Context Navigation

← Previous Period
Next Period →

Timeline

Jan 23, 2021:

2:11 PM Changeset in webkit [271781] by ysuzuki@apple.com

7 edits in trunk/Source/JavaScriptCore

[JSC] DeferredWorkTimer should clear pending task after running
https://bugs.webkit.org/show_bug.cgi?id=220888

Reviewed by Mark Lam.

Wasm code assumes that scheduleWorkSoon clears pending dependencies. But DeferredWorkTimer is not clearing it, and instead, FinalizationRegistry etc. is clearing
it explicitly. This semantics is problematic. We are putting cancelPendingWork in JSPromise::resolve / JSPromise::reject. But they do not work since this is C++
version of them, and JSPromise has JS version of them. And if JS version is called, cancelPendingWork is not called. And we do not want to complicate JSPromise's
reject / resolve path since this is super hot, and we should keep them in JS.
Instead, we should always clear pending task if it is called.

jsc.cpp:

(JSC_DEFINE_HOST_FUNCTION):

runtime/DeferredWorkTimer.cpp:

(JSC::DeferredWorkTimer::doWork):

runtime/DeferredWorkTimer.h:
runtime/JSFinalizationRegistry.cpp:

(JSC::JSFinalizationRegistry::finalizeUnconditionally):

runtime/JSPromise.cpp:

(JSC::JSPromise::resolve): Remove this work-around, and instead, we must call scheduleWorkSoon if addPendingWork is called.
(JSC::JSPromise::reject): Ditto.

wasm/js/JSWebAssembly.cpp:

(JSC::JSWebAssembly::webAssemblyModuleValidateAsync):
(JSC::instantiate): Use instance for Ticket instead of promise to disambiguate the ticket scheduling from compileAndInstantiate's one easily.
(JSC::compileAndInstantiate): There are path that we do not call scheduleWorkSoon while we call addPendingWork, this is wrong, and JSPromise's workaround is added to
alleviate this situation. We should not do that: we must call scheduleWorkSoon at some point if addPendingWork is called.
(JSC::JSWebAssembly::webAssemblyModuleInstantinateAsync):

2:08 PM Changeset in webkit [271780] by pvollan@apple.com

7 edits in trunk

[macOS] Deny mach lookup access to "com.apple.iconservices" in the WebContent process
https://bugs.webkit.org/show_bug.cgi?id=220013
<rdar://problem/60649036>

Reviewed by Brent Fulgham.

Source/WebKit:

Deny mach lookup access to "com.apple.iconservices" in the WebContent process on macOS,
since there are no longer any reports of this being used.

Test: fast/sandbox/mac/sandbox-mach-lookup.html

WebProcess/com.apple.WebProcess.sb.in:

LayoutTests:

fast/sandbox/mac/sandbox-mach-lookup-expected.txt:
fast/sandbox/mac/sandbox-mach-lookup.html:
platform/mac-catalina/fast/sandbox/mac/sandbox-mach-lookup-expected.txt:
platform/mac-mojave/fast/sandbox/mac/sandbox-mach-lookup-expected.txt:

12:31 PM Changeset in webkit [271779] by eric.carlson@apple.com

4 edits
2 adds in trunk

[iOS] Set background playback restriction for WebAudio
https://bugs.webkit.org/show_bug.cgi?id=220879
<rdar://72949281>

Reviewed by Jer Noble.
Source/WebCore:

WebAudio does not play in the background on iOS both because audio doesn't play
when the category is set to AVAudioSessionCategoryAmbient, and because the
AudioContext is paused when the web process is forwarded the
UIApplicationWillResignActiveNotification notification.

This notification isn't forwarded when the WebView is hosted in SafariViewController
so the AudioContext is not paused, so it resumes playing when the application is
foregrounded even if the view controller is not in the foreground.

Fix this by setting the BackgroundProcessPlaybackRestricted restriction for
WebAudio sessions so the context is always paused in the background.

Test: media/webaudio-background-playback.html

platform/audio/ios/MediaSessionManagerIOS.mm:

(WebCore::MediaSessionManageriOS::resetRestrictions):

LayoutTests:

media/media-session-restrictions-expected.txt: Update expectations.
media/webaudio-background-playback-expected.txt: Added.
media/webaudio-background-playback.html: Added.

7:35 AM Changeset in webkit [271778] by pvollan@apple.com

7 edits in trunk

Source/WebKit:
[macOS] Deny mach lookup access to "com.apple.iconservices.store" in the WebContent process
https://bugs.webkit.org/show_bug.cgi?id=220014
<rdar://problem/68923110>

Reviewed by Brent Fulgham.

Deny mach lookup access to "com.apple.iconservices.store" in the WebContent process on macOS,
since there are no longer any reports of this being used.

Test: fast/sandbox/mac/sandbox-mach-lookup.html

WebProcess/com.apple.WebProcess.sb.in:

LayoutTests:
[macOS] Deny mach-lookup to the service 'com.apple.iconservices.store' in the WebContent process
https://bugs.webkit.org/show_bug.cgi?id=220014
<rdar://problem/68923110>

Reviewed by Brent Fulgham.

fast/sandbox/mac/sandbox-mach-lookup-expected.txt:
fast/sandbox/mac/sandbox-mach-lookup.html:
platform/mac-catalina/fast/sandbox/mac/sandbox-mach-lookup-expected.txt:
platform/mac-mojave/fast/sandbox/mac/sandbox-mach-lookup-expected.txt:

7:30 AM Changeset in webkit [271777] by pvollan@apple.com

7 edits in trunk

[macOS] Deny mach-lookup to the service 'com.apple.hiservices-xpcservice' in the WebContent process
https://bugs.webkit.org/show_bug.cgi?id=220321
<rdar://problem/68878470>

Reviewed by Darin Adler.

Source/WebKit:

Deny mach-lookup to the service 'com.apple.hiservices-xpcservice' in the WebContent process on macOS,
since there are no longer any reports of this service being used.

Test: fast/sandbox/mac/sandbox-mach-lookup.html

WebProcess/com.apple.WebProcess.sb.in:

LayoutTests:

fast/sandbox/mac/sandbox-mach-lookup-expected.txt:
fast/sandbox/mac/sandbox-mach-lookup.html:
platform/mac-catalina/fast/sandbox/mac/sandbox-mach-lookup-expected.txt:
platform/mac-mojave/fast/sandbox/mac/sandbox-mach-lookup-expected.txt:

6:16 AM Changeset in webkit [271776] by Alan Bujtas

3 edits in trunk/Source/WebCore

[LFC][Integration] Disable inline boxes with layers
https://bugs.webkit.org/show_bug.cgi?id=220891

Reviewed by Antti Koivisto.

layout/integration/LayoutIntegrationCoverage.cpp:

(WebCore::LayoutIntegration::canUseForChild):

rendering/RenderInline.h:

4:32 AM Changeset in webkit [271775] by commit-queue@webkit.org

37 edits in trunk

[JSC] Allow to build WebAssembly without B3
https://bugs.webkit.org/show_bug.cgi?id=220365

Patch by Xan Lopez <Xan Lopez> on 2021-01-23
Reviewed by Yusuke Suzuki.

Make the WebAssembly feature depend on Baseline JIT, not B3
JIT. Also add a WEBASSEMBLY_B3JIT feature to enable or disable the
B3 tier in WebAssembly.

Source/cmake/WebKitFeatures.cmake: disable on 32bit.

Source/JavaScriptCore:

Make all the B3 related code in WebAssembly a compile-time
option. When disabled WebAssembly will only use its LLInt tier.

llint/LLIntOfflineAsmConfig.h: define WEBASSEMBLY_B3JIT for the

offline assembler.

llint/WebAssembly.asm: guard B3 code inside WEBASSEMBLY_B3JTI ifdefs.
wasm/WasmAirIRGenerator.cpp: ditto.
wasm/WasmAirIRGenerator.h: ditto.
wasm/WasmB3IRGenerator.cpp: ditto.
wasm/WasmB3IRGenerator.h: ditto.
wasm/WasmBBQPlan.cpp: ditto.
wasm/WasmBBQPlan.h: ditto.
wasm/WasmCallee.h: ditto.
wasm/WasmCodeBlock.cpp:

(JSC::Wasm::CodeBlock::CodeBlock): ditto.

wasm/WasmCodeBlock.h:

(JSC::Wasm::CodeBlock::wasmEntrypointCalleeFromFunctionIndexSpace): ditto.

wasm/WasmLLIntGenerator.h: ditto.
wasm/WasmLLIntPlan.cpp: ditto.
wasm/WasmOMGForOSREntryPlan.cpp: ditto.
wasm/WasmOMGForOSREntryPlan.h: ditto.
wasm/WasmOMGPlan.cpp: ditto.
wasm/WasmOMGPlan.h: ditto.
wasm/WasmOSREntryData.h: ditto.
wasm/WasmOperations.cpp: ditto.
wasm/WasmOperations.h: ditto.
wasm/WasmPlan.cpp: ditto.
wasm/WasmPlan.h: ditto.
wasm/WasmSlowPaths.cpp: ditto.
wasm/WasmSlowPaths.h: ditto.
wasm/WasmThunks.cpp: ditto.
wasm/WasmThunks.h: ditto.
wasm/WasmTierUpCount.cpp: ditto.
wasm/WasmTierUpCount.h: ditto.
wasm/generateWasmOpsHeader.py: ditto.

Source/WTF:

wtf/PlatformEnable.h: Disable WebAssembly on 32bit platforms,

enable WebAssembly B3JIT on PLATFORM(COCOA).

Tools:

Scripts/webkitperl/FeatureList.pm: add WebAssembly B3 JIT option.

Jan 22, 2021:

8:58 PM Changeset in webkit [271774] by ysuzuki@apple.com

25 edits
27 adds in trunk

Should SharedArrayBuffer/WebAssembly.Memory really throw?
https://bugs.webkit.org/show_bug.cgi?id=220364

Reviewed by Mark Lam.

LayoutTests/imported/w3c:

Update common/sab.js and wasm/.

web-platform-tests/common/sab.js:

(const.createBuffer):

web-platform-tests/wasm/jsapi/META.yml: Added.
web-platform-tests/wasm/jsapi/constructor/instantiate.any-expected.txt:
web-platform-tests/wasm/jsapi/constructor/instantiate.any.worker-expected.txt:
web-platform-tests/wasm/jsapi/global/type.tentative.any-expected.txt: Added.
web-platform-tests/wasm/jsapi/global/type.tentative.any.html: Added.
web-platform-tests/wasm/jsapi/global/type.tentative.any.js: Added.

(assert_type):
(test):
(string_appeared_here.test):

web-platform-tests/wasm/jsapi/global/type.tentative.any.worker-expected.txt: Added.
web-platform-tests/wasm/jsapi/global/type.tentative.any.worker.html: Added.
web-platform-tests/wasm/jsapi/global/w3c-import.log:
web-platform-tests/wasm/jsapi/instance/constructor.any-expected.txt:
web-platform-tests/wasm/jsapi/instance/constructor.any.worker-expected.txt:
web-platform-tests/wasm/jsapi/instanceTestFactory.js:

(const.imports.string_appeared_here.string_appeared_here):
(return.verify):

web-platform-tests/wasm/jsapi/memory/type.tentative.any-expected.txt: Added.
web-platform-tests/wasm/jsapi/memory/type.tentative.any.html: Added.
web-platform-tests/wasm/jsapi/memory/type.tentative.any.js: Added.

(assert_type):
(test):

web-platform-tests/wasm/jsapi/memory/type.tentative.any.worker-expected.txt: Added.
web-platform-tests/wasm/jsapi/memory/type.tentative.any.worker.html: Added.
web-platform-tests/wasm/jsapi/memory/w3c-import.log:
web-platform-tests/wasm/jsapi/module/exports.any-expected.txt:
web-platform-tests/wasm/jsapi/module/exports.any.js:

(test):

web-platform-tests/wasm/jsapi/module/exports.any.worker-expected.txt:
web-platform-tests/wasm/jsapi/module/imports.any-expected.txt:
web-platform-tests/wasm/jsapi/module/imports.any.js:

(test):

web-platform-tests/wasm/jsapi/module/imports.any.worker-expected.txt:
web-platform-tests/wasm/jsapi/table/constructor-reftypes.tentative.any-expected.txt: Added.
web-platform-tests/wasm/jsapi/table/constructor-reftypes.tentative.any.html: Added.
web-platform-tests/wasm/jsapi/table/constructor-reftypes.tentative.any.js: Added.

(test):

web-platform-tests/wasm/jsapi/table/constructor-reftypes.tentative.any.worker-expected.txt: Added.
web-platform-tests/wasm/jsapi/table/constructor-reftypes.tentative.any.worker.html: Added.
web-platform-tests/wasm/jsapi/table/set-reftypes.tentative.any-expected.txt: Added.
web-platform-tests/wasm/jsapi/table/set-reftypes.tentative.any.html: Added.
web-platform-tests/wasm/jsapi/table/set-reftypes.tentative.any.js: Added.

(test):

web-platform-tests/wasm/jsapi/table/set-reftypes.tentative.any.worker-expected.txt: Added.
web-platform-tests/wasm/jsapi/table/set-reftypes.tentative.any.worker.html: Added.
web-platform-tests/wasm/jsapi/table/w3c-import.log:
web-platform-tests/wasm/jsapi/w3c-import.log:
web-platform-tests/wasm/webapi/META.yml: Added.
web-platform-tests/wasm/webapi/instantiateStreaming.any-expected.txt:
web-platform-tests/wasm/webapi/instantiateStreaming.any.worker-expected.txt:
web-platform-tests/wasm/webapi/invalid-code.any-expected.txt:
web-platform-tests/wasm/webapi/invalid-code.any.js:

(string_appeared_here.Invalid.code):

web-platform-tests/wasm/webapi/invalid-code.any.worker-expected.txt:
web-platform-tests/wasm/webapi/modified-contenttype.any-expected.txt: Added.
web-platform-tests/wasm/webapi/modified-contenttype.any.html: Added.
web-platform-tests/wasm/webapi/modified-contenttype.any.js: Added.

(string_appeared_here.forEach.method.promise_test.async t):
(string_appeared_here.forEach.method.with.Content.Type.set late):

web-platform-tests/wasm/webapi/modified-contenttype.any.worker-expected.txt: Added.
web-platform-tests/wasm/webapi/modified-contenttype.any.worker.html: Added.
web-platform-tests/wasm/webapi/w3c-import.log:

Source/JavaScriptCore:

Not accessing "shared" field if Options::useSharedArrayBuffer() is false.

wasm/js/WebAssemblyMemoryConstructor.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

7:55 PM Changeset in webkit [271773] by Alan Bujtas

4 edits in trunk/Source/WebCore

[LFC][RenderTreeDump] Expand RenderInline 0 height quirk logic to previous/next siblings
https://bugs.webkit.org/show_bug.cgi?id=220884

Reviewed by Simon Fraser.

Check the previous/next siblings to see whether we should apply the zero-height quirk on the current RenderInline.
Note that this does not change the RenderInlines' reported height values on trunk.
However it greatly helps to reduce the required rebaseline when LFC's inline box support is enabled (see webkit.org/b/220148).

rendering/RenderInline.cpp:

(WebCore::RenderInline::shouldCreateLineBoxes const):
(WebCore::RenderInline::updateAlwaysCreateLineBoxes):

rendering/RenderInline.h:
rendering/RenderTreeAsText.cpp:

(WebCore::isRenderInlineEmpty):
(WebCore::hasNonEmptySibling):
(WebCore::RenderTreeAsText::writeRenderObject):

6:13 PM Changeset in webkit [271772] by Wenson Hsieh

4 edits in trunk/Source/WebKit

The web process should be killed after failing to decode display list items in the GPU process
https://bugs.webkit.org/show_bug.cgi?id=219097
<rdar://problem/71546526>

Reviewed by Chris Dumez.

Handle StopReplayReason::InvalidItem by terminating the web process via MESSAGE_CHECK. See below for more
details.

GPUProcess/GPUConnectionToWebProcess.cpp:

(WebKit::GPUConnectionToWebProcess::didReceiveInvalidMessage):
(WebKit::GPUConnectionToWebProcess::terminateWebProcess):

GPUProcess/GPUConnectionToWebProcess.h:

Pull logic for terminating the web process out into a separate helper method on GPUConnectionToWebProcess, and
use this helper in GPUConnectionToWebProcess::didReceiveInvalidMessage, as well as in RemoteRenderingBackend
below.

GPUProcess/graphics/RemoteRenderingBackend.cpp:

Add macro definitions for MESSAGE_CHECK and MESSAGE_CHECK_WITH_RETURN_VALUE. Since the methods on
RemoteRenderingBackend that trigger message checks all run on a background queue, the normal (main-thread) way
of defining these macros (MESSAGE_CHECK_WITH_RETURN_VALUE_BASE and MESSAGE_CHECK_BASE) don't work. We
instead call into the GPU to web process connection object directly to send a TerminateWebProcess message to
the parent (UI) process, and additionally log a given failure message.

(WebKit::RemoteRenderingBackend::nextDestinationImageBufferAfterApplyingDisplayLists):

Replace a number FIXMEs throughout these IPC message handlers with MESSAGE_CHECKs. Additionally, add a new
MESSAGE_CHECK for the case where we stopped replay early due to a corrupted or invalid display list item.

(WebKit::RemoteRenderingBackend::wakeUpAndApplyDisplayList):
(WebKit::RemoteRenderingBackend::setNextItemBufferToRead):

Simply remove the FIXME and early return here; this can only happen in the case where a compromised web content
process attempts to append redundant item buffer change items. However, doing so will either be (1) harmless,
since the pending item buffer information will just be overwritten, or (2) result in hitting a MESSAGE_CHECK
when decoding items if we try to execute the contents of another item buffer that has not been written to.

(WebKit::RemoteRenderingBackend::didCreateSharedDisplayListHandle):

GPUProcess/graphics/RemoteRenderingBackend.h:

5:28 PM Changeset in webkit [271771] by Simon Fraser

8 edits in trunk/Source/WebKit

[iOS WK2] Make the "in stable state" bit in visible content rect updates more fine-grained
https://bugs.webkit.org/show_bug.cgi?id=220875

Reviewed by Tim Horton.

VisibleContentRectUpdateInfo contains a single "in stable state" bit, but in a future
patch the web process will need to know if the UI process is rubberbanding. In addition,
we can fold "isChangingObscuredInsetsInteractively" into the same state bits.

So give VisibleContentRectUpdateInfo a OptionSet<ViewStabilityFlag>.

To give the correct state for non-main UIScrollViews, have _scrollViewIsRubberBanding
take the UIScrollView in question, and only include isChangingObscuredInsetsInteractively
if the question is being asked of the main UIScrollView.

Shared/VisibleContentRectUpdateInfo.cpp:

(WebKit::VisibleContentRectUpdateInfo::encode const):
(WebKit::VisibleContentRectUpdateInfo::decode):
(WebKit::operator<<):

Shared/VisibleContentRectUpdateInfo.h:

(WebKit::VisibleContentRectUpdateInfo::VisibleContentRectUpdateInfo):
(WebKit::VisibleContentRectUpdateInfo::inStableState const):
(WebKit::VisibleContentRectUpdateInfo::viewStability const):
(WebKit::VisibleContentRectUpdateInfo::isFirstUpdateForNewViewSize const):
(WebKit::operator==):
(WebKit::VisibleContentRectUpdateInfo::isChangingObscuredInsetsInteractively const): Deleted.

UIProcess/API/Cocoa/WKWebViewInternal.h:
UIProcess/API/ios/WKWebViewIOS.mm:

(-[WKWebView _didRelaunchProcess]):
(-[WKWebView _scrollViewIsRubberBanding:]):
(-[WKWebView _viewStabilityState:]):
(-[WKWebView _scheduleVisibleContentRectUpdateAfterScrollInView:]):
(-[WKWebView _updateVisibleContentRects]):
(-[WKWebView _scrollViewIsRubberBanding]): Deleted.
(-[WKWebView _scrollViewIsInStableState:]): Deleted.

UIProcess/ios/WKContentView.h:
UIProcess/ios/WKContentView.mm:

(-[WKContentView didUpdateVisibleRect:unobscuredRect:contentInsets:unobscuredRectInScrollViewCoordinates:obscuredInsets:unobscuredSafeAreaInsets:inputViewBounds:scale:minimumScale:viewStability:enclosedInScrollableAncestorView:sendEvenIfUnchanged:]):
(-[WKContentView didUpdateVisibleRect:unobscuredRect:contentInsets:unobscuredRectInScrollViewCoordinates:obscuredInsets:unobscuredSafeAreaInsets:inputViewBounds:scale:minimumScale:inStableState:isChangingObscuredInsetsInteractively:enclosedInScrollableAncestorView:sendEvenIfUnchanged:]): Deleted.

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::updateVisibleContentRects):

5:25 PM Changeset in webkit [271770] by commit-queue@webkit.org

4 edits in trunk

REGRESSION(r266148) Cancelling a navigation in decidePolicyForNavigationAction should not suspend the previous document's font loading timer
https://bugs.webkit.org/show_bug.cgi?id=220882
<rdar://problem/71634501>

Patch by Alex Christensen <achristensen@webkit.org> on 2021-01-22
Reviewed by Brady Eidson.

Source/WebCore:

Things like the load event and didFinishNavigation wait until loading of things like fonts and iframes has completed.

If we navigate to a document that immediately tries to navigate to a different document after starting the loads of fonts,
then we momentarily have two DocumentLoaders with m_frame pointing to the same main frame.

If we cancel that second navigation using WKNavigationActionPolicyCancel, then it calls DocumentLoader::stopLoading on the second DocumentLoader.
This is fine. This is the way things have worked for a very long time.

r266148 introduced a call to the document's font loader's suspendFontLoadingTimer inside of DocumentLoader::stopLoading which is also fine.
What is not fine is the way we get that document. Using m_frame->document() in this case gets us the first document, which may still be loading fonts that we do still want.
Using this->document() only returns non-null if this DocumentLoader is the DocumentLoader that was used to load the Frame's Document,
and in this case the DocumentLoader should only stop the font loading timer if that is true.

I added an API test that reproduces the issue before but not after this fix.
For further verification, you can replace server.request() in my API test with a request to the URL in the radar ending in "Authentication.htm"
and verify it times out before the fix but not after.

This is close to the largest amount of time spent per character changed I've ever written to change "m_frame" to "this".

loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::stopLoading):

Tools:

TestWebKitAPI/Tests/WebKitCocoa/Navigation.mm:

(TEST):

5:24 PM Changeset in webkit [271769] by Jonathan Bedard

4 edits
3 moves in trunk/LayoutTests

[LayoutTests] Move service-worker python files to resources
https://bugs.webkit.org/show_bug.cgi?id=220881
<rdar://problem/73518780>

Reviewed by Alexey Proskuryakov.

http/wpt/service-workers/check-service-worker-header.https.html:
http/wpt/service-workers/check-service-worker-header.py: Moved.
http/wpt/service-workers/file-upload-check.py: Moved.
http/wpt/service-workers/file-upload.html:
http/wpt/service-workers/resources/check-service-worker-header.py: Copied from LayoutTests/http/wpt/service-workers/check-service-worker-header.py.
http/wpt/service-workers/resources/file-upload-check.py: Copied from LayoutTests/http/wpt/service-workers/file-upload-check.py.
http/wpt/service-workers/resources/update-worker.py: Copied from LayoutTests/http/wpt/service-workers/update-worker.py.
http/wpt/service-workers/update-service-worker.https.html:
http/wpt/service-workers/update-worker.py: Moved.

5:22 PM Changeset in webkit [271768] by Jonathan Bedard

2 edits in trunk/Tools

[webkitscmpy] Add GitHub credentials (Follow-up fix)
https://bugs.webkit.org/show_bug.cgi?id=220562
<rdar://problem/73063457>

Reviewed by Aakash Jain.

Scripts/libraries/webkitscmpy/webkitscmpy/init.py: Change xmldict version.

4:23 PM Changeset in webkit [271767] by keith_miller@apple.com

2 edits in trunk/Source/JavaScriptCore

Obj-C API should do correct type checks when using a 32-bit address space
https://bugs.webkit.org/show_bug.cgi?id=220880
<rdar://72370334>

Reviewed by Tadeu Zagallo.

API/JSValue.mm:

(-[JSValue isNull]):
(-[JSValue isBoolean]):
(-[JSValue isNumber]):
(-[JSValue isString]):

4:07 PM Changeset in webkit [271766] by ysuzuki@apple.com

12 edits in trunk/Source/JavaScriptCore

REGRESSION (r271731): Unchecked JS exception under GlobalObject::moduleLoaderFetch
https://bugs.webkit.org/show_bug.cgi?id=220868

Reviewed by Mark Lam.

Because TerminatedExecutionError needs to be uncaught, CatchScope's semantics does not work well.
So, we extend ThrowScope to implement CatchScope's feature, and use ThrowScope etc.
We also add JSPromise::rejectWithCaughtException since this pattern is common enough.

API/JSAPIGlobalObject.mm:

(JSC::JSAPIGlobalObject::moduleLoaderImportModule):
(JSC::JSAPIGlobalObject::moduleLoaderFetch):

jsc.cpp:

(GlobalObject::moduleLoaderImportModule):
(GlobalObject::moduleLoaderFetch):

runtime/Completion.cpp:

(JSC::rejectPromise):
(JSC::loadAndEvaluateModule):
(JSC::loadModule):

runtime/JSGlobalObjectFunctions.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

runtime/JSInternalPromise.cpp:

(JSC::JSInternalPromise::rejectWithCaughtException):

runtime/JSInternalPromise.h:
runtime/JSModuleLoader.cpp:

(JSC::JSModuleLoader::importModule):
(JSC::JSModuleLoader::resolve):
(JSC::JSModuleLoader::fetch):
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::reject): Deleted.

runtime/JSPromise.cpp:

(JSC::JSPromise::rejectWithCaughtException):

runtime/JSPromise.h:
runtime/ThrowScope.h:

(JSC::ThrowScope::clearException):

wasm/js/JSWebAssembly.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::resolve):
(JSC::JSWebAssembly::webAssemblyModuleValidateAsync):
(JSC::instantiate):
(JSC::compileAndInstantiate):
(JSC::JSWebAssembly::webAssemblyModuleInstantinateAsync):
(JSC::reject): Deleted.
(JSC::webAssemblyModuleValidateAsyncInternal): Deleted.
(JSC::webAssemblyModuleInstantinateAsyncInternal): Deleted.

4:04 PM Changeset in webkit [271765] by commit-queue@webkit.org

2 edits in trunk/Tools

Update run-benchmark to work with Python3
https://bugs.webkit.org/show_bug.cgi?id=220878

Patch by W.D. Xiong <w_xiong@apple.com> on 2021-01-22
Reviewed by Jonathan Bedard.

Scripts/webkitpy/benchmark_runner/http_server_driver/simple_http_server_driver.py:

(SimpleHTTPServerDriver._find_http_server_port): Convert byte output to string before parsing regex

3:59 PM Changeset in webkit [271764] by Lauro Moura

2 edits in trunk/Tools

[webkitpy][GTK] Xvfb driver fails to start with python3
https://bugs.webkit.org/show_bug.cgi?id=220870

Reviewed by Jonathan Bedard.

Python2 and Python3 differ in how they handle file descriptor inheritance
and Popen's close_fds default value.

In Python2, os.pipe creates the fds with the inheritable flag set, and
Popen's close_fds defaults to True.

In Python3, os.pipe creates the fds non-inheritable, requiring a call
to os.set_inheritable to enable it. Also, Popen's close_fds defaults
to False, closing all file descriptors except stdin, stdout and stderr.

With this commit, Python3 is able to launch the Xvfb driver for
run-webdriver-tests, but is still failing later with some pytest issue
to be tracked in another bug.

Scripts/webkitpy/port/xvfbdriver.py:

(XvfbDriver._xvfb_pipe): Make the write_fd inheritable if in py3.
(XvfbDriver._xvfb_read_display_id): Encode for py3 bytes compatibility.
(XvfbDriver._xvfb_run): Tell popen to keep the file descriptors open.

3:56 PM Changeset in webkit [271763] by Russell Epstein

1 copy in tags/Safari-611.1.10.1.2

Tag Safari-611.1.10.1.2.

3:53 PM Changeset in webkit [271762] by Jonathan Bedard

2 edits
1 move
1 add in trunk/LayoutTests

[LayoutTests] Move redirect.py in resources folder
https://bugs.webkit.org/show_bug.cgi?id=220876
<rdar://problem/73516627>

Reviewed by Alexey Proskuryakov.

http/wpt/html/dom/elements/images/bypass-cache-redirection-revalidation.html:
http/wpt/html/dom/elements/images/redirect.py: Moved to images/resources /redirect.py
http/wpt/html/dom/elements/images/resources: Added.
http/wpt/html/dom/elements/images/resources/redirect.py: Moved from images/redirect.py.

2:35 PM Changeset in webkit [271761] by Chris Dumez

2 edits in trunk/Source/WebCore

Crash under FFTFrame::fftSetupForSize()
https://bugs.webkit.org/show_bug.cgi?id=220866
<rdar://73199504>

Reviewed by Darin Adler.

Follow-up to r271751 to address comment from Darin Adler. Stop using the double-checked
locking pattern as it is likely not safe [1].

[1] http://erdani.org/publications/DDJ_Jul_Aug_2004_revised.pdf

platform/audio/mac/FFTFrameMac.cpp:

(WebCore::fftSetups):
(WebCore::FFTFrame::fftSetupForSize):

1:55 PM Changeset in webkit [271760] by Chris Fleizach

11 edits
2 adds in trunk

AX: AT-synthesized key events for common user actions (increment/decrement) are detectably different in many ways, potentially causing both web app breakage and AT identification
https://bugs.webkit.org/show_bug.cgi?id=220675
<rdar://problem/73263977>

Reviewed by Zalan Bujtas.

Source/WebCore:

Test: accessibility/keyevents-for-actions-mimic-real-key-events.html

When accessibility posts keyboard events in response to ax actions, they should mimic
real key events so as to be indistinguishable.

https://github.com/WICG/aom/blob/gh-pages/explainer.md#deprecated-keyboardevent-object-properties-optional

accessibility/AccessibilityNodeObject.cpp:

(WebCore::dispatchSimulatedKeyboardUpDownEvent):
(WebCore::InitializeLegacyKeyInitProperties):
(WebCore::AccessibilityNodeObject::performDismissAction):
(WebCore::AccessibilityNodeObject::postKeyboardKeysForValueChange):

dom/KeyboardEvent.cpp:

(WebCore::KeyboardEvent::KeyboardEvent):
(WebCore::KeyboardEvent::create):

dom/KeyboardEvent.h:
dom/UIEvent.cpp:

(WebCore::UIEvent::UIEvent):

dom/UIEvent.h:

(WebCore::UIEvent::create):

dom/UIEventWithKeyState.h:

(WebCore::UIEventWithKeyState::UIEventWithKeyState):

LayoutTests:

accessibility/keyevents-for-actions-mimic-real-key-events-expected.txt: Added.
accessibility/keyevents-for-actions-mimic-real-key-events.html: Added.

1:49 PM Changeset in webkit [271759] by Devin Rousso

3 edits in trunk/LayoutTests/imported/w3c

[WPT] [Payment Request] slight adjustment to payment-request/payment-request-constructor-thcrash.https.html
https://bugs.webkit.org/show_bug.cgi?id=220872

Reviewed by Andy Estes.

The first test in payment-request/payment-request-constructor-thcrash.https.html is
incorrect because duplicate items in methodData provided to PaymentRequest should throw
a RangeError according to step 4.3.3 of <https://www.w3.org/TR/payment-request/#constructor>.

The spec does mention in <https://www.w3.org/TR/payment-request/#conformance>

User agents _MAY_ impose implementation-specific limits on otherwise unconstrained inputs,
e.g., to prevent denial of service attacks, to guard against running out of memory, or to
work around platform-specific limitations. When an input exceeds implementation-specific
limit, the user agent _MUST_ throw, or, in the context of a promise, reject with, a
TypeError optionally informing the developer of how a particular input exceeded an
implementation-specific limit.

but does not specify whether this should happen before or after the above.

In WebKit's case, there is no "implementation-specific limit", so a TypeError should not
be thrown in either case.

web-platform-tests/payment-request/payment-request-constructor-thcrash.https.html:
web-platform-tests/payment-request/payment-request-constructor-thcrash.https-expected.txt:

12:49 PM Changeset in webkit [271758] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Avoid duplicate calculations in RenderBlock::computePreferredLogicalWidths
https://bugs.webkit.org/show_bug.cgi?id=220873

Patch by Rob Buis <rbuis@igalia.com> on 2021-01-22
Reviewed by Darin Adler.

Avoid duplicate calculations in RenderBlock::computePreferredLogicalWidths.

rendering/RenderBlock.cpp:

(WebCore::RenderBlock::computePreferredLogicalWidths):

12:40 PM Changeset in webkit [271757] by Wenson Hsieh

8 edits in trunk

DisplayList::Replayer should stop replay and inform clients after encountering an invalid item
https://bugs.webkit.org/show_bug.cgi?id=220867

Reviewed by Chris Dumez.

Source/WebCore:

Make the DisplayList item iterator emit Optional<ItemHandle> instead of just ItemHandle; in the case of
client decoding or item validation failures (see #220710), this item handle will be WTF::nullopt. The display
list replayer will then handle this by halting replay with StopReplayReason::InvalidItem.

This refactoring will eventually enable RemoteRenderingBackend (in the GPU process) to terminate the web
content process when we fail to decode a display list item during playback (or encounter an invalid inline
item).

Test: DisplayListTests.InlineItemValidationFailure

DisplayListTests.OutOfLineItemDecodingFailure

platform/graphics/displaylists/DisplayList.cpp:

(WebCore::DisplayList::DisplayList::asText const):
(WebCore::DisplayList::DisplayList::dump const):
(WebCore::DisplayList::DisplayList::iterator::atEnd const):
(WebCore::DisplayList::DisplayList::iterator::updateCurrentItem):

Add an m_isValid flag. This flag is set to true initially, and is only set to false when we encounter an
item that is either invalid or unable to be decoded. Additionally, remove release assertions and the FIXMEs
regarding handling item decoding failures.

platform/graphics/displaylists/DisplayList.h:

(WebCore::DisplayList::DisplayList::iterator::operator* const):

If the m_isValid flag above is set, return WTF::nullopt for the item handle.

platform/graphics/displaylists/DisplayListReplayer.cpp:

(WebCore::DisplayList::Replayer::replay):

platform/graphics/displaylists/DisplayListReplayer.h:

Rename DecodingFailure to InvalidItem, since it now applies to both items that are invalid (e.g. contain
identifier values of 0 when they shouldn't) as well as items that fail decoding (which, in the case of the GPU
process, corresponds to IPC decoding failures).

Tools:

TestWebKitAPI/Tests/WebCore/DisplayListTests.cpp:

Adjust a few API tests, since the item handle in the DisplayList iterator is now optional.

TestWebKitAPI/Tests/WebCore/cg/DisplayListTestsCG.cpp:

Add a couple of new API tests to exercise display list item decoding and validation failures.

12:10 PM Changeset in webkit [271756] by weinig@apple.com

2 edits in trunk/Source/WebKitLegacy

Remove generate-preferences.sh from the WebKitLegacy target so it doesn't get included in the framework
https://bugs.webkit.org/show_bug.cgi?id=220871
<rdar://problem/73503409>

Reviewed by Simon Fraser.

WebKitLegacy.xcodeproj/project.pbxproj:

Remove generate-preferences.sh from the WebKitLegacy target so it doesn't get included in the framework.

12:04 PM Changeset in webkit [271755] by commit-queue@webkit.org

2 edits in trunk/Tools

Retried tests are run without --prefer-integrated-gpu
https://bugs.webkit.org/show_bug.cgi?id=220845

Patch by Kimmo Kinnunen <kkinnunen@apple.com> on 2021-01-22
Reviewed by Jonathan Bedard.

Run the test helper with --prefer-integrated-gpu also for retried tests, if
user originally passed --prefer-integrated-gpu to run-webkit-tests.

Scripts/webkitpy/layout_tests/controllers/manager.py:

(Manager._set_up_run):
(Manager._force_pixel_tests_if_needed):

12:04 PM Changeset in webkit [271754] by jiewen_tan@apple.com

3 edits in trunk/Source/WebKit

[WebAuthn] No error is visible after user enters the incorrect PIN
https://bugs.webkit.org/show_bug.cgi?id=220839
<rdar://problem/73378319>

Reviewed by Brent Fulgham.

To fix that, let's have a boolean to indicate the PIN entry UI has already been presented within this session.
And then rely on the error UI to let users retry the PIN.

Covered by manual tests.

UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.h:
UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.mm:

(WebKit::AuthenticatorPresenterCoordinator::requestPin):
(WebKit::AuthenticatorPresenterCoordinator::selectAssertionResponse):
Besides above, this patch also fixes some crashes.

11:53 AM Changeset in webkit [271753] by jiewen_tan@apple.com

2 edits in trunk/Source/WebKit

[WebAuthn] Should only check default browsers for the Modern WebAuthn
https://bugs.webkit.org/show_bug.cgi?id=220840
<rdar://problem/73375937>

Reviewed by Brent Fulgham.

WebProcess/WebAuthentication/WebAuthenticatorCoordinator.cpp:

(WebKit::WebAuthenticatorCoordinator::makeCredential):
(WebKit::WebAuthenticatorCoordinator::getAssertion):
(WebKit::WebAuthenticatorCoordinator::isUserVerifyingPlatformAuthenticatorAvailable):

11:11 AM Changeset in webkit [271752] by Devin Rousso

2 edits in trunk/LayoutTests

Unreviewed, fix crashing test
https://bugs.webkit.org/show_bug.cgi?id=220566

http/tests/paymentrequest/updateWith-modifiers.https.html:

10:42 AM Changeset in webkit [271751] by Chris Dumez

3 edits
2 adds in trunk

Crash under FFTFrame::fftSetupForSize()
https://bugs.webkit.org/show_bug.cgi?id=220866
<rdar://73199504>

Reviewed by Eric Carlson.

Source/WebCore:

The crash was caused by FFTFrame::fftSetupForSize() but being called concurrently
from "HRTF database loader" threads. This patch makes FFTFrame::fftSetupForSize()
thread safe to address the issue.

Test: webaudio/Panner/PannerNode-crash.html

platform/audio/mac/FFTFrameMac.cpp:

(WebCore::fftSetups):
(WebCore::FFTFrame::fftSetupForSize):

LayoutTests:

Add layout test coverage.

webaudio/Panner/PannerNode-crash-expected.txt: Added.
webaudio/Panner/PannerNode-crash.html: Added.

10:33 AM Changeset in webkit [271750] by youenn@apple.com

13 edits in trunk

Add more descriptive messages to setLocalDescription/setRemoteDescription error cases
https://bugs.webkit.org/show_bug.cgi?id=220857

Reviewed by Eric Carlson.

LayoutTests/imported/w3c:

web-platform-tests/webrtc/RTCPeerConnection-SLD-SRD-timing.https-expected.txt:
web-platform-tests/webrtc/RTCPeerConnection-operations.https-expected.txt:
web-platform-tests/webrtc/RTCPeerConnection-perfect-negotiation-stress-glare-linear.https-expected.txt:
web-platform-tests/webrtc/RTCPeerConnection-perfect-negotiation-stress-glare.https-expected.txt:
web-platform-tests/webrtc/RTCPeerConnection-setDescription-transceiver-expected.txt:
web-platform-tests/webrtc/RTCPeerConnection-setLocalDescription-rollback-expected.txt:
web-platform-tests/webrtc/RTCPeerConnection-setRemoteDescription-offer-expected.txt:
web-platform-tests/webrtc/RTCPeerConnection-setRemoteDescription-rollback-expected.txt:

Source/WebCore:

No change of behavior, covered by rebased tests.

Modules/mediastream/PeerConnectionBackend.cpp:

(WebCore::PeerConnectionBackend::setLocalDescription):
(WebCore::PeerConnectionBackend::setRemoteDescription):

LayoutTests:

fast/mediastream/RTCPeerConnection-setRemoteDescription-offer-expected.txt:

10:11 AM Changeset in webkit [271749] by youenn@apple.com

3 edits in trunk/Source/WebCore

Disable verification timer in case of capture suspension
https://bugs.webkit.org/show_bug.cgi?id=220859

Reviewed by Eric Carlson.

In case of suspension/unsuspension, make it as if the capture was interrupted.
Update updateVerifyCapturingTimer to stop timer it capture is interrupted.

Remove RealtimeMediaSource::m_interrupted which is unused and potentially confusing.
Manually tested.

platform/mediastream/RealtimeMediaSource.h:
platform/mediastream/mac/AVVideoCaptureSource.mm:

(WebCore::AVVideoCaptureSource::updateVerifyCapturingTimer):
(WebCore::AVVideoCaptureSource::captureDeviceSuspendedDidChange):

9:53 AM Changeset in webkit [271748] by Jonathan Bedard

8 edits in trunk/Tools

[webkitscmpy] Map alternative default branch names
https://bugs.webkit.org/show_bug.cgi?id=220865
<rdar://problem/73502370>

Reviewed by Aakash Jain.

As WebKit transitions from Subversion to Git, our default branch is changing from
trunk to main. This change allow identifiers with 'main' in them to work in Subversion checkouts.

Scripts/libraries/webkitscmpy/setup.py: Bump version.
Scripts/libraries/webkitscmpy/webkitscmpy/init.py: Ditto.
Scripts/libraries/webkitscmpy/webkitscmpy/local/git.py:

(Git.find): Map set of common default branches to this repository's default branch.

Scripts/libraries/webkitscmpy/webkitscmpy/remote/git_hub.py:

(GitHub.find): Map set of common default branches to this repository's default branch.

Scripts/libraries/webkitscmpy/webkitscmpy/scm_base.py:

(ScmBase.find): Map set of common default branches to this repository's default branch.

Scripts/libraries/webkitscmpy/webkitscmpy/test/git_unittest.py:

(TestGit.test_alternative_default_branch):
(TestGitHub.test_alternative_default_branch):

Scripts/libraries/webkitscmpy/webkitscmpy/test/svn_unittest.py:

(TestLocalSvn.test_alternative_default_branch):
(TestRemoteSvn.test_alternative_default_branch):

9:36 AM Changeset in webkit [271747] by Chris Dumez

2 edits in trunk/LayoutTests

[ Big Sur ] imported/w3c/web-platform-tests/beacon/beacon-cors.sub.window.html is a flaky failure
https://bugs.webkit.org/show_bug.cgi?id=220554
<rdar://problem/73048771>

Unreviewed, unskip test as it no longer appears to be flaky.

platform/mac/TestExpectations:

9:27 AM Changeset in webkit [271746] by mark.lam@apple.com

7 edits in trunk

Disable Options:useAtMethod because of compatibility issue.
https://bugs.webkit.org/show_bug.cgi?id=220788
rdar://72933608

Reviewed by Saam Barati and Yusuke Suzuki.

Source/JavaScriptCore:

See https://github.com/tc39/proposal-relative-indexing-method/issues/41.

jsc.cpp:

(CommandLine::parseArguments):

enable Options::useAtMethod by default for the jsc shell for testing.
runtime/OptionsList.h:

LayoutTests:

Enable Options::useAtMethod for these tests.

inspector/model/remote-object-get-properties.html:
js/Object-getOwnPropertyNames.html:
js/array-unscopables-properties.html:

8:29 AM Changeset in webkit [271745] by commit-queue@webkit.org

7 edits
4 adds in trunk

[css-grid] Relayout grid items when definiteness changes.
https://bugs.webkit.org/show_bug.cgi?id=220657

LayoutTests/imported/w3c:

Tests percentage-size-subitems-002.html and relative-grandchild.html are
imported from WPT.

Patch by Ziran Sun <Ziran Sun> on 2021-01-22
Reviewed by Manuel Rego Casasnovas.

web-platform-tests/css/css-grid/grid-items/percentage-size-subitems-002-expected.html: Added.
web-platform-tests/css/css-grid/grid-items/percentage-size-subitems-002.html: Added.
LayoutTests/imported/w3c/web-platform-tests/css/css-grid/relative-grandchild.html: Added.
LayoutTests/imported/w3c/web-platform-tests/css/css-grid/relative-grandchild-expected.xht: Added.
web-platform-tests/css/css-grid/grid-items/w3c-import.log:

Source/WebCore:

Patch by Ziran Sun <Ziran Sun> on 2021-01-22
Reviewed by Manuel Rego Casasnovas.

When setting an override logical-height the definiteness can change causing %-height
children to resolve differently. This change adds this check to determine if a grid-item
needs relayout. It is an import of Chromium changes at
https://chromium-review.googlesource.com/c/chromium/src/+/2474917
Instead of adding maybeHasPercentHeightDescendant() in WebKit, this change calls
hasPercentHeightDescendants(). In Chromium it wasn't possible to use
hasPercentHeightDescendants() because of this quirk:
https://quirks.spec.whatwg.org/#the-percentage-height-calculation-quirk
WebKit doesn't seem to use the quirk for grid according to the image in
https://github.com/w3c/csswg-drafts/issues/5545

This also fixes issues in test:
grid-child-percent-basis-resize-1.html

Tests have been ported in WPT at
https://github.com/web-platform-tests/wpt/pull/26136

Tests: imported/w3c/web-platform-tests/css/css-grid/grid-items/percentage-size-subitems-002.html

imported/w3c/web-platform-tests/css/css-grid/relative-grandchild.html

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::applyStretchAlignmentToChildIfNeeded):

LayoutTests:

Patch by Ziran Sun <Ziran Sun> on 2021-01-22
Reviewed by Manuel Rego Casasnovas.

TestExpectations:

7:09 AM Changeset in webkit [271744] by Kate Cheney

2 edits in trunk/Source/WebCore

Denying storage access on playstation.com then clicking sign-in fails to show the prompt again
https://bugs.webkit.org/show_bug.cgi?id=220838
<rdar://problem/73477444>

Reviewed by Alex Christensen.

Temporary cross-page storage access in the Web Process for quirks
should only be granted if the user hits "Allow" on the prompt.
This was causing the prompt to fail to show if a user clicks "Don't
Allow" then tries to sign in, then sign-in would fail without
storage access in the Network Process.

page/Quirks.cpp:

(WebCore::Quirks::requestStorageAccessAndHandleClick const):

4:11 AM Changeset in webkit [271743] by Chris Lord

4 edits in trunk/Source/WebCore

Remove individual settings accessors from WorkerGlobalScope and add Settings::Values accessor
https://bugs.webkit.org/show_bug.cgi?id=220854

Reviewed by Youenn Fablet.

Remove individual settings accessors from WorkerGlobalScope and make
Settings::Values accessor public.

No new tests, no behavior change.

html/OffscreenCanvas.cpp:

(WebCore::OffscreenCanvas::createContextWebGL):

workers/WorkerAnimationController.cpp:

(WebCore::WorkerAnimationController::scheduleAnimation):
(WebCore::WorkerAnimationController::serviceRequestAnimationFrameCallbacks):

workers/WorkerGlobalScope.h:

2:59 AM Changeset in webkit [271742] by Chris Lord

11 edits in trunk/Source/WebCore

Move FontGenericFamilies storage from SettingsBase to Settings::Values
https://bugs.webkit.org/show_bug.cgi?id=220801

Reviewed by Myles C. Maxfield.

Move FontGenericFamilies member from SettingsBase to Settings::Values
so that it can potentially be used within Workers. This will aid with
font usage off the main thread.

No new tests, no behavior change.

Headers.cmake:
Scripts/SettingsTemplates/Settings.cpp.erb:
Scripts/SettingsTemplates/Settings.h.erb:
css/CSSFontSelector.cpp:

(WebCore::resolveGenericFamily):
(WebCore::CSSFontSelector::fallbackFontAt):

page/SettingsBase.cpp:

(WebCore::SettingsBase::SettingsBase):
(WebCore::SettingsBase::standardFontFamily const):
(WebCore::SettingsBase::setStandardFontFamily):
(WebCore::SettingsBase::fixedFontFamily const):
(WebCore::SettingsBase::setFixedFontFamily):
(WebCore::SettingsBase::serifFontFamily const):
(WebCore::SettingsBase::setSerifFontFamily):
(WebCore::SettingsBase::sansSerifFontFamily const):
(WebCore::SettingsBase::setSansSerifFontFamily):
(WebCore::SettingsBase::cursiveFontFamily const):
(WebCore::SettingsBase::setCursiveFontFamily):
(WebCore::SettingsBase::fantasyFontFamily const):
(WebCore::SettingsBase::setFantasyFontFamily):
(WebCore::SettingsBase::pictographFontFamily const):
(WebCore::SettingsBase::setPictographFontFamily):

page/SettingsBase.h:
platform/graphics/FontGenericFamilies.cpp:

(WebCore::setGenericFontFamilyForScript):
(WebCore::genericFontFamilyForScript):
(WebCore::FontGenericFamilies::FontGenericFamilies):
(WebCore::FontGenericFamilies::isolatedCopy const):
(WebCore::FontGenericFamilies::standardFontFamily const):
(WebCore::FontGenericFamilies::fixedFontFamily const):
(WebCore::FontGenericFamilies::serifFontFamily const):
(WebCore::FontGenericFamilies::sansSerifFontFamily const):
(WebCore::FontGenericFamilies::cursiveFontFamily const):
(WebCore::FontGenericFamilies::fantasyFontFamily const):
(WebCore::FontGenericFamilies::pictographFontFamily const):
(WebCore::FontGenericFamilies::setStandardFontFamily):
(WebCore::FontGenericFamilies::setFixedFontFamily):
(WebCore::FontGenericFamilies::setSerifFontFamily):
(WebCore::FontGenericFamilies::setSansSerifFontFamily):
(WebCore::FontGenericFamilies::setCursiveFontFamily):
(WebCore::FontGenericFamilies::setFantasyFontFamily):
(WebCore::FontGenericFamilies::setPictographFontFamily):

platform/graphics/FontGenericFamilies.h:
style/StyleResolveForFontRaw.cpp:

(WebCore::Style::resolveForFontRaw):

1:34 AM Changeset in webkit [271741] by youenn@apple.com

5 edits in trunk/Source/WebCore

Validate ItemHandles when decoding them in GPUProcess
https://bugs.webkit.org/show_bug.cgi?id=220710

Reviewed by Wenson Hsieh.

ItemHandle may contain members that need to be validated if they are encoded/decoded through memory copy instead of IPC encode/decode routines.
This is particularly true of identifiers that can be null but cannot be encoded/decoded if the identifier is null.
For these inline ItemHandles, validate them before copying them.
No observable change of behavior, coveredd by existing tests.

platform/graphics/displaylists/DisplayList.cpp:

(WebCore::DisplayList::DisplayList::iterator::updateCurrentItem):

platform/graphics/displaylists/DisplayListItemBuffer.cpp:

(WebCore::DisplayList::ItemHandleInspector::test):
(WebCore::DisplayList::copyInto):
(WebCore::DisplayList::ItemHandle::safeCopyInto const):
(WebCore::DisplayList::ItemHandle::copyTo const): Deleted.

platform/graphics/displaylists/DisplayListItemBuffer.h:
platform/graphics/displaylists/DisplayListItems.h:

(WebCore::DisplayList::ClipToImageBuffer::isValid const):
(WebCore::DisplayList::DrawImageBuffer::isValid const):
(WebCore::DisplayList::DrawNativeImage::isValid const):
(WebCore::DisplayList::DrawPattern::isValid const):
(WebCore::DisplayList::PaintFrameForMedia::isValid const):
(WebCore::DisplayList::FlushContext::FlushContext):
(WebCore::DisplayList::FlushContext::isValid const):
(WebCore::DisplayList::MetaCommandChangeItemBuffer::MetaCommandChangeItemBuffer):
(WebCore::DisplayList::MetaCommandChangeItemBuffer::isValid const):
(WebCore::DisplayList::MetaCommandChangeDestinationImageBuffer::MetaCommandChangeDestinationImageBuffer):
(WebCore::DisplayList::MetaCommandChangeDestinationImageBuffer::isValid const):

1:07 AM Changeset in webkit [271740] by Nikolas Zimmermann

10 edits in trunk/Source/WebCore

Continue removing glue code from RenderLayer that was recently added in r271559
https://bugs.webkit.org/show_bug.cgi?id=220729

Reviewed by Adrian Perez de Castro.

Follow-up on patch adressing the removal of the glue code that
forwards calls from RenderLayer to RenderLayerScrollableArea (see
webkit.org/b/60305).

Covered by existing tests.

page/FrameView.cpp:

(WebCore::FrameView::paintContents):

rendering/RenderBlock.cpp:

(WebCore::RenderBlock::paint):
(WebCore::RenderBlock::isPointInOverflowControl):
(WebCore::RenderBlock::baselinePosition const):

rendering/RenderBox.cpp:

(WebCore::RenderBox::intrinsicScrollbarLogicalWidth const):

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::containsDirtyOverlayScrollbars const): Deleted.
(WebCore::RenderLayer::hitTestOverflowControls): Deleted.
(WebCore::RenderLayer::paintOverflowControls): Deleted.
(WebCore::RenderLayer::paintResizer): Deleted.
(WebCore::RenderLayer::paintScrollCorner): Deleted.
(WebCore::RenderLayer::paintOverlayScrollbars): Deleted.
(WebCore::RenderLayer::layerForHorizontalScrollbar const): Deleted.
(WebCore::RenderLayer::layerForVerticalScrollbar const): Deleted.
(WebCore::RenderLayer::horizontalScrollbar const): Deleted.
(WebCore::RenderLayer::verticalScrollbar const): Deleted.

rendering/RenderLayer.h:

(WebCore::RenderLayer::hasScrollbars const): Deleted.
(WebCore::RenderLayer::hasHorizontalScrollbar const): Deleted.
(WebCore::RenderLayer::hasVerticalScrollbar const): Deleted.

rendering/RenderLayerBacking.cpp:

(WebCore::RenderLayerBacking::requiresHorizontalScrollbarLayer const):
(WebCore::RenderLayerBacking::requiresVerticalScrollbarLayer const):
(WebCore::RenderLayerBacking::requiresScrollCornerLayer const):
(WebCore::RenderLayerBacking::positionOverflowControlsLayers):
(WebCore::RenderLayerBacking::paintIntoLayer):
(WebCore::RenderLayerBacking::paintContents):