Timeline
Mar 1, 2016:
- 11:53 PM Changeset in webkit [197445] by
-
- 2 edits1 add in trunk/Source/JavaScriptCore
[JSC] Simplify ArithMod(ArithMod(x, const1), const2) if const2 >= const1
https://bugs.webkit.org/show_bug.cgi?id=154904
Reviewed by Saam Barati.
The ASM test "ubench" has a "x % 10 % 255".
The second modulo should be eliminated.
This is a 15% improvement on ASMJS' ubench.
- dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
- tests/stress/arith-modulo-twice.js: Added.
(opaqueModuloSmaller):
(opaqueModuloEqual):
(opaqueModuloLarger):
(opaqueModuloSmallerNeg):
(opaqueModuloEqualNeg):
(opaqueModuloLargerNeg):
(opaqueExpectedOther):
- 11:12 PM Changeset in webkit [197444] by
-
- 2 edits in trunk/Source/JavaScriptCore
Unreviewed. Update the status of Proxy objects to "In Development".
- features.json:
- 11:06 PM Changeset in webkit [197443] by
-
- 2 edits in trunk/Source/WebCore
Unreviewed. Remove the "Partial Support" status from web components since shadow DOM and custom elements
are in active development.
- features.json:
- 10:58 PM Changeset in webkit [197442] by
-
- 2 edits in trunk/Tools
Disable FTL JIT testing on 32-bit JSC tester bots
https://bugs.webkit.org/show_bug.cgi?id=154858
Reviewed by Saam Barati.
- BuildSlaveSupport/build.webkit.org-config/master.cfg:
(Run32bitJSCTests):
- 10:56 PM Changeset in webkit [197441] by
-
- 10 edits1 add in trunk/Source
Unreviewed, rolling out r197226 and r197256.
https://bugs.webkit.org/show_bug.cgi?id=154910
Caused crashes on Mac 32-bit and on ARM (Requested by ap on
#webkit).
Reverted changesets:
"Remove the on demand executable allocator"
https://bugs.webkit.org/show_bug.cgi?id=154749
http://trac.webkit.org/changeset/197226
"CLoop build fix."
http://trac.webkit.org/changeset/197256
- 10:53 PM Changeset in webkit [197440] by
-
- 2 edits in trunk/Source/WebCore
Unreviewed. Update the feature status for custom elements API.
- features.json:
- 9:31 PM Changeset in webkit [197439] by
-
- 6 edits2 adds in trunk
Contents inside a shadow host with a negative tabindex should not be tab focusable
https://bugs.webkit.org/show_bug.cgi?id=154769
Reviewed by Antti Koivisto.
Source/WebCore:
Contents inside a shadow host with a negative tabindex content attribute should not be included in
the sequential focus navigation order as discussed on https://github.com/w3c/webcomponents/issues/399.
Test: fast/shadow-dom/negative-tabindex-on-shadow-host.html
- dom/Element.cpp:
(WebCore::Element::tabIndexSetExplicitly): Added.
- dom/Element.h:
- page/FocusController.cpp:
(WebCore::shadowAdjustedTabIndex): Renamed from adjustedTabIndex. Return 0 when tabindex content attribute
is not explicitly set since element.tabIndex() would return -1 for HTML elements in such case.
(WebCore::isFocusableOrHasShadowTreeWithoutCustomFocusLogic): Renamed from shouldVisit.
(WebCore::FocusController::findElementWithExactTabIndex):
(WebCore::nextElementWithGreaterTabIndex):
(WebCore::previousElementWithLowerTabIndex):
(WebCore::FocusController::nextFocusableElement):
(WebCore::FocusController::previousFocusableElement):
LayoutTests:
Added a test for navigating across shadow boundaries.
- fast/shadow-dom/negative-tabindex-on-shadow-host-expected.txt: Added.
- fast/shadow-dom/negative-tabindex-on-shadow-host.html: Added.
- platform/ios-simulator/TestExpectations:
- 8:30 PM Changeset in webkit [197438] by
-
- 3 edits in trunk/Source/JavaScriptCore
Simplify some StringBuilder appends
https://bugs.webkit.org/show_bug.cgi?id=154902
Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-03-01
Reviewed by Mark Lam.
- runtime/ExceptionHelpers.cpp:
(JSC::notAFunctionSourceAppender):
- runtime/SamplingProfiler.cpp:
(JSC::SamplingProfiler::stackTracesAsJSON):
Use StringBuilder::append(char) instead of append(char*) where possible.
- 7:22 PM Changeset in webkit [197437] by
-
- 2 edits in trunk/Source/WebCore
REGRESSION (r197426): Missed adding unicode parameter to call to Yarr::parse() in URLFilterParser::addPattern()
https://bugs.webkit.org/show_bug.cgi?id=154898
Reviewed by Saam Barati.
This is a fix for the API tests after r197426.
Added missing bool unicode parameter of "false".
- contentextensions/URLFilterParser.cpp:
(WebCore::ContentExtensions::URLFilterParser::addPattern):
- 6:53 PM Changeset in webkit [197436] by
-
- 2 edits in trunk/Source/WebCore
Unreviewed build fix after r197434.
Unreviewed
- css/SourceSizeList.cpp:
(WebCore::parseSizesAttribute):
- 6:50 PM Changeset in webkit [197435] by
-
- 3 edits2 adds2 deletes in trunk
Small-caps non-BMP characters are garbled in the complex text codepath
https://bugs.webkit.org/show_bug.cgi?id=154875
Reviewed by Michael Saboff.
Source/WebCore:
We were assuming that all characters able to be capitalized are in BMP. This is not true.
Test: fast/text/complex-small-caps-non-bmp-capitalize.html
- platform/graphics/mac/ComplexTextController.cpp:
(WebCore::capitalized):
(WebCore::ComplexTextController::collectComplexTextRuns):
LayoutTests:
- fast/text/complex-small-caps-non-bmp-capitalize-expected.html: Added.
- fast/text/complex-small-caps-non-bmp-capitalize.html: Added.
- fast/text/regress-154875-expected.txt: Deleted
- fast/text/regress-154875.html: Deleted
- 6:34 PM Changeset in webkit [197434] by
-
- 10 edits in trunk/Source/WebCore
Extend CSSFontSelector's lifetime to be longer than the Document's lifetime
https://bugs.webkit.org/show_bug.cgi?id=154101
Reviewed by Darin Adler.
Rather than destroying the Document's CSSFontSelector, instead, the object should
live for the lifetime of the document, and it should instead be asked to clear its
contents.
This is important for the CSS Font Loading API, where the identity of objects the
CSSFontSelector references needs to persist throughout the lifetime of the
Document. This patch represents the first step to implementing this correctly.
The second step is for the CSSFontSelector to perform a diff instead of a
wholesale clear of its contents. Once this is done, font loading objects can
survive through a call to Document::clearStyleResolver().
This patch gives the CSSFontSelector two states: building underway and building not
underway. The state is building underway in between calls to clearStyleResolver()
and when the style resolver gets built back up. Otherwise, the state is building
not underway. Because of this new design, creation of all FontFace objects can be
postponed until a state transition from building underway to building not underway.
A subsequent patch will perform the diff at this point. An ASSERT() makes sure that
we never service a font lookup request while Building.
No new tests because there is no behavior change.
- css/CSSFontFaceSet.cpp:
(WebCore::CSSFontFaceSet::clear):
- css/CSSFontSelector.cpp:
(WebCore::CSSFontSelector::buildStarted):
(WebCore::CSSFontSelector::buildCompleted):
(WebCore::CSSFontSelector::addFontFaceRule):
(WebCore::CSSFontSelector::fontRangesForFamily):
(WebCore::CSSFontSelector::CSSFontSelector): Deleted.
(WebCore::CSSFontSelector::clearDocument): Deleted.
- css/CSSFontSelector.h:
- css/StyleResolver.cpp:
(WebCore::StyleResolver::appendAuthorStyleSheets):
- dom/Document.cpp:
(WebCore::Document::Document):
(WebCore::Document::~Document):
(WebCore::Document::clearStyleResolver):
(WebCore::Document::fontSelector): Deleted.
- dom/Document.h:
(WebCore::Document::fontSelector):
- 6:28 PM Changeset in webkit [197433] by
-
- 3 edits in trunk/Source/WebCore
Update Xcode project for InstallAPI
https://bugs.webkit.org/show_bug.cgi?id=154896
rdar://problem/24825992
Patch by Daniel Dunbar, reviewed by me.
- Configurations/WebCore.xcconfig:
- WebCore.xcodeproj/project.pbxproj:
- 6:16 PM Changeset in webkit [197432] by
-
- 2 edits in trunk/Source/WebCore
One more attempt to fix the build.
- platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
(WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):
- 6:07 PM Changeset in webkit [197431] by
-
- 2 edits in trunk/Source/WebCore
Attempt to fix the internal build.
- platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
(WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):
- 5:43 PM Changeset in webkit [197430] by
-
- 2 edits in trunk/Tools
Fix iOS EWS.
https://bugs.webkit.org/show_bug.cgi?id=154880
Patch by Dean Johnson <dean_johnson@apple.com> on 2016-03-01
Reviewed by Alexey Proskuryakov.
- Scripts/copy-webkitlibraries-to-product-directory:
- 5:15 PM Changeset in webkit [197429] by
-
- 39 edits in trunk/Source
Adopt the new version of AVOutputDeviceMenuController's showMenuForRect method.
https://bugs.webkit.org/show_bug.cgi?id=154823
Reviewed by Tim Horton.
Source/WebCore:
- Modules/mediasession/WebMediaSessionManager.cpp:
(WebCore::WebMediaSessionManager::showPlaybackTargetPicker):
(WebCore::WebMediaSessionManager::customPlaybackActionSelected):
Call customPlaybackActionSelected() on the client that requested the picker.
- Modules/mediasession/WebMediaSessionManager.h:
- Modules/mediasession/WebMediaSessionManagerClient.h:
- dom/Document.cpp:
(WebCore::Document::showPlaybackTargetPicker):
(WebCore::Document::customPlaybackActionSelected):
- dom/Document.h:
- html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::customPlaybackActionSelected):
(WebCore::HTMLMediaElement::playbackTargetPickerCustomActionName):
- html/HTMLMediaElement.h:
- html/MediaElementSession.cpp:
(WebCore::MediaElementSession::showPlaybackTargetPicker):
(WebCore::MediaElementSession::customPlaybackActionSelected):
- html/MediaElementSession.h:
- page/ChromeClient.h:
- page/Page.cpp:
(WebCore::Page::showPlaybackTargetPicker):
(WebCore::Page::customPlaybackActionSelected):
- page/Page.h:
- platform/audio/PlatformMediaSession.h:
(WebCore::PlatformMediaSessionClient::customPlaybackActionSelected):
- platform/graphics/MediaPlaybackTargetClient.h:
- platform/graphics/MediaPlaybackTargetPicker.cpp:
(WebCore::MediaPlaybackTargetPicker::pendingActionTimerFired):
(WebCore::MediaPlaybackTargetPicker::showPlaybackTargetPicker):
- platform/graphics/MediaPlaybackTargetPicker.h:
(WebCore::MediaPlaybackTargetPicker::Client::customPlaybackActionSelected):
(WebCore::MediaPlaybackTargetPicker::customPlaybackActionSelected):
- platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.h:
- platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
Update the forward declaration of AVOutputDeviceMenuController's showMenuForRect method.
(WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):
Call the new version of showMenuForRect if available.
- platform/mac/WebVideoFullscreenInterfaceMac.h:
- platform/mac/WebVideoFullscreenInterfaceMac.mm:
(WebCore::WebVideoFullscreenInterfaceMac::setExternalPlayback):
- platform/mock/MediaPlaybackTargetPickerMock.cpp:
(WebCore::MediaPlaybackTargetPickerMock::showPlaybackTargetPicker):
- platform/mock/MediaPlaybackTargetPickerMock.h:
- platform/spi/cocoa/AVKitSPI.h:
Updated with the new version of showMenuForRect.
Source/WebKit/mac:
- WebCoreSupport/WebChromeClient.h:
- WebCoreSupport/WebChromeClient.mm:
(WebChromeClient::showPlaybackTargetPicker):
- WebView/WebMediaPlaybackTargetPicker.h:
- WebView/WebMediaPlaybackTargetPicker.mm:
(WebMediaPlaybackTargetPicker::showPlaybackTargetPicker):
(WebMediaPlaybackTargetPicker::customPlaybackActionSelected):
- WebView/WebView.mm:
(-[WebView _showPlaybackTargetPicker:location:hasVideo:]):
Source/WebKit2:
- UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::showPlaybackTargetPicker):
(WebKit::WebPageProxy::customPlaybackActionSelected):
- UIProcess/WebPageProxy.h:
- UIProcess/WebPageProxy.messages.in:
- WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::showPlaybackTargetPicker):
- WebProcess/WebCoreSupport/WebChromeClient.h:
- WebProcess/WebPage/WebPage.h:
- WebProcess/WebPage/WebPage.messages.in:
- WebProcess/WebPage/mac/WebPageMac.mm:
(WebKit::WebPage::customPlaybackActionSelected):
- 5:08 PM Changeset in webkit [197428] by
-
- 2 edits1 add in trunk/Source/JavaScriptCore
Promise.prototype.then should use Symbol.species to construct the return Promise
https://bugs.webkit.org/show_bug.cgi?id=154862
Reviewed by Saam Barati.
- builtins/PromisePrototype.js:
- tests/stress/promise-species-functions.js: Added.
(Symbol.species):
(id):
(funcThrows):
(makeC):
(test.species):
(test.speciesThrows):
(test):
- 5:02 PM Changeset in webkit [197427] by
-
- 5 edits in trunk/Source/WebKit2
[WK2] Stub support for WebsiteDataTypeResourceLoadStatistics
https://bugs.webkit.org/show_bug.cgi?id=154689
<rdar://problem/24702576>
Reviewed by Sam Weinig.
- Shared/WebsiteData/WebsiteDataType.h: Add new WebsiteDataTypeResourceLoadStatistics.
- UIProcess/API/Cocoa/WKWebsiteDataRecord.mm:
(dataTypesToString): Handle new type.
- UIProcess/API/Cocoa/WKWebsiteDataRecordInternal.h:
(WebKit::toWebsiteDataTypes): Ditto.
(WebKit::toWKWebsiteDataTypes): Ditto.
- UIProcess/API/Cocoa/WKWebsiteDataRecordPrivate.h: Add new _WebsiteDataTypeResourceLoadStatistics.
- 4:39 PM Changeset in webkit [197426] by
-
- 27 edits3 moves3 adds in trunk
[ES6] Add support for Unicode regular expressions
https://bugs.webkit.org/show_bug.cgi?id=154842
Reviewed by Filip Pizlo.
Source/JavaScriptCore:
Added processing of Unicode regular expressions to the Yarr interpreter.
Changed parsing of regular expression patterns and PatternTerms to process characters as
UChar32 in the Yarr code. The parser converts matched surrogate pairs into the appropriate
Unicode character when the expression is parsed. When matching a unicode expression and
reading source characters, we convert proper surrogate pair into a Unicode character and
advance the source cursor, "pos", one more position. The exception to this is when we
know when generating a fixed character atom that we need to match a unicode character
that doesn't fit in 16 bits. The code calls this an extendedUnicodeCharacter and has a
helper to determine this.
Added 'u' flag and 'unicode' identifier to regular expression classes. Added an "isUnicode"
parameter to YarrPattern pattern() and internal users of that function.
Updated the generation of the canonicalization tables to include a new set a tables that
follow the ES 6.0, 21.2.2.8.2 Step 2. Renamed the YarrCanonicalizeUCS2.* files to
YarrCanonicalizeUnicode.*.
Added a new Layout/js test that tests the added functionality. Updated other tests that
have minor es6 unicode checks and look for valid flags.
Ran the ChakraCore Unicode regular expression tests as well.
- CMakeLists.txt:
- JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
- JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
- JavaScriptCore.xcodeproj/project.pbxproj:
- inspector/ContentSearchUtilities.cpp:
(Inspector::ContentSearchUtilities::findMagicComment):
- yarr/RegularExpression.cpp:
(JSC::Yarr::RegularExpression::Private::compile):
Updated use of pattern().
- runtime/CommonIdentifiers.h:
- runtime/RegExp.cpp:
(JSC::regExpFlags):
(JSC::RegExpFunctionalTestCollector::outputOneTest):
(JSC::RegExp::finishCreation):
(JSC::RegExp::compile):
(JSC::RegExp::compileMatchOnly):
- runtime/RegExp.h:
- runtime/RegExpKey.h:
- runtime/RegExpPrototype.cpp:
(JSC::regExpProtoFuncCompile):
(JSC::flagsString):
(JSC::regExpProtoGetterMultiline):
(JSC::regExpProtoGetterUnicode):
(JSC::regExpProtoGetterFlags):
Updated for new 'y' (unicode) flag. Add check to use the interpreter for unicode regular expressions.
- tests/es6.yaml:
- tests/stress/static-getter-in-names.js:
Updated tests for new flag and for passing the minimal es6 regular expression processing.
- yarr/Yarr.h: Updated the size of information now kept for backtracking.
- yarr/YarrCanonicalizeUCS2.cpp: Removed.
- yarr/YarrCanonicalizeUCS2.h: Removed.
- yarr/YarrCanonicalizeUCS2.js: Removed.
- yarr/YarrCanonicalizeUnicode.cpp: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUCS2.cpp.
- yarr/YarrCanonicalizeUnicode.h: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUCS2.h.
(JSC::Yarr::canonicalCharacterSetInfo):
(JSC::Yarr::canonicalRangeInfoFor):
(JSC::Yarr::getCanonicalPair):
(JSC::Yarr::isCanonicallyUnique):
(JSC::Yarr::areCanonicallyEquivalent):
(JSC::Yarr::rangeInfoFor): Deleted.
- yarr/YarrCanonicalizeUnicode.js: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUCS2.js.
(printHeader):
(printFooter):
(hex):
(canonicalize):
(canonicalizeUnicode):
(createUCS2CanonicalGroups):
(createUnicodeCanonicalGroups):
(cu.in.groupedCanonically.characters.sort): Deleted.
(cu.in.groupedCanonically.else): Deleted.
Refactored to output two sets of tables, one for UCS2 and one for Unicode. The UCS2 tables follow
the legacy canonicalization rules now specified in ES 6.0, 21.2.2.8.2 Step 3. The new Unicode
tables follow the rules specified in ES 6.0, 21.2.2.8.2 Step 2. Eliminated the unused Latin1 tables.
- yarr/YarrInterpreter.cpp:
(JSC::Yarr::Interpreter::InputStream::InputStream):
(JSC::Yarr::Interpreter::InputStream::readChecked):
(JSC::Yarr::Interpreter::InputStream::readSurrogatePairChecked):
(JSC::Yarr::Interpreter::InputStream::reread):
(JSC::Yarr::Interpreter::InputStream::prev):
(JSC::Yarr::Interpreter::testCharacterClass):
(JSC::Yarr::Interpreter::checkCharacter):
(JSC::Yarr::Interpreter::checkSurrogatePair):
(JSC::Yarr::Interpreter::checkCasedCharacter):
(JSC::Yarr::Interpreter::tryConsumeBackReference):
(JSC::Yarr::Interpreter::backtrackPatternCharacter):
(JSC::Yarr::Interpreter::matchCharacterClass):
(JSC::Yarr::Interpreter::backtrackCharacterClass):
(JSC::Yarr::Interpreter::matchParenthesesTerminalEnd):
(JSC::Yarr::Interpreter::matchDisjunction):
(JSC::Yarr::Interpreter::Interpreter):
(JSC::Yarr::ByteCompiler::assertionWordBoundary):
(JSC::Yarr::ByteCompiler::atomPatternCharacter):
- yarr/YarrInterpreter.h:
(JSC::Yarr::ByteTerm::ByteTerm):
(JSC::Yarr::BytecodePattern::BytecodePattern):
- yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::optimizeAlternative):
(JSC::Yarr::YarrGenerator::matchCharacterClassRange):
(JSC::Yarr::YarrGenerator::matchCharacterClass):
(JSC::Yarr::YarrGenerator::notAtEndOfInput):
(JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
(JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
(JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
(JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
(JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
- yarr/YarrParser.h:
(JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
(JSC::Yarr::Parser::Parser):
(JSC::Yarr::Parser::parseEscape):
(JSC::Yarr::Parser::consumePossibleSurrogatePair):
(JSC::Yarr::Parser::parseCharacterClass):
(JSC::Yarr::Parser::parseTokens):
(JSC::Yarr::Parser::parse):
(JSC::Yarr::Parser::atEndOfPattern):
(JSC::Yarr::Parser::patternRemaining):
(JSC::Yarr::Parser::peek):
(JSC::Yarr::parse):
- yarr/YarrPattern.cpp:
(JSC::Yarr::CharacterClassConstructor::CharacterClassConstructor):
(JSC::Yarr::CharacterClassConstructor::append):
(JSC::Yarr::CharacterClassConstructor::putChar):
(JSC::Yarr::CharacterClassConstructor::putUnicodeIgnoreCase):
(JSC::Yarr::CharacterClassConstructor::putRange):
(JSC::Yarr::CharacterClassConstructor::charClass):
(JSC::Yarr::CharacterClassConstructor::addSorted):
(JSC::Yarr::CharacterClassConstructor::addSortedRange):
(JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
(JSC::Yarr::YarrPatternConstructor::assertionWordBoundary):
(JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
(JSC::Yarr::YarrPatternConstructor::atomCharacterClassBegin):
(JSC::Yarr::YarrPatternConstructor::atomCharacterClassAtom):
(JSC::Yarr::YarrPatternConstructor::atomCharacterClassRange):
(JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):
(JSC::Yarr::YarrPattern::compile):
(JSC::Yarr::YarrPattern::YarrPattern):
- yarr/YarrPattern.h:
(JSC::Yarr::CharacterRange::CharacterRange):
(JSC::Yarr::CharacterClass::CharacterClass):
(JSC::Yarr::PatternTerm::PatternTerm):
(JSC::Yarr::YarrPattern::reset):
- yarr/YarrSyntaxChecker.cpp:
(JSC::Yarr::SyntaxChecker::assertionBOL):
(JSC::Yarr::SyntaxChecker::assertionEOL):
(JSC::Yarr::SyntaxChecker::assertionWordBoundary):
(JSC::Yarr::SyntaxChecker::atomPatternCharacter):
(JSC::Yarr::SyntaxChecker::atomBuiltInCharacterClass):
(JSC::Yarr::SyntaxChecker::atomCharacterClassBegin):
(JSC::Yarr::SyntaxChecker::atomCharacterClassAtom):
(JSC::Yarr::checkSyntax):
LayoutTests:
Added a new test for the added unicode regular expression processing.
Updated several tests for the y flag changes and "unicode" property.
- js/regexp-unicode-expected.txt: Added.
- js/regexp-unicode.html: Added.
- js/script-tests/regexp-unicode.js: Added.
New test.
- js/Object-getOwnPropertyNames-expected.txt:
- js/regexp-flags-expected.txt:
- js/script-tests/Object-getOwnPropertyNames.js:
- js/script-tests/regexp-flags.js:
(RegExp.prototype.hasOwnProperty):
Updated tests.
- 4:31 PM Changeset in webkit [197425] by
-
- 2 edits in trunk/LayoutTests
Marking fast/text/crash-complex-text-surrogate.html as flaky on mac
https://bugs.webkit.org/show_bug.cgi?id=154709
Unreviewed test gardening.
- platform/mac/TestExpectations:
- 4:01 PM Changeset in webkit [197424] by
-
- 2 edits in trunk/Source/WebCore
com.apple.WebKit.Networking.Development crashes in WebCore::formOpen()
https://bugs.webkit.org/show_bug.cgi?id=154682
<rdar://problem/23550269>
Reviewed by Brent Fulgham.
Speculative fix for a race condition when opening the stream for the next form data element.
Calling CFReadStreamOpen(s) in WebCore::openNextStream() can cause stream s to be closed and
deallocated before CFReadStreamOpen(s) returns.
When WebCore::openNextStream() is called it closes and deallocates the current stream and
then opens a new stream for the next form data element. Calling CFReadStreamOpen() in
WebCore::openNextStream() can lead to WebCore::openNextStream() being re-entered via
WebCore::formEventCallback() from another thread. One example when this can occur is when
the stream being opened has no data (i.e. WebCore::formEventCallback() is called
back with event type kCFStreamEventEndEncountered).
I have been unable to reproduce this crash. We know that it occurs from crash reports.
- platform/network/cf/FormDataStreamCFNet.cpp:
(WebCore::closeCurrentStream): Assert that we had acquired a lock to close the stream.
(WebCore::advanceCurrentStream): Assert that we had acquired a lock to advance the stream.
(WebCore::openNextStream): Acquire a lock before we open the next stream to ensure that
exactly one thread executes this critical section at a time.
(WebCore::formFinalize): Acquire a lock before we close the current stream.
(WebCore::formClose): Ditto.
- 4:00 PM Changeset in webkit [197423] by
-
- 3 edits2 adds in trunk
ASSERT in platform/graphics/mac/ComplexTextController.cpp::capitalize()
https://bugs.webkit.org/show_bug.cgi?id=154875
Reviewed by Myles C. Maxfield.
Source/WebCore:
Change an ASSERT to verify that uper casing a character doesn't change its size.
Test: fast/text/regress-154875.html
- platform/graphics/mac/ComplexTextController.cpp:
(WebCore::capitalized):
LayoutTests:
New test.
- fast/text/regress-154875-expected.txt: Added.
- fast/text/regress-154875.html: Added.
- 3:58 PM Changeset in webkit [197422] by
-
- 2 edits in trunk/Source/JavaScriptCore
Remove FIXMEs and add valid test cases after necessary patch has landed.
Rubber stamped by Mark Lam.
- tests/stress/proxy-prevent-extensions.js:
(assert.Object.isSealed):
(assert):
- 3:57 PM Changeset in webkit [197421] by
-
- 2 edits in branches/safari-601-branch/LayoutTests
Rebaseline fast/css/will-change-parsing.html. rdar://problem/24743200
- fast/css/will-change-parsing-expected.txt:
- 3:51 PM Changeset in webkit [197420] by
-
- 4 edits1 add in trunk/Source/JavaScriptCore
[ES6] Implement Proxy.IsExtensible
https://bugs.webkit.org/show_bug.cgi?id=154872
Reviewed by Oliver Hunt.
This patch is a direct implementation of Proxy.IsExtensible with respect to section 9.5.3
of the ECMAScript 6 spec.
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-isextensible
- runtime/ProxyObject.cpp:
(JSC::ProxyObject::preventExtensions):
(JSC::ProxyObject::performIsExtensible):
(JSC::ProxyObject::isExtensible):
(JSC::ProxyObject::visitChildren):
- runtime/ProxyObject.h:
- tests/es6.yaml:
- tests/stress/proxy-is-extensible.js: Added.
(assert):
(throw.new.Error.let.handler.get isExtensible):
(throw.new.Error):
(assert.let.handler.isExtensible):
(assert.):
(let.handler.isExtensible):
- 3:44 PM Changeset in webkit [197419] by
-
- 2 edits in branches/safari-601-branch/LayoutTests
Update TesetExpectations for fast/text/multiple-feature-properties.html. rdar://problem/24494562
- platform/mac/TestExpectations:
- 3:42 PM Changeset in webkit [197418] by
-
- 4 edits1 add in trunk/Source/JavaScriptCore
[ES6] Implement Proxy.PreventExtensions
https://bugs.webkit.org/show_bug.cgi?id=154873
Reviewed by Oliver Hunt.
This patch is a direct implementation of Proxy.PreventExtensions with respect to section 9.5.4
of the ECMAScript 6 spec.
https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-preventextensions
- runtime/ProxyObject.cpp:
(JSC::ProxyObject::deletePropertyByIndex):
(JSC::ProxyObject::performPreventExtensions):
(JSC::ProxyObject::preventExtensions):
(JSC::ProxyObject::visitChildren):
- runtime/ProxyObject.h:
- tests/es6.yaml:
- tests/stress/proxy-prevent-extensions.js: Added.
(assert):
(throw.new.Error.let.handler.get preventExtensions):
(throw.new.Error):
(assert.let.handler.preventExtensions):
(assert.):
(let.handler.preventExtensions):
(assert.Object.isSealed.let.handler.preventExtensions):
(assert.Object.isSealed):
- 3:40 PM Changeset in webkit [197417] by
-
- 1 edit3 adds in trunk/LayoutTests
FTL should simplify StringReplace with an empty replacement string
https://bugs.webkit.org/show_bug.cgi?id=154871
Reviewed by Michael Saboff.
Really add this new test.
- js/regress/script-tests/string-replace-empty.js: Added.
- js/regress/string-replace-empty-expected.txt: Added.
- js/regress/string-replace-empty.html: Added.
- 3:35 PM Changeset in webkit [197416] by
-
- 5 edits in trunk
FTL should simplify StringReplace with an empty replacement string
https://bugs.webkit.org/show_bug.cgi?id=154871
Reviewed by Michael Saboff.
This is a simple and hugely profitable change. If we do a string.replace(/things/, ""), then
this calls directly into StringPrototype's replace-with-empty-string logic instead of going
through stuff that does checks before reaching that same conclusion.
This speeds up Octane/regexp by about 6-10%. It also speeds up the attached microbenchmark by
about 7%.
- ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):
- runtime/StringPrototype.cpp:
(JSC::jsSpliceSubstringsWithSeparators):
(JSC::removeUsingRegExpSearch):
(JSC::replaceUsingRegExpSearch):
(JSC::operationStringProtoFuncReplaceRegExpEmptyStr):
(JSC::operationStringProtoFuncReplaceRegExpString):
- runtime/StringPrototype.h:
- 3:33 PM Changeset in webkit [197415] by
-
- 2 edits in trunk/Source/WebCore
Timer alignment in separate web processes should not all sync up to the same point.
https://bugs.webkit.org/show_bug.cgi?id=154878
Reviewed by Chris Dumez.
For any given WebContent process it is desirable that timers are synchronized to a single
alignment point, but if all WebContent processes align to the same point then there may
be a thundering herd of processes waking up.
- page/DOMTimer.cpp:
(WebCore::DOMTimer::alignedFireTime):
- align to a randomized point.
- 2:29 PM Changeset in webkit [197414] by
-
- 10 edits in trunk
Reduce size of internal windows build output
https://bugs.webkit.org/show_bug.cgi?id=154763
Patch by Alex Christensen <achristensen@webkit.org> on 2016-03-01
Reviewed by Brent Fulgham.
.:
- Source/cmake/OptionsWin.cmake:
Source/JavaScriptCore:
- JavaScriptCore.vcxproj/JavaScriptCore.proj:
Source/WebCore:
- WebCore.vcxproj/WebCore.proj:
Source/WebKit:
- WebKit.vcxproj/WebKit.proj:
Source/WTF:
- WTF.vcxproj/WTF.proj:
- 2:13 PM Changeset in webkit [197413] by
-
- 5 edits in trunk/Source/WebKit2
Correctly keep track of NetworkDataTasks with and without credentials when using NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154876
Reviewed by Brady Eidson.
I was seeing an assertion failure from ASSERT(!m_session.m_dataTaskMap.contains(taskIdentifier()))
in the NetworkDataTask constructor sometimes. This is because a task identifier is not enough information
to uniquely find a NetworkDataTask in a NetworkSession since r196034 because there are two NSURLSessions
in a NetworkSession, one with credentials and one without. The assertion would fire in a case like if we
made the first NetworkDataTask with credentials (taskIdentifier is 1) and the first NetworkDataTask
without credentials before the first NetworkDataTask with credentials was finished. In that case, the
taskIdentifier would also be 1, which would conflict with the other taskIdentifier. That taskIdentifier
would uniquely identify the task in the correct NSURLSession, though, so the solution is to keep a map
for each NSURLSession in the NetworkSession.
- NetworkProcess/NetworkDataTask.h:
- NetworkProcess/NetworkSession.h:
- NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
(WebKit::NetworkDataTask::NetworkDataTask):
(WebKit::NetworkDataTask::~NetworkDataTask):
(WebKit::NetworkDataTask::suspend):
(WebKit::serverTrustCredential):
- NetworkProcess/cocoa/NetworkSessionCocoa.mm:
(-[WKNetworkSessionDelegate URLSession:task:didSendBodyData:totalBytesSent:totalBytesExpectedToSend:]):
(-[WKNetworkSessionDelegate URLSession:task:willPerformHTTPRedirection:newRequest:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:task:didReceiveChallenge:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:task:didCompleteWithError:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveData:]):
(-[WKNetworkSessionDelegate URLSession:downloadTask:didWriteData:totalBytesWritten:totalBytesExpectedToWrite:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didBecomeDownloadTask:]):
(WebKit::NetworkSession::clearCredentials):
(WebKit::NetworkSession::dataTaskForIdentifier):
(WebKit::NetworkSession::addDownloadID):
- 1:45 PM Changeset in webkit [197412] by
-
- 14 edits in trunk/Source/JavaScriptCore
IsExtensible should be a virtual method in the method table
https://bugs.webkit.org/show_bug.cgi?id=154799
Reviewed by Mark Lam.
This patch makes us more consistent with how the ES6 specification models the
IsExtensible trap. Moving this method into ClassInfo::methodTable
is a prerequisite for implementing Proxy.IsExtensible.
- runtime/ClassInfo.h:
- runtime/JSCell.cpp:
(JSC::JSCell::preventExtensions):
(JSC::JSCell::isExtensible):
- runtime/JSCell.h:
- runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncProtoSetter):
- runtime/JSObject.cpp:
(JSC::JSObject::preventExtensions):
(JSC::JSObject::isExtensible):
(JSC::JSObject::reifyAllStaticProperties):
(JSC::JSObject::defineOwnIndexedProperty):
(JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
(JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
(JSC::JSObject::defineOwnNonIndexProperty):
(JSC::JSObject::defineOwnProperty):
- runtime/JSObject.h:
(JSC::JSObject::isSealed):
(JSC::JSObject::isFrozen):
(JSC::JSObject::isExtensibleImpl):
(JSC::JSObject::isStructureExtensible):
(JSC::JSObject::isExtensibleInline):
(JSC::JSObject::indexingShouldBeSparse):
(JSC::JSObject::putDirectInternal):
(JSC::JSObject::isExtensible): Deleted.
- runtime/ObjectConstructor.cpp:
(JSC::objectConstructorSetPrototypeOf):
(JSC::objectConstructorIsSealed):
(JSC::objectConstructorIsFrozen):
(JSC::objectConstructorIsExtensible):
(JSC::objectConstructorIs):
- runtime/ProxyObject.cpp:
(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::performHasProperty):
- runtime/ReflectObject.cpp:
(JSC::reflectObjectIsExtensible):
(JSC::reflectObjectSetPrototypeOf):
- runtime/SparseArrayValueMap.cpp:
(JSC::SparseArrayValueMap::putEntry):
(JSC::SparseArrayValueMap::putDirect):
- runtime/StringObject.cpp:
(JSC::StringObject::defineOwnProperty):
- runtime/Structure.cpp:
(JSC::Structure::isSealed):
(JSC::Structure::isFrozen):
- runtime/Structure.h:
- 1:40 PM Changeset in webkit [197411] by
-
- 2 edits in trunk/Source/JavaScriptCore
Unreviewed, fix CLOOP build.
- jit/JITOperations.h:
- 1:28 PM Changeset in webkit [197410] by
-
- 6 edits in trunk/Source/JavaScriptCore
[ES6] Arrow function. Some not used byte code is emited
https://bugs.webkit.org/show_bug.cgi?id=154639
Reviewed by Saam Barati.
Currently bytecode that is generated for arrow function is not optimal.
Current fix removed following unnecessary bytecode:
1.create_lexical_environment not emited always for arrow function, only if some of
features(this/super/arguments/eval) is used inside of the arrow function.
2.load 'this' from arrow function scope in constructor is done only if super
contains in arrow function
- bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::isSuperCallUsedInInnerArrowFunction):
- bytecompiler/BytecodeGenerator.h:
- bytecompiler/NodesCodegen.cpp:
(JSC::ThisNode::emitBytecode):
(JSC::FunctionNode::emitBytecode):
- parser/Nodes.h:
(JSC::ScopeNode::doAnyInnerArrowFunctionsUseAnyFeature):
- tests/stress/arrowfunction-lexical-bind-supercall-4.js:
- 1:20 PM Changeset in webkit [197409] by
-
- 5 edits in trunk/Source
REGRESSION (r154616): Accelerated drawing is off during the initial load
<https://webkit.org/b/123812>
Reviewed by Tim Horton.
Source/WebCore:
Robustify the hey-the-Settings-changed callbacks in Page to handle document-less frames.
This is needed because now Settings are changed even before the main Frame has a Document.
- page/Page.cpp:
(WebCore::networkStateChanged):
(WebCore::Page::updateStyleForAllPagesAfterGlobalChangeInEnvironment):
(WebCore::Page::takeAnyMediaCanStartListener):
(WebCore::Page::setMediaVolume):
(WebCore::Page::setPageScaleFactor):
(WebCore::Page::invalidateStylesForAllLinks):
(WebCore::Page::invalidateStylesForLink):
(WebCore::Page::dnsPrefetchingStateChanged):
(WebCore::Page::storageBlockingStateChanged):
(WebCore::Page::setMuted):
(WebCore::Page::captionPreferencesChanged):
(WebCore::Page::setSessionID):
(WebCore::Page::setPlaybackTarget):
(WebCore::Page::playbackTargetAvailabilityDidChange):
(WebCore::Page::setShouldPlayToPlaybackTarget):
- page/Settings.cpp:
(WebCore::setImageLoadingSettings):
Source/WebKit2:
Load preferences before instantiating the first DrawingArea. This ensures that we do the
initial paint using accelerated drawing, and avoids allocating persistent data structures
only needed by the software rendering path.
