Context Navigation

← Previous Period
Next Period →

Timeline

Aug 4, 2019:

11:54 PM Changeset in webkit [248267] by youenn@apple.com

3 edits
2 adds in trunk

WebRTC: got incorrect this in negotiationneeded event
https://bugs.webkit.org/show_bug.cgi?id=200427

Reviewed by Darin Adler.

Source/WebCore:

Make sure a dom object created through a JS built-in constructor is added to the wrapper cache.

Test: webrtc/onnegotiationneeded.html

bindings/js/JSDOMBuiltinConstructor.h:

(WebCore::createJSObjectFromWrapper):
(WebCore::createJSObject):

LayoutTests:

webrtc/onnegotiationneeded-expected.txt: Added.
webrtc/onnegotiationneeded.html: Added.

8:26 PM Changeset in webkit [248266] by weinig@apple.com

14 edits
1 add in trunk/Source/WebCore

Mangled WHLSL names don't need to allocate Strings
https://bugs.webkit.org/show_bug.cgi?id=200429

Reviewed by Saam Barati.

To avoid allocating strings for each mangled name used to transform WHLSL to Metal, which we'd
like to avoid since it is both unnecessarily expensive in time and space, we can instead just
store the unique integer identifier that was being used to construct the String.

Since the existing mangled names were all of the form "prefix" + unsigned integer value (where
prefix could be "type", "enumerationMember", "structureElement", "variable" or "function") we
strongly type the integer by storing it in a struct (MangledVariableName, MangledTypeName, etc.)
When the full name is actually needed, StringTypeAdapter's specialized for the structs are
used to write directly into the preallocated buffers of StringBuilders or makeString().

Modules/webgpu/WHLSL/Metal/WHLSLMangledNames.h: Added.

(WebCore::WHLSL::Metal::MangledVariableName):
(WebCore::WHLSL::Metal::MangledTypeName):
(WebCore::WHLSL::Metal::MangledStructureElementName):
(WebCore::WHLSL::Metal::MangledEnumerationMemberName):
(WebCore::WHLSL::Metal::MangledFunctionName):
Adds structs for each type of mangled name and StringTypeAdapter specializations for
each to allow their use in StringBuilder.flexibleAppend() or makeString().

Additionally, a Variant, MangledOrNativeTypeName, of MangledTypeName and String is
declared to allow for the few cases where a native type (e.g. float4) is needed. The
StringTypeAdapter for MangledOrNativeTypeName could be generalized for any Variant
in the future, but I left it non-general for now, as it is non-obvious if one would
want to store Variant<Types...>, and have each member function construct a temporary
StringTypeAdapter, or store a Variant<StringTypeAdapter<Types>...> and perform conversion
in the construction.

Modules/webgpu/WHLSL/Metal/WHLSLEntryPointScaffolding.cpp:

(WebCore::WHLSL::Metal::EntryPointScaffolding::EntryPointScaffolding):
(WebCore::WHLSL::Metal::internalTypeForSemantic):
(WebCore::WHLSL::Metal::EntryPointScaffolding::builtInsSignature):
(WebCore::WHLSL::Metal::EntryPointScaffolding::mangledInputPath):
(WebCore::WHLSL::Metal::VertexEntryPointScaffolding::VertexEntryPointScaffolding):
(WebCore::WHLSL::Metal::VertexEntryPointScaffolding::signature):
(WebCore::WHLSL::Metal::VertexEntryPointScaffolding::pack):
(WebCore::WHLSL::Metal::FragmentEntryPointScaffolding::FragmentEntryPointScaffolding):
(WebCore::WHLSL::Metal::FragmentEntryPointScaffolding::signature):
(WebCore::WHLSL::Metal::FragmentEntryPointScaffolding::pack):
(WebCore::WHLSL::Metal::ComputeEntryPointScaffolding::ComputeEntryPointScaffolding):
(WebCore::WHLSL::Metal::ComputeEntryPointScaffolding::signature):
(WebCore::WHLSL::Metal::ComputeEntryPointScaffolding::pack):

Modules/webgpu/WHLSL/Metal/WHLSLEntryPointScaffolding.h:

(WebCore::WHLSL::Metal::EntryPointScaffolding::parameterVariables):

Modules/webgpu/WHLSL/Metal/WHLSLFunctionWriter.cpp:

(WebCore::WHLSL::Metal::FunctionDeclarationWriter::FunctionDeclarationWriter):
(WebCore::WHLSL::Metal::FunctionDeclarationWriter::visit):
(WebCore::WHLSL::Metal::FunctionDefinitionWriter::FunctionDefinitionWriter):
(WebCore::WHLSL::Metal::FunctionDefinitionWriter::generateNextVariableName):
(WebCore::WHLSL::Metal::FunctionDefinitionWriter::appendRightValueWithNullability):
(WebCore::WHLSL::Metal::FunctionDefinitionWriter::appendRightValue):
(WebCore::WHLSL::Metal::FunctionDefinitionWriter::appendLeftValue):
(WebCore::WHLSL::Metal::FunctionDefinitionWriter::takeLastValue):
(WebCore::WHLSL::Metal::FunctionDefinitionWriter::takeLastValueAndNullability):
(WebCore::WHLSL::Metal::FunctionDefinitionWriter::takeLastLeftValue):
(WebCore::WHLSL::Metal::FunctionDefinitionWriter::visit):
(WebCore::WHLSL::Metal::FunctionDefinitionWriter::emitLoop):
(WebCore::WHLSL::Metal::RenderFunctionDefinitionWriter::RenderFunctionDefinitionWriter):
(WebCore::WHLSL::Metal::RenderFunctionDefinitionWriter::createEntryPointScaffolding):
(WebCore::WHLSL::Metal::ComputeFunctionDefinitionWriter::ComputeFunctionDefinitionWriter):
(WebCore::WHLSL::Metal::ComputeFunctionDefinitionWriter::createEntryPointScaffolding):
(WebCore::WHLSL::Metal::sharedMetalFunctions):

Modules/webgpu/WHLSL/Metal/WHLSLFunctionWriter.h:
Modules/webgpu/WHLSL/Metal/WHLSLMetalCodeGenerator.h:
Modules/webgpu/WHLSL/Metal/WHLSLNativeFunctionWriter.cpp:

(WebCore::WHLSL::Metal::writeNativeFunction):

Modules/webgpu/WHLSL/Metal/WHLSLNativeFunctionWriter.h:
Modules/webgpu/WHLSL/Metal/WHLSLTypeNamer.cpp:

(WebCore::WHLSL::Metal::BaseTypeNameNode::BaseTypeNameNode):
(WebCore::WHLSL::Metal::BaseTypeNameNode::mangledName const):
(WebCore::WHLSL::Metal::ArrayTypeNameNode::ArrayTypeNameNode):
(WebCore::WHLSL::Metal::ArrayReferenceTypeNameNode::ArrayReferenceTypeNameNode):
(WebCore::WHLSL::Metal::PointerTypeNameNode::PointerTypeNameNode):
(WebCore::WHLSL::Metal::ReferenceTypeNameNode::ReferenceTypeNameNode):
(WebCore::WHLSL::Metal::MetalTypeDeclarationWriter::MetalTypeDeclarationWriter):
(WebCore::WHLSL::Metal::TypeNamer::metalTypeDeclarations):
(WebCore::WHLSL::Metal::TypeNamer::emitNamedTypeDefinition):
(WebCore::WHLSL::Metal::TypeNamer::mangledNameForType):
(WebCore::WHLSL::Metal::TypeNamer::mangledNameForEnumerationMember):
(WebCore::WHLSL::Metal::TypeNamer::mangledNameForStructureElement):

Modules/webgpu/WHLSL/Metal/WHLSLTypeNamer.h:

(WebCore::WHLSL::Metal::TypeNamer::generateNextTypeName):
(WebCore::WHLSL::Metal::TypeNamer::generateNextStructureElementName):
(WebCore::WHLSL::Metal::TypeNamer::generateNextEnumerationMemberName):

Modules/webgpu/WHLSL/WHLSLPrepare.h:

Replace uses of String with the appropriate mangled name type.

WebCore.xcodeproj/project.pbxproj:

Add WHLSLMangledNames.h

platform/graphics/gpu/cocoa/GPUComputePipelineMetal.mm:

(WebCore::trySetFunctions):

platform/graphics/gpu/cocoa/GPURenderPipelineMetal.mm:

(WebCore::trySetFunctions):
Convert the mangled names to Strings for passing to Metal API. NOTE: We could avoid having the
toString() member function on MangledFunctionName if we allowed makeString() to take a single
argument.

11:32 AM Changeset in webkit [248265] by Chris Dumez

7 edits
4 adds in trunk

Ping loads should not prevent page caching
https://bugs.webkit.org/show_bug.cgi?id=200418
<rdar://problem/53901632>

Reviewed by Darin Adler.

Source/WebCore:

We normally prevent page caching if there were any pending subresource loads when navigating,
to avoid caching partial / broken content. However, this should not apply to Ping / Beacon
loads since those do not impact page rendering and can outlive the page.

Tests: http/tests/navigation/page-cache-pending-ping-load-cross-origin.html

http/tests/navigation/page-cache-pending-ping-load-same-origin.html

history/PageCache.cpp:

(WebCore::PageCache::addIfCacheable):
After we've fired the 'pagehide' event in each frame, stop all the loads again. This is needed
since pages are allowed to start ping / beacon loads in their 'pagehide' handlers. If we do not
stop those loads, then the next call to canCachePage() would fail because the DocumentLoader is
still loading. Note that we're not actually preventing these ping loads from hitting the server
since we never cancel page loads and those can outlive their page.

loader/DocumentLoader.cpp:

(WebCore::shouldPendingCachedResourceLoadPreventPageCache):
(WebCore::areAllLoadersPageCacheAcceptable):
Make sure that Ping / Beacon / Prefetches / Icon loads do not prevent page caching.

(WebCore::DocumentLoader::addSubresourceLoader):
Tweak assertion that was incorrect since we actually allow ping / beacon loads when the
document is about to enter PageCache (while firing pagehide event).

Tools:

Add TestOption to enable PageCache at UIProcess-level so that we can test
page caching when navigating cross-origin with PSON enabled.

WebKitTestRunner/TestController.cpp:

(WTR::TestController::resetPreferencesToConsistentValues):
(WTR::updateTestOptionsFromTestHeader):

WebKitTestRunner/TestOptions.h:

(WTR::TestOptions::hasSameInitializationOptions const):

LayoutTests:

Add layout test coverage.

http/tests/navigation/page-cache-pending-ping-load-cross-origin-expected.txt: Added.
http/tests/navigation/page-cache-pending-ping-load-cross-origin.html: Added.
http/tests/navigation/page-cache-pending-ping-load-same-origin-expected.txt: Added.
http/tests/navigation/page-cache-pending-ping-load-same-origin.html: Added.

11:28 AM Changeset in webkit [248264] by Konstantin Tokarev

2 edits in trunk/Source/WebKit

Remove unused lambda capture in MemoryPressureMonitor
https://bugs.webkit.org/show_bug.cgi?id=200420

Reviewed by Darin Adler.

UIProcess/linux/MemoryPressureMonitor.cpp:

(WebKit::MemoryPressureMonitor::start):

6:59 AM Changeset in webkit [248263] by Alan Bujtas

2 edits in trunk/Source/WebCore

[LFC][TFC] Create formatting context/state.
https://bugs.webkit.org/show_bug.cgi?id=200428
<rdar://problem/53913625>

Reviewed by Antti Koivisto.

layout/LayoutState.cpp:

(WebCore::Layout::LayoutState::createFormattingStateForFormattingRootIfNeeded):
(WebCore::Layout::LayoutState::createFormattingContext):

3:16 AM Changeset in webkit [248262] by Alan Bujtas

12 edits in trunk/Source/WebCore

[LFC] Cleanup preferred width computation
https://bugs.webkit.org/show_bug.cgi?id=200426
<rdar://problem/53912607>

Reviewed by Antti Koivisto.

The intrinsic width for a formatting root box has 2 sets of values now. One set(min/max) is stored in the established formatting context's state
while the other is in the formatting context's state where the box lives.

<div style="position: absolute"><div style="float: left; border: 1px solid green">foobar</div></div>

The float box participates in the formatting context established by the absolutely position box, but it also establishes an inline formatting context.
The min/max width pair in the established context is the width of the "foobar" (same value for min/max). This set is stored in the inline formatting state.
However the float box has horizontal border so the "final" min/max width pair is expanded by this border value and stored in the formatting state where
the box lives (which is different from the one it establishes).

This and the "remove the formatting context type classes from the tree" changes open up interesting optimization opportunities.
Here is a very simple case:
<div style="display: inline-block; width: auto;">

<div style="float: left">some text</div>
<div style="float: left">some super long .... text</div>
<div></div>

</div>
In order to lay out this content properly, we

Compute the min/max width of the first float (expensive text measuring)
Compute the min/max width of the second float (some more expensive text measuring)
Compute the min/max width of the inline-block (that is pretty much the 2 float's min/max)
Lay out the 2 floats, the empty div and the inline-block using these min/max width pairs.

Now if the inline-block box's display value is changed to "block" and the positioning is to absolute (style="display: box; position: absolute;")
we currently(on trunk) tear down the render tree, build a new one and run all the steps again from #1 to #4.

In LFC, we start with the following layout tree
<container> -> block formatting context

<container> -> inline formatting context

<anonymous inline box>

<container> -> inline formatting context

<anonymous inline box>

<container> -> inline formatting context

and when the style change happens, we don't need to tear down the tree at all. Not only that, but since every formatting contexts stay the same
we can just reuse their states and actually skip all the steps (even the positioning since the absolutely positioned container has static top/bottom/left/right).

Surprisingly the final layout produces the exact same "display boxes" as the original layout.

layout/FormattingContext.h:

(WebCore::Layout::FormattingContext::IntrinsicWidthConstraints::expand):

layout/FormattingContextGeometry.cpp:

(WebCore::Layout::FormattingContext::Geometry::shrinkToFitWidth):

layout/FormattingState.h:

(WebCore::Layout::FormattingState::setIntrinsicWidthConstraints):
(WebCore::Layout::FormattingState::intrinsicWidthConstraints const):
(WebCore::Layout::FormattingState::setIntrinsicWidthConstraintsForBox):
(WebCore::Layout::FormattingState::clearIntrinsicWidthConstraints):
(WebCore::Layout::FormattingState::intrinsicWidthConstraintsForBox const):

layout/blockformatting/BlockFormattingContext.cpp:

(WebCore::Layout::BlockFormattingContext::computedIntrinsicWidthConstraints const):
(WebCore::Layout::BlockFormattingContext::computeIntrinsicWidthConstraints const): Deleted.

layout/blockformatting/BlockFormattingContext.h:
layout/blockformatting/BlockFormattingContextGeometry.cpp:

(WebCore::Layout::BlockFormattingContext::Geometry::intrinsicWidthConstraints):
(WebCore::Layout::BlockFormattingContext::Geometry::intrinsicWidthConstraintsNeedChildrenWidth): Deleted.

layout/displaytree/DisplayBox.h:

(WebCore::Display::Box::horizontalMarginBorderAndPadding const):

layout/inlineformatting/InlineFormattingContext.cpp:

(WebCore::Layout::nextInPreOrder):
(WebCore::Layout::InlineFormattingContext::computedIntrinsicWidthConstraints const):
(WebCore::Layout::InlineFormattingContext::computeIntrinsicWidthForFormattingRoot const):
(WebCore::Layout::InlineFormattingContext::computeIntrinsicWidthConstraints const): Deleted.
(WebCore::Layout::InlineFormattingContext::computeIntrinsicWidthForFloatBox const): Deleted.
(WebCore::Layout::InlineFormattingContext::computeIntrinsicWidthForInlineBlock const): Deleted.

layout/inlineformatting/InlineFormattingContext.h:
layout/tableformatting/TableFormattingContext.cpp:

(WebCore::Layout::TableFormattingContext::computedIntrinsicWidthConstraints const):

layout/tableformatting/TableFormattingContext.h:

Aug 3, 2019:

8:24 PM Changeset in webkit [248261] by Michael Catanzaro

3 edits in releases/WebKitGTK/webkit-2.24/Source/WebCore

Merge r248173 - Harden NodeRareData::m_connectedFrameCount
https://bugs.webkit.org/show_bug.cgi?id=200300

Reviewed by Geoffrey Garen.

Use unsinged integer type in NodeRareData::m_connectedFrameCount since it's padded anyway.

dom/Node.cpp:

(WebCore::Node::decrementConnectedSubframeCount): Check that hasRareNode() is true in release builds.

dom/NodeRareData.h:

8:24 PM Changeset in webkit [248260] by Michael Catanzaro

4 edits
2 adds in releases/WebKitGTK/webkit-2.24

Merge r248172 - Document::resume should delay resetting of form control elements.
https://bugs.webkit.org/show_bug.cgi?id=200376

Reviewed by Geoffrey Garen.

Source/WebCore:

Delay the execution of form control element resets until the next task
to avoid synchronously mutating DOM during page cache restoration.

Test: fast/frames/restoring-page-cache-should-not-run-scripts.html

html/HTMLFormElement.cpp:

(WebCore::HTMLFormElement::resumeFromDocumentSuspension):

html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::resumeFromDocumentSuspension):

LayoutTests:

Added a regression test.

fast/frames/restoring-page-cache-should-not-run-scripts-expected.txt: Added.
fast/frames/restoring-page-cache-should-not-run-scripts.html: Added.
platform/win/TestExpectations: Skip this test on Windows since navigating to blob fails on Windows.

8:24 PM Changeset in webkit [248259] by Michael Catanzaro

5 edits
1 add in releases/WebKitGTK/webkit-2.24

Merge r248149 - GetterSetter type confusion during DFG compilation
https://bugs.webkit.org/show_bug.cgi?id=199903

Reviewed by Mark Lam.

JSTests:

stress/cse-propagated-constant-may-not-follow-structure-restrictions.js: Added.

Source/JavaScriptCore:

In AI, we are strongly assuming that GetGetter's child constant value should be GetterSetter if it exists.
However, this can be wrong since nobody ensures that. AI assumed so because the control-flow and preceding
CheckStructure ensures that. But this preceding check can be eliminated if the node becomes (at runtime) unreachable.

Let's consider the following graph.

129:<!0:-> PutByOffset(KnownCell:@115, KnownCell:@115, Check:Untyped:@124, MustGen, id5{length}, 0, W:NamedProperties(5), ClobbersExit, bc#154, ExitValid)
130:<!0:-> PutStructure(KnownCell:@115, MustGen, %C8:Object -> %C3:Object, ID:7726, R:JSObject_butterfly, W:JSCell_indexingType,JSCell_structureID,JSCell_typeInfoFlags,JSCell_typeInfoType, ClobbersExit, bc#154, ExitInvalid)
...
158:<!0:-> GetLocal(Check:Untyped:@197, JS|MustGen|UseAsOther, Final, loc7(R<Final>/FlushedCell), R:Stack(-8), bc#187, ExitValid) predicting Final
210:< 1:-> DoubleRep(Check:NotCell:@158, Double|PureInt, BytecodeDouble, Exits, bc#187, ExitValid)
...
162:<!0:-> CheckStructure(Cell:@158, MustGen, [%Ad:Object], R:JSCell_structureID, Exits, bc#192, ExitValid)
163:< 1:-> GetGetterSetterByOffset(KnownCell:@158, KnownCell:@158, JS|UseAsOther, OtherCell, id5{length}, 0, R:NamedProperties(5), Exits, bc#192, ExitValid)
164:< 1:-> GetGetter(KnownCell:@163, JS|UseAsOther, Function, R:GetterSetter_getter, Exits, bc#192, ExitValid)

At @163 and @164, AI proves that @158's AbstractValue is None because @210's edge filters out Cells @158 is a cell. But we do not invalidate graph status as "Invalid" even if edge filters out all possible value.
This is because the result of edge can be None in a valid program. For example, we can put a dependency edge between a consuming node and a producing node, where the producing node is just like a check and it
does not produce a value actually. So, @163 and @164 are not invalidated. This is totally fine in our compiler pipeline right now.

But after that, global CSE phase found that @115 and @158 are same and @129 dominates @158. As a result, we can replace GetGetter child's @163 with @124. Since CheckStructure is already removed (and now, at runtime,
@163 and @164 are never executed), we do not have any structure guarantee on @158 and the result of @163. This means that @163's CSE result can be non-GetterSetter value.

124:< 2:-> JSConstant(JS|UseAsOther, Final, Weak:Object: 0x1199e82a0 with butterfly 0x0 (Structure %B4:Object), StructureID: 49116, bc#0, ExitValid)
...
126:< 2:-> GetGetter(KnownCell:Kill:@124, JS|UseAsOther, Function, R:GetterSetter_getter, Exits, bc#192, ExitValid)

AI filters out @124's non-cell values. But @126 can get non-GetterSetter cell at AI phase. But our AI code is like the following.

JSValue base = forNode(node->child1()).m_value;
if (base) {

GetterSetter* getterSetter = jsCast<GetterSetter*>(base);
...

Then, jsCast casts the above object with GetterSetter accidentally.

In general, DFG AI can get a proven constant value, which could not be shown at runtime. This happens if the processing node is unreachable at runtime while the graph is not invalid yet, because preceding edge
filters already filter out all the possible execution. DFG AI already considered about this possibility, and it attempts to fold a node into a constant only when the constant input matches against the expected one.
But several DFG nodes are not handling this correctly: GetGetter, GetSetter, and SkipScope.

In this patch, we use jsDynamicCast to ensure that the constant input matches against the expected (foldable) one, and fold it only when the expectation is met.
We also remove DFG::Node::castConstant and its use. We should not rely on the constant folded value based on graph's control-flow.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGNode.h:

(JSC::DFG::Node::castConstant): Deleted.

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):

8:24 PM Changeset in webkit [248258] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/WebCore

Merge r248009 - [GTK] Compilation errors when GL is disabled
https://bugs.webkit.org/show_bug.cgi?id=200223

Unreviewed, fix build with -DENABLE_OPENGL=OFF.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):

8:24 PM Changeset in webkit [248257] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/WebCore

Merge r247903 - REGRESSION(r243058): [GStreamer] WebKitWebSrc's internal queue can exhaust the WebProcess memory
https://bugs.webkit.org/show_bug.cgi?id=199998

Reviewed by Xabier Rodriguez-Calvar.

With the webkitwebsrc rewrite the element lost its ability to tell
the resource loader when to pause and resume downloading because
we don't use appsrc and its enough-data/need-data signals anymore.
So new heuristics are introduced with this patch. Downloading of
resources bigger than 2MiB might pause when the internal adapter
has enough data (2% of the full resource) and resume when the
adapter size goes below 20% of those 2%.

No new tests, the media element spec doesn't clearly mandate how
the resource loading should behave when the element is paused or
how aggressively the resource should be downloaded during
playback.

This patch was functionally tested with a 1.3GiB resource loaded
over the local network, the resource was downloaded in ~30MiB
chunks, stopping and resuming every 20 seconds, approximately.

platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:

(webkit_web_src_class_init):
(webKitWebSrcCreate):
(CachedResourceStreamingClient::responseReceived):
(CachedResourceStreamingClient::dataReceived):

8:24 PM Changeset in webkit [248256] by Michael Catanzaro

3 edits
1 add in releases/WebKitGTK/webkit-2.24

Merge r247778 - [GStreamer] Don't crash with empty video src
https://bugs.webkit.org/show_bug.cgi?id=200081

LayoutTests/imported/w3c:

Reviewed by Philippe Normand.

web-platform-tests/html/semantics/embedded-content/the-video-element/video_crash_empty_src.html: Added.

Source/WebCore:

When a <video> element is set to load empty or about:blank, a player is still
created, but no pipeline is loaded. This patch fixes some assertion errors that
manifested in that case.

Reviewed by Philippe Normand.

Test: imported/w3c/web-platform-tests/html/semantics/embedded-content/the-video-element/video_crash_empty_src.html

platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::loadFull):
(WebCore::MediaPlayerPrivateGStreamer::platformDuration const):
(WebCore::MediaPlayerPrivateGStreamer::paused const):

8:24 PM Changeset in webkit [248255] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/WebCore

Merge r247643 - [GStreamer] Flush get_range calls during PAUSED->READY in WebKitWebSource
https://bugs.webkit.org/show_bug.cgi?id=199934

Reviewed by Xabier Rodriguez-Calvar.

Unit testing not applicable.

platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:

(webKitWebSrcChangeState): A well-behaved element should unblock streaming threads
during a PAUSED->READY transition, so do that here.

8:24 PM Changeset in webkit [248254] by Michael Catanzaro

5 edits in releases/WebKitGTK/webkit-2.24

Merge r247533 - Web Inspector: application/xml content not shown
https://bugs.webkit.org/show_bug.cgi?id=199861

Patch by Olivier Blin <Olivier Blin> on 2019-07-17
Reviewed by Devin Rousso.

Source/WebInspectorUI:

application/xml content from XHR requests was not shown in the
inspector, an error message was displayed instead.

application/xml content should be treated as text, since
application/xml is the standard mimetype for XML content.
Apache serves XML content with the application/xml mimetype by
default.

UserInterface/Base/MIMETypeUtilities.js:

(WI.fileExtensionForMIMEType):
Report "xml" extension for "application/xml" mimetype.
(WI.shouldTreatMIMETypeAsText):
Treat XML files as text.

LayoutTests:

inspector/unit-tests/mimetype-utilities-expected.txt:
inspector/unit-tests/mimetype-utilities.html:

Test for shouldTreatMIMETypeAsText.

8:24 PM Changeset in webkit [248253] by Michael Catanzaro

6 edits in releases/WebKitGTK/webkit-2.24/Source/WebKit

Merge r247508 - [WPE][GTK] UI process crash due to NULL dereference in webkitWebViewResourceLoadStarted()
https://bugs.webkit.org/show_bug.cgi?id=199621

Reviewed by Michael Catanzaro.

Null-check frame received in injected bundle message to ensure the frame hasn't been destroyed.

UIProcess/API/glib/WebKitInjectedBundleClient.cpp:
UIProcess/API/glib/WebKitWebResource.cpp:

(webkitWebResourceCreate): Receive a reference to the frame instead of a pointer.

UIProcess/API/glib/WebKitWebResourcePrivate.h:
UIProcess/API/glib/WebKitWebView.cpp:

(webkitWebViewResourceLoadStarted): Ditto.

UIProcess/API/glib/WebKitWebViewPrivate.h:

8:24 PM Changeset in webkit [248252] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/WebKit

Merge r247507 - [GTK][WPE] Do not assert when receiving invalid data in injected bundle messages
https://bugs.webkit.org/show_bug.cgi?id=199830

Reviewed by Michael Catanzaro.

Just silently ignore them to avoid UI process crashes.

UIProcess/API/glib/WebKitInjectedBundleClient.cpp:

8:24 PM Changeset in webkit [248251] by Michael Catanzaro

3 edits in releases/WebKitGTK/webkit-2.24/Source/WebCore

Merge r247427 - [GTK] GitHub breaks on FreeBSD because of "unsupported browser"
https://bugs.webkit.org/show_bug.cgi?id=199745

Reviewed by Carlos Garcia Campos.

It's been a while since I last updated the fake version numbers in our user agent, both for
the user agent quirks for naughty websites and also the Safari version in our standard user
agent. Update them. This should fix github.com on FreeBSD at least. I also noticed some
wonkiness on Google Docs recently that I thought required this update, but I didn't do
anything about it at the time because I wasn't able to reproduce the issue when I tried
again later.

This could absolutely break websites, because the web is awful, but that's calculated risk.

platform/UserAgentQuirks.cpp:

(WebCore::UserAgentQuirks::stringForQuirk):

platform/glib/UserAgentGLib.cpp:

(WebCore::buildUserAgentString):

8:23 PM Changeset in webkit [248250] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/WebCore

Merge r247298 - [GStreamer] Protect against null samples and samples with null buffers
https://bugs.webkit.org/show_bug.cgi?id=199619

Reviewed by Philippe Normand.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

(WebCore::GstVideoFrameHolder::GstVideoFrameHolder): Assert to enforce non-null samples.
(WebCore::GstVideoFrameHolder::updateTexture): Protect against null m_buffer and improperly mapped video frame.

8:23 PM Changeset in webkit [248249] by Michael Catanzaro

3 edits
1 add in releases/WebKitGTK/webkit-2.24

Merge r247215 - REGRESSION(r243197): [GStreamer] Web process hangs when scrolling twitter timeline which contains HLS videos
https://bugs.webkit.org/show_bug.cgi?id=197558

Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

Not covered, I have a test locally that would probably trigger the
deadlock if the network requests took a realistic amount of time,
but from a local webserver the window of time to hit this deadlock
is too narrow.

platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:

(webkit_web_src_init): Make the websrc start asynchronously, this
allows the main thread to be free to complete resource loader
setup.
(webKitWebSrcCreate): Calling start() from the create() vfunc is a
recipe for deadlock, since BaseSrc holds the streaming lock during
seeks, and then calls create(). In these cases, we do not want to
notify async-completion, since we've already completed from the
necessarily preceeding start() vfunc, and calling it again would
require the stream-lock and deadlock us.
(webKitWebSrcStart): Refactor to use webKitWebSrcMakeRequest, but
ensuring that we do perform an async-complete notification.
(webKitWebSrcMakeRequest): What Start() used to be, but now can be
toggled when to notify of async-completion. Start() no longer
blocks, since the return value of initiating a resource loader is
of no interest to the callers.
(webKitWebSrcCloseSession): Similarly to Start(), we do not need
to wait for the completion of cancelled net requests.

Tools:

On shutdown we can easily deadlock the web process if we don't
ensure all network operations are completed before comitting state
changes. In HLS, make sure the network operations are cancelled,
and also prevent hlsdemux's retry logic from scuppering our
efforts.

gstreamer/jhbuild.modules: Include the patch.
gstreamer/patches/gst-plugins-bad-do-not-retry-downloads-during-shutdown.patch: Added.

8:23 PM Changeset in webkit [248248] by Michael Catanzaro

3 edits in releases/WebKitGTK/webkit-2.24/LayoutTests

Merge r247207 - [GStreamer] media/video-volume.html broken after switching from cubic to linear scaling
https://bugs.webkit.org/show_bug.cgi?id=199505

Reviewed by Xabier Rodriguez-Calvar.

PulseAudio has a conversion process from volume's in
double-precision to uint32_t volumes. Depending on the environment
can introduce rounding errors. Be more lenient in our comparison
code.

media/video-volume-expected.txt: Update baseline
media/video-volume.html: Compare volume values within a

reasonable tolerance.

8:23 PM Changeset in webkit [248247] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/WebCore

Merge r247204 - [GStreamer] The CREATE_TRACK macro is messed up
https://bugs.webkit.org/show_bug.cgi?id=199356

Reviewed by Xabier Rodriguez-Calvar.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::updateTracks): Fix the
CREATE_TRACK macro for !VIDEO_TRACK builds.

8:23 PM Changeset in webkit [248246] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/WebCore

Merge r247121 - The destructor of CSSAnimationControllerPrivate must explicitly clear the composite animations
https://bugs.webkit.org/show_bug.cgi?id=199415

Reviewed by Simon Fraser.

After the destructor of CSSAnimationControllerPrivate exists, the non
static members are deleted. When the HashMap m_compositeAnimations is
deleted, its entries are deleted. The destructor of CompositeAnimation
calls the method CSSAnimationControllerPrivate::animationWillBeRemoved()
back through its back reference m_animationController. The non static
members of CSSAnimationControllerPrivate are being deleted and it is
incorrect to try to use any of these members after exiting the destructor.

We need to explicitly clear the composite animations before exiting the
destructor of CSSAnimationControllerPrivate.

page/animation/CSSAnimationController.cpp:

(WebCore::CSSAnimationControllerPrivate::~CSSAnimationControllerPrivate):

8:23 PM Changeset in webkit [248245] by Michael Catanzaro

4 edits
4 adds in releases/WebKitGTK/webkit-2.24

Merge r247025 - It should not be possible to trigger a load while in the middle of restoring a page in PageCache
https://bugs.webkit.org/show_bug.cgi?id=199190
<rdar://problem/52114552>

Reviewed by Brady Eidson.

Source/WebCore:

Test: http/tests/security/navigate-when-restoring-cached-page.html

history/CachedFrame.cpp:

(WebCore::CachedFrame::open):
Stop attaching the cached document before calling FrameLoader::open() given that the previous document
is still attached to the frame at this point. This avoids having 2 documents attached to the same frame
during a short period of time.

loader/FrameLoader.cpp:

(WebCore::FrameLoader::open):
We now attach the cached document to the frame *after* calling FrameLoader::clear(), which means that
the previous document now has been detached from this frame.

(WebCore::FrameLoader::detachChildren):
As per the HTML specification [1], an attempt to navigate should fail if the prompt to unload algorithm
is being run for the active document of browsingContext. Note that the "prompt to unload" algorithm [2]
includes firing the 'unload' event in the current document and in all the documents in the subframes.
As a result, FrameLoader::detachChildren() is the right prevent such navigations. We were actually trying
to do this via the SubframeLoadingDisabler stack variable inside detachChildren(). The issue is that this
only prevents navigation in the subframes (i.e. <iframe> elements), not the main frame. As a result,
script would be able to navigate the top-frame even though detachChildren() is being called on the top
frame. To address the issue, I now create a NavigationDisabler variable in the scope of detachChildren()
when detachChildren() is called on the top frame. NavigationDisabler prevents all navigations within the
page, including navigations on the main/top frame.

[1] https://html.spec.whatwg.org/multipage/browsing-the-web.html#navigate
[2] https://html.spec.whatwg.org/multipage/browsing-the-web.html#prompt-to-unload-a-document

LayoutTests:

Add layout test coverage.

http/tests/security/navigate-when-restoring-cached-page-expected.txt: Added.
http/tests/security/navigate-when-restoring-cached-page.html: Added.
http/tests/security/resources/navigate-when-restoring-cached-page-frame.html: Added.
http/tests/security/resources/navigate-when-restoring-cached-page-victim.html: Added.

8:23 PM Changeset in webkit [248244] by Michael Catanzaro

6 edits in releases/WebKitGTK/webkit-2.24/Source/WebCore

Merge r247017 - More judiciously handle clearing/creation of DOMWindows for new Documents.
<rdar://problem/51665406> and https://bugs.webkit.org/show_bug.cgi?id=198786

Reviewed by Chris Dumez.

bindings/js/ScriptController.cpp:

(WebCore::ScriptController::executeIfJavaScriptURL):

loader/DocumentWriter.cpp:

(WebCore::DocumentWriter::replaceDocumentWithResultOfExecutingJavascriptURL): Rename for clarity.
(WebCore::DocumentWriter::begin): Handle DOMWindow taking/creation inside FrameLoader::clear via a lambda.
(WebCore::DocumentWriter::replaceDocument): Deleted.

loader/DocumentWriter.h:

loader/FrameLoader.cpp:

(WebCore::FrameLoader::clear): Take a "handleDOMWindowCreation" lambda to run after clearing the previous document.

loader/FrameLoader.h:

8:23 PM Changeset in webkit [248243] by Michael Catanzaro

3 edits
2 adds in releases/WebKitGTK/webkit-2.24

Merge r246868 - ReplacementFragment should not have script observable side effects
https://bugs.webkit.org/show_bug.cgi?id=199147

Reviewed by Wenson Hsieh.

Source/WebCore:

Fixed the bug that ReplacementFragment has script observable side effects.

Use a brand new document for sanitization where the script is disabled for test rendering,
and remove style and script elements as well as event handlers before the test rendering
and the actual pasting.

Test: editing/pasteboard/paste-contents-with-side-effects.html

editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplacementFragment::document): Deleted.
(WebCore::ReplacementFragment::ReplacementFragment): Use createPageForSanitizingWebContent
to create our own document for test rendering. We need to copy over the computed style
from the root editable element (editing host) to respect whitespace treatment, etc...
(WebCore::ReplacementFragment::removeContentsWithSideEffects): Moved from removeHeadContents.
Now removes event handlers and JavaScript URLs.
(WebCore::ReplacementFragment::insertFragmentForTestRendering): Renamed variable names.
(WebCore::ReplaceSelectionCommand::willApplyCommand): Create the plain text and HTML markup
for beforeinput and input events before ReplacementFragment removes contents with side effects.
(WebCore::ReplaceSelectionCommand::ensureReplacementFragment): The removal of head elements
is now done in ReplacementFragment's constructor.

LayoutTests:

Added regression tests.

editing/pasteboard/paste-contents-with-side-effects-expected.txt: Added.
editing/pasteboard/paste-contents-with-side-effects.html: Added.

8:23 PM Changeset in webkit [248242] by Michael Catanzaro

1 edit in releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog

Merge r246808 - Add didBecomePrototype() calls to global context prototypes
https://bugs.webkit.org/show_bug.cgi?id=199202

Reviewed by Mark Lam.

This fixes some crashes related to asserting that all prototypes
have been marked as such in JSC from
https://trac.webkit.org/changeset/246801. It's ok to call
didBecomePrototype here as we setting up the world state right now
so we won't be having a bad time.

We don't automatically call didBecomePrototype() for
setPrototypeWithoutTransition because existing objects may already
have this structure so it seems more reasonable to be explicit
there.

bindings/js/JSWindowProxy.cpp:

(WebCore::JSWindowProxy::setWindow):

bindings/js/WorkerScriptController.cpp:

(WebCore::WorkerScriptController::initScript):

worklets/WorkletScriptController.cpp:

(WebCore::WorkletScriptController::initScriptWithSubclass):

8:23 PM Changeset in webkit [248241] by Michael Catanzaro

4 edits in releases/WebKitGTK/webkit-2.24/Source/WebCore

Merge r246801 - Add didBecomePrototype() calls to global context prototypes
https://bugs.webkit.org/show_bug.cgi?id=199202

Reviewed by Mark Lam.

We don't automatically call didBecomePrototype() for
setPrototypeWithoutTransition because existing objects may already
have this structure so it seems more reasonable to be explicit
there.

bindings/js/JSWindowProxy.cpp:

(WebCore::JSWindowProxy::setWindow):

bindings/js/WorkerScriptController.cpp:

(WebCore::WorkerScriptController::initScript):

worklets/WorkletScriptController.cpp:

(WebCore::WorkletScriptController::initScriptWithSubclass):

8:23 PM Changeset in webkit [248240] by Michael Catanzaro

5 edits in releases/WebKitGTK/webkit-2.24/Source/JavaScriptCore

Merge r246801 - Structure::create should call didBecomePrototype()
https://bugs.webkit.org/show_bug.cgi?id=196315

Reviewed by Filip Pizlo.

Structure::create should also assert that the indexing type makes sense
for the prototype being used.

runtime/JSObject.h:
runtime/Structure.cpp:

(JSC::Structure::isValidPrototype):
(JSC::Structure::changePrototypeTransition):

runtime/Structure.h:

(JSC::Structure::create): Deleted.

runtime/StructureInlines.h:

(JSC::Structure::create):
(JSC::Structure::setPrototypeWithoutTransition):

8:23 PM Changeset in webkit [248239] by Michael Catanzaro

3 edits in releases/WebKitGTK/webkit-2.24/Source/JavaScriptCore

Merge r247426 - Concurrent GC should not rely on current phase to determine if it's safe to steal conn
https://bugs.webkit.org/show_bug.cgi?id=199786
<rdar://problem/52505197>

Reviewed by Saam Barati.

In r246507, we fixed a race condition in the concurrent GC where the mutator might steal
the conn from the collector thread while it transitions from the End phase to NotRunning.
However, that fix was not sufficient. In the case that the mutator steals the conn, and the
execution interleaves long enough for the mutator to progress to a different collection phase,
the collector will resume in a phase other than NotRunning, and hence the check added to
NotRunning will not suffice. To fix that, we add a new variable to track whether the collector
thread is running (m_collectorThreadIsRunning) and use it to determine whether it's safe to
steal the conn, rather than relying on m_currentPhase.

heap/Heap.cpp:

(JSC::Heap::runNotRunningPhase):
(JSC::Heap::requestCollection):

heap/Heap.h:

8:23 PM Changeset in webkit [248238] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/JavaScriptCore

Merge r246507 - Concurrent GC should check the conn before starting a new collection cycle
https://bugs.webkit.org/show_bug.cgi?id=198913
<rdar://problem/49515149>

Reviewed by Filip Pizlo.

Heap::requestCollection tries to steal the conn as an optimization to avoid waking up the collector
thread if it's idle. We determine if the collector is idle by ensuring that there are no pending collections
and that the current GC phase is NotRunning. However, that's not safe immediately after the concurrent
GC has finished processing the last pending request. The collector thread will runEndPhase and immediately
start runNotRunningPhase, without checking if it still has the conn. If the mutator has stolen the conn in
the mean time, this will lead to both threads collecting concurrently, and eventually we'll crash in checkConn,
since the collector is running but doesn't have the conn anymore.

To solve this, we check if we still have the conn after holding the lock in runNotRunningPhase, in case the mutator
has stolen the conn. Ideally, we wouldn't let the mutator steal the conn in the first place, but that doesn't seem
trivial to determine.

heap/Heap.cpp:

(JSC::Heap::runNotRunningPhase):

8:23 PM Changeset in webkit [248237] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24

Merge r246505 - [JSC] Introduce DisposableCallSiteIndex to enforce type-safety
https://bugs.webkit.org/show_bug.cgi?id=197378

Reviewed by Saam Barati.

JSTests:

stress/disposable-call-site-index-with-call-and-this.js: Added.

(foo):
(bar):

stress/disposable-call-site-index.js: Added.

(foo):
(bar):

Source/JavaScriptCore:

Some of CallSiteIndex are disposable. This is because some of CallSiteIndex are allocated and freed at runtime (not DFG/FTL compile time).
The example is CallSiteIndex for exception handler in GCAwareJITStubRoutineWithExceptionHandler. If we do not allocate and free CallSiteIndex,
we will create a new CallSiteIndex continuously and leak memory.

The other CallSiteIndex are not simply disposable because the ownership model is not unique one. They can be shared between multiple clients.
But not disposing them is OK because they are static one: they are allocated when compiling DFG/FTL, and we do not allocate such CallSiteIndex
at runtime.

To make this difference explicit and avoid disposing non-disposable CallSiteIndex accidentally, we introduce DisposableCallSiteIndex type, and
enforce type-safety to some degree.

We also correctly update the DisposableCallSiteIndex => CodeOrigin table when we are reusing the previously used DisposableCallSiteIndex.

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::newExceptionHandlingCallSiteIndex):
(JSC::CodeBlock::removeExceptionHandlerForCallSite):

bytecode/CodeBlock.h:
bytecode/PolymorphicAccess.cpp:

(JSC::AccessGenerationState::callSiteIndexForExceptionHandling):
(JSC::PolymorphicAccess::regenerate):

bytecode/PolymorphicAccess.h:

(JSC::AccessGenerationState::callSiteIndexForExceptionHandling): Deleted.

dfg/DFGCommonData.cpp:

(JSC::DFG::CommonData::addUniqueCallSiteIndex):
(JSC::DFG::CommonData::addDisposableCallSiteIndex):
(JSC::DFG::CommonData::removeDisposableCallSiteIndex):
(JSC::DFG::CommonData::removeCallSiteIndex): Deleted.

dfg/DFGCommonData.h:
interpreter/CallFrame.h:

(JSC::DisposableCallSiteIndex::DisposableCallSiteIndex):
(JSC::DisposableCallSiteIndex::fromCallSiteIndex):

jit/GCAwareJITStubRoutine.cpp:

(JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler):
(JSC::GCAwareJITStubRoutineWithExceptionHandler::observeZeroRefCount):
(JSC::createJITStubRoutine):

jit/GCAwareJITStubRoutine.h:
jit/JITInlineCacheGenerator.h:

8:23 PM Changeset in webkit [248236] by Michael Catanzaro

7 edits
4 adds in releases/WebKitGTK/webkit-2.24

Merge r246372 - [JSC] Polymorphic call stub's slow path should restore callee saves before performing tail call
https://bugs.webkit.org/show_bug.cgi?id=198770

Reviewed by Saam Barati.

JSTests:

stress/poly-call-stub-slow-path-should-restore-callee-saves-when-doing-tail-call.js: Added.

(test):

Source/JavaScriptCore:

Polymorphic call stub is a bit specially patched in JS call site. Typical JS call site for tail calls
are the following.

if (callee == patchableCallee) {

restore callee saves for tail call
prepare for tail call
jump to the target function

}
restore callee saves for slow path
call the slow path function

And linking patches patchableCallee, target function, and slow path function. But polymorphic call stub
patches the above if statement with the jump to the stub.

jump to the polymorphic call stub

This is because polymorphic call stub wants to use CallFrameShuffler to get scratch registers. As a result,
"restore callee saves for tail call" thing needs to be done in the polymorphic call stubs. While it is
correctly done for the major cases, we have slowPath skips, and that path missed restoring callee saves.
This skip happens if the callee is non JSCell or non JS function, so typically, InternalFunction is handled
in that path.

This patch does that skips after restoring callee saves.

bytecode/CallLinkInfo.cpp:

(JSC::CallLinkInfo::CallLinkInfo):

bytecode/CallLinkInfo.h:

(JSC::CallLinkInfo::setUpCall):
(JSC::CallLinkInfo::calleeGPR):
(JSC::CallLinkInfo::setCalleeGPR): Deleted.

jit/Repatch.cpp:

(JSC::revertCall):
(JSC::linkVirtualFor):
(JSC::linkPolymorphicCall):

jit/Repatch.h:
jit/ThunkGenerators.cpp:

(JSC::virtualThunkFor):

8:23 PM Changeset in webkit [248235] by Michael Catanzaro

3 edits
1 add in releases/WebKitGTK/webkit-2.24

Merge r246420 - Argument elimination should check transitive dependents for interference
https://bugs.webkit.org/show_bug.cgi?id=198520
<rdar://problem/50863343>

Reviewed by Filip Pizlo.

JSTests:

stress/argument-elimination-inline-rest-past-kill.js: Added.

(f2):
(f3):

Source/JavaScriptCore:

Consider the following program:

a: CreateRest
-->

b: CreateRest

<--
c: Spread(@a)
d: Spread(@b)
e: NewArrayWithSpread(@a, @b)
f: KillStack(locX)
g: LoadVarargs(@e)

Suppose @b reads locX, then we cannot transform @e to PhantomNewArraySpread, since that would
move the stack access from @b into @g, and that stack location is no longer valid at that point.

We fix that by computing a set of all inline call frames that any argument elimination candidate
depends on and checking each of them for interference in eliminateCandidatesThatInterfere.

dfg/DFGArgumentsEliminationPhase.cpp:

8:23 PM Changeset in webkit [248234] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24

Merge r246071 - Argument elimination should check for negative indices in GetByVal
https://bugs.webkit.org/show_bug.cgi?id=198302
<rdar://problem/51188095>

Reviewed by Filip Pizlo.

JSTests:

stress/eliminate-arguments-negative-rest-access.js: Added.

(inlinee):
(opt):

Source/JavaScriptCore:

In DFG::ArgumentEliminationPhase, the index is treated as unsigned, but there's no check
for overflow in the addition. In compileGetMyArgumentByVal, there's a check for overflow,
but the index is treated as signed, resulting in an index lower than numberOfArgumentsToSkip.

dfg/DFGArgumentsEliminationPhase.cpp:
ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):

8:23 PM Changeset in webkit [248233] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/JavaScriptCore

Merge r246084 - Unreviewed, update exception scope for putByIndexBeyondVectorLength
https://bugs.webkit.org/show_bug.cgi?id=198477

runtime/JSObject.cpp:

(JSC::JSObject::putByIndexBeyondVectorLength):

8:23 PM Changeset in webkit [248232] by Michael Catanzaro

4 edits
3 adds in releases/WebKitGTK/webkit-2.24

Merge r246040 - [JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect
https://bugs.webkit.org/show_bug.cgi?id=198477
<rdar://problem/51299504>

Reviewed by Saam Barati.

Source/JavaScriptCore:

JSObject::attemptToInterceptPutByIndexOnHole uses getPrototypeDirect, but it should use getPrototype to
handle getPrototype methods in derived JSObject classes correctly.

runtime/JSArrayInlines.h:

(JSC::JSArray::pushInline):

runtime/JSObject.cpp:

(JSC::JSObject::putByIndex):
(JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
(JSC::JSObject::attemptToInterceptPutByIndexOnHole):
(JSC::JSObject::putByIndexBeyondVectorLength):

LayoutTests:

Ensure that JSWindow::getPrototype is used.

http/tests/security/cross-frame-access-object-getPrototypeOf-in-put-expected.txt: Added.
http/tests/security/cross-frame-access-object-getPrototypeOf-in-put.html: Added.
http/tests/security/resources/cross-frame-iframe-for-object-getPrototypeOf-in-put-test.html: Added.

8:23 PM Changeset in webkit [248231] by Michael Catanzaro

8 edits
1 move
1 add in releases/WebKitGTK/webkit-2.24

Merge r245908 - IsoHeaps don't notice uncommitted VA becoming the first eligible.
https://bugs.webkit.org/show_bug.cgi?id=198301

Reviewed by Yusuke Suzuki.

Source/bmalloc:

IsoDirectory has a firstEligible member that is used as an
optimization to help find the first fit. However if the scavenger
decommitted a page before firstEligible then we wouldn't move
firstEligible. Thus, if no space is ever freed below firstEligible
we will never reused the decommitted memory (e.g. if the VA page
is decommitted). The fix is to make IsoDirectory::didDecommit move
the firstEligible page back if the decommitted page is smaller
than the current firstEligible. As such, this patch renames
firstEligible to firstEligibleOrDecommitted.

Also, this patch changes gigacageEnabledForProcess to check if the
process starts with Test rather than just test as TestWTF does.

Lastly, unbeknownst to me IsoHeaps are dependent on gigacage, so
by removing gigacage from arm64 I accidentally disabled
IsoHeaps...

bmalloc.xcodeproj/project.pbxproj:
bmalloc/IsoDirectory.h:
bmalloc/IsoDirectoryInlines.h:

(bmalloc::passedNumPages>::takeFirstEligible):
(bmalloc::passedNumPages>::didBecome):
(bmalloc::passedNumPages>::didDecommit):

bmalloc/IsoHeapImpl.h:
bmalloc/IsoHeapImplInlines.h:

(bmalloc::IsoHeapImpl<Config>::takeFirstEligible):
(bmalloc::IsoHeapImpl<Config>::didBecomeEligibleOrDecommited):
(bmalloc::IsoHeapImpl<Config>::didCommit):
(bmalloc::IsoHeapImpl<Config>::didBecomeEligible): Deleted.

bmalloc/IsoTLS.cpp:

(bmalloc::IsoTLS::determineMallocFallbackState):

bmalloc/ProcessCheck.mm:

(bmalloc::gigacageEnabledForProcess):

Tools:

Move testbmalloc.cpp to TestWTF so it runs in automation.

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WTF/bmalloc/IsoHeap.cpp: Renamed from Source/bmalloc/test/testbmalloc.cpp.

(TEST):

8:23 PM Changeset in webkit [248230] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/JavaScriptCore

Merge r246792 - REGRESSION(r245586): static assertion failed: Match result and EncodedMatchResult should be the same size
https://bugs.webkit.org/show_bug.cgi?id=198518

Reviewed by Keith Miller.

r245586 made some bad assumptions about the size of size_t, which we can solve using the
CPU(ADDRESS32) guard that I didn't know about.

This solution was developed by Mark Lam and Keith Miller. I'm just preparing the patch.

runtime/MatchResult.h:

8:23 PM Changeset in webkit [248229] by Michael Catanzaro

3 edits
1 add in releases/WebKitGTK/webkit-2.24

Merge r245815 - [YARR] Properly handle RegExp's that require large ParenContext space
https://bugs.webkit.org/show_bug.cgi?id=198065

Reviewed by Keith Miller.

JSTests:

New test.

stress/regexp-large-paren-context.js: Added.

(testLargeRegExp):

Source/JavaScriptCore:

Changed what happens when we exceed VM::patternContextBufferSize when compiling a RegExp
that needs ParenCOntextSpace to fail the RegExp JIT compilation and fall back to the YARR
interpreter. This can save large amounts of JIT memory for a
JIT'ed function that cannot ever succeed.

yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::initParenContextFreeList):
(JSC::Yarr::YarrGenerator::compile):

8:23 PM Changeset in webkit [248228] by Michael Catanzaro

7 edits
2 adds in releases/WebKitGTK/webkit-2.24

Merge r245926 - Cleanup Yarr regexp code around paren contexts.
https://bugs.webkit.org/show_bug.cgi?id=198063

Reviewed by Yusuke Suzuki.

JSTests:

stress/regexp-many-named-sequential-capture-groups.js: Added.

(i.s):

stress/regexp-many-unnamed-sequential-capture-groups.js: Added.

Source/JavaScriptCore:

There are three refactoring changes around paren contexts:

Make EncodedMatchResult the same type as MatchResult on X86_64 and arm64 and uint64_t elsewhere.
All function pointer types for Yarr JIT generated code reserve space for paren contexts.
initParenContextFreeList should bail based on VM::patternContextBufferSize as that's the buffer size anyway.

runtime/MatchResult.h:

(JSC::MatchResult::MatchResult):

runtime/RegExpInlines.h:

(JSC::PatternContextBufferHolder::PatternContextBufferHolder):
(JSC::PatternContextBufferHolder::~PatternContextBufferHolder):
(JSC::PatternContextBufferHolder::size):
(JSC::RegExp::matchInline):

runtime/VM.h:
yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::initParenContextFreeList):

yarr/YarrJIT.h:

(JSC::Yarr::YarrCodeBlock::execute):

8:22 PM Changeset in webkit [248227] by Michael Catanzaro

5 edits
2 adds in releases/WebKitGTK/webkit-2.24

Merge r245538 - Fix security check in ScriptController::canAccessFromCurrentOrigin()
https://bugs.webkit.org/show_bug.cgi?id=196730
<rdar://problem/49731231>

Reviewed by Ryosuke Niwa.

Source/WebCore:

Fix security check in ScriptController::canAccessFromCurrentOrigin() when there is no
current JS exec state. Instead of returning true unconditionally, we now fall back to
using the accessing document's origin for the security check. The new behavior is
aligned with Blink:
https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/html/html_frame_element_base.cc?rcl=d3f22423d512b45466f1694020e20da9e0c6ee6a&l=62

This fix is based on a patch from Sergei Glazunov <glazunov@google.com>.

Test: http/tests/security/showModalDialog-sync-cross-origin-page-load2.html

bindings/js/ScriptController.cpp:

(WebCore::ScriptController::canAccessFromCurrentOrigin):

bindings/js/ScriptController.h:
html/HTMLFrameElementBase.cpp:

(WebCore::HTMLFrameElementBase::isURLAllowed const):

LayoutTests:

Add layout test coverage.

http/tests/security/showModalDialog-sync-cross-origin-page-load2-expected.txt: Added.
http/tests/security/showModalDialog-sync-cross-origin-page-load2.html: Added.

8:22 PM Changeset in webkit [248226] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/WebKit

Merge r244970 - Null check m_mainFrame in WebPageProxy.cpp
https://bugs.webkit.org/show_bug.cgi?id=197618
<rdar://problem/47463054>

Patch by Alex Christensen <achristensen@webkit.org> on 2019-05-06
Reviewed by Geoffrey Garen.

It's already null checked in some places, and the places where it isn't are causing crashes.
Let's fix all of them.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::decidePolicyForNavigationAction):
(WebKit::WebPageProxy::decidePolicyForNewWindowAction):
(WebKit::WebPageProxy::createNewPage):

8:22 PM Changeset in webkit [248225] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/WebKit

Merge r245298 - Crash under WebKit::WebProcessProxy::didBecomeUnresponsive()
https://bugs.webkit.org/show_bug.cgi?id=197883
<rdar://problem/50665984>

Reviewed by Alex Christensen.

Protect |this| in didBecomeUnresponsive() and didExceedCPULimit() since we call client
delegates and those may cause |this| to get destroyed.

UIProcess/WebProcessProxy.cpp:

(WebKit::WebProcessProxy::didBecomeUnresponsive):
(WebKit::WebProcessProxy::didExceedCPULimit):

8:22 PM Changeset in webkit [248224] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/WebCore

Merge r245190 - Gracefully handle inaccessible font face data
https://bugs.webkit.org/show_bug.cgi?id=197762
<rdar://problem/50433861>

Reviewed by Per Arne Vollan.

Make sure CSS Font Face handling gracefully recovers from
missing font data.

Test: fast/text/missing-font-crash.html

css/CSSFontFace.cpp:

(WebCore::CSSFontFace::fontLoadEventOccurred):
(WebCore::CSSFontFace::timeoutFired):
(WebCore::CSSFontFace::fontLoaded):
(WebCore::CSSFontFace::font):

8:22 PM Changeset in webkit [248223] by Michael Catanzaro

4 edits
2 adds in releases/WebKitGTK/webkit-2.24

Merge r245158 - Do not mix inline and block level boxes.
https://bugs.webkit.org/show_bug.cgi?id=197462
<rdar://problem/50369362>

Reviewed by Antti Koivisto.

Source/WebCore:

This patch tightens the remove-anonymous-wrappers logic by checking if the removal would
produce an inline-block sibling mix.
When a block level box is removed from the tree, we check if after the removal the anonymous sibling block
boxes are still needed or whether we can removed them as well (and have only inline level child boxes).
In addition to checking if the container is anonymous and is part of a continuation, we also need to check
if collapsing it (and by that moving its children one level up) would cause a inline-block box mix.

Test: fast/ruby/continuation-and-column-spanner-crash.html

rendering/updating/RenderTreeBuilder.cpp:

(WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded):

rendering/updating/RenderTreeBuilderContinuation.cpp:

(WebCore::RenderTreeBuilder::Continuation::cleanupOnDestroy):

LayoutTests:

fast/ruby/continuation-and-column-spanner-crash-expected.txt: Added.
fast/ruby/continuation-and-column-spanner-crash.html: Added.

8:22 PM Changeset in webkit [248222] by Michael Catanzaro

3 edits
1 add in releases/WebKitGTK/webkit-2.24

Merge r245071 - Invalid DFG JIT genereation in high CPU usage state
https://bugs.webkit.org/show_bug.cgi?id=197453

Reviewed by Saam Barati.

JSTests:

stress/string-ident-use-clears-abstract-value-if-rope-string-constant-is-held.js: Added.

(trigger):
(main):

Source/JavaScriptCore:

We have a DFG graph like this.

a: JSConstant(rope JSString)
b: CheckStringIdent(Check:StringUse:@a)
... AI think this is unreachable ...

When executing StringUse edge filter onto @a, AbstractValue::filterValueByType clears AbstractValue and makes it None.
This is because @a constant produces SpecString (SpecStringVar | SpecStringIdent) while StringUse edge filter requires
SpecStringIdent. AbstractValue::filterValueByType has an assumption that the JS constant always produces the same
SpeculatedType. So it clears AbstractValue completely.
But this assumption is wrong. JSString can produce SpecStringIdent later if the string is resolved to AtomicStringImpl.
AI think that we always fail. But once the string is resolved to AtomicStringImpl, we pass this check. So we execute
the breakpoint emitted by DFG since DFG think this is unreachable.

In this patch, we just clear the m_value if AbstractValue type filter fails with the held constant, since the constant
may produce a narrower type which can meet the type filter later.

dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::filterValueByType):

8:22 PM Changeset in webkit [248221] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/JavaScriptCore/bytecompiler

Merge r245403 from safari-607-branch

This fixes the build after the r245047 merge.

bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitEqualityOpImpl):
(JSC::BytecodeGenerator::emitEqualityOp): Deleted.

bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::emitEqualityOp):

8:22 PM Changeset in webkit [248220] by Michael Catanzaro

4 edits
1 add in releases/WebKitGTK/webkit-2.24

Merge r245047 - JSC: A bug in BytecodeGenerator::emitEqualityOpImpl
https://bugs.webkit.org/show_bug.cgi?id=197479

Patch by Yusuke Suzuki <ysuzuki@apple.com> on 2019-05-07
Reviewed by Saam Barati.

JSTests:

stress/do-not-perform-bytecode-peephole-optimization-in-jump-target.js: Added.

(shouldBe):

Source/JavaScriptCore:

Our peephole optimization in BytecodeGenerator is (1) rewinding the previous instruction and (2) emit optimized instruction instead.
If we have jump target between the previous instruction and the subsequent instruction, this peephole optimization breaks the jump target.
To prevent it, we had a mechanism disabling peephole optimization, setting m_lastOpcodeID = op_end and checking m_lastOpcodeID when performing
peephole optimization. However, BytecodeGenerator::emitEqualityOpImpl checks m_lastInstruction->is<OpTypeof> instead of m_lastOpcodeID == op_typeof,
and miss op_end case.

This patch makes the following changes.

Add canDoPeepholeOptimization method to clarify the intent of m_lastInstruction = op_end.
Check canDoPeepholeOptimization status before performing peephole optimization in emitJumpIfTrue, emitJumpIfFalse, and emitEqualityOpImpl.
Add ASSERT(canDoPeepholeOptimization()) in fuseCompareAndJump and fuseTestAndJmp to ensure that peephole optimization is allowed.

bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::fuseCompareAndJump):
(JSC::BytecodeGenerator::fuseTestAndJmp):
(JSC::BytecodeGenerator::emitJumpIfTrue):
(JSC::BytecodeGenerator::emitJumpIfFalse):
(JSC::BytecodeGenerator::emitEqualityOpImpl):

bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::canDoPeepholeOptimization const):

8:22 PM Changeset in webkit [248219] by Michael Catanzaro

3 edits
6 adds in releases/WebKitGTK/webkit-2.24

Merge r245018 - tryCachePutByID should not crash if target offset changes
https://bugs.webkit.org/show_bug.cgi?id=197311
<rdar://problem/48033612>

Reviewed by Filip Pizlo.

JSTests:

Add a series of tests related tryCachePutByID. Two of these tests used to crash and were fixed
by this patch: cache-put-by-id-different-attributes.js and cache-put-by-id-different-offset.js

stress/cache-put-by-id-delete-prototype.js: Added.

(A.prototype.set y):
(A):
(B.prototype.set y):
(B):
(C):

stress/cache-put-by-id-different-proto.js: Added.

(A.prototype.set y):
(A):
(B1):
(B2.prototype.set y):
(B2):
(C):
(D):

stress/cache-put-by-id-different-attributes.js: Added.

(Foo):
(set x):

stress/cache-put-by-id-different-offset.js: Added.

(Foo):
(set x):

stress/cache-put-by-id-insert-prototype.js: Added.

(A.prototype.set y):
(A):
(C):

stress/cache-put-by-id-poly-proto.js: Added.

(Foo):
(set _):
(createBar.Bar):
(createBar):

Source/JavaScriptCore:

When tryCachePutID is called with a cacheable setter, if the target object where the setter was
found is still in the prototype chain and there's no poly protos in the chain, we use
generateConditionsForPrototypePropertyHit to validate that the target object remains the same.
It checks for the absence of the property in every object in the prototype chain from the base
down to the target object and checks that the property is still present in the target object. It
also bails if there are any uncacheable objects, proxies or dictionary objects in the prototype
chain. However, it does not consider two edge cases:

It asserts that the property should still be at the same offset in the target object, but this

assertion does not hold if the setter deletes properties of the object and causes the structure
to be flattened after the deletion. Instead of asserting, we just use the updated offset.

It does not check whether the new slot is also a setter, which leads to a crash in case it's not.

jit/Repatch.cpp:

(JSC::tryCachePutByID):

8:22 PM Changeset in webkit [248218] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24

Merge r244996 - [JSC] We should check OOM for description string of Symbol
https://bugs.webkit.org/show_bug.cgi?id=197634

Reviewed by Keith Miller.

JSTests:

stress/check-symbol-description-oom.js: Added.

(shouldThrow):

Source/JavaScriptCore:

When resoling JSString for description of Symbol, we should check OOM error.
We also change JSValueMakeSymbol(..., nullptr) to returning a symbol value
without description, (1) to simplify the code and (2) give a way for JSC API
to create a symbol value without description.

API/JSValueRef.cpp:

(JSValueMakeSymbol):

API/tests/testapi.cpp:

(TestAPI::symbolsTypeof):
(TestAPI::symbolsDescription):
(testCAPIViaCpp):

dfg/DFGOperations.cpp:
runtime/Symbol.cpp:

(JSC::Symbol::createWithDescription):

runtime/Symbol.h:
runtime/SymbolConstructor.cpp:

(JSC::callSymbol):

8:22 PM Changeset in webkit [248217] by Michael Catanzaro

3 edits in releases/WebKitGTK/webkit-2.24

Merge r244950 - TypedArrays should not store properties that are canonical numeric indices
https://bugs.webkit.org/show_bug.cgi?id=197228
<rdar://problem/49557381>

Patch by Tadeu Zagallo <Tadeu Zagallo> on 2019-05-04
Reviewed by Saam Barati.

JSTests:

stress/array-species-config-array-constructor.js:

(test):

stress/put-direct-index-broken-2.js:
stress/typed-array-canonical-numeric-index-string.js: Added.

(makeTest.assert):
(makeTest):
(const.testInvalidIndices.makeTest.set assert):
(const.testInvalidIndices.makeTest):
(const.makeTestValidIndex.configurable.set assert):
(const.makeTestValidIndex.configurable):

stress/typedarray-access-monomorphic-neutered.js:

(checkNoException):
(testNoException):
(testFTLNoException):

stress/typedarray-access-neutered.js:

(testNoException):

stress/typedarray-getownproperty-not-configurable.js:

(foo):

test262/expectations.yaml:

Source/JavaScriptCore:

According to the spec[1]:

TypedArrays should not perform an ordinary GetOwnProperty/SetOwnProperty if the index is a

CanonicalNumericIndexString, but invalid according to IntegerIndexedElementGet and similar
functions. I.e., there are a few properties that should not be set in a TypedArray, like NaN,
Infinity and -0.

On DefineOwnProperty, the out-of-bounds check should be performed before validating the property

descriptor.

On GetOwnProperty, the returned descriptor for numeric properties should have writable set to true.

[1]: https://www.ecma-international.org/ecma-262/9.0/index.html#sec-integer-indexed-exotic-objects-defineownproperty-p-desc

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
(JSC::JSGenericTypedArrayView<Adaptor>::put):
(JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
(JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex):
(JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):

runtime/PropertyName.h:

(JSC::isCanonicalNumericIndexString):

LayoutTests:

fast/canvas/canvas-ImageData-behaviour-expected.txt:
fast/canvas/canvas-ImageData-behaviour.js:

8:22 PM Changeset in webkit [248216] by Michael Catanzaro

4 edits
1 add in releases/WebKitGTK/webkit-2.24

Merge r243966 - [JSC] CallLinkInfo should clear Callee or CodeBlock even if it is unlinked by jettison
https://bugs.webkit.org/show_bug.cgi?id=196683

Reviewed by Saam Barati.

JSTests:

stress/clear-callee-or-codeblock-in-calllinkinfo-even-cleared-by-jettison.js: Added.

(foo):

Source/JavaScriptCore:

In r243626, we stop repatching CallLinkInfo when the CallLinkInfo is held by jettisoned CodeBlock.
But we still need to clear the Callee or CodeBlock since they are now dead. Otherwise, CodeBlock's
visitWeak eventually accesses this dead cells and crashes because the owner CodeBlock of CallLinkInfo
can be still live.

We also move all repatching operations from CallLinkInfo.cpp to Repatch.cpp for consistency because the
other repatching operations in CallLinkInfo are implemented in Repatch.cpp side.

bytecode/CallLinkInfo.cpp:

(JSC::CallLinkInfo::setCallee):
(JSC::CallLinkInfo::clearCallee):

jit/Repatch.cpp:

(JSC::linkFor):
(JSC::revertCall):

8:22 PM Changeset in webkit [248215] by Michael Catanzaro

6 edits
1 add in releases/WebKitGTK/webkit-2.24

Merge r243626 - CodeBlock::jettison() should disallow repatching its own calls
https://bugs.webkit.org/show_bug.cgi?id=196359
<rdar://problem/48973663>

Reviewed by Saam Barati.

JSTests:

stress/call-link-info-osrexit-repatch.js: Added.

(foo):

Source/JavaScriptCore:

CodeBlock::jettison() calls CommonData::invalidate, which replaces the hlt
instruction with the jump to OSR exit. However, if the hlt was immediately
followed by a call to the CodeBlock being jettisoned, we would write over the
OSR exit address while unlinking all the incoming CallLinkInfos later in
CodeBlock::jettison().

Change it so that we set a flag, clearedByJettison, in all the CallLinkInfos
owned by the CodeBlock being jettisoned. If the flag is set, we will avoid
repatching the call during unlinking. This is safe because this call will never
be reachable again after the CodeBlock is jettisoned.

bytecode/CallLinkInfo.cpp:

(JSC::CallLinkInfo::CallLinkInfo):
(JSC::CallLinkInfo::setCallee):
(JSC::CallLinkInfo::clearCallee):
(JSC::CallLinkInfo::setCodeBlock):
(JSC::CallLinkInfo::clearCodeBlock):

bytecode/CallLinkInfo.h:

(JSC::CallLinkInfo::clearedByJettison):
(JSC::CallLinkInfo::setClearedByJettison):

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::jettison):

jit/Repatch.cpp:

(JSC::revertCall):

8:22 PM Changeset in webkit [248214] by Michael Catanzaro

4 edits in releases/WebKitGTK/webkit-2.24/Source/JavaScriptCore

Merge r243237 - JSC test crash: stress/dont-strength-reduce-regexp-with-compile-error.js.default
https://bugs.webkit.org/show_bug.cgi?id=195906

Reviewed by Mark Lam.

The problem here as that we may successfully parsed a RegExp without running out of stack,
but later run out of stack when trying to JIT compile the same expression.

Added a check for available stack space when we call into one of the parenthesis compilation
functions that recurse. When we don't have enough stack space to recurse, we fail the JIT
compilation and let the interpreter handle the expression.

From code inspection of the YARR interpreter it has the same issue, but I couldn't cause a failure.
Filed a new bug and added a FIXME comment for the Interpreter to have similar checks.
Given that we can reproduce a failure, this is sufficient for now.

This change is covered by the previously added failing test,
JSTests/stress/dont-strength-reduce-regexp-with-compile-error.js.

yarr/YarrInterpreter.cpp:

(JSC::Yarr::Interpreter::interpret):

yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
(JSC::Yarr::YarrGenerator::opCompileParentheticalAssertion):
(JSC::Yarr::YarrGenerator::opCompileBody):
(JSC::Yarr::dumpCompileFailure):

yarr/YarrJIT.h:

8:22 PM Changeset in webkit [248213] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/JavaScriptCore

Merge r242215 - cloop.rb shift mask should depend on the word size being shifted.
https://bugs.webkit.org/show_bug.cgi?id=195181
<rdar://problem/48484164>

Reviewed by Yusuke Suzuki.

Previously, we're always masking the shift amount with 0x1f. This is only correct
for 32-bit words. For 64-bit words, the mask should be 0x3f. For pointer sized
shifts, the mask depends on sizeof(uintptr_t).

offlineasm/cloop.rb:

8:22 PM Changeset in webkit [248212] by Michael Catanzaro

1 edit in releases/WebKitGTK/webkit-2.24/Source/WebKit/Shared/WebCoreArgumentCoders.cpp

Unreviewed, fix build warning in WebCoreArgumentCoders

Shared/WebCoreArgumentCoders.cpp:

(IPC::ArgumentCoder<Region::Span>::decode):

8:22 PM Changeset in webkit [248211] by Michael Catanzaro

1 edit in releases/WebKitGTK/webkit-2.24/Source/WebCore/inspector/InspectorOverlay.cpp

Unreviewed, fix build warnings in InspectorOverlay.cpp

inspector/InspectorOverlay.cpp:

(WebCore::buildArrayForRendererFragments):
(WebCore::buildObjectForShapeOutside):
(WebCore::buildObjectForElementData):
(WebCore::InspectorOverlay::buildHighlightObjectForNode const):

8:22 PM Changeset in webkit [248210] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/JavaScriptCore

Merge r241995 - Unreviewed, fix -Wunused-param warning

jsc.cpp:

8:22 PM Changeset in webkit [248209] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/WTF

Merge r245234 - Unreviewed, fix unused variable warnings in release builds

Source/WebKit:

UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::clearWebProcessHasUploads):

Source/WTF:

wtf/URLHelpers.cpp:

(WTF::URLHelpers::escapeUnsafeCharacters):

8:22 PM Changeset in webkit [248208] by Michael Catanzaro

2 edits in releases/WebKitGTK/webkit-2.24/Source/WTF

Merge r243115 - [WTF] Remove redundant std::move in StringConcatenate
https://bugs.webkit.org/show_bug.cgi?id=195798

Patch by Xan Lopez <Xan Lopez> on 2019-03-18
Reviewed by Darin Adler.

Remove redundant calls to WTFMove in return values for this
method. C++ will already do an implicit move here since we are
returning a local value where copy/move elision is not applicable.

wtf/text/StringConcatenate.h:

(WTF::tryMakeStringFromAdapters):

8:22 PM Changeset in webkit [248207] by Michael Catanzaro

4 edits in releases/WebKitGTK/webkit-2.24/Source

Merge r243204 - Remove copyRef() calls added in r243163
https://bugs.webkit.org/show_bug.cgi?id=195962

Patch by Michael Catanzaro <Michael Catanzaro> on 2019-03-20
Reviewed by Chris Dumez.

Source/JavaScriptCore:

As best I can tell, may be a GCC 9 bug. It shouldn't warn about this case because the return
value is noncopyable and the WTFMove() is absolutely required. We can avoid the warning
without refcount churn by introducing an intermediate variable.

inspector/scripts/codegen/cpp_generator_templates.py:

Source/WebCore:

The first two cases here can just directly return the RefPtr.

In the third case, we have to work around a GCC 6 bug because GCC 6 is unable to pick the
right constructor to use, unlike modern compilers.

Modules/fetch/FetchBody.cpp:

(WebCore::FetchBody::bodyAsFormData const):
(WebCore::FetchBody::take):

8:22 PM Changeset in webkit [248206] by Michael Catanzaro

3 edits in releases/WebKitGTK/webkit-2.24/Source/WebKit

Merge r243203 - Unreviewed, drop invalid assertions landed in r243163.

Those assertions were causing some API tests to crash.
Also include some post-review suggestions from Darin.

Shared/CallbackID.h:

(WebKit::CallbackID::operator=):

Shared/OptionalCallbackID.h:

(WebKit::OptionalCallbackID::operator=):

8:22 PM Changeset in webkit [248205] by Michael Catanzaro

203 edits in releases/WebKitGTK/webkit-2.24/Source

Merge r243163 - Build cleanly with GCC 9
https://bugs.webkit.org/show_bug.cgi?id=195920

Reviewed by Chris Dumez.

WebKit triggers three new GCC 9 warnings:

"""
-Wdeprecated-copy, implied by -Wextra, warns about the C++11 deprecation of implicitly
declared copy constructor and assignment operator if one of them is user-provided.
"""

Solution is to either add a copy constructor or copy assignment operator, if required, or
else remove one if it is redundant.

"""
-Wredundant-move, implied by -Wextra, warns about redundant calls to std::move.
-Wpessimizing-move, implied by -Wall, warns when a call to std::move prevents copy elision.
"""

These account for most of this patch. Solution is to just remove the bad WTFMove().

Additionally, -Wclass-memaccess has been enhanced to catch a few cases that GCC 8 didn't.
These are solved by casting nontrivial types to void* before using memcpy. (Of course, it
would be safer to not use memcpy on nontrivial types, but that's too complex for this
patch. Searching for memcpy used with static_cast<void*> will reveal other cases to fix.)

Source/JavaScriptCore:

b3/B3ValueRep.h:
bindings/ScriptValue.cpp:

(Inspector::jsToInspectorValue):

bytecode/GetterSetterAccessCase.cpp:

(JSC::GetterSetterAccessCase::create):
(JSC::GetterSetterAccessCase::clone const):

bytecode/InstanceOfAccessCase.cpp:

(JSC::InstanceOfAccessCase::clone const):

bytecode/IntrinsicGetterAccessCase.cpp:

(JSC::IntrinsicGetterAccessCase::clone const):

bytecode/ModuleNamespaceAccessCase.cpp:

(JSC::ModuleNamespaceAccessCase::clone const):

bytecode/ProxyableAccessCase.cpp:

(JSC::ProxyableAccessCase::clone const):

bytecode/StructureSet.h:
debugger/Breakpoint.h:
dfg/DFGRegisteredStructureSet.h:
inspector/agents/InspectorDebuggerAgent.cpp:

(Inspector::buildDebuggerLocation):

inspector/scripts/codegen/cpp_generator_templates.py:
parser/UnlinkedSourceCode.h:
wasm/WasmAirIRGenerator.cpp:

(JSC::Wasm::parseAndCompileAir):

wasm/WasmB3IRGenerator.cpp:

(JSC::Wasm::parseAndCompile):

wasm/WasmNameSectionParser.cpp:

(JSC::Wasm::NameSectionParser::parse):

wasm/WasmStreamingParser.cpp:

(JSC::Wasm::StreamingParser::consume):

Source/WebCore:

Modules/encryptedmedia/CDM.cpp:

(WebCore::CDM::getSupportedConfiguration):

Modules/encryptedmedia/MediaKeys.cpp:

(WebCore::MediaKeys::createSession):

Modules/entriesapi/DOMFileSystem.cpp:

(WebCore::listDirectoryWithMetadata):
(WebCore::toFileSystemEntries):

Modules/fetch/FetchBody.cpp:

(WebCore::FetchBody::fromFormData):
(WebCore::FetchBody::bodyAsFormData const):
(WebCore::FetchBody::take):

Modules/fetch/FetchRequest.cpp:

(WebCore::FetchRequest::create):
(WebCore::FetchRequest::clone):

Modules/fetch/FetchResponse.cpp:

(WebCore::FetchResponse::create):
(WebCore::FetchResponse::redirect):
(WebCore::FetchResponse::clone):

Modules/indexeddb/IDBCursor.cpp:

(WebCore::IDBCursor::update):
(WebCore::IDBCursor::deleteFunction):

Modules/indexeddb/IDBDatabase.cpp:

(WebCore::IDBDatabase::transaction):

Modules/indexeddb/IDBDatabaseIdentifier.h:

(WebCore::IDBDatabaseIdentifier::decode):

Modules/indexeddb/IDBKeyData.h:

(WebCore::IDBKeyData::decode):

Modules/indexeddb/IDBObjectStore.cpp:

(WebCore::IDBObjectStore::createIndex):
(WebCore::IDBObjectStore::index):

Modules/indexeddb/IDBValue.h:

(WebCore::IDBValue::decode):

Modules/indexeddb/shared/IDBError.cpp:

(WebCore::IDBError::operator=): Deleted.

Modules/indexeddb/shared/IDBError.h:
Modules/indexeddb/shared/IDBResultData.h:

(WebCore::IDBResultData::decode):

Modules/mediarecorder/MediaRecorder.cpp:

(WebCore::MediaRecorder::create):

Modules/mediasource/MediaSource.cpp:

(WebCore::MediaSource::addSourceBuffer):

Modules/mediastream/RTCPeerConnection.cpp:

(WebCore::iceServersFromConfiguration):
(WebCore::RTCPeerConnection::certificatesFromConfiguration):
(WebCore::certificateTypeFromAlgorithmIdentifier):

Modules/mediastream/libwebrtc/LibWebRTCMediaEndpoint.cpp:

(WebCore::LibWebRTCMediaEndpoint::getStats):

Modules/mediastream/libwebrtc/LibWebRTCPeerConnectionBackend.cpp:

(WebCore::LibWebRTCPeerConnectionBackend::addTrack):
(WebCore::LibWebRTCPeerConnectionBackend::addUnifiedPlanTransceiver):

Modules/webaudio/AudioBuffer.cpp:

(WebCore::AudioBuffer::create):

Modules/webaudio/AudioContext.cpp:

(WebCore::AudioContext::createMediaElementSource):
(WebCore::AudioContext::createMediaStreamSource):
(WebCore::AudioContext::createScriptProcessor):

Modules/webaudio/OfflineAudioContext.cpp:

(WebCore::OfflineAudioContext::create):

Modules/webdatabase/DatabaseManager.cpp:

(WebCore::DatabaseManager::tryToOpenDatabaseBackend):

Modules/webdatabase/DatabaseTracker.cpp:

(WebCore::DatabaseTracker::canEstablishDatabase):
(WebCore::DatabaseTracker::retryCanEstablishDatabase):

Modules/webdatabase/SQLResultSetRowList.cpp:

(WebCore::SQLResultSetRowList::item const):

Modules/websockets/WebSocket.cpp:

(WebCore::WebSocket::create):

accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::rangeForNodeContents):
(WebCore::AXObjectCache::rangeForUnorderedCharacterOffsets):

animation/KeyframeEffect.cpp:

(WebCore::KeyframeEffect::create):
(WebCore::KeyframeEffect::backingAnimationForCompositedRenderer const):

bindings/js/JSCustomElementInterface.cpp:

(WebCore::JSCustomElementInterface::constructElementWithFallback):

bindings/js/JSDOMConvertVariadic.h:

(WebCore::VariadicConverter::convert):
(WebCore::convertVariadicArguments):

bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneDeserializer::readDOMPointInit):
(WebCore::transferArrayBuffers):

bindings/scripts/CodeGeneratorJS.pm:

(GenerateCallbackImplementationContent):

bindings/scripts/test/JS/JSTestCallbackFunction.cpp:

(WebCore::JSTestCallbackFunction::handleEvent):

bindings/scripts/test/JS/JSTestCallbackFunctionRethrow.cpp:

(WebCore::JSTestCallbackFunctionRethrow::handleEvent):

bindings/scripts/test/JS/JSTestCallbackInterface.cpp:

(WebCore::JSTestCallbackInterface::callbackWithAReturnValue):
(WebCore::JSTestCallbackInterface::callbackThatRethrowsExceptions):
(WebCore::JSTestCallbackInterface::callbackThatSkipsInvokeCheck):
(WebCore::JSTestCallbackInterface::callbackWithThisObject):

contentextensions/ContentExtensionParser.cpp:

(WebCore::ContentExtensions::getStringList):
(WebCore::ContentExtensions::loadTrigger):
(WebCore::ContentExtensions::loadEncodedRules):
(WebCore::ContentExtensions::parseRuleList):

crypto/SubtleCrypto.cpp:

(WebCore::normalizeCryptoAlgorithmParameters):

crypto/gcrypt/CryptoAlgorithmHMACGCrypt.cpp:

(WebCore::calculateSignature):

crypto/keys/CryptoKeyEC.cpp:

(WebCore::CryptoKeyEC::exportJwk const):

css/CSSComputedStyleDeclaration.cpp:

(WebCore::computedTransform):
(WebCore::ComputedStyleExtractor::valueForShadow):
(WebCore::ComputedStyleExtractor::valueForFilter):
(WebCore::specifiedValueForGridTrackSize):
(WebCore::valueForGridTrackList):
(WebCore::valueForGridPosition):
(WebCore::willChangePropertyValue):
(WebCore::fontVariantLigaturesPropertyValue):
(WebCore::fontVariantNumericPropertyValue):
(WebCore::fontVariantEastAsianPropertyValue):
(WebCore::touchActionFlagsToCSSValue):
(WebCore::renderTextDecorationFlagsToCSSValue):
(WebCore::renderEmphasisPositionFlagsToCSSValue):
(WebCore::speakAsToCSSValue):
(WebCore::hangingPunctuationToCSSValue):
(WebCore::fillRepeatToCSSValue):
(WebCore::fillSizeToCSSValue):
(WebCore::counterToCSSValue):
(WebCore::fontVariantFromStyle):
(WebCore::fontSynthesisFromStyle):
(WebCore::shapePropertyValue):
(WebCore::paintOrder):
(WebCore::ComputedStyleExtractor::valueForPropertyinStyle):
(WebCore::ComputedStyleExtractor::getCSSPropertyValuesFor2SidesShorthand):
(WebCore::ComputedStyleExtractor::getCSSPropertyValuesFor4SidesShorthand):

css/CSSFontFaceSet.cpp:

(WebCore::CSSFontFaceSet::matchingFacesExcludingPreinstalledFonts):

css/CSSGradientValue.cpp:

(WebCore::CSSGradientValue::image):

css/CSSStyleSheet.cpp:

(WebCore::CSSStyleSheet::rules):

css/DOMMatrixReadOnly.cpp:

(WebCore::DOMMatrixReadOnly::parseStringIntoAbstractMatrix):

css/FontFace.cpp:

(WebCore::FontFace::create):

css/FontVariantBuilder.cpp:

(WebCore::computeFontVariant):

css/PropertySetCSSStyleDeclaration.cpp:

(WebCore::PropertySetCSSStyleDeclaration::removeProperty):

css/SVGCSSComputedStyleDeclaration.cpp:

(WebCore::strokeDashArrayToCSSValueList):
(WebCore::ComputedStyleExtractor::adjustSVGPaintForCurrentColor const):

css/StyleBuilderConverter.h:

(WebCore::StyleBuilderConverter::convertReflection):

css/WebKitCSSMatrix.cpp:

(WebCore::WebKitCSSMatrix::create):
(WebCore::WebKitCSSMatrix::multiply const):

css/parser/CSSPropertyParser.cpp:

(WebCore::consumeFontVariationSettings):
(WebCore::consumeBasicShapePath):
(WebCore::consumeImplicitGridAutoFlow):

cssjit/StackAllocator.h:
dom/DOMImplementation.cpp:

(WebCore::DOMImplementation::createDocument):

dom/Document.cpp:

(WebCore::Document::cloneNodeInternal):

dom/DocumentFragment.cpp:

(WebCore::DocumentFragment::cloneNodeInternal):

dom/Element.cpp:

(WebCore::Element::setAttributeNode):
(WebCore::Element::setAttributeNodeNS):
(WebCore::Element::removeAttributeNode):
(WebCore::Element::parseAttributeName):
(WebCore::Element::animate):

dom/MessagePort.cpp:

(WebCore::MessagePort::disentanglePorts):

dom/NodeIterator.cpp:

(WebCore::NodeIterator::nextNode):
(WebCore::NodeIterator::previousNode):

dom/Range.cpp:

(WebCore::Range::processContents):
(WebCore::processContentsBetweenOffsets):
(WebCore::processAncestorsAndTheirSiblings):

dom/RangeBoundaryPoint.h:
dom/ScriptDisallowedScope.h:

(WebCore::ScriptDisallowedScope::operator=):

dom/Text.cpp:

(WebCore::Text::splitText):

dom/TextDecoder.cpp:

(WebCore::TextDecoder::create):
(WebCore::TextDecoder::decode):

editing/CompositeEditCommand.cpp:

(WebCore::CompositeEditCommand::insertBlockPlaceholder):
(WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary):

editing/Editing.cpp:

(WebCore::createTabSpanElement):

editing/EditingStyle.cpp:

(WebCore::EditingStyle::styleAtSelectionStart):

editing/TextIterator.cpp:

(WebCore::TextIterator::rangeFromLocationAndLength):

editing/VisibleSelection.cpp:

(WebCore::makeSearchRange):

editing/markup.cpp:

(WebCore::styleFromMatchedRulesAndInlineDecl):
(WebCore::createFragmentForInnerOuterHTML):
(WebCore::createContextualFragment):

html/FormController.cpp:

(WebCore::deserializeFormControlState):

html/HTMLCanvasElement.cpp:

(WebCore::HTMLCanvasElement::captureStream):

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::mediaPlayerCreateResourceLoader):

html/HTMLOptionElement.cpp:

(WebCore::HTMLOptionElement::createForJSConstructor):

html/HTMLPlugInImageElement.cpp:

(WebCore::HTMLPlugInImageElement::createElementRenderer):

html/HTMLTableElement.cpp:

(WebCore::HTMLTableElement::createSharedCellStyle):

html/HTMLTableRowElement.cpp:

(WebCore::HTMLTableRowElement::insertCell):

html/ImageData.cpp:

(WebCore::ImageData::create):

html/OffscreenCanvas.cpp:

(WebCore::OffscreenCanvas::transferToImageBitmap):

html/canvas/CanvasRenderingContext2DBase.cpp:

(WebCore::CanvasRenderingContext2DBase::createLinearGradient):
(WebCore::CanvasRenderingContext2DBase::createRadialGradient):

html/canvas/OESVertexArrayObject.cpp:

(WebCore::OESVertexArrayObject::createVertexArrayOES):

html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::WebGLRenderingContextBase::createBuffer):
(WebCore::WebGLRenderingContextBase::createFramebuffer):
(WebCore::WebGLRenderingContextBase::createTexture):
(WebCore::WebGLRenderingContextBase::createProgram):
(WebCore::WebGLRenderingContextBase::createRenderbuffer):
(WebCore::WebGLRenderingContextBase::createShader):
(WebCore::WebGLRenderingContextBase::getContextAttributes):
(WebCore::WebGLRenderingContextBase::getUniform):

html/shadow/TextControlInnerElements.cpp:

(WebCore::TextControlInnerContainer::resolveCustomStyle):
(WebCore::TextControlPlaceholderElement::resolveCustomStyle):

html/track/BufferedLineReader.cpp:

(WebCore::BufferedLineReader::nextLine):

html/track/VTTCue.cpp:

(WebCore::VTTCue::getCueAsHTML):
(WebCore::VTTCue::createCueRenderingTree):

html/track/WebVTTElement.cpp:

(WebCore::WebVTTElement::cloneElementWithoutAttributesAndChildren):

inspector/InspectorStyleSheet.cpp:

(WebCore::asCSSRuleList):
(WebCore::InspectorStyle::buildObjectForStyle const):
(WebCore::InspectorStyleSheet::buildObjectForStyleSheet):
(WebCore::InspectorStyleSheet::buildObjectForRule):

inspector/agents/InspectorCSSAgent.cpp:

(WebCore::InspectorCSSAgent::buildArrayForMatchedRuleList):

inspector/agents/InspectorDOMAgent.cpp:

(WebCore::InspectorDOMAgent::buildArrayForPseudoElements):
(WebCore::InspectorDOMAgent::buildObjectForAccessibilityProperties):

inspector/agents/InspectorNetworkAgent.cpp:

(WebCore::InspectorNetworkAgent::buildObjectForResourceResponse):

loader/FetchOptions.h:

(WebCore::FetchOptions::decode):

loader/MediaResourceLoader.cpp:

(WebCore::MediaResourceLoader::requestResource):

loader/appcache/ApplicationCacheStorage.cpp:

(WebCore::ApplicationCacheStorage::loadCache):
(WebCore::ApplicationCacheStorage::manifestURLs):

loader/archive/mhtml/MHTMLParser.cpp:

(WebCore::MHTMLParser::parseArchiveWithHeader):

loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::requestResource):

page/DOMWindow.cpp:

(WebCore::DOMWindow::getMatchedCSSRules const):

page/DragController.cpp:

(WebCore::documentFragmentFromDragData):

page/EventSource.cpp:

(WebCore::EventSource::create):

page/PerformanceUserTiming.cpp:

(WebCore::UserTiming::mark):
(WebCore::UserTiming::measure):

page/SecurityOrigin.h:

(WebCore::SecurityOrigin::decode):

page/scrolling/ScrollingConstraints.h:

(WebCore::FixedPositionViewportConstraints::FixedPositionViewportConstraints):
(WebCore::LayoutConstraints::LayoutConstraints): Deleted.

platform/Length.h:

(WebCore::Length::Length):

platform/animation/TimingFunction.cpp:

(WebCore::TimingFunction::createFromCSSText):

platform/encryptedmedia/clearkey/CDMClearKey.cpp:

(WebCore::parseLicenseFormat):

platform/graphics/FloatPoint3D.h:
platform/graphics/Font.cpp:

(WebCore::createAndFillGlyphPage):

platform/graphics/GLContext.cpp:

(WebCore::GLContext::createContextForWindow):
(WebCore::GLContext::createSharingContext):

platform/graphics/GraphicsContext.cpp:
platform/graphics/HEVCUtilities.cpp:

(WebCore::parseHEVCCodecParameters):

platform/graphics/gtk/ImageGtk.cpp:

(WebCore::loadImageFromGResource):
(WebCore::loadMissingImageIconFromTheme):

platform/graphics/wayland/PlatformDisplayWayland.cpp:

(WebCore::PlatformDisplayWayland::create):

platform/mediastream/MediaConstraints.h:

(WebCore::MediaTrackConstraintSetMap::decode):

platform/mediastream/MediaStreamRequest.h:

(WebCore::MediaStreamRequest::decode):

platform/mediastream/gstreamer/GStreamerVideoFrameLibWebRTC.cpp:

(WebCore::GStreamerSampleFromLibWebRTCVideoFrame):

platform/mediastream/gstreamer/RealtimeIncomingAudioSourceLibWebRTC.cpp:

(WebCore::RealtimeIncomingAudioSource::create):

platform/mediastream/gstreamer/RealtimeIncomingVideoSourceLibWebRTC.cpp:

(WebCore::RealtimeIncomingVideoSource::create):

platform/mock/MockRealtimeMediaSourceCenter.cpp:

(WebCore::MockRealtimeMediaSourceCenter::captureDeviceWithPersistentID):

platform/mock/mediasource/MockSourceBufferPrivate.cpp:

(WebCore::MockMediaSample::createNonDisplayingCopy const):

platform/network/BlobRegistryImpl.cpp:

(WebCore::BlobRegistryImpl::createResourceHandle):

platform/network/CookieRequestHeaderFieldProxy.h:

(WebCore::CookieRequestHeaderFieldProxy::decode):

platform/network/FormData.h:

(WebCore::FormData::decode):

platform/network/MIMEHeader.cpp:

(WebCore::MIMEHeader::parseHeader):

platform/network/ResourceHandle.cpp:

(WebCore::ResourceHandle::create):

platform/network/soup/DNSResolveQueueSoup.cpp:

(WebCore::DNSResolveQueueSoup::takeCompletionAndCancelHandlers):

rendering/RenderElement.cpp:

(WebCore::RenderElement::createFor):

rendering/shapes/Shape.cpp:

(WebCore::Shape::createRasterShape):
(WebCore::Shape::createBoxShape):

rendering/style/BasicShapes.cpp:

(WebCore::BasicShapeCircle::blend const):
(WebCore::BasicShapeEllipse::blend const):
(WebCore::BasicShapePolygon::blend const):
(WebCore::BasicShapePath::blend const):
(WebCore::BasicShapeInset::blend const):

rendering/style/BasicShapes.h:

(WebCore::BasicShapeRadius::BasicShapeRadius):

rendering/style/ContentData.cpp:

(WebCore::ImageContentData::createContentRenderer const):
(WebCore::TextContentData::createContentRenderer const):
(WebCore::QuoteContentData::createContentRenderer const):

rendering/style/ContentData.h:
rendering/svg/RenderSVGInline.cpp:

(WebCore::RenderSVGInline::createInlineFlowBox):

rendering/svg/RenderSVGInlineText.cpp:

(WebCore::RenderSVGInlineText::createTextBox):

rendering/svg/RenderSVGText.cpp:

(WebCore::RenderSVGText::createRootInlineBox):

svg/SVGFEBlendElement.cpp:

(WebCore::SVGFEBlendElement::build):

svg/SVGFEColorMatrixElement.cpp:

(WebCore::SVGFEColorMatrixElement::build):

svg/SVGFEComponentTransferElement.cpp:

(WebCore::SVGFEComponentTransferElement::build):

svg/SVGFECompositeElement.cpp:

(WebCore::SVGFECompositeElement::build):

svg/SVGFEConvolveMatrixElement.cpp:

(WebCore::SVGFEConvolveMatrixElement::build):

svg/SVGFEDiffuseLightingElement.cpp:

(WebCore::SVGFEDiffuseLightingElement::build):

svg/SVGFEDisplacementMapElement.cpp:

(WebCore::SVGFEDisplacementMapElement::build):

svg/SVGFEDropShadowElement.cpp:

(WebCore::SVGFEDropShadowElement::build):

svg/SVGFEGaussianBlurElement.cpp:

(WebCore::SVGFEGaussianBlurElement::build):

svg/SVGFEMergeElement.cpp:

(WebCore::SVGFEMergeElement::build):

svg/SVGFEMorphologyElement.cpp:

(WebCore::SVGFEMorphologyElement::build):

svg/SVGFEOffsetElement.cpp:

(WebCore::SVGFEOffsetElement::build):

svg/SVGFESpecularLightingElement.cpp:

(WebCore::SVGFESpecularLightingElement::build):

svg/SVGFETileElement.cpp:

(WebCore::SVGFETileElement::build):

svg/SVGTransformList.h:
svg/properties/SVGList.h:

(WebCore::SVGList::initialize):
(WebCore::SVGList::insertItemBefore):
(WebCore::SVGList::replaceItem):
(WebCore::SVGList::removeItem):
(WebCore::SVGList::appendItem):

svg/properties/SVGListProperty.h:

(WebCore::SVGListProperty::initializeValuesAndWrappers):
(WebCore::SVGListProperty::insertItemBeforeValuesAndWrappers):
(WebCore::SVGListProperty::replaceItemValuesAndWrappers):
(WebCore::SVGListProperty::removeItemValues):
(WebCore::SVGListProperty::appendItemValuesAndWrappers):

svg/properties/SVGPrimitiveList.h:
testing/Internals.cpp:

(WebCore::Internals::elementRenderTreeAsText):
(WebCore::parseFindOptions):

workers/AbstractWorker.cpp:

(WebCore::AbstractWorker::resolveURL):

workers/Worker.cpp:

(WebCore::Worker::create):

workers/service/ServiceWorkerJobData.h:

(WebCore::ServiceWorkerJobData::decode):

xml/DOMParser.cpp:

(WebCore::DOMParser::parseFromString):

xml/XPathExpression.cpp:

(WebCore::XPathExpression::evaluate):

Source/WebKit:

NetworkProcess/cache/CacheStorageEngineCache.cpp:

(WebKit::CacheStorage::Cache::decode):

Platform/IPC/ArgumentCoders.h:
Shared/CallbackID.h:

(WebKit::CallbackID::operator=):

Shared/OptionalCallbackID.h:

(WebKit::OptionalCallbackID::operator=):

Shared/Plugins/NPIdentifierData.cpp:

(WebKit::NPIdentifierData::decode):

Shared/Plugins/NPVariantData.cpp:

(WebKit::NPVariantData::decode):

Shared/Plugins/Netscape/NetscapePluginModule.cpp:

(WebKit::NetscapePluginModule::getOrCreate):

Shared/RTCNetwork.cpp:

(WebKit::RTCNetwork::IPAddress::decode):

Shared/SessionState.cpp:

(WebKit::HTTPBody::Element::decode):
(WebKit::FrameState::decode):
(WebKit::BackForwardListItemState::decode):

Shared/WebCompiledContentRuleListData.cpp:

(WebKit::WebCompiledContentRuleListData::decode):

Shared/WebCoreArgumentCoders.cpp:

(IPC::ArgumentCoder<FloatPoint>::decode):
(IPC::ArgumentCoder<FloatRect>::decode):
(IPC::ArgumentCoder<FloatQuad>::decode):
(IPC::ArgumentCoder<ViewportArguments>::decode):
(IPC::ArgumentCoder<IntPoint>::decode):
(IPC::ArgumentCoder<IntRect>::decode):
(IPC::ArgumentCoder<IntSize>::decode):
(IPC::ArgumentCoder<MimeClassInfo>::decode):
(IPC::ArgumentCoder<PluginInfo>::decode):
(IPC::ArgumentCoder<SelectionRect>::decode):
(IPC::ArgumentCoder<CompositionUnderline>::decode):
(IPC::ArgumentCoder<BlobPart>::decode):
(IPC::ArgumentCoder<TextIndicatorData>::decode):
(IPC::ArgumentCoder<ResourceLoadStatistics>::decode):
(IPC::ArgumentCoder<ScrollOffsetRange<float>>::decode):

Shared/WebPageCreationParameters.cpp:

(WebKit::WebPageCreationParameters::decode):

Shared/WebPlatformTouchPoint.cpp:

(WebKit::WebPlatformTouchPoint::decode):

Shared/WebsiteData/WebsiteData.cpp:

(WebKit::WebsiteData::Entry::decode):

Shared/WebsiteDataStoreParameters.cpp:

(WebKit::WebsiteDataStoreParameters::decode):

UIProcess/API/APIContentRuleListStore.cpp:

(API::decodeContentRuleListMetaData):

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::launchProcessForReload):
(WebKit::WebPageProxy::launchProcessWithItem):
(WebKit::WebPageProxy::loadRequest):
(WebKit::WebPageProxy::loadFile):
(WebKit::WebPageProxy::loadData):
(WebKit::WebPageProxy::reload):

UIProcess/WebProcessCache.cpp:

(WebKit::WebProcessCache::takeProcess):

UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::findReusableSuspendedPageProcess):

WebProcess/InjectedBundle/DOM/InjectedBundleCSSStyleDeclarationHandle.cpp:

(WebKit::InjectedBundleCSSStyleDeclarationHandle::getOrCreate):

WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp:

(WebKit::InjectedBundleRangeHandle::getOrCreate):

WebProcess/InjectedBundle/InjectedBundle.cpp:

(WebKit::InjectedBundle::create):

WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::WebLoaderStrategy::tryLoadingSynchronouslyUsingURLSchemeHandler):

WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.cpp:

(WebKit::CompositingCoordinator::createGraphicsLayer):

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::pdfSnapshotAtSize):
(WebKit::WebPage::createDocumentLoader):

WebProcess/WebStorage/StorageNamespaceImpl.cpp:

(WebKit::StorageNamespaceImpl::copy):

Source/WTF:

wtf/CheckedArithmetic.h:

(WTF::Checked::Checked):

wtf/MetaAllocator.cpp:

(WTF::MetaAllocator::allocate):

wtf/URLParser.cpp:

(WTF::CodePointIterator::operator!= const):
(WTF::CodePointIterator::operator=): Deleted.

wtf/text/StringView.h:

(WTF::StringView::CodePoints::Iterator::operator=): Deleted.

7:02 PM WebKitGTK/2.24.x edited by Michael Catanzaro

(diff)

4:14 PM Changeset in webkit [248204] by Devin Rousso

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Elements: Styles: move psuedo-selector rules before inherited rules
https://bugs.webkit.org/show_bug.cgi?id=199950

Reviewed by Joseph Pecoraro.

Since pseudo-selector rules (usually) affect the selected element, or are related to its
content, it's more useful to have them near that element's rules instead of after all of
it's inherited rules.

UserInterface/Views/SpreadsheetRulesStyleDetailsPanel.js:

(WI.SpreadsheetRulesStyleDetailsPanel.prototype.layout):

1:32 PM Changeset in webkit [248203] by Konstantin Tokarev

2 edits in trunk/Source/WebKit

Fix compilation with disabled WebGL
https://bugs.webkit.org/show_bug.cgi?id=200421

Reviewed by Wenson Hsieh.

After r247452 webGLStateTracker is guarded with #if ENABLE(WEBGL)

WebProcess/WebPage/WebPage.cpp:

(WebKit::m_textAutoSizingAdjustmentTimer):

12:36 PM Changeset in webkit [248202] by Devin Rousso

14 edits
1 copy
5 adds in trunk

Web Inspector: Elements: Styles: add icons for various CSS rule types
https://bugs.webkit.org/show_bug.cgi?id=199946

Reviewed by Joseph Pecoraro.

Source/WebInspectorUI:

UserInterface/Controllers/CSSManager.js:

(WI.CSSManager.displayNameForPseudoId):
Add hardcoded pseudo-selector identifiers for older backends.

UserInterface/Models/CSSSelector.js:

(WI.CSSSelector.prototype.isPseudoSelector): Added.
(WI.CSSSelector.prototype.isPseudoElementSelector): Deleted.
There are more types of pseudo-selectors than just :{before|after}.

UserInterface/Models/CSSStyleDeclaration.js:

(WI.CSSStyleDeclaration.prototype.generateCSSRuleString): Added.

UserInterface/Views/SpreadsheetRulesStyleDetailsPanel.js:

(WI.SpreadsheetRulesStyleDetailsPanel.prototype.spreadsheetCSSStyleDeclarationSectionAddNewRule): Added.
(WI.SpreadsheetRulesStyleDetailsPanel.prototype.layout):
Provide a delegate method for adding a new rule, so the WI.SpreadsheetRulesStyleDetailsPanel
can know what selector to focus once the new rule gets added.

UserInterface/Views/SpreadsheetCSSStyleDeclarationSection.js:

(WI.SpreadsheetCSSStyleDeclarationSection.prototype.initialLayout):
(WI.SpreadsheetCSSStyleDeclarationSection.prototype._renderSelector):
(WI.SpreadsheetCSSStyleDeclarationSection.prototype._populateIconElementContextMenu): Added.

UserInterface/Views/SpreadsheetCSSStyleDeclarationSection.css:

(.spreadsheet-css-declaration .header.editing-selector .selector): Added.
(.spreadsheet-css-declaration .selector > .icon): Added.
(.spreadsheet-css-declaration .selector > .icon + *): Added.
(.spreadsheet-css-declaration .selector.style-attribute > span): Added.
When "mousedown" (or "contextmenu") on the icon, show a context menu with helpful actions:

Copy Rule
{Disable|Enable} Rule
Duplicate Selector
Add :{active|focus|hover|visited} Rule
Create ::{before|after} Rule
Reveal in {Resources Tab|Sources Tab|Stylesheet}

Drive-by: add an extra 0.5px of initial margin before the Style Attribute selector (which is
sans-serif) so it properly aligns with the other selectors (which are monospaced).

UserInterface/Views/SpreadsheetCSSStyleDeclarationEditor.js:

(WI.SpreadsheetCSSStyleDeclarationEditor.prototype.layout):

UserInterface/Views/SpreadsheetCSSStyleDeclarationEditor.css:

(.spreadsheet-style-declaration-editor:empty): Added.
(.spreadsheet-style-declaration-editor.no-properties): Deleted.
Add some extra space when there's no inline style so it looks a bit less cramped.

UserInterface/Main.html:
UserInterface/Views/StyleRuleIcons.css: Added.

(.author-style-rule-icon .icon):
(.author-style-rule-icon.pseudo-selector .icon):
(.user-style-rule-icon .icon):
(.user-style-rule-icon.pseudo-selector .icon):
(.user-agent-style-rule-icon .icon):
(.user-agent-style-rule-icon.pseudo-selector .icon):
(.inspector-style-rule-icon .icon):
(.inspector-style-rule-icon.pseudo-selector .icon):
(.inherited-style-rule-icon .icon):
(.inherited-element-style-rule-icon .icon):

UserInterface/Images/StyleRule.svg: Added.
UserInterface/Images/StyleRuleInheritedElement.svg: Added.
UserInterface/Images/StyleRulePseudo.svg: Added.

Add generic icon classes for style rule icons.

UserInterface/Base/Setting.js:
UserInterface/Views/SettingsTabContentView.js:

(WI.SettingsTabContentView.prototype._createExperimentalSettingsView):
Add experimental setting.

Localizations/en.lproj/localizedStrings.js:

LayoutTests:

inspector/css/generateCSSRuleString.html: Added.
inspector/css/generateCSSRuleString-expected.txt: Added.

12:00 PM Changeset in webkit [248201] by Devin Rousso

28 edits
1 move
5 adds
2 deletes in trunk

Web Inspector: DOM: add a special breakpoint for "All Events"
https://bugs.webkit.org/show_bug.cgi?id=200285

Reviewed by Joseph Pecoraro.

Source/JavaScriptCore:

Similar to the existing "All Requests" breakpoint, there should be a way to set a breakpoint
that would pause for any DOM event, regardless of the event's name. This is useful for
situations where the event name isn't known, or where one simply wants to pause on the next
entry to the event loop.

Along these lines, make the "requestAnimationFrame", "setTimeout", and "setInterval"
event breakpoints into special breakpoints that can be added/removed via the create
breakpoint context menu. This simplifies the process for setting these breakpoints, and also
makes them more discoverable (most people wouldn't consider them to be "events").

inspector/protocol/Debugger.json:
- Rename the EventListener pause reason to Listener.
- Split the Timer pause reason into Interval and Timeout.

inspector/protocol/DOMDebugger.json:
- Split the timer type into interval and timeout.
- Make eventName optional for addEventBreakpoint/removeEventBreakpoint. When omitted, the corresponding breakpoint that is added/removed is treated as a global breakpoint that applies to all events of that type (e.g. a global listener breakpoint would pause for any event that is fired).

Source/WebCore:

Tests: inspector/dom/breakpoint-for-event-listener.html

inspector/dom-debugger/event-animation-frame-breakpoints.html
inspector/dom-debugger/event-breakpoint-with-navigation.html
inspector/dom-debugger/event-interval-breakpoints.html
inspector/dom-debugger/event-listener-breakpoints.html
inspector/dom-debugger/event-timeout-breakpoints.html

inspector/agents/InspectorDOMDebuggerAgent.h:
inspector/agents/InspectorDOMDebuggerAgent.cpp:

(WebCore::InspectorDOMDebuggerAgent::disable):
(WebCore::InspectorDOMDebuggerAgent::frameDocumentUpdated):
(WebCore::InspectorDOMDebuggerAgent::setEventBreakpoint):
(WebCore::InspectorDOMDebuggerAgent::removeEventBreakpoint):
(WebCore::InspectorDOMDebuggerAgent::willHandleEvent):
(WebCore::InspectorDOMDebuggerAgent::willFireTimer):
(WebCore::InspectorDOMDebuggerAgent::willFireAnimationFrame):
(WebCore::InspectorDOMDebuggerAgent::discardBindings): Deleted.
Make eventName optional for addEventBreakpoint/removeEventBreakpoint. When omitted,
the corresponding breakpoint that is added/removed is treated as a global breakpoint that
applies to all events of that type (e.g. a global listener breakpoint would pause for any
event that is fired).

Source/WebInspectorUI:

UserInterface/Models/EventBreakpoint.js:

(WI.EventBreakpoint):
(WI.EventBreakpoint.deserialize):
(WI.EventBreakpoint.prototype.saveIdentityToCookie):
(WI.EventBreakpoint.prototype.toJSON):

UserInterface/Controllers/DebuggerManager.js:

(WI.DebuggerManager.prototype._pauseReasonFromPayload):

UserInterface/Controllers/DOMDebuggerManager.js:

(WI.DOMDebuggerManager):
(WI.DOMDebuggerManager.prototype.initializeTarget):
(WI.DOMDebuggerManager.supportsDOMBreakpoints): Added.
(WI.DOMDebuggerManager.supportsEventBreakpoints):
(WI.DOMDebuggerManager.supportsEventListenerBreakpoints): Added.
(WI.DOMDebuggerManager.supportsURLBreakpoints):
(WI.DOMDebuggerManager.supportsXHRBreakpoints): Added.
(WI.DOMDebuggerManager.supportsAllListenersBreakpoint): Added.
(WI.DOMDebuggerManager.prototype.get allAnimationFramesBreakpoint): Added.
(WI.DOMDebuggerManager.prototype.get allIntervalsBreakpoint): Added.
(WI.DOMDebuggerManager.prototype.get allListenersBreakpoint): Added.
(WI.DOMDebuggerManager.prototype.get allTimeoutsBreakpoint): Added.
(WI.DOMDebuggerManager.prototype.get listenerBreakpoints): Added.
(WI.DOMDebuggerManager.prototype.isBreakpointSpecial):
(WI.DOMDebuggerManager.prototype.listenerBreakpointForEventName): Added.
(WI.DOMDebuggerManager.prototype.addEventBreakpoint):
(WI.DOMDebuggerManager.prototype.removeEventBreakpoint):
(WI.DOMDebuggerManager.prototype.addURLBreakpoint):
(WI.DOMDebuggerManager.prototype._resolveDOMBreakpoint):
(WI.DOMDebuggerManager.prototype._updateDOMBreakpoint):
(WI.DOMDebuggerManager.prototype._updateEventBreakpoint):
(WI.DOMDebuggerManager.prototype._updateURLBreakpoint):
(WI.DOMDebuggerManager.prototype._handleDOMBreakpointDisabledStateChanged):
(WI.DOMDebuggerManager.prototype._handleEventBreakpointDisabledStateChanged):
(WI.DOMDebuggerManager.prototype._handleURLBreakpointDisabledStateChanged):
(WI.DOMDebuggerManager.prototype.get eventBreakpoints): Deleted.
(WI.DOMDebuggerManager.prototype.eventBreakpointForTypeAndEventName): Deleted.
Add additional target compatibility checks.

UserInterface/Views/EventBreakpointPopover.js:

(WI.EventBreakpointPopover.prototype.show):
(WI.EventBreakpointPopover.prototype.dismiss):
(WI.EventBreakpointPopover.prototype._handleTypeSelectChange): Deleted.

UserInterface/Views/EventBreakpointPopover.css:

(.popover .event-breakpoint-content > input): Added.
(.popover .event-breakpoint-content > input::placeholder): Added.
(.popover .event-breakpoint-content > .event-type): Deleted.
(.popover .event-breakpoint-content > .event-type > input): Deleted.
(.popover .event-breakpoint-content > .event-type > input::placeholder): Deleted.

UserInterface/Views/EventBreakpointTreeElement.css:

(.breakpoint.event.breakpoint-for-interval:not(.breakpoint-paused-icon) .icon): Added.
(.breakpoint.event.breakpoint-for-timeout:not(.breakpoint-paused-icon) .icon): Added.
(.breakpoint.event.breakpoint-for-timer:not(.breakpoint-paused-icon) .icon): Deleted.

UserInterface/Views/DebuggerSidebarPanel.js:

(WI.DebuggerSidebarPanel):
(WI.DebuggerSidebarPanel.prototype.saveStateToCookie):
(WI.DebuggerSidebarPanel.prototype.restoreStateFromCookie):
(WI.DebuggerSidebarPanel.prototype._addBreakpoint):
(WI.DebuggerSidebarPanel.prototype._addTreeElement):
(WI.DebuggerSidebarPanel.prototype._updatePauseReasonSection):
(WI.DebuggerSidebarPanel.prototype._handleBreakpointElementAddedOrRemoved):
(WI.DebuggerSidebarPanel.prototype._populateCreateBreakpointContextMenu.addToggleForSpecialEventBreakpoint): Added.
(WI.DebuggerSidebarPanel.prototype._populateCreateBreakpointContextMenu):

UserInterface/Views/SourcesNavigationSidebarPanel.js:

(WI.SourcesNavigationSidebarPanel):
(WI.SourcesNavigationSidebarPanel.prototype._insertDebuggerTreeElement):
(WI.SourcesNavigationSidebarPanel.prototype._addBreakpoint):
(WI.SourcesNavigationSidebarPanel.prototype._updatePauseReasonSection):
(WI.SourcesNavigationSidebarPanel.prototype._handleBreakpointElementAddedOrRemoved):
(WI.SourcesNavigationSidebarPanel.prototype._populateCreateBreakpointContextMenu.addToggleForSpecialEventBreakpoint): Added.
(WI.SourcesNavigationSidebarPanel.prototype._populateCreateBreakpointContextMenu):
Add create breakpoint context menu items (also sort the breakpoints in this order):

"All Animation Frames" => [A] All Animation Frames
"All Timeouts" => [T] All Timeouts
"All Intervals" => [I] All Intervals
"All Events" => [E] All Events

UserInterface/Controllers/JavaScriptRuntimeCompletionProvider.js:

(WI.JavaScriptRuntimeCompletionProvider.completionControllerCompletionsNeeded.receivedPropertyNames):

UserInterface/Base/Setting.js:
UserInterface/Images/EventBreakpointInterval.svg: Added.
UserInterface/Images/EventBreakpointTimeout.svg: Renamed from Source/WebInspectorUI/UserInterface/Images/EventBreakpointTimer.svg.
Localizations/en.lproj/localizedStrings.js:

LayoutTests:

inspector/dom/breakpoint-for-event-listener.html:
inspector/dom/breakpoint-for-event-listener-expected.txt:

inspector/dom-debugger/event-animation-frame-breakpoints.html:
inspector/dom-debugger/event-animation-frame-breakpoints-expected.txt:
inspector/dom-debugger/event-breakpoint-with-navigation.html:
inspector/dom-debugger/event-breakpoint-with-navigation-expected.txt:
inspector/dom-debugger/event-interval-breakpoints.html: Added.
inspector/dom-debugger/event-interval-breakpoints-expected.txt: Added.
inspector/dom-debugger/event-listener-breakpoints.html:
inspector/dom-debugger/event-listener-breakpoints-expected.txt:
inspector/dom-debugger/event-timeout-breakpoints.html: Added.
inspector/dom-debugger/event-timeout-breakpoints-expected.txt: Added.

inspector/dom-debugger/resources/event-breakpoint-utilities.js:

(TestPage.registerInitializer.InspectorTest.EventBreakpoint.teardown):
(TestPage.registerInitializer.InspectorTest.EventBreakpoint.failOnPause):
(TestPage.registerInitializer.InspectorTest.EventBreakpoint.createBreakpoint): Added.
(TestPage.registerInitializer.InspectorTest.EventBreakpoint.addBreakpoint):
(TestPage.registerInitializer.InspectorTest.EventBreakpoint.removeBreakpoint):
(TestPage.registerInitializer.InspectorTest.EventBreakpoint.disableBreakpoint):

inspector/dom-debugger/event-timer-breakpoints.html: Removed.
inspector/dom-debugger/event-timer-breakpoints-expected.txt: Removed.

9:09 AM Changeset in webkit [248200] by Alan Bujtas

19 edits
4 deletes in trunk

[LFC] Remove formatting context type leaf classes
https://bugs.webkit.org/show_bug.cgi?id=200224
<rdar://problem/53661907>

Reviewed by Antti Koivisto.

Let's keep the layout tree formatting context type independent.

Sources.txt:
WebCore.xcodeproj/project.pbxproj:
layout/inlineformatting/InlineFormattingContext.cpp:

(WebCore::Layout::InlineFormattingContext::layout const):
(WebCore::Layout::InlineFormattingContext::computeIntrinsicWidthConstraints const):
(WebCore::Layout::InlineFormattingContext::initializeMarginBorderAndPaddingForGenericInlineBox const):
(WebCore::Layout::InlineFormattingContext::collectInlineContent const):

layout/inlineformatting/InlineFormattingContext.h:
layout/inlineformatting/InlineFormattingContextLineLayout.cpp:

(WebCore::Layout::inlineItemWidth):
(WebCore::Layout::LineLayout::placeInlineItem):

layout/inlineformatting/InlineItem.h:
layout/inlineformatting/InlineTextItem.cpp:

(WebCore::Layout::InlineTextItem::createAndAppendTextItems):
(WebCore::Layout::InlineTextItem::InlineTextItem):
(WebCore::Layout::InlineTextItem::split const):

layout/inlineformatting/InlineTextItem.h:

(WebCore::Layout::InlineTextItem::inlineBox const): Deleted.

layout/inlineformatting/text/TextUtil.cpp:

(WebCore::Layout::TextUtil::width):
(WebCore::Layout::TextUtil::split):

layout/inlineformatting/text/TextUtil.h:
layout/layouttree/LayoutBox.cpp:

(WebCore::Layout::Box::Box):
(WebCore::Layout::Box::~Box):
(WebCore::Layout::Box::formattingContextRoot const):
(WebCore::Layout::Box::setTextContent):
(WebCore::Layout::Box::hasTextContent const):
(WebCore::Layout::Box::textContent const):
(WebCore::Layout::Box::replaced const):
(WebCore::Layout::Box::replaced):
(WebCore::Layout::Box::rareDataMap):
(WebCore::Layout::Box::rareData const):
(WebCore::Layout::Box::ensureRareData):
(WebCore::Layout::Box::removeRareData):

layout/layouttree/LayoutBox.h:

(WebCore::Layout::Box::isLineBreakBox const):
(WebCore::Layout::Box::hasRareData const):
(WebCore::Layout::Box::setHasRareData):
(WebCore::Layout::Box::isInlineBox const): Deleted.
(WebCore::Layout::Box::replaced const): Deleted.
(WebCore::Layout::Box::replaced): Deleted.

layout/layouttree/LayoutContainer.h:

(WebCore::Layout::Container::firstChild const): Deleted.
(WebCore::Layout::Container::lastChild const): Deleted.
(WebCore::Layout::Container::hasChild const): Deleted.
(WebCore::Layout::Container::hasInFlowChild const): Deleted.
(WebCore::Layout::Container::hasInFlowOrFloatingChild const): Deleted.
(WebCore::Layout::Container::outOfFlowDescendants const): Deleted.

layout/layouttree/LayoutInlineBox.cpp: Removed.
layout/layouttree/LayoutInlineBox.h: Removed.
layout/layouttree/LayoutLineBreakBox.cpp: Removed.
layout/layouttree/LayoutLineBreakBox.h: Removed.
layout/layouttree/LayoutTreeBuilder.cpp:

(WebCore::Layout::TreeBuilder::createLayoutBox):
(WebCore::Layout::outputLayoutBox):

7:01 AM Changeset in webkit [248199] by Alan Bujtas

13 edits
4 deletes in trunk/Source/WebCore

[LFC] Remove formatting context type container classes.
https://bugs.webkit.org/show_bug.cgi?id=200202

Reviewed by Antti Koivisto.

These are formatting context specific classes. Let's try to have a layout tree without such types.

Sources.txt:
WebCore.xcodeproj/project.pbxproj:
layout/blockformatting/BlockFormattingContext.cpp:

(WebCore::Layout::BlockFormattingContext::computeIntrinsicWidthConstraints const):

layout/inlineformatting/InlineFormattingContext.cpp:

(WebCore::Layout::InlineFormattingContext::layout const):
(WebCore::Layout::InlineFormattingContext::computeMarginBorderAndPaddingForInlineContainer const):

layout/inlineformatting/InlineFormattingContext.h:
layout/inlineformatting/InlineFormattingContextLineLayout.cpp:

(WebCore::Layout::InlineFormattingContext::InlineLayout::layout const):

layout/inlineformatting/InlineLine.cpp:

(WebCore::Layout::Line::appendTextContent):

layout/layouttree/LayoutBlockContainer.cpp: Removed.
layout/layouttree/LayoutBlockContainer.h: Removed.
layout/layouttree/LayoutBox.cpp:

(WebCore::Layout::Box::establishesInlineFormattingContext const):
(WebCore::Layout::Box::establishesInlineFormattingContextOnly const):
(WebCore::Layout::Box::formattingContextRoot const):

layout/layouttree/LayoutBox.h:

(WebCore::Layout::Box::isBlockContainer const):
(WebCore::Layout::Box::isInlineContainer const):
(WebCore::Layout::Box::isInlineBox const):
(WebCore::Layout::Box::establishesInlineFormattingContext const): Deleted.
(WebCore::Layout::Box::establishesInlineFormattingContextOnly const): Deleted.

layout/layouttree/LayoutInlineContainer.cpp: Removed.
layout/layouttree/LayoutInlineContainer.h: Removed.
layout/layouttree/LayoutIterator.h:

(WebCore::Layout::LayoutBoxTraversal::firstChild):

layout/layouttree/LayoutTreeBuilder.cpp:

(WebCore::Layout::TreeBuilder::createLayoutTree):
(WebCore::Layout::TreeBuilder::createLayoutBox):
(WebCore::Layout::TreeBuilder::createTableStructure):
(WebCore::Layout::outputLayoutBox):

layout/layouttree/LayoutTreeBuilder.h:
page/FrameViewLayoutContext.cpp:

(WebCore::layoutUsingFormattingContext):

1:56 AM Changeset in webkit [248198] by Devin Rousso

9 edits in trunk/Source/WebInspectorUI

Web Inspector: Heap Snapshot Views should be searchable
https://bugs.webkit.org/show_bug.cgi?id=157582
<rdar://problem/26228629>

Reviewed by Joseph Pecoraro.

Without the ability to filter/search, it's far more difficult to find objects of interest.
Rather than spending time scrolling through the entire heap snapshot or sorting by "Name",
a simple filter/search (which also uses the global search settings) is almost instant.

UserInterface/Views/HeapAllocationsTimelineView.js:

(WI.HeapAllocationsTimelineView.prototype.updateFilter): Addded.
(WI.HeapAllocationsTimelineView.prototype.get showsFilterBar): Deleted.

UserInterface/Views/HeapSnapshotClusterContentView.js:

(WI.HeapSnapshotClusterContentView.prototype.updateFilter): Added.

UserInterface/Views/HeapSnapshotContentView.js:

(WI.HeapSnapshotContentView):
(WI.HeapSnapshotContentView.prototype.updateFilter): Added.
(WI.HeapSnapshotContentView.prototype.dataGridMatchNodeAgainstCustomFilters): Added.
(WI.HeapSnapshotContentView.prototype.dataGridMatchShouldPopulateWhenFilteringNode): Added.

UserInterface/Views/DataGrid.js:

(WI.DataGrid.prototype._updateFilter.createIteratorForNodesToBeFiltered):
Don't attempt to populate each heap snapshot WI.DataGridNode when filtering, as that can
quickly exhaust memory due to the sheer size of a heap snapshot.

UserInterface/Base/Main.js:

(WI._find):

UserInterface/Views/TimelineTabContentView.js:

(WI.TimelineTabContentView.prototype.get canHandleFindEvent): Added.
(WI.TimelineTabContentView.prototype.handleFindEvent): Added.

UserInterface/Views/TimelineRecordingContentView.js:

(WI.TimelineRecordingContentView.prototype.get canFocusFilterBar): Added.
(WI.TimelineRecordingContentView.prototype.focusFilterBar): Added.

UserInterface/Views/FilterBar.js:

(WI.FilterBar.prototype.focus): Added.
Allow the current tab to intercept the find shortcut and do something custom. In the case
of a WI.TimelineTabContentView, declare that it can handle the find event if the displayed
content view (WI.TimelineRecordingContentView) can focus it's filter bar. If so, when the
find shortcut is triggered, focus the filter bar.

1:52 AM Changeset in webkit [248197] by Devin Rousso

6 edits
2 adds in trunk

Web Inspector: CSS Formatter: comments with an escape character aren't formatted
https://bugs.webkit.org/show_bug.cgi?id=200168

Reviewed by Joseph Pecoraro.

Source/WebInspectorUI:

Don't allow escaping of the "*" in CSS comments (e.g. \*/).

Add additional pretty printing rules for comments so that there's always some space between
them and the surrounding text. This ensures that they don't interfere with readability.

UserInterface/Workers/Formatter/CSSFormatter.js:

(CSSFormatter.prototype._format):

UserInterface/Workers/Formatter/FormatterContentBuilder.js:

(FormatterContentBuilder.prototype.get indented): Added.

LayoutTests:

inspector/formatting/formatting-css.html:
inspector/formatting/formatting-css-expected.txt:
inspector/formatting/resources/css-tests/comment.css: Added.
inspector/formatting/resources/css-tests/comment-expected.css: Added.

12:37 AM Changeset in webkit [248196] by Devin Rousso

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Console: execution context picker doesn't update when switching to the inferred context from auto
https://bugs.webkit.org/show_bug.cgi?id=200279

Reviewed by Joseph Pecoraro.

The representedObject of the "auto" execution context path component is shared with that
execution context's actual path component, meaning that if the user switches from "auto" to
that execution context's path component, the underlying representedObject wouldn't change,
and therfore the RuntimeManager.Event.ActiveExecutionContextChanged wouldn't fire. In this
case, update the visible ("selected") execution context path component manually.

UserInterface/Views/QuickConsole.js:

(WI.QuickConsole.prototype._selectExecutionContext):
(WI.QuickConsole.prototype._pathComponentSelected):

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed