Context Navigation

← Previous Period
Next Period →

Timeline

May 30, 2020:

10:54 PM Changeset in webkit [262355] by mark.lam@apple.com

6 edits in trunk/Source

Rename Signal::BadAccess to Signal::AccessFault.
https://bugs.webkit.org/show_bug.cgi?id=212577

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

runtime/VMTraps.cpp:
wasm/WasmFaultSignalHandler.cpp:

(JSC::Wasm::enableFastMemory):

Source/WTF:

This is needed because GTK port's X11 has a #define for BadAccess (in include/X11/X.h):

#define BadAccess 10 /* depending on context:

key/button already grabbed
attempt to free an illegal cmap entry
attempt to store into a read-only color map entry.
attempt to modify the access control list from other than the local host. */

As a result, this would break the GTK build when wtf/Signals.h is #include'd.

wtf/threads/Signals.cpp:

(WTF::fromMachException):
(WTF::toMachMask):
(WTF::jscSignalHandler):

wtf/threads/Signals.h:

(WTF::toSystemSignal):
(WTF::fromSystemSignal):

8:20 PM Changeset in webkit [262354] by ysuzuki@apple.com

7 edits
5 adds in trunk

[JSC] for-in should allocate new temporary register for base
https://bugs.webkit.org/show_bug.cgi?id=212519
<rdar://problem/63722044>

Reviewed by Saam Barati.

JSTests:

microbenchmarks/has-own-property-for-in-loop-with-heap-variable.js: Added.

(assert):
(test1.count):
(test1):

microbenchmarks/has-own-property-for-in-loop-with-this.js: Added.

(assert):
(test1.count):
(test1):

stress/for-in-body-replace-enumerable.js: Added.

(foo):

stress/for-in-enumerable-shadow.js: Added.

(assert):
(test1.count):
(test1):

stress/for-in-enumerable-this-arrow.js: Added.

(assert):
(test1):

Source/JavaScriptCore:

While r262233 keeps for-in's enumerated object in variable register if possible to use this register for heuristics driving an optimization,
for-in body can replace the content of this register during enumeration and confuse enumerator.

Instead, we record Variable information in StructureForInContext. This allows us to detect patterns using heap-variables too.
Further, this patch extends pattern-matching code to support ThisNode too.

bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::pushStructureForInScope):

bytecompiler/BytecodeGenerator.h:

(JSC::Variable::Variable):
(JSC::Variable::isResolved const):
(JSC::Variable::symbolTableConstantIndex const):
(JSC::Variable::ident const):
(JSC::Variable::offset const):
(JSC::Variable::isLocal const):
(JSC::Variable::local const):
(JSC::Variable::isReadOnly const):
(JSC::Variable::isSpecial const):
(JSC::Variable::isConst const):
(JSC::Variable::setIsReadOnly):
(JSC::Variable::operator== const):
(JSC::StructureForInContext::StructureForInContext):
(JSC::StructureForInContext::baseVariable const):
(JSC::StructureForInContext::base const): Deleted.

bytecompiler/NodesCodegen.cpp:

(JSC::HasOwnPropertyFunctionCallDotNode::emitBytecode):
(JSC::ForInNode::emitBytecode):

parser/ASTBuilder.h:

(JSC::ASTBuilder::makeFunctionCallNode):

parser/Nodes.h:

(JSC::ExpressionNode::isThisNode const):

8:01 PM Changeset in webkit [262353] by ysuzuki@apple.com

2 edits in trunk/Source/JavaScriptCore

Unreviewed, fix JSC debug tests' exception checking
https://bugs.webkit.org/show_bug.cgi?id=212512

runtime/JSBigInt.cpp:

(JSC::JSBigInt::createWithLength):
(JSC::JSBigInt::allocateFor):

3:25 PM Changeset in webkit [262352] by weinig@apple.com

18 edits in trunk

Extended Color: Additional color cleanups
https://bugs.webkit.org/show_bug.cgi?id=212567

Reviewed by Simon Fraser.

Source/WebCore:

A few unrelated quality-of-life cleanups to Color and related classes:

Rename Color::asSimpleColor() to Color::asSimple() for parity with Color::asExtended().
Move SimpleColor implementations of invertedColorWithAlpha() and asSRGBFloatComponents() to SimpleColor for parity with ExtenedColor.
Rename ExtendedColor::channels() to ExtendedColor::components() to consistency.
Adds operator[] to ColorComponents to allow direct access to components rather than requiring and additional .components[]
Using std::minmax() where possible.
Renaming colorFloatToSimpleColorByte to scaleRoundAndClampColorChannel to have a consistent naming and location of conversion to 8-bit color channels.

platform/graphics/Color.cpp:

(WebCore::Color::serialized const):
(WebCore::Color::cssText const):
(WebCore::Color::nameForRenderTreeAsText const):
(WebCore::Color::light const):
(WebCore::Color::dark const):
(WebCore::Color::colorWithAlpha const):
(WebCore::Color::colorWithAlphaUsingAlternativeRounding const):
(WebCore::Color::invertedColorWithAlpha const):
(WebCore::Color::colorSpaceAndComponents const):
(WebCore::Color::toSRGBASimpleColorLossy const):
(WebCore::Color::toSRGBAComponentsLossy const):

platform/graphics/Color.h:

(WebCore::Color::isOpaque const):
(WebCore::Color::isVisible const):
(WebCore::Color::alpha const):
(WebCore::Color::alphaAsFloat const):
(WebCore::Color::asSimple const):
(WebCore::Color::isBlackColor):
(WebCore::Color::isWhiteColor):
(WebCore::Color::encode const):
(WebCore::Color::asSimpleColor const): Deleted.

platform/graphics/ColorComponents.h:

(WebCore::ColorComponents::operator[]):
(WebCore::ColorComponents::operator[] const):
(WebCore::=):
(WebCore::perComponentMax):
(WebCore::perComponentMin):

platform/graphics/ColorMatrix.h:

(WebCore::Rows>::transformedColorComponents const):

platform/graphics/ColorUtilities.cpp:

(WebCore::areEssentiallyEqual):
(WebCore::rgbToLinearComponents):
(WebCore::linearToRGBComponents):
(WebCore::lightness):
(WebCore::luminance):
(WebCore::sRGBToHSL):
(WebCore::hslToSRGB):

platform/graphics/ColorUtilities.h:

(WebCore::scaleRoundAndClampColorChannel):
(WebCore::scaleRoundAndClampColorChannelUsingAlternativeRounding):
(WebCore::colorFloatToSimpleColorByte): Deleted.

platform/graphics/ExtendedColor.cpp:

(WebCore::ExtendedColor::hash const):
(WebCore::ExtendedColor::cssText const):
(WebCore::ExtendedColor::colorWithAlpha const):
(WebCore::ExtendedColor::invertedColorWithAlpha const):
(WebCore::ExtendedColor::toSRGBAComponentsLossy const):
(WebCore::ExtendedColor::isWhite const):
(WebCore::ExtendedColor::isBlack const):

platform/graphics/ExtendedColor.h:

(WebCore::ExtendedColor::alpha const):
(WebCore::ExtendedColor::components const):
(WebCore::ExtendedColor::ExtendedColor):
(WebCore::operator==):
(WebCore::ExtendedColor::channels const): Deleted.

platform/graphics/SimpleColor.cpp:

(WebCore::makeSimpleColorFromFloats):
(WebCore::makeSimpleColorFromHSLA):

platform/graphics/SimpleColor.h:

(WebCore::SimpleColor::SimpleColor):
(WebCore::SimpleColor::valueAsARGB const):
(WebCore::SimpleColor::colorWithAlpha const):
(WebCore::SimpleColor::invertedColorWithAlpha const):
(WebCore::SimpleColor::asSRGBFloatComponents const):
(WebCore::makeSimpleColor):

platform/graphics/cg/ColorCG.cpp:

(WebCore::cachedCGColor):

platform/graphics/filters/FELighting.cpp:

(WebCore::FELighting::drawLighting):

platform/graphics/filters/FETurbulence.cpp:

(WebCore::toIntBasedColorComponents):

platform/graphics/filters/FilterOperation.cpp:

(WebCore::BasicComponentTransferFilterOperation::transformColor const):
(WebCore::InvertLightnessFilterOperation::transformColor const):
(WebCore::InvertLightnessFilterOperation::inverseTransformColor const):

platform/graphics/filters/FilterOperations.cpp:

(WebCore::FilterOperations::transformColor const):
(WebCore::FilterOperations::inverseTransformColor const):

Tools:

TestWebKitAPI/Tests/WebCore/ExtendedColorTests.cpp:

(TestWebKitAPI::TEST):
Update for rename from ExtendedColor::channels() to ExtendedColor::components()

2:09 PM Changeset in webkit [262351] by mark.lam@apple.com

4 edits in trunk/Source/JavaScriptCore

AssemblyHelpers::callExceptionFuzz() is passing a wrong argument to operationExceptionFuzz().
https://bugs.webkit.org/show_bug.cgi?id=212561

Reviewed by Yusuke Suzuki.

There's 2 possible solution to this issue:

Thread the globalObject from all the way up the clients calling into callExceptionFuzz(), or
Introduce a operationExceptionFuzzWithCallFrame() wrapper take receives a VM* and CallFrame*, and use these to get the lexicalGlobalObject.

This patch applies solution 2.

Solution 1 is too unwieldy because it will cause the threading of the globalObject
argument to fan out to many clients, and almost all of those clients currently
do not need the globalObject. Hence, implementing this solution may incur some
performance penalty in normal code, for the sole benefit of this one fuzzing tool.

Secondly, the exception fuzzer doesn't really care which globalObject is used.
It only cares that an exception is thrown, and we need a globalObject in order to
throw that exception. Hence, there is no benefit to threading the globalObject
down from all the clients.

jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::callExceptionFuzz):

jit/JITOperations.cpp:
jit/JITOperations.h:

12:15 PM Changeset in webkit [262350] by commit-queue@webkit.org

23 edits
1 delete in trunk

Unreviewed, reverting r262335.
https://bugs.webkit.org/show_bug.cgi?id=212571

Triggered assertions in WebKit1

Reverted changeset:

"Disallow responses when a response contains invalid header
values"
https://bugs.webkit.org/show_bug.cgi?id=184493
https://trac.webkit.org/changeset/262335

12:14 PM Changeset in webkit [262349] by Simon Fraser

2 edits in trunk/Source/WebCore

For scroll container and scrolled contents layers, use the renderer style to set up the event regions
https://bugs.webkit.org/show_bug.cgi?id=212570

Reviewed by Antti Koivisto.

RenderLayerBacking::updateEventRegion() sets up event regions on the scroll container and scrolled contents
layer using the default style, in order to fill up the m_region part of EventRegion, but we might as well
pass the renderer style so that it fills up the touch-action and wheel event regions as well.

Also re-use the existing event region trace points for region building.

rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::updateEventRegion):

10:42 AM Changeset in webkit [262348] by aestes@apple.com

5 edits in trunk

[Apple Pay] Support percentage border-radius values in -apple-pay-button
https://bugs.webkit.org/show_bug.cgi?id=212559
<rdar://problem/63781881>

Reviewed by Antti Koivisto.

Source/WebCore:

Added test cases to fast/css/appearance-apple-pay-button-border-radius.html.

rendering/RenderThemeCocoa.mm:

(WebCore::RenderThemeCocoa::paintApplePayButton): Used floatValueForLength() to ensure
percentage lengths are resolved before passing a corner radius to PassKit.

LayoutTests:

fast/css/appearance-apple-pay-button-border-radius-expected.html:
fast/css/appearance-apple-pay-button-border-radius.html:

10:38 AM Changeset in webkit [262347] by ddkilzer@apple.com

2 edits in trunk/Source/WebCore/PAL

REGRESSION (r262332): Windows build failure because <nw/private.h> doesn't exist
<https://bugs.webkit.org/show_bug.cgi?id=212551>
<rdar://problem/62461099>

Unreviewed Windows build fix.

pal/spi/cf/CFNetworkSPI.h:
Move <nw/private.h> so it is not included with PLATFORM(WIN).
Add or clean up some macro comments.

9:29 AM Changeset in webkit [262346] by commit-queue@webkit.org

2 edits in trunk/Source/WebKit

Deprecate WKBundlePostSynchronousMessage
https://bugs.webkit.org/show_bug.cgi?id=212536

Patch by Alex Christensen <achristensen@webkit.org> on 2020-05-30
Reviewed by Anders Carlsson.

WebProcess/InjectedBundle/API/c/WKBundle.h:

5:08 AM Changeset in webkit [262345] by Diego Pino Garcia

1 edit
2 adds in trunk/LayoutTests

[GLIB] Unreviewed gardening, update baseline after r262169
https://bugs.webkit.org/show_bug.cgi?id=212566

r262169 modifies Objective-C code and the general expected file. The
change only affected Mac ports. GTK and WPE ports keep expecting the former
result, so a new baseline is emitted for these ports.

platform/glib/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/seeking/seek-to-negative-time-expected.txt: Added.

4:58 AM Changeset in webkit [262344] by Diego Pino Garcia

4 edits in trunk/LayoutTests/imported/w3c

Unreviewed gardening, update offscreen-canvas baselines after r262254
https://bugs.webkit.org/show_bug.cgi?id=212563

web-platform-tests/offscreen-canvas/image-smoothing/image.smoothing-expected.txt:
web-platform-tests/offscreen-canvas/image-smoothing/image.smoothing.worker-expected.txt:
web-platform-tests/offscreen-canvas/the-offscreen-canvas/offscreencanvas.transfer.to.imagebitmap.w-expected.txt:

12:55 AM Changeset in webkit [262343] by Carlos Garcia Campos

11 edits in trunk

[GTK] WebDriver: stop using GdkEvent API in preparation for GTK4
https://bugs.webkit.org/show_bug.cgi?id=212465

Reviewed by Adrian Perez de Castro.

Source/WebKit:

Use the new internal API to synthesize events.

UIProcess/API/gtk/WebKitWebViewBase.cpp:

(webkitWebViewBaseSynthesizeKeyEvent): Add type parameter, since WebDriver can send press and release events
separately. Also add a parameter to indicate that keyval should be translated according to current state that is
required by WebDriver.

UIProcess/API/gtk/WebKitWebViewBaseInternal.h:
UIProcess/Automation/WebAutomationSession.cpp:

(WebKit::WebAutomationSession::documentLoadedForFrame): Call resetClickCount().
(WebKit::WebAutomationSession::updateClickCount): Update the click count for the given button position and
maximum time and distance.
(WebKit::WebAutomationSession::resetClickCount): Reset the click count.

UIProcess/Automation/WebAutomationSession.h:
UIProcess/Automation/gtk/WebAutomationSessionGtk.cpp:

(WebKit::WebAutomationSession::platformSimulateMouseInteraction): Use webkitWebViewBaseSynthesizeMouseEvent().
(WebKit::WebAutomationSession::platformSimulateKeyboardInteraction): Use webkitWebViewBaseSynthesizeKeyEvent().
(WebKit::WebAutomationSession::platformSimulateKeySequence): Ditto.
(WebKit::doMouseEvent): Deleted.
(WebKit::doMotionEvent): Deleted.
(WebKit::doKeyStrokeEvent): Deleted.

UIProcess/gtk/KeyBindingTranslator.cpp: Add missing key shortcuts to predefined list.

Tools:

Update to the new webkitWebViewBaseSynthesizeKeyEvent() API.

WebKitTestRunner/gtk/EventSenderProxyGtk.cpp:

(WTR::EventSenderProxy::keyDown):

WebDriverTests:

Remove expectations for tests that are passing now.

TestExpectations.json:

12:46 AM Changeset in webkit [262342] by ysuzuki@apple.com

17 edits
1 copy in trunk

[JSC] JSBigInt allocation should be graceful for OOM
https://bugs.webkit.org/show_bug.cgi?id=212512

Reviewed by Mark Lam.

JSTests:

stress/bigint-can-throw-oom.js: Copied from JSTests/stress/get-function-realm-not-doing-recursion.js.

(canThrow):
(foo):
(get foo):

stress/get-function-realm-not-doing-recursion.js:

(canThrow):

Source/JavaScriptCore:

This patch allows JSBigInt's storage allocation to fail gracefully if OOM condition happens.
We thread JSGlobalObject* instead of VM& and throw OOM error if storage allocation failed.
We also rename JSGlobalObject* globalObject parameter to JSGlobalObject* nullOrGlobalObjectForOOM
if it can be nullptr.

jit/JITOperations.cpp:
jsc.cpp:

(functionCreateHeapBigInt):

parser/ParserArena.cpp:

(JSC::IdentifierArena::makeBigIntDecimalIdentifier):

runtime/BigIntConstructor.cpp:

(JSC::toBigInt):
(JSC::callBigIntConstructor):

runtime/BigIntPrototype.cpp:

(JSC::toThisBigIntValue):
(JSC::bigIntProtoFuncToString):
(JSC::bigIntProtoFuncToLocaleString):
(JSC::bigIntProtoFuncValueOf):

runtime/CachedTypes.cpp:

(JSC::CachedBigInt::decode const):

runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

runtime/IntlNumberFormatPrototype.cpp:

(JSC::IntlNumberFormatFuncFormat):

runtime/JSBigInt.cpp:

(JSC::JSBigInt::createZero):
(JSC::JSBigInt::tryCreateZero):
(JSC::JSBigInt::createWithLength):
(JSC::JSBigInt::tryCreateWithLength):
(JSC::JSBigInt::createFrom):
(JSC::JSBigInt::tryCreateFrom):
(JSC::JSBigInt::createFromImpl):
(JSC::JSBigInt::parseInt):
(JSC::HeapBigIntImpl::toHeapBigInt):
(JSC::Int32BigIntImpl::toHeapBigInt):
(JSC::zeroImpl):
(JSC::JSBigInt::exponentiateImpl):
(JSC::JSBigInt::multiplyImpl):
(JSC::JSBigInt::divideImpl):
(JSC::JSBigInt::copy):
(JSC::JSBigInt::unaryMinusImpl):
(JSC::JSBigInt::unaryMinus):
(JSC::JSBigInt::remainderImpl):
(JSC::JSBigInt::incImpl):
(JSC::JSBigInt::decImpl):
(JSC::JSBigInt::addImpl):
(JSC::JSBigInt::subImpl):
(JSC::JSBigInt::bitwiseAndImpl):
(JSC::JSBigInt::bitwiseOrImpl):
(JSC::JSBigInt::bitwiseXorImpl):
(JSC::JSBigInt::absoluteAdd):
(JSC::JSBigInt::absoluteSub):
(JSC::JSBigInt::absoluteDivWithDigitDivisor):
(JSC::JSBigInt::absoluteDivWithBigIntDivisor):
(JSC::JSBigInt::absoluteLeftShiftAlwaysCopy):
(JSC::JSBigInt::absoluteBitwiseOp):
(JSC::JSBigInt::absoluteAnd):
(JSC::JSBigInt::absoluteOr):
(JSC::JSBigInt::absoluteAndNot):
(JSC::JSBigInt::absoluteXor):
(JSC::JSBigInt::absoluteAddOne):
(JSC::JSBigInt::absoluteSubOne):
(JSC::JSBigInt::leftShiftByAbsolute):
(JSC::JSBigInt::rightShiftByAbsolute):
(JSC::JSBigInt::rightShiftByMaximum):
(JSC::JSBigInt::toStringBasePowerOfTwo):
(JSC::JSBigInt::toStringGeneric):
(JSC::JSBigInt::rightTrim):
(JSC::JSBigInt::tryRightTrim):
(JSC::JSBigInt::allocateFor):
(JSC::JSBigInt::asIntNImpl):
(JSC::JSBigInt::asUintNImpl):
(JSC::JSBigInt::truncateToNBits):
(JSC::JSBigInt::truncateAndSubFromPowerOfTwo):
(JSC::JSBigInt::createWithLengthUnchecked): Deleted.

runtime/JSBigInt.h:
runtime/JSCJSValue.cpp:

(JSC::JSValue::toThisSlowCase const):

runtime/VM.cpp:

(JSC::VM::VM):

Source/WebCore:

bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneDeserializer::readBigInt):

May 29, 2020:

11:59 PM Changeset in webkit [262341] by commit-queue@webkit.org

10 edits in trunk

Use correct encoding when converting a WTF::URL to CFURLRef
https://bugs.webkit.org/show_bug.cgi?id=212486

Patch by Alex Christensen <achristensen@webkit.org> on 2020-05-29
Reviewed by Darin Adler.

Source/WebKit:

Shared/API/c/cf/WKURLCF.mm:

(WKURLCopyCFURL):

Shared/cf/ArgumentCodersCF.cpp:

(IPC::decode):

Source/WTF:

wtf/cf/CFURLExtras.cpp:

(WTF::createCFURLFromBuffer):

wtf/cf/CFURLExtras.h:
wtf/cf/URLCF.cpp:

(WTF::URL::createCFURL const):

wtf/cocoa/URLCocoa.mm:

(WTF::URL::createCFURL const):

Tools:

TestWebKitAPI/Tests/WTF/cocoa/URLExtras.mm:

(TestWebKitAPI::TEST):

11:37 PM Changeset in webkit [262340] by ysuzuki@apple.com

3 edits
3 adds in trunk/JSTests

[JSC] Split some of JSC tests / reduce iteration count to make it not timed-out in Debug build
https://bugs.webkit.org/show_bug.cgi?id=212557

Reviewed by Mark Lam.

stress/should-not-emit-double-rep-for-bigint.js: Ensured that this iteration count can reproduce the original crash.
stress/tailCallForwardArguments.js: Split tests into 4 files.

(let.bodyText): Deleted.
(baz4): Deleted.
(testFunc): Deleted.
(baz5): Deleted.
(baz6): Deleted.
(arrayEq): Deleted.

stress/tailCallForwardArguments2.js: Added.

(putFuncToPrivateName.createBuiltin):
(createTailCallForwardingFuncWith):
(putFuncToPrivateName):
(let.bodyText):
(baz4):

stress/tailCallForwardArguments3.js: Added.

(putFuncToPrivateName.createBuiltin):
(createTailCallForwardingFuncWith):
(putFuncToPrivateName):
(let.bodyText):
(testFunc):
(baz5):

stress/tailCallForwardArguments4.js: Added.

(putFuncToPrivateName.createBuiltin):
(createTailCallForwardingFuncWith):
(let.bodyText):
(putFuncToPrivateName):
(baz6):
(arrayEq):

11:28 PM Changeset in webkit [262339] by commit-queue@webkit.org

11 edits in trunk/LayoutTests

Add debug alerts to xhr tests
https://bugs.webkit.org/show_bug.cgi?id=212555

Patch by Alex Christensen <achristensen@webkit.org> on 2020-05-29
Reviewed by Alexey Proskuryakov.

LayoutTests/imported/w3c:

web-platform-tests/xhr/event-error-order.sub.html:
web-platform-tests/xhr/send-authentication-basic-cors.htm:
web-platform-tests/xhr/send-network-error-async-events.sub.htm:

LayoutTests:

These should not be upstreamed, but they are needed to help diagnose what is happening in rdar://problem/63684261

platform/mac-wk1/imported/w3c/web-platform-tests/xhr/event-error-order.sub-expected.txt:
platform/mac-wk1/imported/w3c/web-platform-tests/xhr/send-authentication-basic-cors-expected.txt:
platform/mac-wk1/imported/w3c/web-platform-tests/xhr/send-network-error-async-events.sub-expected.txt:

9:39 PM Changeset in webkit [262338] by sbarati@apple.com

8 edits
1 add in trunk

We need to properly model heap ranges of Delete in DFG/B3
https://bugs.webkit.org/show_bug.cgi?id=212538
<rdar://problem/63670964>

Reviewed by Filip Pizlo.

JSTests:

stress/delete-inlining-should-model-aliasing-of-future-stores.js: Added.

Source/JavaScriptCore:

We need to properly model the aliasing dependencies of an inlined delete
operation.

We had a bug in the B3 IR we generated from code like this for a delete
followed by a property addition:
`
const o = { y: 0 };
delete o.y;
o.z = 0;
`

generated:

`
note: bb#5 dominates bb#10, bb#10 dominates bb#15

bb#5
Void b@125 = Store($-562949953421312(b@282), b@112, offset = 16, ControlDependent|Writes:129, D@30)
bb#10
Void b@171 = Store($0(b@2), b@112, offset = 16, ControlDependent|Writes:129, D@37)
bb#15
Void b@217 = Store($-562949953421312(b@282), b@112, offset = 16, ControlDependent|Writes:130, D@44)
`

Notice that "y" and "z" ended up at the same property offset.

In the above program, B3 proves the pointer we're storing to is the same value
in all three stores (b@112). However, because of how it does store forwarding,
it determined it could eliminate b@217 because b@125 already stored the same
value to the same pointer. It didn't know that b@171 was a write because its
heap range is different than @217. Generally, when using two heap ranges, it's
telling B3 that two pointers don't alias.
`
@A, Heap_H
@B, Heap_H
`
In the above program,

If @B reads H and @A writes H, then @B is dependent on @A.
If @B writes H, then @B is dependent on @A if @A reads or writes H.

So for delete, we need to model the deletion of a property as actually
writing to all named properties that may exist at that slot given a
series of structure transitions. We model this by saying the PutStructure
for an inlined delete, or MultiDeleteByOffset, writes to all named properties
(which is a superset of all named properties that may exist at that slot
through a series of transitions).

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

ftl/FTLAbstractHeap.cpp:

(JSC::FTL::IndexedAbstractHeap::dump):
(JSC::FTL::NumberedAbstractHeap::dump):
(JSC::FTL::AbsoluteAbstractHeap::dump):
(JSC::FTL::IndexedAbstractHeap::dump const): Deleted.
(JSC::FTL::NumberedAbstractHeap::dump const): Deleted.
(JSC::FTL::AbsoluteAbstractHeap::dump const): Deleted.

ftl/FTLAbstractHeap.h:

(JSC::FTL::IndexedAbstractHeap::atAnyIndex):
(JSC::FTL::NumberedAbstractHeap::atAnyNumber):
(JSC::FTL::AbsoluteAbstractHeap::atAnyAddress):
(JSC::FTL::IndexedAbstractHeap::atAnyIndex const): Deleted.
(JSC::FTL::NumberedAbstractHeap::atAnyNumber const): Deleted.
(JSC::FTL::AbsoluteAbstractHeap::atAnyAddress const): Deleted.

ftl/FTLAbstractHeapRepository.cpp:

(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):

ftl/FTLAbstractHeapRepository.h:
ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compilePutStructure):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiDeleteByOffset):

9:30 PM Changeset in webkit [262337] by Simon Fraser

4 edits
2 adds in trunk

Event region painting should use the same paint flags as normal painting
https://bugs.webkit.org/show_bug.cgi?id=212547

Reviewed by Sam Weinig.

Source/WebCore:

There are cases (see r260118) where we need to send down the correct paint flags when
painting the scrolled contents layer to avoid unwanted clipping. We need to send down
the one paint flag relevant for event region paints, CompositedOverflowScrollContent,
for the same reasons.

I could not make a testcase that shows a behavior change, but I did copy the testcase
from r260118 and adapt it for event-region generation to detect future behavior changes.

Test: fast/scrolling/mac/wheel-event-listener-region-inside-overflow-scroll-clipped-out.html

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::paintLayerContents):
(WebCore::RenderLayer::collectEventRegionForFragments):

rendering/RenderLayer.h:

LayoutTests:

fast/scrolling/mac/wheel-event-listener-region-inside-overflow-scroll-clipped-out-expected.txt: Added.
fast/scrolling/mac/wheel-event-listener-region-inside-overflow-scroll-clipped-out.html: Added.

9:30 PM Changeset in webkit [262336] by Simon Fraser

4 edits
2 adds in trunk

Elements with wheel event handlers inside overflow:scroll are missing from the event region
https://bugs.webkit.org/show_bug.cgi?id=212545

Reviewed by Zalan Bujtas.

Source/WebCore:

RenderBlock::paintObject() needs to traverse into descendants if there are are
wheel event handlers on the document, just as it does for elements with touch-action.

Test: fast/scrolling/mac/wheel-event-listener-region-inside-overflow-scroll.html

dom/Document.h:

(WebCore::Document::hasTouchEventHandlers const):
(WebCore::Document::hasWheelEventHandlers const):

rendering/RenderBlock.cpp:

(WebCore::RenderBlock::paintObject):

LayoutTests:

fast/scrolling/mac/wheel-event-listener-region-inside-overflow-scroll-expected.txt: Added.
fast/scrolling/mac/wheel-event-listener-region-inside-overflow-scroll.html: Added.

8:52 PM Changeset in webkit [262335] by commit-queue@webkit.org

23 edits
11 adds in trunk

Disallow responses when a response contains invalid header values
https://bugs.webkit.org/show_bug.cgi?id=184493

Patch by Rob Buis <rbuis@igalia.com> on 2020-05-29
Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

Update improved test results and import fetch/h1-parsing.

web-platform-tests/fetch/api/basic/header-value-combining.any-expected.txt:
web-platform-tests/fetch/api/basic/header-value-combining.any.worker-expected.txt:
web-platform-tests/fetch/api/basic/header-value-null-byte.any-expected.txt:
web-platform-tests/fetch/api/basic/header-value-null-byte.any.worker-expected.txt:
web-platform-tests/fetch/h1-parsing/resources-with-0x00-in-header.window-expected.txt: Added.
web-platform-tests/fetch/h1-parsing/resources-with-0x00-in-header.window.html: Added.
web-platform-tests/fetch/h1-parsing/resources-with-0x00-in-header.window.js: Added.

(async_test.t.t.step_timeout):

web-platform-tests/fetch/h1-parsing/resources/README.md: Added.
web-platform-tests/fetch/h1-parsing/resources/blue-with-0x00-in-a-header.asis: Added.
web-platform-tests/fetch/h1-parsing/resources/document-with-0x00-in-header.py: Added.

(main):

web-platform-tests/fetch/h1-parsing/resources/script-with-0x00-in-header.py: Added.

(main):

web-platform-tests/fetch/h1-parsing/resources/w3c-import.log: Added.
web-platform-tests/fetch/h1-parsing/w3c-import.log: Added.
web-platform-tests/xhr/headers-normalize-response-expected.txt:

Source/WebCore:

From the Fetch specification [1]:
"A value is a byte sequence that matches the following conditions:
"- Contains no 0x00 (NUL) or HTTP newline bytes."

[1] https://fetch.spec.whatwg.org/#concept-header-value

Tests: imported/w3c/web-platform-tests/fetch/h1-parsing/resources-with-0x00-in-header.window.html

imported/web-platform-tests/fetch/api/basic/header-value-combining.any.html
imported/web-platform-tests/fetch/api/basic/header-value-combining.any.worker.html
imported/web-platform-tests/fetch/api/basic/header-value-null-byte.any.html
imported/web-platform-tests/fetch/api/basic/header-value-null-byte.any.worker.html
imported/web-platform-tests/xhr/headers-normalize-response.htm

Modules/fetch/FetchHeaders.cpp:

(WebCore::canWriteHeader):
(WebCore::appendToHeaderMap):
(WebCore::FetchHeaders::filterAndFill):

loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::loadRequest):

loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::didReceiveResponse):

platform/network/ResourceResponseBase.cpp:

(WebCore::ResourceResponseBase::containsInvalidHTTPHeaders const):

platform/network/ResourceResponseBase.h:

LayoutTests:

Update improved test results.

platform/glib/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any-expected.txt:
platform/glib/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any.worker-expected.txt:
platform/ios-12/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any-expected.txt:
platform/ios-12/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any.worker-expected.txt:
platform/ios/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any-expected.txt:
platform/ios/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any.worker-expected.txt:
platform/mac-mojave/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any-expected.txt:
platform/mac-mojave/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any.worker-expected.txt:
platform/mac/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any-expected.txt:
platform/mac/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any.worker-expected.txt:

8:27 PM Changeset in webkit [262334] by Peng Liu

2 edits in trunk/Source/WebKit

Replace callOnMainThread() with callOnMainRunLoop() in AudioSessionRoutingArbitratorProxyCocoa.mm
https://bugs.webkit.org/show_bug.cgi?id=212553

Reviewed by Chris Dumez.

Use callOnMainRunLoop() instead of callOnMainThread() in the UIProcess. Also move
m_setupArbitrationOngoing flag to the end of the completion handler.

No new tests, no functional change.

UIProcess/Media/cocoa/AudioSessionRoutingArbitratorProxyCocoa.mm:

(WebKit::SharedArbitrator::beginRoutingArbitrationForArbitrator):

7:10 PM Changeset in webkit [262333] by Oriol Brufau

6 edits in trunk/LayoutTests

[css-grid] Update WPT grid-items-sizing-alignment-001.html
https://bugs.webkit.org/show_bug.cgi?id=169271

Reviewed by Manuel Rego Casasnovas.

LayoutTests/imported/w3c:

Import updated test and expectation.

web-platform-tests/css/css-grid/grid-items/grid-items-sizing-alignment-001-expected.html:
web-platform-tests/css/css-grid/grid-items/grid-items-sizing-alignment-001.html:

LayoutTests:

Expect the test to pass, except on iOS (bug 212493).

TestExpectations:
platform/ios/TestExpectations:

6:19 PM Changeset in webkit [262332] by Brent Fulgham

6 edits in trunk/Source

[Cocoa] Improve logging quality for non-ephemeral sessions
https://bugs.webkit.org/show_bug.cgi?id=212551
<rdar://problem/62461099>

Reviewed by David Kilzer.

Source/WebCore/PAL:

Add support for the 'nw_context_privacy_level' setting.

pal/spi/cf/CFNetworkSPI.h:

Source/WebKit:

In Bug 209522 I switched normal mode logging to use the same privacy-protecting mode we use for ephemeral sessions.
This had the unintended consequence of removing network load data used to investigate networking issues.

This patch adopts the more fine-grained logging provided by the low-level 'nw_context_privacy_level' setting.

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::configurationForSessionID): Adopt 'nw_context_privacy_level' setting.

Source/WTF:

wtf/PlatformHave.h: Add new feature check for CFNetwork convenience setter.

6:08 PM Changeset in webkit [262331] by aestes@apple.com

34 edits in trunk

[Apple Pay] Remove conditionals for ENABLE_APPLE_PAY_SESSION_V(3|4)
https://bugs.webkit.org/show_bug.cgi?id=212541

Reviewed by Darin Adler.

APPLE_PAY_SESSION_V(3|4) is now enabled whenever APPLE_PAY itself is enabled.

Source/cmake/OptionsFTW.cmake:
Source/cmake/OptionsMac.cmake:
Source/cmake/WebKitFeatures.cmake:

Source/JavaScriptCore:

Configurations/FeatureDefines.xcconfig:

Source/WebCore:

Configurations/FeatureDefines.xcconfig:
Modules/applepay/ApplePayError.idl:
Modules/applepay/ApplePayPaymentAuthorizationResult.idl:
Modules/applepay/ApplePayPaymentContact.idl:
Modules/applepay/ApplePayPaymentMethodUpdate.idl:
Modules/applepay/ApplePayRequestBase.idl:
Modules/applepay/ApplePaySession.idl:
Modules/applepay/ApplePayShippingContactUpdate.idl:
Modules/applepay/ApplePayShippingMethodUpdate.idl:
Modules/applepay/PaymentCoordinatorClient.cpp:

(WebCore::PaymentCoordinatorClient::supportsVersion):

Modules/applepay/paymentrequest/ApplePayPaymentHandler.cpp:

(WebCore::ApplePayPaymentHandler::computePaymentMethodErrors const):

accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::applePayButtonDescription const):

css/CSSPrimitiveValueMappings.h:

(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::operator ApplePayButtonType const):

css/CSSValueKeywords.in:
css/parser/CSSParserFastPaths.cpp:

(WebCore::CSSParserFastPaths::isValidKeywordPropertyAndValue):

rendering/RenderThemeCocoa.mm:

(WebCore::toPKPaymentButtonType):

rendering/style/RenderStyleConstants.cpp:

(WebCore::operator<<):

rendering/style/RenderStyleConstants.h:

Source/WebCore/PAL:

Configurations/FeatureDefines.xcconfig:

Source/WebKit:

Configurations/FeatureDefines.xcconfig:

Source/WebKitLegacy/mac:

Configurations/FeatureDefines.xcconfig:

Tools:

Scripts/webkitperl/FeatureList.pm:
TestWebKitAPI/Configurations/FeatureDefines.xcconfig:

5:42 PM Changeset in webkit [262330] by ddkilzer@apple.com

2 edits in trunk/Source/WebKitLegacy/mac

REGRESSION (r260306): Compatibility issue leading to crash on macOS games
<https://webkit.org/b/212546>
<rdar://problem/62624078>

Reviewed by Brent Fulgham.

WebView/WebView.mm:

(_WebSafeForwarder._target):
(_WebSafeForwarder._defaultTarget):

Change weak attribute to unsafe_unretained to fix the crash.

5:03 PM Changeset in webkit [262329] by Alan Coon

8 edits in branches/safari-610.1.15.1-branch/Source

Versioning.

4:57 PM Changeset in webkit [262328] by sbarati@apple.com

5 edits in trunk

Skip a few more JSC tests when $memoryLimited
https://bugs.webkit.org/show_bug.cgi?id=212552

Reviewed by Mark Lam.

JSTests:

stress/call-varargs-inlining-should-not-clobber-previous-to-free-register.js:
stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:

LayoutTests:

js/script-tests/stack-overflow-regexp.js:

4:56 PM Changeset in webkit [262327] by dino@apple.com

1 edit in trunk/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm

Use ALLOW_DEPRECATED_DECLARATIONS_BEGIN instead (thanks to mitz)

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::configurationForSessionID):

4:47 PM Changeset in webkit [262326] by dino@apple.com

2 edits in trunk/Source/WebKit

iOS build fix.

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::configurationForSessionID):

4:16 PM Changeset in webkit [262325] by Alan Coon

1 copy in branches/safari-610.1.15.1-branch

New branch.

4:16 PM Changeset in webkit [262324] by jer.noble@apple.com

3 edits
2 adds in trunk

[EME] navigator.requestMediaKeySystemAccess() should reject PUR sessionTypes in private browsing mode.
https://bugs.webkit.org/show_bug.cgi?id=212540
<rdar://problem/61125757>

Reviewed by Eric Carlson.

Source/WebCore:

A MediaKeySystemAccess with a PUR session type will never be able to create media keys when created in
private browsing mode. Allow clients to fail over to non-PUR session by rejecting the promise returned by
requestMediaKeySystemAccess() when in private browsing mode.

Test: platform/mac/media/encrypted-media/fps-ephemeral-requestMediaKeySystemAccess.html

Modules/encryptedmedia/CDM.cpp:

(WebCore::CDM::getSupportedConfiguration):

LayoutTests:

platform/mac/media/encrypted-media/fps-ephemeral-requestMediaKeySystemAccess-expected.txt: Added.
platform/mac/media/encrypted-media/fps-ephemeral-requestMediaKeySystemAccess.html: Added.

4:09 PM Changeset in webkit [262323] by Wenson Hsieh

4 edits in trunk/Source/WebCore

[iOS] Unable to paste images when composing mail at yahoo.com
https://bugs.webkit.org/show_bug.cgi?id=212544
<rdar://problem/63511613>

Reviewed by Megan Gardner and Andy Estes.

When pasting images in the mobile version of the mail compose editor on mail.yahoo.com, mail.yahoo.com's script
handles the paste by allowing images to be inserted into the DOM (i.e. by not preventing the "paste" event), and
then stripping away the src attribute of the pasted image afterwards. This leaves behind a blank space in the
email.

Work around this by avoiding images when converting the contents of the pasteboard into web content on iOS.
Instead, we fall back to inserting (sanitized) text, or nothing at all if there is no other representation
suitable for converting into web content.

Unfortunately, the mobile version of the website is loaded on iPad as well, even when the desktop website has
been requested (through sending the macOS user agent and "MacIntel" navigator platform).

editing/cocoa/WebContentReaderCocoa.mm:

(WebCore::WebContentReader::readImage):

page/Quirks.cpp:

(WebCore::Quirks::shouldAvoidPastingImagesAsWebContent const):

page/Quirks.h:

4:03 PM Changeset in webkit [262322] by jer.noble@apple.com

2 edits in trunk/Source/WebKit

[Mac,WK2] Fullscreen animation missing a few frames at beginning
https://bugs.webkit.org/show_bug.cgi?id=212156
<rdar://problem/54799415>

Reviewed by Eric Carlson.

When starting the enter fullscreen animation, ensure that the fullscreen window is ordered front, and on top
of the content, as well as having all the animations configured so that their starting state is in place before
calling -[NSWindow enterFullscreenMode:]. Move all the window creation code into
-beganEnterFullScreenWithInitialFrame:finalFrame: from _startEnterFullScreenAnimationWithDuration:. Re-use the
existing zoomAnimation() and maskAnimation() utility methods, but give the animations a very long duration
(since there is no explicit way to start and stop a CAAnimation). This initial animation will be replaced with
the final one inside -_startEnterFullScreenAnimationWithDuration:. Separately, explictly disable implicit
animations of the fullscreen window during -orderIn: and -orderOut:.

UIProcess/mac/WKFullScreenWindowController.mm:

(-[WKFullScreenWindowController initWithWindow:webView:page:impl:]):
(-[WKFullScreenWindowController beganEnterFullScreenWithInitialFrame:finalFrame:]):
(-[WKFullScreenWindowController _startEnterFullScreenAnimationWithDuration:]):

3:35 PM Changeset in webkit [262321] by commit-queue@webkit.org

10 edits in trunk

[GTK][WPE] API for WebView audio mute support
https://bugs.webkit.org/show_bug.cgi?id=176119

Patch by Jan-Michael Brummer <jan.brummer@tabos.org> on 2020-05-29
Reviewed by Michael Catanzaro.

Source/WebKit:

Test implemented in TestWebKitWebView.

UIProcess/API/glib/WebKitWebView.cpp:

(webkitWebViewSetProperty):
(webkitWebViewGetProperty):
(webkit_web_view_class_init):
(webkit_web_view_set_is_muted):
(webkit_web_view_is_muted):

UIProcess/API/gtk/WebKitWebView.h:
UIProcess/API/gtk/docs/webkit2gtk-4.0-sections.txt:
UIProcess/API/wpe/WebKitWebView.h:
UIProcess/API/wpe/docs/wpe-1.0-sections.txt:
UIProcess/WebPageProxy.h:

(WebKit::WebPageProxy::isAudioMuted const):

Tools:

MiniBrowser/gtk/BrowserTab.c:

(audioClicked):
(audioMutedChanged):
(browserTabConstructed):

TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp:

(testWebViewIsAudioMuted):
(beforeAll):

3:02 PM Changeset in webkit [262320] by Alan Coon

1 copy in tags/Safari-610.1.15.1

Tag Safari-610.1.15.1.

2:58 PM Changeset in webkit [262319] by Devin Rousso

1 edit
2 adds in trunk/LayoutTests

Web Inspector: add test for protocol "condition" logic
https://bugs.webkit.org/show_bug.cgi?id=212497

Reviewed by Brian Burg.

inspector/protocol/condition.html: Added.
inspector/protocol/condition-expected.txt: Added.

2:24 PM Changeset in webkit [262318] by Darin Adler

12 edits in trunk

Remove things from FeatureDefines.xcconfig that are covered by PlatformEnableCocoa.h
https://bugs.webkit.org/show_bug.cgi?id=212418

2:13 PM Changeset in webkit [262317] by Peng Liu

2 edits in trunk/Source/WebKit

ASSERT NOT REACHED in IPC::takeAsyncReplyHandler under WebKit::AudioSessionRoutingArbitrator::beginRoutingArbitrationWithCategory
https://bugs.webkit.org/show_bug.cgi?id=212533

Reviewed by Chris Dumez.

When the m_inDispatchMessageMarkedToUseFullySynchronousModeForTesting flag is set,
sendWithAsyncReply() may actually send the message synchronously. Therefore, we have
to set the async reply handler before actually sending the message.

No new tests, fixing test crashes due to assertion failures.

Platform/IPC/Connection.h:

(IPC::Connection::sendWithAsyncReply):

2:06 PM Changeset in webkit [262316] by Jacob Uphoff

5 edits in trunk/Source/WebCore

Unreviewed, reverting r262289.

This commit caused a test to crash internally

Reverted changeset:

"MediaPlayerPrivateMediaStreamAVFObjC should enqueue samples
in a background thread"
https://bugs.webkit.org/show_bug.cgi?id=212073
https://trac.webkit.org/changeset/262289

1:28 PM Changeset in webkit [262315] by commit-queue@webkit.org

2 edits in trunk/Tools

[Win] Allow compiling with the TOUCH_EVENTS enabled
https://bugs.webkit.org/show_bug.cgi?id=212528

Patch by Pavel <pavel.feldman@gmail.com> on 2020-05-29
Reviewed by Fujii Hironori.

Aligning Win with GTK, adding missing EventSenderProxy stubs.
This allows compiling Win with TOUCH_EVENTS and unlocks event
injection / processing by the automation drivers

WebKitTestRunner/win/EventSenderProxyWin.cpp:

(WTR::EventSenderProxy::addTouchPoint):
(WTR::EventSenderProxy::updateTouchPoint):
(WTR::EventSenderProxy::setTouchModifier):
(WTR::EventSenderProxy::setTouchPointRadius):
(WTR::EventSenderProxy::touchStart):
(WTR::EventSenderProxy::touchMove):
(WTR::EventSenderProxy::touchEnd):
(WTR::EventSenderProxy::touchCancel):
(WTR::EventSenderProxy::clearTouchPoints):
(WTR::EventSenderProxy::releaseTouchPoint):
(WTR::EventSenderProxy::cancelTouchPoint):

1:23 PM Changeset in webkit [262314] by Alan Coon

8 edits in branches/safari-610.1.15-branch/Source

Versioning.

1:13 PM Changeset in webkit [262313] by Jacob Uphoff

2 edits in trunk/LayoutTests

[ iOS ] http/wpt/service-workers/service-worker-different-process.https.html & http/wpt/service-workers/service-worker-crashing-while-fetching.https.html are flaky failures
https://bugs.webkit.org/show_bug.cgi?id=212532

Unreviewed test gardening.

platform/ios-wk2/TestExpectations:

1:06 PM Changeset in webkit [262312] by Chris Dumez

223 edits
22 copies
4 moves
243 adds
2 deletes in trunk/LayoutTests

Update web-platform-tests/tools from upstream
https://bugs.webkit.org/show_bug.cgi?id=212498

Reviewed by Carlos Alberto Lopez Perez.

Update web-platform-tests/tools from upstream 6a76a185f913e3c027e369a.

web-platform-tests/tools/*: Updated.

12:47 PM Changeset in webkit [262311] by Darin Adler

12 edits in trunk

Remove things from FeatureDefines.xcconfig that are covered by PlatformEnableCocoa.h
https://bugs.webkit.org/show_bug.cgi?id=212418

Reviewed by Andy Estes.

Source/JavaScriptCore:

Configurations/FeatureDefines.xcconfig: Removed 83 of the 119 things defined in