Context Navigation

← Previous Period
Next Period →

Timeline

Jun 3, 2018:

9:13 PM Changeset in webkit [232461] by Yusuke Suzuki

18 edits in trunk/Source/JavaScriptCore

LayoutTests/fast/css/parsing-css-matches-7.html always abandons its Document (disabling JIT fixes it)
https://bugs.webkit.org/show_bug.cgi?id=186223

Reviewed by Keith Miller.

After preparing catchOSREntryBuffer, we do not clear the active length of this scratch buffer.
It makes this buffer conservative GC root, and allows it to hold GC objects unnecessarily long.

This patch introduces DFG ClearCatchLocals node, which clears catchOSREntryBuffer's active length.
We model ExtractCatchLocal and ClearCatchLocals appropriately in DFG clobberize too to make
this ClearCatchLocals valid.

The existing tests for ExtractCatchLocal just pass.

dfg/DFGAbstractHeap.h:
dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGMayExit.cpp:
dfg/DFGNodeType.h:
dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareCatchOSREntry):

dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileClearCatchLocals):

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileClearCatchLocals):

9:02 PM Changeset in webkit [232460] by aestes@apple.com

2 edits in trunk/Source/WebKit

[Wi-Fi Assertions] Resume assertions when NetworkProcess::cancelPrepareToSuspend is called
https://bugs.webkit.org/show_bug.cgi?id=186247

Reviewed by Tim Horton.

Since we suspended assertions in prepareToSuspend, we need to resume them if
cancelPrepareToSuspend is called.

NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::cancelPrepareToSuspend):

9:01 PM Changeset in webkit [232459] by aestes@apple.com

2 edits in trunk/Source/WebKit

[iOS] Add a needed networking process entitlement
https://bugs.webkit.org/show_bug.cgi?id=186246
<rdar://problem/39578861>

Reviewed by Brent Fulgham.

Also sorted the existing entitlements.

Configurations/Network-iOS.entitlements:

8:26 PM Changeset in webkit [232458] by Fujii Hironori

7 edits in trunk/Tools

[Win][MiniBrowser] Remove gMiniBrowser global variable
https://bugs.webkit.org/show_bug.cgi?id=186134

Reviewed by Brent Fulgham.

It should not be assumed there is only one main window and one browser
window to support multiple windows properly. gMainWindow and
gMiniBrowser global variables should be removed. This change
removes gMiniBrowser.

MiniBrowser/win/Common.cpp: Removed gMiniBrowser global variable.
MiniBrowser/win/Common.h: Ditto.
MiniBrowser/win/MainWindow.cpp:

(MainWindow::init):
(MainWindow::WndProc):
(EditProc): Post WM_COMMAND if the enter key is pressed in URL bar.
(MainWindow::cachesDialogProc): Renamed from Caches.
(MainWindow::customUserAgentDialogProc): Renamed from CustomUserAgent.
(MainWindow::onURLBarEnter): Extracted from EditProc.
(BackButtonProc): Deleted.
(ForwardButtonProc): Deleted.
(Caches): Renamed to MainWindow::cachesDialogProc.
(CustomUserAgent): Renamed to MainWindow::customUserAgentDialogProc.

MiniBrowser/win/MainWindow.h: Convert hCacheWnd global variable to a member variable of MainWindow.
MiniBrowser/win/MiniBrowserLibResource.h:
MiniBrowser/win/WinMain.cpp:

(wWinMain):

7:44 PM Changeset in webkit [232457] by Michael Catanzaro

2 edits in trunk/LayoutTests

More unreviewed GTK test gardening

platform/gtk/TestExpectations:

4:14 PM Changeset in webkit [232456] by Michael Catanzaro

3 edits
2 moves in trunk/LayoutTests

Unreviewed GTK test expectations gardening

TestExpectations:
platform/gtk/TestExpectations:
platform/gtk/editing/selection/simple-line-layout-caret-is-gone-expected.txt: Renamed from LayoutTests/platform/gtk/editing/simple-line-layout-caret-is-gone-expected.txt.
platform/gtk/editing/style/apply-style-iframe-crash-expected.txt: Renamed from LayoutTests/platform/gtk/editing/apply-style-iframe-crash-expected.txt.

3:24 PM Changeset in webkit [232455] by Michael Catanzaro

5 edits in trunk/Source/WebCore

REGRESSION(r232338): [GTK] Broke a few layout tests
https://bugs.webkit.org/show_bug.cgi?id=186244

Unreviewed, also rollout r232392.

rendering/RenderTheme.cpp:

(WebCore::RenderTheme::adjustStyle):

rendering/RenderTheme.h:

(WebCore::RenderTheme::adjustListboxStyle const): Deleted.

rendering/RenderThemeGtk.cpp:

(WebCore::RenderThemeGtk::adjustListboxStyle const): Deleted.

rendering/RenderThemeGtk.h:

3:15 PM Changeset in webkit [232454] by Michael Catanzaro

4 edits in trunk/Source/WebCore

REGRESSION(r232338): [GTK] Broke a few layout tests
https://bugs.webkit.org/show_bug.cgi?id=186244

Unreviewed, rollout r232338.

platform/gtk/RenderThemeGadget.cpp:

(WebCore::RenderThemeGadget::RenderThemeGadget):
(WebCore::baseStyleContext): Deleted.

rendering/RenderThemeGtk.cpp:

(WebCore::RenderThemeGtk::adjustButtonStyle const):
(WebCore::RenderThemeGtk::adjustTextFieldStyle const):
(WebCore::RenderThemeGtk::adjustSearchFieldStyle const):
(WebCore::styleColor):
(WebCore::RenderThemeGtk::adjustTextAreaStyle const): Deleted.

rendering/RenderThemeGtk.h:

1:22 PM Changeset in webkit [232453] by eric.carlson@apple.com

2 edits in trunk/Source/WebCore

[iOS] MediaPlayer.framework is not always available
https://bugs.webkit.org/show_bug.cgi?id=186220
<rdar://problem/40571286>

Reviewed by Tim Horton.

platform/ios/RemoteCommandListenerIOS.mm:

(WebCore::RemoteCommandListener::create):

12:46 PM Changeset in webkit [232452] by Darin Adler

39 edits in trunk

[Cocoa] Update some code to be more ARC-compatible to prepare for future ARC adoption
https://bugs.webkit.org/show_bug.cgi?id=186227

Reviewed by Dan Bernstein.

Source/JavaScriptCore:

API/JSContext.mm:

(-[JSContext name]): Use CFBridgingRelease instead of autorelease.

API/JSValue.mm:

(valueToObjectWithoutCopy): Use CFBridgingRelease instead of autorelease.
(containerValueToObject): Use adoptCF instead of autorelease. This is not only more
ARC-compatible, but more efficient.
(valueToString): Use CFBridgingRelease instead of autorelease.

Source/WebCore:

bridge/objc/objc_instance.mm:

(ObjcInstance::~ObjcInstance): Use @autoreleasepool instead of NSAutoreleasePool.

platform/ios/wak/WAKView.mm:

(-[WAKView _appendDescriptionToString:atLevel:]): Ditto.

Source/WebKitLegacy/mac:

Misc/WebKitErrors.m:

(+[NSError _registerWebKitErrors]): Use @autoreleasepool instead of NSAutoreleasePool.

Plugins/WebPluginDatabase.mm:

(-[WebPluginDatabase refresh]): Ditto.

WebCoreSupport/WebChromeClient.mm:

(WebChromeClient::setStatusbarText): Ditto.

Tools:

DumpRenderTree/mac/AccessibilityCommonMac.mm:

(+[NSString stringWithJSStringRef:]): Use CFBridgingRelease instead of autorelease.
(-[NSString createJSStringRef]): Add bridge to a bridging typecast.

DumpRenderTree/mac/AccessibilityControllerMac.mm: Add a missing include.

DumpRenderTree/mac/AccessibilityNotificationHandler.mm:

(-[NSString createJSStringRef]): Add bridge to a bridging typecast.

DumpRenderTree/mac/AccessibilityTextMarkerMac.mm:

(AccessibilityTextMarker::isEqual): Ditto.
(AccessibilityTextMarkerRange::isEqual): Ditto.

DumpRenderTree/mac/DumpRenderTree.mm:

(-[DumpRenderTree _waitForWebThread]): Use @autoreleasepool instead of NSAutoreleasePool.
(DumpRenderTreeMain): Ditto.
(WebThreadLockAfterDelegateCallbacksHaveCompleted): Ditto.
(runTest): Ditto.

DumpRenderTree/mac/DumpRenderTreeDraggingInfo.mm:

(copyFile): Use a std::pair to return both a URL and an error rather than using an
out argument for the NSError.
(-[DumpRenderTreeFilePromiseReceiver receivePromisedFilesAtDestination:options:operationQueue:reader:]):
Updated for the above change.

DumpRenderTree/mac/DumpRenderTreeWindow.mm:

(-[DumpRenderTreeWindow _addToOpenWindows]): Add bridge to a bridging typecast.
(-[DumpRenderTreeWindow close]): Ditto.

DumpRenderTree/mac/LayoutTestHelper.m:

(setDisplayColorProfile): Ditto.

DumpRenderTree/mac/PolicyDelegate.mm: Add a missing include.

DumpRenderTree/mac/ResourceLoadDelegate.mm:

(-[ResourceLoadDelegate webView:resource:willSendRequest:redirectResponse:fromDataSource:]):
Add bridge to a bridging typecast.

DumpRenderTree/mac/TestRunnerMac.mm:

(-[APITestDelegateIPhone initWithTestRunner:utf8Data:baseURL:]): Ditto.
(TestRunner::apiTestNewWindowDataLoadBaseURL): Use @autoreleasepool instead of NSAutoreleasePool.

DumpRenderTree/mac/TextInputControllerMac.m: Fix a comment.

DumpRenderTree/mac/UIScriptControllerMac.mm:

(WTR::UIScriptController::replaceTextAtRange): Add bridge to a bridging typecast.
(WTR::UIScriptController::contentsOfUserInterfaceItem const): Ditto.
(WTR::UIScriptController::overridePreference): Ditto.

DumpRenderTree/mac/WorkQueueItemMac.mm:

(LoadItem::invoke const): Ditto.
(LoadHTMLStringItem::invoke const): Ditto.
(ScriptItem::invoke const): Ditto.

WebKitTestRunner/InjectedBundle/ios/AccessibilityUIElementIOS.mm:

(+[NSString stringWithJSStringRef:]): Use CFBridgingRelease instead of autorelease.
(-[NSString createJSStringRef]): Add bridge to a bridging typecast.

WebKitTestRunner/InjectedBundle/mac/AccessibilityCommonMac.mm:

(+[NSString stringWithJSStringRef:]): Use CFBridgingRelease instead of autorelease.
(-[NSString createJSStringRef]): Add bridge to a bridging typecast.

WebKitTestRunner/InjectedBundle/mac/AccessibilityControllerMac.mm:

(WTR::AccessibilityController::accessibleElementById): Add bridge to a bridging typecast.

WebKitTestRunner/InjectedBundle/mac/AccessibilityNotificationHandler.mm:

(-[NSString createJSStringRef]): Ditto.

WebKitTestRunner/InjectedBundle/mac/AccessibilityTextMarkerMac.mm:

(WTR::AccessibilityTextMarker::isEqual): Ditto.

WebKitTestRunner/InjectedBundle/mac/AccessibilityTextMarkerRangeMac.mm:

(WTR::AccessibilityTextMarkerRange::isEqual): Ditto.

WebKitTestRunner/InjectedBundle/mac/AccessibilityUIElementMac.mm:

(WTR::AccessibilityUIElement::setSelectedVisibleTextRange): Ditto.
(WTR::AccessibilityUIElement::lineTextMarkerRangeForTextMarker): Ditto.
(WTR::AccessibilityUIElement::textMarkerRangeLength): Ditto.
(WTR::AccessibilityUIElement::previousTextMarker): Ditto.
(WTR::AccessibilityUIElement::nextTextMarker): Ditto.
(WTR::AccessibilityUIElement::stringForTextMarkerRange): Ditto.
(WTR::AccessibilityUIElement::textMarkerRangeForMarkers): Ditto.
(WTR::AccessibilityUIElement::startTextMarkerForTextMarkerRange): Ditto.
(WTR::AccessibilityUIElement::endTextMarkerForTextMarkerRange): Ditto.
(WTR::AccessibilityUIElement::accessibilityElementForTextMarker): Ditto.
(WTR::createJSStringRef): Ditto.
(WTR::AccessibilityUIElement::attributedStringForTextMarkerRange): Ditto.
(WTR::AccessibilityUIElement::attributedStringForTextMarkerRangeWithOptions): Ditto.
(WTR::AccessibilityUIElement::attributedStringForTextMarkerRangeContainsAttribute): Ditto.
(WTR::AccessibilityUIElement::indexForTextMarker): Ditto.
(WTR::AccessibilityUIElement::isTextMarkerValid): Ditto.
(WTR::AccessibilityUIElement::leftWordTextMarkerRangeForTextMarker): Ditto.
(WTR::AccessibilityUIElement::rightWordTextMarkerRangeForTextMarker): Ditto.
(WTR::AccessibilityUIElement::previousWordStartTextMarkerForTextMarker): Ditto.
(WTR::AccessibilityUIElement::nextWordEndTextMarkerForTextMarker): Ditto.
(WTR::AccessibilityUIElement::paragraphTextMarkerRangeForTextMarker): Ditto.
(WTR::AccessibilityUIElement::previousParagraphStartTextMarkerForTextMarker): Ditto.
(WTR::AccessibilityUIElement::nextParagraphEndTextMarkerForTextMarker): Ditto.
(WTR::AccessibilityUIElement::sentenceTextMarkerRangeForTextMarker): Ditto.
(WTR::AccessibilityUIElement::previousSentenceStartTextMarkerForTextMarker): Ditto.
(WTR::AccessibilityUIElement::nextSentenceEndTextMarkerForTextMarker): Ditto.

WebKitTestRunner/cocoa/TestControllerCocoa.mm:

(WTR::initializeWebViewConfiguration): Ditto.
(WTR::TestController::platformContext): Ditto.
(WTR::TestController::platformPreferences): Ditto.
(WTR::TestController::platformAdjustContext): Ditto.

WebKitTestRunner/mac/PlatformWebViewMac.mm:

(WTR::PlatformWebView::PlatformWebView): Ditto.

WebKitTestRunner/mac/TestControllerMac.mm:

(WTR::TestController::initializeInjectedBundlePath): Ditto.
(WTR::TestController::initializeTestPluginDirectory): Ditto.
(WTR::TestController::platformConfigureViewForTest): Ditto.

WebKitTestRunner/mac/UIScriptControllerMac.mm:

(WTR::nsString): Use CFBridgingRelease instead of autorelease.
(WTR::UIScriptController::platformPlayBackEventStream): Add bridge to a bridging
typecast.

WebKitTestRunner/mac/WebKitTestRunnerDraggingInfo.mm: Add a missing include.

WebKitTestRunner/mac/WebKitTestRunnerPasteboard.mm:

(-[LocalPasteboard setPropertyList:forType:]): Add _bridge to a bridging typecast.
(-[LocalPasteboard setString:forType:]): Ditto.

WebKitTestRunner/mac/main.mm:

(main): Use @autoreleasepool instead of NSAutoreleasePool.

11:28 AM Changeset in webkit [232451] by Brent Fulgham

3 edits in trunk/Source/WebKit

Make sure that the fencePort received over IPC has the expected disposition (SEND)
https://bugs.webkit.org/show_bug.cgi?id=186211
<rdar://problem/37814171>

Reviewed by Geoffrey Garen.

It is possible (though very unlikely) for a message to be recevied that has the wrong mach port disposition.
If this happens, we shouldn't manipulate the passed mach_port_t or pass it on to other API. We already
drop messages that violate this expectation in the IPC layer, but code handling IPC::Attachment data types
are not checking this value.

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::setTopContentInsetFenced):

WebProcess/cocoa/VideoFullscreenManager.mm:

(WebKit::VideoFullscreenManager::setVideoLayerFrameFenced):

10:35 AM Changeset in webkit [232450] by zandobersek@gmail.com

4 edits in trunk/Source/WebCore

[WebGL] GL_EXT_robustness utilization should depend on CONTEXT_ROBUST_ACCESS value
https://bugs.webkit.org/show_bug.cgi?id=186187

Reviewed by Carlos Garcia Campos.

Don't utilize the GL_EXT_robustness extension for reading pixels from
the GPU if the underlying OpenGL context did not enable robust access
support upon creation. For EGL contexts, this would be done by passing
EGL_CONTEXT_OPENGL_ROBUST_ACCESS_EXT and EGL_TRUE key-value pair in the
attribute list passed to eglCreateContext() (as specified in the
EGL_EXT_create_context_robustness extension), but at the moment this
capability is not utilized.

As such, on drivers that implement GL_EXT_robustness support, pixel
reads done in WebGLRenderingContextBase end up using glReadnPixels(),
but that fails to successfully read anything due to the context
rejecting such calls.

GL_EXT_robustness is specific to OpenGL ES versions, so to fix this,
Extensions3DOpenGLES overrides the isEnabled() method. That override
returns false immediately if the inherited isEnabled() implementation
returns false. Otherwise it returns true, unless the tested extension
is GL_EXT_robustness, in which case we now check that the context's
CONTEXT_ROBUST_ACCESS state value is true, meaning the context was
created with robust access support enabled.

No new tests are possible because this is optional driver-provided
functionality that Web content cannot have effect on.

platform/graphics/Extensions3D.h:
platform/graphics/opengl/Extensions3DOpenGLES.cpp:

(WebCore::Extensions3DOpenGLES::isEnabled):

platform/graphics/opengl/Extensions3DOpenGLES.h:

Jun 2, 2018:

7:22 PM Changeset in webkit [232449] by Caio Lima

11 edits
14 adds in trunk

[ESNext][BigInt] Implement support for addition operations
https://bugs.webkit.org/show_bug.cgi?id=179002

Reviewed by Yusuke Suzuki.

JSTests:

bigIntTests.yaml:
stress/addition-order-evaluation.js: Added.
stress/big-int-add-wrapped-value.js: Added.
stress/big-int-addition-basic.js: Added.
stress/big-int-addition-jit.js: Added.
stress/big-int-addition-memory-stress.js: Added.
stress/big-int-addition-string-coercion.js: Added.
stress/big-int-addition-to-primitive-precedence.js: Added.
stress/big-int-addition-to-primitive.js: Added.
stress/big-int-addition-type-error.js: Added.
stress/big-int-no-conversion-to-number.js:
stress/big-int-sub-wrapped-value.js: Added.
stress/big-int-subtraction-basic.js: Added.
stress/big-int-subtraction-jit.js: Added.
stress/big-int-subtraction-type-error.js: Added.
stress/sub-order-evaluation.js: Added.

Source/JavaScriptCore:

This patch is implementing support to BigInt Operands into binary "+"
and binary "-" operators. Right now, we have limited support to DFG
and FTL JIT layers, but we plan to fix this support in future
patches.

jit/JITOperations.cpp:
runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

runtime/JSBigInt.cpp:

(JSC::JSBigInt::parseInt):
(JSC::JSBigInt::stringToBigInt):
(JSC::JSBigInt::toString):
(JSC::JSBigInt::multiply):
(JSC::JSBigInt::divide):
(JSC::JSBigInt::remainder):
(JSC::JSBigInt::add):
(JSC::JSBigInt::sub):
(JSC::JSBigInt::absoluteAdd):
(JSC::JSBigInt::absoluteSub):
(JSC::JSBigInt::toStringGeneric):
(JSC::JSBigInt::allocateFor):
(JSC::JSBigInt::toNumber const):
(JSC::JSBigInt::getPrimitiveNumber const):

runtime/JSBigInt.h:
runtime/JSCJSValueInlines.h:
runtime/Operations.cpp:

(JSC::jsAddSlowCase):

runtime/Operations.h:

(JSC::jsSub):

5:49 PM Changeset in webkit [232448] by keith_miller@apple.com

2 edits in trunk/Tools

run-jsc should pass the option to use dollar vm by default
https://bugs.webkit.org/show_bug.cgi?id=186170

Reviewed by Yusuke Suzuki.

Scripts/run-jsc:

4:34 PM Changeset in webkit [232447] by Chris Dumez

2 edits in trunk/Source/WebKit

Unreviewed, rolling out r232275.

May have caused a ~1% PLT regression on iOS

Reverted changeset:

"Store 0-lifetime stylesheets / scripts into the disk cache
for faster history navigations"
https://bugs.webkit.org/show_bug.cgi?id=186060
https://trac.webkit.org/changeset/232275

4:03 PM Changeset in webkit [232446] by commit-queue@webkit.org

11 edits
14 deletes in trunk

Unreviewed, rolling out r232439.
https://bugs.webkit.org/show_bug.cgi?id=186238

It breaks gtk-linux-32-release (Requested by caiolima on
#webkit).

Reverted changeset:

"[ESNext][BigInt] Implement support for addition operations"
https://bugs.webkit.org/show_bug.cgi?id=179002
https://trac.webkit.org/changeset/232439

4:02 PM Changeset in webkit [232445] by commit-queue@webkit.org

6 edits
3 deletes in trunk/Tools

Unreviewed, rolling out r232421.
https://bugs.webkit.org/show_bug.cgi?id=186240

Breaks webkitpy tests (Requested by aakashjain on #webkit).

Reverted changeset:

"Add some tests for lldb_webkit.py"
https://bugs.webkit.org/show_bug.cgi?id=183744
https://trac.webkit.org/changeset/232421

2:13 PM Changeset in webkit [232444] by Yusuke Suzuki

10 edits
2 adds in trunk

Baseline op_jtrue emits an insane amount of code
https://bugs.webkit.org/show_bug.cgi?id=185708

Reviewed by Filip Pizlo.

JSTests:

stress/logical-not-masquerades-as-undefined.js: Added.

(shouldBe):
(test):

stress/logical-not.js: Added.

(shouldBe):
(test):

Source/JavaScriptCore:

op_jtrue / op_jfalse bloats massive amount of code. This patch attempts to reduce the size of this code by,

op_jtrue / op_jfalse immediately jumps if the condition met. We add AssemblyHelpers::branchIf{Truthy,Falsey} to jump directly. This tightens the code.

Align our emitConvertValueToBoolean implementation to FTL's boolify function. It emits less code.

This reduces the code size of op_jtrue in x64 from 220 bytes to 164 bytes.

[ 12] jtrue arg1, 6(->18)

0x7f233170162c: mov 0x30(%rbp), %rax
0x7f2331701630: mov %rax, %rsi
0x7f2331701633: xor $0x6, %rsi
0x7f2331701637: test $0xfffffffffffffffe, %rsi
0x7f233170163e: jnz 0x7f2331701654
0x7f2331701644: cmp $0x7, %eax
0x7f2331701647: setz %sil
0x7f233170164b: movzx %sil, %esi
0x7f233170164f: jmp 0x7f2331701705
0x7f2331701654: test %rax, %r14
0x7f2331701657: jz 0x7f233170169c
0x7f233170165d: cmp %r14, %rax
0x7f2331701660: jb 0x7f2331701675
0x7f2331701666: test %eax, %eax
0x7f2331701668: setnz %sil
0x7f233170166c: movzx %sil, %esi
0x7f2331701670: jmp 0x7f2331701705
0x7f2331701675: lea (%r14,%rax), %rsi
0x7f2331701679: movq %rsi, %xmm0
0x7f233170167e: xorps %xmm1, %xmm1
0x7f2331701681: ucomisd %xmm1, %xmm0
0x7f2331701685: jz 0x7f2331701695
0x7f233170168b: mov $0x1, %esi
0x7f2331701690: jmp 0x7f2331701705
0x7f2331701695: xor %esi, %esi
0x7f2331701697: jmp 0x7f2331701705
0x7f233170169c: test %rax, %r15
0x7f233170169f: jnz 0x7f2331701703
0x7f23317016a5: cmp $0x1, 0x5(%rax)
0x7f23317016a9: jnz 0x7f23317016c1
0x7f23317016af: mov 0x8(%rax), %esi
0x7f23317016b2: test %esi, %esi
0x7f23317016b4: setnz %sil
0x7f23317016b8: movzx %sil, %esi
0x7f23317016bc: jmp 0x7f2331701705
0x7f23317016c1: test $0x1, 0x6(%rax)
0x7f23317016c5: jz 0x7f23317016f9
0x7f23317016cb: mov (%rax), %esi
0x7f23317016cd: mov $0x7f23315000c8, %rdx
0x7f23317016d7: mov (%rdx), %rdx
0x7f23317016da: mov (%rdx,%rsi,8), %rsi
0x7f23317016de: mov $0x7f2330de0000, %rdx
0x7f23317016e8: cmp %rdx, 0x18(%rsi)
0x7f23317016ec: jnz 0x7f23317016f9
0x7f23317016f2: xor %esi, %esi
0x7f23317016f4: jmp 0x7f2331701705
0x7f23317016f9: mov $0x1, %esi
0x7f23317016fe: jmp 0x7f2331701705
0x7f2331701703: xor %esi, %esi
0x7f2331701705: test %esi, %esi
0x7f2331701707: jnz 0x7f233170171b

[ 12] jtrue arg1, 6(->18)

0x7f6c8710156c: mov 0x30(%rbp), %rax
0x7f6c87101570: test %rax, %r15
0x7f6c87101573: jnz 0x7f6c871015c8
0x7f6c87101579: cmp $0x1, 0x5(%rax)
0x7f6c8710157d: jnz 0x7f6c87101592
0x7f6c87101583: cmp $0x0, 0x8(%rax)
0x7f6c87101587: jnz 0x7f6c87101623
0x7f6c8710158d: jmp 0x7f6c87101615
0x7f6c87101592: test $0x1, 0x6(%rax)
0x7f6c87101596: jz 0x7f6c87101623
0x7f6c8710159c: mov (%rax), %esi
0x7f6c8710159e: mov $0x7f6c86f000e0, %rdx
0x7f6c871015a8: mov (%rdx), %rdx
0x7f6c871015ab: mov (%rdx,%rsi,8), %rsi
0x7f6c871015af: mov $0x7f6c867e0000, %rdx
0x7f6c871015b9: cmp %rdx, 0x18(%rsi)
0x7f6c871015bd: jnz 0x7f6c87101623
0x7f6c871015c3: jmp 0x7f6c87101615
0x7f6c871015c8: cmp %r14, %rax
0x7f6c871015cb: jb 0x7f6c871015de
0x7f6c871015d1: test %eax, %eax
0x7f6c871015d3: jnz 0x7f6c87101623
0x7f6c871015d9: jmp 0x7f6c87101615
0x7f6c871015de: test %rax, %r14
0x7f6c871015e1: jz 0x7f6c87101602
0x7f6c871015e7: lea (%r14,%rax), %rsi
0x7f6c871015eb: movq %rsi, %xmm0
0x7f6c871015f0: xorps %xmm1, %xmm1
0x7f6c871015f3: ucomisd %xmm1, %xmm0
0x7f6c871015f7: jz 0x7f6c87101615
0x7f6c871015fd: jmp 0x7f6c87101623
0x7f6c87101602: mov $0x7, %r11
0x7f6c8710160c: cmp %r11, %rax
0x7f6c8710160f: jz 0x7f6c87101623

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitBranch):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::emitBranch):

jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::emitConvertValueToBoolean):
(JSC::AssemblyHelpers::branchIfValue):

jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::branchIfTruthy):
(JSC::AssemblyHelpers::branchIfFalsey):

jit/JIT.h:
jit/JITInlines.h:

(JSC::JIT::addJump):

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jtrue):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jtrue):

2:11 PM Changeset in webkit [232443] by Yusuke Suzuki

11 edits
1 add
1 delete in trunk

[JSC] Remove WeakReferenceHarvester
https://bugs.webkit.org/show_bug.cgi?id=186102

Reviewed by Filip Pizlo.

JSTests:

microbenchmarks/create-many-weak-map.js: Added.

Source/JavaScriptCore:

After several cleanups, now JSWeakMap becomes the last user of WeakReferenceHarvester.
Since JSWeakMap is already managed in IsoSubspace, we can iterate marked JSWeakMap
by using output constraints & Subspace iteration.

This patch removes WeakReferenceHarvester. Instead of managing this linked-list, our
output constraint set iterates marked JSWeakMap by using Subspace.

And we also add locking for JSWeakMap's rehash and output constraint visiting.

Attached microbenchmark does not show any regression.

API/JSAPIWrapperObject.h:
CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
heap/Heap.cpp:

(JSC::Heap::endMarking):
(JSC::Heap::addCoreConstraints):

heap/Heap.h:
heap/SlotVisitor.cpp:

(JSC::SlotVisitor::addWeakReferenceHarvester): Deleted.

heap/SlotVisitor.h:
heap/WeakReferenceHarvester.h: Removed.
runtime/WeakMapImpl.cpp:

(JSC::WeakMapImpl<WeakMapBucket>::visitChildren):
(JSC::WeakMapImpl<WeakMapBucket<WeakMapBucketDataKey>>::visitOutputConstraints):
(JSC::WeakMapImpl<WeakMapBucket<WeakMapBucketDataKeyValue>>::visitOutputConstraints):
(JSC::WeakMapImpl<WeakMapBucket<WeakMapBucketDataKey>>::visitWeakReferences): Deleted.
(JSC::WeakMapImpl<WeakMapBucket<WeakMapBucketDataKeyValue>>::visitWeakReferences): Deleted.

runtime/WeakMapImpl.h:

(JSC::WeakMapImpl::WeakMapImpl):
(JSC::WeakMapImpl::finishCreation):
(JSC::WeakMapImpl::rehash):
(JSC::WeakMapImpl::makeAndSetNewBuffer):
(JSC::WeakMapImpl::DeadKeyCleaner::target): Deleted.

2:08 PM Changeset in webkit [232442] by Yusuke Suzuki

25 edits
9 adds in trunk

[JSC] Object.create should have intrinsic
https://bugs.webkit.org/show_bug.cgi?id=186200

Reviewed by Filip Pizlo.

JSTests:

microbenchmarks/object-create-null.js: Added.

(test):

microbenchmarks/object-create-unknown-object-prototype.js: Added.

(test):

microbenchmarks/object-create-untyped-prototype.js: Added.

(test):

stress/get-by-pname-only-prototype-properties.js: Added.

(foo):

stress/object-create-define.js: Added.

(shouldBe):
(test):

stress/object-create-null-external.js: Added.

(shouldBe):
(test):

stress/object-create-null.js: Added.

(shouldBe):
(test):

stress/object-create-prototype.js: Added.

(shouldBe):
(test):

stress/object-create-undefined.js: Added.

(shouldThrow):
(i.shouldThrow):

Source/JavaScriptCore:

Object.create is used in various JS code. Object.create(null) is particularly used
to create empty plain object with null Prototype. We can find Object.create(null)
call in ARES-6/Babylon code.

This patch adds ObjectCreateIntrinsic to JSC. DFG recognizes it and produces ObjectCreate
DFG node. DFG AI and constant folding attempt to convert it to NewObject when prototype
object is null. It offers significant performance boost for Object.create(null).

baseline patched

object-create-null 53.7940+-1.5297 ^{19.8846+-0.6584} definitely 2.7053x faster
object-create-unknown-object-prototype 38.9977+-1.1364 ^{37.2207+-0.6143} definitely 1.0477x faster
object-create-untyped-prototype 22.5632+-0.6917 22.2539+-0.6876 might be 1.0139x faster

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNode.h:

(JSC::DFG::Node::convertToNewObject):

dfg/DFGNodeType.h:
dfg/DFGOperations.cpp:
dfg/DFGOperations.h:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileObjectCreate):

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileObjectCreate):

runtime/Intrinsic.cpp:

(JSC::intrinsicName):

runtime/Intrinsic.h:
runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::nullPrototypeObjectStructure const):

runtime/ObjectConstructor.cpp:

10:43 AM Changeset in webkit [232441] by mitz@apple.com

9 copies
1 add in releases/Apple/Safari 11.1.1

Added a tag for Safari 11.1.1.

10:43 AM Changeset in webkit [232440] by mitz@apple.com

8 copies
1 add in releases/Apple/iOS 11.4

Added a tag for iOS 11.4.

9:03 AM Changeset in webkit [232439] by Caio Lima

11 edits
14 adds in trunk

[ESNext][BigInt] Implement support for addition operations
https://bugs.webkit.org/show_bug.cgi?id=179002

Reviewed by Yusuke Suzuki.

JSTests:

bigIntTests.yaml:
stress/addition-order-evaluation.js: Added.
stress/big-int-add-wrapped-value.js: Added.
stress/big-int-addition-basic.js: Added.
stress/big-int-addition-jit.js: Added.
stress/big-int-addition-memory-stress.js: Added.
stress/big-int-addition-string-coercion.js: Added.
stress/big-int-addition-to-primitive-precedence.js: Added.
stress/big-int-addition-to-primitive.js: Added.
stress/big-int-addition-type-error.js: Added.
stress/big-int-no-conversion-to-number.js:
stress/big-int-sub-wrapped-value.js: Added.
stress/big-int-subtraction-basic.js: Added.
stress/big-int-subtraction-jit.js: Added.
stress/big-int-subtraction-type-error.js: Added.
stress/sub-order-evaluation.js: Added.

Source/JavaScriptCore:

jit/JITOperations.cpp:
runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

runtime/JSBigInt.cpp:

runtime/JSBigInt.h:
runtime/JSCJSValueInlines.h:
runtime/Operations.cpp:

(JSC::jsAddSlowCase):

runtime/Operations.h:

(JSC::jsSub):

9:03 AM Changeset in webkit [232438] by commit-queue@webkit.org

2 edits in trunk/Source/WebKit

Make WKWebView firstResponder after entering or exiting fullscreen.
https://bugs.webkit.org/show_bug.cgi?id=186088
rdar://problem/40387859

Patch by Jeremy Jones <jeremyj@apple.com> on 2018-06-02
Reviewed by Jer Noble.

Update first responder when WKWebView moves to a new window, otherwise there won't be a first responder.

UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm:

(-[WKFullScreenWindowController beganEnterFullScreenWithInitialFrame:finalFrame:]):
(-[WKFullScreenWindowController _completedExitFullScreen]):

9:02 AM Changeset in webkit [232437] by commit-queue@webkit.org

3 edits in trunk/Source/WebKit

Exit fullscreen when javascript alerts are presented.
https://bugs.webkit.org/show_bug.cgi?id=185619
rdar://problem/35724264

Patch by Jeremy Jones <jeremyj@apple.com> on 2018-06-02
Reviewed by Jer Noble.

Prevent users from being trapped in fullscreen by alert cycles.
Prevent fullscreen from becoming unresponsive due to alerts hidden behind fullscreen.

Fullscreen exit is initiated here in the UI process so that fullscreen UI is torn down immediately,
before the alert is shown.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::exitFullscreenImmediately):
(WebKit::WebPageProxy::runJavaScriptAlert):
(WebKit::WebPageProxy::runJavaScriptConfirm):
(WebKit::WebPageProxy::runJavaScriptPrompt):

UIProcess/WebPageProxy.h:

8:59 AM Changeset in webkit [232436] by youenn@apple.com

3 edits
1 add in trunk/Source/WebKit

Add a sandbox profile for com.cisco.webex.plugin.gpc64 plugin
https://bugs.webkit.org/show_bug.cgi?id=186110

Reviewed by Brent Fulgham.

PluginProcess/mac/com.apple.WebKit.plugin-common.sb.in: Webex needs to create some symlinks.
Resources/PlugInSandboxProfiles/com.cisco.webex.plugin.gpc64.sb: Added.
WebKit.xcodeproj/project.pbxproj:

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed