Context Navigation

← Previous Period
Next Period →

Timeline

Jan 17, 2019:

8:15 PM Changeset in webkit [240139] by Wenson Hsieh

23 edits
4 adds in trunk

[iOS] Content offset jumps erratically when autoscrolling near scroll view content inset areas
https://bugs.webkit.org/show_bug.cgi?id=193494
<rdar://problem/46859627>

Reviewed by Simon Fraser and Tim Horton.

Source/WebCore:

When computing the content offset to scroll to when revealing a given rect in content coordinates, we currently
just use the unobscured content rect. As a result, when scrolling to reveal a rect, we'll clamp the final scroll
position such that only content is visible. For example, when asked to reveal the rect (0, 0, 1, 1), we adjust
the scroll position to be the origin.

However, consider the case where a client (e.g. Mail on iOS) has added a content inset to the web view's scroll
view. If we're asked to reveal a rect that is outside the content area but within a content inset, we will still
end up clamping the scroll position to the unobscured rect. This manifests in a bug where selecting text and
autoscrolling in iOS Mail compose while the scroll view is scrolled all the way to the top to reveal the To/Cc/
Subject fields causes the content offset to jump to the origin, rather than staying at (0, -topContentInset).

To fix this, we teach RenderLayer::scrollRectToVisible about content insets that are visible. Rather than use
the content rects as-is, expand to encompass visible content insets as well. This ensures that revealing a
position which is already visible won't cause us to scroll away the content inset area and only show the
unobscured rect.

Tests: editing/selection/ios/autoscroll-with-top-content-inset.html

fast/scrolling/ios/scroll-into-view-with-top-content-inset.html

page/FrameView.cpp:

(WebCore::FrameView::unobscuredContentRectExpandedByContentInsets const):

Introduce a helper method that expands the unobscured content rect to include surrounding content insets.

page/FrameView.h:
page/Page.h:

(WebCore::Page::contentInsets const):
(WebCore::Page::setContentInsets):

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::scrollRectToVisible):
(WebCore::RenderLayer::getRectToExpose const):

Source/WebKit:

Adds contentInsets to VisibleContentRectUpdateInfo. This keeps track of the visible content insets
surrounding the unobscured content rect. See WebCore ChangeLog for more details.

Shared/VisibleContentRectUpdateInfo.cpp:

(WebKit::VisibleContentRectUpdateInfo::encode const):
(WebKit::VisibleContentRectUpdateInfo::decode):
(WebKit::operator<<):

Shared/VisibleContentRectUpdateInfo.h:

(WebKit::VisibleContentRectUpdateInfo::VisibleContentRectUpdateInfo):
(WebKit::VisibleContentRectUpdateInfo::contentInsets const):
(WebKit::operator==):

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _computedObscuredInset]):
(-[WKWebView _computedContentInset]):
(-[WKWebView _computedUnobscuredSafeAreaInset]):

We don't care about source compatibility with iOS 10 and below anymore, so we should change these >= iOS 11
target checks to simply PLATFORM(IOS).

(-[WKWebView _updateVisibleContentRects]):

Compute the visible content insets on all sides of the unobscured content rect. These insets are scaled to
content coordinates.

UIProcess/ios/WKContentView.h:
UIProcess/ios/WKContentView.mm:

(floatBoxExtent):

Add a helper to convert UIEdgeInsets to WebCore::FloatBoxExtent, and use it in a few places below.

(-[WKContentView didUpdateVisibleRect:unobscuredRect:contentInsets:unobscuredRectInScrollViewCoordinates:obscuredInsets:unobscuredSafeAreaInsets:inputViewBounds:scale:minimumScale:inStableState:isChangingObscuredInsetsInteractively:enclosedInScrollableAncestorView:]):
(-[WKContentView didUpdateVisibleRect:unobscuredRect:unobscuredRectInScrollViewCoordinates:obscuredInsets:unobscuredSafeAreaInsets:inputViewBounds:scale:minimumScale:inStableState:isChangingObscuredInsetsInteractively:enclosedInScrollableAncestorView:]): Deleted.

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::updateVisibleContentRects):

Update the Page's content insets.

Tools:

Add a new test option to add a top content inset to the test runner's WKWebView's scroll view, and automatically
scroll to reveal this top content inset area when beginning the test (i.e., scroll to (0, -topContentInset)).

DumpRenderTree/ios/UIScriptControllerIOS.mm:

(WTR::UIScriptController::contentOffsetX const):
(WTR::UIScriptController::contentOffsetY const):

TestRunnerShared/UIScriptContext/Bindings/UIScriptController.idl:
TestRunnerShared/UIScriptContext/UIScriptController.cpp:

(WTR::UIScriptController::contentOffsetX const):
(WTR::UIScriptController::contentOffsetY const):

TestRunnerShared/UIScriptContext/UIScriptController.h:

Also add new UIScriptController methods to ask for the content offset of the platform scroll view.

WebKitTestRunner/TestController.cpp:

(WTR::updateTestOptionsFromTestHeader):

WebKitTestRunner/TestOptions.h:

(WTR::TestOptions::hasSameInitializationOptions const):

WebKitTestRunner/ios/TestControllerIOS.mm:

(WTR::TestController::platformResetStateToConsistentValues):

WebKitTestRunner/ios/UIScriptControllerIOS.mm:

(WTR::UIScriptController::contentOffsetX const):
(WTR::UIScriptController::contentOffsetY const):

LayoutTests:

editing/selection/ios/autoscroll-with-top-content-inset-expected.txt: Added.
editing/selection/ios/autoscroll-with-top-content-inset.html: Added.

Add a new test to verify that moving the selection by autoscrolling near the top content inset area does not
cause the scroll view's content offset to jump.

fast/scrolling/ios/scroll-into-view-with-top-content-inset-expected.txt: Added.
fast/scrolling/ios/scroll-into-view-with-top-content-inset.html: Added.

Add a new test to verify that programmatically scrolling an element that's already visible into view does not
scroll away the scroll view's content inset.

resources/ui-helper.js:

(window.UIHelper.contentOffset):
(window.UIHelper):

6:11 PM Changeset in webkit [240138] by mark.lam@apple.com

24 edits in trunk/Source/JavaScriptCore

Audit bytecode fields and ensure that LLInt instructions for accessing them are appropriate.
https://bugs.webkit.org/show_bug.cgi?id=193557
<rdar://problem/47369125>

Reviewed by Yusuke Suzuki.

Rename some bytecode fields so that it's easier to discern whether the LLInt is accessing them the right way:
- distinguish between targetVirtualRegister and targetLabel.
- name all StructureID fields as structureID (oldStructureID, newStructureID) instead of structure (oldStructure, newStructure).

Use bitwise_cast in struct Fits when sizeof(T) == size. This prevents potential undefined behavior issues arising from doing assignments with reinterpret_cast'ed pointers.

Make Special::Pointer an unsigned type (previously int). Make ResolveType an unsigned type (previously int).

In LowLevelInterpreter*.asm:

rename the op macro argument to opcodeName or opcodeStruct respectively. This makes it clearer which argument type the macro is working with.

rename the name macro argument to opcodeName.

fix operator types to match the field type being accessed. The following may have resulted in bugs before:

The following should be read with getu() instead of get() because they are unsigned ints:

OpSwitchImm::m_tableIndex
OpSwitchChar::m_tableIndex
OpGetFromArguments::m_index
OpPutToArguments::m_index
OpGetRestLength::m_numParametersToSkip

OpJneqPtr::m_specialPointer should also be read with getu() though this
wasn't a bug because it was previously an int by default, and is only
changed to an unsigned int in this patch.

2.The following should be read with loadi (not loadp) because they are of

unsigned type (not a pointer):

OpResolveScope::Metadata::m_resolveType
CodeBlock::m_numParameters (see prepareForTailCall)

OpPutToScope::Metadata::m_operand should be read with loadp (not loadis) because it is a uintptr_t.

The following should be read with loadi (not loadis) because they are unsigned ints:

OpNegate::Metadata::m_arithProfile + ArithProfile::m_bits
OpPutById::Metadata::m_oldStructureID
OpPutToScope::Metadata::m_getPutInfo + GetPutInfo::m_operand

These may not have manifested in bugs because the operations that follow
the load are 32-bit instructions which ignore the high word.

Give class GetPutInfo a default constructor so that we can use bitwise_cast on it. Also befriend LLIntOffsetsExtractor so that we can take the offset of m_operand in it.

bytecode/ArithProfile.h:
bytecode/BytecodeList.rb:
bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::propagateTransitions):
(JSC::CodeBlock::finalizeLLIntInlineCaches):

bytecode/Fits.h:
bytecode/GetByIdMetadata.h:
bytecode/GetByIdStatus.cpp:

(JSC::GetByIdStatus::computeFromLLInt):

bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp:

(JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::clearLLIntGetByIdCache):

bytecode/PreciseJumpTargetsInlines.h:

(JSC::jumpTargetForInstruction):
(JSC::updateStoredJumpTargetsForInstruction):

bytecode/PutByIdStatus.cpp:

(JSC::PutByIdStatus::computeFromLLInt):

bytecode/SpecialPointer.h:
bytecompiler/BytecodeGenerator.cpp:

(JSC::Label::setLocation):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

jit/JITArithmetic.cpp:

(JSC::JIT::emit_compareAndJump):
(JSC::JIT::emit_compareUnsignedAndJump):
(JSC::JIT::emit_compareAndJumpSlow):

jit/JITArithmetic32_64.cpp:

(JSC::JIT::emit_compareAndJump):
(JSC::JIT::emit_compareUnsignedAndJump):
(JSC::JIT::emit_compareAndJumpSlow):
(JSC::JIT::emitBinaryDoubleOp):

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_jmp):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_jeq):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::emit_op_jneq):
(JSC::JIT::compileOpStrictEqJump):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_check_tdz):
(JSC::JIT::emitSlow_op_jeq):
(JSC::JIT::emitSlow_op_jneq):
(JSC::JIT::emit_op_profile_type):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_jmp):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_jeq):
(JSC::JIT::emitSlow_op_jeq):
(JSC::JIT::emit_op_jneq):
(JSC::JIT::emitSlow_op_jneq):
(JSC::JIT::compileOpStrictEqJump):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_check_tdz):
(JSC::JIT::emit_op_profile_type):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::setupGetByIdPrototypeCache):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
runtime/CommonSlowPaths.cpp:
runtime/GetPutInfo.h:

4:53 PM Changeset in webkit [240137] by Kocsen Chung

7 edits in branches/safari-607-branch/Source

Versioning.

4:43 PM Changeset in webkit [240136] by Truitt Savell

39 edits
22 deletes in trunk

Unreviewed, rolling out r240124.

This commit broke an internal build.

Reverted changeset:

"SDK_VARIANT build destinations should be separate from non-
SDK_VARIANT builds"
https://bugs.webkit.org/show_bug.cgi?id=189553
https://trac.webkit.org/changeset/240124

4:19 PM Changeset in webkit [240135] by Devin Rousso

2 edits in trunk/Source/WebCore

Web Inspector: fix Xcode project file list after r239976
https://bugs.webkit.org/show_bug.cgi?id=193474

Reviewed by Timothy Hatcher.

WebCore.xcodeproj/project.pbxproj:

4:17 PM Changeset in webkit [240134] by Kocsen Chung

7 edits in trunk/Source

Versioning.

4:09 PM Changeset in webkit [240133] by Kocsen Chung

1 copy in tags/Safari-607.1.24

Tag Safari-607.1.24.

2:54 PM Changeset in webkit [240132] by Ross Kirsling

2 edits in trunk/Source/WebCore

Unreviewed WinCairo fix -- hundreds of tests crash after r240031.

platform/network/curl/ResourceHandleCurl.cpp:

(WebCore::ResourceHandle::createCurlRequest):
(WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
(WebCore::ResourceHandle::receivedCredential):
(WebCore::ResourceHandle::getCredential):

1:45 PM Changeset in webkit [240131] by pvollan@apple.com

2 edits in trunk/Source/WebKitLegacy/win

[Win][HighDPI] Repaint glitches when scrolling.
https://bugs.webkit.org/show_bug.cgi?id=173152
<rdar://problem/45269953>

Reviewed by Brent Fulgham.

Non-integral device scale factors are causing repaint glitches, because the computation of the scroll
delta in pixel coordinates from the scroll delta in logical coordinates will not always be correct.
Instead of blitting the scroll rectangle, repaint the entire region affected by scrolling.

WebView.cpp:

(WebView::scrollBackingStore):

1:38 PM Changeset in webkit [240130] by achristensen@apple.com

2 edits in trunk/Tools

Fix string concatenation API test after r239920
https://bugs.webkit.org/show_bug.cgi?id=193551
<rdar://problem/47359304>

Reviewed by Youenn Fablet.

TestWebKitAPI/Tests/WTF/StringConcatenate.cpp:

(TestWebKitAPI::TEST):
Cocoa platforms' interpretation of UChar/unsigned short equality is not affected by ICU's recent change of UChar's type
in WebKit's build configuration like it apparently is on Linux.

1:36 PM Changeset in webkit [240129] by wilander@apple.com

11 edits in trunk

Add infrastructure to enable/disable ITP Debug Mode through Preferences
https://bugs.webkit.org/show_bug.cgi?id=193510
<rdar://problem/47330969>

Reviewed by Dean Jackson.

Source/WebCore:

No new tests. These changes are purely for settings/preferences.

page/RuntimeEnabledFeatures.h:

(WebCore::RuntimeEnabledFeatures::setItpDebugModeEnabled):
(WebCore::RuntimeEnabledFeatures::itpDebugModeEnabled const):
(WebCore::RuntimeEnabledFeatures::setResourceLoadStatisticsDebugMode): Deleted.
(WebCore::RuntimeEnabledFeatures::resourceLoadStatisticsDebugMode const): Deleted.

Renamed.

page/Settings.yaml:

Removed since this particular setting should not be persisted for privacy
reasons.

Source/WebKit:

NetworkProcess/Classifier/ResourceLoadStatisticsMemoryStore.cpp:

(WebKit::ResourceLoadStatisticsMemoryStore::ensurePrevalentResourcesForDebugMode):
(WebKit::ResourceLoadStatisticsMemoryStore::setResourceLoadStatisticsDebugMode):
(WebKit::ResourceLoadStatisticsMemoryStore::setPrevalentResourceForDebugMode):

These functions are now suited for runtime switching of ITP Debug Mode.

Shared/WebPreferences.yaml:

Changed name from ResourceLoadStatisticsDebugMode to ItpDebugModeEnabled.

UIProcess/API/Cocoa/WKPreferences.mm:

(-[WKPreferences _setItpDebugModeEnabled:]):
(-[WKPreferences _itpDebugModeEnabled]):

New private preferences functions.

UIProcess/API/Cocoa/WKPreferencesPrivate.h:
UIProcess/Cocoa/ResourceLoadStatisticsMemoryStoreCocoa.mm:

(WebKit::ResourceLoadStatisticsMemoryStore::registerUserDefaultsIfNeeded):

Removed support for old experimental user default. Added a new one that's
not connected to any UI, i.e. merely for command line debugging where
ITP Debug Mode needs to be on all the time.

LayoutTests:

http/tests/resourceLoadStatistics/set-custom-prevalent-resource-in-debug-mode.html:

Changed the order of function calls since testRunner.setStatisticsPrevalentResourceForDebugMode()
now has to be called before testRunner.setStatisticsDebugMode().

1:28 PM Changeset in webkit [240128] by aakash_jain@apple.com

2 edits in trunk/Tools

[ews-build] validate-patch should handle the case when bug_id is None
https://bugs.webkit.org/show_bug.cgi?id=193547

Reviewed by Lucas Forschler.

BuildSlaveSupport/ews-build/steps.py:

(ValidatePatch._is_bug_closed): Gracefully handle the case when bug_id is None.
(ValidatePatch.start): If bug_id is set as None in build properties, fetch it from the patch.

1:24 PM Changeset in webkit [240127] by aakash_jain@apple.com

2 edits in trunk/Tools

[ews-build] Add patch author information in build
https://bugs.webkit.org/show_bug.cgi?id=193465

Reviewed by Lucas Forschler.

BuildSlaveSupport/ews-build/steps.py:

(ValidatePatch._is_patch_obsolete):

1:14 PM Changeset in webkit [240126] by aakash_jain@apple.com

2 edits in trunk/Tools

[ews-build] Pass bug_id to the triggered builds
https://bugs.webkit.org/show_bug.cgi?id=193548

Reviewed by Lucas Forschler.

BuildSlaveSupport/ews-build/factories.py:

(BuildFactory.propertiesToPassToTriggers):

1:12 PM Changeset in webkit [240125] by timothy_horton@apple.com

4 edits in trunk/Source

Adopt NSTextCheckingSuppressInitialCapitalizationKey
https://bugs.webkit.org/show_bug.cgi?id=193545

Reviewed by Dean Jackson.

Source/WebCore/PAL:

pal/spi/mac/NSSpellCheckerSPI.h:

Source/WebKit:

UIProcess/mac/TextCheckerMac.mm:

(WebKit::TextChecker::checkTextOfParagraph):
(WebKit::TextChecker::getGuessesForWord):

12:46 PM Changeset in webkit [240124] by jer.noble@apple.com

39 edits
22 adds in trunk

SDK_VARIANT build destinations should be separate from non-SDK_VARIANT builds
https://bugs.webkit.org/show_bug.cgi?id=189553

Reviewed by Tim Horton.

Makefile.shared:

PerformanceTests:

MediaTime/Configurations/Base.xcconfig:
MediaTime/Configurations/SDKVariant.xcconfig: Added.

Source/bmalloc:

Configurations/Base.xcconfig:
Configurations/SDKVariant.xcconfig: Added.

Source/JavaScriptCore:

Configurations/Base.xcconfig:
Configurations/SDKVariant.xcconfig: Added.

Source/ThirdParty/ANGLE:

Configurations/Base.xcconfig:
Configurations/SDKVariant.xcconfig: Added.

Source/ThirdParty/libwebrtc:

Configurations/Base.xcconfig:
Configurations/SDKVariant.xcconfig: Added.

Source/WebCore:

Configurations/Base.xcconfig:
Configurations/SDKVariant.xcconfig: Added.
Configurations/WebCore.xcconfig:

Source/WebCore/PAL:

Configurations/Base.xcconfig:
Configurations/PAL.xcconfig:
Configurations/SDKVariant.xcconfig: Added.

Source/WebInspectorUI:

Configurations/Base.xcconfig:
Configurations/SDKVariant.xcconfig: Added.

Source/WebKit:

Configurations/Base.xcconfig:
Configurations/BaseTarget.xcconfig:
Configurations/SDKVariant.xcconfig: Added.

Source/WebKitLegacy/mac:

Configurations/Base.xcconfig:
Configurations/SDKVariant.xcconfig: Added.
Configurations/WebKitLegacy.xcconfig:

Source/WTF:

Configurations/Base.xcconfig:
Configurations/SDKVariant.xcconfig: Added.

Tools:

Add a check-webkit-style check that ensures all SDKVariant.xcconfig files match.

ContentExtensionTester/Configurations/Base.xcconfig:
ContentExtensionTester/Configurations/SDKVariant.xcconfig: Added.
DumpRenderTree/mac/Configurations/Base.xcconfig:
DumpRenderTree/mac/Configurations/SDKVariant.xcconfig: Added.
ImageDiff/cg/Configurations/Base.xcconfig:
ImageDiff/cg/Configurations/SDKVariant.xcconfig: Added.
MiniBrowser/Configurations/Base.xcconfig:
MiniBrowser/Configurations/SDKVariant.xcconfig: Added.
MobileMiniBrowser/Configurations/Base.xcconfig:
MobileMiniBrowser/Configurations/SDKVariant.xcconfig: Added.
Scripts/webkitpy/style/checker.py:

(_all_categories):
(FileType):
(CheckerDispatcher._file_type):
(CheckerDispatcher._create_checker):

Scripts/webkitpy/style/checkers/sdkvariant.py: Added.

(SDKVariantChecker):
(SDKVariantChecker.init):
(SDKVariantChecker.check):

TestWebKitAPI/Configurations/Base.xcconfig:
TestWebKitAPI/Configurations/SDKVariant.xcconfig: Added.
WebEditingTester/Configurations/Base.xcconfig:
WebEditingTester/Configurations/SDKVariant.xcconfig: Added.
WebKitLauncher/Configurations/SDKVariant.xcconfig: Added.
WebKitTestRunner/Configurations/Base.xcconfig:
WebKitTestRunner/Configurations/SDKVariant.xcconfig: Added.
lldb/lldbWebKitTester/Configurations/Base.xcconfig:
lldb/lldbWebKitTester/Configurations/SDKVariant.xcconfig: Added.

12:24 PM Changeset in webkit [240123] by jer.noble@apple.com

7 edits in trunk/Source/WebCore

MediaPlayerPrivateAVFoundationObjC can return incorrect paused information
https://bugs.webkit.org/show_bug.cgi?id=193499

Reviewed by Eric Carlson.

MediaPlayerPrivateAVFoundation uses rate() as an indicator of whether the player
is paused or not. This is incorrect when playback is stalled waiting for more data.
For MPPAVFObjC, use the timeControlStatus as a more accurate indicator of whether
the player is playing.

Now that we have correct play state information, we can remove the handlePlaybackCommand()
path when playing remotely for a more direct approach of notifying the HTMLMediaElement
that the play state has changed.

Drive-by fix: Before throwing away the AVPlayer, clear its output context. This keeps
remote devices from keeping the AVPlayer alive.

Drive-by fix #2: The NullMediaPlayer should always return "true" for paused(), not "false",
since it can't possibly play anything.

platform/graphics/MediaPlayer.cpp:
platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:

(WebCore::MediaPlayerPrivateAVFoundation::paused const):

platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:

(WebCore::MediaPlayerPrivateAVFoundation::platformPaused const):

platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::cancelLoad):
(WebCore::MediaPlayerPrivateAVFoundationObjC::platformPaused const):
(WebCore::MediaPlayerPrivateAVFoundationObjC::timeControlStatusDidChange):

11:34 AM Changeset in webkit [240122] by jiewen_tan@apple.com

3 edits in trunk/Source/WebCore

[Mac] Add a new quirk to HTMLFormControlElement::isMouseFocusable
https://bugs.webkit.org/show_bug.cgi?id=193478
<rdar://problem/34368591>

Reviewed by Brent Fulgham.

By default in macOS, submit buttons (controls) are not focusable. WebKit follows this system convention
as suggested by the spec: https://html.spec.whatwg.org/multipage/interaction.html#focusable-area. This
is also the convention Firefox respects. However, Chrome doesn't. ceac.state.gov is by far the only
website that assumes submit buttons are focusable, and will prohibit users from completing immigration
forms, such as DS160 if buttons are not. To help immigrations, we decide to add a new quirk to
HTMLFormControlElement::isMouseFocusable such that submit buttons are mouse focusable.

This quirk is for ceac.state.gov specifically, and therefore no tests.

html/HTMLFormControlElement.cpp:

(WebCore::HTMLFormControlElement::isMouseFocusable const):
(WebCore::HTMLFormControlElement::needsSiteSpecificQuirks const):

html/HTMLFormControlElement.h:

11:32 AM Changeset in webkit [240121] by achristensen@apple.com

3 edits in trunk/Source/WebCore

Fix WinCairo build after r240117
https://bugs.webkit.org/show_bug.cgi?id=193529

PlatformWin.cmake:
platform/network/curl/SocketStreamHandleImplCurl.cpp:

11:23 AM Changeset in webkit [240120] by youenn@apple.com

17 edits in trunk/Source/WebCore

Add release logging for incoming and outgoing webrtc audio tracks
https://bugs.webkit.org/show_bug.cgi?id=185545

Reviewed by Eric Carlson.

Add logging of audio tracks. When doing a WebRTC call,
one log line is added each second for each audio track.
Validated that logging is done through manual testing.

Refactored code to use LogHelper and apply it to video sources as well.

Modules/mediastream/libwebrtc/LibWebRTCMediaEndpoint.cpp:

(WebCore::LibWebRTCMediaEndpoint::addTrack):
(WebCore::LibWebRTCMediaEndpoint::sourceFromNewReceiver):
(WebCore::sourceFromNewReceiver): Deleted.

Modules/mediastream/libwebrtc/LibWebRTCMediaEndpoint.h:
platform/mediastream/RealtimeIncomingAudioSource.cpp:

(WebCore::RealtimeIncomingAudioSource::RealtimeIncomingAudioSource):
(WebCore::RealtimeIncomingAudioSource::logChannel const):
(WebCore::RealtimeIncomingAudioSource::logger const):

platform/mediastream/RealtimeIncomingAudioSource.h:

(WebCore::RealtimeIncomingAudioSource::setLogger):

platform/mediastream/RealtimeIncomingVideoSource.cpp:

(WebCore::RealtimeIncomingVideoSource::RealtimeIncomingVideoSource):
(WebCore::RealtimeIncomingVideoSource::logChannel const):
(WebCore::RealtimeIncomingVideoSource::logger const):

platform/mediastream/RealtimeIncomingVideoSource.h:

(WebCore::RealtimeIncomingVideoSource::setLogger):

platform/mediastream/RealtimeOutgoingAudioSource.cpp:

(WebCore::RealtimeOutgoingAudioSource::RealtimeOutgoingAudioSource):
(WebCore::RealtimeOutgoingAudioSource::sendAudioFrames):
(WebCore::RealtimeOutgoingAudioSource::logChannel const):
(WebCore::RealtimeOutgoingAudioSource::logger const):

platform/mediastream/RealtimeOutgoingAudioSource.h:

(WebCore::RealtimeOutgoingAudioSource::setLogger):

platform/mediastream/RealtimeOutgoingVideoSource.cpp:

(WebCore::RealtimeOutgoingVideoSource::RealtimeOutgoingVideoSource):
(WebCore::RealtimeOutgoingVideoSource::sendBlackFramesIfNeeded):
(WebCore::RealtimeOutgoingVideoSource::sendOneBlackFrame):
(WebCore::RealtimeOutgoingVideoSource::logChannel const):
(WebCore::RealtimeOutgoingVideoSource::logger const):

platform/mediastream/RealtimeOutgoingVideoSource.h:

(WebCore::RealtimeOutgoingVideoSource::setLogger):

platform/mediastream/mac/RealtimeIncomingAudioSourceCocoa.cpp:

(WebCore::RealtimeIncomingAudioSourceCocoa::OnData):

platform/mediastream/mac/RealtimeIncomingAudioSourceCocoa.h:
platform/mediastream/mac/RealtimeIncomingVideoSourceCocoa.mm:

(WebCore::RealtimeIncomingVideoSourceCocoa::pixelBufferPool):
(WebCore::RealtimeIncomingVideoSourceCocoa::pixelBufferFromVideoFrame):
(WebCore::RealtimeIncomingVideoSourceCocoa::OnFrame):

platform/mediastream/mac/RealtimeOutgoingAudioSourceCocoa.cpp:
platform/mediastream/mac/RealtimeOutgoingVideoSourceCocoa.cpp:

(WebCore::RealtimeOutgoingVideoSourceCocoa::sampleBufferUpdated):

platform/mediastream/mac/RealtimeOutgoingVideoSourceCocoa.mm:

(WebCore::RealtimeOutgoingVideoSourceCocoa::rotatePixelBuffer):

11:15 AM Changeset in webkit [240119] by dino@apple.com

7 edits
2 adds in trunk

(iPad) Link tapping is sluggish on many sites
https://bugs.webkit.org/show_bug.cgi?id=193522
<rdar://problem/47102987>

Reviewed by Wenson Hsieh.

Source/WebKit:

Some WKWebView clients might set the initial zoom scale of the page to
something other than 1, which disables the "fast tap" behaviour.
The fix is very simple -- just check against the initial scale rather
than 1.

The most likely regression from this would be pages designed for desktop,
but provide a viewport tag saying width=device-width and initial-scale.
They might stop allowing double-tap-to-zoom.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _allowsDoubleTapGestures]): Check against initial page scale.

LayoutTests:

Add a test that checks a double tap will trigger a click
event on a page that is at initial scale.

Extra bonus: for some reason adding this test, or making this code
change, uncovered a couple of bugs in existing tests. The
viewport-zooms-from-element-to-initial-scale test was completely wrong
because it was expecting the incorrect result, which was triggered by
the zoom callback firing early at a forced scale value. The
viewport-no-width-value-allows-double-tap test was triggering a JS
error in its UI script. I modernised both of these to use UIHelper instead.

fast/events/ios/fast-click-double-tap-sends-click-when-initial-scale-expected.txt: Added.
fast/events/ios/fast-click-double-tap-sends-click-when-initial-scale.html: Added.
fast/events/ios/viewport-no-width-value-allows-double-tap.html:
fast/events/ios/viewport-zooms-from-element-to-initial-scale-expected.txt:
fast/events/ios/viewport-zooms-from-element-to-initial-scale.html:
resources/ui-helper.js: Add doubleTapAt and zoomByDoubleTapAt helpers. Remove the

unnecessary "Done" return value from many of the callbacks. Give zoomToScale a return
value.
(window.UIHelper.tapAt.return.new.Promise):
(window.UIHelper.tapAt):
(window.UIHelper.doubleTapAt.return.new.Promise):
(window.UIHelper.doubleTapAt):
(window.UIHelper.zoomByDoubleTappingAt):
(window.UIHelper.activateAt.return.new.Promise):
(window.UIHelper.activateAt):
(window.UIHelper.toggleCapsLock):
(window.UIHelper.ensurePresentationUpdate.return.new.Promise):
(window.UIHelper.ensurePresentationUpdate):
(window.UIHelper.activateAndWaitForInputSessionAt.return.new.Promise.):
(window.UIHelper.activateFormControl.return.new.Promise.):
(window.UIHelper.replaceTextAtRange):
(window.UIHelper.zoomToScale):
(window.UIHelper.stylusTapAt.return.new.Promise):
(window.UIHelper.stylusTapAt):

11:13 AM Changeset in webkit [240118] by pvollan@apple.com

2 edits in trunk

[Win] gperf command not found
https://bugs.webkit.org/show_bug.cgi?id=193538
<rdar://problem/47250549>

Reviewed by Brent Fulgham.

CMake only searches for gperf if ENABLE_WEBCORE is on. ENABLE_WEBCORE needs to be set to ON.

Source/cmake/OptionsAppleWin.cmake:

11:10 AM Changeset in webkit [240117] by achristensen@apple.com

33 edits
3 adds in trunk/Source

Stop using NetworkStorageSession::storageSession in WebCore
https://bugs.webkit.org/show_bug.cgi?id=193529

Reviewed by Tim Horton.

Source/WebCore:

Ownership of the map that NetworkStorageSession::storageSession searches needs to move to the WebKit/WebKitLegacy layer,
so when WebCore used to look in this map it needs to call a client function to ask the layer above it for the storage object.
I've called this client StorageSessionProvider::storageSession. Right now it just looks in NetworkStorageSession::storageSession,
but this added abstraction makes it possible to move the currently process-global map to be a member of the NetworkProcess object.

Modules/websockets/WebSocketChannel.cpp:

(WebCore::WebSocketChannel::connect):

WebCore.xcodeproj/project.pbxproj:
loader/CookieJar.cpp:

(WebCore::CookieJar::create):
(WebCore::CookieJar::CookieJar):
(WebCore::CookieJar::cookies const):
(WebCore::CookieJar::setCookies):
(WebCore::CookieJar::cookiesEnabled const):
(WebCore::CookieJar::cookieRequestHeaderFieldValue const):
(WebCore::CookieJar::getRawCookies const):
(WebCore::CookieJar::deleteCookie):

loader/CookieJar.h:
loader/EmptyClients.cpp:

(WebCore::pageConfigurationWithEmptyClients):

page/Page.h:
page/SocketProvider.cpp:

(WebCore::SocketProvider::createSocketStreamHandle):

page/SocketProvider.h:
platform/network/NetworkingContext.h:
platform/network/SocketStreamHandleImpl.cpp:

(WebCore::cookieDataForHandshake):
(WebCore::SocketStreamHandleImpl::platformSendHandshake):

platform/network/StorageSessionProvider.h: Added.

(WebCore::StorageSessionProvider::~StorageSessionProvider):

platform/network/cf/SocketStreamHandleImpl.h:

(WebCore::SocketStreamHandleImpl::create):

platform/network/cf/SocketStreamHandleImplCFNet.cpp:

(WebCore::SocketStreamHandleImpl::SocketStreamHandleImpl):
(WebCore::SocketStreamHandleImpl::getStoredCONNECTProxyCredentials):

platform/network/curl/SocketStreamHandleImpl.h:

(WebCore::SocketStreamHandleImpl::create):

platform/network/soup/SocketStreamHandleImpl.h:
platform/network/soup/SocketStreamHandleImplSoup.cpp:

(WebCore::SocketStreamHandleImpl::create):

Source/WebKit:

NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::createSocketStream):

NetworkProcess/NetworkProcess.h:
NetworkProcess/NetworkSocketStream.cpp:

(WebKit::NetworkSocketStream::create):
(WebKit::NetworkSocketStream::NetworkSocketStream):

NetworkProcess/NetworkSocketStream.h:
NetworkProcess/NetworkStorageSessionProvider.h: Added.
WebKit.xcodeproj/project.pbxproj:
WebProcess/Network/WebSocketProvider.cpp:

(WebKit::WebSocketProvider::createSocketStreamHandle):

WebProcess/Network/WebSocketProvider.h:
WebProcess/WebPage/WebCookieJar.cpp:

(WebKit::WebCookieJar::WebCookieJar):

WebProcess/WebPage/WebCookieJar.h:

Source/WebKitLegacy:

WebCoreSupport/PageStorageSessionProvider.h: Added.
WebKitLegacy.xcodeproj/project.pbxproj:

Source/WebKitLegacy/mac:

Misc/WebCache.mm:

(+[WebCache addImageToCache:forURL:forFrame:]):

WebView/WebView.mm:

(-[WebView _commonInitializationWithFrameName:groupName:]):
(-[WebView initSimpleHTMLDocumentWithStyle:frame:preferences:groupName:]):

Source/WebKitLegacy/win:

WebView.cpp:

(WebView::initWithFrame):

11:03 AM Changeset in webkit [240116] by pvollan@apple.com

2 edits in trunk/LayoutTests

Layout Test js/dfg-int-overflow-in-loop.html is failing
https://bugs.webkit.org/show_bug.cgi?id=193540

Unreviewed test gardening.

platform/win/TestExpectations:

10:34 AM Changeset in webkit [240115] by Ross Kirsling

9 edits
5 deletes in trunk/LayoutTests

Get rid of Sputnik tests.
https://bugs.webkit.org/show_bug.cgi?id=193464

Rubber stamped by Saam Barati.

sputnik/: Removed.
platform/gtk/sputnik/: Removed.
platform/ios/sputnik/: Removed.
platform/mac/sputnik/: Removed.
platform/wpe/sputnik/: Removed.

TestExpectations:
platform/gtk/TestExpectations:
platform/ios-wk2/TestExpectations:
platform/ios/TestExpectations:
platform/mac/TestExpectations:
platform/win/TestExpectations:
platform/wincairo/TestExpectations:
platform/wpe/TestExpectations:

Remove all sputnik/ lines.

9:50 AM Changeset in webkit [240114] by sbarati@apple.com

19 edits
1 add
1 delete in trunk

StringObjectUse should not be a structure check for the original string object structure
https://bugs.webkit.org/show_bug.cgi?id=193483
<rdar://problem/47280522>

Reviewed by Yusuke Suzuki.

JSTests:

stress/cant-eliminate-string-object-structure-check-when-string-object-is-proven.js: Added.

(foo):
(a.valueOf.0):

Source/JavaScriptCore:

Prior to this patch, the use kind for StringObjectUse implied that we
do a StructureCheck on the input operand for the *original* StringObject
structure. This is generally not how we use UseKinds, so it's no surprise
that this is buggy. A UseKind should map to a set of SpeculatedTypes, not an
actual set of structures. This patch changes the meaning of StringObjectUse
to mean an object where jsDynamicCast<StringObject*> would succeed.

This patch also fixes a bug that was caused by the old and weird usage of the
UseKind to mean StructureCheck. Consider a program like this:
`
S1 = Original StringObject structure
S2 = Original StringObject structure with the field "f" added

a: GetLocal()
b: CheckStructure(@a, {S2})
c: ToString(StringObject:@a)
`

According to AI, in the above program, we would exit at @c, since
StringObject:@a implies a structure check of {S1}, and the intersection
of {S1} and {S2} is {}. So, we'd convert the program to be:
`
a: GetLocal()
b: CheckStructure(@a, {S2})
c: Check(StringObject:@a)
d: Unreachable
`

However, AI would set the proof status of the StringObject:@a edge
to be proven, since the SpeculatedType for @a is SpecStringObject.
This was incorrect of AI to do because the SpeculatedType itself
didn't capture the full power of StringObjectUse. However, having
a UseKind mean CheckStructure is weird precisely because what AI was
doing is a natural fit to how we typically we think about UseKinds.

So the above program would then incorrectly be converted to this, and
we'd crash when reaching the Unreachable node:
`
a: GetLocal()
b: CheckStructure(@a, {S2})
d: Unreachable
`

This patch makes it so that StringObjectUse just means that the object that
filters through a StringObjectUse check must !!jsDynamicCast<StringObject*>.
This is now in line with all other UseKinds. It also lets us simplify a bunch
of other code that had weird checks for the StringObjectUse UseKind.

This patch also makes it so that anywhere where we used to rely on
StringObjectUse implying a structure check we actually emit an explicit
CheckStructure node.

JavaScriptCore.xcodeproj/project.pbxproj:
bytecode/ExitKind.cpp:

(JSC::exitKindToString):

bytecode/ExitKind.h:
dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGCSEPhase.cpp:
dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGEdgeUsesStructure.h: Removed.
dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::attemptToForceStringArrayModeByToStringConversion):
(JSC::DFG::FixupPhase::addCheckStructureForOriginalStringObjectUse):
(JSC::DFG::FixupPhase::fixupToPrimitive):
(JSC::DFG::FixupPhase::fixupToStringOrCallStringConstructor):
(JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
(JSC::DFG::FixupPhase::isStringObjectUse): Deleted.

dfg/DFGGraph.cpp:

(JSC::DFG::Graph::canOptimizeStringObjectAccess):

dfg/DFGMayExit.cpp:
dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOrStringValueOf):
(JSC::DFG::SpeculativeJIT::speculateStringObject):
(JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):

dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure): Deleted.

dfg/DFGUseKind.h:

(JSC::DFG::alreadyChecked):
(JSC::DFG::usesStructure): Deleted.

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructorOrStringValueOf):
(JSC::FTL::DFG::LowerDFGToB3::speculateStringObject):
(JSC::FTL::DFG::LowerDFGToB3::speculateStringOrStringObject):
(JSC::FTL::DFG::LowerDFGToB3::speculateStringObjectForCell):
(JSC::FTL::DFG::LowerDFGToB3::speculateStringObjectForStructureID): Deleted.

runtime/JSType.cpp:

(WTF::printInternal):

runtime/JSType.h:
runtime/StringObject.h:

(JSC::StringObject::createStructure):

runtime/StringPrototype.h:

9:32 AM Changeset in webkit [240113] by yusukesuzuki@slowstart.org

2 edits in trunk/Source/JavaScriptCore

[JSC] Add generateHeapSnapshotForGCDebugging function to dump GCDebugging data
https://bugs.webkit.org/show_bug.cgi?id=193526

Reviewed by Michael Saboff.

This patch adds generateHeapSnapshotForGCDebugging to JSC shell to dump heap snapshot JSON string with GCDebugging option.
GCDebuggingSnapshot mode is slightly different from InspectorSnapshot in terms of both the output data and the behavior.
It always takes full snapshot, and it reports internal data too. This is useful to view the live heap objects after running
the code. Also, generateHeapSnapshotForGCDebugging returns String instead of parsing it to JSObject internally by calling
JSON.parse. If we convert the String to bunch of objects by using JSON.parse, it is difficult to call generateHeapSnapshotForGCDebugging
multiple times for debugging. Currently, it only generates a large string, which is easily distinguishable in the heap inspector tool.

jsc.cpp:

(GlobalObject::finishCreation):
(functionGenerateHeapSnapshotForGCDebugging):

8:36 AM Changeset in webkit [240112] by jonlee@apple.com

2 edits in trunk/Source/WebCore

[EME] Remove Amazon Prime Video from quirks list
https://bugs.webkit.org/show_bug.cgi?id=193514
rdar://problem/47295330

Reviewed by Jer Noble.

page/Quirks.cpp:

(WebCore::Quirks::hasBrokenEncryptedMediaAPISupportQuirk const):

8:24 AM Changeset in webkit [240111] by Alan Bujtas

4 edits in trunk

[LFC][BFC] An element with transform is a containing block for positioned descendants.
https://bugs.webkit.org/show_bug.cgi?id=193534

Reviewed by Antti Koivisto.

Source/WebCore:

"For elements whose layout is governed by the CSS box model, any value other than none for the transform
property also causes the element to establish a containing block for all descendants."
https://www.w3.org/TR/css-transforms-1/

layout/layouttree/LayoutBox.cpp:

(WebCore::Layout::Box::containingBlock const):

Tools:

LayoutReloaded/misc/LFC-passing-tests.txt:

8:07 AM Changeset in webkit [240110] by Simon Fraser

6 edits in trunk/Source/WebCore

ScrollingCoordinator: separate updating node geometry from node layers
https://bugs.webkit.org/show_bug.cgi?id=193527

Reviewed by Antti Koivisto.

Updating scrolling tree node layers happens in a different code path from updating geometry;
the former has to be post-flush, when GraphicsLayer has made tiled or structural layers.
Geometry only needs to be updated after layout, and soon we'll do this via compositing updates.

We can also clean up the ScrollingCoordinator API and have a single function that updates
node layers (handling different node types), and separate functions for pushing viewport-constrained
and scrolling node geometry.

No observable behavior change.

page/scrolling/AsyncScrollingCoordinator.cpp:

(WebCore::AsyncScrollingCoordinator::setNodeLayers):
(WebCore::AsyncScrollingCoordinator::setScrollingNodeGeometry):
(WebCore::AsyncScrollingCoordinator::setViewportConstraintedNodeGeometry):
(WebCore::AsyncScrollingCoordinator::updateFrameScrollingNode): Deleted.
(WebCore::AsyncScrollingCoordinator::updateOverflowScrollingNode): Deleted.
(WebCore::AsyncScrollingCoordinator::updateNodeLayer): Deleted.
(WebCore::AsyncScrollingCoordinator::updateNodeViewportConstraints): Deleted.

page/scrolling/AsyncScrollingCoordinator.h:
page/scrolling/ScrollingCoordinator.h:

(WebCore::ScrollingCoordinator::setNodeLayers):
(WebCore::ScrollingCoordinator::setScrollingNodeGeometry):
(WebCore::ScrollingCoordinator::setViewportConstraintedNodeGeometry):
(WebCore::ScrollingCoordinator::updateNodeLayer): Deleted.
(WebCore::ScrollingCoordinator::updateNodeViewportConstraints): Deleted.
(WebCore::ScrollingCoordinator::updateFrameScrollingNode): Deleted.
(WebCore::ScrollingCoordinator::updateOverflowScrollingNode): Deleted.

rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::updateScrollCoordinationForThisFrame):
(WebCore::RenderLayerCompositor::updateScrollCoordinatedLayer):

rendering/RenderLayerCompositor.h:

8:06 AM Changeset in webkit [240109] by Alan Bujtas

5 edits in trunk

[LFC][BFC][Quirk] Take body padding and border into account when stretching height.
https://bugs.webkit.org/show_bug.cgi?id=193528

Reviewed by Antti Koivisto.

Source/WebCore:

layout/blockformatting/BlockFormattingContextQuirks.cpp:

(WebCore::Layout::BlockFormattingContext::Quirks::stretchedInFlowHeight):

layout/displaytree/DisplayBox.h:

(WebCore::Display::Box::verticalBorder const):
(WebCore::Display::Box::horizontalBorder const):
(WebCore::Display::Box::verticalPadding const):
(WebCore::Display::Box::horizontalPadding const):

page/FrameViewLayoutContext.cpp:

(WebCore::layoutUsingFormattingContext):

Tools:

LayoutReloaded/misc/LFC-passing-tests.txt:

8:00 AM Changeset in webkit [240108] by Alan Bujtas

4 edits in trunk

Source/WebCore:
[LFC][BFC] For height computation, the bottom edge of the last line box value should not include top border/padding
https://bugs.webkit.org/show_bug.cgi?id=193520

Reviewed by Antti Koivisto.

This is similar to the other "10.6.3" cases. The bottom edge of the last inline box is in the coordinate systyem
of the containing block's border box (and for content height computation it needs to be mapped to the containing block's content box instead).

layout/blockformatting/BlockFormattingContextGeometry.cpp:

(WebCore::Layout::BlockFormattingContext::Geometry::inFlowNonReplacedHeightAndMargin):

Tools:
[LFC][BFC] For height computation, the bottom edge of the last line box value should include top border/padding
https://bugs.webkit.org/show_bug.cgi?id=193520

Reviewed by Antti Koivisto.

LayoutReloaded/misc/LFC-passing-tests.txt:

5:52 AM Changeset in webkit [240107] by aakash_jain@apple.com

2 edits in trunk/Tools

[ews-build] unapply-patch step should not update source
https://bugs.webkit.org/show_bug.cgi?id=193234

Reviewed by Lucas Forschler.

BuildSlaveSupport/ews-build/steps.py:

(CleanWorkingDirectory): Use clean-webkit script to clean the working directory.
(UnApplyPatchIfRequired): Use CleanWorkingDirectory as base class.

12:10 AM Changeset in webkit [240106] by yusukesuzuki@slowstart.org

4 edits
1 add in trunk

[JSC] ToThis omission in DFGByteCodeParser is wrong
https://bugs.webkit.org/show_bug.cgi?id=193513
<rdar://problem/45842236>

Reviewed by Saam Barati.

JSTests:

stress/to-this-omission-with-different-strict-modes.js: Added.

(thisA):
(thisAStrictWrapper):

Source/JavaScriptCore:

DFGByteCodeParser omitted ToThis node when we have ToThis(ToThis(value)). This semantics is wrong if ToThis has different semantics
in the sloppy mode and the strict mode. If we convert ToThisInSloppyMode(ToThisInStrictMode(boolean)) to ToThisInStrictMode(boolean),
we get boolean instead of BooleanObject.

This optimization is introduced more than 7 years ago, and from that, we have several optimizations that can remove such ToThis nodes
in BytecodeParser, AI, and Fixup. Furthermore, this optimization is simply wrong since toThis() function of JSCell can be defined
as they want. Before ensuring all the toThis function is safe, we should not fold ToThis(ToThis(value)) => ToThis(value).
This patch just removes the problematic optimization. The performance numbers look neutral.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

Jan 16, 2019:

11:46 PM Changeset in webkit [240105] by Simon Fraser

10 edits
1 copy
1 add in trunk/Source/WebCore

Stub out scrolling tree classes for overflow scrolling nodes on macOS
https://bugs.webkit.org/show_bug.cgi?id=193524

Reviewed by Antti Koivisto.

Add an empty implementation of ScrollingTreeOverflowScrollingNodeMac for macOS. Change
ScrollingTreeMac::createScrollingTreeNode() to create these nodes.

Minor refactor of RenderLayerCompositor::useCoordinatedScrollingForLayer() code to ask
the scrolling coordinator if it can coordinate scrolling for this layer; no behavior
change for existing code paths.

SourcesCocoa.txt:
WebCore.xcodeproj/project.pbxproj:
page/scrolling/ScrollingCoordinator.cpp:

(WebCore::ScrollingCoordinator::coordinatesScrollingForOverflowLayer const):

page/scrolling/ScrollingCoordinator.h:
page/scrolling/mac/ScrollingStateFrameScrollingNodeMac.mm:
page/scrolling/mac/ScrollingTreeMac.cpp:

(ScrollingTreeMac::createScrollingTreeNode):

page/scrolling/mac/ScrollingTreeOverflowScrollingNodeMac.h: Copied from Source/WebCore/page/scrolling/mac/ScrollingStateFrameScrollingNodeMac.mm.
page/scrolling/mac/ScrollingTreeOverflowScrollingNodeMac.mm: Added.

(WebCore::ScrollingTreeOverflowScrollingNodeMac::create):
(WebCore::ScrollingTreeOverflowScrollingNodeMac::ScrollingTreeOverflowScrollingNodeMac):
(WebCore::ScrollingTreeOverflowScrollingNodeMac::~ScrollingTreeOverflowScrollingNodeMac):
(WebCore::ScrollingTreeOverflowScrollingNodeMac::commitStateBeforeChildren):
(WebCore::ScrollingTreeOverflowScrollingNodeMac::commitStateAfterChildren):
(WebCore::ScrollingTreeOverflowScrollingNodeMac::updateLayersAfterAncestorChange):
(WebCore::ScrollingTreeOverflowScrollingNodeMac::scrollPosition const):
(WebCore::ScrollingTreeOverflowScrollingNodeMac::setScrollLayerPosition):
(WebCore::ScrollingTreeOverflowScrollingNodeMac::updateLayersAfterDelegatedScroll):

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::usesAsyncScrolling const):

rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::useCoordinatedScrollingForLayer const):

rendering/RenderLayerCompositor.h:

9:56 PM Changeset in webkit [240104] by Dewei Zhu

6 edits
1 add in trunk/Websites/perf.webkit.org

Add UI in analysis task page to show commit testability information.
https://bugs.webkit.org/show_bug.cgi?id=192972

Reviewed by Ryosuke Niwa.

Add UI in custom analysis task configuration and customizable test group form to show testability information.
Fix a bug in 'CustomAnalysisTaskConfigurator._updateCommitSetMap' that 'currentComparison' is incorrectly set.
SQL to update existing database:

ALTER TABLE commits ADD COLUMN IF NOT EXISTS commit_testability varchar(128) DEFAULT NULL;

browser-tests/custom-analysis-task-configurator-tests.js: Added a unit test for the bug in

'CustomAnalysisTaskConfigurator._updateCommitSetMap'.
Added a unit test to make sure 'CustomAnalysisTaskConfigurator' still works when commit fetching never returns.

browser-tests/index.html: Imported custom-analysis-task-configurator-tests.js'.
init-database.sql: Increase 'commit_testability' field length from 64 characters to 128.
public/v3/components/custom-analysis-task-configurator.js: Added UI to show testability information.

(CustomAnalysisTaskConfigurator):
(CustomAnalysisTaskConfigurator.prototype._didUpdateSelectedPlatforms): Should reset related field for corresponding
repositories that user does not specify revision.
(CustomAnalysisTaskConfigurator.prototype._updateMapFromSpecifiedRevisionsForConfiguration): A helper function
to update '_specifiedCommits' and '_invalidRevisionsByConfiguration' per '_specifiedRevisions'.
(CustomAnalysisTaskConfigurator.prototype.render):
(CustomAnalysisTaskConfigurator.prototype._updateCommitSetMap): Fixed a bug that 'currentComparison' is incorrectly set.
(CustomAnalysisTaskConfigurator.prototype._computeCommitSet):
(CustomAnalysisTaskConfigurator.prototype.async._fetchCommitsForConfiguration):
(CustomAnalysisTaskConfigurator.prototype.async._resolveRevision):
(CustomAnalysisTaskConfigurator.prototype._buildRevisionTable):
(CustomAnalysisTaskConfigurator.prototype._buildTestabilityList):
(CustomAnalysisTaskConfigurator.prototype._selectRepositoryGroup):
(CustomAnalysisTaskConfigurator.prototype._buildRevisionInput):
(CustomAnalysisTaskConfigurator.cssTemplate):

public/v3/components/customizable-test-group-form.js: Added UI to show testability information.

(CustomizableTestGroupForm.prototype._renderCustomRevisionTable):
(CustomizableTestGroupForm.prototype._constructTestabilityRows.):
(CustomizableTestGroupForm.prototype._constructTestabilityRows):
(CustomizableTestGroupForm.prototype._constructRevisionRadioButtons):
Changing either revision editor or radio button should trigger a re-render as testability
information for updated revision may change.
(CustomizableTestGroupForm.cssTemplate):

public/v3/models/commit-set.js:

(IntermediateCommitSet.prototype.commitsWithTestability): Renamed from 'commitsWithTestabilityWarnings'.
(IntermediateCommitSet.prototype.commitsWithTestabilityWarnings): Deleted.

7:19 PM Changeset in webkit [240103] by Kocsen Chung

1 edit in branches/safari-607-branch/Source/WebKit/UIProcess/WebAuthentication/fido/CtapHidDriver.cpp

[WebAuthN] Change the nonce in the CTAP kInit command to weak random values
https://bugs.webkit.org/show_bug.cgi?id=192061
<rdar://problem/46471091>

Reviewed by Chris Dumez.

Change the nonce in the CTAP kInit command to weak random values as the nonce is mainly
for being a probabilistically unique global identifier for hand shakes, instead of
preventing replay attacks. Otherwise, it might exhaust system entropy unnecessarily.

The patch also removes all logging when debugging the test case flakiness.

UIProcess/WebAuthentication/AuthenticatorManager.cpp:

(WebKit::AuthenticatorManager::respondReceived):
(WebKit::AuthenticatorManager::initTimeOutTimer):
(WebKit::AuthenticatorManager::timeOutTimerFired):

UIProcess/WebAuthentication/Cocoa/HidService.mm:

(WebKit::HidService::deviceAdded):

UIProcess/WebAuthentication/Mock/MockAuthenticatorManager.cpp:

(WebKit::MockAuthenticatorManager::respondReceivedInternal):

UIProcess/WebAuthentication/Mock/MockHidConnection.cpp:

(WebKit::MockHidConnection::send):

UIProcess/WebAuthentication/fido/CtapHidAuthenticator.cpp:

(WebKit::CtapHidAuthenticator::makeCredential):
(WebKit::CtapHidAuthenticator::getAssertion):

UIProcess/WebAuthentication/fido/CtapHidDriver.cpp:

(WebKit::CtapHidDriver::Worker::write):
(WebKit::CtapHidDriver::Worker::read):
(WebKit::CtapHidDriver::Worker::returnMessage):
(WebKit::CtapHidDriver::transact):
(WebKit::CtapHidDriver::continueAfterChannelAllocated):
(WebKit::CtapHidDriver::continueAfterResponseReceived):

5:37 PM Changeset in webkit [240102] by aboya@igalia.com

4 edits
4 adds in trunk/LayoutTests

Unreviewed GTK and WPE test gardening.
https://bugs.webkit.org/show_bug.cgi?id=193521

platform/gtk/TestExpectations:
platform/gtk/imported/w3c/web-platform-tests/fetch/security/dangling-markup-mitigation-data-url.tentative.sub-expected.txt: Added.
platform/gtk/inspector/canvas/recording-bitmaprenderer-expected.txt:
platform/wpe/TestExpectations:
platform/wpe/imported/w3c/web-platform-tests/fetch/security/dangling-markup-mitigation-data-url.tentative.sub-expected.txt: Added.

5:35 PM Changeset in webkit [240101] by Justin Fan

4 edits in trunk

[WebGPU] Update vertex-buffer-triangle-strip.html to actually use vertex buffer
https://bugs.webkit.org/show_bug.cgi?id=193473

Reviewed by Dean Jackson and Myles Maxfield.

Source/WebCore:

Also, switch to using the inputSlot instead of the shaderLocation field, as this seems more correct.
As of now I cannot determine an analog for WebGPU's shaderLocation in Metal.

Test: Covered by vertex-buffer-triangle-strip.html. No change in behavior.

platform/graphics/gpu/cocoa/GPURenderPipelineMetal.mm:

(WebCore::setInputStateForPipelineDescriptor): Use the inputSlot instead of shaderLocation as bufferIndex.

LayoutTests:

Refactor the vertex shader to use the vertex stage input, rather than buffer resources.

webgpu/vertex-buffer-triangle-strip.html:

5:18 PM Changeset in webkit [240100] by youenn@apple.com

21 edits
2 adds in trunk

Add a new SPI for controlling getUserMedia
https://bugs.webkit.org/show_bug.cgi?id=192793

Reviewed by Eric Carlson.

Source/WebKit:

Some weaknesses of the current getUserMedia/enumerateDevices SPI were found.
In particular:

The hash salt should be handled by WebKit not by apps using WebKit.
No need to expose the frame URL, only the top level origin is needed.
The names of the callback are changed to improve the intent of these callbacks.

Addressed these by creating a new SPI which will replace the current one.
The current SPI will be removed later on.

Did some refactoring by making the callbacks not return false.
Instead, implement the default behavior inside the request objects as deny methods.
Some further refactoring will be done as a follow-up to better align the C API with the Cocoa API.

UIProcess/API/APIUIClient.h:

(API::UIClient::decidePolicyForUserMediaPermissionRequest):
(API::UIClient::checkUserMediaPermissionForOrigin):

UIProcess/API/C/WKPage.cpp:

(WKPageSetPageUIClient):

UIProcess/API/Cocoa/WKUIDelegatePrivate.h:
UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _mediaCaptureState]):
(-[WKWebView _setMediaCaptureMuted:]):

UIProcess/API/Cocoa/WKWebViewPrivate.h:
UIProcess/API/glib/WebKitUIClient.cpp:
UIProcess/Cocoa/MediaCaptureUtilities.h: Added.
UIProcess/Cocoa/MediaCaptureUtilities.mm: Added.
UIProcess/Cocoa/UIDelegate.h:
UIProcess/Cocoa/UIDelegate.mm:

(WebKit::UIDelegate::setDelegate):
(WebKit::requestUserMediaAuthorizationForFrame):
(WebKit::UIDelegate::UIClient::decidePolicyForUserMediaPermissionRequest):
(WebKit::UIDelegate::UIClient::checkUserMediaPermissionForOrigin):
(WebKit::UIDelegate::UIClient::mediaCaptureStateDidChange):

UIProcess/UserMediaPermissionCheckProxy.h:

(WebKit::UserMediaPermissionCheckProxy::deny):

UIProcess/UserMediaPermissionRequestManagerProxy.cpp:

(WebKit::UserMediaPermissionRequestManagerProxy::requestUserMediaPermissionForFrame):
(WebKit::UserMediaPermissionRequestManagerProxy::getUserMediaPermissionInfo):

UIProcess/UserMediaPermissionRequestProxy.h:

Tools:

MiniBrowser/mac/WK2BrowserWindowController.m:

(-[WK2BrowserWindowController _webView:requestUserMediaAuthorizationForFrame:devices:decisionHandler:]):
(-[WK2BrowserWindowController _webView:isMediaCaptureAuthorizedForFrame:decisionHandler:]):

TestWebKitAPI/Tests/WebKit/GetUserMediaNavigation.mm:

(-[NavigationWhileGetUserMediaPromptDisplayedUIDelegate _webView:requestMediaCaptureAuthorizationForFrame:devices:decisionHandler:]):

TestWebKitAPI/Tests/WebKit/GetUserMediaReprompt.mm:

(-[GetUserMediaRepromptUIDelegate _webView:requestMediaCaptureAuthorizationForFrame:devices:decisionHandler:]):

TestWebKitAPI/Tests/WebKit/MediaStreamTrackDetached.mm:

(-[MediaStreamTrackDetachedUIDelegate _webView:requestMediaCaptureAuthorizationForFrame:devices:decisionHandler:]):

TestWebKitAPI/Tests/WebKitCocoa/UserMediaDisabled.mm:

(-[UserMediaUIDelegate _webView:requestMediaCaptureAuthorizationForFrame:devices:decisionHandler:]):
(-[UserMediaUIDelegate _webView:isMediaCaptureAuthorizedForFrame:decisionHandler:]):

TestWebKitAPI/Tests/WebKitCocoa/UserMediaSimulateFailedSandbox.mm:

(-[SimulateFailedSandboxUIDelegate _webView:requestMediaCaptureAuthorizationForFrame:devices:decisionHandler:]):
(-[SimulateFailedSandboxUIDelegate _webView:isMediaCaptureAuthorizedForFrame:decisionHandler:]):

5:16 PM Changeset in webkit [240099] by youenn@apple.com

12 edits in trunk/Source/WebKit

Pipe cache quota request from Network Process to UIProcess
https://bugs.webkit.org/show_bug.cgi?id=193296

Reviewed by Alex Christensen.

When cache storage hits quota for a given origin, pipe the request back to NetworkProcess.
No record will be put until the quota request is answered.
The request is sent from CacheStorage::Caches to CacheStorage::Engine and to NetworkProcess.
NetworkProcess then sends it to NetworkProcessProxy.
Currently NetworkProcessProxy just answers by keeping the quota as it is.
In the future, NetworkProcessProxy should make a delegate call to let the app using WebKit
make a decision on the quota. This will allow prompting user to bump it as done for other data.

NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::requestCacheStorageSpace):

NetworkProcess/NetworkProcess.h:
NetworkProcess/cache/CacheStorageEngine.cpp:

(WebKit::CacheStorage::Engine::~Engine):
(WebKit::CacheStorage::Engine::from):
(WebKit::CacheStorage::Engine::Engine):
(WebKit::CacheStorage::Engine::requestSpace):
(WebKit::CacheStorage::Engine::requestSpaceCompleted):

NetworkProcess/cache/CacheStorageEngine.h:
NetworkProcess/cache/CacheStorageEngineCache.cpp:

(WebKit::CacheStorage::Cache::put):
(WebKit::CacheStorage::Cache::retryPuttingPendingRecords):

NetworkProcess/cache/CacheStorageEngineCache.h:
NetworkProcess/cache/CacheStorageEngineCaches.cpp:

(WebKit::CacheStorage::Caches::requestSpace):
(WebKit::CacheStorage::Caches::notifyCachesOfRequestSpaceEnd):

NetworkProcess/cache/CacheStorageEngineCaches.h:

(WebKit::CacheStorage::Caches::isRequestingSpace const):

UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::requestCacheStorageSpace):

UIProcess/Network/NetworkProcessProxy.h:
UIProcess/Network/NetworkProcessProxy.messages.in:

5:08 PM Changeset in webkit [240098] by mmaxfield@apple.com

5 edits
2 adds in trunk/Source/WebCore

[WHLSL] Add the function stage checker
https://bugs.webkit.org/show_bug.cgi?id=193479

Reviewed by Dean Jackson and Robin Morisset.

This is a translation of https://github.com/gpuweb/WHLSL/blob/master/Source/CheckNativeFuncStages.mjs into C++.

No new tests because it isn't hooked up yet. Not enough of the compiler exists to have any meaningful sort
of test. When enough of the compiler is present, I'll port the reference implementation's test suite.

Modules/webgpu/WHLSL/AST/WHLSLCallExpression.h:

(WebCore::WHLSL::AST::CallExpression::function):

Modules/webgpu/WHLSL/WHLSLFunctionStageChecker.cpp: Added.

(WebCore::WHLSL::FunctionStageChecker::FunctionStageChecker):
(WebCore::WHLSL::checkFunctionStages):

Modules/webgpu/WHLSL/WHLSLFunctionStageChecker.h: Added.
Modules/webgpu/WHLSL/WHLSLIntrinsics.cpp:

(WebCore::WHLSL::Intrinsics::add):

Modules/webgpu/WHLSL/WHLSLIntrinsics.h:

(WebCore::WHLSL::Intrinsics::ddx const):
(WebCore::WHLSL::Intrinsics::ddy const):
(WebCore::WHLSL::Intrinsics::allMemoryBarrier const):
(WebCore::WHLSL::Intrinsics::deviceMemoryBarrier const):
(WebCore::WHLSL::Intrinsics::groupMemoryBarrier const):
(WebCore::WHLSL::Intrinsics::WTF_ARRAY_LENGTH):

Sources.txt:
WebCore.xcodeproj/project.pbxproj:

4:59 PM Changeset in webkit [240097] by mmaxfield@apple.com

10 edits in trunk/Source/WebCore

[WHLSL] Delete the 'restricted' keyword
https://bugs.webkit.org/show_bug.cgi?id=193469

Reviewed by Dean Jackson and Robin Morisset.

This change mirrors https://github.com/gpuweb/WHLSL/pull/304 in the reference implementation.

Modules/webgpu/WHLSL/AST/WHLSLFunctionDefinition.h:

(WebCore::WHLSL::AST::FunctionDefinition::FunctionDefinition):
(WebCore::WHLSL::AST::FunctionDefinition::block):
(WebCore::WHLSL::AST::FunctionDefinition::restricted const): Deleted.

Modules/webgpu/WHLSL/AST/WHLSLNativeFunctionDeclaration.h:

(WebCore::WHLSL::AST::NativeFunctionDeclaration::NativeFunctionDeclaration):
(WebCore::WHLSL::AST::NativeFunctionDeclaration::restricted const): Deleted.

Modules/webgpu/WHLSL/WHLSLChecker.cpp:

(WebCore::WHLSL::resolveWithOperatorAnderIndexer):
(WebCore::WHLSL::resolveWithOperatorLength):
(WebCore::WHLSL::resolveWithReferenceComparator):

Modules/webgpu/WHLSL/WHLSLResolveOverloadImpl.cpp:

(WebCore::WHLSL::resolveFunctionOverloadImpl):

Modules/webgpu/WHLSL/WHLSLSynthesizeArrayOperatorLength.cpp:

(WebCore::WHLSL::synthesizeArrayOperatorLength):

Modules/webgpu/WHLSL/WHLSLSynthesizeConstructors.cpp:

(WebCore::WHLSL::synthesizeConstructors):

Modules/webgpu/WHLSL/WHLSLSynthesizeEnumerationFunctions.cpp:

(WebCore::WHLSL::synthesizeEnumerationFunctions):

Modules/webgpu/WHLSL/WHLSLSynthesizeStructureAccessors.cpp:

(WebCore::WHLSL::synthesizeStructureAccessors):

4:53 PM Changeset in webkit [240096] by mmaxfield@apple.com

4 edits
2 adds in trunk/Source/WebCore

[WHLSL] Implement the recursion checker
https://bugs.webkit.org/show_bug.cgi?id=193436

Reviewed by Saam Barati.

This is a translation of https://github.com/gpuweb/WHLSL/blob/master/Source/RecursionChecker.mjs into C++.

Modules/webgpu/WHLSL/AST/WHLSLCallExpression.h:

(WebCore::WHLSL::AST::CallExpression::function):

Modules/webgpu/WHLSL/WHLSLRecursionChecker.cpp: Copied from Source/WebCore/Modules/webgpu/WHLSL/WHLSLRecursiveTypeChecker.cpp.

(WebCore::WHLSL::checkRecursion):

Modules/webgpu/WHLSL/WHLSLRecursionChecker.h: Added.
Modules/webgpu/WHLSL/WHLSLRecursiveTypeChecker.cpp:
Sources.txt:
WebCore.xcodeproj/project.pbxproj:

4:31 PM Changeset in webkit [240095] by mmaxfield@apple.com

7 edits
1 copy
1 add in trunk/Source/WebCore

[WHLSL] Add the literal type checker
https://bugs.webkit.org/show_bug.cgi?id=193430

Reviewed by Dean Jackson.

This is a translation of https://github.com/gpuweb/WHLSL/blob/master/Source/LiteralTypeChecker.mjs into C++.

Modules/webgpu/WHLSL/AST/WHLSLFloatLiteralType.h:

(WebCore::WHLSL::AST::FloatLiteralType::value const):

Modules/webgpu/WHLSL/AST/WHLSLIntegerLiteralType.h:

(WebCore::WHLSL::AST::IntegerLiteralType::value const):

Modules/webgpu/WHLSL/AST/WHLSLUnsignedIntegerLiteralType.h:

(WebCore::WHLSL::AST::UnsignedIntegerLiteralType::value const):

Modules/webgpu/WHLSL/WHLSLLiteralTypeChecker.cpp: Added.

(WebCore::WHLSL::getNativeTypeDeclaration):
(WebCore::WHLSL::LiteralTypeChecker::visit):
(WebCore::WHLSL::checkLiteralTypes):

Modules/webgpu/WHLSL/WHLSLLiteralTypeChecker.h: Copied from Source/WebCore/Modules/webgpu/WHLSL/AST/WHLSLFloatLiteralType.h.
Sources.txt:
WebCore.xcodeproj/project.pbxproj:

4:20 PM Changeset in webkit [240094] by achristensen@apple.com

2 edits in trunk/Source/WebKit

sendBeacon to previously-unvisited https domain always fails
https://bugs.webkit.org/show_bug.cgi?id=193508

Reviewed by Geoffrey Garen.

NetworkProcess/PingLoad.cpp:

(WebKit::PingLoad::didReceiveChallenge):
If a ping load is doing a TLS handshake, continue if the server has good certificates.

4:17 PM Changeset in webkit [240093] by Alan Bujtas

4 edits in trunk

[LFC][BFC] Inflow non-replaced used width should not be negative.
https://bugs.webkit.org/show_bug.cgi?id=193495

Reviewed by Antti Koivisto.

Source/WebCore:

min-width (initial value 0) enforces non-negative used width.

layout/blockformatting/BlockFormattingContext.cpp:

(WebCore::Layout::BlockFormattingContext::computeWidthAndMargin const):

Tools:

LayoutReloaded/misc/LFC-passing-tests.txt:

4:14 PM Changeset in webkit [240092] by mmaxfield@apple.com

7 edits in trunk/Source/WebCore

[WHLSL] Add a handwritten parser
https://bugs.webkit.org/show_bug.cgi?id=192355

Reviewed by Dean Jackson.

The parser is a mechanical representation of WHLSL's ANTLR grammar at
https://github.com/gpuweb/WHLSL/blob/master/Spec/WHLSL.g4. The parser
uses Expected<> to return an appropriate Error string when parsing fails.

This patch doesn't include the AST nodes themselves - those are in
https://bugs.webkit.org/show_bug.cgi?id=192991. I split up the patch to
aid easier reviewing.

No new tests because the parser isn't hooked up yet.

Modules/webgpu/WHLSL/WHLSLParser.cpp:

(WebCore::WHLSL::Parser::Parser):
(WebCore::WHLSL::Parser::parse):
(WebCore::WHLSL::Parser::fail):
(WebCore::WHLSL::Parser::peek):
(WebCore::WHLSL::Parser::tryType):
(WebCore::WHLSL::Parser::tryTypes):
(WebCore::WHLSL::Parser::consumeType):
(WebCore::WHLSL::Parser::consumeTypes):
(WebCore::WHLSL::digitValue):
(WebCore::WHLSL::intLiteralToInt):
(WebCore::WHLSL::uintLiteralToUint):
(WebCore::WHLSL::floatLiteralToFloat):
(WebCore::WHLSL::Parser::consumeIntegralLiteral):
(WebCore::WHLSL::Parser::consumeNonNegativeIntegralLiteral):
(WebCore::WHLSL::recognizeSimpleUnsignedInteger):
(WebCore::WHLSL::Parser::parseConstantExpression):
(WebCore::WHLSL::Parser::parseTypeArgument):
(WebCore::WHLSL::Parser::parseTypeArguments):
(WebCore::WHLSL::Parser::parseTypeSuffixAbbreviated):
(WebCore::WHLSL::Parser::parseTypeSuffixNonAbbreviated):
(WebCore::WHLSL::Parser::parseAddressSpaceType):
(WebCore::WHLSL::Parser::parseNonAddressSpaceType):
(WebCore::WHLSL::Parser::parseType):
(WebCore::WHLSL::Parser::parseTypeDefinition):
(WebCore::WHLSL::Parser::parseBuiltInSemantic):
(WebCore::WHLSL::Parser::parseResourceSemantic):
(WebCore::WHLSL::Parser::parseSpecializationConstantSemantic):
(WebCore::WHLSL::Parser::parseStageInOutSemantic):
(WebCore::WHLSL::Parser::parseSemantic):
(WebCore::WHLSL::Parser::parseQualifiers):
(WebCore::WHLSL::Parser::parseStructureElement):
(WebCore::WHLSL::Parser::parseStructureDefinition):
(WebCore::WHLSL::Parser::parseEnumerationDefinition):
(WebCore::WHLSL::Parser::parseEnumerationMember):
(WebCore::WHLSL::Parser::parseNativeTypeDeclaration):
(WebCore::WHLSL::Parser::parseNumThreadsFunctionAttribute):
(WebCore::WHLSL::Parser::parseAttributeBlock):
(WebCore::WHLSL::Parser::parseParameter):
(WebCore::WHLSL::Parser::parseParameters):
(WebCore::WHLSL::Parser::parseFunctionDefinition):
(WebCore::WHLSL::Parser::parseEntryPointFunctionDeclaration):
(WebCore::WHLSL::Parser::parseRegularFunctionDeclaration):
(WebCore::WHLSL::Parser::parseOperatorFunctionDeclaration):
(WebCore::WHLSL::Parser::parseFunctionDeclaration):
(WebCore::WHLSL::Parser::parseNativeFunctionDeclaration):
(WebCore::WHLSL::Parser::parseBlock):
(WebCore::WHLSL::Parser::parseBlockBody):
(WebCore::WHLSL::Parser::parseIfStatement):
(WebCore::WHLSL::Parser::parseSwitchStatement):
(WebCore::WHLSL::Parser::parseSwitchCase):
(WebCore::WHLSL::Parser::parseForLoop):
(WebCore::WHLSL::Parser::parseWhileLoop):
(WebCore::WHLSL::Parser::parseDoWhileLoop):
(WebCore::WHLSL::Parser::parseVariableDeclaration):
(WebCore::WHLSL::Parser::parseVariableDeclarations):
(WebCore::WHLSL::Parser::parseStatement):
(WebCore::WHLSL::Parser::parseEffectfulExpression):
(WebCore::WHLSL::Parser::parseEffectfulAssignment):
(WebCore::WHLSL::Parser::parseEffectfulPrefix):
(WebCore::WHLSL::Parser::parseEffectfulSuffix):
(WebCore::WHLSL::Parser::parseLimitedSuffixOperator):
(WebCore::WHLSL::Parser::parseSuffixOperator):
(WebCore::WHLSL::Parser::parseExpression):
(WebCore::WHLSL::Parser::parseTernaryConditional):
(WebCore::WHLSL::Parser::parseAssignment):
(WebCore::WHLSL::Parser::parsePossibleTernaryConditional):
(WebCore::WHLSL::Parser::parsePossibleLogicalBinaryOperation):
(WebCore::WHLSL::Parser::parsePossibleRelationalBinaryOperation):
(WebCore::WHLSL::Parser::parsePossibleShift):
(WebCore::WHLSL::Parser::parsePossibleAdd):
(WebCore::WHLSL::Parser::parsePossibleMultiply):
(WebCore::WHLSL::Parser::parsePossiblePrefix):
(WebCore::WHLSL::Parser::parsePossibleSuffix):
(WebCore::WHLSL::Parser::parseCallExpression):
(WebCore::WHLSL::Parser::parseTerm):

Modules/webgpu/WHLSL/WHLSLParser.h:

(WebCore::WHLSL::Parser::Error::Error):
(WebCore::WHLSL::Parser::backtrackingScope):
(WebCore::WHLSL::Parser::SuffixExpression::SuffixExpression):
(WebCore::WHLSL::Parser::SuffixExpression::operator bool const):

3:54 PM Changeset in webkit [240091] by Alan Coon

2 edits in tags/Safari-608.1.1/Source/WebKit

Cherry-pick r240087. rdar://problem/47297304

Revert r239938
https://bugs.webkit.org/show_bug.cgi?id=193267
<rdar://problem/47297304>

Configurations/WebContent-iOS.entitlements:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@240087 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:52 PM Changeset in webkit [240090] by sihui_liu@apple.com

2 edits in trunk/Source/WebCore

IndexedDB: UniqueIDBDatabase should not be freed if the database task queue is not empty.
https://bugs.webkit.org/show_bug.cgi?id=193093

Reviewed by Brady Eidson.

performUnconditionalDeleteBackingStore killed the database task queue immediately, but performPrefetchCursor
task may be scheduled behind performUnconditionalDeleteBackingStore on database thread.

Modules/indexeddb/server/UniqueIDBDatabase.cpp:

(WebCore::IDBServer::UniqueIDBDatabase::shutdownForClose):
(WebCore::IDBServer::UniqueIDBDatabase::performPrefetchCursor):
(WebCore::IDBServer::UniqueIDBDatabase::isDoneWithHardClose):

3:50 PM Changeset in webkit [240089] by youenn@apple.com

4 edits in trunk/Source/WebKit

ASSERTION FAILED: m_networkLoadInformationByID.contains(identifier) in WebKit::NetworkConnectionToWebProcess::addNetworkLoadInformationMetrics
https://bugs.webkit.org/show_bug.cgi?id=189097
<rdar://problem/43856423>

Reviewed by Alex Christensen.

In case where the inspector is launched, it will instruct the NetworkConnectionToWebProcess to start capturing network metrics.
If this happens in the middle of a load, addNetworkLoadInformationMetrics might fail since addNetworkLoadInformation will not be called.
To fix this issue, store whether to capture metrics at NetworkResourceLoader level.

To ensure that the case of switching back and forth capture of metrics, disable loader capture of metrics whenver NetworkConnectionToWebProcess is asked to.

NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::setCaptureExtraNetworkLoadMetricsEnabled):

NetworkProcess/NetworkConnectionToWebProcess.h:

(WebKit::NetworkConnectionToWebProcess::addNetworkLoadInformationMetrics):

NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::m_shouldCaptureExtraNetworkLoadMetrics):
(WebKit::NetworkResourceLoader::shouldCaptureExtraNetworkLoadMetrics const):

NetworkProcess/NetworkResourceLoader.h:

3:50 PM Changeset in webkit [240088] by Alan Coon

1 copy in tags/Safari-608.1.1

Tag Safari-608.1.1.

3:32 PM Changeset in webkit [240087] by achristensen@apple.com

2 edits in trunk/Source/WebKit

Revert r239938
https://bugs.webkit.org/show_bug.cgi?id=193267
<rdar://problem/47297304>

Configurations/WebContent-iOS.entitlements:

3:28 PM Changeset in webkit [240086] by Alan Coon

3 edits in branches/safari-607-branch/Source/WebCore

Apply patch. rdar://problem/47260377

Cherry-pick r240039. rdar://problem/47260377

IndexedDB: leak WebIDBConnectionToClient for retain cycle
https://bugs.webkit.org/show_bug.cgi?id=193097
<rdar://problem/46899601>

Reviewed by David Kilzer.

Fix API test failure after r239887. After removing the retain cycle, IDBConnectionToClient will no longer live
forever so make sure it is not destructed before UniqueIDBDatabaseConnection unregisters itself.

Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp: (WebCore::IDBServer::UniqueIDBDatabaseConnection::UniqueIDBDatabaseConnection): (WebCore::IDBServer::UniqueIDBDatabaseConnection::~UniqueIDBDatabaseConnection): (WebCore::IDBServer::UniqueIDBDatabaseConnection::fireVersionChangeEvent): (WebCore::IDBServer::UniqueIDBDatabaseConnection::didAbortTransaction): (WebCore::IDBServer::UniqueIDBDatabaseConnection::didCommitTransaction): (WebCore::IDBServer::UniqueIDBDatabaseConnection::didCreateObjectStore): (WebCore::IDBServer::UniqueIDBDatabaseConnection::didDeleteObjectStore): (WebCore::IDBServer::UniqueIDBDatabaseConnection::didRenameObjectStore): (WebCore::IDBServer::UniqueIDBDatabaseConnection::didClearObjectStore): (WebCore::IDBServer::UniqueIDBDatabaseConnection::didCreateIndex): (WebCore::IDBServer::UniqueIDBDatabaseConnection::didDeleteIndex): (WebCore::IDBServer::UniqueIDBDatabaseConnection::didRenameIndex):
Modules/indexeddb/server/UniqueIDBDatabaseConnection.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@240039 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:28 PM Changeset in webkit [240085] by Alan Coon

8 edits in branches/safari-607-branch/Source

Apply patch. rdar://problem/47260377

Cherry-pick r239887. rdar://problem/47260377

IndexedDB: leak WebIDBConnectionToClient for retain cycle
https://bugs.webkit.org/show_bug.cgi?id=193097
<rdar://problem/46899601>

Reviewed by Brady Eidson.

Source/WebCore:

Let IDBConnectionToClient hold a WeakPtr of IDBConnectionToClientDelegate.

Modules/indexeddb/server/IDBConnectionToClient.cpp: (WebCore::IDBServer::IDBConnectionToClient::IDBConnectionToClient): (WebCore::IDBServer::IDBConnectionToClient::identifier const): (WebCore::IDBServer::IDBConnectionToClient::didDeleteDatabase): (WebCore::IDBServer::IDBConnectionToClient::didOpenDatabase): (WebCore::IDBServer::IDBConnectionToClient::didAbortTransaction): (WebCore::IDBServer::IDBConnectionToClient::didCreateObjectStore): (WebCore::IDBServer::IDBConnectionToClient::didDeleteObjectStore): (WebCore::IDBServer::IDBConnectionToClient::didRenameObjectStore): (WebCore::IDBServer::IDBConnectionToClient::didClearObjectStore): (WebCore::IDBServer::IDBConnectionToClient::didCreateIndex): (WebCore::IDBServer::IDBConnectionToClient::didDeleteIndex): (WebCore::IDBServer::IDBConnectionToClient::didRenameIndex): (WebCore::IDBServer::IDBConnectionToClient::didPutOrAdd): (WebCore::IDBServer::IDBConnectionToClient::didGetRecord): (WebCore::IDBServer::IDBConnectionToClient::didGetAllRecords): (WebCore::IDBServer::IDBConnectionToClient::didGetCount): (WebCore::IDBServer::IDBConnectionToClient::didDeleteRecord): (WebCore::IDBServer::IDBConnectionToClient::didOpenCursor): (WebCore::IDBServer::IDBConnectionToClient::didIterateCursor): (WebCore::IDBServer::IDBConnectionToClient::didCommitTransaction): (WebCore::IDBServer::IDBConnectionToClient::fireVersionChangeEvent): (WebCore::IDBServer::IDBConnectionToClient::didStartTransaction): (WebCore::IDBServer::IDBConnectionToClient::didCloseFromServer): (WebCore::IDBServer::IDBConnectionToClient::notifyOpenDBRequestBlocked): (WebCore::IDBServer::IDBConnectionToClient::didGetAllDatabaseNames):
Modules/indexeddb/server/IDBConnectionToClient.h:
Modules/indexeddb/server/IDBConnectionToClientDelegate.h:

Source/WebKit:

Let WebIDBConnectionToClient hold reference to IPC::Connection instead of NetworkConnectionToWebProcess to break
the cycle.

NetworkProcess/IndexedDB/WebIDBConnectionToClient.cpp: (WebKit::WebIDBConnectionToClient::create): (WebKit::WebIDBConnectionToClient::WebIDBConnectionToClient): (WebKit::WebIDBConnectionToClient::messageSenderConnection):
NetworkProcess/IndexedDB/WebIDBConnectionToClient.h:
NetworkProcess/NetworkConnectionToWebProcess.cpp: (WebKit::NetworkConnectionToWebProcess::establishIDBConnectionToServer):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@239887 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:28 PM Changeset in webkit [240084] by Alan Coon

3 edits
1 copy
1 add in branches/safari-607-branch/LayoutTests

Cherry-pick r239958. rdar://problem/47260195

Unreviewed, test fixes after r239852.

http/wpt/webauthn/public-key-credential-create-success-hid.https.html:
http/wpt/webauthn/public-key-credential-create-success-u2f.https.html:
http/wpt/webauthn/public-key-credential-get-success-hid.https.html:
http/wpt/webauthn/public-key-credential-get-success-u2f.https.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239958 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:28 PM Changeset in webkit [240083] by Alan Coon

2 edits in branches/safari-607-branch/Source/WebKit

Cherry-pick r239852. rdar://problem/47260195

[WebAuthN] Change the nonce in the CTAP kInit command to weak random values
https://bugs.webkit.org/show_bug.cgi?id=192061
<rdar://problem/46471091>

Reviewed by Chris Dumez.

Change the nonce in the CTAP kInit command to weak random values as the nonce is mainly
for being a probabilistically unique global identifier for hand shakes, instead of
preventing replay attacks. Otherwise, it might exhaust system entropy unnecessarily.

The patch also removes all logging when debugging the test case flakiness.

UIProcess/WebAuthentication/AuthenticatorManager.cpp: (WebKit::AuthenticatorManager::respondReceived): (WebKit::AuthenticatorManager::initTimeOutTimer): (WebKit::AuthenticatorManager::timeOutTimerFired):
UIProcess/WebAuthentication/Cocoa/HidService.mm: (WebKit::HidService::deviceAdded):
UIProcess/WebAuthentication/Mock/MockAuthenticatorManager.cpp: (WebKit::MockAuthenticatorManager::respondReceivedInternal):
UIProcess/WebAuthentication/Mock/MockHidConnection.cpp: (WebKit::MockHidConnection::send):
UIProcess/WebAuthentication/fido/CtapHidAuthenticator.cpp: (WebKit::CtapHidAuthenticator::makeCredential): (WebKit::CtapHidAuthenticator::getAssertion):
UIProcess/WebAuthentication/fido/CtapHidDriver.cpp: (WebKit::CtapHidDriver::Worker::write): (WebKit::CtapHidDriver::Worker::read): (WebKit::CtapHidDriver::Worker::returnMessage): (WebKit::CtapHidDriver::transact): (WebKit::CtapHidDriver::continueAfterChannelAllocated): (WebKit::CtapHidDriver::continueAfterResponseReceived):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239852 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:28 PM Changeset in webkit [240082] by Alan Coon

2 edits in branches/safari-607-branch/Source/WebKit

Cherry-pick r239757. rdar://problem/47260195

[Mac] Layout Test http/wpt/webauthn/public-key-credential-create-success-hid.https.html and http/wpt/webauthn/public-key-credential-get-success-hid.https.html are flaky
https://bugs.webkit.org/show_bug.cgi?id=192061

Reviewed by Dewei Zhu.

Part 6.

Add some additional temporary logging info to determine if data is actually sent.
Once the bug is determined and fixed, we should remove all logging added in this patch.

UIProcess/WebAuthentication/Mock/MockHidConnection.cpp: (WebKit::MockHidConnection::send):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239757 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:28 PM Changeset in webkit [240081] by Alan Coon

6 edits in branches/safari-607-branch/Source/WebKit

[WebAuthN] Change the nonce in the CTAP kInit command to weak random values
https://bugs.webkit.org/show_bug.cgi?id=192061
<rdar://problem/46471091>

Reviewed by Chris Dumez.

The patch also removes all logging when debugging the test case flakiness.

UIProcess/WebAuthentication/AuthenticatorManager.cpp:

(WebKit::AuthenticatorManager::respondReceived):
(WebKit::AuthenticatorManager::initTimeOutTimer):
(WebKit::AuthenticatorManager::timeOutTimerFired):

UIProcess/WebAuthentication/Cocoa/HidService.mm:

(WebKit::HidService::deviceAdded):

UIProcess/WebAuthentication/Mock/MockAuthenticatorManager.cpp:

(WebKit::MockAuthenticatorManager::respondReceivedInternal):

UIProcess/WebAuthentication/Mock/MockHidConnection.cpp:

(WebKit::MockHidConnection::send):

UIProcess/WebAuthentication/fido/CtapHidAuthenticator.cpp:

(WebKit::CtapHidAuthenticator::makeCredential):
(WebKit::CtapHidAuthenticator::getAssertion):

UIProcess/WebAuthentication/fido/CtapHidDriver.cpp:

3:28 PM Changeset in webkit [240080] by Alan Coon

7 edits in branches/safari-607-branch/Source

Versioning.

3:28 PM Changeset in webkit [240079] by Alan Coon

26 edits
7 adds in branches/safari-607-branch

Cherry-pick r239904. rdar://problem/47260304

Have prefers-color-scheme: light always match on macOS versions before Mojave.
https://bugs.webkit.org/show_bug.cgi?id=191655
rdar://problem/46074680

Reviewed by Megan Gardner.

Source/JavaScriptCore:

Configurations/FeatureDefines.xcconfig: ENABLE_DARK_MODE_CSS_macosx for all OS versions.

Source/WebCore:

Tests: css-dark-mode/older-systems/prefers-color-scheme.html

css-dark-mode/older-systems/supported-color-schemes-css.html
css-dark-mode/older-systems/supported-color-schemes.html

Use new HAVE(OS_DARK_MODE_SUPPORT) to make it easier to find code.
Added HAVE(OS_DARK_MODE_SUPPORT) around more bits to make it work on older systems.

Configurations/FeatureDefines.xcconfig:
dom/Document.cpp: (WebCore::Document::useDarkAppearance const):
inspector/agents/InspectorPageAgent.cpp: (WebCore::InspectorPageAgent::enable):
page/Page.cpp: (WebCore::Page::setUseDarkAppearance): (WebCore::Page::useDarkAppearance const): (WebCore::Page::setUseDarkAppearanceOverride):
platform/mac/LocalDefaultSystemAppearance.h: (WebCore::LocalDefaultSystemAppearance::usingDarkAppearance const):
platform/mac/LocalDefaultSystemAppearance.mm: (WebCore::LocalDefaultSystemAppearance::LocalDefaultSystemAppearance): (WebCore::LocalDefaultSystemAppearance::~LocalDefaultSystemAppearance):
platform/mac/ScrollAnimatorMac.mm:
rendering/RenderThemeMac.mm: (-[WebCoreTextFieldCell _adjustedCoreUIDrawOptionsForDrawingBordersOnly:]): (-[WebListButtonCell drawWithFrame:inView:]): (WebCore::RenderThemeMac::platformInactiveSelectionBackgroundColor const): (WebCore::RenderThemeMac::platformInactiveSelectionForegroundColor const): (WebCore::RenderThemeMac::platformActiveListBoxSelectionBackgroundColor const): (WebCore::RenderThemeMac::platformInactiveListBoxSelectionBackgroundColor const): (WebCore::RenderThemeMac::platformInactiveListBoxSelectionForegroundColor const): (WebCore::RenderThemeMac::systemColor const):

Source/WebCore/PAL:

Configurations/FeatureDefines.xcconfig: ENABLE_DARK_MODE_CSS_macosx for all OS versions.

Source/WebKit:

Configurations/FeatureDefines.xcconfig: ENABLE_DARK_MODE_CSS_macosx for all OS versions.
UIProcess/Cocoa/WebViewImpl.mm: (WebKit::WebViewImpl::effectiveAppearanceIsDark):
UIProcess/RemoteLayerTree/mac/ScrollerMac.mm:

Source/WebKitLegacy/mac:

Configurations/FeatureDefines.xcconfig: ENABLE_DARK_MODE_CSS_macosx for all OS versions.
WebView/WebView.mm: (-[WebView _effectiveAppearanceIsDark]):

Source/WTF:

wtf/Platform.h: Define HAVE_OS_DARK_MODE_SUPPORT on macOS 10.14.

Tools:

TestWebKitAPI/Configurations/FeatureDefines.xcconfig: ENABLE_DARK_MODE_CSS_macosx for all OS versions.
TestWebKitAPI/Tests/WebKit/mac/ForceLightAppearanceInBundle.mm:

LayoutTests:

css-dark-mode/older-systems/prefers-color-scheme-expected.txt: Added.
css-dark-mode/older-systems/prefers-color-scheme.html: Added.
css-dark-mode/older-systems/supported-color-schemes-css-expected.txt: Added.
css-dark-mode/older-systems/supported-color-schemes-css.html: Added.
css-dark-mode/older-systems/supported-color-schemes-expected.txt: Added.
css-dark-mode/older-systems/supported-color-schemes.html: Added.
platform/mac/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239904 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:28 PM Changeset in webkit [240078] by Alan Coon

4 edits in branches/safari-607-branch/Source/JavaScriptCore

Cherry-pick r239898. rdar://problem/47260206

Unreviewed, fix scope check assertions
https://bugs.webkit.org/show_bug.cgi?id=193308

bytecode/CodeBlock.cpp: (JSC::CodeBlock::notifyLexicalBindingShadowing):
runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::notifyLexicalBindingShadowing):
runtime/ProgramExecutable.cpp: (JSC::ProgramExecutable::initializeGlobalProperties):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239898 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:28 PM Changeset in webkit [240077] by Alan Coon

2 edits in branches/safari-607-branch/Source/WTF

Cherry-pick r239894. rdar://problem/47260353

Follow-up: WorkQueue::concurrentApply() passes a raw pointer to a temporary String to Thread::create().
https://bugs.webkit.org/show_bug.cgi?id=191350

wtf/WorkQueue.cpp: (WTF::WorkQueue::concurrentApply): Fix whitespace.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239894 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:28 PM Changeset in webkit [240076] by Alan Coon

3 edits in branches/safari-607-branch/Source/WebCore

Cherry-pick r239889. rdar://problem/47260233

REGRESSION(r239419): Crash in AudioSourceProviderAVFObjC::~AudioSourceProviderAVFObjC()
https://bugs.webkit.org/show_bug.cgi?id=193342
<rdar://problem/47119836>

Reviewed by Eric Carlson.

Make the TapStorage used by AudioSourceProviderAVFObjC thread-safe RefCounted.

platform/graphics/avfoundation/AudioSourceProviderAVFObjC.h:
platform/graphics/avfoundation/AudioSourceProviderAVFObjC.mm: (WebCore::AudioSourceProviderAVFObjC::initCallback): (WebCore::AudioSourceProviderAVFObjC::finalizeCallback):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239889 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:28 PM Changeset in webkit [240075] by Alan Coon

19 edits in branches/safari-607-branch

Cherry-pick r239888. rdar://problem/47260286

Compile out Web API Statistics Collection
https://bugs.webkit.org/show_bug.cgi?id=193370
<rdar://problem/45388584>

Reviewed by Brent Fulgham.

Source/JavaScriptCore:

Configurations/FeatureDefines.xcconfig:

Defined ENABLE_WEB_API_STATISTICS, off by default.

Source/WebCore:

No new tests. This patch disables functionality. The associated tests
are skipped.

These functions are now no-ops unless web API statistics is enabled.

Configurations/FeatureDefines.xcconfig:
loader/ResourceLoadObserver.cpp: (WebCore::ResourceLoadObserver::logFontLoad): (WebCore::ResourceLoadObserver::logCanvasRead): (WebCore::ResourceLoadObserver::logCanvasWriteOrMeasure): (WebCore::ResourceLoadObserver::logNavigatorAPIAccessed): (WebCore::ResourceLoadObserver::logScreenAPIAccessed):
loader/ResourceLoadStatistics.cpp: (WebCore::ResourceLoadStatistics::encode const): (WebCore::ResourceLoadStatistics::decode): (WebCore::ResourceLoadStatistics::toString const): (WebCore::ResourceLoadStatistics::merge):
loader/ResourceLoadStatistics.h:

The associated struct members are skipped unless web API
statistics is enabled.

Source/WebCore/PAL:

Configurations/FeatureDefines.xcconfig:

Defined ENABLE_WEB_API_STATISTICS, off by default.

Source/WebKit:

Configurations/FeatureDefines.xcconfig:

Defined ENABLE_WEB_API_STATISTICS, off by default.

Shared/WebCoreArgumentCoders.cpp: (IPC::ArgumentCoder<ResourceLoadStatistics>::encode):

Skipped encoding of web API statistics.

(IPC::ArgumentCoder<ResourceLoadStatistics>::decode):

Skipped decoding of web API statistics.

Source/WebKitLegacy/mac:

Configurations/FeatureDefines.xcconfig:

Defined ENABLE_WEB_API_STATISTICS, off by default.

Tools:

TestWebKitAPI/Configurations/FeatureDefines.xcconfig:

Defined ENABLE_WEB_API_STATISTICS, off by default.

LayoutTests:

platform/ios-wk2/TestExpectations:

http/tests/webAPIStatistics skipped.

platform/mac-wk2/TestExpectations:

http/tests/webAPIStatistics skipped.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239888 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:28 PM Changeset in webkit [240074] by Alan Coon

5 edits
1 add in branches/safari-607-branch

Cherry-pick r239882. rdar://problem/47260361

DFG combined liveness can be wrong for terminal basic blocks
https://bugs.webkit.org/show_bug.cgi?id=193304
<rdar://problem/45268632>

Reviewed by Yusuke Suzuki.

JSTests:

stress/dfg-combined-liveness-consider-terminal-blocks-bytecode-liveness.js: Added.

Source/JavaScriptCore:

If a block doesn't have any successors, it can't rely on the typical
backwards liveness propagation that CombinedLiveness was doing. The phase
first got what was live in bytecode and IR at the heads of each block. Then
for each block, it made the live at tail the union of the live at head for
each successor. For a terminal block though, this could be wrong. We could
end up saying nothing is live even though many things may be live in bytecode.
We must account for what's bytecode live at the end of the block. Consider a
block that ends with:
`
ForceOSRExit
Unreachable
`

Things may definitely be live in bytecode at the tail. However, we'll
report nothing as being alive. This probably subtly breaks many analyses,
but we have a test case of it breaking the interference analysis that
the ArgumentsEliminationPhase performs.

dfg/DFGBasicBlock.h: (JSC::DFG::BasicBlock::last const):
dfg/DFGCombinedLiveness.cpp: (JSC::DFG::addBytecodeLiveness): (JSC::DFG::liveNodesAtHead): (JSC::DFG::CombinedLiveness::CombinedLiveness):
dfg/DFGCombinedLiveness.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239882 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240073] by Alan Coon

7 edits in branches/safari-607-branch/Source

Cherry-pick r239880. rdar://problem/47260310

REGRESSION (PSON): Firefox app lacks Open in New Tab in menu
https://bugs.webkit.org/show_bug.cgi?id=193366
<rdar://problem/46097212>

Reviewed by Simon Fraser.

Source/WebCore:

platform/RuntimeApplicationChecks.h:
platform/cocoa/RuntimeApplicationChecksCocoa.mm: (WebCore::IOSApplication::isFirefox): Add a Firefox Mobile bundle check.

Source/WebKit:

A pair of unrelated changes broke Firefox's use of WKWebView internals
to override the long-press menu. Maintain binary compatibility by
introducing linked-on-or-after checks.

UIProcess/Cocoa/VersionChecks.h:
UIProcess/WebProcessPool.cpp: (WebKit::WebProcessPool::createWebPage): Disable PSON in Firefox when linked against an SDK where PSON wasn't enabled by default. Because gestures are very stateful, we always swap them out when swapping processes (changing that behavior is fairly risky). Also, we don't always inform the client when we swap processes (only when the process actually crashes), so they currently don't re-adjust the gesture recognizers when a PSON swap occurs.

UIProcess/ios/WKContentView.mm: (-[WKContentView _commonInitializationWithProcessPool:configuration:]): Synchronously install gesture recognizers under -init when linked against an SDK before the version that introduces lazy gesture recognizer installation. r237331 is an optimization that made us lazily install gestures when the view is parented, but Firefox (and potentially other clients) depend on them being installed synchronously in order to find and override them.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239880 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240072] by Alan Coon

16 edits
15 adds in branches/safari-607-branch

Cherry-pick r239879. rdar://problem/47260206

[JSC] Global lexical bindings can shadow global variables if it is configurable = true
https://bugs.webkit.org/show_bug.cgi?id=193308
<rdar://problem/45546542>

Reviewed by Saam Barati.

JSTests:

stress/const-lexical-binding-shadow-existing-global-property-ftl.js: Added. (shouldThrow): (shouldBe): (foo): (get shouldThrow):
stress/const-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added. (shouldThrow): (shouldBe): (foo): (get shouldBe): (get shouldThrow): (get return):
stress/const-lexical-binding-shadow-existing-global-property-tdz.js: Added. (shouldThrow): (shouldBe): (foo): (get shouldBe): (get shouldThrow):
stress/const-lexical-binding-shadow-existing-global-property.js: Added. (shouldThrow): (shouldBe): (foo):
stress/const-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added. (shouldThrow): (shouldBe): (foo):
stress/global-add-function-should-not-be-shadowed-by-lexical-bindings.js: Added. (shouldThrow):
stress/global-static-variables-should-not-be-shadowed-by-lexical-bindings.js: Added. (shouldThrow):
stress/let-lexical-binding-shadow-existing-global-property-ftl.js: Added. (shouldThrow): (shouldBe): (foo):
stress/let-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added. (shouldThrow): (shouldBe): (foo): (get shouldBe): (get shouldThrow): (get return):
stress/let-lexical-binding-shadow-existing-global-property-tdz.js: Added. (shouldThrow): (shouldBe): (foo): (get shouldBe): (get shouldThrow):
stress/let-lexical-binding-shadow-existing-global-property.js: Added. (shouldThrow): (shouldBe): (foo):
stress/let-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added. (shouldThrow): (shouldBe): (foo):

Source/JavaScriptCore:

Previously, we assumed that lexical bindings in JSGlobalLexicalEnvironment cannot shadow existing global properties.
However, it is wrong. According to the spec, we can shadow global properties if a property's attribute is configurable = true.
For example, we execute two scripts.

script1.js

bar = 42;
function load() { return bar; }
print(bar); 42
print(load()); 42

script2.js

let bar = 0; This lexical binding can shadow the global.bar defined in script1.js
print(bar); 0
print(load()); 0

In JSC, we cache GlobalProperty resolve type and its associated information in op_resolve_type, op_get_from_scope, and op_put_to_scope.
They attempt to load a property from JSGlobalObject directly. However, once the newly added lexical binding starts shadowing this, our existing instructions
become invalid since they do not respect JSGlobalLexicalEnvironment.

In this patch, we fix this issue by introducing the following mechanisms.

We have a HashMap<property name, watchpoint set> in JSGlobalObject. DFG and FTL create a watchpoint set with the property name if the generated code depends on GlobalProperty condition of op_resolve_scope etc. These watchpoint will be fired when the shadowing happens, so that our generated DFG and FTL code will be invalidated if it depends on the condition which is no longer valid.

When we detect shadowing, we iterate all the live CodeBlocks which globalObject is the target one. And we rewrite instructions in them from GlobalProperty to GlobalLexicalVar (or Dynamic precisely). So, the subsequent LLInt code just works well. "Dynamic" conversion happens when your op_put_to_scope attempts to put a value onto a const lexical binding. This fails and it should throw a type error.

GlobalProperty scope operations in Baseline JIT start checking ResolveType in metadata, and emit code for GlobalProperty and GlobalLexicalVar. Once the rewrite happens, baseline JIT continues working because it checks the rewritten metadata's ResolveType.

We use this mechanism (which is similar to haveABadTime() thing) because,

Shadowing should be super rare. Before r214145, we made these cases as SytaxError. Thus, before r214145, this type of code cannot be executed in WebKit. And the number of the live CodeBlocks for the given JSGlobalObject should be small. This supports introducing rather simple (but not so efficient) mechanism instead of the complicated one.

Rewriting instructions immediately forces GlobalProperty => GlobalLexicalVar / Dynamic conversion in all the possible CodeBlock. This allows us to avoid compilation failure loop in DFG and FTL: DFG and FTL codes are invalidated by the watchpoint, but we may attempt to compile the code with the invalidated watchpoint and GlobalProperty status if we do not rewrite it. One possible other implementation is having and checking a counter in instruction, and every time we introduce a new shadow binding, bump the counter. And eventually executed instruction will go to the slow path and rewrite itself. However, this way leaves the not-executed-again-yet instructions as is, and DFG and FTL repeatedly fail to compile if we just watch the invalidated watchpoint for that. Rewriting all the existing GlobalProperty immediately avoids this situation easily.

JavaScriptCore.xcodeproj/project.pbxproj:
Sources.txt:
bytecode/CodeBlock.cpp: (JSC::CodeBlock::notifyLexicalBindingShadowing):
bytecode/CodeBlock.h: (JSC::CodeBlock::scriptMode const):
bytecode/Watchpoint.h: (JSC::WatchpointSet::create):
dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock):
dfg/DFGDesiredGlobalProperties.cpp: Added. (JSC::DFG::DesiredGlobalProperties::isStillValidOnMainThread): (JSC::DFG::DesiredGlobalProperties::reallyAdd):
dfg/DFGDesiredGlobalProperties.h: Added. (JSC::DFG::DesiredGlobalProperties::addLazily): We need this DesiredGlobalProperties mechanism since we do not want to ref() the UniquedStringImpl in DFG and FTL thread. We keep JSGlobalObject* and identifierNumber, and materialize WatchpointSets for each JSGlobalObject's property referenced from DFG and FTL and inject CodeBlock jettison watchpoints in the main thread.
dfg/DFGDesiredGlobalProperty.h: Added. (JSC::DFG::DesiredGlobalProperty::DesiredGlobalProperty): (JSC::DFG::DesiredGlobalProperty::globalObject const): (JSC::DFG::DesiredGlobalProperty::identifierNumber const): (JSC::DFG::DesiredGlobalProperty::operator== const): (JSC::DFG::DesiredGlobalProperty::operator!= const): (JSC::DFG::DesiredGlobalProperty::isHashTableDeletedValue const): (JSC::DFG::DesiredGlobalProperty::hash const): (JSC::DFG::DesiredGlobalProperty::dumpInContext const): (JSC::DFG::DesiredGlobalProperty::dump const): (JSC::DFG::DesiredGlobalPropertyHash::hash): (JSC::DFG::DesiredGlobalPropertyHash::equal):
dfg/DFGGraph.h: (JSC::DFG::Graph::globalProperties):
dfg/DFGPlan.cpp: (JSC::DFG::Plan::reallyAdd): (JSC::DFG::Plan::isStillValidOnMainThread): (JSC::DFG::Plan::finalizeWithoutNotifyingCallback): (JSC::DFG::Plan::cancel):
dfg/DFGPlan.h: (JSC::DFG::Plan::globalProperties):
jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_resolve_scope): (JSC::JIT::emit_op_get_from_scope): (JSC::JIT::emit_op_put_to_scope):
jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_resolve_scope): (JSC::JIT::emit_op_get_from_scope): (JSC::JIT::emit_op_put_to_scope):
runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::addStaticGlobals): (JSC::JSGlobalObject::notifyLexicalBindingShadowing): (JSC::JSGlobalObject::getReferencedPropertyWatchpointSet): (JSC::JSGlobalObject::ensureReferencedPropertyWatchpointSet):
runtime/JSGlobalObject.h:
runtime/ProgramExecutable.cpp: (JSC::hasRestrictedGlobalProperty): (JSC::ProgramExecutable::initializeGlobalProperties):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239879 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240071] by Alan Coon

3 edits
2 adds in branches/safari-607-branch

Cherry-pick r239877. rdar://problem/47260302

Release assert when removing element with a map element in the shadow tree
https://bugs.webkit.org/show_bug.cgi?id=193351
<rdar://problem/47208807>

Reviewed by Ryosuke Niwa.

Source/WebCore:

When a shadow host that has a map element in the shadow tree is removed from the document, we try
to remove the map from the scope of the host.

Test: fast/shadow-dom/image-map-tree-scope.html

html/HTMLMapElement.cpp: (WebCore::HTMLMapElement::insertedIntoAncestor): (WebCore::HTMLMapElement::removedFromAncestor):

Add and remove image maps when the scope changes, not when the document changes.
This matches how id/name/etc updates work in the HTMLElement.

LayoutTests:

fast/shadow-dom/image-map-tree-scope-expected.txt: Added.
fast/shadow-dom/image-map-tree-scope.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239877 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240070] by Alan Coon

2 edits in branches/safari-607-branch/Source/WTF

Cherry-pick r239873. rdar://problem/47260353

WorkQueue::concurrentApply() passes a raw pointer to a temporary String to Thread::create().
https://bugs.webkit.org/show_bug.cgi?id=191350

Reviewed by Brent Fulgham.

The non COCOA version of WorkQueue::concurrentApply() creates a temporary
String for the threadName and passes the raw pointer of this String to
Thread::create(). After freeing this String, Thread::entryPoint() uses
the raw char pointer to internally initialize the thread.

The fix is to use a single literal string for all the threads' names since
they are created for a thread-pool.

wtf/WorkQueue.cpp: (WTF::WorkQueue::concurrentApply):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239873 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240069] by Alan Coon

2 edits in branches/safari-607-branch/Source/WebInspectorUI

Cherry-pick r239870. rdar://problem/47260266

Web Inspector: REGRESSION: deleting an audit puts selection in a selected but invisible state
https://bugs.webkit.org/show_bug.cgi?id=192917
<rdar://problem/46875285>

Reviewed by Devin Rousso.

SelectionController should not be notified of removed children until the
child items have been removed from the TreeOutline. Doing so at this stage
is unsafe, since this method checks this.selectedTreeElement, which could
return the adjusted index from the SelectionController before anything has
actually been removed from the TreeOutline.

The number of calls to SelectionController.prototype.didRemoveItems is also
reduced somewhat, since we're no longer calling it for every TreeElement.

UserInterface/Views/TreeOutline.js: (WI.TreeOutline.prototype.removeChildAtIndex): (WI.TreeOutline.prototype.removeChildren): (WI.TreeOutline.prototype._forgetTreeElement): (WI.TreeOutline.prototype._indexesForSubtree): Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239870 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240068] by Alan Coon

2 edits in branches/safari-607-branch/Tools

Cherry-pick r239866. rdar://problem/47260326

Unreviewed, fix #ifdef in API test added in r239851.
https://bugs.webkit.org/show_bug.cgi?id=193327
rdar://problem/47093222

TestWebKitAPI/Tests/WebKit/mac/ForceLightAppearanceInBundle_Bundle.mm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239866 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240067] by Alan Coon

4 edits in branches/safari-607-branch/Source/WebCore

Cherry-pick r239865. rdar://problem/47260332

IndexedDB: leak IDBTransaction, TransactionOperation and IDBRequest in layout tests
https://bugs.webkit.org/show_bug.cgi?id=193167
<rdar://problem/46891688>

Reviewed by Geoffrey Garen.

Do some cleanup to break retain cycle when context is stopped.

Modules/indexeddb/IDBOpenDBRequest.cpp: (WebCore::IDBOpenDBRequest::cancelForStop):
Modules/indexeddb/IDBTransaction.cpp: (WebCore::IDBTransaction::abortOnServerAndCancelRequests): (WebCore::IDBTransaction::stop): (WebCore::IDBTransaction::removeRequest):
Modules/indexeddb/client/TransactionOperation.h: (WebCore::IDBClient::TransactionOperation::doComplete):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239865 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240066] by Alan Coon

5 edits in branches/safari-607-branch/Source/WebCore

Cherry-pick r239857. rdar://problem/47260358

<video> elements do not enter 'paused' state when playing to end over AirPlay
https://bugs.webkit.org/show_bug.cgi?id=193295
<rdar://problem/46708670>

Reviewed by Eric Carlson.

Adopt the -[AVPlayer timeControlStatus] API, which reports whether the AVPlayer is paused, playing, or blocked waiting
for more data before playing. AirPlay devices report this state back from the remote device, and this allows the
MediaPlayerPrivateAVFoundationObjC to differentiate between user-generated pauses and simple stalling.

Adopting this API allows us to remove the heuristic from rateChanged() which inteprets a rate change when the
readyState > HAVE_ENOUGH as an intentional pause.

Drive-by fix: MediaPlayerPrivateAVFoundation had some code to delay calling platformPlay()
until the first frame became available. But this code was entirely undermined by the previous
behavior of setRate(). Fixing setRate()/setRateDouble() to only start playback if playback was
actually requested started making this code work for the first time, and broke some API tests.
Thus, we're removing this previously dead code.

platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp: (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation): (WebCore::MediaPlayerPrivateAVFoundation::play): (WebCore::MediaPlayerPrivateAVFoundation::pause): (WebCore::MediaPlayerPrivateAVFoundation::rateChanged): (WebCore::MediaPlayerPrivateAVFoundation::updateStates):
platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm: (WebCore::MediaPlayerPrivateAVFoundationObjC::cancelLoad): (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer): (WebCore::MediaPlayerPrivateAVFoundationObjC::didEnd): (WebCore::MediaPlayerPrivateAVFoundationObjC::platformPlay): (WebCore::MediaPlayerPrivateAVFoundationObjC::platformPause): (WebCore::MediaPlayerPrivateAVFoundationObjC::seekToTime): (WebCore::MediaPlayerPrivateAVFoundationObjC::setRateDouble): (WebCore::MediaPlayerPrivateAVFoundationObjC::setPlayerRate): (WebCore::MediaPlayerPrivateAVFoundationObjC::timeControlStatusDidChange): (WebCore::MediaPlayerPrivateAVFoundationObjC::setShouldObserveTimeControlStatus): (-[WebCoreAVFMovieObserver observeValueForKeyPath:ofObject:change:context:]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239857 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240065] by Alan Coon

5 edits
3 adds in branches/safari-607-branch

Cherry-pick r239851. rdar://problem/47260326

Add WKBundlePage SPI to temporarily force light or dark appearance on a page.
https://bugs.webkit.org/show_bug.cgi?id=193327
rdar://problem/47093222

Reviewed by Tim Horton.

Source/WebKit:

Tests: WebKit.ForceLightAppearanceInBundle API Test

WebProcess/InjectedBundle/API/c/WKBundlePage.cpp: (WKBundlePageSetUseDarkAppearance): Added. (WKBundlePageIsUsingDarkAppearance): Added.
WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h:

Tools:

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit/mac/ForceLightAppearanceInBundle.mm: Added. (TestWebKitAPI::didFinishNavigation): (TestWebKitAPI::didReceiveMessageFromInjectedBundle): (TestWebKitAPI::TEST):
TestWebKitAPI/Tests/WebKit/mac/ForceLightAppearanceInBundle_Bundle.mm: Added. (TestWebKitAPI::ForceLightAppearanceInBundleTest::ForceLightAppearanceInBundleTest): (TestWebKitAPI::ForceLightAppearanceInBundleTest::didCreatePage): (TestWebKitAPI::ForceLightAppearanceInBundleTest::didReceiveMessage):
TestWebKitAPI/Tests/WebKit/mac/dark-mode.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239851 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240064] by Alan Coon

5 edits in branches/safari-607-branch/Source/WebKit

Cherry-pick r239850. rdar://problem/47260243

DeviceID hash salt manager can be NULL
https://bugs.webkit.org/show_bug.cgi?id=193334
<rdar://problem/47179650>

Reviewed by Youenn Fablet.

UIProcess/UserMediaPermissionRequestManagerProxy.cpp: (WebKit::UserMediaPermissionRequestManagerProxy::userMediaAccessWasGranted): No need to NULL-check websiteDataStore.deviceIdHashSaltStorage, it is a Ref. (WebKit::UserMediaPermissionRequestManagerProxy::requestUserMediaPermissionForFrame): Ditto. (WebKit::UserMediaPermissionRequestManagerProxy::getUserMediaPermissionInfo): Ditto. (WebKit::UserMediaPermissionRequestManagerProxy::enumerateMediaDevicesForFrame): Ditto.

UIProcess/WebsiteData/WebsiteDataStore.cpp: (WebKit::WebsiteDataStore::WebsiteDataStore): m_deviceIdHashSaltStorage is a Ref. (WebKit::WebsiteDataStore::fetchDataAndApply): Ditto. (WebKit::WebsiteDataStore::removeData): Ditto.
UIProcess/WebsiteData/WebsiteDataStore.h: (WebKit::WebsiteDataStore::deviceIdHashSaltStorage): Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239850 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240063] by Alan Coon

2 edits in branches/safari-607-branch/Source/WebCore

Cherry-pick r239847. rdar://problem/47260246

Fix rare crash under ScrollbarThemeMac::paintScrollCorner()
https://bugs.webkit.org/show_bug.cgi?id=193337
rdar://problem/47179993

Reviewed by Zalan Bujtas.

Async image decoding can trigger a FrameView::traverseForPaintInvalidation() fake paint,
which creates a GraphicsContext with no platform context. However, we could hit ScrollView::paintScrollbars()
which tried to get at the platform context, and then crashed.

So protect two functions in ScrollbarThemeMac with if (context.paintingDisabled()) checks. I verified
that other scrollbar-related painting code paths were already protected.

Hard to test because it depends on async image decoding timing.

platform/mac/ScrollbarThemeMac.mm: (WebCore::ScrollbarThemeMac::paint): (WebCore::ScrollbarThemeMac::paintScrollCorner):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239847 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240062] by Alan Coon

11 edits in branches/safari-607-branch/Source

Cherry-pick r239843. rdar://problem/47260277

REGRESSION (r237658): Tap highlight limits cause the highlight to no longer show with legitimate button sizes
https://bugs.webkit.org/show_bug.cgi?id=193294
<rdar://problem/46006678>

Reviewed by Simon Fraser.

Input type elements should always paint tap highlight (ignore size heuristic).

UIProcess/PageClient.h:
UIProcess/WebPageProxy.h:
UIProcess/WebPageProxy.messages.in:
UIProcess/ios/PageClientImplIOS.h:
UIProcess/ios/PageClientImplIOS.mm: (WebKit::PageClientImpl::didGetTapHighlightGeometries):
UIProcess/ios/WKContentViewInteraction.h:
UIProcess/ios/WKContentViewInteraction.mm: (-[WKContentView _showTapHighlight]): (-[WKContentView _didGetTapHighlightForRequest:color:quads:topLeftRadius:topRightRadius:bottomLeftRadius:bottomRightRadius:nodeHasBuiltInClickHandling:]): (-[WKContentView _didGetTapHighlightForRequest:color:quads:topLeftRadius:topRightRadius:bottomLeftRadius:bottomRightRadius:]): Deleted.
UIProcess/ios/WebPageProxyIOS.mm: (WebKit::WebPageProxy::didGetTapHighlightGeometries):
WebProcess/WebPage/ios/WebPageIOS.mm: (WebKit::WebPage::sendTapHighlightForNodeIfNecessary):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239843 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240061] by Alan Coon

2 edits in branches/safari-607-branch/Source/WebCore

Cherry-pick r239833. rdar://problem/47260274

Safari Crashing in Version 12.0.1 (14606.2.104.1.1) WebCore::GraphicsLayerCA::updateBackdropFilters
https://bugs.webkit.org/show_bug.cgi?id=193309
<rdar://problem/45279224>

Reviewed by Antoine Quint.

A speculative fix for a CheckedArithmetic crash triggered in updateBackdropFilters.

The crash log indicates we crash in a Checked<> class that is not recording
overflow i.e. it is crashing due to an overflow. The only place in this function
where that could happen is when we convert the FloatRect for the backdrop
region into a Checked<unsigned> for width and height. This suggests that either
the width or height are negative, or the float values are too large for integers,
or the product of the two overflows.

Avoid this by using RecordOverflow, but also changing the code a little to
bail if the rectangle is incorrect.

platform/graphics/ca/GraphicsLayerCA.cpp: (WebCore::GraphicsLayerCA::updateBackdropFilters):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239833 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:27 PM Changeset in webkit [240060] by Alan Coon

19 edits
4 adds in branches/safari-607-branch

Cherry-pick r239832. rdar://problem/47260343

Override the session configuration for cookieAcceptPolicy
https://bugs.webkit.org/show_bug.cgi?id=190925
<rdar://problem/45497382>

Patch by John Wilander <wilander@apple.com> on 2019-01-10
Reviewed by Alexey Proskuryakov and Alex Christensen.

Source/WebCore/PAL:

pal/spi/cf/CFNetworkSPI.h:

Declaration of _overrideSessionCookieAcceptPolicy on NSHTTPCookieStorage.

Source/WebKit:

NetworkProcess/cocoa/NetworkSessionCocoa.mm: (WebKit::NetworkSessionCocoa::NetworkSessionCocoa):

Now sets cookieStorage._overrideSessionCookieAcceptPolicy to YES.

Source/WTF:

wtf/Platform.h:

Definition of HAVE_CFNETWORK_OVERRIDE_SESSION_COOKIE_ACCEPT_POLICY.

Tools:

Test infrastructure for setting a first-party-only cookie policy.

DumpRenderTree/TestRunner.cpp: (setOnlyAcceptFirstPartyCookiesCallback): (TestRunner::staticFunctions):
DumpRenderTree/TestRunner.h:
DumpRenderTree/mac/TestRunnerMac.mm: (TestRunner::setOnlyAcceptFirstPartyCookies):
DumpRenderTree/win/TestRunnerWin.cpp: (TestRunner::setOnlyAcceptFirstPartyCookies):
WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
WebKitTestRunner/InjectedBundle/TestRunner.cpp: (WTR::TestRunner::setOnlyAcceptFirstPartyCookies):
WebKitTestRunner/InjectedBundle/TestRunner.h:
WebKitTestRunner/TestInvocation.cpp: (WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle):

LayoutTests:

TestExpectations:

Skipped since this cookie policy is only supported on Cocoa platforms.

http/tests/cookies/only-accept-first-party-cookies-expected.txt: Added.
http/tests/cookies/only-accept-first-party-cookies.html: Added.
http/tests/cookies/resources/reset-cookies.html: Added.

To support reset of third-party cookies in an iframe.

http/tests/cookies/resources/set-cookie-and-redirect-back.php: Added.

A simple bounce to set a cookie.

platform/ios/TestExpectations:

Skipped for now. Will be fixed in <rdar://problem/47165939>.

platform/mac/TestExpectations:

Skipped for now. Will be fixed in <rdar://problem/47165939>.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239832 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:26 PM Changeset in webkit [240059] by Alan Coon

2 edits in branches/safari-607-branch/Source/ThirdParty/libwebrtc

Cherry-pick r239829. rdar://problem/47260340

VPModuleInitialize should be called when VCP is enabled
https://bugs.webkit.org/show_bug.cgi?id=193299

Reviewed by Eric Carlson.

Add the necessary include to make sure ENABLE_VCP_ENCODER is defined appropriately.

Source/webrtc/sdk/WebKit/WebKitUtilities.mm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239829 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:26 PM Changeset in webkit [240058] by Alan Coon

6 edits in branches/safari-607-branch/Source/WebCore

Cherry-pick r239814. rdar://problem/47260367

ThreadTimers should not store a raw pointer in its heap
https://bugs.webkit.org/show_bug.cgi?id=192975
<rdar://problem/46893946>

Reviewed by Geoffrey Garen.

Right now, ThreadTimers's heap data structure stores a raw pointer to TimerBase. In order to harden the timer code,
this patch replaces it with ThreadTimerHeapItem, a newly introduced struct, which effectively acks like
WeakReference<TimerBase*> as the timer heap and TimerBase both store RefPtr to it, and TimerBase's destructor clears
the raw pointer back to TimerBase*.

This approach was taken instead of an out-right adoptation of WeakPtr since the heap data structure requires each node
in the heap to have a fixed "priority" yet WeakPtr with no valid pointer back to TimerBase would effectively lose its
"priority" thereby corrupting the heap data structure. That is, each item in the heap must remember its fire time and
insertion order even when the underlying TimerBase had gone away (this should never happen but the whole point of this
hardening is to make it work even in the precense of such a bug).

This patch also moves the heap index in TimerBase to ThreadTimerHeapItem, and replaces the pointer to the heap vector
in TimerBase by a reference to ThreadTimers in ThreadTimerHeapItem. Note that ThreadTimers is a per-thread singleton.

The correctness of this hardening was tested by commenting out the call to stop() and !isInHeap() assertion in
TimerBase::~TimerBase() as well as the !isInHeap() assertion in ThreadTimerHeapItem::clearTimer() and observing that
layout tests run successfully without hitting any debug assertions.

No new tests since there should be no observable behavior difference.

WebCore.xcodeproj/project.pbxproj: Export ThreadTimers.h as a private header since it's now included in Timer.h
platform/ThreadTimers.cpp: (WebCore::ThreadTimers::updateSharedTimer): Delete ThreadTimerHeapItem's with nullptr TimerBase* (TimerBase had already been deleted). This should only happen when TimerBase's destructor failed to remove itself from the timer heap, which should never happen. (WebCore::ThreadTimers::sharedTimerFiredInternal): Ditto. Also removed the redundant code which had removed the timer from the heap since setNextFireTime does the removal already.
platform/ThreadTimers.h: Outdented the whole file. (WebCore::ThreadTimers::timerHeap): We use Vector<RefPtr<ThreadTimerHeapItem>> instead of Vector<Ref<~>> since Ref<~> doesn't have a copy constructor which is used by std::push_heap. (WebCore::ThreadTimerHeapItem): Added. (WebCore::ThreadTimerHeapItem::hasTimer const): Added. (WebCore::ThreadTimerHeapItem::setNotInHeap): Added. ThreadTimerHeapItem uses unsigned -1 as the single value which signifies the item not being in the heap instead of all negative values as in the old code in TimerBase. (WebCore::ThreadTimerHeapItem::isInHeap const): Added. (WebCore::ThreadTimerHeapItem::isFirstInHeap const): Added. (WebCore::ThreadTimerHeapItem::timer): Added. (WebCore::ThreadTimerHeapItem::clearTimer): Added. (WebCore::ThreadTimerHeapItem::heapIndex const): Added. (WebCore::ThreadTimerHeapItem::setHeapIndex): Added. (WebCore::ThreadTimerHeapItem::timerHeap const): Added.
platform/Timer.cpp: (WebCore::threadGlobalTimerHeap): This function is now only used in assertions. (WebCore::ThreadTimerHeapItem::ThreadTimerHeapItem): Added. (WebCore::ThreadTimerHeapItem::create): Added. (WebCore::TimerHeapPointer::TimerHeapPointer): (WebCore::TimerHeapPointer::operator-> const): (WebCore::TimerHeapReference::TimerHeapReference): Added a copy constructor. (WebCore::TimerHeapReference::copyRef const): Added. (WebCore::TimerHeapReference::operator RefPtr<ThreadTimerHeapItem>& const): (WebCore::TimerHeapPointer::operator* const): (WebCore::TimerHeapReference::operator=): Use move assignment operator. (WebCore::TimerHeapReference::swapWith): (WebCore::TimerHeapReference::updateHeapIndex): Extracted to share code between two verions of operator=. (WebCore::swap): (WebCore::TimerHeapIterator::TimerHeapIterator): (WebCore::TimerHeapIterator::operator-> const): (WebCore::TimerHeapLessThanFunction::compare): Added variants which take RefPtr<ThreadTimerHeapItem>. (WebCore::TimerHeapLessThanFunction::operator() const): (WebCore::TimerBase::TimerBase): (WebCore::TimerBase::~TimerBase):Clear the raw pointer in ThreadTimerHeapItem. (WebCore::TimerBase::stop): (WebCore::TimerBase::nextFireInterval const): (WebCore::TimerBase::checkHeapIndex const): Added the consistency check for other items in the heap. (WebCore::TimerBase::checkConsistency const): (WebCore::TimerBase::heapDecreaseKey): (WebCore::TimerBase::heapDelete): (WebCore::TimerBase::heapDeleteMin): (WebCore::TimerBase::heapIncreaseKey): (WebCore::TimerBase::heapInsert): (WebCore::TimerBase::heapPop): (WebCore::TimerBase::heapPopMin): (WebCore::TimerBase::heapDeleteNullMin): Added. Used to delete ThreadTimerHeapItem which no longer has a valid TimerBase. (WebCore::parentHeapPropertyHolds): (WebCore::childHeapPropertyHolds): (WebCore::TimerBase::hasValidHeapPosition const): (WebCore::TimerBase::updateHeapIfNeeded): Tweaked the heap index assertion as heapIndex() itself would assert when called on an item with an invalid (-1) heap index. (WebCore::TimerBase::setNextFireTime): Create ThreadTimerHeapItem. Note m_heapItem is never cleared until this TimerBase is deleted. (WebCore::TimerHeapReference::operator TimerBase* const): Deleted.
platform/Timer.h: (WebCore::TimerBase): Replaced m_nextFireTime, m_heapIndex, m_heapInsertionOrder, and m_cachedThreadGlobalTimerHeap by m_heapItem, RefPtr to an ThreadTimerHeapItem. (WebCore::TimerBase::augmentFireInterval): (WebCore::TimerBase::inHeap const): (WebCore::TimerBase::nextFireTime const): (WebCore::TimerBase::isActive const): (WebCore::TimerBase:: const): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239814 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:26 PM Changeset in webkit [240057] by Alan Coon

9 edits in branches/safari-607-branch/Source

Cherry-pick r239787. rdar://problem/47260350

Gigacage disabling checks should handle the GIGACAGE_ALLOCATION_CAN_FAIL case properly.
https://bugs.webkit.org/show_bug.cgi?id=193292
<rdar://problem/46485450>

Reviewed by Yusuke Suzuki.

Source/bmalloc:

Previously, when GIGACAGE_ALLOCATION_CAN_FAIL is true, we allow the Gigacage to
be disabled if we fail to allocate memory for it. However, Gigacage::primitiveGigacageDisabled()
still always assumes that the Gigacage is always enabled after ensureGigacage() is
called.

This patch updates Gigacage::primitiveGigacageDisabled() to allow the Gigacage to
already be disabled if GIGACAGE_ALLOCATION_CAN_FAIL is true and wasEnabled() is
false.

In this patch, we also put the wasEnabled flag in the 0th slot of the
g_gigacageBasePtrs buffer to ensure that it is also protected against writes just
like the Gigacage base pointers.

To achieve this, we do the following:

Added a reservedForFlags field in struct BasePtrs.
Added a ReservedForFlagsAndNotABasePtr Gigacage::Kind.
Added assertions to ensure that the BasePtrs::primitive is at the offset matching the offset computed from Gigacage::Primitive. Ditto for BasePtrs::jsValue and Gigacage::JSValue.
Added assertions to ensure that Gigacage::ReservedForFlagsAndNotABasePtr is not used for fetching a Gigacage base pointer.
Added RELEASE_BASSERT_NOT_REACHED() to implement such assertions in bmalloc.

No test added because this issue requires Gigacage allocation to fail in order to
manifest. I've tested it manually by modifying the code locally to force an
allocation failure.

bmalloc/BAssert.h:
bmalloc/Gigacage.cpp: (Gigacage::ensureGigacage): (Gigacage::primitiveGigacageDisabled):
bmalloc/Gigacage.h: (Gigacage::wasEnabled): (Gigacage::setWasEnabled): (Gigacage::name): (Gigacage::basePtr): (Gigacage::size):
bmalloc/HeapKind.h: (bmalloc::heapKind):

Source/JavaScriptCore:

runtime/VM.h: (JSC::VM::gigacageAuxiliarySpace):

Source/WTF:

Update the USE_SYSTEM_MALLOC version of Gigacage.h to match the bmalloc version.

wtf/Gigacage.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239787 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:26 PM Changeset in webkit [240056] by Alan Coon

5 edits
2 adds in branches/safari-607-branch

Cherry-pick r239786. rdar://problem/47260219

[Datalist] Crash when input with datalist is dynamically added.
https://bugs.webkit.org/show_bug.cgi?id=193012
<rdar://problem/45923457>

Reviewed by Brent Fulgham.

Source/WebCore:

In certain cases (cloning, setAttribute), it's too early to check for the list attribute in createShadowSubtree
to see whether the input needs datalist related items. The list attribute is simply not set yet.
This patch only addresses the obvious crash. m_dataListDropdownIndicator clearly lacks proper lifecycle management (see webkit.org/b/193032).

Test: fast/forms/datalist/datalist-crash-when-dynamic.html

html/TextFieldInputType.cpp: (WebCore::TextFieldInputType::createShadowSubtree): (WebCore::TextFieldInputType::attributeChanged): (WebCore::TextFieldInputType::createDataListDropdownIndicator):
html/TextFieldInputType.h:

LayoutTests:

fast/forms/datalist/datalist-crash-when-dynamic-expected.txt: Added.
fast/forms/datalist/datalist-crash-when-dynamic.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@239786 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:17 PM Changeset in webkit [240055] by Chris Dumez

4 edits in trunk/Source/WebKit

Regression(r240046) Several API tests are crashing
https://bugs.webkit.org/show_bug.cgi?id=193509

Reviewed by Geoffrey Garen.

The crashes would happen because loadRequestShared() would take a WebProcessProxy& in parameter but
then call reattachToWebProcess() if the page is not valid, which would replace m_process and invalidate
our process reference.

To address the issue, move the reattachToWebProcess() call to loadRequest(), before calling
loadRequestShared(). Also, update *Shared() methods to take a Ref<WebProcessProxy>&& instead
of a WebProcessProxy& in parameter. Since we call client delegates, we need to make sure
our process stays alive.

UIProcess/ProvisionalPageProxy.cpp:

(WebKit::ProvisionalPageProxy::loadData):
(WebKit::ProvisionalPageProxy::loadRequest):
(WebKit::ProvisionalPageProxy::didCreateMainFrame):
(WebKit::ProvisionalPageProxy::didPerformClientRedirect):
(WebKit::ProvisionalPageProxy::didStartProvisionalLoadForFrame):
(WebKit::ProvisionalPageProxy::didFailProvisionalLoadForFrame):
(WebKit::ProvisionalPageProxy::didNavigateWithNavigationData):
(WebKit::ProvisionalPageProxy::didChangeProvisionalURLForFrame):
(WebKit::ProvisionalPageProxy::decidePolicyForNavigationActionAsync):
(WebKit::ProvisionalPageProxy::decidePolicyForResponse):
(WebKit::ProvisionalPageProxy::startURLSchemeTask):
(WebKit::ProvisionalPageProxy::backForwardGoToItem):

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::loadRequest):
(WebKit::WebPageProxy::loadRequestWithNavigationShared):
(WebKit::WebPageProxy::loadData):
(WebKit::WebPageProxy::loadDataWithNavigationShared):
(WebKit::WebPageProxy::didPerformDragControllerAction):
(WebKit::WebPageProxy::findPlugin):
(WebKit::WebPageProxy::didCreateMainFrame):
(WebKit::WebPageProxy::didCreateSubframe):
(WebKit::WebPageProxy::didStartProvisionalLoadForFrame):
(WebKit::WebPageProxy::didStartProvisionalLoadForFrameShared):
(WebKit::WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame):
(WebKit::WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrameShared):
(WebKit::WebPageProxy::willPerformClientRedirectForFrame):
(WebKit::WebPageProxy::didCancelClientRedirectForFrame):
(WebKit::WebPageProxy::didChangeProvisionalURLForFrame):
(WebKit::WebPageProxy::didChangeProvisionalURLForFrameShared):
(WebKit::WebPageProxy::didFailProvisionalLoadForFrame):
(WebKit::WebPageProxy::didFailProvisionalLoadForFrameShared):
(WebKit::WebPageProxy::didCommitLoadForFrame):
(WebKit::WebPageProxy::didFinishDocumentLoadForFrame):
(WebKit::WebPageProxy::didFinishLoadForFrame):
(WebKit::WebPageProxy::didFailLoadForFrame):
(WebKit::WebPageProxy::didSameDocumentNavigationForFrame):
(WebKit::WebPageProxy::didReceiveTitleForFrame):
(WebKit::WebPageProxy::didFirstVisuallyNonEmptyLayoutForFrame):
(WebKit::WebPageProxy::didDisplayInsecureContentForFrame):
(WebKit::WebPageProxy::didRunInsecureContentForFrame):
(WebKit::WebPageProxy::frameDidBecomeFrameSet):
(WebKit::WebPageProxy::decidePolicyForNavigationActionAsync):
(WebKit::WebPageProxy::decidePolicyForNavigationActionAsyncShared):
(WebKit::WebPageProxy::decidePolicyForNavigationAction):
(WebKit::WebPageProxy::decidePolicyForNavigationActionSync):
(WebKit::WebPageProxy::decidePolicyForNewWindowAction):
(WebKit::WebPageProxy::decidePolicyForResponse):
(WebKit::WebPageProxy::decidePolicyForResponseShared):
(WebKit::WebPageProxy::unableToImplementPolicy):
(WebKit::WebPageProxy::willSubmitForm):
(WebKit::WebPageProxy::didNavigateWithNavigationData):
(WebKit::WebPageProxy::didNavigateWithNavigationDataShared):
(WebKit::WebPageProxy::didPerformClientRedirect):
(WebKit::WebPageProxy::didPerformClientRedirectShared):
(WebKit::WebPageProxy::didPerformServerRedirect):
(WebKit::WebPageProxy::didUpdateHistoryTitle):
(WebKit::WebPageProxy::createNewPage):
(WebKit::WebPageProxy::runJavaScriptAlert):
(WebKit::WebPageProxy::runJavaScriptConfirm):
(WebKit::WebPageProxy::runJavaScriptPrompt):
(WebKit::WebPageProxy::unavailablePluginButtonClicked):
(WebKit::WebPageProxy::runBeforeUnloadConfirmPanel):
(WebKit::WebPageProxy::runOpenPanel):
(WebKit::WebPageProxy::printFrame):
(WebKit::WebPageProxy::backForwardGoToItem):
(WebKit::WebPageProxy::backForwardGoToItemShared):
(WebKit::WebPageProxy::learnWord):
(WebKit::WebPageProxy::ignoreWord):
(WebKit::WebPageProxy::didReceiveEvent):
(WebKit::WebPageProxy::editingRangeCallback):
(WebKit::WebPageProxy::rectForCharacterRangeCallback):
(WebKit::WebPageProxy::focusedFrameChanged):
(WebKit::WebPageProxy::frameSetLargestFrameChanged):
(WebKit::WebPageProxy::exceededDatabaseQuota):
(WebKit::WebPageProxy::requestGeolocationPermissionForFrame):
(WebKit::WebPageProxy::requestUserMediaPermissionForFrame):
(WebKit::WebPageProxy::enumerateMediaDevicesForFrame):
(WebKit::WebPageProxy::startURLSchemeTask):
(WebKit::WebPageProxy::startURLSchemeTaskShared):
(WebKit::WebPageProxy::stopURLSchemeTask):
(WebKit::WebPageProxy::loadSynchronousURLSchemeTask):

UIProcess/WebPageProxy.h:

2:52 PM Changeset in webkit [240054] by achristensen@apple.com

2 edits in trunk/Source/WebCore

Internal build fix.

platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:

(WebCore::layerContentsFormat):

2:44 PM Changeset in webkit [240053] by ddkilzer@apple.com

16 edits
1 add in trunk/Source/ThirdParty/libwebrtc

clang-tidy: Fix unnecessary copy/ref churn of for loop variables in libwebrtc
<https://webkit.org/b/193498>

Reviewed by Youenn Fablet.

Fix unwanted copying/ref churn of loop variables by making them
const references.

Source/webrtc/modules/bitrate_controller/loss_based_bandwidth_estimation.cc:
Source/webrtc/modules/rtp_rtcp/source/rtcp_receiver.cc:
Source/webrtc/p2p/base/mdns_message.cc:
Source/webrtc/p2p/base/port.cc:
Source/webrtc/p2p/base/stunrequest.cc:
Source/webrtc/pc/jseptransportcontroller.cc:
Source/webrtc/pc/peerconnection.cc:
Source/webrtc/pc/rtcstatscollector.cc:
Source/webrtc/pc/rtpreceiver.cc:
Source/webrtc/pc/rtptransceiver.cc:
Source/webrtc/pc/statscollector.cc:
Source/webrtc/pc/trackmediainfomap.cc:
Source/webrtc/rtc_base/filerotatingstream.cc:
Source/webrtc/rtc_base/opensslsessioncache.cc:
Source/webrtc/video/receive_statistics_proxy.cc:
WebKit/0002-libwebrtc-fix-unnecessary-copy-of-for-loop-variables.diff: Added.

2:08 PM Changeset in webkit [240052] by Kocsen Chung

1 copy in tags/Safari-607.1.23

Tag Safari-607.1.23.

2:04 PM Changeset in webkit [240051] by Matt Baker

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Fix TreeOutline TypeError: this._indexesForSubtree is not a function
https://bugs.webkit.org/show_bug.cgi?id=193501
<rdar://problem/47323967>

Reviewed by Joseph Pecoraro.

UserInterface/Views/TreeOutline.js:

(WI.TreeOutline.prototype.removeChildAtIndex):

1:06 PM Changeset in webkit [240050] by timothy_horton@apple.com

2 edits in trunk/Source/WebCore/PAL

Unreviewed build fix.

pal/spi/ios/UIKitSPI.h:

I don't even.

12:51 PM Changeset in webkit [240049] by youenn@apple.com

2 edits in trunk/Source/WebCore

ServiceWorkerContainer is leaking due to a ref cycle
https://bugs.webkit.org/show_bug.cgi?id=193462
<rdar://problem/47026303>

Reviewed by Brady Eidson.

ServiceWorkerContainer keeps a reference to its ready promise.
The ready promise keeps a ref to its value which is a ServiceWorkerRegistration.
ServiceWorkerRegistration keeps a ref to ServiceWorkerContainer.

To break the reference cycle, set the ready promise to zero when ServiceWorkerContainer is stopped.

Covered by imported/w3c/web-platform-tests/service-workers/service-worker/ready.https.html no longer leaking.

workers/service/ServiceWorkerContainer.cpp:

(WebCore::ServiceWorkerContainer::stop):

12:48 PM Changeset in webkit [240048] by Megan Gardner

2 edits in trunk/Source/WebCore/PAL

Build fix for iOSMac Reveal
https://bugs.webkit.org/show_bug.cgi?id=193503

Unreviewed build fix.

pal/spi/ios/UIKitSPI.h:

12:40 PM Changeset in webkit [240047] by Simon Fraser

8 edits in trunk/Source/WebCore

Make didCommitChangesForLayer() explicitly about the platform layer changing because of tile/non-tile swapping
https://bugs.webkit.org/show_bug.cgi?id=193290

Reviewed by Tim Horton.

RenderLayerCompositor::didFlushChangesForLayer() triggers updates scrolling tree nodes for
the flushed layer, but it's not clear what has changed at this point.

didCommitChangesForLayer()/didFlushChangesForLayer() were added to explicitly handle the
case where the underlying platform layer for a GraphicsLayer changes because the layer swaps
between tiled and non-tiled, and structural layer changes; we need to push the new layer to
the scrolling tree because it operates on platform layers. So the only work that
didFlushChangesForLayer() should do is to update layers on scrolling tree nodes; it doesn't
need to do any geometry updating. Move towards that goal by renaming this callback to
didChangePlatformLayerForLayer() to make its function more explicit.

platform/graphics/GraphicsLayerClient.h:

(WebCore::GraphicsLayerClient::didChangePlatformLayerForLayer):
(WebCore::GraphicsLayerClient::didCommitChangesForLayer const): Deleted.

platform/graphics/ca/GraphicsLayerCA.cpp:

(WebCore::GraphicsLayerCA::flushCompositingStateForThisLayerOnly):
(WebCore::GraphicsLayerCA::recursiveCommitChanges):
(WebCore::GraphicsLayerCA::commitLayerChangesBeforeSublayers):

platform/graphics/ca/GraphicsLayerCA.h:
rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::didChangePlatformLayerForLayer):
(WebCore::RenderLayerBacking::didCommitChangesForLayer const): Deleted.

rendering/RenderLayerBacking.h:
rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::didChangePlatformLayerForLayer):
(WebCore::LegacyWebKitScrollingLayerCoordinator::didChangePlatformLayerForLayer):
(WebCore::RenderLayerCompositor::didFlushChangesForLayer): Deleted.
(WebCore::RenderLayerCompositor::didCommitChangesForLayer const): Deleted.
(WebCore::LegacyWebKitScrollingLayerCoordinator::didFlushChangesForLayer): Deleted.

rendering/RenderLayerCompositor.h:

12:40 PM Changeset in webkit [240046] by Chris Dumez

55 edits
2 adds in trunk

Regression(PSON) View becomes blank after click a cross-site download link
https://bugs.webkit.org/show_bug.cgi?id=193361
<rdar://problem/47099573>

Reviewed by Geoffrey Garen.

Source/WebCore:

loader/FrameLoader.cpp:

(WebCore::FrameLoader::commitProvisionalLoad):
When restoring from PageCache, make sure we notify the client that the load was committed
*before* we tell it that the navigation is complete. This would confuse the ProvisionalPageProxy
logic in the UIProcess.

Source/WebKit:

The issue tracked by rdar://problem/47099573 is that a provisional load may get
canceled (or converted into a download) *after* we've decided to process-swap.
In such cases, the view should keep displaying the current site and it should
still be interactive. However, with the previous PSON model, the view (pageProxy)
would have already swapped to the new process and would end up displaying the
initially empty document.

To address the issue, this patch introduces the concept of a provisional load
in the UIProcess, handled by a ProvisionalPageProxy which has its own privisional
process. The WebPageProxy owns the ProvisionalPageProxy but we do not commit the
provisional page until after the load was committed in the new process. This means
that the view / WebPageProxy keeps using the old process and displays the current
content until a load has committed in the provisional page. If no load commits
in the provisional process (e.g. because the load is cancelled or converted into
a download), then we merely destroy the ProvisionalPageProxy and terminate its
process, without impacting the WebPageProxy.

Shared/WebPageCreationParameters.cpp:

(WebKit::WebPageCreationParameters::encode const):
(WebKit::WebPageCreationParameters::decode):

Shared/WebPageCreationParameters.h:

Rename isSwapFromSuspended to isProcessSwap for clarity as we always want to
delay attaching the drawing area in case of a process-swap, no matter what
now that the previous process is kept alive until the provisional load is
committed in the new process.

Shared/WebPolicyAction.h:

Drop Suspend policy action. At decidePolicyForNavigationAction time, in case of
process-swap, we now tell the previous process to simply ignore the load, while
we create a ProvisionalPageProxy to do the new load in a new process.
Suspension of the previous page in the old process, happens later, when a load
is actually committed in the new process.

Sources.txt:

Add new ProvisionalPageProxy file.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _killWebContentProcessAndResetState]):
When calling _killWebContentProcessAndResetState on a WKWebView, kill both the current
process and the provisional one, to maintain previous behavior in our API tests.

UIProcess/API/gtk/PageClientImpl.cpp:

(WebKit::PageClientImpl::createDrawingAreaProxy):

UIProcess/API/gtk/PageClientImpl.h:
UIProcess/API/wpe/PageClientImpl.cpp:

(WebKit::PageClientImpl::createDrawingAreaProxy):

UIProcess/API/wpe/PageClientImpl.h:
UIProcess/AcceleratedDrawingAreaProxy.cpp:

(WebKit::AcceleratedDrawingAreaProxy::AcceleratedDrawingAreaProxy):
(WebKit::AcceleratedDrawingAreaProxy::didUpdateBackingStoreState):
(WebKit::AcceleratedDrawingAreaProxy::sendUpdateBackingStoreState):
(WebKit::AcceleratedDrawingAreaProxy::waitForAndDispatchDidUpdateBackingStoreState):
(WebKit::AcceleratedDrawingAreaProxy::setNativeSurfaceHandleForCompositing):
(WebKit::AcceleratedDrawingAreaProxy::destroyNativeSurfaceHandleForCompositing):

UIProcess/AcceleratedDrawingAreaProxy.h:
UIProcess/Cocoa/WebViewImpl.h:
UIProcess/Cocoa/WebViewImpl.mm:

(WebKit::WebViewImpl::createDrawingAreaProxy):

UIProcess/DrawingAreaProxy.cpp:

(WebKit::DrawingAreaProxy::DrawingAreaProxy):
(WebKit::DrawingAreaProxy::~DrawingAreaProxy):
(WebKit::DrawingAreaProxy::viewExposedRectChangedTimerFired):

UIProcess/DrawingAreaProxy.h:

(WebKit::DrawingAreaProxy::process):

UIProcess/DrawingAreaProxyImpl.cpp:

(WebKit::DrawingAreaProxyImpl::DrawingAreaProxyImpl):
(WebKit::DrawingAreaProxyImpl::update):

UIProcess/DrawingAreaProxyImpl.h:
UIProcess/PageClient.h:
UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.h:
UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm:

(WebKit::RemoteLayerTreeDrawingAreaProxy::RemoteLayerTreeDrawingAreaProxy):
(WebKit::RemoteLayerTreeDrawingAreaProxy::~RemoteLayerTreeDrawingAreaProxy):
(WebKit::RemoteLayerTreeDrawingAreaProxy::deviceScaleFactorDidChange):
(WebKit::RemoteLayerTreeDrawingAreaProxy::sendUpdateGeometry):
(WebKit::RemoteLayerTreeDrawingAreaProxy::acceleratedAnimationDidStart):
(WebKit::RemoteLayerTreeDrawingAreaProxy::acceleratedAnimationDidEnd):
(WebKit::RemoteLayerTreeDrawingAreaProxy::didRefreshDisplay):
(WebKit::RemoteLayerTreeDrawingAreaProxy::waitForDidUpdateActivityState):
(WebKit::RemoteLayerTreeDrawingAreaProxy::dispatchAfterEnsuringDrawing):

UIProcess/ios/PageClientImplIOS.h:
UIProcess/ios/PageClientImplIOS.mm:

(WebKit::PageClientImpl::createDrawingAreaProxy):

UIProcess/ios/WKContentView.h:
UIProcess/ios/WKContentView.mm:

(-[WKContentView _createDrawingAreaProxy:]):

UIProcess/mac/PageClientImplMac.h:
UIProcess/mac/PageClientImplMac.mm:

(WebKit::PageClientImpl::createDrawingAreaProxy):

UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.h:
UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm:

(WebKit::TiledCoreAnimationDrawingAreaProxy::TiledCoreAnimationDrawingAreaProxy):
(WebKit::TiledCoreAnimationDrawingAreaProxy::deviceScaleFactorDidChange):
(WebKit::TiledCoreAnimationDrawingAreaProxy::colorSpaceDidChange):
(WebKit::TiledCoreAnimationDrawingAreaProxy::waitForDidUpdateActivityState):
(WebKit::TiledCoreAnimationDrawingAreaProxy::createFence):
(WebKit::TiledCoreAnimationDrawingAreaProxy::sendUpdateGeometry):
(WebKit::TiledCoreAnimationDrawingAreaProxy::adjustTransientZoom):
(WebKit::TiledCoreAnimationDrawingAreaProxy::commitTransientZoom):
(WebKit::TiledCoreAnimationDrawingAreaProxy::dispatchAfterEnsuringDrawing):

UIProcess/mac/WebPageProxyMac.mm:
UIProcess/win/PageClientImpl.cpp:

(WebKit::PageClientImpl::createDrawingAreaProxy):

UIProcess/win/PageClientImpl.h:
UIProcess/win/PageClientImpl.cpp:

(WebKit::PageClientImpl::createDrawingAreaProxy):

UIProcess/win/PageClientImpl.h:
WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:

(WebKit::TiledCoreAnimationDrawingArea::TiledCoreAnimationDrawingArea):
Pass the drawing area's associated process when constructing it and store it as a member
in addition to the page. This is necessary now that a page can be associated with 2
WebProcesses at a time, each having its own drawing area.

UIProcess/Cocoa/WebPageProxyCocoa.mm:

(WebKit::WebPageProxy::createSandboxExtensionsIfNeeded):
Pass the process.

UIProcess/ProvisionalPageProxy.cpp: Added.

(WebKit::ProvisionalPageProxy::ProvisionalPageProxy):
(WebKit::ProvisionalPageProxy::~ProvisionalPageProxy):
(WebKit::ProvisionalPageProxy::processDidTerminate):
(WebKit::ProvisionalPageProxy::takeDrawingArea):
(WebKit::ProvisionalPageProxy::cancel):
(WebKit::ProvisionalPageProxy::processDidFinishLaunching):
(WebKit::ProvisionalPageProxy::finishInitializingWebPageAfterProcessLaunch):
(WebKit::ProvisionalPageProxy::initializeWebPage):
(WebKit::ProvisionalPageProxy::loadData):
(WebKit::ProvisionalPageProxy::loadRequest):
(WebKit::ProvisionalPageProxy::goToBackForwardItem):
(WebKit::ProvisionalPageProxy::didCreateMainFrame):
(WebKit::ProvisionalPageProxy::didPerformClientRedirect):
(WebKit::ProvisionalPageProxy::didStartProvisionalLoadForFrame):
(WebKit::ProvisionalPageProxy::didFailProvisionalLoadForFrame):
(WebKit::ProvisionalPageProxy::didCommitLoadForFrame):
(WebKit::ProvisionalPageProxy::didNavigateWithNavigationData):
(WebKit::ProvisionalPageProxy::didChangeProvisionalURLForFrame):
(WebKit::ProvisionalPageProxy::decidePolicyForNavigationActionAsync):
(WebKit::ProvisionalPageProxy::decidePolicyForResponse):
(WebKit::ProvisionalPageProxy::startURLSchemeTask):
(WebKit::ProvisionalPageProxy::backForwardGoToItem):
(WebKit::ProvisionalPageProxy::didReceiveMessage):
(WebKit::ProvisionalPageProxy::didReceiveSyncMessage):

UIProcess/ProvisionalPageProxy.h: Added.

(WebKit::ProvisionalPageProxy::page):
(WebKit::ProvisionalPageProxy::mainFrame const):
(WebKit::ProvisionalPageProxy::process):
(WebKit::ProvisionalPageProxy::processSwapRequestedByClient const):
(WebKit::ProvisionalPageProxy::navigationID const):
(WebKit::ProvisionalPageProxy::drawingArea const):
New WebPageProxy-like class which is owned by the WebPageProxy and proxies IPC from
the provisional process.

UIProcess/SuspendedPageProxy.cpp:

(WebKit::SuspendedPageProxy::~SuspendedPageProxy):
(WebKit::SuspendedPageProxy::unsuspend):
(WebKit::SuspendedPageProxy::didProcessRequestToSuspend):
Unregister the SuspendedPageProxy as an IPC message receiver a little bit earlier
when we're going to unsuspend it. This avoids conflicting with the ProvisionalPageProxy
which tries to register itself as an IPC message receiver for the same pageID when
a process-swap occurs and we're switching to a suspended page.

UIProcess/WebFrameProxy.cpp:

(WebKit::WebFrameProxy::isMainFrame const):
WebFrameProxy::isMainFrame() relies on checking that the frame is the WebPageProxy's m_mainFrame.
Now that the WebPageProxy can have a ProvisionalPageProxy, also check if it is the ProvisionalPageProxy's
m_mainFrame to maintain previous behavior.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::provisionalDrawingArea const):
Add getter for the provisional drawing area. We normally only deal with the page's current drawing area, but
the ViewGestureController needs access to the provisional once to display the swipe gesture snapshot.

(WebKit::WebPageProxy::swapToWebProcess):
swapToWebProcess() no longer takes care of unsuspending the SuspendedPage because we now call swapToWebProcess()
later, when a load is actually committed in the provisional page / process. swapToWebProcess() now also needs
to initialize some data members such as the drawing area and the main frame as it is transferring them over from
the ProvisionalPageProxy which started the provisional load.

(WebKit::WebPageProxy::finishAttachingToWebProcess):
We no longer need IsSwapFromSuspended parameter as this is called later now, after a load has actually been
committed in the provisional process.

(WebKit::WebPageProxy::setDrawingArea):
(WebKit::WebPageProxy::initializeWebPage):

We no longer need IsSwapFromSuspended parameter as this is called later now, after a load has actually been committed in the provisional process.
Factor some code out to WebPageProxy::setDrawingArea() so that it can be shared with swapToWebProcess().

(WebKit::WebPageProxy::maybeInitializeSandboxExtensionHandle):
(WebKit::WebPageProxy::loadRequest):
(WebKit::WebPageProxy::loadRequestWithNavigationShared):
Only call setPendingAPIRequestURL() in loadRequestWithNavigation() only if ShouldTreatAsContinuingLoad is not
Yes. This avoids hitting some assertions as this was already called during the first API call if needed.

(WebKit::WebPageProxy::loadData):
(WebKit::WebPageProxy::loadDataWithNavigationShared):
(WebKit::WebPageProxy::stopLoading):
(WebKit::WebPageProxy::reload):
(WebKit::WebPageProxy::didPerformDragControllerAction):
(WebKit::WebPageProxy::findPlugin):
(WebKit::WebPageProxy::receivedNavigationPolicyDecision):
In case of process swap, tell the previous process to ignore the load instead of suspending it right away.
Suspension now happens later, only if we end up committing the provisional load in the new process.
Also discard the SuspendedPage if it failed to suspend (we only reuse its process in this case). This used
to happen a bit later but it is clearer if we do this as early as possible I think.

(WebKit::WebPageProxy::commitProvisionalPage):
When the load is committed in the new process, we call WebPageProxy::commitProvisionalPage(). It takes care of:

Actually swapping the WebPageProxy to the new process by calling processDidTerminate() / swapToWebProcess().
Suspending the current page.
Letting the client know the load is comitted
Destroy the ProvisionalPageProxy.

This work used to happen earlier in continueNavigationInNewProcess().

(WebKit::WebPageProxy::continueNavigationInNewProcess):
Moved some of the logic to commitProvisionalPage(). We now merely start the load in a new ProvisionalPageProxy,
without actually having the WebPageProxy switch to the new process yet.

(WebKit::WebPageProxy::didCreateMainFrame):
(WebKit::WebPageProxy::didCreateSubframe):
(WebKit::WebPageProxy::didCreateWindow):
Drop some code that is no longer needed, now that the ProvisionalPageProxy takes care of this.

(WebKit::WebPageProxy::didDestroyNavigation):
On process-swap, when telling the previous process to ignore the load and starting the new load in a new
ProvisionalPageProxy, the previous WebPage attempts to destroy the navigation. In this case, we ignore
the call since the navigation is merely taken over by the ProvisionalPageProxy.

(WebKit::WebPageProxy::didStartProvisionalLoadForFrame):
(WebKit::WebPageProxy::didStartProvisionalLoadForFrameShared):
Moved some PSON logic to the ProvisionalPageProxy instead.

(WebKit::WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame):
(WebKit::WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrameShared):
(WebKit::WebPageProxy::willPerformClientRedirectForFrame):
(WebKit::WebPageProxy::didCancelClientRedirectForFrame):
(WebKit::WebPageProxy::didChangeProvisionalURLForFrame):
(WebKit::WebPageProxy::didChangeProvisionalURLForFrameShared):

(WebKit::WebPageProxy::didFailProvisionalLoadForFrame):
(WebKit::WebPageProxy::didFailProvisionalLoadForFrameShared):
When didFailProvisionalLoadForFrame() is called for a ProvisionalPageProxy, destroy it.

(WebKit::WebPageProxy::didCommitLoadForFrame):
(WebKit::WebPageProxy::didFinishDocumentLoadForFrame):
(WebKit::WebPageProxy::didFinishLoadForFrame):
(WebKit::WebPageProxy::didFailLoadForFrame):
(WebKit::WebPageProxy::didSameDocumentNavigationForFrame):
(WebKit::WebPageProxy::didReceiveTitleForFrame):
(WebKit::WebPageProxy::didFirstVisuallyNonEmptyLayoutForFrame):
(WebKit::WebPageProxy::didDisplayInsecureContentForFrame):
(WebKit::WebPageProxy::didRunInsecureContentForFrame):
(WebKit::WebPageProxy::frameDidBecomeFrameSet):
(WebKit::WebPageProxy::decidePolicyForNavigationActionAsync):
(WebKit::WebPageProxy::decidePolicyForNavigationActionAsyncShared):
(WebKit::WebPageProxy::decidePolicyForNavigationAction):
(WebKit::WebPageProxy::decidePolicyForNavigationActionSync):
(WebKit::WebPageProxy::decidePolicyForNewWindowAction):
(WebKit::WebPageProxy::decidePolicyForResponse):
(WebKit::WebPageProxy::decidePolicyForResponseShared):
(WebKit::WebPageProxy::unableToImplementPolicy):
(WebKit::WebPageProxy::willSubmitForm):
(WebKit::WebPageProxy::didNavigateWithNavigationData):
(WebKit::WebPageProxy::didNavigateWithNavigationDataShared):
(WebKit::WebPageProxy::didPerformClientRedirect):
(WebKit::WebPageProxy::didPerformClientRedirectShared):
(WebKit::WebPageProxy::didPerformServerRedirect):
(WebKit::WebPageProxy::didUpdateHistoryTitle):
(WebKit::WebPageProxy::createNewPage):
(WebKit::WebPageProxy::runJavaScriptAlert):
(WebKit::WebPageProxy::runJavaScriptConfirm):
(WebKit::WebPageProxy::runJavaScriptPrompt):
(WebKit::WebPageProxy::unavailablePluginButtonClicked):
(WebKit::WebPageProxy::runBeforeUnloadConfirmPanel):
(WebKit::WebPageProxy::runOpenPanel):
(WebKit::WebPageProxy::printFrame):
(WebKit::WebPageProxy::backForwardGoToItem):
(WebKit::WebPageProxy::backForwardGoToItemShared):
(WebKit::WebPageProxy::learnWord):
(WebKit::WebPageProxy::ignoreWord):
(WebKit::WebPageProxy::didReceiveEvent):
(WebKit::WebPageProxy::editingRangeCallback):
(WebKit::WebPageProxy::rectForCharacterRangeCallback):
(WebKit::WebPageProxy::focusedFrameChanged):
(WebKit::WebPageProxy::frameSetLargestFrameChanged):

(WebKit::WebPageProxy::provisionalProcessDidTerminate):
Cancel the provisiona load and destroy the ProvisionalPageProxy if
the provisional process crashes.

(WebKit::WebPageProxy::resetState):
Drop some code that is no longer needed.

(WebKit::WebPageProxy::creationParameters):

Move the hasRegisteredServiceWorkers flag initialization from the call site to here now that we have

more than one call site. This was just some bad factoring.

Take the process in parameter now that we page can be associated with several processes at a time.

(WebKit::WebPageProxy::exceededDatabaseQuota):
(WebKit::WebPageProxy::requestGeolocationPermissionForFrame):
(WebKit::WebPageProxy::requestUserMediaPermissionForFrame):
(WebKit::WebPageProxy::enumerateMediaDevicesForFrame):
(WebKit::WebPageProxy::startURLSchemeTask):
(WebKit::WebPageProxy::startURLSchemeTaskShared):
(WebKit::WebPageProxy::stopURLSchemeTask):
(WebKit::WebPageProxy::loadSynchronousURLSchemeTask):
(WebKit::WebPageProxy::checkURLReceivedFromCurrentOrPreviousWebProcess):
(WebKit::WebPageProxy::willAcquireUniversalFileReadSandboxExtension):

UIProcess/WebPageProxy.h:

(WebKit::WebPageProxy::visitedLinkStore):
(WebKit::WebPageProxy::provisionalPageProxy const):

UIProcess/WebProcessProxy.cpp:

(WebKit::WebProcessProxy::hasProvisionalPageWithID const):
(WebKit::WebProcessProxy::updateBackForwardItem):
(WebKit::WebProcessProxy::processDidTerminateOrFailedToLaunch):
(WebKit::WebProcessProxy::didFinishLaunching):
(WebKit::WebProcessProxy::canTerminateChildProcess):

UIProcess/WebProcessProxy.h:

(WebKit::WebProcessProxy::addProvisionalPageProxy):
(WebKit::WebProcessProxy::removeProvisionalPageProxy):
Before updating a BackForwardListItem, we normally make sure the process has a WebPageProxy with the
item's pageID. We have to tweak the logic because there may now be no WebPageProxy with this pageID
associated with this process yet, because it is still a ProvisionalPageProxy.

UIProcess/WebURLSchemeHandler.cpp:

(WebKit::WebURLSchemeHandler::startTask):

UIProcess/WebURLSchemeHandler.h:
UIProcess/WebURLSchemeTask.cpp:

(WebKit::WebURLSchemeTask::create):
(WebKit::WebURLSchemeTask::WebURLSchemeTask):
(WebKit::WebURLSchemeTask::didPerformRedirection):
(WebKit::WebURLSchemeTask::didReceiveResponse):
(WebKit::WebURLSchemeTask::didReceiveData):
(WebKit::WebURLSchemeTask::didComplete):
(WebKit::WebURLSchemeTask::pageDestroyed):

UIProcess/WebURLSchemeTask.h:

Pass the process when constructing a WebURLSchemeTask and store it as a data member in addition to
the page. This is necessary now that a WebPageProxy can be associated with several WebProcesses.

UIProcess/ios/ViewGestureControllerIOS.mm:

(WebKit::ViewGestureController::endSwipeGesture):
Use the provisional drawing area to display the swipe snapshot as it may differ from the one currently
associated with the page in case of process swap.

WebKit.xcodeproj/project.pbxproj:

Add ProvisionalPageProxy class.

WebProcess/WebPage/WebFrame.cpp:

(WebKit::toPolicyAction):
(WebKit::WebFrame::didReceivePolicyDecision):

WebProcess/WebPage/WebPage.cpp:

(WebKit::m_shouldAttachDrawingAreaOnPageTransition):
(WebKit::WebPage::reinitializeWebPage):
(WebKit::WebPage::didReceivePolicyDecision):
Stop dealing with WebPolicyAction::Suspend as it no longer exists.

(WebKit::WebPage::didCompletePageTransition):

(WebKit::WebPage::setIsSuspended):
Suspend the Page when setIsSuspended(true) is called, now that there is no longer a WebPolicyAction::Suspend.
setIsSuspended(true) IPC is sent when we actually commit the provisional page.

WebProcess/WebPage/WebPage.h:

Tools:

Add API test coverage.

TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:

(-[PSONNavigationDelegate webView:decidePolicyForNavigationResponse:decisionHandler:]):

LayoutTests:

Skip test testing the cross-process DOMWindow API as I broke it with this patch.
The feature is far from ready and off by default anyway. I will add support back
in a follow-up.

platform/wk2/TestExpectations:

12:35 PM Changeset in webkit [240045] by timothy_horton@apple.com

2 edits in trunk/Source/WebKit

Frequent null-deref under TiledCoreAnimationDrawingArea::scaleViewToFitDocumentIfNeeded()
https://bugs.webkit.org/show_bug.cgi?id=193468
<rdar://problem/38645869>

Reviewed by Zalan Bujtas.

WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:

(WebKit::TiledCoreAnimationDrawingArea::scaleViewToFitDocumentIfNeeded):
Adjust the null-check a bit; Zalan pointed out that the layout could
be responsible for the Frame/RenderView going away, so we should bail
*after* layout, not before.

11:56 AM Changeset in webkit [240044] by Devin Rousso

2 edits in trunk/Source/WebCore

Web Inspector: extend overlay element bounds lines to the right/below as well
https://bugs.webkit.org/show_bug.cgi?id=193336

Reviewed by Matt Baker.

This patch is purely a visual change for WebInspector, and doesn't affect anything else.

inspector/InspectorOverlayPage.js:

(_drawBounds):

11:08 AM Changeset in webkit [240043] by keith_miller@apple.com

6 edits
1 copy in trunk/Source

bmalloc should use JSC VM tag for gigacage
https://bugs.webkit.org/show_bug.cgi?id=193496

Reviewed by Mark Lam.

Source/bmalloc:

This patch moves the VMTag info from WTF to bmalloc so that we can
tag gigacage memory with the unused JSC memory tag. The JSC memory
tag was previously used for wasm but since wasm is now allocated
out of the primitive cage it was unused.

bmalloc.xcodeproj/project.pbxproj:
bmalloc/BVMTags.h: Copied from Source/WTF/wtf/VMTags.h.
bmalloc/Gigacage.cpp:

(Gigacage::ensureGigacage):

bmalloc/VMAllocate.h:

(bmalloc::tryVMAllocate):
(bmalloc::vmZeroAndPurge):

Source/WTF:

Move most of the macros for vm tagging to bmalloc.

wtf/VMTags.h:

11:07 AM Changeset in webkit [240042] by youenn@apple.com

7 edits in trunk/Source/WebCore

Prevent WorkerRunLoop::runInMode from spinning in nested cases
https://bugs.webkit.org/show_bug.cgi?id=193359
<rdar://problem/46345353>

Reviewed by Joseph Pecoraro.

Speculative fix for some cases where service worker is spinning and consuming a lot of CPU.
The hypothesis is that:

Service Worker is checking for its script freshness through WorkerScriptLoader.

This triggers the worker run loop to be nested.

The run loop timer is active and needs to fire immediately.

The hypothesis is that this happens in some cases like restarting a device after sleep mode.

WorkerRunLoop::runInMode will then compute a 0 timeout value for getting a message.
This will trigger a timeout while waiting for the message queue.
Since the run loop is nested, the run loop timer will not be able to fire,
and it will keep ask to fire immediately.
runInMode will return timeout as a result and WorkerRunLoop::run will call it immediately.

The fix is to prevent the shared timer to fire only when the run loop is being debugged through the web inspector.
We compute this by checking the run loop mode as debuggerMode().
Did some refactoring by introducing helper routines for running the loop and posting task in debugger mode.

inspector/WorkerScriptDebugServer.cpp:

(WebCore::WorkerScriptDebugServer::runEventLoopWhilePaused):

workers/WorkerInspectorProxy.cpp:

(WebCore::WorkerInspectorProxy::resumeWorkerIfPaused):
(WebCore::WorkerInspectorProxy::connectToWorkerInspectorController):
(WebCore::WorkerInspectorProxy::disconnectFromWorkerInspectorController):
(WebCore::WorkerInspectorProxy::sendMessageToWorkerInspectorController):

workers/WorkerRunLoop.cpp:

(WebCore::ModePredicate::ModePredicate):
(WebCore::WorkerRunLoop::WorkerRunLoop):
(WebCore::debuggerMode):
(WebCore::RunLoopSetup::RunLoopSetup):
(WebCore::RunLoopSetup::~RunLoopSetup):
(WebCore::WorkerRunLoop::run):
(WebCore::WorkerRunLoop::runInDebuggerMode):
(WebCore::WorkerRunLoop::runInMode):
(WebCore::WorkerRunLoop::Task::performTask):

workers/WorkerRunLoop.h:

(WebCore::WorkerRunLoop::isBeingDebugged const):

workers/WorkerThread.cpp:

(WebCore::WorkerThread::startRunningDebuggerTasks):

workers/service/context/ServiceWorkerInspectorProxy.cpp:

(WebCore::ServiceWorkerInspectorProxy::connectToWorker):
(WebCore::ServiceWorkerInspectorProxy::disconnectFromWorker):
(WebCore::ServiceWorkerInspectorProxy::sendMessageToWorker):

10:44 AM Changeset in webkit [240041] by mark.lam@apple.com

35 edits in trunk/Source/JavaScriptCore

Refactor new bytecode structs so that the fields are prefixed with "m_".
https://bugs.webkit.org/show_bug.cgi?id=193467

Reviewed by Saam Barati and Tadeu Zagallo.

This makes it easier to do a manual audit of type correctness of the LLInt
instructions used to access these fields. Without this change, it would be
difficult (and error prone) to distinguish the difference between field names and
macro variables. This audit will be done after this patch lands.

bytecode/BytecodeGeneratorification.cpp:

(JSC::BytecodeGeneratorification::BytecodeGeneratorification):

bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeOffset):

bytecode/CallLinkStatus.cpp:

(JSC::CallLinkStatus::computeFromLLInt):

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::propagateTransitions):
(JSC::CodeBlock::finalizeLLIntInlineCaches):
(JSC::CodeBlock::ensureCatchLivenessIsComputedForBytecodeOffset):
(JSC::CodeBlock::ensureCatchLivenessIsComputedForBytecodeOffsetSlow):
(JSC::CodeBlock::getArrayProfile):
(JSC::CodeBlock::notifyLexicalBindingShadowing):
(JSC::CodeBlock::tryGetValueProfileForBytecodeOffset):
(JSC::CodeBlock::arithProfileForPC):
(JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler):

bytecode/CodeBlockInlines.h:

(JSC::CodeBlock::forEachValueProfile):
(JSC::CodeBlock::forEachArrayProfile):
(JSC::CodeBlock::forEachArrayAllocationProfile):
(JSC::CodeBlock::forEachObjectAllocationProfile):
(JSC::CodeBlock::forEachLLIntCallLinkInfo):

bytecode/GetByIdStatus.cpp:

(JSC::GetByIdStatus::computeFromLLInt):

bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp:

(JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::clearLLIntGetByIdCache):

bytecode/PreciseJumpTargetsInlines.h:

(JSC::jumpTargetForInstruction):
(JSC::extractStoredJumpTargetsForInstruction):
(JSC::updateStoredJumpTargetsForInstruction):

bytecode/PutByIdStatus.cpp:

(JSC::PutByIdStatus::computeFromLLInt):

bytecode/UnlinkedCodeBlock.cpp:

(JSC::dumpLineColumnEntry):

bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::fuseCompareAndJump):
(JSC::BytecodeGenerator::fuseTestAndJmp):
(JSC::BytecodeGenerator::emitEqualityOp):
(JSC::BytecodeGenerator::endSwitch):
(JSC::StructureForInContext::finalize):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleCall):
(JSC::DFG::ByteCodeParser::handleVarargsCall):
(JSC::DFG::ByteCodeParser::parseGetById):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::handlePutByVal):
(JSC::DFG::ByteCodeParser::handlePutAccessorById):
(JSC::DFG::ByteCodeParser::handlePutAccessorByVal):
(JSC::DFG::ByteCodeParser::handleNewFunc):
(JSC::DFG::ByteCodeParser::handleNewFuncExp):

dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareCatchOSREntry):

ftl/FTLOperations.cpp:

(JSC::FTL::operationMaterializeObjectInOSR):

generator/Argument.rb:
generator/Metadata.rb:
generator/Opcode.rb:
jit/JIT.h:
jit/JITArithmetic.cpp:

(JSC::JIT::emit_op_unsigned):
(JSC::JIT::emit_compareAndJump):
(JSC::JIT::emit_compareUnsignedAndJump):
(JSC::JIT::emit_compareUnsigned):
(JSC::JIT::emit_compareAndJumpSlow):
(JSC::JIT::emit_op_inc):
(JSC::JIT::emit_op_dec):
(JSC::JIT::emit_op_mod):
(JSC::JIT::emit_op_negate):
(JSC::JIT::emitBitBinaryOpFastPath):
(JSC::JIT::emit_op_bitnot):
(JSC::JIT::emitRightShiftFastPath):
(JSC::JIT::emit_op_add):
(JSC::JIT::emitMathICFast):
(JSC::JIT::emitMathICSlow):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emit_op_sub):

jit/JITArithmetic32_64.cpp:

(JSC::JIT::emit_compareAndJump):
(JSC::JIT::emit_compareUnsignedAndJump):
(JSC::JIT::emit_compareUnsigned):
(JSC::JIT::emit_compareAndJumpSlow):
(JSC::JIT::emit_op_unsigned):
(JSC::JIT::emit_op_inc):
(JSC::JIT::emit_op_dec):
(JSC::JIT::emitBinaryDoubleOp):
(JSC::JIT::emit_op_mod):

jit/JITCall.cpp:

(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileTailCall):
(JSC::JIT::compileOpCall):

jit/JITCall32_64.cpp:

(JSC::JIT::emitPutCallResult):
(JSC::JIT::emit_op_ret):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileOpCall):

jit/JITInlines.h:

(JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
(JSC::JIT::emitValueProfilingSite):
(JSC::JIT::copiedGetPutInfo):
(JSC::JIT::copiedArithProfile):

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_mov):
(JSC::JIT::emit_op_end):
(JSC::JIT::emit_op_jmp):
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emit_op_is_empty):
(JSC::JIT::emit_op_is_undefined):
(JSC::JIT::emit_op_is_undefined_or_null):
(JSC::JIT::emit_op_is_boolean):
(JSC::JIT::emit_op_is_number):
(JSC::JIT::emit_op_is_cell_with_type):
(JSC::JIT::emit_op_is_object):
(JSC::JIT::emit_op_ret):
(JSC::JIT::emit_op_to_primitive):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_not):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_eq):
(JSC::JIT::emit_op_jeq):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::emit_op_neq):
(JSC::JIT::emit_op_jneq):
(JSC::JIT::emit_op_throw):
(JSC::JIT::compileOpStrictEq):
(JSC::JIT::compileOpStrictEqJump):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_string):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_get_parent_scope):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_debug):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_get_scope):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emit_op_check_tdz):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emitSlow_op_jeq):
(JSC::JIT::emitSlow_op_jneq):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_new_regexp):
(JSC::JIT::emitNewFuncCommon):
(JSC::JIT::emitNewFuncExprCommon):
(JSC::JIT::emit_op_new_array):
(JSC::JIT::emit_op_new_array_with_size):
(JSC::JIT::emit_op_has_structure_property):
(JSC::JIT::emit_op_has_indexed_property):
(JSC::JIT::emitSlow_op_has_indexed_property):
(JSC::JIT::emit_op_get_direct_pname):
(JSC::JIT::emit_op_enumerator_structure_pname):
(JSC::JIT::emit_op_enumerator_generic_pname):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_prologue):
(JSC::JIT::emit_op_log_shadow_chicken_tail):
(JSC::JIT::emit_op_profile_control_flow):
(JSC::JIT::emit_op_argument_count):
(JSC::JIT::emit_op_get_rest_length):
(JSC::JIT::emit_op_get_argument):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_mov):
(JSC::JIT::emit_op_end):
(JSC::JIT::emit_op_jmp):
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_is_empty):
(JSC::JIT::emit_op_is_undefined):
(JSC::JIT::emit_op_is_undefined_or_null):
(JSC::JIT::emit_op_is_boolean):
(JSC::JIT::emit_op_is_number):
(JSC::JIT::emit_op_is_cell_with_type):
(JSC::JIT::emit_op_is_object):
(JSC::JIT::emit_op_to_primitive):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_not):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_eq):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::emit_op_jeq):
(JSC::JIT::emitSlow_op_jeq):
(JSC::JIT::emit_op_neq):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emit_op_jneq):
(JSC::JIT::emitSlow_op_jneq):
(JSC::JIT::compileOpStrictEq):
(JSC::JIT::compileOpStrictEqJump):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_throw):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_string):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_get_parent_scope):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_debug):
(JSC::JIT::emit_op_get_scope):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_check_tdz):
(JSC::JIT::emit_op_has_structure_property):
(JSC::JIT::emit_op_has_indexed_property):
(JSC::JIT::emitSlow_op_has_indexed_property):
(JSC::JIT::emit_op_get_direct_pname):
(JSC::JIT::emit_op_enumerator_structure_pname):
(JSC::JIT::emit_op_enumerator_generic_pname):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_prologue):
(JSC::JIT::emit_op_log_shadow_chicken_tail):

jit/JITOperations.cpp:
jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitGetByValWithCachedId):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitGenericContiguousPutByVal):
(JSC::JIT::emitArrayStoragePutByVal):
(JSC::JIT::emitPutByValWithCachedId):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_put_to_arguments):
(JSC::JIT::emitIntTypedArrayPutByVal):
(JSC::JIT::emitFloatTypedArrayPutByVal):

jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitGetByValWithCachedId):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitGenericContiguousPutByVal):
(JSC::JIT::emitArrayStoragePutByVal):
(JSC::JIT::emitPutByValWithCachedId):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_put_to_arguments):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::setupGetByIdPrototypeCache):
(JSC::LLInt::getByVal):
(JSC::LLInt::genericCall):
(JSC::LLInt::varargsSetup):
(JSC::LLInt::commonCallEval):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):
(JSC::updateArithProfileForUnaryArithOp):

runtime/CommonSlowPaths.h:

(JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
(JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):

10:10 AM Changeset in webkit [240040] by mark.lam@apple.com

6 edits
4 adds in trunk

JSFunction::canUseAllocationProfile() should account for builtin functions with no own prototypes.
https://bugs.webkit.org/show_bug.cgi?id=193423
<rdar://problem/46209355>

Reviewed by Saam Barati.

JSTests:

microbenchmarks/sinkable-new-object-with-builtin-constructor.js: Added.
stress/constructing-builtin-functions-with-getter-prototype-should-only-call-getter-once-per-new-1.js: Added.
stress/constructing-builtin-functions-with-getter-prototype-should-only-call-getter-once-per-new-2.js: Added.
stress/jsfunction-cannot-use-allocation-profile-with-builtin-functions-with-no-prototype.js: Added.

Source/JavaScriptCore:

JSFunction::canUseAllocationProfile() should return false for most builtins
because the majority of them have no prototype property. The only exception to
this is the few builtin functions that are explicitly used as constructors.

For these builtin constructors, JSFunction::canUseAllocationProfile() should also
return false if the prototype property is a getter or custom getter because
getting the prototype would then be effectful.

dfg/DFGOperations.cpp:
runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

runtime/JSFunctionInlines.h:

(JSC::JSFunction::canUseAllocationProfile):

runtime/PropertySlot.h:

9:11 AM Changeset in webkit [240039] by sihui_liu@apple.com

3 edits in trunk/Source/WebCore

IndexedDB: leak WebIDBConnectionToClient for retain cycle
https://bugs.webkit.org/show_bug.cgi?id=193097
<rdar://problem/46899601>

Reviewed by David Kilzer.

Fix API test failure after r239887. After removing the retain cycle, IDBConnectionToClient will no longer live
forever so make sure it is not destructed before UniqueIDBDatabaseConnection unregisters itself.

Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:

(WebCore::IDBServer::UniqueIDBDatabaseConnection::UniqueIDBDatabaseConnection):
(WebCore::IDBServer::UniqueIDBDatabaseConnection::~UniqueIDBDatabaseConnection):
(WebCore::IDBServer::UniqueIDBDatabaseConnection::fireVersionChangeEvent):
(WebCore::IDBServer::UniqueIDBDatabaseConnection::didAbortTransaction):
(WebCore::IDBServer::UniqueIDBDatabaseConnection::didCommitTransaction):
(WebCore::IDBServer::UniqueIDBDatabaseConnection::didCreateObjectStore):
(WebCore::IDBServer::UniqueIDBDatabaseConnection::didDeleteObjectStore):
(WebCore::IDBServer::UniqueIDBDatabaseConnection::didRenameObjectStore):
(WebCore::IDBServer::UniqueIDBDatabaseConnection::didClearObjectStore):
(WebCore::IDBServer::UniqueIDBDatabaseConnection::didCreateIndex):
(WebCore::IDBServer::UniqueIDBDatabaseConnection::didDeleteIndex):
(WebCore::IDBServer::UniqueIDBDatabaseConnection::didRenameIndex):

Modules/indexeddb/server/UniqueIDBDatabaseConnection.h:

8:32 AM Changeset in webkit [240038] by berto@igalia.com

2 edits in trunk/Source/WTF

[WTF] Compilation fails with system malloc
https://bugs.webkit.org/show_bug.cgi?id=172445

Reviewed by Michael Catanzaro.

Follow-up to r217270. The sysinfo() system call is specific to
Linux so update the #ifdef checks accordingly.

wtf/RAMSize.cpp:

(WTF::computeRAMSize):

8:03 AM Changeset in webkit [240037] by Antti Koivisto

5 edits in trunk/Source/WebCore

Add more assertions to find root cause for release assert hit in StyleResolver
https://bugs.webkit.org/show_bug.cgi?id=193488
<rdar://problem/30983040>

Reviewed by Zalan Bujtas.

css/StyleResolver.cpp:

(WebCore::StyleResolver::~StyleResolver):

Release assert we are not resolving tree style.

dom/Document.cpp:

(WebCore::Document::setIsResolvingTreeStyle):

dom/Document.h:

(WebCore::Document::isResolvingTreeStyle const):

style/StyleTreeResolver.cpp:

(WebCore::Style::TreeResolver::Scope::Scope):
(WebCore::Style::TreeResolver::Scope::~Scope):

Set isResolvingTreeStyle bit when we have a tree resolver scope.

7:23 AM Changeset in webkit [240036] by Alan Bujtas

5 edits
2 adds in trunk

[LFC][Out-of-flow] Set used vertical margin values when top/height/bottom are non-auto.
https://bugs.webkit.org/show_bug.cgi?id=193470

Reviewed by Antti Koivisto.

Source/WebCore:

Non-auto vertical margin values (which is mostly the case) should be set as used values.

Test: fast/block/block-only/non-auto-top-bottom-height-with-margins.html

layout/FormattingContextGeometry.cpp:

(WebCore::Layout::FormattingContext::Geometry::outOfFlowNonReplacedVerticalGeometry):

Tools:

LayoutReloaded/misc/LFC-passing-tests.txt:

LayoutTests:

fast/block/block-only/non-auto-top-bottom-height-with-margins-expected.txt: Added.
fast/block/block-only/non-auto-top-bottom-height-with-margins.html: Added.

6:52 AM Changeset in webkit [240035] by Alan Bujtas

5 edits
2 adds in trunk

[LFC] Adjust margin box verification.
https://bugs.webkit.org/show_bug.cgi?id=193482

Source/WebCore:

Reviewed by Antti Koivisto.

In certain cases, like out-of-flow boxes with margin auto, marginBoxRect() returns 0. It's clearly incorrect,
so let's check the individual margin values instead (and at this point we know that all other boxes match).

Test: fast/block/block-only/non-auto-top-bottom-height-with-auto-margins.html

layout/Verification.cpp:

(WebCore::Layout::outputMismatchingBlockBoxInformationIfNeeded):

Tools:

Reviewed by Antti Koivisto.

LayoutReloaded/misc/LFC-passing-tests.txt:

LayoutTests:

Reviewed by Antti Koivisto.

fast/block/block-only/non-auto-top-bottom-height-with-auto-margins-expected.txt: Added.
fast/block/block-only/non-auto-top-bottom-height-with-auto-margins.html: Added.

3:05 AM Changeset in webkit [240034] by zandobersek@gmail.com

2 edits in trunk/Source/WebCore

[FreeType] Cache the zero-width space glyph in GlyphPage::fill()
https://bugs.webkit.org/show_bug.cgi?id=193485

Reviewed by Carlos Garcia Campos.

In FreeType's implementation of GlyphPage::fill(), we can cache the
zero-width space glyph upon first retrieval through the
FcFreeTypeCharIndex() entrypoint, avoiding any subsequent calls
for other ignorable characters.

platform/graphics/freetype/GlyphPageTreeNodeFreeType.cpp:

(WebCore::GlyphPage::fill):

2:53 AM Changeset in webkit [240033] by mmaxfield@apple.com

3 edits
2 adds in trunk/Source/WebCore

[WHLSL] Add the high zombie finder
https://bugs.webkit.org/show_bug.cgi?id=193432

Reviewed by Robin Morisset and Saam Barati.

This is a translation of https://github.com/gpuweb/WHLSL/blob/master/Source/HighZombieFinder.mjs into C++.

Modules/webgpu/WHLSL/WHLSLHighZombieFinder.cpp: Added.

(WebCore::WHLSL::findHighZombies):

Modules/webgpu/WHLSL/WHLSLHighZombieFinder.h: Added.
Sources.txt:
WebCore.xcodeproj/project.pbxproj:

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed