⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Timeline



Jan 28, 2018:

10:35 PM Changeset in webkit [227722] by commit-queue@webkit.org
  • 5 edits
    2 adds in trunk

Overflow of formulas is hidden for display mathematics
​https://bugs.webkit.org/show_bug.cgi?id=160547

Patch by Minsheng Liu <​lambda@liu.ms> on 2018-01-28
Reviewed by Frédéric Wang.

Source/WebCore:

Previously, <math> with display="block" uses its container's logical width as logical width.
However, that behavior will truncate overflowed contents. The patch fixes it by setting
the logical width as its content width rather than its container's logical width
if the former is wider than the latter.

Test: mathml/presentation/display-math-horizontal-overflow.html

  • rendering/mathml/RenderMathMLRow.cpp:

(WebCore::RenderMathMLRow::layoutBlock):

LayoutTests:

Add a test to ensure <math> with display="block" will not truncate overflowed contents.

  • mathml/presentation/display-math-horizontal-overflow-expected.txt: Added.
  • mathml/presentation/display-math-horizontal-overflow.html: Added.
9:08 PM Changeset in webkit [227721] by fpizlo@apple.com
  • 5 edits in trunk/Source/JavaScriptCore

LargeAllocation should do the same distancing as MarkedBlock
​https://bugs.webkit.org/show_bug.cgi?id=182226

Reviewed by Saam Barati.

This makes LargeAllocation do the same exact distancing that MarkedBlock promises to do.

To make that possible, this patch first makes MarkedBlock know exactly how much distancing it
is doing:

  • I've rationalized the payloadSize calculation. In particular, I made MarkedSpace use the calculation done in MarkedBlock. MarkedSpace used to do the math a different way. This keeps the old way just for a static_assert.


  • The promised amount of distancing is now codified in HeapCell.h as minimumDistanceBetweenCellsFromDifferentOrigins. We assert that the footer size is at least as big as this. I didn't want to just use footer size for this constant because then, if you increased the size of the footer, you'd also add padding to every large allocation.


Then this patch just adds minimumDistanceBetweenCellsFromDifferentOrigins to each large
allocation. It also zeroes that slice of memory to prevent any information leaks that way.

This is perf neutral. Large allocations start out at ~8000 bytes. The amount of padding is
~300 bytes. That's 3.75% space overhead for objects that are ~8000 bytes, zero overhead for
smaller objects, and diminishing overhead for larger objects. We allocate very few large
objects, so we shouldn't have any real space overhead from this.

  • heap/HeapCell.h:
  • heap/LargeAllocation.cpp:

(JSC::LargeAllocation::tryCreate):

  • heap/MarkedBlock.h:
  • heap/MarkedSpace.h:
12:54 PM Changeset in webkit [227720] by zandobersek@gmail.com
  • 2 edits in trunk/LayoutTests

Unreviewed WPE gardening.

  • platform/wpe/TestExpectations: Add test failure expectations. Shuffle

around a few expectations and eliminate duplicate ones, removing overlap
warnings printed out when invoking run-webkit-tests.

12:00 PM Changeset in webkit [227719] by zandobersek@gmail.com
  • 2 edits
    4 adds in trunk/LayoutTests

Unreviewed GTK+ gardening.

  • platform/gtk/TestExpectations: Add failure expectations for three tests.
  • platform/gtk/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/errorhandling-expected.txt:

Added a test baseline due to console messages being output in a slightly different order.

11:20 AM WebKitGTK/2.18.x edited by Michael Catanzaro
Add warning about r227544 (diff)
11:08 AM Changeset in webkit [227718] by fpizlo@apple.com
  • 8 edits in trunk/Source/JavaScriptCore

Make MarkedBlock::Footer bigger
​https://bugs.webkit.org/show_bug.cgi?id=182220

Reviewed by JF Bastien.

This makes the block footer larger by moving the newlyAllocated bits from the handle into
the footer.

It used to be profitable to put anything we could into the handle because that would free up
payload space inside the block. But now that we want to use the footer for padding, it's
profitable to put GC state information - especially data that is used by the GC itself and so
is not useful for a Spectre attack - into the footer to increase object distancing.

  • heap/CellContainer.cpp:

(JSC::CellContainer::isNewlyAllocated const):

  • heap/IsoCellSet.cpp:

(JSC::IsoCellSet::sweepToFreeList):

  • heap/MarkedBlock.cpp:

(JSC::MarkedBlock::Handle::Handle):
(JSC::MarkedBlock::Footer::Footer):
(JSC::MarkedBlock::Handle::stopAllocating):
(JSC::MarkedBlock::Handle::lastChanceToFinalize):
(JSC::MarkedBlock::Handle::resumeAllocating):
(JSC::MarkedBlock::aboutToMarkSlow):
(JSC::MarkedBlock::resetAllocated):
(JSC::MarkedBlock::Handle::resetAllocated): Deleted.

  • heap/MarkedBlock.h:

(JSC::MarkedBlock::newlyAllocatedVersion const):
(JSC::MarkedBlock::isNewlyAllocated):
(JSC::MarkedBlock::setNewlyAllocated):
(JSC::MarkedBlock::clearNewlyAllocated):
(JSC::MarkedBlock::newlyAllocated const):
(JSC::MarkedBlock::Handle::newlyAllocatedVersion const): Deleted.
(JSC::MarkedBlock::Handle::isNewlyAllocated): Deleted.
(JSC::MarkedBlock::Handle::setNewlyAllocated): Deleted.
(JSC::MarkedBlock::Handle::clearNewlyAllocated): Deleted.
(JSC::MarkedBlock::Handle::newlyAllocated const): Deleted.

  • heap/MarkedBlockInlines.h:

(JSC::MarkedBlock::isNewlyAllocatedStale const):
(JSC::MarkedBlock::hasAnyNewlyAllocated):
(JSC::MarkedBlock::Handle::isLive):
(JSC::MarkedBlock::Handle::specializedSweep):
(JSC::MarkedBlock::Handle::newlyAllocatedMode):
(JSC::MarkedBlock::Handle::isNewlyAllocatedStale const): Deleted.
(JSC::MarkedBlock::Handle::hasAnyNewlyAllocated): Deleted.

  • heap/MarkedSpace.cpp:

(JSC::MarkedSpace::endMarking):

  • heap/SlotVisitor.cpp:

(JSC::SlotVisitor::appendJSCellOrAuxiliary):

Jan 27, 2018:

6:23 PM Changeset in webkit [227717] by fpizlo@apple.com
  • 12 edits in trunk/Source/JavaScriptCore

MarkedBlock should have a footer instead of a header
​https://bugs.webkit.org/show_bug.cgi?id=182217

Reviewed by JF Bastien.

This moves the MarkedBlock's meta-data from the header to the footer. This doesn't really
change anything except for some compile-time constants, so it should not affect performance.

This change is to help protect against Spectre attacks on structure checks, which allow for
small-offset out-of-bounds access. By putting the meta-data at the end of the block, small
OOBs will only get to other objects in the same block or the block footer. The block footer
is not super interesting. So, if we combine this with the TLC change (r227617), this means we
can use blocks as the mechanism of achieving distance between objects from different origins.
We just need to avoid ever putting objects from different origins in the same block. That's
what bug 181636 is about.

  • heap/BlockDirectory.cpp:

(JSC::blockHeaderSize): Deleted.
(JSC::BlockDirectory::blockSizeForBytes): Deleted.

  • heap/BlockDirectory.h:
  • heap/HeapUtil.h:

(JSC::HeapUtil::findGCObjectPointersForMarking):

  • heap/MarkedBlock.cpp:

(JSC::MarkedBlock::MarkedBlock):
(JSC::MarkedBlock::~MarkedBlock):
(JSC::MarkedBlock::Footer::Footer):
(JSC::MarkedBlock::Footer::~Footer):
(JSC::MarkedBlock::Handle::stopAllocating):
(JSC::MarkedBlock::Handle::lastChanceToFinalize):
(JSC::MarkedBlock::Handle::resumeAllocating):
(JSC::MarkedBlock::aboutToMarkSlow):
(JSC::MarkedBlock::resetMarks):
(JSC::MarkedBlock::assertMarksNotStale):
(JSC::MarkedBlock::Handle::didConsumeFreeList):
(JSC::MarkedBlock::markCount):
(JSC::MarkedBlock::clearHasAnyMarked):
(JSC::MarkedBlock::Handle::didAddToDirectory):
(JSC::MarkedBlock::Handle::didRemoveFromDirectory):
(JSC::MarkedBlock::Handle::sweep):

  • heap/MarkedBlock.h:

(JSC::MarkedBlock::markingVersion const):
(JSC::MarkedBlock::lock):
(JSC::MarkedBlock::subspace const):
(JSC::MarkedBlock::footer):
(JSC::MarkedBlock::footer const):
(JSC::MarkedBlock::handle):
(JSC::MarkedBlock::handle const):
(JSC::MarkedBlock::Handle::blockFooter):
(JSC::MarkedBlock::isAtomAligned):
(JSC::MarkedBlock::Handle::cellAlign):
(JSC::MarkedBlock::blockFor):
(JSC::MarkedBlock::vm const):
(JSC::MarkedBlock::weakSet):
(JSC::MarkedBlock::cellSize):
(JSC::MarkedBlock::attributes const):
(JSC::MarkedBlock::atomNumber):
(JSC::MarkedBlock::areMarksStale):
(JSC::MarkedBlock::aboutToMark):
(JSC::MarkedBlock::isMarkedRaw):
(JSC::MarkedBlock::isMarked):
(JSC::MarkedBlock::testAndSetMarked):
(JSC::MarkedBlock::marks const):
(JSC::MarkedBlock::isAtom):
(JSC::MarkedBlock::Handle::forEachCell):
(JSC::MarkedBlock::hasAnyMarked const):
(JSC::MarkedBlock::noteMarked):
(WTF::MarkedBlockHash::hash):
(JSC::MarkedBlock::firstAtom): Deleted.

  • heap/MarkedBlockInlines.h:

(JSC::MarkedBlock::marksConveyLivenessDuringMarking):
(JSC::MarkedBlock::Handle::isLive):
(JSC::MarkedBlock::Handle::specializedSweep):
(JSC::MarkedBlock::Handle::forEachLiveCell):
(JSC::MarkedBlock::Handle::forEachDeadCell):
(JSC::MarkedBlock::Handle::forEachMarkedCell):

  • heap/MarkedSpace.cpp:
  • heap/MarkedSpace.h:
  • llint/LowLevelInterpreter.asm:
  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm:
10:14 AM Changeset in webkit [227716] by Yusuke Suzuki
  • 3 edits
    2 adds in trunk

DFG strength reduction fails to convert NumberToStringWithValidRadixConstant for 0 to constant '0'
​https://bugs.webkit.org/show_bug.cgi?id=182213

Reviewed by Mark Lam.

JSTests:

  • stress/int32-min-to-string.js: Added.

(shouldBe):
(test2):
(test4):
(test8):
(test16):
(test32):

  • stress/zero-to-string.js: Added.

(shouldBe):
(test2):
(test4):
(test8):
(test16):
(test32):

Source/JavaScriptCore:

toStringWithRadixInternal is originally used for the slow path if the given value is larger than radix or negative.
As a result, it does not accept 0 correctly, and produces an empty string. Since DFGStrengthReductionPhase uses
this function, it accidentally converts NumberToStringWithValidRadixConstant(0, radix) to an empty string.
This patch fixes toStringWithRadixInternal to accept 0. This change fixes twitch.tv's issue.

We also add a careful cast to avoid -INT32_MIN. It does not produce incorrect value in x86 in practice,
but it is UB, and a compiler may assume that the given value is never INT32_MIN and could do an incorrect optimization.

  • runtime/NumberPrototype.cpp:

(JSC::toStringWithRadixInternal):

9:50 AM Changeset in webkit [227715] by mitz@apple.com
  • 12 edits in trunk

HaveInternalSDK includes should be "#include?"
​https://bugs.webkit.org/show_bug.cgi?id=179670

Source/ThirdParty:

  • gtest/xcode/Config/General.xcconfig:

Source/ThirdParty/ANGLE:

  • Configurations/Base.xcconfig:

Source/ThirdParty/libwebrtc:

  • Configurations/Base.xcconfig:

Source/WebCore/PAL:

  • Configurations/Base.xcconfig:

Source/WebKitLegacy/mac:

  • Configurations/Base.xcconfig:

Tools:

  • DumpRenderTree/mac/Configurations/Base.xcconfig:
1:26 AM Changeset in webkit [227714] by graouts@webkit.org
  • 11 edits
    1 add in trunk

[Web Animations] Distinguish between an omitted and a null timeline argument to the Animation constructor
​https://bugs.webkit.org/show_bug.cgi?id=179065
LayoutTests/imported/w3c:

Reviewed by Dean Jackson.

Update WPT test output with progressions.

  • web-platform-tests/web-animations/interfaces/Animation/constructor-expected.txt:
  • web-platform-tests/web-animations/timing-model/animations/reversing-an-animation-expected.txt:
  • web-platform-tests/web-animations/timing-model/animations/set-the-timeline-of-an-animation-expected.txt:

Source/WebCore:

<rdar://problem/36869046>

Reviewed by Dean Jackson.

The Web Animations specification requires that a missing or undefined "timeline" parameter means that the
document's timeline should be used, but a null value should be supported. To support this, we need to provide
a custom Animation constructor where we can check on the ExecState whether the second argument passed is
undefined, which is true if an explicit "undefined" value is passed or if the argument does not exist.

  • Sources.txt: Add the new JSWebAnimationCustom.cpp file.
  • WebCore.xcodeproj/project.pbxproj: Add the new JSWebAnimationCustom.cpp file.
  • animation/WebAnimation.cpp:

(WebCore::WebAnimation::create): Add a create() variant that doesn't provide an AnimationTimeline parameter
to clearly indicate that the provided Document's timeline should be used.

  • animation/WebAnimation.h:
  • animation/WebAnimation.idl:
  • bindings/js/JSWebAnimationCustom.cpp: Added.

(WebCore::constructJSWebAnimation): Provide a custom Animation constructor where we check whether the second
argument, the timeline, is undefined.

  • dom/Element.cpp:

(WebCore::Element::animate): Use the new create() variant since passing "nullptr" now means a null timeline.

Note: See TracTimeline for information about the timeline view.