Timeline

Dec 24, 2016:

1:26 PM Changeset in webkit [210146] by commit-queue@webkit.org

• 16 edits
  2 adds in trunk

[test262] Fixing mapped arguments object property test case
​https://bugs.webkit.org/show_bug.cgi?id=159398

Patch by Caio Lima <Caio Lima> on 2016-12-24
Reviewed by Saam Barati.

JSTests:

• stress/arguments-bizarre-behaviour-disable-enumerability.js:
• stress/arguments-define-property.js: Added.

(assert):
(testProperties):

• stress/arguments-non-configurable.js: Added.

(assert):
(tryChangeNonConfigurableDescriptor):
(set tryChangeNonConfigurableDescriptor):
(tryChangeWritableOfNonConfigurableDescriptor):

• test262.yaml:

Source/JavaScriptCore:

This patch changes GenericArguments' override mechanism to
implement corret behavior on ECMAScript test262 suite test cases of
mapped arguments object with non-configurable and non-writable
property. Also it is ensuring that arguments[i]
cannot be deleted when argument "i" is {configurable: false}.

The previous implementation is against to the specification for 2 reasons:

1. Every argument in arguments object are {writable: true} by default (​http://www.ecma-international.org/ecma-262/7.0/index.html#sec-createunmappedargumentsobject). It means that we have to stop mapping a defined property index if the new property descriptor contains writable (i.e writable is present) and its value is false (also check ​https://tc39.github.io/ecma262/#sec-arguments-exotic-objects-defineownproperty-p-desc). Previous implementation considers {writable: false} if writable is not present.

2. When a property is overriden, "delete" operation is always returning true. However delete operations should follow the specification.

We created an auxilary boolean array named m_modifiedArgumentsDescriptor
to store which arguments[i] descriptor was changed from its default
property descriptor. This modification was necessary because m_overrides
was responsible to keep this information at the same time
of keeping information about arguments mapping. The problem of this apporach was
that we needed to call overridesArgument(i) as soon as the ith argument's property
descriptor was changed and it stops the argument's mapping as sideffect, producing
wrong behavior.
To keep tracking arguments mapping status, we renamed DirectArguments::m_overrides to
DirectArguments::m_mappedArguments and now we it is responsible to manage if an
argument[i] is mapped or not.
With these 2 structures, now it is possible to an argument[i] have its property
descriptor modified and don't stop the mapping as soon as it happens. One example
of that wrong behavior can be found on arguments-bizarre-behaviour-disable-enumerability
test case, that now is fixed by this new mechanism.

• bytecode/PolymorphicAccess.cpp:

(JSC::AccessCase::generateWithGuard):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
(JSC::DFG::SpeculativeJIT::compileGetArrayLength):
(JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):

• ftl/FTLAbstractHeapRepository.h:
• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):

• jit/JITOperations.cpp:

(JSC::canAccessArgumentIndexQuickly):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emitDirectArgumentsGetByVal):

• runtime/DirectArguments.cpp:

(JSC::DirectArguments::estimatedSize):
(JSC::DirectArguments::visitChildren):
(JSC::DirectArguments::overrideThings):
(JSC::DirectArguments::overrideThingsIfNecessary):
(JSC::DirectArguments::unmapArgument):
(JSC::DirectArguments::copyToArguments):
(JSC::DirectArguments::overridesSize):
(JSC::DirectArguments::overrideArgument): Deleted.

• runtime/DirectArguments.h:

(JSC::DirectArguments::length):
(JSC::DirectArguments::isMappedArgument):
(JSC::DirectArguments::isMappedArgumentInDFG):
(JSC::DirectArguments::getIndexQuickly):
(JSC::DirectArguments::setIndexQuickly):
(JSC::DirectArguments::overrodeThings):
(JSC::DirectArguments::initModifiedArgumentsDescriptorIfNecessary):
(JSC::DirectArguments::setModifiedArgumentDescriptor):
(JSC::DirectArguments::isModifiedArgumentDescriptor):
(JSC::DirectArguments::offsetOfMappedArguments):
(JSC::DirectArguments::offsetOfModifiedArgumentsDescriptor):
(JSC::DirectArguments::canAccessIndexQuickly): Deleted.
(JSC::DirectArguments::canAccessArgumentIndexQuicklyInDFG): Deleted.
(JSC::DirectArguments::offsetOfOverrides): Deleted.

• runtime/GenericArguments.h:
• runtime/GenericArgumentsInlines.h:

(JSC::GenericArguments<Type>::visitChildren):
(JSC::GenericArguments<Type>::getOwnPropertySlot):
(JSC::GenericArguments<Type>::getOwnPropertySlotByIndex):
(JSC::GenericArguments<Type>::getOwnPropertyNames):
(JSC::GenericArguments<Type>::put):
(JSC::GenericArguments<Type>::putByIndex):
(JSC::GenericArguments<Type>::deleteProperty):
(JSC::GenericArguments<Type>::deletePropertyByIndex):
(JSC::GenericArguments<Type>::defineOwnProperty):
(JSC::GenericArguments<Type>::initModifiedArgumentsDescriptor):
(JSC::GenericArguments<Type>::initModifiedArgumentsDescriptorIfNecessary):
(JSC::GenericArguments<Type>::setModifiedArgumentDescriptor):
(JSC::GenericArguments<Type>::isModifiedArgumentDescriptor):
(JSC::GenericArguments<Type>::copyToArguments):

• runtime/ScopedArguments.cpp:

(JSC::ScopedArguments::visitChildren):
(JSC::ScopedArguments::unmapArgument):
(JSC::ScopedArguments::overrideArgument): Deleted.

• runtime/ScopedArguments.h:

(JSC::ScopedArguments::isMappedArgument):
(JSC::ScopedArguments::isMappedArgumentInDFG):
(JSC::ScopedArguments::getIndexQuickly):
(JSC::ScopedArguments::setIndexQuickly):
(JSC::ScopedArguments::initModifiedArgumentsDescriptorIfNecessary):
(JSC::ScopedArguments::setModifiedArgumentDescriptor):
(JSC::ScopedArguments::isModifiedArgumentDescriptor):
(JSC::ScopedArguments::canAccessIndexQuickly): Deleted.
(JSC::ScopedArguments::canAccessArgumentIndexQuicklyInDFG): Deleted.

10:00 AM Changeset in webkit [210145] by Alan Bujtas

• 8 edits in trunk/Source/WebCore

RenderBlockFlow::moveFloatsTo does not move floats.
​https://bugs.webkit.org/show_bug.cgi?id=166467

Reviewed by Darin Adler.

RenderBlockFlow::moveFloatsTo name is misleading. Floats are not moved from "this" to
the new RenderBlockFlow parent, but rather they are copied so that overhanging floats
don't get lost.

Covered by existing tests.

• rendering/FloatingObjects.cpp:

(WebCore::FloatingObject::cloneForNewParent):
(WebCore::FloatingObject::unsafeClone): Deleted.

• rendering/FloatingObjects.h:
• rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::addFloatsToNewParent):
(WebCore::RenderBlockFlow::moveAllChildrenIncludingFloatsTo):
(WebCore::RenderBlockFlow::moveFloatsTo): Deleted.

• rendering/RenderBlockFlow.h:
• rendering/RenderRubyBase.cpp:

(WebCore::RenderRubyBase::mergeChildrenWithBase):

• rendering/RenderRubyBase.h:
• rendering/RenderRubyRun.cpp:

(WebCore::RenderRubyRun::removeChild):

Dec 23, 2016:

8:39 PM Changeset in webkit [210144] by aestes@apple.com

• 2 edits in trunk/Source/WebKit/mac

[iOS] DumpRenderTree triggers an assertion failure when calling +[WebPreferences _switchNetworkLoaderToNewTestingSession]
​https://bugs.webkit.org/show_bug.cgi?id=166471

Reviewed by Andreas Kling.

When DumpRenderTree starts up, it calls
+[WebPreferences _switchNetworkLoaderToNewTestingSession] from the main thread. In Debug
builds, this triggers the ASSERT(isMainThread()) in
NetworkStorageSession::defaultNetworkStorageSession() because the Web thread has already
started, we are on the main thread, and we are not holding the Web thread lock. This is
causing all layout tests to crash in the iOS WK1 Debug configuration.

• WebView/WebPreferences.mm: (+[WebPreferences _switchNetworkLoaderToNewTestingSession]):

Take the Web thread lock before calling NetworkStorageSession::switchToNewTestingSession().

5:14 PM Changeset in webkit [210143] by aestes@apple.com

• 7 edits
  1 move
  1 delete in trunk

[iOS] Fix some crashing webarchive tests
​https://bugs.webkit.org/show_bug.cgi?id=166470

Reviewed by Andreas Kling.

Tools:

Tests that use TestRunner.dumpDOMAsWebArchive() crashed on iOS due to a stub implementation
of WebArchiveDumpSupport in WebKitTestRunner. The Mac implementation works fine on iOS too,
so this change uses that on both platforms.

• WebKitTestRunner/Configurations/InjectedBundle.xcconfig: Removed

WebArchiveDumpSupportMac.mm from EXCLUDED_SOURCE_FILE_NAMES.

• WebKitTestRunner/InjectedBundle/cocoa/WebArchiveDumpSupportCocoa.mm: Renamed from

Tools/WebKitTestRunner/mac/WebArchiveDumpSupportMac.mm.

• WebKitTestRunner/PlatformMac.cmake:
• WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj:
• WebKitTestRunner/ios/WebArchiveDumpSupportIOS.mm: Removed.

LayoutTests:

Removed entries for previously crashing/failing tests.

• platform/ios-simulator-wk2/TestExpectations:
• platform/ios-simulator/TestExpectations:

4:23 PM Changeset in webkit [210142] by akling@apple.com

• 6 edits
  2 adds in trunk

REGRESSION(r209865): Crash when navigating back to some pages with compositing layers.
<​https://webkit.org/b/166469>
<rdar://problem/29109053>

Reviewed by Darin Adler.

Source/WebCore:

Remove the old WK1-era clear/restoreBackingStores optimization from the page cache.
When enabling it on non-iOS platforms, we started hitting lots of assertions,
and none of our memory tests showed any significant improvement anyway.

Test: compositing/page-cache-back-crash.html

• history/CachedFrame.cpp:

(WebCore::CachedFrameBase::CachedFrameBase):
(WebCore::CachedFrameBase::restore):
(WebCore::CachedFrame::CachedFrame):

• history/CachedFrame.h:
• page/FrameView.cpp:

(WebCore::FrameView::restoreBackingStores): Deleted.

• page/FrameView.h:

LayoutTests:

Add a smoke test for the crashes we were seeing. Thanks to Zalán for the reduction.

• compositing/page-cache-back-crash-expected.txt: Added.
• compositing/page-cache-back-crash.html: Added.

2:13 PM Changeset in webkit [210141] by aestes@apple.com

• 1 edit in trunk/Source/WebKit2/UIProcess/ApplePay/cocoa/WebPaymentCoordinatorProxyCocoa.mm

Fix iOS engineering builds.

2:01 PM Changeset in webkit [210140] by commit-queue@webkit.org

• 4 edits in trunk/Source/WebCore

Add missing std::optional to ApplePayPaymentRequest.lineItems
​https://bugs.webkit.org/show_bug.cgi?id=166468

Patch by Sam Weinig <​sam@webkit.org> on 2016-12-23
Reviewed by Alexey Proskuryakov.

No functional change, but is more consistent.

• Modules/applepay/ApplePayPaymentRequest.h:

Remove unnecessary #include of <heap/Strong.h>, add std::optional to lineItems.

• Modules/applepay/ApplePaySession.cpp:

(WebCore::convertAndValidate):
Update to deal with optional line items, remove unnecessary comment.

• Modules/applepay/ApplePaySession.h:

Remove unneeded forward declarations.

11:45 AM Changeset in webkit [210139] by mark.lam@apple.com

• 2 edits in trunk/Source/JavaScriptCore

Using Option::breakOnThrow() shouldn't crash while printing a null CodeBlock.
​https://bugs.webkit.org/show_bug.cgi?id=166466

Reviewed by Keith Miller.

• runtime/VM.cpp:

(JSC::VM::throwException):

11:26 AM Changeset in webkit [210138] by mark.lam@apple.com

• 2 edits in trunk/Source/JavaScriptCore

Enhance LLInt tracing to dump the codeBlock signature instead of just a pointer where appropriate.
​https://bugs.webkit.org/show_bug.cgi?id=166465

Reviewed by Keith Miller.

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::traceFunctionPrologue):

11:08 AM Changeset in webkit [210137] by keith_miller@apple.com

• 8 edits in trunk

WebAssembly: trap on bad division.
​https://bugs.webkit.org/show_bug.cgi?id=164786

Reviewed by Mark Lam.

JSTests:

Also, mark conversions as passing.

• wasm.yaml:
• wasm/wasm.json:

Source/JavaScriptCore:

This patch adds traps for division / modulo by zero and for
division by int_min / -1.

• wasm/WasmB3IRGenerator.cpp:

(JSC::Wasm::B3IRGenerator::emitChecksForModOrDiv):

• wasm/WasmExceptionType.h:
• wasm/WasmPlan.cpp:

(JSC::Wasm::Plan::run):

• wasm/wasm.json:

11:01 AM Changeset in webkit [210136] by mark.lam@apple.com

• 3 edits in trunk/Source/JavaScriptCore

Fix broken LLINT_SLOW_PATH_TRACING build.
​https://bugs.webkit.org/show_bug.cgi?id=166463

Reviewed by Keith Miller.

• llint/LLIntExceptions.cpp:

(JSC::LLInt::returnToThrow):
(JSC::LLInt::callToThrow):

• runtime/CommonSlowPathsExceptions.cpp:

(JSC::CommonSlowPaths::interpreterThrowInCaller):

10:16 AM Changeset in webkit [210135] by aestes@apple.com

• 1 edit in trunk/Source/WebCore/platform/network/mac/WebCoreResourceHandleAsDelegate.mm

Try to fix the Mac CMake build after r210130.

• platform/network/mac/WebCoreResourceHandleAsDelegate.mm:

9:09 AM Changeset in webkit [210134] by weinig@apple.com

• 22 edits
  3 deletes in trunk

[WebIDL] Remove custom bindings for WebSQL code
​https://bugs.webkit.org/show_bug.cgi?id=166441

Reviewed by Darin Adler.

Source/WebCore:

• Replace custom variant type SQLValue with a type alias of a Variant.
• Use the newly representable SQLValue to remove custom bindings for SQLResultSetRowList::item and SQLTransaction::executeSql.

• CMakeLists.txt:
• WebCore.xcodeproj/project.pbxproj:
• bindings/js/JSBindingsAllInOne.cpp:
• bindings/js/JSSQLResultSetRowListCustom.cpp: Removed.
• bindings/js/JSSQLTransactionCustom.cpp: Removed.
• platform/sql/SQLValue.cpp: Removed.

Remove files.

• Modules/webdatabase/SQLResultSetRowList.cpp:

(WebCore::SQLResultSetRowList::length):
(WebCore::SQLResultSetRowList::item):

• Modules/webdatabase/SQLResultSetRowList.h:
• Modules/webdatabase/SQLResultSetRowList.idl:

Sink the implementation of item() into the implementation. Use a
record type to bridge to javascript.

• Modules/webdatabase/SQLStatement.cpp:

(WebCore::SQLStatement::SQLStatement):

• Modules/webdatabase/SQLStatement.h:

Update to take arguments by rvalue reference.

• Modules/webdatabase/SQLTransaction.cpp:

(WebCore::SQLTransaction::executeSql):

• Modules/webdatabase/SQLTransaction.h:
• Modules/webdatabase/SQLTransaction.idl:

Remove custom annotation, and update signature to match the IDL.

• Modules/webdatabase/SQLTransactionBackend.cpp:
• Modules/webdatabase/SQLTransactionBackend.h:

Remove unneeded #includes of SQLValue.h

• bindings/js/JSDOMConvert.h:

(WebCore::Converter<IDLNull>::convert):
(WebCore::JSConverter<IDLNull>::convert):
Implement conversion for the null type so it can be used in the SQLValue union.

• inspector/InspectorDatabaseAgent.cpp:
• platform/sql/SQLiteStatement.cpp:

(WebCore::SQLiteStatement::bindValue):
(WebCore::SQLiteStatement::getColumnValue):

• platform/sql/SQLiteStatement.h:

Replace old switch with a WTF::switchOn that operates on the new variant.

• platform/sql/SQLValue.h:

(WebCore::SQLValue::SQLValue): Deleted.
(WebCore::SQLValue::type): Deleted.
Replace implementation with a Variant.

LayoutTests:

• storage/websql/execute-sql-args-expected.txt:
• storage/websql/execute-sql-args.js:

Update test and result to be slightly more strict about functions taking sequences.

6:41 AM WebKitGTK/2.14.x edited by Michael Catanzaro

(diff)

6:36 AM Changeset in webkit [210133] by Michael Catanzaro

• 2 edits in trunk/Source/WebCore

[GTK] GLES build broken since r208997
​https://bugs.webkit.org/show_bug.cgi?id=166455

Unreviewed. Fix the preprocessor guards here; this code is incompatible with GLES2.

Looks like it's been broken for a month. Typical!

• platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:

(WebCore::Extensions3DOpenGLCommon::initializeAvailableExtensions):

1:15 AM Changeset in webkit [210132] by zandobersek@gmail.com

• 11 edits in trunk/Source/WebCore

[EME][GStreamer] Enable various code paths for ENCRYPTED_MEDIA
​https://bugs.webkit.org/show_bug.cgi?id=166054

Reviewed by Xabier Rodriguez-Calvar.

Add ENABLE_ENCRYPTED_MEDIA build guards in various places in GStreamer
code to enable decryption-related GStreamer elements and the proper
decryptor handling in AppendPipeline.

• platform/GStreamer.cmake:
• platform/graphics/gstreamer/GStreamerUtilities.cpp:
• platform/graphics/gstreamer/GStreamerUtilities.h:
• platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

(WebCore::registerWebKitGStreamerElements):
(WebCore::MediaPlayerPrivateGStreamerBase::handleSyncMessage):
Only call needKey() if LEGACY_ENCRYPTED_MEDIA is enabled, since this is
the way the legacy EME system expects to be notified of key necessity.
It's very likely ENCRYPTED_MEDIA will do this differently.

• platform/graphics/gstreamer/eme/WebKitClearKeyDecryptorGStreamer.cpp:
• platform/graphics/gstreamer/eme/WebKitClearKeyDecryptorGStreamer.h:
• platform/graphics/gstreamer/eme/WebKitCommonEncryptionDecryptorGStreamer.cpp:
• platform/graphics/gstreamer/eme/WebKitCommonEncryptionDecryptorGStreamer.h:
• platform/graphics/gstreamer/mse/AppendPipeline.cpp:

(WebCore::AppendPipeline::parseDemuxerSrcPadCaps):
(WebCore::AppendPipeline::connectDemuxerSrcPadToAppsinkFromAnyThread):
(WebCore::AppendPipeline::disconnectDemuxerSrcPadFromAppsinkFromAnyThread):

• platform/graphics/gstreamer/mse/AppendPipeline.h:

1:11 AM Changeset in webkit [210131] by rniwa@webkit.org

• 3 edits in trunk/Source/WebCore

Eliminate the use of lastChild in TextIterator
​https://bugs.webkit.org/show_bug.cgi?id=166456

Reviewed by Antti Koivisto.

Just use the node we just existed in TextIterator::exitNode and in emitting additional new line
to eliminate the use of Node::lastChild.

Also initialize member variables in the declaration instead of the constructor to modernize the code.

• editing/TextIterator.cpp:

(WebCore::TextIterator::TextIterator):
(WebCore::TextIterator::advance):
(WebCore::TextIterator::exitNode):

• editing/TextIterator.h: