⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Timeline



Nov 26, 2017:

11:51 PM Changeset in webkit [225154] by Yusuke Suzuki
  • 19 edits
    5 adds in trunk

[DFG] Add NormalizeMapKey DFG IR
​https://bugs.webkit.org/show_bug.cgi?id=179912

Reviewed by Saam Barati.

JSTests:

  • stress/map-untyped-normalize-cse.js: Added.

(shouldBe):
(test):

  • stress/map-untyped-normalize.js: Added.

(shouldBe):
(test):

  • stress/set-untyped-normalize-cse.js: Added.

(shouldBe):
(set return.set has.set has):

  • stress/set-untyped-normalize.js: Added.

(shouldBe):
(set return.set has):

Source/JavaScriptCore:

This patch introduces NormalizeMapKey DFG node. It executes what normalizeMapKey does in inlined manner.
By separating this from MapHash and Map/Set related operations, we can perform CSE onto that, and we
do not need to call normalizeMapKey conservatively in DFG operations.
This can reduce slow path case in Untyped GetMapBucket since we can normalize keys in DFG/FTL.

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupNormalizeMapKey):

  • dfg/DFGNodeType.h:
  • dfg/DFGOperations.cpp:
  • dfg/DFGPredictionPropagationPhase.cpp:
  • dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNormalizeMapKey):

  • dfg/DFGSpeculativeJIT.h:
  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileMapHash):
(JSC::FTL::DFG::LowerDFGToB3::compileNormalizeMapKey):
(JSC::FTL::DFG::LowerDFGToB3::compileGetMapBucket):

  • runtime/HashMapImpl.h:
7:45 PM Changeset in webkit [225153] by Yusuke Suzuki
  • 4 edits
    2 adds in trunk

[FTL] Support DeleteById and DeleteByVal
​https://bugs.webkit.org/show_bug.cgi?id=180022

Reviewed by Saam Barati.

JSTests:

  • stress/delete-by-id.js: Added.

(shouldBe):
(test1):
(test2):

  • stress/delete-by-val-ftl.js: Added.

(shouldBe):
(test1):
(test2):

Source/JavaScriptCore:

We should increase the coverage of FTL. Even if the code includes DeleteById,
it does not mean that remaining part of the code should not be optimized in FTL.
Right now, even CallEval and with scope are handled in FTL.

This patch just adds DeleteById and DeleteByVal handling to FTL to allow optimizing
code including them.

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileDeleteById):
(JSC::FTL::DFG::LowerDFGToB3::compileDeleteByVal):

6:19 PM Changeset in webkit [225152] by Simon Fraser
  • 3 edits
    2 adds in trunk

feImage as filter input has skewed colors
​https://bugs.webkit.org/show_bug.cgi?id=180021

Reviewed by Sam Weinig.
Source/WebCore:

Using an <feImage> as a filter input sometimes results in incorrect colors, because
the image is being sourced as linearRGB when it should always be sRGB.

Fix by setting the result colorspace in FEImage before we allocate the output
buffer.

Tests: svg/filters/feImage-color-fidelity-expected.svg

svg/filters/feImage-color-fidelity.svg

  • svg/graphics/filters/SVGFEImage.cpp:

(WebCore::FEImage::platformApplySoftware):

LayoutTests:

  • svg/filters/feImage-color-fidelity-expected.svg: Added.
  • svg/filters/feImage-color-fidelity.svg: Added.
5:46 PM Changeset in webkit [225151] by Yusuke Suzuki
  • 8 edits
    5 adds in trunk

[DFG] Introduce {Set,Map,WeakMap}Fields
​https://bugs.webkit.org/show_bug.cgi?id=179925

Reviewed by Saam Barati.

JSTests:

  • stress/map-set-clobber-map-get.js: Added.

(shouldBe):
(test):

  • stress/map-set-does-not-clobber-set-has.js: Added.

(shouldBe):

  • stress/map-set-does-not-clobber-weak-map-get.js: Added.

(shouldBe):
(test):

  • stress/set-add-clobber-set-has.js: Added.

(shouldBe):

  • stress/set-add-does-not-clobber-map-get.js: Added.

(shouldBe):

Source/JavaScriptCore:

SetAdd and MapSet uses write(MiscFields), but it is not correct. It accidentally
writes readonly MiscFields which is used by various nodes and make optimization
conservative.

We introduce JSSetFields, JSMapFields, and JSWeakMapFields to precisely model clobberizing of Map, Set, and WeakMap.

  • dfg/DFGAbstractHeap.h:
  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGHeapLocation.cpp:

(WTF::printInternal):

  • dfg/DFGHeapLocation.h:
  • dfg/DFGNode.h:

(JSC::DFG::Node::hasBucketOwnerType):

5:22 PM Changeset in webkit [225150] by Yusuke Suzuki
  • 12 edits
    1 delete in trunk/Source/JavaScriptCore

[JSC] Remove JSStringBuilder
​https://bugs.webkit.org/show_bug.cgi?id=180016

Reviewed by Saam Barati.

JSStringBuilder is replaced with WTF::StringBuilder.
This patch removes remaning uses and drop JSStringBuilder.

  • JavaScriptCore.xcodeproj/project.pbxproj:
  • runtime/ArrayPrototype.cpp:
  • runtime/AsyncFunctionPrototype.cpp:
  • runtime/AsyncGeneratorFunctionPrototype.cpp:
  • runtime/ErrorPrototype.cpp:
  • runtime/FunctionPrototype.cpp:
  • runtime/GeneratorFunctionPrototype.cpp:
  • runtime/JSGlobalObjectFunctions.cpp:

(JSC::decode):
(JSC::globalFuncEscape):

  • runtime/JSStringBuilder.h: Removed.
  • runtime/JSStringInlines.h:

(JSC::jsMakeNontrivialString):

  • runtime/RegExpPrototype.cpp:
  • runtime/StringPrototype.cpp:
5:15 PM Changeset in webkit [225149] by Yusuke Suzuki
  • 15 edits in trunk/Source/JavaScriptCore

[DFG] Remove GetLocalUnlinked
​https://bugs.webkit.org/show_bug.cgi?id=180017

Reviewed by Saam Barati.

Since DFGArgumentsSimplificationPhase is removed 2 years ago, GetLocalUnlinked is no longer used in DFG.
This patch just removes it.

  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGCommon.h:
  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

  • dfg/DFGNode.h:

(JSC::DFG::Node::hasUnlinkedLocal):
(JSC::DFG::Node::convertToGetLocalUnlinked): Deleted.
(JSC::DFG::Node::convertToGetLocal): Deleted.
(JSC::DFG::Node::hasUnlinkedMachineLocal): Deleted.
(JSC::DFG::Node::setUnlinkedMachineLocal): Deleted.
(JSC::DFG::Node::unlinkedMachineLocal): Deleted.

  • dfg/DFGNodeType.h:
  • dfg/DFGPredictionPropagationPhase.cpp:
  • dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGStackLayoutPhase.cpp:

(JSC::DFG::StackLayoutPhase::run):

  • dfg/DFGValidate.cpp:
2:13 PM Changeset in webkit [225148] by commit-queue@webkit.org
  • 3 edits in trunk/Source/WebCore

Cleanup code for RenderMathMLUnderOver::layoutBlock
​https://bugs.webkit.org/show_bug.cgi?id=179681

Patch by Minsheng Liu <​lambda@liu.ms> on 2017-11-26
Reviewed by Frédéric Wang.

The patch removes some unnecessary calls to layoutIfNeeds() and guards the change
with assertion. Since there is no behavior change, no new tests are required.

  • rendering/mathml/RenderMathMLUnderOver.cpp:

(WebCore::RenderMathMLUnderOver::stretchHorizontalOperatorsAndLayoutChildren):
(WebCore::RenderMathMLUnderOver::layoutBlock):
(WebCore::RenderMathMLUnderOver::computeOperatorsHorizontalStretch): Deleted.

  • rendering/mathml/RenderMathMLUnderOver.h:
12:03 PM Changeset in webkit [225147] by Simon Fraser
  • 36 edits in trunk

Use more Uint8ClampedArray& and constness in filter and image buffer code
​https://bugs.webkit.org/show_bug.cgi?id=180008

Reviewed by Darin Adler.

Source/WebCore:

Use references to Uint8ClampedArrays rather than pointers where necessary.

Use const for source data buffers when possible, and uint8_t for the underlying
data type.

Fix a bug in FEGaussianBlur where the output of the last blur pass wasn't
copied to the result buffer, which required a test adjustment.

  • html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::putImageData):

  • platform/graphics/ImageBuffer.cpp:

(WebCore::ImageBuffer::genericConvertToLuminanceMask):

  • platform/graphics/ImageBuffer.h:
  • platform/graphics/ShadowBlur.cpp:

(WebCore::ShadowBlur::blurShadowBuffer):

  • platform/graphics/cairo/ImageBufferCairo.cpp:

(WebCore::ImageBuffer::putByteArray):

  • platform/graphics/cg/ImageBufferCG.cpp:

(WebCore::ImageBuffer::putByteArray):

  • platform/graphics/cg/ImageBufferDataCG.cpp:

(WebCore::ImageBufferData::getData const):
(WebCore::ImageBufferData::putData):

  • platform/graphics/cg/ImageBufferDataCG.h:
  • platform/graphics/cpu/arm/filters/FEBlendNEON.h:

(WebCore::FEBlend::platformApplySoftware):

  • platform/graphics/cpu/arm/filters/FECompositeArithmeticNEON.h:

(WebCore::FEComposite::computeArithmeticPixelsNeon):
(WebCore::FEComposite::platformArithmeticNeon):

  • platform/graphics/cpu/arm/filters/FEGaussianBlurNEON.h:

(WebCore::boxBlurNEON):

  • platform/graphics/cpu/arm/filters/NEONHelpers.h:

(WebCore::loadRGBA8AsFloat):

  • platform/graphics/filters/FEColorMatrix.cpp:

(WebCore::effectApplyAccelerated):
(WebCore::effectType):
(WebCore::FEColorMatrix::platformApplySoftware):

  • platform/graphics/filters/FEComponentTransfer.cpp:

(WebCore::FEComponentTransfer::platformApplySoftware):

  • platform/graphics/filters/FEComposite.cpp:

(WebCore::computeArithmeticPixels):
(WebCore::FEComposite::platformArithmeticSoftware):
(WebCore::FEComposite::platformApplySoftware):

  • platform/graphics/filters/FEComposite.h:
  • platform/graphics/filters/FEConvolveMatrix.cpp:

(WebCore::setDestinationPixels):
(WebCore::FEConvolveMatrix::fastSetInteriorPixels):
(WebCore::FEConvolveMatrix::fastSetOuterPixels):
(WebCore::FEConvolveMatrix::platformApplySoftware):

  • platform/graphics/filters/FEConvolveMatrix.h:
  • platform/graphics/filters/FEDisplacementMap.cpp:

(WebCore::FEDisplacementMap::platformApplySoftware):

  • platform/graphics/filters/FEDropShadow.cpp:

(WebCore::FEDropShadow::platformApplySoftware):

  • platform/graphics/filters/FEGaussianBlur.cpp:

(WebCore::boxBlurAlphaOnly):
(WebCore::boxBlur):
(WebCore::accelerateBoxBlur):
(WebCore::standardBoxBlur):
(WebCore::FEGaussianBlur::platformApplyGeneric):
(WebCore::FEGaussianBlur::platformApplyWorker):
(WebCore::FEGaussianBlur::platformApply):
(WebCore::FEGaussianBlur::platformApplySoftware):

  • platform/graphics/filters/FEGaussianBlur.h:
  • platform/graphics/filters/FELighting.cpp:

(WebCore::FELighting::drawLighting):
(WebCore::FELighting::platformApplySoftware):

  • platform/graphics/filters/FELighting.h:
  • platform/graphics/filters/FEMorphology.cpp:

(WebCore::columnExtremum):
(WebCore::FEMorphology::platformApplyGeneric):
(WebCore::FEMorphology::platformApplyDegenerate):
(WebCore::FEMorphology::platformApplySoftware):

  • platform/graphics/filters/FEMorphology.h:
  • platform/graphics/filters/FETurbulence.cpp:

(WebCore::FETurbulence::fillRegion const):
(WebCore::FETurbulence::fillRegionWorker):
(WebCore::FETurbulence::platformApplySoftware):

  • platform/graphics/filters/FETurbulence.h:
  • platform/graphics/filters/FilterEffect.cpp:

(WebCore::FilterEffect::forceValidPreMultipliedPixels):
(WebCore::FilterEffect::imageBufferResult):
(WebCore::FilterEffect::unmultipliedResult):
(WebCore::FilterEffect::premultipliedResult):
(WebCore::FilterEffect::copyImageBytes const):
(WebCore::copyPremultiplyingAlpha):
(WebCore::copyUnpremultiplyingAlpha):
(WebCore::FilterEffect::copyUnmultipliedResult):
(WebCore::FilterEffect::copyPremultipliedResult):

  • platform/graphics/filters/FilterEffect.h:
  • platform/graphics/win/ImageBufferDataDirect2D.cpp:

(WebCore::ImageBufferData::putData):

  • platform/graphics/win/ImageBufferDataDirect2D.h:

LayoutTests:

Fix a bug in FEGaussianBlur where the output of the last blur pass wasn't
copied to the result buffer, which required a test adjustment.

  • css3/filters/filter-on-overflow-hidden-expected.html:
  • css3/filters/filter-on-overflow-hidden.html:
7:56 AM Changeset in webkit [225146] by Yusuke Suzuki
  • 2 edits in trunk/Source/JavaScriptCore

Make ArgList::data() private again when we can remove callWasmFunction().
​https://bugs.webkit.org/show_bug.cgi?id=168582

Reviewed by JF Bastien.

Make ArgList::data() private since we already removed callWasmFunction.

  • runtime/ArgList.h:

Nov 25, 2017:

8:59 AM Changeset in webkit [225145] by Alan Bujtas
  • 3 edits in trunk/Source/WebCore

Make RenderSnapshottedPlugIn ISO allocated
​https://bugs.webkit.org/show_bug.cgi?id=180010
<rdar://problem/35671977>

Reviewed by David Kilzer.

RenderEmbeddedObject, the base class is ISO allocated since r224537.

  • rendering/RenderSnapshottedPlugIn.cpp:
  • rendering/RenderSnapshottedPlugIn.h:
Note: See TracTimeline for information about the timeline view.