⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Timeline



Jan 8, 2018:

11:17 PM Changeset in webkit [226616] by zandobersek@gmail.com
  • 2 edits in trunk/Source/JavaScriptCore

REGRESSION(r225913): about 30 JSC test failures on ARMv7
​https://bugs.webkit.org/show_bug.cgi?id=181162
<rdar://problem/36261349>

Unreviewed follow-up to r226298. Enable the fast case in
DFG::SpeculativeJIT::compileArraySlice() for any 64-bit platform,
assuming in good faith that enough GP registers are available on any
such configuration. The accompanying comment is adjusted to describe
this assumption.

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileArraySlice):

11:10 PM Changeset in webkit [226615] by jfbastien@apple.com
  • 15 edits in trunk

WebAssembly: mask indexed accesses to Table
​https://bugs.webkit.org/show_bug.cgi?id=181412
<rdar://problem/36363236>

Reviewed by Saam Barati.

JSTests:

Update error messages.

  • wasm/js-api/table.js:

(assert.throws.WebAssembly.Table.prototype.grow):

Source/JavaScriptCore:

WebAssembly Table indexed accesses are user-controlled and
bounds-checked. Force allocations of Table data to be a
power-of-two, and explicitly mask accesses after bounds-check
branches.

Rename misleading usage of "size" when "length" of a Table was
intended.

Rename the Spectre option from "disable" to "enable".

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::SpeculativeJIT):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::LowerDFGToB3):

  • jit/JIT.cpp:

(JSC::JIT::JIT):

  • runtime/Options.h:
  • wasm/WasmB3IRGenerator.cpp:

(JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
(JSC::Wasm::B3IRGenerator::addCallIndirect):

  • wasm/WasmTable.cpp:

(JSC::Wasm::Table::allocatedLength):
(JSC::Wasm::Table::setLength):
(JSC::Wasm::Table::create):
(JSC::Wasm::Table::Table):
(JSC::Wasm::Table::grow):
(JSC::Wasm::Table::clearFunction):
(JSC::Wasm::Table::setFunction):

  • wasm/WasmTable.h:

(JSC::Wasm::Table::length const):
(JSC::Wasm::Table::offsetOfLength):
(JSC::Wasm::Table::offsetOfMask):
(JSC::Wasm::Table::mask const):
(JSC::Wasm::Table::isValidLength):

  • wasm/js/JSWebAssemblyInstance.cpp:

(JSC::JSWebAssemblyInstance::create):

  • wasm/js/JSWebAssemblyTable.cpp:

(JSC::JSWebAssemblyTable::JSWebAssemblyTable):
(JSC::JSWebAssemblyTable::visitChildren):
(JSC::JSWebAssemblyTable::grow):
(JSC::JSWebAssemblyTable::getFunction):
(JSC::JSWebAssemblyTable::clearFunction):
(JSC::JSWebAssemblyTable::setFunction):

  • wasm/js/JSWebAssemblyTable.h:

(JSC::JSWebAssemblyTable::isValidLength):
(JSC::JSWebAssemblyTable::length const):
(JSC::JSWebAssemblyTable::allocatedLength const):

  • wasm/js/WebAssemblyModuleRecord.cpp:

(JSC::WebAssemblyModuleRecord::evaluate):

  • wasm/js/WebAssemblyTablePrototype.cpp:

(JSC::webAssemblyTableProtoFuncLength):
(JSC::webAssemblyTableProtoFuncGrow):
(JSC::webAssemblyTableProtoFuncGet):
(JSC::webAssemblyTableProtoFuncSet):

10:41 PM Changeset in webkit [226614] by commit-queue@webkit.org
  • 9 edits
    3 adds
    6 deletes in trunk

::first-letter incorrectly selects grapheme pairs
​https://bugs.webkit.org/show_bug.cgi?id=181315

Patch by Chris Nardi <​csnardi1@gmail.com> on 2018-01-08
Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Updated css-pseudo-4 to latest WPT revision and added first-letter-004.html.

  • web-platform-tests/css/css-pseudo-4/first-letter-004-expected.html: Added.
  • web-platform-tests/css/css-pseudo-4/first-letter-004.html: Added.
  • web-platform-tests/css/css-pseudo-4/marker-color-expected.html:
  • web-platform-tests/css/css-pseudo-4/marker-color.html:
  • web-platform-tests/css/css-pseudo-4/marker-font-properties.html:
  • web-platform-tests/css/css-pseudo-4/w3c-import.log:

Source/WebCore:

Grapheme pairs were incorrectly selected by ::first-letter. This
change fixes their selection.

Tests: Updated fast/css/first-letter-punctuation.html and imported
LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo-4/first-letter-004.html

  • rendering/updating/RenderTreeBuilderFirstLetter.cpp:

(WebCore::isPunctuationForFirstLetter):
(WebCore::shouldSkipForFirstLetter):
(WebCore::RenderTreeBuilder::FirstLetter::createRenderers):

LayoutTests:

  • fast/css/first-letter-punctuation-expected.html: Added.
  • fast/css/first-letter-punctuation.html:
  • platform/gtk/fast/css/first-letter-punctuation-expected.png: Removed.
  • platform/gtk/fast/css/first-letter-punctuation-expected.txt: Removed.
  • platform/ios/fast/css/first-letter-punctuation-expected.txt: Removed.
  • platform/mac/fast/css/first-letter-punctuation-expected.png: Removed.
  • platform/mac/fast/css/first-letter-punctuation-expected.txt: Removed.
  • platform/win/fast/css/first-letter-punctuation-expected.txt: Removed.
10:19 PM Changeset in webkit [226613] by Darin Adler
  • 13 edits
    2 adds
    1 delete in trunk

Special list-item counter starts from an incorrect number for ::before and ::after
​https://bugs.webkit.org/show_bug.cgi?id=181084

Reviewed by Zalan Bujtas.

Source/WebCore:

Test: fast/css/counters/counter-list-item.html

  • Sources.txt: Removed CounterDirectives.cpp.
  • WebCore.xcodeproj/project.pbxproj: Ditto.
  • css/CSSComputedStyleDeclaration.cpp:

(WebCore::counterToCSSValue): Updated for changes to the CounterDirectives struct.

  • css/StyleBuilderCustom.h:

(WebCore::StyleBuilderCustom::applyInheritCounter): Ditto.
(WebCore::StyleBuilderCustom::applyValueCounter): Ditto.

  • html/HTMLLIElement.cpp:

(WebCore::HTMLLIElement::parseValue): Call setExplicitValue(std::nullopt) instead
of clearExplicitValue since we are using std::optional now.

  • rendering/RenderCounter.cpp:

(WebCore::listItemCounterDirectives): Added. Computes the counter directives that
express the effects on the list-item counter from list item and list elements.
Used something as close to what the CSS 3 draft says as possible. This uses a
negative increment when creating a list to counteract the positive increment done
by a list element, except in the case of an unordered list. This is where the bug
fix actually lies. Also fixed handling of reversed ordered lists at the same time.
(WebCore::planCounter): Refactored to use the function above. Also changed the
code to pay attention to both the counter directives and the implicit ones from
list item and list elements, getting as close as possible to what the specification
seems to call for.

  • rendering/RenderListItem.cpp:

(WebCore::RenderListItem::RenderListItem): Since we are using std::optional and no
longer using bit fields, simplified the constructor for each list item.
(WebCore::RenderListItem::calcValue const): Deleted.
(WebCore::RenderListItem::updateValueNow const): Merged in all the code from the
old calcValue function, but it is also simpler now since m_value is std::optional.
(WebCore::RenderListItem::updateValue): Updated to use std::optional.
(WebCore::RenderListItem::setExplicitValue): Ditto.
(WebCore::RenderListItem::clearExplicitValue): Deleted.
(WebCore::RenderListItem::updateListMarkerNumbers): Updated to use std::optional.
(WebCore::RenderListItem::isInReversedOrderedList const): Added. This is used by
the counter code so it can decrement instead of incrementing.

  • rendering/RenderListItem.h: Updated to use std::optional. Also marked functions

final instead of override and initialized m_notInList after making it not be a
bitfield any more.

  • rendering/style/CounterDirectives.cpp: Removed.
  • rendering/style/CounterDirectives.h: Removed most of the CounterDirectives

class and replaced it with a struct with two std::optional. Added an addClamped
function so the counter code can share it with the addIncrementValue function.
If we want to make a faster version that doesn't use double, we can come back
and do that. Also moved the == function to the header since the implementation
is so trivial.

  • rendering/style/StyleAllInOne.cpp: Removed CounterDirectives.cpp.
  • rendering/style/StyleRareNonInheritedData.cpp:

(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData): Updated to
use std::make_unique directly instead of using a clone function.

LayoutTests:

  • fast/css/counters/counter-list-item-expected.html: Added.
  • fast/css/counters/counter-list-item.html: Added.
8:08 PM Changeset in webkit [226612] by Wenson Hsieh
  • 4 edits in trunk

[Attachment Support] Expose HTMLAttachmentElement.uniqueIdentifier to bindings
​https://bugs.webkit.org/show_bug.cgi?id=181420
<rdar://problem/36365827>

Reviewed by Alex Christensen.

Source/WebCore:

Add a new IDL definition for uniqueIdentifier on HTMLAttachmentElement. This allows clients to relate attachment
elements in the DOM to _WKAttachments delivered via Objective-C SPI.

Adjusted existing tests in WKAttachmentTests.

  • html/HTMLAttachmentElement.idl:

Tools:

Adjusts some existing API tests to verify that attachment elements' uniqueIdentifiers match the uniqueIdentifier
of corresponding _WKAttachments.

  • TestWebKitAPI/Tests/WebKitCocoa/WKAttachmentTests.mm:

(TestWebKitAPI::TEST):

7:52 PM Changeset in webkit [226611] by jmarcell@apple.com
  • 7 edits in trunk/Source

Versioning.

7:27 PM Changeset in webkit [226610] by achristensen@apple.com
  • 6 edits in trunk

Add WKNavigationDelegate SPI exposing WebProcess crash reason
​https://bugs.webkit.org/show_bug.cgi?id=181410
<rdar://problem/36167199>

Reviewed by Wenson Hsieh.

Source/WebKit:

We exposed it in the C SPI.

  • UIProcess/API/Cocoa/WKNavigationDelegatePrivate.h:
  • UIProcess/Cocoa/NavigationState.h:
  • UIProcess/Cocoa/NavigationState.mm:

(WebKit::NavigationState::setNavigationDelegate):
(WebKit::toWKProcessTerminationReason):
(WebKit::NavigationState::NavigationClient::processDidTerminate):

Tools:

  • TestWebKitAPI/Tests/WebKitCocoa/Navigation.mm:

(-[CrashReasonDelegate _webView:webContentProcessDidTerminateWithReason:]):
(TEST):

7:26 PM Changeset in webkit [226609] by achristensen@apple.com
  • 8 edits in trunk/Source/WebKit

Make ObjC SPI equivalent to WKPageNavigationClient.decidePolicyForPluginLoad
​https://bugs.webkit.org/show_bug.cgi?id=181413
<rdar://problem/36169005>

Reviewed by Wenson Hsieh.

  • UIProcess/API/APINavigationClient.h:

(API::NavigationClient::decidePolicyForPluginLoad):

  • UIProcess/API/C/WKPage.cpp:

(WKPageSetPageNavigationClient):

  • UIProcess/API/Cocoa/WKNavigationDelegatePrivate.h:
  • UIProcess/Cocoa/NavigationState.h:
  • UIProcess/Cocoa/NavigationState.mm:

(WebKit::NavigationState::setNavigationDelegate):
(WebKit::toPluginModuleLoadPolicy):
(WebKit::toWKPluginModuleLoadPolicy):
(WebKit::NavigationState::NavigationClient::decidePolicyForPluginLoad):

  • UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::findPlugin):

7:08 PM Changeset in webkit [226608] by rniwa@webkit.org
  • 2 edits in trunk/Source/WebKit

iOS build fix attempt after r226602.

  • UIProcess/API/C/WKContextMenuListener.cpp:

(WKContextMenuListenerUseContextMenuItems):

6:56 PM Changeset in webkit [226607] by achristensen@apple.com
  • 6 edits
    1 add in trunk

Add SPI for WKOpenPanelParameters._acceptedMIMETypes and _acceptedFileExtensions
​https://bugs.webkit.org/show_bug.cgi?id=181408
<rdar://problem/35884960>

Reviewed by Tim Horton.

Source/WebKit:

  • UIProcess/API/Cocoa/WKOpenPanelParameters.mm:

(-[WKOpenPanelParameters _acceptedMIMETypes]):
(-[WKOpenPanelParameters _acceptedFileExtensions]):

  • UIProcess/API/Cocoa/WKOpenPanelParametersInternal.h:
  • UIProcess/API/Cocoa/WKOpenPanelParametersPrivate.h: Added.
  • WebKit.xcodeproj/project.pbxproj:

Tools:

  • TestWebKitAPI/Tests/WebKitCocoa/RunOpenPanel.mm:

(-[RunOpenPanelUIDelegate webView:runOpenPanelWithParameters:initiatedByFrame:completionHandler:]):

6:16 PM Changeset in webkit [226606] by don.olmstead@sony.com
  • 2 edits in trunk/Source/WebCore

AccessibilityARIAGrid does not compile when accessibility is disabled
​https://bugs.webkit.org/show_bug.cgi?id=181418
<rdar://problem/36365398>

Reviewed by Chris Fleizach.

No new tests. No change in behavior.

  • accessibility/AccessibilityARIAGrid.cpp:
6:07 PM Changeset in webkit [226605] by commit-queue@webkit.org
  • 30 edits in trunk

Unreviewed, rolling out r226532 and r226540.
​https://bugs.webkit.org/show_bug.cgi?id=181422

jessie says basic browsing does not seem to work (Requested by
alexchristensen on #webkit).

Reverted changesets:

"Add CSP support to service workers"
​https://bugs.webkit.org/show_bug.cgi?id=181385
​https://trac.webkit.org/changeset/226532

"SWClientConnection should not keep references to service
worker jobs"
​https://bugs.webkit.org/show_bug.cgi?id=181381
​https://trac.webkit.org/changeset/226540

6:05 PM Changeset in webkit [226604] by Wenson Hsieh
  • 21 edits in trunk

[Attachment Support] Expose file name and content type of WKAttachment
​https://bugs.webkit.org/show_bug.cgi?id=181390
<rdar://problem/36336837>

Reviewed by Tim Horton.

Source/WebCore:

Add new structs in AttachmentTypes.h and refactor HTMLAttachmentElement::requestData to requestInfo. See below
for more details. Augmented existing API tests in WKAttachmentTests.

  • html/AttachmentTypes.h:

Add a struct to represent a snapshot of information about an attachment element.

  • html/HTMLAttachmentElement.cpp:

(WebCore::HTMLAttachmentElement::requestInfo):
(WebCore::HTMLAttachmentElement::requestData): Deleted.

  • html/HTMLAttachmentElement.h:

Change requestData to requestInfo. Instead of fetching and delivering data via callback, requestInfo returns an
AttachmentInfo.

  • rendering/RenderThemeIOS.mm:

(WebCore::RenderAttachmentInfo::addLine):
(WebCore::RenderAttachmentInfo::buildWrappedLines):
(WebCore::RenderAttachmentInfo::buildSingleLine):
(WebCore::RenderAttachmentInfo::RenderAttachmentInfo):
(WebCore::RenderThemeIOS::attachmentBaseline const):
(WebCore::paintAttachmentIcon):
(WebCore::paintAttachmentText):
(WebCore::paintAttachmentProgress):
(WebCore::attachmentBorderPath):
(WebCore::RenderThemeIOS::paintAttachment):
(WebCore::AttachmentInfo::addLine): Deleted.
(WebCore::AttachmentInfo::buildWrappedLines): Deleted.
(WebCore::AttachmentInfo::buildSingleLine): Deleted.
(WebCore::AttachmentInfo::AttachmentInfo): Deleted.

Rename AttachmentInfo to RenderAttachmentInfo to resolve a name conflict with the new AttachmentInfo struct.

Source/WebKit:

Add support for -[_WKAttachment requestInfo:], which fetches a snapshot of the attachment's state. This API is
meant to be a replacement for -requestData: that provides additional metadata about the attachment.

  • Scripts/webkit/messages.py:

(headers_for_type):

  • Shared/WebCoreArgumentCoders.cpp:

(IPC::ArgumentCoder<AttachmentInfo>::encode):
(IPC::ArgumentCoder<AttachmentInfo>::decode):

  • Shared/WebCoreArgumentCoders.h:

Add IPC support for AttachmentInfo. Note that instead of using (encode|decode)SharedBuffer, we send and receive
data references to the shared buffer.

  • UIProcess/API/APIAttachment.cpp:

(API::Attachment::requestInfo):
(API::Attachment::requestData): Deleted.

  • UIProcess/API/APIAttachment.h:

Change requestData to requestInfo.

  • UIProcess/API/Cocoa/_WKAttachment.h:
  • UIProcess/API/Cocoa/_WKAttachment.mm:

(-[_WKAttachmentInfo initWithInfo:]):
(-[_WKAttachmentInfo data]):
(-[_WKAttachmentInfo name]):
(-[_WKAttachmentInfo filePath]):
(-[_WKAttachmentInfo contentType]):
(-[_WKAttachment requestInfo:]):
(-[_WKAttachment requestData:]):

Implement -requestInfo: by calling into APIAttachment, and reimplement -requestData: in terms of -requestInfo:.

  • UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::attachmentInfoCallback):
(WebKit::WebPageProxy::requestAttachmentInfo):
(WebKit::WebPageProxy::sharedBufferCallback): Deleted.
(WebKit::WebPageProxy::requestAttachmentData): Deleted.

  • UIProcess/WebPageProxy.h:
  • UIProcess/WebPageProxy.messages.in:

Rename the SharedBufferCallback IPC message to AttachmentInfoCallback, and make it conditional on
ATTACHMENT_ELEMENT. Rename requestAttachmentData to requestAttachmentInfo.

  • WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::requestAttachmentInfo):
(WebKit::WebPage::invokeSharedBufferCallback): Deleted.
(WebKit::WebPage::requestAttachmentData): Deleted.

Rename requestAttachmentData to requestAttachmentInfo and adopt HTMLAttachmentElement::requestInfo.

  • WebProcess/WebPage/WebPage.h:
  • WebProcess/WebPage/WebPage.messages.in:

Tools:

Adjusts some existing tests in WKAttachmentTests to exercise -requestInfo:.

  • TestWebKitAPI/Tests/WebKitCocoa/WKAttachmentTests.mm:

(-[_WKAttachment synchronouslyRequestInfo:]):
(-[_WKAttachment synchronouslyRequestData:]):

Reimplement this in terms of -synchronouslyRequestInfo:.

(-[_WKAttachment expectRequestedDataToBe:]):
(TestWebKitAPI::TEST):

5:55 PM Changeset in webkit [226603] by sbarati@apple.com
  • 2 edits in trunk/Source/WebCore

Speculative build fix after r226600. We only use clflush on x86 and the asm volatile syntax is not available in the Windows build.

No new tests because this is a build fix.

  • dom/Comment.cpp:

(WebCore::Comment::clflushReadLength):

5:53 PM Changeset in webkit [226602] by achristensen@apple.com
  • 10 edits in trunk/Source/WebKit

Pass around Vector<Ref<WebContextMenuItem>> instead of WKArrayRef or Vector<WebContextMenuItemData>
​https://bugs.webkit.org/show_bug.cgi?id=181419

Reviewed by Tim Horton.

Passing a WKArrayRef to an API object is messy and was preventing me from moving things around and making ObjC SPI.
No change in behavior. Just using different layering abstractions for the same data.

  • UIProcess/API/C/WKContextMenuListener.cpp:

(WKContextMenuListenerUseContextMenuItems):

  • UIProcess/WebContextMenuListenerProxy.cpp:

(WebKit::WebContextMenuListenerProxy::useContextMenuItems):

  • UIProcess/WebContextMenuListenerProxy.h:
  • UIProcess/WebContextMenuProxy.h:
  • UIProcess/mac/WebContextMenuProxyMac.h:
  • UIProcess/mac/WebContextMenuProxyMac.mm:

(WebKit::WebContextMenuProxyMac::showContextMenuWithItems):
(WebKit::WebContextMenuProxyMac::showContextMenu):

5:21 PM Changeset in webkit [226601] by don.olmstead@sony.com
  • 2 edits in trunk/Source/WTF

Add WTF_EXPORTs to UniStdExtras
​https://bugs.webkit.org/show_bug.cgi?id=181415

Reviewed by Alex Christensen.

  • wtf/UniStdExtras.h:
5:07 PM Changeset in webkit [226600] by msaboff@apple.com
  • 8 edits in trunk/Source

Add a DOM gadget for Spectre testing
​https://bugs.webkit.org/show_bug.cgi?id=181351

Source/JavaScriptCore:

Reviewed by Michael Saboff.

Added a new JSC::Option named enableSpectreGadgets to enable any gadgets added to test
Spectre mitigations.

  • runtime/Options.h:

Source/WebCore:

Reviewed by Saam Barati.

This change is used to test Spectre mitigations.

Added a side data array to the Comment DOM node to test for Spectre issues in
the DOM layer. This additional functionality is disabled by default and must
be enabled through the JSC option "enableSpectreGadgets".

  • dom/Comment.cpp:

(WebCore::Comment::Comment):
(WebCore::Comment::setReadLength):
(WebCore::Comment::charCodeAt):
(WebCore::Comment::clflushReadLength):

  • dom/Comment.h:
  • dom/Comment.idl:
  • page/RuntimeEnabledFeatures.cpp:

(WebCore::RuntimeEnabledFeatures::spectreGadgetsEnabled const):

  • page/RuntimeEnabledFeatures.h:
4:35 PM Changeset in webkit [226599] by commit-queue@webkit.org
  • 4 edits
    6 adds in trunk

A canvas should not be tainted if it draws a data URL SVGImage with a <foreignObject>
​https://bugs.webkit.org/show_bug.cgi?id=180301

Patch by Said Abou-Hallawa <​sabouhallawa@apple.com> on 2018-01-08
Reviewed by Dean Jackson.

Source/WebCore:

Don't taint the canvas if it draws a data URL SVGImage with a <foreignObject>.
There should not be a cross-origin data leak in this case.

Tests: svg/as-image/svg-canvas-data-url-svg-with-feimage-not-tainted.html

svg/as-image/svg-canvas-data-url-svg-with-foreign-object-not-tainted.html
svg/as-image/svg-canvas-data-url-svg-with-image-not-tainted.html

  • html/ImageBitmap.cpp:

(WebCore::taintsOrigin):

  • html/canvas/CanvasRenderingContext.cpp:

(WebCore::CanvasRenderingContext::wouldTaintOrigin):

LayoutTests:

  • svg/as-image/svg-canvas-data-url-svg-with-feimage-not-tainted-expected.txt: Added.
  • svg/as-image/svg-canvas-data-url-svg-with-feimage-not-tainted.html: Added.
  • svg/as-image/svg-canvas-data-url-svg-with-foreign-object-not-tainted-expected.txt: Added.
  • svg/as-image/svg-canvas-data-url-svg-with-foreign-object-not-tainted.html: Added.
  • svg/as-image/svg-canvas-data-url-svg-with-image-not-tainted-expected.txt: Added.
  • svg/as-image/svg-canvas-data-url-svg-with-image-not-tainted.html: Added.
4:16 PM Changeset in webkit [226598] by jmarcell@apple.com
  • 1 copy in tags/Safari-604.5.5

Tag Safari-604.5.5.

4:16 PM Changeset in webkit [226597] by jmarcell@apple.com
  • 1 copy in tags/Safari-604.5.4

Tag Safari-604.5.4.

4:12 PM Changeset in webkit [226596] by jmarcell@apple.com
  • 1 copy in tags/Safari-604.5.100.5

Tag Safari-604.5.100.5.

4:12 PM Changeset in webkit [226595] by jmarcell@apple.com
  • 1 copy in tags/Safari-604.5.100.4

Tag Safari-604.5.100.4.

4:07 PM Changeset in webkit [226594] by jmarcell@apple.com
  • 3 edits in branches/safari-604.5.100-branch/Source/WebCore

Cherry-pick r226457. rdar://problem/36324013

4:07 PM Changeset in webkit [226593] by jmarcell@apple.com
  • 7 edits in branches/safari-604.5.100-branch/Source

Versioning.

4:07 PM Changeset in webkit [226592] by jmarcell@apple.com
  • 1 edit in branches/safari-604.5.100-branch/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp

Apply patch. rdar://problem/36276168

fix indexing mask

4:07 PM Changeset in webkit [226591] by jmarcell@apple.com
  • 7 edits in branches/safari-604.5.100-branch/Source

Versioning.

4:07 PM Changeset in webkit [226590] by jmarcell@apple.com
  • 5 edits in branches/safari-604.5.100-branch

Apply patch. rdar://problem/36257610

Reduce the precision of "high" resolution time to 1ms
​https://bugs.webkit.org/show_bug.cgi?id=180910
<rdar://problem/36085943>

Reviewed by Saam Barati.

Add a flaky test expectation to imported/w3c/web-platform-tests/workers/worker-performance.worker.html
due to a test bug. The test fix is tracked in ​https://github.com/w3c/web-platform-tests/pull/8711

4:07 PM Changeset in webkit [226589] by jmarcell@apple.com
  • 3 edits in branches/safari-604.5.100-branch/Source/JavaScriptCore

Apply patch. rdar://problem/36257696

Disable/remove SharedArrayBuffers from Web API
rdar://problem/36077849

Removed SharedArrayBuffer prototype and structure to disable.

  • runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildren):
  • runtime/JSGlobalObject.h: (JSC::JSGlobalObject::arrayBufferPrototype const): (JSC::JSGlobalObject::arrayBufferStructure const):
3:51 PM Changeset in webkit [226588] by jmarcell@apple.com
  • 3 edits in branches/safari-604-branch/Source/WebCore

Cherry-pick r226457. rdar://problem/36323985

3:50 PM Changeset in webkit [226587] by jmarcell@apple.com
  • 7 edits in branches/safari-604-branch/Source

Versioning.

3:50 PM Changeset in webkit [226586] by jmarcell@apple.com
  • 1 edit in branches/safari-604-branch/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp

Apply patch. rdar://problem/36276141

fix indexing mask

3:50 PM Changeset in webkit [226585] by jmarcell@apple.com
  • 7 edits in branches/safari-604-branch/Source

Versioning.

3:50 PM Changeset in webkit [226584] by jmarcell@apple.com
  • 5 edits in branches/safari-604-branch

Apply patch. rdar://problem/36257607

Reduce the precision of "high" resolution time to 1ms
​https://bugs.webkit.org/show_bug.cgi?id=180910
<rdar://problem/36085943>

Reviewed by Saam Barati.

Add a flaky test expectation to imported/w3c/web-platform-tests/workers/worker-performance.worker.html
due to a test bug. The test fix is tracked in ​https://github.com/w3c/web-platform-tests/pull/8711

3:50 PM Changeset in webkit [226583] by jmarcell@apple.com
  • 3 edits in branches/safari-604-branch/Source/JavaScriptCore

Apply patch. rdar://problem/36257695

Disable/remove SharedArrayBuffers from Web API
rdar://problem/36077849

Removed SharedArrayBuffer prototype and structure to disable.

  • runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildren):
  • runtime/JSGlobalObject.h: (JSC::JSGlobalObject::arrayBufferPrototype const): (JSC::JSGlobalObject::arrayBufferStructure const):
3:32 PM Changeset in webkit [226582] by jmarcell@apple.com
  • 7 edits in tags/Safari-605.1.20/Source

Versioning.

3:27 PM Changeset in webkit [226581] by don.olmstead@sony.com
  • 6 edits in trunk/Source/WebCore

Simplify platform checks in Graphics Context
​https://bugs.webkit.org/show_bug.cgi?id=181344

Reviewed by Alex Christensen.

No new tests. No change in behavior.

  • platform/graphics/ANGLEWebKitBridge.h:
  • platform/graphics/GLContext.h:
  • platform/graphics/GraphicsContext3D.h:
  • platform/graphics/OpenGLESShims.h:
  • platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:

(WebCore::GraphicsContext3D::checkVaryingsPacking const):

3:23 PM Changeset in webkit [226580] by jmarcell@apple.com
  • 1 copy in tags/Safari-604.4.7.10.6

Tag Safari-604.4.7.10.6.

3:19 PM Changeset in webkit [226579] by jmarcell@apple.com
  • 1 copy in tags/Safari-604.4.7.10.5

Tag Safari-604.4.7.10.5.

3:16 PM Changeset in webkit [226578] by Matt Lewis
  • 2 edits in trunk/LayoutTests

Marked imported/w3c/web-platform-tests/service-workers/service-worker/register-closed-window.https.html as flaky.
​https://bugs.webkit.org/show_bug.cgi?id=181087

Unreviewed test gardening.

  • platform/ios-wk2/TestExpectations:
3:15 PM Changeset in webkit [226577] by jmarcell@apple.com
  • 7 edits in branches/safari-604.4.7.10-branch/Source

Versioning.

3:15 PM Changeset in webkit [226576] by jmarcell@apple.com
  • 1 edit in branches/safari-604.4.7.10-branch/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp

Apply patch. rdar://problem/36267662

fix indexing mask

3:15 PM Changeset in webkit [226575] by jmarcell@apple.com
  • 7 edits in branches/safari-604.4.7.10-branch/Source

Versioning.

3:15 PM Changeset in webkit [226574] by jmarcell@apple.com
  • 2 edits in branches/safari-604.4.7.10-branch/Source/JavaScriptCore

Apply patch. rdar://problem/36116826

32-bit fix.

3:15 PM Changeset in webkit [226573] by jmarcell@apple.com
  • 62 edits
    4 copies
    3 adds in branches/safari-604.4.7.10-branch

Apply patch. rdar://problem/36116820

Cherry-pick r225363, r225437, r225632, r225659, r225697, r225857. rdar://problem/36085975

Also merged offlineasm parts of r220184 and r222549. These changes are required
to support the code in cherry-picked revisions above.

2017-11-30 Mark Lam <​mark.lam@apple.com>

Let's scramble MacroAssemblerCodePtr values.
​https://bugs.webkit.org/show_bug.cgi?id=180169
<rdar://problem/35758340>

Reviewed by Filip Pizlo, Saam Barati, and JF Bastien.

  1. MacroAssemblerCodePtr now stores a ScrambledPtr instead of a void*.
  1. MacroAssemblerCodePtr's executableAddress() and dataLocation() now take a template argument type that will be used to cast the result. This makes the client code that uses these functions a little less verbose.
  1. Change the code base in general to minimize passing void* code pointers around. We now pass MacroAssemblerCodePtr as much as possible, and descramble it only at the last moment when we need the underlying code pointer.
  1. Added some MasmScrambledPtr paranoid asserts that are disabled (not built) by default. I'm leaving them in because they are instrumental in finding bugs where not all MacroAssemblerCodePtr values were not scrambled as expected. I expect them to be useful in the near future as we add more scrambling.
  1. Also disable the casting operator on MacroAssemblerCodePtr (except for explicit casts to a boolean). This ensures that clients will always explicitly use scrambledBits() or executableAddress() to get a value based on which value they actually need.
  1. Added currentThread() id to the logging in LLIntSlowPath trace functions. This was helpful when debugging tests that ran multiple VMs concurrently on different threads.

MacroAssemblerCodePtr is currently supported on 64-bit builds (including the
CLoop). It is not yet supported in 32-bit and Windows because we don't
currently have a way to read a global variable from their LLInt code.

  • assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::differenceBetweenCodePtr): (JSC::AbstractMacroAssembler::linkPointer):
  • assembler/CodeLocation.h: (JSC::CodeLocationCommon::instructionAtOffset): (JSC::CodeLocationCommon::labelAtOffset): (JSC::CodeLocationCommon::jumpAtOffset): (JSC::CodeLocationCommon::callAtOffset): (JSC::CodeLocationCommon::nearCallAtOffset): (JSC::CodeLocationCommon::dataLabelPtrAtOffset): (JSC::CodeLocationCommon::dataLabel32AtOffset): (JSC::CodeLocationCommon::dataLabelCompactAtOffset): (JSC::CodeLocationCommon::convertibleLoadAtOffset):
  • assembler/LinkBuffer.cpp: (JSC::LinkBuffer::finalizeCodeWithDisassembly):
  • assembler/LinkBuffer.h: (JSC::LinkBuffer::link): (JSC::LinkBuffer::patch):
  • assembler/MacroAssemblerCodeRef.cpp: (JSC::MacroAssemblerCodePtr::initialize):
  • assembler/MacroAssemblerCodeRef.h: (JSC::FunctionPtr::FunctionPtr): (JSC::FunctionPtr::value const): (JSC::FunctionPtr::executableAddress const): (JSC::ReturnAddressPtr::ReturnAddressPtr): (JSC::ReturnAddressPtr::value const): (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr): (JSC::MacroAssemblerCodePtr::createFromExecutableAddress): (JSC::MacroAssemblerCodePtr::scrambledPtr const): (JSC::MacroAssemblerCodePtr:: const): (JSC::MacroAssemblerCodePtr::operator! const): (JSC::MacroAssemblerCodePtr::operator bool const): (JSC::MacroAssemblerCodePtr::operator== const): (JSC::MacroAssemblerCodePtr::hash const): (JSC::MacroAssemblerCodePtr::emptyValue): (JSC::MacroAssemblerCodePtr::deletedValue): (JSC::MacroAssemblerCodePtr::executableAddress const): Deleted. (JSC::MacroAssemblerCodePtr::dataLocation const): Deleted.
  • b3/B3LowerMacros.cpp:
  • b3/testb3.cpp: (JSC::B3::testInterpreter):
  • dfg/DFGDisassembler.cpp: (JSC::DFG::Disassembler::dumpDisassembly):
  • dfg/DFGJITCompiler.cpp: (JSC::DFG::JITCompiler::link): (JSC::DFG::JITCompiler::compileFunction):
  • dfg/DFGOperations.cpp:
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::emitSwitchIntJump): (JSC::DFG::SpeculativeJIT::emitSwitchImm): (JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump): (JSC::DFG::SpeculativeJIT::emitSwitchChar):
  • dfg/DFGSpeculativeJIT.h:
  • disassembler/Disassembler.cpp: (JSC::disassemble):
  • disassembler/UDis86Disassembler.cpp: (JSC::tryToDisassembleWithUDis86):
  • ftl/FTLCompile.cpp: (JSC::FTL::compile):
  • ftl/FTLJITCode.cpp: (JSC::FTL::JITCode::executableAddressAtOffset):
  • ftl/FTLLink.cpp: (JSC::FTL::link):
  • ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileMathIC): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct): (JSC::FTL::DFG::LowerDFGToB3::compileTailCall): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
  • interpreter/InterpreterInlines.h: (JSC::Interpreter::getOpcodeID):
  • jit/JITArithmetic.cpp: (JSC::JIT::emitMathICFast): (JSC::JIT::emitMathICSlow):
  • jit/JITCode.cpp: (JSC::JITCodeWithCodeRef::executableAddressAtOffset): (JSC::JITCodeWithCodeRef::dataAddressAtOffset): (JSC::JITCodeWithCodeRef::offsetOf):
  • jit/JITDisassembler.cpp: (JSC::JITDisassembler::dumpDisassembly):
  • jit/PCToCodeOriginMap.cpp: (JSC::PCToCodeOriginMap::PCToCodeOriginMap):
  • jit/Repatch.cpp: (JSC::ftlThunkAwareRepatchCall):
  • jit/ThunkGenerators.cpp: (JSC::virtualThunkFor): (JSC::boundThisNoArgsFunctionCallGenerator):
  • llint/LLIntSlowPaths.cpp: (JSC::LLInt::llint_trace_operand): (JSC::LLInt::llint_trace_value): (JSC::LLInt::handleHostCall): (JSC::LLInt::setUpCall):
  • llint/LowLevelInterpreter64.asm:
  • offlineasm/cloop.rb:
  • runtime/InitializeThreading.cpp: (JSC::initializeThreading):
  • wasm/WasmBBQPlan.cpp: (JSC::Wasm::BBQPlan::complete):
  • wasm/WasmCallee.h: (JSC::Wasm::Callee::entrypoint const):
  • wasm/WasmCodeBlock.cpp: (JSC::Wasm::CodeBlock::CodeBlock):
  • wasm/WasmOMGPlan.cpp: (JSC::Wasm::OMGPlan::work):
  • wasm/js/WasmToJS.cpp: (JSC::Wasm::wasmToJS):
  • wasm/js/WebAssemblyFunction.cpp: (JSC::callWebAssemblyFunction):
  • wasm/js/WebAssemblyFunction.h:
  • wasm/js/WebAssemblyWrapperFunction.cpp: (JSC::WebAssemblyWrapperFunction::create):

2017-12-01 Mark Lam <​mark.lam@apple.com>

Let's scramble ClassInfo pointers in cells.
​https://bugs.webkit.org/show_bug.cgi?id=180291
<rdar://problem/35807620>

Reviewed by JF Bastien.

  • API/JSCallbackObject.h:
  • API/JSObjectRef.cpp: (classInfoPrivate):
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • Sources.txt:
  • assembler/MacroAssemblerCodeRef.cpp: (JSC::MacroAssemblerCodePtr::initialize): Deleted.
  • assembler/MacroAssemblerCodeRef.h: (JSC::MacroAssemblerCodePtr:: const): (JSC::MacroAssemblerCodePtr::hash const):
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::checkArray): (JSC::DFG::SpeculativeJIT::compileCheckSubClass): (JSC::DFG::SpeculativeJIT::compileNewStringObject):
  • ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject): (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
  • jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitAllocateDestructibleObject):
  • jit/SpecializedThunkJIT.h: (JSC::SpecializedThunkJIT::loadArgumentWithSpecificClass):
  • runtime/InitializeThreading.cpp: (JSC::initializeThreading):
  • runtime/JSCScrambledPtr.cpp: Added. (JSC::initializeScrambledPtrKeys):
  • runtime/JSCScrambledPtr.h: Added.
  • runtime/JSDestructibleObject.h: (JSC::JSDestructibleObject::classInfo const):
  • runtime/JSSegmentedVariableObject.h: (JSC::JSSegmentedVariableObject::classInfo const):
  • runtime/Structure.h:
  • runtime/VM.h:

2017-12-07 Mark Lam <​mark.lam@apple.com>

[Re-landing r225620] Refactoring: Rename ScrambledPtr to Poisoned.
​https://bugs.webkit.org/show_bug.cgi?id=180514

Reviewed by Saam Barati and JF Bastien.

Re-landing r225620 with speculative build fix for GCC 7.

  • API/JSCallbackObject.h:
  • API/JSObjectRef.cpp: (classInfoPrivate):
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • Sources.txt:
  • assembler/MacroAssemblerCodeRef.h: (JSC::FunctionPtr::FunctionPtr): (JSC::FunctionPtr::value const): (JSC::FunctionPtr::executableAddress const): (JSC::ReturnAddressPtr::ReturnAddressPtr): (JSC::ReturnAddressPtr::value const): (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr): (JSC::MacroAssemblerCodePtr::createFromExecutableAddress): (JSC::MacroAssemblerCodePtr::poisonedPtr const): (JSC::MacroAssemblerCodePtr:: const): (JSC::MacroAssemblerCodePtr::operator! const): (JSC::MacroAssemblerCodePtr::operator== const): (JSC::MacroAssemblerCodePtr::emptyValue): (JSC::MacroAssemblerCodePtr::deletedValue): (JSC::MacroAssemblerCodePtr::scrambledPtr const): Deleted.
  • b3/B3LowerMacros.cpp:
  • b3/testb3.cpp: (JSC::B3::testInterpreter):
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::checkArray): (JSC::DFG::SpeculativeJIT::compileCheckSubClass): (JSC::DFG::SpeculativeJIT::compileNewStringObject): (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
  • ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject): (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
  • jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitAllocateDestructibleObject):
  • jit/SpecializedThunkJIT.h: (JSC::SpecializedThunkJIT::loadArgumentWithSpecificClass):
  • jit/ThunkGenerators.cpp: (JSC::virtualThunkFor): (JSC::boundThisNoArgsFunctionCallGenerator):
  • llint/LLIntSlowPaths.cpp: (JSC::LLInt::handleHostCall): (JSC::LLInt::setUpCall):
  • llint/LowLevelInterpreter64.asm:
  • runtime/InitializeThreading.cpp: (JSC::initializeThreading):
  • runtime/JSCPoisonedPtr.cpp: Copied from Source/JavaScriptCore/runtime/JSCScrambledPtr.cpp. (JSC::initializePoison): (JSC::initializeScrambledPtrKeys): Deleted.
  • runtime/JSCPoisonedPtr.h: Copied from Source/JavaScriptCore/runtime/JSCScrambledPtr.h.
  • runtime/JSCScrambledPtr.cpp: Removed.
  • runtime/JSCScrambledPtr.h: Removed.
  • runtime/JSDestructibleObject.h: (JSC::JSDestructibleObject::classInfo const):
  • runtime/JSSegmentedVariableObject.h: (JSC::JSSegmentedVariableObject::classInfo const):
  • runtime/Structure.h:
  • runtime/VM.h:

2017-12-07 Mark Lam <​mark.lam@apple.com>

Apply poisoning to some native code pointers.
​https://bugs.webkit.org/show_bug.cgi?id=180541
<rdar://problem/35916875>

Reviewed by Filip Pizlo.

Renamed g_classInfoPoison to g_globalDataPoison.
Renamed g_masmPoison to g_jitCodePoison.
Introduced g_nativeCodePoison.
Applied g_nativeCodePoison to poisoning some native code pointers.

Introduced non-random Int32 poison values (in JSCPoison.h) for use with pointers
to malloc allocated data structures (where needed).

  • API/JSCallbackFunction.h: (JSC::JSCallbackFunction::functionCallback):
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • jit/ThunkGenerators.cpp: (JSC::nativeForGenerator):
  • llint/LowLevelInterpreter64.asm:
  • runtime/CustomGetterSetter.h: (JSC::CustomGetterSetter::getter const): (JSC::CustomGetterSetter::setter const):
  • runtime/InternalFunction.cpp: (JSC::InternalFunction::getCallData): (JSC::InternalFunction::getConstructData):
  • runtime/InternalFunction.h: (JSC::InternalFunction::nativeFunctionFor):
  • runtime/JSCPoison.h: Added.
  • runtime/JSCPoisonedPtr.cpp: (JSC::initializePoison):
  • runtime/JSCPoisonedPtr.h:
  • runtime/Lookup.h:
  • runtime/NativeExecutable.cpp: (JSC::NativeExecutable::hashFor const):
  • runtime/NativeExecutable.h:
  • runtime/Structure.cpp: (JSC::StructureTransitionTable::setSingleTransition):
  • runtime/StructureTransitionTable.h: (JSC::StructureTransitionTable::StructureTransitionTable): (JSC::StructureTransitionTable::isUsingSingleSlot const): (JSC::StructureTransitionTable::map const): (JSC::StructureTransitionTable::weakImpl const): (JSC::StructureTransitionTable::setMap):

2017-12-08 Mark Lam <​mark.lam@apple.com>

Need to unpoison native function pointers for CLoop.
​https://bugs.webkit.org/show_bug.cgi?id=180601
<rdar://problem/35942028>

Reviewed by JF Bastien.

  • llint/LowLevelInterpreter64.asm:

2017-12-13 Mark Lam <​mark.lam@apple.com>

Fill out some Poisoned APIs, fix some bugs, and add some tests.
​https://bugs.webkit.org/show_bug.cgi?id=180724
<rdar://problem/36006884>

Reviewed by JF Bastien.

  • runtime/StructureTransitionTable.h:

2017-12-18 Jason Marcell <​jmarcell@apple.com>

Apply patch. rdar://problem/36113365

Cherry-pick r225363, r225437, r225632, r225659, r225697, r225857. rdar://problem/36085975

2017-11-30 Mark Lam <​mark.lam@apple.com>

Let's scramble MacroAssemblerCodePtr values.
​https://bugs.webkit.org/show_bug.cgi?id=180169
<rdar://problem/35758340>

Reviewed by Filip Pizlo, Saam Barati, and JF Bastien.

Introduce a ScrambledPtr class to facilitate scrambling.

  • WTF.xcodeproj/project.pbxproj:
  • wtf/CMakeLists.txt:
  • wtf/ScrambledPtr.cpp: Added. (WTF::makeScrambledPtrKey):
  • wtf/ScrambledPtr.h: Added. (WTF::ScrambledPtr::ScrambledPtr): (WTF::ScrambledPtr::paranoidAssertIsScrambled const): (WTF::ScrambledPtr::paranoidAssertIsNotScrambled const): (WTF::ScrambledPtr:: const): (WTF::ScrambledPtr::operator-> const): (WTF::ScrambledPtr::scrambledBits const): (WTF::ScrambledPtr::operator! const): (WTF::ScrambledPtr::operator bool const): (WTF::ScrambledPtr::operator== const): (WTF::ScrambledPtr::operator==): (WTF::ScrambledPtr::scramble): (WTF::ScrambledPtr::descramble):

2017-12-01 Mark Lam <​mark.lam@apple.com>

Let's scramble ClassInfo pointers in cells.
​https://bugs.webkit.org/show_bug.cgi?id=180291
<rdar://problem/35807620>

Reviewed by JF Bastien.

  • wtf/ScrambledPtr.h: (WTF::ScrambledPtr::descrambled const): (WTF::ScrambledPtr::bits const): (WTF::ScrambledPtr::operator==): (WTF::ScrambledPtr::operator=): (WTF::ScrambledPtr::scramble): (WTF::ScrambledPtr::descramble): (WTF::ScrambledPtr:: const): Deleted. (WTF::ScrambledPtr::scrambledBits const): Deleted.

2017-12-07 Mark Lam <​mark.lam@apple.com>

[Re-landing r225620] Refactoring: Rename ScrambledPtr to Poisoned.
​https://bugs.webkit.org/show_bug.cgi?id=180514

Reviewed by Saam Barati and JF Bastien.

Re-landing r225620 with speculative build fix for GCC 7.

  • WTF.xcodeproj/project.pbxproj:
  • wtf/CMakeLists.txt:
  • wtf/Poisoned.cpp: Copied from Source/WTF/wtf/ScrambledPtr.cpp. (WTF::makePoison): (WTF::makeScrambledPtrKey): Deleted.
  • wtf/Poisoned.h: Copied from Source/WTF/wtf/ScrambledPtr.h. (WTF::PoisonedImpl::PoisonedImpl): (WTF::PoisonedImpl::assertIsPoisoned const): (WTF::PoisonedImpl::assertIsNotPoisoned const): (WTF::PoisonedImpl::unpoisoned const): (WTF::PoisonedImpl::operator-> const): (WTF::PoisonedImpl::bits const): (WTF::PoisonedImpl::operator! const): (WTF::PoisonedImpl::operator bool const): (WTF::PoisonedImpl::operator== const): (WTF::PoisonedImpl::operator==): (WTF::PoisonedImpl::operator=): (WTF::PoisonedImpl::poison): (WTF::PoisonedImpl::unpoison): (WTF::ScrambledPtr::ScrambledPtr): Deleted. (WTF::ScrambledPtr::assertIsScrambled const): Deleted. (WTF::ScrambledPtr::assertIsNotScrambled const): Deleted. (WTF::ScrambledPtr::descrambled const): Deleted. (WTF::ScrambledPtr::operator-> const): Deleted. (WTF::ScrambledPtr::bits const): Deleted. (WTF::ScrambledPtr::operator! const): Deleted. (WTF::ScrambledPtr::operator bool const): Deleted. (WTF::ScrambledPtr::operator== const): Deleted. (WTF::ScrambledPtr::operator==): Deleted. (WTF::ScrambledPtr::operator=): Deleted. (WTF::ScrambledPtr::scramble): Deleted. (WTF::ScrambledPtr::descramble): Deleted.
  • wtf/ScrambledPtr.cpp: Removed.
  • wtf/ScrambledPtr.h: Removed.

2017-12-07 Mark Lam <​mark.lam@apple.com>

Apply poisoning to some native code pointers.
​https://bugs.webkit.org/show_bug.cgi?id=180541
<rdar://problem/35916875>

Reviewed by Filip Pizlo.

Ensure that the resultant poisoned bits still looks like a pointer in that its
bottom bits are 0, just like the alignment bits of a pointer. This allows the
client to use the bottom bits of the poisoned bits as flag bits just like the
client was previously able to do with pointer values.

Note: we only ensure that the bottom alignment bits of the generated poison
value is 0. We're not masking out the poisoned bits. This means that the bottom
bits of the poisoned bits will only be null if the original pointer is aligned.
Hence, if the client applies the poison to an unaligned pointer, we do not lose
any information on the low bits.

Also removed 2 wrong assertions in PoisonedImpl's constructors. We were
asserting that Poisoned will never be used with a null value, but that's invalid.
We do want to allow a null value so that we don't have to constantly do null
checks in the clients. This was uncovered by some layout tests.

  • wtf/Poisoned.cpp: (WTF::makePoison):
  • wtf/Poisoned.h: (WTF::PoisonedImpl::PoisonedImpl):

2017-12-13 Mark Lam <​mark.lam@apple.com>

Fill out some Poisoned APIs, fix some bugs, and add some tests.
​https://bugs.webkit.org/show_bug.cgi?id=180724
<rdar://problem/36006884>

Reviewed by JF Bastien.

Also rename Int32Poisoned to ConstExprPoisoned. The key it takes is actually a
uint32_t. So, Int32 is really a misnomer. In addition, the key needs to be a
constexpr. So, ConstExprPoisoned is a better name for it.

  • wtf/Poisoned.cpp: (WTF::makePoison):
  • wtf/Poisoned.h: (WTF::PoisonedImplHelper::asReference): (WTF::PoisonedImpl::PoisonedImpl): (WTF::PoisonedImpl::clear): (WTF::PoisonedImpl::operator* const): (WTF::PoisonedImpl::operator-> const): (WTF::PoisonedImpl::operator== const): (WTF::PoisonedImpl::operator!= const): (WTF::PoisonedImpl::operator< const): (WTF::PoisonedImpl::operator<= const): (WTF::PoisonedImpl::operator> const): (WTF::PoisonedImpl::operator>= const): (WTF::PoisonedImpl::operator=): (WTF::PoisonedImpl::swap): (WTF::PoisonedImpl::exchange): (WTF::swap): (WTF::makePoison): (WTF::PoisonedImpl::operator==): Deleted.
3:15 PM Changeset in webkit [226572] by jmarcell@apple.com
  • 27 edits in branches/safari-604.4.7.10-branch/Source

Apply patch. rdar://problem/36116826

Use index masking for TypedArrays and and Wasm.
​https://bugs.webkit.org/show_bug.cgi?id=180920

Reviewed by Filip Pizlo.

We should have index masking for our TypedArray code in the
DFG/FTL and for Wasm when doing bounds checking. Index masking for
Wasm is added to the WasmBoundsCheckValue. Since we don't CSE any
WasmBoundsCheckValues we don't need to worry about combining a
bounds check for a load and a store. I went with fusing the
pointer masking in the WasmBoundsCheckValue since it should reduce
additional compiler overhead.

  • b3/B3LowerToAir.cpp:
  • b3/B3Validate.cpp:
  • b3/B3WasmBoundsCheckValue.cpp: (JSC::B3::WasmBoundsCheckValue::WasmBoundsCheckValue): (JSC::B3::WasmBoundsCheckValue::dumpMeta const):
  • b3/B3WasmBoundsCheckValue.h: (JSC::B3::WasmBoundsCheckValue::pinnedIndexingMask const):
  • b3/air/AirCustom.h: (JSC::B3::Air::WasmBoundsCheckCustom::generate):
  • b3/testb3.cpp: (JSC::B3::testWasmBoundsCheck):
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::loadFromIntTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
  • dfg/DFGSpeculativeJIT.h:
  • dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile):
  • ftl/FTLAbstractHeapRepository.h:
  • ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileAtomicsReadModifyWrite): (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal): (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray): (JSC::FTL::DFG::LowerDFGToB3::pointerIntoTypedArray):
  • jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitComputeButterflyIndexingMask):
  • runtime/Butterfly.h:
  • runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::JSArrayBufferView):
  • runtime/JSArrayBufferView.h: (JSC::JSArrayBufferView::offsetOfIndexingMask):
  • wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::B3IRGenerator): (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState): (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer): (JSC::Wasm::B3IRGenerator::load): (JSC::Wasm::B3IRGenerator::store): (JSC::Wasm::B3IRGenerator::addCallIndirect):
  • wasm/WasmBinding.cpp: (JSC::Wasm::wasmToWasm):
  • wasm/WasmMemory.cpp: (JSC::Wasm::Memory::Memory):
  • wasm/WasmMemory.h: (JSC::Wasm::Memory::offsetOfIndexingMask):
  • wasm/WasmMemoryInformation.cpp: (JSC::Wasm::PinnedRegisterInfo::get): (JSC::Wasm::PinnedRegisterInfo::PinnedRegisterInfo):
  • wasm/WasmMemoryInformation.h: (JSC::Wasm::PinnedRegisterInfo::toSave const):
  • wasm/js/JSToWasm.cpp: (JSC::Wasm::createJSToWasmWrapper):

Use index masking for TypedArrays and and Wasm.
​https://bugs.webkit.org/show_bug.cgi?id=180920

Reviewed by Filip Pizlo.

Copy things from ToT that we will need for a branch.

  • wtf/MathExtras.h: (WTF::computeIndexingMask):
  • wtf/StdLibExtras.h: (std::clz):
3:15 PM Changeset in webkit [226571] by jmarcell@apple.com
  • 5 edits in branches/safari-604.4.7.10-branch

Apply patch. rdar://problem/36116741

Reduce the precision of "high" resolution time to 1ms
​https://bugs.webkit.org/show_bug.cgi?id=180910
<rdar://problem/36085943>

Reviewed by Saam Barati.

Add a flaky test expectation to imported/w3c/web-platform-tests/workers/worker-performance.worker.html
due to a test bug. The test fix is tracked in ​https://github.com/w3c/web-platform-tests/pull/8711

3:15 PM Changeset in webkit [226570] by jmarcell@apple.com
  • 13 edits in branches/safari-604.4.7.10-branch/Source

Cherry-pick r226068. rdar://problem/36116830

3:14 PM Changeset in webkit [226569] by jmarcell@apple.com
  • 3 edits in branches/safari-604.4.7.10-branch/Source/JavaScriptCore

Apply patch. rdar://problem/36116696

Disable/remove SharedArrayBuffers from Web API
rdar://problem/36077849

Removed SharedArrayBuffer prototype and structure to disable.

  • runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildren):
  • runtime/JSGlobalObject.h: (JSC::JSGlobalObject::arrayBufferPrototype const): (JSC::JSGlobalObject::arrayBufferStructure const):
3:14 PM Changeset in webkit [226568] by Alan Bujtas
  • 9 edits
    2 adds in trunk/Source/WebCore

[RenderTreeBuilder] Move SVG addChild logic to RenderTreeBuilder
​https://bugs.webkit.org/show_bug.cgi?id=181405
<rdar://problem/36360476>

Reviewed by Antti Koivisto.

This is about moving the code, no cleanup and/or normalization (unfortunately it also means
some temporary changes).

No change in functionality.

  • Sources.txt:
  • WebCore.xcodeproj/project.pbxproj:
  • rendering/svg/RenderSVGContainer.cpp:

(WebCore::RenderSVGContainer::addChild):

  • rendering/svg/RenderSVGInline.cpp:

(WebCore::RenderSVGInline::addChild):

  • rendering/svg/RenderSVGRoot.cpp:

(WebCore::RenderSVGRoot::addChild):

  • rendering/svg/RenderSVGText.cpp:

(WebCore::RenderSVGText::addChild):

  • rendering/updating/RenderTreeBuilder.cpp:

(WebCore::RenderTreeBuilder::RenderTreeBuilder):
(WebCore::RenderTreeBuilder::insertChildToSVGContainer):
(WebCore::RenderTreeBuilder::insertChildToSVGInline):
(WebCore::RenderTreeBuilder::insertChildToSVGRoot):
(WebCore::RenderTreeBuilder::insertChildToSVGText):

  • rendering/updating/RenderTreeBuilder.h:

(WebCore::RenderTreeBuilder::SVGBuilder):

  • rendering/updating/RenderTreeBuilderSVG.cpp: Added.

(WebCore::RenderTreeBuilder::SVG::SVG):
(WebCore::RenderTreeBuilder::SVG::insertChild):

  • rendering/updating/RenderTreeBuilderSVG.h: Added.
3:11 PM Changeset in webkit [226567] by jmarcell@apple.com
  • 1 copy in tags/Safari-604.4.7.1.6

Tag Safari-604.4.7.1.6.

3:10 PM Changeset in webkit [226566] by jmarcell@apple.com
  • 1 copy in tags/Safari-604.4.7.1.5

Tag Safari-604.4.7.1.5.

3:09 PM Changeset in webkit [226565] by jmarcell@apple.com
  • 7 edits in branches/safari-604.4.7.1-branch/Source

Versioning.

3:09 PM Changeset in webkit [226564] by jmarcell@apple.com
  • 1 edit in branches/safari-604.4.7.1-branch/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp

Apply patch. rdar://problem/36267626

fix indexing mask

3:09 PM Changeset in webkit [226563] by jmarcell@apple.com
  • 7 edits in branches/safari-604.4.7.1-branch/Source

Versioning.

3:09 PM Changeset in webkit [226562] by jmarcell@apple.com
  • 2 edits in branches/safari-604.4.7.1-branch/Source/JavaScriptCore

Apply patch. rdar://problem/36116390

32-bit fix.

3:09 PM Changeset in webkit [226561] by jmarcell@apple.com
  • 62 edits
    4 copies
    3 adds in branches/safari-604.4.7.1-branch

Apply patch. rdar://problem/36116388

Cherry-pick r225363, r225437, r225632, r225659, r225697, r225857. rdar://problem/36085975

Also merged offlineasm parts of r220184 and r222549. These changes are required
to support the code in cherry-picked revisions above.

2017-11-30 Mark Lam <​mark.lam@apple.com>

Let's scramble MacroAssemblerCodePtr values.
​https://bugs.webkit.org/show_bug.cgi?id=180169
<rdar://problem/35758340>

Reviewed by Filip Pizlo, Saam Barati, and JF Bastien.

  1. MacroAssemblerCodePtr now stores a ScrambledPtr instead of a void*.
  1. MacroAssemblerCodePtr's executableAddress() and dataLocation() now take a template argument type that will be used to cast the result. This makes the client code that uses these functions a little less verbose.
  1. Change the code base in general to minimize passing void* code pointers around. We now pass MacroAssemblerCodePtr as much as possible, and descramble it only at the last moment when we need the underlying code pointer.
  1. Added some MasmScrambledPtr paranoid asserts that are disabled (not built) by default. I'm leaving them in because they are instrumental in finding bugs where not all MacroAssemblerCodePtr values were not scrambled as expected. I expect them to be useful in the near future as we add more scrambling.
  1. Also disable the casting operator on MacroAssemblerCodePtr (except for explicit casts to a boolean). This ensures that clients will always explicitly use scrambledBits() or executableAddress() to get a value based on which value they actually need.
  1. Added currentThread() id to the logging in LLIntSlowPath trace functions. This was helpful when debugging tests that ran multiple VMs concurrently on different threads.

MacroAssemblerCodePtr is currently supported on 64-bit builds (including the
CLoop). It is not yet supported in 32-bit and Windows because we don't
currently have a way to read a global variable from their LLInt code.

  • assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::differenceBetweenCodePtr): (JSC::AbstractMacroAssembler::linkPointer):
  • assembler/CodeLocation.h: (JSC::CodeLocationCommon::instructionAtOffset): (JSC::CodeLocationCommon::labelAtOffset): (JSC::CodeLocationCommon::jumpAtOffset): (JSC::CodeLocationCommon::callAtOffset): (JSC::CodeLocationCommon::nearCallAtOffset): (JSC::CodeLocationCommon::dataLabelPtrAtOffset): (JSC::CodeLocationCommon::dataLabel32AtOffset): (JSC::CodeLocationCommon::dataLabelCompactAtOffset): (JSC::CodeLocationCommon::convertibleLoadAtOffset):
  • assembler/LinkBuffer.cpp: (JSC::LinkBuffer::finalizeCodeWithDisassembly):
  • assembler/LinkBuffer.h: (JSC::LinkBuffer::link): (JSC::LinkBuffer::patch):
  • assembler/MacroAssemblerCodeRef.cpp: (JSC::MacroAssemblerCodePtr::initialize):
  • assembler/MacroAssemblerCodeRef.h: (JSC::FunctionPtr::FunctionPtr): (JSC::FunctionPtr::value const): (JSC::FunctionPtr::executableAddress const): (JSC::ReturnAddressPtr::ReturnAddressPtr): (JSC::ReturnAddressPtr::value const): (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr): (JSC::MacroAssemblerCodePtr::createFromExecutableAddress): (JSC::MacroAssemblerCodePtr::scrambledPtr const): (JSC::MacroAssemblerCodePtr:: const): (JSC::MacroAssemblerCodePtr::operator! const): (JSC::MacroAssemblerCodePtr::operator bool const): (JSC::MacroAssemblerCodePtr::operator== const): (JSC::MacroAssemblerCodePtr::hash const): (JSC::MacroAssemblerCodePtr::emptyValue): (JSC::MacroAssemblerCodePtr::deletedValue): (JSC::MacroAssemblerCodePtr::executableAddress const): Deleted. (JSC::MacroAssemblerCodePtr::dataLocation const): Deleted.
  • b3/B3LowerMacros.cpp:
  • b3/testb3.cpp: (JSC::B3::testInterpreter):
  • dfg/DFGDisassembler.cpp: (JSC::DFG::Disassembler::dumpDisassembly):
  • dfg/DFGJITCompiler.cpp: (JSC::DFG::JITCompiler::link): (JSC::DFG::JITCompiler::compileFunction):
  • dfg/DFGOperations.cpp:
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::emitSwitchIntJump): (JSC::DFG::SpeculativeJIT::emitSwitchImm): (JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump): (JSC::DFG::SpeculativeJIT::emitSwitchChar):
  • dfg/DFGSpeculativeJIT.h:
  • disassembler/Disassembler.cpp: (JSC::disassemble):
  • disassembler/UDis86Disassembler.cpp: (JSC::tryToDisassembleWithUDis86):
  • ftl/FTLCompile.cpp: (JSC::FTL::compile):
  • ftl/FTLJITCode.cpp: (JSC::FTL::JITCode::executableAddressAtOffset):
  • ftl/FTLLink.cpp: (JSC::FTL::link):
  • ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileMathIC): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct): (JSC::FTL::DFG::LowerDFGToB3::compileTailCall): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
  • interpreter/InterpreterInlines.h: (JSC::Interpreter::getOpcodeID):
  • jit/JITArithmetic.cpp: (JSC::JIT::emitMathICFast): (JSC::JIT::emitMathICSlow):
  • jit/JITCode.cpp: (JSC::JITCodeWithCodeRef::executableAddressAtOffset): (JSC::JITCodeWithCodeRef::dataAddressAtOffset): (JSC::JITCodeWithCodeRef::offsetOf):
  • jit/JITDisassembler.cpp: (JSC::JITDisassembler::dumpDisassembly):
  • jit/PCToCodeOriginMap.cpp: (JSC::PCToCodeOriginMap::PCToCodeOriginMap):
  • jit/Repatch.cpp: (JSC::ftlThunkAwareRepatchCall):
  • jit/ThunkGenerators.cpp: (JSC::virtualThunkFor): (JSC::boundThisNoArgsFunctionCallGenerator):
  • llint/LLIntSlowPaths.cpp: (JSC::LLInt::llint_trace_operand): (JSC::LLInt::llint_trace_value): (JSC::LLInt::handleHostCall): (JSC::LLInt::setUpCall):
  • llint/LowLevelInterpreter64.asm:
  • offlineasm/cloop.rb:
  • runtime/InitializeThreading.cpp: (JSC::initializeThreading):
  • wasm/WasmBBQPlan.cpp: (JSC::Wasm::BBQPlan::complete):
  • wasm/WasmCallee.h: (JSC::Wasm::Callee::entrypoint const):
  • wasm/WasmCodeBlock.cpp: (JSC::Wasm::CodeBlock::CodeBlock):
  • wasm/WasmOMGPlan.cpp: (JSC::Wasm::OMGPlan::work):
  • wasm/js/WasmToJS.cpp: (JSC::Wasm::wasmToJS):
  • wasm/js/WebAssemblyFunction.cpp: (JSC::callWebAssemblyFunction):
  • wasm/js/WebAssemblyFunction.h:
  • wasm/js/WebAssemblyWrapperFunction.cpp: (JSC::WebAssemblyWrapperFunction::create):

2017-12-01 Mark Lam <​mark.lam@apple.com>

Let's scramble ClassInfo pointers in cells.
​https://bugs.webkit.org/show_bug.cgi?id=180291
<rdar://problem/35807620>

Reviewed by JF Bastien.

  • API/JSCallbackObject.h:
  • API/JSObjectRef.cpp: (classInfoPrivate):
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • Sources.txt:
  • assembler/MacroAssemblerCodeRef.cpp: (JSC::MacroAssemblerCodePtr::initialize): Deleted.
  • assembler/MacroAssemblerCodeRef.h: (JSC::MacroAssemblerCodePtr:: const): (JSC::MacroAssemblerCodePtr::hash const):
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::checkArray): (JSC::DFG::SpeculativeJIT::compileCheckSubClass): (JSC::DFG::SpeculativeJIT::compileNewStringObject):
  • ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject): (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
  • jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitAllocateDestructibleObject):
  • jit/SpecializedThunkJIT.h: (JSC::SpecializedThunkJIT::loadArgumentWithSpecificClass):
  • runtime/InitializeThreading.cpp: (JSC::initializeThreading):
  • runtime/JSCScrambledPtr.cpp: Added. (JSC::initializeScrambledPtrKeys):
  • runtime/JSCScrambledPtr.h: Added.
  • runtime/JSDestructibleObject.h: (JSC::JSDestructibleObject::classInfo const):
  • runtime/JSSegmentedVariableObject.h: (JSC::JSSegmentedVariableObject::classInfo const):
  • runtime/Structure.h:
  • runtime/VM.h:

2017-12-07 Mark Lam <​mark.lam@apple.com>

[Re-landing r225620] Refactoring: Rename ScrambledPtr to Poisoned.
​https://bugs.webkit.org/show_bug.cgi?id=180514

Reviewed by Saam Barati and JF Bastien.

Re-landing r225620 with speculative build fix for GCC 7.

  • API/JSCallbackObject.h:
  • API/JSObjectRef.cpp: (classInfoPrivate):
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • Sources.txt:
  • assembler/MacroAssemblerCodeRef.h: (JSC::FunctionPtr::FunctionPtr): (JSC::FunctionPtr::value const): (JSC::FunctionPtr::executableAddress const): (JSC::ReturnAddressPtr::ReturnAddressPtr): (JSC::ReturnAddressPtr::value const): (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr): (JSC::MacroAssemblerCodePtr::createFromExecutableAddress): (JSC::MacroAssemblerCodePtr::poisonedPtr const): (JSC::MacroAssemblerCodePtr:: const): (JSC::MacroAssemblerCodePtr::operator! const): (JSC::MacroAssemblerCodePtr::operator== const): (JSC::MacroAssemblerCodePtr::emptyValue): (JSC::MacroAssemblerCodePtr::deletedValue): (JSC::MacroAssemblerCodePtr::scrambledPtr const): Deleted.
  • b3/B3LowerMacros.cpp:
  • b3/testb3.cpp: (JSC::B3::testInterpreter):
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::checkArray): (JSC::DFG::SpeculativeJIT::compileCheckSubClass): (JSC::DFG::SpeculativeJIT::compileNewStringObject): (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
  • ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject): (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
  • jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitAllocateDestructibleObject):
  • jit/SpecializedThunkJIT.h: (JSC::SpecializedThunkJIT::loadArgumentWithSpecificClass):
  • jit/ThunkGenerators.cpp: (JSC::virtualThunkFor): (JSC::boundThisNoArgsFunctionCallGenerator):
  • llint/LLIntSlowPaths.cpp: (JSC::LLInt::handleHostCall): (JSC::LLInt::setUpCall):
  • llint/LowLevelInterpreter64.asm:
  • runtime/InitializeThreading.cpp: (JSC::initializeThreading):
  • runtime/JSCPoisonedPtr.cpp: Copied from Source/JavaScriptCore/runtime/JSCScrambledPtr.cpp. (JSC::initializePoison): (JSC::initializeScrambledPtrKeys): Deleted.
  • runtime/JSCPoisonedPtr.h: Copied from Source/JavaScriptCore/runtime/JSCScrambledPtr.h.
  • runtime/JSCScrambledPtr.cpp: Removed.
  • runtime/JSCScrambledPtr.h: Removed.
  • runtime/JSDestructibleObject.h: (JSC::JSDestructibleObject::classInfo const):
  • runtime/JSSegmentedVariableObject.h: (JSC::JSSegmentedVariableObject::classInfo const):
  • runtime/Structure.h:
  • runtime/VM.h:

2017-12-07 Mark Lam <​mark.lam@apple.com>

Apply poisoning to some native code pointers.
​https://bugs.webkit.org/show_bug.cgi?id=180541
<rdar://problem/35916875>

Reviewed by Filip Pizlo.

Renamed g_classInfoPoison to g_globalDataPoison.
Renamed g_masmPoison to g_jitCodePoison.
Introduced g_nativeCodePoison.
Applied g_nativeCodePoison to poisoning some native code pointers.

Introduced non-random Int32 poison values (in JSCPoison.h) for use with pointers
to malloc allocated data structures (where needed).

  • API/JSCallbackFunction.h: (JSC::JSCallbackFunction::functionCallback):
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • jit/ThunkGenerators.cpp: (JSC::nativeForGenerator):
  • llint/LowLevelInterpreter64.asm:
  • runtime/CustomGetterSetter.h: (JSC::CustomGetterSetter::getter const): (JSC::CustomGetterSetter::setter const):
  • runtime/InternalFunction.cpp: (JSC::InternalFunction::getCallData): (JSC::InternalFunction::getConstructData):
  • runtime/InternalFunction.h: (JSC::InternalFunction::nativeFunctionFor):
  • runtime/JSCPoison.h: Added.
  • runtime/JSCPoisonedPtr.cpp: (JSC::initializePoison):
  • runtime/JSCPoisonedPtr.h:
  • runtime/Lookup.h:
  • runtime/NativeExecutable.cpp: (JSC::NativeExecutable::hashFor const):
  • runtime/NativeExecutable.h:
  • runtime/Structure.cpp: (JSC::StructureTransitionTable::setSingleTransition):
  • runtime/StructureTransitionTable.h: (JSC::StructureTransitionTable::StructureTransitionTable): (JSC::StructureTransitionTable::isUsingSingleSlot const): (JSC::StructureTransitionTable::map const): (JSC::StructureTransitionTable::weakImpl const): (JSC::StructureTransitionTable::setMap):

2017-12-08 Mark Lam <​mark.lam@apple.com>

Need to unpoison native function pointers for CLoop.
​https://bugs.webkit.org/show_bug.cgi?id=180601
<rdar://problem/35942028>

Reviewed by JF Bastien.

  • llint/LowLevelInterpreter64.asm:

2017-12-13 Mark Lam <​mark.lam@apple.com>

Fill out some Poisoned APIs, fix some bugs, and add some tests.
​https://bugs.webkit.org/show_bug.cgi?id=180724
<rdar://problem/36006884>

Reviewed by JF Bastien.

  • runtime/StructureTransitionTable.h:

2017-12-18 Jason Marcell <​jmarcell@apple.com>

Apply patch. rdar://problem/36113365

Cherry-pick r225363, r225437, r225632, r225659, r225697, r225857. rdar://problem/36085975

2017-11-30 Mark Lam <​mark.lam@apple.com>

Let's scramble MacroAssemblerCodePtr values.
​https://bugs.webkit.org/show_bug.cgi?id=180169
<rdar://problem/35758340>

Reviewed by Filip Pizlo, Saam Barati, and JF Bastien.

Introduce a ScrambledPtr class to facilitate scrambling.

  • WTF.xcodeproj/project.pbxproj:
  • wtf/CMakeLists.txt:
  • wtf/ScrambledPtr.cpp: Added. (WTF::makeScrambledPtrKey):
  • wtf/ScrambledPtr.h: Added. (WTF::ScrambledPtr::ScrambledPtr): (WTF::ScrambledPtr::paranoidAssertIsScrambled const): (WTF::ScrambledPtr::paranoidAssertIsNotScrambled const): (WTF::ScrambledPtr:: const): (WTF::ScrambledPtr::operator-> const): (WTF::ScrambledPtr::scrambledBits const): (WTF::ScrambledPtr::operator! const): (WTF::ScrambledPtr::operator bool const): (WTF::ScrambledPtr::operator== const): (WTF::ScrambledPtr::operator==): (WTF::ScrambledPtr::scramble): (WTF::ScrambledPtr::descramble):

2017-12-01 Mark Lam <​mark.lam@apple.com>

Let's scramble ClassInfo pointers in cells.
​https://bugs.webkit.org/show_bug.cgi?id=180291
<rdar://problem/35807620>

Reviewed by JF Bastien.

  • wtf/ScrambledPtr.h: (WTF::ScrambledPtr::descrambled const): (WTF::ScrambledPtr::bits const): (WTF::ScrambledPtr::operator==): (WTF::ScrambledPtr::operator=): (WTF::ScrambledPtr::scramble): (WTF::ScrambledPtr::descramble): (WTF::ScrambledPtr:: const): Deleted. (WTF::ScrambledPtr::scrambledBits const): Deleted.

2017-12-07 Mark Lam <​mark.lam@apple.com>

[Re-landing r225620] Refactoring: Rename ScrambledPtr to Poisoned.
​https://bugs.webkit.org/show_bug.cgi?id=180514

Reviewed by Saam Barati and JF Bastien.

Re-landing r225620 with speculative build fix for GCC 7.

  • WTF.xcodeproj/project.pbxproj:
  • wtf/CMakeLists.txt:
  • wtf/Poisoned.cpp: Copied from Source/WTF/wtf/ScrambledPtr.cpp. (WTF::makePoison): (WTF::makeScrambledPtrKey): Deleted.
  • wtf/Poisoned.h: Copied from Source/WTF/wtf/ScrambledPtr.h. (WTF::PoisonedImpl::PoisonedImpl): (WTF::PoisonedImpl::assertIsPoisoned const): (WTF::PoisonedImpl::assertIsNotPoisoned const): (WTF::PoisonedImpl::unpoisoned const): (WTF::PoisonedImpl::operator-> const): (WTF::PoisonedImpl::bits const): (WTF::PoisonedImpl::operator! const): (WTF::PoisonedImpl::operator bool const): (WTF::PoisonedImpl::operator== const): (WTF::PoisonedImpl::operator==): (WTF::PoisonedImpl::operator=): (WTF::PoisonedImpl::poison): (WTF::PoisonedImpl::unpoison): (WTF::ScrambledPtr::ScrambledPtr): Deleted. (WTF::ScrambledPtr::assertIsScrambled const): Deleted. (WTF::ScrambledPtr::assertIsNotScrambled const): Deleted. (WTF::ScrambledPtr::descrambled const): Deleted. (WTF::ScrambledPtr::operator-> const): Deleted. (WTF::ScrambledPtr::bits const): Deleted. (WTF::ScrambledPtr::operator! const): Deleted. (WTF::ScrambledPtr::operator bool const): Deleted. (WTF::ScrambledPtr::operator== const): Deleted. (WTF::ScrambledPtr::operator==): Deleted. (WTF::ScrambledPtr::operator=): Deleted. (WTF::ScrambledPtr::scramble): Deleted. (WTF::ScrambledPtr::descramble): Deleted.
  • wtf/ScrambledPtr.cpp: Removed.
  • wtf/ScrambledPtr.h: Removed.

2017-12-07 Mark Lam <​mark.lam@apple.com>

Apply poisoning to some native code pointers.
​https://bugs.webkit.org/show_bug.cgi?id=180541
<rdar://problem/35916875>

Reviewed by Filip Pizlo.

Ensure that the resultant poisoned bits still looks like a pointer in that its
bottom bits are 0, just like the alignment bits of a pointer. This allows the
client to use the bottom bits of the poisoned bits as flag bits just like the
client was previously able to do with pointer values.

Note: we only ensure that the bottom alignment bits of the generated poison
value is 0. We're not masking out the poisoned bits. This means that the bottom
bits of the poisoned bits will only be null if the original pointer is aligned.
Hence, if the client applies the poison to an unaligned pointer, we do not lose
any information on the low bits.

Also removed 2 wrong assertions in PoisonedImpl's constructors. We were
asserting that Poisoned will never be used with a null value, but that's invalid.
We do want to allow a null value so that we don't have to constantly do null
checks in the clients. This was uncovered by some layout tests.

  • wtf/Poisoned.cpp: (WTF::makePoison):
  • wtf/Poisoned.h: (WTF::PoisonedImpl::PoisonedImpl):

2017-12-13 Mark Lam <​mark.lam@apple.com>

Fill out some Poisoned APIs, fix some bugs, and add some tests.
​https://bugs.webkit.org/show_bug.cgi?id=180724
<rdar://problem/36006884>

Reviewed by JF Bastien.

Also rename Int32Poisoned to ConstExprPoisoned. The key it takes is actually a
uint32_t. So, Int32 is really a misnomer. In addition, the key needs to be a
constexpr. So, ConstExprPoisoned is a better name for it.

  • wtf/Poisoned.cpp: (WTF::makePoison):
  • wtf/Poisoned.h: (WTF::PoisonedImplHelper::asReference): (WTF::PoisonedImpl::PoisonedImpl): (WTF::PoisonedImpl::clear): (WTF::PoisonedImpl::operator* const): (WTF::PoisonedImpl::operator-> const): (WTF::PoisonedImpl::operator== const): (WTF::PoisonedImpl::operator!= const): (WTF::PoisonedImpl::operator< const): (WTF::PoisonedImpl::operator<= const): (WTF::PoisonedImpl::operator> const): (WTF::PoisonedImpl::operator>= const): (WTF::PoisonedImpl::operator=): (WTF::PoisonedImpl::swap): (WTF::PoisonedImpl::exchange): (WTF::swap): (WTF::makePoison): (WTF::PoisonedImpl::operator==): Deleted.
3:09 PM Changeset in webkit [226560] by jmarcell@apple.com
  • 27 edits in branches/safari-604.4.7.1-branch/Source

Apply patch. rdar://problem/36116390

Use index masking for TypedArrays and and Wasm.
​https://bugs.webkit.org/show_bug.cgi?id=180920

Reviewed by Filip Pizlo.

We should have index masking for our TypedArray code in the
DFG/FTL and for Wasm when doing bounds checking. Index masking for
Wasm is added to the WasmBoundsCheckValue. Since we don't CSE any
WasmBoundsCheckValues we don't need to worry about combining a
bounds check for a load and a store. I went with fusing the
pointer masking in the WasmBoundsCheckValue since it should reduce
additional compiler overhead.

  • b3/B3LowerToAir.cpp:
  • b3/B3Validate.cpp:
  • b3/B3WasmBoundsCheckValue.cpp: (JSC::B3::WasmBoundsCheckValue::WasmBoundsCheckValue): (JSC::B3::WasmBoundsCheckValue::dumpMeta const):
  • b3/B3WasmBoundsCheckValue.h: (JSC::B3::WasmBoundsCheckValue::pinnedIndexingMask const):
  • b3/air/AirCustom.h: (JSC::B3::Air::WasmBoundsCheckCustom::generate):
  • b3/testb3.cpp: (JSC::B3::testWasmBoundsCheck):
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::loadFromIntTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
  • dfg/DFGSpeculativeJIT.h:
  • dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile):
  • ftl/FTLAbstractHeapRepository.h:
  • ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileAtomicsReadModifyWrite): (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal): (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray): (JSC::FTL::DFG::LowerDFGToB3::pointerIntoTypedArray):
  • jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitComputeButterflyIndexingMask):
  • runtime/Butterfly.h:
  • runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::JSArrayBufferView):
  • runtime/JSArrayBufferView.h: (JSC::JSArrayBufferView::offsetOfIndexingMask):
  • wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::B3IRGenerator): (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState): (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer): (JSC::Wasm::B3IRGenerator::load): (JSC::Wasm::B3IRGenerator::store): (JSC::Wasm::B3IRGenerator::addCallIndirect):
  • wasm/WasmBinding.cpp: (JSC::Wasm::wasmToWasm):
  • wasm/WasmMemory.cpp: (JSC::Wasm::Memory::Memory):
  • wasm/WasmMemory.h: (JSC::Wasm::Memory::offsetOfIndexingMask):
  • wasm/WasmMemoryInformation.cpp: (JSC::Wasm::PinnedRegisterInfo::get): (JSC::Wasm::PinnedRegisterInfo::PinnedRegisterInfo):
  • wasm/WasmMemoryInformation.h: (JSC::Wasm::PinnedRegisterInfo::toSave const):
  • wasm/js/JSToWasm.cpp: (JSC::Wasm::createJSToWasmWrapper):

Use index masking for TypedArrays and and Wasm.
​https://bugs.webkit.org/show_bug.cgi?id=180920

Reviewed by Filip Pizlo.

Copy things from ToT that we will need for a branch.

  • wtf/MathExtras.h: (WTF::computeIndexingMask):
  • wtf/StdLibExtras.h: (std::clz):
3:08 PM Changeset in webkit [226559] by jmarcell@apple.com
  • 5 edits in branches/safari-604.4.7.1-branch

Apply patch. rdar://problem/36116546

Reduce the precision of "high" resolution time to 1ms
​https://bugs.webkit.org/show_bug.cgi?id=180910
<rdar://problem/36085943>

Reviewed by Saam Barati.

Add a flaky test expectation to imported/w3c/web-platform-tests/workers/worker-performance.worker.html
due to a test bug. The test fix is tracked in ​https://github.com/w3c/web-platform-tests/pull/8711

3:08 PM Changeset in webkit [226558] by jmarcell@apple.com
  • 13 edits in branches/safari-604.4.7.1-branch/Source

Cherry-pick r226068. rdar://problem/36116392

3:08 PM Changeset in webkit [226557] by jmarcell@apple.com
  • 3 edits in branches/safari-604.4.7.1-branch/Source/JavaScriptCore

Apply patch. rdar://problem/36116362

Disable/remove SharedArrayBuffers from Web API
rdar://problem/36077849

Removed SharedArrayBuffer prototype and structure to disable.

  • runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildren):
  • runtime/JSGlobalObject.h: (JSC::JSGlobalObject::arrayBufferPrototype const): (JSC::JSGlobalObject::arrayBufferStructure const):
2:59 PM Changeset in webkit [226556] by mark.lam@apple.com
  • 6 edits in trunk/Source/JavaScriptCore

Rename CodeBlock::m_vm to CodeBlock::m_poisonedVM.
​https://bugs.webkit.org/show_bug.cgi?id=181403
<rdar://problem/36359789>

Rubber-stamped by JF Bastien.

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::~CodeBlock):
(JSC::CodeBlock::setConstantRegisters):
(JSC::CodeBlock::propagateTransitions):
(JSC::CodeBlock::finalizeLLIntInlineCaches):
(JSC::CodeBlock::jettison):
(JSC::CodeBlock::predictedMachineCodeSize):

  • bytecode/CodeBlock.h:

(JSC::CodeBlock::vm const):
(JSC::CodeBlock::addConstant):
(JSC::CodeBlock::heap const):
(JSC::CodeBlock::replaceConstant):

  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm:
2:51 PM Changeset in webkit [226555] by jmarcell@apple.com
  • 1 copy in tags/Safari-604.4.7.0.5

Tag Safari-604.4.7.0.5.

2:50 PM Changeset in webkit [226554] by jmarcell@apple.com
  • 1 copy in tags/Safari-604.4.7.0.4

Tag Safari-604.4.7.0.4.

2:45 PM Changeset in webkit [226553] by jmarcell@apple.com
  • 1 copy in tags/Safari-605.1.20

Tag Safari-605.1.20.

2:42 PM Changeset in webkit [226552] by jmarcell@apple.com
  • 7 edits in branches/safari-604.4.7.0-branch/Source

Versioning.

2:42 PM Changeset in webkit [226551] by jmarcell@apple.com
  • 1 edit in branches/safari-604.4.7.0-branch/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp

Apply patch. rdar://problem/36267602

fix indexing mask

2:42 PM Changeset in webkit [226550] by jmarcell@apple.com
  • 7 edits in branches/safari-604.4.7.0-branch/Source

Versioning.

2:42 PM Changeset in webkit [226549] by jmarcell@apple.com
  • 3 edits in branches/safari-604.4.7.0-branch/Source/JavaScriptCore/offlineasm

Apply patch. rdar://problem/36113365

Fix build failure for iOS. Partial cherry-pick r223239 (offlineasm portion of that change).

2:42 PM Changeset in webkit [226548] by jmarcell@apple.com
  • 2 edits in branches/safari-604.4.7.0-branch/Source/JavaScriptCore

Apply patch. rdar://problem/36113365

32-bit fix.

2:42 PM Changeset in webkit [226547] by jmarcell@apple.com
  • 62 edits
    4 copies
    3 adds in branches/safari-604.4.7.0-branch

Apply patch. rdar://problem/36113352

Cherry-pick r225363, r225437, r225632, r225659, r225697, r225857. rdar://problem/36085975

Also merged offlineasm parts of r220184 and r222549. These changes are required
to support the code in cherry-picked revisions above.

2017-11-30 Mark Lam <​mark.lam@apple.com>

Let's scramble MacroAssemblerCodePtr values.
​https://bugs.webkit.org/show_bug.cgi?id=180169
<rdar://problem/35758340>

Reviewed by Filip Pizlo, Saam Barati, and JF Bastien.

  1. MacroAssemblerCodePtr now stores a ScrambledPtr instead of a void*.
  1. MacroAssemblerCodePtr's executableAddress() and dataLocation() now take a template argument type that will be used to cast the result. This makes the client code that uses these functions a little less verbose.
  1. Change the code base in general to minimize passing void* code pointers around. We now pass MacroAssemblerCodePtr as much as possible, and descramble it only at the last moment when we need the underlying code pointer.
  1. Added some MasmScrambledPtr paranoid asserts that are disabled (not built) by default. I'm leaving them in because they are instrumental in finding bugs where not all MacroAssemblerCodePtr values were not scrambled as expected. I expect them to be useful in the near future as we add more scrambling.
  1. Also disable the casting operator on MacroAssemblerCodePtr (except for explicit casts to a boolean). This ensures that clients will always explicitly use scrambledBits() or executableAddress() to get a value based on which value they actually need.
  1. Added currentThread() id to the logging in LLIntSlowPath trace functions. This was helpful when debugging tests that ran multiple VMs concurrently on different threads.

MacroAssemblerCodePtr is currently supported on 64-bit builds (including the
CLoop). It is not yet supported in 32-bit and Windows because we don't
currently have a way to read a global variable from their LLInt code.

  • assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::differenceBetweenCodePtr): (JSC::AbstractMacroAssembler::linkPointer):
  • assembler/CodeLocation.h: (JSC::CodeLocationCommon::instructionAtOffset): (JSC::CodeLocationCommon::labelAtOffset): (JSC::CodeLocationCommon::jumpAtOffset): (JSC::CodeLocationCommon::callAtOffset): (JSC::CodeLocationCommon::nearCallAtOffset): (JSC::CodeLocationCommon::dataLabelPtrAtOffset): (JSC::CodeLocationCommon::dataLabel32AtOffset): (JSC::CodeLocationCommon::dataLabelCompactAtOffset): (JSC::CodeLocationCommon::convertibleLoadAtOffset):
  • assembler/LinkBuffer.cpp: (JSC::LinkBuffer::finalizeCodeWithDisassembly):
  • assembler/LinkBuffer.h: (JSC::LinkBuffer::link): (JSC::LinkBuffer::patch):
  • assembler/MacroAssemblerCodeRef.cpp: (JSC::MacroAssemblerCodePtr::initialize):
  • assembler/MacroAssemblerCodeRef.h: (JSC::FunctionPtr::FunctionPtr): (JSC::FunctionPtr::value const): (JSC::FunctionPtr::executableAddress const): (JSC::ReturnAddressPtr::ReturnAddressPtr): (JSC::ReturnAddressPtr::value const): (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr): (JSC::MacroAssemblerCodePtr::createFromExecutableAddress): (JSC::MacroAssemblerCodePtr::scrambledPtr const): (JSC::MacroAssemblerCodePtr:: const): (JSC::MacroAssemblerCodePtr::operator! const): (JSC::MacroAssemblerCodePtr::operator bool const): (JSC::MacroAssemblerCodePtr::operator== const): (JSC::MacroAssemblerCodePtr::hash const): (JSC::MacroAssemblerCodePtr::emptyValue): (JSC::MacroAssemblerCodePtr::deletedValue): (JSC::MacroAssemblerCodePtr::executableAddress const): Deleted. (JSC::MacroAssemblerCodePtr::dataLocation const): Deleted.
  • b3/B3LowerMacros.cpp:
  • b3/testb3.cpp: (JSC::B3::testInterpreter):
  • dfg/DFGDisassembler.cpp: (JSC::DFG::Disassembler::dumpDisassembly):
  • dfg/DFGJITCompiler.cpp: (JSC::DFG::JITCompiler::link): (JSC::DFG::JITCompiler::compileFunction):
  • dfg/DFGOperations.cpp:
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::emitSwitchIntJump): (JSC::DFG::SpeculativeJIT::emitSwitchImm): (JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump): (JSC::DFG::SpeculativeJIT::emitSwitchChar):
  • dfg/DFGSpeculativeJIT.h:
  • disassembler/Disassembler.cpp: (JSC::disassemble):
  • disassembler/UDis86Disassembler.cpp: (JSC::tryToDisassembleWithUDis86):
  • ftl/FTLCompile.cpp: (JSC::FTL::compile):
  • ftl/FTLJITCode.cpp: (JSC::FTL::JITCode::executableAddressAtOffset):
  • ftl/FTLLink.cpp: (JSC::FTL::link):
  • ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileMathIC): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct): (JSC::FTL::DFG::LowerDFGToB3::compileTailCall): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread): (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
  • interpreter/InterpreterInlines.h: (JSC::Interpreter::getOpcodeID):
  • jit/JITArithmetic.cpp: (JSC::JIT::emitMathICFast): (JSC::JIT::emitMathICSlow):
  • jit/JITCode.cpp: (JSC::JITCodeWithCodeRef::executableAddressAtOffset): (JSC::JITCodeWithCodeRef::dataAddressAtOffset): (JSC::JITCodeWithCodeRef::offsetOf):
  • jit/JITDisassembler.cpp: (JSC::JITDisassembler::dumpDisassembly):
  • jit/PCToCodeOriginMap.cpp: (JSC::PCToCodeOriginMap::PCToCodeOriginMap):
  • jit/Repatch.cpp: (JSC::ftlThunkAwareRepatchCall):
  • jit/ThunkGenerators.cpp: (JSC::virtualThunkFor): (JSC::boundThisNoArgsFunctionCallGenerator):
  • llint/LLIntSlowPaths.cpp: (JSC::LLInt::llint_trace_operand): (JSC::LLInt::llint_trace_value): (JSC::LLInt::handleHostCall): (JSC::LLInt::setUpCall):
  • llint/LowLevelInterpreter64.asm:
  • offlineasm/cloop.rb:
  • runtime/InitializeThreading.cpp: (JSC::initializeThreading):
  • wasm/WasmBBQPlan.cpp: (JSC::Wasm::BBQPlan::complete):
  • wasm/WasmCallee.h: (JSC::Wasm::Callee::entrypoint const):
  • wasm/WasmCodeBlock.cpp: (JSC::Wasm::CodeBlock::CodeBlock):
  • wasm/WasmOMGPlan.cpp: (JSC::Wasm::OMGPlan::work):
  • wasm/js/WasmToJS.cpp: (JSC::Wasm::wasmToJS):
  • wasm/js/WebAssemblyFunction.cpp: (JSC::callWebAssemblyFunction):
  • wasm/js/WebAssemblyFunction.h:
  • wasm/js/WebAssemblyWrapperFunction.cpp: (JSC::WebAssemblyWrapperFunction::create):

2017-12-01 Mark Lam <​mark.lam@apple.com>

Let's scramble ClassInfo pointers in cells.
​https://bugs.webkit.org/show_bug.cgi?id=180291
<rdar://problem/35807620>

Reviewed by JF Bastien.

  • API/JSCallbackObject.h:
  • API/JSObjectRef.cpp: (classInfoPrivate):
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • Sources.txt:
  • assembler/MacroAssemblerCodeRef.cpp: (JSC::MacroAssemblerCodePtr::initialize): Deleted.
  • assembler/MacroAssemblerCodeRef.h: (JSC::MacroAssemblerCodePtr:: const): (JSC::MacroAssemblerCodePtr::hash const):
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::checkArray): (JSC::DFG::SpeculativeJIT::compileCheckSubClass): (JSC::DFG::SpeculativeJIT::compileNewStringObject):
  • ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject): (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
  • jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitAllocateDestructibleObject):
  • jit/SpecializedThunkJIT.h: (JSC::SpecializedThunkJIT::loadArgumentWithSpecificClass):
  • runtime/InitializeThreading.cpp: (JSC::initializeThreading):
  • runtime/JSCScrambledPtr.cpp: Added. (JSC::initializeScrambledPtrKeys):
  • runtime/JSCScrambledPtr.h: Added.
  • runtime/JSDestructibleObject.h: (JSC::JSDestructibleObject::classInfo const):
  • runtime/JSSegmentedVariableObject.h: (JSC::JSSegmentedVariableObject::classInfo const):
  • runtime/Structure.h:
  • runtime/VM.h:

2017-12-07 Mark Lam <​mark.lam@apple.com>

[Re-landing r225620] Refactoring: Rename ScrambledPtr to Poisoned.
​https://bugs.webkit.org/show_bug.cgi?id=180514

Reviewed by Saam Barati and JF Bastien.

Re-landing r225620 with speculative build fix for GCC 7.

  • API/JSCallbackObject.h:
  • API/JSObjectRef.cpp: (classInfoPrivate):
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • Sources.txt:
  • assembler/MacroAssemblerCodeRef.h: (JSC::FunctionPtr::FunctionPtr): (JSC::FunctionPtr::value const): (JSC::FunctionPtr::executableAddress const): (JSC::ReturnAddressPtr::ReturnAddressPtr): (JSC::ReturnAddressPtr::value const): (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr): (JSC::MacroAssemblerCodePtr::createFromExecutableAddress): (JSC::MacroAssemblerCodePtr::poisonedPtr const): (JSC::MacroAssemblerCodePtr:: const): (JSC::MacroAssemblerCodePtr::operator! const): (JSC::MacroAssemblerCodePtr::operator== const): (JSC::MacroAssemblerCodePtr::emptyValue): (JSC::MacroAssemblerCodePtr::deletedValue): (JSC::MacroAssemblerCodePtr::scrambledPtr const): Deleted.
  • b3/B3LowerMacros.cpp:
  • b3/testb3.cpp: (JSC::B3::testInterpreter):
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::checkArray): (JSC::DFG::SpeculativeJIT::compileCheckSubClass): (JSC::DFG::SpeculativeJIT::compileNewStringObject): (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
  • ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject): (JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
  • jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitAllocateDestructibleObject):
  • jit/SpecializedThunkJIT.h: (JSC::SpecializedThunkJIT::loadArgumentWithSpecificClass):
  • jit/ThunkGenerators.cpp: (JSC::virtualThunkFor): (JSC::boundThisNoArgsFunctionCallGenerator):
  • llint/LLIntSlowPaths.cpp: (JSC::LLInt::handleHostCall): (JSC::LLInt::setUpCall):
  • llint/LowLevelInterpreter64.asm:
  • runtime/InitializeThreading.cpp: (JSC::initializeThreading):
  • runtime/JSCPoisonedPtr.cpp: Copied from Source/JavaScriptCore/runtime/JSCScrambledPtr.cpp. (JSC::initializePoison): (JSC::initializeScrambledPtrKeys): Deleted.
  • runtime/JSCPoisonedPtr.h: Copied from Source/JavaScriptCore/runtime/JSCScrambledPtr.h.
  • runtime/JSCScrambledPtr.cpp: Removed.
  • runtime/JSCScrambledPtr.h: Removed.
  • runtime/JSDestructibleObject.h: (JSC::JSDestructibleObject::classInfo const):
  • runtime/JSSegmentedVariableObject.h: (JSC::JSSegmentedVariableObject::classInfo const):
  • runtime/Structure.h:
  • runtime/VM.h:

2017-12-07 Mark Lam <​mark.lam@apple.com>

Apply poisoning to some native code pointers.
​https://bugs.webkit.org/show_bug.cgi?id=180541
<rdar://problem/35916875>

Reviewed by Filip Pizlo.

Renamed g_classInfoPoison to g_globalDataPoison.
Renamed g_masmPoison to g_jitCodePoison.
Introduced g_nativeCodePoison.
Applied g_nativeCodePoison to poisoning some native code pointers.

Introduced non-random Int32 poison values (in JSCPoison.h) for use with pointers
to malloc allocated data structures (where needed).

  • API/JSCallbackFunction.h: (JSC::JSCallbackFunction::functionCallback):
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • jit/ThunkGenerators.cpp: (JSC::nativeForGenerator):
  • llint/LowLevelInterpreter64.asm:
  • runtime/CustomGetterSetter.h: (JSC::CustomGetterSetter::getter const): (JSC::CustomGetterSetter::setter const):
  • runtime/InternalFunction.cpp: (JSC::InternalFunction::getCallData): (JSC::InternalFunction::getConstructData):
  • runtime/InternalFunction.h: (JSC::InternalFunction::nativeFunctionFor):
  • runtime/JSCPoison.h: Added.
  • runtime/JSCPoisonedPtr.cpp: (JSC::initializePoison):
  • runtime/JSCPoisonedPtr.h:
  • runtime/Lookup.h:
  • runtime/NativeExecutable.cpp: (JSC::NativeExecutable::hashFor const):
  • runtime/NativeExecutable.h:
  • runtime/Structure.cpp: (JSC::StructureTransitionTable::setSingleTransition):
  • runtime/StructureTransitionTable.h: (JSC::StructureTransitionTable::StructureTransitionTable): (JSC::StructureTransitionTable::isUsingSingleSlot const): (JSC::StructureTransitionTable::map const): (JSC::StructureTransitionTable::weakImpl const): (JSC::StructureTransitionTable::setMap):

2017-12-08 Mark Lam <​mark.lam@apple.com>

Need to unpoison native function pointers for CLoop.
​https://bugs.webkit.org/show_bug.cgi?id=180601
<rdar://problem/35942028>

Reviewed by JF Bastien.

  • llint/LowLevelInterpreter64.asm:

2017-12-13 Mark Lam <​mark.lam@apple.com>

Fill out some Poisoned APIs, fix some bugs, and add some tests.
​https://bugs.webkit.org/show_bug.cgi?id=180724
<rdar://problem/36006884>

Reviewed by JF Bastien.

  • runtime/StructureTransitionTable.h:

2017-12-18 Jason Marcell <​jmarcell@apple.com>

Apply patch. rdar://problem/36113365

Cherry-pick r225363, r225437, r225632, r225659, r225697, r225857. rdar://problem/36085975

2017-11-30 Mark Lam <​mark.lam@apple.com>

Let's scramble MacroAssemblerCodePtr values.
​https://bugs.webkit.org/show_bug.cgi?id=180169
<rdar://problem/35758340>

Reviewed by Filip Pizlo, Saam Barati, and JF Bastien.

Introduce a ScrambledPtr class to facilitate scrambling.

  • WTF.xcodeproj/project.pbxproj:
  • wtf/CMakeLists.txt:
  • wtf/ScrambledPtr.cpp: Added. (WTF::makeScrambledPtrKey):
  • wtf/ScrambledPtr.h: Added. (WTF::ScrambledPtr::ScrambledPtr): (WTF::ScrambledPtr::paranoidAssertIsScrambled const): (WTF::ScrambledPtr::paranoidAssertIsNotScrambled const): (WTF::ScrambledPtr:: const): (WTF::ScrambledPtr::operator-> const): (WTF::ScrambledPtr::scrambledBits const): (WTF::ScrambledPtr::operator! const): (WTF::ScrambledPtr::operator bool const): (WTF::ScrambledPtr::operator== const): (WTF::ScrambledPtr::operator==): (WTF::ScrambledPtr::scramble): (WTF::ScrambledPtr::descramble):

2017-12-01 Mark Lam <​mark.lam@apple.com>

Let's scramble ClassInfo pointers in cells.
​https://bugs.webkit.org/show_bug.cgi?id=180291
<rdar://problem/35807620>

Reviewed by JF Bastien.

  • wtf/ScrambledPtr.h: (WTF::ScrambledPtr::descrambled const): (WTF::ScrambledPtr::bits const): (WTF::ScrambledPtr::operator==): (WTF::ScrambledPtr::operator=): (WTF::ScrambledPtr::scramble): (WTF::ScrambledPtr::descramble): (WTF::ScrambledPtr:: const): Deleted. (WTF::ScrambledPtr::scrambledBits const): Deleted.

2017-12-07 Mark Lam <​mark.lam@apple.com>

[Re-landing r225620] Refactoring: Rename ScrambledPtr to Poisoned.
​https://bugs.webkit.org/show_bug.cgi?id=180514

Reviewed by Saam Barati and JF Bastien.

Re-landing r225620 with speculative build fix for GCC 7.

  • WTF.xcodeproj/project.pbxproj:
  • wtf/CMakeLists.txt:
  • wtf/Poisoned.cpp: Copied from Source/WTF/wtf/ScrambledPtr.cpp. (WTF::makePoison): (WTF::makeScrambledPtrKey): Deleted.
  • wtf/Poisoned.h: Copied from Source/WTF/wtf/ScrambledPtr.h. (WTF::PoisonedImpl::PoisonedImpl): (WTF::PoisonedImpl::assertIsPoisoned const): (WTF::PoisonedImpl::assertIsNotPoisoned const): (WTF::PoisonedImpl::unpoisoned const): (WTF::PoisonedImpl::operator-> const): (WTF::PoisonedImpl::bits const): (WTF::PoisonedImpl::operator! const): (WTF::PoisonedImpl::operator bool const): (WTF::PoisonedImpl::operator== const): (WTF::PoisonedImpl::operator==): (WTF::PoisonedImpl::operator=): (WTF::PoisonedImpl::poison): (WTF::PoisonedImpl::unpoison): (WTF::ScrambledPtr::ScrambledPtr): Deleted. (WTF::ScrambledPtr::assertIsScrambled const): Deleted. (WTF::ScrambledPtr::assertIsNotScrambled const): Deleted. (WTF::ScrambledPtr::descrambled const): Deleted. (WTF::ScrambledPtr::operator-> const): Deleted. (WTF::ScrambledPtr::bits const): Deleted. (WTF::ScrambledPtr::operator! const): Deleted. (WTF::ScrambledPtr::operator bool const): Deleted. (WTF::ScrambledPtr::operator== const): Deleted. (WTF::ScrambledPtr::operator==): Deleted. (WTF::ScrambledPtr::operator=): Deleted. (WTF::ScrambledPtr::scramble): Deleted. (WTF::ScrambledPtr::descramble): Deleted.
  • wtf/ScrambledPtr.cpp: Removed.
  • wtf/ScrambledPtr.h: Removed.

2017-12-07 Mark Lam <​mark.lam@apple.com>

Apply poisoning to some native code pointers.
​https://bugs.webkit.org/show_bug.cgi?id=180541
<rdar://problem/35916875>

Reviewed by Filip Pizlo.

Ensure that the resultant poisoned bits still looks like a pointer in that its
bottom bits are 0, just like the alignment bits of a pointer. This allows the
client to use the bottom bits of the poisoned bits as flag bits just like the
client was previously able to do with pointer values.

Note: we only ensure that the bottom alignment bits of the generated poison
value is 0. We're not masking out the poisoned bits. This means that the bottom
bits of the poisoned bits will only be null if the original pointer is aligned.
Hence, if the client applies the poison to an unaligned pointer, we do not lose
any information on the low bits.

Also removed 2 wrong assertions in PoisonedImpl's constructors. We were
asserting that Poisoned will never be used with a null value, but that's invalid.
We do want to allow a null value so that we don't have to constantly do null
checks in the clients. This was uncovered by some layout tests.

  • wtf/Poisoned.cpp: (WTF::makePoison):
  • wtf/Poisoned.h: (WTF::PoisonedImpl::PoisonedImpl):

2017-12-13 Mark Lam <​mark.lam@apple.com>

Fill out some Poisoned APIs, fix some bugs, and add some tests.
​https://bugs.webkit.org/show_bug.cgi?id=180724
<rdar://problem/36006884>

Reviewed by JF Bastien.

Also rename Int32Poisoned to ConstExprPoisoned. The key it takes is actually a
uint32_t. So, Int32 is really a misnomer. In addition, the key needs to be a
constexpr. So, ConstExprPoisoned is a better name for it.

  • wtf/Poisoned.cpp: (WTF::makePoison):
  • wtf/Poisoned.h: (WTF::PoisonedImplHelper::asReference): (WTF::PoisonedImpl::PoisonedImpl): (WTF::PoisonedImpl::clear): (WTF::PoisonedImpl::operator* const): (WTF::PoisonedImpl::operator-> const): (WTF::PoisonedImpl::operator== const): (WTF::PoisonedImpl::operator!= const): (WTF::PoisonedImpl::operator< const): (WTF::PoisonedImpl::operator<= const): (WTF::PoisonedImpl::operator> const): (WTF::PoisonedImpl::operator>= const): (WTF::PoisonedImpl::operator=): (WTF::PoisonedImpl::swap): (WTF::PoisonedImpl::exchange): (WTF::swap): (WTF::makePoison): (WTF::PoisonedImpl::operator==): Deleted.
2:41 PM Changeset in webkit [226546] by jmarcell@apple.com
  • 27 edits in branches/safari-604.4.7.0-branch/Source

Apply patch. rdar://problem/36113365

Use index masking for TypedArrays and and Wasm.
​https://bugs.webkit.org/show_bug.cgi?id=180920

Reviewed by Filip Pizlo.

We should have index masking for our TypedArray code in the
DFG/FTL and for Wasm when doing bounds checking. Index masking for
Wasm is added to the WasmBoundsCheckValue. Since we don't CSE any
WasmBoundsCheckValues we don't need to worry about combining a
bounds check for a load and a store. I went with fusing the
pointer masking in the WasmBoundsCheckValue since it should reduce
additional compiler overhead.

  • b3/B3LowerToAir.cpp:
  • b3/B3Validate.cpp:
  • b3/B3WasmBoundsCheckValue.cpp: (JSC::B3::WasmBoundsCheckValue::WasmBoundsCheckValue): (JSC::B3::WasmBoundsCheckValue::dumpMeta const):
  • b3/B3WasmBoundsCheckValue.h: (JSC::B3::WasmBoundsCheckValue::pinnedIndexingMask const):
  • b3/air/AirCustom.h: (JSC::B3::Air::WasmBoundsCheckCustom::generate):
  • b3/testb3.cpp: (JSC::B3::testWasmBoundsCheck):
  • dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::loadFromIntTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
  • dfg/DFGSpeculativeJIT.h:
  • dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile):
  • ftl/FTLAbstractHeapRepository.h:
  • ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileAtomicsReadModifyWrite): (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal): (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray): (JSC::FTL::DFG::LowerDFGToB3::pointerIntoTypedArray):
  • jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::emitComputeButterflyIndexingMask):
  • runtime/Butterfly.h:
  • runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::JSArrayBufferView):
  • runtime/JSArrayBufferView.h: (JSC::JSArrayBufferView::offsetOfIndexingMask):
  • wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::B3IRGenerator): (JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState): (JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer): (JSC::Wasm::B3IRGenerator::load): (JSC::Wasm::B3IRGenerator::store): (JSC::Wasm::B3IRGenerator::addCallIndirect):
  • wasm/WasmBinding.cpp: (JSC::Wasm::wasmToWasm):
  • wasm/WasmMemory.cpp: (JSC::Wasm::Memory::Memory):
  • wasm/WasmMemory.h: (JSC::Wasm::Memory::offsetOfIndexingMask):
  • wasm/WasmMemoryInformation.cpp: (JSC::Wasm::PinnedRegisterInfo::get): (JSC::Wasm::PinnedRegisterInfo::PinnedRegisterInfo):
  • wasm/WasmMemoryInformation.h: (JSC::Wasm::PinnedRegisterInfo::toSave const):
  • wasm/js/JSToWasm.cpp: (JSC::Wasm::createJSToWasmWrapper):

Use index masking for TypedArrays and and Wasm.
​https://bugs.webkit.org/show_bug.cgi?id=180920

Reviewed by Filip Pizlo.

Copy things from ToT that we will need for a branch.

  • wtf/MathExtras.h: (WTF::computeIndexingMask):
  • wtf/StdLibExtras.h: (std::clz):
2:41 PM Changeset in webkit [226545] by jmarcell@apple.com
  • 5 edits in branches/safari-604.4.7.0-branch

Apply patch. rdar://problem/36113340

Reduce the precision of "high" resolution time to 1ms
​https://bugs.webkit.org/show_bug.cgi?id=180910
<rdar://problem/36085943>

Reviewed by Saam Barati.

Add a flaky test expectation to imported/w3c/web-platform-tests/workers/worker-performance.worker.html
due to a test bug. The test fix is tracked in ​https://github.com/w3c/web-platform-tests/pull/8711

2:41 PM Changeset in webkit [226544] by jmarcell@apple.com
  • 13 edits in branches/safari-604.4.7.0-branch/Source

Cherry-pick r226068. rdar://problem/36113378

2:41 PM Changeset in webkit [226543] by jmarcell@apple.com
  • 3 edits in branches/safari-604.4.7.0-branch/Source/JavaScriptCore

Apply patch. rdar://problem/36113314

Disable/remove SharedArrayBuffers from Web API
rdar://problem/36077849

Removed SharedArrayBuffer prototype and structure to disable.

  • runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init): (JSC::JSGlobalObject::visitChildren):
  • runtime/JSGlobalObject.h: (JSC::JSGlobalObject::arrayBufferPrototype const): (JSC::JSGlobalObject::arrayBufferStructure const):
2:41 PM Changeset in webkit [226542] by wilander@apple.com
  • 8 edits in trunk/Source

Storage Access API: Remove access for all frames under a page when the page is closed
​https://bugs.webkit.org/show_bug.cgi?id=181398
<rdar://problem/36357879>

Reviewed by Alex Christensen.

Source/WebCore:

No new tests. Discussed with Alex Christensen and we concluded that
both a layout test and an API test would require a lot of work and
we have existing tests for clearing out storage access for frames.

  • platform/network/NetworkStorageSession.h:
  • platform/network/cf/NetworkStorageSessionCFNet.cpp:

(WebCore::NetworkStorageSession::removeStorageAccessForAllFramesOnPage):

Source/WebKit:

  • NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::removeStorageAccessForAllFramesOnPage):

  • NetworkProcess/NetworkConnectionToWebProcess.h:
  • NetworkProcess/NetworkConnectionToWebProcess.messages.in:
  • WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::close):

2:35 PM Changeset in webkit [226541] by Matt Lewis
  • 7 edits
    4 deletes in trunk

Unreviewed, rolling out r226385.

The test introduced with this was a flaky since being added.

Reverted changeset:

"AX: when invert colors is on, double-invert certain media
elements in UserAgentStyleSheet"
​https://bugs.webkit.org/show_bug.cgi?id=168447
​https://trac.webkit.org/changeset/226385

2:33 PM Changeset in webkit [226540] by commit-queue@webkit.org
  • 12 edits in trunk/Source

SWClientConnection should not keep references to service worker jobs
​https://bugs.webkit.org/show_bug.cgi?id=181381

Patch by Youenn Fablet <​youenn@apple.com> on 2018-01-08
Reviewed by Chris Dumez.

Source/WebCore:

Difficult to test determiniscally but corresponding crash log should no longer happen in debug builds.

Stopped passing ServiceWorkerJob references from ServiceWorkerContainer (potentially in service worker thread) to SWClientConnection (main thread).
Instead pass job identifiers and related data to the main thread.

Minor refactoring to use ServiceWorkerJobIdentifier instead of ServiceWorkerJobDataIdentifier which contains more data than needed.

  • workers/service/SWClientConnection.cpp:

(WebCore::SWClientConnection::scheduleJob):
(WebCore::SWClientConnection::failedFetchingScript):
(WebCore::SWClientConnection::postTaskForJob):
(WebCore::SWClientConnection::jobRejectedInServer):
(WebCore::SWClientConnection::registrationJobResolvedInServer):
(WebCore::SWClientConnection::unregistrationJobResolvedInServer):
(WebCore::SWClientConnection::startScriptFetchForServer):
(WebCore::SWClientConnection::clearPendingJobs):
(WebCore::SWClientConnection::finishedFetchingScript): Deleted.

  • workers/service/SWClientConnection.h:
  • workers/service/ServiceWorkerContainer.cpp:

(WebCore::ServiceWorkerContainer::scheduleJob):
(WebCore::ServiceWorkerContainer::startScriptFetchForJob):
(WebCore::ServiceWorkerContainer::jobFinishedLoadingScript):
(WebCore::ServiceWorkerContainer::jobFailedLoadingScript):

  • workers/service/ServiceWorkerContainer.h:
  • workers/service/server/SWServer.cpp:

(WebCore::SWServer::rejectJob):
(WebCore::SWServer::resolveRegistrationJob):
(WebCore::SWServer::resolveUnregistrationJob):
(WebCore::SWServer::startScriptFetch):

  • workers/service/server/SWServer.h:

Source/WebKit:

Updated IPC handling based on WebCore refactoring.

  • Scripts/webkit/messages.py:

(forward_declarations_and_headers):
(headers_for_type):

  • StorageProcess/ServiceWorker/WebSWServerConnection.cpp:

(WebKit::WebSWServerConnection::rejectJobInClient):
(WebKit::WebSWServerConnection::resolveRegistrationJobInClient):
(WebKit::WebSWServerConnection::resolveUnregistrationJobInClient):
(WebKit::WebSWServerConnection::startScriptFetchInClient):

  • StorageProcess/ServiceWorker/WebSWServerConnection.h:
  • WebProcess/Storage/WebSWClientConnection.messages.in:
2:19 PM Changeset in webkit [226539] by Wenson Hsieh
  • 8 edits in trunk

Copying, pasting, and then deleting an attachment element breaks attachment data requests
​https://bugs.webkit.org/show_bug.cgi?id=181365
<rdar://problem/36340647>

Reviewed by Tim Horton.

Source/WebCore:

Currently, copying and pasting an attachment element within the same document and then deleting backwards to
remove the pasted attachment element causes the original attachment element to be inaccessible via SPI. This is
because there are now two different attachment elements with the same unique identifier, such that Document,
which keeps a map of all unique attachment identifiers to attachment elements, will lose track of the original
attachment element.

To fix this, we ensure that attachment elements should always have unique identifiers when they are inserted
into the document. We make several small adjustments to accomplish this:

  1. First, refactor HTMLAttachmentElement's unique identifier so that it no longer depends on the value of the

"webkitattachmentid" attribute, and is instead just a member of HTMLAttachmentElement that is not exposed to
DOM bindings. This means setting and querying an attachment element's uniqueIdentifier can be done without
triggering any side effects, such as layout or mutation events.

  1. Next, make "webkitattachmentid" a temporary attribute similar to "webkitattachmentpath" and

"webkitattachmentbloburl", so that it is added only when generating a markup fragment for editing, and
removed upon deserialization.

  1. Lastly, shift the responsibility of assigning a unique identifier to an attachment away from places where we

create attachment elements, and instead have Document enforce this when an attachment element is inserted.

Tests: WKAttachmentTests.InsertAndRemoveDuplicateAttachment

WKAttachmentTests.InsertDuplicateAttachmentAndUpdateData

  • dom/Document.cpp:

(WebCore::Document::didInsertAttachmentElement):

Assign the unique identifier of an attachment element that has been inserted. If the identifier already tracks
an existing attachment element in the document or is missing, reassign the identifier to a new value.

  • editing/cocoa/WebContentReaderCocoa.mm:

(WebCore::createFragmentForImageAttachment):
(WebCore::replaceRichContentWithAttachments):
(WebCore::WebContentReader::readFilePaths):

Remove calls to setUniqueIdentifier here, since Document will assign a unique identifier upon insertion.

  • editing/markup.cpp:

(WebCore::StyledMarkupAccumulator::appendCustomAttributes):
(WebCore::createFragmentFromMarkup):

Set the attachment's unique identifier to the value of the "webkitattachmentid" attribute. When moving existing
attachments around in the DOM without duplication, this ensures that the attachment will be removed and
reinserted in the document without triggering removal and insertion client delegate methods.

When pasting an attachment element that has the same identifier as an existing attachment, we let Document
realize that the attachment identifier already exists, and reassign it to a unique value.

  • html/HTMLAttachmentElement.cpp:

(WebCore::HTMLAttachmentElement::uniqueIdentifier const): Deleted.
(WebCore::HTMLAttachmentElement::setUniqueIdentifier): Deleted.

  • html/HTMLAttachmentElement.h:

Tools:

Adds two new attachment API tests to verify that copying and pasting an existing attachment inserts an
attachment element that may be edited independently of the original attachment. See WebCore/ChangeLog for more
detail.

  • TestWebKitAPI/Tests/WebKitCocoa/WKAttachmentTests.mm:

(TestWebKitAPI::TEST):

2:13 PM Changeset in webkit [226538] by Ryan Haddad
  • 2 edits in trunk/LayoutTests

Skip http/tests/resourceLoadStatistics/clear-in-memory-and-persistent-store.html
​https://bugs.webkit.org/show_bug.cgi?id=181223

Unreviewed test gardening.

  • platform/wk2/TestExpectations:
2:04 PM Changeset in webkit [226537] by Alan Bujtas
  • 7 edits
    2 adds in trunk/Source/WebCore

[RenderTreeBuilder] Move RenderBlockFlow addChild logic to RenderTreeBuilder
​https://bugs.webkit.org/show_bug.cgi?id=181348
<rdar://problem/36328117>

Reviewed by Antti Koivisto.

This is about moving the code, no cleanup and/or normalization (unfortunately it also means
some temporary changes).

No change in functionality.

  • Sources.txt:
  • WebCore.xcodeproj/project.pbxproj:
  • rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::addChild):

  • rendering/updating/RenderTreeBuilder.cpp:

(WebCore::RenderTreeBuilder::RenderTreeBuilder):
(WebCore::RenderTreeBuilder::insertChildToRenderBlockFlow):

  • rendering/updating/RenderTreeBuilder.h:

(WebCore::RenderTreeBuilder::blockFlowBuilder):

  • rendering/updating/RenderTreeBuilderBlockFlow.cpp: Added.

(WebCore::RenderTreeBuilder::BlockFlow::BlockFlow):
(WebCore::RenderTreeBuilder::BlockFlow::insertChild):

  • rendering/updating/RenderTreeBuilderBlockFlow.h: Added.
2:01 PM Changeset in webkit [226536] by commit-queue@webkit.org
  • 3 edits
    4 adds in trunk/Source/WebKit

[Cocoa] Web Inspector: Provide a way for clients to check if an NSWindow is a Web Inspector window
​https://bugs.webkit.org/show_bug.cgi?id=181361
<rdar://problem/36332865>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2018-01-08
Reviewed by Darin Adler.

  • WebKit.xcodeproj/project.pbxproj:

New files.

  • Shared/API/Cocoa/_WKNSWindowExtras.h: Added.
  • Shared/API/Cocoa/_WKNSWindowExtras.mm: Added.

(-[NSWindow _web_isWebInspectorWindow]):
Method to determing if a window is being used for Web Inspector content.

  • UIProcess/mac/WKInspectorWindow.h: Added.
  • UIProcess/mac/WKInspectorWindow.mm: Added.

Named subclass so we can use isKindOfClass.

  • UIProcess/mac/WebInspectorProxyMac.mm:

(WebKit::WebInspectorProxy::createFrontendWindow):
Use the named subclass.

1:54 PM Changeset in webkit [226535] by Ryan Haddad
  • 2 edits in trunk/JSTests

Disable SharedArrayBuffer tests missed in r226386.
​https://bugs.webkit.org/show_bug.cgi?id=181266

Unreviewed test gardening.

  • test262.yaml:
1:53 PM Changeset in webkit [226534] by Matt Lewis
  • 2 edits in trunk/LayoutTests

Marked http/wpt/cache-storage/cache-put-stream.https.any.html as flaky on macOS WK2.
​https://bugs.webkit.org/show_bug.cgi?id=181107

Unreviewed test gardening.

  • platform/mac-wk2/TestExpectations:
1:48 PM Changeset in webkit [226533] by timothy_horton@apple.com
  • 2 edits in trunk/Source/WebKit

Build fix for WKPDFView
​https://bugs.webkit.org/show_bug.cgi?id=181399
<rdar://problem/36311915>

Reviewed by Simon Fraser.

  • UIProcess/ios/WKPDFView.mm:

Disable deprecation warnings in this whole file.

1:19 PM Changeset in webkit [226532] by commit-queue@webkit.org
  • 25 edits in trunk

Add CSP support to service workers
​https://bugs.webkit.org/show_bug.cgi?id=181385

Patch by Youenn Fablet <​youenn@apple.com> on 2018-01-08
Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

  • web-platform-tests/service-workers/service-worker/service-worker-csp-connect.https-expected.txt:
  • web-platform-tests/service-workers/service-worker/service-worker-csp-default.https-expected.txt:
  • web-platform-tests/service-workers/service-worker/service-worker-csp-script.https-expected.txt:

Source/WebCore:

Covered by rebased tests.

Added recovery of CSP information from WorkerScriptLoader.
Added plumbing to pass the CSP information to Service Workers.
Added persistency support for the CSP information.

  • workers/WorkerScriptLoader.cpp:

(WebCore::WorkerScriptLoader::loadAsynchronously):
(WebCore::WorkerScriptLoader::didReceiveResponse):

  • workers/WorkerScriptLoader.h:

(WebCore::WorkerScriptLoader::contentSecurityPolicy const):

  • workers/service/SWClientConnection.cpp:

(WebCore::SWClientConnection::finishedFetchingScript):
(WebCore::SWClientConnection::failedFetchingScript):

  • workers/service/SWClientConnection.h:
  • workers/service/ServiceWorkerContainer.cpp:

(WebCore::ServiceWorkerContainer::addRegistration):
(WebCore::ServiceWorkerContainer::jobFailedWithException):
(WebCore::ServiceWorkerContainer::jobResolvedWithRegistration):
(WebCore::ServiceWorkerContainer::jobFinishedLoadingScript):

  • workers/service/ServiceWorkerContainer.h:
  • workers/service/ServiceWorkerContextData.cpp:

(WebCore::ServiceWorkerContextData::isolatedCopy const):

  • workers/service/ServiceWorkerContextData.h:

(WebCore::ServiceWorkerContextData::encode const):
(WebCore::ServiceWorkerContextData::decode):

  • workers/service/ServiceWorkerFetchResult.h:

(WebCore::ServiceWorkerFetchResult::encode const):
(WebCore::ServiceWorkerFetchResult::decode):

  • workers/service/ServiceWorkerGlobalScope.cpp:

(WebCore::ServiceWorkerGlobalScope::create):

  • workers/service/ServiceWorkerGlobalScope.h:
  • workers/service/ServiceWorkerJob.cpp:

(WebCore::ServiceWorkerJob::notifyFinished):

  • workers/service/ServiceWorkerJobClient.h:
  • workers/service/context/ServiceWorkerThread.cpp:

(WebCore::ServiceWorkerThread::ServiceWorkerThread):
(WebCore::ServiceWorkerThread::createWorkerGlobalScope):

  • workers/service/server/RegistrationDatabase.cpp:

(WebCore::v1RecordsTableSchema):
(WebCore::RegistrationDatabase::openSQLiteDatabase):
(WebCore::RegistrationDatabase::doPushChanges):
(WebCore::RegistrationDatabase::importRecords):

  • workers/service/server/SWServer.cpp:

(WebCore::SWServer::updateWorker):
(WebCore::SWServer::installContextData):

  • workers/service/server/SWServer.h:
  • workers/service/server/SWServerJobQueue.cpp:

(WebCore::SWServerJobQueue::scriptFetchFinished):

  • workers/service/server/SWServerWorker.cpp:

(WebCore::SWServerWorker::SWServerWorker):
(WebCore::m_contentSecurityPolicy):
(WebCore::SWServerWorker::contextData const):

  • workers/service/server/SWServerWorker.h:
1:06 PM Changeset in webkit [226531] by commit-queue@webkit.org
  • 6 edits in trunk

Use no-cache fetch mode when loading main documents with location.reload()
​https://bugs.webkit.org/show_bug.cgi?id=181285

Patch by Youenn Fablet <​youenn@apple.com> on 2018-01-08
Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

  • web-platform-tests/service-workers/service-worker/fetch-event.https-expected.txt:

Source/WebCore:

Covered by rebased tests.

Start to translate cache policy used for navigation as FetchOptions::Cache.
This allows ensuring service workers receive the right cache mode when intercepting navigation loads.
To not change current navigation behavior, ReturnCacheDataElseLoad and ReturnCacheDataDontLoad still trigger default fetch cache mode.

For Reload and ReloadExpiredOnly frame load types, using no-cache mode is more efficient than reload mode,
as a conditional request will be sent if possible. This applies to location.reload which is consistent with other browsers.
Keep reload mode for ReloadFromOrigin.

  • loader/DocumentLoader.cpp:

(WebCore::toFetchOptionsCache):
(WebCore::DocumentLoader::loadMainResource):

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadFrameRequest):
(WebCore::FrameLoader::loadURL):
(WebCore::FrameLoader::load):
(WebCore::FrameLoader::reload):
(WebCore::FrameLoader::defaultRequestCachingPolicy):
(WebCore::FrameLoader::loadDifferentDocumentItem):

  • loader/NavigationScheduler.cpp:
1:05 PM Changeset in webkit [226530] by mark.lam@apple.com
  • 26 edits in trunk/Source

Apply poisoning to more pointers in JSC.
​https://bugs.webkit.org/show_bug.cgi?id=181096
<rdar://problem/36182970>

Reviewed by JF Bastien.

Source/JavaScriptCore:

  • assembler/MacroAssembler.h:

(JSC::MacroAssembler::xorPtr):

  • assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::xor64):

  • assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::xor64):

  • Add xorPtr implementation.
  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::inferredName const):
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::~CodeBlock):
(JSC::CodeBlock::setConstantRegisters):
(JSC::CodeBlock::visitWeakly):
(JSC::CodeBlock::visitChildren):
(JSC::CodeBlock::propagateTransitions):
(JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences):
(JSC::CodeBlock::finalizeLLIntInlineCaches):
(JSC::CodeBlock::finalizeBaselineJITInlineCaches):
(JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally):
(JSC::CodeBlock::jettison):
(JSC::CodeBlock::predictedMachineCodeSize):
(JSC::CodeBlock::findPC):

  • bytecode/CodeBlock.h:

(JSC::CodeBlock::UnconditionalFinalizer::UnconditionalFinalizer):
(JSC::CodeBlock::WeakReferenceHarvester::WeakReferenceHarvester):
(JSC::CodeBlock::stubInfoBegin):
(JSC::CodeBlock::stubInfoEnd):
(JSC::CodeBlock::callLinkInfosBegin):
(JSC::CodeBlock::callLinkInfosEnd):
(JSC::CodeBlock::instructions):
(JSC::CodeBlock::instructions const):
(JSC::CodeBlock::vm const):

  • dfg/DFGOSRExitCompilerCommon.h:

(JSC::DFG::adjustFrameAndStackInOSRExitCompilerThunk):

  • jit/JIT.h:
  • llint/LLIntOfflineAsmConfig.h:
  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter64.asm:
  • parser/UnlinkedSourceCode.h:
  • runtime/JSCPoison.h:
  • runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

  • runtime/JSGlobalObject.h:
  • runtime/JSScriptFetchParameters.h:
  • runtime/JSScriptFetcher.h:
  • runtime/StructureTransitionTable.h:
  • wasm/js/JSWebAssemblyCodeBlock.cpp:

(JSC::JSWebAssemblyCodeBlock::JSWebAssemblyCodeBlock):
(JSC::JSWebAssemblyCodeBlock::visitChildren):
(JSC::JSWebAssemblyCodeBlock::UnconditionalFinalizer::finalizeUnconditionally):

  • wasm/js/JSWebAssemblyCodeBlock.h:

Source/WTF:

Added support for PoisonedBag and PoisonedRefCountedArray.

  • wtf/Bag.h:

(WTF::Private::BagNode::BagNode):
(WTF::Bag::Bag):
(WTF::Bag::operator=):
(WTF::Bag::clear):
(WTF::Bag::add):
(WTF::Bag::begin):
(WTF::Bag::unwrappedHead):
(WTF::Bag::Node::Node): Deleted.

  • wtf/BagToHashMap.h:

(WTF::toHashMap):

  • wtf/Poisoned.h:

(WTF::constExprPoisonRandom):
(WTF::makeConstExprPoison):

  • wtf/RefCountedArray.h:

(WTF::RefCountedArray::RefCountedArray):
(WTF::RefCountedArray::clone const):
(WTF::RefCountedArray::operator=):
(WTF::RefCountedArray::~RefCountedArray):
(WTF::RefCountedArray::refCount const):
(WTF::RefCountedArray::size const):
(WTF::RefCountedArray::data):
(WTF::RefCountedArray::begin):
(WTF::RefCountedArray::end):
(WTF::RefCountedArray::data const):
(WTF::RefCountedArray::begin const):
(WTF::RefCountedArray::operator== const):
(WTF::RefCountedArray::Header::fromPayload):

  • wtf/WTFAssertions.cpp:
1:02 PM Changeset in webkit [226529] by ddkilzer@apple.com
  • 2 edits in trunk/Source/WebKitLegacy/mac

Fix check-webkit-style issues with WebNSDataExtras.mm
<​https://webkit.org/b/181369>

Reviewed by Alex Christensen.

  • Misc/WebNSDataExtras.mm:

(-[NSString _web_capitalizeRFC822HeaderFieldName]):
(-[NSData _webkit_guessedMIMETypeForXML]):
(-[NSData _webkit_guessedMIMEType]):
(-[NSData _web_isCaseInsensitiveEqualToCString:]):
(_findEOL):
(-[NSData _webkit_parseRFC822HeaderFields]):
(-[NSData _web_locationAfterFirstBlankLine]):

  • Fix all the check-webkit-style warnings.
12:47 PM Changeset in webkit [226528] by commit-queue@webkit.org
  • 2 edits in trunk/Source/WebKit

Caches::writeCachesToDisk should assert that it is initialized
​https://bugs.webkit.org/show_bug.cgi?id=181383

Patch by Youenn Fablet <​youenn@apple.com> on 2018-01-08
Reviewed by Alex Christensen.

Add assertion to ensure caches is initialized

  • NetworkProcess/cache/CacheStorageEngineCaches.cpp:

(WebKit::CacheStorage::Caches::writeCachesToDisk):

12:45 PM Changeset in webkit [226527] by commit-queue@webkit.org
  • 1 edit
    2 adds in trunk/LayoutTests

[WinCairo] Add default port TestExpectations for wincairo
​https://bugs.webkit.org/show_bug.cgi?id=179221

Patch by Basuke Suzuki <Basuke Suzuki> on 2018-01-08
Reviewed by Alex Christensen.

  • platform/wincairo-win10/TestExpectations: Added.
10:58 AM Changeset in webkit [226526] by commit-queue@webkit.org
  • 14 edits
    2 adds in trunk

Stop exposing fetch and extendable events to window
​https://bugs.webkit.org/show_bug.cgi?id=181325

Patch by Youenn Fablet <​youenn@apple.com> on 2018-01-08
Reviewed by Chris Dumez.

Source/WebCore:

Covered by updated tests.

Marked FetchEvent and ExtendableEvent as visible in ServiceWorker environments only.
Moved related Internals testing routines to ServiceWorkerInternals.

  • testing/Internals.cpp:

(WebCore::Internals::waitForFetchEventToFinish): Deleted.
(WebCore::Internals::createBeingDispatchedFetchEvent): Deleted.

  • testing/Internals.h:
  • testing/Internals.idl:
  • testing/ServiceWorkerInternals.cpp:

(WebCore::ServiceWorkerInternals::waitForFetchEventToFinish):
(WebCore::ServiceWorkerInternals::createBeingDispatchedFetchEvent):

  • testing/ServiceWorkerInternals.h:
  • testing/ServiceWorkerInternals.idl:
  • workers/service/ExtendableEvent.idl:
  • workers/service/FetchEvent.idl:

LayoutTests:

  • http/wpt/service-workers/extendableEvent.https-expected.txt:
  • http/wpt/service-workers/extendableEvent.https.html:
  • http/wpt/service-workers/fetchEvent.https-expected.txt:
  • http/wpt/service-workers/fetchEvent.https.html:
10:55 AM Changeset in webkit [226525] by jmarcell@apple.com
  • 5 edits in tags/Safari-605.1.19.1

Cherry-pick r226495. rdar://problem/36085943

10:55 AM Changeset in webkit [226524] by jmarcell@apple.com
  • 24 edits in tags/Safari-605.1.19.1/Source

Cherry-pick r226461. rdar://problem/36085949

10:55 AM Changeset in webkit [226523] by jmarcell@apple.com
  • 20 edits in tags/Safari-605.1.19.1

Cherry-pick r226386. rdar://problem/36077849

10:54 AM Changeset in webkit [226522] by jmarcell@apple.com
  • 4 edits in tags/Safari-605.1.19.1

Cherry-pick r226371. rdar://problem/36146670

10:47 AM Changeset in webkit [226521] by Antti Koivisto
  • 5 edits
    2 adds in trunk

REGRESSION (r219145): Toggling layer borders on a static document no longer works immediately
​https://bugs.webkit.org/show_bug.cgi?id=176260
<rdar://problem/34219966>

Reviewed by Simon Fraser.

Source/WebCore:

Optimization reveled bugs in debug indicator painting.

Test: compositing/debug-borders-dynamic.html

  • platform/graphics/ca/GraphicsLayerCA.cpp:

(WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):
(WebCore::GraphicsLayerCA::updateDebugIndicators):
(WebCore::GraphicsLayerCA::updateDebugBorder): Deleted.

  • Rename to indicate this is not just about debug borders.
  • Trigger display so repaint counters get painted. This helper is only called when the indicators change.
  • platform/graphics/ca/GraphicsLayerCA.h:
  • rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::cacheAcceleratedCompositingFlags):

Ensure we do compositing update on debug border change even when there is no layout.

LayoutTests:

  • compositing/debug-borders-dynamic-expected.html: Added.
  • compositing/debug-borders-dynamic.html: Added.
10:38 AM Changeset in webkit [226520] by Alan Bujtas
  • 8 edits
    1 copy
    1 add in trunk/Source/WebCore

[RenderTreeBuilder] Move RenderInline addChild logic to RenderTreeBuilder
​https://bugs.webkit.org/show_bug.cgi?id=181336
<rdar://problem/36324693>

Reviewed by Antti Koivisto.

This is about moving the code, no cleanup and/or normalization (unfortunately it also means
some temporary changes).

No change in functionality.

  • Sources.txt:
  • WebCore.xcodeproj/project.pbxproj:
  • rendering/RenderInline.cpp:

(WebCore::RenderInline::addChild):
(WebCore::RenderInline::addChildIgnoringContinuation):
(WebCore::RenderInline::childBecameNonInline):
(WebCore::nextContinuation): Deleted.
(WebCore::RenderInline::continuationBefore): Deleted.
(WebCore::newChildIsInline): Deleted.
(WebCore::RenderInline::cloneAsContinuation const): Deleted.
(WebCore::RenderInline::splitInlines): Deleted.
(WebCore::RenderInline::splitFlow): Deleted.
(WebCore::canUseAsParentForContinuation): Deleted.
(WebCore::RenderInline::addChildToContinuation): Deleted.

  • rendering/RenderInline.h:
  • rendering/updating/RenderTreeBuilder.cpp:

(WebCore::RenderTreeBuilder::RenderTreeBuilder):
(WebCore::RenderTreeBuilder::insertChildToRenderInline):
(WebCore::RenderTreeBuilder::insertChildToRenderInlineIgnoringContinuation):
(WebCore::RenderTreeBuilder::splitFlow):

  • rendering/updating/RenderTreeBuilder.h:

(WebCore::RenderTreeBuilder::inlineBuilder):

  • rendering/updating/RenderTreeBuilderInline.cpp: Added.

(WebCore::canUseAsParentForContinuation):
(WebCore::nextContinuation):
(WebCore::continuationBefore):
(WebCore::cloneAsContinuation):
(WebCore::newChildIsInline):
(WebCore::inFlowPositionedInlineAncestor):
(WebCore::RenderTreeBuilder::Inline::Inline):
(WebCore::RenderTreeBuilder::Inline::insertChild):
(WebCore::RenderTreeBuilder::Inline::insertChildToContinuation):
(WebCore::RenderTreeBuilder::Inline::insertChildIgnoringContinuation):
(WebCore::RenderTreeBuilder::Inline::splitFlow):
(WebCore::RenderTreeBuilder::Inline::splitInlines):

  • rendering/updating/RenderTreeBuilderInline.h: Added.
10:37 AM Changeset in webkit [226519] by commit-queue@webkit.org
  • 2 edits in trunk/Source/WebKit

WebProcessPool::terminateServiceWorkerProcess should protect itself in debug builds
​https://bugs.webkit.org/show_bug.cgi?id=181384

Patch by Youenn Fablet <​youenn@apple.com> on 2018-01-08
Reviewed by Chris Dumez.

  • UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::terminateServiceWorkerProcess):

10:33 AM Changeset in webkit [226518] by commit-queue@webkit.org
  • 3 edits
    11 adds in trunk/LayoutTests

[EME] Add layout test for InitData and InitDataType in CENC encrypted event
​https://bugs.webkit.org/show_bug.cgi?id=180430

Patch by Yacine Bandou <​yacine.bandou_ext@softathome.com> on 2018-01-08
Reviewed by Xabier Rodriguez-Calvar.

This is a simple encrypted video file used for regular playback.
It has been encrypted with BENTO4. ​https://www.bento4.com/

  • media/content/encrypted/segments/VideoClearKeyCenc-seg-0.mp4: Added.

This is a simple encrypted video fragment used in MSE playback.
It has been fragmented and encrypted with BENTO4. ​https://www.bento4.com/

  • media/encrypted-media/clearKey/clearKey-encrypted-cenc-event-expected.txt: Added.
  • media/encrypted-media/clearKey/clearKey-encrypted-cenc-event-mse-expected.txt: Added.
  • media/encrypted-media/clearKey/clearKey-encrypted-cenc-event-mse.html: Added.

This is a test with MSE.

  • media/encrypted-media/clearKey/clearKey-encrypted-cenc-event.html: Added.

This is a test with a regular playback.

  • media/encrypted-media/medias-enc.js: Added.

This JavaScrit file lists the encrypted media wich will be used in encrypted-media tests.
It gives all necessary informations about the encrypted media: path of the file or
the path of the segments in MSE case, mimeType, initDataType and the encryption keys.

  • media/media-source/media-source-loader-simple.js: Added.

This JavaScript file provides a simple MSE implementation, reads the segments of the media and appends them
in the appropriate SourceBuffer.

  • platform/wpe/TestExpectations:
9:42 AM Changeset in webkit [226517] by commit-queue@webkit.org
  • 2 edits in trunk/Source/WebInspectorUI

Web Inspector: Find next / previous within a resource content view does not have bouncy highlight when editor scrolls
​https://bugs.webkit.org/show_bug.cgi?id=181279
<rdar://problem/36291097>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2018-01-08
Reviewed by Brian Burg.

  • UserInterface/Views/TextEditor.js:

(WI.TextEditor.prototype._revealSearchResult):
Reposition the bouncy highlight on scroll based on the CodeMirror
line/ch position of the search result.

(WI.TextEditor.prototype._removeBouncyHighlightElementIfNeeded):
Track the bouncy highlight scroll handler in a member variable so that
we always remember to remove it and don't leak scroll handlers.

9:40 AM Changeset in webkit [226516] by Alan Bujtas
  • 13 edits
    2 adds in trunk/Source/WebCore

[RenderTreeBuilder] Move RenderBlock addChild logic to RenderTreeBuilder
​https://bugs.webkit.org/show_bug.cgi?id=181319
<rdar://problem/36313464>

Reviewed by Antti Koivisto.

This is about moving the code, no cleanup and/or normalization (unfortunately it also means
some temporary changes).

No change in functionality.

  • Sources.txt:
  • WebCore.xcodeproj/project.pbxproj:
  • rendering/RenderBlock.cpp:

(WebCore::RenderBlock::addChild):
(WebCore::RenderBlock::addChildIgnoringContinuation):
(WebCore::RenderBlock::childBecameNonInline):
(WebCore::RenderBlock::continuationBefore): Deleted.
(WebCore::RenderBlock::addChildToContinuation): Deleted.
(WebCore::getInlineRun): Deleted.
(WebCore::RenderBlock::makeChildrenNonInline): Deleted.

  • rendering/RenderBlock.h:
  • rendering/RenderBox.cpp:

(WebCore::markBoxForRelayoutAfterSplit): Deleted.
(WebCore::RenderBox::splitAnonymousBoxesAroundChild): Deleted.

  • rendering/RenderBox.h:
  • rendering/RenderRubyBase.cpp:

(WebCore::RenderRubyBase::moveChildren):
(WebCore::RenderRubyBase::moveBlockChildren):

  • rendering/RenderTable.cpp:

(WebCore::RenderTable::addChild):

  • rendering/RenderTableRow.cpp:

(WebCore::RenderTableRow::addChild):

  • rendering/RenderTableSection.cpp:

(WebCore::RenderTableSection::addChild):

  • rendering/updating/RenderTreeBuilder.cpp:

(WebCore::markBoxForRelayoutAfterSplit):
(WebCore::getInlineRun):
(WebCore::RenderTreeBuilder::RenderTreeBuilder):
(WebCore::RenderTreeBuilder::insertChildToRenderBlock):
(WebCore::RenderTreeBuilder::insertChildToRenderBlockIgnoringContinuation):
(WebCore::RenderTreeBuilder::makeChildrenNonInline):
(WebCore::RenderTreeBuilder::splitAnonymousBoxesAroundChild):

  • rendering/updating/RenderTreeBuilder.h:

(WebCore::RenderTreeBuilder::blockBuilder):

  • rendering/updating/RenderTreeBuilderBlock.cpp: Added.

(WebCore::continuationBefore):
(WebCore::RenderTreeBuilder::Block::Block):
(WebCore::RenderTreeBuilder::Block::insertChild):
(WebCore::RenderTreeBuilder::Block::insertChildToContinuation):
(WebCore::RenderTreeBuilder::Block::insertChildIgnoringContinuation):

  • rendering/updating/RenderTreeBuilderBlock.h: Added.
9:02 AM Changeset in webkit [226515] by commit-queue@webkit.org
  • 2 edits in trunk/Source/WebCore

Standard controls sometimes say video is in pip when it isnt.
​https://bugs.webkit.org/show_bug.cgi?id=181095
rdar://problem/36182687

Patch by Jeremy Jones <​jeremyj@apple.com> on 2018-01-08
Reviewed by Eric Carlson.

  • html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::exitFullscreen):

8:46 AM Changeset in webkit [226514] by jer.noble@apple.com
  • 2 edits in trunk/Source/WebCore

REGRESSION: [iOS] ASSERTION FAILED: !node.isConnected() in WebCore::notifyNodeInsertedIntoDocument
​https://bugs.webkit.org/show_bug.cgi?id=181091

Reviewed by Darin Adler.

Move the work previously performed in insertedIntoAncestor() into didFinishInsertingNode().

  • html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::prepareForLoad):

8:14 AM Changeset in webkit [226513] by fred.wang@free.fr
  • 2 edits in trunk/Source/WebKit

Unreviewed build fix after r226211.

Patch by Frederic Wang <​fwang@igalia.com> on 2018-01-08

  • UIProcess/API/Cocoa/WKPreferencesPrivate.h: Use WK_IOS_TBA for iOS.
7:55 AM Changeset in webkit [226512] by Ms2ger@igalia.com
  • 11 edits in trunk/LayoutTests

Update imagebitmap tests.
​https://bugs.webkit.org/show_bug.cgi?id=181379

Unreviewed test gardening.

LayoutTests/imported/w3c:

  • web-platform-tests/2dcontext/imagebitmap/common.js:
  • web-platform-tests/2dcontext/imagebitmap/createImageBitmap-drawImage-expected.txt:
  • web-platform-tests/2dcontext/imagebitmap/createImageBitmap-drawImage.html:
  • web-platform-tests/2dcontext/imagebitmap/createImageBitmap-invalid-args-expected.txt:
  • web-platform-tests/2dcontext/imagebitmap/createImageBitmap-invalid-args.html:

LayoutTests:

  • platform/gtk/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-drawImage-expected.txt:
  • platform/gtk/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-invalid-args-expected.txt:
  • platform/wpe/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-drawImage-expected.txt:
  • platform/wpe/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-invalid-args-expected.txt:
7:00 AM Changeset in webkit [226511] by zandobersek@gmail.com
  • 7 edits in trunk/Source/WebCore

[Cairo] Use isolated fill and stroke source containers
​https://bugs.webkit.org/show_bug.cgi?id=181386

Reviewed by Carlos Garcia Campos.

Generate fill and stroke source objects upon invocation of various Cairo
operations, initializing necessary data from the GraphicsContextState
object.

Cairo::FillSource and Cairo::StrokeSource structs are introduced, both
being default-constructible as well as providing a constructor that
accepts a GraphicsContextState object from which the appropriate
resources are created.

The FillSource and StrokeSource objects are then passed to
PlatformContextCairo's prepareForFilling() and prepareForStroking()
methods. Here the helper prepareCairoContextSource() function is now
invoked with cairo_pattern_t objects as pattern or gradient sources, or
the source color if neither cairo_pattern_t object is specified.

The FillSource and StrokeSource constructors mimic the previous behavior
of prepareCairoContextSource(). In case the source is a Pattern object,
a cairo_pattern_t object is created from that. In case of FillSource,
we also retrieve pattern size, transform and repetition information. In
case the source os a Gradient object, we create a 'base' cairo_pattern_t
object for a completely opaque alpha channel. Additionally, if the alpha
value on the state is not 1, we create an alpha-adjusted cairo_pattern_t
that is potentially used for any filling or stroking operation that has
to preserve transparency. If neither Pattern or Gradient objects are set
on the GraphicsContextState, we default to the current fill or stroke
color.

Overall, there's no change in behavior, this is simply a refactoring
that enables us to construct Cairo objects for filling and stroking
sources at the time of Cairo operation dispatch, instead of pulling down
GraphicsContextState deeper into the Cairo-specific code.

No new tests -- no change in functionality.

  • platform/graphics/cairo/CairoOperations.cpp:

(WebCore::Cairo::drawPathShadow):
(WebCore::Cairo::fillCurrentCairoPath):
(WebCore::Cairo::FillSource::FillSource):
(WebCore::Cairo::StrokeSource::StrokeSource):
(WebCore::Cairo::fillRect):
(WebCore::Cairo::fillRectWithRoundedHole):
(WebCore::Cairo::fillPath):
(WebCore::Cairo::strokeRect):
(WebCore::Cairo::strokePath):
(WebCore::Cairo::drawGlyphs):

  • platform/graphics/cairo/CairoOperations.h:
  • platform/graphics/cairo/FontCairo.cpp:

(WebCore::FontCascade::drawGlyphs):

  • platform/graphics/cairo/GraphicsContextCairo.cpp:

(WebCore::GraphicsContext::fillPath):
(WebCore::GraphicsContext::strokePath):
(WebCore::GraphicsContext::fillRect):
(WebCore::GraphicsContext::strokeRect):
(WebCore::GraphicsContext::fillRectWithRoundedHole):

  • platform/graphics/cairo/PlatformContextCairo.cpp:

(WebCore::prepareCairoContextSource):
(WebCore::PlatformContextCairo::prepareForFilling):
(WebCore::PlatformContextCairo::prepareForStroking):
(WebCore::PlatformContextCairo::clipForPatternFilling):

  • platform/graphics/cairo/PlatformContextCairo.h:
6:43 AM Changeset in webkit [226510] by commit-queue@webkit.org
  • 21 edits
    6 adds in trunk

navigator.onLine does not work inside service workers
​https://bugs.webkit.org/show_bug.cgi?id=181079
<rdar://problem/36178606>

Patch by Youenn Fablet <​youenn@apple.com> on 2018-01-08
Reviewed by Darin Adler.

Source/WebCore:

Test: http/wpt/service-workers/online.https.html

Added support for onLine by reusing a similar implementation as regular workers.
Added ServiceWorkerInternals as an interface for an object exposed as self.internals in WTR.
This object has currently one method to trigger change in the online/offline status.
This allows writing a test for the onLine feature.

Note that self.internals is inserted asynchronously after the script was evaluated.
When writing a worker script using self.internals, one must make sure to use self.internals when initialized.
online-worker.js for instance makes use of self.internals in a postMessage callback.

  • CMakeLists.txt:
  • DerivedSources.make:
  • WebCore.xcodeproj/project.pbxproj:
  • bindings/js/WorkerScriptController.h:
  • dom/ScriptExecutionContext.h:
  • testing/ServiceWorkerInternals.cpp: Added.

(WebCore::ServiceWorkerInternals::ServiceWorkerInternals):
(WebCore::ServiceWorkerInternals::setOnline):

  • testing/ServiceWorkerInternals.h: Added.
  • testing/ServiceWorkerInternals.idl: Added.
  • testing/js/WebCoreTestSupport.cpp:

(WebCoreTestSupport::setupNewlyCreateServiceWorker):

  • testing/js/WebCoreTestSupport.h:
  • workers/service/context/SWContextManager.cpp:

(WebCore::SWContextManager::registerServiceWorkerThreadForInstall):
(WebCore::SWContextManager::startedServiceWorker):

  • workers/service/context/SWContextManager.h:

(WebCore::SWContextManager::setServiceWorkerCreationCallback):
(WebCore::SWContextManager::workerByID):

  • workers/service/context/ServiceWorkerThread.cpp:

(WebCore::ServiceWorkerThread::ServiceWorkerThread):

  • workers/service/context/ServiceWorkerThreadProxy.cpp:

(WebCore::ServiceWorkerThreadProxy::ServiceWorkerThreadProxy):
(WebCore::ServiceWorkerThreadProxy::~ServiceWorkerThreadProxy):
(WebCore::ServiceWorkerThreadProxy::networkStateChanged):
(WebCore::ServiceWorkerThreadProxy::notifyNetworkStateChange):

  • workers/service/context/ServiceWorkerThreadProxy.h:

Source/WebKit:

Added support for a callback called for each service worker proxy creation.
Callback is used by WTR to inject a self.internals object used for testing.

  • WebProcess/InjectedBundle/API/c/WKBundle.cpp:

(WKBundleSetServiceWorkerProxyCreationCallback):

  • WebProcess/InjectedBundle/API/c/WKBundle.h:
  • WebProcess/InjectedBundle/InjectedBundle.cpp:

(WebKit::InjectedBundle::setServiceWorkerProxyCreationCallback):

  • WebProcess/InjectedBundle/InjectedBundle.h:

Tools:

  • WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:

(WTR::InjectedBundle::initialize): Setting service worker creation callback to inject ServiceWorkerInternals object.

LayoutTests:

  • http/wpt/service-workers/online-worker.js: Added.

(async.waitForOnlineEvent):
(async.doTest):

  • http/wpt/service-workers/online.https-expected.txt: Added.
  • http/wpt/service-workers/online.https.html: Added.
6:38 AM Changeset in webkit [226509] by zandobersek@gmail.com
  • 5 edits in trunk/Source/WebCore

[Cairo] Contain shadow blur requirement state in a separate object
​https://bugs.webkit.org/show_bug.cgi?id=181380

Reviewed by Carlos Garcia Campos.

Instead of picking up the necessary state parameters from a
GraphicsContextState object, store the necessary parameters in a helper
ShadowBlurUsage struct. Mimicking the mustUseShadowBlur() function that
is being removed, values of the shadow color, shadow blur, and shadow
transform ignorance are stored there. Additionally, the required()
method accepts a PlatformContextCairo object through which it can
retrieve the current CTM and determine whether it's an identity, finally
deciding whether shadow blur can or cannot be ignored.

Goal of this change is to limit usage of GraphicsContextState directly
in operations implemented inside the Cairo namespace. Instead, the
state parameters should be passed directly, or an equivalent but limited
state object should be constructed for invocation of such operations.

This is likely only an intermediate solution. It's possible it will be
replaced by a more complete shadow state struct that would be used for
any operation that is required to draw shadows, if necessary.

No new tests -- no change in functionality.

  • platform/graphics/cairo/CairoOperations.cpp:

(WebCore::Cairo::drawGlyphsShadow):
(WebCore::Cairo::ShadowBlurUsage::ShadowBlurUsage):
(WebCore::Cairo::ShadowBlurUsage::required const):
(WebCore::Cairo::fillRectWithRoundedHole):
(WebCore::Cairo::drawGlyphs):
(WebCore::Cairo::mustUseShadowBlur): Deleted.

  • platform/graphics/cairo/CairoOperations.h:
  • platform/graphics/cairo/FontCairo.cpp:

(WebCore::FontCascade::drawGlyphs):

  • platform/graphics/cairo/GraphicsContextCairo.cpp:

(WebCore::GraphicsContext::fillRectWithRoundedHole):

5:53 AM Changeset in webkit [226508] by Philippe Normand
  • 13 edits
    2 deletes in trunk/Source/WebCore

[GStreamer][Soup] Remove dead getCreateOrReadBuffer code path
​https://bugs.webkit.org/show_bug.cgi?id=181376

Reviewed by Carlos Garcia Campos.

This code path is no longer used now that the GStreamer HTTP
source element uses data coming directly from the network process.

  • SourcesGTK.txt:
  • SourcesWPE.txt:
  • loader/MediaResourceLoader.cpp:

(WebCore::MediaResource::getOrCreateReadBuffer): Deleted.

  • loader/MediaResourceLoader.h:
  • loader/SubresourceLoader.h:
  • loader/cache/CachedRawResource.h:
  • loader/cache/CachedRawResourceClient.h:

(WebCore::CachedRawResourceClient::finishedTimingForWorkerLoad):
(WebCore::CachedRawResourceClient::getOrCreateReadBuffer): Deleted.

  • loader/cache/CachedResource.h:

(WebCore::CachedResource::getOrCreateReadBuffer): Deleted.

  • loader/soup/CachedRawResourceSoup.cpp: Removed.
  • loader/soup/SubresourceLoaderSoup.cpp: Removed.
  • platform/graphics/PlatformMediaResourceLoader.h:

(WebCore::PlatformMediaResourceClient::loadFinished):
(WebCore::PlatformMediaResourceClient::getOrCreateReadBuffer): Deleted.

  • platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:

(CachedResourceStreamingClient::getOrCreateReadBuffer): Deleted.

  • platform/network/ResourceHandleClient.h:

(WebCore::ResourceHandleClient::getOrCreateReadBuffer): Deleted.

  • platform/network/soup/ResourceHandleSoup.cpp:

(WebCore::ResourceHandle::ensureReadBuffer):

4:32 AM Changeset in webkit [226507] by commit-queue@webkit.org
  • 2 edits in trunk/LayoutTests

imported/w3c/web-platform-tests/service-workers/service-worker/interfaces-sw.https.html is slow in Debug
​https://bugs.webkit.org/show_bug.cgi?id=181382

Unreviewed.

Patch by Youenn Fablet <​youenn@apple.com> on 2018-01-08

3:33 AM Changeset in webkit [226506] by ddkilzer@apple.com
  • 4 edits in trunk/Source/ThirdParty/libwebrtc

libwebrtc: Fix 'ld: warning: cannot export hidden symbol' messages
<​https://webkit.org/b/181378>

Reviewed by Youenn Fablet.

  • Configurations/libwebrtc.iOS.exp:
  • Configurations/libwebrtc.iOSsim.exp:
  • Configurations/libwebrtc.mac.exp:
  • Remove 117 symbols that are not currently exported. These warnings only appear in Release and Production builds.
1:38 AM Changeset in webkit [226505] by Carlos Garcia Campos
  • 2 edits in trunk/LayoutTests

Unreviewed GTK gardening. Rebaseline test again after r226500.

  • platform/gtk/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-invalid-args-expected.txt:
1:34 AM Changeset in webkit [226504] by Carlos Garcia Campos
  • 3 edits
    2 adds in trunk/Source/WebCore

[GStreamer] use FastMalloc-based GstAllocator
​https://bugs.webkit.org/show_bug.cgi?id=165793

Reviewed by Philippe Normand.

Add GstAllocatorFastMalloc, a GstAllocator implementation using fast malloc. It's only used when fast malloc is
enabled and can be disabled using an environment variable for debugging purposes.

  • platform/GStreamer.cmake:
  • platform/graphics/gstreamer/GStreamerUtilities.cpp:

(WebCore::initializeGStreamer):

  • platform/graphics/gstreamer/GstAllocatorFastMalloc.cpp: Added.

(gstMemoryFastMallocNew):
(gstAllocatorFastMallocAlloc):
(gstAllocatorFastMallocFree):
(gstAllocatorFastMallocMemMap):
(gstAllocatorFastMallocMemUnmap):
(gstAllocatorFastMallocMemCopy):
(gstAllocatorFastMallocMemShare):
(gstAllocatorFastMallocMemIsSpan):
(gst_allocator_fast_malloc_class_init):
(gst_allocator_fast_malloc_init):

  • platform/graphics/gstreamer/GstAllocatorFastMalloc.h: Added.
1:22 AM Changeset in webkit [226503] by ddkilzer@apple.com
  • 2 edits in trunk/Source/WebKitLegacy/mac

Build fix #2: Enable -Wcast-qual for WebInspectorUI, WebKitLegacy, WebKit projects
<​https://webkit.org/b/181256>
<rdar://problem/36281730>

  • Plugins/WebNetscapePluginEventHandlerCocoa.mm:

(WebNetscapePluginEventHandlerCocoa::handleTSMEvent):

  • Use reinterpret_cast<NPNSString*>(const_cast<CFMutableStringRef>()) to avoid warnings from casting CFStringRef to NPNSString*. Note that CFMutableStringRef is the same as CFStringRef without the const modifier, hence its use in the const_cast<> above.
1:16 AM Changeset in webkit [226502] by Carlos Garcia Campos
  • 3 edits in trunk/LayoutTests

Unreviewed GTK gardening. Partially revert r224460.

Two tests were incorrectly rebaselined in r224460.

  • platform/gtk/fast/forms/auto-fill-button/input-strong-confirmation-password-auto-fill-button-expected.txt:
  • platform/gtk/fast/forms/auto-fill-button/input-strong-password-auto-fill-button-expected.txt:
1:08 AM Changeset in webkit [226501] by ddkilzer@apple.com
  • 2 edits in trunk/Source/WebKitLegacy/mac

Build fix: Enable -Wcast-qual for WebInspectorUI, WebKitLegacy, WebKit projects
<​https://webkit.org/b/181256>
<rdar://problem/36281730>

  • Carbon/HIWebView.mm:

(StartUpdateObserver): Include TypeCastsCF.h from WTF, and use
checked_cf_cast<CFRunLoopRef>() to fix warning.

Jan 7, 2018:

11:23 PM Changeset in webkit [226500] by Ms2ger@igalia.com
  • 9 edits in trunk

Implement createImageBitmap(ImageBitmap)
​https://bugs.webkit.org/show_bug.cgi?id=181287

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

  • web-platform-tests/2dcontext/imagebitmap/createImageBitmap-drawImage-expected.txt: rebaseline.

Source/WebCore:

Tests: imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-drawImage.html

imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-invalid-args.html

  • html/ImageBitmap.cpp:

(WebCore::ImageBitmap::createPromise):

LayoutTests:

  • platform/gtk/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-drawImage-expected.txt: rebaseline.
  • platform/gtk/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-invalid-args-expected.txt: rebaseline.
  • platform/wpe/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-drawImage-expected.txt: rebaseline.
  • platform/wpe/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-invalid-args-expected.txt: rebaseline.
10:00 PM Changeset in webkit [226499] by ddkilzer@apple.com
  • 28 edits
    1 move in trunk/Source

Enable -Wcast-qual for WebInspectorUI, WebKitLegacy, WebKit projects
<​https://webkit.org/b/181256>
<rdar://problem/36281730>

Reviewed by Darin Adler.

Source/WebInspectorUI:

  • Configurations/Base.xcconfig:

(WARNING_CFLAGS): Add -Wcast-qual.

Source/WebKit:

  • Configurations/Base.xcconfig:

(WARNING_CFLAGS): Add -Wcast-qual.

  • NetworkProcess/cache/NetworkCacheCodersCocoa.cpp:

(WTF::Persistence::encodeCertificateChain): Include
TypeCastsCF.h from WTF, and use
checked_cf_cast<SecCertificateRef>() to fix warning.

  • Platform/cocoa/WKCrashReporter.mm:

(WebKit::setCrashReportApplicationSpecificInformation):

  • Move oldMessage check above nullptr check to fix a leak when passing in nullptr after previously setting the crash string.
  • Change C-style cast to const_cast<char*>() to fix warning.
  • PluginProcess/mac/PluginProcessShim.mm:

(WebKit::shim_shmat): Change C-style cast to
const_cast<void*>() to fix warning.

  • Shared/Authentication/mac/AuthenticationManager.mac.mm:

(WebKit::leafCertificate): Include TypeCastsCF.h from
WTF, and use checked_cf_cast<SecCertificateRef>() to fix
warning.

  • Shared/cf/ArgumentCodersCF.cpp:

(IPC::encode): Use static_cast<>(const_cast<void*>() to
fix warnings since the CFTypeID has already been
checked.

  • Shared/mac/WebCoreArgumentCodersMac.mm:

(IPC::decodeNSError): Use an auto variable to hold the
CFMutableDictionaryRef, then WTFMove() to assign it back to
userInfo.

  • UIProcess/Cocoa/WebViewImpl.mm:

(WebKit::takeWindowSnapshot): Include TypeCastsCF.h from
WTF, and use checked_cf_cast<CGImageRef>() to fix
warning.

Source/WebKitLegacy:

  • PlatformMac.cmake:
  • WebKitLegacy.xcodeproj/project.pbxproj:
  • Rename WebNSDataExtras.m to WebNSDataExtras.mm and change file type to Objective-C++.

Source/WebKitLegacy/mac:

  • Carbon/CarbonUtils.m:

(PoolCleaner):

  • Use #pragmas to ignore -Wcast-qual warnings when using a C-style cast from CFTypeRef to CFRunloopRef.
  • Carbon/CarbonWindowFrame.m:

(-[CarbonWindowFrame title]):

  • Use #pragmas to ignore -Wcast-qual warnings when using a C-style cast from CFStringRef to NSString *.
  • Carbon/HIViewAdapter.m:

(+[HIViewAdapter getHIViewForNSView:]):

  • Use #pragmas to ignore -Wcast-qual warnings when using a C-style cast from CFTypeRef to HIViewRef.
  • Configurations/Base.xcconfig:

(WARNING_CFLAGS): Add -Wcast-qual.

  • Misc/WebElementDictionary.mm:

(-[WebElementDictionary objectForKey:]):

  • Use static_cast<SEL>(const_cast<void*>()) to fix warning.
  • Misc/WebNSDataExtras.mm: Renamed from Source/WebKitLegacy/mac/Misc/WebNSDataExtras.m.

(-[NSString _web_capitalizeRFC822HeaderFieldName]):
(-[NSData _webkit_guessedMIMETypeForXML]):
(-[NSData _webkit_guessedMIMEType]):
(-[NSData _web_isCaseInsensitiveEqualToCString:]):
(_findEOL):
(-[NSData _webkit_parseRFC822HeaderFields]):
(-[NSData _web_startsWithBlankLine]):
(-[NSData _web_locationAfterFirstBlankLine]):

  • Rename WebNSDataExtras.m to WebNSDataExtras.mm and change file type to Objective-C++. This fixes the warnings about discarding the const modifier when casing from CFStringRef to NSString * because in older clang versions, -Wcast-qual was completely broken when compiling C++ and Objective-C++ source files. In newer clang versions, discarding the const modifier for toll-free bridged types is ignored when compiling Objective-C++ source.
  • Update copyright and license header.
  • Use reinterpret_cast<> and static_cast<> to fix warnings unrelated to (NSString *) C-style casts.
  • Replace use of MIN() macro with std::min<> template functions.
  • Fix location of * for local variables modified above.
  • Plugins/Hosted/NetscapePluginHostManager.mm:

(WebKit::NetscapePluginHostManager::spawnPluginHost):
(WebKit::NetscapePluginHostManager::initializeVendorPort):
(WebKit::NetscapePluginHostManager::instantiatePlugin):

  • Use static_cast<uint8_t*>(const_cast<void*>()) to fix warnings.
  • Plugins/Hosted/NetscapePluginHostProxy.mm:

(WebKit::NetscapePluginHostProxy::NetscapePluginHostProxy):

  • Use reinterpret_cast<mig_subsystem_t>(const_cast<struct WKWebKitPluginClient_subsystem*>()) to fix warning.
  • Plugins/Hosted/ProxyInstance.mm:

(WebKit::ProxyInstance::invoke):

  • Use static_cast<char*>(const_cast<void*>()) to fix warning when using -[NSData bytes].

(WebKit::ProxyInstance::fieldValue const):

  • Use reinterpret_cast<char*>(const_cast<unsigned char*>()) to fix warning when using CFDataGetBytePtr().
  • Plugins/Hosted/WebTextInputWindowController.m:

(-[WebTextInputPanel _interpretKeyEvent:string:]):

  • Use #pragma to ignore -Wcast-qual warning since there is not a good way to avoid this warning in Objective-C.
  • Plugins/WebNetscapePluginStream.mm:

(WebNetscapePluginStream::deliverData):

  • Use const_cast<void*>() to fix warning when using -[NSData bytes].
  • Plugins/WebNetscapePluginView.mm:

(-[WebNetscapePluginView _createPlugin]):

  • Change C-style cast to const_cast<char*>() to fix warning.
  • WebCoreSupport/WebChromeClient.mm:

(WebChromeClient::wrapCryptoKey const):
(WebChromeClient::unwrapCryptoKey const):

  • Change C-style cast to static_cast<uint8_t*>(const_cast<void*>() to fix warning.
  • WebView/WebPDFView.mm:

(_applicationInfoForMIMEType):

  • Change local variable type from 'NSURL *' to 'CFURLRef' to fix warning. Cast back to 'NSURL *' when calling -[NSURL path].
9:33 PM Changeset in webkit [226498] by jmarcell@apple.com
  • 4 edits in tags/Safari-605.1.19.1

Cherry-pick r226359. rdar://problem/36146670

9:32 PM Changeset in webkit [226497] by jmarcell@apple.com
  • 7 edits in tags/Safari-605.1.19.1/Source

Versioning.

9:24 PM Changeset in webkit [226496] by jmarcell@apple.com
  • 1 copy in tags/Safari-605.1.19.1

New tag.

5:22 PM Changeset in webkit [226495] by rniwa@webkit.org
  • 5 edits in trunk

Reduce the precision of "high" resolution time to 1ms
​https://bugs.webkit.org/show_bug.cgi?id=180910
<rdar://problem/36085943>

Reviewed by Saam Barati.

Source/WebCore:

Reduced the high prevision time's resolution to 1ms, the same precision as Date.now().

Also fixed the bug in fillRTCStats that we weren't reducing the time resolution in RTCStats dictionaries.

  • Modules/mediastream/libwebrtc/LibWebRTCMediaEndpoint.cpp:

(WebCore::fillRTCStats):

  • page/Performance.cpp:

(WebCore::Performance::reduceTimeResolution):

LayoutTests:

Add a flaky test expectation to imported/w3c/web-platform-tests/workers/worker-performance.worker.html
due to a test bug. The test fix is tracked in ​https://github.com/w3c/web-platform-tests/pull/8711

2:50 PM Changeset in webkit [226494] by Konstantin Tokarev
  • 2 edits in trunk/Source/WebKit

[cmake] Unset CMAKE_REQUIRED_LIBRARIES after check_function_exists test
​https://bugs.webkit.org/show_bug.cgi?id=181371

Reviewed by Michael Catanzaro.

This variable is used by check_function_exists internally, its value
should be never used for anything else.

  • CMakeLists.txt:
2:22 PM Changeset in webkit [226493] by sbarati@apple.com
  • 2 edits in trunk/Tools

Add total exits and total compilations sorting mode to the "full" command in display-profiler-output
​https://bugs.webkit.org/show_bug.cgi?id=181372

Reviewed by Filip Pizlo.

Adding these sorting modes makes it easier to analyze functions
that recompile a lot and exit a lot.

  • Scripts/display-profiler-output:
Note: See TracTimeline for information about the timeline view.