Context Navigation

← Previous Period
Next Period →

Timeline

Jan 14, 2019:

10:01 PM Changeset in webkit [239975] by mmaxfield@apple.com

3 edits
4 adds in trunk/Source/WebCore

[WHLSL] Implement the Type Checker
https://bugs.webkit.org/show_bug.cgi?id=193080

Reviewed by Dean Jackson.

This is a translation of https://github.com/gpuweb/WHLSL/blob/master/Source/Checker.mjs into C++.

The Checker passes types between nested expressions. An inner expression figures out what type it is, and
passes that information up to an outer expression. This is done via reading/writing into a HashMap,
because all the type information needs to be saved so that the Metal codegen can emit the correct types.

These types can have two forms: A regular type (like "int[]") or a ResolvableType. ResolvableTypes
represent literals, since a literal needs to know its context before it knows what type it should be. So,
if you have a function like "void foo(int x)" and you have a call like "foo(3)", the 3's ResolvableType
gets passed to the CallExpression, which then unifies it with the function's parameter type, thereby
resolving the 3 to be an int.

There are a few examples where multiple expressions will have the same type: "return (foo, 3)." If those
types are regular types, then it's no problem; we can just clone() the type and stick both in the HashMap.
However, if the type is a ResolvableType, an outer expression will only resolve that type once, so the two
ResolvableTypes can't be distinct. The Checker solves this problem by making a reference-counted wrapper
around ResolvableTypes and using that in the HashMap instead.

Once all the ResolvableTypes have been resolved, a second pass runs through the entire HashMap and assigns
the known types to all the expressions. LValues and their associated address spaces are held in a parallel
HashMap, and are assigned to the expression at the same time. The type is an Optional<AddressSpace> because
address spaces are only relevant if the value is an lvalue; if it's nullopt then that means the expression
is an rvalue.

No new tests because it isn't hooked up yet. Not enough of the compiler exists to have any meaningful sort
of test. When enough of the compiler is present, I'll port the reference implementation's test suite.

Modules/webgpu/WHLSL/WHLSLChecker.cpp: Added.

(WebCore::WHLSL::resolveWithOperatorAnderIndexer):
(WebCore::WHLSL::resolveWithOperatorLength):
(WebCore::WHLSL::resolveWithReferenceComparator):
(WebCore::WHLSL::resolveByInstantiation):
(WebCore::WHLSL::checkSemantics):
(WebCore::WHLSL::checkOperatorOverload):
(WebCore::WHLSL::Checker::Checker):
(WebCore::WHLSL::Checker::visit):
(WebCore::WHLSL::Checker::assignTypes):
(WebCore::WHLSL::Checker::checkShaderType):
(WebCore::WHLSL::matchAndCommit):
(WebCore::WHLSL::Checker::recurseAndGetInfo):
(WebCore::WHLSL::Checker::getInfo):
(WebCore::WHLSL::Checker::assignType):
(WebCore::WHLSL::Checker::forwardType):
(WebCore::WHLSL::getUnnamedType):
(WebCore::WHLSL::Checker::finishVisitingPropertyAccess):
(WebCore::WHLSL::Checker::recurseAndWrapBaseType):
(WebCore::WHLSL::Checker::isBoolType):
(WebCore::WHLSL::Checker::recurseAndRequireBoolType):
(WebCore::WHLSL::check):

Modules/webgpu/WHLSL/WHLSLChecker.h: Added.
Modules/webgpu/WHLSL/WHLSLGatherEntryPointItems.cpp: Added.

(WebCore::WHLSL::Gatherer::Gatherer):
(WebCore::WHLSL::Gatherer::reset):
(WebCore::WHLSL::Gatherer::takeEntryPointItems):
(WebCore::WHLSL::Gatherer::visit):
(WebCore::WHLSL::gatherEntryPointItems):

Modules/webgpu/WHLSL/WHLSLGatherEntryPointItems.h: Added.

(WebCore::WHLSL::EntryPointItem::EntryPointItem):

Sources.txt:
WebCore.xcodeproj/project.pbxproj:

9:15 PM Changeset in webkit [239974] by achristensen@apple.com

6 edits in trunk/Source

Split headerValueForVary into specialized functions for NetworkProcess and WebProcess/WebKitLegacy
https://bugs.webkit.org/show_bug.cgi?id=193429

Reviewed by Joseph Pecoraro.

Source/WebCore:

headerValueForVary is a strange function that is causing trouble with my NetworkProcess global state removal project.
It currently accesses the cookie storage to see if there's a match in two different ways currently written as fallbacks.
In the WebProcess or in WebKitLegacy, it uses cookiesStrategy to access cookies via IPC or directly, respectively,
depending on the PlatformStrategies implementation of cookiesStrategy for that process.
In the NetworkProcess, it uses WebCore::NetworkStorageSession to access cookies directly.
Both of these cookie accessing methods use global state in the process, and I must split them to refactor them separately.
This patch does the split by passing in the method of cookie access: a CookiesStrategy& or a NetworkStorageSession&.
Further refactoring will be done in bug 193368 and bug 161106 to build on this and replace the global state with
member variables of the correct containing objects.

loader/cache/CachedResource.cpp:

(WebCore::CachedResource::setResponse):
(WebCore::CachedResource::varyHeaderValuesMatch):

platform/network/CacheValidation.cpp:

(WebCore::cookieRequestHeaderFieldValue):
(WebCore::headerValueForVary):
(WebCore::collectVaryingRequestHeaders):
(WebCore::verifyVaryingRequestHeaders):

platform/network/CacheValidation.h:

Source/WebKit:

NetworkProcess/cache/NetworkCache.cpp:

(WebKit::NetworkCache::makeUseDecision):
(WebKit::NetworkCache::Cache::retrieve):
(WebKit::NetworkCache::Cache::makeEntry):
(WebKit::NetworkCache::Cache::makeRedirectEntry):
(WebKit::NetworkCache::Cache::update):

8:11 PM Changeset in webkit [239973] by timothy_horton@apple.com

2 edits in trunk/Tools

Move a test implementation file that got misplaced in the Xcode project

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:

8:03 PM Changeset in webkit [239972] by timothy_horton@apple.com

2 edits in trunk/Source/WebKit

Fix a style mistake in PageClientImplMac

UIProcess/mac/PageClientImplMac.h:

Somehow these methods ended up above the members.

7:31 PM Changeset in webkit [239971] by Simon Fraser

2 edits in trunk/Source/WebCore

Only run the node comparison code in FrameSelection::respondToNodeModification() for range selections
https://bugs.webkit.org/show_bug.cgi?id=193416

Reviewed by Wenson Hsieh.

The code inside the m_selection.firstRange() clause needs to only run for non-collapsed selections, and
it shows up on Speedometer profiles so optimize to only run this code if we have a selection range.

editing/FrameSelection.cpp:

(WebCore::FrameSelection::respondToNodeModification):

7:26 PM Changeset in webkit [239970] by Michael Catanzaro

2 edits in trunk/Source/WTF

Use unorm2_normalize instead of precomposedStringWithCanonicalMapping in userVisibleString
https://bugs.webkit.org/show_bug.cgi?id=192945

Reviewed by Alex Christensen.

Replace use of the nice NSString function precomposedStringWithCanonicalMapping with the ICU
API unorm2_normalize. This is to prep the code for translation to cross-platform C++. Of
course this is much worse than the preexisting code, but this is just a transitional
measure and not the final state of the code. It wouldn't make sense to do this if the code
were to remain Objective C++.

wtf/cocoa/NSURLExtras.mm:

(WTF::toNormalizationFormC):
(WTF::userVisibleString):

7:01 PM Changeset in webkit [239969] by msaboff@apple.com

2 edits in trunk/Source/JavaScriptCore

Add option to JSC to dump memory footprint on script completion
https://bugs.webkit.org/show_bug.cgi?id=193422

Reviewed by Mark Lam.

Added the --footprint option to dump peak and current memory usage. This uses the same
OS calls added in r2362362.

jsc.cpp:

(printUsageStatement):
(CommandLine::parseArguments):
(jscmain):

6:37 PM Changeset in webkit [239968] by keith_miller@apple.com

2 edits in trunk/JSTests

Skip type-check-hoisting-phase-hoist... with no jit
https://bugs.webkit.org/show_bug.cgi?id=193421

Reviewed by Mark Lam.

It's timing out the 32-bit bots and takes 330 seconds
on my machine when run by itself.

stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js:

6:14 PM Changeset in webkit [239967] by achristensen@apple.com

5 edits in trunk

Bulgarian TLD should not punycode-encode URLs with Bulgarian Cyrillic characters
https://bugs.webkit.org/show_bug.cgi?id=193411
<rdar://problem/47215929>

Reviewed by Alexey Proskuryakov.

Source/WTF:

wtf/cocoa/NSURLExtras.mm:

(WTF::allCharactersAllowedByTLDRules):

LayoutTests:

fast/url/user-visible/cyrillic-NFD-expected.txt:
fast/url/user-visible/cyrillic-NFD.html:

5:51 PM Changeset in webkit [239966] by wilander@apple.com

3 edits in trunk/LayoutTests

Restructure http/tests/resourceLoadStatistics/remove-blocking-in-redirect.html to address flakiness
https://bugs.webkit.org/show_bug.cgi?id=191211
<rdar://problem/45818606>

Unreviewed test gardening.

This test is flaky on the MacOS WK2 bot. The patch avoids a page navigation and
redirect which may avoid the code that changed in
https://trac.webkit.org/changeset/237735/webkit and made the test more flaky.

http/tests/resourceLoadStatistics/remove-blocking-in-redirect-expected.txt:
http/tests/resourceLoadStatistics/remove-blocking-in-redirect.html:

5:31 PM Changeset in webkit [239965] by Simon Fraser

12 edits in trunk

Animation and other code is too aggressive about invalidating layer composition
https://bugs.webkit.org/show_bug.cgi?id=193343

Reviewed by Antoine Quint.

Source/WebCore:

We used to have the concept of a "SyntheticStyleChange", which was used to trigger
style updates for animation, and also to get compositing updated.

That morphed into a call to Element::invalidateStyleAndLayerComposition(), which causes
a style update to result in a "RecompositeLayer" diff, which in turn triggers compositing work,
and dirties DOM touch event regions (which can be expensive to update).

However, not all the callers of Element::invalidateStyleAndLayerComposition() need to trigger
compositing, and doing so from animations caused excessive touch event regions on yahoo.com,
which has several visibility:hidden elements with background-position animation.

So fix callers of invalidateStyleAndLayerComposition() which don't care about compositing to instead
call just invalidateStyle().

Also fix KeyframeAnimation::animate to correctly return true when animation state changes—it failed to
do so, because fireAnimationEventsIfNeeded() can run the state machine and change state.

animation/KeyframeEffect.cpp:

(WebCore::invalidateElement):

page/animation/AnimationBase.cpp:

(WebCore::AnimationBase::setNeedsStyleRecalc):

page/animation/CSSAnimationController.cpp:

(WebCore::CSSAnimationControllerPrivate::updateAnimations):
(WebCore::CSSAnimationControllerPrivate::fireEventsAndUpdateStyle):
(WebCore::CSSAnimationControllerPrivate::pauseAnimationAtTime):
(WebCore::CSSAnimationControllerPrivate::pauseTransitionAtTime):
(WebCore::CSSAnimationController::cancelAnimations):

page/animation/KeyframeAnimation.cpp:

(WebCore::KeyframeAnimation::animate):

rendering/RenderImage.cpp:

(WebCore::RenderImage::imageChanged):

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::calculateClipRects const):

rendering/svg/SVGResourcesCache.cpp:

(WebCore::SVGResourcesCache::clientStyleChanged):

style/StyleTreeResolver.cpp:

(WebCore::Style::TreeResolver::createAnimatedElementUpdate):

svg/SVGAnimateElementBase.cpp:

(WebCore::applyCSSPropertyToTarget):
(WebCore::removeCSSPropertyFromTarget):

LayoutTests:

This test was clobbering the 'box' class on the animating element and therefore making it disappear.

legacy-animation-engine/compositing/animation/animation-compositing.html:

5:26 PM Changeset in webkit [239964] by yusukesuzuki@slowstart.org

4 edits
1 add in trunk

[JSC] AI should check the given constant's array type when folding GetByVal into constant
https://bugs.webkit.org/show_bug.cgi?id=193413
<rdar://problem/46092389>

Reviewed by Keith Miller.

JSTests:

This test is super flaky. It causes crash in r238109, but it does not crash with --useConcurrentJIT=false.
It does not cause any crashes on the latest revision too. Basically, it highly depends on the timing, and
without this patch, the root cause is not fixed yet. If GetLocal is turned into JSConstant in AI,
but GetByVal does not have appropriate ArrayModes, JSC crashes.

stress/ai-should-perform-array-check-on-get-by-val-constant-folding.js: Added.

(compareArray):

Source/JavaScriptCore:

If GetByVal's DFG::ArrayMode's type is Array::Double, we expect that the result of GetByVal is Double, since we already performed CheckStructure or CheckArray
to ensure this array type. But this assumption on the given value becomes wrong in AI, since CheckStructure may not perform filtering. And the proven AbstractValue
in GetByVal would not be expected one.

We have the graph before performing constant folding.

53:<!0:-> GetLocal(Check:Untyped:@77, JS|MustGen|UseAsOther, Array, arg2(C<Array>/FlushedCell), R:Stack(7), bc#37, ExitValid) predicting Array
54:< 1:-> JSConstant(JS|PureNum|UseAsOther|UseAsInt|ReallyWantsInt, BoolInt32, Int32: 0, bc#37, ExitValid)
93:<!0:-> CheckStructure(Cell:@53, MustGen, [%C7:Array], R:JSCell_structureID, Exits, bc#37, ExitValid)
94:< 1:-> GetButterfly(Check:Cell:@53, Storage|PureInt, R:JSObject_butterfly, Exits, bc#37, ExitValid)
55:<!0:-> GetByVal(Check:KnownCell:@53, Check:Int32:@54, Check:Untyped:@94, Double|MustGen|VarArgs|PureInt, AnyIntAsDouble|NonIntAsdouble, Double+OriginalCopyOnWriteArray+SaneChain+AsIs+Read, R:Butterfly_publicLength,IndexedDoubleProperties, Exits, bc#37, ExitValid) predicting StringIdent|NonIntAsdouble

And 53 is converted to JSConstant in the constant folding. It leads to constant folding attempt in GetByVal.

53:< 1:-> JSConstant(JS|UseAsOther, Array, Weak:Object: 0x117fb4370 with butterfly 0x8000e4050 (Structure %BV:Array), StructureID: 104, bc#37, ExitValid)
54:< 1:-> JSConstant(JS|PureNum|UseAsOther|UseAsInt|ReallyWantsInt, BoolInt32, Int32: 0, bc#37, ExitValid)
93:<!0:-> CheckStructure(Cell:@53, MustGen, [%C7:Array], R:JSCell_structureID, Exits, bc#37, ExitValid)
94:< 1:-> GetButterfly(Check:Cell:@53, Storage|PureInt, R:JSObject_butterfly, Exits, bc#37, ExitValid)
55:<!0:-> GetByVal(Check:KnownCell:@53, Check:Int32:@54, Check:Untyped:@94, Double|MustGen|VarArgs|PureInt, AnyIntAsDouble|NonIntAsdouble, Double+OriginalCopyOnWriteArray+SaneChain+AsIs+Read, R:Butterfly_publicLength,IndexedDoubleProperties, Exits, bc#37, ExitValid) predicting StringIdent|NonIntAsdouble

GetByVal gets constant Array from @53, and attempt to perform constant folding by leverating CoW state: if the given array's butterfly is CoW and we performed CoW array check for this GetByVal, the array would not be changed as long as the check works.
However, CheckStructure for @53 does not filter anything at AI. So, if @53 is CopyOnWrite | Contiguous array (not CopyOnWrite | Double array!), GetByVal will get a JSValue. But it does not meet the requirement of GetByVal since it has Double Array mode, and says it returns Double.
Here, CheckStructure is valid because structure of the constant object would be changed. What we should do is additional CoW & ArrayShape check in GetByVal when folding since this node leverages CoW's interesting feature,
"If CoW array check (CheckStructure etc.) is emitted by GetByVal's DFG::ArrayMode, the content is not changed from the creation!".

This patch adds ArrayShape check in addition to CoW status check in GetByVal.

Unfortunately, this crash is very flaky. In the above case, if @53 stays GetLocal after the constant folding phase, this issue does not occur. We can see this crash in r238109, but it is really hard to reproduce it in the current ToT.
I verified this fix works in r238109 with the attached test.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::fixTypeForRepresentation):

4:55 PM Changeset in webkit [239963] by pvollan@apple.com

2 edits in trunk/Source/WebKit

[macOS] Remove reporting for mach lookups confirmed in-use
https://bugs.webkit.org/show_bug.cgi?id=193415
<rdar://problem/47266542>

Reviewed by Brent Fulgham.

Also, start denying the services which have not been confirmed to be in use.

WebProcess/com.apple.WebProcess.sb.in:

4:49 PM Changeset in webkit [239962] by Alan Coon

7 edits in tags/Safari-607.1.20.2/Source

Versioning.

4:39 PM Changeset in webkit [239961] by Caio Lima

3 edits
1 add in trunk

[BigInt] Literal parsing is crashing when used inside a Object Literal
https://bugs.webkit.org/show_bug.cgi?id=193404

Reviewed by Yusuke Suzuki.

JSTests:

stress/big-int-literal-inside-literal-object.js: Added.

Source/JavaScriptCore:

Former implementation was relying into token.m_data.radix after the
call of next() into Parser.cpp. This is not safe because next
clobbers token.m_data.radix in some cases (e.g is CLOSEBRACE).
Now we get radix value before calling next() into parser and store
in a local variable.

parser/Parser.cpp:

(JSC::Parser<LexerType>::parsePrimaryExpression):

4:19 PM Changeset in webkit [239960] by sihui_liu@apple.com

2 edits in trunk/Source/WebCore

IndexedDB: When deleting databases, some open databases might be missed
https://bugs.webkit.org/show_bug.cgi?id=193090

Reviewed by Brady Eidson.

We should close all databases with an open backing store instead of looking at which ones have an open database
connection. This is because a database might be in the process of getting a backing store before its connection
has been created.

Modules/indexeddb/server/IDBServer.cpp:

(WebCore::IDBServer::IDBServer::closeAndDeleteDatabasesModifiedSince):
(WebCore::IDBServer::IDBServer::closeAndDeleteDatabasesForOrigins):

4:00 PM Changeset in webkit [239959] by commit-queue@webkit.org

19 edits
1 copy
3 moves
35 adds
4 deletes in trunk/LayoutTests

Import current Resource-Timing WPTs
https://bugs.webkit.org/show_bug.cgi?id=193302

Patch by Charles Vazac <cvazac@akamai.com> on 2019-01-14
Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

web-platform-tests/resource-timing/SyntheticResponse.py:

(main):

web-platform-tests/resource-timing/buffer-full-add-after-full-event-expected.txt: Added.
web-platform-tests/resource-timing/buffer-full-add-after-full-event.html: Added.
web-platform-tests/resource-timing/buffer-full-add-entries-during-callback-expected.txt: Added.
web-platform-tests/resource-timing/buffer-full-add-entries-during-callback-that-drop.html: Added.
web-platform-tests/resource-timing/buffer-full-add-entries-during-callback.html: Added.
web-platform-tests/resource-timing/buffer-full-add-then-clear-expected.txt: Added.
web-platform-tests/resource-timing/buffer-full-add-then-clear.html: Added.
web-platform-tests/resource-timing/buffer-full-decrease-buffer-during-callback.html: Added.
web-platform-tests/resource-timing/buffer-full-increase-buffer-during-callback-expected.txt: Added.
web-platform-tests/resource-timing/buffer-full-increase-buffer-during-callback.html: Added.
web-platform-tests/resource-timing/buffer-full-inspect-buffer-during-callback-expected.txt: Added.
web-platform-tests/resource-timing/buffer-full-inspect-buffer-during-callback.html: Added.
web-platform-tests/resource-timing/buffer-full-set-to-current-buffer-expected.txt: Added.
web-platform-tests/resource-timing/buffer-full-set-to-current-buffer.html: Added.
web-platform-tests/resource-timing/buffer-full-store-and-clear-during-callback-expected.txt: Added.
web-platform-tests/resource-timing/buffer-full-store-and-clear-during-callback.html: Added.
web-platform-tests/resource-timing/buffer-full-then-increased-expected.txt: Added.
web-platform-tests/resource-timing/buffer-full-then-increased.html: Added.
web-platform-tests/resource-timing/buffer-full-when-populate-entries-expected.txt: Added.
web-platform-tests/resource-timing/buffer-full-when-populate-entries.html: Added.
web-platform-tests/resource-timing/document-domain-no-impact-loader.sub-expected.txt: Added.
web-platform-tests/resource-timing/document-domain-no-impact-loader.sub.html: Added.
web-platform-tests/resource-timing/no-entries-for-cross-origin-css-fetched.sub-expected.txt: Added.
web-platform-tests/resource-timing/no-entries-for-cross-origin-css-fetched.sub.html: Added.
web-platform-tests/resource-timing/resource-timing-level1.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/resource-timing/resource-timing.js.

(assertInvariants):
(window.onload):

web-platform-tests/resource-timing/resource-timing-level1.sub-expected.txt: Added.
web-platform-tests/resource-timing/resource-timing-level1.sub.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/resource-timing/resource-timing.html.
web-platform-tests/resource-timing/resource_connection_reuse.html:
web-platform-tests/resource-timing/resource_timing.worker.js:
web-platform-tests/resource-timing/resource_timing_buffer_full_when_populate_entries-expected.txt: Removed.
web-platform-tests/resource-timing/resource_timing_buffer_full_when_populate_entries.html: Removed.
web-platform-tests/resource-timing/resource_timing_store_and_clear_during_callback-expected.txt: Removed.
web-platform-tests/resource-timing/resource_timing_store_and_clear_during_callback.html: Removed.
web-platform-tests/resource-timing/resources/buffer-full-utilities.js: Added.

(let.appendScript):
(let.waitForNextTask):
(let.waitForEventToFire.return.new.Promise):
(let.waitForEventToFire):

web-platform-tests/resource-timing/resources/document-domain-no-impact.sub.html: Added.
web-platform-tests/resource-timing/resources/iframe-setdomain.sub.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/resource-timing/iframe-setdomain.sub.html.
web-platform-tests/resource-timing/resources/w3c-import.log:
web-platform-tests/resource-timing/resources/webperftestharness.js:

(wp_test):
(test_namespace):

web-platform-tests/resource-timing/resources/webperftestharnessextension.js:

(test_resource_entries):
(performance_entrylist_checker): Deleted.

web-platform-tests/resource-timing/single-entry-per-resource.html:
web-platform-tests/resource-timing/supported_resource_type.any-expected.txt: Added.
web-platform-tests/resource-timing/supported_resource_type.any.html: Added.
web-platform-tests/resource-timing/supported_resource_type.any.js: Added.

(test):

web-platform-tests/resource-timing/supported_resource_type.any.worker-expected.txt: Added.
web-platform-tests/resource-timing/supported_resource_type.any.worker.html: Added.
web-platform-tests/resource-timing/test_resource_timing.https-expected.txt: Added.
web-platform-tests/resource-timing/test_resource_timing.https.html: Added.
web-platform-tests/resource-timing/test_resource_timing.js:

(resource_load):

web-platform-tests/resource-timing/w3c-import.log:

LayoutTests:

TestExpectations:
tests-options.json:

3:45 PM Changeset in webkit [239958] by jiewen_tan@apple.com

5 edits in trunk/LayoutTests

Unreviewed, test fixes after r239852.

http/wpt/webauthn/public-key-credential-create-success-hid.https.html:
http/wpt/webauthn/public-key-credential-create-success-u2f.https.html:
http/wpt/webauthn/public-key-credential-get-success-hid.https.html:
http/wpt/webauthn/public-key-credential-get-success-u2f.https.html:

3:24 PM Changeset in webkit [239957] by Michael Catanzaro

9 edits in releases/WebKitGTK/webkit-2.22/Source

Merge r239787 - Gigacage disabling checks should handle the GIGACAGE_ALLOCATION_CAN_FAIL case properly.
https://bugs.webkit.org/show_bug.cgi?id=193292
<rdar://problem/46485450>

Reviewed by Yusuke Suzuki.

Source/bmalloc:

Previously, when GIGACAGE_ALLOCATION_CAN_FAIL is true, we allow the Gigacage to
be disabled if we fail to allocate memory for it. However, Gigacage::primitiveGigacageDisabled()
still always assumes that the Gigacage is always enabled after ensureGigacage() is
called.

This patch updates Gigacage::primitiveGigacageDisabled() to allow the Gigacage to
already be disabled if GIGACAGE_ALLOCATION_CAN_FAIL is true and wasEnabled() is
false.

In this patch, we also put the wasEnabled flag in the 0th slot of the
g_gigacageBasePtrs buffer to ensure that it is also protected against writes just
like the Gigacage base pointers.

To achieve this, we do the following:

Added a reservedForFlags field in struct BasePtrs.
Added a ReservedForFlagsAndNotABasePtr Gigacage::Kind.
Added assertions to ensure that the BasePtrs::primitive is at the offset matching the offset computed from Gigacage::Primitive. Ditto for BasePtrs::jsValue and Gigacage::JSValue.
Added assertions to ensure that Gigacage::ReservedForFlagsAndNotABasePtr is not used for fetching a Gigacage base pointer.
Added RELEASE_BASSERT_NOT_REACHED() to implement such assertions in bmalloc.

No test added because this issue requires Gigacage allocation to fail in order to
manifest. I've tested it manually by modifying the code locally to force an
allocation failure.

bmalloc/BAssert.h:
bmalloc/Gigacage.cpp:

(Gigacage::ensureGigacage):
(Gigacage::primitiveGigacageDisabled):

bmalloc/Gigacage.h:

(Gigacage::wasEnabled):
(Gigacage::setWasEnabled):
(Gigacage::name):
(Gigacage::basePtr):
(Gigacage::size):

bmalloc/HeapKind.h:

(bmalloc::heapKind):

Source/JavaScriptCore:

runtime/VM.h:

(JSC::VM::gigacageAuxiliarySpace):

Source/WTF:

Update the USE_SYSTEM_MALLOC version of Gigacage.h to match the bmalloc version.

wtf/Gigacage.h:

3:24 PM Changeset in webkit [239956] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.22/Source/bmalloc

Merge r239245 - Gigacage runway should immediately follow the primitive cage
https://bugs.webkit.org/show_bug.cgi?id=192733

Reviewed by Saam Barati.

This patch makes sure that the Gigacage runway is always
immediately after the primitive cage. Since writing outside the
primitive gigacage is likely to be more dangerous than the JSValue
cage. The ordering of the cages is still random however.

bmalloc/Gigacage.cpp:

(Gigacage::ensureGigacage):

3:22 PM Changeset in webkit [239955] by Devin Rousso

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Event breakpoints: typing uppercase "DOM" doesn't show completions for events that start with "DOM"
https://bugs.webkit.org/show_bug.cgi?id=193384

Reviewed by Joseph Pecoraro.

UserInterface/Views/EventBreakpointPopover.js:

(WI.EventBreakpointPopover.prototype.show):

2:59 PM Changeset in webkit [239954] by Alan Coon

1 copy in tags/Safari-607.1.20.2

New tag.

2:52 PM Changeset in webkit [239953] by Devin Rousso

4 edits in trunk/Source/WebInspectorUI

Web Inspector: Event breakpoints: text field and completion popover fonts should match
https://bugs.webkit.org/show_bug.cgi?id=193249

Reviewed by Matt Baker.

UserInterface/Views/EventBreakpointPopover.css:

(.popover .event-breakpoint-content > .event-type > input): Added.
(.popover .event-breakpoint-content > .event-type > input::placeholder): Added.

UserInterface/Views/EventBreakpointPopover.js:

(WI.EventBreakpointPopover.prototype.show):
(WI.EventBreakpointPopover.prototype._showSuggestionsView):
Subtract the <input> border and padding from the bounds position so the <input> text lines
up with the WI.CompletionSuggestionsView text.

UserInterface/Views/CompletionSuggestionsView.js:

(WI.CompletionSuggestionsView):
Drive-by: force dir=ltr to match the text-align: left; CSS styling.

2:51 PM Changeset in webkit [239952] by rniwa@webkit.org

15 edits in trunk/Source/WebCore

Remove redundant check for alignAttr and hiddenAttr in various isPresentationAttribute overrides
https://bugs.webkit.org/show_bug.cgi?id=193410

Reviewed by Simon Fraser.

Removed redundant checks for check for alignAttr and hiddenAttr in isPresentationAttribute overrides
in HTMLElement subclasses since HTMLElement::isPresentationAttribute already checks for those attributes.

html/HTMLDivElement.cpp:

(WebCore::HTMLDivElement::isPresentationAttribute const): Deleted.

html/HTMLDivElement.h:
html/HTMLEmbedElement.cpp:

(WebCore::HTMLEmbedElement::isPresentationAttribute const): Deleted.

html/HTMLEmbedElement.h:
html/HTMLHRElement.cpp:

(WebCore::HTMLHRElement::isPresentationAttribute const):

html/HTMLIFrameElement.cpp:

(WebCore::HTMLIFrameElement::isPresentationAttribute const):

html/HTMLImageElement.cpp:

(WebCore::HTMLImageElement::isPresentationAttribute const):

html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::isPresentationAttribute const):

html/HTMLParagraphElement.cpp:

(WebCore::HTMLParagraphElement::isPresentationAttribute const): Deleted.

html/HTMLParagraphElement.h:
html/HTMLTableCaptionElement.cpp:

(WebCore::HTMLTableCaptionElement::isPresentationAttribute const): Deleted.

html/HTMLTableCaptionElement.h:
html/HTMLTableElement.cpp:

(WebCore::HTMLTableElement::isPresentationAttribute const):

html/HTMLTablePartElement.cpp:

(WebCore::HTMLTablePartElement::isPresentationAttribute const):

2:31 PM Changeset in webkit [239951] by yusukesuzuki@slowstart.org

13 edits
1 add in trunk

[JSC] Do not use asArrayModes() with Structures because it discards TypedArray information
https://bugs.webkit.org/show_bug.cgi?id=193372

Reviewed by Saam Barati.

JSTests:

stress/typed-array-array-modes-profile.js: Added.

(foo):

Source/JavaScriptCore:

When RegisteredStructureSet is filtered with AbstractValue, we use structure, SpeculationType, and ArrayModes.
However, we use asArrayModes() function with IndexingMode to compute the ArrayModes in AbstractValue. This is
wrong since this discards TypedArray ArrayModes. As a result, if RegisteredStructureSet with TypedArrays is
filtered with ArrayModes of AbstractValue populated from TypedArrays, we filter all the structures out since
AbstractValue's ArrayModes become NonArray, which is wrong with the TypedArrays' ArrayModes. This leads to
incorrect FTL code generation with MultiGetByOffset etc. nodes because,

AI think that this MultiGetByOffset never succeeds since all the values of RegisteredStructureSet are filtered out by the AbstractValue.
AI says the state of MultiGetByOffset is invalid since AI think it never succeeds.
So subsequent code becomes FTL crash code since AI think the execution should do OSR exit.
Then, FTL emits the code for MultiGetByOffset, and emits crash after that.
But in reality, the incoming value can match to the one of the RegisteredStructureSet value since (1)'s structures are incorrectly filtered by the incorrect ArrayModes.
Then, the execution goes on, and falls into the FTL crash.

This patch fixes the incorrect ArrayModes calculation by the following changes

Rename asArrayModes to asArrayModesIgnoringTypedArrays.
Fix incorrect asArrayModesIgnoringTypedArrays use in our code. Use arrayModesFromStructure instead.
Fix OSR exit code which stores incorrect ArrayModes to the profiles.

bytecode/ArrayProfile.cpp:

(JSC::dumpArrayModes):
(JSC::ArrayProfile::computeUpdatedPrediction):

bytecode/ArrayProfile.h:

(JSC::asArrayModesIgnoringTypedArrays):
(JSC::arrayModesFromStructure):
(JSC::arrayModesIncludeIgnoringTypedArrays):
(JSC::shouldUseSlowPutArrayStorage):
(JSC::shouldUseFastArrayStorage):
(JSC::shouldUseContiguous):
(JSC::shouldUseDouble):
(JSC::shouldUseInt32):
(JSC::asArrayModes): Deleted.
(JSC::arrayModeFromStructure): Deleted.
(JSC::arrayModesInclude): Deleted.

dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::observeTransitions):
(JSC::DFG::AbstractValue::set):
(JSC::DFG::AbstractValue::mergeOSREntryValue):
(JSC::DFG::AbstractValue::contains const):

dfg/DFGAbstractValue.h:

(JSC::DFG::AbstractValue::observeTransition):
(JSC::DFG::AbstractValue::validate const):
(JSC::DFG::AbstractValue::observeIndexingTypeTransition):

dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::fromObserved):
(JSC::DFG::ArrayMode::alreadyChecked const):

dfg/DFGArrayMode.h:

(JSC::DFG::ArrayMode::structureWouldPassArrayModeFiltering):
(JSC::DFG::ArrayMode::arrayModesThatPassFiltering const):
(JSC::DFG::ArrayMode::arrayModesWithIndexingShape const):

dfg/DFGOSRExit.cpp:

(JSC::DFG::OSRExit::executeOSRExit):
(JSC::DFG::OSRExit::compileExit):

dfg/DFGRegisteredStructureSet.cpp:

(JSC::DFG::RegisteredStructureSet::filterArrayModes):
(JSC::DFG::RegisteredStructureSet::arrayModesFromStructures const):

ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

jit/JITInlines.h:

(JSC::JIT::chooseArrayMode):
(JSC::arrayProfileSaw): Deleted.

runtime/JSType.h:

(JSC::isTypedArrayType):

2:23 PM Changeset in webkit [239950] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.22/Source/WTF

Merge r239873 - WorkQueue::concurrentApply() passes a raw pointer to a temporary String to Thread::create().
https://bugs.webkit.org/show_bug.cgi?id=191350

Reviewed by Brent Fulgham.

The non COCOA version of WorkQueue::concurrentApply() creates a temporary
String for the threadName and passes the raw pointer of this String to
Thread::create(). After freeing this String, Thread::entryPoint() uses
the raw char pointer to internally initialize the thread.

The fix is to use a single literal string for all the threads' names since
they are created for a thread-pool.

wtf/WorkQueue.cpp:

(WTF::WorkQueue::concurrentApply):

2:23 PM Changeset in webkit [239949] by Michael Catanzaro

3 edits
2 adds in releases/WebKitGTK/webkit-2.22

Merge r239642 - Parsed protocol of javascript URLs with embedded newlines and carriage returns do not match parsed protocol in Chrome and Firefox
https://bugs.webkit.org/show_bug.cgi?id=193155
<rdar://problem/40230982>

Reviewed by Chris Dumez.

Source/WebCore:

Test: fast/loader/comment-only-javascript-url.html

Make a special case for URLs beginning with 'javascript:'. We should always
treat these as JS URLs, even if the content contained within the URL
string might match other parts of the URL parsing spec.

html/URLUtils.h:

(WebCore::URLUtils<T>::protocol const):

LayoutTests:

fast/loader/comment-only-javascript-url-expected.txt: Added.
fast/loader/comment-only-javascript-url.html: Added.

2:19 PM Changeset in webkit [239948] by commit-queue@webkit.org

49 edits in trunk

Unreviewed, rolling out r239901, r239909, r239910, r239912,
r239913, and r239914.
https://bugs.webkit.org/show_bug.cgi?id=193407

These revisions caused an internal failure (Requested by
Truitt on #webkit).

Reverted changesets:

"[Cocoa] Avoid importing directly from subumbrella frameworks"
https://bugs.webkit.org/show_bug.cgi?id=186016
https://trac.webkit.org/changeset/239901

"Tried to fix USE(APPLE_INTERNAL_SDK) builds after r239901."
https://trac.webkit.org/changeset/239909

"Tried to fix the build."
https://trac.webkit.org/changeset/239910

"Fixed iOS builds after r239910."
https://trac.webkit.org/changeset/239912

"More build fixing."
https://trac.webkit.org/changeset/239913

"Tried to fix USE(APPLE_INTERNAL_SDK) 32-bit builds."
https://trac.webkit.org/changeset/239914

2:16 PM Changeset in webkit [239947] by mark.lam@apple.com

14 edits in trunk

Re-enable ability to build --cloop builds.
https://bugs.webkit.org/show_bug.cgi?id=192955
Source/JavaScriptCore:

<rdar://problem/46882363>