Context Navigation

← Previous Period
Next Period →

Timeline

Sep 15, 2019:

10:51 PM Changeset in webkit [249889] by ddkilzer@apple.com

2 edits in trunk/Source/WebKit

REGRESSION (r248592): Leak of CFDictionaryRef in WebKit::NetworkRTCProvider::proxyInfoFromSession()
<https://webkit.org/b/201811>

Reviewed by Youenn Fablet.

NetworkProcess/webrtc/NetworkRTCProvider.mm:

(WebKit::NetworkRTCProvider::proxyInfoFromSession): Use
RetainPtr<> to fix the leak.

5:41 PM Changeset in webkit [249888] by aestes@apple.com

4 edits
6 adds in trunk/Source/WebCore

[WebIDL] Derived dictionaries should inherit their inherited dictionaries' partials
https://bugs.webkit.org/show_bug.cgi?id=201802

Reviewed by Sam Weinig.

Prior to this change, a dictionary D that inherits from dictionary B would not inherit B's
partial dictionaries. Fixed this by moving supplemental dependencies processing from
generate-bindings.pl to CodeGenerator.pm and reusing it in GetDictionaryByType.

Added new bindings tests.

bindings/scripts/CodeGenerator.pm:

(new):
(ProcessDocument):
(ProcessSupplementalDependencies):
(shouldPropertyBeExposed):
(GetDictionaryByType):

bindings/scripts/generate-bindings.pl:

(generateBindings):
(shouldPropertyBeExposed): Deleted.

bindings/scripts/test/JS/JSTestDerivedDictionary.cpp: Added.

(WebCore::convertDictionary<TestDerivedDictionary>):
(WebCore::convertDictionaryToJS):

bindings/scripts/test/JS/JSTestDerivedDictionary.h: Added.
bindings/scripts/test/JS/JSTestInheritedDictionary.cpp: Added.

(WebCore::convertDictionary<TestInheritedDictionary>):
(WebCore::convertDictionaryToJS):

bindings/scripts/test/JS/JSTestInheritedDictionary.h: Added.
bindings/scripts/test/TestDerivedDictionary.idl: Added.
bindings/scripts/test/TestInheritedDictionary.idl: Added.
bindings/scripts/test/TestSupplemental.idl:

2:43 PM Changeset in webkit [249887] by ddkilzer@apple.com

2 edits in trunk/Source/WebCore

Missing call to [self init] in -[WebScrollbarPartAnimation initWithScrollbar:featureToAnimate:animateFrom:animateTo:duration:]
<https://webkit.org/b/201806>

Reviewed by Simon Fraser.

platform/mac/ScrollAnimatorMac.mm:

(-[WebScrollbarPartAnimation initWithScrollbar:featureToAnimate:animateFrom:animateTo:duration:]):
Call [self init] and return early if the result is nil.

12:25 PM Changeset in webkit [249886] by Chris Dumez

442 edits
13 moves
2115 adds
71 deletes in trunk/LayoutTests

Re-sync HTML web-platform-tests from upstream
https://bugs.webkit.org/show_bug.cgi?id=201753

Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

Re-sync HTML web-platform-tests from upstream 8893b1bcfc2ca0675f4e81.

web-platform-tests/html/*: Updated.

LayoutTests:

TestExpectations:
platform/gtk/TestExpectations:
platform/ios-wk1/TestExpectations:
platform/ios/TestExpectations:
platform/mac-wk2/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/type-change-state-expected.txt:
platform/mac/TestExpectations:
platform/mac/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location_hash-expected.txt:
platform/win/TestExpectations:
tests-options.json:

10:17 AM Changeset in webkit [249885] by ddkilzer@apple.com

2 edits in trunk/Source/JavaScriptCore

Leak of NSMapTable in -[JSVirtualMachine addManagedReference:withOwner:]
<https://webkit.org/b/201803>

Reviewed by Dan Bernstein.

API/JSVirtualMachine.mm:

(-[JSVirtualMachine addManagedReference:withOwner:]): Use
RetainPtr<> to fix the leak.

7:14 AM Changeset in webkit [249884] by ddkilzer@apple.com

3 edits in trunk/Tools

block-spammers should obtain credentials the same way as webkit-patch
<https://webkit.org/b/201733>

Reviewed by Lucas Forschler.

Scripts/block-spammers: Import Credentials from webkitpy.

Remove unused imports. Enable logging at info level to match
webkit-patch.
(get_bugzilla_token): Use Credentials module to get
bugs.webkit.org credentials.

Scripts/webkitpy/common/net/credentials.py:

(Credentials._run_security_tool): Change logging level from
error to info since multiple attempts are made at reading the
keychain. Fix typos in comment.
(Credentials._credentials_from_security_command): Extract common
logic from Credentials._credentials_from_keychain into new
method.
(Credentials._credentials_from_keychain): Make fallback logic
for checking for credentials in the keychain more consistent and
easier to read. Add error logging if no credentials are found.

6:30 AM Changeset in webkit [249883] by Adrian Perez de Castro

2 edits in trunk

[GTK][WPE] Do not run the Bubblewrap executable when configuring for cross-compilation
https://bugs.webkit.org/show_bug.cgi?id=201340

Reviewed by Konstantin Tokarev.

Source/cmake/BubblewrapSandboxChecks.cmake: Do not run the

Bubblewrap executable when cross-compiling to guess its version.
Emit a warning instead and trust that valid run-time paths will
be set using the BWRAP_EXECUTABLE and DBUS_PROXY_EXECUTABLE
variables. While at it, fix the regular expression used to match
the version string in the Bubblewrap output when not cross-compiling.

Sep 14, 2019:

3:45 PM Changeset in webkit [249882] by Adrian Perez de Castro

2 edits in trunk/Source/WebKit

[GTK][WPE] Check for a Snap sandbox a bit harder
https://bugs.webkit.org/show_bug.cgi?id=201793

Reviewed by Michael Catanzaro.

UIProcess/Launcher/glib/ProcessLauncherGLib.cpp:

(WebKit::isInsideSnap): Check whether the SNAP_NAME and SNAP_REVISION
environment variables are defined as well.

3:31 PM Changeset in webkit [249881] by Justin Fan

11 edits in trunk/Source/WebCore

[WebGPU] Make WebGPURenderPipeline and WebGPUComputePipeline inherit from GPUObjectBase
https://bugs.webkit.org/show_bug.cgi?id=201207

Reviewed by Dean Jackson.

Make remaining WebGPU "client" classes manage their error scopes, instead of the internal classes.
Matches Web/GPUBuffer, and allows "invalid" WebGPU objects to create errors.

Covered by existing tests.

Modules/webgpu/WebGPUComputePipeline.cpp:

(WebCore::WebGPUComputePipeline::create):
(WebCore::WebGPUComputePipeline::WebGPUComputePipeline):

Modules/webgpu/WebGPUComputePipeline.h:
Modules/webgpu/WebGPUDevice.cpp:

(WebCore::WebGPUDevice::createRenderPipeline const):
(WebCore::WebGPUDevice::createComputePipeline const):

Modules/webgpu/WebGPURenderPipeline.cpp:

(WebCore::WebGPURenderPipeline::create):
(WebCore::WebGPURenderPipeline::WebGPURenderPipeline):

Modules/webgpu/WebGPURenderPipeline.h:
WebCore.xcodeproj/project.pbxproj:
platform/graphics/gpu/GPUComputePipeline.h:
platform/graphics/gpu/GPURenderPipeline.h:
platform/graphics/gpu/cocoa/GPUComputePipelineMetal.mm:

(WebCore::GPUComputePipeline::tryCreate):
(WebCore::GPUComputePipeline::GPUComputePipeline):

platform/graphics/gpu/cocoa/GPURenderPipelineMetal.mm:

(WebCore::GPURenderPipeline::tryCreate):
(WebCore::GPURenderPipeline::GPURenderPipeline):

12:36 PM Changeset in webkit [249880] by ysuzuki@apple.com

26 edits in trunk/Source

Retire x86 32bit JIT support
https://bugs.webkit.org/show_bug.cgi?id=201790

Reviewed by Mark Lam.

Source/JavaScriptCore:

Now, Xcode no longer has ability to build 32bit binary, so we cannot even test it on macOS.
Fedora stops shipping x86 32bit kernel. Our x86/x86_64 JIT requires SSE2, and so such relatively modern CPUs
can use JIT by switching x86 to x86_64. And these CPUs are modern enough to run CLoop at high speed.
WebKit already disabled x86 JIT by default while the implementation exists. So literary, it is not tested.

While x86 32bit becomes less useful, x86 32bit JIT backend is very complicated and is being a major maintenance burden.
This is due to very few # of registers. Which scatters a lot of isX86 / CPU(X86) in Baseline, DFG, and Yarr.

This patch retires x86 JIT support from JavaScriptCore and CSS JIT. We still keep MacroAssembler and GPRInfo / FPRInfo,
MachineContext information since they are useful even though JIT is not supported.

dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::refine const):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compileExceptionHandlers):

dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::osrWriteBarrier):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileArithDiv):
(JSC::DFG::SpeculativeJIT::compileArithMod):
(JSC::DFG::SpeculativeJIT::compileCreateRest):
(JSC::DFG::SpeculativeJIT::compileGetDirectPname):

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGThunks.cpp:

(JSC::DFG::osrExitGenerationThunkGenerator):

ftl/FTLThunks.cpp:

(JSC::FTL::slowPathCallThunkGenerator):

jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::callExceptionFuzz):
(JSC::AssemblyHelpers::debugCall):

jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::emitComputeButterflyIndexingMask):

jit/CCallHelpers.h:

(JSC::CCallHelpers::setupArgumentsImpl):
(JSC::CCallHelpers::prepareForTailCallSlow):

jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::prepareForTailCall):

jit/JIT.cpp:

(JSC::JIT::privateCompileExceptionHandlers):

jit/JITArithmetic32_64.cpp:

(JSC::JIT::emit_op_mod):
(JSC::JIT::emitSlow_op_mod):

jit/SlowPathCall.h:

(JSC::JITSlowPathCall::call):

jit/ThunkGenerators.cpp:

(JSC::nativeForGenerator):
(JSC::arityFixupGenerator):

wasm/WasmAirIRGenerator.cpp:

(JSC::Wasm::AirIRGenerator::emitModOrDiv):

yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::generateDotStarEnclosure):
(JSC::Yarr::YarrGenerator::generateEnter):
(JSC::Yarr::YarrGenerator::generateReturn):
(JSC::Yarr::YarrGenerator::compile):

yarr/YarrJIT.h:

Source/WebCore:

cssjit/FunctionCall.h:

(WebCore::FunctionCall::callAndBranchOnBooleanReturnValue):
(WebCore::FunctionCall::swapArguments):

Source/WTF:

wtf/Platform.h:

11:52 AM Changeset in webkit [249879] by Alan Bujtas

5 edits in trunk/Source/WebCore

[LFC] FormattingContext::Geometry::inFlowPositionedPositionOffset should not read containing block's width
https://bugs.webkit.org/show_bug.cgi?id=201797
<rdar://problem/55366244>

Reviewed by Antti Koivisto.

This is in preparation for using constraint values instead of querying the display tree for containing block geometry information.
See webkit.org/b/201795

layout/FormattingContext.h:
layout/FormattingContextGeometry.cpp:

(WebCore::Layout::FormattingContext::Geometry::inFlowPositionedPositionOffset const):

layout/blockformatting/BlockFormattingContext.cpp:

(WebCore::Layout::BlockFormattingContext::placeInFlowPositionedChildren):

layout/inlineformatting/InlineFormattingContextLineLayout.cpp:

(WebCore::Layout::InlineFormattingContext::InlineLayout::createDisplayRuns const):

11:05 AM Changeset in webkit [249878] by Alan Bujtas

9 edits in trunk/Source/WebCore

[LFC] FormattingContext::Geometry::inlineReplacedHeightAndMargin should not read containing block's width
https://bugs.webkit.org/show_bug.cgi?id=201796
<rdar://problem/55366109>

Reviewed by Antti Koivisto.

This is in preparation for using constraint values instead of querying the display tree for containing block geometry information.
See webkit.org/b/201795

layout/FormattingContext.h:
layout/FormattingContextGeometry.cpp:

(WebCore::Layout::FormattingContext::Geometry::outOfFlowReplacedVerticalGeometry const):
(WebCore::Layout::FormattingContext::Geometry::complicatedCases const):
(WebCore::Layout::FormattingContext::Geometry::floatingReplacedHeightAndMargin const):
(WebCore::Layout::FormattingContext::Geometry::floatingHeightAndMargin const):
(WebCore::Layout::FormattingContext::Geometry::inlineReplacedHeightAndMargin const):

layout/blockformatting/BlockFormattingContext.cpp:

(WebCore::Layout::BlockFormattingContext::computeHeightAndMargin):

layout/blockformatting/BlockFormattingContext.h:
layout/blockformatting/BlockFormattingContextGeometry.cpp:

(WebCore::Layout::BlockFormattingContext::Geometry::inFlowHeightAndMargin):

layout/inlineformatting/InlineFormattingContext.cpp:

(WebCore::Layout::InlineFormattingContext::computeHeightAndMargin):

layout/inlineformatting/InlineFormattingContext.h:
layout/inlineformatting/InlineFormattingContextGeometry.cpp:

(WebCore::Layout::InlineFormattingContext::Geometry::inlineBlockHeightAndMargin const):

10:23 AM Changeset in webkit [249877] by Alan Bujtas

4 edits in trunk/Source/WebCore

[LFC] FormattingContext::Geometry::outOfFlowReplacedVerticalGeometry should not read containing block's width.
https://bugs.webkit.org/show_bug.cgi?id=201794
<rdar://problem/55365669>

Reviewed by Antti Koivisto.

This is in preparation for using constraint values instead of querying the display tree for containing block geometry information.
See webkit.org/b/201795

layout/FormattingContext.cpp:

(WebCore::Layout::FormattingContext::computeOutOfFlowVerticalGeometry):

layout/FormattingContext.h:
layout/FormattingContextGeometry.cpp:

(WebCore::Layout::FormattingContext::Geometry::outOfFlowNonReplacedVerticalGeometry const):
(WebCore::Layout::FormattingContext::Geometry::outOfFlowReplacedVerticalGeometry const):
(WebCore::Layout::FormattingContext::Geometry::outOfFlowVerticalGeometry const):

9:00 AM Changeset in webkit [249876] by Chris Dumez

2 edits in trunk/Source/WebCore

newController may be moved several times under SWClientConnection::notifyClientsOfControllerChange()
https://bugs.webkit.org/show_bug.cgi?id=201792
<rdar://problem/55351284>

Reviewed by Youenn Fablet.

Stop WTFMove()'ing inside the for loop.

workers/service/SWClientConnection.cpp:

(WebCore::SWClientConnection::notifyClientsOfControllerChange):

8:41 AM Changeset in webkit [249875] by mark.lam@apple.com

2 edits in branches/safari-608.2.11.1-branch/Source/JavaScriptCore

Cherry-pick r249345. rdar://problem/55362909

2019-08-30 Mark Lam <mark.lam@apple.com>

Fix a bug in SlotVisitor::reportZappedCellAndCrash() and also capture more information.
https://bugs.webkit.org/show_bug.cgi?id=201345

Reviewed by Yusuke Suzuki.

This patch fixes a bug where SlotVisitor::reportZappedCellAndCrash() was using
the wrong pointer for capture the cell headerWord and zapReason. As a result,
we get junk for those 2 values.

Previously, we were only capturing the upper 32-bits of the cell header slot,
and the lower 32-bit of the next slot in the zapped cell. We now capture the
full 64-bits of both slots. If the second slot did not contain a zapReason as we
expect, the upper 32-bits might give us a clue as to what type of value the slot
contains.

This patch also adds capturing of the found MarkedBlock address for the zapped
cell, as well as some state bit values.

heap/SlotVisitor.cpp: (JSC::SlotVisitor::reportZappedCellAndCrash):

8:16 AM Changeset in webkit [249874] by mark.lam@apple.com

22 edits in branches/safari-608.2.11.1-branch

Source/JavaScriptCore:
Cherry-pick r248143, r248162. rdar://problem/55362908

Also deleted an unused function. This is needed to resolve a merge conflict for
this patch.

heap/MarkedBlock.cpp:

(JSC::MarkedBlock::Handle::zap): Deleted.

heap/MarkedBlock.h:

(JSC::MarkedBlock::Handle::zap): Deleted.

2019-08-01 Mark Lam <mark.lam@apple.com>

Add crash diagnostics for debugging unexpected zapped cells.
https://bugs.webkit.org/show_bug.cgi?id=200149
<rdar://problem/53570112>

Reviewed by Yusuke Suzuki.

Add a check for zapped cells in SlotVisitor::appendToMarkStack() and
SlotVisitor::visitChildren(). If a zapped cell is detected, we will crash with
some diagnostic info.

To facilitate this, we've made the following changes:

Changed FreeCell to preserve the 1st 8 bytes. This is fine to do because all cells are at least 16 bytes long.
Changed HeapCell::zap() to only zap the structureID. Leave the rest of the cell header info intact (including the cell JSType).
Changed HeapCell::zap() to record the reason for zapping the cell. We stash the reason immediately after the first 8 bytes. This is the same location as FreeCell::scrambledNext. However, since a cell is not expected to be zapped and on the free list at the same time, it is also fine to do this.
Added a few utility functions to MarkedBlock for checking if a cell points into the block.
Added VMInspector and JSDollarVM utilities to dump in-use subspace hashes.
Added some comments to document the hashes of known subspaces.
Added Options::dumpZappedCellCrashData() to make this check conditional. We use this option to disable this check for slower machines so that their PLT5 performance is not impacted.

assembler/CPU.cpp: (JSC::hwL3CacheSize): (JSC::hwPhysicalCPUMax):
assembler/CPU.h: (JSC::hwL3CacheSize): (JSC::hwPhysicalCPUMax):
heap/FreeList.h: (JSC::FreeCell::offsetOfScrambledNext):
heap/HeapCell.h: (JSC::HeapCell::zap): (JSC::HeapCell::isZapped const):
heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::stopAllocating):
heap/MarkedBlock.h: (JSC::MarkedBlock::Handle::start const): (JSC::MarkedBlock::Handle::end const): (JSC::MarkedBlock::Handle::contains const):
heap/MarkedBlockInlines.h: (JSC::MarkedBlock::Handle::specializedSweep):
heap/MarkedSpace.h: (JSC::MarkedSpace::forEachSubspace):
heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendToMarkStack): (JSC::SlotVisitor::visitChildren): (JSC::SlotVisitor::reportZappedCellAndCrash):
heap/SlotVisitor.h:
jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
runtime/Options.cpp: (JSC::Options::initialize):
runtime/Options.h:
runtime/VM.cpp: (JSC::VM::VM):
tools/JSDollarVM.cpp: (JSC::functionDumpSubspaceHashes): (JSC::JSDollarVM::finishCreation):
tools/VMInspector.cpp: (JSC::VMInspector::dumpSubspaceHashes):
tools/VMInspector.h:

2019-08-02 Mark Lam <mark.lam@apple.com>

Gardening: build fix.
https://bugs.webkit.org/show_bug.cgi?id=200149
<rdar://problem/53570112>

Not reviewed.

assembler/CPU.cpp: (JSC::hwPhysicalCPUMax):

Source/WebCore:
Cherry-pick r248143. rdar://problem/55362908

2019-08-01 Mark Lam <mark.lam@apple.com>

Add crash diagnostics for debugging unexpected zapped cells.
https://bugs.webkit.org/show_bug.cgi?id=200149
<rdar://problem/53570112>

Reviewed by Yusuke Suzuki.

No new tests because this is a feature for debugging crashes. It has been tested
manually by modifying the code to force a crash at the point of interest.

Added some comments to document the hashes of known subspaces.

bindings/js/WebCoreJSClientData.cpp: (WebCore::JSVMClientData::JSVMClientData):

6:55 AM Changeset in webkit [249873] by Alan Bujtas

6 edits in trunk/Source/WebCore

[LFC] FormattingContext::Geometry::computedHeightValue should not read containing block's height.
https://bugs.webkit.org/show_bug.cgi?id=201791
<rdar://problem/55361695>

Reviewed by Antti Koivisto.

While sizing/positioning a particular box, we oftentimes need some containing block geometry information.
The idea here is that instead of calling formattingContext().geometry(containingBlock), these constraint values
would be pushed in to those compute* functions. It helps controlling the access to the display box tree and
prevents formatting context escaping.

layout/FormattingContext.cpp:

(WebCore::Layout::FormattingContext::computeOutOfFlowVerticalGeometry):

layout/FormattingContext.h:
layout/FormattingContextGeometry.cpp:

(WebCore::Layout::FormattingContext::Geometry::computedHeightValue const):
(WebCore::Layout::FormattingContext::Geometry::computedMaxHeight const):
(WebCore::Layout::FormattingContext::Geometry::computedMinHeight const):
(WebCore::Layout::FormattingContext::Geometry::outOfFlowNonReplacedVerticalGeometry const):
(WebCore::Layout::FormattingContext::Geometry::outOfFlowReplacedVerticalGeometry const):
(WebCore::Layout::FormattingContext::Geometry::outOfFlowVerticalGeometry const):
(WebCore::Layout::FormattingContext::Geometry::inlineReplacedHeightAndMargin const):