- WebProcess/WebPage/WebPage.cpp:
- 1:18 PM Changeset in webkit [197408] by
-
- 28 edits3 adds in trunk
Turn String.prototype.replace into an intrinsic
https://bugs.webkit.org/show_bug.cgi?id=154835
Reviewed by Michael Saboff.
Source/JavaScriptCore:
Octane/regexp spends a lot of time in String.prototype.replace(). That function does a lot
of checks to see if the parameters are what they are likely to often be (a string, a
regexp, and a string). The intuition of this patch is that it's good to remove those checks
and it's good to call the native function as directly as possible.
This yields a 10% speed-up on a replace microbenchmark and a 3% speed-up on Octane/regexp.
It also improves Octane/jquery.
This is only the beginning of what I want to do with replace optimizations. The other
optimizations will rely on StringReplace being revealed as a construct in DFG IR.
- JavaScriptCore.xcodeproj/project.pbxproj:
- bytecode/SpeculatedType.cpp:
(JSC::dumpSpeculation):
(JSC::speculationToAbbreviatedString):
(JSC::speculationFromClassInfo):
- bytecode/SpeculatedType.h:
(JSC::isStringOrStringObjectSpeculation):
(JSC::isRegExpObjectSpeculation):
(JSC::isBoolInt32Speculation):
- dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
- dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
- dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
- dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
- dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
- dfg/DFGNode.h:
(JSC::DFG::Node::shouldSpeculateStringOrStringObject):
(JSC::DFG::Node::shouldSpeculateRegExpObject):
(JSC::DFG::Node::shouldSpeculateSymbol):
- dfg/DFGNodeType.h:
- dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
- dfg/DFGSafeToExecute.h:
(JSC::DFG::SafeToExecuteEdge::operator()):
(JSC::DFG::safeToExecute):
- dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculateFinalObject):
(JSC::DFG::SpeculativeJIT::speculateRegExpObject):
(JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
(JSC::DFG::SpeculativeJIT::speculate):
- dfg/DFGSpeculativeJIT.h:
- dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
- dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
- dfg/DFGUseKind.cpp:
(WTF::printInternal):
- dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor):
(JSC::DFG::isCell):
- ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
- ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
(JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):
(JSC::FTL::DFG::LowerDFGToB3::didOverflowStack):
(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::speculateFinalObject):
(JSC::FTL::DFG::LowerDFGToB3::speculateRegExpObject):
(JSC::FTL::DFG::LowerDFGToB3::speculateString):
- jit/JITOperations.h:
- runtime/Intrinsic.h:
- runtime/JSType.h:
- runtime/RegExpObject.h:
(JSC::RegExpObject::createStructure):
- runtime/StringPrototype.cpp:
(JSC::StringPrototype::finishCreation):
(JSC::removeUsingRegExpSearch):
(JSC::replaceUsingRegExpSearch):
(JSC::operationStringProtoFuncReplaceRegExpString):
(JSC::replaceUsingStringSearch):
(JSC::stringProtoFuncRepeat):
(JSC::replace):
(JSC::stringProtoFuncReplace):
(JSC::operationStringProtoFuncReplaceGeneric):
(JSC::stringProtoFuncToString):
- runtime/StringPrototype.h:
LayoutTests:
- js/regress/script-tests/string-replace.js: Added.
- js/regress/string-replace-expected.txt: Added.
- js/regress/string-replace.html: Added.
- 12:00 PM Changeset in webkit [197407] by
-
- 2 edits in trunk/Source/WebKit2
Fix tests when using NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154866
Reviewed by Brady Eidson.
- NetworkProcess/cocoa/NetworkSessionCocoa.mm:
(WebKit::globalCustomProtocolManager):
(WebKit::NetworkSession::setCustomProtocolManager):
Use a static NeverDestroyed instead of a local NeverDestroyed.
This fix was suggested by Darin after I broke the custom protocol tests in r197362.
(WebKit::NetworkSession::clearCredentials):
In r197223 I added code that I thought cleared the credentials of a session, but it was
actually trying (and failing) to remove the credentials from the NSURLCredentialStorage that
were stored with NSURLCredentialPersistencePermanent.
This was causing credentials stored in an NSURLSession with NSURLCredentialPersistenceForSession
to remain for the next tests, and was causing credentials from previous tests, usually from
http/tests/loading/basic-credentials-sent-automatically.html, to be used in future tests.
Creating a new NSURLSession is the equivalent of CredentialStorage::clearCredentials because it
removes all credentials stored with NSURLCredentialPersistenceForSession.
- 11:47 AM Changeset in webkit [197406] by
-
- 8 edits in trunk
Unreviewed, rolling out r197056.
https://bugs.webkit.org/show_bug.cgi?id=154870
broke win ews (Requested by alexchristensen on #webkit).
Reverted changeset:
"[cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK."
https://bugs.webkit.org/show_bug.cgi?id=154651
http://trac.webkit.org/changeset/197056
- 11:41 AM Changeset in webkit [197405] by
-
- 4 edits in trunk/Source/WebCore
Modern IDB: Possible crash deallocating IDBDatabaseInfo/IDBObjectStoreInfo/IDBIndexInfo.
https://bugs.webkit.org/show_bug.cgi?id=154860
Reviewed by Alex Christensen.
Covered by existing tests.
- Modules/indexeddb/shared/IDBDatabaseInfo.cpp:
(WebCore::IDBDatabaseInfo::IDBDatabaseInfo):
(WebCore::IDBDatabaseInfo::isolatedCopy):
- Modules/indexeddb/shared/IDBDatabaseInfo.h:
- Modules/indexeddb/shared/IDBTransactionInfo.cpp:
(WebCore::IDBTransactionInfo::isolatedCopy): If there's an IDBDatabaseInfo to copy, that
copy needs to be isolated.
- 10:49 AM Changeset in webkit [197404] by
-
- 8 edits in trunk/Source
Expose MediaElement and VideoElement to the Objective-C DOM bindings
https://bugs.webkit.org/show_bug.cgi?id=154830
Reviewed by Sam Weinig.
Source/WebCore:
- Modules/mediasession/HTMLMediaElementMediaSession.idl:
- Modules/mediastream/HTMLMediaElementMediaStream.idl:
- html/HTMLMediaElement.idl:
- html/HTMLVideoElement.idl:
Avoid Objective-C bindings for various extraneous bits, like MediaSource and MediaSession,
to avoid exposing way more than we need to.
- WebCore.xcodeproj/project.pbxproj:
Add a bunch of Derived Sources.
Source/WebKit/mac:
- MigrateHeaders.make:
- 10:33 AM Changeset in webkit [197403] by
-
- 3 edits in trunk/LayoutTests
Rebaseline isplaylists/extent-includes tests for mac-wk1
Unreviewed test gardening.
- platform/mac-wk1/displaylists/extent-includes-shadow-expected.txt:
- platform/mac-wk1/displaylists/extent-includes-transforms-expected.txt:
- 9:42 AM Changeset in webkit [197402] by
-
- 2 edits in trunk/Source/WebKit2
NetworkCache: Web process leaks resource buffer when using shareable reasources
https://bugs.webkit.org/show_bug.cgi?id=154852
Reviewed by Darin Adler.
ResourceLoader::didReceiveBuffer() expects a PassRefPtr, but we
are passing a raw pointer making PassRefPtr to take another
reference instead of transfering the ownership as expected.
- WebProcess/Network/WebResourceLoader.cpp:
(WebKit::WebResourceLoader::didReceiveResource):
- 9:33 AM Changeset in webkit [197401] by
-
- 22 edits in trunk/Source/WebCore
Text control shadow element style shouldn't depend on renderers
https://bugs.webkit.org/show_bug.cgi?id=154855
Reviewed by Andreas Kling.
Currently the code for computing style for text control shadow elements lives in render tree.
Style is the input for building a render tree and should be computable without having one.
Fix by moving virtual createInnerTextStyle() from RenderTextControl hierarchy to the DOM side
HTMLTextFormControlElement hierarchy.
- dom/Element.cpp:
(WebCore::Element::didDetachRenderers):
(WebCore::Element::customStyleForRenderer):
Also pass shadow host style as it is needed for text controls.
- dom/Element.h:
- dom/PseudoElement.cpp:
(WebCore::PseudoElement::clearHostElement):
(WebCore::PseudoElement::customStyleForRenderer):
- dom/PseudoElement.h:
- html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::setRangeText):
(WebCore::HTMLInputElement::createInnerTextStyle):
(WebCore::HTMLInputElement::setupDateTimeChooserParameters):
- html/HTMLInputElement.h:
- html/HTMLTextAreaElement.cpp:
(WebCore::HTMLTextAreaElement::willRespondToMouseClickEvents):
(WebCore::HTMLTextAreaElement::createInnerTextStyle):
- html/HTMLTextAreaElement.h:
- html/HTMLTextFormControlElement.cpp:
(WebCore::HTMLTextFormControlElement::directionForFormData):
(WebCore::HTMLTextFormControlElement::adjustInnerTextStyle):
- html/HTMLTextFormControlElement.h:
(WebCore::HTMLTextFormControlElement::cachedSelectionDirection):
- html/shadow/TextControlInnerElements.cpp:
(WebCore::TextControlInnerElement::create):
(WebCore::TextControlInnerElement::customStyleForRenderer):
(WebCore::TextControlInnerTextElement::renderer):
(WebCore::TextControlInnerTextElement::customStyleForRenderer):
- html/shadow/TextControlInnerElements.h:
- rendering/RenderTextControl.cpp:
(WebCore::RenderTextControl::styleDidChange):
(WebCore::RenderTextControl::textBlockLogicalHeight):
(WebCore::RenderTextControl::adjustInnerTextStyle): Deleted.
- rendering/RenderTextControl.h:
- rendering/RenderTextControlMultiLine.cpp:
(WebCore::RenderTextControlMultiLine::baselinePosition):
(WebCore::RenderTextControlMultiLine::layoutSpecialExcludedChild):
(WebCore::RenderTextControlMultiLine::createInnerTextStyle): Deleted.
createInnerTextStyle moves to HTMLTextAreaElement::createInnerTextStyle
- rendering/RenderTextControlMultiLine.h:
- rendering/RenderTextControlSingleLine.cpp:
(WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
Remove m_desiredInnerTextLogicalHeight cache. It doesn't work, it is never valid when hit.
(WebCore::RenderTextControlSingleLine::layout):
(WebCore::RenderTextControlSingleLine::styleDidChange):
(WebCore::RenderTextControlSingleLine::computeControlLogicalHeight):
(WebCore::RenderTextControlSingleLine::textShouldBeTruncated):
(WebCore::RenderTextControlSingleLine::createInnerTextStyle): Deleted.
(WebCore::RenderTextControlSingleLine::createInnerBlockStyle): Deleted.
- createInnerTextStyle moves to HTMLInputElement::createInnerTextStyle
- createInnerBlockStyle moves to TextControlInnerElement::customStyleForRenderer
- rendering/RenderTextControlSingleLine.h:
(WebCore::RenderTextControlSingleLine::centerContainerIfNeeded):
(WebCore::RenderTextControlSingleLine::containerElement):
- style/StyleTreeResolver.cpp:
(WebCore::Style::TreeResolver::styleForElement):
- svg/SVGElement.cpp:
(WebCore::SVGElement::synchronizeSystemLanguage):
(WebCore::SVGElement::customStyleForRenderer):
- svg/SVGElement.h:
- 8:54 AM Changeset in webkit [197400] by
-
- 8 edits in trunk/Source/WebCore
[css-grid] Get rid of GridResolvedPosition
https://bugs.webkit.org/show_bug.cgi?id=154818
Reviewed by Darin Adler.
GridResolvedPosition was a small class just wrapping a unsigned.
In the future it should actually wrap an integer,
as we want to support implicit tracks before the explicit grid.
The class itself is not providing any benefit,
so we can get rid of it and store directly 2 unsigned in GridSpan.
This will make simpler future changes related to this task.
We keep the class just as a utility for the methods
that deal with the positions resolution.
But it should be renamed in a follow-up patch.
No new tests, no change of behavior.
- css/CSSGridTemplateAreasValue.cpp:
(WebCore::stringForPosition):
- css/CSSParser.cpp:
(WebCore::CSSParser::parseGridTemplateAreasRow):
- css/StyleBuilderConverter.h:
(WebCore::StyleBuilderConverter::createImplicitNamedGridLinesFromGridArea):
- rendering/RenderGrid.cpp:
(WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
(WebCore::RenderGrid::findFlexFactorUnitSize):
(WebCore::RenderGrid::spanningItemCrossesFlexibleSizedTracks):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForItems):
(WebCore::RenderGrid::insertItemIntoGrid):
(WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
(WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
(WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
(WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
(WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
(WebCore::RenderGrid::gridAreaBreadthForChild):
(WebCore::RenderGrid::gridAreaBreadthForChildIncludingAlignmentOffsets):
(WebCore::RenderGrid::columnAxisOffsetForChild):
(WebCore::RenderGrid::rowAxisOffsetForChild):
- rendering/style/GridCoordinate.h:
(WebCore::GridSpan::definiteGridSpan):
(WebCore::GridSpan::integerSpan):
(WebCore::GridSpan::resolvedInitialPosition):
(WebCore::GridSpan::resolvedFinalPosition):
(WebCore::GridSpan::GridSpanIterator::GridSpanIterator):
(WebCore::GridSpan::GridSpanIterator::operator*):
(WebCore::GridSpan::GridSpanIterator::operator++):
(WebCore::GridSpan::GridSpanIterator::operator!=):
(WebCore::GridSpan::begin):
(WebCore::GridSpan::end):
(WebCore::GridSpan::GridSpan):
- rendering/style/GridResolvedPosition.cpp:
(WebCore::resolveNamedGridLinePositionFromStyle):
(WebCore::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveGridPositionAgainstOppositePosition):
(WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
(WebCore::resolveGridPositionFromStyle):
(WebCore::GridResolvedPosition::resolveGridPositionsFromStyle):
- rendering/style/GridResolvedPosition.h:
(WebCore::GridResolvedPosition::GridResolvedPosition): Deleted.
(WebCore::GridResolvedPosition::operator*): Deleted.
(WebCore::GridResolvedPosition::operator++): Deleted.
(WebCore::GridResolvedPosition::operator==): Deleted.
(WebCore::GridResolvedPosition::operator!=): Deleted.
(WebCore::GridResolvedPosition::operator<): Deleted.
(WebCore::GridResolvedPosition::operator>): Deleted.
(WebCore::GridResolvedPosition::operator<=): Deleted.
(WebCore::GridResolvedPosition::operator>=): Deleted.
(WebCore::GridResolvedPosition::toInt): Deleted.
(WebCore::GridResolvedPosition::next): Deleted.
(WebCore::GridResolvedPosition::prev): Deleted.
- 6:29 AM Changeset in webkit [197399] by
-
- 2 edits in trunk/Source/WebCore
MemoryCache::forEachResource() should guard resources across function invocation.
<https://webkit.org/b/154846>
Reviewed by Antti Koivisto.
It occurred to me that we should protect the CachedResources from being
deleted while invoking the custom function here, lest we create a giant footgun.
- loader/cache/MemoryCache.cpp:
(WebCore::MemoryCache::forEachResource):
- 3:58 AM Changeset in webkit [197398] by
-
- 2 edits in trunk/Source/WebCore
[Mac][cmake] One more unreviewed speculative buildfix after r197375. Just for fun.
- PlatformMac.cmake:
- 3:17 AM Changeset in webkit [197397] by
-
- 2 edits in trunk/Source/WebCore
[Mac][cmake] Unreviewed speculative buildfix after r197375. Just for fun.
- PlatformMac.cmake:
- 2:34 AM Changeset in webkit [197396] by
-
- 8 edits in trunk
[Fetch API] Support Request and Response blob() when body data is a blob
https://bugs.webkit.org/show_bug.cgi?id=154820
Reviewed by Darin Adler.
LayoutTests/imported/w3c:
Adding blob specific tests. New tests are not covered yet as they require converting data from a blob into another form (JSON, text...).
Rebasing expectations with test that is now passing and new failing tests.
Fixing typos in test (Json -> JSON and removing TextDecoder use).
- web-platform-tests/fetch/api/request/request-consume-expected.txt:
- web-platform-tests/fetch/api/request/request-consume.html:
- web-platform-tests/fetch/api/response/response-consume-expected.txt:
- web-platform-tests/fetch/api/response/response-consume.html:
Source/WebCore:
Adding support for returning the same Blob that is stored in Body in case JS blob() is called.
Adding support for Blob creation when data is stored as text.
Updated JSDOMBinding and JSDOMPromise to return a JS ArrayBuffer for Vector<char> as well as Vector<unsigned char>.
Covered by added tests.
- Modules/fetch/FetchBody.cpp:
(WebCore::FetchBody::arrayBuffer):
(WebCore::FetchBody::blob):
(WebCore::FetchBody::extractFromText):
- Modules/fetch/FetchBody.h:
- bindings/js/JSDOMBinding.h:
(WebCore::toJS):
- bindings/js/JSDOMPromise.h:
(WebCore::DeferredWrapper::resolve): Deleted.
- 1:05 AM Changeset in webkit [197395] by
-
- 1 copy in releases/WebKitGTK/webkit-2.11.91
WebKitGTK+ 2.11.91
- 1:03 AM Changeset in webkit [197394] by
-
- 4 edits in releases/WebKitGTK/webkit-2.12
Unreviewed. Update OptionsGTK.cmake and NEWS for 2.11.91 release.
.:
- Source/cmake/OptionsGTK.cmake: Bump version numbers.
Source/WebKit2:
- gtk/NEWS: Add release notes for 2.11.91.
- 1:03 AM Changeset in webkit [197393] by
-
- 10 edits1 add in releases/WebKitGTK/webkit-2.12/Source
Revert "Merge r197226 - Remove the on demand executable allocator"
This reverts commit 3380464fbd83e408a06904221206c9bd1cafe2e6.
- 1:02 AM Changeset in webkit [197392] by
-
- 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Revert "Merge r197256 - CLoop build fix."
This reverts commit d6136b81fc3f561214c85ccf3e69a4109963bae9.
- 12:11 AM Changeset in webkit [197391] by
-
- 12 edits in trunk/Source/JavaScriptCore
PreventExtensions should be a virtual method in the method table.
https://bugs.webkit.org/show_bug.cgi?id=154800
Reviewed by Yusuke Suzuki.
This patch makes us more consistent with how the ES6 specification models the
PreventExtensions trap. Moving this method into ClassInfo::methodTable
is a prerequisite for implementing Proxy.PreventExtensions.
- runtime/ClassInfo.h:
- runtime/JSCell.cpp:
(JSC::JSCell::getGenericPropertyNames):
(JSC::JSCell::preventExtensions):
- runtime/JSCell.h:
- runtime/JSModuleNamespaceObject.cpp:
(JSC::JSModuleNamespaceObject::JSModuleNamespaceObject):
(JSC::JSModuleNamespaceObject::finishCreation):
(JSC::JSModuleNamespaceObject::destroy):
- runtime/JSModuleNamespaceObject.h:
(JSC::JSModuleNamespaceObject::create):
(JSC::JSModuleNamespaceObject::moduleRecord):
- runtime/JSObject.cpp:
(JSC::JSObject::freeze):
(JSC::JSObject::preventExtensions):
(JSC::JSObject::reifyAllStaticProperties):
- runtime/JSObject.h:
(JSC::JSObject::isSealed):
(JSC::JSObject::isFrozen):
(JSC::JSObject::isExtensible):
- runtime/ObjectConstructor.cpp:
(JSC::objectConstructorSeal):
(JSC::objectConstructorFreeze):
(JSC::objectConstructorPreventExtensions):
(JSC::objectConstructorIsSealed):
- runtime/ReflectObject.cpp:
(JSC::reflectObjectPreventExtensions):
- runtime/Structure.cpp:
(JSC::Structure::Structure):
(JSC::Structure::preventExtensionsTransition):
- runtime/Structure.h:
Feb 29, 2016:
- 11:39 PM Changeset in webkit [197390] by
-
- 2 edits in trunk/Source/WebKit2
ThreadedCompositor: clean up composition-specific resources before shutting down the thread
https://bugs.webkit.org/show_bug.cgi?id=154793
Reviewed by Carlos Garcia Campos.
- Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:
(WebKit::ThreadedCompositor::runCompositingThread): Before concluding the
compositing thread run, clean up all the resources that were allocated at
the start, and in the reverse order. Specifically, we now also deallocate
the CoordinatedGraphicsScene and the SimpleViewportController objects. This
way these are not deallocated on the main thread when the ThreadedCompositor
destructor would otherwise clean them up.
- 11:37 PM Changeset in webkit [197389] by
-
- 13 edits in trunk
Have parseHTMLInteger() / parseHTMLNonNegativeInteger() use WTF::Optional
https://bugs.webkit.org/show_bug.cgi?id=154845
Reviewed by Ryosuke Niwa.
Source/WebCore:
Have parseHTMLInteger() / parseHTMLNonNegativeInteger() use
WTF::Optional.
- dom/Element.cpp:
(WebCore::Element::getIntegralAttribute):
(WebCore::Element::getUnsignedIntegralAttribute):
(WebCore::Element::setUnsignedIntegralAttribute): Deleted.
- html/HTMLElement.cpp:
(WebCore::HTMLElement::parseBorderWidthAttribute):
(WebCore::HTMLElement::parseAttribute):
- html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::parseMaxLengthAttribute):
- html/HTMLInputElement.h:
- html/HTMLOListElement.cpp:
(WebCore::HTMLOListElement::parseAttribute):
- html/HTMLTextAreaElement.cpp:
(WebCore::HTMLTextAreaElement::maxLength):
- html/ImageInputType.cpp:
(WebCore::ImageInputType::height):
(WebCore::ImageInputType::width):
- html/parser/HTMLParserIdioms.cpp:
(WebCore::parseHTMLIntegerInternal):
(WebCore::parseHTMLInteger):
(WebCore::parseHTMLNonNegativeInteger):
- html/parser/HTMLParserIdioms.h:
(WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
(WebCore::limitToOnlyHTMLNonNegative):
- svg/SVGElement.cpp:
(WebCore::SVGElement::parseAttribute):
Tools:
Update API tests accordingly.
- TestWebKitAPI/Tests/WebCore/HTMLParserIdioms.cpp:
(TestWebKitAPI::testParseHTMLInteger):
(TestWebKitAPI::parseHTMLIntegerFails):
(TestWebKitAPI::testParseHTMLNonNegativeInteger):
(TestWebKitAPI::parseHTMLNonNegativeIntegerFails):
(TestWebKitAPI::TEST): Deleted.
- 11:36 PM Changeset in webkit [197388] by
-
- 3 edits in trunk/Source/WebKit2
ThreadSafeCoordinatedSurface: remove the unused private create() static method
https://bugs.webkit.org/show_bug.cgi?id=154792
Reviewed by Carlos Garcia Campos.
Remove the static ThreadSafeCoordinatedSurface::create() method that accepted
a std::unique_ptr<ImageBuffer> object as its third parameter. This was not used
anywhere.
- Shared/CoordinatedGraphics/threadedcompositor/ThreadSafeCoordinatedSurface.cpp:
(WebKit::ThreadSafeCoordinatedSurface::create): Deleted.
- Shared/CoordinatedGraphics/threadedcompositor/ThreadSafeCoordinatedSurface.h:
- 11:32 PM Changeset in webkit [197387] by
-
- 2 edits in trunk/Source/WebCore
TextureMapperGL: simplify TransformationMatrix copies in draw(), beginClip()
https://bugs.webkit.org/show_bug.cgi?id=154791
Reviewed by Carlos Garcia Campos.
In both functions, the passed-in model-view matrix is first copied, multiplied
against a rect-to-rect TransformationMatrix, and then assigned into a local
TransformationMatrix variable, which causes another copy due to the multiply()
function returning a reference to the modified object.
To avoid the last copy, first copy the model-view matrix into a local variable,
and multiply the rect-to-rect TransformationMatrix into the new object afterwards.
- platform/graphics/texmap/TextureMapperGL.cpp:
(WebCore::TextureMapperGL::draw):
(WebCore::TextureMapperGL::beginClip):
- 11:31 PM Changeset in webkit [197386] by
-
- 2 edits in trunk/Source/WebCore
ImageBufferCairo should support OpenGL ES 2 configurations
https://bugs.webkit.org/show_bug.cgi?id=154790
Reviewed by Carlos Garcia Campos.
When building with OpenGL ES 2 and with accelerated 2D canvas support,
the GLES2 header should be included instead of the OpenGLShims.h header.
The glTexParameterf() calls targeting GL_TEXTURE_WRAP_S and
GL_TEXTURE_WRAP_T parameters should use the GL_CLAMP_TO_EDGE value.
GL_CLAMP isn't available in OpenGL ES 2 and was dropped in OpenGL 3.
- platform/graphics/cairo/ImageBufferCairo.cpp:
(WebCore::ImageBufferData::createCairoGLSurface):
- 11:30 PM Changeset in webkit [197385] by
-
- 2 edits in trunk/Source/WebCore
TextureMapperGL: beginPainting() should handle the PaintingMirrored value in PaintFlags
https://bugs.webkit.org/show_bug.cgi?id=154789
Reviewed by Carlos Garcia Campos.
- platform/graphics/texmap/TextureMapperGL.cpp:
(WebCore::TextureMapperGL::beginPainting): The ClipStack should be reset with
a Y-axis mode that corresponds to the presence of the PaintingMirrored value in
the passed-in PaintFlags argument. If present, the default Y-axis mode should be
used, and the inverted Y-axis otherwise.
- 11:28 PM Changeset in webkit [197384] by
-
- 2 edits in trunk/Source/WebCore
CoordinatedGraphicsLayer should override the inherited TextureMapperPlatformLayer::Client methods
https://bugs.webkit.org/show_bug.cgi?id=154788
Reviewed by Carlos Garcia Campos.
- platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:
Add the override specifiers for the two methods that are inherited
from the TextureMapperPlatformLayer::Client interface.
- 7:48 PM Changeset in webkit [197383] by
-
- 3 edits1 add in trunk/Source/JavaScriptCore
[JSC] Private symbols should not be trapped by proxy handler
https://bugs.webkit.org/show_bug.cgi?id=154817
Reviewed by Mark Lam.
Since the runtime has some assumptions on the properties associated with the private symbols, ES6 Proxy should not trap these property operations.
For example, in ArrayIteratorPrototype.js
var itemKind = this.@arrayIterationKind;
if (itemKind === @undefined)
throw new @TypeError("%ArrayIteratorPrototype%.next requires that |this| be an Array Iterator instance");
Here, we assume that only the array iterator has the @arrayIterationKind property that value is non-undefined.
But If we implement Proxy with the get handler, that returns a non-undefined value for every operations, we accidentally assumes that the given value is an array iterator.
To avoid these situation, we perform the default operations onto property operations with private symbols.
- runtime/ProxyObject.cpp:
(JSC::performProxyGet):
(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::performHasProperty):
(JSC::ProxyObject::performPut):
(JSC::ProxyObject::performDelete):
(JSC::ProxyObject::deleteProperty):
(JSC::ProxyObject::deletePropertyByIndex):
- tests/stress/proxy-basic.js:
- tests/stress/proxy-with-private-symbols.js: Added.
(assert):
(let.handler.getOwnPropertyDescriptor):
- 7:42 PM Changeset in webkit [197382] by
-
- 25 edits in trunk
Remove the experimental feature of antialiased font dilation
https://bugs.webkit.org/show_bug.cgi?id=154843
Reviewed by Zalan Bujtas.
Source/WebCore:
Remove the "antialiased font dilation" code path, and related prefs.
- page/Settings.cpp:
(WebCore::Settings::Settings): Deleted.
(WebCore::Settings::setAntialiasedFontDilationEnabled): Deleted.
- page/Settings.h:
(WebCore::Settings::antialiasedFontDilationEnabled): Deleted.
- platform/graphics/FontCascade.cpp:
(WebCore::FontCascade::setAntialiasedFontDilationEnabled): Deleted.
(WebCore::FontCascade::antialiasedFontDilationEnabled): Deleted.
- platform/graphics/FontCascade.h:
- platform/graphics/GraphicsContext.cpp:
(WebCore::GraphicsContextStateChange::changesFromState): Deleted.
(WebCore::GraphicsContextStateChange::accumulate): Deleted.
(WebCore::GraphicsContextStateChange::apply): Deleted.
(WebCore::GraphicsContextStateChange::dump): Deleted.
(WebCore::GraphicsContext::setAntialiasedFontDilationEnabled): Deleted.
- platform/graphics/GraphicsContext.h:
(WebCore::GraphicsContextState::GraphicsContextState): Deleted.
(WebCore::GraphicsContext::antialiasedFontDilationEnabled): Deleted.
- platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
(PlatformCALayer::drawLayerContents): Deleted.
- platform/graphics/cocoa/FontCascadeCocoa.mm:
(WebCore::dilationSizeForTextColor): Deleted.
(WebCore::FontCascade::drawGlyphs): Deleted.
- platform/graphics/displaylists/DisplayList.cpp:
(WebCore::DisplayList::DisplayList::shouldDumpForFlags): Deleted.
Source/WebKit/mac:
Remove the "antialiased font dilation" code path, and related prefs.
- WebView/WebPreferenceKeysPrivate.h:
- WebView/WebPreferences.mm:
(+[WebPreferences initialize]): Deleted.
(-[WebPreferences setAntialiasedFontDilationEnabled:]): Deleted.
(-[WebPreferences antialiasedFontDilationEnabled]): Deleted.
- WebView/WebPreferencesPrivate.h:
- WebView/WebView.mm:
(-[WebView _preferencesChanged:]): Deleted.
Source/WebKit2:
Remove the "antialiased font dilation" code path, and related prefs.
- Shared/WebPreferencesDefinitions.h:
- UIProcess/API/C/WKPreferences.cpp:
(WKPreferencesSetAntialiasedFontDilationEnabled):
(WKPreferencesGetAntialiasedFontDilationEnabled):
- UIProcess/API/C/WKPreferencesRefPrivate.h:
- UIProcess/API/Cocoa/WKPreferences.mm:
(-[WKPreferences _antialiasedFontDilationEnabled]): Deleted.
(-[WKPreferences _setAntialiasedFontDilationEnabled:]): Deleted.
- UIProcess/API/Cocoa/WKPreferencesPrivate.h:
- WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::updatePreferences): Deleted.
Tools:
Remove the "antialiased font dilation" code path, and related prefs.
- DumpRenderTree/mac/DumpRenderTree.mm:
(resetWebPreferencesToConsistentValues): Deleted.
- WebKitTestRunner/TestController.cpp:
(WTR::TestController::resetPreferencesToConsistentValues): Deleted.
- 7:18 PM Changeset in webkit [197381] by
-
- 3 edits in trunk/Source/JavaScriptCore
regress/script-tests/double-pollution-putbyoffset.js.ftl-eager timed out because of a lock ordering deadlock involving InferredType and CodeBlock
https://bugs.webkit.org/show_bug.cgi?id=154841
Reviewed by Benjamin Poulain.
Here's the deadlock:
Main thread:
1) Change an InferredType. This acquires InferredType::m_lock.
2) Fire watchpoint set. This triggers CodeBlock invalidation, which acquires
CodeBlock::m_lock.
DFG thread:
1) Iterate over the information in a CodeBlock. This acquires CodeBlock::m_lock.
2) Ask an InferredType for its descriptor(). This acquires InferredType::m_lock.
I think that the DFG thread's ordering should be legal, because the best logic for lock
hierarchies is that locks that protect the largest set of stuff should be acquired first.
This means that the main thread shouldn't be holding the InferredType::m_lock when firing
watchpoint sets. That's what this patch ensures.
At the time of writing, this test was deadlocking for me on trunk 100% of the time. With
this change I cannot get it to deadlock.
- runtime/InferredType.cpp:
(JSC::InferredType::willStoreValueSlow):
(JSC::InferredType::makeTopSlow):
(JSC::InferredType::set):
(JSC::InferredType::removeStructure):
(JSC::InferredType::InferredStructureWatchpoint::fireInternal):
- runtime/InferredType.h:
- 6:30 PM Changeset in webkit [197380] by
-
- 46 edits8 adds in trunk
[DFG][FTL][B3] Support floor and ceil
https://bugs.webkit.org/show_bug.cgi?id=154683
Reviewed by Filip Pizlo.
Source/JavaScriptCore:
This patch implements and fixes the following things.
- Implement Ceil and Floor in DFG, FTL and B3
x86 SSE 4.2 and ARM64 have round instructions that can directly perform Ceil or Floor.
This patch leverages this functionality. We introduce ArithFloor and ArithCeil.
During DFG phase, these nodes attempt to convert itself to Identity (in Fixup phase).
As the same to ArithRound, it tracks arith rounding mode.
And if these nodes are required to emit machine codes, we emit rounding machine code
if it is supported in the current machine. For example, in x86, we emitround.
This
Floorfunctionality is nice for @toInteger in builtin.
That is used for Array.prototype.{forEach, map, every, some, reduce...}
And according to the benchmark results, Kraken audio-oscillator is slightly improved
due to its frequent Math.round and Math.floor calls.
- Implement Floor in B3 and Air
As the same to Ceil in B3, we add a new B3 IR and Air opcode, Floor.
This Floor is leveraged to implement ArithFloor in DFG.
- Fix ArithRound operation
Currently, we used cvtsd2si (in x86) to convert double value to int32.
And we also used this to implement Math.round, like, cvtsd2si(value + 0.5).
However, this implementation is not correct. Because cvtsd2si is not floor operation.
It is trucate operation. This is OK for positive numbers. But NG for negative numbers.
For example, the current implementation accidentally rounds-0.6to-0.0. This should be-1.0.
Using Ceil and Floor instructions, we implement correct ArithRound.
- assembler/MacroAssemblerARM.h:
(JSC::MacroAssemblerARM::supportsFloatingPointRounding):
(JSC::MacroAssemblerARM::ceilDouble):
(JSC::MacroAssemblerARM::floorDouble):
(JSC::MacroAssemblerARM::supportsFloatingPointCeil): Deleted.
- assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::supportsFloatingPointRounding):
(JSC::MacroAssemblerARM64::floorFloat):
(JSC::MacroAssemblerARM64::supportsFloatingPointCeil): Deleted.
- assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::supportsFloatingPointRounding):
(JSC::MacroAssemblerARMv7::ceilDouble):
(JSC::MacroAssemblerARMv7::floorDouble):
(JSC::MacroAssemblerARMv7::supportsFloatingPointCeil): Deleted.
- assembler/MacroAssemblerMIPS.h:
(JSC::MacroAssemblerMIPS::ceilDouble):
(JSC::MacroAssemblerMIPS::floorDouble):
(JSC::MacroAssemblerMIPS::supportsFloatingPointRounding):
(JSC::MacroAssemblerMIPS::supportsFloatingPointCeil): Deleted.
- assembler/MacroAssemblerSH4.h:
(JSC::MacroAssemblerSH4::supportsFloatingPointRounding):
(JSC::MacroAssemblerSH4::ceilDouble):
(JSC::MacroAssemblerSH4::floorDouble):
(JSC::MacroAssemblerSH4::supportsFloatingPointCeil): Deleted.
- assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::floorDouble):
(JSC::MacroAssemblerX86Common::floorFloat):
(JSC::MacroAssemblerX86Common::supportsFloatingPointRounding):
(JSC::MacroAssemblerX86Common::supportsFloatingPointCeil): Deleted.
- b3/B3ConstDoubleValue.cpp:
(JSC::B3::ConstDoubleValue::floorConstant):
- b3/B3ConstDoubleValue.h:
- b3/B3ConstFloatValue.cpp:
(JSC::B3::ConstFloatValue::floorConstant):
- b3/B3ConstFloatValue.h:
- b3/B3LowerMacrosAfterOptimizations.cpp:
- b3/B3LowerToAir.cpp:
(JSC::B3::Air::LowerToAir::lower):
- b3/B3Opcode.cpp:
(WTF::printInternal):
- b3/B3Opcode.h:
- b3/B3ReduceDoubleToFloat.cpp:
- b3/B3ReduceStrength.cpp:
- b3/B3Validate.cpp:
- b3/B3Value.cpp:
(JSC::B3::Value::floorConstant):
(JSC::B3::Value::isRounded):
(JSC::B3::Value::effects):
(JSC::B3::Value::key):
(JSC::B3::Value::typeFor):
- b3/B3Value.h:
- b3/air/AirFixPartialRegisterStalls.cpp:
- b3/air/AirOpcode.opcodes:
- b3/testb3.cpp:
(JSC::B3::testFloorCeilArg):
(JSC::B3::testFloorArg):
(JSC::B3::testFloorImm):
(JSC::B3::testFloorMem):
(JSC::B3::testFloorFloorArg):
(JSC::B3::testCeilFloorArg):
(JSC::B3::testFloorIToD64):
(JSC::B3::testFloorIToD32):
(JSC::B3::testFloorArgWithUselessDoubleConversion):
(JSC::B3::testFloorArgWithEffectfulDoubleConversion):
(JSC::B3::run):
- dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
- dfg/DFGArithMode.cpp:
(WTF::printInternal):
- dfg/DFGArithMode.h:
- dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
- dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
- dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
- dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
- dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dump):
- dfg/DFGGraph.h:
(JSC::DFG::Graph::roundShouldSpeculateInt32):
- dfg/DFGNode.h:
(JSC::DFG::Node::arithNodeFlags):
(JSC::DFG::Node::hasHeapPrediction):
(JSC::DFG::Node::hasArithRoundingMode):
- dfg/DFGNodeType.h:
- dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
- dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
- dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileArithRounding):
(JSC::DFG::SpeculativeJIT::compileArithRound): Deleted.
- dfg/DFGSpeculativeJIT.h:
- dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
- dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
- ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
- ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
(JSC::FTL::DFG::LowerDFGToB3::compileArithFloor):
(JSC::FTL::DFG::LowerDFGToB3::compileArithCeil):
- ftl/FTLOutput.h:
(JSC::FTL::Output::doubleFloor):
- jit/ThunkGenerators.cpp:
(JSC::ceilThunkGenerator):
- tests/stress/math-ceil-arith-rounding-mode.js: Added.
(firstCareAboutZeroSecondDoesNot):
(firstDoNotCareAboutZeroSecondDoes):
(warmup):
(verifyNegativeZeroIsPreserved):
- tests/stress/math-ceil-basics.js: Added.
(mathCeilOnIntegers):
(mathCeilOnDoubles):
(mathCeilOnBooleans):
(uselessMathCeil):
(mathCeilWithOverflow):
(mathCeilConsumedAsDouble):
(mathCeilDoesNotCareAboutMinusZero):
(mathCeilNoArguments):
(mathCeilTooManyArguments):
(testMathCeilOnConstants):
(mathCeilStructTransition):
(Math.ceil):
- tests/stress/math-floor-arith-rounding-mode.js: Added.
(firstCareAboutZeroSecondDoesNot):
(firstDoNotCareAboutZeroSecondDoes):
(warmup):
(verifyNegativeZeroIsPreserved):
- tests/stress/math-floor-basics.js: Added.
(mathFloorOnIntegers):
(mathFloorOnDoubles):
(mathFloorOnBooleans):
(uselessMathFloor):
(mathFloorWithOverflow):
(mathFloorConsumedAsDouble):
(mathFloorDoesNotCareAboutMinusZero):
(mathFloorNoArguments):
(mathFloorTooManyArguments):
(testMathFloorOnConstants):
(mathFloorStructTransition):
(Math.floor):
- tests/stress/math-round-should-not-use-truncate.js: Added.
(mathRoundDoesNotCareAboutMinusZero):
- tests/stress/math-rounding-infinity.js: Added.
(shouldBe):
(testRound):
(testFloor):
(testCeil):
- tests/stress/math-rounding-nan.js: Added.
(shouldBe):
(testRound):
(testFloor):
(testCeil):
- tests/stress/math-rounding-negative-zero.js: Added.
(shouldBe):
(testRound):
(testFloor):
(testCeil):
(testRoundNonNegativeZero):
(testRoundNonNegativeZero2):
Websites/webkit.org:
- docs/b3/intermediate-representation.html:
- 6:07 PM Changeset in webkit [197379] by
-
- 29 edits in trunk/Source/JavaScriptCore
Add new MethodTable method to get an estimated size for a cell
https://bugs.webkit.org/show_bug.cgi?id=154838
Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-29
Reviewed by Filip Pizlo.
The new class method estimatedSize(JSCell*) estimates the size for a single cell.
As the name implies, this is meant to be an approximation. It is more important
that big objects report a large size, then to get perfect size information for
all objects in the heap.
Base implementation (JSCell):
- returns the MarkedBlock bucket size for this cell.
- This gets us the object size include inline storage. Basically a better sizeof.
Subclasses with "Extra Memory Cost":
- Any class that reports extra memory (reportExtraMemoryVisited) should include that in the estimated size.
- E.g. CodeBlock, JSGenericTypedArrayView, WeakMapData, etc.
Subclasses with "Copied Space" storage:
- Any class with data in copied space (copyBackingStore) should include that in the estimated size.
- E.g. JSObject, JSGenericTypedArrayView, JSMap, JSSet, DirectArguments, etc.
Add reportExtraMemoryVisited for UnlinkedCodeBlock's compressed unlinked
instructions because this can be larger than 1kb, which is significant.
This has one special case for RegExp generated bytecode / JIT code, which
does not currently fall into the extra memory cost or copied space storage.
In practice I haven't seen this grow to a significant cost.
- runtime/ClassInfo.h:
Add the new estimatedSize method to the table.
- bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::visitChildren):
(JSC::UnlinkedCodeBlock::estimatedSize):
(JSC::UnlinkedCodeBlock::setInstructions):
- bytecode/UnlinkedCodeBlock.h:
Report an extra memory cost for unlinked code blocks like
we do for linked code blocks.
- bytecode/CodeBlock.cpp:
(JSC::CodeBlock::estimatedSize):
- bytecode/CodeBlock.h:
- bytecode/UnlinkedInstructionStream.cpp:
(JSC::UnlinkedInstructionStream::sizeInBytes):
- bytecode/UnlinkedInstructionStream.h:
- runtime/DirectArguments.cpp:
(JSC::DirectArguments::estimatedSize):
- runtime/DirectArguments.h:
- runtime/JSCell.cpp:
(JSC::JSCell::estimatedSizeInBytes):
(JSC::JSCell::estimatedSize):
- runtime/JSCell.h:
- runtime/JSGenericTypedArrayView.h:
- runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::estimatedSize):
- runtime/JSMap.cpp:
(JSC::JSMap::estimatedSize):
- runtime/JSMap.h:
- runtime/JSObject.cpp:
(JSC::JSObject::visitButterfly):
- runtime/JSObject.h:
- runtime/JSSet.cpp:
(JSC::JSSet::estimatedSize):
- runtime/JSSet.h:
- runtime/JSString.cpp:
(JSC::JSString::estimatedSize):
- runtime/JSString.h:
- runtime/MapData.h:
(JSC::MapDataImpl::capacityInBytes):
- runtime/WeakMapData.cpp:
(JSC::WeakMapData::estimatedSize):
(JSC::WeakMapData::visitChildren):
- runtime/WeakMapData.h:
Implement estimated size following the pattern of reporting
extra visited size, or copy space memory.
- runtime/RegExp.cpp:
(JSC::RegExp::estimatedSize):
- runtime/RegExp.h:
- yarr/YarrInterpreter.h:
(JSC::Yarr::ByteDisjunction::estimatedSizeInBytes):
(JSC::Yarr::BytecodePattern::estimatedSizeInBytes):
- yarr/YarrJIT.h:
(JSC::Yarr::YarrCodeBlock::size):
Include generated bytecode / JITCode to a RegExp's size.
- 5:36 PM Changeset in webkit [197378] by
-
- 3 edits in trunk/LayoutTests
Marking webgl/1.0.2/conformance/extensions/get-extension.html as flaky on mac, removing wk1 specific flakiness expectation.
https://bugs.webkit.org/show_bug.cgi?id=152506
Unreviewed test gardening.
- platform/mac-wk1/TestExpectations:
- platform/mac/TestExpectations:
- 5:16 PM Changeset in webkit [197377] by
-
- 2 edits in trunk/LayoutTests
Marking storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange.html as flaky on mac
https://bugs.webkit.org/show_bug.cgi?id=154748
Unreviewed test gardening.
- platform/mac/TestExpectations:
- 4:54 PM Changeset in webkit [197376] by
-
- 2 edits in trunk/LayoutTests
Re-enable passing fast/multicol/newmulticol tests on ios-simulator
Unreviewed test gardening.
- platform/ios-simulator-wk2/TestExpectations:
- 4:44 PM Changeset in webkit [197375] by
-
- 7 edits9 adds in trunk/Source/WebCore
Refactor CoreVideo API access into their own classes so code can be re-used.
https://bugs.webkit.org/show_bug.cgi?id=154544
Reviewed by Eric Carlson.
In order for common CoreVideo code paths to be re-used in other classes, pull those paths
out of MediaPlayerPrivateAVFoundationObjC and into re-usable clasess.
- WebCore.xcodeproj/project.pbxproj:
- platform/cf/CoreMediaSoftLink.cpp:
- platform/cf/CoreMediaSoftLink.h:
- platform/cocoa/CoreVideoSoftLink.cpp: Added.
- platform/cocoa/CoreVideoSoftLink.h: Added.
- platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
- platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
(WebCore::MediaPlayerPrivateAVFoundationObjC::createPixelBuffer):
(WebCore::MediaPlayerPrivateAVFoundationObjC::updateLastImage):
(WebCore::MediaPlayerPrivateAVFoundationObjC::copyVideoTextureToPlatformTexture):
(WebCore::CVPixelBufferGetBytePointerCallback): Deleted.
(WebCore::CVPixelBufferReleaseBytePointerCallback): Deleted.
(WebCore::CVPixelBufferReleaseInfoCallback): Deleted.
(WebCore::createImageFromPixelBuffer): Deleted.
(WebCore::enumToStringMap): Deleted.
- platform/graphics/cv/PixelBufferConformerCV.cpp: Added.
(WebCore::PixelBufferConformerCV::PixelBufferConformerCV):
(WebCore::CVPixelBufferGetBytePointerCallback):
(WebCore::CVPixelBufferReleaseBytePointerCallback):
(WebCore::CVPixelBufferReleaseInfoCallback):
(WebCore::PixelBufferConformerCV::createImageFromPixelBuffer):
- platform/graphics/cv/PixelBufferConformerCV.h: Added.
- platform/graphics/cv/TextureCacheCV.h: Added.
(WebCore::TextureCacheCV::context):
- platform/graphics/cv/TextureCacheCV.mm: Added.
(WebCore::TextureCacheCV::create):
(WebCore::TextureCacheCV::TextureCacheCV):
(WebCore::TextureCacheCV::textureFromImage):
- platform/graphics/cv/VideoTextureCopierCV.cpp: Added.
(WebCore::VideoTextureCopierCV::VideoTextureCopierCV):
(WebCore::VideoTextureCopierCV::~VideoTextureCopierCV):
(WebCore::enumToStringMap):
(WebCore::VideoTextureCopierCV::copyVideoTextureToPlatformTexture):
- platform/graphics/cv/VideoTextureCopierCV.h: Added.
(WebCore::VideoTextureCopierCV::context):
- platform/mediastream/mac/AVVideoCaptureSource.mm: Move SOFT_LINK declarations into CoreVideoSoftLink.h/cpp.
- 4:39 PM Changeset in webkit [197374] by
-
- 2 edits in trunk/Source/JavaScriptCore
SpeculatedType should be easier to edit
https://bugs.webkit.org/show_bug.cgi?id=154840
Reviewed by Mark Lam.
We used to specify the bitmasks in SpeculatedType.h using hex codes. This used to work
great because we didn't have so many masks and you could use the mask to visually see
which ones overlapped. It also made it easy to visualize subset relationships.
But now we have a lot of masks with a lot of confusing overlaps, and it's no longer
possible to just see their relationship by looking at hex codes. Worse, the use of hex
codes makes it super annoying to move the bits around. For example, right now we have two
bits free, but if we wanted to reclaim them by editing the old hex masks, it would be a
nightmare.
So this patch replaces the hex masks with shift expressions (1u << 15 for example) and it
makes any derived masks (i.e. masks that are the bit-or of other masks) be expressed using
an or expression (SpecFoo | SpecBar | SpecBaz for example).
This makes it easier to see the relationships and it makes it easier to take bits for new
types.
- bytecode/SpeculatedType.h:
- 4:08 PM Changeset in webkit [197373] by
-
- 4 edits in trunk/Tools
Fix timing flakiness in test I added in http://trac.webkit.org/changeset/197372
Unreviewed.
- TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess-1.html:
- TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess-2.html:
- TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess.mm:
(TEST): Sometimes a third message from the first html file was leaking through. The message is expected
so we should always wait for it and make sure we got it.
- 3:13 PM Changeset in webkit [197372] by
-
- 9 edits3 adds in trunk
Modern IDB: WebKit 2 IPC layer easily confused about multiple web processes being connected.
https://bugs.webkit.org/show_bug.cgi?id=154837
Reviewed by Alex Christensen.
Source/WebKit2:
The crux of the bug is that WebProcesses cannot assign themselves server-unique identifiers...
The server must do that for them.
A once-per-session-per-WebProcess sync message and a few updates to connection management fix this.
- DatabaseProcess/DatabaseToWebProcessConnection.cpp:
(WebKit::DatabaseToWebProcessConnection::didReceiveSyncMessage):
(WebKit::generateConnectionToServerIdentifier):
(WebKit::DatabaseToWebProcessConnection::establishIDBConnectionToServer):
- DatabaseProcess/DatabaseToWebProcessConnection.h:
- DatabaseProcess/DatabaseToWebProcessConnection.messages.in:
- WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:
(WebKit::WebIDBConnectionToServer::WebIDBConnectionToServer):
(WebKit::generateConnectionToServerIdentifier): Deleted.
- WebProcess/Databases/WebToDatabaseProcessConnection.cpp:
(WebKit::WebToDatabaseProcessConnection::didReceiveMessage):
(WebKit::WebToDatabaseProcessConnection::idbConnectionToServerForSession):
- WebProcess/Databases/WebToDatabaseProcessConnection.h:
Tools:
- TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
- TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess-1.html: Added.
- TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess-2.html: Added.
- TestWebKitAPI/Tests/WebKit2Cocoa/IndexedDBMultiProcess.mm: Added.
- 3:06 PM Changeset in webkit [197371] by
-
- 8 edits in trunk/Source/WebInspectorUI
Web Inspector: Add direct number inputs to Bezier editor
https://bugs.webkit.org/show_bug.cgi?id=154809
<rdar://problem/24881465>
Patch by Devin Rousso <Devin Rousso> on 2016-02-29
Reviewed by Timothy Hatcher.
- UserInterface/Base/Main.js:
(WebInspector._updateWindowKeydownListener):
Now only adds the shared event listener when the first keydown listener
is added via WebInspector.addWindowKeydownListener
- UserInterface/Controllers/CodeMirrorBezierEditingController.js:
(WebInspector.CodeMirrorBezierEditingController.prototype.popoverDidDismiss):
- UserInterface/Controllers/CodeMirrorEditingController.js:
(WebInspector.CodeMirrorEditingController.prototype.popoverDidDismiss):
(WebInspector.CodeMirrorEditingController.prototype.didDismissPopover):
Added function that is called when the popover is dismissed so that
removing event listeners is possible.
- UserInterface/Views/BezierEditor.css:
(.bezier-editor):
(.bezier-editor > .number-input-container):
(.bezier-editor > .number-input-container > input):
- UserInterface/Views/BezierEditor.js:
(WebInspector.BezierEditor.createControl):
(WebInspector.BezierEditor.createBezierInput):
(WebInspector.BezierEditor):
Added usage of Element.prototype.createChild for ease of readability.
Also added input elements for manually changing the values of each bezier
point's x and y values.
(WebInspector.BezierEditor.prototype.set bezier):
(WebInspector.BezierEditor.prototype.removeListeners):
(WebInspector.BezierEditor.prototype._handleMousedown):
(WebInspector.BezierEditor.prototype._updateBezier):
(WebInspector.BezierEditor.prototype._updateBezierPreview):
(WebInspector.BezierEditor.prototype._triggerPreviewAnimation):
(WebInspector.BezierEditor.prototype._handleNumberInputInput):
(WebInspector.BezierEditor.prototype._handleNumberInputKeydown):
(WebInspector.BezierEditor.prototype._changeBezierForInput):
Refactored code to make it more reusable, as well as adding event listeners
to the newly created inputs, including value chaning from the arrow keys.
- UserInterface/Views/CSSStyleDeclarationTextEditor.js:
(WebInspector.CSSStyleDeclarationTextEditor.prototype.didDismissPopover): Deleted.
Removed unused code.
- UserInterface/Views/InlineSwatch.js:
(WebInspector.InlineSwatch):
(WebInspector.InlineSwatch.prototype.didDismissPopover):
Removes any global event listeners added by the current editor if able.
(WebInspector.InlineSwatch.prototype._swatchElementClicked):
Now saves the current editor object as a member variable.
- 2:45 PM Changeset in webkit [197370] by
-
- 3 edits in trunk/Source/JavaScriptCore
OverridesHasInstance constant folding is wrong
https://bugs.webkit.org/show_bug.cgi?id=154833
Reviewed by Filip Pizlo.
The current implementation of OverridesHasInstance constant folding
is incorrect. Since it relies on OSR exit information it has been
moved to the StrengthReductionPhase. Normally, such an optimazation would be
put in FixupPhase, however, there are a number of cases where we don't
determine an edge of OverridesHasInstance is a constant until after fixup.
Performing the optimization during StrengthReductionPhase means we can defer
our decision until later.
In the future we should consider creating a version of this optimization
that does not depend on OSR exit information and move the optimization back
to ConstantFoldingPhase.
- dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants): Deleted.
- dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
- 2:41 PM Changeset in webkit [197369] by
-
- 1 edit1 delete in trunk/LayoutTests
Removing unnecessary ios-simulator-wk2 expectation file.
Unreviewed test gardening.
- platform/ios-simulator-wk2/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/type-change-state-expected.txt: Removed.
- 2:37 PM Changeset in webkit [197368] by
-
- 2 edits in trunk/LayoutTests
Rebaseline imported/w3c/web-platform-tests/html/dom/reflection-forms.html after r197355
Unreviewed test gardening.
- platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-forms-expected.txt:
- 2:37 PM Changeset in webkit [197367] by
-
- 2 edits in trunk/LayoutTests
Rebaseline imported/w3c/web-platform-tests/html/dom/reflection-embedded.html for ios-simulator after r197237
Unreviewed test gardening.
- platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/reflection-embedded-expected.txt:
- 2:33 PM Changeset in webkit [197366] by
-
- 5 edits6 adds in trunk
B3 should have global store elimination
https://bugs.webkit.org/show_bug.cgi?id=154658
Reviewed by Benjamin Poulain.
Source/JavaScriptCore:
Implements fairly comprehensive global store elimination:
1) If you store the result of a load with no interference in between, remove the store.
2) If you store the same thing you stored previously, remove the store.
3) If you store something that you either loaded previously or stored previously along
arbitrarily many paths, remove the store.
4) If you store to something that is stored to again in the future with no interference in
between, remove the store.
Rule (4) is super relevant to FTL since the DFG does not eliminate redundant PutStructures.
A constructor that produces a large object will have many redundant stores to the same base
pointer, offset, and heap range, with no code to observe that heap raneg in between.
This doesn't have a decisive effect on major benchmarks, but it's an enormous win for
microbenchmarks:
- 30% faster to construct an object with many fields.
- 5x faster to do many stores to a global variable.
The compile time cost should be very small. Although the optimization is global, it aborts as
soon as it sees anything that would confound store elimination. For rules (1)-(3), we
piggy-back the existing load elimination, which gives up on interfering stores. For rule (4),
we search forward through the current block and then globally a block at a time (skipping
block contents thanks to summary data), which could be expensive. But rule (4) aborts as soon
as it sees a read, write, or end block (Return or Oops). Any Check will claim to read TOP. Any
Patchpoint that results from an InvalidationPoint will claim to read TOP, as will any
Patchpoints for ICs. Those are usually sprinkled all over the program.
In other words, this optimization rarely kicks in. When it does kick in, it makes programs run
faster. When it doesn't kick in, it's usually O(1) because there are reasons for aborting all
over a "normal" program so the search will halt almost immediately. This of course raises the
question: how much more in compile time do we pay when the optimization does kick in? The
optimization kicks in the most for the microbenchmarks I wrote for this patch. Amazingly, the
effect of the optimization a wash for compile time: whatever cost we pay doing the O(n2)
searches is balanced by the massive reduction in work in the backend. On one of the two
microbenchmarks, overall compile time actually shrank with this optimization even though CSE
itself cost more. That's not too surprising - the backend costs much more per instruction, so
things that remove instructions before we get to the backend tend to be a good idea.
We could consider adding a more aggressive version of this in the future, which could sink
stores into checks. That could be crazy fun: https://bugs.webkit.org/show_bug.cgi?id=152162#c3
But mainly, I'm adding this optimization because it was super fun to implement during the
WebAssembly CG summit.
- b3/B3EliminateCommonSubexpressions.cpp:
- b3/B3MemoryValue.h:
- b3/B3SuccessorCollection.h:
(JSC::B3::SuccessorCollection::begin):
(JSC::B3::SuccessorCollection::end):
(JSC::B3::SuccessorCollection::const_iterator::const_iterator):
(JSC::B3::SuccessorCollection::const_iterator::operator*):
(JSC::B3::SuccessorCollection::const_iterator::operator++):
(JSC::B3::SuccessorCollection::const_iterator::operator==):
(JSC::B3::SuccessorCollection::const_iterator::operator!=):
LayoutTests:
These two benchmarks both speed up significantly with this change.
- js/regress/build-large-object-expected.txt: Added.
- js/regress/build-large-object.html: Added.
- js/regress/many-repeat-stores-expected.txt: Added.
- js/regress/many-repeat-stores.html: Added.
- js/regress/script-tests/build-large-object.js: Added.
- js/regress/script-tests/many-repeat-stores.js: Added.
- 2:14 PM Changeset in webkit [197365] by
-
- 9 edits1 add in trunk/Source/JavaScriptCore
Make it cheap to #include "JITOperations.h"
https://bugs.webkit.org/show_bug.cgi?id=154836
Reviewed by Mark Lam.
Prior to this change, this header included the whole world even though it did't have any
definitions. This patch turns almost all of the includes into forward declarations. Right
now this header is very cheap to include.
- JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
- JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
- JavaScriptCore.xcodeproj/project.pbxproj:
- dfg/DFGSpeculativeJIT.h:
- jit/JITOperations.cpp:
- jit/JITOperations.h:
- jit/Repatch.h:
- runtime/CommonSlowPaths.h:
(JSC::encodeResult): Deleted.
(JSC::decodeResult): Deleted.
- runtime/SlowPathReturnType.h: Added.
(JSC::encodeResult):
(JSC::decodeResult):
- 1:32 PM Changeset in webkit [197364] by
-
- 3 edits in trunk/Source/WebCore
Use WTF::Optional for HTMLOListElement::m_start
https://bugs.webkit.org/show_bug.cgi?id=154824
Reviewed by Andreas Kling.
Use WTF::Optional for HTMLOListElement::m_start.
- html/HTMLOListElement.cpp:
(WebCore::HTMLOListElement::parseAttribute):
- html/HTMLOListElement.h:
- 1:14 PM Changeset in webkit [197363] by
-
- 2 edits1 add in trunk/Tools
[GTK][jhbuild] GLib build fails with GCC 6.0
https://bugs.webkit.org/show_bug.cgi?id=154825
Use the upstream work-around. https://bugzilla.gnome.org/show_bug.cgi?id=761550
Reviewed by Csaba Osztrogonác.
- gtk/jhbuild.modules: Apply upstream path.
- gtk/patches/gdate-suppress-string-format-literal-warning.patch: Added.
- 12:46 PM Changeset in webkit [197362] by
-
- 5 edits in trunk/Source/WebKit2
Don't call NetworkProcess::singleton from WebProcess when using NetworkSession
https://bugs.webkit.org/show_bug.cgi?id=154829
Reviewed by Anders Carlsson.
We were calling NetworkProcess::singleton when making the default session in the
WebProcess, which caused bad things to happen. We also were never clearing the
credentials in the WebProcess between tests because it used to always call
NetworkProcess::singleton, which caused flaky tests.
This fixes repeatable crashes in http/tests/media/media-document-referer.html and
http/tests/media/media-document.html when using NetworkSession.
- NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::NetworkProcess):
(WebKit::NetworkProcess::~NetworkProcess):
- NetworkProcess/NetworkSession.h:
- NetworkProcess/cocoa/NetworkSessionCocoa.mm:
(WebKit::configurationForType):
(WebKit::globalCustomProtocolManager):
(WebKit::NetworkSession::setCustomProtocolManager):
(WebKit::NetworkSession::defaultSession):
- WebProcess/WebProcess.cpp:
(WebKit::WebProcess::clearCachedCredentials):
- 11:35 AM Changeset in webkit [197361] by
-
- 2 edits in trunk/Tools
We've been running Octane/regexp all wrong in run-jsc-benchmarks
https://bugs.webkit.org/show_bug.cgi?id=154827
Reviewed by Andreas Kling.
Octane v.2 and JetStream v.1.1 run this benchmark with warmup. This script was running
it without warmup. This patches fixes this by making this script run it with warmup.
This fix shows that my last patch, which added FTL support for regexp, was actually a 3%
speed-up on Octane/regexp, not a slow-down as the ChangeLog claimed.
It discovered this bug because for each Octane test that I want to debug, I usually make
a standalone .js file that contains the whole test along with a miniharness - usually
a plain loop - that runs it almost like it would for real but with whatever hacks I'm
using for debugging. When I wrote such a thing for regexp, I used a ~20 iteration warmup
to match the one second of warmup that this benchmark gets in Octane. To my surprise,
this quite faithful regexp runner did not see the regression that run-jsc-benchmarks
saw. That's when I found out that run-jsc-benchmarks was running it wrong.
The reason for the no-warmup slow-down is that the FTL is actually fairly expensive to
run on some of these very large functions in the regexp benchmark. I don't think we can
do anything about that, and I'd argue that the speed-up we see after the compilation is
done suggests that it was worth it.
- Scripts/run-jsc-benchmarks:
- 11:32 AM WebKitIDL edited by
- (diff)
- 11:31 AM WebKitIDL edited by
- [TreatNullAs=EmptyString] (diff)
- 10:55 AM Changeset in webkit [197360] by
-
- 16 edits in trunk
RefCounter<T>::Event -> RefCounterEvent
https://bugs.webkit.org/show_bug.cgi?id=154767
Reviewed by Darin Adler.
RefCounter<T>::Event is kinda verbose to use, and there is no need for this
to be specific to a particular typeof RefCounter. Move the enum class up to
the top level & rename to RefCounterEvent.
Source/WebCore:
- page/PageThrottler.cpp:
(WebCore::PageThrottler::PageThrottler):
(WebCore::m_audiblePluginHysteresis):
(WebCore::m_mediaActivityCounter):
(WebCore::m_pageLoadActivityCounter):
- platform/VNodeTracker.cpp:
(WebCore::VNodeTracker::singleton):
(WebCore::VNodeTracker::VNodeTracker):
(WebCore::m_lastWarningTime):
Source/WebKit2:
Also remove UserObservablePageToken - this is vestigial & not really offering
anything over just using UserObservablePageCounter::Token directly.
- UIProcess/Plugins/PluginProcessManager.cpp:
(WebKit::PluginProcessManager::PluginProcessManager):
- UIProcess/Plugins/PluginProcessManager.h:
- UIProcess/Plugins/mac/PluginProcessManagerMac.mm:
(WebKit::PluginProcessManager::updateProcessSuppressionDisabled):
- UIProcess/ProcessThrottler.cpp:
(WebKit::ProcessThrottler::ProcessThrottler):
(WebKit::m_backgroundCounter):
(WebKit::m_suspendMessageCount):
- UIProcess/ProcessThrottler.h:
- UIProcess/WebPageProxy.h:
- UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::WebProcessPool):
(WebKit::m_processSuppressionDisabledForPageCounter):
(WebKit::m_hiddenPageThrottlingAutoIncreasesCounter):
- UIProcess/WebProcessPool.h:
Source/WTF:
- wtf/RefCounter.h:
(WTF::RefCounter<T>::Count::ref):
(WTF::RefCounter<T>::Count::deref):
Tools:
- TestWebKitAPI/Tests/WTF/RefCounter.cpp:
(TestWebKitAPI::TEST):
- 10:51 AM Changeset in webkit [197359] by
-
- 3 edits in trunk/LayoutTests
streams/pipe-to.html flaky on mac-wk1 debug
https://bugs.webkit.org/show_bug.cgi?id=154687
Reviewed by Darin Adler.
- TestExpectations: Marking streams/pipe-to.html as slow.
- streams/pipe-to.html: Increasing the timeout value.
- 10:33 AM Changeset in webkit [197358] by
-
- 5 edits1 delete in trunk/Tools
Remove more LLVM related cruft
https://bugs.webkit.org/show_bug.cgi?id=154821
Reviewed by Darin Adler.
- Scripts/build-jsc:
- Scripts/build-webkit:
- Scripts/copy-webkitlibraries-to-product-directory:
- Scripts/export-llvm-build: Removed.
- Scripts/run-jsc-stress-tests:
- 10:05 AM Changeset in webkit [197357] by
-
- 8 edits2 adds in trunk/Source/JavaScriptCore
FTL should be able to run everything in Octane/regexp
https://bugs.webkit.org/show_bug.cgi?id=154266
Reviewed by Saam Barati.
Adds FTL support for NewRegexp, RegExpTest, and RegExpExec. I couldn't figure out how to
make the RegExpExec peephole optimization work in FTL. This optimizations shouldn't be a
DFG backend optimization anyway - if we need this optimization then it should be a
strength reduction rule over IR. That way, it can be shared by all backends.
I measured whether removing that optimization had any effect on performance separately
from measuring the performance of this patch. Removing that optimization did not change
our score on any benchmarks.
This patch does have an overall negative effect on the Octane/regexp score. This is
presumably because tiering up to the FTL has no value to the code in the regexp test. Or
maybe it's something else. No matter - the overall effect on the Octane score is not
statistically significant and we don't want this kind of coverage blocked by the fact
that adding coverage hurts a benchmark.
- dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
- dfg/DFGNode.h:
(JSC::DFG::Node::setIndexingType):
(JSC::DFG::Node::hasRegexpIndex):
- dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNotifyWrite):
(JSC::DFG::SpeculativeJIT::compileIsObjectOrNull):
(JSC::DFG::SpeculativeJIT::compileRegExpExec): Deleted.
- dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
- dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
- ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
- ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckWatchdogTimer):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
(JSC::FTL::DFG::LowerDFGToB3::didOverflowStack):
- tests/stress/ftl-regexp-exec.js: Added.
- tests/stress/ftl-regexp-test.js: Added.
- 9:54 AM Changeset in webkit [197356] by
-
- 2 edits in releases/WebKitGTK/webkit-2.4/Source/WebCore
Unreviewed. Fix the build with GTK+ < 3.19.
- platform/gtk/ScrollbarThemeGtk3.cpp:
(WebCore::ScrollbarThemeGtk::paintScrollbarBackground):
(WebCore::ScrollbarThemeGtk::paintThumb):
(WebCore::ScrollbarThemeGtk::paintButton):
- 9:36 AM Changeset in webkit [197355] by
-
- 4 edits in trunk
Use HTML parsing rules for textarea.maxLength
https://bugs.webkit.org/show_bug.cgi?id=154805
Reviewed by Andreas Kling.
LayoutTests/imported/w3c:
Rebaseline now that more checks are passing.
- web-platform-tests/html/dom/reflection-forms-expected.txt:
Source/WebCore:
Use HTML parsing rules for textarea.maxLength:
- https://html.spec.whatwg.org/multipage/forms.html#dom-textarea-maxlength
- https://html.spec.whatwg.org/multipage/infrastructure.html#limited-to-only-non-negative-numbers
No new tests, already covered by existing test.
- html/HTMLTextAreaElement.cpp:
(WebCore::HTMLTextAreaElement::maxLength):
- 9:32 AM Changeset in webkit [197354] by
-
- 6 edits in trunk
Align td.rowSpan / td.colSpan with the specification
https://bugs.webkit.org/show_bug.cgi?id=154803
Reviewed by Darin Adler.
LayoutTests/imported/w3c:
Rebaseline now that more checks are passing.
- web-platform-tests/html/dom/reflection-tabular-expected.txt:
Source/WebCore:
Align td.rowSpan / td.colSpan with the specification:
- https://html.spec.whatwg.org/multipage/tables.html#htmltablecellelement
- https://html.spec.whatwg.org/multipage/tables.html#dom-tdth-colspan
- https://html.spec.whatwg.org/multipage/tables.html#dom-tdth-rowspan
In particular, the following changes were made:
- Change type from 'long' to 'unsigned long'.
- Use HTML rules for parsing unsigned integers:
- Use 1 as default value when the input value is out of range instead of 0 when setting.
- rowspan is still clamped to [1, 8190] internally but we now expose the unclamped value to JS as this is an internal restriction. The same is done for a colSpan value of 0, we expose 0 to the Web but clamp to 1 internally.
No new tests, already covered by existing test.
- html/HTMLTableCellElement.cpp:
(WebCore::HTMLTableCellElement::colSpan):
(WebCore::HTMLTableCellElement::rowSpan):
(WebCore::HTMLTableCellElement::rowSpanForBindings):
(WebCore::HTMLTableCellElement::setColSpan):
(WebCore::HTMLTableCellElement::setRowSpanForBindings):
(WebCore::HTMLTableCellElement::axis): Deleted.
(WebCore::HTMLTableCellElement::headers): Deleted.
- html/HTMLTableCellElement.h:
- html/HTMLTableCellElement.idl:
- 9:28 AM Changeset in webkit [197353] by
-
- 39 edits in trunk/Source/WebCore
[Web IDL] Add support for [TreatNullAs=EmptyString] and use it
https://bugs.webkit.org/show_bug.cgi?id=154654
Reviewed by Darin Adler.
Add support for [TreatNullAs=EmptyString] standard Web IDL extended
attribute:
This replaces the WebKit-specific [TreatNullAs=NullString] IDL
extended attribute. Instead of passing a null String() to the
implementation, emptyString() is passed.
This patch does not cause any web-exposed behavior change. For
case where switching from NullString to EmptyString would change
the behavior (or require changes to the implementation), the old
IDL attribute was kept. However, it was renamed to
[TreatNullAs=LegacyNullString] to discourage its use in new code.
Eventually, this legacy IDL attribute should go away entirely.
[TreatNullAs=EmptyString] should only be used when it is present
in the corresponding specification. Note that there are a lot of
places where we use [TreatNullAs=EmptyString] in our IDL where it
does not match the specification. I have added FIXME comments for
those so we can clean them up later.
No new tests, no web-exposed behavior change.
- Modules/mediastream/RTCPeerConnection.idl:
No behavior change because this is not implemented.
- bindings/js/JSDOMBinding.cpp:
(WebCore::valueToStringTreatingNullAsEmptyString):
- bindings/js/JSDOMBinding.h:
Add new function to convert a JSValue into a String while treating
null as the empty string.
- bindings/scripts/CodeGeneratorJS.pm:
(JSValueToNative):
- bindings/scripts/IDLAttributes.txt:
- Add support for [TreatNullAs=EmptyString].
- Rename NullString to LegacyNullString to discourage its use.
- bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
- bindings/scripts/test/GObject/WebKitDOMTestObj.h:
- bindings/scripts/test/JS/JSTestObj.cpp:
- bindings/scripts/test/ObjC/DOMTestObj.h:
- bindings/scripts/test/ObjC/DOMTestObj.mm:
- bindings/scripts/test/TestObj.idl:
Add bindings tests coverage for [TreatNullAs=EmptyString].
- css/CSSStyleDeclaration.idl:
- dom/CharacterData.idl:
- dom/DOMImplementation.idl:
- dom/Document.idl:
- dom/Element.idl:
- dom/ShadowRoot.idl:
- html/HTMLOutputElement.idl:
- html/HTMLScriptElement.idl:
- html/URLUtils.idl:
- svg/SVGAngle.idl:
- svg/SVGLength.idl:
Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString].
There is not behavior change because the implementation does
not distinguish the null string from the empty string.
- html/HTMLBaseElement.idl:
- html/HTMLButtonElement.idl:
- html/HTMLFormElement.idl:
- html/HTMLMediaElement.idl:
- html/HTMLSelectElement.idl:
- svg/SVGElement.idl:
- svg/SVGScriptElement.idl:
Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString],
no behavior change.
- html/HTMLDocument.idl:
- dir and *Color: Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString].
- designMode: Drop [TreatNullAs=NullString] as per the specification:
- https://html.spec.whatwg.org/multipage/dom.html#the-document-object null now gets converted to "null" instead of the null String but this does not change behavior because the implementation only recognizes "on" / "off" / others. So we still end up using inherit mode when set to null.
- html/HTMLElement.idl:
- Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString] for innerText / outerText. Does not change behavior because the implementation does not distinguishes.
- Drop [TreatNullAs=NullString] from contentEditable to match the spec:
- https://html.spec.whatwg.org/multipage/interaction.html#elementcontenteditable This does not change behavior because the implementation will the a SyntaxError wether a null String or the string "null" is passed.
- html/HTMLFrameElement.idl:
Drop [TreatNullAs=NullString] from location attribute. This does not
change behavior because the attribute is using a custom setter.
- html/HTMLInputElement.idl:
- formEnctype / formMethod / autocapitalize: Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString].
- value: Rename [TreatNullAs=NullString] to Rename [TreatNullAs=EmptyString], which does not change behavior because the implementation does not distinguish. Also drop the extended attribute for non-JS bindings as it has no impact.
- html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::setMediaGroup):
Drop redundant group.isNull() check as group.isEmpty() already checks for null.
- html/HTMLScriptElement.cpp:
(WebCore::HTMLScriptElement::setText):
Drop useless .impl() call as we have a String and the method requires a String
as input.
- html/HTMLTextAreaElement.cpp:
(WebCore::HTMLTextAreaElement::setValueCommon):
Use emptyString() instead of "" as it is slightly more efficient.
- html/HTMLTextAreaElement.idl:
- value: Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString]. No behavior change because the implementation does not distinguish.
- autocapitalize: Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString].
- html/canvas/CanvasRenderingContext2D.idl:
- globalCompositeOperation / repetitionType: Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString]. No behavior change because the implementation does not distinguish.
- lineCap / lineJoin: Drop the [TreatNullAs=NullString] to match the spec:
- https://html.spec.whatwg.org/multipage/scripting.html#canvaspathdrawingstyles There is no behavior change because those are string enumerations and the value is not recognized either way (String() or String("null")).
- shadowColor: Drop the [TreatNullAs=NullString] to match the spec:
- https://html.spec.whatwg.org/multipage/scripting.html#canvasshadowstyles No behavior change because this is not a valid color either way.
- 7:03 AM Changeset in webkit [197352] by
-
- 2 edits in trunk/Source/WebKit2
Fixed compilation with !ENABLE(DATABASE_PROCESS).
https://bugs.webkit.org/show_bug.cgi?id=154813
Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-29
Reviewed by Michael Catanzaro.
- UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::terminateDatabaseProcess): Added missing #if
guard.
- 7:01 AM Changeset in webkit [197351] by
-
- 4 edits in trunk
[GTK] Touch slider test fails due to assertion in webkitWebViewBaseTouchEvent()
https://bugs.webkit.org/show_bug.cgi?id=153829
Patch by Adrien Plazas <aplazas@igalia.com> on 2016-02-29
Reviewed by Carlos Garcia Campos.
Source/WebKit2:
Once a touch event sequence is identified as a gesture, remove it
from the list of handled touch events.
- UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseTouchEvent):
LayoutTests:
- platform/gtk/TestExpectations:
Remove now passing tests from the expected failures.
- 6:59 AM Changeset in webkit [197350] by
-
- 2 edits in trunk
[cmake] Allow using FindGLIB in case glib is optional dependency.
https://bugs.webkit.org/show_bug.cgi?id=154796
Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-29
Reviewed by Michael Catanzaro.
FindGLIB caused internal CMake error in case glibconfig.h is not
found.
- Source/cmake/FindGLIB.cmake:
- 5:32 AM Changeset in webkit [197349] by
-
- 3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Revert "Merge r197303 - Shrink UnlinkedCodeBlock a bit."
This reverts commit 200002afed4ac67e3cff10bfa9d7e32d879c9a1f.
- 5:32 AM Changeset in webkit [197348] by
-
- 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Revert "Merge r197305 - REGRESSION(r197303): 4 jsc tests failing on bots."
This reverts commit 497aed24c9437e5d994322493011412097672fab.
- 5:01 AM Changeset in webkit [197347] by
-
- 6 edits in trunk/Source/WebCore
Refactor FetchBody constructors
https://bugs.webkit.org/show_bug.cgi?id=154721
Reviewed by Sam Weinig and Darin Adler.
Covered by existing tests.
- Modules/fetch/FetchBody.cpp:
(WebCore::FetchBody::extract): Renamed from "fromJSValue"
(WebCore::FetchBody::extractFromBody): Renamed from "fromRequestBody" and making use of move constructor.
- Modules/fetch/FetchBody.h:
(WebCore::FetchBody::FetchBody): Making default constructor public and removing empty static method.
- Modules/fetch/FetchRequest.cpp:
(WebCore::buildBody):
- Modules/fetch/FetchResponse.cpp:
(WebCore::FetchResponse::error):
(WebCore::FetchResponse::redirect):
(WebCore::FetchResponse::initializeWith):
- Modules/fetch/FetchResponse.h:
(WebCore::FetchResponse::create):
- 3:47 AM Changeset in webkit [197346] by
-
- 2 edits in trunk/Source/WebKit2
[Mac][cmake] Unreviewed buildfix after r197177. Just for fun.
- PlatformMac.cmake:
- 3:45 AM Changeset in webkit [197345] by
-
- 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Merge r197305 - REGRESSION(r197303): 4 jsc tests failing on bots.
Unreviewed follow-up fix.
- bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): This function
can still get called with !m_rareData, in case the type profiler is active but this
particular code block doesn't have type profiler data. Handle it gracefully.
- 3:45 AM Changeset in webkit [197344] by
-
- 3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Merge r197303 - Shrink UnlinkedCodeBlock a bit.
<https://webkit.org/b/154797>
Reviewed by Anders Carlsson.
Move profiler-related members of UnlinkedCodeBlock into its RareData
structure, saving 40 bytes, and then reorder the other members of
UnlinkedCodeBlock to save another 24 bytes, netting a nice total 64.
The VM member was removed entirely since UnlinkedCodeBlock is a cell
and can retrieve its VM through MarkedBlock header lookup.
- bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::vm):
(JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset):
(JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo):
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
- bytecode/UnlinkedCodeBlock.h:
(JSC::UnlinkedCodeBlock::addRegExp):
(JSC::UnlinkedCodeBlock::addConstant):
(JSC::UnlinkedCodeBlock::addFunctionDecl):
(JSC::UnlinkedCodeBlock::addFunctionExpr):
(JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset):
(JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets):
(JSC::UnlinkedCodeBlock::vm): Deleted.
- 3:31 AM Changeset in webkit [197343] by
-
- 3 edits2 adds in releases/WebKitGTK/webkit-2.12
Merge r197300 - Variables can resolve to the wrong value when elements differ in nothing but inherited variable value
https://bugs.webkit.org/show_bug.cgi?id=154785
Reviewed by Antti Koivisto.
Source/WebCore:
Test: fast/css/variables/avoid-matched-property-cache.html
- css/StyleResolver.cpp:
(WebCore::StyleResolver::MatchResult::addMatchedProperties):
Disable the matched property cache when a value is variable-dependent, because
they can resolve to inherited values, and the matched property cache could
end up copying the wrong value from another similarly-styled element.
LayoutTests:
- fast/css/variables/avoid-matched-property-cache-expected.html: Added.
- fast/css/variables/avoid-matched-property-cache.html: Added.
Add a test. The non-standard element is necessary because the resolved property
cache is already disabled when using the "simple" default style sheet, and
it seems better to use a totally non-standard element than one that might
end up in the "simple" default style sheet in the future and would silently
invalidate the test.
- 3:30 AM Changeset in webkit [197342] by
-
- 10 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Merge r197299 - FTL should lower its abstract heaps to B3 heap ranges
https://bugs.webkit.org/show_bug.cgi?id=154782
Reviewed by Saam Barati.
The FTL can describe the abstract heaps (points-to sets) that a memory operation will
affect. The abstract heaps are arranged as a hierarchy. We used to transform this into
TBAA hierarchies in LLVM, but we never got around to wiring this up to B3's equivalent
notion - the HeapRange. That's what this patch fixes.
B3 has a minimalistic alias analysis. It represents abstract heaps using unsigned 32-bit
integers. There are 1<<32 abstract heaps. The B3 client can describe what an operation
affects by specifying a heap range: a begin...end pair that says that the operation
affects all abstract heaps H such that begin <= H < end.
This peculiar scheme was a deliberate attempt to distill what the abstract heap
hierarchy is all about. We can assign begin...end numbers to abstract heaps so that:
- A heap's end is greater than its begin.
- A heap's begin is greater than or equal to its parent's begin.
- A heap's end is less than or equal to its parent's end.
This is easy to do using a recursive traversal of the abstract heap hierarchy. I almost
went for the iterative traversal, which is a splendid algorithm, but it's totally
unnecessary here since we tightly control the height of the heap hierarchy.
Because abstract heaps are produced on-the-fly by FTL lowering, due to the fact that we
generate new ones for field names and constant indices we encounter, we can't actually
decorate the B3 instructions we create in lowering until all lowering is done. Adding a
new abstract heap to the hierarchy after ranges were already computed would require
updating the ranges of any heaps "to the right" of that heap in the hierarchy. This
patch solves that problem by recording the associations between abstract heaps and their
intended roles in the generated IR, and then decorating all of the relevant B3 values
after we compute the ranges of the hierarchy after lowering.
This is perf-neutral. I was hoping for a small speed-up, but I could not detect a
speed-up on any benchmark. That's not too surprising. We already have very precise CSE
in the DFG, so there aren't many opportunities left for the B3 CSE and it may have
already been getting the big ones even without alias analysis.
Even without a speed-up, this patch is valuable because it makes it easier to implement
other optimizations, like store elimination.
- b3/B3HeapRange.h:
(JSC::B3::HeapRange::HeapRange):
- ftl/FTLAbstractHeap.cpp:
(JSC::FTL::AbstractHeap::AbstractHeap):
(JSC::FTL::AbstractHeap::changeParent):
(JSC::FTL::AbstractHeap::compute):
(JSC::FTL::AbstractHeap::shallowDump):
(JSC::FTL::AbstractHeap::dump):
(JSC::FTL::AbstractHeap::deepDump):
(JSC::FTL::AbstractHeap::badRangeError):
(JSC::FTL::IndexedAbstractHeap::IndexedAbstractHeap):
(JSC::FTL::IndexedAbstractHeap::baseIndex):
(JSC::FTL::IndexedAbstractHeap::atSlow):
(JSC::FTL::IndexedAbstractHeap::initialize):
(JSC::FTL::AbstractHeap::decorateInstruction): Deleted.
(JSC::FTL::AbstractField::dump): Deleted.
- ftl/FTLAbstractHeap.h:
(JSC::FTL::AbstractHeap::AbstractHeap):
(JSC::FTL::AbstractHeap::isInitialized):
(JSC::FTL::AbstractHeap::initialize):
(JSC::FTL::AbstractHeap::parent):
(JSC::FTL::AbstractHeap::heapName):
(JSC::FTL::AbstractHeap::range):
(JSC::FTL::AbstractHeap::offset):
(JSC::FTL::IndexedAbstractHeap::atAnyIndex):
(JSC::FTL::IndexedAbstractHeap::at):
(JSC::FTL::IndexedAbstractHeap::operator[]):
(JSC::FTL::IndexedAbstractHeap::returnInitialized):
(JSC::FTL::IndexedAbstractHeap::WithoutZeroOrOneHashTraits::constructDeletedValue):
(JSC::FTL::IndexedAbstractHeap::WithoutZeroOrOneHashTraits::isDeletedValue):
(JSC::FTL::AbstractHeap::changeParent): Deleted.
(JSC::FTL::AbstractField::AbstractField): Deleted.
(JSC::FTL::AbstractField::initialize): Deleted.
(JSC::FTL::AbstractField::offset): Deleted.
- ftl/FTLAbstractHeapRepository.cpp:
(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
(JSC::FTL::AbstractHeapRepository::~AbstractHeapRepository):
(JSC::FTL::AbstractHeapRepository::decorateMemory):
(JSC::FTL::AbstractHeapRepository::decorateCCallRead):
(JSC::FTL::AbstractHeapRepository::decorateCCallWrite):
(JSC::FTL::AbstractHeapRepository::decoratePatchpointRead):
(JSC::FTL::AbstractHeapRepository::decoratePatchpointWrite):
(JSC::FTL::AbstractHeapRepository::computeRangesAndDecorateInstructions):
- ftl/FTLAbstractHeapRepository.h:
(JSC::FTL::AbstractHeapRepository::forArrayType):
(JSC::FTL::AbstractHeapRepository::HeapForValue::HeapForValue):
- ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::lower):
- ftl/FTLOutput.cpp:
(JSC::FTL::Output::load):
(JSC::FTL::Output::load8SignExt32):
(JSC::FTL::Output::load8ZeroExt32):
(JSC::FTL::Output::load16SignExt32):
(JSC::FTL::Output::load16ZeroExt32):
(JSC::FTL::Output::store):
(JSC::FTL::Output::store32As8):
(JSC::FTL::Output::store32As16):
(JSC::FTL::Output::baseIndex):
- ftl/FTLOutput.h:
(JSC::FTL::Output::address):
(JSC::FTL::Output::absolute):
(JSC::FTL::Output::load8SignExt32):
(JSC::FTL::Output::load8ZeroExt32):
(JSC::FTL::Output::load16SignExt32):
(JSC::FTL::Output::load16ZeroExt32):
(JSC::FTL::Output::load32):
(JSC::FTL::Output::load64):
(JSC::FTL::Output::loadPtr):
(JSC::FTL::Output::loadDouble):
(JSC::FTL::Output::store32):
(JSC::FTL::Output::store64):
(JSC::FTL::Output::storePtr):
(JSC::FTL::Output::storeDouble):
(JSC::FTL::Output::ascribeRange):
(JSC::FTL::Output::nonNegative32):
(JSC::FTL::Output::load32NonNegative):
(JSC::FTL::Output::equal):
(JSC::FTL::Output::notEqual):
- ftl/FTLTypedPointer.h:
(JSC::FTL::TypedPointer::operator!):
(JSC::FTL::TypedPointer::heap):
(JSC::FTL::TypedPointer::value):
- 3:21 AM Changeset in webkit [197341] by
-
- 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore
Merge r197298 - SVGToOTFFontConversion.cpp does not compile with libstdc++ 4.8
https://bugs.webkit.org/show_bug.cgi?id=154794
Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-02-28
Reviewed by Michael Catanzaro.
No new tests needed.
- svg/SVGToOTFFontConversion.cpp:
(WebCore::SVGToOTFFontConverter::appendLigatureSubtable): Added const
qualifiers.
- 3:20 AM Changeset in webkit [197340] by
-
- 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI
Merge r197265 - Web Inspector: DataGrid's resizers aren't horizontally centered
https://bugs.webkit.org/show_bug.cgi?id=154787
<rdar://problem/24876901>
Reviewed by Timothy Hatcher.
- UserInterface/Views/DataGrid.css:
(.data-grid .resizer):
Use CSS transforms as margin-left doesn't support sub-pixel values.
- 3:19 AM Changeset in webkit [197339] by
-
- 10 edits in releases/WebKitGTK/webkit-2.12
Merge r197263 - Prevent cross-origin access to Location.assign() / Location.reload()
https://bugs.webkit.org/show_bug.cgi?id=154779
Reviewed by Darin Adler.
Source/WebCore:
Prevent cross-origin access to Location.assign() / Location.reload()
to match the latest specification:
Firefox and Chrome already prevent this but WebKit allowed it.
No new tests, already covered by existing tests.
- bindings/js/JSLocationCustom.cpp:
(WebCore::JSLocation::getOwnPropertySlotDelegate):
(WebCore::JSLocation::putDelegate): Deleted.
LayoutTests:
Update existing layout tests now that we prevent cross-origin access to
Location.assign() / Location.reload().
- http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt:
- http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html:
- http/tests/security/cross-frame-access-location-get-expected.txt:
- http/tests/security/cross-frame-access-location-get-override-expected.txt:
- http/tests/security/cross-frame-access-location-get-override.html:
- http/tests/security/cross-frame-access-location-get.html:
- http/tests/security/xss-DENIED-defineProperty-expected.txt:
- 3:17 AM Changeset in webkit [197338] by
-
- 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Merge r197256 - CLoop build fix.
- 3:16 AM Changeset in webkit [197337] by
-
- 3 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI
Merge r197245 - Web Inspector: Increase clickable area of the console prompt
https://bugs.webkit.org/show_bug.cgi?id=154719
<rdar://problem/24854538>
Reviewed by Timothy Hatcher.
Clicking on the area around CodeMirror element now moves
focus to the console prompt.
- UserInterface/Views/QuickConsole.js:
(WebInspector.QuickConsole.prototype._handleMouseDown):
Only capture mousedown events on .quick-console.
Don't capture clicks on CodeMirror.
- UserInterface/Views/QuickConsole.css:
(.quick-console > .console-prompt):
(.quick-console > .console-prompt > .CodeMirror):
Make sure .console-prompt is never an event.target for _handleMouseDown.
- 3:16 AM Changeset in webkit [197336] by
-
- 8 edits in releases/WebKitGTK/webkit-2.12/Source
Merge r197244 - Network cache: old pages returned by disk cache on history navigation after session is restored
https://bugs.webkit.org/show_bug.cgi?id=153230
Reviewed by Chris Dumez.
Source/WebCore:
Add a flag to HistoryItem to mark them as restored from session
and use it from the FrameLoader to not change the policy request
when navigating to a history item that was restored from session,
except for iOS port.
- history/HistoryItem.h:
(WebCore::HistoryItem::setWasRestoredFromSession):
(WebCore::HistoryItem::wasRestoredFromSession):
- loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadDifferentDocumentItem):
Source/WebKit2:
Since r181734, the network cache never revalidates resources for
history navigation. This is good for the memory cache, but in the
case of disk cache, we might end up with outdated pages when
restoring the session. When restoring the session happens because
of an API request (we also restore the session when recovering
from a web process crash), we should revalidate back forward list
requests in the disk cache if needed. This will only happen the
first time they are loaded after a session restore. After a web process
crash, resources will be used uncondionally from the disk cache.
- WebProcess/WebPage/WebBackForwardListProxy.cpp:
(WebKit::WebBackForwardListProxy::addItemFromUIProcess): Use Ref&&
instead of PassRefPtr.
- WebProcess/WebPage/WebBackForwardListProxy.h:
- WebProcess/WebPage/WebPage.cpp:
(WebKit::WePage::WebPage): Call restoreSessionInternal passing
No as restoredByAPIRequest parameter.
(WebKit::WebPage::restoreSessionInternal): Set restoredFromSession
flag to the created HistoryItem if the item was restored from
session by an API request.
(WebKit::WebPage::restoreSession): Call restoreSessionInternal
passing Yes as restoredByAPIRequest parameter.
- WebProcess/WebPage/WebPage.h:
- 3:14 AM Changeset in webkit [197335] by
-
- 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI
Merge r197242 - REGRESSION (r196741): Web Inspector: Bottom section of Layers sidebar is 1px shorter than the console prompt
https://bugs.webkit.org/show_bug.cgi?id=154773
<rdar://problem/24873345>
Reviewed by Timothy Hatcher.
- UserInterface/Views/LayerTreeDetailsSidebarPanel.css:
(.sidebar > .panel.details.layer-tree > .content):
(.panel.details.layer-tree .bottom-bar):
- 3:13 AM Changeset in webkit [197334] by
-
- 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2
Merge r197236 - [GTK] Fix order of parameters in gtkdoc for webkit_web_view_get_snapshot
Unreviewed.
- UIProcess/API/gtk/WebKitWebView.cpp:
- 3:12 AM Changeset in webkit [197333] by
-
- 10 edits1 delete in releases/WebKitGTK/webkit-2.12/Source
Merge r197226 - Remove the on demand executable allocator
https://bugs.webkit.org/show_bug.cgi?id=154749
Reviewed by Geoffrey Garen.
Source/JavaScriptCore:
Remove all the DemandExecutable code and executable allocator ifdefs.
- CMakeLists.txt:
- JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
- JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
- JavaScriptCore.xcodeproj/project.pbxproj:
- jit/ExecutableAllocator.cpp: Removed.
(JSC::DemandExecutableAllocator::DemandExecutableAllocator): Deleted.
(JSC::DemandExecutableAllocator::~DemandExecutableAllocator): Deleted.
(JSC::DemandExecutableAllocator::bytesAllocatedByAllAllocators): Deleted.
(JSC::DemandExecutableAllocator::bytesCommittedByAllocactors): Deleted.
(JSC::DemandExecutableAllocator::dumpProfileFromAllAllocators): Deleted.
(JSC::DemandExecutableAllocator::allocateNewSpace): Deleted.
(JSC::DemandExecutableAllocator::notifyNeedPage): Deleted.
(JSC::DemandExecutableAllocator::notifyPageIsFree): Deleted.
(JSC::DemandExecutableAllocator::allocators): Deleted.
(JSC::DemandExecutableAllocator::allocatorsMutex): Deleted.
(JSC::ExecutableAllocator::initializeAllocator): Deleted.
(JSC::ExecutableAllocator::ExecutableAllocator): Deleted.
(JSC::ExecutableAllocator::~ExecutableAllocator): Deleted.
(JSC::ExecutableAllocator::isValid): Deleted.
(JSC::ExecutableAllocator::underMemoryPressure): Deleted.
(JSC::ExecutableAllocator::memoryPressureMultiplier): Deleted.
(JSC::ExecutableAllocator::allocate): Deleted.
(JSC::ExecutableAllocator::committedByteCount): Deleted.
(JSC::ExecutableAllocator::dumpProfile): Deleted.
(JSC::ExecutableAllocator::getLock): Deleted.
(JSC::ExecutableAllocator::isValidExecutableMemory): Deleted.
(JSC::ExecutableAllocator::reprotectRegion): Deleted.
- jit/ExecutableAllocator.h:
- jit/ExecutableAllocatorFixedVMPool.cpp:
- jit/JITStubRoutine.h:
(JSC::JITStubRoutine::canPerformRangeFilter): Deleted.
(JSC::JITStubRoutine::filteringStartAddress): Deleted.
(JSC::JITStubRoutine::filteringExtentSize): Deleted.
Source/WTF:
Remove the DeamndExecutableAllocator compile flags.
- wtf/Platform.h:
- 2:40 AM Changeset in webkit [197332] by
-
- 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Merge r197210 - Reduce direct callers of Structure::findStructuresAndMapForMaterialization
https://bugs.webkit.org/show_bug.cgi?id=154751
Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-02-26
Reviewed by Mark Lam.
- runtime/Structure.cpp:
(JSC::Structure::toStructureShape):
This property name iteration is identical to Structure::forEachPropertyConcurrently.
Share the code and reduce callers to the subtle findStructuresAndMapForMaterialization.
- 2:33 AM Changeset in webkit [197331] by
-
- 3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Merge r197196 - Folding of OverridesHasInstance DFG nodes shoud happen in constant folding not fixup
https://bugs.webkit.org/show_bug.cgi?id=154743
Reviewed by Mark Lam.
- dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
- dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
- 2:26 AM Changeset in webkit [197330] by
-
- 4 edits1 add6 deletes in releases/WebKitGTK/webkit-2.12
Merge r197194 - <g> wrapping <symbol> causes display of hidden <symbol>
https://bugs.webkit.org/show_bug.cgi?id=154576
Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2016-02-26
Reviewed by Darin Adler.
Source/WebCore:
The SVGSymbolElement is allowed in the shadow tree of an SVGUseElement
only if it subtree root element. Any descendant SVGSymbolElement should
be removed from the subtree because it is a hidden container. If the cloned
subtree includes an SVGUseElement which references an SVGSymbolElement,
the same rule will be applied to the descendant SVGUseElement. The goal
is to remove all the descendant SVGSymbolElements from the cloned target
because these SVGSymbolElements will be expanded to SVGSVGElements and
hence become visible.
- svg/SVGUseElement.cpp:
(WebCore::disassociateAndRemoveClones): A helper function which removes
cloned SVGElements and their subtrees from their parents and disassociate
them from their originals.
(WebCore::removeDisallowedElementsFromSubtree): Use disassociateAndRemoveClones().
(WebCore::removeSymbolElementsFromSubtree): Removes all the descendant
SVGSymbolElements from the cloned subtree. It does not remove the root
element itself if it is an SVGSymbolElement because this one will be
expanded to an SVGSVGElement which is exactly what we need.
(WebCore::SVGUseElement::cloneTarget): Call removeSymbolElementsFromSubtree()
to remove the descendant SVGSymbolElements from the cloned subtree before
appending it to the container shadow root.
LayoutTests:
Ensure the <symbol> element is not displayed when it's wrapped in a <g>
element and this <g> element is referenced by a <use> element.
- platform/gtk/svg/custom/use-on-g-containing-symbol-expected.png: Removed.
- platform/gtk/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
- platform/ios-simulator/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
- platform/mac/svg/custom/use-on-g-containing-symbol-expected.png: Removed.
- platform/mac/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
- platform/win/svg/custom/use-on-g-containing-symbol-expected.txt: Removed.
- svg/custom/use-on-g-containing-symbol-expected.svg: Added.
- svg/custom/use-on-g-containing-symbol.svg:
The original test was wrong. It had the following definition:
"<g id='symbol'><symbol>...</symbol></g>"
And it was expecting to have the symbol drawn if the <g> element was
referenced like that
"<use xlink:href='#symbol'/>"
FireFox does not render anything for this <use> element which is correct.
With this patch, this test failed so it had to be modified to test the right
behavior. Also it is now converted to a ref test.
- 2:23 AM Changeset in webkit [197329] by
-
- 3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Merge r197186 - [JSC] Add32(Imm, Tmp, Tmp) does not ZDef the destination if Imm is zero
https://bugs.webkit.org/show_bug.cgi?id=154704
Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-26
Reviewed by Geoffrey Garen.
If the Imm is zero, we should still zero the top bits
to match the definition in AirOpcodes.
- assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::add32):
- b3/testb3.cpp:
- 2:08 AM Changeset in webkit [197328] by
-
- 4 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2
Merge r197180 - Cache::traverse should pass the record info to its traversal handler
https://bugs.webkit.org/show_bug.cgi?id=154695
Reviewed by Antti Koivisto.
- NetworkProcess/NetworkProcess.cpp:
(WebKit::fetchDiskCacheEntries):
(WebKit::clearDiskCacheEntries):
- NetworkProcess/cache/NetworkCache.cpp:
(WebKit::NetworkCache::Cache::traverse):
- NetworkProcess/cache/NetworkCache.h:
- 2:06 AM Changeset in webkit [197327] by
-
- 2 edits in trunk
Unreviewed, rolling out r197297.
https://bugs.webkit.org/show_bug.cgi?id=154810
This change broke build of GTK from scratch (Requested by
annulen on #webkit).
Reverted changeset:
"[cmake] Allow using FindGLIB in case glib is optional
dependency."
https://bugs.webkit.org/show_bug.cgi?id=154796
http://trac.webkit.org/changeset/197297
- 2:03 AM Changeset in webkit [197326] by
-
- 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebInspectorUI
Merge r197169 - Web Inspector: Option-clicking on the a CSS property sometimes doesn't work
https://bugs.webkit.org/show_bug.cgi?id=154384
<rdar://problem/24714755>
Patch by Devin Rousso <Devin Rousso> on 2016-02-26
Reviewed by Timothy Hatcher.
It seems as though there were race conditions between CodeMirror's event
and the native mousemove such that if CodeMirror fired second, the current
candidate was cleared, and would not reset itself until the cursor was
moved, at which point the same issue could happen. To fix this, the current
candidate is no longer cleared by CodeMirror's event and is instead only
modified by the native mouse-events.
- UserInterface/Controllers/CodeMirrorTokenTrackingController.js:
(WebInspector.CodeMirrorTokenTrackingController.prototype._hidePopover):
- 2:02 AM Changeset in webkit [197325] by
-
- 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Merge r197164 - [DFG] Drop unnecessary proved type branch in ToPrimitive
https://bugs.webkit.org/show_bug.cgi?id=154716
Reviewed by Geoffrey Garen.
This branching based on the proved types is unnecessary because this is already handled in constant folding phase.
In fact, the DFGSpeculativeJIT64.cpp case is already removed in r164243.
This patch removes the remaining JIT32_64 case.
- dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
- 2:02 AM Changeset in webkit [197324] by
-
- 8 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Merge r197159 - [JSC] Be aggressive with OSR Entry to FTL if the DFG function was only used for OSR Entry itself
https://bugs.webkit.org/show_bug.cgi?id=154575
Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-25
Reviewed by Filip Pizlo.
I noticed that imaging-gaussian-blur spends most of its
samples in DFG code despite executing most of the loop
iterations in FTL.
On this particular test, the main function is only entered
once and have a very heavy loop there. What happens is DFG
starts by compiling the full function in FTL. That takes about
8 to 10 milliseconds during which the DFG code makes very little
progress. The calls to triggerOSREntryNow() try to OSR Enter
for a while then finally start compiling something. By the time
the function is ready, we have wasted a lot of time in DFG code.
What this patch does is set a flag when a DFG function is entered.
If we try to triggerOSREntryNow() and the flag was never set,
we start compiling both the full function and the one for OSR Entry.
- dfg/DFGJITCode.h:
- dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::compileEntryExecutionFlag):
(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):
- dfg/DFGJITCompiler.h:
- dfg/DFGOperations.cpp:
- dfg/DFGPlan.cpp:
(JSC::DFG::Plan::Plan): Deleted.
- dfg/DFGPlan.h:
- dfg/DFGTierUpCheckInjectionPhase.cpp:
(JSC::DFG::TierUpCheckInjectionPhase::run):
- 1:53 AM Changeset in webkit [197323] by
-
- 2 edits1 add in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Merge r197155 - [JSC] Temporal Dead Zone checks on "this" are eliminated when doing OSR Entry to FTL
https://bugs.webkit.org/show_bug.cgi?id=154664
Reviewed by Saam Barati.
When doing OSR Enter into a constructor, we lose the information
that this may have been set to empty by a previously executed block.
All the code just assumed the type for a FlushedJS value and thus
not an empty value. It was then okay to eliminate the TDZ checks.
In this patch, the values on root entry now assume they may be empty.
As a result, the SetArgument() for "this" has "empty" as possible
type and the TDZ checks are no longer eliminated.
- dfg/DFGInPlaceAbstractState.cpp:
(JSC::DFG::InPlaceAbstractState::initialize):
[JSC] Add the test for r197155
https://bugs.webkit.org/show_bug.cgi?id=154715
Reviewed by Mark Lam.
Silly me. I forgot the test in the latest patch update.
- tests/stress/class-syntax-tdz-osr-entry-in-loop.js: Added.
- 1:45 AM Changeset in webkit [197322] by
-
- 14 edits34 deletes in releases/WebKitGTK/webkit-2.12
Merge r197142 - CSP: Remove SecurityPolicy script interface
https://bugs.webkit.org/show_bug.cgi?id=154694
<rdar://problem/24846482>
Reviewed by Andy Estes.
Source/WebCore:
Remove the Content Security Policy script interface, SecurityPolicy. This interface was only
enabled when building with ENABLE(CSP_NEXT) (disabled by default).
For completeness, the SecurityPolicy interface was removed from the Content Security Policy 1.1 spec.
in <https://github.com/w3c/webappsec/commit/18882953ce2d8afca25f685557fef0e0471b2c9a> (12/26/2013).
- CMakeLists.txt: Remove files to DOMSecurityPolicy.{cpp, idl}.
- DerivedSources.cpp: Remove file JSDOMSecurityPolicy.cpp.
- DerivedSources.make: Remove file DOMSecurityPolicy.idl.
- PlatformGTK.cmake: Ditto.
- PlatformMac.cmake: Ditto.
- WebCore.xcodeproj/project.pbxproj: Remove files DOMSecurityPolicy files.
- bindings/scripts/CodeGeneratorGObject.pm: Remove reference to DOMSecurityPolicy.
- dom/Document.cpp:
(WebCore::Document::securityPolicy): Deleted.
- dom/Document.h:
- dom/Document.idl: Remove attribute securityPolicy.
- page/DOMSecurityPolicy.cpp: Removed.
- page/DOMSecurityPolicy.h: Removed.
- page/DOMSecurityPolicy.idl: Removed.
LayoutTests:
Remove SecurityPolicy tests and update platform-specific expected results as needed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowconnectionto-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowconnectionto.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-alloweval-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-alloweval.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowfontfrom-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowfontfrom.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowformaction-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowformaction.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowframefrom-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowframefrom.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowimagefrom-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowimagefrom.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinescript-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinescript.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinestyle-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowinlinestyle.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowmediafrom-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowmediafrom.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowobjectfrom-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowobjectfrom.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowplugintype-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowplugintype.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowscriptfrom-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowscriptfrom.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowstylefrom-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-allowstylefrom.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-isactive-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-isactive.html: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-reporturi-expected.txt: Removed.
- http/tests/security/contentSecurityPolicy/1.1/securitypolicy-reporturi.html: Removed.
- http/tests/security/contentSecurityPolicy/resources/securitypolicy-tests-base.js: Removed.
- platform/gtk/js/dom/global-constructors-attributes-expected.txt: Update expected result as needed.
- platform/win/js/dom/global-constructors-attributes-expected.txt: Ditto.
- 1:27 AM Changeset in webkit [197321] by
-
- 2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore
Merge r197141 - Don't clear the weak JSString cache on memory pressure.
<https://webkit.org/b/154693>
Reviewed by Antti Koivisto.
This was stupid. The cache is a WeakGCMap, so all the JSStrings pointed to are
still alive anyway. This way we keep the ability to deduplicate common strings.
- platform/MemoryPressureHandler.cpp:
(WebCore::MemoryPressureHandler::releaseNoncriticalMemory): Deleted.
- 1:25 AM Changeset in webkit [197320] by
-
- 4 edits1 delete in releases/WebKitGTK/webkit-2.12/LayoutTests
Merge r197138 - Unreviewed test gardening.
Fix a test flake where order doesn't matter.
- platform/wk2/storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-expected.txt: Removed.
- storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-expected.txt:
- storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-private-expected.txt:
- storage/indexeddb/resources/deletedatabase-delayed-by-open-and-versionchange.js:
(prepareDatabase.request.onblocked):
(onOpenSuccess):
- 1:25 AM Changeset in webkit [197319] by
-
- 2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore
Merge r197134 - [JSC] Remove a useless "Move" in the lowering of Select
https://bugs.webkit.org/show_bug.cgi?id=154670
Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-02-25
Reviewed by Geoffrey Garen.
I left the Move instruction when creating the aliasing form
of Select.
On ARM64, that meant a useless move for any case that can't
be coalesced.
On x86, that meant an extra constraint on child2, making it
stupidly hard to alias child1.
- b3/B3LowerToAir.cpp:
(JSC::B3::Air::LowerToAir::createSelect): Deleted.
- 1:15 AM Changeset in webkit [197318] by
-
- 4 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore
Merge r197125 - REGRESSION (r196268): Many assertion failures and crashes on SVG path animation tests when JS garbage collection happens quickly
https://bugs.webkit.org/show_bug.cgi?id=154331
Reviewed by Darin Adler.
This is not an actual regression. The bug did exist before r196268 but
the whole document was leaking once an SVGAnimatedProperty was created
so there was no way to produce this bug. After fixing the leak, one crash
and one assert got uncovered. Both of them happen because of the fact:
"if an SVGAnimatedProperty is not referenced it will be deleted."
- svg/SVGPathElement.cpp:
(WebCore::SVGPathElement::lookupOrCreateDWrapper):
The code in this function was assuming that the wrapper will be created
only once which happens when SVGAnimatedProperty::lookupOrCreateWrapper()
is called. Before making this single call, lookupOrCreateDWrapper() was
building an initial SVGPathSegList from byte stream. But now
SVGAnimatedProperty::lookupWrapper() can return false even after creating
the SVGAnimatedProperty because it was deleted later. Calling
buildSVGPathSegListFromByteStream() more than once was causing
SVGAnimatedListPropertyTearOff::animationStarted() to fire the assertion
ASSERT(m_values.size() == m_wrappers.size()) because the path segments were
appended twice to m_values which is in fact SVGPathElement::m_pathSegList.value.
The fix is to build the initial SVGPathSegList only once which should happen
when m_pathSegList.value.isEmpty().
(WebCore::SVGPathElement::animatedPropertyWillBeDeleted):
- svg/SVGPathElement.h:
- svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
(WebCore::SVGAnimatedPathSegListPropertyTearOff::~SVGAnimatedPathSegListPropertyTearOff):
SVGPathElement is assuming the following equivalence relation:
m_pathSegList.shouldSynchronize ~ SVGAnimatedProperty_is_created_and_not_null.
SVGPathElement::animatedPathSegList() and animatedNormalizedPathSegList()
set m_pathSegList.shouldSynchronize to true when SVGAnimatedProperty is
created but nothing sets m_pathSegList.shouldSynchronize back to false.
This was not a problem when the SVGAnimatedProperty was leaking but after
ensuring it is deleted when it is not referenced this equivalence relation
becomes untrue sometimes. This caused SVGPathElement::svgAttributeChanged()
to crash when we check m_pathSegList.shouldSynchronize and if it is true we
assume that SVGAnimatedProperty::lookupWrapper() will return a non-null pointer
and therefore we deference this pointer and call SVGAnimatedProperty::isAnimating().
To fix this crash we need to set m_pathSegList.shouldSynchronize back to false
when the associated SVGAnimatedProperty is deleted.
- 1:13 AM Changeset in webkit [197317] by
-
- 4 edits in releases/WebKitGTK/webkit-2.12
Merge r197123 - HashMap::ensure() should return an AddResult like all the other add-like functions.
https://bugs.webkit.org/show_bug.cgi?id=154680
Reviewed by Anders Carlsson.
While adopting HashMap::ensure(), I found it was useful in some circumstances to know
if the value was added or not. While I could discern this information by setting a bool
in the passed in lambda, it seemed clearer and more idiomatic to just have ensure return
an AddResult like all the other add-like functions do.
- wtf/HashMap.h:
Change return type of HashMap::ensure() to be an AddResult.
Tools:
HashMap::ensure() should return an AddResult like all the other add-like functions
https://bugs.webkit.org/show_bug.cgi?id=154680
Reviewed by Anders Carlsson.
- TestWebKitAPI/Tests/WTF/HashMap.cpp:
(TestWebKitAPI::TEST):
Update tests to use/test the new AddResult result.
- 12:36 AM Changeset in webkit [197316] by
-
- 3 edits2 adds in trunk
::slotted doesn't work in nested shadow trees
https://bugs.webkit.org/show_bug.cgi?id=154765
<rdar://problem/24870995>
Reviewed by Ryosuke Niwa.
Source/WebCore:
See https://github.com/w3c/webcomponents/issues/331#issuecomment-189191593
Test: fast/shadow-dom/css-scoping-shadow-slotted-nested.html
- css/ElementRuleCollector.cpp:
(WebCore::ElementRuleCollector::matchSlottedPseudoElementRules):
Collect ::slotted rules from all the nested shadow trees instead of just the host's.
LayoutTests:
- fast/shadow-dom/css-scoping-shadow-slotted-nested-expected.html: Added.
- fast/shadow-dom/css-scoping-shadow-slotted-nested.html: Added.
