Context Navigation

← Previous Period
Next Period →

Timeline

Apr 19, 2020:

11:32 PM Changeset in webkit [260353] by Simon Fraser

6 edits in trunk/Source/WebCore

Use Optional<FloatQuad> in TransformState
https://bugs.webkit.org/show_bug.cgi?id=144226

Reviewed by Sam Weinig.

Use Optional<> instead of pointers in TransformState, make it loggable, make FloatQuad loggable.

platform/graphics/FloatQuad.cpp:

(WebCore::operator<<):

platform/graphics/FloatQuad.h:
platform/graphics/ca/GraphicsLayerCA.cpp:

(WebCore::GraphicsLayerCA::flushCompositingState):
(WebCore::GraphicsLayerCA::computeVisibleAndCoverageRect const):
(WebCore::GraphicsLayerCA::recursiveCommitChanges):

platform/graphics/transforms/TransformState.cpp:

(WebCore::TransformState::operator=):
(WebCore::TransformState::mappedSecondaryQuad const):
(WebCore::TransformState::setLastPlanarSecondaryQuad):
(WebCore::TransformState::flattenWithTransform):
(WebCore::operator<<):

platform/graphics/transforms/TransformState.h:

(WebCore::TransformState::setSecondaryQuad):
(WebCore::TransformState::lastPlanarSecondaryQuad const):
(WebCore::TransformState::isMappingSecondaryQuad const):
(WebCore::TransformState::accumulatedTransform const):

11:30 PM Changeset in webkit [260352] by ysuzuki@apple.com

2 edits in trunk/LayoutTests

Unreviewed, skip imported/w3c/web-platform-tests/IndexedDB/structured-clone
https://bugs.webkit.org/show_bug.cgi?id=210731#c4

Skipping this test based on the following rationales.

This test was previously *effectively* skipped because it is including BigInt syntax. This test immediately throws SyntaxError. So nothing in this test was executed before.
Now JSC supports BigInt syntax. Then, this test is now executed finally. And crash happens when deserializaing DOMMatrixReadOnly.
This is because DOMMatrixReadOnly requires JSDOMGlobalObject since DOMMatrixReadOnly is WebCore object, not JSC object.
However, IDBSerializationContext.cpp is using plain JSGlobalObject. This is not correct since it is JSC JSGlobalObject and it does not include DOMMatrix implementations.
So, nothing is related to BigInt here.

TestExpectations:

11:20 PM Changeset in webkit [260351] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Remove unneeded code from FrameLoader::loadURL
https://bugs.webkit.org/show_bug.cgi?id=210696

Patch by Rob Buis <rbuis@igalia.com> on 2020-04-19
Reviewed by Darin Adler.

Remove unneeded code from FrameLoader::loadURL, since the only way the load type can be Reload
is if loadFrameRequest set it, and the only way loadFrameRequest can set it is if cachePolicy
is ReloadIgnoringCacheData, so no need to set it again in FrameLoader::loadURL.

loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadURL):

10:55 PM Changeset in webkit [260350] by beidson@apple.com

37 edits
1 add in trunk

Add WKScriptMessageHandler API that asynchronously responds with a promise.
rdar://problem/57243492 and https://bugs.webkit.org/show_bug.cgi?id=206398

Reviewed by Andy Estes.
Source/WebCore:

Covered by new API tests.

Updated for moving an #include into implementation files:

bindings/js/JSDOMPromiseDeferred.cpp:
bindings/js/JSDOMPromiseDeferred.h:
html/HTMLMediaElement.cpp:
page/DOMWindow.cpp:
workers/service/ServiceWorkerGlobalScope.cpp:

page/UserMessageHandler.cpp:

(WebCore::UserMessageHandler::postMessage): Return a promise to be fulfilled by the API client.

page/UserMessageHandler.h:
page/UserMessageHandler.idl:
page/UserMessageHandlerDescriptor.h:

Source/WebKit:

Change webkit.messageHandlers.<name>.postMessage() to return a promise instead of undefined.

Allow for that promise to be resolved by an asynchronous reply block up in the API client.
This is like the spiritual opposite version of [WKWebView callAsyncFunction:...]

And while we're adding a new script message handler variant, we're adding it sandboxed by WKContentWorld.

Shared/API/APISerializedScriptValue.h:
UIProcess/API/Cocoa/APISerializedScriptValueCocoa.mm:

(API::validateObject):
(API::coreValueFromNSObject):
(API::SerializedScriptValue::createFromNSObject):
(API::SerializedScriptValue::wireBytesFromNSObject): Deleted.

UIProcess/API/Cocoa/WKScriptMessage.h: Now that script message handlers can be per-world, messages declare which world they were posted from.
UIProcess/API/Cocoa/WKScriptMessage.mm:

(-[WKScriptMessage _initWithBody:webView:frameInfo:name:world:]):
(-[WKScriptMessage world]):
(-[WKScriptMessage _initWithBody:webView:frameInfo:name:]): Deleted.

UIProcess/API/Cocoa/WKScriptMessageInternal.h:

UIProcess/API/Cocoa/WKScriptMessageHandlerWithReply.h: Added. Declare the new protocol for a script message handler that can reply to messages asynchronously.

UIProcess/API/Cocoa/WKUserContentController.h:
UIProcess/API/Cocoa/WKUserContentController.mm:

(-[WKUserContentController _addScriptMessageHandler:]):
(-[WKUserContentController addScriptMessageHandler:name:]):
(-[WKUserContentController addScriptMessageHandler:contentWorld:name:]):
(-[WKUserContentController addScriptMessageHandlerWithReply:contentWorld:name:]):
(-[WKUserContentController removeScriptMessageHandlerForName:contentWorld:]):
(-[WKUserContentController removeAllScriptMessageHandlersFromContentWorld:]):
(-[WKUserContentController removeAllScriptMessageHandlers]):

UIProcess/API/Cocoa/WKUserContentControllerInternal.h:
UIProcess/API/Cocoa/WKUserContentControllerPrivate.h:

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _evaluateJavaScript:asAsyncFunction:withArguments:forceUserGesture:inFrame:inWorld:completionHandler:]):
Update for new shared API::SerializedScriptValue initialization.

UIProcess/API/glib/WebKitUserContentManager.cpp:
UIProcess/API/gtk/WebKitRemoteInspectorProtocolHandler.cpp:
UIProcess/Inspector/socket/RemoteInspectorProtocolHandler.cpp:

UIProcess/UserContent/WebScriptMessageHandler.h:
UIProcess/UserContent/WebUserContentControllerProxy.cpp:

(WebKit::WebUserContentControllerProxy::removeAllUserMessageHandlers):
(WebKit::WebUserContentControllerProxy::didPostMessage):

UIProcess/UserContent/WebUserContentControllerProxy.h:
UIProcess/UserContent/WebUserContentControllerProxy.messages.in:

WebKit.xcodeproj/project.pbxproj:

WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDOMWindow.cpp:

(webkit_dom_dom_window_webkit_message_handlers_post_message):

WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::removeAllUserScriptMessageHandlers):
(WebKit::WebUserContentController::removeAllUserScriptMessageHandlersForWorlds):

WebProcess/UserContent/WebUserContentController.h:
WebProcess/UserContent/WebUserContentController.messages.in:

Source/WTF:

wtf/CompletionHandler.h:

(WTF::CompletionHandlerWithFinalizer<Out): Add a variant of CompletionHandler that allows for a Finalizer function

to handle cases where the Completion function hasn't been called at destruction time.

Tools:

TestWebKitAPI/Tests/WebKitCocoa/UserContentController.mm:

(TEST):
(webViewForScriptMessageHandlerMultipleHandlerRemovalTest):
(-[AsyncScriptMessageHandler userContentController:didReceiveScriptMessage:replyHandler:]):

10:15 PM Changeset in webkit [260349] by Ross Kirsling

25 edits
1 copy
6 adds in trunk

[ECMA-402] Intl.RelativeTimeFormat missing in WebKit
https://bugs.webkit.org/show_bug.cgi?id=209770

Reviewed by Darin Adler.

JSTests:

stress/intl-relativetimeformat.js: Added.

test262/config.yaml:

Enable Intl.RelativeTimeFormat feature with flag.

test262/expectations.yaml:

Mark known failures.
Test for locale validation is not specific to RelativeTimeFormat and should be investigated separately.
Tests for Polish appear to be wrong and should be corrected in test262.

Source/JavaScriptCore:

This patch implements the recent ECMA-402 feature Intl.RelativeTimeFormat.

RelativeTimeFormat has format / formatToParts functions like NumberFormat / DateTimeFormat
and is used to turn a number and unit into a formatted relative time string, e.g.:

new Intl.RelativeTimeFormat('en').format(10, 'day')

'in 10 days'

new Intl.RelativeTimeFormat('en', { numeric: 'auto' }).format(0, 'day')

'today'

Implementation of RelativeTimeFormat#formatToParts makes direct use of NumberFormat#formatToParts,
as the relative time string consists of at most one formatted number with optional literal text on either side.

This feature is runtime-guarded by the useIntlRelativeTimeFormat option.

CMakeLists.txt:
DerivedSources-input.xcfilelist:
DerivedSources-output.xcfilelist:
DerivedSources.make:
JavaScriptCore.xcodeproj/project.pbxproj:
Sources.txt:
runtime/CommonIdentifiers.h:
runtime/IntlRelativeTimeFormat.cpp: Added.
runtime/IntlRelativeTimeFormat.h: Added.
runtime/IntlRelativeTimeFormatConstructor.cpp: Added.
runtime/IntlRelativeTimeFormatConstructor.h: Added.
runtime/IntlRelativeTimeFormatPrototype.cpp: Added.
runtime/IntlRelativeTimeFormatPrototype.h: Added.
runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::relativeTimeFormatStructure):

runtime/OptionsList.h:
runtime/VM.cpp:

(JSC::VM::VM):

runtime/VM.h:

Add feature and runtime option.

runtime/IntlDateTimeFormat.cpp:

(JSC::IntlDateTimeFormat::formatToParts):

runtime/IntlPluralRules.cpp:

(JSC::IntlPluralRules::initializePluralRules):
(JSC::IntlPluralRules::resolvedOptions):
Make "type" a property name.

runtime/IntlNumberFormat.cpp:

(JSC::IntlNumberFormat::initializeNumberFormat):
(JSC::IntlNumberFormat::resolvedOptions):
(JSC::IntlNumberFormat::formatToPartsInternal):
(JSC::IntlNumberFormat::formatToParts):

runtime/IntlNumberFormat.h:

Factor out formatToPartsInternal so that RelativeTimeFormat can use it with its own UNumberFormat.
(This logic is too complicated to duplicate; it's because ICU won't split, e.g., "10,000" into parts for us.)

runtime/IntlObject.cpp:

(JSC::IntlObject::IntlObject):
(JSC::IntlObject::create):
(JSC::IntlObject::finishCreation):
(JSC::intlAvailableLocales):
(JSC::intlCollatorAvailableLocales):
(JSC::isUnicodeLocaleIdentifierType):
(JSC::supportedLocales):
(JSC::intlDateTimeFormatAvailableLocales): Deleted.
(JSC::intlNumberFormatAvailableLocales): Deleted.

runtime/IntlObject.h:

(JSC::intlDateTimeFormatAvailableLocales):
(JSC::intlNumberFormatAvailableLocales):
(JSC::intlPluralRulesAvailableLocales):
(JSC::intlRelativeTimeFormatAvailableLocales):
Perform three corrections for Intl classes:

Collator should be the only class with unique "available locales". [unum|udat]_getAvailable exist but they've deferred to uloc_getAvailable for 20 years.
isUnicodeLocaleIdentifierType isn't just alphanum{3,8} but rather alphanum{3,8} (sep alphanum{3,8})*. This is my own mistake from r239941.
supportedLocalesOf entries should not be frozen. Changed in https://github.com/tc39/ecma402/pull/278.

tools/JSDollarVM.cpp:

(JSC::functionICUVersion):
(JSC::JSDollarVM::finishCreation):
Add $vm.icuVersion so that we can add per-line skips to stress tests.

Tools:

Scripts/run-jsc-stress-tests:

Add runIntlRelativeTimeFormatEnabled.

8:46 PM Changeset in webkit [260348] by ddkilzer@apple.com

2 edits in trunk/Source/WebKit

REGRESSION (r244091): Leak of TaskStateChangedCallbackType due to missing -dealloc
<https://webkit.org/b/210710>
<rdar://problem/61992856>

Reviewed by Darin Adler.

Shared/Cocoa/ProcessTaskStateObserver.mm:

(-[WKProcessTaskStateObserverDelegate dealloc]): Add.

Release _taskStateChangedCallback to fix the leak.

7:18 PM Changeset in webkit [260347] by ddkilzer@apple.com

2 edits in trunk/Source/WebKit

[IPC hardening] Use MESSAGE_CHECK in WebPageProxy::loadRecentSearches() and WebPageProxy::saveRecentSearches()
<https://webkit.org/b/210683>
<rdar://problem/59240446>

Reviewed by Geoffrey Garen.

UIProcess/Cocoa/WebPageProxyCocoa.mm:

(MESSAGE_CHECK): Add.
(MESSAGE_CHECK_COMPLETION): Add.
(WebKit::WebPageProxy::saveRecentSearches):
(WebKit::WebPageProxy::loadRecentSearches):

Replace boolean check of const String& with MESSAGE_CHECK.

6:56 PM Changeset in webkit [260346] by ysuzuki@apple.com

3 edits in trunk/Source/JavaScriptCore

[JSC] SlowPathCall is not supported by callOperation in Windows
https://bugs.webkit.org/show_bug.cgi?id=210727

Reviewed by Ross Kirsling.

In Windows, SlowPathCall should be handled by JITSlowPathCall, otherwise, stack is not correctly allocated.

jit/JITCall.cpp:

(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):

jit/SlowPathCall.h:

(JSC::JITSlowPathCall::call):

5:59 PM Changeset in webkit [260345] by ysuzuki@apple.com

4 edits in trunk/Source

[JSC] Enable BigInt
https://bugs.webkit.org/show_bug.cgi?id=210726

Reviewed by Mark Lam.

Source/JavaScriptCore:

runtime/OptionsList.h:

Source/WTF:

wtf/PlatformUse.h:

4:53 PM Changeset in webkit [260344] by ysuzuki@apple.com

5 edits in trunk/Source/JavaScriptCore

[JSC] LLInt slow path call should not have third argument
https://bugs.webkit.org/show_bug.cgi?id=210721

Reviewed by Mark Lam.

LLInt callSlowPath does not work with third argument in Windows, CLoop etc. LLInt slow-path should not take third argument,
instead, use bytecode.metadata(...) to get metadata.

jit/JITCall.cpp:

(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):

llint/LowLevelInterpreter64.asm:
runtime/CommonSlowPaths.cpp:

(JSC::iterator_open_try_fast):
(JSC::SLOW_PATH_DECL):
(JSC::iterator_next_try_fast):
(JSC::iterator_open_try_fast_narrow): Deleted.
(JSC::iterator_open_try_fast_wide16): Deleted.
(JSC::iterator_open_try_fast_wide32): Deleted.
(JSC::iterator_next_try_fast_narrow): Deleted.
(JSC::iterator_next_try_fast_wide16): Deleted.
(JSC::iterator_next_try_fast_wide32): Deleted.

runtime/CommonSlowPaths.h:

2:18 PM Changeset in webkit [260343] by mark.lam@apple.com

6 edits in trunk/Source/JavaScriptCore

Fix missing exception checks and handling in JSC APIs.
https://bugs.webkit.org/show_bug.cgi?id=210715
<rdar://problem/61599658>

Reviewed by Saam Barati.

API/APICallbackFunction.h:

(JSC::APICallbackFunction::call):

We should return early if an exception was thrown. We should not be using the result in any way since we cannot rely on it having any sane value.

(JSC::APICallbackFunction::construct):

For consistency, also return an undefined here when an exception was thrown.

API/JSCallbackObjectFunctions.h:

(JSC::JSCallbackObject<Parent>::construct):
(JSC::JSCallbackObject<Parent>::call):

Return an undefined if an exception was thrown. Don't return the potentially garbage result value. Who knows what the client code will do with it. Returning an undefined here makes the code more robust.

API/JSObjectRef.cpp:

(JSObjectGetProperty):
(JSObjectHasPropertyForKey):
(JSObjectGetPropertyForKey):
(JSObjectDeletePropertyForKey):
(JSObjectGetPropertyAtIndex):
(JSObjectDeleteProperty):

Explicitly return a nullptr if an exception was thrown. The toRef() on the result that follows the exception check may or may not return a nullptr (also see toRef(JSC::VM& vm, JSC::JSValue v) for !CPU(ADDRESS64)).

API/JSValueRef.cpp:

(JSValueIsEqual):
(JSValueIsInstanceOfConstructor):

For consistency, make these return false if an exception is thrown.

API/ObjCCallbackFunction.mm:

(JSC::objCCallbackFunctionCallAsFunction):
(JSC::objCCallbackFunctionCallAsConstructor):
(JSC::ObjCCallbackFunctionImpl::call):

Add some assertions and return early if an exception was thrown.

11:34 AM Changeset in webkit [260342] by Alan Bujtas

4 edits
2 adds in trunk

[LFC][TFC] Add column spanning support for flexible table width
https://bugs.webkit.org/show_bug.cgi?id=210713

Reviewed by Antti Koivisto.

Source/WebCore:

Test: fast/layoutformattingcontext/table-flex-width-colspans.html

This patch slightly changes the extra space distribution logic by using either the minimum or
the maximum width as the base initial width for the columns.

layout/tableformatting/TableFormattingContext.cpp:

(WebCore::Layout::TableFormattingContext::layoutInFlowContent):
(WebCore::Layout::TableFormattingContext::computeColumnWidths):
(WebCore::Layout::TableFormattingContext::computeAndDistributeExtraHorizontalSpace): Deleted.

layout/tableformatting/TableFormattingContext.h:

LayoutTests:

fast/layoutformattingcontext/table-flex-width-colspans-expected.txt: Added.
fast/layoutformattingcontext/table-flex-width-colspans.html: Added.

11:12 AM Changeset in webkit [260341] by don.olmstead@sony.com

4 edits
3 moves
2 adds in trunk/Tools

[CMake] Consolidate TestNetscapePlugin build
https://bugs.webkit.org/show_bug.cgi?id=210691

Reviewed by Fujii Hironori.

The DumpRenderTree CMakeLists.txt contained a definition of TestNetscapePlugIn
which was used for WebKitLegacy ports. The TestNetscapePlugIn directory also had
a CMakeLists.txt used by GTK for its port. The definitions in DumpRenderTree's
CMake are moved into the TestNetscapePlugIn CMake to provide a common definition
for all ports that ENABLE_NETSCAPE_PLUGIN_API.

DumpRenderTree/CMakeLists.txt:
DumpRenderTree/PlatformWin.cmake:
DumpRenderTree/TestNetscapePlugIn/CMakeLists.txt:
DumpRenderTree/TestNetscapePlugIn/PlatformGTK.cmake: Added.
DumpRenderTree/TestNetscapePlugIn/PlatformWin.cmake: Added.
DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugIn.def: Renamed from Tools/DumpRenderTree/win/TestNetscapePlugin.def.
DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugIn.rc: Renamed from Tools/DumpRenderTree/win/TestNetscapePlugin.rc.
DumpRenderTree/TestNetscapePlugIn/win/resource.h: Renamed from Tools/DumpRenderTree/win/resource.h.

11:01 AM Changeset in webkit [260340] by emilio

8 edits in trunk

Don't use the inherited custom properties to store environment variables.
https://bugs.webkit.org/show_bug.cgi?id=210707

Reviewed by Antti Koivisto.

LayoutTests/imported/w3c:

Annotate the progressions.

web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:
web-platform-tests/css/cssom/getComputedStyle-logical-enumeration-expected.txt:

Source/WebCore:

It leaks this implementation detail when enumerating the computed style.

Tests: imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml.xhtml

imported/w3c/web-platform-tests/css/cssom/getComputedStyle-logical-enumeration.html

css/CSSVariableReferenceValue.cpp:

(WebCore::resolveVariableReference):
(WebCore::resolveTokenRange):

style/StyleResolveForDocument.cpp:

(WebCore::Style::resolveForDocument):

LayoutTests:

platform/ios/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:

10:56 AM Changeset in webkit [260339] by emilio

2 edits in trunk/Tools

Allow to override sccache server port.
https://bugs.webkit.org/show_bug.cgi?id=210722

Reviewed by Philippe Normand.

This is useful so that sccache can work both inside and outside the sandbox,
without getting confused about flatpak's chroot.

flatpak/flatpakutils.py:

(WebkitFlatpak.run_in_sandbox):

10:51 AM Changeset in webkit [260338] by Antti Koivisto

28 edits
2 adds
8 deletes in trunk

[CSS selectors] :is() / :where() should not allow pseudo-elements at parse-time
https://bugs.webkit.org/show_bug.cgi?id=210701

Reviewed by Anders Carlsson.

Source/WebCore:

https://drafts.csswg.org/selectors/#matches:

"Pseudo-elements cannot be represented by the matches-any pseudo-class; they are not valid within :is()."

Test: fast/selectors/pseudo-element-in-is-where.html

css/parser/CSSSelectorParser.cpp:

(WebCore::CSSSelectorParser::consumePseudo):

LayoutTests:

Remove or update tests for pseudo elements inside :is()/:where().
Also add some :where() rountrip coverage.

fast/css/css-selector-text-expected.txt:
fast/css/css-selector-text.html:
fast/css/css-set-selector-text-expected.txt:
fast/css/css-set-selector-text.html:
fast/css/is-specificity-6-expected.html: Removed.
fast/css/is-specificity-6.html: Removed.
fast/css/matches-specificity-6-expected.html: Removed.
fast/css/matches-specificity-6.html: Removed.
fast/css/parsing-css-allowed-string-characters-expected.txt:
fast/css/parsing-css-is-1-expected.txt:
fast/css/parsing-css-is-1.html:
fast/css/parsing-css-is-2-expected.txt:
fast/css/parsing-css-is-2.html:
fast/css/parsing-css-is-3-expected.txt:
fast/css/parsing-css-is-3.html:
fast/css/parsing-css-is-4-expected.txt:
fast/css/parsing-css-is-4.html:
fast/css/parsing-css-matches-1-expected.txt:
fast/css/parsing-css-matches-1.html:
fast/css/parsing-css-matches-2-expected.txt:
fast/css/parsing-css-matches-2.html:
fast/css/parsing-css-matches-3-expected.txt:
fast/css/parsing-css-matches-3.html:
fast/css/parsing-css-matches-4-expected.txt:
fast/css/parsing-css-matches-4.html:
fast/selectors/pseudo-element-in-is-where-expected.html: Added.
fast/selectors/pseudo-element-in-is-where.html: Added.
fast/selectors/pseudo-element-inside-is-expected.html: Removed.
fast/selectors/pseudo-element-inside-is.html: Removed.
fast/selectors/pseudo-element-inside-matches-expected.html: Removed.
fast/selectors/pseudo-element-inside-matches.html: Removed.
fast/selectors/querySelector-is-expected.txt:
fast/selectors/querySelector-is.html:
fast/selectors/querySelector-matches-expected.txt:
fast/selectors/querySelector-matches.html:

10:49 AM Changeset in webkit [260337] by Alan Bujtas

4 edits in trunk/Source/WebCore

[LFC][TFC] Take border spacing into account when distributing column spanners width.
https://bugs.webkit.org/show_bug.cgi?id=210712

Reviewed by Antti Koivisto.

While distributing the column spanner extra space among individual columns,
the spacing between these columns (set by border-spacing) should be taken into
account and subtract it from the width to distribute.

<table style="border-spacing: 50px"><tr><td colspan=2>long long text</td></tr><tr><td>lo</td><td>xt</td><tr></table>
[long long text]
[lo] [xt]
The individual columns don't require any extra space from the spanner.

layout/FormattingContext.h:

(WebCore::Layout::FormattingContext::IntrinsicWidthConstraints::operator+=):
(WebCore::Layout::FormattingContext::IntrinsicWidthConstraints::operator-=):

layout/tableformatting/TableFormattingContext.cpp:

(WebCore::Layout::TableFormattingContext::computedIntrinsicWidthConstraints):
(WebCore::Layout::TableFormattingContext::computedPreferredWidthForColumns):
(WebCore::Layout::TableFormattingContext::computeAndDistributeExtraHorizontalSpace):

layout/tableformatting/TableGrid.h:

(WebCore::Layout::TableGrid::horizontalSpacing const):
(WebCore::Layout::TableGrid::totalHorizontalSpacing const): Deleted.

10:24 AM Changeset in webkit [260336] by Darin Adler

2 edits in trunk/Tools

REGRESSION (r260334): SpacebarScrolling.cpp (test in TestWebKitAPI) fails to compile because it includes an Objective-C header
https://bugs.webkit.org/show_bug.cgi?id=210723

Reviewed by Brady Eidson.

TestWebKitAPI/Tests/WebKit/SpacebarScrolling.cpp: Instead of including

WKPreferencesPrivate.h, an Objective-C header, include WKPreferencesRefPrivate.h,
the header with the functions this test is trying to use.

6:46 AM Changeset in webkit [260335] by emilio

5 edits
2 adds in trunk

Fix the logic to decide whether a property is enumerated in a computed style declaration.
https://bugs.webkit.org/show_bug.cgi?id=210695

Reviewed by Antti Koivisto.

LayoutTests/imported/w3c:

Import the test from
https://github.com/web-platform-tests/wpt/pull/23088. One subtest is
failing, separate bug.

web-platform-tests/css/cssom/getComputedStyle-logical-enumeration-expected.txt: Added.
web-platform-tests/css/cssom/getComputedStyle-logical-enumeration.html: Added.

Source/WebCore:

Fix the logic to decide whether a property is enumerated in a computed
style declaration.

Logical properties don't need stylebuilder code, but still should be
generated. Using the specification->category for this seems a bit
hacky, but unclear if it's worse than adding a new flag.

Tests: fast/css/getComputedStyle/computed-style-enumeration.html

imported/w3c/web-platform-tests/css/cssom/getComputedStyle-logical-enumeration.html

css/makeprop.pl:

(skippedFromComputedStyle):
(isLogical):
(sortWithPrefixedPropertiesLast):

Apr 18, 2020:

9:41 PM Changeset in webkit [260334] by Darin Adler

58 edits in trunk

Update header postprocessing version cutoff to keep Apple internal builds working
https://bugs.webkit.org/show_bug.cgi?id=210708

Reviewed by Brady Eidson.

Source/WebKit:

Configurations/WebKit.xcconfig: Update versions to make building with older

Apple internal SDKs continue to work.

Shared/API/Cocoa/WKFoundation.h:
Shared/API/Cocoa/_WKFrameHandle.h:
Shared/API/Cocoa/_WKRemoteObjectInterface.h:
UIProcess/API/Cocoa/WKContentWorld.h:
UIProcess/API/Cocoa/WKFindConfiguration.h:
UIProcess/API/Cocoa/WKFindResult.h:
UIProcess/API/Cocoa/WKFrameInfoPrivate.h:
UIProcess/API/Cocoa/WKHTTPCookieStorePrivate.h:
UIProcess/API/Cocoa/WKNavigationDelegatePrivate.h:
UIProcess/API/Cocoa/WKPDFConfiguration.h:
UIProcess/API/Cocoa/WKPreferences.h:
UIProcess/API/Cocoa/WKPreferencesPrivate.h:
UIProcess/API/Cocoa/WKProcessPoolPrivate.h:
UIProcess/API/Cocoa/WKUIDelegatePrivate.h:
UIProcess/API/Cocoa/WKURLSchemeTaskPrivate.h:
UIProcess/API/Cocoa/WKUserScriptPrivate.h:
UIProcess/API/Cocoa/WKWebView.h:
UIProcess/API/Cocoa/WKWebViewConfiguration.h:
UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h:
UIProcess/API/Cocoa/WKWebViewPrivate.h:
UIProcess/API/Cocoa/WKWebpagePreferences.h:
UIProcess/API/Cocoa/WKWebpagePreferencesPrivate.h:
UIProcess/API/Cocoa/WKWebsiteDataRecordPrivate.h:
UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:
UIProcess/API/Cocoa/_WKDownload.h:
UIProcess/API/Cocoa/_WKFrameTreeNode.h:
UIProcess/API/Cocoa/_WKInputDelegate.h:
UIProcess/API/Cocoa/_WKInspectorDebuggableInfo.h:
UIProcess/API/Cocoa/_WKProcessPoolConfiguration.h:
UIProcess/API/Cocoa/_WKRemoteWebInspectorViewController.h:
UIProcess/API/Cocoa/_WKResourceLoadDelegate.h:
UIProcess/API/Cocoa/_WKResourceLoadInfo.h:
UIProcess/API/Cocoa/_WKResourceLoadStatisticsFirstParty.h:
UIProcess/API/Cocoa/_WKResourceLoadStatisticsThirdParty.h:
UIProcess/API/Cocoa/_WKTextManipulationConfiguration.h:
UIProcess/API/Cocoa/_WKTextManipulationExclusionRule.h:
UIProcess/API/Cocoa/_WKTextManipulationItem.h:
UIProcess/API/Cocoa/_WKTextManipulationToken.h:
UIProcess/API/Cocoa/_WKUserContentWorld.h:
UIProcess/API/Cocoa/_WKUserStyleSheet.h:
UIProcess/API/Cocoa/_WKWebAuthenticationAssertionResponse.h:
UIProcess/API/Cocoa/_WKWebAuthenticationPanel.h:
UIProcess/API/Cocoa/_WKWebsiteDataStoreConfiguration.h:
UIProcess/API/Cocoa/_WKWebsitePolicies.h:

Because the way we do post-processing of headers in the legacy Xcode
build system won't work once the files have been processed once, touch
each file that has WK_MAC_TBA, WK_IOS_TBA, or
WK_FRAMEWORK_HEADER_POSTPROCESSING_ENABLED in it. Found something to
change in each file. This is likely unnecessary in the new Xcode build
system, but I wasn't able to test that locally.

WebKit.xcodeproj/project.pbxproj:

(postprocess-header-rule): Added dependencies so that post-processing will be
redone if Configurations/WebKit.xcconfig is touched, since that is where
WK_FRAMEWORK_HEADER_POSTPROCESSING_DISABLED is set, or if
Scripts/postprocess-header-rule is touched, since that is where the
post-processing code is. If either of those files changes it could affect the
output of post-processing. This should make a change like this work in the
new Xcode build system without touching files as is done above.

Tools:

DumpRenderTree/ios/TextInputControllerIOS.m:
DumpRenderTree/mac/DumpRenderTreeDraggingInfo.mm:
DumpRenderTree/mac/EditingDelegate.mm:
DumpRenderTree/mac/EventSendingController.h:
DumpRenderTree/mac/EventSendingController.mm:
DumpRenderTree/mac/FrameLoadDelegate.mm:
DumpRenderTree/mac/ObjCPlugin.m:
DumpRenderTree/mac/PixelDumpSupportMac.mm:
DumpRenderTree/mac/ResourceLoadDelegate.mm:
DumpRenderTree/mac/UIScriptControllerMac.mm:

Removed includes of <WebKit/WebKit.h>, the header for modern WebKit, from the files
here that are intending to use WebKitLegacy. This is harmless, except for if someone
builds DumpRenderTree *before* building WebKit as I just did.

8:43 PM Changeset in webkit [260333] by keith_miller@apple.com

6 edits in trunk/Source/JavaScriptCore

Fix CLoop build for iterator opcodes
https://bugs.webkit.org/show_bug.cgi?id=210709

Reviewed by Robin Morisset.

We need to add a default paramater for the metadata pointer
in the CLoop build. Additionally, the helper declarations need
to be in the various slow path header files. Lastly we need
opcode labels for our new JS call return points.

bytecode/BytecodeList.rb:
llint/LLIntSlowPaths.cpp:
llint/LLIntSlowPaths.h:
runtime/CommonSlowPaths.h:

8:07 PM Changeset in webkit [260332] by keith_miller@apple.com

2 edits in trunk/JSTests

Unreviewed, mark test passing.

test262/expectations.yaml:

7:20 PM Changeset in webkit [260331] by rmorisset@apple.com

107 edits
1 copy in trunk

Support an inlined representation in JSValue of small BigInts ("BigInt32")
https://bugs.webkit.org/show_bug.cgi?id=206182

Reviewed by Yusuke Suzuki.

JSTests:

I improved several of the tests to give more informative error messages in the process of fixing them.

More interestingly I had to modify "missing-exception-check-in-string-compare" because it relied on "s1 == s1" resolving ropes, and we now just return true.

stress/big-int-division.js:

(testDiv):

stress/big-int-left-shift-wrapped-value.js:

(assert.sameValue):

stress/big-int-logical-not.js:

(assert):

stress/big-int-mod-jit.js:
stress/big-int-right-shift-general.js:

(testRightShift):

stress/big-int-type-of-proven-type.js:

(assert):

stress/compare-strict-eq-on-various-types.js:

(testAllTypesCall):

stress/ftl-string-strict-equality.js:
stress/missing-exception-check-in-string-compare.js:

Source/JavaScriptCore:

This patch attempts to optimize the performance of BigInts, when they are small (32 bit or less).
It works by inlining them into JSValue on 64-bit platforms, avoiding the allocation of a JSBigInt.
The bit pattern we use is 0000:XXXX:XXXX:0012
This representation works because of the following things:

It cannot be confused with a Double or Integer thanks to the top bits
It cannot be confused with a pointer to a Cell, thanks to bit 1 which is set to true
It cannot be confused with a pointer to wasm thanks to bit 0 which is set to false
It cannot be confused with true/false because bit 2 is set to false
It cannot be confused for null/undefined because bit 4 is set to true

This entire change is gated by USE(BIGINT32), to make it easier to disable if it turns out to have bugs.
It should also make it much easier to verify if a given bug comes from it or from something else.

Note that in this patch we create BigInt32s when parsing small BigInt constants, and most operations (e.g. Add or BitOr) produce a BigInt32 if both of their operands are BigInt32,
but we don't produce a BigInt32 from for example the substraction/division of two large heap-allocated JSBigInts, even if the result fits in 32-bits.
As a result, small BigInts can now either be heap-allocated or inlined in the JSValue.

This patch includes a significant refactor of various slow paths, which are now grouped together in Operations.h
Because this increased the size of Operations.h significantly, I split the parts of Operations.h which are only used by the GC into Scribble.h, to avoid bloating compile times.

In the DFG and FTL we now have 3 UseKinds for BigInts: HeapBigIntUse, BigInt32Use and AnyBigIntUse.
The latter is useful when we know that we are receiving BigInts, but speculation indicates a mix of heap-allocated and small (inlined) big-ints.

Unfortunately, a naive implementation of this patch significantly regresses the performance of StrictEq (and its variants), as it is no longer true that a cell and a non-cell cannot be equal.
Before this patch, the code was jumping to a slow path if either:

at least one operand is a double
or both operands are cells

Now, it also needs to jump to the slow path if at least one is a cell.
To recover this performance cost, I significantly rewrote this code, from

if (left is Cell && right is Cell) {

if (left == right)

return true;

goto slowPath;

}
if (! left is Int32) {

if (left is Number)

goto slowPath

}
if (! right is Int32) {

if (right is Number)

goto slowPath

}
return left == right

To the following:

if (left is Double

right is Double)

goto slowPath

if (left == right)

return true;

if (left is Cell

right is Cell)

goto slowPath

return false;

I believe this to be faster than just replacing (left is Cell && right is Cell) by an

, because I found a bit-trick to check (left is Double

right is Double) which should help reduce the pressure on the branch predictor.

Early JetStream2 tests appear to confirm that this patch is roughly neutral while it was a 0.5% regression before I used this trick, but the numbers are still too noisy, I plan to do more measurements before landing this patch.

I don't yet have performance numbers for this patch on a BigInt benchmark, I will get such numbers before trying to land it, but I'd like some review in the meantime.

JavaScriptCore.xcodeproj/project.pbxproj:
assembler/X86Assembler.h:

(JSC::X86Assembler::X86InstructionFormatter::SingleInstructionBufferWriter::memoryModRM):

bytecode/ArithProfile.cpp:

(JSC::ArithProfile<BitfieldType>::emitObserveResult):
(JSC::ArithProfile<BitfieldType>::shouldEmitSetBigInt32 const):
(JSC::ArithProfile<BitfieldType>::shouldEmitSetHeapBigInt const):
(JSC::ArithProfile<BitfieldType>::emitSetHeapBigInt const):
(JSC::ArithProfile<BitfieldType>::emitSetBigInt32 const):
(WTF::printInternal):

bytecode/ArithProfile.h:

(JSC::ObservedResults::didObserveNonInt32):
(JSC::ObservedResults::didObserveBigInt):
(JSC::ObservedResults::didObserveHeapBigInt):
(JSC::ObservedResults::didObserveBigInt32):
(JSC::ArithProfile::didObserveHeapBigInt const):
(JSC::ArithProfile::didObserveBigInt32 const):
(JSC::ArithProfile::setObservedHeapBigInt):
(JSC::ArithProfile::setObservedBigInt32):
(JSC::ArithProfile::observeResult):

bytecode/BytecodeList.rb:
bytecode/BytecodeLivenessAnalysisInlines.h:
bytecode/BytecodeUseDef.cpp:

(JSC::computeUsesForBytecodeIndexImpl):
(JSC::computeDefsForBytecodeIndexImpl):

bytecode/CodeBlock.cpp:
bytecode/DataFormat.h:
bytecode/MethodOfGettingAValueProfile.cpp:

(JSC::MethodOfGettingAValueProfile::emitReportValue const):

bytecode/MethodOfGettingAValueProfile.h:
bytecode/SpeculatedType.cpp:

(JSC::dumpSpeculation):
(JSC::speculationFromClassInfo):
(JSC::speculationFromStructure):
(JSC::speculationFromValue):
(JSC::speculationFromJSType):
(JSC::leastUpperBoundOfStrictlyEquivalentSpeculations):

bytecode/SpeculatedType.h:

(JSC::isBigInt32Speculation):
(JSC::isHeapBigIntSpeculation):
(JSC::isBigIntSpeculation):

bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitEqualityOpImpl):
(JSC::BytecodeGenerator::addBigIntConstant):

bytecompiler/BytecodeGenerator.h:
dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::isToThisAnIdentity):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupToThis):
(JSC::DFG::FixupPhase::fixupToNumeric):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
(JSC::DFG::FixupPhase::fixupCompareStrictEqAndSameValue):

dfg/DFGMayExit.cpp:
dfg/DFGNode.h:

(JSC::DFG::Node::shouldSpeculateBigInt32):
(JSC::DFG::Node::shouldSpeculateHeapBigInt):

dfg/DFGNodeType.h:
dfg/DFGOSRExit.cpp:

(JSC::DFG::OSRExit::compileExit):

dfg/DFGOSRExit.h:
dfg/DFGOperations.cpp:
dfg/DFGOperations.h:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):
(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
(JSC::DFG::SpeculativeJIT::compileValueBitNot):
(JSC::DFG::SpeculativeJIT::emitUntypedOrAnyBigIntBitOp):
(JSC::DFG::SpeculativeJIT::compileValueBitwiseOp):
(JSC::DFG::SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp):
(JSC::DFG::SpeculativeJIT::compileValueLShiftOp):
(JSC::DFG::SpeculativeJIT::compileValueBitRShift):
(JSC::DFG::SpeculativeJIT::compileShiftOp):
(JSC::DFG::SpeculativeJIT::compileValueAdd):
(JSC::DFG::SpeculativeJIT::compileValueSub):
(JSC::DFG::SpeculativeJIT::compileIncOrDec):
(JSC::DFG::SpeculativeJIT::compileValueNegate):
(JSC::DFG::SpeculativeJIT::compileValueMul):
(JSC::DFG::SpeculativeJIT::compileValueDiv):
(JSC::DFG::SpeculativeJIT::compileValueMod):
(JSC::DFG::SpeculativeJIT::compileValuePow):
(JSC::DFG::SpeculativeJIT::compare):
(JSC::DFG::SpeculativeJIT::compileStrictEq):
(JSC::DFG::SpeculativeJIT::speculateHeapBigInt):
(JSC::DFG::SpeculativeJIT::speculate):
(JSC::DFG::SpeculativeJIT::compileToNumeric):
(JSC::DFG::SpeculativeJIT::compileHeapBigIntEquality):

dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculateBigInt32Operand::SpeculateBigInt32Operand):
(JSC::DFG::SpeculateBigInt32Operand::~SpeculateBigInt32Operand):
(JSC::DFG::SpeculateBigInt32Operand::edge const):
(JSC::DFG::SpeculateBigInt32Operand::node const):
(JSC::DFG::SpeculateBigInt32Operand::gpr):
(JSC::DFG::SpeculateBigInt32Operand::use):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::speculateBigInt32):
(JSC::DFG::SpeculativeJIT::speculateAnyBigInt):
(JSC::DFG::SpeculativeJIT::fillSpeculateBigInt32):
(JSC::DFG::SpeculativeJIT::compileBigInt32Compare):
(JSC::DFG::SpeculativeJIT::compilePeepHoleBigInt32Branch):
(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

dfg/DFGUseKind.cpp:

(WTF::printInternal):

dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):
(JSC::DFG::isCell):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLCommonValues.cpp:

(JSC::FTL::CommonValues::initializeConstants):

ftl/FTLCommonValues.h:
ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileValueAdd):
(JSC::FTL::DFG::LowerDFGToB3::compileValueSub):
(JSC::FTL::DFG::LowerDFGToB3::compileValueMul):
(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileValueDiv):
(JSC::FTL::DFG::LowerDFGToB3::compileValueMod):
(JSC::FTL::DFG::LowerDFGToB3::compileValuePow):
(JSC::FTL::DFG::LowerDFGToB3::compileValueBitNot):
(JSC::FTL::DFG::LowerDFGToB3::compileValueBitAnd):
(JSC::FTL::DFG::LowerDFGToB3::compileValueBitOr):
(JSC::FTL::DFG::LowerDFGToB3::compileValueBitXor):
(JSC::FTL::DFG::LowerDFGToB3::compileValueBitRShift):
(JSC::FTL::DFG::LowerDFGToB3::compileArithBitRShift):
(JSC::FTL::DFG::LowerDFGToB3::compileArithBitLShift):
(JSC::FTL::DFG::LowerDFGToB3::compileValueBitLShift):
(JSC::FTL::DFG::LowerDFGToB3::compileBitURShift):
(JSC::FTL::DFG::LowerDFGToB3::compileToNumeric):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareEq):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
(JSC::FTL::DFG::LowerDFGToB3::compileIsBigInt):
(JSC::FTL::DFG::LowerDFGToB3::emitBinarySnippet):
(JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet):
(JSC::FTL::DFG::LowerDFGToB3::boolify):
(JSC::FTL::DFG::LowerDFGToB3::buildTypeOf):
(JSC::FTL::DFG::LowerDFGToB3::lowHeapBigInt):
(JSC::FTL::DFG::LowerDFGToB3::lowBigInt32):
(JSC::FTL::DFG::LowerDFGToB3::isBigInt32):
(JSC::FTL::DFG::LowerDFGToB3::isNotBigInt32):
(JSC::FTL::DFG::LowerDFGToB3::unboxBigInt32):
(JSC::FTL::DFG::LowerDFGToB3::boxBigInt32):
(JSC::FTL::DFG::LowerDFGToB3::isNotAnyBigInt):
(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::isNotHeapBigIntUnknownWhetherCell):
(JSC::FTL::DFG::LowerDFGToB3::isNotHeapBigInt):
(JSC::FTL::DFG::LowerDFGToB3::isHeapBigInt):
(JSC::FTL::DFG::LowerDFGToB3::speculateHeapBigInt):
(JSC::FTL::DFG::LowerDFGToB3::speculateHeapBigIntUnknownWhetherCell):
(JSC::FTL::DFG::LowerDFGToB3::speculateBigInt32):
(JSC::FTL::DFG::LowerDFGToB3::speculateAnyBigInt):

ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

heap/HeapSnapshotBuilder.cpp:

(JSC::HeapSnapshotBuilder::json):

heap/MarkedBlockInlines.h:
heap/PreciseAllocation.cpp:
inspector/agents/InspectorHeapAgent.cpp:

(Inspector::InspectorHeapAgent::getPreview):

interpreter/Interpreter.cpp:

(JSC::sizeOfVarargs):

jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::emitConvertValueToBoolean):
(JSC::AssemblyHelpers::branchIfValue):

jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::branchIfBigInt32):
(JSC::AssemblyHelpers::branchIfBigInt32KnownNotNumber):
(JSC::AssemblyHelpers::branchIfNotBigInt32KnownNotNumber):
(JSC::AssemblyHelpers::branchIfHeapBigInt):
(JSC::AssemblyHelpers::branchIfNotHeapBigInt):
(JSC::AssemblyHelpers::unboxBigInt32):
(JSC::AssemblyHelpers::boxBigInt32):
(JSC::AssemblyHelpers::emitTypeOf):

jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

jit/JIT.h:
jit/JITArithmetic.cpp:

(JSC::JIT::emit_op_negate):
(JSC::JIT::emitSlow_op_negate):

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_is_big_int):
(JSC::JIT::compileOpStrictEq):
(JSC::JIT::compileOpStrictEqJump):
(JSC::JIT::emit_op_to_numeric):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_is_big_int):
(JSC::JIT::emit_op_to_numeric):

jit/JITOperations.cpp:
jit/JITOperations.h:
llint/LLIntOfflineAsmConfig.h:
llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter64.asm:
parser/ParserArena.cpp:

(JSC::IdentifierArena::makeBigIntDecimalIdentifier):

runtime/ArrayPrototype.cpp:
runtime/BigIntConstructor.cpp:

(JSC::toBigInt):
(JSC::callBigIntConstructor):

runtime/BigIntObject.cpp:

(JSC::BigIntObject::create):
(JSC::BigIntObject::finishCreation):

runtime/BigIntObject.h:
runtime/BigIntPrototype.cpp:

(JSC::toThisBigIntValue):
(JSC::bigIntProtoFuncToStringImpl):

runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):
(JSC::updateArithProfileForUnaryArithOp):
(JSC::updateArithProfileForBinaryArithOp):

runtime/JSBigInt.cpp:

(JSC::JSBigInt::createStructure):
(JSC::JSBigInt::parseInt):
(JSC::JSBigInt::stringToBigInt):
(JSC::JSBigInt::inc):
(JSC::JSBigInt::dec):
(JSC::JSBigInt::bitwiseAnd):
(JSC::JSBigInt::toStringGeneric):
(JSC::JSBigInt::equalsToNumber):
(JSC::JSBigInt::equalsToInt32):

runtime/JSBigInt.h:

(JSC::asHeapBigInt):

runtime/JSCJSValue.cpp:

(JSC::JSValue::toNumberSlowCase const):
(JSC::JSValue::toObjectSlowCase const):
(JSC::JSValue::toThisSlowCase const):
(JSC::JSValue::synthesizePrototype const):
(JSC::JSValue::dumpInContextAssumingStructure const):
(JSC::JSValue::dumpForBacktrace const):
(JSC::JSValue::toStringSlowCase const):

runtime/JSCJSValue.h:
runtime/JSCJSValueInlines.h:

(JSC::JSValue::JSValue):
(JSC::JSValue::asHeapBigInt const):
(JSC::JSValue::isBigInt const):
(JSC::JSValue::isHeapBigInt const):
(JSC::JSValue::isBigInt32 const):
(JSC::JSValue::bigInt32AsInt32 const):
(JSC::JSValue::isPrimitive const):
(JSC::JSValue::getPrimitiveNumber):
(JSC::JSValue::toNumeric const):
(JSC::JSValue::toBigIntOrInt32 const):
(JSC::JSValue::equalSlowCaseInline):
(JSC::JSValue::strictEqualForCells):
(JSC::JSValue::strictEqual):
(JSC::JSValue::pureStrictEqual):
(JSC::JSValue::pureToBoolean const):

runtime/JSCell.cpp:

(JSC::JSCell::put):
(JSC::JSCell::putByIndex):
(JSC::JSCell::toPrimitive const):
(JSC::JSCell::getPrimitiveNumber const):
(JSC::JSCell::toNumber const):
(JSC::JSCell::toObjectSlow const):

runtime/JSCell.h:
runtime/JSCellInlines.h:

(JSC::JSCell::isHeapBigInt const):
(JSC::JSCell::toBoolean const):
(JSC::JSCell::pureToBoolean const):

runtime/JSString.h:

(JSC::JSValue::toBoolean const):

runtime/JSType.cpp:

(WTF::printInternal):

runtime/JSType.h:
runtime/JSTypeInfo.h:
runtime/ObjectInitializationScope.cpp:
runtime/Operations.cpp:

(JSC::jsAddSlowCase):
(JSC::jsIsObjectTypeOrNull):

runtime/Operations.h:

(JSC::compareBigIntToOtherPrimitive):
(JSC::bigIntCompare):
(JSC::jsLess):
(JSC::jsLessEq):
(JSC::arithmeticBinaryOp):
(JSC::jsSub):
(JSC::jsMul):
(JSC::jsDiv):
(JSC::jsRemainder):
(JSC::jsPow):
(JSC::jsInc):
(JSC::jsDec):
(JSC::jsBitwiseNot):
(JSC::shift):
(JSC::jsLShift):
(JSC::jsRShift):
(JSC::bitwiseBinaryOp):
(JSC::jsBitwiseAnd):
(JSC::jsBitwiseOr):
(JSC::jsBitwiseXor):

runtime/Scribble.h: Copied from Source/JavaScriptCore/runtime/BigIntObject.h.

(JSC::scribbleFreeCells):
(JSC::isScribbledValue):
(JSC::scribble):

runtime/StructureInlines.h:

(JSC::prototypeForLookupPrimitiveImpl):

Source/WTF:

Add a USE(BIGINT32) flag.

wtf/PlatformUse.h:

7:08 PM Changeset in webkit [260330] by beidson@apple.com

7 edits in trunk

Fix WebUserContentControllerProxy vs ContentWorld lifetime
https://bugs.webkit.org/show_bug.cgi?id=210700

Reviewed by Alex Christensen.

Source/WebKit:

Covered by API test.

WebUserContentControllerProxy currently keeps all of its associated API::ContentWorlds alive via RefPtrs.

This is despite the fact that all of the associated WebScriptMessageHandlers, UserScripts, and
UserStyleSheets already keep their associated API::ContentWorlds alive.

It then decideds to tell WebProcesses to forget a content world after all of its clients are removed.

Unfortunately, content worlds are used for more than just content controller stuff. They're used for direct
JavaScript evaluation as well.

So a client could:

Add a script message handler in a content world.
Evaluate JavaScript in that content world, setting up some persistent state.
Remove the script message handler.
Find that their persistent state from the JavaScript evaluation is gone from that world, even though they still retain a usable handle to that world.

The only party who has any business managing the lifetime of an API::ContentWorld is the API::ContentWorld itself.

Making this change is:

1 - Nice cleanup
2 - Fixes the above mentioned bug

UIProcess/API/APIContentWorld.cpp:

(API::ContentWorld::worldForIdentifier):
(API::ContentWorld::ContentWorld):
(API::ContentWorld::sharedWorldWithName):
(API::ContentWorld::~ContentWorld):
(API::ContentWorld::addAssociatedUserContentControllerProxy):
(API::ContentWorld::userContentControllerProxyDestroyed):

UIProcess/API/APIContentWorld.h:

UIProcess/UserContent/WebUserContentControllerProxy.cpp:

(WebKit::WebUserContentControllerProxy::parameters const):
(WebKit::WebUserContentControllerProxy::addContentWorld):
(WebKit::WebUserContentControllerProxy::contentWorldDestroyed):
(WebKit::WebUserContentControllerProxy::addUserScript):
(WebKit::WebUserContentControllerProxy::removeUserScript):
(WebKit::WebUserContentControllerProxy::removeAllUserScripts):
(WebKit::WebUserContentControllerProxy::addUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeAllUserStyleSheets):
(WebKit::WebUserContentControllerProxy::addUserScriptMessageHandler):
(WebKit::WebUserContentControllerProxy::removeUserMessageHandlerForName):
(WebKit::WebUserContentControllerProxy::removeAllUserMessageHandlers):
(WebKit::WebUserContentControllerProxy::addContentWorldUse): Deleted.
(WebKit::WebUserContentControllerProxy::shouldSendRemoveContentWorldsMessage): Deleted.
(WebKit::WebUserContentControllerProxy::removeContentWorldUses): Deleted.

UIProcess/UserContent/WebUserContentControllerProxy.h:

Tools:

TestWebKitAPI/Tests/WebKitCocoa/WKWebViewEvaluateJavaScript.mm:

(-[DummyMessageHandler userContentController:didReceiveScriptMessage:]):
(TEST): Make sure removing a script message handler from a particular world

doesn't also destroy the other JavaScript contents of that world.

4:32 PM Changeset in webkit [260329] by achristensen@apple.com

5 edits in branches/safari-609-branch/Source/JavaScriptCore

Branch build fix after r260286
https://bugs.webkit.org/show_bug.cgi?id=210583
<rdar://problem/61943707>

The branch used ensureStillAliveHere but did not have the rename of that function in r258825,
so this effectively merges that revision, too, to make the branch and trunk more similar.

No change in behavior, just rename to successfully compile.

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayIndexOf):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCodePointAt):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):

4:23 PM Changeset in webkit [260328] by ddkilzer@apple.com

2 edits in trunk/Source/WebKit

Attempt #4 to fix tvOS build

Unreviewed.

WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::platformInitializeWebProcess):

Add #if ENABLE(VIDEO_PRESENTATION_MODE)/#endif to protect function defined in WebCore/PictureInPictureSupport.h.
See previous build fixes in r260307, r260308 and r260313.

4:20 PM Changeset in webkit [260327] by dbates@webkit.org

2 edits in trunk/Tools

Add some more tests for -focusTextInputContext:placeCaretAt:completionHandler:
https://bugs.webkit.org/show_bug.cgi?id=210624

Reviewed by Simon Fraser.

Test behavior when the target element is already focused, when the target element
is programmatically replaced, and focusing the target element after the page was
navigated away.

Also while I am here, fix up the test FocusFieldAndPlaceCaretOutsideField to
use the size of the exampleText constant - 1 instead of hardcoding this value.
This will future proof this test should the example text string literal change.

TestWebKitAPI/Tests/WebKitCocoa/RequestTextInputContext.mm:

(TEST):

4:17 PM Changeset in webkit [260326] by dbates@webkit.org

1 edit
2 adds in trunk/LayoutTests

Add a test to ensure WebKit::mayContainEditableElementsInRect() returns true if the document element is editable
https://bugs.webkit.org/show_bug.cgi?id=210560

Reviewed by Simon Fraser.

If the document element is marked editable then all child elements are editable.
Add a test to ensure that WebKit::mayContainEditableElementsInRect() returns true
for such a page.

editing/editable-region/hit-test-editable-document-element-expected.txt: Added.
editing/editable-region/hit-test-editable-document-element.html: Added.

4:02 PM Changeset in webkit [260325] by keith_miller@apple.com

3 edits in trunk/Source/JavaScriptCore

Unreviewed, remove commented out/dead code that didn't failed to
get removed when landing r260323.

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

runtime/CommonSlowPaths.cpp:

(JSC::iterator_next_try_fast):

2:52 PM Changeset in webkit [260324] by fpizlo@apple.com

3 edits in trunk/Websites/webkit.org

Unreviewed, check in some more files for a blog post.

blog-files/speculation-in-jsc/osr-exit-implicit-control-flow.graffle:
blog-files/speculation-in-jsc/osr-exit-implicit-control-flow.svg:

2:45 PM Changeset in webkit [260323] by keith_miller@apple.com

83 edits
1 copy
13 adds in trunk

Redesign how we do for-of iteration for JSArrays
https://bugs.webkit.org/show_bug.cgi?id=175454

JSTests:

Reviewed by Filip Pizlo.

microbenchmarks/for-of-iterate-array-entries.js:

(foo):

stress/custom-iterators.js:

(catch):
(iter.return):
(iteratorInterfaceErrorTest):
(iteratorInterfaceErrorTestReturn):
(iteratorInterfaceBreakTestReturn):

stress/for-of-array-different-globals.js: Added.

(foo):
(array.Symbol.iterator.proto.next):

stress/for-of-array-mixed-values.js: Added.

(test):

stress/for-of-no-direct-loop-back-edge-osr.js: Added.

(osrIfFinalTier):
(test):

stress/generator-containing-for-of-on-map.js: Added.

(find):
(i.let.v.of.find):

stress/generator-containing-for-of-on-set.js: Added.

(find):
(set add):

stress/osr-from-for-of-done-getter.js: Added.

(i.let.iterable.next.return.get done):
(i.let.iterable.next):
(i.let.iterable.Symbol.iterator):
(i.let.iterable.return):

stress/osr-from-for-of-value-getter.js: Added.

(i.let.iterable.next.return.get value):
(i.let.iterable.next):
(i.let.iterable.Symbol.iterator):
(i.let.iterable.return):

stress/throw-for-of-next-returns-non-object.js: Added.

(i.let.iterable.next):
(i.let.iterable.Symbol.iterator):
(i.let.iterable.return):
(i.catch):

stress/throw-from-done-getter-in-for-of-header.js: Added.

(i.let.iterable.next):
(i.let.iterable.get done):
(i.let.iterable.Symbol.iterator):
(i.let.iterable.return):
(i.catch):

stress/throw-from-next-in-for-of-header.js: Added.

(i.let.iterable.next):
(i.let.iterable.Symbol.iterator):
(i.let.iterable.return):
(i.catch):

stress/throw-from-value-getter-in-for-of-header.js: Added.

(i.let.iterable.next):
(i.let.iterable.get value):
(i.let.iterable.Symbol.iterator):
(i.let.iterable.return):
(i.catch):

stress/webidl-tokenizer-for-of.js: Added.

(tokenise.attemptTokenMatch):
(tokenise):
(Tokeniser):
(Tokeniser.prototype.probe):
(Tokeniser.prototype.consume):
(Tokeniser.prototype.unconsume):

Source/JavaScriptCore:

Reviewed by Filip Pizlo and Saam Barati.

This patch intrinsics for-of iteration for JSArrays when they are
being iterated with the built-in Symbol.iterator. We do this by
adding two new bytecodes op_iterator_open and
op_iterator_next. These bytecodes are essentially a fused set of
existing bytecodes with a special case for our intrinsiced JSArray
case. This patch only adds support for these instructions on
64-bit.

The op_iterator_open bytecode is semantically the same as:
iterator = symbolIterator.@call(iterable);
next = iterator.next;

where iterable is the rhs of the for-of and symbolIterator is the
result of running iterable.symbolIterator;

The op_iterator_next bytecode is semantically the same as:
nextResult = next.@call(iterator);
done = nextResult.done;
value = done ? (undefined / bottom) : nextResult.value;

where nextResult is a temporary (the value VirtualRegister in the
LLInt/Baseline and a tmp in the DFG).

In order to make sure these bytecodes have the same perfomance as
the existing bytecode sequence, we need to make sure we have the
same profiling data and inline caching. Most of the existing
get_by_id code assumed a particular bytecode member name was the
same in each flavor get_by_id access. This patch adds template
specialized functions that vend the correct
Profile/VirtualRegister for the current bytecode/checkpoint. This
means we can have meaningful names for our Bytecode structs and
still use the generic functions.

In the LLInt most of the logic for calls/get_by_id had to be
factored into helper macros, so we could have bytecodes that are
some combination of those.

The trickiest part of this patch was getting the hand rolled DFG
IR to work correctly. This is because we don't have a great way to
express large chucks of DFG graph that doesn't involve manually
tracking all the DFG's invariants. Such as:

1) Flushing/Phantoming values at the end of each block.
2) Rolling forwards and backwards the BytecodeIndex when switching

blocks.

3) Remembering to GetLocal each variable at the top of every block.
4) Ensuring that the JSValue stored to the op_iterator_next.m_value

local does not cause us to OSR exit at the set local.

(4) is handled by a new function, bottomValueMatchingSpeculation,
on DFGGraph that produces a FrozenValue that is roughly the bottom
for a given speculated type. In a future patch we should make this
more complete, probably by adding a VM::bottomCellForSetLocal that
prediction propagation and AI know how treat as a true bottom
value. See: https://bugs.webkit.org/show_bug.cgi?id=210694

Lastly, this patch changes the DFG NodeType, CheckCell to be
CheckIsConstant. CheckIsConstant is equivalent to the == operator
on JSValue where it just checks the register values are the
same. In order to keep the same perf that we had for CheckCell,
CheckIsConstant supports CellUse.

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::or8):
(JSC::MacroAssemblerARM64::store8):

assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::or8):

bytecode/ArrayProfile.h:

(JSC::ArrayProfile::observeStructureID):
(JSC::ArrayProfile::observeStructure):

bytecode/BytecodeList.rb:
bytecode/BytecodeLivenessAnalysis.cpp:

(JSC::tmpLivenessForCheckpoint):

bytecode/BytecodeOperandsForCheckpoint.h: Added.

(JSC::arrayProfileForImpl):
(JSC::hasArrayProfileFor):
(JSC::arrayProfileFor):
(JSC::valueProfileForImpl):
(JSC::hasValueProfileFor):
(JSC::valueProfileFor):
(JSC::destinationFor):
(JSC::calleeFor):
(JSC::argumentCountIncludingThisFor):
(JSC::stackOffsetInRegistersForCall):
(JSC::callLinkInfoFor):

bytecode/BytecodeUseDef.cpp:

(JSC::computeUsesForBytecodeIndexImpl):
(JSC::computeDefsForBytecodeIndexImpl):

bytecode/CallLinkInfo.cpp:

(JSC::CallLinkInfo::callTypeFor):

bytecode/CallLinkStatus.cpp:

(JSC::CallLinkStatus::computeFromLLInt):

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::finalizeLLIntInlineCaches):
(JSC::CodeBlock::tryGetValueProfileForBytecodeIndex):

bytecode/CodeBlock.h:

(JSC::CodeBlock::instructionAt const):

bytecode/CodeBlockInlines.h:

(JSC::CodeBlock::forEachValueProfile):
(JSC::CodeBlock::forEachArrayProfile):

bytecode/GetByStatus.cpp:

(JSC::GetByStatus::computeFromLLInt):

bytecode/Instruction.h:

(JSC::BaseInstruction::width const):
(JSC::BaseInstruction::hasCheckpoints const):
(JSC::BaseInstruction::asKnownWidth const):
(JSC::BaseInstruction::wide16 const):
(JSC::BaseInstruction::wide32 const):

bytecode/InstructionStream.h:
bytecode/IterationModeMetadata.h: Copied from Source/JavaScriptCore/bytecode/SuperSampler.h.
bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp:

(JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::fireInternal):
(JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::clearLLIntGetByIdCache):

bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h:
bytecode/Opcode.h:
bytecode/SpeculatedType.h:

(JSC::isSubtypeSpeculation):
(JSC::speculationContains):

bytecode/SuperSampler.h:

(JSC::SuperSamplerScope::release):

bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitGenericEnumeration):
(JSC::BytecodeGenerator::emitEnumeration):
(JSC::BytecodeGenerator::emitIsEmpty):
(JSC::BytecodeGenerator::emitIteratorOpen):
(JSC::BytecodeGenerator::emitIteratorNext):
(JSC::BytecodeGenerator::emitGetGenericIterator):
(JSC::BytecodeGenerator::emitIteratorGenericNext):
(JSC::BytecodeGenerator::emitIteratorGenericNextWithValue):
(JSC::BytecodeGenerator::emitIteratorGenericClose):
(JSC::BytecodeGenerator::emitGetAsyncIterator):
(JSC::BytecodeGenerator::emitDelegateYield):
(JSC::BytecodeGenerator::emitIteratorNextWithValue): Deleted.
(JSC::BytecodeGenerator::emitIteratorClose): Deleted.
(JSC::BytecodeGenerator::emitGetIterator): Deleted.

bytecompiler/BytecodeGenerator.h:
bytecompiler/NodesCodegen.cpp:

(JSC::ArrayPatternNode::bindValue const):

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):

dfg/DFGAtTailAbstractState.h:

(JSC::DFG::AtTailAbstractState::size const):
(JSC::DFG::AtTailAbstractState::numberOfTmps const):
(JSC::DFG::AtTailAbstractState::atIndex):
(JSC::DFG::AtTailAbstractState::tmp):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::progressToNextCheckpoint):
(JSC::DFG::ByteCodeParser::get):
(JSC::DFG::ByteCodeParser::set):
(JSC::DFG::ByteCodeParser::jsConstant):
(JSC::DFG::ByteCodeParser::weakJSConstant):
(JSC::DFG::ByteCodeParser::addCall):
(JSC::DFG::ByteCodeParser::allocateUntargetableBlock):
(JSC::DFG::ByteCodeParser::handleCall):
(JSC::DFG::ByteCodeParser::emitFunctionChecks):
(JSC::DFG::ByteCodeParser::inlineCall):
(JSC::DFG::ByteCodeParser::handleCallVariant):
(JSC::DFG::ByteCodeParser::handleVarargsInlining):
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::handleMinMax):
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
(JSC::DFG::ByteCodeParser::handleDOMJITCall):
(JSC::DFG::ByteCodeParser::handleIntrinsicGetter):
(JSC::DFG::ByteCodeParser::handleDOMJITGetter):
(JSC::DFG::ByteCodeParser::handleModuleNamespaceLoad):
(JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):
(JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
(JSC::DFG::ByteCodeParser::handlePutByVal):
(JSC::DFG::ByteCodeParser::handleCreateInternalFieldObject):
(JSC::DFG::ByteCodeParser::parse):

dfg/DFGCFGSimplificationPhase.cpp:

(JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
(JSC::DFG::CFGSimplificationPhase::jettisonBlock):
(JSC::DFG::CFGSimplificationPhase::mergeBlocks):

dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::addStringReplacePrimordialChecks):

dfg/DFGForAllKills.h:

(JSC::DFG::forAllKilledOperands):

dfg/DFGGraph.cpp:

(JSC::DFG::Graph::bottomValueMatchingSpeculation):

dfg/DFGGraph.h:
dfg/DFGInPlaceAbstractState.cpp:

(JSC::DFG::InPlaceAbstractState::beginBasicBlock):
(JSC::DFG::InPlaceAbstractState::initialize):
(JSC::DFG::InPlaceAbstractState::endBasicBlock):
(JSC::DFG::InPlaceAbstractState::merge):

dfg/DFGInPlaceAbstractState.h:

(JSC::DFG::InPlaceAbstractState::size const):
(JSC::DFG::InPlaceAbstractState::numberOfTmps const):
(JSC::DFG::InPlaceAbstractState::atIndex):
(JSC::DFG::InPlaceAbstractState::operand):
(JSC::DFG::InPlaceAbstractState::local):
(JSC::DFG::InPlaceAbstractState::argument):
(JSC::DFG::InPlaceAbstractState::variableAt): Deleted.

dfg/DFGLazyJSValue.h:

(JSC::DFG::LazyJSValue::speculatedType const):

dfg/DFGNode.h:

(JSC::DFG::Node::hasConstant):
(JSC::DFG::Node::hasCellOperand):

dfg/DFGNodeType.h:
dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::callerReturnPC):

dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCheckIsConstant):
(JSC::DFG::SpeculativeJIT::compileCheckCell): Deleted.

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGValidate.cpp:
ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckIsConstant):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckCell): Deleted.

generator/DSL.rb:
generator/Metadata.rb:
generator/Section.rb:
jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):

jit/JIT.h:
jit/JITCall.cpp:

(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileOpCall):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):

jit/JITCall32_64.cpp:

(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):

jit/JITInlines.h:

(JSC::JIT::updateTopCallFrame):
(JSC::JIT::advanceToNextCheckpoint):
(JSC::JIT::emitJumpSlowToHotForCheckpoint):
(JSC::JIT::emitValueProfilingSite):

jit/JITOperations.cpp:
jit/JITOperations.h:
llint/LLIntSlowPaths.cpp:

(JSC::LLInt::setupGetByIdPrototypeCache):
(JSC::LLInt::performLLIntGetByID):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::genericCall):
(JSC::LLInt::handleIteratorOpenCheckpoint):
(JSC::LLInt::handleIteratorNextCheckpoint):
(JSC::LLInt::slow_path_checkpoint_osr_exit):
(JSC::LLInt::llint_dump_value):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
offlineasm/transform.rb:
runtime/CommonSlowPaths.cpp:

(JSC::iterator_open_try_fast):
(JSC::iterator_open_try_fast_narrow):
(JSC::iterator_open_try_fast_wide16):
(JSC::iterator_open_try_fast_wide32):
(JSC::iterator_next_try_fast):
(JSC::iterator_next_try_fast_narrow):
(JSC::iterator_next_try_fast_wide16):
(JSC::iterator_next_try_fast_wide32):

runtime/CommonSlowPaths.h:
runtime/Intrinsic.cpp:

(JSC::interationKindForIntrinsic):

runtime/Intrinsic.h:
runtime/JSArrayIterator.h:
runtime/JSCJSValue.h:
runtime/JSCJSValueInlines.h:

(JSC::JSValue::isCallable const):

runtime/JSCast.h:
runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::arrayProtoValuesFunctionConcurrently const):

runtime/OptionsList.h:
runtime/Structure.cpp:

(JSC::Structure::dumpBrief const):

Source/WTF:

Reviewed by Filip Pizlo.

wtf/EnumClassOperatorOverloads.h:

2:39 PM Changeset in webkit [260322] by commit-queue@webkit.org

5 edits in trunk

Fix client certificate authentication when using non-default WKWebsiteDataStores
https://bugs.webkit.org/show_bug.cgi?id=210681

Patch by Alex Christensen <achristensen@webkit.org> on 2020-04-18
Reviewed by Brady Eidson.

Source/WebKit:

NetworkProcessProxy was trying to keep a map of WebsiteDataStores, but it wasn't as accurate as the one WebsiteDataStore was maintaining.
Use the latter map instead and client certificate authentication works. Otherwise, the credential isn't serialized correctly.
I found this while working on <rdar://problem/60340449> but this was unrelated so I put it in a different change.
This may fix <rdar://problem/60910392>.

UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::websiteDataStoreFromSessionID):

Tools:

TestWebKitAPI/Tests/WebKitCocoa/Challenge.mm:

(TestWebKitAPI::TEST):

2:13 PM Changeset in webkit [260321] by ysuzuki@apple.com

25 edits in trunk/Source/JavaScriptCore

[JSC] Replace DFG NewPromise with NewInternalFieldObject
https://bugs.webkit.org/show_bug.cgi?id=210687

Reviewed by Saam Barati.

The feature of DFG::NewPromise can be implemented completely with DFG::NewInternalFieldObject. This reduces code duplication, and furthermore,
this offers Object Allocation Sinking support for free. This patch replaces DFG::NewPromise with DFG::NewInternalFieldObject and remove DFG::NewPromise
completely.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGClobbersExitState.cpp:

(JSC::DFG::clobbersExitState):

dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNode.h:

(JSC::DFG::Node::convertToNewInternalFieldObject):
(JSC::DFG::Node::convertToNewInternalFieldObjectWithInlineFields):
(JSC::DFG::Node::hasIsInternalPromise):
(JSC::DFG::Node::hasStructure):
(JSC::DFG::Node::convertToNewPromise): Deleted.

dfg/DFGNodeType.h:
dfg/DFGObjectAllocationSinkingPhase.cpp:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewInternalFieldObject):
(JSC::DFG::SpeculativeJIT::compileNewPromise): Deleted.

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGStoreBarrierInsertionPhase.cpp:
ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileNewInternalFieldObject):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewInternalFieldObject):
(JSC::FTL::DFG::LowerDFGToB3::compileNewPromise): Deleted.

ftl/FTLOperations.cpp:

(JSC::FTL::operationPopulateObjectInOSR):
(JSC::FTL::operationMaterializeObjectInOSR):

runtime/JSInternalPromise.cpp:

(JSC::JSInternalPromise::createWithInitialValues):

runtime/JSInternalPromise.h:
runtime/JSPromise.cpp:

(JSC::JSPromise::createWithInitialValues):
(JSC::JSPromise::finishCreation):
(JSC::JSPromise::status const):
(JSC::JSPromise::result const):
(JSC::JSPromise::flags const):
(JSC::JSPromise::resolve):
(JSC::JSPromise::reject):
(JSC::JSPromise::rejectAsHandled):

runtime/JSPromise.h:

(JSC::JSPromise::initialValues):
(JSC::JSPromise::internalField const):
(JSC::JSPromise::internalField):

2:08 PM Changeset in webkit [260320] by fpizlo@apple.com

1 edit
2 adds in trunk/Websites/webkit.org

Unreviewed, check in some more files for a blog post.

blog-files/speculation-in-jsc/osr-exit-implicit-control-flow.graffle: Added.
blog-files/speculation-in-jsc/osr-exit-implicit-control-flow.svg: Added.

1:24 PM Changeset in webkit [260319] by Antti Koivisto

10 edits
2 adds in trunk

[CSS selectors] Support :where() pseudo class
https://bugs.webkit.org/show_bug.cgi?id=210690

Reviewed by Sam Weinig.

LayoutTests/imported/w3c:

web-platform-tests/css/selectors/invalidation/where-expected.txt:

Source/WebCore:

"The Specificity-adjustment pseudo-class, :where(), is a functional pseudo-class with the same
syntax and functionality as :is(). Unlike :is(), neither the :where pseudo-class, nor any of
its arguments contribute to the specificity of the selector—its specificity is always zero.

This is useful for introducing filters in a selector while keeping the associated style
declarations easy to override."

https://drafts.csswg.org/selectors-4/#zero-matches

In terms of implementation this is just another alias for :is() with different (always 0) specificity.

Test: fast/selectors/where-specificity.html

css/CSSSelector.cpp:

(WebCore::simpleSelectorSpecificityInternal):

Here is where it differs from PseudoClassIs.

(WebCore::CSSSelector::selectorText const):

css/CSSSelector.h:
css/SelectorChecker.cpp:

(WebCore::SelectorChecker::checkOne const):

css/SelectorPseudoClassAndCompatibilityElementMap.in:
css/parser/CSSSelectorParser.cpp:

(WebCore::isOnlyPseudoClassFunction):
(WebCore::CSSSelectorParser::consumePseudo):

cssjit/SelectorCompiler.cpp:

(WebCore::SelectorCompiler::addPseudoClassType):

LayoutTests:

fast/selectors/where-specificity-expected.html: Added.
fast/selectors/where-specificity.html: Added.

10:17 AM Changeset in webkit [260318] by Pablo Saavedra

2 edits in trunk/Source/WebKit

[GTK][WPE] Replace evil strtok() calls with fscanf() in MemoryPressureMonitor.cpp
https://bugs.webkit.org/show_bug.cgi?id=210346

Reviewed by Adrian Perez de Castro.

UIProcess/linux/MemoryPressureMonitor.cpp:

(WebKit::lowWatermarkPages):
(WebKit::getCgroupControllerPath):
(WebKit::systemMemoryUsedAsPercentage):
(WebKit::CGroupMemoryController::getCgroupFileValue):

10:04 AM Changeset in webkit [260317] by commit-queue@webkit.org

24 edits in trunk/Source

Reduce parameter list of the FrameLoadRequest constructor
https://bugs.webkit.org/show_bug.cgi?id=210668

Patch by Rob Buis <rbuis@igalia.com> on 2020-04-18
Reviewed by Darin Adler.

Source/WebCore:

Reduce parameter list of the FrameLoadRequest constructor by
instead using various setters. By choosing the most common
defaults the actual number of setters to call are minimized.

inspector/InspectorFrontendClientLocal.cpp:

(WebCore::InspectorFrontendClientLocal::openInNewTab):

inspector/agents/InspectorPageAgent.cpp:

(WebCore::InspectorPageAgent::navigate):

loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::handleProvisionalLoadFailureFromContentFilter):

loader/FrameLoadRequest.cpp:

(WebCore::FrameLoadRequest::FrameLoadRequest):

loader/FrameLoadRequest.h:

(WebCore::FrameLoadRequest::FrameLoadRequest):
(WebCore::FrameLoadRequest::disableShouldReplaceDocumentIfJavaScriptURL):

loader/FrameLoader.cpp:

(WebCore::FrameLoader::changeLocation):
(WebCore::FrameLoader::loadURLIntoChildFrame):

loader/NavigationScheduler.cpp:

(WebCore::NavigationScheduler::scheduleLocationChange):

page/ContextMenuController.cpp:

(WebCore::openNewWindow):
(WebCore::ContextMenuController::contextMenuItemSelected):

page/DOMWindow.cpp:

(WebCore::DOMWindow::createWindow):

page/DragController.cpp:

(WebCore::DragController::performDragOperation):

Source/WebKit:

Adapt to API change.

WebProcess/Inspector/WebInspector.cpp:

(WebKit::WebInspector::openInNewTab):

WebProcess/Plugins/PluginView.cpp:

(WebKit::PluginView::performFrameLoadURLRequest):
(WebKit::PluginView::loadURL):

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::loadURLInFrame):
(WebKit::WebPage::loadDataInFrame):
(WebKit::WebPage::loadRequest):
(WebKit::WebPage::loadDataImpl):

Source/WebKitLegacy/ios:

Adapt to API change.

WebView/WebPDFViewPlaceholder.mm:

(-[WebPDFViewPlaceholder simulateClickOnLinkToURL:]):

Source/WebKitLegacy/mac:

Adapt to API change.

Plugins/WebPluginController.mm:

(-[WebPluginController webPlugInContainerLoadRequest:inFrame:]):

WebView/WebFrame.mm:

(-[WebFrame loadRequest:]):
(-[WebFrame _loadData:MIMEType:textEncodingName:baseURL:unreachableURL:]):

WebView/WebPDFView.mm:

(-[WebPDFView PDFViewWillClickOnLink:withURL:]):

Source/WebKitLegacy/win:

Adapt to API change.

Plugins/PluginView.cpp:

(WebCore::PluginView::start):
(WebCore::PluginView::performRequest):
(WebCore::PluginView::getURLNotify):
(WebCore::PluginView::getURL):
(WebCore::PluginView::handlePost):

WebFrame.cpp:

(WebFrame::loadRequest):
(WebFrame::loadData):

9:35 AM Changeset in webkit [260316] by ddkilzer@apple.com

5 edits in trunk/Source/WebKit

[IPC hardening] Use MESSAGE_CHECK in WebPasteboardProxy
<https://webkit.org/b/210684>
<rdar://problem/59906721>

Reviewed by Wenson Hsieh.

UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:
Add missing #undef of MESSAGE_CHECK_COMPLETION and MESSAGE_CHECK_WITH_RETURN_VALUE.

(WebKit::WebPasteboardProxy::getPasteboardPathnamesForType):
(WebKit::WebPasteboardProxy::getPasteboardStringForType):
(WebKit::WebPasteboardProxy::getPasteboardStringsForType):
(WebKit::WebPasteboardProxy::getPasteboardBufferForType):
(WebKit::WebPasteboardProxy::setPasteboardStringForType):
(WebKit::WebPasteboardProxy::setPasteboardBufferForType):
(WebKit::WebPasteboardProxy::typesSafeForDOMToReadAndWrite):
(WebKit::WebPasteboardProxy::readStringFromPasteboard):
(WebKit::WebPasteboardProxy::readBufferFromPasteboard):

Replace existing code with MESSAGE_CHECK_COMPLETION macros.

UIProcess/WebPasteboardProxy.cpp:

(WebKit::WebPasteboardProxy::typesSafeForDOMToReadAndWrite):

UIProcess/WebPasteboardProxy.h:
UIProcess/WebPasteboardProxy.messages.in:
Add IPC::Connection to TypesSafeForDOMToReadAndWrite.

9:33 AM Changeset in webkit [260315] by ddkilzer@apple.com

2 edits in trunk/Source/WebKitLegacy/mac

-[WebPreferences initWithCoder:] should use -[NSCoder decodeValueOfObjCType:at:size:]
<https://webkit.org/b/210621>
<rdar://problem/61906458>

Reviewed by Anders Carlsson.

WebView/WebPreferences.mm:

(-[WebPreferences initWithCoder:]):

Switch to -[NSCoder decodeValueOfObjCType:at:size:].

9:25 AM Changeset in webkit [260314] by ysuzuki@apple.com

2 edits in trunk/Source/JavaScriptCore

Unreviewed, build fix for ARM64E after r260310
https://bugs.webkit.org/show_bug.cgi?id=207330

r260310 uses undefined function Instruction.cloneWithNewOperands in arm64e.rb and throws an error.
This patch calls node.cloneWithNewOperands.

offlineasm/arm64e.rb:

9:01 AM Changeset in webkit [260313] by ddkilzer@apple.com

2 edits in trunk/Source/WebCore

Attempt #3 to fix tvOS build

Unreviewed.

platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer):
(WebCore::MediaPlayerPrivateAVFoundationObjC::updateDisableExternalPlayback):

Use !PLATFORM(APPLETV) to comment out functions declared within ENABLE(VIDEO_PRESENTATION_MODE) from r260307 and r260308.

9:01 AM Changeset in webkit [260312] by Alexey Shvayka

9 edits
1 add in trunk

RegExp.prototype[@@search] should use SameValue
https://bugs.webkit.org/show_bug.cgi?id=173226

Reviewed by Yusuke Suzuki.

JSTests:

stress/same-value-intrinsic.js: Added.
test262/expectations.yaml: Mark 4 test cases as passing.

Source/JavaScriptCore:

This change exposes Object.is implementation as link-time-constant @sameValue and utilizes
it in RegExp.prototype[@@search] per spec [1], aligning JSC with V8 and SpiderMonkey.

[1]: https://tc39.es/ecma262/#sec-regexp.prototype-@@search (steps 5, 8)

builtins/BuiltinNames.h:
builtins/RegExpPrototype.js:

(Symbol.search):

bytecode/LinkTimeConstant.h:
runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

runtime/ObjectConstructor.cpp:
runtime/ObjectConstructor.h:

8:57 AM Changeset in webkit [260311] by ysuzuki@apple.com

12 edits
1 move in trunk/Source

[WTF] Move DataRef.h from WebCore to WTF to utilize it in JSC
https://bugs.webkit.org/show_bug.cgi?id=210689

Reviewed by Anders Carlsson.

Source/WebCore:

No behavior change, just moving header from WebCore to WTF.

Headers.cmake:
WebCore.xcodeproj/project.pbxproj:
rendering/style/NinePieceImage.h:
rendering/style/RenderStyle.h:
rendering/style/SVGRenderStyle.h:
rendering/style/StyleRareInheritedData.cpp:
rendering/style/StyleRareInheritedData.h:
rendering/style/StyleRareNonInheritedData.h:

Source/WTF:

WTF.xcodeproj/project.pbxproj:
wtf/CMakeLists.txt:
wtf/DataRef.h: Renamed from Source/WebCore/rendering/style/DataRef.h.

7:59 AM Changeset in webkit [260310] by commit-queue@webkit.org

5 edits in trunk/Source/JavaScriptCore

Fix code origin when lowering offlineasm instructions on MIPS/ARM64E
https://bugs.webkit.org/show_bug.cgi?id=207330

Patch by Angelos Oikonomopoulos <Angelos Oikonomopoulos> on 2020-04-18
Reviewed by Mark Lam.

Instruction operands are mapped to RegisterID in RegisterID.forName
and the operation is memoized. Therefore, we can't use the codeOrigin
of the operand at that point. Use the codeOrigin of the original
instruction instead.

offlineasm/arm64e.rb:
offlineasm/ast.rb:
offlineasm/mips.rb:
offlineasm/risc.rb:

7:19 AM Changeset in webkit [260309] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

REGRESSION(r260246): It broke build on MIPS32
https://bugs.webkit.org/show_bug.cgi?id=210665

Patch by Angelos Oikonomopoulos <Angelos Oikonomopoulos> on 2020-04-18
Reviewed by Aakash Jain.

The mnemonic for 'store halfword' is 'sh', not 'shv'. This appears to
be a typo in a path that was never exercised.

Exposed by r260246; riscLowerMisplacedAddresses now calls into
riscAsRegisters with an 'h' suffix, which results in a 'storeh'
instruction. The storeh is then lowered to the non-existent 'shv'.

offlineasm/mips.rb:

4:58 AM Changeset in webkit [260308] by ddkilzer@apple.com

2 edits in trunk/Source/WebCore

Attempt #2 to fix tvOS build

Unreviewed.

platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
Add #if ENABLE(VIDEO_PRESENTATION_MODE)/#endif to protect methods defined in MediaPlayerPrivate.h.
The previous commit was (r260307) also to fix tvOS, not watchOS.

12:15 AM Changeset in webkit [260307] by ddkilzer@apple.com

2 edits in trunk/Source/WebCore

Attempt to fix watchOS build

Unreviewed.

platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
Add #if ENABLE(VIDEO_PRESENTATION_MODE)/#endif to protect methods defined in MediaPlayerPrivate.h.

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed