⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Timeline



Aug 9, 2020:

10:12 PM Changeset in webkit [265422] by commit-queue@webkit.org
  • 15 edits
    1 copy
    1 move
    4 adds
    1 delete in trunk

[macOS] Drag/drop an image of a unsupported format to an file input element should convert it to a supported format
​https://bugs.webkit.org/show_bug.cgi?id=212482
<rdar://problem/63731672>

Patch by Said Abou-Hallawa <​sabouhallawa@apple.com> on 2020-08-09
Reviewed by Darin Adler.

Source/WebCore:

Although the list of the dropped files are sent from the UI process to
the Web process through the WebPage channel, the file input settings are
only known by the Web process. So we have to do the image transcoding in
WebCore.

Tests: fast/forms/file/entries-api/image-no-transcode-drag-drop.html

fast/forms/file/entries-api/image-transcode-drag-drop.html

  • SourcesCocoa.txt:
  • WebCore.xcodeproj/project.pbxproj:
  • html/FileInputType.cpp:

(WebCore::FileInputType::handleDOMActivateEvent):
(WebCore::FileInputType::fileChooserSettings const):
Move filling FileChooserSettings to the function: fileChooserSettings().

(WebCore::FileInputType::applyFileChooserSettings):
Call fileChooserSettings() instead of receiving FileChooserSettings as
an argument.

(WebCore::FileInputType::filesChosen):
Add this function which can be called from receiveDroppedFiles() or
receiveDroppedFilesWithImageTranscoding().

(WebCore::FileInputType::receiveDroppedFilesWithImageTranscoding):
Finds out whether image transcoding is needed for the dropped files. If
it is needed, it will be done in a WorkQueue and call filesChosen() when
it is done. Otherwise it will call filesChosen() immediately.

(WebCore::FileInputType::receiveDroppedFiles):

  • html/FileInputType.h:
  • platform/graphics/ImageUtilities.h: Added.
  • platform/graphics/cg/ImageUtilitiesCG.cpp: Added.

(WebCore::sharedImageTranscodingQueue):
Provide a shared WorkQueue which can be used by WebCore and WebKit.

(WebCore::transcodeImage):
(WebCore::findImagesForTranscoding):
(WebCore::transcodeImages):

Source/WebKit:

Move ImageUtilities.h and ImageUtilitiesCG.cpp from WebKit to WebCore.
Use the image transcoding functions and shared WorkQueue from WebCore.

  • Platform/ImageUtilities.h: Removed.
  • Platform/cg: Removed.
  • SourcesCocoa.txt:
  • UIProcess/WebPageProxy.cpp:

(WebKit::m_limitsNavigationsToAppBoundDomains):
(WebKit::WebPageProxy::didChooseFilesForOpenPanelWithImageTranscoding):
(WebKit::m_transcodingQueue): Deleted.

  • UIProcess/WebPageProxy.h:
  • WebKit.xcodeproj/project.pbxproj:

LayoutTests:

Enable the new tests on macOS WK1. eventSender.beginDragWithFiles is
supported on WK1 only.

  • fast/forms/file/entries-api/image-no-transcode-drag-drop-expected.txt: Added.
  • fast/forms/file/entries-api/image-no-transcode-drag-drop.html: Added.
  • fast/forms/file/entries-api/image-transcode-drag-drop-expected.txt: Added.
  • fast/forms/file/entries-api/image-transcode-drag-drop.html: Added.
  • platform/ios/TestExpectations:
  • platform/win/TestExpectations:
  • platform/wincairo/TestExpectations:
  • platform/wk2/TestExpectations:
9:48 PM Changeset in webkit [265421] by commit-queue@webkit.org
  • 2 edits in trunk/Source/JavaScriptCore

Unreviewed, reverting r265392.
​https://bugs.webkit.org/show_bug.cgi?id=215316

Crash ARM64 / ARM64E JSC tests

Reverted changeset:

"REGRESSION(r261159) PokerBros only shows black screen"
​https://bugs.webkit.org/show_bug.cgi?id=215293
​https://trac.webkit.org/changeset/265392

7:18 PM Changeset in webkit [265420] by Wenson Hsieh
  • 7 edits in trunk

REGRESSION (r260831): Web process crashes under Editor::setComposition() after navigating with marked text
​https://bugs.webkit.org/show_bug.cgi?id=215315
<rdar://problem/64740092>

Reviewed by Darin Adler.

Source/WebCore:

To address a variety of crashes due to frames changing (or otherwise losing) their document while executing
editing commands, r260831 refactored the Editor class such that it extends the functionality of the Document
class, rather than the Frame class. In nearly all scenarios, this either leads to no behavior change or prevents
null pointer crashes, since a document is almost always attached to a frame when applying any editing commands.

However, there is one scenario where a document that has not yet been attached to its frame (and therefore does
not have a browsing context) will cause a null deref when trying to confirm an existing IME composition. The
logic added in <​https://trac.webkit.org/r150291> will try and confirm any existing composition range on a
document right before committing provisional navigation. In the case where we are navigating back to a
previously visited page, m_frame's document in FrameLoader::commitProvisionalLoad() will not be attached
until the cached page's mainframe is opened underneath CachedPage::restore(). Since the call to
Editor::confirmComposition() currently happens before this step, we end up crashing while attempting to create
a UserTypingGestureIndicator. Note that even if we avoid this with a null check, we'll still end up crashing
shortly thereafter, underneath Editor::insertTextForConfirmedComposition. And even if this second crash is
avoided with another null check, we'll just end up with some version of webkit.org/b/59121, where the
composition range is present after navigation, but is out of sync with platform UI.

To fix the crash (and also not bring back bug #59121), we refactor this composition confirmation logic so that
it lives in Editor, and is also robust against the case where the document is not attached to a frame; we then
invoke this call after we're done committing the provisional load, so that any frame that is not yet attached
before commiting the load still has a chance to confirm its composition.

Test: WKWebViewMacEditingTests.ProcessSwapAfterSettingMarkedText

  • editing/Editor.cpp:

(WebCore::Editor::confirmCompositionAndNotifyClient):

Move functionality from willTransitionToCommitted to confirmCompositionAndNotifyClient, a helper method that
will bail if the document is not attached, but otherwise confirm the active composition (if it exists).

  • editing/Editor.h:
  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::commitProvisionalLoad):

Add a call to confirm the editor's current composition after we're done committing the load. Note that in the
case where we had a composition before committing the load, we'll end up confirming the composition earlier (in
the first call site), rather than confirming after the load has been committed. This means that this second call
will be a no-op, due to the editor not having any composition.

(WebCore::FrameLoader::willTransitionToCommitted): Deleted.

  • loader/FrameLoader.h:

Tools:

Add a new API that exercises the crash by:

  • Enabling PSON.
  • Navigating to page A and inserting some marked text.
  • Navigating to page B with a process swap (without confirming the marked text).
  • Navigating back to page A, and verifying that the previoulsy marked text is now committed.
  • TestWebKitAPI/Tests/mac/WKWebViewMacEditingTests.mm:
1:41 PM Changeset in webkit [265419] by ysuzuki@apple.com
  • 2 edits in trunk/Source/JavaScriptCore

[JSC] Make CommandLine on Worker agent (JSC shell feature for testing) work on iOS
​https://bugs.webkit.org/show_bug.cgi?id=215311
<rdar://problem/66660053>

Reviewed by Mark Lam.

We should not reconfigure Options since this is once initialized. Since Options are frozen,
this results in crash.

  • jsc.cpp:

(CommandLine::CommandLine):
(functionDollarAgentStart):

11:23 AM Changeset in webkit [265418] by Ben Nham
  • 4 edits in trunk/Source

Preload graphics drivers in Mac WebProcess
​https://bugs.webkit.org/show_bug.cgi?id=215183

Reviewed by Darin Adler.

Source/WebCore:

In newer versions of Mac OS, graphics drivers are no longer part of the shared cache due to
size restrictions. This can cause first render to be blocked by ~10 ms when we dlopen those
drivers. To work around this, we preload the drivers when prewarming the WebProcess.

  • page/ProcessWarming.cpp:

(WebCore::ProcessWarming::prewarmGlobally):

Source/WTF:

Enable GPU driver preheating in versions of the OS that might not have the drivers in the dyld
shared cache due to size restrictions.

  • wtf/PlatformEnableCocoa.h:
8:34 AM Changeset in webkit [265417] by youenn@apple.com
  • 13 edits
    3 adds
    6 deletes in trunk

Always resolve ReadableStream's tee()'s cancel promise after the stream closes or errors
​https://bugs.webkit.org/show_bug.cgi?id=215197

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

  • resources/import-expectations.json:
  • web-platform-tests/streams: Resynced to upstream WPT.

