Timeline

Jan 2, 2021:

11:18 PM Changeset in webkit [271124] by commit-queue@webkit.org

• 14 edits in trunk/Source

Remove some FrameLoader::changeLocation parameters
​https://bugs.webkit.org/show_bug.cgi?id=220186

Patch by Rob Buis <​rbuis@igalia.com> on 2021-01-02
Reviewed by Darin Adler.

Source/WebCore:

In all cases changeLocation is called with the default
values for LockHistory and LockBackForwardList, so we
do not need to have these parameters.

• html/HTMLAnchorElement.cpp:

(WebCore::HTMLAnchorElement::handleClick):

• html/HTMLLinkElement.cpp:

(WebCore::HTMLLinkElement::handleClick):

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::changeLocation):

• loader/FrameLoader.h:
• loader/NavigationScheduler.cpp:
• mathml/MathMLElement.cpp:

(WebCore::MathMLElement::defaultEventHandler):

• svg/SVGAElement.cpp:

(WebCore::SVGAElement::defaultEventHandler):

Source/WebKit:

Adapt to API change.

• WebProcess/Plugins/PDF/PDFPlugin.mm:

(WebKit::PDFPlugin::clickedLink):

• WebProcess/WebCoreSupport/WebContextMenuClient.cpp:

(WebKit::WebContextMenuClient::searchWithGoogle):

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::navigateToPDFLinkWithSimulatedClick):

Source/WebKitLegacy/win:

Adapt to API change.

• WebCoreSupport/WebContextMenuClient.cpp:

(WebContextMenuClient::searchWithGoogle):

5:56 PM Changeset in webkit [271123] by Simon Fraser

• 11 edits in trunk/Source/WebCore

[LFC Display] Rename Box::Flags to Box::TypeFlags
​https://bugs.webkit.org/show_bug.cgi?id=220223

Reviewed by Sam Weinig.

I'll be adding a separate OptionSet<> of flags that can change dynamically
on a Display::Box, so rename the existing flags to TypeFlags, and make the member
const. They will never change after construction.

• display/css/DisplayBox.cpp:

(WebCore::Display::Box::Box):

• display/css/DisplayBox.h:

(WebCore::Display::Box::Box):
(WebCore::Display::Box::isBoxModelBox const):
(WebCore::Display::Box::isContainerBox const):
(WebCore::Display::Box::isImageBox const):
(WebCore::Display::Box::isReplacedBox const):
(WebCore::Display::Box::isTextBox const):
(WebCore::Display::Box::isLineBreakBox const):

• display/css/DisplayBoxFactory.cpp:

(WebCore::Display::BoxFactory::displayBoxForLayoutBox const):

• display/css/DisplayBoxModelBox.cpp:

(WebCore::Display::BoxModelBox::BoxModelBox):

• display/css/DisplayBoxModelBox.h:

(WebCore::Display::BoxModelBox::BoxModelBox):

• display/css/DisplayContainerBox.cpp:

(WebCore::Display::ContainerBox::ContainerBox):

• display/css/DisplayImageBox.cpp:

(WebCore::Display::ImageBox::ImageBox):

• display/css/DisplayReplacedBox.cpp:

(WebCore::Display::ReplacedBox::ReplacedBox):

• display/css/DisplayReplacedBox.h:
• display/css/DisplayTextBox.cpp:

(WebCore::Display::TextBox::TextBox):

1:11 PM Changeset in webkit [271122] by Fujii Hironori

• 2 edits in trunk/Source/WebKitLegacy/win

[Win][DumpRenderTree] Some JS tests are timing out only in Debug builds since r269157
​https://bugs.webkit.org/show_bug.cgi?id=220145
<rdar://problem/72756207>

Reviewed by Sam Weinig.

r269157 added new WebKit1 APIs to set a preference, and
DumpRenderTree uses them to reset all preferences after each
testing. However, it was too slow for large pages because the API
is causing resolveStyle for every preference. Some JS tests failed
as timeout in debug builds because they are generating large
pages.

• WebPreferences.cpp:

(stringValueForPreferencesValue): Added.
(WebPreferences::setBoolPreferenceForTesting):
(WebPreferences::setUInt32PreferenceForTesting):
(WebPreferences::setDoublePreferenceForTesting):
(WebPreferences::setStringPreferenceForTesting):
Do nothing if the new preference value is same with the current
value.

12:46 PM Changeset in webkit [271121] by ysuzuki@apple.com

• 4 edits
  1 add in trunk

[JSC] Remove unnecessary mov bytecodes when performing simple object pattern destructuring to variables
​https://bugs.webkit.org/show_bug.cgi?id=220219

Reviewed by Alexey Shvayka.

JSTests:

• stress/object-pattern-simple-fast-path.js: Added.

(shouldBe):
(shouldThrow):
(test1):

Source/JavaScriptCore:

Currently, we are first puts object pattern's expression into temporary variable, and then, we store it into local variable register.

The following code

({ data } = object);

emits this kind of bytecode.

get_by_id dst:loc10, base:loc9, property:0
mov dst:loc6, src:loc10

However, this should be

get_by_id dst:loc6, base:loc9, property:0

We are emitting many unnecessary movs since this destructuring pattern is common. Increasing amount of mov (1) discourages inlining unnecessarily and (2) simply makes
bytecode memory large. Since this is very common pattern, we should carefully optimize it to remove such unnecessary movs.

This patch looks into pattern when performing object pattern destructuring. And avoid emitting mov when it is possible. There are some cases we cannot remove movs, so
this patch's writableDirectBindingIfPossible looks into whether this is possible (& profitable).

• bytecompiler/NodesCodegen.cpp:

(JSC::ObjectPatternNode::bindValue const):
(JSC::BindingNode::writableDirectBindingIfPossible const):
(JSC::BindingNode::finishDirectBindingAssignment const):
(JSC::AssignmentElementNode::writableDirectBindingIfPossible const):
(JSC::AssignmentElementNode::finishDirectBindingAssignment const):

• parser/Nodes.h:

(JSC::DestructuringPatternNode::writableDirectBindingIfPossible const):
(JSC::DestructuringPatternNode::finishDirectBindingAssignment const):

11:27 AM Changeset in webkit [271120] by Alexey Shvayka

• 21 edits in trunk

Improve error message for uninitialized |this| in derived constructor
​https://bugs.webkit.org/show_bug.cgi?id=220221

Reviewed by Yusuke Suzuki.

JSTests:

• stress/async-arrow-functions-lexical-binding-in-class.js:
• stress/async-arrow-functions-lexical-super-binding.js:
• stress/class-derived-from-null.js:
• stress/generator-eval-this.js:
• stress/super-property-access-tdz.js:

LayoutTests/imported/w3c:

• web-platform-tests/custom-elements/parser/parser-fallsback-to-unknown-element-expected.txt:

Source/JavaScriptCore:

Since class constructors perform return this; by default, and derived
constructors require super() to be called before |this| access, regular
TDZ error message is quite confusing, given the following code:

new (class extends Object { constructor() { } });

Considering that currently op_check_tdz is called on thisRegister() only
in derived constructors, this patch modifies its slow path to throw a
helpful error message that covers |this| access and non-object returns.

V8 and SpiderMonkey have similar error messages, mentioning super().

slow_path_throw_tdz_error is merged into slow_path_check_tdz, which is
invoked from baseline JIT, so we can reliably acquire the bytecode and
avoid code duplication.

• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/CommonSlowPaths.cpp:

(JSC::JSC_DEFINE_COMMON_SLOW_PATH):

• runtime/CommonSlowPaths.h:

LayoutTests:

• js/arrowfunction-supercall-expected.txt:
• js/arrowfunction-superproperty-expected.txt:
• js/class-syntax-extends-expected.txt:
• js/class-syntax-super-expected.txt:
• js/script-tests/arrowfunction-supercall.js:
• js/script-tests/arrowfunction-superproperty.js:
• js/script-tests/class-syntax-super.js:

10:41 AM Changeset in webkit [271119] by Alexey Shvayka

• 9 edits
  1 add
  5 deletes in trunk

Don't throw if function.caller is a non-strict / generator / async function
​https://bugs.webkit.org/show_bug.cgi?id=220216

Reviewed by Yusuke Suzuki.

JSTests:

• stress/function-caller-async-arrow-function-body.js: Removed.
• stress/function-caller-async-function-body.js: Removed.
• stress/function-caller-async-generator-body.js: Removed.
• stress/function-caller-generator-body.js: Removed.
• stress/function-caller-generator-method-body.js: Removed.
• stress/function-hidden-as-caller.js: Added.
• stress/polymorphic-access-exception-handler-should-not-clobber-used-register.js:
• stress/tail-call-recognize.js:
• test262/expectations.yaml: Mark 45 test cases as passing.

Source/JavaScriptCore:

The spec forbids [1] ES6+ and strict mode functions from having their own "caller"
property. r230662 went even further, throwing TypeError if function.caller attempts
to return non-strict / generator / async function, which doesn't contradict ECMA-262,
but diverges from V8 and SpiderMonkey (they just return the caller).

Since throwing TypeError causes quite a lot test262 failures and is a bit dangerous
(legacy library which uses function.caller is called from ES6 code), this patch
replaces it with null return.

Given that r230662 appears to be web-compatible, this change preserves its intent
to limit function.caller API as much as possible by returning null for all ES6+
functions, including methods, accessors, and arrow functions.

[1]: ​https://tc39.es/ecma262/#sec-forbidden-extensions (paragraphs 1-2)

• runtime/JSFunction.cpp:

(JSC::JSC_DEFINE_CUSTOM_GETTER):

LayoutTests:

• js/caller-property-expected.txt:
• js/script-tests/caller-property.js:

12:09 AM Changeset in webkit [271118] by James Darpinian

• 3 edits in trunk/Source/ThirdParty/ANGLE

Enable some ANGLE workarounds on iOS
​https://bugs.webkit.org/show_bug.cgi?id=220203

Reviewed by Kenneth Russell.

Running ANGLE's unit tests on iOS upstream exposed the need to enable a couple of existing
workaround flags. ​https://crrev.com/c/2601106 and ​https://crrev.com/c/2606657 are the
upstream changes corresponding to these fixes.

• src/libANGLE/renderer/gl/FramebufferGL.cpp:

(rx::FramebufferGL::blit):

• src/libANGLE/renderer/gl/renderergl_utils.cpp:

(rx::nativegl_gl::InitializeFeatures):