Timeline

Mar 11, 2018:

12:03 AM Changeset in webkit [229515] by Yusuke Suzuki

• 3 edits in trunk/Source/WTF

[Win] Use SRWLOCK and CONDITION_VARIABLE to simplify implementation
​https://bugs.webkit.org/show_bug.cgi?id=183541

Reviewed by Darin Adler.

After Windows Vista, Windows offers SRWLOCK and CONDITION_VARIABLE.
They can simplify the implementation of our WTF::Mutex and WTF::ThreadCondition.

C++ std::mutex and std::condition_variable uses std::chrono for their timed
functions. Since std::chrono is not overflow-aware, we cannot reliably use
this functionalities. This is why we still keep WTF::Mutex and WTF::ThreadCondition.
They are used for ParkingLot.

• wtf/ThreadingPrimitives.h:
• wtf/ThreadingWin.cpp:

(WTF::Mutex::Mutex):
(WTF::Mutex::~Mutex):
(WTF::Mutex::lock):
(WTF::Mutex::tryLock):
(WTF::Mutex::unlock):
(WTF::absoluteTimeToWaitTimeoutInterval):
(WTF::ThreadCondition::ThreadCondition):
(WTF::ThreadCondition::~ThreadCondition):
(WTF::ThreadCondition::wait):
(WTF::ThreadCondition::timedWait):
(WTF::ThreadCondition::signal):
(WTF::ThreadCondition::broadcast):
(WTF::PlatformCondition::timedWait): Deleted.
(WTF::PlatformCondition::signal): Deleted.

Mar 10, 2018:

8:46 PM Changeset in webkit [229522] by Alan Bujtas

• 5 edits
  2 copies
  11 moves
  4 adds in trunk/Tools

[LayoutReloaded] Add Line class for InlineFormattingContext -and move files around.
​https://bugs.webkit.org/show_bug.cgi?id=183551

Reviewed by Wenson Hsieh.

• LayoutReloaded/FormattingContext/BlockFormatting/BlockFormattingContext.js: Renamed from Tools/LayoutReloaded/BlockFormattingContext.js.

(BlockFormattingContext):
(BlockFormattingContext.prototype.layout):
(BlockFormattingContext.prototype.computeWidth):
(BlockFormattingContext.prototype.computeHeight):
(BlockFormattingContext.prototype.marginTop):
(BlockFormattingContext.prototype.marginBottom):
(BlockFormattingContext.prototype._computeStaticPosition):
(BlockFormattingContext.prototype._placeInFlowPositionedChildren):
(BlockFormattingContext.prototype._placeOutOfFlowDescendants):
(BlockFormattingContext.prototype._computeOutOfFlowWidth):
(BlockFormattingContext.prototype._computeFloatingWidth):
(BlockFormattingContext.prototype._computeInFlowWidth):
(BlockFormattingContext.prototype._computeOutOfFlowHeight):
(BlockFormattingContext.prototype._computeFloatingHeight):
(BlockFormattingContext.prototype._computeInFlowHeight):
(BlockFormattingContext.prototype._computeHorizontalConstraint):
(BlockFormattingContext.prototype._computeContentHeight):
(BlockFormattingContext.prototype._computeInFlowPositionedPosition):
(BlockFormattingContext.prototype._computeOutOfFlowPosition):
(BlockFormattingContext.prototype._shrinkToFitWidth):

• LayoutReloaded/FormattingContext/BlockFormatting/BlockMarginCollapse.js: Renamed from Tools/LayoutReloaded/BlockMarginCollapse.js.

(BlockMarginCollapse.marginTop):
(BlockMarginCollapse.marginBottom):
(BlockMarginCollapse._isMarginTopCollapsedWithSibling):
(BlockMarginCollapse._isMarginBottomCollapsedWithSibling):
(BlockMarginCollapse._isMarginTopCollapsedWithParent):
(BlockMarginCollapse._isMarginBottomCollapsedWithParent):
(BlockMarginCollapse._nonCollapsedMarginTop):
(BlockMarginCollapse._nonCollapsedMarginBottom):
(BlockMarginCollapse._collapsedMarginTopFromFirstChild):
(BlockMarginCollapse._collapsedMarginBottomFromLastChild):
(BlockMarginCollapse._marginValue):
(BlockMarginCollapse._hasAdjoiningMarginTopAndBottom):
(BlockMarginCollapse):

• LayoutReloaded/FormattingContext/FloatingContext.js: Renamed from Tools/LayoutReloaded/FloatingContext.js.

(FloatingContext):
(FloatingContext.prototype.computePosition):
(FloatingContext.prototype.bottom):
(FloatingContext.prototype._positionForFloating):
(FloatingContext.prototype._positionForClear):
(FloatingContext.prototype._computePositionToAvoidIntrudingFloats):
(FloatingContext.prototype._addFloating):
(FloatingContext.prototype._findInnerMostLeftAndRight):
(FloatingContext.prototype._moveToNextVerticalPosition):
(FloatingContext.prototype._availableSpace):
(FloatingContext.prototype._findFloatingAtVerticalPosition):
(FloatingContext.prototype._isEmpty):
(FloatingContext.prototype._adjustedFloatingPosition):
(FloatingContext.prototype._bottom):
(FloatingContext.prototype._formattingContext):

• LayoutReloaded/FormattingContext/FormattingContext.js: Renamed from Tools/LayoutReloaded/FormattingContext.js.

(FormattingContext):
(FormattingContext.prototype.rootContainer):
(FormattingContext.prototype.floatingContext):
(FormattingContext.prototype.layout):
(FormattingContext.prototype.computeWidth):
(FormattingContext.prototype.computeHeight):
(FormattingContext.prototype.marginTop):
(FormattingContext.prototype.marginLeft):
(FormattingContext.prototype.marginBottom):
(FormattingContext.prototype.marginRight):
(FormattingContext.prototype.absoluteMarginBox):
(FormattingContext.prototype.absoluteBorderBox):
(FormattingContext.prototype.absolutePaddingBox):
(FormattingContext.prototype.absoluteContentBox):

• LayoutReloaded/FormattingContext/InlineFormatting/InlineFormattingContext.js: Renamed from Tools/LayoutReloaded/InlineFormattingContext.js.

(InlineFormattingContext):
(InlineFormattingContext.prototype.layout):
(InlineFormattingContext.prototype._handleInlineBox):
(InlineFormattingContext.prototype._handleText):
(InlineFormattingContext.prototype._commitLine):
(InlineFormattingContext.prototype._line):

• LayoutReloaded/FormattingContext/InlineFormatting/Line.js: Copied from Tools/LayoutReloaded/InitialBlockContainer.js.

(Line):
(Line.prototype.isEmpty):
(Line.prototype.availableWidth):
(Line.prototype.appendFragment):

• LayoutReloaded/LayoutReloaded.xcworkspace/contents.xcworkspacedata:
• LayoutReloaded/LayoutTree/BlockContainer.js: Renamed from Tools/LayoutReloaded/BlockContainer.js.

(BlockContainer):
(BlockContainer.prototype.establishesInlineFormattingContext):

• LayoutReloaded/LayoutTree/Box.js: Renamed from Tools/LayoutReloaded/Box.js.

(Box):
(Box.prototype.id):
(Box.prototype.setRendererName):
(Box.prototype.name):
(Box.prototype.node):
(Box.prototype.parent):
(Box.prototype.nextSibling):
(Box.prototype.nextInFlowSibling):
(Box.prototype.previousSibling):
(Box.prototype.previousInFlowSibling):
(Box.prototype.setParent):
(Box.prototype.setNextSibling):
(Box.prototype.setPreviousSibling):
(Box.prototype.rect):
(Box.prototype.topLeft):
(Box.prototype.bottomRight):
(Box.prototype.setTopLeft):
(Box.prototype.setSize):
(Box.prototype.setWidth):
(Box.prototype.setHeight):
(Box.prototype.isContainer):
(Box.prototype.isBlockLevelBox):
(Box.prototype.isBlockContainerBox):
(Box.prototype.isInlineLevelBox):
(Box.prototype.setIsAnonymous):
(Box.prototype.isAnonymous):
(Box.prototype.establishesFormattingContext):
(Box.prototype.establishedFormattingContext):
(Box.prototype.establishesBlockFormattingContext):
(Box.prototype.establishesInlineFormattingContext):
(Box.prototype.isPositioned):
(Box.prototype.isRelativePositioned):
(Box.prototype.isAbsolutePositioned):
(Box.prototype.isFixedPositioned):
(Box.prototype.isInFlow):
(Box.prototype.isOutOfFlowPositioned):
(Box.prototype.isInFlowPositioned):
(Box.prototype.isFloatingPositioned):
(Box.prototype.isFloatingOrOutOfFlowPositioned):
(Box.prototype.isRootElement):
(Box.prototype.containingBlock):
(Box.prototype.borderBox):
(Box.prototype.paddingBox):
(Box.prototype.contentBox):

• LayoutReloaded/LayoutTree/Container.js: Renamed from Tools/LayoutReloaded/Container.js.

(Container):
(Container.prototype.isContainer):
(Container.prototype.setFirstChild):
(Container.prototype.setLastChild):
(Container.prototype.firstChild):
(Container.prototype.firstInFlowChild):
(Container.prototype.lastChild):
(Container.prototype.lastInFlowChild):
(Container.prototype.hasChild):
(Container.prototype.hasInFlowChild):

• LayoutReloaded/LayoutTree/InitialBlockContainer.js: Renamed from Tools/LayoutReloaded/InitialBlockContainer.js.

(InitialBlockContainer):
(InitialBlockContainer.prototype.establishesBlockFormattingContext):
(InitialBlockContainer.prototype.paddingBox):
(InitialBlockContainer.prototype.contentBox):

• LayoutReloaded/LayoutTree/InlineBox.js: Renamed from Tools/LayoutReloaded/InlineBox.js.

(InlineBox):
(InlineBox.prototype.setText):
(InlineBox.prototype.text):

• LayoutReloaded/LayoutTree/Text.js: Renamed from Tools/LayoutReloaded/Text.js.

(Text):
(Text.prototype.node):
(Text.prototype.content):
(Text.prototype.length):

• LayoutReloaded/Utils.js:

(Utils.nextBreakingOpportunity):
(Utils.measureText):

• LayoutReloaded/misc/headers/Line.h: Copied from Tools/LayoutReloaded/misc/headers/Text.h.
• LayoutReloaded/misc/headers/Text.h:
• LayoutReloaded/test/border-simple.html:
• LayoutReloaded/test/index.html:

8:38 PM Changeset in webkit [229521] by Wenson Hsieh

• 2 edits in trunk/Source/WebKit

Fix the internal iOS build after r229512
​https://bugs.webkit.org/show_bug.cgi?id=183550

Reviewed by Zalan Bujtas.

Fixes a typo in a header import, as well as a nullability error. SecTrustEvaluate() takes in a nonnull outparam,
which was removed in r229512; this adds the outparam back, but does not consult its value when setting the
infoDictionary.

• UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm:

(-[WKFullScreenWindowController _EVOrganizationName]):

8:25 PM Changeset in webkit [229520] by Yusuke Suzuki

• 4 edits
  2 adds in trunk

[DFG] AI should convert CreateThis to NewObject if the prototype object is proved
​https://bugs.webkit.org/show_bug.cgi?id=183310

Reviewed by Filip Pizlo.

JSTests:

• stress/ai-create-this-to-new-object-fire.js: Added.

(assert):
(test):
(func):
(check):
(test.body.A):
(test.body.B):
(test.body):

• stress/ai-create-this-to-new-object.js: Added.

(assert):
(test):
(func):
(check):
(test.body.A):
(test.body.B):
(test.body):

Source/JavaScriptCore:

This patch implements CreateThis -> NewObject conversion in AI if the given function is constant.
This contributes to 6% win in Octane/raytrace.

baseline patched

raytrace x2 1.19915+-0.01862 ^{1.13156+-0.01589} definitely 1.0597x faster

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

3:05 PM Changeset in webkit [229519] by Wenson Hsieh

• 2 edits in trunk/Source/JavaScriptCore

Disable Sigill crash analyzer on watchOS
​https://bugs.webkit.org/show_bug.cgi?id=183548
<rdar://problem/38338032>

Reviewed by Mark Lam.

Sigill is not supported on watchOS.

• runtime/Options.cpp:

(JSC::overrideDefaults):

2:09 PM Changeset in webkit [229518] by fpizlo@apple.com

• 22 edits
  1 add in trunk/Source

Split DirectArguments into JSValueOOB and JSValueStrict parts
​https://bugs.webkit.org/show_bug.cgi?id=183458

Reviewed by Yusuke Suzuki.
Source/JavaScriptCore:

Our Spectre plan for JSValue objects is to allow inline JSValue stores and loads guarded by
unmitigated structure checks. This works because objects reachable from JSValues (i.e. JSValue
objects, like String, Symbol, and any descendant of JSObject) will only contain fields that it's OK
to read and write within a Spectre mitigation window. Writes are important, because within the
window, a write could appear to be made speculatively and rolled out later. This means that:

• JSValue objects cannot have lengths, masks, or anything else inline.

• JSValue objects cannot have an inline type that is used as part of a Spectre mitigation for a type check, unless that type is in the form of a poison key.

This means that the dynamic poisoning that I previously landed for DirectArguments is wrong. It also
means that it's wrong for DirectArguments to have an inline length.

This changes DirectArguments to use poisoning according to the universal formula:

• The random accessed portions are out-of-line, pointed to by a poisoned pointer.

• No inline length.

Surprisingly, this is perf-neutral. It's probably perf-neutral because our compiler optimizations
amortize whatever cost there was.

• bytecode/AccessCase.cpp:

(JSC::AccessCase::generateWithGuard):

• dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h:

(JSC::DFG::CallCreateDirectArgumentsSlowPathGenerator::CallCreateDirectArgumentsSlowPathGenerator):

• dfg/DFGCallCreateDirectArgumentsWithKnownLengthSlowPathGenerator.h: Added.

(JSC::DFG::CallCreateDirectArgumentsWithKnownLengthSlowPathGenerator::CallCreateDirectArgumentsWithKnownLengthSlowPathGenerator):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
(JSC::DFG::SpeculativeJIT::compileGetArrayLength):
(JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
(JSC::DFG::SpeculativeJIT::compileGetFromArguments):
(JSC::DFG::SpeculativeJIT::compilePutToArguments):

• ftl/FTLAbstractHeapRepository.h:
• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
(JSC::FTL::DFG::LowerDFGToB3::compileGetFromArguments):
(JSC::FTL::DFG::LowerDFGToB3::compilePutToArguments):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckSubClass):
(JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedHeapCell):
(JSC::FTL::DFG::LowerDFGToB3::dynamicPoison): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::dynamicPoisonOnLoadedType): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::dynamicPoisonOnType): Deleted.

• heap/SecurityKind.h:
• jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_put_to_arguments):
(JSC::JIT::emitDirectArgumentsGetByVal):

• jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_put_to_arguments):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/DirectArguments.cpp:

(JSC::DirectArguments::DirectArguments):
(JSC::DirectArguments::createUninitialized):
(JSC::DirectArguments::create):
(JSC::DirectArguments::createByCopying):
(JSC::DirectArguments::estimatedSize):
(JSC::DirectArguments::visitChildren):
(JSC::DirectArguments::overrideThings):
(JSC::DirectArguments::copyToArguments):
(JSC::DirectArguments::mappedArgumentsSize):

• runtime/DirectArguments.h:
• runtime/JSCPoison.h:
• runtime/JSLexicalEnvironment.h:
• runtime/JSSymbolTableObject.h:
• runtime/VM.cpp:

(JSC::VM::VM):

• runtime/VM.h:

Source/WTF:

• wtf/MathExtras.h:

(WTF::dynamicPoison): Deleted.

12:52 PM Changeset in webkit [229517] by Yusuke Suzuki

• 5 edits in trunk/Source/JavaScriptCore

[B3] Above/Below should be strength-reduced for comparison with 0
​https://bugs.webkit.org/show_bug.cgi?id=183543

Reviewed by Filip Pizlo.

Above(0, x) and BelowEqual(0, x) can be converted to constants false and true respectively.
This can be seen in ArraySlice(0) case: Select(Above(0, length), length, 0) this should
be converted to 0. This patch adds such a folding to comparisons.

We also fix B3ReduceStrength issue creating an orphan value. If a flipped value is folded to
a constant, we do not insert flipped value and make it an orphan. This issue causes JSC test
failure with this B3Const32/64Value change. With this patch, we create a flipped value only
when we fail to fold it to a constant.

• b3/B3Const32Value.cpp:

(JSC::B3::Const32Value::lessThanConstant const):
(JSC::B3::Const32Value::greaterThanConstant const):
(JSC::B3::Const32Value::lessEqualConstant const):
(JSC::B3::Const32Value::greaterEqualConstant const):
(JSC::B3::Const32Value::aboveConstant const):
(JSC::B3::Const32Value::belowConstant const):
(JSC::B3::Const32Value::aboveEqualConstant const):
(JSC::B3::Const32Value::belowEqualConstant const):

• b3/B3Const64Value.cpp:

(JSC::B3::Const64Value::lessThanConstant const):
(JSC::B3::Const64Value::greaterThanConstant const):
(JSC::B3::Const64Value::lessEqualConstant const):
(JSC::B3::Const64Value::greaterEqualConstant const):
(JSC::B3::Const64Value::aboveConstant const):
(JSC::B3::Const64Value::belowConstant const):
(JSC::B3::Const64Value::aboveEqualConstant const):
(JSC::B3::Const64Value::belowEqualConstant const):

• b3/B3ReduceStrength.cpp:
• b3/testb3.cpp:

(JSC::B3::int64Operands):
(JSC::B3::int32Operands):

10:45 AM Changeset in webkit [229516] by fpizlo@apple.com

• 10 edits
  1 add in trunk/Source/bmalloc

PerProcess<> should be safe by default
​https://bugs.webkit.org/show_bug.cgi?id=183545

Reviewed by Yusuke Suzuki.

This makes PerProcess<> safe by default, so we don't need SafePerProcess<>.

The new PerProcess<> design relies on a hash-consing mechanism for PerProcess<> storage based
on the PRETTY_FUNCTION from inside PerProcess<>, which captures the instantiated type in
the string. Therefore, this can be used to runtime-coalesce PerProcess<> instances based on
type.

I expect this to be perf-neutral. It's an important prerequisite to more bmalloc work, since I
don't want to have more PerProcess<> vs SafePerProcess<> bugs, and SafePerProcess<> can't be
used for everything (I don't see how to use it for isoheaps).

• CMakeLists.txt:
• bmalloc.xcodeproj/project.pbxproj:
• bmalloc/Heap.cpp:

(bmalloc::Heap::Heap):

• bmalloc/IsoDirectoryInlines.h:

(bmalloc::passedNumPages>::takeFirstEligible):
(bmalloc::passedNumPages>::didBecome):

• bmalloc/PerProcess.cpp: Added.

(bmalloc::stringHash):
(bmalloc::allocate):
(bmalloc::getPerProcessData):

• bmalloc/PerProcess.h:

(bmalloc::PerProcess::mutex):
(bmalloc::PerProcess::coalesce):
(bmalloc::PerProcess::getSlowCase):
(): Deleted.

• bmalloc/Scavenger.cpp:
• bmalloc/Scavenger.h:
• bmalloc/bmalloc.cpp:

(bmalloc::api::scavenge):
(bmalloc::api::setScavengerThreadQOSClass):

Mar 10, 2018:

11:20 PM Changeset in webkit [229514] by Yusuke Suzuki

• 25 edits
  4 adds in trunk

[FTL] Drop NewRegexp for String.prototype.match with RegExp + global flag
​https://bugs.webkit.org/show_bug.cgi?id=181848

Reviewed by Sam Weinig.

JSTests:

• microbenchmarks/regexp-u-global-es5.js: Added.

(fn):

• microbenchmarks/regexp-u-global-es6.js: Added.

(fn):

• stress/materialized-regexp-has-correct-last-index-set-by-match-at-osr-exit.js: Added.

(shouldBe):
(test):
(i.switch):

• stress/materialized-regexp-has-correct-last-index-set-by-match.js: Added.

(shouldBe):
(test):

Source/JavaScriptCore:

In r181535, we support string.match(/nonglobal/) code. However, string.match(/global/g) is not
optimized since it sets lastIndex value before performing RegExp operation.

This patch optimizes the above "with a global flag" case by emitting SetRegExpObjectLastIndex properly.
RegExpMatchFast is converted to SetRegExpObjectLastIndex and RegExpMatchFastGlobal. The latter node
just holds RegExp (not RegExpObject) cell so that it can offer a chance to make NewRegexp PhantomNewRegexp
in object allocation sinking phase.

Added microbenchmarks shows that this patch makes NewRegexp PhantomNewRegexp even if the given RegExp
has a global flag. And it improves the performance.

baseline patched

regexp-u-global-es5 44.1298+-4.6128 ^{33.7920+-2.0110} definitely 1.3059x faster
regexp-u-global-es6 182.3272+-2.2861 ^{154.3414+-7.6769} definitely 1.1813x faster

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGMayExit.cpp:
• dfg/DFGNode.cpp:

(JSC::DFG::Node::convertToRegExpMatchFastGlobal):

• dfg/DFGNode.h:

(JSC::DFG::Node::hasHeapPrediction):
(JSC::DFG::Node::hasCellOperand):

• dfg/DFGNodeType.h:
• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileRegExpMatchFastGlobal):

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileRegExpMatchFastGlobal):

• runtime/RegExpObject.cpp:

(JSC::collectMatches): Deleted.

• runtime/RegExpObject.h:
• runtime/RegExpObjectInlines.h:

(JSC::RegExpObject::execInline):
(JSC::RegExpObject::matchInline):
(JSC::advanceStringUnicode):
(JSC::collectMatches):
(JSC::RegExpObject::advanceStringUnicode): Deleted.

• runtime/RegExpPrototype.cpp:

(JSC::advanceStringIndex):

11:16 PM Changeset in webkit [229513] by Yusuke Suzuki

• 3 edits in trunk/Source/JavaScriptCore

B3::reduceStrength should canonicalize integer comparisons
​https://bugs.webkit.org/show_bug.cgi?id=150958

Reviewed by Filip Pizlo.

This patch sorts operands of comparisons by flipping opcode. For example, Above(0, @2) is
converted to Below(@2, 0). This sorting is the same to handleCommutativity rule. Since we
canonicalize comparisons to have constant value at least on the right hand side, we can
remove pattern matchings checking leftImm in B3LowerToAir.

Since this flipping changes the opcode of the value, to achieve safely, we just create a
new value which has flipped opcode and swapped operands. If we can fold it to a constant,
we replace m_value with this constant. If we fail to fold it to constant, we replace
m_value with the flipped one.

These comparisons are already handled in testb3.

• b3/B3LowerToAir.cpp:
• b3/B3ReduceStrength.cpp:

5:49 PM Changeset in webkit [229512] by jer.noble@apple.com

• 2 edits
  3 copies
  1 move
  5 adds
  1 delete in trunk/Source/WebKit

Improvements to fullscreen; new UI and security features
​https://bugs.webkit.org/show_bug.cgi?id=183503

Reviewed by Dean Jackson.

Now that the iOS Fullscreen code has more than one major class, move it into an ios/
directory.

Clean up the WKFullScreenWindowControllerIOS class to more clearly separate external
facing API from purely internal functions.

Move the WKFullScreenViewController out into its own file. Add support for fullscreen
top inset and fullscreen autohide duration CSS constants.

Add a heuristic to distinguish between media control related touches and ones that look
more keyboard interactions.

Add a new UIStackView based control to hold the fullscreen controls.

• UIProcess/ios/WKFullScreenWindowControllerIOS.mm: Removed.
• UIProcess/ios/fullscreen/FullscreenTouchSecheuristic.cpp: Added.

(WebKit::FullscreenTouchSecheuristic::scoreOfNextTouch):
(WebKit::FullscreenTouchSecheuristic::reset):
(WebKit::FullscreenTouchSecheuristic::distanceScore):
(WebKit::FullscreenTouchSecheuristic::attenuationFactor):

• UIProcess/ios/fullscreen/FullscreenTouchSecheuristic.h:

(WebKit::FullscreenTouchSecheuristic::setRampUpSpeed):
(WebKit::FullscreenTouchSecheuristic::setRampDownSpeed):
(WebKit::FullscreenTouchSecheuristic::setXWeight):
(WebKit::FullscreenTouchSecheuristic::setYWeight):
(WebKit::FullscreenTouchSecheuristic::setSize):
(WebKit::FullscreenTouchSecheuristic::setGamma):
(WebKit::FullscreenTouchSecheuristic::setGammaCutoff):

• UIProcess/ios/fullscreen/WKFullScreenViewController.h:
• UIProcess/ios/fullscreen/WKFullScreenViewController.mm: Added.

(WKFullScreenViewControllerPlaybackSessionModelClient::setParent):
(WKFullScreenViewControllerPlaybackSessionModelClient::setInterface):
(-[_WKExtrinsicButton setExtrinsicContentSize:]):
(-[_WKExtrinsicButton intrinsicContentSize]):
(-[WKFullScreenViewController initWithWebView:]):
(-[WKFullScreenViewController dealloc]):
(-[WKFullScreenViewController showUI]):
(-[WKFullScreenViewController hideUI]):
(-[WKFullScreenViewController videoControlsManagerDidChange]):
(-[WKFullScreenViewController setPrefersStatusBarHidden:]):
(-[WKFullScreenViewController setPlaying:]):
(-[WKFullScreenViewController setPictureInPictureActive:]):
(-[WKFullScreenViewController loadView]):
(-[WKFullScreenViewController viewWillAppear:]):
(-[WKFullScreenViewController viewDidLayoutSubviews]):
(-[WKFullScreenViewController viewWillTransitionToSize:withTransitionCoordinator:]):
(-[WKFullScreenViewController preferredStatusBarStyle]):
(-[WKFullScreenViewController prefersStatusBarHidden]):
(-[WKFullScreenViewController gestureRecognizer:shouldRecognizeSimultaneouslyWithGestureRecognizer:]):
(-[WKFullScreenViewController gestureRecognizer:shouldReceiveTouch:]):
(-[WKFullScreenViewController _manager]):
(-[WKFullScreenViewController _effectiveFullscreenInsetTop]):
(-[WKFullScreenViewController _cancelAction:]):
(-[WKFullScreenViewController _togglePiPAction:]):
(-[WKFullScreenViewController _touchDetected:]):
(-[WKFullScreenViewController _statusBarFrameDidChange:]):
(-[WKFullScreenViewController _updateWebViewFullscreenInsets]):
(-[WKFullScreenViewController _showPhishingAlert]):

• UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.h: Copied from Source/WebKit/UIProcess/ios/WKFullScreenWindowControllerIOS.h.
• UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm: Added.

(WebKit::replaceViewWithView):
(WebKit::WKWebViewState::applyTo):
(WebKit::WKWebViewState::store):
(-[WKFullscreenAnimationController transitionDuration:]):
(-[WKFullscreenAnimationController configureInitialAndFinalStatesForTransition:]):
(-[WKFullscreenAnimationController animateTransition:]):
(-[WKFullscreenAnimationController animationEnded:]):
(-[WKFullscreenAnimationController startInteractiveTransition:]):
(-[WKFullscreenAnimationController updateWithPercent:]):
(-[WKFullscreenAnimationController updateWithPercent:translation:anchor:]):
(-[WKFullscreenAnimationController end:]):
(-[WKFullScreenInteractiveTransition initWithAnimator:anchor:]):
(-[WKFullScreenInteractiveTransition wantsInteractiveStart]):
(-[WKFullScreenInteractiveTransition startInteractiveTransition:]):
(-[WKFullScreenInteractiveTransition updateInteractiveTransition:withTranslation:]):
(-[WKFullScreenInteractiveTransition cancelInteractiveTransition]):
(-[WKFullScreenInteractiveTransition finishInteractiveTransition]):
(-[WKFullScreenWindowController initWithWebView:]):
(-[WKFullScreenWindowController dealloc]):
(-[WKFullScreenWindowController isFullScreen]):
(-[WKFullScreenWindowController webViewPlaceholder]):
(-[WKFullScreenWindowController enterFullScreen]):
(-[WKFullScreenWindowController beganEnterFullScreenWithInitialFrame:finalFrame:]):
(-[WKFullScreenWindowController requestExitFullScreen]):
(-[WKFullScreenWindowController exitFullScreen]):
(-[WKFullScreenWindowController beganExitFullScreenWithInitialFrame:finalFrame:]):
(-[WKFullScreenWindowController _completedExitFullScreen]):
(-[WKFullScreenWindowController close]):
(-[WKFullScreenWindowController webViewDidRemoveFromSuperviewWhileInFullscreen]):
(-[WKFullScreenWindowController videoControlsManagerDidChange]):
(-[WKFullScreenWindowController gestureRecognizer:shouldRecognizeSimultaneouslyWithGestureRecognizer:]):
(-[WKFullScreenWindowController animationControllerForPresentedController:presentingController:sourceController:]):
(-[WKFullScreenWindowController animationControllerForDismissedController:]):
(-[WKFullScreenWindowController interactionControllerForDismissal:]):
(-[WKFullScreenWindowController _exitFullscreenImmediately]):
(-[WKFullScreenWindowController _invalidateEVOrganizationName]):
(-[WKFullScreenWindowController _isSecure]):
(-[WKFullScreenWindowController _serverTrust]):
(-[WKFullScreenWindowController _EVOrganizationName]):
(-[WKFullScreenWindowController _updateLocationInfo]):
(-[WKFullScreenWindowController _manager]):
(-[WKFullScreenWindowController _startToDismissFullscreenChanged:]):
(-[WKFullScreenWindowController _interactiveDismissChanged:]):

• UIProcess/ios/fullscreen/WKFullscreenStackView.h: Renamed from Source/WebKit/UIProcess/ios/WKFullScreenWindowControllerIOS.h.
• UIProcess/ios/fullscreen/WKFullscreenStackView.mm: Added.

(+[WKFullscreenStackView baseEffects]):
(+[WKFullscreenStackView configureView:forTintEffectWithColor:filterType:]):
(+[WKFullscreenStackView configureView:withBackgroundFillOfColor:opacity:filter:]):
(+[WKFullscreenStackView secondaryMaterialOverlayView]):
(+[WKFullscreenStackView applyPrimaryGlyphTintToView:]):
(+[WKFullscreenStackView applySecondaryGlyphTintToView:]):
(-[WKFullscreenStackView initWithArrangedSubviews:axis:]):
(-[WKFullscreenStackView setTargetViewForSecondaryMaterialOverlay:]):
(-[WKFullscreenStackView contentView]):
(-[WKFullscreenStackView _setArrangedSubviews:axis:]):
(-[WKFullscreenStackView setBounds:]):
(-[WKFullscreenStackView updateConstraints]):

• WebKit.xcodeproj/project.pbxproj:

5:38 PM Changeset in webkit [229511] by Megan Gardner

• 17 edits in trunk/Source

Media query for default appearance
​https://bugs.webkit.org/show_bug.cgi?id=183539
<rdar://problem/38326388>

Reviewed by Tim Horton.

Source/WebCore:

Not currently testable, will add tests in a later patch.

Write a media query to evaluate appearance.

• css/CSSValueKeywords.in:
• css/MediaFeatureNames.h:
• css/MediaQueryEvaluator.cpp:

(WebCore::defaultAppearanceEvaluate):

• css/MediaQueryExpression.cpp:

(WebCore::featureWithValidIdent):
(WebCore::isFeatureValidWithoutValue):

• page/Page.h:

(WebCore::Page::defaultAppearance const):
(WebCore::Page::setDefaultAppearance):

Source/WebKit:

Write a media query to evaluate appearance.

• Shared/WebPageCreationParameters.cpp:

(WebKit::WebPageCreationParameters::encode const):
(WebKit::WebPageCreationParameters::decode):

• Shared/WebPageCreationParameters.h:
• UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _initializeWithConfiguration:]):
(-[WKWebView _setUseSystemAppearance:]):

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::creationParameters):
(WebKit::WebPageProxy::setDefaultAppearance):

• UIProcess/WebPageProxy.h:

(WebKit::WebPageProxy::defaultAppearance const):

• WebProcess/WebPage/WebPage.cpp:

(WebKit::m_credentialsMessenger):
(WebKit::WebPage::setDefaultAppearance):

• WebProcess/WebPage/WebPage.h:
• WebProcess/WebPage/WebPage.messages.in:

Source/WebKitLegacy/mac:

Write a media query to evaluate appearance.

• WebView/WebView.mm:

(-[WebView _commonInitializationWithFrameName:groupName:]):
(-[WebView _setUseSystemAppearance:]):

3:26 PM Changeset in webkit [229510] by dbates@webkit.org

• 6 edits in trunk/Source/WebCore

InlineTextBox should own shadow data
​https://bugs.webkit.org/show_bug.cgi?id=183359
<rdar://problem/38171343>

Reviewed by Darin Adler.

Following r229147 we recompute the selection style, including any shadow data, whenever we
paint the inline text box. Therefore, InlineTextBox needs to take ownership of the shadow
data or it may be deallocated before it can be used.

Covered by existing tests.

• rendering/InlineTextBox.cpp: Changed data type of InlineTextBox::MarkedTextStyle::textShadow

from const ShadowData* to std::optional<ShadowData>. Also removed explicitly deleted equality
and inequality operators as they are unnecessary. Layout tests should catch if these are ever
implemented and used when painting because the painted results will be wrong.
(WebCore::InlineTextBox::computeStyleForUnmarkedMarkedText const): Clone ShadowData.
(WebCore::InlineTextBox::resolveStyleForMarkedText): Simplified logic.
(WebCore::InlineTextBox::paintMarkedTextForeground): Modified code now that MarkedTextStyle
holds a std::optional<ShadowData>.
(WebCore::InlineTextBox::paintMarkedTextDecoration): Ditto.

• rendering/TextPaintStyle.cpp:

(WebCore::computeTextSelectionPaintStyle): Changed the out parameter type from const ShadowData*
to std::optional<ShadowData>& and modified code as needed.

• rendering/TextPaintStyle.h:
• rendering/style/ShadowData.cpp: Removed unncessary #include of header LayoutRect.h.

This header will be included via ShadowData.h.
(WebCore::ShadowData::clone): Convenience method that returns an std::optional to a
cloned ShadowData object.

• rendering/style/ShadowData.h:

1:43 PM Changeset in webkit [229509] by jmarcell@apple.com

• 4 edits in tags/Safari-606.1.7.1/Source/JavaScriptCore

Cherry-pick r229506. rdar://problem/38316707

1:37 PM Changeset in webkit [229508] by jmarcell@apple.com

• 7 edits in tags/Safari-606.1.7.1/Source

Versioning.

1:34 PM Changeset in webkit [229507] by jmarcell@apple.com

• 1 copy in tags/Safari-606.1.7.1

New tag.

12:13 PM Changeset in webkit [229506] by mark.lam@apple.com

• 4 edits in trunk/Source/JavaScriptCore

offlineasm should reset the Assembler's working state before doing another pass for a new target.
​https://bugs.webkit.org/show_bug.cgi?id=183538
<rdar://problem/38325955>

Reviewed by Michael Saboff.

• llint/LowLevelInterpreter.cpp:
• offlineasm/asm.rb:
• offlineasm/cloop.rb:

11:31 AM Changeset in webkit [229505] by Alan Bujtas

• 3 edits
  2 adds in trunk

Turn off offset*/scroll* optimization for input elements with shadow content
​https://bugs.webkit.org/show_bug.cgi?id=182383
<rdar://problem/37114190>

Reviewed by Antti Koivisto.

Source/WebCore:

We normally ensure clean tree before calling offsetHeight/Width, scrollHeight/Width.
In certain cases (see updateLayoutIfDimensionsOutOfDate() for details), it's okay to return
the previously computed values even when some part of the tree is dirty.
In case of shadow content, updateLayoutIfDimensionsOutOfDate() might return false (no need to layout)
for the root, while true (needs layout) for the shadow content.
This could confuse the caller (Element::scrollWidth/Height etc) and lead to incorrect result.

Test: fast/forms/scrollheight-with-mutation-crash.html

• dom/Document.cpp:

(WebCore::Document::updateLayoutIfDimensionsOutOfDate):

LayoutTests:

• fast/forms/scrollheight-with-mutation-crash-expected.txt: Added.
• fast/forms/scrollheight-with-mutation-crash.html: Added.

9:28 AM Changeset in webkit [229504] by commit-queue@webkit.org

• 8 edits in trunk/Source

Unreviewed, rolling out r229436.
​https://bugs.webkit.org/show_bug.cgi?id=183542

seems to have regressed wasm compile times by 10% (Requested
by pizlo-mbp on #webkit).

Reverted changeset:

"bmalloc mutex should be adaptive"
​https://bugs.webkit.org/show_bug.cgi?id=177839
​https://trac.webkit.org/changeset/229436

3:33 AM Changeset in webkit [229503] by Wenson Hsieh

• 15 edits in trunk

[macOS] Copying a table from the Numbers app and pasting into iCloud Numbers fails
​https://bugs.webkit.org/show_bug.cgi?id=183485
<rdar://problem/38041984>

Reviewed by Ryosuke Niwa.

Source/WebCore:

After r222656, WebKit now treats raw image data on the pasteboard as files for the purposes of computing
DataTransfer.files and DataTransfer.types. However, this is combined with existing policies that suppress
DataTransfer.getData and DataTransfer.setData when the pasteboard contains files (generalized to copy/paste in
r222688). This means we now don't allow web pages to access "text/plain" in the case where the user copies part
of a table from the native Numbers app since Numbers additionally writes a snapshot of the table to the platform
pasteboard.

This restriction on getData/setData was intended to prevent web pages from extracting users' file paths when
pasting or dropping, so it doesn't make sense to enforce this restriction even when there is only in-memory
image data on the pasteboard. To fix this bug, we make Pasteboard::fileContentState() differentiate between
cases where there are (real) files on the pasteboard, and cases where we've fallen back to treating image data
as files.

Rebaselined existing LayoutTests to match new behavior.
Also covered by 4 new API tests:

• PasteMixedContent.ImageDataAndPlainText
• PasteMixedContent.ImageDataAndPlainTextAndURL
• PasteMixedContent.ImageDataAndPlainTextAndURLAndHTML
• UIPasteboardTests.DataTransferGetDataWhenPastingImageAndText

• dom/DataTransfer.cpp:

(WebCore::DataTransfer::shouldSuppressGetAndSetDataToAvoidExposingFilePaths const):

If custom pasteboard data is enabled, suppress getData and setData if and only if we might actually expose file
paths (see Pasteboard::fileContentState).

(WebCore::DataTransfer::types const):

Only allow "text/html" or "text/uri-list" in the case where there are actual files in the pasteboard. If there's
only image data, add all of the DOM-safe types back into the list of types.

• platform/Pasteboard.h:
• platform/StaticPasteboard.h:

Add an enum type to represent the result of Pasteboard::fileContentState.

• NoFileOrImageData indicates that there was nothing on the pasteboard that could be considered a file

from the point of view of the page.

• InMemoryImage indicates that there are no files on the pasteboard, but there is image data that we consider

to be files, exposed via DataTransfer API.

• MayContainFilePaths indicates that there might be file paths on the pasteboard. This means that the source

has either written file paths to the pasteboard (for example, through NSFilenamesPboardType) or the source
has written image data along with a URL type of some sort that does not match one of the allowed URL schemes
that are safe to expose (currently, these are http-family, data, or blob).

• platform/cocoa/PasteboardCocoa.mm:

(WebCore::Pasteboard::fileContentState):

Refactor to return one of the three enum types described above.

(WebCore::Pasteboard::containsFiles): Deleted.

• platform/gtk/PasteboardGtk.cpp:

(WebCore::Pasteboard::fileContentState):
(WebCore::Pasteboard::containsFiles): Deleted.

• platform/win/PasteboardWin.cpp:

(WebCore::Pasteboard::fileContentState):
(WebCore::Pasteboard::containsFiles): Deleted.

• platform/wpe/PasteboardWPE.cpp:

(WebCore::Pasteboard::fileContentState):
(WebCore::Pasteboard::containsFiles): Deleted.

Adjust for Pasteboard::fileContentState() tweaks.

Tools:

Add new API tests to cover scenarios in which we paste image data alongside text data.

• TestWebKitAPI/Tests/WebKitCocoa/PasteMixedContent.mm:

(TestWebKitAPI::TEST):

• TestWebKitAPI/Tests/ios/UIPasteboardTests.mm:

(TestWebKitAPI::TEST):

LayoutTests:

Rebaseline some pasteboard-related layout tests, in which we now expose text/plain alongside files that were
written to the DataTransfer by the page itself.

• editing/pasteboard/data-transfer-item-list-add-file-multiple-times-expected.txt:
• editing/pasteboard/data-transfer-item-list-add-file-on-copy-expected.txt:
• editing/pasteboard/data-transfer-item-list-add-file-on-drag-expected.txt: