Timeline

Apr 18, 2020:

9:41 PM Changeset in webkit [260334] by Darin Adler

• 58 edits in trunk

Update header postprocessing version cutoff to keep Apple internal builds working
​https://bugs.webkit.org/show_bug.cgi?id=210708

Reviewed by Brady Eidson.

Source/WebKit:

• Configurations/WebKit.xcconfig: Update versions to make building with older

Apple internal SDKs continue to work.

• Shared/API/Cocoa/WKFoundation.h:
• Shared/API/Cocoa/_WKFrameHandle.h:
• Shared/API/Cocoa/_WKRemoteObjectInterface.h:
• UIProcess/API/Cocoa/WKContentWorld.h:
• UIProcess/API/Cocoa/WKFindConfiguration.h:
• UIProcess/API/Cocoa/WKFindResult.h:
• UIProcess/API/Cocoa/WKFrameInfoPrivate.h:
• UIProcess/API/Cocoa/WKHTTPCookieStorePrivate.h:
• UIProcess/API/Cocoa/WKNavigationDelegatePrivate.h:
• UIProcess/API/Cocoa/WKPDFConfiguration.h:
• UIProcess/API/Cocoa/WKPreferences.h:
• UIProcess/API/Cocoa/WKPreferencesPrivate.h:
• UIProcess/API/Cocoa/WKProcessPoolPrivate.h:
• UIProcess/API/Cocoa/WKUIDelegatePrivate.h:
• UIProcess/API/Cocoa/WKURLSchemeTaskPrivate.h:
• UIProcess/API/Cocoa/WKUserScriptPrivate.h:
• UIProcess/API/Cocoa/WKWebView.h:
• UIProcess/API/Cocoa/WKWebViewConfiguration.h:
• UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h:
• UIProcess/API/Cocoa/WKWebViewPrivate.h:
• UIProcess/API/Cocoa/WKWebpagePreferences.h:
• UIProcess/API/Cocoa/WKWebpagePreferencesPrivate.h:
• UIProcess/API/Cocoa/WKWebsiteDataRecordPrivate.h:
• UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:
• UIProcess/API/Cocoa/_WKDownload.h:
• UIProcess/API/Cocoa/_WKFrameTreeNode.h:
• UIProcess/API/Cocoa/_WKInputDelegate.h:
• UIProcess/API/Cocoa/_WKInspectorDebuggableInfo.h:
• UIProcess/API/Cocoa/_WKProcessPoolConfiguration.h:
• UIProcess/API/Cocoa/_WKRemoteWebInspectorViewController.h:
• UIProcess/API/Cocoa/_WKResourceLoadDelegate.h:
• UIProcess/API/Cocoa/_WKResourceLoadInfo.h:
• UIProcess/API/Cocoa/_WKResourceLoadStatisticsFirstParty.h:
• UIProcess/API/Cocoa/_WKResourceLoadStatisticsThirdParty.h:
• UIProcess/API/Cocoa/_WKTextManipulationConfiguration.h:
• UIProcess/API/Cocoa/_WKTextManipulationExclusionRule.h:
• UIProcess/API/Cocoa/_WKTextManipulationItem.h:
• UIProcess/API/Cocoa/_WKTextManipulationToken.h:
• UIProcess/API/Cocoa/_WKUserContentWorld.h:
• UIProcess/API/Cocoa/_WKUserStyleSheet.h:
• UIProcess/API/Cocoa/_WKWebAuthenticationAssertionResponse.h:
• UIProcess/API/Cocoa/_WKWebAuthenticationPanel.h:
• UIProcess/API/Cocoa/_WKWebsiteDataStoreConfiguration.h:
• UIProcess/API/Cocoa/_WKWebsitePolicies.h:

Because the way we do post-processing of headers in the legacy Xcode
build system won't work once the files have been processed once, touch
each file that has WK_MAC_TBA, WK_IOS_TBA, or
WK_FRAMEWORK_HEADER_POSTPROCESSING_ENABLED in it. Found something to
change in each file. This is likely unnecessary in the new Xcode build
system, but I wasn't able to test that locally.

• WebKit.xcodeproj/project.pbxproj:

(postprocess-header-rule): Added dependencies so that post-processing will be
redone if Configurations/WebKit.xcconfig is touched, since that is where
WK_FRAMEWORK_HEADER_POSTPROCESSING_DISABLED is set, or if
Scripts/postprocess-header-rule is touched, since that is where the
post-processing code is. If either of those files changes it could affect the
output of post-processing. This should make a change like this work in the
new Xcode build system without touching files as is done above.

Tools:

• DumpRenderTree/ios/TextInputControllerIOS.m:
• DumpRenderTree/mac/DumpRenderTreeDraggingInfo.mm:
• DumpRenderTree/mac/EditingDelegate.mm:
• DumpRenderTree/mac/EventSendingController.h:
• DumpRenderTree/mac/EventSendingController.mm:
• DumpRenderTree/mac/FrameLoadDelegate.mm:
• DumpRenderTree/mac/ObjCPlugin.m:
• DumpRenderTree/mac/PixelDumpSupportMac.mm:
• DumpRenderTree/mac/ResourceLoadDelegate.mm:
• DumpRenderTree/mac/UIScriptControllerMac.mm:

Removed includes of <WebKit/WebKit.h>, the header for modern WebKit, from the files
here that are intending to use WebKitLegacy. This is harmless, except for if someone
builds DumpRenderTree *before* building WebKit as I just did.

8:43 PM Changeset in webkit [260333] by keith_miller@apple.com

• 6 edits in trunk/Source/JavaScriptCore

Fix CLoop build for iterator opcodes
​https://bugs.webkit.org/show_bug.cgi?id=210709

Reviewed by Robin Morisset.

We need to add a default paramater for the metadata pointer
in the CLoop build. Additionally, the helper declarations need
to be in the various slow path header files. Lastly we need
opcode labels for our new JS call return points.

• bytecode/BytecodeList.rb:
• llint/LLIntSlowPaths.cpp:
• llint/LLIntSlowPaths.h:
• runtime/CommonSlowPaths.h:

8:07 PM Changeset in webkit [260332] by keith_miller@apple.com

• 2 edits in trunk/JSTests

Unreviewed, mark test passing.

• test262/expectations.yaml:

7:20 PM Changeset in webkit [260331] by rmorisset@apple.com

• 107 edits
  1 copy in trunk

Support an inlined representation in JSValue of small BigInts ("BigInt32")
​https://bugs.webkit.org/show_bug.cgi?id=206182

Reviewed by Yusuke Suzuki.

JSTests:

I improved several of the tests to give more informative error messages in the process of fixing them.

More interestingly I had to modify "missing-exception-check-in-string-compare" because it relied on "s1 == s1" resolving ropes, and we now just return true.

• stress/big-int-division.js:

(testDiv):

• stress/big-int-left-shift-wrapped-value.js:

(assert.sameValue):

• stress/big-int-logical-not.js:

(assert):

• stress/big-int-mod-jit.js:
• stress/big-int-right-shift-general.js:

(testRightShift):

• stress/big-int-type-of-proven-type.js:

(assert):

• stress/compare-strict-eq-on-various-types.js:

(testAllTypesCall):

• stress/ftl-string-strict-equality.js:
• stress/missing-exception-check-in-string-compare.js:

Source/JavaScriptCore:

This patch attempts to optimize the performance of BigInts, when they are small (32 bit or less).
It works by inlining them into JSValue on 64-bit platforms, avoiding the allocation of a JSBigInt.
The bit pattern we use is 0000:XXXX:XXXX:0012
This representation works because of the following things:

• It cannot be confused with a Double or Integer thanks to the top bits
• It cannot be confused with a pointer to a Cell, thanks to bit 1 which is set to true
• It cannot be confused with a pointer to wasm thanks to bit 0 which is set to false
• It cannot be confused with true/false because bit 2 is set to false
• It cannot be confused for null/undefined because bit 4 is set to true

This entire change is gated by USE(BIGINT32), to make it easier to disable if it turns out to have bugs.
It should also make it much easier to verify if a given bug comes from it or from something else.

Note that in this patch we create BigInt32s when parsing small BigInt constants, and most operations (e.g. Add or BitOr) produce a BigInt32 if both of their operands are BigInt32,
but we don't produce a BigInt32 from for example the substraction/division of two large heap-allocated JSBigInts, even if the result fits in 32-bits.
As a result, small BigInts can now either be heap-allocated or inlined in the JSValue.

This patch includes a significant refactor of various slow paths, which are now grouped together in Operations.h
Because this increased the size of Operations.h significantly, I split the parts of Operations.h which are only used by the GC into Scribble.h, to avoid bloating compile times.

In the DFG and FTL we now have 3 UseKinds for BigInts: HeapBigIntUse, BigInt32Use and AnyBigIntUse.
The latter is useful when we know that we are receiving BigInts, but speculation indicates a mix of heap-allocated and small (inlined) big-ints.

Unfortunately, a naive implementation of this patch significantly regresses the performance of StrictEq (and its variants), as it is no longer true that a cell and a non-cell cannot be equal.
Before this patch, the code was jumping to a slow path if either:

• at least one operand is a double
• or both operands are cells

Now, it also needs to jump to the slow path if at least one is a cell.
To recover this performance cost, I significantly rewrote this code, from

if (left is Cell && right is Cell) {

if (left == right)

return true;

goto slowPath;

}
if (! left is Int32) {

if (left is Number)

goto slowPath

}
if (! right is Int32) {

if (right is Number)

goto slowPath

}
return left == right

To the following:

if (left is Double

right is Double)

goto slowPath

if (left == right)

return true;

if (left is Cell

right is Cell)

goto slowPath

return false;

I believe this to be faster than just replacing (left is Cell && right is Cell) by an

, because I found a bit-trick to check (left is Double

right is Double) which should help reduce the pressure on the branch predictor.

Early JetStream2 tests appear to confirm that this patch is roughly neutral while it was a 0.5% regression before I used this trick, but the numbers are still too noisy, I plan to do more measurements before landing this patch.

I don't yet have performance numbers for this patch on a BigInt benchmark, I will get such numbers before trying to land it, but I'd like some review in the meantime.

• JavaScriptCore.xcodeproj/project.pbxproj:
• assembler/X86Assembler.h:

(JSC::X86Assembler::X86InstructionFormatter::SingleInstructionBufferWriter::memoryModRM):

• bytecode/ArithProfile.cpp:

(JSC::ArithProfile<BitfieldType>::emitObserveResult):
(JSC::ArithProfile<BitfieldType>::shouldEmitSetBigInt32 const):
(JSC::ArithProfile<BitfieldType>::shouldEmitSetHeapBigInt const):
(JSC::ArithProfile<BitfieldType>::emitSetHeapBigInt const):
(JSC::ArithProfile<BitfieldType>::emitSetBigInt32 const):
(WTF::printInternal):

• bytecode/ArithProfile.h:

(JSC::ObservedResults::didObserveNonInt32):
(JSC::ObservedResults::didObserveBigInt):
(JSC::ObservedResults::didObserveHeapBigInt):
(JSC::ObservedResults::didObserveBigInt32):
(JSC::ArithProfile::didObserveHeapBigInt const):
(JSC::ArithProfile::didObserveBigInt32 const):
(JSC::ArithProfile::setObservedHeapBigInt):
(JSC::ArithProfile::setObservedBigInt32):
(JSC::ArithProfile::observeResult):

• bytecode/BytecodeList.rb:
• bytecode/BytecodeLivenessAnalysisInlines.h:
• bytecode/BytecodeUseDef.cpp:

(JSC::computeUsesForBytecodeIndexImpl):
(JSC::computeDefsForBytecodeIndexImpl):

• bytecode/CodeBlock.cpp:
• bytecode/DataFormat.h:
• bytecode/MethodOfGettingAValueProfile.cpp:

(JSC::MethodOfGettingAValueProfile::emitReportValue const):

• bytecode/MethodOfGettingAValueProfile.h:
• bytecode/SpeculatedType.cpp:

(JSC::dumpSpeculation):
(JSC::speculationFromClassInfo):
(JSC::speculationFromStructure):
(JSC::speculationFromValue):
(JSC::speculationFromJSType):
(JSC::leastUpperBoundOfStrictlyEquivalentSpeculations):

• bytecode/SpeculatedType.h:

(JSC::isBigInt32Speculation):
(JSC::isHeapBigIntSpeculation):
(JSC::isBigIntSpeculation):

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitEqualityOpImpl):
(JSC::BytecodeGenerator::addBigIntConstant):

• bytecompiler/BytecodeGenerator.h:
• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::isToThisAnIdentity):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupToThis):
(JSC::DFG::FixupPhase::fixupToNumeric):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
(JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):

• dfg/DFGMayExit.cpp:
• dfg/DFGNode.h:

(JSC::DFG::Node::shouldSpeculateBigInt32):
(JSC::DFG::Node::shouldSpeculateHeapBigInt):

• dfg/DFGNodeType.h:
• dfg/DFGOSRExit.cpp:

(JSC::DFG::OSRExit::compileExit):

• dfg/DFGOSRExit.h:
• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):
(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
(JSC::DFG::SpeculativeJIT::compileValueBitNot):
(JSC::DFG::SpeculativeJIT::emitUntypedOrAnyBigIntBitOp):
(JSC::DFG::SpeculativeJIT::compileValueBitwiseOp):
(JSC::DFG::SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp):
(JSC::DFG::SpeculativeJIT::compileValueLShiftOp):
(JSC::DFG::SpeculativeJIT::compileValueBitRShift):
(JSC::DFG::SpeculativeJIT::compileShiftOp):
(JSC::DFG::SpeculativeJIT::compileValueAdd):
(JSC::DFG::SpeculativeJIT::compileValueSub):
(JSC::DFG::SpeculativeJIT::compileIncOrDec):
(JSC::DFG::SpeculativeJIT::compileValueNegate):
(JSC::DFG::SpeculativeJIT::compileValueMul):
(JSC::DFG::SpeculativeJIT::compileValueDiv):
(JSC::DFG::SpeculativeJIT::compileValueMod):
(JSC::DFG::SpeculativeJIT::compileValuePow):
(JSC::DFG::SpeculativeJIT::compare):
(JSC::DFG::SpeculativeJIT::compileStrictEq):
(JSC::DFG::SpeculativeJIT::speculateHeapBigInt):
(JSC::DFG::SpeculativeJIT::speculate):
(JSC::DFG::SpeculativeJIT::compileToNumeric):
(JSC::DFG::SpeculativeJIT::compileHeapBigIntEquality):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculateBigInt32Operand::SpeculateBigInt32Operand):
(JSC::DFG::SpeculateBigInt32Operand::~SpeculateBigInt32Operand):
(JSC::DFG::SpeculateBigInt32Operand::edge const):
(JSC::DFG::SpeculateBigInt32Operand::node const):
(JSC::DFG::SpeculateBigInt32Operand::gpr):
(JSC::DFG::SpeculateBigInt32Operand::use):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::speculateBigInt32):
(JSC::DFG::SpeculativeJIT::speculateAnyBigInt):
(JSC::DFG::SpeculativeJIT::fillSpeculateBigInt32):
(JSC::DFG::SpeculativeJIT::compileBigInt32Compare):
(JSC::DFG::SpeculativeJIT::compilePeepHoleBigInt32Branch):
(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

• dfg/DFGUseKind.cpp:

(WTF::printInternal):

• dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):
(JSC::DFG::isCell):

• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLCommonValues.cpp:

(JSC::FTL::CommonValues::initializeConstants):

• ftl/FTLCommonValues.h:
• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileValueAdd):
(JSC::FTL::DFG::LowerDFGToB3::compileValueSub):
(JSC::FTL::DFG::LowerDFGToB3::compileValueMul):
(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileValueDiv):
(JSC::FTL::DFG::LowerDFGToB3::compileValueMod):
(JSC::FTL::DFG::LowerDFGToB3::compileValuePow):
(JSC::FTL::DFG::LowerDFGToB3::compileValueBitNot):
(JSC::FTL::DFG::LowerDFGToB3::compileValueBitAnd):
(JSC::FTL::DFG::LowerDFGToB3::compileValueBitOr):
(JSC::FTL::DFG::LowerDFGToB3::compileValueBitXor):
(JSC::FTL::DFG::LowerDFGToB3::compileValueBitRShift):
(JSC::FTL::DFG::LowerDFGToB3::compileArithBitRShift):
(JSC::FTL::DFG::LowerDFGToB3::compileArithBitLShift):
(JSC::FTL::DFG::LowerDFGToB3::compileValueBitLShift):
(JSC::FTL::DFG::LowerDFGToB3::compileBitURShift):
(JSC::FTL::DFG::LowerDFGToB3::compileToNumeric):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareEq):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
(JSC::FTL::DFG::LowerDFGToB3::compileIsBigInt):
(JSC::FTL::DFG::LowerDFGToB3::emitBinarySnippet):
(JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet):
(JSC::FTL::DFG::LowerDFGToB3::boolify):
(JSC::FTL::DFG::LowerDFGToB3::buildTypeOf):
(JSC::FTL::DFG::LowerDFGToB3::lowHeapBigInt):
(JSC::FTL::DFG::LowerDFGToB3::lowBigInt32):
(JSC::FTL::DFG::LowerDFGToB3::isBigInt32):
(JSC::FTL::DFG::LowerDFGToB3::isNotBigInt32):
(JSC::FTL::DFG::LowerDFGToB3::unboxBigInt32):
(JSC::FTL::DFG::LowerDFGToB3::boxBigInt32):
(JSC::FTL::DFG::LowerDFGToB3::isNotAnyBigInt):
(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::isNotHeapBigIntUnknownWhetherCell):
(JSC::FTL::DFG::LowerDFGToB3::isNotHeapBigInt):
(JSC::FTL::DFG::LowerDFGToB3::isHeapBigInt):
(JSC::FTL::DFG::LowerDFGToB3::speculateHeapBigInt):
(JSC::FTL::DFG::LowerDFGToB3::speculateHeapBigIntUnknownWhetherCell):
(JSC::FTL::DFG::LowerDFGToB3::speculateBigInt32):
(JSC::FTL::DFG::LowerDFGToB3::speculateAnyBigInt):

• ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

• heap/HeapSnapshotBuilder.cpp:

(JSC::HeapSnapshotBuilder::json):

• heap/MarkedBlockInlines.h:
• heap/PreciseAllocation.cpp:
• inspector/agents/InspectorHeapAgent.cpp:

(Inspector::InspectorHeapAgent::getPreview):

• interpreter/Interpreter.cpp:

(JSC::sizeOfVarargs):

• jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::emitConvertValueToBoolean):
(JSC::AssemblyHelpers::branchIfValue):

• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::branchIfBigInt32):
(JSC::AssemblyHelpers::branchIfBigInt32KnownNotNumber):
(JSC::AssemblyHelpers::branchIfNotBigInt32KnownNotNumber):
(JSC::AssemblyHelpers::branchIfHeapBigInt):
(JSC::AssemblyHelpers::branchIfNotHeapBigInt):
(JSC::AssemblyHelpers::unboxBigInt32):
(JSC::AssemblyHelpers::boxBigInt32):
(JSC::AssemblyHelpers::emitTypeOf):

• jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

• jit/JIT.h:
• jit/JITArithmetic.cpp:

(JSC::JIT::emit_op_negate):
(JSC::JIT::emitSlow_op_negate):

• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_is_big_int):
(JSC::JIT::compileOpStrictEq):
(JSC::JIT::compileOpStrictEqJump):
(JSC::JIT::emit_op_to_numeric):

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_is_big_int):
(JSC::JIT::emit_op_to_numeric):

• jit/JITOperations.cpp:
• jit/JITOperations.h:
• llint/LLIntOfflineAsmConfig.h:
• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter64.asm:
• parser/ParserArena.cpp:

(JSC::IdentifierArena::makeBigIntDecimalIdentifier):

• runtime/ArrayPrototype.cpp:
• runtime/BigIntConstructor.cpp:

(JSC::toBigInt):
(JSC::callBigIntConstructor):

• runtime/BigIntObject.cpp:

(JSC::BigIntObject::create):
(JSC::BigIntObject::finishCreation):

• runtime/BigIntObject.h:
• runtime/BigIntPrototype.cpp:

(JSC::toThisBigIntValue):
(JSC::bigIntProtoFuncToStringImpl):

• runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):
(JSC::updateArithProfileForUnaryArithOp):
(JSC::updateArithProfileForBinaryArithOp):

• runtime/JSBigInt.cpp:

(JSC::JSBigInt::createStructure):
(JSC::JSBigInt::parseInt):
(JSC::JSBigInt::stringToBigInt):
(JSC::JSBigInt::inc):
(JSC::JSBigInt::dec):
(JSC::JSBigInt::bitwiseAnd):
(JSC::JSBigInt::toStringGeneric):
(JSC::JSBigInt::equalsToNumber):
(JSC::JSBigInt::equalsToInt32):

• runtime/JSBigInt.h:

(JSC::asHeapBigInt):

• runtime/JSCJSValue.cpp:

(JSC::JSValue::toNumberSlowCase const):
(JSC::JSValue::toObjectSlowCase const):
(JSC::JSValue::toThisSlowCase const):
(JSC::JSValue::synthesizePrototype const):
(JSC::JSValue::dumpInContextAssumingStructure const):
(JSC::JSValue::dumpForBacktrace const):
(JSC::JSValue::toStringSlowCase const):

• runtime/JSCJSValue.h:
• runtime/JSCJSValueInlines.h:

(JSC::JSValue::JSValue):
(JSC::JSValue::asHeapBigInt const):
(JSC::JSValue::isBigInt const):
(JSC::JSValue::isHeapBigInt const):
(JSC::JSValue::isBigInt32 const):
(JSC::JSValue::bigInt32AsInt32 const):
(JSC::JSValue::isPrimitive const):
(JSC::JSValue::getPrimitiveNumber):
(JSC::JSValue::toNumeric const):
(JSC::JSValue::toBigIntOrInt32 const):
(JSC::JSValue::equalSlowCaseInline):
(JSC::JSValue::strictEqualForCells):
(JSC::JSValue::strictEqual):
(JSC::JSValue::pureStrictEqual):
(JSC::JSValue::pureToBoolean const):

• runtime/JSCell.cpp:

(JSC::JSCell::put):
(JSC::JSCell::putByIndex):
(JSC::JSCell::toPrimitive const):
(JSC::JSCell::getPrimitiveNumber const):
(JSC::JSCell::toNumber const):
(JSC::JSCell::toObjectSlow const):

• runtime/JSCell.h:
• runtime/JSCellInlines.h:

(JSC::JSCell::isHeapBigInt const):
(JSC::JSCell::toBoolean const):
(JSC::JSCell::pureToBoolean const):

• runtime/JSString.h:

(JSC::JSValue::toBoolean const):

• runtime/JSType.cpp:

(WTF::printInternal):

• runtime/JSType.h:
• runtime/JSTypeInfo.h:
• runtime/ObjectInitializationScope.cpp:
• runtime/Operations.cpp:

(JSC::jsAddSlowCase):
(JSC::jsIsObjectTypeOrNull):

• runtime/Operations.h:

(JSC::compareBigIntToOtherPrimitive):
(JSC::bigIntCompare):
(JSC::jsLess):
(JSC::jsLessEq):
(JSC::arithmeticBinaryOp):
(JSC::jsSub):
(JSC::jsMul):
(JSC::jsDiv):
(JSC::jsRemainder):
(JSC::jsPow):
(JSC::jsInc):
(JSC::jsDec):
(JSC::jsBitwiseNot):
(JSC::shift):
(JSC::jsLShift):
(JSC::jsRShift):
(JSC::bitwiseBinaryOp):
(JSC::jsBitwiseAnd):
(JSC::jsBitwiseOr):
(JSC::jsBitwiseXor):

• runtime/Scribble.h: Copied from Source/JavaScriptCore/runtime/BigIntObject.h.

(JSC::scribbleFreeCells):
(JSC::isScribbledValue):
(JSC::scribble):

• runtime/StructureInlines.h:

(JSC::prototypeForLookupPrimitiveImpl):

Source/WTF:

Add a USE(BIGINT32) flag.

• wtf/PlatformUse.h:

7:08 PM Changeset in webkit [260330] by beidson@apple.com

• 7 edits in trunk

Fix WebUserContentControllerProxy vs ContentWorld lifetime
​https://bugs.webkit.org/show_bug.cgi?id=210700

Reviewed by Alex Christensen.

Source/WebKit:

Covered by API test.

WebUserContentControllerProxy currently keeps all of its associated API::ContentWorlds alive via RefPtrs.

This is despite the fact that all of the associated WebScriptMessageHandlers, UserScripts, and
UserStyleSheets already keep their associated API::ContentWorlds alive.

It then decideds to tell WebProcesses to forget a content world after all of its clients are removed.

Unfortunately, content worlds are used for more than just content controller stuff. They're used for direct
JavaScript evaluation as well.

So a client could:

• Add a script message handler in a content world.
• Evaluate JavaScript in that content world, setting up some persistent state.
• Remove the script message handler.
• Find that their persistent state from the JavaScript evaluation is gone from that world, even though they still retain a usable handle to that world.

The only party who has any business managing the lifetime of an API::ContentWorld is the API::ContentWorld itself.

Making this change is:

1 - Nice cleanup
2 - Fixes the above mentioned bug

• UIProcess/API/APIContentWorld.cpp:

(API::ContentWorld::worldForIdentifier):
(API::ContentWorld::ContentWorld):
(API::ContentWorld::sharedWorldWithName):
(API::ContentWorld::~ContentWorld):
(API::ContentWorld::addAssociatedUserContentControllerProxy):
(API::ContentWorld::userContentControllerProxyDestroyed):

• UIProcess/API/APIContentWorld.h:

• UIProcess/UserContent/WebUserContentControllerProxy.cpp:

(WebKit::WebUserContentControllerProxy::parameters const):
(WebKit::WebUserContentControllerProxy::addContentWorld):
(WebKit::WebUserContentControllerProxy::contentWorldDestroyed):
(WebKit::WebUserContentControllerProxy::addUserScript):
(WebKit::WebUserContentControllerProxy::removeUserScript):
(WebKit::WebUserContentControllerProxy::removeAllUserScripts):
(WebKit::WebUserContentControllerProxy::addUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeAllUserStyleSheets):
(WebKit::WebUserContentControllerProxy::addUserScriptMessageHandler):
(WebKit::WebUserContentControllerProxy::removeUserMessageHandlerForName):
(WebKit::WebUserContentControllerProxy::removeAllUserMessageHandlers):
(WebKit::WebUserContentControllerProxy::addContentWorldUse): Deleted.
(WebKit::WebUserContentControllerProxy::shouldSendRemoveContentWorldsMessage): Deleted.
(WebKit::WebUserContentControllerProxy::removeContentWorldUses): Deleted.

• UIProcess/UserContent/WebUserContentControllerProxy.h:

Tools:

• TestWebKitAPI/Tests/WebKitCocoa/WKWebViewEvaluateJavaScript.mm:

(-[DummyMessageHandler userContentController:didReceiveScriptMessage:]):
(TEST): Make sure removing a script message handler from a particular world

doesn't also destroy the other JavaScript contents of that world.

4:32 PM Changeset in webkit [260329] by achristensen@apple.com

• 5 edits in branches/safari-609-branch/Source/JavaScriptCore

Branch build fix after r260286
​https://bugs.webkit.org/show_bug.cgi?id=210583
<rdar://problem/61943707>

The branch used ensureStillAliveHere but did not have the rename of that function in r258825,
so this effectively merges that revision, too, to make the branch and trunk more similar.

No change in behavior, just rename to successfully compile.

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayIndexOf):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCodePointAt):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):

4:23 PM Changeset in webkit [260328] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebKit

Attempt #4 to fix tvOS build

Unreviewed.

• WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::platformInitializeWebProcess):

• Add #if ENABLE(VIDEO_PRESENTATION_MODE)/#endif to protect function defined in WebCore/PictureInPictureSupport.h.
• See previous build fixes in r260307, r260308 and r260313.

4:20 PM Changeset in webkit [260327] by dbates@webkit.org

• 2 edits in trunk/Tools

Add some more tests for -focusTextInputContext:placeCaretAt:completionHandler:
​https://bugs.webkit.org/show_bug.cgi?id=210624

Reviewed by Simon Fraser.

Test behavior when the target element is already focused, when the target element
is programmatically replaced, and focusing the target element after the page was
navigated away.

Also while I am here, fix up the test FocusFieldAndPlaceCaretOutsideField to
use the size of the exampleText constant - 1 instead of hardcoding this value.
This will future proof this test should the example text string literal change.

• TestWebKitAPI/Tests/WebKitCocoa/RequestTextInputContext.mm:

(TEST):

4:17 PM Changeset in webkit [260326] by dbates@webkit.org

• 1 edit
  2 adds in trunk/LayoutTests

Add a test to ensure WebKit::mayContainEditableElementsInRect() returns true if the document element is editable
​https://bugs.webkit.org/show_bug.cgi?id=210560

Reviewed by Simon Fraser.

If the document element is marked editable then all child elements are editable.
Add a test to ensure that WebKit::mayContainEditableElementsInRect() returns true
for such a page.

• editing/editable-region/hit-test-editable-document-element-expected.txt: Added.
• editing/editable-region/hit-test-editable-document-element.html: Added.

4:02 PM Changeset in webkit [260325] by keith_miller@apple.com

• 3 edits in trunk/Source/JavaScriptCore

Unreviewed, remove commented out/dead code that didn't failed to
get removed when landing r260323.

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

• runtime/CommonSlowPaths.cpp:

(JSC::iterator_next_try_fast):

2:52 PM Changeset in webkit [260324] by fpizlo@apple.com

• 3 edits in trunk/Websites/webkit.org

Unreviewed, check in some more files for a blog post.

• blog-files/speculation-in-jsc/osr-exit-implicit-control-flow.graffle:
• blog-files/speculation-in-jsc/osr-exit-implicit-control-flow.svg:

2:45 PM Changeset in webkit [260323] by keith_miller@apple.com

• 83 edits
  1 copy
  13 adds in trunk

Redesign how we do for-of iteration for JSArrays
​https://bugs.webkit.org/show_bug.cgi?id=175454

JSTests:

Reviewed by Filip Pizlo.

• microbenchmarks/for-of-iterate-array-entries.js:

(foo):

• stress/custom-iterators.js:

(catch):
(iter.return):
(iteratorInterfaceErrorTest):
(iteratorInterfaceErrorTestReturn):
(iteratorInterfaceBreakTestReturn):

• stress/for-of-array-different-globals.js: Added.

(foo):
(array.Symbol.iterator.proto.next):

• stress/for-of-array-mixed-values.js: Added.

(test):

• stress/for-of-no-direct-loop-back-edge-osr.js: Added.

(osrIfFinalTier):
(test):

• stress/generator-containing-for-of-on-map.js: Added.

(find):
(i.let.v.of.find):

• stress/generator-containing-for-of-on-set.js: Added.

(find):
(set add):

• stress/osr-from-for-of-done-getter.js: Added.

(i.let.iterable.next.return.get done):
(i.let.iterable.next):
(i.let.iterable.Symbol.iterator):
(i.let.iterable.return):

• stress/osr-from-for-of-value-getter.js: Added.

(i.let.iterable.next.return.get value):
(i.let.iterable.next):
(i.let.iterable.Symbol.iterator):
(i.let.iterable.return):

• stress/throw-for-of-next-returns-non-object.js: Added.

(i.let.iterable.next):
(i.let.iterable.Symbol.iterator):
(i.let.iterable.return):
(i.catch):

• stress/throw-from-done-getter-in-for-of-header.js: Added.

(i.let.iterable.next):
(i.let.iterable.get done):
(i.let.iterable.Symbol.iterator):
(i.let.iterable.return):
(i.catch):

• stress/throw-from-next-in-for-of-header.js: Added.

(i.let.iterable.next):
(i.let.iterable.Symbol.iterator):
(i.let.iterable.return):
(i.catch):

• stress/throw-from-value-getter-in-for-of-header.js: Added.

(i.let.iterable.next):
(i.let.iterable.get value):
(i.let.iterable.Symbol.iterator):
(i.let.iterable.return):
(i.catch):

• stress/webidl-tokenizer-for-of.js: Added.

(tokenise.attemptTokenMatch):
(tokenise):
(Tokeniser):
(Tokeniser.prototype.probe):
(Tokeniser.prototype.consume):
(Tokeniser.prototype.unconsume):

Source/JavaScriptCore:

Reviewed by Filip Pizlo and Saam Barati.

This patch intrinsics for-of iteration for JSArrays when they are
being iterated with the built-in Symbol.iterator. We do this by
adding two new bytecodes op_iterator_open and
op_iterator_next. These bytecodes are essentially a fused set of
existing bytecodes with a special case for our intrinsiced JSArray
case. This patch only adds support for these instructions on
64-bit.

The op_iterator_open bytecode is semantically the same as:
iterator = symbolIterator.@call(iterable);
next = iterator.next;

where iterable is the rhs of the for-of and symbolIterator is the
result of running iterable.symbolIterator;

The op_iterator_next bytecode is semantically the same as:
nextResult = next.@call(iterator);
done = nextResult.done;
value = done ? (undefined / bottom) : nextResult.value;

where nextResult is a temporary (the value VirtualRegister in the
LLInt/Baseline and a tmp in the DFG).

In order to make sure these bytecodes have the same perfomance as
the existing bytecode sequence, we need to make sure we have the
same profiling data and inline caching. Most of the existing
get_by_id code assumed a particular bytecode member name was the
same in each flavor get_by_id access. This patch adds template
specialized functions that vend the correct
Profile/VirtualRegister for the current bytecode/checkpoint. This
means we can have meaningful names for our Bytecode structs and
still use the generic functions.

In the LLInt most of the logic for calls/get_by_id had to be
factored into helper macros, so we could have bytecodes that are
some combination of those.

The trickiest part of this patch was getting the hand rolled DFG
IR to work correctly. This is because we don't have a great way to
express large chucks of DFG graph that doesn't involve manually
tracking all the DFG's invariants. Such as:

1) Flushing/Phantoming values at the end of each block.
2) Rolling forwards and backwards the BytecodeIndex when switching

blocks.

3) Remembering to GetLocal each variable at the top of every block.
4) Ensuring that the JSValue stored to the op_iterator_next.m_value

local does not cause us to OSR exit at the set local.

(4) is handled by a new function, bottomValueMatchingSpeculation,
on DFGGraph that produces a FrozenValue that is roughly the bottom
for a given speculated type. In a future patch we should make this
more complete, probably by adding a VM::bottomCellForSetLocal that
prediction propagation and AI know how treat as a true bottom
value. See: ​https://bugs.webkit.org/show_bug.cgi?id=210694

Lastly, this patch changes the DFG NodeType, CheckCell to be
CheckIsConstant. CheckIsConstant is equivalent to the == operator
on JSValue where it just checks the register values are the
same. In order to keep the same perf that we had for CheckCell,
CheckIsConstant supports CellUse.

• CMakeLists.txt:
• JavaScriptCore.xcodeproj/project.pbxproj:
• assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::or8):
(JSC::MacroAssemblerARM64::store8):

• assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::or8):

• bytecode/ArrayProfile.h:

(JSC::ArrayProfile::observeStructureID):
(JSC::ArrayProfile::observeStructure):

• bytecode/BytecodeList.rb:
• bytecode/BytecodeLivenessAnalysis.cpp:

(JSC::tmpLivenessForCheckpoint):

• bytecode/BytecodeOperandsForCheckpoint.h: Added.

(JSC::arrayProfileForImpl):
(JSC::hasArrayProfileFor):
(JSC::arrayProfileFor):
(JSC::valueProfileForImpl):
(JSC::hasValueProfileFor):
(JSC::valueProfileFor):
(JSC::destinationFor):
(JSC::calleeFor):
(JSC::argumentCountIncludingThisFor):
(JSC::stackOffsetInRegistersForCall):
(JSC::callLinkInfoFor):

• bytecode/BytecodeUseDef.cpp:

(JSC::computeUsesForBytecodeIndexImpl):
(JSC::computeDefsForBytecodeIndexImpl):

• bytecode/CallLinkInfo.cpp:

(JSC::CallLinkInfo::callTypeFor):

• bytecode/CallLinkStatus.cpp:

(JSC::CallLinkStatus::computeFromLLInt):

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::finalizeLLIntInlineCaches):
(JSC::CodeBlock::tryGetValueProfileForBytecodeIndex):

• bytecode/CodeBlock.h:

(JSC::CodeBlock::instructionAt const):

• bytecode/CodeBlockInlines.h:

(JSC::CodeBlock::forEachValueProfile):
(JSC::CodeBlock::forEachArrayProfile):

• bytecode/GetByStatus.cpp:

(JSC::GetByStatus::computeFromLLInt):

• bytecode/Instruction.h:

(JSC::BaseInstruction::width const):
(JSC::BaseInstruction::hasCheckpoints const):
(JSC::BaseInstruction::asKnownWidth const):
(JSC::BaseInstruction::wide16 const):
(JSC::BaseInstruction::wide32 const):

• bytecode/InstructionStream.h:
• bytecode/IterationModeMetadata.h: Copied from Source/JavaScriptCore/bytecode/SuperSampler.h.
• bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp:

(JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::fireInternal):
(JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::clearLLIntGetByIdCache):

• bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h:
• bytecode/Opcode.h:
• bytecode/SpeculatedType.h:

(JSC::isSubtypeSpeculation):
(JSC::speculationContains):

• bytecode/SuperSampler.h:

(JSC::SuperSamplerScope::release):

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitGenericEnumeration):
(JSC::BytecodeGenerator::emitEnumeration):
(JSC::BytecodeGenerator::emitIsEmpty):
(JSC::BytecodeGenerator::emitIteratorOpen):
(JSC::BytecodeGenerator::emitIteratorNext):
(JSC::BytecodeGenerator::emitGetGenericIterator):
(JSC::BytecodeGenerator::emitIteratorGenericNext):
(JSC::BytecodeGenerator::emitIteratorGenericNextWithValue):
(JSC::BytecodeGenerator::emitIteratorGenericClose):
(JSC::BytecodeGenerator::emitGetAsyncIterator):
(JSC::BytecodeGenerator::emitDelegateYield):
(JSC::BytecodeGenerator::emitIteratorNextWithValue): Deleted.
(JSC::BytecodeGenerator::emitIteratorClose): Deleted.
(JSC::BytecodeGenerator::emitGetIterator): Deleted.

• bytecompiler/BytecodeGenerator.h:
• bytecompiler/NodesCodegen.cpp:

(JSC::ArrayPatternNode::bindValue const):

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):

• dfg/DFGAtTailAbstractState.h:

(JSC::DFG::AtTailAbstractState::size const):
(JSC::DFG::AtTailAbstractState::numberOfTmps const):
(JSC::DFG::AtTailAbstractState::atIndex):
(JSC::DFG::AtTailAbstractState::tmp):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::progressToNextCheckpoint):
(JSC::DFG::ByteCodeParser::get):
(JSC::DFG::ByteCodeParser::set):
(JSC::DFG::ByteCodeParser::jsConstant):
(JSC::DFG::ByteCodeParser::weakJSConstant):
(JSC::DFG::ByteCodeParser::addCall):
(JSC::DFG::ByteCodeParser::allocateUntargetableBlock):
(JSC::DFG::ByteCodeParser::handleCall):
(JSC::DFG::ByteCodeParser::emitFunctionChecks):
(JSC::DFG::ByteCodeParser::inlineCall):
(JSC::DFG::ByteCodeParser::handleCallVariant):
(JSC::DFG::ByteCodeParser::handleVarargsInlining):
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::handleMinMax):
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
(JSC::DFG::ByteCodeParser::handleDOMJITCall):
(JSC::DFG::ByteCodeParser::handleIntrinsicGetter):
(JSC::DFG::ByteCodeParser::handleDOMJITGetter):
(JSC::DFG::ByteCodeParser::handleModuleNamespaceLoad):
(JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):
(JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
(JSC::DFG::ByteCodeParser::handlePutByVal):
(JSC::DFG::ByteCodeParser::handleCreateInternalFieldObject):
(JSC::DFG::ByteCodeParser::parse):

• dfg/DFGCFGSimplificationPhase.cpp:

(JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
(JSC::DFG::CFGSimplificationPhase::jettisonBlock):
(JSC::DFG::CFGSimplificationPhase::mergeBlocks):

• dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::addStringReplacePrimordialChecks):

• dfg/DFGForAllKills.h:

(JSC::DFG::forAllKilledOperands):

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::bottomValueMatchingSpeculation):

• dfg/DFGGraph.h:
• dfg/DFGInPlaceAbstractState.cpp:

(JSC::DFG::InPlaceAbstractState::beginBasicBlock):
(JSC::DFG::InPlaceAbstractState::initialize):
(JSC::DFG::InPlaceAbstractState::endBasicBlock):
(JSC::DFG::InPlaceAbstractState::merge):

• dfg/DFGInPlaceAbstractState.h:

(JSC::DFG::InPlaceAbstractState::size const):
(JSC::DFG::InPlaceAbstractState::numberOfTmps const):
(JSC::DFG::InPlaceAbstractState::atIndex):
(JSC::DFG::InPlaceAbstractState::operand):
(JSC::DFG::InPlaceAbstractState::local):
(JSC::DFG::InPlaceAbstractState::argument):
(JSC::DFG::InPlaceAbstractState::variableAt): Deleted.

• dfg/DFGLazyJSValue.h:

(JSC::DFG::LazyJSValue::speculatedType const):

• dfg/DFGNode.h:

(JSC::DFG::Node::hasConstant):
(JSC::DFG::Node::hasCellOperand):

• dfg/DFGNodeType.h:
• dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::callerReturnPC):

• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCheckIsConstant):
(JSC::DFG::SpeculativeJIT::compileCheckCell): Deleted.

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGValidate.cpp:
• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckIsConstant):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckCell): Deleted.

• generator/DSL.rb:
• generator/Metadata.rb:
• generator/Section.rb:
• jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):

• jit/JIT.h:
• jit/JITCall.cpp:

(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileOpCall):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):

• jit/JITCall32_64.cpp:

(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):

• jit/JITInlines.h:

(JSC::JIT::updateTopCallFrame):
(JSC::JIT::advanceToNextCheckpoint):
(JSC::JIT::emitJumpSlowToHotForCheckpoint):
(JSC::JIT::emitValueProfilingSite):

• jit/JITOperations.cpp:
• jit/JITOperations.h:
• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::setupGetByIdPrototypeCache):
(JSC::LLInt::performLLIntGetByID):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::genericCall):
(JSC::LLInt::handleIteratorOpenCheckpoint):
(JSC::LLInt::handleIteratorNextCheckpoint):
(JSC::LLInt::slow_path_checkpoint_osr_exit):
(JSC::LLInt::llint_dump_value):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• offlineasm/transform.rb:
• runtime/CommonSlowPaths.cpp:

(JSC::iterator_open_try_fast):
(JSC::iterator_open_try_fast_narrow):
(JSC::iterator_open_try_fast_wide16):
(JSC::iterator_open_try_fast_wide32):
(JSC::iterator_next_try_fast):
(JSC::iterator_next_try_fast_narrow):
(JSC::iterator_next_try_fast_wide16):
(JSC::iterator_next_try_fast_wide32):

• runtime/CommonSlowPaths.h:
• runtime/Intrinsic.cpp:

(JSC::interationKindForIntrinsic):

• runtime/Intrinsic.h:
• runtime/JSArrayIterator.h:
• runtime/JSCJSValue.h:
• runtime/JSCJSValueInlines.h:

(JSC::JSValue::isCallable const):

• runtime/JSCast.h:
• runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::arrayProtoValuesFunctionConcurrently const):

• runtime/OptionsList.h:
• runtime/Structure.cpp:

(JSC::Structure::dumpBrief const):

Source/WTF:

Reviewed by Filip Pizlo.

• wtf/EnumClassOperatorOverloads.h:

2:39 PM Changeset in webkit [260322] by commit-queue@webkit.org

• 5 edits in trunk

Fix client certificate authentication when using non-default WKWebsiteDataStores
​https://bugs.webkit.org/show_bug.cgi?id=210681

Patch by Alex Christensen <​achristensen@webkit.org> on 2020-04-18
Reviewed by Brady Eidson.

Source/WebKit:

NetworkProcessProxy was trying to keep a map of WebsiteDataStores, but it wasn't as accurate as the one WebsiteDataStore was maintaining.
Use the latter map instead and client certificate authentication works. Otherwise, the credential isn't serialized correctly.
I found this while working on <rdar://problem/60340449> but this was unrelated so I put it in a different change.
This may fix <rdar://problem/60910392>.

• UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::websiteDataStoreFromSessionID):

Tools:

• TestWebKitAPI/Tests/WebKitCocoa/Challenge.mm:

(TestWebKitAPI::TEST):

2:13 PM Changeset in webkit [260321] by ysuzuki@apple.com

• 25 edits in trunk/Source/JavaScriptCore

[JSC] Replace DFG NewPromise with NewInternalFieldObject
​https://bugs.webkit.org/show_bug.cgi?id=210687

Reviewed by Saam Barati.

The feature of DFG::NewPromise can be implemented completely with DFG::NewInternalFieldObject. This reduces code duplication, and furthermore,
this offers Object Allocation Sinking support for free. This patch replaces DFG::NewPromise with DFG::NewInternalFieldObject and remove DFG::NewPromise
completely.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGClobbersExitState.cpp:

(JSC::DFG::clobbersExitState):

• dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGNode.h:

(JSC::DFG::Node::convertToNewInternalFieldObject):
(JSC::DFG::Node::convertToNewInternalFieldObjectWithInlineFields):
(JSC::DFG::Node::hasIsInternalPromise):
(JSC::DFG::Node::hasStructure):
(JSC::DFG::Node::convertToNewPromise): Deleted.

• dfg/DFGNodeType.h:
• dfg/DFGObjectAllocationSinkingPhase.cpp:
• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewInternalFieldObject):
(JSC::DFG::SpeculativeJIT::compileNewPromise): Deleted.

• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGStoreBarrierInsertionPhase.cpp:
• ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileNewInternalFieldObject):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewInternalFieldObject):
(JSC::FTL::DFG::LowerDFGToB3::compileNewPromise): Deleted.

• ftl/FTLOperations.cpp:

(JSC::FTL::operationPopulateObjectInOSR):
(JSC::FTL::operationMaterializeObjectInOSR):

• runtime/JSInternalPromise.cpp:

(JSC::JSInternalPromise::createWithInitialValues):

• runtime/JSInternalPromise.h:
• runtime/JSPromise.cpp:

(JSC::JSPromise::createWithInitialValues):
(JSC::JSPromise::finishCreation):
(JSC::JSPromise::status const):
(JSC::JSPromise::result const):
(JSC::JSPromise::flags const):
(JSC::JSPromise::resolve):
(JSC::JSPromise::reject):
(JSC::JSPromise::rejectAsHandled):

• runtime/JSPromise.h:

(JSC::JSPromise::initialValues):
(JSC::JSPromise::internalField const):
(JSC::JSPromise::internalField):

2:08 PM Changeset in webkit [260320] by fpizlo@apple.com

• 1 edit
  2 adds in trunk/Websites/webkit.org

Unreviewed, check in some more files for a blog post.

• blog-files/speculation-in-jsc/osr-exit-implicit-control-flow.graffle: Added.
• blog-files/speculation-in-jsc/osr-exit-implicit-control-flow.svg: Added.

1:24 PM Changeset in webkit [260319] by Antti Koivisto

• 10 edits
  2 adds in trunk

[CSS selectors] Support :where() pseudo class
​https://bugs.webkit.org/show_bug.cgi?id=210690

Reviewed by Sam Weinig.

LayoutTests/imported/w3c:

• web-platform-tests/css/selectors/invalidation/where-expected.txt:

Source/WebCore:

"The Specificity-adjustment pseudo-class, :where(), is a functional pseudo-class with the same
syntax and functionality as :is(). Unlike :is(), neither the :where pseudo-class, nor any of
its arguments contribute to the specificity of the selector—its specificity is always zero.

This is useful for introducing filters in a selector while keeping the associated style
declarations easy to override."

​https://drafts.csswg.org/selectors-4/#zero-matches

In terms of implementation this is just another alias for :is() with different (always 0) specificity.

Test: fast/selectors/where-specificity.html

• css/CSSSelector.cpp:

(WebCore::simpleSelectorSpecificityInternal):

Here is where it differs from PseudoClassIs.

(WebCore::CSSSelector::selectorText const):

• css/CSSSelector.h:
• css/SelectorChecker.cpp:

(WebCore::SelectorChecker::checkOne const):

• css/SelectorPseudoClassAndCompatibilityElementMap.in:
• css/parser/CSSSelectorParser.cpp:

(WebCore::isOnlyPseudoClassFunction):
(WebCore::CSSSelectorParser::consumePseudo):

• cssjit/SelectorCompiler.cpp:

(WebCore::SelectorCompiler::addPseudoClassType):

LayoutTests:

• fast/selectors/where-specificity-expected.html: Added.
• fast/selectors/where-specificity.html: Added.

10:17 AM Changeset in webkit [260318] by Pablo Saavedra

• 2 edits in trunk/Source/WebKit

[GTK][WPE] Replace evil strtok() calls with fscanf() in MemoryPressureMonitor.cpp
​https://bugs.webkit.org/show_bug.cgi?id=210346

Reviewed by Adrian Perez de Castro.

• UIProcess/linux/MemoryPressureMonitor.cpp:

(WebKit::lowWatermarkPages):
(WebKit::getCgroupControllerPath):
(WebKit::systemMemoryUsedAsPercentage):
(WebKit::CGroupMemoryController::getCgroupFileValue):

10:04 AM Changeset in webkit [260317] by commit-queue@webkit.org

• 24 edits in trunk/Source

Reduce parameter list of the FrameLoadRequest constructor
​https://bugs.webkit.org/show_bug.cgi?id=210668

Patch by Rob Buis <​rbuis@igalia.com> on 2020-04-18
Reviewed by Darin Adler.

Source/WebCore:

Reduce parameter list of the FrameLoadRequest constructor by
instead using various setters. By choosing the most common
defaults the actual number of setters to call are minimized.

• inspector/InspectorFrontendClientLocal.cpp:

(WebCore::InspectorFrontendClientLocal::openInNewTab):

• inspector/agents/InspectorPageAgent.cpp:

(WebCore::InspectorPageAgent::navigate):

• loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::handleProvisionalLoadFailureFromContentFilter):

• loader/FrameLoadRequest.cpp:

(WebCore::FrameLoadRequest::FrameLoadRequest):

• loader/FrameLoadRequest.h:

(WebCore::FrameLoadRequest::FrameLoadRequest):
(WebCore::FrameLoadRequest::disableShouldReplaceDocumentIfJavaScriptURL):

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::changeLocation):
(WebCore::FrameLoader::loadURLIntoChildFrame):

• loader/NavigationScheduler.cpp:

(WebCore::NavigationScheduler::scheduleLocationChange):

• page/ContextMenuController.cpp:

(WebCore::openNewWindow):
(WebCore::ContextMenuController::contextMenuItemSelected):

• page/DOMWindow.cpp:

(WebCore::DOMWindow::createWindow):

• page/DragController.cpp:

(WebCore::DragController::performDragOperation):

Source/WebKit:

Adapt to API change.

• WebProcess/Inspector/WebInspector.cpp:

(WebKit::WebInspector::openInNewTab):

• WebProcess/Plugins/PluginView.cpp:

(WebKit::PluginView::performFrameLoadURLRequest):
(WebKit::PluginView::loadURL):

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::loadURLInFrame):
(WebKit::WebPage::loadDataInFrame):
(WebKit::WebPage::loadRequest):
(WebKit::WebPage::loadDataImpl):

Source/WebKitLegacy/ios:

Adapt to API change.

• WebView/WebPDFViewPlaceholder.mm:

(-[WebPDFViewPlaceholder simulateClickOnLinkToURL:]):

Source/WebKitLegacy/mac:

Adapt to API change.

• Plugins/WebPluginController.mm:

(-[WebPluginController webPlugInContainerLoadRequest:inFrame:]):

• WebView/WebFrame.mm:

(-[WebFrame loadRequest:]):
(-[WebFrame _loadData:MIMEType:textEncodingName:baseURL:unreachableURL:]):

• WebView/WebPDFView.mm:

(-[WebPDFView PDFViewWillClickOnLink:withURL:]):

Source/WebKitLegacy/win:

Adapt to API change.

• Plugins/PluginView.cpp:

(WebCore::PluginView::start):
(WebCore::PluginView::performRequest):
(WebCore::PluginView::getURLNotify):
(WebCore::PluginView::getURL):
(WebCore::PluginView::handlePost):

• WebFrame.cpp:

(WebFrame::loadRequest):
(WebFrame::loadData):

9:35 AM Changeset in webkit [260316] by ddkilzer@apple.com

• 5 edits in trunk/Source/WebKit

[IPC hardening] Use MESSAGE_CHECK in WebPasteboardProxy
<​https://webkit.org/b/210684>
<rdar://problem/59906721>

Reviewed by Wenson Hsieh.

• UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:
• Add missing #undef of MESSAGE_CHECK_COMPLETION and MESSAGE_CHECK_WITH_RETURN_VALUE.

(WebKit::WebPasteboardProxy::getPasteboardPathnamesForType):
(WebKit::WebPasteboardProxy::getPasteboardStringForType):
(WebKit::WebPasteboardProxy::getPasteboardStringsForType):
(WebKit::WebPasteboardProxy::getPasteboardBufferForType):
(WebKit::WebPasteboardProxy::setPasteboardStringForType):
(WebKit::WebPasteboardProxy::setPasteboardBufferForType):
(WebKit::WebPasteboardProxy::typesSafeForDOMToReadAndWrite):
(WebKit::WebPasteboardProxy::readStringFromPasteboard):
(WebKit::WebPasteboardProxy::readBufferFromPasteboard):

• Replace existing code with MESSAGE_CHECK_COMPLETION macros.

• UIProcess/WebPasteboardProxy.cpp:

(WebKit::WebPasteboardProxy::typesSafeForDOMToReadAndWrite):

• UIProcess/WebPasteboardProxy.h:
• UIProcess/WebPasteboardProxy.messages.in:
• Add IPC::Connection to TypesSafeForDOMToReadAndWrite.

9:33 AM Changeset in webkit [260315] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebKitLegacy/mac

-[WebPreferences initWithCoder:] should use -[NSCoder decodeValueOfObjCType:at:size:]
<​https://webkit.org/b/210621>
<rdar://problem/61906458>

Reviewed by Anders Carlsson.

• WebView/WebPreferences.mm:

(-[WebPreferences initWithCoder:]):

• Switch to -[NSCoder decodeValueOfObjCType:at:size:].

9:25 AM Changeset in webkit [260314] by ysuzuki@apple.com

• 2 edits in trunk/Source/JavaScriptCore

Unreviewed, build fix for ARM64E after r260310
​https://bugs.webkit.org/show_bug.cgi?id=207330

r260310 uses undefined function Instruction.cloneWithNewOperands in arm64e.rb and throws an error.
This patch calls node.cloneWithNewOperands.

• offlineasm/arm64e.rb:

9:01 AM Changeset in webkit [260313] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebCore

Attempt #3 to fix tvOS build

Unreviewed.

• platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer):
(WebCore::MediaPlayerPrivateAVFoundationObjC::updateDisableExternalPlayback):

• Use !PLATFORM(APPLETV) to comment out functions declared within ENABLE(VIDEO_PRESENTATION_MODE) from r260307 and r260308.

9:01 AM Changeset in webkit [260312] by Alexey Shvayka

• 9 edits
  1 add in trunk

RegExp.prototype[@@search] should use SameValue
​https://bugs.webkit.org/show_bug.cgi?id=173226

Reviewed by Yusuke Suzuki.

JSTests:

• stress/same-value-intrinsic.js: Added.
• test262/expectations.yaml: Mark 4 test cases as passing.

Source/JavaScriptCore:

This change exposes Object.is implementation as link-time-constant @sameValue and utilizes
it in RegExp.prototype[@@search] per spec [1], aligning JSC with V8 and SpiderMonkey.

[1]: ​https://tc39.es/ecma262/#sec-regexp.prototype-@@search (steps 5, 8)

• builtins/BuiltinNames.h:
• builtins/RegExpPrototype.js:

(Symbol.search):

• bytecode/LinkTimeConstant.h:
• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

• runtime/ObjectConstructor.cpp:
• runtime/ObjectConstructor.h:

8:57 AM Changeset in webkit [260311] by ysuzuki@apple.com

• 12 edits
  1 move in trunk/Source

[WTF] Move DataRef.h from WebCore to WTF to utilize it in JSC
​https://bugs.webkit.org/show_bug.cgi?id=210689

Reviewed by Anders Carlsson.

Source/WebCore:

No behavior change, just moving header from WebCore to WTF.

• Headers.cmake:
• WebCore.xcodeproj/project.pbxproj:
• rendering/style/NinePieceImage.h:
• rendering/style/RenderStyle.h:
• rendering/style/SVGRenderStyle.h:
• rendering/style/StyleRareInheritedData.cpp:
• rendering/style/StyleRareInheritedData.h:
• rendering/style/StyleRareNonInheritedData.h:

Source/WTF:

• WTF.xcodeproj/project.pbxproj:
• wtf/CMakeLists.txt:
• wtf/DataRef.h: Renamed from Source/WebCore/rendering/style/DataRef.h.

7:59 AM Changeset in webkit [260310] by commit-queue@webkit.org

• 5 edits in trunk/Source/JavaScriptCore

Fix code origin when lowering offlineasm instructions on MIPS/ARM64E
​https://bugs.webkit.org/show_bug.cgi?id=207330

Patch by Angelos Oikonomopoulos <Angelos Oikonomopoulos> on 2020-04-18
Reviewed by Mark Lam.

Instruction operands are mapped to RegisterID in RegisterID.forName
and the operation is memoized. Therefore, we can't use the codeOrigin
of the operand at that point. Use the codeOrigin of the original
instruction instead.

• offlineasm/arm64e.rb:
• offlineasm/ast.rb:
• offlineasm/mips.rb:
• offlineasm/risc.rb:

7:19 AM Changeset in webkit [260309] by commit-queue@webkit.org

• 2 edits in trunk/Source/JavaScriptCore

REGRESSION(r260246): It broke build on MIPS32
​https://bugs.webkit.org/show_bug.cgi?id=210665

Patch by Angelos Oikonomopoulos <Angelos Oikonomopoulos> on 2020-04-18
Reviewed by Aakash Jain.

The mnemonic for 'store halfword' is 'sh', not 'shv'. This appears to
be a typo in a path that was never exercised.

Exposed by r260246; riscLowerMisplacedAddresses now calls into
riscAsRegisters with an 'h' suffix, which results in a 'storeh'
instruction. The storeh is then lowered to the non-existent 'shv'.

• offlineasm/mips.rb:

4:58 AM Changeset in webkit [260308] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebCore

Attempt #2 to fix tvOS build

Unreviewed.

• platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
• Add #if ENABLE(VIDEO_PRESENTATION_MODE)/#endif to protect methods defined in MediaPlayerPrivate.h.
• The previous commit was (r260307) also to fix tvOS, not watchOS.

12:15 AM Changeset in webkit [260307] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebCore

Attempt to fix watchOS build

Unreviewed.

• platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
• Add #if ENABLE(VIDEO_PRESENTATION_MODE)/#endif to protect methods defined in MediaPlayerPrivate.h.

Apr 17, 2020:

8:04 PM Changeset in webkit [260306] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebKitLegacy/mac

[iOS WK1] -[_WebSafeForwarder asyncForwarder] uses non-static dispatch_once_t predicate
<​https://webkit.org/b/210625>

Reviewed by Daniel Bates.

Remove use of dispatch_once to initialize
_WebSafeForwarder._asyncForwarder, and modernize both
_WebSafeForwarder and _WebSafeAsyncForwarder classes.

• WebView/WebView.mm:

(@interface _WebSafeAsyncForwarder):

• Make _forwarder weak. It can't be strong or a retain cycle would be created between this object and _WebSafeForwarder.
• Change return type from id to instancetype for -[_WebSafeAsyncForwarder initWithForwarder:].

(@interface _WebSafeForwarder):

• Make _target weak and rename from target.
• Make _defaultTarget weak and rename from defaultTarget.
• Rename _asyncForwarder from asyncForwarder.
• Delete unused asyncForwarderPred.
• Replace -asyncForwarder method declaration with a @property definition.

(-[_WebSafeForwarder initWithTarget:defaultTarget:]):

• Update for instance variable renames.
• Iniitalize _asyncForwarder here. There are (at most) eight _WebSafeForwarder objects created per WebView, so creating this object in the constructor seems reasonable.

(-[_WebSafeForwarder asyncForwarder:]):

• Delete this method (and use of dispatch_once, fixing the bug). Replace with @synthesize statement.

(-[_WebSafeForwarder dealloc:]):

• Update for instance variable renames, and assign nil to all instance variables.

(-[_WebSafeForwarder forwardInvocation:]):
(-[_WebSafeForwarder respondsToSelector:]):
(-[_WebSafeForwarder methodSignatureForSelector:]):

• Update for instance variable renames.

(-[_WebSafeForwarder initWithForwarder:]):

• Change return type from id to instancetype.

6:37 PM Changeset in webkit [260305] by Simon Fraser

• 45 edits in trunk

Group overflow controls layers into a single container layer
​https://bugs.webkit.org/show_bug.cgi?id=210675

Reviewed by Zalan Bujtas.

Source/WebCore:

Overflow control layers are going to change z-order in a future change. To make this
easier, group the overflow controls layer into their own container layer.

• rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::updateDebugIndicators):
(WebCore::RenderLayerBacking::updateGeometry): Size the overflow controls layer using paddingBoxRectIncludingScrollbar().
(WebCore::RenderLayerBacking::updateInternalHierarchy): New parenting.
(WebCore::RenderLayerBacking::updateOverflowControlsLayers): Some refactoring with a nice lambda.
(WebCore::RenderLayerBacking::positionOverflowControlsLayers): Lovely lambda here. Nice.

• rendering/RenderLayerBacking.h:

LayoutTests:

Rebaselines.

• compositing/clipping/border-radius-async-overflow-clipping-layer-expected.txt:
• compositing/layer-creation/absolute-in-async-overflow-scroll-expected.txt:
• compositing/layer-creation/clipping-scope/nested-scroller-overlap-expected.txt:
• compositing/layer-creation/clipping-scope/overlap-constrained-inside-scroller-expected.txt:
• compositing/layer-creation/clipping-scope/overlap-constrained-inside-stacking-context-scroller-expected.txt:
• compositing/layer-creation/clipping-scope/scroller-with-negative-z-children-expected.txt:
• compositing/layer-creation/clipping-scope/shared-layers-in-scroller-expected.txt:
• compositing/overflow/overflow-auto-with-touch-expected.txt:
• compositing/overflow/overflow-overlay-with-touch-expected.txt:
• compositing/overflow/overflow-scrollbar-layer-positions-expected.txt:
• compositing/overflow/scrolling-content-clip-to-viewport-expected.txt:
• compositing/overflow/stacking-context-composited-scroller-with-foreground-paint-phases-expected.txt:
• compositing/overflow/textarea-scroll-touch-expected.txt:
• compositing/repaint/scroller-with-foreground-layer-repaints-expected.txt:
• compositing/rtl/rtl-scrolling-with-transformed-descendants-expected.txt:
• compositing/scrolling/async-overflow-scrolling/clipped-layer-in-overflow-clipped-by-scroll-expected.txt:
• compositing/scrolling/async-overflow-scrolling/clipped-layer-in-overflow-expected.txt:
• compositing/scrolling/async-overflow-scrolling/clipped-layer-in-overflow-nested-expected.txt:
• compositing/scrolling/async-overflow-scrolling/layer-for-negative-z-in-scroller-expected.txt:
• compositing/scrolling/async-overflow-scrolling/layer-in-overflow-clip-to-hidden-expected.txt:
• compositing/scrolling/async-overflow-scrolling/layer-in-overflow-clip-to-visible-expected.txt:
• compositing/scrolling/async-overflow-scrolling/layer-in-overflow-expected.txt:
• compositing/scrolling/async-overflow-scrolling/layer-in-overflow-gain-clipping-layer-expected.txt:
• compositing/scrolling/async-overflow-scrolling/layer-in-overflow-in-clipped-expected.txt:
• compositing/scrolling/async-overflow-scrolling/layer-in-overflow-lose-clipping-layer-expected.txt:
• compositing/scrolling/async-overflow-scrolling/visibility-hidden-scrollers-expected.txt:
• compositing/scrolling/overflow-scrolling-layers-are-self-painting-expected.txt:
• compositing/shared-backing/overflow-scroll/absolute-in-stacking-relative-in-scroller-expected.txt:
• compositing/shared-backing/overflow-scroll/composited-absolute-in-absolute-in-relative-in-scroller-expected.txt:
• compositing/shared-backing/overflow-scroll/nested-absolute-with-clipping-in-stacking-overflow-expected.txt:
• compositing/shared-backing/overflow-scroll/previous-sibling-prevents-inclusiveness-expected.txt:
• compositing/shared-backing/overflow-scroll/relative-in-clipping-in-scroller-in-clipping-expected.txt:
• compositing/shared-backing/overflow-scroll/relative-in-clipping-in-scroller-in-relative-clipping-expected.txt:
• compositing/shared-backing/overflow-scroll/relative-in-div-in-overflow-scroll-expected.txt:
• compositing/shared-backing/overflow-scroll/scrolled-contents-has-painted-content-expected.txt:
• fast/scrolling/mac/event-region-scrolled-contents-layer-expected.txt:
• platform/mac-wk1/compositing/clipping/border-radius-async-overflow-clipping-layer-expected.txt:
• platform/mac/compositing/overflow/overflow-auto-with-touch-toggle-expected.txt:
• tiled-drawing/scrolling/overflow/overflow-scrolled-down-tile-coverage-expected.txt:
• tiled-drawing/scrolling/overflow/overflow-scrolled-up-tile-coverage-expected.txt:
• tiled-drawing/scrolling/overflow/overflow-tile-coverage-expected.txt:

6:26 PM Changeset in webkit [260304] by mmaxfield@apple.com

• 2 edits in trunk/LayoutTests

[Cocoa] Password obscuring dots drawn with the system font are too small
​https://bugs.webkit.org/show_bug.cgi?id=209692

Reviewed by Darin Adler.

Addressing post-review comments.

• platform/mac/TestExpectations:

5:54 PM Changeset in webkit [260303] by Kate Cheney

• 31 edits in trunk

Enable service workers for app-bound domains
​https://bugs.webkit.org/show_bug.cgi?id=210451
<rdar://problem/61479474>

Reviewed by Brent Fulgham.

Source/WebCore:

SWServer now retrieves the app-bound domains from the UI Process and
only continues with the load if the proper entitlement is present
or the load is coming from an app-bound domain.

• workers/service/server/SWServer.cpp:

(WebCore::SWServer::addRegistrationFromStore):
(WebCore::SWServer::SWServer):
(WebCore::SWServer::validateRegistrationDomain):
(WebCore::SWServer::scheduleJob):

• workers/service/server/SWServer.h:

Source/WebKit:

• NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::createFetchTask):
(WebKit::NetworkConnectionToWebProcess::scheduleResourceLoad):
(WebKit::NetworkConnectionToWebProcess::swConnection):
(WebKit::NetworkConnectionToWebProcess::isServiceWorkerAllowed const): Deleted.

• NetworkProcess/NetworkConnectionToWebProcess.h:

Removed ASSERTS and service worker entitlement checks which are now done along with app-bound
domain checks in SWServer.cpp.

• NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::initializeNetworkProcess):
(WebKit::NetworkProcess::addWebsiteDataStore):
Remove the check for parentProcessHasServiceWorkerEntitlement() before
adding a serviceWorkerSession. This doesn't do anything except add an
entry to a map, and simplifies the case where we need a session for
app-bound instances which should have service workers but have no entitlement.

Pass the entitlement and a new callback to request app-bound domains
from the UI Process to the SWServer. This will make sure the server
checks for the entitlement or list of app-bound domains before completing a load.

(WebKit::NetworkProcess::registerSWServerConnection):
Remove unnecessary ASSERT for entitlement.

• NetworkProcess/NetworkProcess.h:
• NetworkProcess/NetworkProcess.messages.in:
• NetworkProcess/ios/NetworkProcessIOS.mm:

(WebKit::NetworkProcess::parentProcessHasServiceWorkerEntitlement const):
(WebKit::NetworkProcess::disableServiceWorkerEntitlement):
(WebKit::NetworkProcess::clearServiceWorkerEntitlementOverride):
In order to test this thoroughly, TestWebKitAPI needed a way to
temporarily disable the service worker entitlement. This function
overrides the check for the entitlement if the bool is set, disabling
the entitlement.

• Shared/WebPageCreationParameters.cpp:

(WebKit::WebPageCreationParameters::encode const):
(WebKit::WebPageCreationParameters::decode):

• Shared/WebPageCreationParameters.h:

WebPage needs to know if it is app-bound when created so it can update
the service worker preferences key accordingly.

• Shared/WebPreferences.yaml:
• UIProcess/API/Cocoa/WKPreferences.mm:

(-[WKPreferences _serviceWorkerEntitlementDisabledForTesting]):
(-[WKPreferences _setServiceWorkerEntitlementDisabledForTesting:]):

• UIProcess/API/Cocoa/WKPreferencesPrivate.h:

Disable entitlement for testing.

• UIProcess/API/APIPageConfiguration.cpp:

(API::PageConfiguration::copy const):

• UIProcess/API/APIPageConfiguration.h:

(API::PageConfiguration::limitsNavigationsToAppBoundDomains const):
(API::PageConfiguration::setLimitsNavigationsToAppBoundDomains):
(API::PageConfiguration::limitsNavigationToAppBoundDomains const): Deleted.
(API::PageConfiguration::setLimitsNavigationToAppBoundDomains): Deleted.
(-[WKWebViewConfiguration limitsNavigationsToAppBoundDomains]):
(-[WKWebViewConfiguration setLimitsNavigationsToAppBoundDomains:]):
(-[WKWebViewConfiguration limitsNavigationToAppBoundDomains]): Deleted.
(-[WKWebViewConfiguration setLimitsNavigationToAppBoundDomains:]): Deleted.

• UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

Inconsistent naming (Navigation vs Navigations).

• UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _setupPageConfiguration:]):
Check for entitlement or app-bound webview.

(-[WKWebView _serviceWorkersEnabled:]):
(-[WKWebView _clearServiceWorkerEntitlementOverride:]):

• UIProcess/API/Cocoa/WKWebViewPrivate.h:

Testing SPIs.

• UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::getAppBoundDomains):

• UIProcess/Network/NetworkProcessProxy.h:
• UIProcess/Network/NetworkProcessProxy.messages.in:

Sends the app-bound domains to the Network Process.

• UIProcess/WebPageProxy.cpp:

(WebKit::m_limitsNavigationsToAppBoundDomains):
(WebKit::m_limitsNavigationToAppBoundDomains): Deleted.
Naming inconsistency.

(WebKit::WebPageProxy::disableServiceWorkerEntitlementInNetworkProcess):
(WebKit::WebPageProxy::clearServiceWorkerEntitlementOverride):

• UIProcess/WebPageProxy.h:

Disable entitlement for testing.

• WebProcess/WebPage/WebPage.cpp:

(WebKit::m_isNavigatingToAppBoundDomain):
Set this parameter in the constructor so it will be accurate when
updating preferences.

(WebKit::WebPage::updatePreferences):

• WebProcess/WebPage/WebPage.h:

(WebKit::WebPage::clearServiceWorkerEntitlementOverride):

• WebProcess/WebPage/WebPage.messages.in:
• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::parentProcessHasServiceWorkerEntitlement const):
(WebKit::WebPage::disableServiceWorkerEntitlement):
(WebKit::WebPage::clearServiceWorkerEntitlementOverride):
Disable entitlement for testing.

Tools:

Adds 2 test cases to make sure service workers behave properly on
app bound domains, and that the APIs are not available on non-app
bound domains.

• TestWebKitAPI/Tests/WebKitCocoa/InAppBrowserPrivacy.mm:

(-[SWInAppBrowserPrivacyMessageHandler userContentController:didReceiveScriptMessage:]):

4:40 PM Changeset in webkit [260302] by achristensen@apple.com

• 7 edits in trunk

NetworkSessionCocoa should request client certificate only once per host/port
​https://bugs.webkit.org/show_bug.cgi?id=210626
<rdar://problem/60340449>

Reviewed by Geoffrey Garen.

Source/WebKit:

NSURLSession creates more than one TCP connection to a server when using HTTP 1.1.
Each TCP connection with TLS generates a didReceiveChallenge to do the server trust evaluation of the certificate chain.
If the server requests a client certificate in the TLS handshake, it also generates a didReceiveChallenge to request client
certificates as well. This is an implementation detail of our networking. We should not actually ask the WKNavigationDelegate
for client certificates more than once per host/port. We should remember the credential and give it to NSURLSession immediately
if we have used this credential in the past for a task that has received bytes (either a response or a redirect). If the TLS
handshake fails, we should not reuse that same certificate automatically.

• NetworkProcess/cocoa/NetworkSessionCocoa.h:
• NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:task:willPerformHTTPRedirection:newRequest:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:task:didReceiveChallenge:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:task:didCompleteWithError:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]):
(WebKit::NetworkSessionCocoa::clientCertificateSuggestedForHost):
(WebKit::NetworkSessionCocoa::taskReceivedBytes):
(WebKit::NetworkSessionCocoa::taskFailed):
(WebKit::NetworkSessionCocoa::successfulClientCertificateForHost const):

Tools:

• TestWebKitAPI/Tests/WebKitCocoa/Challenge.mm:

(TestWebKitAPI::clientCertServerWithCertVerifier):
(TestWebKitAPI::TEST):

• TestWebKitAPI/cocoa/HTTPServer.h:

(TestWebKitAPI::HTTPServer::HTTPResponse::HTTPResponse):

• TestWebKitAPI/cocoa/HTTPServer.mm:

(TestWebKitAPI::HTTPServer::HTTPServer):

4:30 PM Changeset in webkit [260301] by dino@apple.com

• 6 edits in trunk/Source/WebCore

[WebGL] Confirm there are no errors when setting up framebuffers
​https://bugs.webkit.org/show_bug.cgi?id=210632
<rdar://problem/61916680>

Reviewed by Simon Fraser.

We're seeing crashes on macOS inside GraphicsContextGL::reshape().
Specifically when we submit work at the end of the function via
glFlush.

At the moment the cause is a mystery, because we should bail out
before then if the multisample renderbuffer was not complete. In
the hope that it helps somewhat, add a call to glGetError to double
check that there isn't anything horribly wrong before we talk to
the GPU.

• html/canvas/WebGL2RenderingContext.cpp:

(WebCore::WebGL2RenderingContext::WebGL2RenderingContext): If the underlying
GCGL context was marked as "LOST" during initialization, skip the rest of our
initialization.

• html/canvas/WebGLRenderingContext.cpp: Ditto.

(WebCore::WebGLRenderingContext::WebGLRenderingContext):

• html/canvas/WebGLRenderingContextBase.cpp: Ditto.

(WebCore::WebGLRenderingContextBase::WebGLRenderingContextBase):

• platform/graphics/angle/GraphicsContextGLANGLE.cpp: Check for a GL error during

setup and, if there is one, skip directly into a LOST state.
(WebCore::GraphicsContextGLOpenGL::reshape):

• platform/graphics/opengl/GraphicsContextGLOpenGLCommon.cpp:

(WebCore::GraphicsContextGLOpenGL::reshape):

4:13 PM Changeset in webkit [260300] by Alan Coon

• 1 copy in tags/Safari-609.2.7.1

Tag Safari-609.2.7.1.

4:06 PM Changeset in webkit [260299] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebKit

Bug 210646: REGRESSION (r260112): createArchiveList() leaks malloc memory on early returns due to an error
<​https://webkit.org/b/210646>
<rdar://problem/61928031>

Reviewed by Darin Adler.

• Shared/mac/WebCoreArgumentCodersMac.mm:

(IPC::createArchiveList):

• Move early returns for protocolProperties, protocolProperties and mimeType above memory allocation to fix the memory leak.

4:05 PM Changeset in webkit [260298] by ddkilzer@apple.com

• 2 edits in trunk/Tools

Bug 210645: REGRESSION (r211095): [iOS] TestRunnerWKWebView leaks @property accessibilitySpeakSelectionContent
<​https://webkit.org/b/210645>
<rdar://problem/61927607>

Reviewed by Chris Fleizach.

• WebKitTestRunner/cocoa/TestRunnerWKWebView.mm:

(-[TestRunnerWKWebView dealloc]):

• Release accessibilitySpeakSelectionContent in -dealloc.

4:01 PM Changeset in webkit [260297] by commit-queue@webkit.org

• 2 edits in trunk/Source/JavaScriptCore

Unreviewed, reverting r260279.
​https://bugs.webkit.org/show_bug.cgi?id=210678

Throwing error would be more efficient, having a generic code
is still worth doing (Requested by yusukesuzuki on #webkit).

Reverted changeset:

"[JSC] We do not need to have exit-check for Map/Set iterator
functions"
​https://bugs.webkit.org/show_bug.cgi?id=210667
​https://trac.webkit.org/changeset/260279

4:01 PM Changeset in webkit [260296] by Alan Coon

• 8 edits in branches/safari-609.2.7-branch/Source

Versioning.

3:55 PM Changeset in webkit [260295] by beidson@apple.com

• 17 edits in trunk

Pass sandbox extensions for back/forward list navigations after the policy is decided at process-swap time.
<rdar://problem/59535167> and ​https://bugs.webkit.org/show_bug.cgi?id=210623

Reviewed by Geoff Garen.

Source/WebKit:

Covered by almost all existing tests, and a new API test.

Instead of granting a sandbox extension when updating the back/forward cursor for a pending
back/forward list traversal, do so after the client decides the policy.
(Which is also along with a process swap in interesting cases)

• Shared/PolicyDecision.h:

(WebKit::PolicyDecision::encode const):
(WebKit::PolicyDecision::decode):

• Shared/WebPageCreationParameters.h:

• UIProcess/API/APINavigation.cpp:

(API::Navigation::Navigation):

• UIProcess/API/APINavigation.h:

(API::Navigation::create):
(API::Navigation::reloadItem const):

• UIProcess/ProvisionalPageProxy.cpp:

(WebKit::ProvisionalPageProxy::backForwardGoToItem):

• UIProcess/ProvisionalPageProxy.h:

• UIProcess/WebNavigationState.cpp:

(WebKit::WebNavigationState::createReloadNavigation):

• UIProcess/WebNavigationState.h:

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::launchProcessForReload):
(WebKit::WebPageProxy::reload):
(WebKit::WebPageProxy::receivedNavigationPolicyDecision):
(WebKit::WebPageProxy::receivedPolicyDecision):

• UIProcess/WebPageProxy.h:

(WebKit::WebPageProxy::receivedPolicyDecision):

• UIProcess/WebPageProxy.messages.in:

• WebProcess/WebPage/WebBackForwardListProxy.cpp:

(WebKit::WebBackForwardListProxy::goToItem):

• WebProcess/WebPage/WebFrame.cpp:

(WebKit::WebFrame::didReceivePolicyDecision):

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::SandboxExtensionTracker::didStartProvisionalLoad):

Tools:

• TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:

3:45 PM Changeset in webkit [260294] by Alan Coon

• 1 copy in branches/safari-609.2.7-branch

New branch.

3:41 PM Changeset in webkit [260293] by Peng Liu

• 4 edits in trunk/Source/WebCore

Cleanup the macros for video fullscreen and picture-in-picture
​https://bugs.webkit.org/show_bug.cgi?id=210638

Reviewed by Eric Carlson.

A follow-up patch to fix build failures of r260259.

• platform/ios/VideoFullscreenInterfaceAVKit.h:
• platform/ios/VideoFullscreenInterfaceAVKit.mm:
• platform/ios/WebVideoFullscreenControllerAVKit.mm:

3:35 PM Changeset in webkit [260292] by Russell Epstein

• 1 copy in tags/Safari-610.1.10

Tag Safari-610.1.10.

3:33 PM Changeset in webkit [260291] by Devin Rousso

• 12 edits in trunk/Source/WebInspectorUI

Web Inspector: REGRESSION(r242018): using RegExp.prototype.test with a global RegExp will ignore one potential match after each successful match
​https://bugs.webkit.org/show_bug.cgi?id=210671

Reviewed by Timothy Hatcher.

• UserInterface/Base/SearchUtilities.js:

(WI.SearchUtilities.searchRegExpForString):
(WI.SearchUtilities.filterRegExpForString):
(WI.SearchUtilities._regExpForString):
(WI.SearchUtilities.regExpForString): Deleted.
Many uses of WI.SearchUtilities.regExpForString use the returned RegExp multiple times,
expecting each use to be done in isolation from every other use (e.g. filtering). In these
cases, the global flag g should not be set on the RegExp, as otherwise it will keep a
state of the last matched index, thereby breaking this isolation. As such, it is necessary
to split WI.SearchUtilities.regExpForString into two versions, one for each use case.

• UserInterface/Views/DOMTreeElement.js:

(WI.DOMTreeElement.prototype._highlightSearchResults):

• UserInterface/Views/LogContentView.js:

(WI.LogContentView.prototype.performSearch):

• UserInterface/Views/ResourceHeadersContentView.js:

(WI.ResourceHeadersContentView.prototype._perfomSearchOnKeyValuePairs):

• UserInterface/Views/ResourceSecurityContentView.js:

(WI.ResourceSecurityContentView.prototype._perfomSearchOnKeyValuePairs):

• UserInterface/Views/SearchSidebarPanel.js:

(WI.SearchSidebarPanel.prototype.performSearch.forEachMatch):
Use WI.SearchUtilities.searchRegExpForString as these views expect the search to maintain
its current position throughout the contents of the view.

• UserInterface/Views/DataGrid.js:

(WI.DataGrid.prototype._updateFilter):

• UserInterface/Views/IndexedDatabaseObjectStoreContentView.js:

(WI.IndexedDatabaseObjectStoreContentView.prototype.dataGridMatchNodeAgainstCustomFilters):

• UserInterface/Views/NetworkTableContentView.js:

(WI.NetworkTableContentView.prototype._urlFilterDidChange):

• UserInterface/Views/SourceCodeTextEditor.js:

(WI.SourceCodeTextEditor.prototype.customPerformSearch.searchResultCallback):

• UserInterface/Views/TextEditor.js:

(WI.TextEditor.prototype.performSearch):
Use WI.SearchUtilities.filterRegExpForString as these views expect each search to be done
in isolation from every other search (e.g. filtering).

3:08 PM Changeset in webkit [260290] by ddkilzer@apple.com

• 5 edits in trunk/Source

REGRESSION (r234105): [iOS] WKColorButton leaks a UIColor
<​https://webkit.org/b/210658>
<rdar://problem/61938137>

Reviewed by Darin Adler.

Source/WebCore:

• html/ColorInputType.cpp:

(WebCore::ColorInputType::isKeyboardFocusable const):

• page/Chrome.cpp:

(WebCore::Chrome::createColorChooser):

• Drive-by fix of unreachable code on PLATFORM(IOS_FAMILY).

Source/WebKit:

• UIProcess/ios/forms/WKFormColorPicker.mm:

(-[WKColorButton dealloc]): Add.

• Release _color instance variable to fix leak.

2:48 PM Changeset in webkit [260289] by sbarati@apple.com

• 8 edits
  1 add in trunk

GetTypedArrayByteOffset is broken on arm64e
​https://bugs.webkit.org/show_bug.cgi?id=210631

Reviewed by Mark Lam.

JSTests:

• stress/byte-offset-on-wasteful-neutered-arm64e.js: Added.

(foo):
(assert):
(transferArrayBuffer.array.buffer):

Source/JavaScriptCore:

The vector of JSArrayBufferView is signed even when null on arm64e. However, we were
comparing against zero, which is wrong. This patch changes it so we do the right thing
and instead compare against whatever constant (ptr=nullptr,size=0) signs as.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):

• runtime/CagedBarrierPtr.h:

(JSC::CagedBarrierPtr::rawBits const):

• runtime/JSArrayBufferView.h:

(JSC::JSArrayBufferView::nullVectorPtr):

Source/WTF:

• wtf/CagedPtr.h:

(WTF::CagedPtr::rawBits const):

2:34 PM Changeset in webkit [260288] by Alan Coon

• 4 edits
  1 add in branches/safari-609-branch

Cherry-pick r260278. rdar://problem/61950220

Bring Fullscreen API + alert() behavior from iOS to macOS
​https://bugs.webkit.org/show_bug.cgi?id=210662

Reviewed by Eric Carlson.

Source/WebKit:

When a page is showing an alert(), all non-synchronous messages will be blocked until the sync XPC for alert()
ends. And when exiting fullscreen, we block completing the fullscreen exit animation until a repaint XPC completes.
So a page that is showing an alert() will never fully exit element fullscreen mode.

On iOS, we fixed this behavior by exiting fullscreen mode whenever the page shows an alert() or prompt(). We should
bring this behavior to macOS as well.

• UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::runJavaScriptAlert): (WebKit::WebPageProxy::runJavaScriptConfirm): (WebKit::WebPageProxy::runJavaScriptPrompt):

Tools:

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WebKitCocoa/FullscreenAlert.mm: Added. (TestWebKitAPI::TEST):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@260278 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:34 PM Changeset in webkit [260287] by Alan Coon

• 2 edits in branches/safari-609-branch/Source/JavaScriptCore

Cherry-pick r260246. rdar://problem/61943700

offlineasm is generating the wrong load/store for the "orh" instruction.
​https://bugs.webkit.org/show_bug.cgi?id=210639
<rdar://problem/21501876>

Reviewed by Robin Morisset.

For example, on ARM64E, the "orh" instruction was generating the following:

"\tldr w17, [x1, #0]\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:919
"\torr w17, w17, #64\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:919
"\tstr w17, [x1, #0]\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:919

i.e. a 32-bit load, followed by a 32-bit OR, followed by a 32-bit store.

Instead, it should be generating the following:

"\tldrh w17, [x1, #0]\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:919
"\torr w17, w17, #64\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:919
"\tstrh w17, [x1, #0]\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:919

i.e. a 16-bit load, followed by a 32-bit OR, followed by a 16-bit store.

This bug also affects ARM64, ARMv7, and MIPS (basically any backend that uses
riscLowerMisplacedAddresses() from rise.rb). It does not affect x86, x86_64, and
C_LOOP (which was written based on x86).

• offlineasm/risc.rb:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@260246 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:34 PM Changeset in webkit [260286] by Alan Coon

• 3 edits in branches/safari-609-branch/Source/JavaScriptCore

Cherry-pick r260180. rdar://problem/61943707

[JSC] Use ensureStillAliveHere in FTL when content of storage should be kept alive
​https://bugs.webkit.org/show_bug.cgi?id=210583
<rdar://problem/61831515>

Reviewed by Mark Lam.

The content of Butterfly / ArrayStorage is kept alive only when the owner JSCell is alive.
This means that we should keep the owner JSCell alive if we are loading content of storage
which includes JSCells. This patch inserts ensureStillAliveHere in FTL to ensure this invariant.

• ftl/FTLJITCode.cpp: (JSC::FTL::JITCode::~JITCode): Found that we get crash with dumpDisassembly if FTL::JITCode is destroyed while it fails to generate code while testing this.
• ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal): (JSC::FTL::DFG::LowerDFGToB3::compileArrayIndexOf): (JSC::FTL::DFG::LowerDFGToB3::compileArrayPop): (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt): (JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt): (JSC::FTL::DFG::LowerDFGToB3::compileStringCodePointAt): (JSC::FTL::DFG::LowerDFGToB3::compileGetByOffset): (JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@260180 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:34 PM Changeset in webkit [260285] by Alan Coon

• 2 edits in branches/safari-609-branch/Source/JavaScriptCore

Cherry-pick r259572. rdar://problem/61943713

[JSC] Put ensureStillAliveHere for Integer TypedArrays in GetByVal
​https://bugs.webkit.org/show_bug.cgi?id=210047

Reviewed by Mark Lam.

While r258381 puts ensureStillAliveHere in FTL to keep base alive for float/double TypedArrays,
we need to do the same thing for integer TypedArrays too. This patch places it.

• ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@259572 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:29 PM Changeset in webkit [260284] by pvollan@apple.com

• 2 edits in trunk/Source/WebKit

[iOS] Deny iokit open access of unused class in the WebContent sandbox
​https://bugs.webkit.org/show_bug.cgi?id=210669

Reviewed by Brent Fulgham.

Telemetry shows that iokit open access of an iokit class can be removed from the WebContent sandbox.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

2:20 PM Changeset in webkit [260283] by Chris Dumez

• 17 edits in trunk/Source/WebKit

[iOS] Refactor WebKit uploads process assertion logic to minimize chances of leaking them
​https://bugs.webkit.org/show_bug.cgi?id=210664
<rdar://problem/61751982>

Reviewed by Geoff Garen.

To minimize chances of leaking "WebKit uploads" process assertion, the following refactoring
was done:

1. WebKit upload assertions are now held by NetworkProcessProxy instead of the WebProcessPool. This makes more sense since uploads are tied to a particular network process. In base of a network process crash, we would not want those assertions to persist for example.
2. Store all upload assertions (UIProcess + NetworkProcess + WebProcesses) into a single UploadActivity data structure that can easily be cleared. Make sure we clear it on network process crash.
3. No longer on the WebProcess to send IPC whenever its has pending uploads or not. Instead, have the network process send such IPC. This makes more sense, especially now that all webkit upload process assertions are now stored on NetworkProcessProxy. It also makes it so that we deal properly with WebProcess crashes. In case of a WebProcess crash, its connection to the network process will get closed. NetworkConnectionToWebProcess::didClose() gets called and causes all NetworkResourceLoader objects for this connection to get destroyed. As a result, the network process will properly notify the UIProcess that this process no longer has any upload in progress.

• NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::NetworkConnectionToWebProcess):
(WebKit::NetworkConnectionToWebProcess::~NetworkConnectionToWebProcess):
(WebKit::NetworkConnectionToWebProcess::hasUploadStateChanged):

• NetworkProcess/NetworkConnectionToWebProcess.h:
• NetworkProcess/NetworkResourceLoadMap.cpp:

(WebKit::NetworkResourceLoadMap::NetworkResourceLoadMap):
(WebKit::NetworkResourceLoadMap::~NetworkResourceLoadMap):
(WebKit::NetworkResourceLoadMap::add):
(WebKit::NetworkResourceLoadMap::clear):
(WebKit::NetworkResourceLoadMap::take):
(WebKit::NetworkResourceLoadMap::setHasUpload):

• NetworkProcess/NetworkResourceLoadMap.h:

(WebKit::NetworkResourceLoadMap::hasUpload const):

• UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::didClose):
(WebKit::NetworkProcessProxy::setWebProcessHasUploads):

• UIProcess/Network/NetworkProcessProxy.h:
• UIProcess/Network/NetworkProcessProxy.messages.in:
• UIProcess/ProcessAssertion.cpp:

(WebKit::ProcessAssertion::ProcessAssertion):

• UIProcess/ProcessAssertion.h:

(WebKit::ProcessAssertion::pid const):

• UIProcess/WebProcessPool.cpp:
• UIProcess/WebProcessPool.h:
• UIProcess/WebProcessPool.messages.in:
• UIProcess/WebProcessProxy.cpp:

(WebKit::WebProcessProxy::~WebProcessProxy):

• UIProcess/WebProcessProxy.h:
• WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::WebLoaderStrategy::scheduleLoadFromNetworkProcess):
(WebKit::WebLoaderStrategy::remove):
(WebKit::WebLoaderStrategy::loadResourceSynchronously):

• WebProcess/Network/WebLoaderStrategy.h:

2:19 PM Changeset in webkit [260282] by Brent Fulgham

• 2 edits in trunk/Tools

Unreviewed build fix after r260269.

• TestWebKitAPI/Tests/WebKitCocoa/InAppBrowserPrivacy.mm:

(TEST): Correct argument order.

2:13 PM Changeset in webkit [260281] by Ryan Haddad

• 2 edits in branches/safari-609-branch/Tools

Cherry-pick r258385. rdar://problem/61948294

Pull in JS tests from "Internal" when there are "Internal" tests in an adjacent directory
​https://bugs.webkit.org/show_bug.cgi?id=209038

Reviewed by Keith Miller.

This allows us to automatically pull in some tests that are in non open sourced Apple
checkouts.

• Scripts/run-javascriptcore-tests: (runJSCStressTests):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@258385 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:05 PM Changeset in webkit [260280] by Alan Coon

• 8 edits in branches/safari-609-branch/Source

Versioning.

2:03 PM Changeset in webkit [260279] by ysuzuki@apple.com

• 2 edits in trunk/Source/JavaScriptCore

[JSC] We do not need to have exit-check for Map/Set iterator functions
​https://bugs.webkit.org/show_bug.cgi?id=210667

Reviewed by Michael Saboff.

If the intrinsic's DFG node does not support general cases, we should check exit-frequency to avoid exit-recompile loop.
However, Map/Set iterator creation functions (values, keys, entries) always require Map / Set types. And throwing an error
when this is not met. So, the current DFG nodes for these intrinsic supports all the cases except for the case throwing an
error, and error will exit anyway. So we do not need to have this exit-frequency guard here.

This path is already tested by map-iterator-check-before-fail.js / set-iterator-check-before-fail.js.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

1:41 PM Changeset in webkit [260278] by jer.noble@apple.com

• 4 edits
  1 add in trunk

Bring Fullscreen API + alert() behavior from iOS to macOS
​https://bugs.webkit.org/show_bug.cgi?id=210662

Reviewed by Eric Carlson.

Source/WebKit:

When a page is showing an alert(), all non-synchronous messages will be blocked until the sync XPC for alert()
ends. And when exiting fullscreen, we block completing the fullscreen exit animation until a repaint XPC completes.
So a page that is showing an alert() will never fully exit element fullscreen mode.

On iOS, we fixed this behavior by exiting fullscreen mode whenever the page shows an alert() or prompt(). We should
bring this behavior to macOS as well.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::runJavaScriptAlert):
(WebKit::WebPageProxy::runJavaScriptConfirm):
(WebKit::WebPageProxy::runJavaScriptPrompt):

Tools:

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WebKitCocoa/FullscreenAlert.mm: Added.

(TestWebKitAPI::TEST):

1:15 PM Changeset in webkit [260277] by don.olmstead@sony.com

• 20 edits
  1 add in trunk

[CMake] Add WebKit::WebCore target
​https://bugs.webkit.org/show_bug.cgi?id=210445

Reviewed by Michael Catanzaro.

.:

Add a target file for internal Apple Windows builds.

• Source/cmake/target/WebCore.cmake: Added.

Source/WebCore:

Add a WebKit::WebCore target. Remove the WebCoreHeaderInterface target since
the WebKit::WebCore target is functionaly the same.

• CMakeLists.txt:

Source/WebKit:

Use the WebKit::WebCore target within the WebKit target.

• CMakeLists.txt:
• PlatformGTK.cmake:
• PlatformWPE.cmake:
• PlatformWin.cmake:

Source/WebKitLegacy:

Use the WebKit::WebCore target within WebKitLegacy.

• CMakeLists.txt:
• PlatformFTW.cmake:
• PlatformWin.cmake:

Tools:

Use the WebKit::WebCore target within tests and developer tools.

• DumpRenderTree/TestNetscapePlugIn/CMakeLists.txt:
• MiniBrowser/wpe/CMakeLists.txt:
• TestWebKitAPI/CMakeLists.txt:
• TestWebKitAPI/PlatformGTK.cmake:
• TestWebKitAPI/PlatformWPE.cmake:
• TestWebKitAPI/PlatformWin.cmake:
• TestWebKitAPI/glib/CMakeLists.txt:

1:04 PM Changeset in webkit [260276] by Simon Fraser

• 3 edits in trunk/Source/WebKit

Turn async frame and overflow scrolling on by default on macOS
​https://bugs.webkit.org/show_bug.cgi?id=210661
rdar://problem/60420037

Reviewed by Tim Horton.

Flip the plist value and the default value for macOS which is outside of the feature flag #ifdef.

Testing keeps async overflow scrolling off by default, so this should not affect testing.

This only impacts WebKit2.

• FeatureFlags/WebKit.plist:
• Shared/WebPreferencesDefaultValues.cpp:

(WebKit::defaultAsyncFrameAndOverflowScrollingEnabled):

12:46 PM Changeset in webkit [260275] by Devin Rousso

• 8 edits
  1 move in trunk

Rename NullishEq / NULLISHEQUAL to CoalesceEq / COALESCEEQUAL to match the spec
​https://bugs.webkit.org/show_bug.cgi?id=210663

Reviewed by Ross Kirsling.

JSTests:

• stress/logical-assignment-operator-coalesce.js: Renamed from stress/logical-assignment-operator-nullish.js.

Source/JavaScriptCore:

• bytecompiler/NodesCodegen.cpp:

(JSC::emitShortCircuitAssignment):

• parser/ASTBuilder.h:

(JSC::ASTBuilder::makeAssignNode):

• parser/Lexer.cpp:

(JSC::Lexer<T>::lexWithoutClearingLineTerminator):

• parser/Nodes.h:
• parser/Parser.cpp:

(JSC::Parser<LexerType>::parseAssignmentExpression):

• parser/ParserTokens.h:

12:32 PM Changeset in webkit [260274] by Ryan Haddad

• 9 edits
  8 deletes in trunk

Unreviewed, reverting r260245.

The tests added with this change are frequently failing on
macOS bots.

Reverted changeset:

"Safari doesn't apply frameRate limit when request stream from
Camera"
​https://bugs.webkit.org/show_bug.cgi?id=210186
​https://trac.webkit.org/changeset/260245

12:31 PM Changeset in webkit [260273] by Devin Rousso

• 28 edits
  6 adds in trunk

Implement Promise.any and AggregateError
​https://bugs.webkit.org/show_bug.cgi?id=202566

Reviewed by Yusuke Suzuki.

JSTests:

• test262/config.yaml:
• test262/expectations.yaml:

Source/JavaScriptCore:

Promise.any resolves when any of the given promises resolve, but only rejects if _all_
of the given promises reject. In order to support aggregating all of the reason values
for all of the rejections, a new error type AggregateError is introduced which has an
get errors that returns an aggregated array of the reason values.

• builtins/PromiseConstructor.js:

(all.newResolveElement):
(allSettled.newResolveRejectElements):
(any): Added.
(any.newRejectElement): Added.

• runtime/JSPromiseConstructor.cpp:

• builtins/BuiltinNames.h:
• bytecode/LinkTimeConstant.h:
• runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::errorStructure const):

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::initializeAggregateErrorConstructor): Added.
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):
Expose @AggregateError for builtins.

• runtime/AggregateError.h: Added.

(JSC::AggregateError::destroy):
(JSC::AggregateError::subspaceFor):
(JSC::AggregateError::createStructure):
(JSC::AggregateError::create):
(JSC::AggregateError::errors const):

• runtime/AggregateError.cpp: Added.

(JSC::AggregateError::AggregateError):
(JSC::AggregateError::visitChildren):
(JSC::AggregateError::create):
(JSC::AggregateError::finishCreation):

• runtime/AggregateErrorPrototype.h: Added.
• runtime/AggregateErrorPrototype.cpp: Added.

(JSC::AggregateErrorPrototype::AggregateErrorPrototype):
(JSC::AggregateErrorPrototype::finishCreation):
(JSC::aggregateErrorPrototypeAccessorErrors):

• runtime/AggregateErrorConstructor.h: Added.
• runtime/AggregateErrorConstructor.cpp: Added.

(JSC::callAggregateErrorConstructor):
(JSC::constructAggregateErrorConstructor):
(JSC::AggregateErrorConstructor::AggregateErrorConstructor):
(JSC::AggregateErrorConstructor::finishCreation):

• runtime/ErrorType.h:
• runtime/ErrorType.cpp:

(JSC::errorTypeName):

• runtime/VM.h:
• runtime/VM.cpp:

(JSC::VM::VM):
Make an IsoSubspace for AggregateError as it has a different size than ErrorInstance.

• runtime/ErrorInstance.h:

(JSC::ErrorInstance::create):

• runtime/ErrorInstance.cpp:

(JSC::ErrorInstance::finishCreation):

• wasm/js/JSWebAssemblyCompileError.cpp:

(JSC::JSWebAssemblyCompileError::create):

• wasm/js/JSWebAssemblyLinkError.cpp:

(JSC::JSWebAssemblyLinkError::create):

• wasm/js/JSWebAssemblyRuntimeError.cpp:

(JSC::JSWebAssemblyRuntimeError::create):
Assign to ErrorInstance member variables inside ErrorInstance::finishCreation instead of
inside ErrorInstance::create so that subclasses don't have to do the work as well.

• runtime/Error.cpp:

(JSC::createError):

• runtime/ErrorPrototype.h:

(JSC::ErrorPrototype::createStructure):

• runtime/NativeErrorPrototype.h:

(JSC::NativeErrorPrototype::createStructure):
Drive-by: fix incorrect usage of ErrorInstanceType since ErrorPrototype does not inherit

from ErrorInstance (and therefore neither does NativeErrorPrototype).

• runtime/ArgList.h:

Add WTF_MAKE_NONMOVABLE to MarkedArgumentBuffer.

• Sources.txt:
• JavaScriptCore.xcodeproj/project.pbxproj:

Source/WebInspectorUI:

• UserInterface/Models/IssueMessage.js:

Mark AggregateError as a WI.IssueMessage.Type.SemanticIssue.

12:26 PM Changeset in webkit [260272] by Ryan Haddad

• 2 edits in trunk/LayoutTests

REGRESSION (r259463): [ Mojave Debug ] http/tests/IndexedDB/collect-IDB-objects.https.html is flaky failing and timing out
​https://bugs.webkit.org/show_bug.cgi?id=210219

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations: Test transitioned from timeout -> failure.

12:10 PM Changeset in webkit [260271] by pvollan@apple.com

• 2 edits in trunk/Source/WebCore

Unreviewed build fix.

• platform/cocoa/AGXCompilerService.cpp:

11:55 AM Changeset in webkit [260270] by Jason_Lawrence

• 2 edits in trunk/LayoutTests

REGRESSION ( r254044 ): [ Win ] css1/box_properties/padding_left.html is failing
​https://bugs.webkit.org/show_bug.cgi?id=207480

Unreviewed test gardening.

Adjusted this test expectation and others in the Windows category with lint alerts.

• platform/win/TestExpectations:

11:35 AM Changeset in webkit [260269] by graouts@webkit.org

• 2 edits in trunk/Tools

Stop including style rules related to media controls in the UA style sheet when Modern Media Controls are enabled
​https://bugs.webkit.org/show_bug.cgi?id=210606

Unreviewed build fix after r260261.

• TestWebKitAPI/Tests/WebKitCocoa/InAppBrowserPrivacy.mm:

(TEST):

11:22 AM Changeset in webkit [260268] by Russell Epstein

• 1 copy in tags/Safari-609.2.7

Tag Safari-609.2.7.

11:06 AM Changeset in webkit [260267] by Jason_Lawrence

• 2 edits in trunk/LayoutTests

Layout Test fast/text/variations/ipc2.html is failing
​https://bugs.webkit.org/show_bug.cgi?id=189550

Unreviewed test gardening.

• platform/win/TestExpectations:

11:04 AM Changeset in webkit [260266] by Alan Coon

• 539 edits
  19 adds
  160 deletes in branches/safari-610.1.10-branch/Source/ThirdParty/ANGLE

Revert r259589. rdar://problem/61942180

10:57 AM Changeset in webkit [260265] by Ross Kirsling

• 16 edits in trunk/Source/JavaScriptCore

Clean up some Intl classes following the ICU upgrade
​https://bugs.webkit.org/show_bug.cgi?id=210637

Reviewed by Yusuke Suzuki.

In r259606, I removed the compile-time guards for {DateTimeFormat, NumberFormat}.prototype.formatToParts,
but I forgot to move the method setup back to the lookup table.

This patch addresses that and prunes various other unnecessary includes and forward declarations.

• runtime/IntlCollator.h:
• runtime/IntlCollatorConstructor.h:
• runtime/IntlDateTimeFormat.h:
• runtime/IntlDateTimeFormatConstructor.h:
• runtime/IntlDateTimeFormatPrototype.cpp:

(JSC::IntlDateTimeFormatPrototype::create):
(JSC::IntlDateTimeFormatPrototype::finishCreation):

• runtime/IntlDateTimeFormatPrototype.h:
• runtime/IntlNumberFormat.h:
• runtime/IntlNumberFormatConstructor.h:
• runtime/IntlNumberFormatPrototype.cpp:

(JSC::IntlNumberFormatPrototype::create):
(JSC::IntlNumberFormatPrototype::finishCreation):

• runtime/IntlNumberFormatPrototype.h:
• runtime/IntlObject.h:
• runtime/IntlPluralRules.h:
• runtime/IntlPluralRulesConstructor.h:
• runtime/IntlPluralRulesPrototype.cpp:

(JSC::IntlPluralRulesPrototype::create):
(JSC::IntlPluralRulesPrototype::finishCreation):

• runtime/IntlPluralRulesPrototype.h:

10:56 AM Changeset in webkit [260264] by Jason_Lawrence

• 2 edits in trunk/LayoutTests

[ macOS ] inspector/runtime/getCollectionEntries.html is flaky failing
​https://bugs.webkit.org/show_bug.cgi?id=207642

Unreviewed test gardening.

Removed duplicate expectations.

• platform/mac/TestExpectations:

10:44 AM Changeset in webkit [260263] by pvollan@apple.com

• 2 edits in trunk/Source/WebKit

[iOS] Add telemetry to some mach lookup sandbox extensions
​https://bugs.webkit.org/show_bug.cgi?id=210657

Reviewed by Darin Adler.

Add telemetry in order to learn more about how some of the mach lookup extensions are being used in the WebContent process on iOS.

No new tests, since this patch does not change any behavior.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

10:43 AM Changeset in webkit [260262] by Jason_Lawrence

• 2 edits in trunk/LayoutTests

[Web Animations] Update WPT tests related to Web Animations and remove imported Mozilla tests
​https://bugs.webkit.org/show_bug.cgi?id=203291

Unreviewed test gardening.

Removed duplicate test expectations.

• platform/ios/TestExpectations:

10:24 AM Changeset in webkit [260261] by graouts@webkit.org

• 7 edits in trunk/Source/WebCore

Stop including style rules related to media controls in the UA style sheet when Modern Media Controls are enabled
​https://bugs.webkit.org/show_bug.cgi?id=210606

Reviewed by Antti Koivisto and Daniel Bates.

There is no need to insert style rules related to media controls in the UA stylesheet when Modern Media Controls are enabled.
There is one rule from mediaControlsApple.css for the default sizing of <audio> that makes sense broadly for content on the Web
so we move that to html.css. We also set the background-color property for media documents in html.css.

• Modules/mediacontrols/mediaControlsApple.css:

(audio): Deleted.
(body:-webkit-full-page-media): Deleted.

• Modules/mediacontrols/mediaControlsiOS.css:

(body:-webkit-full-page-media): Deleted.

• Modules/modern-media-controls/controls/media-document.css:

(:host(.media-document)):

• css/html.css:

(body:-webkit-full-page-media):
(audio):

• css/mediaControls.css:

(body:-webkit-full-page-media): Deleted.

• style/UserAgentStyle.cpp:

(WebCore::Style::UserAgentStyle::ensureDefaultStyleSheetsForElement):

10:17 AM Changeset in webkit [260260] by youenn@apple.com

• 2 edits in trunk/Source/WebKit

Validate socket in NetworkRTCProvider::wrapNewTCPConnection
​https://bugs.webkit.org/show_bug.cgi?id=210594

Reviewed by Eric Carlson.

• NetworkProcess/webrtc/NetworkRTCProvider.cpp:

(WebKit::NetworkRTCProvider::wrapNewTCPConnection):
Add a null check in case the identifier does not relate to an existing pending socket.

10:13 AM Changeset in webkit [260259] by Peng Liu

• 33 edits in trunk/Source

Cleanup the macros for video fullscreen and picture-in-picture
​https://bugs.webkit.org/show_bug.cgi?id=210638

Reviewed by Eric Carlson.

Source/WebCore:

Replace some "#if PLATFORM(IOS_FAMILY) and all "#if (PLATFORM(IOS_FAMILY) && HAVE(AVKIT))

(PLATFORM(MAC) && ENABLE(VIDEO_PRESENTATION_MODE))"

(PLATFORM(MAC) && ENABLE(VIDEO_PRESENTATION_MODE))"

with "#if ENABLE(VIDEO_PRESENTATION_MODE)".

No new tests, no functional change.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::mediaEngineWasUpdated):
(WebCore::HTMLMediaElement::setVideoFullscreenStandby):

• html/HTMLMediaElement.h:
• html/HTMLVideoElement.cpp:
• html/HTMLVideoElement.h:
• platform/PictureInPictureSupport.h:
• platform/cocoa/VideoFullscreenChangeObserver.h:
• platform/cocoa/VideoFullscreenModel.h:
• platform/cocoa/VideoFullscreenModelVideoElement.h:
• platform/cocoa/VideoFullscreenModelVideoElement.mm:
• platform/graphics/MediaPlayer.cpp:
• platform/graphics/MediaPlayer.h:
• platform/graphics/MediaPlayerPrivate.h:
• platform/ios/VideoFullscreenInterfaceAVKit.mm:

(WebCore::supportsPictureInPicture):

Source/WebKit:

Replace some "#if PLATFORM(IOS_FAMILY) and all "#if (PLATFORM(IOS_FAMILY) && HAVE(AVKIT))

(PLATFORM(MAC) && ENABLE(VIDEO_PRESENTATION_MODE))"

(PLATFORM(MAC) && ENABLE(VIDEO_PRESENTATION_MODE))"

with "#if ENABLE(VIDEO_PRESENTATION_MODE)".

• GPUProcess/media/RemoteMediaPlayerProxy.cpp:

(WebKit::RemoteMediaPlayerProxy::setVideoFullscreenGravity):
(WebKit::RemoteMediaPlayerProxy::updateVideoFullscreenInlineImage):
(WebKit::RemoteMediaPlayerProxy::setVideoFullscreenMode):
(WebKit::RemoteMediaPlayerProxy::videoFullscreenStandbyChanged):

• UIProcess/Cocoa/VideoFullscreenManagerProxy.h:
• UIProcess/Cocoa/VideoFullscreenManagerProxy.messages.in:
• UIProcess/Cocoa/VideoFullscreenManagerProxy.mm:
• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::didAttachToRunningProcess):
(WebKit::WebPageProxy::viewDidLeaveWindow):
(WebKit::WebPageProxy::exitFullscreenImmediately):

• UIProcess/WebPageProxy.h:
• WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp:
• WebProcess/GPU/media/MediaPlayerPrivateRemote.h:
• WebProcess/GPU/media/cocoa/MediaPlayerPrivateRemoteCocoa.mm:
• WebProcess/WebCoreSupport/WebChromeClient.cpp:
• WebProcess/WebCoreSupport/WebChromeClient.h:
• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::~WebPage):

• WebProcess/WebPage/WebPage.h:
• WebProcess/cocoa/VideoFullscreenManager.h:
• WebProcess/cocoa/VideoFullscreenManager.messages.in:
• WebProcess/cocoa/VideoFullscreenManager.mm:

Source/WTF:

Add macro ENABLE_VIDEO_PRESENTATION_MODE.

• wtf/PlatformEnable.h:

10:01 AM Changeset in webkit [260258] by Alan Bujtas

• 2 edits in trunk/Source/WebCore

[LFC][TFC] Resolve the minimum width for overlapping spanner columns
​https://bugs.webkit.org/show_bug.cgi?id=210654

Reviewed by Antti Koivisto.

The extra horizontal space distribution is based on the columns' minimum widths.
In case of column spanners, first we need to distribute the spanner's minimum
width across the columns using the non-spanning minimum widths as the distribution ratio.
When there's no non-spanning minimum width for a column (all rows have column spanners for tbis particular column)
the minimum width gets distributed equally across the spanned columns. This distribution starts with the shortest columns spans
so that we can use these resolved column widths to compute the wider ones.

• layout/tableformatting/TableFormattingContext.cpp:

(WebCore::Layout::TableFormattingContext::computeAndDistributeExtraHorizontalSpace):

9:36 AM Changeset in webkit [260257] by Claudio Saavedra

• 2 edits in trunk/Source/WTF

[GTK][WPE] Bump dependencies minimum required version in Platform.h
​https://bugs.webkit.org/show_bug.cgi?id=210651

Reviewed by Adrian Perez de Castro.

Bring the minimum required version in Platform.h in sync with the actual
minimal required version. This ensures that deprecated APIs used bring up
compilation warnings.

• wtf/Platform.h:

9:24 AM Changeset in webkit [260256] by Jason_Lawrence

• 2 edits in trunk/LayoutTests/imported/w3c

REGRESSION: (r260243) [ Mac and iOS ] imported/w3c/web-platform-tests/css/cssom-view/MediaQueryList-addListener-handleEvent.html fails.
​https://bugs.webkit.org/show_bug.cgi?id=210655

Unreviewed test gardening.

• web-platform-tests/css/cssom-view/MediaQueryList-addListener-handleEvent-expected.txt:

8:50 AM Changeset in webkit [260255] by Claudio Saavedra

• 9 edits in trunk

[GTK] Update for GdkKeymap API changes
​https://bugs.webkit.org/show_bug.cgi?id=210642

Reviewed by Adrian Perez de Castro.

No new tests needed.

gdk_keymap_get_default() is deprecated in GTK+ 3.22, so use
gdk_keymap_get_for_display() instead. Since in GTK4 this method is
removed to gdk_display_get_keymap(), add a helper to
GtkVersioning.h to avoid cluttering with ifdefs all over the
place.

Source/WebCore:

• platform/gtk/GtkVersioning.h:

(gdk_keymap_get_for_display):

• platform/gtk/PlatformKeyboardEventGtk.cpp:

(WebCore::PlatformKeyboardEvent::currentCapsLockState):
(WebCore::PlatformKeyboardEvent::modifiersContainCapsLock):

Source/WebKit:

• UIProcess/Automation/gtk/WebAutomationSessionGtk.cpp:

(WebKit::doKeyStrokeEvent):

Tools:

• TestWebKitAPI/glib/WebKitGLib/gtk/WebViewTestGtk.cpp:

(WebViewTest::keyStroke):

• TestWebKitAPI/gtk/PlatformWebViewGtk.cpp:

(TestWebKitAPI::doKeyStroke):

• WebKitTestRunner/gtk/EventSenderProxyGtk.cpp:

(WTR::EventSenderProxy::keyDown):

8:49 AM WebKitGTK/2.28.x edited by Michael Catanzaro

(diff)

8:47 AM Changeset in webkit [260254] by graouts@webkit.org

• 6 edits in trunk

Allow the UserStyleLevel to be set through _WKUserStyleSheet
​https://bugs.webkit.org/show_bug.cgi?id=210653
<rdar://problem/60506645>

Reviewed by Tim Horton.

Source/WebKit:

Add a new _WKUserStyleLevel enum such that we may provide the specificity level of the backing UserStyleSheet, represented by the UserStyleLevel enum in WebCore.

• UIProcess/API/Cocoa/_WKUserStyleSheet.h:
• UIProcess/API/Cocoa/_WKUserStyleSheet.mm:

(-[_WKUserStyleSheet initWithSource:forWKWebView:forMainFrameOnly:level:userContentWorld:]):
(-[_WKUserStyleSheet initWithSource:forMainFrameOnly:legacyWhitelist:legacyBlacklist:baseURL:level:userContentWorld:]):
(-[_WKUserStyleSheet initWithSource:forWKWebView:forMainFrameOnly:userContentWorld:]): Deleted.

• UIProcess/API/Cocoa/_WKUserStyleSheetInternal.h:

(API::toWebCoreUserStyleLevel):

Tools:

Add new tests for the "level" parameter when creating a _WKUserStyleSheet.

• TestWebKitAPI/Tests/WebKitCocoa/UserContentController.mm:

(TEST):

8:41 AM Changeset in webkit [260253] by commit-queue@webkit.org

• 2 edits in trunk/JSTests

Reduce test iterations for stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js on mips
​https://bugs.webkit.org/show_bug.cgi?id=210641

Patch by Paulo Matos <Paulo Matos> on 2020-04-17
Reviewed by Yusuke Suzuki.

Reduce test iteration count on mips for which the current value is too high.

• stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:

8:24 AM Changeset in webkit [260252] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebKit

[GTK][X11] REGRESSION(r259944): Wrong position of select popup menu in X11
​https://bugs.webkit.org/show_bug.cgi?id=210603

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2020-04-17
Reviewed by Michael Catanzaro.

gdk_window_move_to_rect expects the given rectangle in coordinates relative to the top-left corner of the window
that the popup window is transient for. We were using screen coordinates.

• UIProcess/gtk/WebPopupMenuProxyGtk.cpp:

(WebKit::WebPopupMenuProxyGtk::showPopupMenu): Translate widget coordinates to window coordinates before passing
the rectangle to gdk_window_move_to_rect().

8:02 AM Changeset in webkit [260251] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebKit

REGRESSION (r256756): -[WKUserDefaults initWithSuiteName:]: Instance variable used while 'self' is not set to the result of '[(super or self) init...]'
<​https://webkit.org/b/210647>
<rdar://problem/61928289>

Reviewed by Anders Carlsson.

• UIProcess/Cocoa/PreferenceObserver.mm:

(-[WKUserDefaults initWithSuiteName:]):

• Call [self initWithSuite:] and set self to fix the clang static analyzer warning.
• Fix camelCase of suitename parameter.

7:57 AM Changeset in webkit [260250] by ddkilzer@apple.com

• 2 edits in trunk/Tools

REGRESSION (r162729): [iOS] WebKitTestRunner over-releases UITextField in WTR::PlatformWebView::removeChromeInputField()
<​https://webkit.org/b/210643>
<rdar://problem/61927190>

Reviewed by Wenson Hsieh.

• WebKitTestRunner/ios/PlatformWebViewIOS.mm:

(WTR::PlatformWebView::removeChromeInputField):

• Remove unnecessary -release.

7:46 AM Changeset in webkit [260249] by Oriol Brufau

• 27 edits in trunk

Revert "[css-grid] Exclude implicit grid tracks from the resolved value"
​https://bugs.webkit.org/show_bug.cgi?id=210617

Reviewed by Manuel Rego Casasnovas.

LayoutTests/imported/w3c:

WPT tests are not reverted for now, just updating the expectations.

• web-platform-tests/css/css-grid/grid-definition/grid-inline-support-flexible-lengths-001-expected.txt:
• web-platform-tests/css/css-grid/grid-definition/grid-inline-support-grid-template-columns-rows-001-expected.txt:
• web-platform-tests/css/css-grid/grid-definition/grid-inline-support-named-grid-lines-001-expected.txt:
• web-platform-tests/css/css-grid/grid-definition/grid-inline-support-repeat-001-expected.txt:
• web-platform-tests/css/css-grid/grid-definition/grid-inline-template-columns-rows-resolved-values-001-expected.txt:
• web-platform-tests/css/css-grid/grid-definition/grid-support-flexible-lengths-001-expected.txt:
• web-platform-tests/css/css-grid/grid-definition/grid-support-grid-template-columns-rows-001-expected.txt:
• web-platform-tests/css/css-grid/grid-definition/grid-support-named-grid-lines-001-expected.txt:
• web-platform-tests/css/css-grid/grid-definition/grid-support-repeat-001-expected.txt:
• web-platform-tests/css/css-grid/grid-definition/grid-template-columns-rows-resolved-values-001-expected.txt:
• web-platform-tests/css/css-grid/grid-layout-properties-expected.txt:
• web-platform-tests/css/css-grid/parsing/grid-template-columns-computed-withcontent-expected.txt:
• web-platform-tests/css/css-grid/parsing/grid-template-rows-computed-withcontent-expected.txt:

Source/WebCore:

Revert r254561 since it appears to be breaking site authoring tools
which were relying on the previous behaviour.

Tests: fast/css-grid-layout/grid-auto-columns-rows-get-set.html

fast/css-grid-layout/grid-columns-rows-get-set.html
fast/css-grid-layout/grid-template-shorthand-get-set.html
fast/css-grid-layout/mark-as-infinitely-growable.html
fast/css-grid-layout/named-grid-lines-computed-style-implicit-tracks.html
fast/css-grid-layout/negative-growth-share-as-infinity-crash.html
imported/w3c/web-platform-tests/css/css-grid/grid-definition/grid-inline-support-flexible-lengths-001.html
imported/w3c/web-platform-tests/css/css-grid/grid-definition/grid-inline-support-grid-template-columns-rows-001.html
imported/w3c/web-platform-tests/css/css-grid/grid-definition/grid-inline-support-named-grid-lines-001.html
imported/w3c/web-platform-tests/css/css-grid/grid-definition/grid-inline-support-repeat-001.html
imported/w3c/web-platform-tests/css/css-grid/grid-definition/grid-inline-template-columns-rows-resolved-values-001.html
imported/w3c/web-platform-tests/css/css-grid/grid-definition/grid-support-flexible-lengths-001.html
imported/w3c/web-platform-tests/css/css-grid/grid-definition/grid-support-grid-template-columns-rows-001.html
imported/w3c/web-platform-tests/css/css-grid/grid-definition/grid-support-named-grid-lines-001.html
imported/w3c/web-platform-tests/css/css-grid/grid-definition/grid-support-repeat-001.html
imported/w3c/web-platform-tests/css/css-grid/grid-definition/grid-template-columns-rows-resolved-values-001.html
imported/w3c/web-platform-tests/css/css-grid/grid-layout-properties.html
imported/w3c/web-platform-tests/css/css-grid/parsing/grid-template-columns-computed-withcontent.html
imported/w3c/web-platform-tests/css/css-grid/parsing/grid-template-rows-computed-withcontent.html

• css/CSSComputedStyleDeclaration.cpp:

(WebCore::valueForGridTrackList):

• rendering/RenderGrid.cpp:

(WebCore::RenderGrid::trackSizesForComputedStyle const):

LayoutTests:

Revert r254561 since it appears to be breaking site authoring tools
which were relying on the previous behaviour.

• fast/css-grid-layout/grid-auto-columns-rows-get-set-expected.txt:
• fast/css-grid-layout/grid-auto-columns-rows-get-set.html:
• fast/css-grid-layout/grid-columns-rows-get-set.html:
• fast/css-grid-layout/grid-template-shorthand-get-set-expected.txt:
• fast/css-grid-layout/grid-template-shorthand-get-set.html:
• fast/css-grid-layout/mark-as-infinitely-growable.html:
• fast/css-grid-layout/named-grid-lines-computed-style-implicit-tracks-expected.txt:
• fast/css-grid-layout/named-grid-lines-computed-style-implicit-tracks.html:
• fast/css-grid-layout/negative-growth-share-as-infinity-crash.html:

7:41 AM Changeset in webkit [260248] by ysuzuki@apple.com

• 3 edits
  2 adds in trunk

[JSC] Map/Set iterator creation functions should fail with BadType etc. before executing insertChecks
​https://bugs.webkit.org/show_bug.cgi?id=210649
<rdar://problem/61925452>

Reviewed by Mark Lam.

JSTests:

• stress/map-iterator-check-before-fail.js: Added.

(test):

• stress/set-iterator-check-before-fail.js: Added.

(set new):
(set var):

Source/JavaScriptCore:

Since insertChecks adds some DFG nodes, we should determine whether this intrinsic handling is OK or not before executing insertChecks.
Otherwise, we will hit an assertion with !didInsertChecks.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

7:40 AM Changeset in webkit [260247] by pvollan@apple.com

• 22 edits
  3 adds in trunk

[iOS] Deny iokit open access to graphics related classes
​https://bugs.webkit.org/show_bug.cgi?id=210616

Reviewed by Darin Adler.

Source/WebCore:

Deny iokit open access to graphics related classes in the WebContent process on iOS, but issue
extensions for these for some devices which still need access to them.

API test: WebKit.IOKitOpenSandboxAccessForDeviceWithAGXCompilerService

• WebCore.xcodeproj/project.pbxproj:
• platform/cocoa/AGXCompilerService.cpp: Added.

(WebCore::setDeviceHasAGXCompilerServiceForTesting):
(WebCore::deviceHasAGXCompilerService):

• platform/cocoa/AGXCompilerService.h: Added.
• testing/Internals.cpp:

(WebCore::Internals::hasSandboxIOKitOpenAccessToClass):

• testing/Internals.h:
• testing/Internals.idl:
• testing/Internals.mm:

(WebCore::Internals::hasSandboxIOKitOpenAccessToClass):

Source/WebKit:

Deny iokit open access to graphics related classes in the WebContent process on iOS, but issue
extensions for these for some devices which still need access to them.

• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
• Shared/Cocoa/SandboxExtensionCocoa.mm:

(WebKit::SandboxExtensionImpl::sandboxExtensionForType):
(WebKit::SandboxExtension::createHandleForIOKitClassExtension):

• Shared/SandboxExtension.h:
• Shared/WebProcessCreationParameters.cpp:

(WebKit::WebProcessCreationParameters::encode const):
(WebKit::WebProcessCreationParameters::decode):

• Shared/WebProcessCreationParameters.h:
• UIProcess/API/ios/WKWebViewPrivateForTestingIOS.h:
• UIProcess/API/ios/WKWebViewTestingIOS.mm:

(-[WKWebView _setDeviceHasAGXCompilerServiceForTesting]):

• UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::platformInitializeWebProcess):
(WebKit::deviceHasAGXCompilerService): Deleted.

• UIProcess/WebPageProxy.h:
• UIProcess/ios/WebPageProxyIOS.mm:

(WebKit::WebPageProxy::setDeviceHasAGXCompilerServiceForTesting const):

• WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::platformInitializeWebProcess):

Source/WTF:

• wtf/spi/darwin/SandboxSPI.h:

Tools:

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WebKit/AGXCompilerService.mm: Added.

(TEST):

7:38 AM Changeset in webkit [260246] by mark.lam@apple.com

• 2 edits in trunk/Source/JavaScriptCore

offlineasm is generating the wrong load/store for the "orh" instruction.
​https://bugs.webkit.org/show_bug.cgi?id=210639
<rdar://problem/21501876>

Reviewed by Robin Morisset.

For example, on ARM64E, the "orh" instruction was generating the following:

"\tldr w17, [x1, #0]\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:919
"\torr w17, w17, #64\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:919
"\tstr w17, [x1, #0]\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:919

i.e. a 32-bit load, followed by a 32-bit OR, followed by a 32-bit store.

Instead, it should be generating the following:

"\tldrh w17, [x1, #0]\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:919
"\torr w17, w17, #64\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:919
"\tstrh w17, [x1, #0]\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:919

i.e. a 16-bit load, followed by a 32-bit OR, followed by a 16-bit store.

This bug also affects ARM64, ARMv7, and MIPS (basically any backend that uses
riscLowerMisplacedAddresses() from rise.rb). It does not affect x86, x86_64, and
C_LOOP (which was written based on x86).

• offlineasm/risc.rb:

7:22 AM Changeset in webkit [260245] by youenn@apple.com

• 9 edits
  8 adds in trunk

Safari doesn't apply frameRate limit when request stream from Camera
​https://bugs.webkit.org/show_bug.cgi?id=210186
<rdar://problem/61452794>

Reviewed by Eric Carlson.

Source/WebCore:

Add support to RealtimeVideoSource to decimate the video samples based on the observed frame rate of its capture source.
This allows supporting two tracks using the same capture device, one track being low frame rate and the other one high frame rate.

Clean-up refactoring to make RealtimeVideoSource directly inherit from RealtimeVideoCaptureSource.
Migrate size and format of frame adaptation from RealtimeVideoCaptureSource to RealtimeVideoSource.
Fix mock capture source to update its frame rate when asked by applyConstraints.

Tests: fast/mediastream/mediastreamtrack-video-frameRate-clone-decreasing.html

fast/mediastream/mediastreamtrack-video-frameRate-clone-increasing.html
fast/mediastream/mediastreamtrack-video-frameRate-decreasing.html
fast/mediastream/mediastreamtrack-video-frameRate-increasing.html

• platform/mediastream/RealtimeVideoCaptureSource.cpp:

(WebCore::RealtimeVideoCaptureSource::dispatchMediaSampleToObservers):
(WebCore::RealtimeVideoCaptureSource::clientUpdatedSizeAndFrameRate):

• platform/mediastream/RealtimeVideoCaptureSource.h:

(WebCore::RealtimeVideoCaptureSource::observedFrameRate const):

• platform/mediastream/RealtimeVideoSource.cpp:

(WebCore::RealtimeVideoSource::RealtimeVideoSource):
(WebCore::m_source):
(WebCore::RealtimeVideoSource::adaptVideoSample):
(WebCore::RealtimeVideoSource::videoSampleAvailable):

• platform/mediastream/RealtimeVideoSource.h:
• platform/mock/MockRealtimeVideoSource.cpp:

(WebCore::MockRealtimeVideoSource::setFrameRateWithPreset):

• testing/Internals.cpp:

(WebCore::Internals::observeMediaStreamTrack):

LayoutTests:

• fast/mediastream/mediastreamtrack-video-frameRate-clone-decreasing-expected.txt: Added.
• fast/mediastream/mediastreamtrack-video-frameRate-clone-decreasing.html: Added.
• fast/mediastream/mediastreamtrack-video-frameRate-clone-increasing-expected.txt: Added.
• fast/mediastream/mediastreamtrack-video-frameRate-clone-increasing.html: Added.
• fast/mediastream/mediastreamtrack-video-framerate-decreasing-expected.txt: added.
• fast/mediastream/mediastreamtrack-video-framerate-decreasing.html: added.
• fast/mediastream/mediastreamtrack-video-framerate-increasing-expected.txt: added.
• fast/mediastream/mediastreamtrack-video-framerate-increasing.html: added.
• webrtc/routines.js:

6:36 AM WebKitGTK/Gardening/Howto edited by Lauro Moura

Update flakiness dashboard link (diff)

5:53 AM Changeset in webkit [260244] by Carlos Garcia Campos

• 2 edits in trunk/Source/WebKit

[GTK] UI process crash when entering compositing mode when WPE_RENDERER is enabled
​https://bugs.webkit.org/show_bug.cgi?id=209118

Reviewed by Michael Catanzaro.

Check if EGL_WL_bind_wayland_display extension is available when using WPE_RENDERER, since we don't suport the
SHM interface.

• UIProcess/gtk/AcceleratedBackingStoreWayland.cpp:

(WebKit::AcceleratedBackingStoreWayland::checkRequirements): Return false if EGL_WL_bind_wayland_display is not present.

3:16 AM Changeset in webkit [260243] by Alexey Shvayka

• 31 edits
  3 adds
  5 deletes in trunk

MediaQueryList should extend EventTarget
​https://bugs.webkit.org/show_bug.cgi?id=203288

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

• web-platform-tests/css/cssom-view/MediaQueryList-addListener-handleEvent-expected.txt:
• web-platform-tests/css/cssom-view/MediaQueryList-addListener-removeListener-expected.txt:
• web-platform-tests/css/cssom-view/MediaQueryList-extends-EventTarget-expected.txt:
• web-platform-tests/css/cssom-view/MediaQueryList-extends-EventTarget-interop-expected.txt:
• web-platform-tests/css/cssom-view/MediaQueryListEvent-expected.txt:
• web-platform-tests/css/cssom-view/idlharness-expected.txt:
• web-platform-tests/css/cssom-view/matchMedia-expected.txt:

Source/WebCore:

Initially, CSSOM View Module specification [1] had a custom callback mechanism with addListener() and removeListener(),
and the callback was invoked with the associated MediaQueryList as argument.

Now the normal event mechanism [2] is used instead. For backwards compatibility, addListener() and removeListener()
methods are basically aliases for addEventListener() and removeEventListener(), respectively, and the "change" event
masquerades as a MediaQueryList.

This patch implements new event mechanism, aligning WebKit with Blink and SpiderMonkey, and also fixes
a few minor spec incompatibilities: mandatory listener argument, "handleEvent" support, and listeners call order.

[1]: ​https://www.w3.org/TR/2011/WD-cssom-view-20110804/#mediaquerylist
[2]: ​https://www.w3.org/TR/cssom-view-1/#mediaquerylist

Tests: fast/media/media-query-list-07.html

web-platform-tests/css/cssom-view/MediaQueryList-addListener-handleEvent.html
web-platform-tests/css/cssom-view/MediaQueryList-addListener-removeListener.html
web-platform-tests/css/cssom-view/MediaQueryList-extends-EventTarget.html
web-platform-tests/css/cssom-view/MediaQueryList-extends-EventTarget-interop.html
web-platform-tests/css/cssom-view/MediaQueryListEvent.html
web-platform-tests/css/cssom-view/idlharness.html
web-platform-tests/css/cssom-view/matchMedia.html

• CMakeLists.txt:
• DerivedSources-input.xcfilelist:
• DerivedSources-output.xcfilelist:
• DerivedSources.make:
• Sources.txt:
• WebCore.xcodeproj/project.pbxproj:
• bindings/js/WebCoreBuiltinNames.h:
• bindings/scripts/test/JS/*: Updated.
• css/MediaQueryList.cpp:

(WebCore::MediaQueryList::MediaQueryList):
(WebCore::MediaQueryList::create):
(WebCore::MediaQueryList::~MediaQueryList):
(WebCore::MediaQueryList::addListener):
(WebCore::MediaQueryList::removeListener):

• css/MediaQueryList.h:
• css/MediaQueryList.idl:
• css/MediaQueryListEvent.cpp: Added.

(WebCore::MediaQueryListEvent::MediaQueryListEvent):

• css/MediaQueryListEvent.h: Added.
• css/MediaQueryListEvent.idl: Added.
• css/MediaQueryListListener.h: Removed.
• css/MediaQueryListListener.idl: Removed.
• css/MediaQueryMatcher.cpp:

(WebCore::MediaQueryMatcher::documentDestroyed):
(WebCore::MediaQueryMatcher::addMediaQueryList):
(WebCore::MediaQueryMatcher::removeMediaQueryList):
(WebCore::MediaQueryMatcher::matchMedia):
(WebCore::MediaQueryMatcher::evaluateAll):
(WebCore::MediaQueryMatcher::addListener): Deleted.
(WebCore::MediaQueryMatcher::removeListener): Deleted.

• css/MediaQueryMatcher.h:
• dom/EventNames.in:
• dom/EventTarget.h:

(WebCore::EventTarget::removeEventListener):

• dom/EventTargetFactory.in:

Source/WebInspectorUI:

• UserInterface/Models/NativeFunctionParameters.js:

LayoutTests:

• TestExpectations:
• fast/media/media-query-list-07-expected.txt:
• fast/media/media-query-list-07.html:

2:35 AM Changeset in webkit [260242] by Adrian Perez de Castro

• 2 edits in trunk/Source/WebCore

Unreviewed build fix after r260123

No new tests needed.

• platform/gtk/CursorGtk.cpp:

(WebCore::createCustomCursor): Pass missing pixel buffer data pointer to gdk_memory_texture_new().

1:40 AM Changeset in webkit [260241] by youenn@apple.com

• 10 edits in trunk/Source

Make use of WeakHashSet for MediaStreamTrackPrivate and RealtimeMediaSource observers
​https://bugs.webkit.org/show_bug.cgi?id=210492

Reviewed by Geoffrey Garen.

Source/WebCore:

We are making use of WeakHashSet to improve the robustness of the code.
For that purpose we use the new WeakHashSet::forEach method.
No change of behavior.

• Modules/mediarecorder/MediaRecorder.h:
• platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
• platform/mediastream/MediaStreamPrivate.cpp:

(WebCore::MediaStreamPrivate::forEachObserver const):

• platform/mediastream/MediaStreamTrackPrivate.cpp:

(WebCore::MediaStreamTrackPrivate::forEachObserver):
(WebCore::MediaStreamTrackPrivate::addObserver):
(WebCore::MediaStreamTrackPrivate::removeObserver):
(WebCore::MediaStreamTrackPrivate::forEachObserver const): Deleted.

• platform/mediastream/MediaStreamTrackPrivate.h:

(WebCore::MediaStreamTrackPrivate::hasObserver const): Deleted.

• platform/mediastream/RealtimeMediaSource.cpp:

(WebCore::RealtimeMediaSource::addAudioSampleObserver):
(WebCore::RealtimeMediaSource::removeAudioSampleObserver):
(WebCore::RealtimeMediaSource::addObserver):
(WebCore::RealtimeMediaSource::removeObserver):
(WebCore::RealtimeMediaSource::forEachObserver):
(WebCore::RealtimeMediaSource::notifyMutedObservers):
(WebCore::RealtimeMediaSource::requestToEnd):
(WebCore::RealtimeMediaSource::forEachObserver const): Deleted.
(WebCore::RealtimeMediaSource::notifyMutedObservers const): Deleted.

• platform/mediastream/RealtimeMediaSource.h:
• platform/mediastream/RealtimeOutgoingVideoSource.h:

Source/WTF:

• wtf/WeakHashSet.h:

1:37 AM Changeset in webkit [260240] by commit-queue@webkit.org

• 2 edits in trunk/Tools

[Flatpak SDK] Not fully hooked in BuildSlaveSupport
​https://bugs.webkit.org/show_bug.cgi?id=210548

Patch by Philippe Normand <​pnormand@igalia.com> on 2020-04-17
Reviewed by Carlos Alberto Lopez Perez.

• Scripts/webkitdirs.pm:

(determineBaseProductDir): Flatpak SDK builds use a dedicated product directory per port.

12:52 AM Changeset in webkit [260239] by commit-queue@webkit.org

• 17 edits in trunk/Source

Move allowPlugins to FrameLoader
​https://bugs.webkit.org/show_bug.cgi?id=205876

Patch by Rob Buis <​rbuis@igalia.com> on 2020-04-17
Reviewed by Darin Adler.

Source/WebCore:

Move allowPlugins to FrameLoader to reduce
pointer dereferences and lessen dependency
on SubframeLoader. Also rename to
arePluginsEnabled since the method is asking
the Setting with the same name.

• dom/DOMImplementation.cpp:

(WebCore::DOMImplementation::createDocument):

• html/HTMLElement.cpp:

(WebCore::HTMLElement::rendererIsEverNeeded):

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::arePluginsEnabled):

• loader/FrameLoader.h:
• loader/SubframeLoader.cpp:

(WebCore::SubframeLoader::createJavaAppletWidget):
(WebCore::SubframeLoader::allowPlugins): Deleted.

• loader/SubframeLoader.h:
• plugins/DOMMimeType.cpp:

(WebCore::DOMMimeType::enabledPlugin const):

Source/WebKit:

Adapt to API change.

• WebProcess/Plugins/WebPluginInfoProvider.cpp:

(WebKit::WebPluginInfoProvider::pluginInfo):
(WebKit::WebPluginInfoProvider::populatePluginCache):

• WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::objectContentType):

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::createPlugin):
(WebKit::WebPage::canPluginHandleResponse):
(WebKit::WebPage::canShowMIMEType const):

Source/WebKitLegacy/mac:

Adapt to API change.

• WebCoreSupport/WebPluginInfoProvider.mm:

(WebPluginInfoProvider::pluginInfo):

• WebView/WebFrame.mm:

(-[WebFrame _canProvideDocumentSource]):

Source/WebKitLegacy/win:

Adapt to API change.

• WebView.cpp:

(WebView::canShowMIMEType):

12:35 AM Changeset in webkit [260238] by commit-queue@webkit.org

• 5 edits in trunk

Fix an integer overflow in WebCrypto AES-CTR Mac implementation, which may detect a false loop
​https://bugs.webkit.org/show_bug.cgi?id=210540

Source/WebCore:

(1 << counterLength) causes an integer overflow, and the undefined behavior.
The longest valid counterLength on 64 bit machine is 63,
and the literal 1 is considered as 32-bit signed integer.
Left shifting 1 beyond or to sign-bit is undefined behavior in C++ spec.

• ​https://en.cppreference.com/w/cpp/language/integer_literal
• ​https://en.cppreference.com/w/cpp/language/operator_arithmetic#Bitwise_shift_operators

This issue is originally found in ​https://bugs.webkit.org/show_bug.cgi?id=208186#c2

Patch by Tomoki Imai <Tomoki Imai> on 2020-04-17
Reviewed by Jiewen Tan.

Test: crypto/subtle/aes-ctr-import-key-encrypt.html

• crypto/mac/CryptoAlgorithmAES_CTRMac.cpp:

(WebCore::transformAES_CTR):

LayoutTests:

Patch by Tomoki Imai <Tomoki Imai> on 2020-04-17
Reviewed by Jiewen Tan.

Added more AES-CTR tests for AesCtrParams.length larger than 32.

• crypto/subtle/aes-ctr-import-key-encrypt-expected.txt:
• crypto/subtle/aes-ctr-import-key-encrypt.html: