⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Timeline



May 28, 2017:

10:30 PM Changeset in webkit [217531] by mitz@apple.com
  • 39 edits in trunk/Source

[Xcode] ALWAYS_SEARCH_USER_PATHS is set to YES
​https://bugs.webkit.org/show_bug.cgi?id=172691

Reviewed by Tim Horton.

  • Configurations/Base.xcconfig: Set ALWAYS_SEARCH_USER_PATHS to NO.

Source/JavaScriptCore:

Source/WebCore:

  • WebCore.xcodeproj/project.pbxproj: Added DateTimeChooser.h, DateTimeChooserClient.h, PerformanceMark.h, PerformanceMeasure.h, SVGUnknownElement.h, and MathMLUnknownElement.h to the WebCore target.

Source/WebKit2:

  • UIProcess/API/C/WKAPICast.h: Moved GTK-only definitions that used WebGrammarDetail.h to WKAPICastGtk.h. This had the effect of no longer including APIArray.h from this header.
  • UIProcess/API/C/gtk/WKAPICastGtk.h: Moved GTK-only definitions to here.

(WebKit::toAPI):

  • UIProcess/WebGrammarDetail.h: Replaced include of APIArray.h with a forward declaration.
  • Shared/API/c/WKRenderLayer.cpp:
  • Shared/API/c/WKRenderObject.cpp:
  • UIProcess/API/C/WKApplicationCacheManager.cpp:
  • UIProcess/API/C/WKContext.cpp:
  • UIProcess/API/C/WKContextConfigurationRef.cpp:
  • UIProcess/API/C/WKCookieManager.cpp:
  • UIProcess/API/C/WKKeyValueStorageManager.cpp:
  • UIProcess/API/C/WKNotificationManager.cpp:
  • UIProcess/API/C/WKOpenPanelResultListener.cpp:
  • UIProcess/API/C/WKPageGroup.cpp:
  • UIProcess/API/C/WKResourceCacheManager.cpp:
  • UIProcess/API/C/WKUserContentControllerRef.cpp:
  • UIProcess/API/gtk/WebKitBackForwardList.cpp:
  • UIProcess/WebContextMenuListenerProxy.cpp:

Added #include "APIArray.h" to these files now that WKAPICast.h does not include it.

10:09 PM Changeset in webkit [217530] by Yusuke Suzuki
  • 2 edits in trunk/Source/JavaScriptCore

[JSC] Provide better type information of toLength and tighten bytecode
​https://bugs.webkit.org/show_bug.cgi?id=172690

Reviewed by Sam Weinig.

In this patch, we carefully leverage operator + in order to

  1. tighten bytecode

operator+ emits to_number bytecode. What this bytecode does is the same
to @Number() call. It is more efficient, and it is smaller bytecode
than @Number() call (load global variable @Number, set up arguments, and
call it).

  1. offer better type prediction data

Now, we have code like

length > 0 ? (length < @MAX_SAFE_INTEGER ? length : @MAX_SAFE_INTEGER) : 0

This is not good because DFG prediction propagation phase predicts as Double
since @MAX_SAFE_INTEGER is double. But actually it rarely becomes Double.
Usually, the result becomes Int32. This patch leverages to_number in a bit
interesting way: to_number has value profiling to offer better type prediction.
This value profiling can offer a chance to change the prediction to Int32 efficiently.
It is a bit tricky. But it is worth doing to speed up our builtin functions,
which should leverage all the JSC's tricky things to be optimized.

Related microbenchmarks show performance improvement.

baseline patched

array-prototype-forEach 50.2348+-2.2331 49.7568+-2.3507
array-prototype-map 51.0574+-1.8166 47.9531+-2.1653 might be 1.0647x faster
array-prototype-some 52.3926+-1.8882 48.3632+-2.0852 definitely 1.0833x faster
array-prototype-every 52.7394+-2.0712 50.2896+-2.1480 might be 1.0487x faster
array-prototype-reduce 54.9994+-2.3638 51.8716+-2.6253 might be 1.0603x faster
array-prototype-reduceRight 209.7594+-9.2594 51.5867+-2.5745 definitely 4.0662x faster

  • builtins/GlobalOperations.js:

(globalPrivate.toInteger):
(globalPrivate.toLength):

6:30 PM Changeset in webkit [217529] by commit-queue@webkit.org
  • 7 edits
    2 adds in trunk

[WebIDL] @@iterator should only be accessed once when disambiguating a union type
​https://bugs.webkit.org/show_bug.cgi?id=172684

Patch by Sam Weinig <​sam@webkit.org> on 2017-05-28
Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

  • runtime/IteratorOperations.cpp:

(JSC::iteratorMethod):
(JSC::iteratorForIterable):

  • runtime/IteratorOperations.h:

(JSC::forEachInIterable):
Add additional iterator helpers to allow union + sequence conversion code
to check for iterability by getting the iterator method, and iterate using
that method later on.

Source/WebCore:

WebIDL specifies that when determining if the value you are converting to a union
is a sequence, you must get the @@iterator property and, should it exist, use it
to iterate the sequence. While we correctly accessing the property to make the
determination, we were not passing it into the sequence conversion code, and thus
the sequence conversion code re-accessed it, which is observable and wrong.

This patch pipes the @@iterator method through the sequence conversion code to avoid
this.

Test: js/dom/sequence-in-union-iterator-access.html

  • bindings/js/JSDOMConvertSequences.h:

(WebCore::Detail::GenericSequenceConverter::convert):
(WebCore::Detail::NumericSequenceConverter::convertArray):
(WebCore::Detail::NumericSequenceConverter::convert):
(WebCore::Detail::SequenceConverter::convertArray):
(WebCore::Detail::SequenceConverter::convert):
(WebCore::Detail::SequenceConverter<IDLLong>::convert):
(WebCore::Detail::SequenceConverter<IDLFloat>::convert):
(WebCore::Detail::SequenceConverter<IDLUnrestrictedFloat>::convert):
(WebCore::Detail::SequenceConverter<IDLDouble>::convert):
(WebCore::Detail::SequenceConverter<IDLUnrestrictedDouble>::convert):
(WebCore::Converter<IDLSequence<T>>::convert):
(WebCore::Converter<IDLFrozenArray<T>>::convert):
Add variants of convert that take a JSObject* (sequence) / JSValue (iterator method)
rather than just the JSValue (sequence). To avoid too much duplication, split some
parts of SequenceConverter and NumericSequenceConverter up so they could be reused.

  • bindings/js/JSDOMConvertUnion.h:
  • Fix incorrect step 3 (WebIDL got updated at some point and we didn't notice) to remove records.
  • Update sequence and FrozenArray checking/conversion to get the iterator method and pass it along, using the new ConditionalSequenceConverter helper which forwards to the new sequence converters that accept the iterator method.

LayoutTests:

  • js/dom/sequence-in-union-iterator-access-expected.txt: Added.
  • js/dom/sequence-in-union-iterator-access.html: Added.

Add test case showing that @@iterator is only accessed once when converting a sequence
as part of a union.

7:11 AM Changeset in webkit [217528] by Yusuke Suzuki
  • 2 edits in trunk/Source/WTF

[JSC][Linux][FreeBSD] Use faster Interpreter::getOpcodeID()
​https://bugs.webkit.org/show_bug.cgi?id=172686

Reviewed by Mark Lam.

As of r217526, JSC gets faster Interpreter::getOpcodeID() by
embedding OpcodeID value just before the LLInt machine code
handler pointer. By doing so, we can retrieve OpcodeID from
the LLInt machine code handler by dereferencing the code
pointer. *((int*)ptr - 1).

This patch allows Linux and FreeBSD environments to use this
optimization.

  • wtf/Platform.h:
4:33 AM Changeset in webkit [217527] by Yusuke Suzuki
  • 5 edits in trunk/Source/JavaScriptCore

Unreviewed, build fix for Windows
​https://bugs.webkit.org/show_bug.cgi?id=172413

Optimized jsDynamicCast for JSMap and JSSet will be handled in [1].

[1]: ​https://bugs.webkit.org/show_bug.cgi?id=172685

  • runtime/JSMap.h:

(JSC::isJSMap):
(JSC::jsDynamicCast): Deleted.
(JSC::>): Deleted.

  • runtime/JSSet.h:

(JSC::isJSSet):
(JSC::jsDynamicCast): Deleted.
(JSC::>): Deleted.

  • runtime/MapConstructor.cpp:

(JSC::constructMap):

  • runtime/SetConstructor.cpp:

(JSC::constructSet):

1:12 AM Changeset in webkit [217526] by mark.lam@apple.com
  • 9 edits in trunk/Source

Implement a faster Interpreter::getOpcodeID().
​https://bugs.webkit.org/show_bug.cgi?id=172669

Reviewed by Saam Barati.

Source/JavaScriptCore:

We can implement Interpreter::getOpcodeID() without a hash table lookup by always
embedding the OpcodeID in the 32-bit word just before the start of the LLInt
handler code that executes each opcode. getOpcodeID() can therefore just read
the 32-bits before the opcode address to get its OpcodeID.

This is currently only enabled for CPU(X86), CPU(X86_64), CPU(ARM64),
CPU(ARM_THUMB2), and only for OS(DARWIN). It'll probably just work for linux as
well, but I'll let the Linux folks turn that on after they have verified that it
works on linux too.

I'll also take this opportunity to clean up how we initialize the opcodeIDTable:

  1. we only need to initialize it once per process, not once per VM / interpreter instance.
  2. we can initialize it in the Interpreter constructor instead of requiring a separate call to an initialize() function.

On debug builds, the Interpreter constructor will also verify that getOpcodeID()
is working correctly for each opcode when USE(LLINT_EMBEDDED_OPCODE_ID).

  • bytecode/BytecodeList.json:
  • generate-bytecode-files:
  • interpreter/Interpreter.cpp:

(JSC::Interpreter::Interpreter):
(JSC::Interpreter::opcodeIDTable):
(JSC::Interpreter::initialize): Deleted.

  • interpreter/Interpreter.h:

(JSC::Interpreter::getOpcode):
(JSC::Interpreter::getOpcodeID):

  • llint/LowLevelInterpreter.cpp:
  • runtime/VM.cpp:

(JSC::VM::VM):

Source/WTF:

Added the USE(LLINT_EMBEDDED_OPCODE_ID) configuration.

  • wtf/Platform.h:

May 27, 2017:

4:21 PM Changeset in webkit [217525] by Yusuke Suzuki
  • 18 edits
    1 move
    10 adds
    1 delete in trunk

[JSC] Map and Set constructors should have fast path for cloning
​https://bugs.webkit.org/show_bug.cgi?id=172413

Reviewed by Saam Barati.

JSTests:

  • stress/map-clone-instance-iterator-change.js: Added.

(shouldBe):
(map.Symbol.iterator):

  • stress/map-clone-iterator-change.js: Added.

(shouldBe):
(Map.prototype.Symbol.iterator):

  • stress/map-clone-next-change.js: Added.

(shouldBe):
(map.Symbol.iterator.proto.next):

  • stress/map-clone.js: Added.

(shouldBe):
(Map.prototype):

  • stress/map-inherit-set.js: Added.

(shouldBe):
(DerivedMap):
(set for):

  • stress/set-clone-instance-iterator-change.js: Added.

(shouldBe):
(set Symbol.iterator):

  • stress/set-clone-iterator-change.js: Added.

(shouldBe):
(set Set.prototype.Symbol.iterator):

  • stress/set-clone-next-change.js: Added.

(shouldBe):
(set Symbol.iterator.proto.next):

  • stress/set-clone.js: Added.

(shouldBe):
(set Set.prototype.add):

  • stress/set-inherit-add.js: Added.

(shouldBe):
(DerivedSet.set add):

Source/JavaScriptCore:

In this patch, we add a fast path for cloning in Set and Map constructors.

In ARES-6 Air, we have code like new Set(set) to clone the given set.
At that time, our generic path just iterates the given set object and add
it to the newly created one. It is quite slow because we need to follow
the iterator protocol inside C++ and we need to call set.add() repeatedly
while the given set guarantees the elements are unique.

This patch implements clone() function to JSMap and JSSet. Cloning JSMap
and JSSet are done really fast without invoking any observable JS functions.
To check whether we can use this clone() function in Set and Map constructors,
we set several watchpoints.

In the case of Set,

  1. Set.prototype[Symbol.iterator] is not changed.
  2. SetIterator.prototype.next is not changed.
  3. Set.prototype.add is not changed.
  4. The given Set does not have [Symbol.iterator] function in its instance.
  5. The given Set's Prototype is Set.prototype.
  6. Newly created set's Prototype is Set.prototype.

If the above requirements are met, cloning the given Set is not observable to users.
Thus we can take a fast path.

Currently, we do not integrate this optimization into DFG and FTL.
And we do not optimize other iterables. For example, we can optimize Set
constructor taking Int32 Array. And we should optimize generic iterator cases too.
They are planned as part of a separate bug[1].

This change improves ARES-6 Air by 5.3% in steady state.

Baseline:

Running... Air ( 1 to go)
firstIteration: 76.41 +- 15.60 ms
averageWorstCase: 40.63 +- 7.54 ms
steadyState: 9.13 +- 0.51 ms

Patched:

Running... Air ( 1 to go)
firstIteration: 75.00 +- 22.54 ms
averageWorstCase: 39.18 +- 8.45 ms
steadyState: 8.67 +- 0.28 ms

[1]: ​https://bugs.webkit.org/show_bug.cgi?id=172419

  • CMakeLists.txt:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • runtime/ArrayIteratorAdaptiveWatchpoint.cpp: Removed.
  • runtime/HashMapImpl.h:

(JSC::HashMapBucket::extractValue):
(JSC::HashMapImpl::finishCreation):
(JSC::HashMapImpl::add):
(JSC::HashMapImpl::setUpHeadAndTail):
(JSC::HashMapImpl::addNormalizedNonExistingForCloning):
(JSC::HashMapImpl::addNormalizedInternal):

  • runtime/InternalFunction.cpp:

(JSC::InternalFunction::createSubclassStructureSlow):
(JSC::InternalFunction::createSubclassStructure): Deleted.

  • runtime/InternalFunction.h:

(JSC::InternalFunction::createSubclassStructure):

  • runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::JSGlobalObject):
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):

  • runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::mapIteratorProtocolWatchpoint):
(JSC::JSGlobalObject::setIteratorProtocolWatchpoint):
(JSC::JSGlobalObject::mapSetWatchpoint):
(JSC::JSGlobalObject::setAddWatchpoint):
(JSC::JSGlobalObject::mapPrototype):
(JSC::JSGlobalObject::jsSetPrototype):
(JSC::JSGlobalObject::setStructure):

  • runtime/JSGlobalObjectInlines.h:

(JSC::JSGlobalObject::isMapPrototypeIteratorProtocolFastAndNonObservable):
(JSC::JSGlobalObject::isSetPrototypeIteratorProtocolFastAndNonObservable):
(JSC::JSGlobalObject::isMapPrototypeSetFastAndNonObservable):
(JSC::JSGlobalObject::isSetPrototypeAddFastAndNonObservable):

  • runtime/JSMap.cpp:

(JSC::JSMap::clone):
(JSC::JSMap::canCloneFastAndNonObservable):

  • runtime/JSMap.h:

(JSC::jsDynamicCast):
(JSC::>):
(JSC::JSMap::createStructure): Deleted.
(JSC::JSMap::create): Deleted.
(JSC::JSMap::set): Deleted.
(JSC::JSMap::JSMap): Deleted.

  • runtime/JSSet.cpp:

(JSC::JSSet::clone):
(JSC::JSSet::canCloneFastAndNonObservable):

  • runtime/JSSet.h:

(JSC::jsDynamicCast):
(JSC::>):
(JSC::JSSet::createStructure): Deleted.
(JSC::JSSet::create): Deleted.
(JSC::JSSet::JSSet): Deleted.

  • runtime/MapConstructor.cpp:

(JSC::constructMap):

  • runtime/ObjectPropertyChangeAdaptiveWatchpoint.h: Renamed from Source/JavaScriptCore/runtime/ArrayIteratorAdaptiveWatchpoint.h.

(JSC::ObjectPropertyChangeAdaptiveWatchpoint::ObjectPropertyChangeAdaptiveWatchpoint):

  • runtime/SetConstructor.cpp:

(JSC::constructSet):

Tools:

  • TestWebKitAPI/Tests/WTF/MathExtras.cpp:

(TestWebKitAPI::TEST):

1:15 PM Changeset in webkit [217524] by Chris Dumez
  • 11 edits
    2 adds in trunk

imported/w3c/web-platform-tests/html/semantics/forms/form-control-infrastructure/form_attribute.html is crashing
​https://bugs.webkit.org/show_bug.cgi?id=172472
<rdar://problem/32334831>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

  • web-platform-tests/html/semantics/forms/form-control-infrastructure/form_attribute-expected.txt:

Rebaseline test now that more checks are passing. We were previously wrongly resetting the input form owner
to null when removing the form from the document and the input had a form attribute set and was a descendant
of the form.

Source/WebCore:

Fix assertion hit when running imported/w3c/web-platform-tests/html/semantics/forms/form-control-infrastructure/form_attribute.html.

When the form was removed from the document, A descendant would try to find a new form owner in the document. If the descendant had
a form content attribute and there was another form in the document with this ID, then we would erroneously associate the descendant with
that other form, even though that descendant is being disconnected. This is because when the form with the given id is removed, we
notify the IdTargetObservers of the change. In this case, the form control is an IdTargetObserver and gets notified after
removedFrom() has been called on the form but *before* removedFrom() has been called on its descendant form control. As a result, the
form control still thinks it is in the tree (i.e. isConnected() wrongly returns true) and we make the wrong decision and try to
associate it with another form in the document.

To address the problem, we leverage the fact that when a form element is being removed, it already notifies its associated form
controls that it is being removed. When it does, we make sure to clear the control's id observer if the form is its ancestor.
The ID observer is no longer needed beyond this point since the control is now disconnected from the document, and the ID observer
callback would erroneously associate it with another form element in the document of the same ID because isConnected() still returns
true at that point.
As a result, the control's form owner is kept unchanged, which is the right thing to do here, since it is its ancestor, even
though both are detached.

Test: fast/dom/HTMLFormElement/form-removal-duplicate-id-crash.html

  • dom/ContainerNode.h:

(WebCore::Node::rootNode):
Inline rootNode to avoid an extra function call in the fast path case. For the slow path, we now
call traverseToRootNode() to avoid duolicating logic.

  • dom/Node.cpp:

(WebCore::Node::traverseToRootNode):
Add a traverseToRootNode() method which gets the root node by traversing the ancestors. This logic was duplicated in 3 places:

  • Slow path in Node::rootNode()
  • computeRootNode() in FormAssociatedElement.cpp
  • findRoot() in HTMLFormElement.cpp

They are now consolidated in a single place to avoid duplication.

  • dom/Node.h:
  • html/FormAssociatedElement.cpp:

(WebCore::FormAssociatedElement::removedFrom):
Just simplify the logic a bit:

  • Clear the id observer (i.e. m_formAttributeTargetObserver) no matter what. Since the element is no longer part of the document, it is no longer needed. We would previously have checks that would basically avoid resetting m_formAttributeTargetObserver to null if it is already null. Settign m_formAttributeTargetObserver to null is cheap so there is no reason for those checks. Those checks were also confusing because they made it look like we would sometimes keep on id observer after being removed from the document.
  • Use new traverseToRootNode() utility function (no behavior change)
  • Drop unnecessary |element| local variable

(WebCore::FormAssociatedElement::formOwnerRemovedFromTree):

  • Rename to formOwnerRemovedFromTree() to make it clear that it is the element's form owner that is removed, and not just any form.
  • As we traverse the tree up to find the root, also check if we find the form owner. If we do, clear the id observer since we are effectively detached from the document and return early since there is no need to reset our form owner in this case.
  • html/FormAssociatedElement.h:
  • html/HTMLFormElement.cpp:

(WebCore::HTMLFormElement::removedFrom):

  • Use new traverseToRootNode() utility function (no behavior change)

LayoutTests:

Unskip test that is no longer crashing in Debug builds.

  • fast/dom/HTMLFormElement/form-removal-duplicate-id-crash-expected.txt: Added.
  • fast/dom/HTMLFormElement/form-removal-duplicate-id-crash.html: Added.

Add reduced test case reproducing the crash.

12:03 PM Changeset in webkit [217523] by Yusuke Suzuki
  • 26 edits
    13 moves
    1 delete in trunk/Source

[DOMJIT] Move DOMJIT patchpoint infrastructure out of domjit
​https://bugs.webkit.org/show_bug.cgi?id=172260

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

DOMJIT::Patchpoint is now used for generalized CheckSubClass. And it becomes mature enough
to be used as a general-purpose injectable compiler over all the JIT tiers.

We extract DOMJIT::Patchpoint to jit/ and rename it JSC::Snippet.

  • CMakeLists.txt:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • bytecode/AccessCaseSnippetParams.cpp: Renamed from Source/JavaScriptCore/bytecode/DOMJITAccessCasePatchpointParams.cpp.

(JSC::SlowPathCallGeneratorWithArguments::generateImpl):
(JSC::AccessCaseSnippetParams::emitSlowPathCalls):

  • bytecode/AccessCaseSnippetParams.h: Renamed from Source/JavaScriptCore/bytecode/DOMJITAccessCasePatchpointParams.h.

(JSC::AccessCaseSnippetParams::AccessCaseSnippetParams):

  • bytecode/GetterSetterAccessCase.cpp:

(JSC::GetterSetterAccessCase::emitDOMJITGetter):

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::blessCallDOMGetter):
(JSC::DFG::ByteCodeParser::handleDOMJITGetter):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGGraph.h:
  • dfg/DFGNode.h:
  • dfg/DFGSnippetParams.cpp: Renamed from Source/JavaScriptCore/dfg/DFGDOMJITPatchpointParams.cpp.
  • dfg/DFGSnippetParams.h: Renamed from Source/JavaScriptCore/dfg/DFGDOMJITPatchpointParams.h.

(JSC::DFG::SnippetParams::SnippetParams):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::allocateTemporaryRegistersForSnippet):
(JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
(JSC::DFG::SpeculativeJIT::compileCheckSubClass):
(JSC::DFG::allocateTemporaryRegistersForPatchpoint): Deleted.

  • domjit/DOMJITCallDOMGetterSnippet.h: Renamed from Source/JavaScriptCore/domjit/DOMJITCallDOMGetterPatchpoint.h.

(JSC::DOMJIT::CallDOMGetterSnippet::create):

  • domjit/DOMJITGetterSetter.h:
  • domjit/DOMJITSignature.h:
  • domjit/DOMJITValue.h: Removed.
  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
(JSC::FTL::DFG::LowerDFGToB3::compileCallDOMGetter):

  • ftl/FTLSnippetParams.cpp: Renamed from Source/JavaScriptCore/ftl/FTLDOMJITPatchpointParams.cpp.
  • ftl/FTLSnippetParams.h: Renamed from Source/JavaScriptCore/ftl/FTLDOMJITPatchpointParams.h.

(JSC::FTL::SnippetParams::SnippetParams):

  • jit/Snippet.h: Renamed from Source/JavaScriptCore/domjit/DOMJITPatchpoint.h.

(JSC::Snippet::create):
(JSC::Snippet::setGenerator):
(JSC::Snippet::generator):

  • jit/SnippetParams.h: Renamed from Source/JavaScriptCore/domjit/DOMJITPatchpointParams.h.

(JSC::SnippetParams::~SnippetParams):
(JSC::SnippetParams::Value::Value):
(JSC::SnippetParams::Value::isGPR):
(JSC::SnippetParams::Value::isFPR):
(JSC::SnippetParams::Value::isJSValueRegs):
(JSC::SnippetParams::Value::gpr):
(JSC::SnippetParams::Value::fpr):
(JSC::SnippetParams::Value::jsValueRegs):
(JSC::SnippetParams::Value::reg):
(JSC::SnippetParams::Value::value):
(JSC::SnippetParams::SnippetParams):

  • jit/SnippetReg.h: Renamed from Source/JavaScriptCore/domjit/DOMJITReg.h.

(JSC::SnippetReg::SnippetReg):

  • jit/SnippetSlowPathCalls.h: Renamed from Source/JavaScriptCore/domjit/DOMJITSlowPathCalls.h.
  • jsc.cpp:

(WTF::DOMJITNode::checkSubClassSnippet):
(WTF::DOMJITFunctionObject::checkSubClassSnippet):
(WTF::DOMJITNode::checkSubClassPatchpoint): Deleted.
(WTF::DOMJITFunctionObject::checkSubClassPatchpoint): Deleted.

  • runtime/ClassInfo.h:

Source/WebCore:

  • ForwardingHeaders/jit/Snippet.h: Renamed from Source/WebCore/ForwardingHeaders/domjit/DOMJITPatchpoint.h.
  • ForwardingHeaders/jit/SnippetParams.h: Renamed from Source/WebCore/ForwardingHeaders/domjit/DOMJITPatchpointParams.h.
  • bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):
(GenerateImplementation):

  • bindings/scripts/test/JS/JSTestDOMJIT.h:
  • domjit/DOMJITCheckDOM.h:

(WebCore::DOMJIT::checkDOM):

  • domjit/DOMJITHelpers.h:

(WebCore::DOMJIT::toWrapper):

  • domjit/JSDocumentDOMJIT.cpp:

(WebCore::checkSubClassSnippetForJSDocument):
(WebCore::DocumentDocumentElementDOMJIT::callDOMGetter):
(WebCore::DocumentBodyDOMJIT::callDOMGetter):
(WebCore::checkSubClassPatchpointForJSDocument): Deleted.

  • domjit/JSDocumentFragmentDOMJIT.cpp:

(WebCore::checkSubClassSnippetForJSDocumentFragment):
(WebCore::checkSubClassPatchpointForJSDocumentFragment): Deleted.

  • domjit/JSElementDOMJIT.cpp:

(WebCore::checkSubClassSnippetForJSElement):
(WebCore::checkSubClassPatchpointForJSElement): Deleted.

  • domjit/JSEventDOMJIT.cpp:

(WebCore::checkSubClassSnippetForJSEvent):
(WebCore::checkSubClassPatchpointForJSEvent): Deleted.

  • domjit/JSNodeDOMJIT.cpp:

(WebCore::checkSubClassSnippetForJSNode):
(WebCore::createCallDOMGetterForOffsetAccess):
(WebCore::NodeFirstChildDOMJIT::callDOMGetter):
(WebCore::NodeLastChildDOMJIT::callDOMGetter):
(WebCore::NodeNextSiblingDOMJIT::callDOMGetter):
(WebCore::NodePreviousSiblingDOMJIT::callDOMGetter):
(WebCore::NodeParentNodeDOMJIT::callDOMGetter):
(WebCore::NodeNodeTypeDOMJIT::callDOMGetter):
(WebCore::NodeOwnerDocumentDOMJIT::callDOMGetter):
(WebCore::checkSubClassPatchpointForJSNode): Deleted.

10:13 AM Changeset in webkit [217522] by Simon Fraser
  • 22 edits
    1 copy
    4 adds in trunk

getComputedStyle returns percentage values for left / right / top / bottom
​https://bugs.webkit.org/show_bug.cgi?id=29084

Reviewed by Zalan Bujtas.
LayoutTests/imported/w3c:

New baselines (still failing).

  • web-platform-tests/css-timing-1/frames-timing-functions-output-expected.txt:
  • web-platform-tests/html/semantics/interactive-elements/the-dialog-element/centering-expected.txt:

Source/WebCore:

Fix getComputedStyle() to return pixel values for left / right / top / bottom, per spec.

This is mostly a merge of ​https://codereview.chromium.org/13871003/.

Behavior now matches Chrome and Firefox.

Test: fast/css/getComputedStyle/getComputedStyle-offsets.html

  • css/CSSComputedStyleDeclaration.cpp:

(WebCore::getOffsetComputedLength):
(WebCore::getOffsetUsedStyleRelative):
(WebCore::getOffsetUsedStyleAbsolute):
(WebCore::positionOffsetValue):
(WebCore::positionOffsetValueIsRendererDependent):
(WebCore::isNonReplacedInline):
(WebCore::isLayoutDependent):
(WebCore::ComputedStyleExtractor::propertyValue):

LayoutTests:

Some new baselines, a new test, and an improved test.

  • animations/trigger-container-scroll-boundaries-expected.txt:
  • animations/trigger-container-scroll-boundaries.html:
  • animations/trigger-container-scroll-empty-expected.txt:
  • animations/trigger-container-scroll-empty.html:
  • animations/trigger-container-scroll-simple-expected.txt:
  • animations/trigger-container-scroll-simple.html:
  • fast/css/getComputedStyle/computed-style-expected.txt:
  • fast/css/getComputedStyle/computed-style-negative-top-expected.txt:
  • fast/css/getComputedStyle/computed-style-negative-top.html: Convert to a real JS test, add more cases.
  • fast/css/getComputedStyle/getComputedStyle-offsets-expected.txt: Added.
  • fast/css/getComputedStyle/getComputedStyle-offsets.html: Added.
  • fast/css/getComputedStyle/getComputedStyle-zoom-and-background-size-expected.txt:
  • fast/css/getComputedStyle/getComputedStyle-zoom-and-background-size.html: It doesn't make any sense to test right/bottom.
  • fast/css/hover-affects-child-expected.txt:
  • fast/css/hover-affects-child.html:
  • platform/mac-elcapitan/fast/css/getComputedStyle/computed-style-expected.txt:
  • transitions/transition-to-from-auto-expected.txt:
  • transitions/transition-to-from-auto.html:
9:23 AM Changeset in webkit [217521] by Alan Bujtas
  • 4 edits in trunk

enclosingIntRect returns a rect with -1 width/height when the input FloatRect overflows integer.
​https://bugs.webkit.org/show_bug.cgi?id=172676

Reviewed by Simon Fraser.

Source/WebCore:

Clamp integer values soon after the enclosing rectangle is resolved.

  • platform/graphics/FloatRect.cpp:

(WebCore::enclosingIntRect):

Tools:

  • TestWebKitAPI/Tests/WebCore/FloatRect.cpp:

(TestWebKitAPI::TEST):

Note: See TracTimeline for information about the timeline view.