/WebKit2/UIProcess/API/efl/EWebKit2.h.
- 12:19 AM Changeset in webkit [171453] by
-
- 8 edits in trunk
[EFL] Do not generate forwarding header for ewk headers
https://bugs.webkit.org/show_bug.cgi?id=135147
Reviewed by Gyuyoung Kim.
Source/WebKit2:
Only EWebKit2.h and ewk_text_checker.h are generated as forwarding header.
This is unnecessary.
- UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestBase.h:
- UIProcess/API/efl/tests/test_ewk2_application_cache_manager.cpp:
- UIProcess/API/efl/tests/test_ewk2_context_menu.cpp:
- UIProcess/API/efl/tests/test_ewk2_window_features.cpp:
- UIProcess/efl/TextCheckerClientEfl.h:
Tools:
- WebKitTestRunner/EventSenderProxy.h:
- 12:16 AM Changeset in webkit [171452] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit/mac
Merge r171338
- 12:14 AM Changeset in webkit [171451] by
-
- 13 edits in branches/safari-600.1-branch/Source
Merge r171336
- 12:12 AM Changeset in webkit [171450] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebCore
Merge r171332
- 12:10 AM Changeset in webkit [171449] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171329
- 12:08 AM Changeset in webkit [171448] by
-
- 4 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171326
- 12:08 AM Changeset in webkit [171447] by
-
- 3 edits in trunk/Source/JavaScriptCore
[EFL] Build fix after the [ftlopt] branch merge.
Reviewed by Csaba Osztrogonác.
- dfg/DFGBranchDirection.h:
(JSC::DFG::branchDirectionToString):
- dfg/DFGStructureClobberState.h:
(JSC::DFG::merge):
- 12:06 AM Changeset in webkit [171446] by
-
- 5 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171322
- 12:03 AM Changeset in webkit [171445] by
-
- 8 edits in branches/safari-600.1-branch/Source
Merge r171321
Jul 22, 2014:
- 11:59 PM Changeset in webkit [171444] by
-
- 11 edits in branches/safari-600.1-branch/Source
Merge r171320
- 11:56 PM Changeset in webkit [171443] by
-
- 6 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171317
- 11:54 PM Changeset in webkit [171442] by
-
- 5 edits2 copies in branches/safari-600.1-branch
Merge r171316
- 11:51 PM Changeset in webkit [171441] by
-
- 6 edits in branches/safari-600.1-branch/Source
Merge r171314
- 11:49 PM Changeset in webkit [171440] by
-
- 7 edits1 copy in branches/safari-600.1-branch/Source/WebInspectorUI
Merge r171312
- 11:46 PM Changeset in webkit [171439] by
-
- 7 edits in branches/safari-600.1-branch/Source
Merge r171308
- 11:43 PM Changeset in webkit [171438] by
-
- 3 edits in branches/safari-600.1-branch/Source/WebCore
Merge r171306
- 11:39 PM Changeset in webkit [171437] by
-
- 2 edits in branches/safari-600.1-branch/WebKitLibraries
Merge r171305
- 11:37 PM Changeset in webkit [171436] by
-
- 5 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171303
- 11:35 PM Changeset in webkit [171435] by
-
- 4 edits in branches/safari-600.1-branch/Source/WebCore
Merge r171299
- 11:33 PM Changeset in webkit [171434] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebCore
Merge r171289
- 11:31 PM Changeset in webkit [171433] by
-
- 17 edits in branches/safari-600.1-branch/Source
Merge r171288
- 11:29 PM Changeset in webkit [171432] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebCore
Merge r171287
- 11:27 PM Changeset in webkit [171431] by
-
- 10 edits in branches/safari-600.1-branch/Source
Merge r171286
- 11:24 PM Changeset in webkit [171430] by
-
- 4 edits1 copy in branches/safari-600.1-branch
Merge r171284
- 11:24 PM Changeset in webkit [171429] by
-
- 2 edits in trunk/LayoutTests
This test is slow so we shouldn't run it in the slower variants (like ftl-eager/dfg-eager).
- js/regress/script-tests/getter-richards.js:
- 11:22 PM Changeset in webkit [171428] by
-
- 4 edits in branches/safari-600.1-branch/Source/WebCore
Merge r171283
- 11:20 PM Changeset in webkit [171427] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171280
- 11:18 PM Changeset in webkit [171426] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171257
- 11:16 PM Changeset in webkit [171425] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171256
- 11:14 PM Changeset in webkit [171424] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171253
- 11:12 PM Changeset in webkit [171423] by
-
- 25 edits in branches/safari-600.1-branch/Source
Merge r171252
- 11:09 PM Changeset in webkit [171422] by
-
- 5 edits3 copies in branches/safari-600.1-branch
Merge r171250
- 11:05 PM Changeset in webkit [171421] by
-
- 3 edits in branches/safari-600.1-branch/Source/WebCore
Merged r171246
- 11:02 PM Changeset in webkit [171420] by
-
- 7 edits in trunk/Source/WebKit2
Unreviewed, rolling out r171366.
https://bugs.webkit.org/show_bug.cgi?id=135190
Broke three API tests (Requested by ap on #webkit).
Reverted changeset:
"REGRESSION (r171239): Much more time spent taking snapshots
during the PLT"
https://bugs.webkit.org/show_bug.cgi?id=135177
http://trac.webkit.org/changeset/171366
- 11:02 PM Changeset in webkit [171419] by
-
- 15 edits in branches/safari-600.1-branch/Source
Merge r171239
- 10:59 PM Changeset in webkit [171418] by
-
- 4 edits in branches/safari-600.1-branch
Merge r171228
- 10:56 PM Changeset in webkit [171417] by
-
- 3 edits in branches/safari-600.1-branch/Source/WebInspectorUI
Merge r171227
- 10:53 PM Changeset in webkit [171416] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171225
- 10:52 PM Changeset in webkit [171415] by
-
- 6 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171219
- 10:50 PM Changeset in webkit [171414] by
-
- 2 edits in branches/safari-600.1-branch/Tools
Merge r171217
- 10:48 PM Changeset in webkit [171413] by
-
- 3 edits in branches/safari-600.1-branch/Tools
Merge r171216
- 10:46 PM Changeset in webkit [171412] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebCore
Merge r171215
- 10:44 PM Changeset in webkit [171411] by
-
- 18 edits3 copies in branches/safari-600.1-branch
Merge r171213
- 10:41 PM Changeset in webkit [171410] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171211
- 10:39 PM Changeset in webkit [171409] by
-
- 6 edits in branches/safari-600.1-branch
Merge r171167
- 10:33 PM Changeset in webkit [171408] by
-
- 4 edits2 copies in branches/safari-600.1-branch
Merge r171210
- 10:31 PM Changeset in webkit [171407] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171197
- 10:28 PM Changeset in webkit [171406] by
-
- 2 edits in branches/safari-600.1-branch/Source/JavaScriptCore
Merge r171204
- 10:27 PM Changeset in webkit [171405] by
-
- 27 edits1 copy1 delete in branches/safari-600.1-branch
Merge r171195
- 10:18 PM Changeset in webkit [171404] by
-
- 2 edits in trunk/Source/WebCore
[Win] Build fix for bot.
- platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
(WebCore::createLegibleOutputSubtypes): Declare 'wvtt' locally, rather
than relying on potentially unavailable declaration.
- 10:16 PM Changeset in webkit [171403] by
-
- 2 edits in trunk/Source/WebKit/win
[Win] Build fix after r171370.
- WebCoreSupport/WebEditorClient.h: Add override
for new 'overflowScrollPositionChanged'.
- 10:15 PM Changeset in webkit [171402] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171194
- 10:13 PM Changeset in webkit [171401] by
-
- 9 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171191
- 10:11 PM Changeset in webkit [171400] by
-
- 3 edits2 copies in branches/safari-600.1-branch/Source/JavaScriptCore
Merge r171190
- 10:09 PM Changeset in webkit [171399] by
-
- 3 edits in branches/safari-600.1-branch/Tools
Merge r171199
- 10:07 PM Changeset in webkit [171398] by
-
- 6 edits1 copy in branches/safari-600.1-branch/Source/WebCore
Merge r171188
- 10:05 PM Changeset in webkit [171397] by
-
- 7 edits in branches/safari-600.1-branch
Merge r171184
- 9:58 PM Changeset in webkit [171396] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebKit2
Merge r171365
- 9:58 PM Changeset in webkit [171395] by
-
- 2 edits in trunk/Source/JavaScriptCore
Build fix for non-clang compile.
- jsc.cpp:
(WTF::RuntimeArray::put): Remove incorrect return statement
I added.
- 9:54 PM Changeset in webkit [171394] by
-
- 2 edits in branches/safari-600.1-branch/Source/WebCore
Merge r171376
- 9:53 PM Changeset in webkit [171393] by
-
- 2 edits in trunk/Source/JavaScriptCore
Build fix for non-clang compile.
- jsc.cpp:
(WTF::RuntimeArray::deleteProperty): Need (fake) return
value when NO_RETURN_DUE_TO_CRASH is not defined.
- 9:40 PM Changeset in webkit [171392] by
-
- 2 edits in trunk/Source/WebCore
[Win] Build fix for Windows bots
- platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp: Provide missing
structure definition when needed by bot.
- 9:33 PM Changeset in webkit [171391] by
-
- 29 edits4 adds1 delete in trunk/Source/JavaScriptCore
Merge r169628 from ftlopt.
2014-06-04 Matthew Mirman <mmirman@apple.com>
Added system for inlining native functions via the FTL.
https://bugs.webkit.org/show_bug.cgi?id=131515
Reviewed by Filip Pizlo.
Also fixed the build to not compress the bitcode and to
include all of the relevant runtime. With GCC_GENERATE_DEBUGGING_SYMBOLS = NO,
the produced bitcode files are a 100th the size they were before.
Now we can include all of the relevant runtime files with only a 3mb overhead.
This is the same overhead as for two compressed files before,
but done more efficiently (on both ends) and with less code.
Deciding whether to inline native functions is left up to LLVM.
The entire module containing the function is linked into the current
compiled JS so that inlining the native functions shouldn't make them smaller.
Rather than loading Runtime.symtbl at runtime FTLState.cpp now generates a file
InlineRuntimeSymbolTable.h which statically builds the symbol table hash table.
- JavaScriptCore.xcodeproj/project.pbxproj: Added back runtime files to compile.
- build-symbol-table-index.py: Changed bitcode suffix. Added inclusion of only tested symbols. Added output to InlineRuntimeSymbolTable.h.
- build-symbol-table-index.sh: Changed bitcode suffix.
- copy-llvm-ir-to-derived-sources.sh: Removed gzip compression.
- tested-symbols.symlst: Added.
- dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleCall): Now sets the knownFunction of the call node if such a function exists and emits a check that during runtime the callee is in fact known.
- dfg/DFGNode.h: Added functions to set the known function of a call node. (JSC::DFG::Node::canBeKnownFunction): Added. (JSC::DFG::Node::hasKnownFunction): Added. (JSC::DFG::Node::knownFunction): Added. (JSC::DFG::Node::giveKnownFunction): Added.
- ftl/FTLAbbreviatedTypes.h: Added a typedef for LLVMMemoryBufferRef
- ftl/FTLAbbreviations.h: Added some abbreviations.
- ftl/FTLLowerDFGToLLVM.cpp: (JSC::FTL::LowerDFGToLLVM::isInlinableSize): Added. Hardcoded threshold to 275. (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol): Added. (JSC::FTL::LowerDFGToLLVM::getFunctionBySymbol): Added. (JSC::FTL::LowerDFGToLLVM::possiblyCompileInlineableNativeCall): Added. (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct): Added call to possiblyCompileInlineableNativeCall
- ftl/FTLOutput.h: (JSC::FTL::Output::allocaName): Added. Useful for debugging.
- ftl/FTLState.cpp: (JSC::FTL::State::State): Added an include for InlineRuntimeSymbolTable.h
- ftl/FTLState.h: Added symbol table hash table.
- ftl/FTLCompile.cpp: (JSC::FTL::compile): Added inlining and dead function elimination passes.
- heap/HandleStack.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
- llvm/InitializeLLVMMac.mm: Deleted.
- llvm/InitializeLLVMMac.cpp: Added.
- llvm/LLVMAPIFunctions.h: Added macros to include Bitcode parsing and linking functions.
- llvm/LLVMHeaders.h: Added includes for Bitcode parsing and linking.
- runtime/BundlePath.h: Added.
- runtime/BundlePath.mm: Added.
- runtime/DateInstance.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
- runtime/DateInstance.h: ditto.
- runtime/DateConversion.h: ditto.
- runtime/ExceptionHelpers.h: ditto.
- runtime/JSCJSValue.h: ditto.
- runtime/JSArray.h: ditto.
- runtime/JSDateMath.h: ditto.
- runtime/JSObject.h: ditto.
- runtime/JSObject.h: ditto.
- runtime/RegExp.h: ditto.
- runtime/Structure.h: ditto.
- runtime/Options.h: Added maximumLLVMInstructionCountForNativeInlining.
- 9:18 PM Changeset in webkit [171390] by
-
- 3 edits2 adds in trunk/Source/JavaScriptCore
Array.concat() should work on runtime arrays too.
<https://webkit.org/b/135179>
Reviewed by Geoffrey Garen.
- jsc.cpp:
(WTF::RuntimeArray::create):
(WTF::RuntimeArray::~RuntimeArray):
(WTF::RuntimeArray::destroy):
(WTF::RuntimeArray::getOwnPropertySlot):
(WTF::RuntimeArray::getOwnPropertySlotByIndex):
(WTF::RuntimeArray::put):
(WTF::RuntimeArray::deleteProperty):
(WTF::RuntimeArray::getLength):
(WTF::RuntimeArray::createPrototype):
(WTF::RuntimeArray::createStructure):
(WTF::RuntimeArray::finishCreation):
(WTF::RuntimeArray::RuntimeArray):
(WTF::RuntimeArray::lengthGetter):
(GlobalObject::finishCreation):
(functionCreateRuntimeArray):
- Added support to create a runtime array for testing purpose.
- runtime/ArrayPrototype.cpp:
(JSC::getLength):
- Added fast case for when the array object is a JSArray.
(JSC::arrayProtoFuncJoin):
- Added a needed but missing exception check.
(JSC::arrayProtoFuncConcat):
- Use getLength() to compute the array length instead of assuming that the array is a JSArray instance.
- tests/stress/regexp-matches-array.js: Added.
(testArrayConcat):
- tests/stress/runtime-array.js: Added.
(testArrayConcat):
- 9:04 PM Changeset in webkit [171389] by
-
- 23 edits in branches/ftlopt/Source/JavaScriptCore
[ftlopt] Get rid of structure checks as a way of checking if a function is in fact a function
https://bugs.webkit.org/show_bug.cgi?id=135146
Reviewed by Oliver Hunt.
This greatly simplifies our closure call optimizations by taking advantage of the type
bits available in the cell header.
- bytecode/CallLinkInfo.cpp:
(JSC::CallLinkInfo::visitWeak):
- bytecode/CallLinkStatus.cpp:
(JSC::CallLinkStatus::CallLinkStatus):
(JSC::CallLinkStatus::computeFor):
(JSC::CallLinkStatus::dump):
- bytecode/CallLinkStatus.h:
(JSC::CallLinkStatus::CallLinkStatus):
(JSC::CallLinkStatus::executable):
(JSC::CallLinkStatus::structure): Deleted.
- dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::emitFunctionChecks):
- dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
- dfg/DFGSafeToExecute.h:
(JSC::DFG::SafeToExecuteEdge::operator()):
- dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArray):
(JSC::DFG::SpeculativeJIT::speculateCellTypeWithoutTypeFiltering):
(JSC::DFG::SpeculativeJIT::speculateCellType):
(JSC::DFG::SpeculativeJIT::speculateFunction):
(JSC::DFG::SpeculativeJIT::speculateFinalObject):
(JSC::DFG::SpeculativeJIT::speculate):
- dfg/DFGSpeculativeJIT.h:
- dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
- dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
- dfg/DFGUseKind.cpp:
(WTF::printInternal):
- dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor):
(JSC::DFG::isCell):
- ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
- ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileCheckExecutable):
(JSC::FTL::LowerDFGToLLVM::speculate):
(JSC::FTL::LowerDFGToLLVM::isFunction):
(JSC::FTL::LowerDFGToLLVM::isNotFunction):
(JSC::FTL::LowerDFGToLLVM::speculateFunction):
- jit/ClosureCallStubRoutine.cpp:
(JSC::ClosureCallStubRoutine::ClosureCallStubRoutine):
(JSC::ClosureCallStubRoutine::markRequiredObjectsInternal):
- jit/ClosureCallStubRoutine.h:
(JSC::ClosureCallStubRoutine::structure): Deleted.
- jit/JIT.h:
(JSC::JIT::compileClosureCall): Deleted.
- jit/JITCall.cpp:
(JSC::JIT::privateCompileClosureCall): Deleted.
- jit/JITCall32_64.cpp:
(JSC::JIT::privateCompileClosureCall): Deleted.
- jit/JITOperations.cpp:
- jit/Repatch.cpp:
(JSC::linkClosureCall):
- jit/Repatch.h:
- 8:52 PM Changeset in webkit [171388] by
-
- 2 edits in trunk/Source/WebCore
[Win] Build fix for EWS bots.
- platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp: Forward declare
structure definition.
- 8:39 PM Changeset in webkit [171387] by
-
- 2 edits in trunk/Source/JavaScriptCore
Fix Windows (return a value!)
- jsc.cpp:
(functionQuit): Satisfy compiler's need for
a return value.
- 8:29 PM Changeset in webkit [171386] by
-
- 2 edits in trunk/Source/JavaScriptCore
Fix Windows (sleep -> Sleep)
- jsc.cpp:
(WTF::jscExit):
- 8:19 PM Changeset in webkit [171385] by
-
- 3 edits in trunk/Source/WebCore
[Win] Fix Crash when handling Legible Output callbacks
https://bugs.webkit.org/show_bug.cgi?id=134946
Reviewed by Dean Jackson.
Relanding after adding fixes to support build bots.
- platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
(WebCore::InbandTextTrackPrivateAVF::processNativeSamples): Remove
Windows-specific 'ASSERT_NOT_REACHED' code path.
- platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
(WebCore::createLegibleOutputSubtypes): Added.
(WebCore::AVFWrapper::createPlayerItem): Updated to request native
samples from AVFoundationCF.
- 7:37 PM Changeset in webkit [171384] by
-
- 2 edits in trunk/Source/WebKit2
Reduce the size of the root WebContent sandbox profile
https://bugs.webkit.org/show_bug.cgi?id=135182
<rdar://problem/17739108>
Reviewed by Alexey Proskuryakov.
Switch from apple-ui-app to uikit-app as the root of the webcontent
profile.
- Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
- 7:19 PM Changeset in webkit [171383] by
-
- 4 edits2 adds in trunk
Copying and pasting trivial H2 content causes a crash in firstPositionInNode
https://bugs.webkit.org/show_bug.cgi?id=134897
Reviewed by Ryosuke Niwa.
Source/WebCore:
ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder() attempts
to move pasted headings out of existed headings, with out regard to if the existing
heading is the contenteditable root.
Test: editing/pasteboard/heading-crash.html
- editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::makeInsertedContentRoundTrippableWithHTMLTreeBuilder):
LayoutTests:
Copy and paste text from one heading to another. Make sure there is no crash.
- editing/pasteboard/heading-crash-expected.txt: Added.
- editing/pasteboard/heading-crash.html: Added.
- 7:19 PM Changeset in webkit [171382] by
-
- 2 edits in trunk/Source/JavaScriptCore
Fix Windows.
- jsc.cpp:
(WTF::jscExit):
- 6:43 PM Changeset in webkit [171381] by
-
- 2 edits in trunk/Source/JavaScriptCore
Fix 32-bit.
- dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
- 6:19 PM Changeset in webkit [171380] by
-
- 57 edits42 adds in trunk
Merge r169148, r169185, r169188, r169578, r169582, r169584, r169588, r169753 from ftlopt.
Source/JavaScriptCore:
Note that r169753 is merged out of order because it fixes a bug in r169588.
2014-06-10 Filip Pizlo <fpizlo@apple.com>
[ftlopt] Structure::dfgShouldWatchIfPossible() is unsound
https://bugs.webkit.org/show_bug.cgi?id=133624
Reviewed by Mark Hahnenberg.
- runtime/Structure.h: (JSC::Structure::dfgShouldWatchIfPossible): Make it sound and add some verbiage.
2014-06-04 Filip Pizlo <fpizlo@apple.com>
[ftlopt] AI should be able track structure sets larger than 1
https://bugs.webkit.org/show_bug.cgi?id=128073
Reviewed by Oliver Hunt.
This makes two major changes to how AI (abstract interpreter) proves that a value has
some structure:
- StructureAbstractValue can now track an arbitrary number of structures. A set whose size is greater than one means that the value may have any of the structures, and we don't know which - but we do know that it cannot be any structure not in the set. The structure abstract value can still be TOP, which means the set of all structures. We artificially limit the set size to StructureAbstractValue::polymorphismLimit to guard memory explosion on pathological programs. This limit is big enough that it wouldn't kick in for normal code, since we have other heuristics that limit the number of structures that we would allow an inline cache to know about.
- We eagerly set watchpoints on all watchable structures and then we assume that watchable structures are being watched, and that the watchpoint will jettison the code. This allows tracking of watchable structures to be far simpler than before. Previously, a structure being tracked as "future possible" was predicated on it being watchable but we might not actually watch it. This makes algebra over sets of future possible structures quite weird. But watching all watchable structures means that we simple say that a structure set can be in the following states: unclobbered, which means it's just a set of structures and it doesn't matter what is watchable or what isn't because we've proven that the value must have one of these structures right now; and clobbered, which means that we have a set of structures, plus all possible structures temporarily, with invalidation removing the "plus all possible structures". Clobbering a set means that if any of its structures are unwatchable, the set just becomes TOP; but if all structures in the set are watchable then we just set the clobbered bit to add the "plus all possible structures temporarily" thing. This precisely tracks the exact meaning of watchability and invalidation points.
Slight SunSpider slow-down, neutral on Octane, slight AsmBench speed-up. I believe that
we will ultimately undo the SunSpider slow-down by making further improvements to the set
representation. I believe that Octane perfromance will ultimately improve once we remove
remaining singleton special-cases. The ultimate goal of this is to remove the need to
try quite so desperately hard to make everything monomorphic as we do currently.
- CMakeLists.txt:
- JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
- JavaScriptCore.xcodeproj/project.pbxproj:
- bytecode/StructureSet.cpp: (JSC::StructureSet::clear): (JSC::StructureSet::remove): (JSC::StructureSet::filter): (JSC::StructureSet::copyFromOutOfLine): (JSC::StructureSet::StructureSet): Deleted. (JSC::StructureSet::operator=): Deleted. (JSC::StructureSet::copyFrom): Deleted.
- bytecode/StructureSet.h: (JSC::StructureSet::StructureSet): (JSC::StructureSet::operator=): (JSC::StructureSet::isEmpty): (JSC::StructureSet::genericFilter): (JSC::StructureSet::ContainsOutOfLine::ContainsOutOfLine): (JSC::StructureSet::ContainsOutOfLine::operator()): (JSC::StructureSet::copyFrom): (JSC::StructureSet::deleteStructureListIfNecessary): (JSC::StructureSet::setEmpty): (JSC::StructureSet::getReservedFlag): (JSC::StructureSet::setReservedFlag):
- dfg/DFGAbstractInterpreter.h: (JSC::DFG::AbstractInterpreter::setBuiltInConstant):
- dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::booleanResult): (JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge): (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberCapturedVars): (JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues): (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberStructures): (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition): (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions): (JSC::DFG::AbstractInterpreter<AbstractStateType>::setDidClobber): (JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):
- dfg/DFGAbstractValue.cpp: (JSC::DFG::AbstractValue::observeTransitions): (JSC::DFG::AbstractValue::setMostSpecific): (JSC::DFG::AbstractValue::set): (JSC::DFG::AbstractValue::filter): (JSC::DFG::AbstractValue::shouldBeClear): (JSC::DFG::AbstractValue::normalizeClarity): (JSC::DFG::AbstractValue::checkConsistency): (JSC::DFG::AbstractValue::assertIsWatched): (JSC::DFG::AbstractValue::dumpInContext): (JSC::DFG::AbstractValue::setFuturePossibleStructure): Deleted.
- dfg/DFGAbstractValue.h: (JSC::DFG::AbstractValue::clear): (JSC::DFG::AbstractValue::clobberStructures): (JSC::DFG::AbstractValue::clobberStructuresFor): (JSC::DFG::AbstractValue::observeInvalidationPoint): (JSC::DFG::AbstractValue::observeInvalidationPointFor): (JSC::DFG::AbstractValue::observeTransition): (JSC::DFG::AbstractValue::TransitionObserver::TransitionObserver): (JSC::DFG::AbstractValue::TransitionObserver::operator()): (JSC::DFG::AbstractValue::TransitionsObserver::TransitionsObserver): (JSC::DFG::AbstractValue::TransitionsObserver::operator()): (JSC::DFG::AbstractValue::isHeapTop): (JSC::DFG::AbstractValue::setType): (JSC::DFG::AbstractValue::operator==): (JSC::DFG::AbstractValue::merge): (JSC::DFG::AbstractValue::validate): (JSC::DFG::AbstractValue::hasClobberableState): (JSC::DFG::AbstractValue::assertIsWatched): (JSC::DFG::AbstractValue::observeIndexingTypeTransition): (JSC::DFG::AbstractValue::makeTop): (JSC::DFG::AbstractValue::bestProvenStructure): Deleted.
- dfg/DFGAllocator.h:
- dfg/DFGArgumentsSimplificationPhase.cpp: (JSC::DFG::ArgumentsSimplificationPhase::run):
- dfg/DFGArrayMode.cpp: (JSC::DFG::ArrayMode::alreadyChecked):
- dfg/DFGAtTailAbstractState.h: (JSC::DFG::AtTailAbstractState::structureClobberState): (JSC::DFG::AtTailAbstractState::setStructureClobberState): (JSC::DFG::AtTailAbstractState::setFoundConstants): (JSC::DFG::AtTailAbstractState::haveStructures): Deleted. (JSC::DFG::AtTailAbstractState::setHaveStructures): Deleted.
- dfg/DFGBasicBlock.cpp: (JSC::DFG::BasicBlock::BasicBlock):
- dfg/DFGBasicBlock.h:
- dfg/DFGBranchDirection.h: (JSC::DFG::branchDirectionToString): (WTF::printInternal):
- dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handlePutById):
- dfg/DFGCFAPhase.cpp: (JSC::DFG::CFAPhase::performBlockCFA):
- dfg/DFGCSEPhase.cpp: (JSC::DFG::CSEPhase::checkStructureElimination): (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): (JSC::DFG::CSEPhase::performNodeCSE):
- dfg/DFGClobberize.h: (JSC::DFG::clobberize):
- dfg/DFGCommon.cpp: (JSC::DFG::startCrashing): (JSC::DFG::isCrashing):
- dfg/DFGCommon.h:
- dfg/DFGCommonData.cpp: (JSC::DFG::CommonData::notifyCompilingStructureTransition):
- dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): (JSC::DFG::ConstantFoldingPhase::emitGetByOffset): (JSC::DFG::ConstantFoldingPhase::emitPutByOffset): (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
- dfg/DFGDesiredWatchpoints.cpp: (JSC::DFG::DesiredWatchpoints::consider): (JSC::DFG::DesiredWatchpoints::addLazily): Deleted.
- dfg/DFGDesiredWatchpoints.h: (JSC::DFG::GenericDesiredWatchpoints::reallyAdd): (JSC::DFG::GenericDesiredWatchpoints::areStillValid): (JSC::DFG::GenericDesiredWatchpoints::isWatched): (JSC::DFG::DesiredWatchpoints::isWatched): (JSC::DFG::WatchpointForGenericWatchpointSet::WatchpointForGenericWatchpointSet): Deleted. (JSC::DFG::GenericDesiredWatchpoints::addLazily): Deleted. (JSC::DFG::GenericDesiredWatchpoints::isStillValid): Deleted. (JSC::DFG::GenericDesiredWatchpoints::shouldAssumeMixedState): Deleted. (JSC::DFG::GenericDesiredWatchpoints::isValidOrMixed): Deleted. (JSC::DFG::DesiredWatchpoints::isStillValid): Deleted. (JSC::DFG::DesiredWatchpoints::shouldAssumeMixedState): Deleted. (JSC::DFG::DesiredWatchpoints::isValidOrMixed): Deleted.
- dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC):
- dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess): (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
- dfg/DFGGraph.cpp: (JSC::DFG::Graph::~Graph): (JSC::DFG::Graph::dump): (JSC::DFG::Graph::dumpBlockHeader): (JSC::DFG::Graph::tryGetFoldableView): (JSC::DFG::Graph::visitChildren): (JSC::DFG::Graph::assertIsWatched): (JSC::DFG::Graph::handleAssertionFailure):
- dfg/DFGGraph.h: (JSC::DFG::Graph::convertToConstant): (JSC::DFG::Graph::masqueradesAsUndefinedWatchpointIsStillValid): (JSC::DFG::Graph::addStructureTransitionData): Deleted.
- dfg/DFGInPlaceAbstractState.cpp: (JSC::DFG::InPlaceAbstractState::beginBasicBlock): (JSC::DFG::InPlaceAbstractState::initialize): (JSC::DFG::InPlaceAbstractState::endBasicBlock): (JSC::DFG::InPlaceAbstractState::reset): (JSC::DFG::InPlaceAbstractState::merge):
- dfg/DFGInPlaceAbstractState.h: (JSC::DFG::InPlaceAbstractState::structureClobberState): (JSC::DFG::InPlaceAbstractState::setStructureClobberState): (JSC::DFG::InPlaceAbstractState::setFoundConstants): (JSC::DFG::InPlaceAbstractState::haveStructures): Deleted. (JSC::DFG::InPlaceAbstractState::setHaveStructures): Deleted.
- dfg/DFGLivenessAnalysisPhase.cpp: (JSC::DFG::LivenessAnalysisPhase::run):
- dfg/DFGNode.h: (JSC::DFG::Node::hasTransition): (JSC::DFG::Node::transition): (JSC::DFG::Node::hasStructure): (JSC::DFG::StructureTransitionData::StructureTransitionData): Deleted. (JSC::DFG::Node::convertToStructureTransitionWatchpoint): Deleted. (JSC::DFG::Node::hasStructureTransitionData): Deleted. (JSC::DFG::Node::structureTransitionData): Deleted.
- dfg/DFGNodeType.h:
- dfg/DFGPlan.cpp: (JSC::DFG::Plan::compileInThreadImpl):
- dfg/DFGPredictionPropagationPhase.cpp: (JSC::DFG::PredictionPropagationPhase::propagate):
- dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute):
- dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage): (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
- dfg/DFGSpeculativeJIT.h: (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
- dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile):
- dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile):
- dfg/DFGStructureAbstractValue.cpp: Added. (JSC::DFG::StructureAbstractValue::assertIsWatched): (JSC::DFG::StructureAbstractValue::clobber): (JSC::DFG::StructureAbstractValue::observeTransition): (JSC::DFG::StructureAbstractValue::observeTransitions): (JSC::DFG::StructureAbstractValue::add): (JSC::DFG::StructureAbstractValue::merge): (JSC::DFG::StructureAbstractValue::mergeSlow): (JSC::DFG::StructureAbstractValue::mergeNotTop): (JSC::DFG::StructureAbstractValue::filter): (JSC::DFG::StructureAbstractValue::filterSlow): (JSC::DFG::StructureAbstractValue::contains): (JSC::DFG::StructureAbstractValue::isSubsetOf): (JSC::DFG::StructureAbstractValue::isSupersetOf): (JSC::DFG::StructureAbstractValue::overlaps): (JSC::DFG::StructureAbstractValue::equalsSlow): (JSC::DFG::StructureAbstractValue::dumpInContext): (JSC::DFG::StructureAbstractValue::dump):
- dfg/DFGStructureAbstractValue.h: (JSC::DFG::StructureAbstractValue::StructureAbstractValue): (JSC::DFG::StructureAbstractValue::operator=): (JSC::DFG::StructureAbstractValue::clear): (JSC::DFG::StructureAbstractValue::makeTop): (JSC::DFG::StructureAbstractValue::assertIsWatched): (JSC::DFG::StructureAbstractValue::observeInvalidationPoint): (JSC::DFG::StructureAbstractValue::top): (JSC::DFG::StructureAbstractValue::isClear): (JSC::DFG::StructureAbstractValue::isTop): (JSC::DFG::StructureAbstractValue::isNeitherClearNorTop): (JSC::DFG::StructureAbstractValue::isClobbered): (JSC::DFG::StructureAbstractValue::merge): (JSC::DFG::StructureAbstractValue::filter): (JSC::DFG::StructureAbstractValue::operator==): (JSC::DFG::StructureAbstractValue::size): (JSC::DFG::StructureAbstractValue::at): (JSC::DFG::StructureAbstractValue::operator[]): (JSC::DFG::StructureAbstractValue::onlyStructure): (JSC::DFG::StructureAbstractValue::isSupersetOf): (JSC::DFG::StructureAbstractValue::makeTopWhenThin): (JSC::DFG::StructureAbstractValue::setClobbered): (JSC::DFG::StructureAbstractValue::add): Deleted. (JSC::DFG::StructureAbstractValue::addAll): Deleted. (JSC::DFG::StructureAbstractValue::contains): Deleted. (JSC::DFG::StructureAbstractValue::isSubsetOf): Deleted. (JSC::DFG::StructureAbstractValue::doesNotContainAnyOtherThan): Deleted. (JSC::DFG::StructureAbstractValue::isClearOrTop): Deleted. (JSC::DFG::StructureAbstractValue::last): Deleted. (JSC::DFG::StructureAbstractValue::speculationFromStructures): Deleted. (JSC::DFG::StructureAbstractValue::isValidOffset): Deleted. (JSC::DFG::StructureAbstractValue::hasSingleton): Deleted. (JSC::DFG::StructureAbstractValue::singleton): Deleted. (JSC::DFG::StructureAbstractValue::dumpInContext): Deleted. (JSC::DFG::StructureAbstractValue::dump): Deleted. (JSC::DFG::StructureAbstractValue::topValue): Deleted.
- dfg/DFGStructureClobberState.h: Added. (JSC::DFG::merge): (WTF::printInternal):
- dfg/DFGTransition.cpp: Added. (JSC::DFG::Transition::dumpInContext): (JSC::DFG::Transition::dump):
- dfg/DFGTransition.h: Added. (JSC::DFG::Transition::Transition):
- dfg/DFGTypeCheckHoistingPhase.cpp: (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks): (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
- dfg/DFGWatchableStructureWatchingPhase.cpp: Added. (JSC::DFG::WatchableStructureWatchingPhase::WatchableStructureWatchingPhase): (JSC::DFG::WatchableStructureWatchingPhase::run): (JSC::DFG::WatchableStructureWatchingPhase::tryWatch): (JSC::DFG::performWatchableStructureWatching):
- dfg/DFGWatchableStructureWatchingPhase.h: Added.
- dfg/DFGWatchpointCollectionPhase.cpp: (JSC::DFG::WatchpointCollectionPhase::handle): (JSC::DFG::WatchpointCollectionPhase::handleEdge): Deleted.
- ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile):
- ftl/FTLIntrinsicRepository.h:
- ftl/FTLLowerDFGToLLVM.cpp: (JSC::FTL::ftlUnreachable): (JSC::FTL::LowerDFGToLLVM::createPhiVariables): (JSC::FTL::LowerDFGToLLVM::compileBlock): (JSC::FTL::LowerDFGToLLVM::compileNode): (JSC::FTL::LowerDFGToLLVM::compileUpsilon): (JSC::FTL::LowerDFGToLLVM::compilePhi): (JSC::FTL::LowerDFGToLLVM::compileDoubleRep): (JSC::FTL::LowerDFGToLLVM::compileValueRep): (JSC::FTL::LowerDFGToLLVM::compileValueToInt32): (JSC::FTL::LowerDFGToLLVM::compileGetArgument): (JSC::FTL::LowerDFGToLLVM::compileGetLocal): (JSC::FTL::LowerDFGToLLVM::compileSetLocal): (JSC::FTL::LowerDFGToLLVM::compileArithAddOrSub): (JSC::FTL::LowerDFGToLLVM::compileArithMul): (JSC::FTL::LowerDFGToLLVM::compileArithDiv): (JSC::FTL::LowerDFGToLLVM::compileArithMod): (JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax): (JSC::FTL::LowerDFGToLLVM::compileArithAbs): (JSC::FTL::LowerDFGToLLVM::compileArithNegate): (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure): (JSC::FTL::LowerDFGToLLVM::compilePutStructure): (JSC::FTL::LowerDFGToLLVM::compileGetById): (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentsLength): (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal): (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength): (JSC::FTL::LowerDFGToLLVM::compileGetByVal): (JSC::FTL::LowerDFGToLLVM::compilePutByVal): (JSC::FTL::LowerDFGToLLVM::compileArrayPush): (JSC::FTL::LowerDFGToLLVM::compileArrayPop): (JSC::FTL::LowerDFGToLLVM::compileNewArray): (JSC::FTL::LowerDFGToLLVM::compileNewArrayBuffer): (JSC::FTL::LowerDFGToLLVM::compileAllocatePropertyStorage): (JSC::FTL::LowerDFGToLLVM::compileReallocatePropertyStorage): (JSC::FTL::LowerDFGToLLVM::compileToString): (JSC::FTL::LowerDFGToLLVM::compileMakeRope): (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset): (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset): (JSC::FTL::LowerDFGToLLVM::compileCompareEq): (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq): (JSC::FTL::LowerDFGToLLVM::compileSwitch): (JSC::FTL::LowerDFGToLLVM::compare): (JSC::FTL::LowerDFGToLLVM::boolify): (JSC::FTL::LowerDFGToLLVM::terminate): (JSC::FTL::LowerDFGToLLVM::lowInt32): (JSC::FTL::LowerDFGToLLVM::lowInt52): (JSC::FTL::LowerDFGToLLVM::opposite): (JSC::FTL::LowerDFGToLLVM::lowCell): (JSC::FTL::LowerDFGToLLVM::lowBoolean): (JSC::FTL::LowerDFGToLLVM::lowDouble): (JSC::FTL::LowerDFGToLLVM::lowJSValue): (JSC::FTL::LowerDFGToLLVM::speculate): (JSC::FTL::LowerDFGToLLVM::isArrayType): (JSC::FTL::LowerDFGToLLVM::speculateStringObjectForStructureID): (JSC::FTL::LowerDFGToLLVM::callCheck): (JSC::FTL::LowerDFGToLLVM::buildExitArguments): (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode): (JSC::FTL::LowerDFGToLLVM::setInt52): (JSC::FTL::LowerDFGToLLVM::crash): (JSC::FTL::LowerDFGToLLVM::compileStructureTransitionWatchpoint): Deleted.
- ftl/FTLOutput.cpp: (JSC::FTL::Output::crashNonTerminal): Deleted.
- ftl/FTLOutput.h: (JSC::FTL::Output::crash): Deleted.
- jit/JITOperations.h:
- jsc.cpp: (WTF::jscExit): (functionQuit): (main): (printUsageStatement): (CommandLine::parseArguments):
- runtime/Structure.h: (JSC::Structure::dfgShouldWatchIfPossible): (JSC::Structure::dfgShouldWatch):
- tests/stress/arrayify-to-structure-contradiction.js: Added. (foo):
- tests/stress/ftl-getmyargumentslength-inline.js: Added. (foo):
- tests/stress/multi-put-by-offset-multiple-transitions.js: Added. (foo): (Foo):
- tests/stress/throw-from-ftl-in-loop.js: Added.
- tests/stress/throw-from-ftl.js: Added. (foo):
2014-06-03 Filip Pizlo <fpizlo@apple.com>
[ftlopt] Unreviewed, roll out r169578. The build system needs some more love.
- InlineRuntimeSymbolTable.h: Removed.
- JavaScriptCore.xcodeproj/project.pbxproj:
- build-symbol-table-index.py:
- build-symbol-table-index.sh:
- copy-llvm-ir-to-derived-sources.sh:
- dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleCall):
- dfg/DFGNode.h: (JSC::DFG::Node::canBeKnownFunction): Deleted. (JSC::DFG::Node::hasKnownFunction): Deleted. (JSC::DFG::Node::knownFunction): Deleted. (JSC::DFG::Node::giveKnownFunction): Deleted.
- ftl/FTLAbbreviatedTypes.h:
- ftl/FTLCompile.cpp: (JSC::FTL::compile):
- ftl/FTLLowerDFGToLLVM.cpp: (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM): (JSC::FTL::LowerDFGToLLVM::lower): (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct): (JSC::FTL::LowerDFGToLLVM::possiblyCompileInlineableNativeCall): Deleted. (JSC::FTL::LowerDFGToLLVM::getFunctionBySymbol): Deleted. (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol): Deleted. (JSC::FTL::LowerDFGToLLVM::isInlinableSize): Deleted.
- ftl/FTLState.cpp: (JSC::FTL::State::State):
- ftl/FTLState.h:
- heap/HandleStack.h:
- llvm/InitializeLLVM.h:
- llvm/InitializeLLVMMac.cpp: Removed.
- llvm/InitializeLLVMMac.mm: Added. (JSC::initializeLLVMImpl):
- llvm/LLVMAPIFunctions.h:
- llvm/LLVMHeaders.h:
- runtime/BundlePath.h: Removed.
- runtime/BundlePath.mm: Removed.
- runtime/DateConversion.h:
- runtime/DateInstance.h:
- runtime/ExceptionHelpers.h:
- runtime/JSArray.h:
- runtime/JSCJSValue.h: (JSC::JSValue::toFloat):
- runtime/JSDateMath.h:
- runtime/JSObject.h:
- runtime/JSWrapperObject.h:
- runtime/Options.h:
- runtime/RegExp.h:
- runtime/StringObject.h:
- runtime/Structure.h:
- tested-symbols.symlst: Removed.
2014-06-03 Filip Pizlo <fpizlo@apple.com>
[ftlopt] FTL native inlining tests take far too long
https://bugs.webkit.org/show_bug.cgi?id=133498
Unreviewed test gardening.
Added a new exceptions test since the other one appears to not work.
- tests/stress/ftl-library-exception.js:
- tests/stress/ftl-library-inline-gettimezoneoffset.js: Added. (foo):
- tests/stress/ftl-library-inlining-exceptions-dataview.js: Added. (foo):
- tests/stress/ftl-library-inlining-exceptions.js: Copied from LayoutTests/js/regress/script-tests/ftl-library-inlining-exceptions.js.
- tests/stress/ftl-library-inlining-loops.js: Copied from LayoutTests/js/regress/script-tests/ftl-library-inlining-loops.js.
- tests/stress/ftl-library-inlining-random.js:
- tests/stress/ftl-library-substring.js:
2014-06-03 Matthew Mirman <mmirman@apple.com>
[ftlopt] Added system for inlining native functions via the FTL.
https://bugs.webkit.org/show_bug.cgi?id=131515
Reviewed by Filip Pizlo.
Also fixed the build to not compress the bitcode and to
include all of the relevant runtime. With GCC_GENERATE_DEBUGGING_SYMBOLS = NO,
the produced bitcode files are a 100th the size they were before.
Now we can include all of the relevant runtime files with only a 3mb overhead.
This is the same overhead as for two compressed files before,
but done more efficiently (on both ends) and with less code.
Deciding whether to inline native functions is left up to LLVM.
The entire module containing the function is linked into the current
compiled JS so that inlining the native functions shouldn't make them smaller.
Rather than loading Runtime.symtbl at runtime FTLState.cpp now includes a file
InlineRuntimeSymbolTable.h which statically builds the symbol table hash table.
Currently build-symbol-table-index.py updates this file from the
contents of tested-symbols.symlst when done building as a matter of convenience.
However, in order to include the new contents of the file in the build
you'd need to build twice. This will be fixed in future versions.
- JavaScriptCore.xcodeproj/project.pbxproj: Added back runtime files to compile.
- build-symbol-table-index.py: Changed bitcode suffix. Added inclusion of only tested symbols. Added output to InlineRuntimeSymbolTable.h.
- build-symbol-table-index.sh: Changed bitcode suffix.
- copy-llvm-ir-to-derived-sources.sh: Removed gzip compression.
- tested-symbols.symlst: Added.
- dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleCall): Now sets the knownFunction of the call node if such a function exists and emits a check that during runtime the callee is in fact known.
- dfg/DFGNode.h: Added functions to set the known function of a call node. (JSC::DFG::Node::canBeKnownFunction): Added. (JSC::DFG::Node::hasKnownFunction): Added. (JSC::DFG::Node::knownFunction): Added. (JSC::DFG::Node::giveKnownFunction): Added.
- ftl/FTLAbbreviatedTypes.h: Added a typedef for LLVMMemoryBufferRef
- ftl/FTLLowerDFGToLLVM.cpp: (JSC::FTL::LowerDFGToLLVM::isInlinableSize): Added. Hardcoded threshold to 275. (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol): Added. (JSC::FTL::LowerDFGToLLVM::getFunctionBySymbol): Added. (JSC::FTL::LowerDFGToLLVM::possiblyCompileInlineableNativeCall): Added. (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct): Added call to possiblyCompileInlineableNativeCall
- ftl/FTLOutput.h: (JSC::FTL::Output::allocaName): Added. Useful for debugging.
- ftl/FTLState.cpp: (JSC::FTL::State::State): Added an include for InlineRuntimeSymbolTable.h
- ftl/FTLState.h: Added symbol table hash table.
- ftl/FTLCompile.cpp: (JSC::FTL::compile): Added inlining and dead function elimination passes.
- heap/HandleStack.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
- InlineRuntimeSymbolTable.h: Added.
- llvm/InitializeLLVMMac.mm: Deleted.
- llvm/InitializeLLVMMac.cpp: Added.
- llvm/LLVMAPIFunctions.h: Added macros to include Bitcode parsing and linking functions.
- llvm/LLVMHeaders.h: Added includes for Bitcode parsing and linking.
- runtime/BundlePath.h: Added.
- runtime/BundlePath.mm: Added.
- runtime/DateInstance.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
- runtime/DateInstance.h: ditto.
- runtime/DateConversion.h: ditto.
- runtime/ExceptionHelpers.h: ditto.
- runtime/JSCJSValue.h: ditto.
- runtime/JSArray.h: ditto.
- runtime/JSDateMath.h: ditto.
- runtime/JSObject.h: ditto.
- runtime/JSObject.h: ditto.
- runtime/RegExp.h: ditto.
- runtime/Structure.h: ditto.
- runtime/Options.h: Added maximumLLVMInstructionCountForNativeInlining.
- tests/stress/ftl-library-inlining-random.js: Added.
- tests/stress/ftl-library-substring.js: Added.
2014-05-21 Filip Pizlo <fpizlo@apple.com>
[ftlopt] DFG::clobberize should be blind to the effects of GC
https://bugs.webkit.org/show_bug.cgi?id=133166
Reviewed by Goeffrey Garen.
Move the computation of where GCs happen to DFG::doesGC().
Large (>5x) speed-up on programs that do loop-invariant string concatenations.
- CMakeLists.txt:
- JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
- JavaScriptCore.xcodeproj/project.pbxproj:
- dfg/DFGAbstractHeap.h:
- dfg/DFGClobberize.h: (JSC::DFG::clobberize): (JSC::DFG::clobberizeForAllocation): Deleted.
- dfg/DFGDoesGC.cpp: Added. (JSC::DFG::doesGC):
- dfg/DFGDoesGC.h: Added.
- dfg/DFGStoreBarrierElisionPhase.cpp: (JSC::DFG::StoreBarrierElisionPhase::handleNode): (JSC::DFG::StoreBarrierElisionPhase::couldCauseGC): Deleted.
2014-05-16 Filip Pizlo <fpizlo@apple.com>
[ftlopt] A StructureSet with one element should only require one word and no allocation
https://bugs.webkit.org/show_bug.cgi?id=133014
Reviewed by Oliver Hunt.
This makes it more efficient to use StructureSet in situations where the common case is
just one structure.
I also took the opportunity to use the same set terminology we use in BitVector: merge,
filter, exclude, contains, etc.
Eventually, this will be used to implement StructureAbstractValue as well.
- CMakeLists.txt:
- JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
- JavaScriptCore.xcodeproj/project.pbxproj:
- bytecode/StructureSet.cpp: Added. (JSC::StructureSet::StructureSet): (JSC::StructureSet::operator=): (JSC::StructureSet::clear): (JSC::StructureSet::add): (JSC::StructureSet::remove): (JSC::StructureSet::contains): (JSC::StructureSet::merge): (JSC::StructureSet::filter): (JSC::StructureSet::exclude): (JSC::StructureSet::isSubsetOf): (JSC::StructureSet::overlaps): (JSC::StructureSet::operator==): (JSC::StructureSet::speculationFromStructures): (JSC::StructureSet::arrayModesFromStructures): (JSC::StructureSet::dumpInContext): (JSC::StructureSet::dump): (JSC::StructureSet::addOutOfLine): (JSC::StructureSet::containsOutOfLine): (JSC::StructureSet::copyFrom): (JSC::StructureSet::OutOfLineList::create): (JSC::StructureSet::OutOfLineList::destroy):
- bytecode/StructureSet.h: (JSC::StructureSet::StructureSet): (JSC::StructureSet::~StructureSet): (JSC::StructureSet::onlyStructure): (JSC::StructureSet::isEmpty): (JSC::StructureSet::size): (JSC::StructureSet::at): (JSC::StructureSet::operator[]): (JSC::StructureSet::last): (JSC::StructureSet::OutOfLineList::list): (JSC::StructureSet::OutOfLineList::OutOfLineList): (JSC::StructureSet::deleteStructureListIfNecessary): (JSC::StructureSet::isThin): (JSC::StructureSet::pointer): (JSC::StructureSet::singleStructure): (JSC::StructureSet::structureList): (JSC::StructureSet::set): (JSC::StructureSet::clear): Deleted. (JSC::StructureSet::add): Deleted. (JSC::StructureSet::addAll): Deleted. (JSC::StructureSet::remove): Deleted. (JSC::StructureSet::contains): Deleted. (JSC::StructureSet::containsOnly): Deleted. (JSC::StructureSet::isSubsetOf): Deleted. (JSC::StructureSet::overlaps): Deleted. (JSC::StructureSet::singletonStructure): Deleted. (JSC::StructureSet::speculationFromStructures): Deleted. (JSC::StructureSet::arrayModesFromStructures): Deleted. (JSC::StructureSet::operator==): Deleted. (JSC::StructureSet::dumpInContext): Deleted. (JSC::StructureSet::dump): Deleted.
- dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
- dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::emitPrototypeChecks): (JSC::DFG::ByteCodeParser::handleGetById): (JSC::DFG::ByteCodeParser::parseBlock):
- dfg/DFGCSEPhase.cpp: (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
- dfg/DFGNode.h: (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
- dfg/DFGTypeCheckHoistingPhase.cpp: (JSC::DFG::TypeCheckHoistingPhase::noticeStructureCheck):
Source/WTF:
2014-06-04 Filip Pizlo <fpizlo@apple.com>
[ftlopt] AI should be able track structure sets larger than 1
https://bugs.webkit.org/show_bug.cgi?id=128073
Reviewed by Oliver Hunt.
- wtf/Bag.h: (WTF::Bag::Node::Node): (WTF::Bag::add):
LayoutTests:
2014-06-04 Filip Pizlo <fpizlo@apple.com>
[ftlopt] AI should be able track structure sets larger than 1
https://bugs.webkit.org/show_bug.cgi?id=128073
Reviewed by Oliver Hunt.
- js/regress/get-by-id-bimorphic-check-structure-elimination-expected.txt: Added.
- js/regress/get-by-id-bimorphic-check-structure-elimination-simple-expected.txt: Added.
- js/regress/get-by-id-bimorphic-check-structure-elimination-simple.html: Added.
- js/regress/get-by-id-bimorphic-check-structure-elimination.html: Added.
- js/regress/get-by-id-check-structure-elimination-expected.txt: Added.
- js/regress/get-by-id-check-structure-elimination.html: Added.
- js/regress/get-by-id-quadmorphic-check-structure-elimination-simple-expected.txt: Added.
- js/regress/get-by-id-quadmorphic-check-structure-elimination-simple.html: Added.
- js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination-simple.js: Added.
- js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination.js: Added.
- js/regress/script-tests/get-by-id-check-structure-elimination.js: Added.
- js/regress/script-tests/get-by-id-quadmorphic-check-structure-elimination-simple.js: Added.
2014-06-03 Filip Pizlo <fpizlo@apple.com>
[ftlopt] FTL native inlining tests take far too long
https://bugs.webkit.org/show_bug.cgi?id=133498
Unreviewed test gardening.
Move long-running tests that focus on correctness into JSC/tests/stress.
Speed up the performance tests by reducing allocation and call overhead.
- js/regress/ftl-library-inlining-exceptions-expected.txt: Removed.
- js/regress/ftl-library-inlining-exceptions.html: Removed.
- js/regress/ftl-library-inlining-folding-expected.txt: Removed.
- js/regress/ftl-library-inlining-folding.html: Removed.
- js/regress/ftl-library-inlining-loops-expected.txt: Removed.
- js/regress/ftl-library-inlining-loops.html: Removed.
- js/regress/script-tests/ftl-library-inlining-dataview.js: (foo): Deleted.
- js/regress/script-tests/ftl-library-inlining-exceptions.js: Removed.
- js/regress/script-tests/ftl-library-inlining-folding.js: Removed.
- js/regress/script-tests/ftl-library-inlining-loops.js: Removed.
- js/regress/script-tests/ftl-library-inlining.js: (foo): Deleted.
2014-06-03 Matthew Mirman <mmirman@apple.com>
[ftlopt] Added system for inlining native functions via the FTL.
https://bugs.webkit.org/show_bug.cgi?id=131515
Reviewed by Filip Pizlo.
Adds microbenchmarks.
- js/regress/script-tests/ftl-library-inlining.js: Added.
- js/regress/ftl-library-inlining-expected.txt: Added.
- js/regress/ftl-library-inlining.html: Added.
- js/regress/script-tests/ftl-library-inlining-dataview.js: Added.
- js/regress/ftl-library-inlining-dataview-expected.txt: Added.
- js/regress/ftl-library-inlining-dataview.html: Added.
- js/regress/script-tests/ftl-library-inlining-exceptions.js: Added.
- js/regress/ftl-library-inlining-exceptions-expected.txt: Added.
- js/regress/ftl-library-inlining-exceptions.html: Added.
- js/regress/script-tests/ftl-library-inlining-folding.js: Added.
- js/regress/ftl-library-inlining-folding-expected.txt: Added.
- js/regress/ftl-library-inlining-folding-expected.html: Added.
- js/regress/script-tests/ftl-library-inlining-loops.js: Added.
- js/regress/ftl-library-inlining-loops-expected.txt: Added.
- js/regress/ftl-library-inlining-loops.html: Added.
2014-05-21 Filip Pizlo <fpizlo@apple.com>
[ftlopt] DFG::clobberize should be blind to the effects of GC
https://bugs.webkit.org/show_bug.cgi?id=133166
Reviewed by Geoffrey Garen.
- js/regress/hoist-make-rope-expected.txt: Added.
- js/regress/hoist-make-rope.html: Added.
- js/regress/script-tests/hoist-make-rope.js: Added. (foo):
- 6:12 PM Changeset in webkit [171379] by
-
- 3 edits in trunk/Source/WebCore
Remove dead APIs from TiledBackingStore
https://bugs.webkit.org/show_bug.cgi?id=135158
Reviewed by Gyuyoung Kim.
setContentsFrozen and related code of TiledBackingStore are not used since Qt port is removed.
- platform/graphics/TiledBackingStore.cpp:
(WebCore::TiledBackingStore::TiledBackingStore):
(WebCore::TiledBackingStore::updateTileBuffers):
(WebCore::TiledBackingStore::setContentsScale):
(WebCore::TiledBackingStore::createTiles):
(WebCore::TiledBackingStore::startTileBufferUpdateTimer):
(WebCore::TiledBackingStore::startBackingStoreUpdateTimer):
(WebCore::TiledBackingStore::commitScaleChange): Deleted.
(WebCore::TiledBackingStore::isBackingStoreUpdatesSuspended): Deleted.
(WebCore::TiledBackingStore::isTileBufferUpdatesSuspended): Deleted.
(WebCore::TiledBackingStore::setContentsFrozen): Deleted.
- platform/graphics/TiledBackingStore.h:
(WebCore::TiledBackingStore::contentsFrozen): Deleted.
- 6:01 PM Changeset in webkit [171378] by
-
- 4 edits2 adds in trunk
Fix window-inactive css selectors when using querySelector.
https://bugs.webkit.org/show_bug.cgi?id=135149
Patch by Alex Christensen <achristensen@webkit.org> on 2014-07-22
Reviewed by Tim Horton.
Source/WebCore:
Test: fast/selectors/querySelector-window-inactive.html
- css/SelectorChecker.cpp:
(WebCore::SelectorChecker::checkOne):
Removed default and implemented case PseudoClassWindowInactive.
LayoutTests:
- fast/selectors/querySelector-window-inactive-expected.txt: Added.
- fast/selectors/querySelector-window-inactive.html: Added.
- platform/wk2/TestExpectations:
Added querySelector-window-inactive.html to list of tests that do not work in WK2 because of setWindowIsKey.
- 5:41 PM Changeset in webkit [171377] by
-
- 34 edits in branches/safari-537.78-branch
Merge r169475
- 5:36 PM Changeset in webkit [171376] by
-
- 2 edits in trunk/Source/WebCore
REGRESSION (r171016): Reproducible infinite spin selecting phone number
https://bugs.webkit.org/show_bug.cgi?id=135183
<rdar://problem/17727342>
Reviewed by Ryosuke Niwa.
- editing/Editor.cpp:
(WebCore::Editor::scanRangeForTelephoneNumbers):
Make use of TextIterator::subrange, which knows how to make a subrange from character positions,
instead of assuming that our character positions translate directly to positions in the incoming range.
Make use of DocumentMarkerController::addMarker, which takes a range and applies the marker to
all text nodes inside the range as appropriate.
Fix naming of the shadowed 'length' local.
Fix a typo in the comment.
- 5:35 PM Changeset in webkit [171375] by
-
- 2 edits in trunk/Source/WebCore
[iOS] [OSX] Don't transcode WOFF on platforms that support it natively
https://bugs.webkit.org/show_bug.cgi?id=134904
Reviewed by Andreas Kling.
No new tests because there is no behavior change.
- loader/cache/CachedFont.cpp:
(WebCore::CachedFont::ensureCustomFontData):
- 5:27 PM Changeset in webkit [171374] by
-
- 11 edits in branches/safari-537.78-branch/Source
Merge r152704
- 5:14 PM Changeset in webkit [171373] by
-
- 2 edits in trunk/Source/WebKit2
Unreviewed build fix on EFL port after r171356.
Implement a dummy platformMediaCacheDirectory() to avoid undefined reference error.
- UIProcess/efl/WebContextEfl.cpp:
(WebKit::WebContext::platformMediaCacheDirectory):
- 4:52 PM Changeset in webkit [171372] by
-
- 2 edits in trunk/Source/JavaScriptCore
Unreviewed build fix attempt on the EFL port after r171362.
Build break because of -Werror=return-type
- bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::makesCalls):
- 4:33 PM Changeset in webkit [171371] by
-
- 2 edits in trunk/Source/WebCore
[Win] Crash after plugin is unloaded.
https://bugs.webkit.org/show_bug.cgi?id=119044
Patch by peavo@outlook.com <peavo@outlook.com> on 2014-07-22
Reviewed by Darin Adler.
We need to invalidate all runtime objects when a plugin view is destroyed, in case the plugin is unloaded,
and one of these runtime objects accesses the plugin function table upon destruction afterwards, which will cause a crash.
If we use the weak pointer to the runtime object when invalidating, it will be null if it's in the WeakImpl::Dead state.
This means the runtime object will not be invalidated, possibly causing a crash if the plugin is unloaded.
It should be safe to use the raw pointer to the runtime object when invalidating, since finalized runtime objects
will be removed from the set of runtime objects in the method RootObject::finalize().
- bridge/runtime_root.cpp:
(JSC::Bindings::RootObject::invalidate): Make sure all runtime objects are invalidated by getting the raw runtime object pointer from the hash key.
- 4:28 PM Changeset in webkit [171370] by
-
- 24 edits in trunk/Source
REGRESSION (WebKit2): Selection inside accelerated overflow:scroll doesn't track scrolling.
https://bugs.webkit.org/show_bug.cgi?id=135180
<rdar://problem/16721055>
Reviewed by Simon Fraser.
Source/WebCore:
AsyncScrollingCoordinator will force a selection update on iOS
when scrolling terminates in an overflow scroll.
- loader/EmptyClients.h:
- page/EditorClient.h:
- page/scrolling/AsyncScrollingCoordinator.cpp:
(WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll):
- page/scrolling/ScrollingTree.h:
(WebCore::ScrollingTree::scrollingTreeNodeWillStartScroll):
(WebCore::ScrollingTree::scrollingTreeNodeDidEndScroll):
Source/WebKit/mac:
- WebCoreSupport/WebEditorClient.h:
Source/WebKit2:
Adds notifications to the WKContentView to know when scrolling starts and ends
in an overflow scroll. When scrolling starts, we hide the selection and we restore
it when scrolling ends, though not before the selection information in the editor
state has been updated.
It also adds a new method to the EditorClient class to force the
selection update when scrolling is completed.
- UIProcess/PageClient.h:
- UIProcess/Scrolling/RemoteScrollingCoordinatorProxy.h:
- UIProcess/Scrolling/RemoteScrollingTree.cpp:
(WebKit::RemoteScrollingTree::scrollingTreeNodeWillStartScroll):
(WebKit::RemoteScrollingTree::scrollingTreeNodeDidEndScroll):
- UIProcess/Scrolling/RemoteScrollingTree.h:
- UIProcess/Scrolling/ios/ScrollingTreeOverflowScrollingNodeIOS.h:
- UIProcess/Scrolling/ios/ScrollingTreeOverflowScrollingNodeIOS.mm:
(-[WKOverflowScrollViewDelegate scrollViewWillBeginDragging:]):
(-[WKOverflowScrollViewDelegate scrollViewDidEndDragging:willDecelerate:]):
(-[WKOverflowScrollViewDelegate scrollViewDidEndDecelerating:]):
(WebKit::ScrollingTreeOverflowScrollingNodeIOS::overflowScrollWillStart):
(WebKit::ScrollingTreeOverflowScrollingNodeIOS::overflowScrollDidEnd):
- UIProcess/WebPageProxy.h:
- UIProcess/ios/PageClientImplIOS.h:
- UIProcess/ios/PageClientImplIOS.mm:
(WebKit::PageClientImpl::overflowScrollWillStartScroll):
(WebKit::PageClientImpl::overflowScrollDidEndScroll):
- UIProcess/ios/RemoteScrollingCoordinatorProxyIOS.mm:
(WebKit::RemoteScrollingCoordinatorProxy::scrollingTreeNodeWillStartScroll):
(WebKit::RemoteScrollingCoordinatorProxy::scrollingTreeNodeDidEndScroll):
- UIProcess/ios/WKContentViewInteraction.h:
- UIProcess/ios/WKContentViewInteraction.mm:
(-[WKContentView _overflowScrollingWillBegin]):
(-[WKContentView _overflowScrollingDidEnd]):
(-[WKContentView _updateChangedSelection]):
- UIProcess/ios/WebPageProxyIOS.mm:
(WebKit::WebPageProxy::overflowScrollWillStartScroll):
(WebKit::WebPageProxy::overflowScrollDidEndScroll):
- WebProcess/WebCoreSupport/WebEditorClient.h:
- WebProcess/WebCoreSupport/WebEditorClient.cpp:
- WebProcess/WebCoreSupport/ios/WebEditorClientIOS.mm:
(WebKit::WebEditorClient::updateSelection):
- 4:25 PM Changeset in webkit [171369] by
-
- 11 edits2 copies in branches/safari-537.78-branch/Source/WebKit2
Merge r169457
- 3:32 PM Changeset in webkit [171368] by
-
- 2 edits in trunk/Source/WebKit2
[iOS][WK2] WebPageProxy should not do anything when responding to an animated resize is the page is not in a valid state
https://bugs.webkit.org/show_bug.cgi?id=135169
<rdar://problem/17740149>
Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-07-22
Reviewed by Tim Horton.
- UIProcess/ios/WebPageProxyIOS.mm:
(WebKit::WebPageProxy::dynamicViewportSizeUpdate):
Neither m_dynamicViewportSizeUpdateWaitingForTarget nor m_dynamicViewportSizeUpdateWaitingForLayerTreeCommit should
be modified if there is not WebProcess to respond to DynamicViewportSizeUpdate.
(WebKit::WebPageProxy::synchronizeDynamicViewportUpdate):
We should not attempt to synchronize anything if the page was closed before the end of the dynamic viewport
update.
- 3:09 PM Changeset in webkit [171367] by
-
- 2 edits in trunk/Source/JavaScriptCore
JSLock release should only modify the AtomicStringTable if it modified in acquire
https://bugs.webkit.org/show_bug.cgi?id=135143
Reviewed by Pratik Solanki.
- runtime/JSLock.cpp:
(JSC::JSLock::willDestroyVM):
(JSC::JSLock::willReleaseLock):
Only set the AtomicStringTable when there was a VM, to balance JSLock::didAcquireLock.
- 2:46 PM Changeset in webkit [171366] by
-
- 7 edits in trunk/Source/WebKit2
REGRESSION (r171239): Much more time spent taking snapshots during the PLT
https://bugs.webkit.org/show_bug.cgi?id=135177
<rdar://problem/17764847>
Reviewed by Dan Bernstein.
- UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::willChangeCurrentHistoryItemForMainFrame):
(WebKit::WebPageProxy::willChangeCurrentHistoryItem): Deleted.
- UIProcess/WebPageProxy.h:
- UIProcess/WebPageProxy.messages.in:
- WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::willChangeCurrentHistoryItem):
- WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::willChangeCurrentHistoryItemForMainFrame):
(WebKit::WebPage::willChangeCurrentHistoryItem): Deleted.
- WebProcess/WebPage/WebPage.h:
Rename WillChangeCurrentHistoryItem to WillChangeCurrentHistoryItemForMainFrame.
Only send it when the current history item for the main frame changes.
- 2:32 PM Changeset in webkit [171365] by
-
- 2 edits in trunk/Source/WebKit2
Add accountsd access to network sandbox profile
https://bugs.webkit.org/show_bug.cgi?id=135176
<rdar://17656487>
Reviewed by Anders Carlsson.
This is available to the webcontent process already, but is also
needed for the networking process.
- Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
- 2:30 PM Changeset in webkit [171364] by
-
- 2 edits in trunk/Source/JavaScriptCore
Fix cloop build.
- bytecode/CallLinkStatus.cpp:
(JSC::CallLinkStatus::computeExitSiteData):
- 2:25 PM Changeset in webkit [171363] by
-
- 3 edits in trunk/Source/WebKit2
Remove unused com.apple.webkit.* rules from profiles
https://bugs.webkit.org/show_bug.cgi?id=135174
<rdar://17755931>
Reviewed by Anders Carlsson.
We never send these rules so we should just remove use of them
from the profiles.
- Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
- Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
- 2:08 PM Changeset in webkit [171362] by
-
- 51 edits24 adds in trunk
Merge r168635, r168780, r169005, r169014, and r169143 from ftlopt.
2014-05-20 Filip Pizlo <fpizlo@apple.com>
[ftlopt] DFG bytecode parser should turn GetById with nothing but a Getter stub as stuff+handleCall, and handleCall should be allowed to inline if it wants to
https://bugs.webkit.org/show_bug.cgi?id=133105
Reviewed by Michael Saboff.
Source/JavaScriptCore:
- GetByIdStatus now knows about getters and can report intelligent things about them. As is usually the case with how we do these things, GetByIdStatus knows more about getters than the DFG can actually handle: it'll report details about polymorphic getter calls even though the DFG won't be able to handle those. This is fine; the DFG will see those statuses and bail to a generic slow path.
- The DFG::ByteCodeParser now knows how to set up and do handleCall() for a getter call. This can, and usually does, result in inlining of getters!
- CodeOrigin and OSR exit know about inlined getter calls. When you OSR out of an inlined getter, we set the return PC to a getter return thunk that fixes up the stack. We use the usual offset-true-return-PC trick, where OSR exit places the true return PC of the getter's caller as a phony argument that only the thunk knows how to find.
- Removed a bunch of dead monomorphic chain support from StructureStubInfo.
- A large chunk of this change is dragging GetGetterSetterByOffset, GetGetter, and GetSetter through the DFG and FTL. GetGetterSetterByOffset is like GetByOffset except that we know that we're returning a GetterSetter cell. GetGetter and GetSetter extract the getter, or setter, from the GetterSetter.
This is a ~2.5x speed-up on the getter microbenchmarks that we already had. So far none
of the "real" benchmarks exercise getters enough for this to matter. But I noticed that
some of the variants of the Richards benchmark in other languages - for example
Wolczko's Java translation of a C++ translation of Deutsch's Smalltalk version - use
getters and setters extensively. So, I created a getter/setter JavaScript version of
Richards and put it in regress/script-tests/getter-richards.js. That sees about a 2.4x
speed-up from this patch, which is very reassuring.
- bytecode/CodeBlock.cpp: (JSC::CodeBlock::printGetByIdCacheStatus): (JSC::CodeBlock::findStubInfo):
- bytecode/CodeBlock.h:
- bytecode/CodeOrigin.cpp: (WTF::printInternal):
- bytecode/CodeOrigin.h: (JSC::InlineCallFrame::specializationKindFor):
- bytecode/GetByIdStatus.cpp: (JSC::GetByIdStatus::computeFor): (JSC::GetByIdStatus::computeForStubInfo): (JSC::GetByIdStatus::makesCalls): (JSC::GetByIdStatus::computeForChain): Deleted.
- bytecode/GetByIdStatus.h: (JSC::GetByIdStatus::makesCalls): Deleted.
- bytecode/GetByIdVariant.cpp: (JSC::GetByIdVariant::~GetByIdVariant): (JSC::GetByIdVariant::GetByIdVariant): (JSC::GetByIdVariant::operator=): (JSC::GetByIdVariant::dumpInContext):
- bytecode/GetByIdVariant.h: (JSC::GetByIdVariant::GetByIdVariant): (JSC::GetByIdVariant::callLinkStatus):
- bytecode/PolymorphicGetByIdList.cpp: (JSC::GetByIdAccess::fromStructureStubInfo): (JSC::PolymorphicGetByIdList::from):
- bytecode/SpeculatedType.h:
- bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::deref): (JSC::StructureStubInfo::visitWeakReferences):
- bytecode/StructureStubInfo.h: (JSC::isGetByIdAccess): (JSC::StructureStubInfo::initGetByIdChain): Deleted.
- dfg/DFGAbstractHeap.h:
- dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
- dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::addCall): (JSC::DFG::ByteCodeParser::handleCall): (JSC::DFG::ByteCodeParser::handleInlining): (JSC::DFG::ByteCodeParser::handleGetByOffset): (JSC::DFG::ByteCodeParser::handleGetById): (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): (JSC::DFG::ByteCodeParser::parse):
- dfg/DFGCSEPhase.cpp: (JSC::DFG::CSEPhase::getGetterSetterByOffsetLoadElimination): (JSC::DFG::CSEPhase::getInternalFieldLoadElimination): (JSC::DFG::CSEPhase::performNodeCSE): (JSC::DFG::CSEPhase::getTypedArrayByteOffsetLoadElimination): Deleted.
- dfg/DFGClobberize.h: (JSC::DFG::clobberize):
- dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode):
- dfg/DFGJITCompiler.cpp: (JSC::DFG::JITCompiler::linkFunction):
- dfg/DFGNode.h: (JSC::DFG::Node::hasStorageAccessData):
- dfg/DFGNodeType.h:
- dfg/DFGOSRExitCompilerCommon.cpp: (JSC::DFG::reifyInlinedCallFrames):
- dfg/DFGPredictionPropagationPhase.cpp: (JSC::DFG::PredictionPropagationPhase::propagate):
- dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute):
- dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile):
- dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile):
- ftl/FTLAbstractHeapRepository.cpp:
- ftl/FTLAbstractHeapRepository.h:
- ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile):
- ftl/FTLLink.cpp: (JSC::FTL::link):
- ftl/FTLLowerDFGToLLVM.cpp: (JSC::FTL::LowerDFGToLLVM::compileNode): (JSC::FTL::LowerDFGToLLVM::compileGetGetter): (JSC::FTL::LowerDFGToLLVM::compileGetSetter):
- jit/AccessorCallJITStubRoutine.h:
- jit/JIT.cpp: (JSC::JIT::assertStackPointerOffset): (JSC::JIT::privateCompile):
- jit/JIT.h:
- jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_get_by_id):
- jit/ThunkGenerators.cpp: (JSC::arityFixupGenerator): (JSC::baselineGetterReturnThunkGenerator): (JSC::baselineSetterReturnThunkGenerator): (JSC::arityFixup): Deleted.
- jit/ThunkGenerators.h:
- runtime/CommonSlowPaths.cpp: (JSC::setupArityCheckData):
- tests/stress/exit-from-getter.js: Added.
- tests/stress/poly-chain-getter.js: Added. (Cons): (foo): (test):
- tests/stress/poly-chain-then-getter.js: Added. (Cons1): (Cons2): (foo): (test):
- tests/stress/poly-getter-combo.js: Added. (Cons1): (Cons2): (foo): (test): (.test):
- tests/stress/poly-getter-then-chain.js: Added. (Cons1): (Cons2): (foo): (test):
- tests/stress/poly-getter-then-self.js: Added. (foo): (test): (.test):
- tests/stress/poly-self-getter.js: Added. (foo): (test): (getter):
- tests/stress/poly-self-then-getter.js: Added. (foo): (test):
- tests/stress/weird-getter-counter.js: Added. (foo): (test):
2014-05-17 Filip Pizlo <fpizlo@apple.com>
[ftlopt] Factor out how CallLinkStatus uses exit site data
https://bugs.webkit.org/show_bug.cgi?id=133042
Reviewed by Anders Carlsson.
This makes it easier to use CallLinkStatus from clients that are calling into after
already holding some of the relevant locks. This is necessary because we use a "one lock
at a time" policy for CodeBlock locks: if you hold one then you're not allowed to acquire
any of the others. So, any code that needs to lock multiple CodeBlock locks needs to sort
of lock one, do some stuff, release it, then lock another, and then do more stuff. The
exit site data corresponds to the stuff you do while holding the baseline lock, while the
CallLinkInfo method corresponds to the stuff you do while holding the CallLinkInfo owner's
lock.
- bytecode/CallLinkStatus.cpp: (JSC::CallLinkStatus::computeFor): (JSC::CallLinkStatus::computeExitSiteData): (JSC::CallLinkStatus::computeDFGStatuses):
- bytecode/CallLinkStatus.h: (JSC::CallLinkStatus::ExitSiteData::ExitSiteData):
2014-05-17 Filip Pizlo <fpizlo@apple.com>
[ftlopt] InlineCallFrame::isCall should be an enumeration
https://bugs.webkit.org/show_bug.cgi?id=133034
Reviewed by Sam Weinig.
Once we start inlining getters and setters, we'll want InlineCallFrame to be able to tell
us that the inlined call was a getter call or a setter call. Initially I thought I would
have a new field called "kind" that would have components NormalCall, GetterCall, and
SetterCall. But that doesn't make sense, because for GetterCall and SetterCall, isCall
would have to be true. Hence, It makes more sense to have one enumeration that is Call,
Construct, GetterCall, or SetterCall. This patch is a first step towards this.
It's interesting that isClosureCall should probably still be separate, since getter and
setter inlining could inline closure calls.
- bytecode/CodeBlock.h: (JSC::baselineCodeBlockForInlineCallFrame):
- bytecode/CodeOrigin.cpp: (JSC::InlineCallFrame::dumpInContext): (WTF::printInternal):
- bytecode/CodeOrigin.h: (JSC::InlineCallFrame::kindFor): (JSC::InlineCallFrame::specializationKindFor): (JSC::InlineCallFrame::InlineCallFrame): (JSC::InlineCallFrame::specializationKind):
- dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
- dfg/DFGOSRExitPreparation.cpp: (JSC::DFG::prepareCodeOriginForOSRExit):
- runtime/Arguments.h: (JSC::Arguments::finishCreation):
2014-05-13 Filip Pizlo <fpizlo@apple.com>
[ftlopt] DFG should not exit due to inadequate profiling coverage when it can trivially fill in the profiling coverage due to variable constant inference and the better prediction modeling of typed array GetByVals
https://bugs.webkit.org/show_bug.cgi?id=132896
Reviewed by Geoffrey Garen.
This is a slight win on SunSpider, but it's meant to ultimately help us on
embenchen/lua. We already do well on that benchmark but our convergence is slower than
I'd like.
- dfg/DFGArrayMode.cpp: (JSC::DFG::ArrayMode::refine):
- dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock):
- dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode):
- dfg/DFGPredictionPropagationPhase.cpp: (JSC::DFG::PredictionPropagationPhase::propagate):
2014-05-08 Filip Pizlo <fpizlo@apple.com>
jsSubstring() should be lazy
https://bugs.webkit.org/show_bug.cgi?id=132556
Reviewed by Andreas Kling.
jsSubstring() is now lazy by using a special rope that is a substring instead of a
concatenation. To make this patch super simple, we require that a substring's base is
never a rope. Hence, when resolving a rope, we either go down a non-recursive substring
path, or we go down a concatenation path which may see exactly one level of substrings in
its fibers.
This is up to a 50% speed-up on microbenchmarks and a 10% speed-up on Octane/regexp.
Relanding this with assertion fixes.
- heap/MarkedBlock.cpp: (JSC::MarkedBlock::specializedSweep):
- runtime/JSString.cpp: (JSC::JSRopeString::visitFibers): (JSC::JSRopeString::resolveRopeInternal8): (JSC::JSRopeString::resolveRopeInternal16): (JSC::JSRopeString::clearFibers): (JSC::JSRopeString::resolveRope): (JSC::JSRopeString::resolveRopeSlowCase8): (JSC::JSRopeString::resolveRopeSlowCase):
- runtime/JSString.h: (JSC::JSRopeString::finishCreation): (JSC::JSRopeString::append): (JSC::JSRopeString::create): (JSC::JSRopeString::offsetOfFibers): (JSC::JSRopeString::fiber): (JSC::JSRopeString::substringBase): (JSC::JSRopeString::substringOffset): (JSC::JSRopeString::notSubstringSentinel): (JSC::JSRopeString::substringSentinel): (JSC::JSRopeString::isSubstring): (JSC::JSRopeString::setIsSubstring): (JSC::jsSubstring):
- runtime/RegExpMatchesArray.cpp: (JSC::RegExpMatchesArray::reifyAllProperties):
- runtime/StringPrototype.cpp: (JSC::stringProtoFuncSubstring):
Source/WTF:
- wtf/Bag.h: (WTF::Bag::iterator::operator!=):
LayoutTests:
- js/regress/getter-no-activation-expected.txt: Added.
- js/regress/getter-no-activation.html: Added.
- js/regress/script-tests/getter-no-activation.js: Added.
- js/regress/getter-richards-expected.txt: Added.
- js/regress/getter-richards.html: Added.
- js/regress/script-tests/getter-richards.js: Added.
2014-05-08 Filip Pizlo <fpizlo@apple.com>
jsSubstring() should be lazy
https://bugs.webkit.org/show_bug.cgi?id=132556
Reviewed by Andreas Kling.
These tests get 35-50% faster.
- js/regress/script-tests/substring-concat-weird.js: Added. (foo):
- js/regress/script-tests/substring-concat.js: Added. (foo):
- js/regress/script-tests/substring.js: Added. (foo):
- js/regress/substring-concat-expected.txt: Added.
- js/regress/substring-concat-weird-expected.txt: Added.
- js/regress/substring-concat-weird.html: Added.
- js/regress/substring-concat.html: Added.
- js/regress/substring-expected.txt: Added.
- js/regress/substring.html: Added.
- 1:57 PM Changeset in webkit [171361] by
-
- 3 edits in trunk/Websites/perf.webkit.org
Perf dashboard spends 2s processing JSON data during the page loads
https://bugs.webkit.org/show_bug.cgi?id=135152
Reviewed by Andreas Kling.
In the Apple internal dashboard, we were spending as much as 2 seconds
converting raw JSON data into proper JS objects while loading the dashboard.
This caused the apparent unresponsiveness of the dashboard despite of the fact
charts themselves updated almost instantaneously.
- public/index.html:
- public/js/helper-classes.js:
(TestBuild): Compute the return values of formattedTime and formattedBuildTime
lazily as creating new Date objects and running string replace is expensive.
(TestBuild.formattedTime):
(TestBuild.formattedBuildTime):
(PerfTestRuns.setResults): Added. Pushing each result was the biggest bottle neck.
(PerfTestRuns.addResult): Deleted.
- 1:51 PM Changeset in webkit [171360] by
-
- 23 edits in trunk
[Mac] Cocoa throws exception when the return type of NSAccessibilityLinkedUIElementsAttribute is not an array
https://bugs.webkit.org/show_bug.cgi?id=135165
Reviewed by Simon Fraser.
Source/WebCore:
Return an empty array instead of nil.
Updated tests.
- accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):
LayoutTests:
Updating tests.
- accessibility/parent-delete-expected.txt:
- accessibility/transformed-element-expected.txt:
- platform/mac/accessibility/aria-columnrowheaders-expected.txt:
- platform/mac/accessibility/bounds-for-range-expected.txt:
- platform/mac/accessibility/document-attributes-expected.txt:
- platform/mac/accessibility/document-links-expected.txt:
- platform/mac/accessibility/image-link-expected.txt:
- platform/mac/accessibility/image-map2-expected.txt:
- platform/mac/accessibility/internal-link-anchors-expected.txt:
- platform/mac/accessibility/internal-link-anchors2-expected.txt:
- platform/mac/accessibility/lists-expected.txt:
- platform/mac/accessibility/plugin-expected.txt:
- platform/mac/accessibility/table-attributes-expected.txt:
- platform/mac/accessibility/table-cell-spans-expected.txt:
- platform/mac/accessibility/table-cells-expected.txt:
- platform/mac/accessibility/table-detection-expected.txt:
- platform/mac/accessibility/table-one-cell-expected.txt:
- platform/mac/accessibility/table-sections-expected.txt:
- platform/mac/accessibility/table-with-rules-expected.txt:
- platform/mac-mountainlion/accessibility/lists-expected.txt:
- 1:28 PM Changeset in webkit [171359] by
-
- 3 edits in trunk/Source/WebCore
Unreviewed, rolling out r171357.
https://bugs.webkit.org/show_bug.cgi?id=135173
broke Windows build. (Requested by bfulgham on #webkit).
Reverted changeset:
"[Win] Fix Crash when handling Legible Output callbacks"
https://bugs.webkit.org/show_bug.cgi?id=134946
http://trac.webkit.org/changeset/171357
- 1:22 PM Changeset in webkit [171358] by
-
- 3 edits in trunk/LayoutTests
[Mac] accessibility/aria-columnrowheaders.html doesn't test lengths of arrays
https://bugs.webkit.org/show_bug.cgi?id=135166
Reviewed by Chris Fleizach.
Using debug() interprets strings like "<array of size 0>" as markup, thereby not
showing it in the expected output. Instead, we should use innerText (which is
what all the other accessibility tests use).
- platform/mac/accessibility/aria-columnrowheaders-expected.txt:
- platform/mac/accessibility/aria-columnrowheaders.html:
- 1:00 PM Changeset in webkit [171357] by
-
- 3 edits in trunk/Source/WebCore
[Win] Fix Crash when handling Legible Output callbacks
https://bugs.webkit.org/show_bug.cgi?id=134946
Reviewed by Dean Jackson.
- platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
(WebCore::InbandTextTrackPrivateAVF::processNativeSamples): Remove
Windows-specific 'ASSERT_NOT_REACHED' code path.
- platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
(WebCore::createLegibleOutputSubtypes): Added.
(WebCore::AVFWrapper::createPlayerItem): Updated to request native
samples from AVFoundationCF.
- 12:58 PM Changeset in webkit [171356] by
-
- 9 edits in trunk/Source/WebKit2
Provide networking process with access to its HSTS db
https://bugs.webkit.org/show_bug.cgi?id=135121
<rdar://17654369>
Reviewed by Alexey Proskuryakov.
Add an extension parameter to pass the hsts database file.
This requires us to create the Caches/com.apple.WebKit.Networking
directory in the UI process, as the network sandbox
does not allow it to create the containing directory.
- NetworkProcess/cocoa/NetworkProcessCocoa.mm:
(WebKit::NetworkProcess::platformInitializeNetworkProcessCocoa):
- Shared/Network/NetworkProcessCreationParameters.cpp:
(WebKit::NetworkProcessCreationParameters::encode):
(WebKit::NetworkProcessCreationParameters::decode):
- Shared/Network/NetworkProcessCreationParameters.h:
- UIProcess/WebContext.cpp:
(WebKit::WebContext::ensureNetworkProcess):
(WebKit::WebContext::networkingHSTSDatabasePath):
- UIProcess/WebContext.h:
- UIProcess/mac/WebContextMac.mm:
(WebKit::WebContext::platformDefaultNetworkingHSTSDatabasePath):
- 12:48 PM Changeset in webkit [171355] by
-
- 7 edits1 add in trunk
[Cocoa] WKScriptMessageHandlers don't seem to function properly after navigating
https://bugs.webkit.org/show_bug.cgi?id=135148
Reviewed by Geoffrey Garen.
Source/JavaScriptCore:
- runtime/CommonIdentifiers.h:
Add a common identifier for the string "webkit".
Source/WebCore:
The "webkit" property on the window was not getting installed for subsequent
loads due to intricate dance playing setting the JSDOMWindow where the DOMWindow
object is not yet in a Frame when the JSDOMWindow is created. Since we were
adding the "webkit" property on construction, the property was returning null
thinking it had no Frame and was in a bad state. We can fix this by making the
"webkit" property behave like all the other window properties moving its getting
to JSDOMWindow::getOwnPropertySlot.
Added API test (WebKit2Cocoa/UserContentController).
- bindings/js/JSDOMWindowBase.cpp:
(WebCore::JSDOMWindowBase::finishCreation):
- bindings/js/JSDOMWindowCustom.cpp:
(WebCore::jsDOMWindowWebKit):
(WebCore::JSDOMWindow::getOwnPropertySlot):
Tools:
- TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
- TestWebKitAPI/Tests/WebKit2Cocoa/UserContentController.mm: Added.
(-[SimpleNavigationDelegate webView:didFinishNavigation:]):
(-[ScriptMessageHandler userContentController:didReceiveScriptMessage:]):
- 12:46 PM Changeset in webkit [171354] by
-
- 2 edits1 add in trunk/Source/JavaScriptCore
ASSERTION FAILED: info.spillFormat() & DataFormatJS in JSC::DFG::SpeculativeJIT::fillSpeculateCell
https://bugs.webkit.org/show_bug.cgi?id=135155
<rdar://problem/17763909>
Reviewed by Oliver Hunt.
The DFG fillSpeculate code paths all need to be mindful of the fact that they may be stumbling upon a
contradiction, and that this is OK. In this case, we were speculating cell on an int.
- dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
- tests/stress/regress-135155.js: Added.
(run.t.length):
(run):
- 12:36 PM Changeset in webkit [171353] by
-
- 2 edits in trunk/Source/WebCore
[Win] Fix Leak in WebCore::createGlobalImageFileDescriptor
https://bugs.webkit.org/show_bug.cgi?id=134423
<rdar://problem/17492758>
Reviewed by Geoffrey Garen.
- platform/win/PasteboardWin.cpp:
(WebCore::createGlobalImageFileDescriptor): Unlock and release the
HGLOBAL when exiting early.
- 12:25 PM Changeset in webkit [171352] by
-
- 3 edits in trunk/Source/WebKit2
[iOS][WK2] UI helpers that zoom on an element ignore the viewport's allowsUserScaling
https://bugs.webkit.org/show_bug.cgi?id=135140
<rdar://problem/17754921>
Patch by Benjamin Poulain <bpoulain@apple.com> on 2014-07-22
Reviewed by Tim Horton.
UIScrollView makes a difference between min/max zoom and allowUserScaling. To express that,
everything is set up on the LayerTransaction.
For zooming related helpers (find on page, double tap to zoom, etc), the min and max zoom
should be the actual min/max for the current page state.
This patch split the two explicitely.
For layer transactions, the values are taken from the viewport configuration directly.
For everything else, we should use minimumPageScaleFactor/maximumPageScaleFactor. Those two methods
have been updated to take into account allowsUserScaling.
- WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::willCommitLayerTree):
- WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::minimumPageScaleFactor):
(WebKit::WebPage::maximumPageScaleFactor):
(WebKit::WebPage::getAssistedNodeInformation):
- 11:35 AM Changeset in webkit [171351] by
-
- 4 edits in trunk
Correct handling of VERSION_TEXT for 4+-tuple versions
https://bugs.webkit.org/show_bug.cgi?id=135161
<rdar://problem/17763546>
Reviewed by David Kilzer.
Tools:
- Scripts/webkitperl/auto-version_unittest/autoVersionTests.pl:
Add additional test cases to catch errors in multiple-tuple
version string handling.
WebKitLibraries:
Revise the auto-version.pl script to properly handle version
strings with 4 (or more) version tuples. Previously these were
being truncated from the version.
- win/tools/scripts/auto-version.pl:
(splitVersion): Return truncated version of
overall version string.
- 11:27 AM Changeset in webkit [171350] by
-
- 9 edits2 adds in trunk
Extend exception fuzzing to the LLInt
https://bugs.webkit.org/show_bug.cgi?id=135076
Reviewed by Oliver Hunt.
Source/JavaScriptCore:
- CMakeLists.txt:
- JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
- JavaScriptCore.xcodeproj/project.pbxproj:
- jit/JITOperations.cpp:
(JSC::numberOfExceptionFuzzChecks): Deleted.
- llint/LLIntSlowPaths.cpp:
(JSC::LLInt::setUpCall):
- runtime/CommonSlowPaths.cpp:
- runtime/ExceptionFuzz.cpp: Added.
(JSC::numberOfExceptionFuzzChecks):
(JSC::doExceptionFuzzing):
- runtime/ExceptionFuzz.h: Added.
(JSC::doExceptionFuzzingIfEnabled):
Tools:
- Scripts/jsc-stress-test-helpers/js-exception-fuzz:
- 11:13 AM Changeset in webkit [171349] by
-
- 2 edits in trunk/Source/WebKit2
Web Inspector: Fix unused parameter build warning
https://bugs.webkit.org/show_bug.cgi?id=135151
Patch by Shivakumar JM <shiva.jm@samsung.com> on 2014-07-22
Reviewed by Joseph Pecoraro.
Fix unused parameter build warning by removing the parameter name
- WebProcess/WebPage/WebInspector.cpp:
(WebKit::WebInspector::setJavaScriptProfilingEnabled):
- 11:03 AM FeatureFlags edited by
- (diff)
- 11:01 AM Changeset in webkit [171348] by
-
- 1 edit2 adds in trunk/LayoutTests
[Mac] [WK2] selection-gap-fixed-child.html and selection-gap-flipped-fixed-child.html
have been failing since they were added in r148258
https://bugs.webkit.org/show_bug.cgi?id=114573
Landing actual results as expected for WK2. This test isn't meaningful for WK2, because of layers.
- platform/mac-wk2/TestExpectations:
- platform/mac-wk2/fast/repaint/selection-gap-fixed-child-expected.txt: Added.
- platform/mac-wk2/fast/repaint/selection-gap-flipped-fixed-child-expected.txt: Added.
- 11:00 AM FeatureFlags edited by
- (diff)
- 10:50 AM Changeset in webkit [171347] by
-
- 3 edits2 adds in trunk
Source/WebCore: Clicking on links while accessibility is enabled sometimes crashes
https://bugs.webkit.org/show_bug.cgi?id=135074
Reviewed by Chris Fleizach.
When an accessibility request comes in from the system, we call updateBackingStore() on the
relevant AccessibilityObject, which triggers a relayout of the entire document. This relayout
might delete that accessibility node and its parent, which would cause the node to be deleted.
After the stack unwinds, we then call a member function on the node without checking for this
condition.
Test: accessibility/parent-delete.html
- accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::updateBackingStore): Retain the node for the duration of the
function.
LayoutTests: Clicking on links while accessibility is enabled does not render as expected
https://bugs.webkit.org/show_bug.cgi?id=135074
Reviewed by Chris Fleizach.
Delete a node and its parent, then call allAttributes() on the accessibility representation of
the deleted child and make sure there is no crash.
- accessibility/parent-delete-expected.txt: Added
- accessibility/parent-delete.html: Added
- 10:32 AM Changeset in webkit [171346] by
-
- 2 edits in trunk/Source/WebKit2
Fix unused parameter build warning in UIProcess module
https://bugs.webkit.org/show_bug.cgi?id=135154
Patch by Shivakumar JM <shiva.jm@samsung.com> on 2014-07-22
Reviewed by Alexey Proskuryakov.
Fix unused parameter build warning in UIProcess module by using UNUSED_PARAM macro.
- UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::viewStateDidChange):
- 10:19 AM Changeset in webkit [171345] by
-
- 11 edits in trunk/Source
Don't create new UIWindow for video fullscreen.
https://bugs.webkit.org/show_bug.cgi?id=135038
Patch by Jeremy Jones <jeremyj@apple.com> on 2014-07-22
Reviewed by Darin Adler.
Source/WebCore:
- WebCore.exp.in:
- platform/ios/WebVideoFullscreenControllerAVKit.h: use UIView instead of UIScreen.
- platform/ios/WebVideoFullscreenControllerAVKit.mm:
(-[WebVideoFullscreenController enterFullscreen:]): provide parent UIView.
- platform/ios/WebVideoFullscreenInterfaceAVKit.h: remove UIWindow.
- platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
(WebVideoFullscreenInterfaceAVKit::setupFullscreen): ditto
(WebVideoFullscreenInterfaceAVKit::cleanupFullscreen): ditto
(WebVideoFullscreenInterfaceAVKit::invalidate): ditto
(WebVideoFullscreenInterfaceAVKit::requestHideAndExitFullscreen): ditto
Source/WebKit/mac:
Provide UIView to WebVideoFullscreenController
- WebView/WebView.mm:
(-[WebView _enterFullscreenForNode:]): pass UIView instead of nil
Source/WebKit2:
Use root UIView to parent fullscreen interface.
- UIProcess/ios/WebVideoFullscreenManagerProxy.mm:
(WebKit::WebVideoFullscreenManagerProxy::setupFullscreenWithID): pass parent UIView
- WebProcess/ios/WebVideoFullscreenManager.mm:
(WebKit::screenRectForNode): Use client rect instead of screen rect.
- 9:38 AM Changeset in webkit [171344] by
-
- 3 edits in trunk/LayoutTests
media/track/track-in-band-subtitles-too-large.html and
media/track/track-long-word-container-sizing.html fail on Mac (dependent on other tests?)
https://bugs.webkit.org/show_bug.cgi?id=135160
Correcting test expectations - the failures are not WK1 only.
- platform/mac-wk1/TestExpectations:
- platform/mac/TestExpectations:
- 8:02 AM Changeset in webkit [171343] by
-
- 2 edits in trunk/Source/WebCore
[GTK] Rollout r170529 due to ~10% performance regression on the
perf test Animation/balls.
https://bugs.webkit.org/show_bug.cgi?id=134972
Reviewed by Martin Robinson.
Reverted changeset:
"Increase priority on SharedTimer source."
https://trac.webkit.org/r170529
- 6:47 AM Changeset in webkit [171342] by
-
- 2 edits in trunk/LayoutTests
Unreviewed EFL gardening
- platform/efl/TestExpectations: Update incorrect test expectations for passing and crashing tests.
- 6:27 AM Changeset in webkit [171341] by
-
- 39 edits6 adds in trunk
Turn width/height to presentation attributes
https://bugs.webkit.org/show_bug.cgi?id=135046
Patch by Dirk Schulze <krit@webkit.org> on 2014-07-18
Reviewed by Dean Jackson.
Source/WebCore:
The elements <svg>, <image>, <pattern>, <mask> and <foreignObject> have the
'width' and 'height' attributes. So far they can just be set by SVG DOM or
setAttribute. Furthermore, animations just work with SVG Animation - No support
for CSS Animations and CSS Transitions. We started to turn the width and height
attributes on SVG roots to presentation attributes already. A presentation
attribute is a CSS property that can also be set by DOM (or now by SVG DOM).
This patch turns all width and height attributes to presentation attributes. It
basically allows authors to style width and height with CSS as well. Width and
height can now be set with CSS style sheets and can be animated with CSS.
To some degree it made it possible to remove code duplication. However, since
SVG DOM requires us to use SVGLength types and since we did not turn all
SVG attributes to the CSS length values (and our internal Length struct) yet,
we still need a hybrid - a bridge between SVGLength (for SVG DOM) and Length (for
RenderStyle). Once we move all attributes to use the Length struct, we can make SVGLength
a wrapper for Length and can move more code to the render tree.
The current challenge is to synchronize SVG DOM, normal DOM and RenderStyle.
With this patch we handle most part in RenderStyle. SVG DOM changes are
synchronized to DOM and RenderStyle will call needsStyleRecalc. Furthermore,
SVG Animations will continue to animate the SVG DOM (and synchronize the changes
back to RenderStyle) if the element has a JS property for the currently animated
attribute.
Short example:
<rect>
<animate attributeName="width">
</rect>
The <rect> element has the SVG DOM property 'width'. Therefore, we animate the SVG DOM
property and synchronize RenderStyle.
<ellipse>
<animate attributeName="width">
</ellipse>
The <ellipse> element does NOT have the SVG DOM property 'width'. Therefore, we
animate the CSS property directly. With synchronizing RenderStyle in all cases, we
make sure that the CSS cascade works even on animating on multiple SVG hierarchy
levels (animation of 'width' on <g> and inheriting the property value on a child
<rect>).
With using presentation attributes, we also inherit the CSS property parsing for
SVG attributes. <rect width=" 100px "> is possible now. (Note the trailing whitespaces.)
This follows a recent resolution of the SVG WG.
Since we turned width and height to presentation attributes, the layout optimization
selfHasRelativeLengths() in the DOM can't be used anymore. selfHasRelativeLengths() was
intended to solve a problem where we did not layout relatively position/sized elements
when the parent changes its size. However, as a side effect it did not call layout
for absolutely positioned/sized elements since the layout does not change. I run
all performance tests that we have and even wrote a test with hundreds of elements
that would be affected by this optimization. The differences were inside the sigma
of a normal test run. (Means I couldn't measure a performance difference.)
Therefore, it is not worth it to keep the "optimization" around and I will probably
remove it entirely for all basic shapes but <path> and <polygon> in future patches.
Tests: svg/css/parse-height.html
svg/css/parse-width.html
svg/css/width-height-presentation-attribute-expected.svg
svg/css/width-height-presentation-attribute.svg
- css/CSSComputedStyleDeclaration.cpp:
(WebCore::ComputedStyleExtractor::propertyValue): We never calculated the computed
value of width/height for SVG elements and returned auto instead. This is based
on a rule of CSS 2 and needs to be fixed in CSS3.
- css/DeprecatedStyleBuilder.cpp:
(WebCore::ApplyPropertyLength::applyValue): Length always incorporates the zoom level.
In SVG we still apply the zoom after all operations by scaling the context. We need
to take this in account for Length and don't apply zoom on SVG inline elements.
- css/StyleResolver.cpp:
(WebCore::StyleResolver::useSVGZoomRulesForLength):
See above.
- css/StyleResolver.h:
- rendering/svg/RenderSVGRect.cpp:
(WebCore::RenderSVGRect::updateShapeFromElement): Do not call width() and height() on
SVG DOM but use the values of RenderStyle instead.
- rendering/svg/SVGPathData.cpp:
(WebCore::updatePathFromRectElement): Ditto.
- svg/SVGAnimateElement.cpp:
(WebCore::SVGAnimateElement::resetAnimatedType): We need to differ between CSS properties
with and without SVG DOM on the current element. In the later case we animate the
SVG DOM and need to synch RenderStyle.
(WebCore::SVGAnimateElement::clearAnimatedType): Ditto.
(WebCore::SVGAnimateElement::applyResultsToTarget): Ditto.
- svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::isTargetAttributeCSSProperty): This checks if the CSS property
has to be synched with SVG DOM.
(WebCore::SVGAnimationElement::shouldApplyAnimation): Ditto.
- svg/SVGAnimationElement.h:
- svg/SVGElement.cpp:
(WebCore::populateAttributeNameToCSSPropertyIDMap): Add width and heigth to the CSS property
list for presentation attributes.
(WebCore::populateCSSPropertyWithSVGDOMNameToAnimatedPropertyTypeMap): CSS properties with
SVG DOM synchronization need to be treated differently. Collect them in a separate map.
(WebCore::cssPropertyWithSVGDOMNameToAnimatedPropertyTypeMap): Caller for the map.
(WebCore::SVGElement::animatedPropertyTypeForAttribute): We need to check both maps here:
CSS properties and CSS properties with SVG DOM synch.
(WebCore::SVGElement::isAnimatableCSSProperty): Ditto.
(WebCore::SVGElement::isPresentationAttributeWithSVGDOM): Just return true if the property name
is in the map of properties with SVG DOM for the current element.
- svg/SVGElement.h:
(WebCore::SVGElement::invalidateSVGPresentationAttributeStyle): Call needsStyleRecalc.
- svg/SVGFilterElement.cpp: Make width/height presentation attribute.
(WebCore::SVGFilterElement::svgAttributeChanged):
(WebCore::SVGFilterElement::selfHasRelativeLengths): Deleted.
- svg/SVGFilterElement.h: Ditto.
- svg/SVGForeignObjectElement.cpp:
(WebCore::SVGForeignObjectElement::svgAttributeChanged):
(WebCore::SVGForeignObjectElement::selfHasRelativeLengths): Deleted.
- svg/SVGForeignObjectElement.h:
- svg/SVGImageElement.cpp: Ditto.
(WebCore::SVGImageElement::svgAttributeChanged):
(WebCore::SVGImageElement::isPresentationAttribute): Deleted.
(WebCore::SVGImageElement::collectStyleForPresentationAttribute): Deleted.
(WebCore::SVGImageElement::selfHasRelativeLengths): Deleted.
- svg/SVGImageElement.h:
- svg/SVGLength.h: Transform an Length value to an absolute value by taking the SVG viewport
into account. (An SVG viewport is not the same as the CSS viewport.)
- svg/SVGLengthContext.cpp: Ditto.
(WebCore::SVGLengthContext::valueForLength):
- svg/SVGLengthContext.h:
- svg/SVGMaskElement.cpp: Make width/height presentation attribute.
(WebCore::SVGMaskElement::svgAttributeChanged):
(WebCore::SVGMaskElement::selfHasRelativeLengths): Deleted.
- svg/SVGMaskElement.h:
- svg/SVGPatternElement.cpp: Ditto.
(WebCore::SVGPatternElement::svgAttributeChanged):
(WebCore::SVGPatternElement::selfHasRelativeLengths): Deleted.
- svg/SVGPatternElement.h:
- svg/SVGRectElement.cpp: Ditto.
(WebCore::SVGRectElement::svgAttributeChanged):
(WebCore::SVGRectElement::selfHasRelativeLengths): Deleted.
- svg/SVGRectElement.h:
- svg/SVGSVGElement.cpp: Ditto.
(WebCore::SVGSVGElement::svgAttributeChanged): Clean up redundant layout calls.
(WebCore::SVGSVGElement::isPresentationAttribute): Deleted.
(WebCore::SVGSVGElement::collectStyleForPresentationAttribute): Deleted.
- svg/SVGSVGElement.h:
- svg/properties/SVGAnimatedProperty.cpp: Synchronize SVG DOM with DOM.
(WebCore::SVGAnimatedProperty::commitChange):
LayoutTests:
We already had a lot of tests for animating width/height as property.
So far they assumed that this is not possible. They simply needed to
be updated.
Furthermore, I added reference tests to test different inheritance
scenarios of CSS properties and setting them to elements.
A parsing test makes sure that the global property values inherit is
supported as well as CSS parsing rules for SVG attributes.
Negative tests test not-allowed behavior.
- platform/mac/svg/W3C-SVG-1.1/coords-units-03-b-expected.txt:
- svg/animations/attributeTypes-expected.txt:
- svg/animations/resources/attributeTypes.svg:
- svg/animations/script-tests/attributeTypes.js:
(sample1):
(sample2):
(sample3):
- svg/css/getComputedStyle-basic-expected.txt:
- svg/css/parse-height-expected.txt: Added.
- svg/css/parse-height.html: Added.
- svg/css/parse-width-expected.txt: Added.
- svg/css/parse-width.html: Added.
- svg/css/width-height-presentation-attribute-expected.svg: Added.
- svg/css/width-height-presentation-attribute.svg: Added.
- svg/custom/mask-excessive-malloc-expected.txt:
- svg/hixie/error/015-expected.txt:
- 2:48 AM Changeset in webkit [171340] by
-
- 2 edits in trunk/Tools
Fix my email address in contributors.json
https://bugs.webkit.org/show_bug.cgi?id=135156
Reviewed by Gyuyoung Kim.
- Scripts/webkitpy/common/config/contributors.json:
- 1:50 AM Changeset in webkit [171339] by
-
- 5 edits in trunk
[GStreamer] [GTK] WebKit does not build with GStreamer 1.4
https://bugs.webkit.org/show_bug.cgi?id=135114
.:
Fix build with GStreamer 1.4
Patch by Adrian Perez de Castro <Adrian Perez de Castro> on 2014-07-22
Reviewed by Philippe Normand.
- Source/cmake/FindGStreamer.cmake: Check version 1.4.0 for the
gst-mpegts component instead of the unstable 1.3.x verstions.
Source/WebCore:
Patch by Adrian Perez de Castro <Adrian Perez de Castro> on 2014-07-22
Reviewed by Philippe Normand.
Fix build with GStreamer 1.4
- platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
Change GstMpegTs-prefixed types to use the GstMpegts prefix.
(WebCore::MediaPlayerPrivateGStreamer::handleMessage):
(WebCore::MediaPlayerPrivateGStreamer::processMpegTsSection):
- platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
Ditto.
