Timeline

Jan 18, 2021:

8:59 PM Changeset in webkit [271596] by ysuzuki@apple.com

• 3 edits
  1 add in trunk

[JSC] FTL::prepareOSREntry can clear OSR entry CodeBlock if it is already invalidated
​https://bugs.webkit.org/show_bug.cgi?id=220718
<rdar://problem/70527068>

Reviewed by Mark Lam.

JSTests:

• stress/ftl-osr-failure-clear-twice.js: Added.

(foo):

Source/JavaScriptCore:

FTL::prepareOSREntry can clear OSR entry CodeBlock if it is already invalidated. However, the caller is not assuming that,
and it calls clearOSREntryBlockAndResetThresholds again. And clearOSREntryBlockAndResetThresholds's assertion hit.
This patch correctly handles the invalidated case.

• dfg/DFGOperations.cpp:

(JSC::DFG::tierUpCommon):

8:28 PM Changeset in webkit [271595] by Lauro Moura

• 4 edits in trunk/LayoutTests

[GLIB] Gardening some failures and crashes

Unreviewed test gardening.

• platform/glib/TestExpectations:
• platform/gtk/TestExpectations:
• platform/wpe/TestExpectations:

4:24 PM Changeset in webkit [271594] by commit-queue@webkit.org

• 28 edits
  5 moves in trunk/Source/JavaScriptCore

[JSC] Implement a B3::Compilation replacement for wasm-llint
​https://bugs.webkit.org/show_bug.cgi?id=220585

Patch by Xan López <Xan Lopez> on 2021-01-18
Reviewed by Yusuke Suzuki.

Move B3Compilation, B3OpaqueByproducts and B3OpaqueByproduct to
jit/. They are used by non-B3 code and they are not really B3
specific. Also rename B3CompilationPtrTag to JITCompilationPtrTag.

• CMakeLists.txt: add new source files.
• JavaScriptCore.xcodeproj/project.pbxproj: ditto.
• Sources.txt: ditto.
• b3/B3Compile.cpp:

(JSC::B3::compile): use JITCompilationPtrTag.

• b3/B3Compile.h: change includes.
• b3/B3DataSection.h: ditto.
• b3/B3Procedure.cpp: ditto.
• b3/B3Procedure.h: ditto.
• b3/air/testair.cpp: use JITCompilationPtrTag.
• b3/testb3.h: change includes.

(invoke):

• b3/testb3_6.cpp:

(testInterpreter): use JITCompilationPtrTag.
(testEntrySwitchSimple): ditto.
(testEntrySwitchNoEntrySwitch): ditto.
(testEntrySwitchWithCommonPaths): ditto.
(testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint): ditto.
(testEntrySwitchLoop): ditto.

• ftl/FTLJITCode.h: use JSC::OpaqueByproducts.
• ftl/FTLOutput.h: change includes.
• jit/JITCompilation.cpp: Renamed from Source/JavaScriptCore/b3/B3Compilation.cpp.

(JSC::Compilation::Compilation):

• jit/JITCompilation.h: Renamed from Source/JavaScriptCore/b3/B3Compilation.h.

(JSC::Compilation::code const):
(JSC::Compilation::codeRef const):

• jit/JITOpaqueByproduct.h: Renamed from Source/JavaScriptCore/b3/B3OpaqueByproduct.h.
• jit/JITOpaqueByproducts.cpp: Renamed from Source/JavaScriptCore/b3/B3OpaqueByproducts.cpp.
• jit/JITOpaqueByproducts.h: Renamed from Source/JavaScriptCore/b3/B3OpaqueByproducts.h.
• runtime/JSCPtrTag.h: rename B3CompilationPtrTag to JITCompilationPtrTag.
• wasm/WasmB3IRGenerator.h: use JSC::OpaqueByproducts.
• wasm/WasmBBQPlan.cpp: use JSC::Compilation.

(JSC::Wasm::BBQPlan::work):
(JSC::Wasm::BBQPlan::didCompleteCompilation):

• wasm/WasmBinding.h: change includes.
• wasm/WasmCallee.h: ditto.
• wasm/WasmFormat.h: use JSC::Compilation.
• wasm/WasmLLIntPlan.cpp: ditto.

(JSC::Wasm::LLIntPlan::didCompleteCompilation):

• wasm/WasmLLIntPlan.h: use JITCompilationPtrTag.
• wasm/WasmModule.h: ditto.
• wasm/WasmOMGForOSREntryPlan.cpp: use JSC::Compilation.

(JSC::Wasm::OMGForOSREntryPlan::work):

• wasm/WasmOMGPlan.cpp: ditto.

(JSC::Wasm::OMGPlan::work):

• wasm/WasmParser.h: change includes.
• wasm/js/WasmToJS.h: ditto.

4:14 PM Changeset in webkit [271593] by Fujii Hironori

• 5 edits in trunk

[Win][DumpRenderTree] ASSERT(!m_channel) failed in WebSocket::contextDestroyed
​https://bugs.webkit.org/show_bug.cgi?id=220450

Reviewed by Per Arne Vollan.

Tools:

WebSocket::failAsynchronously() posts a deferred task calling
WebSocket::stop() by using callOnMainThread, but the task was not
executed soon because DumpRenderTree stopped running the run loop
after finishing the test.

DumpRenderTree's run loop should dispatch all deferred tasks
before finishing the current test. Deffer setting the variable
'done' by posting a application message.

• DumpRenderTree/win/DumpRenderTree.cpp: Define a application message WM_DRT_TEST_DONE.

(DumpRenderTreeWndProc): Set 'done' in the case of WM_DRT_TEST_DONE.
(dump): Post WM_DRT_TEST_DONE.

LayoutTests:

• platform/win/TestExpectations: Marked fast/events/currentTarget-gc-crash.html.
• platform/wincairo-wk1/TestExpectations: Ditto.

4:07 PM Changeset in webkit [271592] by ysuzuki@apple.com

• 4 edits
  2 adds in trunk

[JSC] earlyReturnFromInfiniteLoopsLimit should check all caller functions when emitting
​https://bugs.webkit.org/show_bug.cgi?id=220700
<rdar://problem/71229150>

Reviewed by Mark Lam.

JSTests:

• stress/early-return-from-builtin.js: Added.

(let.o.get value):
(let.iter.Symbol.iterator):

• stress/early-return-from-builtin2.js: Added.

(foo):

Source/JavaScriptCore:

earlyReturnFromInfiniteLoopsLimit does not return when the function is builtin. But this does not consider about the case that
the caller is inlining and the caller is builtin. Since this returns from entire DFG / FTL functions, we should check any of
callers are not builtin functions too.

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileLoopHint):

4:06 PM Changeset in webkit [271591] by ysuzuki@apple.com

• 1 edit
  1 add in trunk/JSTests

[JSC] Add another tests for r271571 part 2
​https://bugs.webkit.org/show_bug.cgi?id=220702
<rdar://problem/71365255>

Reviewed by Mark Lam.

This patch adds yet another test for r271571.

• stress/ftl-osr-entry-order-reverse3.js: Added.

(foo.bar):
(foo):

4:04 PM Changeset in webkit [271590] by ysuzuki@apple.com

• 1 edit
  1 add in trunk/JSTests

[JSC] Add another tests for r271571
​https://bugs.webkit.org/show_bug.cgi?id=220701
<rdar://problem/72464341>

Reviewed by Mark Lam.

This patch adds another test for r271571 "[JSC] FTL OSR entry FlushFormat array is reversed".

• stress/ftl-osr-entry-order-reverse2.js: Added.

(foo):

4:03 PM Changeset in webkit [271589] by Andres Gonzalez

• 2 edits in trunk/Source/WebCore

Apple Mail AX, VoiceOver: When composing a new email message, moving VO focus to the message body field does not bring keyboard focus along.
​https://bugs.webkit.org/show_bug.cgi?id=220672
<rdar://problem/73045466>

Reviewed by Darin Adler.

The call to AccessibilityObject::setFocused to set the focus to the
scroll view needs to happen before the check for canSetFocusAttribute.

• accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::setFocused):

4:00 PM Changeset in webkit [271588] by ysuzuki@apple.com

• 1 edit
  1 add in trunk/JSTests

[JSC] Add another tests for r271571 part 3
​https://bugs.webkit.org/show_bug.cgi?id=220703
<rdar://problem/71224976>

Reviewed by Mark Lam.

This patch adds yet another test for r271571.

• stress/ftl-osr-entry-order-reverse4.js: Added.

(foo):

3:54 PM Changeset in webkit [271587] by Andres Gonzalez

• 9 edits
  1 delete in trunk

Fix for LayoutTests/accessibility/canvas-fallback-content.html in isolated tree mode.
​https://bugs.webkit.org/show_bug.cgi?id=220644

Reviewed by Chris Fleizach.

Source/WebCore:

Tests:
accessibility/canvas-fallback-content.html
accessibility/canvas-fallback-content-2.html

• Updates the accessibility isolated tree when the ARIA role attribute

changes for a DOM element.

• Modified tests to use Promises and retrieve accessible elements by IDs

so that they work in both isolated tree mode on and off.

• accessibility/AXLogger.cpp:

(WebCore::operator<<): Added new value to the AXNotification enum.

• accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::handleAriaRoleChanged):
Updates the isolated tree when an ARIA role attribute changes.
(WebCore::AXObjectCache::updateIsolatedTree):
Handles the AXAriaRoleChanged notification.

• accessibility/AXObjectCache.h:

LayoutTests:

• accessibility/canvas-fallback-content-2-expected.txt:

Removed the checks for the document.activeElement since the goal here is
not to test this method.

• accessibility/canvas-fallback-content-2.html:

Retrieved the accessibility Objects by ID directly from the accessibilityController.
This simplifies the code since it is not necessary to set focus to the
object via the document, to then retrieve the focused accessibility element.
This works for isolated tree mode on and off.

• accessibility/canvas-fallback-content.html:

Kept the focus manipulations but used Promises to make it work in both
isolated mode on and off.

• platform/win/accessibility/canvas-fallback-content-expected.txt: Deleted.
• platform/win/TestExpectations: Skip since this test was already failing in win.

1:49 PM Changeset in webkit [271586] by mark.lam@apple.com

• 2 edits in trunk/Source/JavaScriptCore

[AppleWin 32bit] LLInt C Loop: LowLevelInterpreter.cpp(90,7): error C2653: 'WebConfig': is not a class or namespace name
​https://bugs.webkit.org/show_bug.cgi?id=220405

Reviewed by Fujii Hironori.

Add a missing #if ENABLE(UNIFIED_AND_FREEZABLE_CONFIG_RECORD).

• llint/LowLevelInterpreter.cpp:

1:11 PM Changeset in webkit [271585] by Nikolas Zimmermann

• 9 edits in trunk/Source

Remove recently added glue code: RenderLayer::(setAdjustForIOSCaretWhenScrolling / setScrollShouldClearLatchedState / setConstrainsScrollingToContentEdge)
​https://bugs.webkit.org/show_bug.cgi?id=220708

Reviewed by Adrian Perez de Castro.

Follow-up on patch adressing the removal of the glue code that
forwards calls from RenderLayer to RenderLayerScrollableArea (see
webkit.org/b/60305).

Covered by existing tests.

Source/WebCore:

• dom/Element.cpp:

(WebCore::Element::setScrollLeft):
(WebCore::Element::setScrollTop):

• editing/FrameSelection.cpp:

(WebCore::FrameSelection::revealSelection):

• rendering/RenderLayer.cpp:

(WebCore::RenderLayer::scroll):
(WebCore::RenderLayer::setAdjustForIOSCaretWhenScrolling): Deleted.
(WebCore::RenderLayer::setScrollShouldClearLatchedState): Deleted.
(WebCore::RenderLayer::setConstrainsScrollingToContentEdge): Deleted.

• rendering/RenderLayer.h:
• rendering/RenderMarquee.cpp:

(WebCore::RenderMarquee::RenderMarquee):

Source/WebKitLegacy/mac:

• DOM/DOMHTML.mm:

(-[DOMHTMLElement setScrollXOffset:scrollYOffset:adjustForIOSCaret:]):

• WebView/WebFrame.mm:

(-[WebFrame _scrollDOMRangeToVisible:]):
(-[WebFrame _scrollDOMRangeToVisible:withInset:]):

12:26 PM Changeset in webkit [271584] by Antti Koivisto

• 12 edits in trunk/Source/WebCore

Optimize :hover/:active style invalidation for deep trees and descendant selectors
​https://bugs.webkit.org/show_bug.cgi?id=220711

Reviewed by Zalan Bujtas.

Hover and active states are flipped for the entire ancestor chain. We compute invalidation for each flipped
element separately. If the selectors are of form ':active .descendant' then each of these invalidations needs
to traverse the whole subtree, leading to O(n^{2) behavior.}

We really only need to traverse the descendants once, starting from the element closest to the root that changes state.

• dom/Document.cpp:

(WebCore::Document::updateHoverActiveState):

Compute the change root and pass the information to setActive/Hover.
Reorganize the function a bit to allow this, and for general readability.

• dom/Element.cpp:

(WebCore::Element::setActive):
(WebCore::Element::setHovered):

• dom/Element.h:
• html/HTMLAnchorElement.cpp:

(WebCore::HTMLAnchorElement::setActive):

• html/HTMLAnchorElement.h:
• html/HTMLLabelElement.cpp:

(WebCore::HTMLLabelElement::setActive):
(WebCore::HTMLLabelElement::setHovered):

• html/HTMLLabelElement.h:
• html/shadow/SpinButtonElement.cpp:

(WebCore::SpinButtonElement::setHovered):

• html/shadow/SpinButtonElement.h:
• style/PseudoClassChangeInvalidation.cpp:

(WebCore::Style::PseudoClassChangeInvalidation::computeInvalidation):

Only include descendant traversing rulesets for the change root.

• style/PseudoClassChangeInvalidation.h:

(WebCore::Style::PseudoClassChangeInvalidation::PseudoClassChangeInvalidation):

12:13 PM Changeset in webkit [271583] by Fujii Hironori

• 4 edits
  2 adds in trunk

createImageBitmap() causes null pointer dereference using Cairo lib
​https://bugs.webkit.org/show_bug.cgi?id=220584

Reviewed by Carlos Garcia Campos.

Source/WebCore:

createImageBitmap(ImageData) creates an internal ImageBuffer with
the same size of the given ImageData. Cairo port has the
limitation to maximum width/height of ImageBuffer as 32768. It
fails to create the internal ImageBuffer if the ImageData size is
greater than 32768. Added a null-checking for the case.

Test: fast/images/createImageBitmap-with-ImageData.html

• html/ImageBitmap.cpp:

(WebCore::ImageBitmap::createPromise): Added a null-checking for
tempBitmapData. Call resolveWithBlankImageBuffer in the case.

• platform/graphics/cairo/ImageBufferCairoImageSurfaceBackend.cpp:

(WebCore::ImageBufferCairoImageSurfaceBackend::create): Check the
cairo_surface_status of 'surface' to avoid the assertion failure
in ImageBufferCairoImageSurfaceBackend ctor.

LayoutTests:

• fast/images/createImageBitmap-with-ImageData-expected.txt: Added.
• fast/images/createImageBitmap-with-ImageData.html: Added.

11:41 AM Changeset in webkit [271582] by Alan Bujtas

• 2 edits in trunk/Source/WebCore

[LFC][Integration] Disable inline boxes with outline
​https://bugs.webkit.org/show_bug.cgi?id=220698

Reviewed by Antti Koivisto.

• layout/integration/LayoutIntegrationCoverage.cpp:

(WebCore::LayoutIntegration::canUseForChild):

11:40 AM Changeset in webkit [271581] by Alan Bujtas

• 2 edits in trunk/Source/WebCore

[LFC][Integration] Disable inflow positioned inline boxes
​https://bugs.webkit.org/show_bug.cgi?id=220696

Reviewed by Antti Koivisto.

• layout/integration/LayoutIntegrationCoverage.cpp:

(WebCore::LayoutIntegration::canUseForChild):

8:09 AM WebKitGTK/2.30.x edited by Michael Catanzaro

(diff)

7:56 AM Changeset in webkit [271580] by commit-queue@webkit.org

• 4 edits in trunk/Source

[GTK] Multilib conflicts in gir files
​https://bugs.webkit.org/show_bug.cgi?id=220636

Patch by Michael Catanzaro <Michael Catanzaro> on 2021-01-18
Reviewed by Carlos Garcia Campos.

Source/JavaScriptCore:

• PlatformGTK.cmake:

Source/WebKit:

By passing --sources-top-dirs to g-ir-scanner, we ensure all paths in the generated gir
files are relative to the toplevel builddir. This avoids multilib conflicts when the
builddir contains the target architecture.

• PlatformGTK.cmake:

5:16 AM Changeset in webkit [271579] by youenn@apple.com

• 2 edits in trunk/LayoutTests

[ Mac WK1 ] REGRESSION (r239145) Layout Test http/wpt/mediarecorder/MediaRecorder-dataavailable.html is flaky text diff failure
​https://bugs.webkit.org/show_bug.cgi?id=194779
<rdar://problem/48166474>

Tests are no longer flaky no webkit bots.
Unreviewed.

• platform/ios/TestExpectations:

3:24 AM Changeset in webkit [271578] by Lauro Moura

• 5 edits in trunk/Tools

[WPE] Fix WPEQt tests after r271514
​https://bugs.webkit.org/show_bug.cgi?id=220681

Reviewed by Carlos Garcia Campos.

Setting the title became async, so we must wait for it to be
processed.

• TestWebKitAPI/Tests/WPEQt/TestLoad.cpp:

(TestLoad::main):

• TestWebKitAPI/Tests/WPEQt/TestLoadHtml.cpp:

(TestLoadHtml::main):

• TestWebKitAPI/Tests/WPEQt/TestLoadRequest.cpp:

(TestLoadRequest::main):

• TestWebKitAPI/Tests/WPEQt/TestRunJavaScript.cpp:

(TestRunJavaScript::main):

2:29 AM Changeset in webkit [271577] by Nikolas Zimmermann

• 7 edits in trunk/Source

Remove recently added glue code: RenderLayer::(scrollToOffset / scrollToXOffset / scrollToYOffset)
​https://bugs.webkit.org/show_bug.cgi?id=220705

Reviewed by Adrian Perez de Castro.

Follow-up on patch adressing the removal of the glue code that
forwards calls from RenderLayer to RenderLayerScrollableArea (see
webkit.org/b/60305).

Covered by existing tests.

Source/WebCore:

• accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::scrollTo const):

• rendering/RenderLayer.cpp:

(WebCore::RenderLayer::scrollToOffset): Deleted.

• rendering/RenderLayer.h:

(WebCore::RenderLayer::scrollToXOffset): Deleted.
(WebCore::RenderLayer::scrollToYOffset): Deleted.

• rendering/RenderMarquee.cpp:

(WebCore::RenderMarquee::start):
(WebCore::RenderMarquee::timerFired):

Source/WebKitLegacy/mac:

• DOM/DOMHTML.mm:

(-[DOMHTMLElement setScrollXOffset:scrollYOffset:adjustForIOSCaret:]):

2:24 AM Changeset in webkit [271576] by magomez@igalia.com

• 2 edits in trunk/Source/WebCore

[WPE][GTK] Mark that the AminatedBackingStoreClient has changed only when layer requires it
​https://bugs.webkit.org/show_bug.cgi?id=220590

Reviewed by Philippe Normand.

Mark AnimatedBackingStoreClient instance as changed when it really has changed. When the layer
doesn't require a client, make it nullptr and don't modify it anymore.

• platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:

(WebCore::CoordinatedGraphicsLayer::flushCompositingStateForThisLayerOnly):

12:40 AM Changeset in webkit [271575] by youenn@apple.com

• 9 edits in trunk

WebRTC live Opus audio stream stutters
​https://bugs.webkit.org/show_bug.cgi?id=220599
<rdar://problem/73190139>

Reviewed by Darin Adler.

Source/WebCore:

Before the patch, the MediaStreamTrack was owning its audio source provider.
Two MediaStreamAudioSourceNode reading the same track would read on the same provider buffer.
Instead, create a provider for each node.

Covered by updated test.

• Modules/mediastream/MediaStreamTrack.cpp:

(WebCore::MediaStreamTrack::createAudioSourceProvider):

• Modules/mediastream/MediaStreamTrack.h:
• Modules/webaudio/MediaStreamAudioSourceNode.cpp:

(WebCore::MediaStreamAudioSourceNode::create):
(WebCore::MediaStreamAudioSourceNode::MediaStreamAudioSourceNode):
(WebCore::MediaStreamAudioSourceNode::~MediaStreamAudioSourceNode):
(WebCore::MediaStreamAudioSourceNode::provideInput):

• Modules/webaudio/MediaStreamAudioSourceNode.h:
• platform/mediastream/MediaStreamTrackPrivate.cpp:

(WebCore::MediaStreamTrackPrivate::createAudioSourceProvider):

• platform/mediastream/MediaStreamTrackPrivate.h:

LayoutTests:

Add media stream source nodes to ensure that concurrent reading is not an issue anymore.

• fast/mediastream/mock-media-source-webaudio.html:

12:40 AM Changeset in webkit [271574] by ysuzuki@apple.com

• 3 edits
  1 add in trunk

[JSC] callerIsOMGCompiled should be robust
​https://bugs.webkit.org/show_bug.cgi?id=220697

Reviewed by Mark Lam.

JSTests:

• stress/callerIsOMGCompiled-should-be-robust.js: Added.

Source/JavaScriptCore:

This function did not work if this function is called from microtask / unhandled rejection since there is no caller frame.
This patch makes this function more robust against such usage.

• jsc.cpp:

(JSC_DEFINE_HOST_FUNCTION):

Jan 17, 2021:

11:56 PM Changeset in webkit [271573] by ysuzuki@apple.com

• 4 edits
  1 add in trunk

[JSC] DFG/FTL Atomics should not accept Float32/Float64 typed arrays
​https://bugs.webkit.org/show_bug.cgi?id=220692
<rdar://problem/73238369>

Reviewed by Mark Lam.

JSTests:

• stress/atomics-float-edge.js: Added.

(foo):

Source/JavaScriptCore:

We accidentally accept Float32/Float64 typed arrays. We should accept only integer TypedArrays (Int8, Uint8, ... etc.)
as specified in [1]. If the other types come, we just make it Array::Generic and call slow path which can handle them.

[1]: ​https://tc39.es/ecma262/#sec-validateintegertypedarray

• dfg/DFGArrayMode.h:

(JSC::DFG::ArrayMode::isOneOfTypedArrayView const): Deleted.

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

11:41 PM Changeset in webkit [271572] by commit-queue@webkit.org

• 3 edits in trunk/Source/WebCore

GraphicsContextGLOpenGL::reshapeFBOs() ANGLE variant calls into makeContextCurrent()
​https://bugs.webkit.org/show_bug.cgi?id=220460

Patch by Kimmo Kinnunen <​kkinnunen@apple.com> on 2021-01-17
Reviewed by Dean Jackson.

The call is problematic if it is taken, since in some cases makeContextCurrent() fails
due to reshapeFBOs being in middle of a reshape. The problematic case is taken if
the reshape call happens before first getExtensions().

Fix by
1) Resolving the needed depth-stencil buffer format during validateDepthStencil.
2) Always enable the packed depth-stencil extension if it is present. Otherwise

depth-stencil bindings will not work for the context that does not have
default stencil buffer, since the enable call was not taken before
WebGLRenderingContextBase uses the "isEnabled" to enable DEPTH_STENCIL
features.

Tested by WebGL 1/2 conformance tests, but only reveals the bug after
applying the patch in the depending bug.

• platform/graphics/angle/GraphicsContextGLANGLE.cpp:

(WebCore::GraphicsContextGLOpenGL::validateAttributes):
(WebCore::GraphicsContextGLOpenGL::reshapeFBOs):
(WebCore::GraphicsContextGLOpenGL::validateDepthStencil):

• platform/graphics/opengl/GraphicsContextGLOpenGL.h:

11:16 PM Changeset in webkit [271571] by ysuzuki@apple.com

• 3 edits
  1 add in trunk

[JSC] FTL OSR entry FlushFormat array is reversed
​https://bugs.webkit.org/show_bug.cgi?id=220695
<rdar://problem/72930932>

Reviewed by Mark Lam.

JSTests:

• stress/ftl-osr-entry-order-reverse.js: Added.

(shouldThrow):
(foo):

Source/JavaScriptCore:

After r268783, FlushFormat array is erroneously sorted in reversed order.
This patch fixes that.

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):

10:36 PM Changeset in webkit [271570] by ysuzuki@apple.com

• 3 edits
  1 add in trunk

[JSC] GenericArguments<Type>::defineOwnProperty's assumption about error is not correct
​https://bugs.webkit.org/show_bug.cgi?id=220693
<rdar://problem/72929171>

Reviewed by Mark Lam.

JSTests:

• stress/freeze-invokes-out-of-memory.js: Added.

(shouldThrow):

Source/JavaScriptCore:

Any function taking JSGlobalObject* can cause out-of-memory error potentially. And we have a way to invoke it.
But GenericArguments<Type>::defineOwnProperty didn't assume OutOfMemory error. This patch fixes it.

• runtime/GenericArgumentsInlines.h:

(JSC::GenericArguments<Type>::defineOwnProperty):

10:25 PM Changeset in webkit [271569] by Jonathan Bedard

• 2 edits in trunk/Tools

[webkitscmpy] Add GitHub credentials (Follow-up fix)
​https://bugs.webkit.org/show_bug.cgi?id=220562
<rdar://problem/73063457>

Unreviewed follow-up fix.

• Scripts/webkitpy/init.py: Ensure that webkitscmpy's dependencies are auto installed.

10:03 PM Changeset in webkit [271568] by ysuzuki@apple.com

• 3 edits
  2 adds in trunk

[JSC] Add some more exception checks in globalFuncCopyDataProperties
​https://bugs.webkit.org/show_bug.cgi?id=220691

Reviewed by Mark Lam.

JSTests:

• stress/spread-object-check.js: Added.
• stress/spread-object-check2.js: Added.

Source/JavaScriptCore:

This patch add some missing exception checks in globalFuncCopyDataProperties to fix tests attached in this patch.

• runtime/JSGlobalObjectFunctions.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

8:09 PM Changeset in webkit [271567] by Alan Bujtas

• 3 edits in trunk/Source/WebCore

[LFC][IFC] Extend simplified vertical alignment for cases when the line has only "empty" runs
​https://bugs.webkit.org/show_bug.cgi?id=220689

Reviewed by Antti Koivisto.

Quirks::inlineLevelBoxAffectsLineBox now does not need to check for empty inline boxes as
those cases would always end up in the simplified vertical alignment path.

• layout/inlineformatting/InlineFormattingContextGeometry.cpp:

(WebCore::Layout::LineBoxBuilder::constructInlineLevelBoxes):

• layout/inlineformatting/InlineFormattingContextQuirks.cpp:

(WebCore::Layout::InlineFormattingContext::Quirks::inlineLevelBoxAffectsLineBox const):

4:06 PM Changeset in webkit [271566] by Alan Bujtas

• 2 edits in trunk/Source/WebCore

[LFC][IFC] Add the root inline collapsing case to simplified vertical alignment
​https://bugs.webkit.org/show_bug.cgi?id=220685

Reviewed by Antti Koivisto.

Let's produce a 0 height line box when there are no runs on the line as part of the simplified vertical alignment optimization.

• layout/inlineformatting/InlineFormattingContextGeometry.cpp:

(WebCore::Layout::LineBoxBuilder::constructInlineLevelBoxes):

3:51 PM Changeset in webkit [271565] by ysuzuki@apple.com

• 6 edits
  1 delete in trunk/Source/WebKit

JITOperation does not exist in WebKit
​https://bugs.webkit.org/show_bug.cgi?id=220686

Reviewed by Mark Lam.

Now, we do not register host functions as JIT operations. As a result, WebKit.framework does not have any JITOperations.
We should remove population of JITOperations code in WebKit.framework.

• Shared/API/c/WKString.cpp:

(WKStringCopyJSString):

• Shared/Cocoa/WebKit2InitializeCocoa.mm:

(WebKit::runInitializationCode):

• Shared/WebKit2Initialize.cpp:

(WebKit::InitializeWebKit2):

• Shared/WebKitJITOperations.cpp: Removed.
• Sources.txt:
• WebKit.xcodeproj/project.pbxproj:

1:06 PM Changeset in webkit [271564] by Wenson Hsieh

• 3 edits in trunk/Source/WebCore

Unreviewed, fix the internal iOS build after r271559

Fix the build with IOS_TOUCH_EVENTS enabled.

• rendering/RenderLayer.cpp:

(WebCore::RenderLayer::handleTouchEvent): Deleted.
(WebCore::RenderLayer::registerAsTouchEventListenerForScrolling): Deleted.
(WebCore::RenderLayer::unregisterAsTouchEventListenerForScrolling): Deleted.

Remove a few undeclared method definitions. These methods were relocated to RenderLayerScrollableArea.

• rendering/RenderLayerScrollableArea.cpp:

Remove several methods that have duplicate implementations.

11:55 AM Changeset in webkit [271563] by Fujii Hironori

• 13 edits in trunk/Source/WebKit

[non-Cocoa] Add a new AuxiliaryProcessMainBase class for auxiliary processes without singleton()
​https://bugs.webkit.org/show_bug.cgi?id=220615

Reviewed by Don Olmstead.

non-Cocoa ports auxiliary processes are using AuxiliaryProcessMain
as the entry points. AuxiliaryProcessMain supports both kinds of
auxiliary processes with and without singleton() method by using
initializeAuxiliaryProcess template function. However, all
initializeAuxiliaryProcess look similar code. They can share more
code.

Added a AuxiliaryProcessMainBaseNoSingleton template class for
auxiliary processes without singleton().

Moved the code that was in AuxiliaryProcessMain to
AuxiliaryProcessMainBase::run() to remove
takeInitializationParameters().

• GPUProcess/gstreamer/GPUProcessMainGStreamer.cpp:

(WebKit::GPUProcessMain):
(WebKit::initializeAuxiliaryProcess<GPUProcess>): Deleted.

• GPUProcess/playstation/GPUProcessMainPlayStation.cpp:

(WebKit::GPUProcessMain):
(WebKit::initializeAuxiliaryProcess<GPUProcess>): Deleted.

• GPUProcess/win/GPUProcessMainWin.cpp:

(WebKit::GPUProcessMain):
(WebKit::initializeAuxiliaryProcess<GPUProcess>): Deleted.

• NetworkProcess/curl/NetworkProcessMainCurl.cpp:

(WebKit::NetworkProcessMain):
(WebKit::initializeAuxiliaryProcess<NetworkProcess>): Deleted.

• NetworkProcess/soup/NetworkProcessMainSoup.cpp:

(WebKit::NetworkProcessMain):
(WebKit::initializeAuxiliaryProcess<NetworkProcess>): Deleted.

• Shared/AuxiliaryProcessMain.h:

(WebKit::AuxiliaryProcessMainBase::platformInitialize):
(WebKit::AuxiliaryProcessMainBase::platformFinalize):
(WebKit::AuxiliaryProcessMainBase::initializeAuxiliaryProcess):
(WebKit::AuxiliaryProcessMainBase::run):
(WebKit::AuxiliaryProcessMainBaseNoSingleton::process):
(WebKit::AuxiliaryProcessMain):
(WebKit::AuxiliaryProcessMainBase::initializationParameters): Deleted.
(WebKit::AuxiliaryProcessMainBase::takeInitializationParameters): Deleted.
(WebKit::initializeAuxiliaryProcess): Deleted.

• Shared/unix/AuxiliaryProcessMain.cpp:

(WebKit::AuxiliaryProcessMainCommon::parseCommandLine):
(WebKit::AuxiliaryProcessMainBase::parseCommandLine): Deleted.

• Shared/win/AuxiliaryProcessMainWin.cpp:

(WebKit::AuxiliaryProcessMainCommon::parseCommandLine):
(WebKit::AuxiliaryProcessMainBase::parseCommandLine): Deleted.

• WebProcess/gtk/WebProcessMainGtk.cpp:

(WebKit::WebProcessMain):

• WebProcess/playstation/WebProcessMainPlayStation.cpp:

(WebKit::WebProcessMain):

• WebProcess/win/WebProcessMainWin.cpp:

(WebKit::WebProcessMain):

• WebProcess/wpe/WebProcessMainWPE.cpp:

(WebKit::WebProcessMain):

6:44 AM Changeset in webkit [271562] by Alan Bujtas

• 7 edits in trunk/Source/WebCore

[LFC][IFC] No need to maintain the "is considered empty" bit anymore.
​https://bugs.webkit.org/show_bug.cgi?id=220228

Reviewed by Antti Koivisto.

Now that isConsideredEmpty() bit is only used as input to line breaking, let's change it to a more
focused check and remove the concept of "is considered empty" completely.

• layout/inlineformatting/InlineContentBreaker.cpp:

(WebCore::Layout::InlineContentBreaker::processInlineContent):
(WebCore::Layout::InlineContentBreaker::processOverflowingContent const):

• layout/inlineformatting/InlineContentBreaker.h:
• layout/inlineformatting/InlineLine.cpp:

(WebCore::Layout::Line::initialize):
(WebCore::Layout::Line::removeTrailingTrimmableContent):
(WebCore::Layout::Line::append):
(WebCore::Layout::Line::appendTextContent):

• layout/inlineformatting/InlineLine.h:

(WebCore::Layout::Line::isConsideredEmpty const): Deleted.

• layout/inlineformatting/InlineLineBuilder.cpp:

(WebCore::Layout::LineBuilder::close):
(WebCore::Layout::LineBuilder::handleInlineContent):

4:36 AM Changeset in webkit [271561] by youenn@apple.com

• 2 edits in trunk/Source/WebKit

Add CoreMedia aavds entitlement to WebContent and GPU processes
​https://bugs.webkit.org/show_bug.cgi?id=220238

Reviewed by Brent Fulgham.

Manually tested.

• Scripts/process-entitlements.sh:

12:50 AM Changeset in webkit [271560] by ysuzuki@apple.com

• 9 edits in trunk/Source

Add JSC API configuring GC signals in Linux
​https://bugs.webkit.org/show_bug.cgi?id=220641

Reviewed by Mark Lam.

Source/JavaScriptCore:

Add JSConfigureSignalForGC function for Linux and FreeBSD (non Apple, non Windows platforms).

• API/JSBase.cpp:

(JSConfigureSignalForGC):

• API/JSBasePrivate.h:

Source/WTF:

In Linux and FreeBSD, we need to use signals to suspend and resume threads.
By default, we are using SIGUSR1, but it is possible that some embedders want to use
the other signals since they are using SIGUSR1 already. To work-around that, this
patch offers the way for embedders to configure signals.

• wtf/Threading.h:
• wtf/WTFConfig.h:
• wtf/posix/ThreadingPOSIX.cpp:

(WTF::Thread::signalHandlerSuspendResume):
(WTF::Thread::initializePlatformThreading):
(WTF::Thread::initializeCurrentThreadEvenIfNonWTFCreated):
(WTF::Thread::initializeCurrentTLS):
(WTF::Thread::suspend):
(WTF::Thread::resume):

• wtf/threads/Signals.cpp:

(WTF::addSignalHandler):

• wtf/win/ThreadingWin.cpp:

(WTF::Thread::initializeCurrentTLS):