Source/WebCore:

Make sure to resolve the cancel promise if the source gets closed or errored.
Test: imported/w3c/web-platform-tests/streams/queuing-strategies-size-function-per-global.window.html

  • Modules/streams/ReadableStreamInternals.js:

(readableStreamTee):
(readableStreamTeePullFunction):

4:49 AM Changeset in webkit [265416] by commit-queue@webkit.org
  • 13 edits in trunk/Source

Unreviewed, reverting r263195, r263252, and r265394.
​https://bugs.webkit.org/show_bug.cgi?id=215312

Revert all related GC Bitmap changes because some of perf is
not fully recovered

Reverted changesets:

"Replace JSC::FreeList linked list with a Bitmap."
​https://bugs.webkit.org/show_bug.cgi?id=213071
​https://trac.webkit.org/changeset/263195

"Unify Bitmap math loops in
MarkedBlock::Handle::specializedSweep()."
​https://bugs.webkit.org/show_bug.cgi?id=213345
​https://trac.webkit.org/changeset/263252

"[JSC] Disable ENABLE_BITMAP_FREELIST"
​https://bugs.webkit.org/show_bug.cgi?id=215285
​https://trac.webkit.org/changeset/265394

12:36 AM Changeset in webkit [265415] by mmaxfield@apple.com
  • 3 edits in trunk/Source/WebCore

Update OriginalAdvancesForCharacterTreatedAsSpace to work correctly in the presence of inserted or removed glyphs
​https://bugs.webkit.org/show_bug.cgi?id=215302

Reviewed by Darin Adler.

OriginalAdvancesForCharacterTreatedAsSpace is trying to make sure that shaping doesn't cause
spaces to get wider or thinner. However, the way it was doing that is, for all the space
characters, overwrite that glyph index's advance after shaping to be what it was before shaping.
However, this is wrong, because shaping can insert or delete glyphs. Instead, now that we have
explicit string indices for each glyph, we can use those to determine which glyphs come from
space characters. These glyphs are the ones which should be overwritten.

  • platform/graphics/WidthIterator.cpp:

(WebCore::WidthIterator::applyFontTransforms):
(WebCore::WidthIterator::advanceInternal):

  • platform/graphics/WidthIterator.h:

Aug 8, 2020:

11:40 PM Changeset in webkit [265414] by mmaxfield@apple.com
  • 2 edits in trunk/Source/WebCore

Fix bad merge in r265241
​https://bugs.webkit.org/show_bug.cgi?id=215051

Unreviewed. This is something that got dropped in a bad merge from r265241.

  • platform/graphics/FontCascade.cpp:

(WebCore::FontCascade::widthForSimpleText const):

10:14 PM Changeset in webkit [265413] by mmaxfield@apple.com
  • 7 edits
    1 delete in trunk

Make GlyphBuffers required in the fast text codepath
​https://bugs.webkit.org/show_bug.cgi?id=215052

Reviewed by Darin Adler.

Source/WebCore:

This is in preparation for ​https://bugs.webkit.org/show_bug.cgi?id=214769
and ​https://bugs.webkit.org/show_bug.cgi?id=206208.

Performing shaping affects the width of strings; indeed, that is one of
its purposes for existence. Shaping can only happen when we have a GlyphBuffer
to shape. We can't just arbitrarily decide to disable shaping for various
functions just because those functions don't ever inspect the exact glyphs.

No new tests. This is a preparation step toward
​https://bugs.webkit.org/show_bug.cgi?id=214769 and
​https://bugs.webkit.org/show_bug.cgi?id=206208, and I couldn't come up with a
test case that was broken here.

  • platform/graphics/FontCascade.cpp:

(WebCore::FontCascade::widthOfTextRange const):
(WebCore::FontCascade::widthForSimpleText const):
(WebCore::FontCascade::layoutSimpleText const):
(WebCore::FontCascade::floatWidthForSimpleText const):
(WebCore::FontCascade::adjustSelectionRectForSimpleText const):

  • platform/graphics/WidthIterator.cpp:

(WebCore::WidthIterator::shouldApplyFontTransforms const):
(WebCore::WidthIterator::applyFontTransforms):
(WebCore::WidthIterator::advanceInternal):
(WebCore::WidthIterator::advance):
(WebCore::WidthIterator::advanceOneCharacter):

  • platform/graphics/WidthIterator.h:
  • rendering/svg/SVGTextMetricsBuilder.cpp:

(WebCore::SVGTextMetricsBuilder::advanceSimpleText):

LayoutTests:

  • platform/win/fast/events/selectstart-by-drag-expected.txt: Test progressed on Windows.
9:27 PM Changeset in webkit [265412] by mmaxfield@apple.com
  • 4 edits in trunk/Source/WebCore

WidthIterator::m_finalRoundingWidth is always 0
​https://bugs.webkit.org/show_bug.cgi?id=215307

Reviewed by Darin Adler.

There's no reason for it to exist.

No new tests because there is no behavior change.

  • platform/graphics/FontCascade.cpp:

(WebCore::FontCascade::layoutSimpleText const):

  • platform/graphics/WidthIterator.cpp:

(WebCore::WidthIterator::advanceInternal):

  • platform/graphics/WidthIterator.h:

(WebCore::WidthIterator::runWidthSoFar const):
(WebCore::WidthIterator::finalRoundingWidth const): Deleted.

8:57 PM Changeset in webkit [265411] by mmaxfield@apple.com
  • 8 edits in trunk/Source/WebCore

Use references instead of pointers for GlyphBuffer::add()'s Font argument
​https://bugs.webkit.org/show_bug.cgi?id=215309

Reviewed by Darin Adler.

They're not allowed to be null.

No new tests because there is no behavior change.

  • platform/graphics/ComplexTextController.cpp:

(WebCore::ComplexTextController::advance):

  • platform/graphics/FontCascade.cpp:

(WebCore::FontCascade::widthForSimpleText const):
(WebCore::FontCascade::drawGlyphBuffer const):
(WebCore::offsetToMiddleOfGlyph):
(WebCore::FontCascade::drawEmphasisMarks const):
(WebCore::GlyphToPathTranslator::GlyphToPathTranslator):
(WebCore::GlyphToPathTranslator::advance):
(WebCore::FontCascade::dashesForIntersectionsWithRect const):

  • platform/graphics/GlyphBuffer.h:

(WebCore::GlyphBuffer::fontAt const):
(WebCore::GlyphBuffer::add):

  • platform/graphics/WidthIterator.cpp:

(WebCore::WidthIterator::advanceInternal):

  • platform/graphics/displaylists/DisplayListItems.cpp:

(WebCore::DisplayList::DrawGlyphs::generateGlyphBuffer const):

  • rendering/mathml/MathOperator.cpp:

(WebCore::MathOperator::paintGlyph):
(WebCore::MathOperator::paint):

  • rendering/mathml/RenderMathMLToken.cpp:

(WebCore::RenderMathMLToken::paint):

8:23 PM Changeset in webkit [265410] by Wenson Hsieh
  • 8 edits in trunk

[ iOS wk2 ] editing/pasteboard/paste-without-nesting.html is a flaky failure
​https://bugs.webkit.org/show_bug.cgi?id=215218
<rdar://problem/66628493>

Reviewed by Darin Adler.

Source/WebKit:

This test writes to the system pasteboard using document.execCommand("Copy"), and then immediately reads from
the system pasteboard by triggering document.execCommand("Paste"). On rare occasions, this fails on iOS, where
IPC messages for writing content to the pasteboard (e.g. WebPasteboardProxy::WriteWebContentToPasteboard) are
asynchronous, but the IPC message to get the pasteboard change count before pasting (GetPasteboardChangeCount)
is synchronous. This means that Connection may end up dispatching the sync GetPasteboardChangeCount IPC
message before dispatching WriteWebContentToPasteboard, which causes the pasteboard read to fail, because the
contents on the pasteboard have changed after starting to read from the pasteboard.

Note that this is not a problem on macOS since all pasteboard writing IPC is synchronous. Instead of turning all
of the async iOS pasteboard writing messages synchronous as well, we can fix this by adding a mechanism in
WebProcess to keep track of outgoing async pasteboard write messages; then, before attempting to grab the
change count when we start reading, wait for any of these pending async writes to finish before we continue.

In a future patch, we could actually adopt this same mechanism in SetPasteboardTypes and neighboring IPC
messages to turn these all asynchronous.

  • UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:

(WebKit::WebPasteboardProxy::writeURLToPasteboard):
(WebKit::WebPasteboardProxy::writeWebContentToPasteboard):
(WebKit::WebPasteboardProxy::writeImageToPasteboard):
(WebKit::WebPasteboardProxy::writeStringToPasteboard):

Call didWriteToPasteboardAsynchronously after we finish writing to the pasteboard asynchronously.

  • WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:

(WebKit::WebPlatformStrategies::changeCount):

Before accessing changeCount, wait until any asynchronous calls to write to the system pasteboard have finished.

(WebKit::WebPlatformStrategies::writeToPasteboard):

Right before we send an async message to the UI process to write to the system pasteboard, notify WebProcess
so that it can keep track of pending clipboard writes.

  • WebProcess/WebProcess.h:
  • WebProcess/WebProcess.messages.in:
  • WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::willWriteToPasteboardAsynchronously):
(WebKit::WebProcess::didWriteToPasteboardAsynchronously):
(WebKit::WebProcess::waitForPendingPasteboardWritesToFinish):

Wait for a maximum of 1 second for any outgoing pasteboard writing messages to return to the web process.

LayoutTests:

Remove the flaky test expectation.

  • platform/ios-simulator-wk2/TestExpectations:
1:31 PM Changeset in webkit [265409] by Fujii Hironori
  • 2 edits in trunk/Tools

[WinCairo] REGRESSION(r265408): Unreviewed layout test script fix
​https://bugs.webkit.org/show_bug.cgi?id=215292
<rdar://problem/66698141>

os.getuid() is available only for Unix.

AttributeError: 'module' object has no attribute 'getuid'

  • Scripts/webkitpy/init.py: Don't use os.getuid() unless sys.platform == 'darwin'.
6:43 AM Changeset in webkit [265408] by Jonathan Bedard
  • 2 edits in trunk/Tools

[webkitpy] Pick a reasonable auto-install location on NFS mounts
​https://bugs.webkit.org/show_bug.cgi?id=215292
<rdar://problem/66698141>

Reviewed by Dewei Zhu.

  • Scripts/webkitpy/init.py: On MacOS, when the current user does not own the checkout, use ~/Libraries/webkitpy.
3:54 AM Changeset in webkit [265407] by jh718.park@samsung.com
  • 2 edits in trunk/Source/WTF

[WTF] Remove the build warning since r265344.
​https://bugs.webkit.org/show_bug.cgi?id=215269

warning: parameter ‘integer’ set but not used [-Wunused-but-set-parameter]

  • wtf/text/IntegerToStringConversion.h:

(WTF::lengthOfIntegerAsString):

3:37 AM Changeset in webkit [265406] by youenn@apple.com
  • 2 edits in trunk/Tools

Add a quota delegate test for miniaturized/deminiaturized pages
​https://bugs.webkit.org/show_bug.cgi?id=215166

Reviewed by Alex Christensen.

Add a Mac specific test for testing quota delegate in case page is miniaturized or not.
Update testing code to show more meaningful error reports.

  • TestWebKitAPI/Tests/WebKitCocoa/StorageQuota.mm:

(-[QuotaMessageHandler userContentController:didReceiveScriptMessage:]):
(-[QuotaMessageHandler receivedMessage]):

12:44 AM Changeset in webkit [265405] by ysuzuki@apple.com
  • 5 edits in trunk/Source/JavaScriptCore

[JSC] Speculate children first in DFG NewArray
​https://bugs.webkit.org/show_bug.cgi?id=215308
<rdar://problem/64749263>

Reviewed by Mark Lam.

SpeculativeJIT::emitAllocateRawObject can create uninitialized butterfly since we later fill them.
However, DFG NewArray node has speculation after that. So if speculation failure happens, we release
half-baked butterfly.

Let's see the example.

8459 emitAllocateRawObject(resultGPR, structure, storageGPR, numElements, vectorLengthHint);
...
8482 case ALL_INT32_INDEXING_TYPES:
8483 case ALL_CONTIGUOUS_INDEXING_TYPES: {
8484 JSValueOperand operand(this, use, ManualOperandSpeculation);
8485 JSValueRegs operandRegs = operand.jsValueRegs();
8486 if (hasInt32(node->indexingType())) {
8487 DFG_TYPE_CHECK(
8488 operandRegs, use, SpecInt32Only,
8489 m_jit.branchIfNotInt32(operandRegs));
8490 }
8491 m_jit.storeValue(operandRegs, MacroAssembler::Address(storageGPR, sizeof(JSValue) * operandIdx));
8492 break;
8493 }

L8487-L8489 is doing speculation check. If it failed, the rest of the butterfly can be filled with garbage. This looks OK since
it is Int32 butterfly so GC never scans it. However, if have-a-bad-time happens and the array is reachable from the conservative root,
this half-baked array is converted from Int32 array to ArrayStorage. At that time, since Int32 butterfly should hold JSInt32,
we store this garbage to ArrayStorage. Later, if conservative root still holds this array, and GC scans this garbage as as JSValue,
this value confuses GC.

In this patch, we first perform speculation before creating uninitialized JSArray so that we can ensure that we never exit after
creating this array until we fill it. This strategy is the same to FTL's NewArray implementation.

And we also found that emitAllocateRawObject is allocating an object from JSFinalObject space while we use it for JSArray too.
We should get per-type allocator to ensure JSArray is allocated in its IsoSubspace.

  • dfg/DFGOperations.cpp:
  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
(JSC::DFG::SpeculativeJIT::compileNewArray):
(JSC::DFG::SpeculativeJIT::compileMaterializeNewObject):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNewArray):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):

  • runtime/JSObject.h:

(JSC::JSObject::createRawObject): Deleted.

Note: See TracTimeline for information about the timeline view.