Context Navigation

← Previous Period
Next Period →

Timeline

Jan 13, 2020:

11:55 PM Changeset in webkit [254498] by Alexey Shvayka

4 edits in trunk

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

web-platform-tests/html/semantics/embedded-content/the-iframe-element/srcdoc_process_attributes-expected.txt:

Source/WebCore:

Test: imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/srcdoc_process_attributes.html

Per spec, "srcdoc" attribute of an <iframe> takes precedence over "src" [1].
Before this change, "srcdoc" handling in HTMLFrameElementBase::parseAttribute didn't check whether
the attribute was set or removed. As a result, removal of "srcdoc" attribute navigated the <iframe>
to "about:srcdoc" instead of URL in value of "src" attribute.

With this change, <iframe> attributes processing matches Chrome and Firefox.

[1] https://html.spec.whatwg.org/multipage/iframe-embed-object.html#process-the-iframe-attributes

html/HTMLFrameElementBase.cpp:

(WebCore::HTMLFrameElementBase::parseAttribute):

11:18 PM Changeset in webkit [254497] by Simon Fraser

5 edits
2 adds in trunk

REGRESSION (Catalina) non-scrolling iframe prevents document scrolling
https://bugs.webkit.org/show_bug.cgi?id=202687

Reviewed by Tim Horton.

Source/WebCore:

Latching code in EventHandlerMac would consider <iframe scrolling=no> to be a latching
candidate, which would cause mousewheel scrolling in a <iframe scrolling=no> nested inside
a scrollable frame to not scroll. This affected ads and twitch.tv.

Fix by having scrolledToEdgeInDominantDirection() return true for non-scrollable iframes.

Test: tiled-drawing/scrolling/scrolling-no-iframe-latching.html

page/mac/EventHandlerMac.mm:

(WebCore::scrolledToEdgeInDominantDirection):

platform/ScrollView.h:

(WebCore::ScrollView::canHaveScrollbars const): Deleted.

platform/ScrollableArea.h:

(WebCore::ScrollableArea::canHaveScrollbars const):

LayoutTests:

tiled-drawing/scrolling/scrolling-no-iframe-latching-expected.txt: Added.
tiled-drawing/scrolling/scrolling-no-iframe-latching.html: Added.

11:03 PM Changeset in webkit [254496] by sbarati@apple.com

2 edits in trunk/JSTests

Unreviewed. Change useLLInt=0 to forceBaseline=1

stress/racy-gc-cleanup-of-identifier-after-mutator-stops-running.js:

10:41 PM Changeset in webkit [254495] by don.olmstead@sony.com

2 edits in trunk/Source/WebKit

[WebAuthn] Support CTAP Client Pin
https://bugs.webkit.org/show_bug.cgi?id=191516
<rdar://problem/56558558>

Unreviewed build fix after r254439.

CryptoKeyEC was forward declared into WebCore but the namespace was not used in
continueGetPinTokenAfterRequestPin. Looks like something in the unified sources
was covering this issue.

UIProcess/WebAuthentication/fido/CtapAuthenticator.h:

10:24 PM Changeset in webkit [254494] by Ross Kirsling

3 edits in trunk/Source/WebKit

Expose Phase on all WebWheelEvent implementations
https://bugs.webkit.org/show_bug.cgi?id=206195

Reviewed by Don Olmstead.

No change to behavior; just unhide what needn't be hidden.

Shared/WebEvent.h:

(WebKit::WebWheelEvent::directionInvertedFromDevice const):
(WebKit::WebWheelEvent::momentumPhase const):

Shared/WebWheelEvent.cpp:

(WebKit::WebWheelEvent::WebWheelEvent):

9:56 PM Changeset in webkit [254493] by Fujii Hironori

4 edits in trunk

Unreviewed sort-Xcode-project-file

Source/JavaScriptCore:

JavaScriptCore.xcodeproj/project.pbxproj:

Tools:

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:

9:40 PM Changeset in webkit [254492] by Simon Fraser

4 edits in trunk

Scrollbar hiding on iOS via ::-webkit-scrollbar { display: none } doesn't work
https://bugs.webkit.org/show_bug.cgi?id=206197

Reviewed by Tim Horton.
Source/WebCore:

The logic added in r251369 was reversed, causing scrollbar hiding to not work correctly.

Tested by fast/scrolling/ios/scrollbar-hiding.html

rendering/RenderScrollbar.cpp:

(WebCore::RenderScrollbar::isHiddenByStyle const):

LayoutTests:

The logic added in r251369 was reversed, causing scrollbar hiding to not work correctly.

fast/scrolling/ios/scrollbar-hiding-expected.txt:

9:24 PM Changeset in webkit [254491] by keith_miller@apple.com

4 edits
1 add in trunk

scanSideState scans too much side state
https://bugs.webkit.org/show_bug.cgi?id=206166

Reviewed by Tadeu Zagallo.

JSTests:

stress/checkpoint-side-state-gc-tmps-overflow.js: Added.

(v8):

Source/JavaScriptCore:

The old code would would scan tmps + sizeof(tmps) but sizeof(tmps)
is not the length of the array. instead we should scan tmps +
maxNumCheckpointTmps.

interpreter/CheckpointOSRExitSideState.h:
runtime/VM.cpp:

(JSC::VM::scanSideState const):

9:09 PM Changeset in webkit [254490] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

[WK1][iOS] VideoFullscreenControllerContext uses UIKit on the WebThread
https://bugs.webkit.org/show_bug.cgi?id=206203
<rdar://problem/48742782>

Reviewed by Simon Fraser.

platform/ios/WebVideoFullscreenControllerAVKit.mm:

(VideoFullscreenControllerContext::setVideoLayerFrame):

8:53 PM Changeset in webkit [254489] by don.olmstead@sony.com

8 edits
1 move
2 deletes in trunk/Source/WebKit

Share WebPreferences stub for ports without an implementation
https://bugs.webkit.org/show_bug.cgi?id=206186

Reviewed by Alex Christensen.

No new tests. No change in behavior.

Moved the platform agnostic stubs that were common in the GTK, WPE and Windows ports
into WebPreferences.cpp. Only Cocoa ports are implementing the platform specific parts
of WebPreferences.

Also moving WebPreferencesMac.mm to WebPreferencesCocoa.mm. There were no platform guards
for iOS family code and there was no iOS specific implementation.

PlatformFTW.cmake:
PlatformWin.cmake:
SourcesCocoa.txt:
SourcesWPE.txt:
UIProcess/Cocoa/WebPreferencesCocoa.mm: Renamed from Source/WebKit/UIProcess/mac/WebPreferencesMac.mm.
UIProcess/WebPreferences.cpp:

(WebKit::WebPreferences::platformInitializeStore):
(WebKit::WebPreferences::platformUpdateStringValueForKey):
(WebKit::WebPreferences::platformUpdateBoolValueForKey):
(WebKit::WebPreferences::platformUpdateUInt32ValueForKey):
(WebKit::WebPreferences::platformUpdateDoubleValueForKey):
(WebKit::WebPreferences::platformUpdateFloatValueForKey):
(WebKit::WebPreferences::platformDeleteKey):
(WebKit::WebPreferences::platformGetStringUserValueForKey):
(WebKit::WebPreferences::platformGetBoolUserValueForKey):
(WebKit::WebPreferences::platformGetUInt32UserValueForKey):
(WebKit::WebPreferences::platformGetDoubleUserValueForKey):

UIProcess/gtk/WebPreferencesGtk.cpp:

(WebKit::WebPreferences::platformUpdateStringValueForKey): Deleted.
(WebKit::WebPreferences::platformUpdateBoolValueForKey): Deleted.
(WebKit::WebPreferences::platformUpdateUInt32ValueForKey): Deleted.
(WebKit::WebPreferences::platformUpdateDoubleValueForKey): Deleted.
(WebKit::WebPreferences::platformUpdateFloatValueForKey): Deleted.
(WebKit::WebPreferences::platformDeleteKey): Deleted.
(WebKit::WebPreferences::platformGetStringUserValueForKey): Deleted.
(WebKit::WebPreferences::platformGetBoolUserValueForKey): Deleted.
(WebKit::WebPreferences::platformGetUInt32UserValueForKey): Deleted.
(WebKit::WebPreferences::platformGetDoubleUserValueForKey): Deleted.

UIProcess/win/WebPreferencesWin.cpp: Removed.
UIProcess/wpe/WebPreferencesWPE.cpp: Removed.
WebKit.xcodeproj/project.pbxproj:

8:37 PM Changeset in webkit [254488] by Jon Davis

1 edit
3 adds in trunk/Websites/webkit.org

Add support for Web Inspector pages and topic taxonomy
https://bugs.webkit.org/show_bug.cgi?id=206034

Reviewed by Devin Rousso.

wp-content/plugins/web-inspector-pages.php: Added.
wp-content/themes/webkit/archive-web_inspector_page.php: Added.
wp-content/themes/webkit/single-web_inspector_page.php: Added.

8:21 PM Changeset in webkit [254487] by Keith Rollin

3 edits in trunk/Source/WebKit

Reformat WebProcessPool logging
https://bugs.webkit.org/show_bug.cgi?id=205882
<rdar://problem/58384349>

Reviewed by Brent Fulgham.

Update the format used by WebProcessPool in its RELEASE_LOG logging.
Use the format used by WebPageProxy and NetworkResourceLoader, which
is generally of the form:

<object-address> - [<values that help thread together operations>] <class>::<method>: <message and other useful values>

So, for example:

Using prewarmed process 0

becomes:

0x7f81e8804008 - WebProcessPool::processForRegistrableDomain: Using prewarmed process (process=0x1471c2a00, PID=64197)

No new tests - no added or changed functionality.

UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::applicationIsAboutToSuspend):

UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::establishWorkerContextConnectionToNetworkProcess):
(WebKit::WebProcessPool::tryTakePrewarmedProcess):
(WebKit::WebProcessPool::prewarmProcess):
(WebKit::WebProcessPool::processForRegistrableDomain):
(WebKit::WebProcessPool::didReachGoodTimeToPrewarm):
(WebKit::WebProcessPool::handleMemoryPressureWarning):
(WebKit::WebProcessPool::processForNavigation):
(WebKit::WebProcessPool::processForNavigationInternal):
(WebKit::WebProcessPool::setWebProcessHasUploads):
(WebKit::WebProcessPool::clearWebProcessHasUploads):
(WebKit::WebProcessPool::setWebProcessIsPlayingAudibleMedia):
(WebKit::WebProcessPool::clearWebProcessIsPlayingAudibleMedia):
(WebKit::WebProcessPool::setUseSeparateServiceWorkerProcess):

8:05 PM Changeset in webkit [254486] by Pablo Saavedra

11 edits in trunk/LayoutTests

[GTK] Many imported/w3c/web-platform-tests/html/ tests failing after r253791
https://bugs.webkit.org/show_bug.cgi?id=206127

Reviewed by Philippe Normand.

LayoutTests/imported/w3c:

web-platform-tests/html/semantics/embedded-content/media-elements/ready-states/autoplay-with-slow-text-tracks-expected.txt:

LayoutTests:

platform/gtk/TestExpectations:
platform/gtk/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt:
platform/gtk/imported/w3c/web-platform-tests/html/semantics/forms/the-form-element/form-autocomplete-expected.txt:
platform/gtk/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-showModal-expected.txt:
platform/gtk/imported/w3c/web-platform-tests/html/semantics/interfaces-expected.txt:
platform/wpe/TestExpectations:
platform/wpe/imported/w3c/web-platform-tests/html/dom/reflection-forms-expected.txt:
platform/wpe/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-showModal-expected.txt:

7:44 PM Changeset in webkit [254485] by Devin Rousso

3 edits in trunk/Source/WebInspectorUI

Web Inspector: "Enable Local Override" and "Delete Local Override" are displayed twice in the contextual menu
https://bugs.webkit.org/show_bug.cgi?id=206184
<rdar://problem/58409880>

Reviewed by Brian Burg.

UserInterface/Views/ContextMenuUtilities.js:

(WI.appendContextMenuItemsForSourceCode):

UserInterface/Views/LocalResourceOverrideTreeElement.js:

(WI.LocalResourceOverrideTreeElement.prototype.populateContextMenu):
Add an expando flag that can be set by WI.LocalResourceOverrideTreeElement to ensure that
the local override context menu items aren't added again by WI.ResourceTreeElement.

7:28 PM Changeset in webkit [254484] by Alan Bujtas

3 edits
2 adds in trunk

RenderTreeBuilder::Block::attachIgnoringContinuation should handle inline-block anonymous containers.
https://bugs.webkit.org/show_bug.cgi?id=202913
<rdar://problem/56233694>

Reviewed by Simon Fraser.

Source/WebCore:

When the before child happens to be a block level box wrapped in an anonymous inline-block (e.g. ruby),
let's attach this new child before the anonymous inline-block wrapper instead.

Test: fast/ruby/before-child-is-block-after.html

rendering/updating/RenderTreeBuilderBlock.cpp:

(WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation):

LayoutTests:

fast/ruby/before-child-is-block-after-expected.txt: Added.
fast/ruby/before-child-is-block-after.html: Added.

7:18 PM Changeset in webkit [254483] by Darin Adler

8 edits in trunk/Source/WebCore

Remove the "needsFullOrderingComparisons" feature from PODRedBlackTree
https://bugs.webkit.org/show_bug.cgi?id=205238

Reviewed by Sam Weinig.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::updateActiveTextTrackCues): Simplified code and
eliminate uses of the createInterval function to construct PODInterval objects.
(WebCore::HTMLMediaElement::textTrackAddCue): Ditto.
(WebCore::HTMLMediaElement::textTrackRemoveCue): Ditto.

html/HTMLMediaElement.h: Removed unnecessary include of PODInterval.h.

html/shadow/MediaControlElements.cpp: Added include of PODInterval.h.

platform/PODInterval.h: Changed operator< to compare low, high, and user

data, not just low and high so it's consistent with operator== and we
can use it to search a tree. Added a partial specialization for WeakPtr
since a WeakPtr's value can change (to null) so it can't be used for
ordering and equality checks; luckily the clients don't need to use it
that way; they build an interval tree but never search for anything or
remove anything from the tree.

platform/PODIntervalTree.h: Make the search adapter used to find overlaps

a member class instead of a top level class template and simplified it a bit.
Removed the unneeded createInterval function. Stopped passing true for
"needsFullOrderingComparisons" since it's not needed any more due to the
changes to PODInterval.

platform/PODRedBlackTree.h: Removed the "needsFullOrderingComparisons"

template argument for the PODRedBlackTree class template.
(WebCore::PODRedBlackTree::Node::moveDataFrom): Take a reference (why not,
since this always requires a non-null pointer).
(WebCore::PODRedBlackTree::updateNode): Ditto.
(WebCore::PODRedBlackTree::treeSearch const): Merged the three search
functions into a single one since we don't need the peculiar
"full comparisons" mode.
(WebCore::PODRedBlackTree::propagateUpdates): Simplified logic to remove
the boolean local variable.
(WebCore::PODRedBlackTree::dumpSubtree const): Renamed from dumpFromNode
since the comment said "dumps the subtree". Also removed the comment now
that the function name says what it said.

rendering/FloatingObjects.h: Removed unnecessary include of PODInterval.h.

7:15 PM Changeset in webkit [254482] by wilander@apple.com

3 edits in trunk/LayoutTests

Remove calls to testRunner.installStatisticsDidModifyDataRecordsCallback() in http/tests/resourceLoadStatistics/classify-as-non-prevalent-based-on-sub-frame-under-top-frame-origins*
https://bugs.webkit.org/show_bug.cgi?id=206188
<rdar://problem/58540033>

Unreviewed test gardening.

Removed the calls to testRunner.installStatisticsDidModifyDataRecordsCallback()
to address flakiness.

http/tests/resourceLoadStatistics/classify-as-non-prevalent-based-on-sub-frame-under-top-frame-origins-database.html:
http/tests/resourceLoadStatistics/classify-as-non-prevalent-based-on-sub-frame-under-top-frame-origins.html:

6:34 PM Changeset in webkit [254481] by Justin Fan

19 edits in trunk

[WebGL 2] Implement transform feedback and pass transform feedback conformance tests
https://bugs.webkit.org/show_bug.cgi?id=205823

Reviewed by Dean Jackson.

Source/WebCore:

Covered by webgl/2.0.0/conformance2/transform_feedback conformance tests.

bindings/js/JSDOMConvertWebGL.cpp:

(WebCore::convertToJSValue):

html/canvas/WebGL2RenderingContext.cpp:

(WebCore::WebGL2RenderingContext::WebGL2RenderingContext):
(WebCore::WebGL2RenderingContext::~WebGL2RenderingContext):
(WebCore::WebGL2RenderingContext::initializeTransformFeedbackBufferCache):
(WebCore::WebGL2RenderingContext::getBufferSubData): ANGLE validation in mapBufferRange may fail; prevent copying from a nullptr.
(WebCore::WebGL2RenderingContext::vertexAttribIPointer):

Bare minimum stubs to get WebGLQuery passing transform_feedback tests:
(WebCore::WebGL2RenderingContext::createQuery):
(WebCore::WebGL2RenderingContext::beginQuery):
(WebCore::WebGL2RenderingContext::endQuery):
(WebCore::WebGL2RenderingContext::getQueryParameter):
(WebCore::WebGLQuery::WebGLQuery):

html/canvas/WebGLQuery.h:

Transform feedback functions:
(WebCore::WebGL2RenderingContext::createTransformFeedback):
(WebCore::WebGL2RenderingContext::deleteTransformFeedback):
(WebCore::WebGL2RenderingContext::isTransformFeedback):
(WebCore::WebGL2RenderingContext::bindTransformFeedback):
(WebCore::WebGL2RenderingContext::beginTransformFeedback):
(WebCore::WebGL2RenderingContext::endTransformFeedback):
(WebCore::WebGL2RenderingContext::transformFeedbackVaryings):
(WebCore::WebGL2RenderingContext::getTransformFeedbackVarying):

html/canvas/WebGLTransformFeedback.cpp:

(WebCore::WebGLTransformFeedback::WebGLTransformFeedback):
(WebCore::WebGLTransformFeedback::deleteObjectImpl):

Misc functions that needed added functionality:
(WebCore::WebGL2RenderingContext::bindBufferBase):
(WebCore::WebGL2RenderingContext::getIndexedParameter):
(WebCore::WebGL2RenderingContext::getParameter):

Helper functions to track WebGL2 state/objects:
(WebCore::WebGL2RenderingContext::uncacheDeletedBuffer):

html/canvas/WebGL2RenderingContext.h:
html/canvas/WebGLAny.h:
html/canvas/WebGLBuffer.cpp:

(WebCore::WebGLBuffer::setTarget):

html/canvas/WebGLBuffer.h:
html/canvas/WebGLQuery.cpp:
html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::WebGLRenderingContextBase::validateAndCacheBufferBinding):
(WebCore::WebGLRenderingContextBase::bindBuffer):
(WebCore::WebGLRenderingContextBase::uncacheDeletedBuffer):
(WebCore::WebGLRenderingContextBase::deleteBuffer):
(WebCore::WebGLRenderingContextBase::getProgramParameter):

html/canvas/WebGLRenderingContextBase.h:

Pipe new GraphicsContextGL methods to ANGLE:

platform/graphics/GraphicsContextGL.h:
platform/graphics/angle/GraphicsContextGLANGLE.cpp:

(WebCore::GraphicsContextGLOpenGL::vertexAttribIPointer):
(WebCore::GraphicsContextGLOpenGL::createQuery):
(WebCore::GraphicsContextGLOpenGL::beginQuery):
(WebCore::GraphicsContextGLOpenGL::endQuery):
(WebCore::GraphicsContextGLOpenGL::getQueryObjectuiv):
(WebCore::GraphicsContextGLOpenGL::createTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::deleteTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::isTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::bindTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::beginTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::endTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::transformFeedbackVaryings):
(WebCore::GraphicsContextGLOpenGL::getTransformFeedbackVarying):
(WebCore::GraphicsContextGLOpenGL::bindBufferBase):

Add missing unrelated GraphicsContextGL stubs for ANGLE builds:

platform/graphics/angle/GraphicsContextGLANGLE.cpp:

(WebCore::GraphicsContextGLOpenGL::vertexAttribIPointer):
(WebCore::GraphicsContextGLOpenGL::getUniformBlockIndex):
(WebCore::GraphicsContextGLOpenGL::getActiveUniformBlockiv):
(WebCore::GraphicsContextGLOpenGL::getActiveUniformBlockName):
(WebCore::GraphicsContextGLOpenGL::uniformBlockBinding):
(WebCore::GraphicsContextGLOpenGL::createQuery):
(WebCore::GraphicsContextGLOpenGL::beginQuery):
(WebCore::GraphicsContextGLOpenGL::endQuery):
(WebCore::GraphicsContextGLOpenGL::getQueryObjectuiv):
(WebCore::GraphicsContextGLOpenGL::createTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::deleteTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::isTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::bindTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::beginTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::endTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::transformFeedbackVaryings):
(WebCore::GraphicsContextGLOpenGL::getTransformFeedbackVarying):
(WebCore::GraphicsContextGLOpenGL::bindBufferBase):
(WebCore::GraphicsContextGLOpenGL::bufferData):
(WebCore::GraphicsContextGLOpenGL::bufferSubData):
(WebCore::GraphicsContextGLOpenGL::getBufferSubData):
(WebCore::GraphicsContextGLOpenGL::blitFramebuffer):
(WebCore::GraphicsContextGLOpenGL::framebufferTextureLayer):
(WebCore::GraphicsContextGLOpenGL::invalidateFramebuffer):
(WebCore::GraphicsContextGLOpenGL::invalidateSubFramebuffer):
(WebCore::GraphicsContextGLOpenGL::readBuffer):
(WebCore::GraphicsContextGLOpenGL::texImage3D):
(WebCore::GraphicsContextGLOpenGL::texSubImage3D):
(WebCore::GraphicsContextGLOpenGL::copyTexSubImage3D):
(WebCore::GraphicsContextGLOpenGL::compressedTexImage3D):
(WebCore::GraphicsContextGLOpenGL::compressedTexSubImage3D):
(WebCore::GraphicsContextGLOpenGL::getFragDataLocation):
(WebCore::GraphicsContextGLOpenGL::uniform1ui):
(WebCore::GraphicsContextGLOpenGL::uniform2ui):
(WebCore::GraphicsContextGLOpenGL::uniform3ui):
(WebCore::GraphicsContextGLOpenGL::uniform4ui):
(WebCore::GraphicsContextGLOpenGL::uniform1uiv):
(WebCore::GraphicsContextGLOpenGL::uniform2uiv):
(WebCore::GraphicsContextGLOpenGL::uniform3uiv):
(WebCore::GraphicsContextGLOpenGL::uniform4uiv):
(WebCore::GraphicsContextGLOpenGL::uniformMatrix2x3fv):
(WebCore::GraphicsContextGLOpenGL::uniformMatrix3x2fv):
(WebCore::GraphicsContextGLOpenGL::uniformMatrix2x4fv):
(WebCore::GraphicsContextGLOpenGL::uniformMatrix4x2fv):
(WebCore::GraphicsContextGLOpenGL::uniformMatrix3x4fv):
(WebCore::GraphicsContextGLOpenGL::uniformMatrix4x3fv):
(WebCore::GraphicsContextGLOpenGL::vertexAttribI4i):
(WebCore::GraphicsContextGLOpenGL::vertexAttribI4iv):
(WebCore::GraphicsContextGLOpenGL::vertexAttribI4ui):
(WebCore::GraphicsContextGLOpenGL::vertexAttribI4uiv):
(WebCore::GraphicsContextGLOpenGL::drawRangeElements):
(WebCore::GraphicsContextGLOpenGL::drawBuffers):
(WebCore::GraphicsContextGLOpenGL::clearBufferiv):
(WebCore::GraphicsContextGLOpenGL::clearBufferuiv):
(WebCore::GraphicsContextGLOpenGL::clearBufferfv):
(WebCore::GraphicsContextGLOpenGL::clearBufferfi):
(WebCore::GraphicsContextGLOpenGL::deleteQuery):
(WebCore::GraphicsContextGLOpenGL::isQuery):
(WebCore::GraphicsContextGLOpenGL::getQuery):
(WebCore::GraphicsContextGLOpenGL::createSampler):
(WebCore::GraphicsContextGLOpenGL::deleteSampler):
(WebCore::GraphicsContextGLOpenGL::isSampler):
(WebCore::GraphicsContextGLOpenGL::bindSampler):
(WebCore::GraphicsContextGLOpenGL::samplerParameteri):
(WebCore::GraphicsContextGLOpenGL::samplerParameterf):
(WebCore::GraphicsContextGLOpenGL::getSamplerParameterfv):
(WebCore::GraphicsContextGLOpenGL::getSamplerParameteriv):
(WebCore::GraphicsContextGLOpenGL::fenceSync):
(WebCore::GraphicsContextGLOpenGL::isSync):
(WebCore::GraphicsContextGLOpenGL::deleteSync):
(WebCore::GraphicsContextGLOpenGL::clientWaitSync):
(WebCore::GraphicsContextGLOpenGL::waitSync):
(WebCore::GraphicsContextGLOpenGL::getSynciv):
(WebCore::GraphicsContextGLOpenGL::pauseTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::resumeTransformFeedback):
(WebCore::GraphicsContextGLOpenGL::bindBufferRange):
(WebCore::GraphicsContextGLOpenGL::getUniformIndices):
(WebCore::GraphicsContextGLOpenGL::texImage2D):
(WebCore::GraphicsContextGLOpenGL::texSubImage2D):
(WebCore::GraphicsContextGLOpenGL::compressedTexImage2D):
(WebCore::GraphicsContextGLOpenGL::compressedTexSubImage2D):
(WebCore::GraphicsContextGLOpenGL::uniform1fv):
(WebCore::GraphicsContextGLOpenGL::uniform2fv):
(WebCore::GraphicsContextGLOpenGL::uniform3fv):
(WebCore::GraphicsContextGLOpenGL::uniform4fv):
(WebCore::GraphicsContextGLOpenGL::uniform1iv):
(WebCore::GraphicsContextGLOpenGL::uniform2iv):
(WebCore::GraphicsContextGLOpenGL::uniform3iv):
(WebCore::GraphicsContextGLOpenGL::uniform4iv):
(WebCore::GraphicsContextGLOpenGL::uniformMatrix2fv):
(WebCore::GraphicsContextGLOpenGL::uniformMatrix3fv):
(WebCore::GraphicsContextGLOpenGL::uniformMatrix4fv):
(WebCore::GraphicsContextGLOpenGL::readPixels):

platform/graphics/opengl/GraphicsContextGLOpenGL.h:
platform/graphics/opengl/GraphicsContextGLOpenGLCommon.cpp:

(WebCore::GraphicsContextGLOpenGL::getQueryObjectuiv):
(WebCore::GraphicsContextGLOpenGL::getTransformFeedbackVarying):
(WebCore::GraphicsContextGLOpenGL::glGetQueryObjectuiv): Deleted.

LayoutTests:

Add passing results for transform_feedback, as expected when ANGLE is enabled.

webgl/2.0.0/conformance2/transform_feedback/two-unreferenced-varyings-expected.txt:
webgl/2.0.0/conformance2/transform_feedback/unwritten-output-defaults-to-zero-expected.txt:

5:43 PM Changeset in webkit [254480] by sbarati@apple.com

25 edits in trunk

Throw away baseline code if there is an optimized replacement
https://bugs.webkit.org/show_bug.cgi?id=202503

Reviewed by Yusuke Suzuki.

JSTests:

stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js:
stress/getter-setter-inlining-should-emit-movhint.js:
stress/make-dictionary-repatch.js:
stress/merging-ic-variants-should-bail-if-structures-overlap.js:
stress/proxy-getter-stack-overflow.js:
stress/regress-192717.js:
stress/retry-cache-later.js:

Source/JavaScriptCore:

This patch's goal is to help us save JIT executable memory by throwing
away baseline code when it has an optimized replacement. To make it
easy to reason about, we do this when finalizing a GC, and when the
CodeBlock is not on the stack. When we do this, we throw away all JIT
data and unlink all incoming calls.

This patch also paves the way for the LOL tier by making it so we always
exit to the LLInt. This allows the code in CodeBlock finalization to not
have to consider whether or not an an OSR exit is wired to baseline
JIT code, since all exits are now to the LLInt. Because of this, this
patch removes the forceOSRExitToLLInt option. Also, this patch renames
the useLLInt option to forceBaseline and inverts its meaning.
Options::forceBaseline=true implies that code will start off executing in
the baseline JIT instead of the LLInt. However, it won't prevent us from
emitting an OSR exit which jumps to LLInt code.

API/tests/ExecutionTimeLimitTest.cpp:

(testExecutionTimeLimit):

API/tests/PingPongStackOverflowTest.cpp:

(testPingPongStackOverflow):

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::resetJITData):
(JSC::CodeBlock::optimizedReplacement):
(JSC::CodeBlock::hasOptimizedReplacement):
(JSC::CodeBlock::tallyFrequentExitSites):
(JSC::CodeBlock::findStubInfo): Deleted.
(JSC::CodeBlock::getCallLinkInfoForBytecodeIndex): Deleted.

bytecode/CodeBlock.h:

(JSC::CodeBlock::setJITCode):

dfg/DFGDriver.cpp:

(JSC::DFG::compileImpl):

dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::callerReturnPC):
(JSC::DFG::reifyInlinedCallFrames):
(JSC::DFG::adjustAndJumpToTarget):

dfg/DFGOSRExitCompilerCommon.h:
heap/CodeBlockSet.cpp:

(JSC::CodeBlockSet::isCurrentlyExecuting):

heap/CodeBlockSet.h:
heap/Heap.cpp:

(JSC::Heap::finalizeUnconditionalFinalizers):
(JSC::Heap::runEndPhase):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::dispatchToNextInstruction):

runtime/Options.cpp:

(JSC::recomputeDependentOptions):
(JSC::Options::initialize):
(JSC::Options::ensureOptionsAreCoherent):

runtime/OptionsList.h:
runtime/ScriptExecutable.cpp:

(JSC::ScriptExecutable::prepareForExecutionImpl):

Tools:

Scripts/run-jsc-stress-tests:

5:37 PM Changeset in webkit [254479] by yoshiaki.jitsukawa@sony.com

3 edits in trunk/Tools

Fix path-specific filters on Windows
https://bugs.webkit.org/show_bug.cgi?id=205786

Reviewed by David Kilzer.

Scripts/webkitpy/style/filter.py:

(FilterConfiguration._path_rules_from_path):
Convert forward slashes to backward slashes on Windows by using
os.path.normcase(). Nothing changed on other OSs.

Scripts/webkitpy/style/filter_unittest.py:

(FilterConfigurationTest.test_path_with_different_case):

5:10 PM Changeset in webkit [254478] by Alan Coon

2 edits in branches/safari-609-branch/Tools

Cherry-pick r254440. rdar://problem/58530962

Don't softlink AVCapture classes on watchOS or tvOS
https://bugs.webkit.org/show_bug.cgi?id=205974
<rdar://problem/58427281>

Unreviewed test fix after r254257.

TestWebKitAPI/Tests/WebCore/cocoa/AVFoundationSoftLinkTest.mm: (TestWebKitAPI::TEST):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@254440 268f45cc-cd09-0410-ab3c-d52691b4dbfc

5:10 PM Changeset in webkit [254477] by Alan Coon

3 edits
4 adds in branches/safari-609-branch

Cherry-pick r254349. rdar://problem/58529720

ObjectAllocationSinkingPhase doesn't model pointers to allocations in control flow properly
https://bugs.webkit.org/show_bug.cgi?id=204738
<rdar://problem/57553238>

Reviewed by Yusuke Suzuki.

JSTests:

stress/allocation-sinking-must-model-allocation-pointers-properly-2.js: Added. (assert): (v9):
stress/allocation-sinking-must-model-allocation-pointers-properly-3.js: Added. (assert): (v9):
stress/allocation-sinking-must-model-allocation-pointers-properly-4.js: Added. (bool): (effects): (escape): (bar):
stress/allocation-sinking-must-model-allocation-pointers-properly.js: Added. (alwaysFalse): (sometimesZero): (assert): (v9):

Source/JavaScriptCore:

Allocation sinking phase conducts a points to analysis. It uses this
information for programs like:

`
1: NewObject
2: NewObject
3: PutByOffset(@2, @1, "x")
4: GetByOffset(@2, "x")
`

It solves the points to problem knowing @4 points to @1.

It tracks this data in the LocalHeap data structure. This is used to track
the heap across blocks, and it includes a merge function to handle control
flow merges. However, this merge function would not always merge the pointer
sets together. It sometimes would merge them together, since it had a fast
path check inside merge, which would just copy the contents of the block to be
merged with itself if it were this block's first time merging. This fast path happened
to hide the bug in general case merge code. If we didn't take this fast path,
we would just never transfer pointer sets from predecessor to successor. This
could lead to all kinds of issues, including using the incorrect phantom node
in IR instead of its materialized version. It could also lead to the phase not
sinking objects it is capable of sinking.

This patch makes it so that we merge together the pointer sets. We always add
new pointers to the set. So in pointer A->B, if the set has yet to see A, we
add it. If the set already contains pointer A->B, and we encounter a new
pointer A->C, or if we encounter a merge without any A->* pointer, we mark
the A pointer as top, marking it A->TOP. We do this to ensure that we fixpoint.
We're guaranteed that m_pointers is monotonically increasing (module liveness
pruning, which is a constant). And once something is TOP, it never becomes
anything else. (Instead of marking a pointer top, we used to just remove it
from the set, but this has issues, as it could lead to us ping-ponging in
our fixpoint analysis, add, remove, add, remove, etc.)

So the merge rules are:
{A->B} merge {A->B} => {A->B}
{A->B} merge {A->C} => {A->TOP}
{A->B} merge {A->TOP} => {A->TOP}
{A->B} merge {} => {A->TOP}

Thanks to Samuel Groß of Google Project Zero for identifying this bug.

dfg/DFGObjectAllocationSinkingPhase.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@254349 268f45cc-cd09-0410-ab3c-d52691b4dbfc

5:10 PM Changeset in webkit [254476] by Alan Coon

3 edits in branches/safari-609-branch/Source/WebCore/PAL

Cherry-pick r254257. rdar://problem/58530962

Don't softlink AVCapture classes on watchOS or tvOS
https://bugs.webkit.org/show_bug.cgi?id=205974
<rdar://problem/45508044>

Reviewed by Jon Lee.

pal/cocoa/AVFoundationSoftLink.h:
pal/cocoa/AVFoundationSoftLink.mm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@254257 268f45cc-cd09-0410-ab3c-d52691b4dbfc

5:10 PM Changeset in webkit [254475] by Alan Coon

3 edits
2 adds in branches/safari-609-branch

Cherry-pick r254220. rdar://problem/58429234

Fix specification violation in Font Loading API
https://bugs.webkit.org/show_bug.cgi?id=205901
<rdar://problem/58083743>

Reviewed by Brent Fulgham.

Source/WebCore:

Our Font Loading API does not comply with the spec:

If the parsed value is a CSS-wide keyword, return a syntax error.

Rather than crashing, we should return a syntax error.

Test: fast/text/font-loading-global-keyword.html

css/CSSFontFaceSet.cpp: (WebCore::computeFontSelectionRequest): (WebCore::CSSFontFaceSet::matchingFacesExcludingPreinstalledFonts):

LayoutTests:

Test all the entry points to the CSS Font Loading API that accept CSS keywords.

fast/text/font-loading-global-keyword-expected.txt: Added.
fast/text/font-loading-global-keyword.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@254220 268f45cc-cd09-0410-ab3c-d52691b4dbfc

5:10 PM Changeset in webkit [254474] by Alan Coon

7 edits in branches/safari-609-branch/Source/WebKit

Cherry-pick r254101. rdar://problem/58535157

[iOS] Get display level in the UI process for all iOS platforms
https://bugs.webkit.org/show_bug.cgi?id=205835
<rdar://problem/58116883>

Reviewed by Brent Fulgham.

This was previously only done for iOS, but should be done for all iOS platforms.

UIProcess/Cocoa/WebProcessPoolCocoa.mm: (WebKit::WebProcessPool::registerNotificationObservers):
UIProcess/WebProcessPool.cpp: (WebKit::WebProcessPool::initializeNewWebProcess):
UIProcess/WebProcessPool.h:
WebProcess/WebProcess.h:
WebProcess/WebProcess.messages.in:
WebProcess/cocoa/WebProcessCocoa.mm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@254101 268f45cc-cd09-0410-ab3c-d52691b4dbfc

5:08 PM Changeset in webkit [254473] by ddkilzer@apple.com

2 edits in trunk/Tools

WTR::TestController::decidePolicyForPluginLoad() should output bundle identifier on release assert
<https://webkit.org/b/206105>

Reviewed by Brent Fulgham.

WebKitTestRunner/TestController.cpp:

(WTR::TestController::decidePolicyForPluginLoad): Change
RELEASE_ASSERT_NOT_REACHED() to
RELEASE_ASSERT_NOT_REACHED_WITH_MESSAGE() with bundle
identifier.

4:39 PM Changeset in webkit [254472] by Kate Cheney

4 edits in trunk/Source/WebKit

_WKResourceLoadStatisticsFirstParty should be forward declared not imported in _WKResourceLoadStatisticsThirdParty
https://bugs.webkit.org/show_bug.cgi?id=206183
<rdar://problem/58535245>

Reviewed by Alex Christensen.

UIProcess/API/Cocoa/_WKResourceLoadStatisticsFirstParty.h:
UIProcess/API/Cocoa/_WKResourceLoadStatisticsThirdParty.h:
UIProcess/API/Cocoa/_WKResourceLoadStatisticsThirdParty.mm:

The additional import statement here was unnecessary because
this file imports _WKResourceLoadStatisticsThirdPartyInternal.h
which forward declares the _WKResourceLoadStatisticsFirstParty class.

4:28 PM Changeset in webkit [254471] by Ross Kirsling

2 edits in trunk/Source/WebCore

Unreviewed build fix for PlayStation and clang-cl.

clang for Windows (< v10.0.0) cannot destructure a const class. See also r249524.

rendering/InlineTextBox.cpp:

(WebCore::InlineTextBox::collectMarkedTextsForHighlights const):

4:15 PM Changeset in webkit [254470] by Alan Coon

8 edits in branches/safari-609-branch/Source

Versioning.

4:13 PM Changeset in webkit [254469] by Kate Cheney

2 edits in trunk/Source/WebKit

Unreviewed followup fix to: https://bugs.webkit.org/show_bug.cgi?id=205288.
This flag should be off-by-default.

Shared/WebPreferences.yaml:

4:11 PM Changeset in webkit [254468] by Truitt Savell

2 edits in trunk/Source/WebCore

Unreviewed, rolling out r254463.

Broke all Mac and iOS Builds.

Reverted changeset:

"Unreviewed build fix for PlayStation and clang-cl."
https://trac.webkit.org/changeset/254463

4:08 PM Changeset in webkit [254467] by commit-queue@webkit.org

1568 edits
2 copies
39 adds
2 deletes in trunk/LayoutTests

REGRESSION(r253683): [GTK][WPE] Lots of offscreen-canvas WPT tests failing
https://bugs.webkit.org/show_bug.cgi?id=205445

Patch by Chris Lord <Chris Lord> on 2020-01-13
Reviewed by Carlos Alberto Lopez Perez.

Bug 205445 - Update and re-enable OffscreenCanvas tests

LayoutTests/imported/w3c:

resources/import-expectations.json:
web-platform-tests/fetch/nosniff/image-expected.txt: Newly passing test, presumable due to previously missing resource.
web-platform-tests/images/*: Updated.
web-platform-tests/offscreen-canvas/*: Updated.

LayoutTests:

platform/gtk/TestExpectations:
platform/wpe/TestExpectations:

4:05 PM Changeset in webkit [254466] by Alan Coon

8 edits in branches/safari-609.1.14-branch/Source

Versioning.

3:57 PM Changeset in webkit [254465] by youenn@apple.com

3 edits in trunk/Source/WebCore

Clean-up MediaPlayerPrivateMediaStreamAVFObjC.h/.mm
https://bugs.webkit.org/show_bug.cgi?id=206060

Reviewed by Eric Carlson.

No change of behavior.

platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:

3:55 PM Changeset in webkit [254464] by mark.lam@apple.com

45 edits
4 adds in trunk

Replace uses of Box<Identifier> with a new CacheableIdentifier class.
https://bugs.webkit.org/show_bug.cgi?id=205544
<rdar://problem/58041800>

Reviewed by Saam Barati.

JSTests:

stress/racy-gc-cleanup-of-identifier-after-mutator-stops-running.js: Added.

Source/JavaScriptCore:

The introduction of the use of Box<Identifier> was to get around having to
ref/deref the underlying UniqedStringImpl in Identifiers from the compiler
and GC threads. However, it proves to be difficult to control when these
Box<Identifier>s get destructed, and requires that we find all the places in
the compier and GC threads where this can happen, and apply keep alive tactics
there to defer destruction of the Box<Identifier> to the mutator thread.

This patch fixes this by replacing uses of Box<Identifier> with
CacheableIdentifier, which is effectively a tagged union of a JSCell* or a
UniquedStringImpl*. The JSCell*, in this case, can be either a Symbol* or a
JSString* that is backed by an atom string. The VM runtime ensures that we'll
never try to cache an identifier from a JSCell that is not one of these. This
CacheableIdentifier can be destructed from the compiler or GC thread. Since it
doesn't hold a ref of the underlying UniquedStringImpl, it won't try to deref
it on destruction.

Instead, we'll need to visit CacheableIdentifiers during GC scans to keep the
JSCell in it alive, and that JSCell will, in turn, keep the underlying
UniquedStringImpl alive.

This patch also does the following:

Add a visitAggregate() method to StructureStubInfo, PolymorphicAccess, and AccessCase to visit the CacheableIdentifier's JSCell identifier. This visitAggregate() is called from CodeBlock::stronglyVisitStrongReferences().

When we write barrier a CodeBlock, it guarantees that its visitAggregate()
methods is called. However, it does not guarantee that its propagateTransitions()
method will be called. Since the CacheableIdentifier's reference to a cell
should be a strong reference, visiting it via a StructureStubInfo::visitAggregate()
method is the right thing to do.
See https://bugs.webkit.org/show_bug.cgi?id=205544#c7 for an example of why
propagateTransitions() doesn't always do the job.

StructureStubInfo::visitWeakReferences() is also inappropriate for this
because it is only called after all marking is done. It is also not meant
to keep cells alive but merely for clearing weak references to dead cells.

Also add to visitAggregate() for ModuleNamespaceData's m_identifier in GetByStatus::markIfCheap().

Remove previously applied keep alive tactics to work around Box<Identifier> destruction. This also retores the allowance to destruct DFG::Plans on a compiler thread.

Added a JSString:getValueImpl() helper.

Added a write barrier in DFG and FTL JITFinalizer's finalizeCommon() to ensure that frozen values are scanned by the GC.

During compilation, the frozen values were previously protected by the Plan.
After finalization, they should be protected by the CodeBlock. Hence, we
should barrier the CodeBlock since the last GC scan of the CodeBlock may have
happened before the frozen values were registered with the CodeBlock.

GC considerations:
==================
The following also addresses Yusuke's concerns in https://bugs.webkit.org/show_bug.cgi?id=205544#c10.

CacheableIdentifier is only stored as fields in 4 classes/structs:

AccessCase::m_identifier
GetByIdVariant::m_identifier
ModuleNamespaceData::m_identifier
StructureStubInfo::m_getByIdSelfIdentifier

AccessCase::m_identifier
========================
While the access case is being created and added in tryCacheGetBy(), the
CacheableIdentifier is still on the stack and protected from the GC. At the
bottom of tryCacheGetBy(), StructureStubInfo::addAccessCase() is called to add
the access case.

StructureStubInfo::addAccessCase() will barrier the owner CodeBlock at its end,
and CodeBlock::stronglyVisitStrongReferences() will visit the StructureStubInfo,
which in turn visits the AccessCase. StructureStubInfo::visitAggregate() has
been added for this purpose.

GetByIdVariant::m_identifier
============================
GetByIdVariant is only stored in GetByStatus. Both GetByIdVariant and GetByStatus
are only created and handled in the DFG/FTL compiler threads. While the compiler
thread is working with them, they are safe from the GC because the GC won't collect
objects until the compiler thread is at a SafePoint.

At compiler SafePoints, any GetByStatus that needs to be persisted is stored in
DFG::Plan::m_recordedStatuses. The Plan will visit the m_recordedStatuses in
Plan::checkLivenessAndVisitChildren().

At the end of compilation, Plan::m_recordedStatuses is transferred over to the owner
CodeBlock's DFG::CommonData in Plan::finalizeWithoutNotifyingCallback().
Plan::finalizeWithoutNotifyingCallback() will also barrier the owner CodeBlock at
its end.

Thereafter, CodeBlock::stronglyVisitStrongReferences() will visit the recordedStatuses.

ModuleNamespaceData::m_identifier
=================================
ModuleNamespaceData is only stored in a GetByStatus, and is therefore protected
similarly as the GetByIdVariant::m_identifier case above.

StructureStubInfo::m_getByIdSelfIdentifier
==========================================
StructureStubInfo::initGetByIdSelf() is called from inside tryCacheGetBy().
StructureStubInfo::initGetByIdSelf() will barrier the owner CodeBlock. The
CacheableIdentifier here is protected in the same way as the AccessCase::m_identifier
case above.

DesiredIdentifiers
==================
The compiler thread may also stash a CacheableIdentifier's uid in its
DesiredIdentifiers. Normally, the identifiers stashed in DesiredIdentifiers are
from identifiers that the CodeBlock already knows abut and manages (e.g. from
GetByIds). For uids from a cell-based CacheableIdentifier variable is passed to
a GetByVal, we need kep the cell alive in order to keep the uid alive. This is
achieved by freezing the cell with freezeStrong() in the op_get_by_val case in
the DFG BytecodeParser.

Reseting a StructureStubInfo while its IC code is still executing on the stack
==============================================================================
The concern is that IC code may call slow path / getter functions that may in turn:

reset the IC, and
run the GC.

This can be a problem if:

there is a scenario where we return from the slow path / getter function and run IC code that uses the cell / uid from the CacheableIdentifier.

This is because the StructureStubInfo is what visits the that cell, which
in turn its uid alive. Once the StructureStubInfo is reset, it will no
longer be associated with any AccessCase or the m_getByIdSelfIdentifier.
As such they will not be visited, and the CacheableIdentifier may be collected
by the GC.

In practice, the generated IC code never uses the cell / uid after it calls
any slow path / getter function. I've verified this by auditing the code
generation in InlineAccess::generateSelfInAccess() and PolymorphicAccess::regenerate().
Hence, there's no issue with using a collected cell / uid.

there is a scenario where a slow path / getter function makes use of the cell / uid from the CacheableIdentifier but does not protect it.

The only 2 slow path functions:

operationGetByValGeneric()
operationGetByValOptimize()

operationGetByValGeneric() does not use any CacheableIdentifier from the StructureStubInfo.

operationGetByValOptimize() modifies the StructureStubInfo in tryCacheGetBy()
under the protection of a GCSafeConcurrentJSLocker, and can reset the
StructureStubInfo. However, it does not use any CacheableIdentifier after
that.

Hence, there's also no GC issue here.

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
Sources.txt:
bytecode/AccessCase.cpp:

(JSC::AccessCase::AccessCase):
(JSC::AccessCase::create):
(JSC::AccessCase::fromStructureStubInfo):
(JSC::AccessCase::commit):
(JSC::AccessCase::canReplace const):
(JSC::AccessCase::dump const):
(JSC::AccessCase::visitAggregate const):
(JSC::AccessCase::generateWithGuard):
(JSC::AccessCase::generateImpl):

bytecode/AccessCase.h:

(JSC::AccessCase::uid const):
(JSC::AccessCase::identifier const):

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::propagateTransitions):
(JSC::CodeBlock::stronglyVisitStrongReferences):

bytecode/GetByIdVariant.cpp:

(JSC::GetByIdVariant::GetByIdVariant):
(JSC::GetByIdVariant::attemptToMerge):
(JSC::GetByIdVariant::visitAggregate):
(JSC::GetByIdVariant::dumpInContext const):

bytecode/GetByIdVariant.h:

(JSC::GetByIdVariant::identifier const):
(JSC::GetByIdVariant::overlaps):

bytecode/GetByStatus.cpp:

(JSC::GetByStatus::computeFromLLInt):
(JSC::GetByStatus::computeFor):
(JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
(JSC::GetByStatus::visitAggregate):
(JSC::GetByStatus::singleIdentifier const):

bytecode/GetByStatus.h:
bytecode/GetterSetterAccessCase.cpp:

(JSC::GetterSetterAccessCase::GetterSetterAccessCase):
(JSC::GetterSetterAccessCase::create):

bytecode/GetterSetterAccessCase.h:
bytecode/InstanceOfAccessCase.cpp:

(JSC::InstanceOfAccessCase::InstanceOfAccessCase):

bytecode/IntrinsicGetterAccessCase.cpp:

(JSC::IntrinsicGetterAccessCase::IntrinsicGetterAccessCase):
(JSC::IntrinsicGetterAccessCase::create):

bytecode/IntrinsicGetterAccessCase.h:
bytecode/ModuleNamespaceAccessCase.cpp:

(JSC::ModuleNamespaceAccessCase::ModuleNamespaceAccessCase):
(JSC::ModuleNamespaceAccessCase::create):

bytecode/ModuleNamespaceAccessCase.h:
bytecode/PolymorphicAccess.cpp:

(JSC::PolymorphicAccess::visitAggregate):
(JSC::PolymorphicAccess::regenerate):

bytecode/PolymorphicAccess.h:
bytecode/ProxyableAccessCase.cpp:

(JSC::ProxyableAccessCase::ProxyableAccessCase):
(JSC::ProxyableAccessCase::create):

bytecode/ProxyableAccessCase.h:
bytecode/RecordedStatuses.cpp:

(JSC::RecordedStatuses::visitAggregate):

bytecode/RecordedStatuses.h:
bytecode/StructureStubInfo.cpp:

(JSC::StructureStubInfo::initGetByIdSelf):
(JSC::StructureStubInfo::addAccessCase):
(JSC::StructureStubInfo::visitAggregate):

bytecode/StructureStubInfo.h:

(JSC::StructureStubInfo::getByIdSelfIdentifier):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseGetById):
(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGDesiredIdentifiers.cpp:

(JSC::DFG::DesiredIdentifiers::ensure):
(JSC::DFG::DesiredIdentifiers::at const):
(JSC::DFG::DesiredIdentifiers::reallyAdd):
(JSC::DFG::DesiredIdentifiers::processCodeBlockIdentifiersIfNeeded): Deleted.

dfg/DFGDesiredIdentifiers.h:
dfg/DFGJITFinalizer.cpp:

(JSC::DFG::JITFinalizer::finalizeCommon):

dfg/DFGPlan.cpp:

(JSC::DFG::Plan::~Plan):
(JSC::DFG::Plan::checkLivenessAndVisitChildren):
(JSC::DFG::Plan::cancel):

dfg/DFGPlan.h:

(JSC::DFG::Plan::keepAliveIdentifier): Deleted.

dfg/DFGWorklist.cpp:

(JSC::DFG::Worklist::removeAllReadyPlansForVM):
(JSC::DFG::Worklist::removeDeadPlans):
(JSC::DFG::Worklist::removeNonCompilingPlansForVM):
(JSC::DFG::Worklist::deleteCancelledPlansForVM): Deleted.

dfg/DFGWorklist.h:
ftl/FTLJITFinalizer.cpp:

(JSC::FTL::JITFinalizer::finalizeCommon):

jit/JITOperations.cpp:
jit/Repatch.cpp:

(JSC::tryCacheGetBy):
(JSC::repatchGetBy):
(JSC::tryCacheArrayGetByVal):
(JSC::tryCacheInstanceOf):

jit/Repatch.h:
runtime/CacheableIdentifier.cpp: Added.

(JSC::CacheableIdentifier::dump const):

runtime/CacheableIdentifier.h: Added.

(JSC::CacheableIdentifier::CacheableIdentifier):
(JSC::CacheableIdentifier::isUid const):
(JSC::CacheableIdentifier::isCell const):
(JSC::CacheableIdentifier::isSymbol const):
(JSC::CacheableIdentifier::operator bool const):

runtime/CacheableIdentifierInlines.h: Added.

(JSC::CacheableIdentifier::CacheableIdentifier):
(JSC::CacheableIdentifier::cell const):
(JSC::CacheableIdentifier::uid const):
(JSC::CacheableIdentifier::isCacheableIdentifierCell):
(JSC::CacheableIdentifier::isSymbolCell const):
(JSC::CacheableIdentifier::isStringCell const):
(JSC::CacheableIdentifier::setCellBits):
(JSC::CacheableIdentifier::setUidBits):
(JSC::CacheableIdentifier::visitAggregate const):
(JSC::CacheableIdentifier::operator== const):
(JSC::CacheableIdentifier::operator!= const):

runtime/ExceptionHelpers.cpp:

(JSC::functionCallBase):

runtime/JSString.h:

(JSC::JSString::getValueImpl const):

runtime/VM.cpp:

(JSC::VM::ensureWatchpointSetForImpureProperty):
(JSC::VM::addImpureProperty):
(JSC::VM::registerWatchpointForImpureProperty): Deleted.

runtime/VM.h:

Source/WebCore:

bindings/js/CommonVM.cpp:

(WebCore::addImpureProperty):

3:52 PM Changeset in webkit [254463] by Ross Kirsling

2 edits in trunk/Source/WebCore

Unreviewed build fix for PlayStation and clang-cl.

clang for Windows (< v10.0.0) cannot destructure a const class. See also r249524.

rendering/InlineTextBox.cpp:

(WebCore::InlineTextBox::collectMarkedTextsForHighlights const):

3:37 PM Changeset in webkit [254462] by achristensen@apple.com

2 edits in trunk/Source/WebKit

Propogate UIEdgeInsets from WKWebView to WKSafeBrowsingWarning on iOS
https://bugs.webkit.org/show_bug.cgi?id=206201
<rdar://problem/57135847>

Reviewed by Tim Horton.

Manually verified this fixes the radar.

UIProcess/API/ios/WKWebViewIOS.mm:

(-[WKWebView _computedObscuredInsetForSafeBrowsingWarning]):
(-[WKWebView safeAreaInsetsDidChange]):
(-[WKWebView _setObscuredInsets:]):

3:35 PM Changeset in webkit [254461] by cathiechen

8 edits in trunk/LayoutTests/imported/w3c

Import the update of img-aspect-ratio.html.
https://bugs.webkit.org/show_bug.cgi?id=206160

Reviewed by Frédéric Wang

Use parseFloat() instead of parseInt() in img-aspect-ratio.html.
The resource location was changed to relative in bug 205678. To keep them consistent with others, restore them.

web-platform-tests/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/align.html:
web-platform-tests/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/canvas-aspect-ratio.html:
web-platform-tests/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/content-aspect-ratio.html:
web-platform-tests/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/img-aspect-ratio.html:
web-platform-tests/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/img-no-alt-replaced.html:
web-platform-tests/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/img-replaced-box-while-loading.html:
web-platform-tests/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/video-aspect-ratio.html:

3:20 PM Changeset in webkit [254460] by Alan Coon

8 edits in branches/safari-609-branch/Source

Revert "Versioning."

This reverts revision 254459.

3:17 PM Changeset in webkit [254459] by Alan Coon

8 edits in branches/safari-609-branch/Source

Versioning.

3:06 PM Changeset in webkit [254458] by commit-queue@webkit.org

3 edits
2 adds in trunk

Fix computeFloatVisibleRectInContainer to handle non-SVG object parent
https://bugs.webkit.org/show_bug.cgi?id=205282
Source/WebCore:

<rdar://problem/57975185>

Patch by Sunny He <sunny_he@apple.com> on 2020-01-13
Reviewed by Darin Adler.

Test: svg/dom/replaceChild-document-crash.html

rendering/svg/SVGRenderSupport.cpp:

(WebCore::SVGRenderSupport::computeFloatVisibleRectInContainer):

LayoutTests:

Patch by Sunny He <sunny_he@apple.com> on 2020-01-13
Reviewed by Darin Adler.

svg/dom/replaceChild-document-crash-expected.txt: Added.
svg/dom/replaceChild-document-crash.html: Added.

3:02 PM Changeset in webkit [254457] by Alan Coon

1 copy in branches/safari-609.1.14-branch

New branch.

3:02 PM Changeset in webkit [254456] by Alan Coon

1 delete in branches/safari-609.1.14-branch

Delete branch.

2:54 PM Changeset in webkit [254455] by Alan Coon

1 copy in branches/safari-610.1.1-branch

New branch.

2:27 PM Changeset in webkit [254454] by eric.carlson@apple.com

21 edits
6 adds in trunk

Expose audio tracks for media files in the GPUProcess
https://bugs.webkit.org/show_bug.cgi?id=206152
<rdar://problem/58513227>

Reviewed by youenn fablet.

Source/WebCore:

No new tests, un-skipped existing tests that pass because of this change.

platform/graphics/AudioTrackPrivate.h:
platform/graphics/TrackPrivateBase.h:

Source/WebKit:

GPUProcess/media/RemoteAudioTrackProxy.cpp: Added.

(WebKit::RemoteAudioTrackProxy::RemoteAudioTrackProxy):
(WebKit::RemoteAudioTrackProxy::configuration):
(WebKit::RemoteAudioTrackProxy::configurationChanged):
(WebKit::RemoteAudioTrackProxy::willRemove):
(WebKit::RemoteAudioTrackProxy::enabledChanged):
(WebKit::RemoteAudioTrackProxy::idChanged):
(WebKit::RemoteAudioTrackProxy::labelChanged):
(WebKit::RemoteAudioTrackProxy::languageChanged):

GPUProcess/media/RemoteAudioTrackProxy.h: Added.
GPUProcess/media/RemoteMediaPlayerManagerProxy.cpp:

(WebKit::RemoteMediaPlayerManagerProxy::setRate):
(WebKit::RemoteMediaPlayerManagerProxy::audioTrackSetEnabled):

GPUProcess/media/RemoteMediaPlayerManagerProxy.h:
GPUProcess/media/RemoteMediaPlayerManagerProxy.messages.in:
GPUProcess/media/RemoteMediaPlayerProxy.cpp:

(WebKit::RemoteMediaPlayerProxy::mediaPlayerDidAddAudioTrack):
(WebKit::RemoteMediaPlayerProxy::mediaPlayerDidRemoveAudioTrack):
(WebKit::RemoteMediaPlayerProxy::audioTrackSetEnabled):

GPUProcess/media/RemoteMediaPlayerProxy.h:
GPUProcess/media/TrackPrivateRemoteConfiguration.h: Added.

(WebKit::TrackPrivateRemoteConfiguration::encode const):
(WebKit::TrackPrivateRemoteConfiguration::decode):

GPUProcess/media/TrackPrivateRemoteIdentifier.h: Added.
Scripts/webkit/messages.py:
Sources.txt:
WebKit.xcodeproj/project.pbxproj:
WebProcess/GPU/media/AudioTrackPrivateRemote.cpp: Added.

(WebKit::AudioTrackPrivateRemote::AudioTrackPrivateRemote):
(WebKit::AudioTrackPrivateRemote::setEnabled):
(WebKit::AudioTrackPrivateRemote::updateConfiguration):

WebProcess/GPU/media/AudioTrackPrivateRemote.h: Added.

(WebKit::AudioTrackPrivateRemote::create):

WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp:

(WebKit::MediaPlayerPrivateRemote::addRemoteAudioTrack):
(WebKit::MediaPlayerPrivateRemote::removeRemoteAudioTrack):
(WebKit::MediaPlayerPrivateRemote::remoteAudioTrackConfigurationChanged):

WebProcess/GPU/media/MediaPlayerPrivateRemote.h:
WebProcess/GPU/media/RemoteMediaPlayerManager.cpp:

(WebKit::RemoteMediaPlayerManager::timeChanged):
(WebKit::RemoteMediaPlayerManager::durationChanged):
(WebKit::RemoteMediaPlayerManager::engineFailedToLoad):
(WebKit::RemoteMediaPlayerManager::characteristicChanged):
(WebKit::RemoteMediaPlayerManager::sizeChanged):
(WebKit::RemoteMediaPlayerManager::addRemoteAudioTrack):
(WebKit::RemoteMediaPlayerManager::removeRemoteAudioTrack):
(WebKit::RemoteMediaPlayerManager::remoteAudioTrackConfigurationChanged):
(WebKit::RemoteMediaPlayerManager::updateCachedState):

WebProcess/GPU/media/RemoteMediaPlayerManager.h:
WebProcess/GPU/media/RemoteMediaPlayerManager.messages.in:
WebProcess/GPU/webrtc/LibWebRTCCodecs.cpp:

LayoutTests:

gpu-process/TestExpectations:

2:26 PM Changeset in webkit [254453] by Alan Bujtas

1 edit
2 adds in trunk/LayoutTests

Add a simple trailing letter-spacing test case
https://bugs.webkit.org/show_bug.cgi?id=206185
<rdar://problem/58535841>

Reviewed by Antti Koivisto.

fast/text/trailing-letter-spacing-long-expected.html: Added.
fast/text/trailing-letter-spacing-long.html: Added.

1:49 PM Changeset in webkit [254452] by weinig@apple.com

3 edits in trunk/Source/WTF

Platform.h is out of control Part 3: Move all ENABLE_* macros definitions in FeatureDefines.h
https://bugs.webkit.org/show_bug.cgi?id=206139

Reviewed by Anders Carlsson.

Moves all remaining ENABLE_* defines out of Platform.h and into FeatureDefines.h
Moves most, USE_UDIS86 and USE_ARM64_DISASSEMBLER are tangled up in the JIT definitions still, HAVE_* and USE_* defines out of FeatureDefines.h and into Platform.h
Where straigthforward, convert macro definitions into a canonical 3 line entry of the form:

#if !defined(MACRO_NAME) && (<CONDITIONS HERE>)
#define MACRO_NAME 1
#endif

There is rarely (if ever) a resone to undefine or define one of these platform related
macros to 0 as the usage macros (e.g. HAVE(...), ENABLE(...), etc.) handle undefined as 0.

Added a guard so that FeatureDefines.h can't be included directly, and must be included via Platform.h. This is necessary as it depends heavily on macros defined in Platform.h
Added numerous FIXMEs detailing follow up cleaning.

wtf/FeatureDefines.h:
wtf/Platform.h:

1:42 PM Changeset in webkit [254451] by Alan Coon

3 edits
4 adds in branches/safari-608.5.7.3-branch

Cherry-pick r254349. rdar://problem/58529694

ObjectAllocationSinkingPhase doesn't model pointers to allocations in control flow properly
https://bugs.webkit.org/show_bug.cgi?id=204738
<rdar://problem/57553238>

Reviewed by Yusuke Suzuki.

JSTests:

stress/allocation-sinking-must-model-allocation-pointers-properly-2.js: Added. (assert): (v9):
stress/allocation-sinking-must-model-allocation-pointers-properly-3.js: Added. (assert): (v9):
stress/allocation-sinking-must-model-allocation-pointers-properly-4.js: Added. (bool): (effects): (escape): (bar):
stress/allocation-sinking-must-model-allocation-pointers-properly.js: Added. (alwaysFalse): (sometimesZero): (assert): (v9):

Source/JavaScriptCore:

Allocation sinking phase conducts a points to analysis. It uses this
information for programs like:

`
1: NewObject
2: NewObject
3: PutByOffset(@2, @1, "x")
4: GetByOffset(@2, "x")
`

It solves the points to problem knowing @4 points to @1.

It tracks this data in the LocalHeap data structure. This is used to track
the heap across blocks, and it includes a merge function to handle control
flow merges. However, this merge function would not always merge the pointer
sets together. It sometimes would merge them together, since it had a fast
path check inside merge, which would just copy the contents of the block to be
merged with itself if it were this block's first time merging. This fast path happened
to hide the bug in general case merge code. If we didn't take this fast path,
we would just never transfer pointer sets from predecessor to successor. This
could lead to all kinds of issues, including using the incorrect phantom node
in IR instead of its materialized version. It could also lead to the phase not
sinking objects it is capable of sinking.

This patch makes it so that we merge together the pointer sets. We always add
new pointers to the set. So in pointer A->B, if the set has yet to see A, we
add it. If the set already contains pointer A->B, and we encounter a new
pointer A->C, or if we encounter a merge without any A->* pointer, we mark
the A pointer as top, marking it A->TOP. We do this to ensure that we fixpoint.
We're guaranteed that m_pointers is monotonically increasing (module liveness
pruning, which is a constant). And once something is TOP, it never becomes
anything else. (Instead of marking a pointer top, we used to just remove it
from the set, but this has issues, as it could lead to us ping-ponging in
our fixpoint analysis, add, remove, add, remove, etc.)

So the merge rules are:
{A->B} merge {A->B} => {A->B}
{A->B} merge {A->C} => {A->TOP}
{A->B} merge {A->TOP} => {A->TOP}
{A->B} merge {} => {A->TOP}

Thanks to Samuel Groß of Google Project Zero for identifying this bug.

dfg/DFGObjectAllocationSinkingPhase.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@254349 268f45cc-cd09-0410-ab3c-d52691b4dbfc

1:37 PM Changeset in webkit [254450] by Alan Coon

3 edits
4 deletes in branches/safari-608.5.0.2-branch

Revert r254349. rdar://problem/58529691

This reverts commit r254445.

1:37 PM Changeset in webkit [254449] by Truitt Savell

2 edits in trunk/LayoutTests

Flaky Test: imported/w3c/web-platform-tests/svg/import/struct-dom-06-b-manual.svg
https://bugs.webkit.org/show_bug.cgi?id=204312

Unreviewed test gardening.

platform/mac/TestExpectations:

1:33 PM Changeset in webkit [254448] by aakash_jain@apple.com

1 edit
1 add in trunk/Tools

[EWS] Add unit tests for factories
https://bugs.webkit.org/show_bug.cgi?id=206159

Reviewed by Jonathan Bedard.

BuildSlaveSupport/ews-build/factories_unittest.py: Added unit tests for factories.

1:28 PM Changeset in webkit [254447] by ysuzuki@apple.com

9 edits
2 deletes in trunk/Source/JavaScriptCore

[JSC] Put JSProxy in IsoSubspace
https://bugs.webkit.org/show_bug.cgi?id=206187

Reviewed by Mark Lam.

Put JSProxy in IsoSubspace.
Make JSProxy non-destructible since derived class JSWindowProxy is having its own IsoSubspace with destructibility.

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
Sources.txt:
runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::resetPrototype):
(JSC::JSGlobalObject::finishCreation):

runtime/JSNonDestructibleProxy.cpp: Removed.
runtime/JSNonDestructibleProxy.h: Removed.
runtime/JSProxy.h:

(JSC::JSProxy::subspaceFor):

runtime/JSStringIterator.h:
runtime/VM.cpp:

(JSC::VM::VM):

runtime/VM.h:

12:21 PM Changeset in webkit [254446] by youenn@apple.com

11 edits
1 copy
2 moves
2 adds in trunk/Source/WebCore

Split AudioTrackPrivateMediaStreamCocoa to implement remote audio rendering
https://bugs.webkit.org/show_bug.cgi?id=206172

Reviewed by Eric Carlson.

Refactor code to allow in the future rendering of media stream audio tracks in a remote process.
For that purpose, split AudioTrackPrivateMediaStreamCocoa functionality in two parts.
The first part is moved back to AudioTrackPrivateMediaStream.
The second part is platform specific and is defined in terms of an interface AudioMediaStreamTrackRenderer
and an in process implementation named AudioMediaStreamTrackRendererCocoa.

Make TrackPrivateBase and MediaStreamTrackPrivate public LoggerHelper.
This allows making AudioMediaStreamTrackRenderer and AudioSampleDataSource to take a LoggerHelper instead of a derived instance.

No change of behavior.

Sources.txt:
SourcesCocoa.txt:
WebCore.xcodeproj/project.pbxproj:
platform/audio/mac/AudioSampleDataSource.h:
platform/audio/mac/AudioSampleDataSource.mm:

(WebCore::AudioSampleDataSource::create):
(WebCore::AudioSampleDataSource::AudioSampleDataSource):

platform/graphics/TrackPrivateBase.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:

(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::updateTracks):

platform/mediastream/AudioMediaStreamTrackRenderer.h: Added.

(WebCore::AudioMediaStreamTrackRenderer::setMuted):
(WebCore::AudioMediaStreamTrackRenderer::setVolume):
(WebCore::AudioMediaStreamTrackRenderer::volume const):
(WebCore::AudioMediaStreamTrackRenderer::isMuted const):

platform/mediastream/AudioTrackPrivateMediaStream.cpp: Added.

(WebCore::AudioTrackPrivateMediaStream::setLogger):
(WebCore::AudioTrackPrivateMediaStream::AudioTrackPrivateMediaStream):
(WebCore::AudioTrackPrivateMediaStream::~AudioTrackPrivateMediaStream):
(WebCore::AudioTrackPrivateMediaStream::clear):
(WebCore::AudioTrackPrivateMediaStream::playInternal):
(WebCore::AudioTrackPrivateMediaStream::play):
(WebCore::AudioTrackPrivateMediaStream::pause):
(WebCore::AudioTrackPrivateMediaStream::setVolume):
(WebCore::AudioTrackPrivateMediaStream::volume const):
(WebCore::AudioTrackPrivateMediaStream::audioSamplesAvailable):
(WebCore::AudioTrackPrivateMediaStream::trackMutedChanged):
(WebCore::AudioTrackPrivateMediaStream::trackEnabledChanged):
(WebCore::AudioTrackPrivateMediaStream::updateRendererMutedState):
(WebCore::AudioTrackPrivateMediaStream::trackEnded):

platform/mediastream/AudioTrackPrivateMediaStream.h:
platform/mediastream/MediaStreamTrackPrivate.h:
platform/mediastream/mac/AudioMediaStreamTrackRendererCocoa.cpp: Added.

(WebCore::AudioMediaStreamTrackRendererCocoa::stop):
(WebCore::AudioMediaStreamTrackRendererCocoa::clear):
(WebCore::AudioMediaStreamTrackRendererCocoa::setPaused):
(WebCore::AudioMediaStreamTrackRendererCocoa::createAudioUnit):
(WebCore::AudioMediaStreamTrackRendererCocoa::pushSamples):
(WebCore::AudioMediaStreamTrackRendererCocoa::render):
(WebCore::AudioMediaStreamTrackRendererCocoa::inputProc):

platform/mediastream/mac/AudioMediaStreamTrackRendererCocoa.h: Added.
platform/mediastream/mac/AudioTrackPrivateMediaStreamCocoa.h: Removed.

11:57 AM Changeset in webkit [254445] by Alan Coon

3 edits
4 adds in branches/safari-608.5.0.2-branch

Cherry-pick r254349. rdar://problem/58529691

ObjectAllocationSinkingPhase doesn't model pointers to allocations in control flow properly
https://bugs.webkit.org/show_bug.cgi?id=204738
<rdar://problem/57553238>

Reviewed by Yusuke Suzuki.

JSTests:

stress/allocation-sinking-must-model-allocation-pointers-properly-2.js: Added. (assert): (v9):
stress/allocation-sinking-must-model-allocation-pointers-properly-3.js: Added. (assert): (v9):
stress/allocation-sinking-must-model-allocation-pointers-properly-4.js: Added. (bool): (effects): (escape): (bar):
stress/allocation-sinking-must-model-allocation-pointers-properly.js: Added. (alwaysFalse): (sometimesZero): (assert): (v9):

Source/JavaScriptCore:

Allocation sinking phase conducts a points to analysis. It uses this
information for programs like:

`
1: NewObject
2: NewObject
3: PutByOffset(@2, @1, "x")
4: GetByOffset(@2, "x")
`

It solves the points to problem knowing @4 points to @1.

It tracks this data in the LocalHeap data structure. This is used to track
the heap across blocks, and it includes a merge function to handle control
flow merges. However, this merge function would not always merge the pointer
sets together. It sometimes would merge them together, since it had a fast
path check inside merge, which would just copy the contents of the block to be
merged with itself if it were this block's first time merging. This fast path happened
to hide the bug in general case merge code. If we didn't take this fast path,
we would just never transfer pointer sets from predecessor to successor. This
could lead to all kinds of issues, including using the incorrect phantom node
in IR instead of its materialized version. It could also lead to the phase not
sinking objects it is capable of sinking.

This patch makes it so that we merge together the pointer sets. We always add
new pointers to the set. So in pointer A->B, if the set has yet to see A, we
add it. If the set already contains pointer A->B, and we encounter a new
pointer A->C, or if we encounter a merge without any A->* pointer, we mark
the A pointer as top, marking it A->TOP. We do this to ensure that we fixpoint.
We're guaranteed that m_pointers is monotonically increasing (module liveness
pruning, which is a constant). And once something is TOP, it never becomes
anything else. (Instead of marking a pointer top, we used to just remove it
from the set, but this has issues, as it could lead to us ping-ponging in
our fixpoint analysis, add, remove, add, remove, etc.)

So the merge rules are:
{A->B} merge {A->B} => {A->B}
{A->B} merge {A->C} => {A->TOP}
{A->B} merge {A->TOP} => {A->TOP}
{A->B} merge {} => {A->TOP}

Thanks to Samuel Groß of Google Project Zero for identifying this bug.

dfg/DFGObjectAllocationSinkingPhase.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@254349 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:51 AM Changeset in webkit [254444] by Alan Coon

7 edits in branches/safari-608.5.7.3-branch/Source

Versioning.

11:48 AM Changeset in webkit [254443] by Alan Coon

3 edits
4 adds in branches/safari-608-branch

Cherry-pick r254349. rdar://problem/58529693

ObjectAllocationSinkingPhase doesn't model pointers to allocations in control flow properly
https://bugs.webkit.org/show_bug.cgi?id=204738
<rdar://problem/57553238>

Reviewed by Yusuke Suzuki.

JSTests:

stress/allocation-sinking-must-model-allocation-pointers-properly-2.js: Added. (assert): (v9):
stress/allocation-sinking-must-model-allocation-pointers-properly-3.js: Added. (assert): (v9):
stress/allocation-sinking-must-model-allocation-pointers-properly-4.js: Added. (bool): (effects): (escape): (bar):
stress/allocation-sinking-must-model-allocation-pointers-properly.js: Added. (alwaysFalse): (sometimesZero): (assert): (v9):

Source/JavaScriptCore:

Allocation sinking phase conducts a points to analysis. It uses this
information for programs like:

`
1: NewObject
2: NewObject
3: PutByOffset(@2, @1, "x")
4: GetByOffset(@2, "x")
`

It solves the points to problem knowing @4 points to @1.

It tracks this data in the LocalHeap data structure. This is used to track
the heap across blocks, and it includes a merge function to handle control
flow merges. However, this merge function would not always merge the pointer
sets together. It sometimes would merge them together, since it had a fast
path check inside merge, which would just copy the contents of the block to be
merged with itself if it were this block's first time merging. This fast path happened
to hide the bug in general case merge code. If we didn't take this fast path,
we would just never transfer pointer sets from predecessor to successor. This
could lead to all kinds of issues, including using the incorrect phantom node
in IR instead of its materialized version. It could also lead to the phase not
sinking objects it is capable of sinking.

This patch makes it so that we merge together the pointer sets. We always add
new pointers to the set. So in pointer A->B, if the set has yet to see A, we
add it. If the set already contains pointer A->B, and we encounter a new
pointer A->C, or if we encounter a merge without any A->* pointer, we mark
the A pointer as top, marking it A->TOP. We do this to ensure that we fixpoint.
We're guaranteed that m_pointers is monotonically increasing (module liveness
pruning, which is a constant). And once something is TOP, it never becomes
anything else. (Instead of marking a pointer top, we used to just remove it
from the set, but this has issues, as it could lead to us ping-ponging in
our fixpoint analysis, add, remove, add, remove, etc.)

So the merge rules are:
{A->B} merge {A->B} => {A->B}
{A->B} merge {A->C} => {A->TOP}
{A->B} merge {A->TOP} => {A->TOP}
{A->B} merge {} => {A->TOP}

Thanks to Samuel Groß of Google Project Zero for identifying this bug.

dfg/DFGObjectAllocationSinkingPhase.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@254349 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:42 AM Changeset in webkit [254442] by Alan Coon

7 edits in branches/safari-608-branch/Source

Versioning.

11:32 AM Changeset in webkit [254441] by Alan Bujtas

2 edits in trunk/LayoutTests

Explain why we started skipping "insert-span-into-long-text-bug-28245.html" in debug.

TestExpectations:

11:26 AM Changeset in webkit [254440] by eric.carlson@apple.com

2 edits in trunk/Tools

Don't softlink AVCapture classes on watchOS or tvOS
https://bugs.webkit.org/show_bug.cgi?id=205974
<rdar://problem/58427281>

Unreviewed test fix after r254257.

TestWebKitAPI/Tests/WebCore/cocoa/AVFoundationSoftLinkTest.mm:

(TestWebKitAPI::TEST):

10:53 AM Changeset in webkit [254439] by jiewen_tan@apple.com

24 edits
5 adds in trunk

[WebAuthn] Support CTAP Client Pin
https://bugs.webkit.org/show_bug.cgi?id=191516
<rdar://problem/56558558>

Reviewed by Brent Fulgham.

Source/WebCore:

Covered by API tests.

Modules/webauthn/fido/DeviceRequestConverter.cpp:

(fido::encodeMakeCredenitalRequestAsCBOR):
(fido::encodeGetAssertionRequestAsCBOR):

Modules/webauthn/fido/Pin.cpp:

(fido::pin::RetriesResponse::parse):
(fido::pin::TokenResponse::parse):
(fido::pin::TokenRequest::tryCreate):
(fido::pin::encodeAsCBOR):

Modules/webauthn/fido/Pin.h:
crypto/algorithms/CryptoAlgorithmAES_CBC.h:
crypto/gcrypt/CryptoAlgorithmAES_CBCGCrypt.cpp:

(WebCore::CryptoAlgorithmAES_CBC::platformEncrypt):
(WebCore::CryptoAlgorithmAES_CBC::platformDecrypt):

crypto/mac/CryptoAlgorithmAES_CBCMac.cpp:

(WebCore::transformAES_CBC):
(WebCore::CryptoAlgorithmAES_CBC::platformEncrypt):
(WebCore::CryptoAlgorithmAES_CBC::platformDecrypt):

testing/MockWebAuthenticationConfiguration.h:

(WebCore::MockWebAuthenticationConfiguration::HidConfiguration::encode const):
(WebCore::MockWebAuthenticationConfiguration::HidConfiguration::decode):

testing/MockWebAuthenticationConfiguration.idl:

Source/WebKit:

This patch implements authenticatorClientPIN from the spec:
https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorClientPIN
Specifically, it implements section 5.5.1, 5.5.3, 5.5.4, 5.5.7, and 5.5.8.

Here is the flow how makeCredential/getAssertion works with a PIN in our implementation:

Determine if the connected authenticator has a PIN;
If yes, send the makeCredential/getAssertion request to the authenticator with an empty pinAuth

such that the authenticator will wink for user gestures. This step intends to confirm the authenticator
is the one the user wants to use. Otherwise, we don't know which authenticator to send the PIN
if multiple are connected;

Once the user confirms the authetnicator, it will return either CTAP2_ERR_PIN_INVALID or

CTAP2_ERR_PIN_AUTH_INVALID. Some authenticators return CTAP2_ERR_PIN_AUTH_INVALID even though
it is not suggested by the spec;

Get retries from the authenticator;
Get key agreement from the authenticator;
Ask the UI client for the PIN and at the meantime inform it the retries;
Get pin token from the authenticator;
Resend the makeCredential/getAssertion request with the desired pinAuth.

Besides implementating the above flow, this patch also fixes some bugs within the PIN commands encoder:

pinAuth/pinProtocol are wrongly encoded for makeCredential/getAssertion;
AES CBC should be called without any padding. Therefore, CryptoAlgorithmAES_CBC adds a no padding mode;
The sharedSecret is the SHA256 digest of the ECDH key agreement instead of the raw key agreement.

UIProcess/API/APIWebAuthenticationPanelClient.h:

(API::WebAuthenticationPanelClient::requestPin const):

UIProcess/WebAuthentication/Authenticator.h:
UIProcess/WebAuthentication/AuthenticatorManager.cpp:

(WebKit::AuthenticatorManager::requestPin):

UIProcess/WebAuthentication/AuthenticatorManager.h:
UIProcess/WebAuthentication/Cocoa/WebAuthenticationPanelClient.h:
UIProcess/WebAuthentication/Cocoa/WebAuthenticationPanelClient.mm:

(WebKit::WebAuthenticationPanelClient::WebAuthenticationPanelClient):
(WebKit::WebAuthenticationPanelClient::requestPin const):

UIProcess/WebAuthentication/Mock/MockHidConnection.cpp:

(WebKit::MockHidConnection::feedReports):

UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp:

(WebKit::CtapAuthenticator::makeCredential):
(WebKit::CtapAuthenticator::continueMakeCredentialAfterResponseReceived):
(WebKit::CtapAuthenticator::getAssertion):
(WebKit::CtapAuthenticator::continueGetAssertionAfterResponseReceived):
(WebKit::CtapAuthenticator::getRetries):
(WebKit::CtapAuthenticator::continueGetKeyAgreementAfterGetRetries):
(WebKit::CtapAuthenticator::continueRequestPinAfterGetKeyAgreement):
(WebKit::CtapAuthenticator::continueGetPinTokenAfterRequestPin):
(WebKit::CtapAuthenticator::continueRequestAfterGetPinToken):
(WebKit::CtapAuthenticator::continueMakeCredentialAfterResponseReceived const): Deleted.

UIProcess/WebAuthentication/fido/CtapAuthenticator.h:

Tools:

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebCore/CtapPinTest.cpp:

(TestWebKitAPI::TEST):

TestWebKitAPI/Tests/WebCore/FidoTestData.h:
TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:

(-[TestWebAuthenticationPanelDelegate panel:requestPINWithRemainingRetries:completionHandler:]):
(TestWebKitAPI::TEST):

TestWebKitAPI/Tests/WebKitCocoa/web-authentication-get-assertion-hid-pin.html: Added.
TestWebKitAPI/Tests/WebKitCocoa/web-authentication-make-credential-hid-pin-get-key-agreement-error.html: Added.
TestWebKitAPI/Tests/WebKitCocoa/web-authentication-make-credential-hid-pin-get-pin-token-error.html: Added.
TestWebKitAPI/Tests/WebKitCocoa/web-authentication-make-credential-hid-pin-get-retries-error.html: Added.
TestWebKitAPI/Tests/WebKitCocoa/web-authentication-make-credential-hid-pin.html: Added.

10:34 AM Changeset in webkit [254438] by Alan Bujtas

4 edits in trunk

[LFC][Integration] Turn off trailing letter-space trimming for the LineBreaker content
https://bugs.webkit.org/show_bug.cgi?id=206181
<rdar://problem/58532931>

Reviewed by Antti Koivisto.

Source/WebCore:

Do not mark trailing letter-spacing as trimmable in the "continuous content" we feed in to line breaking.
This causes different and unexpected line breaking behavior as we don't try to fit the letter-spacing after the last character.

layout/inlineformatting/InlineLineBreaker.cpp:

(WebCore::Layout::ContinuousContent::ContinuousContent):

LayoutTests:

platform/ios/css1/text_properties/letter_spacing-expected.txt: Undo the rebaselining.

9:52 AM Changeset in webkit [254437] by Wenson Hsieh

2 edits in trunk/LayoutTests

[iOS] editing/selection/ios/clear-selection-after-tap-in-large-selected-non-editable-text.html times out
https://bugs.webkit.org/show_bug.cgi?id=206126
<rdar://problem/58060387>

Reviewed by Tim Horton.

This test is intended to verify that when ranged selection UI covers up most of the view, tapping the selection
will clear the selection instead of toggling the callout bar. However, there are a couple of issues that make
this test fail:

The long press that is intended to select text ends up under the "Sel" in select and above the "ect" that

wraps to the next line, which causes the word to not be selected. To fix this, I changed the tap location from
the center of the view to somewhere in the top half of the view, near the middle of "Sel".

The callout bar appears in the center of the screen with the "Look up" action in the middle, so tapping the

center of the view again causes a view controller to be presented when looking up the selected word ("Select").
We can avoid this by also moving the tap location away from the center of the view.

On iPad, the word "Select" isn't big enough to encompass most of the screen even at 250px, so the test fails.

We fix this by making the "Select" text much bigger (500px), and then make the body overflow: hidden so that
selecting the word on iPhone's smaller screen doesn't cause scrolling.

editing/selection/ios/clear-selection-after-tap-in-large-selected-non-editable-text.html:

9:39 AM Changeset in webkit [254436] by Brent Fulgham

2 edits in trunk/Source/WebKit

[iOS] Remove 'com.apple.diagnosticd' from WebContent process sandbox
https://bugs.webkit.org/show_bug.cgi?id=206114
<rdar://problem/58496791>

Reviewed by Per Arne Vollan.

In Bug 205292 we began dynamically adding a sandbox extension for 'com.apple.diagnosticd' when needed.
We should remove the blanket permission from the sandbox.

Test: fast/sandbox/ios/sandbox-mach-lookup.html

Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

9:35 AM Changeset in webkit [254435] by Truitt Savell

2 edits in trunk/LayoutTests

Correct test expectations after r254428
https://bugs.webkit.org/show_bug.cgi?id=206164

Unreviewed test gardening.

platform/mac-wk1/TestExpectations:

9:19 AM Changeset in webkit [254434] by keith_miller@apple.com

4 edits
1 add in trunk

CheckNeutered needs to claim it reads JSType in clobberize.
https://bugs.webkit.org/show_bug.cgi?id=206136

Reviewed by Yusuke Suzuki.

JSTests:

stress/check-neutered-clobberize-reads-jstype.js: Added.

(foo):

Source/JavaScriptCore:

CheckNeutered needs to read JSType otherwise it can get hoisted
past the TypedArray check guarding it.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

9:14 AM Changeset in webkit [254433] by Wenson Hsieh

7 edits in trunk/Source/WebKit

[macCatalyst] UI process crashes on launch after r254101
https://bugs.webkit.org/show_bug.cgi?id=206156
<rdar://problem/58514942>

Reviewed by Brent Fulgham.

Fixes the crash by not soft-linking BackBoardServices in an attempt to invoke BKSDisplayBrightnessGetCurrent on
macCatalyst. Prior to r254101, this was only defined on iOS and not watchOS or tvOS; after this change, it
should be defined only on iOS, watchOS and tvOS.

UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::registerNotificationObservers):

UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::initializeNewWebProcess):

UIProcess/WebProcessPool.h:
WebProcess/WebProcess.h:
WebProcess/WebProcess.messages.in:
WebProcess/cocoa/WebProcessCocoa.mm:

9:06 AM Changeset in webkit [254432] by Diego Pino Garcia

2 edits in trunk/LayoutTests

[GTK] Unreviewed gardening after r254409
https://bugs.webkit.org/show_bug.cgi?id=206150

platform/gtk/TestExpectations:

8:09 AM Changeset in webkit [254431] by Antti Koivisto

4 edits in trunk

[LFC][Integration] editing/text-iterator/findString.html fails on iOS
https://bugs.webkit.org/show_bug.cgi?id=206164

Reviewed by Zalan Bujtas.

Source/WebCore:

rendering/line/LineLayoutTraversalDisplayRunPath.h:

(WebCore::LineLayoutTraversal::DisplayRunPath::isLastOnLine const):

The test here was reversed.

LayoutTests:

platform/ios/TestExpectations:

8:02 AM Changeset in webkit [254430] by Antti Koivisto

2 edits in trunk/LayoutTests

[iOS] Unreviewed test gardening after r254428.

platform/ios/css1/text_properties/letter_spacing-expected.txt:

7:04 AM Changeset in webkit [254429] by Alan Bujtas

3 edits in trunk/LayoutTests

[Win] Unreviewed test gardening after r254421.

platform/win/css1/text_properties/text_indent-expected.txt:
platform/win/css2.1/t1601-c547-indent-01-d-expected.txt:

4:47 AM Changeset in webkit [254428] by Antti Koivisto

16 edits in trunk

[LFC][Integration] Enable LFC integration
https://bugs.webkit.org/show_bug.cgi?id=206128

Reviewed by Zalan Bujtas.

Source/WebCore:

Enable the new line layout path.

page/RuntimeEnabledFeatures.h:

Source/WebKit:

Shared/WebPreferences.yaml:

LayoutTests:

Rebase for some progressions.

fast/dom/Range/getBoundingClientRect-expected.txt:
fast/dom/Range/getBoundingClientRect.html:

Update the test for new results. These match the complex line layout results (simple lines produce wrong results).

platform/ios/fast/text/whitespace/pre-break-word-expected.txt:
platform/ios/fast/text/word-break-expected.txt:
platform/mac/fast/text/hyphenate-limit-lines-expected.txt:
platform/mac/fast/text/whitespace/pre-break-word-expected.txt:
platform/mac/fast/text/word-break-expected.txt:

Line breaking and white-space progressions.

platform/ios/TestExpectations:

A subtest of editing/text-iterator/findString.html fails on iOS. This needs futher analysis.

platform/win/TestExpectations:

fast/dom/Range/getBoundingClientRect.html now fails on windows because LFC is not enabled there.

3:54 AM Changeset in webkit [254427] by Antti Koivisto

2 edits in trunk/Source/WebCore

[LFC][Integration] imported/blink/fast/shapes/crash-caused-by-dirtying-a-shape-while-computing-it-requires-a-long-filename-to-crash.html crashes on iOS
https://bugs.webkit.org/show_bug.cgi?id=206151

Reviewed by Zalan Bujtas.

layout/layouttree/LayoutTreeBuilder.cpp:

(WebCore::Layout::TreeBuilder::createLayoutBox):

LFC doesn't expect line break boxes with float set (other layout systems just ignore it).

2:14 AM Changeset in webkit [254426] by Antti Koivisto

7 edits in trunk/LayoutTests

[LFC][Integration] Ensure that simple line layout tests stays don't turn into LFC tests
https://bugs.webkit.org/show_bug.cgi?id=206153

Reviewed by Zalan Bujtas.

We have a handful of SLL tests that document non-standard behaviors. Keep these SLL only with LFC enabled.

fast/text/embed-at-end-of-pre-wrap-line-simple-lines-expected.html:
fast/text/embed-at-end-of-pre-wrap-line-simple-lines.html:
fast/text/simple-line-layout-leading-whitespace-with-soft-hard-linebreak-expected.html:
fast/text/simple-line-layout-leading-whitespace-with-soft-hard-linebreak.html:
fast/text/whitespace/pre-wrap-long-word-simple-lines-expected.html:
fast/text/whitespace/pre-wrap-long-word-simple-lines.html:

2:11 AM Changeset in webkit [254425] by Antti Koivisto

2 edits in trunk/Source/WebCore

[LFC][IFC] fast/text/fast-run-width-vs-slow-run-width.html is failing
https://bugs.webkit.org/show_bug.cgi?id=206143

Reviewed by Zalan Bujtas.

The test is constructed so that the preferred width computation produces float value that maps exactly to LayoutUnit
(usually it gets ceiled up). This get converted back to float and the same input widths are substracted from
the total during inline layout. Due to nature of floating point arithmetic this ends up producing slightly
different result and the last word doesn't fit.

layout/inlineformatting/InlineLineBreaker.cpp:

(WebCore::Layout::LineBreaker::tryWrappingInlineContent const):

When using floats, do an additional equality comparison that accepts values within scaled float epsilon as equal.

1:31 AM Changeset in webkit [254424] by Carlos Garcia Campos

5 edits in trunk/Source

WebDriver: pressed virtual keys not correctly handled in action sequences
https://bugs.webkit.org/show_bug.cgi?id=205997

Reviewed by Brian Burg.

Source/WebDriver:

We are assuming that only one virtual key can be pressed and that a key up always releases the pressed virtual
key if any. We should keep a list of pressed keys and remove them from the list when key up happens for them.

Fixes: imported/w3c/webdriver/tests/perform_actions/key_modifiers.py::test_shift_modifier_generates_capital_letters[\ue008]

imported/w3c/webdriver/tests/perform_actions/key_modifiers.py::test_shift_modifier_generates_capital_letters[\ue050]

Session.cpp:

(WebDriver::Session::performActions):

Session.h:

Source/WebKit:

When modifiers are present we need to translate the keys that might be affected by the modifiers.

UIProcess/Automation/gtk/WebAutomationSessionGtk.cpp:

(WebKit::doKeyStrokeEvent):

1:27 AM Changeset in webkit [254423] by Carlos Garcia Campos

3 edits in trunk/Source/WebKit

Unreviewed. [GTK][WPE] Add missing autocleanup definition for WebKitInputMethodContext

I forgot to add it in r253749.

UIProcess/API/gtk/WebKitAutocleanups.h:
UIProcess/API/wpe/WebKitAutocleanups.h:

Jan 12, 2020:

11:33 PM Changeset in webkit [254422] by timothy_horton@apple.com

2 edits in trunk/Source/WebKit

Remove CorePDF linkage in WebKit
https://bugs.webkit.org/show_bug.cgi?id=206103
<rdar://problem/58490563>

Reviewed by Wenson Hsieh.

Configurations/WebKit.xcconfig:

7:40 PM Changeset in webkit [254421] by Alan Bujtas

7 edits in trunk

Text-indent with percentage value should resolve against the available width
https://bugs.webkit.org/show_bug.cgi?id=206155
<rdar://problem/58514882>

Reviewed by Antti Koivisto.

Source/WebCore:

https://www.w3.org/TR/css-text-3/#text-indent-property
"<percentage> Gives the amount of the indent as a percentage of the block container’s own logical width"

rendering/RenderBlock.cpp:

(WebCore::RenderBlock::textIndentOffset const):

LayoutTests:

platform/mac/css1/text_properties/text_indent-expected.txt:
platform/mac/css2.1/t1601-c547-indent-01-d-expected.txt:

7:12 PM Changeset in webkit [254420] by ysuzuki@apple.com

19 edits in trunk

[JSC] Use internal object field mechanism to implement JSStringIterator
https://bugs.webkit.org/show_bug.cgi?id=206144

Reviewed by Ross Kirsling.

JSTests:

stress/string-iterators.js:
stress/tailCallForwardArguments.js:

(putFuncToPrivateName.createBuiltin):
(createTailCallForwardingFuncWith):

Source/JavaScriptCore:

This patch uses internal object field mechanism to implement JSStringIterator,
and we also put JSStringIterator into IsoSubspace.

builtins/BuiltinNames.h:
builtins/StringIteratorPrototype.js:

(next):

bytecode/BytecodeIntrinsicRegistry.cpp:

(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):

bytecode/BytecodeIntrinsicRegistry.h:
bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::emitIsStringIterator):

bytecompiler/NodesCodegen.cpp:

(JSC::stringIteratorInternalFieldIndex):
(JSC::BytecodeIntrinsicNode::emit_intrinsic_getStringIteratorInternalField):
(JSC::BytecodeIntrinsicNode::emit_intrinsic_putStringIteratorInternalField):

inspector/JSInjectedScriptHost.cpp:

(Inspector::JSInjectedScriptHost::getInternalProperties):

runtime/JSCast.h:
runtime/JSStringIterator.cpp:

(JSC::JSStringIterator::finishCreation):
(JSC::JSStringIterator::clone):
(JSC::JSStringIterator::visitChildren):
(JSC::JSStringIterator::iteratedValue const): Deleted.

runtime/JSStringIterator.h:
runtime/JSType.cpp:

(WTF::printInternal):

runtime/JSType.h:
runtime/StringPrototype.cpp:

(JSC::stringProtoFuncIterator):

runtime/VM.cpp:
runtime/VM.h:

7:10 PM Changeset in webkit [254419] by ysuzuki@apple.com

12 edits in trunk/Source/JavaScriptCore

[JSC] Remove IsDone from JSArrayIterator
https://bugs.webkit.org/show_bug.cgi?id=206140

Reviewed by Keith Miller.

We can store -1 in Index field to represent whether the iterator is closed.
While this patch does not change the allocation size of JSArrayIterator, this style can
shrink the size of JSStringIterator when we implement it in the same style.

We also rename iterationKindKeyValue to iterationKindEntries.

builtins/ArrayIteratorPrototype.js:

(globalPrivate.arrayIteratorNextHelper):

builtins/MapIteratorPrototype.js:

(globalPrivate.mapIteratorNext):

builtins/MapPrototype.js:

(entries):

builtins/SetIteratorPrototype.js:

(globalPrivate.setIteratorNext):

builtins/SetPrototype.js:

(entries):

bytecode/BytecodeIntrinsicRegistry.cpp:

(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):

bytecode/BytecodeIntrinsicRegistry.h:
bytecompiler/NodesCodegen.cpp:

(JSC::arrayIteratorInternalFieldIndex):

inspector/JSInjectedScriptHost.cpp:

(Inspector::cloneArrayIteratorObject):

runtime/JSArrayIterator.cpp:

(JSC::JSArrayIterator::finishCreation):

runtime/JSArrayIterator.h:

5:18 PM Changeset in webkit [254418] by ysuzuki@apple.com

13 edits in trunk/Source/JavaScriptCore

[JSC] Consistently use "var" in builtin JS
https://bugs.webkit.org/show_bug.cgi?id=206157

Reviewed by Mark Lam.

let / const requires additional bytecode to make it Empty initialized for now.
For builtin JS, we would like to keep it as efficient and compact as we can
so we should use var consistently.

builtins/ArrayPrototype.js:

(sort.stringComparator):
(sort.compactSparse):
(sort.compactSlow):
(sort.compact):
(sort.merge):
(sort.mergeSort):
(sort.bucketSort):
(sort.comparatorSort):
(sort.stringSort):
(sort):
(globalPrivate.concatSlowPath):
(concat):

builtins/FunctionPrototype.js:

(call):
(overriddenName.string_appeared_here.symbolHasInstance):

builtins/GlobalOperations.js:

(globalPrivate.copyDataProperties):
(globalPrivate.copyDataPropertiesNoExclusions):

builtins/IteratorHelpers.js:

(performIteration):

builtins/ModuleLoader.js:

(async loadModule):
(async loadAndEvaluateModule):
(async requestImportModule):
(dependencyKeysIfEvaluated):

builtins/ObjectConstructor.js:

(fromEntries):

builtins/PromisePrototype.js:

(finally):
(valueThunk):
(globalPrivate.getThenFinally):
(thrower):
(globalPrivate.getCatchFinally):
(const.valueThunk): Deleted.
(const.thrower): Deleted.

builtins/RegExpPrototype.js:

(globalPrivate.advanceStringIndex):
(globalPrivate.regExpExec):
(globalPrivate.hasObservableSideEffectsForRegExpMatch):
(globalPrivate.matchSlow):
(overriddenName.string_appeared_here.match):
(overriddenName.string_appeared_here.matchAll):
(getSubstitution):
(overriddenName.string_appeared_here.replace):
(overriddenName.string_appeared_here.search):
(globalPrivate.hasObservableSideEffectsForRegExpSplit):
(overriddenName.string_appeared_here.split):
(intrinsic.RegExpTestIntrinsic.test):

builtins/RegExpStringIteratorPrototype.js:

(next):

builtins/StringPrototype.js:

(match):
(matchAll):
(globalPrivate.hasObservableSideEffectsForStringReplace):
(intrinsic.StringPrototypeReplaceIntrinsic.replace):
(globalPrivate.createHTML):

builtins/TypedArrayConstructor.js:

(of):
(from):

builtins/TypedArrayPrototype.js:

(globalPrivate.typedArraySpeciesConstructor):
(globalPrivate.typedArrayClampArgumentToStartOrEnd):
(fill):
(find):
(subarray):

4:21 PM Changeset in webkit [254417] by weinig@apple.com

4 edits
1 copy in trunk/Source/WTF

Platform.h is out of control Part 2: Split WTF_OS_* macro definitions out of Platform.h and into a new OS.h
https://bugs.webkit.org/show_bug.cgi?id=206138

Reviewed by Anders Carlsson.

As a another step towards cleaning up Platform.h, split out OS related
macros into their own file.

WTF.xcodeproj/project.pbxproj:
wtf/CMakeLists.txt:
wtf/OS.h: Copied from Source/WTF/wtf/Platform.h.
wtf/Platform.h:

2:42 PM Changeset in webkit [254416] by ysuzuki@apple.com

6 edits in trunk/Source

[WebCore] Reorganize JSType in WebCore to offer more bits to JSC
https://bugs.webkit.org/show_bug.cgi?id=206141

Reviewed by Keith Miller.

Source/JavaScriptCore:

runtime/JSType.h:

Source/WebCore:

This patch reorganize JSType a bit to offer more bits to JSC. Then JSC can use JSType for types easily.

bindings/js/JSDOMWrapper.h:
bindings/js/JSElementCustom.h:

(JSC::JSCastingHelpers::InheritsTraits<WebCore::JSElement>::inherits):

domjit/DOMJITHelpers.h:

(WebCore::DOMJIT::branchIfElement):
(WebCore::DOMJIT::branchIfNotElement):

1:30 PM Changeset in webkit [254415] by mmaxfield@apple.com

2 edits in trunk/LayoutTests

REGRESSION(r185816): In the Hong Kong locale, navigator.language reports it's in the Taiwan locale
https://bugs.webkit.org/show_bug.cgi?id=200043

Make iOS bots green until they can be updated.

Unreviewed.

platform/ios/TestExpectations:

11:10 AM Changeset in webkit [254414] by Darin Adler

5 edits in trunk/Source/WebCore

Remove unneeded MemoryIDBBackingStore::create
https://bugs.webkit.org/show_bug.cgi?id=205512

Reviewed by Youenn Fablet.

Modules/indexeddb/server/IDBServer.cpp:

(WebCore::IDBServer::IDBServer::createBackingStore): Call makeUnique
instead of MemoryIDBBackingStore::create.

Modules/indexeddb/server/MemoryCursor.cpp: Removed unneeded include

of MemoryIDBBackingStore.h.

Modules/indexeddb/server/MemoryIDBBackingStore.cpp: Fixed a comment

and replaced a global variable with a constant.
(WebCore::IDBServer::MemoryIDBBackingStore::create): Deleted.

Modules/indexeddb/server/MemoryIDBBackingStore.h: Made the class

final, made more of the member functions private, and moved a couple
function members out from in between the data members.

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed