Timeline
Apr 1, 2018:
- 10:59 PM Changeset in webkit [230149] by
-
- 5 edits in trunk/Source/WebInspectorUI
Web Inspector: Remove dead TabBrowser/TabContentView code
https://bugs.webkit.org/show_bug.cgi?id=184104
Reviewed by Devin Rousso.
- UserInterface/Base/Main.js:
(WI._tryToRestorePendingTabs):
- UserInterface/Views/NewTabContentView.js:
(WI.NewTabContentView.prototype.shown):
(WI.NewTabContentView.prototype.hidden):
- UserInterface/Views/TabBrowser.js:
(WI.TabBrowser.prototype.addTabForContentView):
(WI.TabBrowser.prototype.showTabForContentView):
(WI.TabBrowser._tabBarItemRemoved):
- UserInterface/Views/TabContentView.js:
(WI.TabContentView.prototype.get parentTabBrowser): Deleted.
(WI.TabContentView.prototype.set parentTabBrowser): Deleted.
- 10:03 PM Changeset in webkit [230148] by
-
- 3 edits1 add in trunk/Tools
[LayoutReloaded] Use containing block's contentBox left edge when the float is to the right.
https://bugs.webkit.org/show_bug.cgi?id=184230
Reviewed by Antti Koivisto.
- LayoutReloaded/FormattingContext/InlineFormatting/InlineFormattingContext.js:
(InlineFormattingContext.prototype._mapFloatingPosition):
(InlineFormattingContext):
- LayoutReloaded/test/index.html:
- LayoutReloaded/test/inline-formatting-context-with-floats2.html: Added.
- 8:18 PM Changeset in webkit [230147] by
-
- 7 edits in trunk/Source/WebCore
Use WTF::Lock instead of GMutex
https://bugs.webkit.org/show_bug.cgi?id=184227
Reviewed by Saam Barati.
Prefer WTF::Lock over GMutex since these locks are just protecting WebKit C++ fields.
No behavior change.
- platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp:
(WebCore::AudioSourceProviderGStreamer::AudioSourceProviderGStreamer):
(WebCore::AudioSourceProviderGStreamer::~AudioSourceProviderGStreamer):
(WebCore::AudioSourceProviderGStreamer::provideInput):
(WebCore::AudioSourceProviderGStreamer::handleAudioBuffer):
(WebCore::AudioSourceProviderGStreamer::clearAdapters):
- platform/audio/gstreamer/AudioSourceProviderGStreamer.h:
- platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
(WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):
(WebCore::MediaPlayerPrivateGStreamerBase::naturalSize const):
(WebCore::MediaPlayerPrivateGStreamerBase::pushTextureToCompositor):
(WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
(WebCore::MediaPlayerPrivateGStreamerBase::flushCurrentBuffer):
(WebCore::MediaPlayerPrivateGStreamerBase::paint):
(WebCore::MediaPlayerPrivateGStreamerBase::copyVideoTextureToPlatformTexture):
(WebCore::MediaPlayerPrivateGStreamerBase::nativeImageForCurrentTime):
- platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
- platform/graphics/gstreamer/mse/PlaybackPipeline.cpp:
- platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.cpp:
- 7:04 PM Changeset in webkit [230146] by
-
- 5 edits in trunk
Show punycode if URL contains hyphen character
https://bugs.webkit.org/show_bug.cgi?id=184221
<rdar://problem/38044633>
Reviewed by Darin Adler.
Source/WebCore:
Revise our "lookalike character" logic to include the hyphen,
non-breaking hyphen, and minus sign.
Test: fast/url/host.html
- platform/mac/WebCoreNSURLExtras.mm:
(WebCore::isLookalikeCharacter):
LayoutTests:
- fast/url/host-expected.txt:
- fast/url/host.html:
- 12:46 PM Changeset in webkit [230145] by
-
- 2 edits in trunk/Source/JavaScriptCore
Raise the for-call inlining threshold to 190 to fix JetStream/richards regression
https://bugs.webkit.org/show_bug.cgi?id=184228
Reviewed by Yusuke Suzuki.
- runtime/Options.h:
- 10:57 AM Changeset in webkit [230144] by
-
- 54 edits in trunk/Source
JSObject shouldn't do index masking
https://bugs.webkit.org/show_bug.cgi?id=184194
Reviewed by Yusuke Suzuki.
Source/JavaScriptCore:
Remove index masking, because it's not the way we'll mitigate Spectre.
- API/tests/JSObjectGetProxyTargetTest.cpp:
(testJSObjectGetProxyTarget):
- b3/B3LowerToAir.cpp:
- b3/B3Validate.cpp:
- b3/B3WasmBoundsCheckValue.cpp:
(JSC::B3::WasmBoundsCheckValue::WasmBoundsCheckValue):
(JSC::B3::WasmBoundsCheckValue::dumpMeta const):
- b3/B3WasmBoundsCheckValue.h:
(JSC::B3::WasmBoundsCheckValue::bounds const):
(JSC::B3::WasmBoundsCheckValue::pinnedIndexingMask const): Deleted.
- b3/testb3.cpp:
(JSC::B3::testWasmBoundsCheck):
(JSC::B3::run):
- dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
- dfg/DFGArgumentsEliminationPhase.cpp:
- dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
- dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
- dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
- dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
- dfg/DFGNodeType.h:
- dfg/DFGPredictionPropagationPhase.cpp:
- dfg/DFGSSALoweringPhase.cpp:
(JSC::DFG::SSALoweringPhase::handleNode):
- dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
- dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::SpeculativeJIT):
(JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
(JSC::DFG::SpeculativeJIT::loadFromIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
(JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
(JSC::DFG::SpeculativeJIT::compileCreateActivation):
(JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
(JSC::DFG::SpeculativeJIT::compileArraySlice):
(JSC::DFG::SpeculativeJIT::compileNewStringObject):
(JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
(JSC::DFG::SpeculativeJIT::compileNewRegexp):
(JSC::DFG::SpeculativeJIT::compileCreateThis):
(JSC::DFG::SpeculativeJIT::compileNewObject):
- dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
(JSC::DFG::SpeculativeJIT::emitAllocateJSObjectWithKnownSize):
- dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
- dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
- ftl/FTLAbstractHeapRepository.h:
- ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
- ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileAtomicsReadModifyWrite):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
(JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
(JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):
(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
(JSC::FTL::DFG::LowerDFGToB3::allocateObject):
(JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
(JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
(JSC::FTL::DFG::LowerDFGToB3::pointerIntoTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::compileGetArrayMask): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::maskedIndex): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::computeButterflyIndexingMask): Deleted.
- jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::emitAllocateJSObject):
(JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
(JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
(JSC::AssemblyHelpers::emitAllocateDestructibleObject):
- jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emit_op_create_this):
- jit/JITOperations.cpp:
- jit/JITPropertyAccess.cpp:
(JSC::JIT::emitDoubleLoad):
(JSC::JIT::emitContiguousLoad):
(JSC::JIT::emitArrayStorageLoad):
- llint/LowLevelInterpreter32_64.asm:
- llint/LowLevelInterpreter64.asm:
- runtime/Butterfly.h:
(JSC::ContiguousData::at const):
(JSC::ContiguousData::at):
(JSC::Butterfly::computeIndexingMask const): Deleted.
- runtime/ButterflyInlines.h:
(JSC::ContiguousData<T>::at const): Deleted.
(JSC::ContiguousData<T>::at): Deleted.
- runtime/ClonedArguments.cpp:
(JSC::ClonedArguments::createEmpty):
- runtime/JSArray.cpp:
(JSC::JSArray::tryCreateUninitializedRestricted):
(JSC::JSArray::appendMemcpy):
(JSC::JSArray::setLength):
(JSC::JSArray::pop):
(JSC::JSArray::shiftCountWithAnyIndexingType):
(JSC::JSArray::unshiftCountWithAnyIndexingType):
(JSC::JSArray::fillArgList):
(JSC::JSArray::copyToArguments):
- runtime/JSArrayBufferView.cpp:
(JSC::JSArrayBufferView::JSArrayBufferView):
- runtime/JSArrayInlines.h:
(JSC::JSArray::pushInline):
- runtime/JSFixedArray.h:
- runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
- runtime/JSObject.cpp:
(JSC::JSObject::getOwnPropertySlotByIndex):
(JSC::JSObject::putByIndex):
(JSC::JSObject::createInitialUndecided):
(JSC::JSObject::createInitialInt32):
(JSC::JSObject::createInitialDouble):
(JSC::JSObject::createInitialContiguous):
(JSC::JSObject::createArrayStorage):
(JSC::JSObject::convertUndecidedToInt32):
(JSC::JSObject::convertUndecidedToDouble):
(JSC::JSObject::convertUndecidedToContiguous):
(JSC::JSObject::convertUndecidedToArrayStorage):
(JSC::JSObject::convertInt32ToDouble):
(JSC::JSObject::convertInt32ToArrayStorage):
(JSC::JSObject::convertDoubleToContiguous):
(JSC::JSObject::convertDoubleToArrayStorage):
(JSC::JSObject::convertContiguousToArrayStorage):
(JSC::JSObject::createInitialForValueAndSet):
(JSC::JSObject::deletePropertyByIndex):
(JSC::JSObject::getOwnPropertyNames):
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
(JSC::JSObject::countElements):
(JSC::JSObject::increaseVectorLength):
(JSC::JSObject::ensureLengthSlow):
(JSC::JSObject::reallocateAndShrinkButterfly):
(JSC::JSObject::getEnumerableLength):
- runtime/JSObject.h:
(JSC::JSObject::canGetIndexQuickly):
(JSC::JSObject::getIndexQuickly):
(JSC::JSObject::tryGetIndexQuickly const):
(JSC::JSObject::setIndexQuickly):
(JSC::JSObject::initializeIndex):
(JSC::JSObject::initializeIndexWithoutBarrier):
(JSC::JSObject::butterflyOffset):
(JSC::JSObject::setButterfly):
(JSC::JSObject::nukeStructureAndSetButterfly):
(JSC::JSObject::JSObject):
(JSC::JSObject::butterflyIndexingMaskOffset): Deleted.
(JSC::JSObject::butterflyIndexingMask const): Deleted.
(JSC::JSObject::setButterflyWithIndexingMask): Deleted.
- runtime/JSObjectInlines.h:
(JSC::JSObject::prepareToPutDirectWithoutTransition):
(JSC::JSObject::putDirectInternal):
- runtime/RegExpMatchesArray.h:
(JSC::tryCreateUninitializedRegExpMatchesArray):
- runtime/Structure.cpp:
(JSC::Structure::flattenDictionaryStructure):
- wasm/WasmB3IRGenerator.cpp:
(JSC::Wasm::B3IRGenerator::B3IRGenerator):
(JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
(JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
(JSC::Wasm::B3IRGenerator::load):
(JSC::Wasm::B3IRGenerator::store):
(JSC::Wasm::B3IRGenerator::addCallIndirect):
- wasm/WasmBinding.cpp:
(JSC::Wasm::wasmToWasm):
- wasm/WasmInstance.h:
(JSC::Wasm::Instance::updateCachedMemory):
(JSC::Wasm::Instance::offsetOfCachedMemorySize):
(JSC::Wasm::Instance::offsetOfCachedIndexingMask): Deleted.
- wasm/WasmMemory.cpp:
(JSC::Wasm::Memory::Memory):
(JSC::Wasm::Memory::grow):
- wasm/WasmMemory.h:
(JSC::Wasm::Memory::size const):
(JSC::Wasm::Memory::offsetOfSize):
(JSC::Wasm::Memory::indexingMask): Deleted.
(JSC::Wasm::Memory::offsetOfIndexingMask): Deleted.
- wasm/WasmMemoryInformation.cpp:
(JSC::Wasm::PinnedRegisterInfo::get):
(JSC::Wasm::PinnedRegisterInfo::PinnedRegisterInfo):
- wasm/WasmMemoryInformation.h:
(JSC::Wasm::PinnedRegisterInfo::toSave const):
- wasm/js/JSToWasm.cpp:
(JSC::Wasm::createJSToWasmWrapper):
Source/WebCore:
No new tests because no new behavior.
- bindings/js/JSDOMConvertSequences.h:
(WebCore::Detail::NumericSequenceConverter::convertArray):
(WebCore::Detail::SequenceConverter::convertArray):
- 10:08 AM Changeset in webkit [230143] by
-
- 3 edits2 adds in trunk
JSC crash in JIT code with for-of loop and Array/Set iterators
https://bugs.webkit.org/show_bug.cgi?id=183174
Reviewed by Saam Barati.
JSTests:
- microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js: Added. This test shows that fixing the bug didn't break hoisting of GetByOffset with inferred types. I confirmed that if I did break it, this test slows down by >7x.
(foo):
- stress/hoist-get-by-offset-with-control-dependent-inferred-type.js: Added. This test shows that the bug is fixed.
(f):
Source/JavaScriptCore:
- dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute): Fix the bug by making GetByOffset and friends verify that they are getting the type proof they want at the desired hoisting site.
- 9:47 AM Changeset in webkit [230142] by
-
- 3 edits1 add in trunk/Tools
[LayoutReloaded] Right floating box reduces available line width.
https://bugs.webkit.org/show_bug.cgi?id=184226
Reviewed by Antti Koivisto.
- LayoutReloaded/FormattingContext/InlineFormatting/InlineFormattingContext.js:
(InlineFormattingContext.prototype._createNewLine):
- LayoutReloaded/test/index.html:
- LayoutReloaded/test/inline-with-floats-right-left-simple.html: Added.
Mar 31, 2018:
- 10:37 PM Changeset in webkit [230141] by
-
- 5 edits1 add in trunk/Tools
[LayoutReloaded] Floating box reduces line with in inline formatting context
https://bugs.webkit.org/show_bug.cgi?id=184223
Reviewed by Antti Koivisto.
- LayoutReloaded/FormattingContext/FloatingContext.js:
(FloatingContext.prototype.left):
(FloatingContext.prototype.right):
(FloatingContext.prototype._mapDisplayMarginBoxToFormattingRoot):
(FloatingContext.prototype._mapBorderBoxToFormattingRoot):
(FloatingContext.prototype._mapContentBoxToFormattingRoot):
(FloatingContext.prototype.formattingRoot):
(FloatingContext.prototype._floatingState):
(FloatingContext.prototype._formattingRoot): Deleted.
- LayoutReloaded/FormattingContext/InlineFormatting/InlineFormattingContext.js:
(InlineFormattingContext.prototype._createNewLine):
(InlineFormattingContext.prototype._mapFloatingPosition):
(InlineFormattingContext):
- LayoutReloaded/FormattingState/FormattingState.js:
(FormattingState.prototype.displayBox):
(FormattingState):
- LayoutReloaded/test/index.html:
- LayoutReloaded/test/inline-formatting-context-with-floats.html: Added.
- 8:07 PM Changeset in webkit [230140] by
-
- 5 edits in trunk/Tools
[LayoutReloaded] InlineFormattingState should inherit the floating state from its parent formatting state
https://bugs.webkit.org/show_bug.cgi?id=184220
Reviewed by Antti Koivisto.
If the block container box that initiates an inline formatting context also establishes a block context,
create a new float state, otherwise use the existing one.
- LayoutReloaded/FormattingContext/BlockFormatting/BlockFormattingContext.js:
(BlockFormattingContext.prototype._contentHeight):
- LayoutReloaded/FormattingState/InlineFormattingState.js:
(InlineFormattingState):
- LayoutReloaded/LayoutState.js:
(LayoutState.prototype.establishedFormattingState):
(LayoutState.prototype.formattingStateForBox):
(LayoutState.prototype.formattingState): Deleted.
- LayoutReloaded/Utils.js:
- 7:44 PM Changeset in webkit [230139] by
-
- 3 edits in trunk/Tools
[LayoutReloaded] FloatingContext does not need a parent formatting context.
https://bugs.webkit.org/show_bug.cgi?id=184219
Reviewed by Antti Koivisto.
We don't need the formatting context in the FloatingContext now that margins are moved over to Display.Box.
This is in preparation for being able to create a FloatingContext for an inline formatting context,
when the inline context actually inherits the floating state from its formatting root.
- LayoutReloaded/FormattingContext/FloatingContext.js:
(FloatingContext):
(FloatingContext.prototype._availableSpace):
(FloatingContext.prototype._adjustedFloatingPosition):
(FloatingContext.prototype._addFloatingBox):
(FloatingContext.prototype._formattingContext): Deleted.
- LayoutReloaded/FormattingContext/FormattingContext.js:
(FormattingContext):
- 7:24 PM Changeset in webkit [230138] by
-
- 4 edits in trunk/Tools
[LayoutReloaded] Do not clone Display.Box for FloatingState stacks.
https://bugs.webkit.org/show_bug.cgi?id=184218
Reviewed by Antti Koivisto.
Now that Display.Box is in a tree context, we can't just clone it for the purpose of caching its absolute position.
- LayoutReloaded/DisplayTree/Box.js:
(Display.Box.prototype.clone): Deleted.
- LayoutReloaded/FormattingContext/FloatingContext.js:
(FloatingContext.prototype._positionForFloating):
(FloatingContext.prototype._moveToNextVerticalPosition):
(FloatingContext.prototype._availableSpace):
(FloatingContext.prototype._findFloatingAtVerticalPosition):
(FloatingContext.prototype._adjustedFloatingPosition):
(FloatingContext.prototype._bottom):
(FloatingContext.prototype._addFloatingBox):
(FloatingContext.prototype._mapMarginBoxToFormattingRoot):
(FloatingContext.prototype._mapDisplayMarginBoxToFormattingRoot):
- LayoutReloaded/FormattingState/FloatingState.js:
(FloatingState.prototype.addFloating):
- 7:07 PM Changeset in webkit [230137] by
-
- 5 edits in trunk/Tools
[LayoutReloaded] Remove all FormattingContext::absolute*Box functions.
https://bugs.webkit.org/show_bug.cgi?id=184215
Reviewed by Antti Koivisto.
Use Display.Box instead.
- LayoutReloaded/FormattingContext/BlockFormatting/BlockFormattingContext.js:
(BlockFormattingContext.prototype._computeOutOfFlowPosition):
- LayoutReloaded/FormattingContext/FloatingContext.js:
(FloatingContext.prototype._availableSpace):
(FloatingContext.prototype._adjustedFloatingPosition):
(FloatingContext.prototype._mapBorderBoxToFormattingRoot):
(FloatingContext.prototype._mapContentBoxToFormattingRoot):
- LayoutReloaded/FormattingContext/FormattingContext.js:
(FormattingContext.prototype.absoluteBorderBox): Deleted.
(FormattingContext.prototype.absolutePaddingBox): Deleted.
(FormattingContext.prototype.absoluteContentBox): Deleted.
(FormattingContext.prototype._toAbsolutePosition): Deleted.
(FormattingContext.prototype._toRootAbsolutePosition): Deleted.
- LayoutReloaded/Utils.js:
(Utils.mapPosition):
(Utils.marginBox):
(Utils.borderBox):
(Utils.contentBox):
- 6:12 PM Changeset in webkit [230136] by
-
- 4 edits in trunk/Tools
[LayoutReloaded] Remove FormattingContext::absoluteMarginBox
https://bugs.webkit.org/show_bug.cgi?id=184213
Reviewed by Antti Koivisto.
Display.Box already has the margin values.
- LayoutReloaded/FormattingContext/FloatingContext.js:
(FloatingContext.prototype._positionForFloating):
(FloatingContext.prototype._addFloatingBox):
(FloatingContext.prototype._mapMarginBoxToFormattingRoot):
(FloatingContext.prototype._formattingRoot):
- LayoutReloaded/FormattingContext/FormattingContext.js:
(FormattingContext.prototype.absoluteMarginBox): Deleted.
- LayoutReloaded/Utils.js:
(Utils.marginBox):
- 5:50 PM Changeset in webkit [230135] by
-
- 4 edits in trunk/Tools
[layoutReloaded] Introduce margin to Display.Box
https://bugs.webkit.org/show_bug.cgi?id=184212
Reviewed by Antti Koivisto.
This is in preparation for moving margin box out of formatting context to Display.Box.
- LayoutReloaded/DisplayTree/Box.js:
(Display.Box):
(Display.Box.prototype.setRect):
(Display.Box.prototype.setTopLeft):
(Display.Box.prototype.setTop):
(Display.Box.prototype.setLeft):
(Display.Box.prototype.setSize):
(Display.Box.prototype.setWidth):
(Display.Box.prototype.setHeight):
(Display.Box.prototype.width):
(Display.Box.prototype.setMarginTop):
(Display.Box.prototype.setMarginLeft):
(Display.Box.prototype.setMarginBottom):
(Display.Box.prototype.setMarginRight):
(Display.Box.prototype.marginTop):
(Display.Box.prototype.marginLeft):
(Display.Box.prototype.marginBottom):
(Display.Box.prototype.marginRight):
(Display.Box.prototype.marginBox):
- LayoutReloaded/FormattingContext/FormattingContext.js:
(FormattingContext.prototype.absoluteMarginBox):
(FormattingContext.prototype._addToLayoutQueue):
- LayoutReloaded/FormattingState/FormattingState.js:
(FormattingState.prototype.createDisplayBox):
- 4:39 PM Changeset in webkit [230134] by
-
- 3 edits in trunk/Tools
[LayoutReloaded] Add tree context to Display.Box
https://bugs.webkit.org/show_bug.cgi?id=184211
Reviewed by Antti Koivisto.
This is preparation for using the Display.Box tree to resolve absolute coordinates.
- LayoutReloaded/DisplayTree/Box.js:
(Display.Box):
(Display.Box.prototype.setParent):
(Display.Box.prototype.setNextSibling):
(Display.Box.prototype.setPreviousSibling):
(Display.Box.prototype.setFirstChild):
(Display.Box.prototype.setLastChild):
(Display.Box.prototype.parent):
(Display.Box.prototype.nextSibling):
(Display.Box.prototype.previousSibling):
(Display.Box.prototype.firstChild):
(Display.Box.prototype.lastChild):
- LayoutReloaded/FormattingState/FormattingState.js:
(FormattingState.prototype.createDisplayBox):
- 10:32 AM Changeset in webkit [230133] by
-
- 5 edits in tags/Safari-606.1.11.2/Source
Cherry-pick r230128. rdar://problem/39057006
REGRESSION (r229828): Facebook login popup is blank
https://bugs.webkit.org/show_bug.cgi?id=184206
<rdar://problem/39057006>
Reviewed by Wenson Hsieh.
Source/WebCore:
Since r229828, we freeze the layer tree during the navigation policy check.
We freeze in WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction()
and unfreeze in WebFrameLoaderClient::didDecidePolicyForNavigationAction().
WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction() gets called
from PolicyChecker::checkNavigationPolicy() which has 3 call sites in
FrameLoader and one in DocumentLoader for redirects. The call sites in
FrameLoader were taking care of calling didDecidePolicyForNavigationAction()
on the FrameLoaderClient in their completion handler, but the DocumentLoader
call site was failing to do so. As a result, the layer tree would stay frozen.
To make this a lot less error prone, I moved the call to
WebFrameLoaderClient::didDecidePolicyForNavigationAction() to
PolicyChecker::checkNavigationPolicy(), inside the completion handler passed
to WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction(). This way,
even if new code starts calling PolicyChecker::checkNavigationPolicy(), we
do not need to worry about letting the client know when the policy decision
is made.
No new tests, covered by existing redirection tests with the
new assertion I added.
- loader/FrameLoader.cpp: (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy): (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
- loader/PolicyChecker.cpp: (WebCore::PolicyChecker::checkNavigationPolicy):
Source/WebKit:
Add assertion to make sure we never try to do a policy check to
a resource response while a policy check for a navigation is
pending. This assertion was being hit by several of our redirection
tests without my fix.
- WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp: (WebKit::WebFrameLoaderClient::dispatchDecidePolicyForResponse):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230128 268f45cc-cd09-0410-ab3c-d52691b4dbfc
- 10:26 AM Changeset in webkit [230132] by
-
- 7 edits in tags/Safari-606.1.11.2/Source
Versioning.
- 10:22 AM Changeset in webkit [230131] by
-
- 1 copy in tags/Safari-606.1.11.2
New tag.
- 8:55 AM Changeset in webkit [230130] by
-
- 12 edits in trunk/Source
Strings and Vectors shouldn't do index masking
https://bugs.webkit.org/show_bug.cgi?id=184193
Reviewed by Mark Lam.
Source/JavaScriptCore:
- dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
(JSC::DFG::SpeculativeJIT::compileGetByValOnString):
- ftl/FTLAbstractHeapRepository.h:
- ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt):
- jit/ThunkGenerators.cpp:
(JSC::stringCharLoad):
Source/WTF:
- wtf/SizeLimits.cpp:
- wtf/Vector.h:
(WTF::VectorBufferBase::allocateBuffer):
(WTF::VectorBufferBase::tryAllocateBuffer):
(WTF::VectorBufferBase::reallocateBuffer):
(WTF::VectorBufferBase::deallocateBuffer):
(WTF::VectorBufferBase::releaseBuffer):
(WTF::VectorBufferBase::VectorBufferBase):
(WTF::VectorBuffer::allocateBuffer):
(WTF::VectorBuffer::tryAllocateBuffer):
(WTF::VectorBuffer::swap):
(WTF::VectorBuffer::restoreInlineBufferIfNeeded):
(WTF::Vector::at):
(WTF::Vector::at const):
(WTF::VectorBufferBase::updateMask): Deleted.
- wtf/text/StringImpl.h:
(WTF::StringImpl::flagIsSymbol):
(WTF::StringImpl::length const):
(WTF::StringImplShape::StringImplShape):
(WTF::StringImpl::at const):
(WTF::StringImpl::tailOffset):
(WTF::StringImpl::maskOffset): Deleted.
(WTF::StringImpl::mask const): Deleted.
- wtf/text/StringView.h:
(WTF::StringView::StringView):
(WTF::StringView::operator=):
(WTF::StringView::initialize):
(WTF::StringView::clear):
(WTF::StringView::operator[] const):
- wtf/text/WTFString.h:
(WTF::String::length const):
(WTF::String::mask const): Deleted.
- 12:04 AM Changeset in webkit [230129] by
-
- 58 edits in trunk/Source
Add pointer profiling support in baseline JIT and supporting files.
https://bugs.webkit.org/show_bug.cgi?id=184200
<rdar://problem/39057300>
Reviewed by Filip Pizlo.
Source/JavaScriptCore:
- To simplify pointer profiling support, vmEntryToJavaScript() now always enters the code via the arity check entry.
- To accommodate (1), all JITCode must now populate their arity check entry code pointers as well. For native code, programs, evals, and modules that don't do arity check, we set the normal entry as the arity check entry (though with the CodeEntryWithArityCheckPtrTag profile instead).
- assembler/AbstractMacroAssembler.h:
- assembler/LinkBuffer.h:
(JSC::LinkBuffer::locationOfNearCall):
- assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::readCallTarget):
(JSC::MacroAssemblerARM64::linkCall):
- bytecode/AccessCase.cpp:
(JSC::AccessCase::generateImpl):
- bytecode/AccessCaseSnippetParams.cpp:
(JSC::SlowPathCallGeneratorWithArguments::generateImpl):
- bytecode/CodeBlock.cpp:
(JSC::CodeBlock::addJITAddIC):
(JSC::CodeBlock::addJITMulIC):
(JSC::CodeBlock::addJITSubIC):
(JSC::CodeBlock::addJITNegIC):
- bytecode/CodeBlock.h:
(JSC::CodeBlock::addMathIC):
- bytecode/InlineAccess.cpp:
(JSC::InlineAccess::rewireStubAsJump):
- bytecode/LLIntCallLinkInfo.h:
(JSC::LLIntCallLinkInfo::unlink):
(): Deleted.
- bytecode/PolymorphicAccess.cpp:
(JSC::AccessGenerationState::emitExplicitExceptionHandler):
(JSC::PolymorphicAccess::regenerate):
- dfg/DFGJITFinalizer.cpp:
(JSC::DFG::JITFinalizer::finalize):
(JSC::DFG::JITFinalizer::finalizeFunction):
- dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileValueAdd):
(JSC::DFG::SpeculativeJIT::compileArithSub):
(JSC::DFG::SpeculativeJIT::compileArithNegate):
(JSC::DFG::SpeculativeJIT::compileArithMul):
(JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
(JSC::DFG::SpeculativeJIT::emitSwitchImm):
(JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):
- disassembler/ARM64Disassembler.cpp:
(JSC::tryToDisassemble):
- ftl/FTLJITFinalizer.cpp:
(JSC::FTL::JITFinalizer::finalizeCommon):
- ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileValueAdd):
(JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileArithAddOrSub):
(JSC::FTL::DFG::LowerDFGToB3::compileArithMul):
(JSC::FTL::DFG::LowerDFGToB3::compileArithNegate):
- heap/JITStubRoutineSet.h:
(JSC::JITStubRoutineSet::mark):
- jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::callExceptionFuzz):
(JSC::AssemblyHelpers::debugCall):
- jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::emitFunctionPrologue):
- jit/CCallHelpers.cpp:
(JSC::CCallHelpers::ensureShadowChickenPacket):
- jit/CCallHelpers.h:
(JSC::CCallHelpers::prepareForTailCallSlow):
- jit/CallFrameShuffler.cpp:
(JSC::CallFrameShuffler::prepareForTailCall):
- jit/ExecutableAllocator.cpp:
(JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
- jit/ExecutableAllocator.h:
(JSC::performJITMemcpy):
- jit/JIT.cpp:
(JSC::JIT::compileWithoutLinking):
(JSC::JIT::link):
- jit/JITArithmetic.cpp:
(JSC::JIT::emit_op_negate):
(JSC::JIT::emit_op_add):
(JSC::JIT::emitMathICFast):
(JSC::JIT::emitMathICSlow):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emit_op_sub):
- jit/JITCode.cpp:
(JSC::JITCode::execute):
(JSC::JITCodeWithCodeRef::executableAddressAtOffset):
(JSC::DirectJITCode::DirectJITCode):
(JSC::DirectJITCode::initializeCodeRef):
(JSC::NativeJITCode::addressForCall):
- jit/JITExceptions.cpp:
(JSC::genericUnwind):
- jit/JITMathIC.h:
(JSC::isProfileEmpty):
(JSC::JITBinaryMathIC::JITBinaryMathIC):
(JSC::JITUnaryMathIC::JITUnaryMathIC):
- jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::privateCompileHasIndexedProperty):
(JSC::JIT::emitSlow_op_has_indexed_property):
- jit/JITOpcodes32_64.cpp:
(JSC::JIT::privateCompileHasIndexedProperty):
- jit/JITOperations.cpp:
(JSC::getByVal):
(JSC::tryGetByValOptimize):
- jit/JITPropertyAccess.cpp:
(JSC::JIT::stringGetByValStubGenerator):
(JSC::JIT::emitGetByValWithCachedId):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emitPutByValWithCachedId):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::privateCompileGetByVal):
(JSC::JIT::privateCompileGetByValWithCachedId):
(JSC::JIT::privateCompilePutByVal):
(JSC::JIT::privateCompilePutByValWithCachedId):
- jit/JITThunks.cpp:
(JSC::JITThunks::hostFunctionStub):
- jit/Repatch.cpp:
(JSC::tryCacheGetByID):
(JSC::repatchGetByID):
(JSC::appropriateOptimizingPutByIdFunction):
(JSC::tryCachePutByID):
(JSC::repatchPutByID):
(JSC::linkFor):
(JSC::revertCall):
(JSC::linkPolymorphicCall):
(JSC::resetGetByID):
(JSC::resetPutByID):
- jit/Repatch.h:
- jit/SpecializedThunkJIT.h:
(JSC::SpecializedThunkJIT::finalize):
(JSC::SpecializedThunkJIT::callDoubleToDouble):
- jit/ThunkGenerators.cpp:
(JSC::emitPointerValidation):
(JSC::throwExceptionFromCallSlowPathGenerator):
(JSC::slowPathFor):
(JSC::linkCallThunkGenerator): Deleted.
(JSC::linkPolymorphicCallThunkGenerator): Deleted.
(JSC::virtualThunkFor): Deleted.
(JSC::nativeForGenerator): Deleted.
(JSC::nativeCallGenerator): Deleted.
(JSC::nativeTailCallGenerator): Deleted.
(JSC::nativeTailCallWithoutSavedTagsGenerator): Deleted.
(JSC::nativeConstructGenerator): Deleted.
(JSC::internalFunctionCallGenerator): Deleted.
(JSC::internalFunctionConstructGenerator): Deleted.
(JSC::arityFixupGenerator): Deleted.
(JSC::unreachableGenerator): Deleted.
(JSC::stringCharLoad): Deleted.
(JSC::charToString): Deleted.
(JSC::charCodeAtThunkGenerator): Deleted.
(JSC::charAtThunkGenerator): Deleted.
(JSC::fromCharCodeThunkGenerator): Deleted.
(JSC::clz32ThunkGenerator): Deleted.
(JSC::sqrtThunkGenerator): Deleted.
(JSC::floorThunkGenerator): Deleted.
(JSC::ceilThunkGenerator): Deleted.
(JSC::truncThunkGenerator): Deleted.
(JSC::roundThunkGenerator): Deleted.
(JSC::expThunkGenerator): Deleted.
(JSC::logThunkGenerator): Deleted.
(JSC::absThunkGenerator): Deleted.
(JSC::imulThunkGenerator): Deleted.
(JSC::randomThunkGenerator): Deleted.
(JSC::boundThisNoArgsFunctionCallGenerator): Deleted.
- llint/LLIntData.cpp:
(JSC::LLInt::initialize):
- llint/LLIntData.h:
(JSC::LLInt::getCodePtr):
- llint/LLIntEntrypoint.cpp:
(JSC::LLInt::setEvalEntrypoint):
(JSC::LLInt::setProgramEntrypoint):
(JSC::LLInt::setModuleProgramEntrypoint):
- llint/LLIntSlowPaths.cpp:
(JSC::LLInt::setUpCall):
- llint/LLIntThunks.cpp:
(JSC::LLInt::generateThunkWithJumpTo):
- llint/LowLevelInterpreter.asm:
- llint/LowLevelInterpreter32_64.asm:
- llint/LowLevelInterpreter64.asm:
- runtime/ExecutableBase.h:
- runtime/NativeExecutable.cpp:
(JSC::NativeExecutable::finishCreation):
- runtime/NativeFunction.h:
(JSC::TaggedNativeFunction::TaggedNativeFunction):
(JSC::TaggedNativeFunction::operator NativeFunction):
- runtime/PropertySlot.h:
(JSC::PropertySlot::setCustom):
(JSC::PropertySlot::setCacheableCustom):
- runtime/PtrTag.h:
- runtime/PutPropertySlot.h:
(JSC::PutPropertySlot::setCustomValue):
(JSC::PutPropertySlot::setCustomAccessor):
- runtime/SamplingProfiler.cpp:
(JSC::SamplingProfiler::takeSample):
- runtime/VMTraps.cpp:
(JSC::SignalContext::SignalContext):
(JSC::VMTraps::tryInstallTrapBreakpoints):
- tools/SigillCrashAnalyzer.cpp:
(JSC::installCrashHandler):
- yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::generateTryReadUnicodeCharacterHelper):
(JSC::Yarr::YarrGenerator::generateEnter):
Source/WTF:
- wtf/PointerPreparations.h:
- Remove WTF_PREPARE_FUNCTION_POINTER_FOR_EXECUTION. It is no longer needed.
