⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Timeline



Aug 10, 2021:

11:57 PM Changeset in webkit [280885] by Peng Liu
  • 2 edits in trunk/Source/WTF

Disable SYSTEM_FEATURE_FLAGS on iOS 14
​https://bugs.webkit.org/show_bug.cgi?id=228979
<rdar://problem/81764452>

Reviewed by Tim Horton.

Stop using feature flags mechanism on iOS 14 to avoid some issues on iOS simulators.

  • wtf/PlatformHave.h:
11:10 PM Changeset in webkit [280884] by Peng Liu
  • 2 edits in trunk/Source/WebKitLegacy/mac

REGRESSION (r280726): [ Big Sur wk1 ] 25 imported/w3c/web-platform-tests/fetch/ failing
​https://bugs.webkit.org/show_bug.cgi?id=228926

Reviewed by Jer Noble.

Revert a part of r280726 while investigating the test failures.

  • WebView/WebPreferencesDefaultValues.mm:

(WebKit::isFeatureFlagEnabled):

10:28 PM Changeset in webkit [280883] by timothy_horton@apple.com
  • 2 edits in trunk/Source/WebKit

Unreviewed build fix after r280875

  • UIProcess/ios/forms/WKFileUploadPanel.mm:

(-[WKFileUploadPanel documentPicker:didPickDocumentsAtURLs:]):

9:09 PM Changeset in webkit [280882] by Jonathan Bedard
  • 3 edits in trunk/Tools

[webkitpy] Stop relying on device.plist for simulated device state
​https://bugs.webkit.org/show_bug.cgi?id=228974
<rdar://problem/81749547>

Reviewed by Stephanie Lewis.

  • Scripts/webkitpy/xcode/simulated_device.py:

(SimulatedDeviceManager):
(SimulatedDeviceManager.populate_available_devices): Device state check is now shared between simulators.
(SimulatedDeviceManager._disambiguate_device_type): Only extract hardware family and type from candidate.
(SimulatedDevice.init): Device state check is now shared between simulators.
(SimulatedDevice.state): Use 'xcrun simctl list' instead of device.plist.

  • Scripts/webkitpy/xcode/simulated_device_unittest.py:

(SimulatedDeviceTest.change_state_to): Deleted.
(SimulatedDeviceTest.test_swapping_devices): Deleted.

7:58 PM Changeset in webkit [280881] by Chris Dumez
  • 34 edits in trunk

Add Cross-Origin-Opener-Policy support for Blob URLs
​https://bugs.webkit.org/show_bug.cgi?id=228924

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

Rebaseline WPT test that is now passing.

  • web-platform-tests/html/cross-origin-opener-policy/blob-popup.https-expected.txt:

Source/WebCore:

Pass ScriptExecutionContext's cross-origin-opener-policy when registering a public
Blob URL and store it in the blob registry alongside the blob data. As a result,
we are able to service the right COOP headers on the blob response later on when
doing a load of this blob. In the future, we'll pass the cross-origin-embedder-policy
as well, once we support it.

No new tests, rebaselined existing test.

  • Modules/fetch/FetchLoader.cpp:

(WebCore::FetchLoader::startLoadingBlobURL):

  • dom/Document.h:
  • dom/ScriptExecutionContext.cpp:

(WebCore::ScriptExecutionContext::crossOriginOpenerPolicy const):

  • dom/ScriptExecutionContext.h:
  • fileapi/Blob.cpp:

(WebCore::BlobURLRegistry::registerURL):
(WebCore::Blob::Blob):

  • fileapi/FileReaderLoader.cpp:

(WebCore::FileReaderLoader::start):

  • fileapi/ThreadableBlobRegistry.cpp:

(WebCore::ThreadableBlobRegistry::registerBlobURL):

  • fileapi/ThreadableBlobRegistry.h:
  • html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::loadResource):

  • loader/CrossOriginEmbedderPolicy.cpp:

(WebCore::obtainCrossOriginEmbedderPolicy):
For WebKit1, the initial empty document seems to have an empty URL instead of
"about:blank" so I had to extend the check so that COEP properly gets enabled.

  • loader/CrossOriginOpenerPolicy.cpp:

(WebCore::obtainCrossOriginOpenerPolicy):
For WebKit1, the initial empty document seems to have an empty URL instead of
"about:blank" so I had to extend the check so that COOP properly gets enabled.

(WebCore::crossOriginOpenerPolicyToString):
(WebCore::CrossOriginOpenerPolicy::isolatedCopy const):
(WebCore::addCrossOriginOpenerPolicyHeaders):

  • loader/CrossOriginOpenerPolicy.h:

(WebCore::operator==):
(WebCore::CrossOriginOpenerPolicy::encode const):
(WebCore::CrossOriginOpenerPolicy::decode):

  • platform/network/BlobData.cpp:

(WebCore::BlobData::clone const):

  • platform/network/BlobData.h:

(WebCore::BlobData::crossOriginOpenerPolicy const):
(WebCore::BlobData::setCrossOriginOpenerPolicy):

  • platform/network/BlobRegistry.h:
  • platform/network/BlobRegistryImpl.cpp:

(WebCore::BlobRegistryImpl::registerBlobURL):
(WebCore::BlobRegistryImpl::registerBlobURLOptionallyFileBacked):

  • platform/network/BlobRegistryImpl.h:
  • platform/network/BlobResourceHandle.cpp:

(WebCore::BlobResourceHandle::notifyResponseOnSuccess):

Source/WebKit:

  • NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::registerBlobURLFromURL):
(WebKit::NetworkConnectionToWebProcess::registerBlobURLOptionallyFileBacked):

  • NetworkProcess/NetworkConnectionToWebProcess.h:
  • NetworkProcess/NetworkConnectionToWebProcess.messages.in:
  • NetworkProcess/NetworkDataTaskBlob.cpp:

(WebKit::NetworkDataTaskBlob::dispatchDidReceiveResponse):

  • NetworkProcess/NetworkProcessPlatformStrategies.cpp:

(WebKit::NetworkProcessPlatformStrategies::createBlobRegistry):

  • WebProcess/FileAPI/BlobRegistryProxy.cpp:

(WebKit::BlobRegistryProxy::registerBlobURL):

  • WebProcess/FileAPI/BlobRegistryProxy.h:

Source/WebKitLegacy/mac:

  • WebCoreSupport/WebPlatformStrategies.mm:

Source/WebKitLegacy/win:

  • WebCoreSupport/WebPlatformStrategies.cpp:
6:55 PM Changeset in webkit [280880] by Lauro Moura
  • 2 edits in trunk/LayoutTests

[WPE] Garden new css-counter imageonly failures

Unreviewed test gardening.

Some width issues in some specific cases of upper/lower roman style.

  • platform/wpe/TestExpectations:
6:51 PM Changeset in webkit [280879] by timothy_horton@apple.com
  • 2 edits in trunk/Source/WebKit

Unreviewed build fix.

  • NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(stringForTLSProtocolVersion):
(-[WKNetworkSessionDelegate URLSession:task:didReceiveChallenge:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]):
Ignore some slightly less unconventional deprecation warnings.

6:34 PM Changeset in webkit [280878] by timothy_horton@apple.com
  • 2 edits in trunk/Source/WebCore/PAL

Unreviewed build fix.

  • pal/spi/ios/CelestialSPI.h:

Ignore unconventional deprecation warnings until they can be fixed properly.

5:54 PM Changeset in webkit [280877] by commit-queue@webkit.org
  • 2 edits
    1 delete in trunk/LayoutTests

[GLIB] Update test expectations after r280742
​https://bugs.webkit.org/show_bug.cgi?id=228972

Unreviewed test gardening.

Patch by Arcady Goldmints-Orlov <Arcady Goldmints-Orlov> on 2021-08-10

  • platform/glib/TestExpectations:
  • platform/glib/compositing/backing/form-controls-backing-expected.txt: Removed.
5:54 PM Changeset in webkit [280876] by Alan Coon
  • 1 copy in tags/Safari-612.1.27.0.6

Tag Safari-612.1.27.0.6.

5:12 PM Changeset in webkit [280875] by commit-queue@webkit.org
  • 4 edits in trunk/Source/WebKit

WebKitBlobResource error 1 exactly after 60 seconds when trying to read file input
​https://bugs.webkit.org/show_bug.cgi?id=228683
<rdar://78448610>

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-08-10
Reviewed by Tim Horton.

To prevent UIKit from deleting our files to upload after 60 seconds, copy them to a temporary directory,
then delete the files when cleaning up the WKContentView.

I manually verified this makes the files able to upload after more than 60 seconds, then deletes them when you close the tab.

  • UIProcess/ios/WKContentView.h:
  • UIProcess/ios/WKContentView.mm:

(-[WKContentView dealloc]):
(-[WKContentView _removeTemporaryFilesIfNecessary]):
(-[WKContentView _removeTemporaryFilesWhenDeallocated:]):

  • UIProcess/ios/WKContentViewInteraction.h.orig: Added.
  • UIProcess/ios/WKContentViewInteraction.mm.orig: Added.
  • UIProcess/ios/forms/WKFileUploadPanel.mm:

(-[WKFileUploadPanel documentPicker:didPickDocumentsAtURLs:]):

5:00 PM Changeset in webkit [280874] by Alan Coon
  • 8 edits in branches/safari-612.1.27.0-branch/Source

Versioning.

WebKit-7612.1.27.0.6

4:53 PM Changeset in webkit [280873] by Cameron McCormack
  • 2 edits in trunk/Source/WebCore/PAL

Remove unused ColorSync SPI
​https://bugs.webkit.org/show_bug.cgi?id=228306
<rdar://problem/81136866>

Reviewed by Darin Adler.

We now use -[NSScreen canRepresentDisplayGamut:displayGamut] and
kMGQHasExtendedColorDisplay.

  • pal/spi/cg/CoreGraphicsSPI.h:
4:51 PM Changeset in webkit [280872] by Wenson Hsieh
  • 2 edits in trunk/Source/WebCore

[Live Text] Unable to start drag on image when the first piece of text inside the image is selected
​https://bugs.webkit.org/show_bug.cgi?id=228967
rdar://80471465

Reviewed by Tim Horton.

When selecting text inside an image element using Live Text, if the text selection contains the very first
character (in DOM order) that appears in the image element's shadow root, the user will be unable to start an
image drag on the same image by clicking another part of the image that does not contain Live Text. This happens
because DragController::startDrag to handle the drag as a selection drag rather than an image drag, which (in
turn) happens because DragController::draggableElement computes a drag source type of
DragSourceAction::Selection.

This occurs because FrameSelection::contains(const LayoutPoint&) returns true for any point inside the
shadow root of an image element with Live Text that does NOT hit-test to a text node, because we end up hit-
testing to the image overlay container div as our innerNode, which means that the DOM position for the given
point is going to be at the first position inside the image overlay container. Since this canonicalizes to the
beginning of the first text node (in DOM order) inside the image overlay, if that first text node happens to be
selected, we'll end up believing that the layout point (which is not over any text inside the image) is inside
the selection.

To avoid this, we make a minor adjustment to the logic in FrameSelection::contains, so that we handle text
inside image overlays by mapping the selected text range to absolute quads, and then checking whether the given
point (in absolute coordinates) is contained in any of those quads.

While we could theoretically use this approach for all selections, it's both more expensive than a hit-test and
might result in compatibility issues, so we just limit it to the case where we know (a-prior) that all
selectable text is arbitrarily positioned using transforms.

This change fixes an API test that currently fails on macOS: DragAndDropTests.DragElementWithImageOverlay

  • editing/FrameSelection.cpp:

(WebCore::FrameSelection::contains const):

4:51 PM Changeset in webkit [280871] by Cameron McCormack
  • 2 edits in trunk/Tools

Restore color profiles correctly on displays with multiple named modes
​https://bugs.webkit.org/show_bug.cgi?id=228313
<rdar://problem/81146417>

Reviewed by Alexey Proskuryakov.

Look up a device's current color profile by checking the default mode
rather than assuming it is "1". The device info dictionary returned
by ColorSyncDeviceCopyDeviceInfo has this shape:

{

CustomProfiles = {

ModeName1 = "​file:///path/to/custom/profile.ics";

};
FactoryProfiles = {

DeviceDefaultProfileID = "ModeName1";
ModeName1 = {

DeviceModeDescription = "Mode Name 1";
DeviceProfileURL = "​file:///path/to/factory/profile1.ics";

};
ModeName2 = {

DeviceModeDescription = "Mode Name 2";
DeviceProfileURL = "​file:///path/to/factory/profile2.ics";

};

};

}

where CustomProfiles is only present if a custom profile has been
selected, and the default mode name is "1". Displays connected over
HDMI don't use the default mode name.

  • DumpRenderTree/mac/LayoutTestHelper.m:

(colorProfileURLForDisplay):

4:19 PM Changeset in webkit [280870] by Chris Dumez
  • 15 edits in trunk

Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set
​https://bugs.webkit.org/show_bug.cgi?id=228965

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline WPT tests that are now passing.

  • web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-1-expected.txt:
  • web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-2-expected.txt:

Source/WebCore:

Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set:

Firefox and Chrome already behave this way.

No new tests, rebaselined existing tests.

  • dom/Document.cpp:

(WebCore::Document::processMetaHttpEquiv):

  • dom/Document.h:
  • html/HTMLMetaElement.cpp:

(WebCore::HTMLMetaElement::process):

  • loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::responseReceived):

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::receivedFirstData):
(WebCore::FrameLoader::scheduleRefreshIfNeeded):

  • loader/FrameLoader.h:
  • loader/FrameLoaderTypes.h:
  • loader/NavigationScheduler.cpp:

(WebCore::ScheduledRedirect::ScheduledRedirect):
(WebCore::NavigationScheduler::scheduleRedirect):

  • loader/NavigationScheduler.h:

LayoutTests:

Unskip tests that should no longer be flaky now that they are passing.

3:41 PM Changeset in webkit [280869] by Jonathan Bedard
  • 10 edits in trunk/Tools

[resultsdbpy] Add results-summary API
​https://bugs.webkit.org/show_bug.cgi?id=226894
<rdar://problem/79155181>

Reviewed by Aakash Jain.

  • Scripts/libraries/resultsdbpy/resultsdbpy/init.py: Bump version.
  • Scripts/libraries/resultsdbpy/resultsdbpy/controller/api_routes.py:

(APIRoutes.init): Add aggregate-results endpoint.

  • Scripts/libraries/resultsdbpy/resultsdbpy/controller/commit_controller.py:

(commit_for_query): Add decorator which converts a set of arguments into a single commit.

  • Scripts/libraries/resultsdbpy/resultsdbpy/controller/test_controller.py:

(TestController):
(TestController.summarize_test_results): Given a single commit and suite/test combination, compute
the liklihood of each potential result.

  • Scripts/libraries/resultsdbpy/resultsdbpy/controller/test_controller_unittest.py:

(TestControllerTest.test_summarize_general): Added.
(TestControllerTest.test_summarize_specific): Added.
(TestControllerTest.test_summarize_expectations): Added.

  • Scripts/libraries/resultsdbpy/resultsdbpy/model/commit_context.py:

(CommitContext.find_commits_in_range): Use ascended table if user only provides lower bound.

  • Scripts/libraries/resultsdbpy/resultsdbpy/model/commit_context_unittest.py:

(CommitContextTest.test_stash_commits_before): Verify upper bound.
(CommitContextTest.test_svn_commits_before): Ditto.
(CommitContextTest.test_stash_commits_after): Verify lower bound.
(CommitContextTest.test_svn_commits_after): Ditto.

  • Scripts/libraries/resultsdbpy/resultsdbpy/view/templates/documentation.html: Add aggregate-results

documentation.

  • Scripts/libraries/resultsdbpy/setup.py: Bump version.
3:23 PM Changeset in webkit [280868] by Russell Epstein
  • 1 copy in tags/Safari-612.1.27.0.5

Tag Safari-612.1.27.0.5.

3:17 PM Changeset in webkit [280867] by timothy_horton@apple.com
  • 2 edits in trunk/Tools

macCatalyst: Flexible viewport tests that dump the window size fail because it doesn't match iPad
​https://bugs.webkit.org/show_bug.cgi?id=228964

Reviewed by Darin Adler.

  • WebKitTestRunner/ios/TestControllerIOS.mm:

(WTR::TestController::platformConfigureViewForTest):
For platforms where we control the size of the window/scene, resize it
to match the chosen default testing iPad size (768x1024), but with the
default testing iPad's status bar subtracted out, and the current platform's
added in, so that the end result is a WKWebView of identical size to
one on the default testing iPad.

2:53 PM Changeset in webkit [280866] by stephan.szabo@sony.com
  • 2 edits in trunk/Source/WTF

[WTF][PlayStation] REGRESSION(r280795) error: undefined symbol: WTF::logLevelString()
​https://bugs.webkit.org/show_bug.cgi?id=228959

Reviewed by Fujii Hironori.

As per followup win fix, for declspec platforms, LoggingUnix needs
to include LogInitialization to get the export declaration.

  • wtf/unix/LoggingUnix.cpp:
2:37 PM Changeset in webkit [280865] by Andres Gonzalez
  • 6 edits in trunk/Source/WebKit

Notify accessibility that WebProcess is suspended when in process cache.
​https://bugs.webkit.org/show_bug.cgi?id=228936
rdar://80911502

Reviewed by Chris Dumez.

Need to notify accessibility clients that a WebProcess in the process
cache is suspended. Otherwise accessibility clients may continue making
requests to the cached Webprocess and be waiting indefinitely for a
suspended process.
Deleted WebProcess::accessibilityProcessSuspendedNotification and
instead use IPC::AccessibilityProcessSuspendedNotification

  • Platform/IPC/Connection.h:
  • Platform/IPC/cocoa/ConnectionCocoa.mm:

(IPC::AccessibilityProcessSuspendedNotification):

  • WebProcess/WebProcess.cpp:

(WebKit::WebProcess::setIsInProcessCache):
(WebKit::WebProcess::prepareToSuspend):
(WebKit::WebProcess::processDidResume):

  • WebProcess/WebProcess.h:
  • WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::accessibilityProcessSuspendedNotification): Deleted.

2:35 PM Changeset in webkit [280864] by Jonathan Bedard
  • 10 edits in trunk/Tools

[git-webkit] Color log output
​https://bugs.webkit.org/show_bug.cgi?id=228662
<rdar://problem/81344181>

Reviewed by Dewei Zhu.

  • Scripts/libraries/webkitcorepy/setup.py: Bump version.
  • Scripts/libraries/webkitcorepy/webkitcorepy/init.py: Bump version, export Terminal.
  • Scripts/libraries/webkitcorepy/webkitcorepy/terminal.py: Added.

(Terminal):
(Terminal.assert_writeable_stream): Assert that the provided object is a writable stream.
(Terminal.supports_color): Check if the provided file supports colored output.
(Terminal.isatty): Check if a stream is an atty, both according to the stream itself and our override.
(Terminal.override_atty): Allow callers to override and declare explicitly if a stream is an atty.
(Terminal.Text): Group text colors and styles.
(Terminal.Style): Group functions modifying style of a stream.
(Terminal.Style.enabled): Check if styled printing is enabled on a stream.
(Terminal.Style.disable): Disable styled printing on a stream.
(Terminal.Style.enable): Enable styled printing on a stream.
(Terminal.Style.is_styled): Check if a stream is currently styled.
(Terminal.Style.init): Construct a text style.
(Terminal.Style.repr): Output the terminal characters styling a stream.
(Terminal.Style.set): Apply style to a stream.
(Terminal.Style.apply): Apply style to a stream, unapply when exiting context.

  • Scripts/libraries/webkitscmpy/setup.py:
  • Scripts/libraries/webkitscmpy/webkitscmpy/init.py:
  • Scripts/libraries/webkitscmpy/webkitscmpy/program/blame.py: Pass isatty to child process.
  • Scripts/libraries/webkitscmpy/webkitscmpy/program/command.py:

(FilteredCommand.pager): Pass isatty to child process, ask 'more' to display colors.
(FilteredCommand.main): Color header and error.

  • Scripts/libraries/webkitscmpy/webkitscmpy/program/log.py: Pass isatty to child process.
  • Scripts/libraries/webkitscmpy/webkitscmpy/test/log_unittest.py: Override atty behavior.
2:28 PM Changeset in webkit [280863] by Russell Epstein
  • 5 edits in branches/safari-611.3.10.0-branch/Source

Apply patch. rdar://problem/79924198

2:24 PM Changeset in webkit [280862] by Ayumi Kojima
  • 2 edits in trunk/LayoutTests

[ Win EWS ] fast/forms/search/search-zoom-computed-style-height.html is flaky crashing.
​https://bugs.webkit.org/show_bug.cgi?id=228968

Unreviewed Windows test gardening to seed up EWS.

  • platform/win/TestExpectations:
1:49 PM Changeset in webkit [280861] by rniwa@webkit.org
  • 2 edits in trunk/Source/WebCore

Deploy some more smart pointers in DOMWindow.cpp
​https://bugs.webkit.org/show_bug.cgi?id=228883

Reviewed by Darin Adler.

A follow up to r279661. Deploy even more smart pointers.

  • page/DOMWindow.cpp:

(WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents):
(WebCore::DOMWindow::failedToRegisterDeviceMotionEventListener):
(WebCore::DOMWindow::dispatchEvent):

12:50 PM Changeset in webkit [280860] by Antti Koivisto
  • 2 edits in trunk/Source/WebCore

Remove some dead code from LegacyInlineFlowBox::nodeAtPoint
​https://bugs.webkit.org/show_bug.cgi?id=228960

Reviewed by Alan Bujtas.

  • rendering/LegacyInlineFlowBox.cpp:

(WebCore::LegacyInlineFlowBox::nodeAtPoint):

This hit test quirk got accidentally disabled 7 years ago (in ​http://trac.webkit.org/changeset/170875/webkit)
and this became dead code. No one has complained.

11:52 AM Changeset in webkit [280859] by Ben Nham
  • 5 edits in trunk

Fix nested resource load tracepoints
​https://bugs.webkit.org/show_bug.cgi?id=228242

Reviewed by Alex Christensen.

Source/WebCore:

The main resource and subresource load tracepoints aren't interpreted correctly if there are
multiple resource loads in flight at the same time. To fix this, we pass the pointer to the
FrameLoader or SubresourceLoader to ktrace so that the tracing tool can use that pointer to
properly nest overlapping resource loading trace intervals.

One additional change I made is to move the SubresourceLoadWillStart tracepoint to after the
call to willSendRequestInternal. The reason for this is because I wanted to log the resource
ID associated with the subresource request, but we only generate that ID after the call to
willSendRequestInternal.

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::provisionalLoadStarted):
(WebCore::FrameLoader::checkLoadCompleteForThisFrame):

  • loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::willSendRequestInternal):
(WebCore::SubresourceLoader::didFinishLoading):
(WebCore::SubresourceLoader::didFail):
(WebCore::SubresourceLoader::didCancel):

Tools:

Use page and resource ids to properly handle nested main resource and subresource load
tracepoint intervals.

  • Tracing/SystemTracePoints.plist:
11:17 AM Changeset in webkit [280858] by keith_miller@apple.com
  • 7 edits in trunk/Source

CallFrame::returnPC should untag the return address before passing it to ReturnAddressPtr
​https://bugs.webkit.org/show_bug.cgi?id=228931

Reviewed by Mark Lam.

Source/JavaScriptCore:

Right now current debugging code expects that the JS return PC on
the stack is already unsigned. This is not true on arm64e.
This patch now properly unsigns the return PC before passing it to
the ReturnAddressPC constructor.

  • assembler/MacroAssemblerCodeRef.h:

(JSC::ReturnAddressPtr::fromTaggedPC):

  • interpreter/AbstractPC.cpp:

(JSC::AbstractPC::AbstractPC):

  • interpreter/AbstractPC.h:

(JSC::AbstractPC::AbstractPC):
(JSC::AbstractPC::jitReturnAddress const):

  • interpreter/CallFrame.h:

(JSC::CallFrame::returnPC const):

Source/WTF:

Add a new helper to untag the return pc from a stack frame.

  • wtf/PtrTag.h:

(WTF::untagReturnPC):

11:06 AM Changeset in webkit [280857] by Russell Epstein
  • 8 edits in branches/safari-612.1.27.0-branch

Cherry-pick r280826. rdar://problem/81749833

Partially revert r280256 behavior change since it broke Facetime
​https://bugs.webkit.org/show_bug.cgi?id=228943
rdar://81700268

Reviewed by Mark Lam.

Source/WebCore:

In r280256, custom accessors start getting holder's JSGlobalObject (this is right behavior).
We also introduced IncumbentWindow IDL attribute to get the caller's JSGlobalObject, which is
necessary in Location. At that time, we replaced all ActiveWindow to IncumbentWindow, but it
changes the JSGlobalObject of replace, assign, and reload since they are functions (not
custom accessors). We observed that, after this change, facetime Web page is broken: when opening
the link to Facetime, it should show the prompt of "Open in Facetime app" in iOS. But after this
change, it won't happen.

We revert the semantic change by using ActiveWindow for replace, assign, and reload. This is
not the correct semantics from the spec, but this is the same to one before r280256, and we
will change this once we find the way to bypass this issue.

  • page/Location.cpp: (WebCore::Location::assign): (WebCore::Location::replace): (WebCore::Location::reload):
  • page/Location.h:
  • page/Location.idl:

LayoutTests:

  • fast/frames/sandboxed-iframe-navigation-parent-expected.txt:
  • fast/frames/sandboxed-iframe-navigation-parent.html:
  • http/tests/security/frameNavigation/context-for-location-assign-expected.txt:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280826 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:05 AM Changeset in webkit [280856] by Russell Epstein
  • 8 edits in branches/safari-612.1.27.0-branch/Source

Versioning.

WebKit-7612.1.27.0.5

10:51 AM Changeset in webkit [280855] by Chris Dumez
  • 14 edits
    1 move
    1 add
    1 delete in trunk

Document.baseURI is inaccurate for iframe srcdoc documents
​https://bugs.webkit.org/show_bug.cgi?id=228933

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

Rebaseline WPT tests now that more checks are passing.

  • web-platform-tests/html/infrastructure/urls/terminology-0/document-base-url-expected.txt:
  • web-platform-tests/html/semantics/document-metadata/the-base-element/base_about_blank-expected.txt:
  • web-platform-tests/html/semantics/document-metadata/the-base-element/base_href_invalid-expected.txt:
  • web-platform-tests/html/semantics/document-metadata/the-base-element/base_srcdoc-expected.txt:

Source/WebCore:

Document.baseURI is inaccurate for iframe srcdoc documents:

This aligns our behavior with both Chrome and Firefox.

No new tests, rebaselined existing tests.

  • dom/Document.cpp:

(WebCore::Document::fallbackBaseURL const):
(WebCore::Document::updateBaseURL):
Extract "fallback base URL" logic out of updateBaseURL() and into its own function so that
it can be called from other places. Add logic to deal with iframe srcdoc documents to
our "fallback base URL" logic, as per:

(WebCore::Document::processBaseElement):
As per ​https://html.spec.whatwg.org/#set-the-frozen-base-url, we should use the document's fallback base URL
as base URL when parsing the base element's href attribute.

  • dom/Document.h:
  • html/HTMLBaseElement.cpp:

(WebCore::HTMLBaseElement::href const):
Per ​https://html.spec.whatwg.org/#dom-base-href, we should use the document's fallback base URL when
parsing the base element's href attribute. Also we should return the attribute value if the URL fails
parsing, not a null URL.

  • xml/parser/XMLDocumentParserLibxml2.cpp:

(WebCore::openFunc):
Keep in sync with HTMLBaseElement::href(), as per comment.

Source/WebKitLegacy/mac:

  • DOM/DOMHTMLBaseElement.mm:

(-[DOMHTMLBaseElement href]):

LayoutTests:

Update existing layout test to reflect behavior change.

  • fast/dom/HTMLBaseElement/href-attribute-resolves-with-respect-to-document.html: Removed.
  • http/tests/misc/href-attribute-resolves-with-respect-to-document-expected.txt: Renamed from LayoutTests/fast/dom/HTMLBaseElement/href-attribute-resolves-with-respect-to-document-expected.txt.
  • http/tests/misc/href-attribute-resolves-with-respect-to-document.html: Added.
10:35 AM Changeset in webkit [280854] by commit-queue@webkit.org
  • 9 edits in trunk

Scripts/generate-derived-sources.sh: line 19: [: binary operator expected while building Source/WebKit
​https://bugs.webkit.org/show_bug.cgi?id=228908

Patch by Kimmo Kinnunen <​kkinnunen@apple.com> on 2021-08-10
Reviewed by Per Arne Vollan.

Source/JavaScriptCore:

  • Scripts/generate-derived-sources.sh:

Quote the use of CC so that future copy-paste does not make the same mistake
as this bug.

Source/WebCore:

  • Scripts/generate-derived-sources.sh:

Quote the use of CC so that future copy-paste does not make the same mistake
as this bug.

Source/WebKit:

Change variable references in the sh script to quoted "$VAR".
[ -z $VAR ] with VAR="a b" would mean
[ -z a b ].

-z is unary operator, so the expression b would be in position

where test would expect an operator.
The correct form is [ -z "a b" ].

In general, sh scripts usually refer to variables using quotes.

  • Scripts/generate-derived-sources.sh:

Fix a bug where multiple space separated paths in
WEBKITADDITIONS_HEADER_SEARCH_PATHS would cause
test expression to receive arguments after the -z arg.

Quote the use of CC so future copy-paste does not make the same mistake
as this bug.

Tools:

  • DumpRenderTree/Scripts/generate-derived-sources.sh:
  • WebKitTestRunner/Scripts/generate-derived-sources.sh:

Quote the use of CC so that future copy-paste does not make the same mistake
as this bug.

10:34 AM Changeset in webkit [280853] by Russell Epstein
  • 4 edits in branches/safari-611.3.10.0-branch/Source/WebKit

Cherry-pick r279287. rdar://problem/80635807

Explicitly invalidate WKFullScreenViewController after a video exits fullscreen
​https://bugs.webkit.org/show_bug.cgi?id=227372

Reviewed by Eric Carlson.

Since WKFullScreenWindowController owns WKFullScreenViewController,
we had better let WKFullScreenWindowController manage the life cycle
of WKFullScreenViewController.

  • UIProcess/ios/fullscreen/WKFullScreenViewController.h:
  • UIProcess/ios/fullscreen/WKFullScreenViewController.mm: (-[WKFullScreenViewController initWithWebView:]): (-[WKFullScreenViewController invalidate]): (-[WKFullScreenViewController dealloc]): (-[WKFullScreenViewController showUI]): (-[WKFullScreenViewController hideUI]): (-[WKFullScreenViewController videoControlsManagerDidChange]): (-[WKFullScreenViewController setAnimatingViewAlpha:]): (-[WKFullScreenViewController setPrefersStatusBarHidden:]): (-[WKFullScreenViewController setPrefersHomeIndicatorAutoHidden:]): (-[WKFullScreenViewController setPlaying:]): (-[WKFullScreenViewController setPictureInPictureActive:]): (-[WKFullScreenViewController setAnimating:]): (-[WKFullScreenViewController _manager]): (-[WKFullScreenViewController _effectiveFullscreenInsets]): (-[WKFullScreenViewController _cancelAction:]): (-[WKFullScreenViewController _togglePiPAction:]): (-[WKFullScreenViewController _touchDetected:]): (-[WKFullScreenViewController _statusBarFrameDidChange:]): (-[WKFullScreenViewController _updateWebViewFullscreenInsets]): (-[WKFullScreenViewController _showPhishingAlert]):
  • UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm: (-[WKFullScreenWindowController _completedExitFullScreen]):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@279287 268f45cc-cd09-0410-ab3c-d52691b4dbfc

10:33 AM Changeset in webkit [280852] by Peng Liu
  • 2 edits in trunk/Source/WebKit

RemoteImageDecoderAVF::clearFrameBufferCache() uses a weak pointer without checking its validity
​https://bugs.webkit.org/show_bug.cgi?id=228925

Reviewed by Eric Carlson.

Only use m_gpuProcessConnection when it is a valid pointer.

  • WebProcess/GPU/media/RemoteImageDecoderAVF.cpp:

(WebKit::RemoteImageDecoderAVF::clearFrameBufferCache):

10:30 AM Changeset in webkit [280851] by Russell Epstein
  • 1 edit in branches/safari-611.3.10.0-branch/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm

Apply patch. rdar://problem/80636822

10:29 AM Changeset in webkit [280850] by Megan Gardner
  • 2 edits in trunk/Source/WebKit

Don't instantiate a SYNotesActivationObserver to just say that it's not active or visible.
​https://bugs.webkit.org/show_bug.cgi?id=228929
rdar://81634182

Reviewed by Wenson Hsieh.

If we do not have an SYNotesActivationObserver then we do not need to make one to say that it is not visible
or that it's not occuding the screen. This is a performance optimization for all WebViews that are not
in Safari as well as all pages that do not have highlights to restore.

  • UIProcess/Cocoa/WebPageProxyCocoa.mm:

(WebKit::WebPageProxy::appHighlightsVisibility):
(WebKit::WebPageProxy::appHighlightsOverlayRect):

10:08 AM Changeset in webkit [280849] by Russell Epstein
  • 6 edits
    1 add in branches/safari-611.3.10.0-branch

Cherry-pick r280507. rdar://problem/79730568

Improve OSR entry into Wasm loops with arguments
​https://bugs.webkit.org/show_bug.cgi?id=228595

Reviewed by Yusuke Suzuki.

JSTests:

Just a straightforward test that counts to 1M in a loop, to exercise both OSR entry and a loop with an argument at the same time.
100k iterations was not enough to reliably complete an OSR entry.

  • wasm/stress/osr-entry-with-loop-arguments.js: Added. (async test):

Source/JavaScriptCore:

This patch has two parts:

  • improve the Wasm OSR code to fully support loop arguments (just some plumbing to make sure that the right values are propagated)
  • improve the B3 validator to fix a hole I noticed while writing the first part: we were not detecting code that introduce Upsilons in the wrong blocks. Naturally, this caused hard to debug issues, as B3 has no well-defined semantics for a Phi that is reached before the corresponding Upsilon(s).
  • b3/B3Validate.cpp:
  • wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck): (JSC::Wasm::AirIRGenerator::addLoop):
  • wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck): (JSC::Wasm::B3IRGenerator::addLoop):
  • wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::LLIntGenerator::addLoop):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280507 268f45cc-cd09-0410-ab3c-d52691b4dbfc

10:08 AM Changeset in webkit [280848] by Russell Epstein
  • 2 edits in branches/safari-611.3.10.0-branch/Source/WebKit

Cherry-pick r279254. rdar://problem/80635931

Crash in WebFrameLoaderClient::dispatchDidStartProvisionalLoad after provisionalLoader is gone.
​https://bugs.webkit.org/show_bug.cgi?id=226979

Patch by Venky Dass <​yaranamavenkataramana@apple.com> on 2021-06-24
Reviewed by Ryosuke Niwa.

  • WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp: (WebKit::WebFrameLoaderClient::dispatchDidStartProvisionalLoad):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@279254 268f45cc-cd09-0410-ab3c-d52691b4dbfc

10:08 AM Changeset in webkit [280847] by Russell Epstein
  • 3 edits
    1 add in branches/safari-611.3.10.0-branch

Cherry-pick r275472. rdar://problem/81710596

DFG arity fixup nodes should exit to the caller's call opcode
​https://bugs.webkit.org/show_bug.cgi?id=223278

Reviewed by Saam Barati.

JSTests:

  • stress/dfg-arity-fixup-uses-callers-exit-origin.js: Added. (main.v22): (main.v30): (main.try.v40): (main.try.v47): (main.try.v56): (main.): (main):

Source/JavaScriptCore:

Right now when we do arity fixup in the DFG we model it in the
same way that it executes, which means all the nodes are part of
the callee. Unfortunately, this causes PhantomInsertionPhase to
think those nodes could be replacing previously defined
VirtualRegisters as they are part of the callee's header (always
alive). When PhantomInsertionPhase then inserts a Phantom it will
put that node in the caller's frame as that's the first ExitOK
node. The caller however may have no knowledge of that
VirtualRegister though. For example:

--> foo: loc10 is a local in foo.

...
1: MovHint(loc10)
2: SetLocal(loc10)

<-- foo loc10 ten is now out of scope for the InlineCallFrame of the caller.
...
 Phantom will be inserted here refering to loc10, which doesn't make sense.
--> bar loc10 is an argument to bar and needs arity fixup.

... All of these nodes are ExitInvalid
3: MovHint(loc10, ExitInvalid)
4: SetLocal(loc10, ExitInvalid)
...

  • dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::currentNodeOrigin): (JSC::DFG::ByteCodeParser::inlineCall):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@275472 268f45cc-cd09-0410-ab3c-d52691b4dbfc

9:56 AM Changeset in webkit [280846] by commit-queue@webkit.org
  • 4 edits in trunk/LayoutTests

[GLIB] Update crypto test baselines after r280790
​https://bugs.webkit.org/show_bug.cgi?id=228957

Unreviewed test gardening.

Patch by Arcady Goldmints-Orlov <Arcady Goldmints-Orlov> on 2021-08-10

  • platform/glib/TestExpectations:
  • platform/glib/crypto/subtle/aes-cbc-cfb-decrypt-malformed-parameters-expected.txt:
  • platform/glib/crypto/subtle/aes-cbc-cfb-encrypt-malformed-parameters-expected.txt:
9:35 AM Changeset in webkit [280845] by Russell Epstein
  • 8 edits in branches/safari-611.3.10.0-branch/Source

Versioning.

WebKit-7611.4.0.1

9:27 AM Changeset in webkit [280844] by Russell Epstein
  • 1 delete in branches/safari-611.4-branch

Delete branch.

9:25 AM Changeset in webkit [280843] by Russell Epstein
  • 1 copy in branches/safari-611.4-branch

New branch.

9:15 AM Changeset in webkit [280842] by Ayumi Kojima
  • 2 edits in trunk/LayoutTests

[ MacOS ] inspector/canvas/shaderProgram-add-remove-webgl2.html is flaky.
​https://bugs.webkit.org/show_bug.cgi?id=228934

Unreviewed test gardening.

  • platform/mac-wk2/TestExpectations:
8:20 AM Changeset in webkit [280841] by ddkilzer@apple.com
  • 2 edits in trunk/Source/WebKit

ThreadSanitizer: data race in WTF::StringImpl::deref() under WebKit::WebProcessPool::setMediaAccessibilityPreferences()
<​https://webkit.org/b/228932>

Reviewed by Chris Dumez.

Covered by numerous layout tests running with TSan including:

crypto/crypto-random-values-types.html

  • UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::setMediaAccessibilityPreferences):

  • Make an isolatedCopy() of Vector<String> object before passing it to the main thread.
7:31 AM Changeset in webkit [280840] by Devin Rousso
  • 9 edits in trunk

[macOS] REGRESSION(r278850): modifying playbackRate via JS on a TouchBar mac only sometimes works and also causes the defaultPlaybackRate to change
​https://bugs.webkit.org/show_bug.cgi?id=228939
<rdar://problem/80427578>

Reviewed by Eric Carlson.

Source/WebCore:

Test: VideoControlsManager.VideoControlsManagerDoesNotChangeValuesExposedToJavaScript

  • platform/mac/PlaybackSessionInterfaceMac.mm:

(WebCore::PlaybackSessionInterfaceMac::rateChanged):
Make sure to change the defaultPlaybackRate before the rate as otherwise the former will
override changes made to the latter (see r278850 (and r277203) for details as to why).

  • platform/mac/WebPlaybackControlsManager.h:
  • platform/mac/WebPlaybackControlsManager.mm:

(-[WebPlaybackControlsManager setDefaultPlaybackRate:]):
(-[WebPlaybackControlsManager setDefaultPlaybackRate:fromJavaScript:]): Added.
(-[WebPlaybackControlsManager setRate:]):
(-[WebPlaybackControlsManager setRate:fromJavaScript:]): Added.
Add a way to distinguish whether the change to the rate/defaultPlaybackRate came from JS
or some native call (e.g. AVKit). If the former, don't propagate the change to the playback
model (which eventually is the HTMLMediaElement in the WebProcess) as that's where the
value came from in the first place. Note that we still want to propagate the rate to the
defaultPlaybackRate (and vice versa when isPlaying) in the UIProcess for the reasons
described in r278850 (and r277203), but we don't want to expose it to JS.

  • platform/ios/PlaybackSessionInterfaceAVKit.mm:

(WebCore::PlaybackSessionInterfaceAVKit::rateChanged):

  • platform/ios/WebAVPlayerController.h:
  • platform/ios/WebAVPlayerController.mm:

(-[WebAVPlayerController setDefaultPlaybackRate:]):
(-[WebAVPlayerController setDefaultPlaybackRate:fromJavaScript:]): Added.
(-[WebAVPlayerController setRate:]):
(-[WebAVPlayerController setRate:fromJavaScript:]): Added.
Drive-by: r278850 was based r277203 (which added the above), so fix that code now too.

Tools:

  • TestWebKitAPI/Tests/WebKitCocoa/VideoControlsManager.mm:

(TestWebKitAPI::TEST.VideoControlsManager.VideoControlsManagerDoesNotChangeValuesExposedToJavaScript): Added.

2:35 AM Changeset in webkit [280839] by Adrian Perez de Castro
  • 53 edits in releases/WebKitGTK/webkit-2.32/Source/WebKit

Merge r274172 - [IPC Hardening] Protect against bad input in WebProcessProxy::createSpeechRecognitionServer() and MessageReceiverMap
​https://bugs.webkit.org/show_bug.cgi?id=222948
<rdar://problem/75191472>

Reviewed by Alex Christensen.

Update MessageReceiverMap so that:

  1. Trying to remove a MessageReceiver that is not in the map does not do dangerous things.
  2. It stores weak pointers to the receivers instead of raw pointers. This would avoid doing bad things when trying to remove a message receiver that's already been destroyed.

Add a MESSAGE_CHECK() in WebProcessProxy::createSpeechRecognitionServer() to
make sure the identifier is not already in the map. There used to be a debug
assertion but we should MESSAGE_CHECK() too since the value is coming from
IPC.

  • GPUProcess/GPUConnectionToWebProcess.h:
  • GPUProcess/GPUProcess.h:
  • GPUProcess/media/RemoteAudioSessionProxy.h:
  • GPUProcess/media/RemoteCDMFactoryProxy.h:
  • GPUProcess/media/RemoteCDMProxy.h:
  • GPUProcess/media/RemoteLegacyCDMFactoryProxy.h:
  • GPUProcess/media/RemoteLegacyCDMProxy.h:
  • GPUProcess/media/RemoteLegacyCDMSessionProxy.h:
  • GPUProcess/media/RemoteMediaEngineConfigurationFactoryProxy.h:
  • GPUProcess/media/RemoteMediaPlayerManagerProxy.h:
  • GPUProcess/media/RemoteMediaPlayerProxy.h:
  • GPUProcess/media/RemoteMediaResourceManager.h:
  • GPUProcess/webrtc/RemoteSampleBufferDisplayLayer.h:
  • NetworkProcess/NetworkProcess.h:
  • NetworkProcess/ServiceWorker/WebSWServerConnection.h:
  • NetworkProcess/ServiceWorker/WebSWServerToContextConnection.h:
  • Platform/IPC/MessageReceiver.h:
  • Platform/IPC/MessageReceiverMap.cpp:

(IPC::MessageReceiverMap::addMessageReceiver):
(IPC::MessageReceiverMap::removeMessageReceiver):
(IPC::MessageReceiverMap::dispatchMessage):
(IPC::MessageReceiverMap::dispatchSyncMessage):

  • Platform/IPC/MessageReceiverMap.h:
  • Shared/API/Cocoa/RemoteObjectRegistry.h:
  • Shared/ApplePay/WebPaymentCoordinatorProxy.h:
  • Shared/Authentication/AuthenticationManager.h:
  • Shared/AuxiliaryProcess.h:
  • UIProcess/GPU/GPUProcessProxy.h:
  • UIProcess/Inspector/WebInspectorProxy.h:
  • UIProcess/Inspector/WebInspectorUIExtensionControllerProxy.h:
  • UIProcess/Media/AudioSessionRoutingArbitratorProxy.h:
  • UIProcess/Network/CustomProtocols/LegacyCustomProtocolManagerProxy.h:
  • UIProcess/Network/NetworkProcessProxy.h:
  • UIProcess/ProvisionalPageProxy.h:
  • UIProcess/SpeechRecognitionRemoteRealtimeMediaSourceManager.h:
  • UIProcess/SpeechRecognitionServer.h:
  • UIProcess/SuspendedPageProxy.h:
  • UIProcess/WebAuthentication/WebAuthnProcessProxy.h:
  • UIProcess/WebPageProxy.h:
  • UIProcess/WebProcessPool.h:
  • UIProcess/WebProcessProxy.cpp:

(WebKit::WebProcessProxy::createSpeechRecognitionServer):

  • UIProcess/WebProcessProxy.h:
  • WebAuthnProcess/WebAuthnProcess.h:
  • WebProcess/GPU/GPUProcessConnection.h:
  • WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h:
  • WebProcess/GPU/media/MediaPlayerPrivateRemote.h:
  • WebProcess/GPU/media/MediaSourcePrivateRemote.h:
  • WebProcess/GPU/media/SourceBufferPrivateRemote.h:
  • WebProcess/GPU/webrtc/SampleBufferDisplayLayer.h:
  • WebProcess/Inspector/WebInspectorUIExtensionController.h:
  • WebProcess/Network/WebSocketChannel.h:
  • WebProcess/Speech/SpeechRecognitionRealtimeMediaSourceManager.h:
  • WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.h:
  • WebProcess/WebPage/WebPage.h:
  • WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h:
  • WebProcess/WebStorage/StorageAreaMap.h:
2:33 AM Changeset in webkit [280838] by Adrian Perez de Castro
  • 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebKit

Merge r274160 - [IPC Hardening] IPC::decode(Decoder& decoder, RetainPtr<CFDictionaryRef>&) should make sure keys & values aren't null
​https://bugs.webkit.org/show_bug.cgi?id=222980

Reviewed by Geoffrey Garen.

[NSMutableDictionary setObject:forKey:] throws an exception when the given object or key is nil. The dictionary decoder
should therefore fail nicely when either of these is nil, instead of crashing.

  • Shared/cf/ArgumentCodersCF.cpp:

(IPC::decode):

2:31 AM Changeset in webkit [280837] by Adrian Perez de Castro
  • 3 edits in releases/WebKitGTK/webkit-2.32/Source/WebKit

Merge r274158 - [IPC Hardening] SandboxExtension::HandleArray IPC decoder should not call Vector::resize()
​https://bugs.webkit.org/show_bug.cgi?id=222977
<rdar://problem/75218451>

Reviewed by Anders Carlsson.

SandboxExtension::HandleArray IPC decoder should not call Vector::resize() with an untrusted size
coming from IPC. Instead, call Vector::append(), like the Vector IPC decoder does.

  • Shared/Cocoa/SandboxExtensionCocoa.mm:

(WebKit::SandboxExtension::HandleArray::append):
(WebKit::SandboxExtension::HandleArray::decode):

  • Shared/SandboxExtension.h:

(WebKit::SandboxExtension::append):

2:29 AM Changeset in webkit [280836] by Adrian Perez de Castro
  • 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebKit

Merge r274153 - [IPC Hardening] Protect WebPageProxy::willSubmitForm() against bad Strings
​https://bugs.webkit.org/show_bug.cgi?id=222955
<rdar://problem/75195062>

Reviewed by Anders Carlsson.

The Strings passed in textFieldValues are used as keys in a HashMap later on so we need
to validate them.

  • UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::willSubmitForm):

2:28 AM Changeset in webkit [280835] by Adrian Perez de Castro
  • 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274146 - Suspend widget hierarchy updates while executing node insertion
​https://bugs.webkit.org/show_bug.cgi?id=222719

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2021-03-09
Reviewed by Ryosuke Niwa.

  • dom/ContainerNode.cpp:

(WebCore::executeNodeInsertionWithScriptAssertion):

2:27 AM Changeset in webkit [280834] by Adrian Perez de Castro
  • 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274144 - [Multi-column] Adjust fragmented flow state of the out-of-flow descendants
​https://bugs.webkit.org/show_bug.cgi?id=222958
<rdar://74865741>

Reviewed by Antti Koivisto.

When a block container's style change from positioned to non-positioned and it is part of a multi-column context,
we need to make sure that the out-of-flow positined descendants' flow state are updated accordingly (as
they may not be part of the multi-column context anymore).

  • rendering/RenderElement.cpp:

(WebCore::RenderElement::adjustFragmentedFlowStateOnContainingBlockChangeIfNeeded):

2:27 AM Changeset in webkit [280833] by Adrian Perez de Castro
  • 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274131 - Crash in in ReplaceSelectionCommand::mergeEndIfNeeded()
​https://bugs.webkit.org/show_bug.cgi?id=222941

Patch by Julian Gonzalez <​julian_a_gonzalez@apple.com> on 2021-03-08
Reviewed by Ryosuke Niwa.

Make a copy of Ref<HTMLBRElement> when inserting before start of paragraph.

  • editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplaceSelectionCommand::mergeEndIfNeeded):

2:22 AM Changeset in webkit [280832] by Adrian Perez de Castro
  • 3 edits
    2 adds in releases/WebKitGTK/webkit-2.32

Merge r274064 - REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
​https://bugs.webkit.org/show_bug.cgi?id=222720

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2021-03-08
Reviewed by Ryosuke Niwa.

Source/WebCore:

The list of assigned nodes contains weak pointers, we should check the node hasn't been destroyed.

Test: fast/html/details-set-inner-text-crash.html

  • dom/ComposedTreeIterator.cpp:

(WebCore::ComposedTreeIterator::traverseNextInShadowTree):

LayoutTests:

  • fast/html/details-set-inner-text-crash-expected.txt: Added.
  • fast/html/details-set-inner-text-crash.html: Added.
2:22 AM Changeset in webkit [280831] by Adrian Perez de Castro
  • 3 edits in releases/WebKitGTK/webkit-2.32/Source/WebKit

Merge r274027 - [IPC Hardening] Protect against bad navigationID in WebPageProxy::didDestroyNavigation()
​https://bugs.webkit.org/show_bug.cgi?id=222842
<rdar://problem/75119560>

Reviewed by Darin Adler.

  • UIProcess/WebNavigationState.h:
  • UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::didDestroyNavigation):

2:20 AM Changeset in webkit [280830] by Adrian Perez de Castro
  • 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r273938 - Deploy Ref<T> in SVGUseElement.cpp
​https://bugs.webkit.org/show_bug.cgi?id=222637

Patch by Julian Gonzalez <​julian_a_gonzalez@apple.com> on 2021-03-04
Reviewed by Ryosuke Niwa.

Remove usage of raw pointers in a few functions here
that showed issues in 222397.

Thanks to Darin Adler for the initial version of this patch
and Ryosuke Niwa for refinements.

  • svg/SVGUseElement.cpp:

(WebCore::disassociateAndRemoveClones):
(WebCore::removeDisallowedElementsFromSubtree):
(WebCore::removeSymbolElementsFromSubtree):

2:19 AM Changeset in webkit [280829] by Adrian Perez de Castro
  • 11 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r273935 - "precustomized" state of custom elements can become HTMLUnknownElement
​https://bugs.webkit.org/show_bug.cgi?id=221652

Reviewed by Darin Adler.

The bug was caused by createJSHTMLWrapper in JSHTMLElementWrapperFactory.cpp relying on
!isCustomElementUpgradeCandidate() to create HTMLUnknownElement as JS wrapper of the element.

This is problematic after r266269 since that change re-purposes CustomElementState::Failed
on a custom element as "precustomized" state instead of introducing another enum value in
CustomElementState as RareDataBitFields has no more bits available.

This patch fixes the problem by introducing a new NodeFlag::IsUnknownElement and using that
to check whether JSHTMLUnknownElement should be created for a given element or not. Note that
HTMLElement had a virtual function, isHTMLUnknownElement, to check this condition but invoking
a virtual function proved to incur too much runtime cost.

  • dom/Node.h:

(WebCore::Node::isUnknownElement const): Added.
(WebCore::Node::isHTMLUnknownElement const): Added.
(WebCore::Node::isSVGUnknownElement const): Added.
(WebCore::Node::isMathMLUnknownElement const): Added.
(WebCore::Node::NodeFlag): Added NodeFlag::IsUnknownElement.

  • dom/make_names.pl:

(printWrapperFactoryCppFile): Treat the element as HTMLUnknownElement only if isUnknownElement
returns true instead of isCustomElementUpgradeCandidate returning false.

  • html/HTMLElement.h:

(WebCore::HTMLElement::isHTMLUnknownElement const): Deleted.

  • html/HTMLUnknownElement.h:
  • mathml/MathMLElement.cpp:

(WebCore::MathMLElement::MathMLElement): Added ConstructionType as an argument.

  • mathml/MathMLElement.h:
  • mathml/MathMLUnknownElement.h:

(WebCore::MathMLUnknownElement::MathMLUnknownElement): Set NodeFlag::IsUnknownElement.

  • svg/SVGElement.cpp:

(WebCore::SVGElement::SVGElement): Added ConstructionType as an argument.

  • svg/SVGElement.h:
  • svg/SVGUnknownElement.h:

(WebCore::SVGUnknownElement::SVGUnknownElement): Set NodeFlag::IsUnknownElement.

1:57 AM Changeset in webkit [280828] by Adrian Perez de Castro
  • 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r273692 - Protect AudioWorkletGlobalScope::registerProcessor() against re-entry
​https://bugs.webkit.org/show_bug.cgi?id=222567
<rdar://74860464>

Reviewed by Eric Carlson.

AudioWorkletGlobalScope::registerProcessor() checks if 'name' is in m_processorConstructorMap
then does some checks that potentially run JS and thus call registerProcessor() again (potentially
with the same name). To address this, we now check the map again after potentially running the
JS code.

  • Modules/webaudio/AudioWorkletGlobalScope.cpp:

(WebCore::AudioWorkletGlobalScope::registerProcessor):

1:41 AM Changeset in webkit [280827] by cathiechen
  • 4 edits
    4 adds in trunk/LayoutTests

Import css/css-sizing/aspect-ratio tests from WPT
​https://bugs.webkit.org/show_bug.cgi?id=228945

LayoutTests/imported/w3c:

Import css/css-sizing/aspect-ratio tests from WPT commit dd5aead14c.

Reviewed by Rob Buis.

  • web-platform-tests/css/css-sizing/aspect-ratio/flex-aspect-ratio-029-expected.xht: Added.
  • web-platform-tests/css/css-sizing/aspect-ratio/flex-aspect-ratio-029.html: Added.
  • web-platform-tests/css/css-sizing/aspect-ratio/flex-aspect-ratio-030-expected.xht: Added.
  • web-platform-tests/css/css-sizing/aspect-ratio/flex-aspect-ratio-030.html: Added.
  • web-platform-tests/css/css-sizing/aspect-ratio/w3c-import.log:

LayoutTests:

Reviewed by Rob Buis.

1:25 AM Changeset in webkit [280826] by ysuzuki@apple.com
  • 8 edits in trunk

Partially revert r280256 behavior change since it broke Facetime
​https://bugs.webkit.org/show_bug.cgi?id=228943
rdar://81700268

Reviewed by Mark Lam.

Source/WebCore:

In r280256, custom accessors start getting holder's JSGlobalObject (this is right behavior).
We also introduced IncumbentWindow IDL attribute to get the caller's JSGlobalObject, which is
necessary in Location. At that time, we replaced all ActiveWindow to IncumbentWindow, but it
changes the JSGlobalObject of replace, assign, and reload since they are functions (not
custom accessors). We observed that, after this change, facetime Web page is broken: when opening
the link to Facetime, it should show the prompt of "Open in Facetime app" in iOS. But after this
change, it won't happen.

We revert the semantic change by using ActiveWindow for replace, assign, and reload. This is
not the correct semantics from the spec, but this is the same to one before r280256, and we
will change this once we find the way to bypass this issue.

  • page/Location.cpp:

(WebCore::Location::assign):
(WebCore::Location::replace):
(WebCore::Location::reload):

  • page/Location.h:
  • page/Location.idl:

LayoutTests:

  • fast/frames/sandboxed-iframe-navigation-parent-expected.txt:
  • fast/frames/sandboxed-iframe-navigation-parent.html:
  • http/tests/security/frameNavigation/context-for-location-assign-expected.txt:

Aug 9, 2021:

11:56 PM Changeset in webkit [280825] by ysuzuki@apple.com
  • 4 edits in trunk

[JSC] super-Latin1 white space and line terminator after regular expression literal misinterpreted as flags
​https://bugs.webkit.org/show_bug.cgi?id=227944

Reviewed by Alexey Shvayka.

JSTests:

  • test262/expectations.yaml:

Source/JavaScriptCore:

There are non-Latin1 white-spaces and line-terminators, but Lexer::scanRegExp's code did not assume that.
As a result, if there is a non-Latin1 white-spaces or line-terminators after RegExp, we raise SyntaxError
while this is valid. This patch fixes that.

  • parser/Lexer.cpp:

(JSC::Lexer<T>::scanRegExp):

8:33 PM Changeset in webkit [280824] by Chris Dumez
  • 35 edits
    2 adds in trunk

Blob URL changes after loading it
​https://bugs.webkit.org/show_bug.cgi?id=228923

Reviewed by Geoff Garen.

Source/WebCore:

Blob URL changes after loading it. This is because we use URLWithBlobURLLifetimeExtension to
extend the lifetime of the Blob URL during the load and URLWithBlobURLLifetimeExtension ends
up creating a new public Blob URL. This is Web-observable so we need a way to extend the
lifetime of a Blob URL without actually generating a new Blob URL.

This patch replaces URLWithBlobURLLifetimeExtension with a new BlobURLHandle class which
extends the lifetime of a Blob URL as long as there are BlobURLHandle objects referring
to it. BlobURLHandle works with both private and public Blob URLs so it replaces
Blob::Handle as well (which I recently introduced via r280547). The Blob URL no longer
changes when we extend its lifetime. Instead, the Blob registry now keeps track of
references to a given Blob and only removes a Blob URL once there are no longer any
references to it.

Test: fast/files/blob-as-frame-url.html

  • Headers.cmake:
  • WebCore.xcodeproj/project.pbxproj:
  • bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneSerializer::serialize):
(WebCore::CloneSerializer::CloneSerializer):
(WebCore::CloneSerializer::dumpIfTerminal):
(WebCore::SerializedScriptValue::SerializedScriptValue):
(WebCore::SerializedScriptValue::create):

  • bindings/js/SerializedScriptValue.h:

(WebCore::SerializedScriptValue::blobHandles const):
(WebCore::SerializedScriptValue::SerializedScriptValue):

  • fileapi/Blob.cpp:

(WebCore::Blob::Blob):
(WebCore::Blob::slice const):
(WebCore::Blob::size const):
(WebCore::Blob::handle const):

  • fileapi/Blob.h:

(WebCore::Blob::url const):

  • fileapi/BlobURL.cpp:

(WebCore::BlobURLHandle::BlobURLHandle):
(WebCore::BlobURLHandle::~BlobURLHandle):
(WebCore::BlobURLHandle::registerBlobURLHandleIfNecessary):
(WebCore::BlobURLHandle::unregisterBlobURLHandleIfNecessary):
(WebCore::BlobURLHandle::operator=):
(WebCore::BlobURLHandle::clear):

  • fileapi/BlobURL.h:

(WebCore::BlobURLHandle::BlobURLHandle):
(WebCore::BlobURLHandle::url const):

  • fileapi/ThreadableBlobRegistry.cpp:

(WebCore::ThreadableBlobRegistry::registerBlobURLHandle):
(WebCore::ThreadableBlobRegistry::unregisterBlobURLHandle):

  • fileapi/ThreadableBlobRegistry.h:
  • loader/PolicyChecker.cpp:

(WebCore::FrameLoader::PolicyChecker::extendBlobURLLifetimeIfNecessary const):
(WebCore::FrameLoader::PolicyChecker::checkNavigationPolicy):
(WebCore::FrameLoader::PolicyChecker::checkNewWindowPolicy):

  • loader/PolicyChecker.h:
  • platform/network/BlobRegistry.h:
  • platform/network/BlobRegistryImpl.cpp:

(WebCore::BlobRegistryImpl::registerFileBlobURL):
(WebCore::BlobRegistryImpl::registerBlobURL):
(WebCore::BlobRegistryImpl::registerBlobURLOptionallyFileBacked):
(WebCore::BlobRegistryImpl::registerBlobURLForSlice):
(WebCore::BlobRegistryImpl::unregisterBlobURL):
(WebCore::BlobRegistryImpl::addBlobData):
(WebCore::BlobRegistryImpl::registerBlobURLHandle):
(WebCore::BlobRegistryImpl::unregisterBlobURLHandle):

  • platform/network/BlobRegistryImpl.h:
  • xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::setResponseType):
(WebCore::XMLHttpRequest::open):
(WebCore::XMLHttpRequest::prepareToSend):
(WebCore::XMLHttpRequest::send):
(WebCore::XMLHttpRequest::createRequest):
(WebCore::XMLHttpRequest::clearRequest):
(WebCore::XMLHttpRequest::didFinishLoading):

  • xml/XMLHttpRequest.h:

Source/WebKit:

  • NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::registerBlobURLHandle):
(WebKit::NetworkConnectionToWebProcess::unregisterBlobURLHandle):

  • NetworkProcess/NetworkConnectionToWebProcess.h:
  • NetworkProcess/NetworkConnectionToWebProcess.messages.in:
  • NetworkProcess/NetworkProcessPlatformStrategies.cpp:

(WebKit::NetworkProcessPlatformStrategies::createBlobRegistry):

  • WebProcess/FileAPI/BlobRegistryProxy.cpp:

(WebKit::BlobRegistryProxy::registerBlobURLHandle):
(WebKit::BlobRegistryProxy::unregisterBlobURLHandle):

  • WebProcess/FileAPI/BlobRegistryProxy.h:

Source/WebKitLegacy/mac:

  • WebCoreSupport/WebPlatformStrategies.mm:

Source/WebKitLegacy/win:

  • WebCoreSupport/WebPlatformStrategies.cpp:

LayoutTests:

Add layout test coverage.

  • fast/files/blob-as-frame-url-expected.txt: Added.
  • fast/files/blob-as-frame-url.html: Added.
8:11 PM Changeset in webkit [280823] by mmaxfield@apple.com
  • 2 edits in trunk

Update logging docs after r280758
​https://bugs.webkit.org/show_bug.cgi?id=228899

Reviewed by Fujii Hironori.

Add more information about logging.

  • Introduction.md:
7:54 PM Changeset in webkit [280822] by Lauro Moura
  • 2 edits in trunk/LayoutTests

[GLIB] Garden two getUserMedia timeouts

Unreviewed test gardening.

  • platform/glib/TestExpectations:
7:29 PM Changeset in webkit [280821] by Fujii Hironori
  • 2 edits in trunk/Source/WTF

[GTK][WPE] REGRESSION(r280795): MemoryPressureHandlerUnix.cpp:45:28: error: ‘LogMemoryPressure’ was not declared in this scope
​https://bugs.webkit.org/show_bug.cgi?id=228938

Unreviewed build fix.

  • wtf/unix/MemoryPressureHandlerUnix.cpp:
7:15 PM Changeset in webkit [280820] by Fujii Hironori
  • 2 edits in trunk/Source/WTF

[WTF][Win] REGRESSION(r280795) error LNK2019: unresolved external symbol "class WTF::String cdecl WTF::logLevelString(void)"
​https://bugs.webkit.org/show_bug.cgi?id=228937
<rdar://problem/81722757>

Unresolved build fix.
The previous attempt (r280819) didn't actually fix the build
error. LoggingWin.cpp has to include LogInitialization.h.

  • wtf/win/LoggingWin.cpp:
6:36 PM Changeset in webkit [280819] by Fujii Hironori
  • 2 edits in trunk/Source/WTF

[WTF][Win] REGRESSION(r280795) error LNK2019: unresolved external symbol "class WTF::String cdecl WTF::logLevelString(void)"
​https://bugs.webkit.org/show_bug.cgi?id=228937

Unreviewed build fix.

error LNK2019: unresolved external symbol "class WTF::String cdecl WTF::logLevelString(void)" (?logLevelString@WTF@@YA?AVString@1@XZ)

referenced in function "private: void cdecl WebKit::GPUProcessProxy::platformInitializeGPUProcessParameters(struct WebKit::GPUProcessCreationParameters &)"
(?platformInitializeGPUProcessParameters@GPUProcessProxy@WebKit@@AEAAXAEAUGPUProcessCreationParameters@2@@Z)
bin64\WebKit2.dll : fatal error LNK1120: 1 unresolved externals

  • wtf/LogInitialization.h: Added WTF_EXPORT_PRIVATE for logLevelString.
6:02 PM Changeset in webkit [280818] by Russell Epstein
  • 1 copy in tags/Safari-612.1.27.2.1

Tag Safari-612.1.27.2.1.

6:02 PM Changeset in webkit [280817] by Russell Epstein
  • 1 copy in tags/Safari-612.1.27.3.2

Tag Safari-612.1.27.3.2.

6:00 PM Changeset in webkit [280816] by Russell Epstein
  • 2 edits in branches/safari-612.1.27.3-branch/Source/WebKit

Cherry-pick r280753. rdar://problem/81700429

Page on mhlw.go.jp triggers WebContent termination by GPU process
​https://bugs.webkit.org/show_bug.cgi?id=228885
<rdar://81603231>

Reviewed by Wenson Hsieh.

​https://www.mhlw.go.jp/stf/seisakunitsuite/bunya/0000164708_00001.html triggered an issue
where RemoteRenderingBackend::finalizeRenderingUpdate() would be called when the
GPU process had just processed a "switching to next item buffer" meta command,
but had not yet received the new item buffer. This triggered the
MESSAGE_CHECK(initialHandle, "Missing initial shared display list handle");
in RemoteRenderingBackend::wakeUpAndApplyDisplayList().

Protect against this by having finalizeRenderingUpdate() check that
arguments.itemBufferIdentifier had been received, which is similar to what happens
inside the loop in wakeUpAndApplyDisplayList() already.

Not easily testable.

  • GPUProcess/graphics/RemoteRenderingBackend.cpp: (WebKit::RemoteRenderingBackend::finalizeRenderingUpdate):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280753 268f45cc-cd09-0410-ab3c-d52691b4dbfc

5:59 PM Changeset in webkit [280815] by Russell Epstein
  • 8 edits in branches/safari-612.1.27.3-branch/Source

Versioning.

WebKit-7612.1.27.3.2

5:45 PM Changeset in webkit [280814] by Russell Epstein
  • 2 edits in branches/safari-612.1.27.2-branch/Source/WebKit

Cherry-pick r280753. rdar://problem/81700429

Page on mhlw.go.jp triggers WebContent termination by GPU process
​https://bugs.webkit.org/show_bug.cgi?id=228885
<rdar://81603231>

Reviewed by Wenson Hsieh.

​https://www.mhlw.go.jp/stf/seisakunitsuite/bunya/0000164708_00001.html triggered an issue
where RemoteRenderingBackend::finalizeRenderingUpdate() would be called when the
GPU process had just processed a "switching to next item buffer" meta command,
but had not yet received the new item buffer. This triggered the
MESSAGE_CHECK(initialHandle, "Missing initial shared display list handle");
in RemoteRenderingBackend::wakeUpAndApplyDisplayList().

Protect against this by having finalizeRenderingUpdate() check that
arguments.itemBufferIdentifier had been received, which is similar to what happens
inside the loop in wakeUpAndApplyDisplayList() already.

Not easily testable.

  • GPUProcess/graphics/RemoteRenderingBackend.cpp: (WebKit::RemoteRenderingBackend::finalizeRenderingUpdate):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280753 268f45cc-cd09-0410-ab3c-d52691b4dbfc

5:43 PM Changeset in webkit [280813] by Russell Epstein
  • 8 edits in branches/safari-612.1.27.2-branch/Source

Versioning.

WebKit-7612.1.27.2.1

5:27 PM Changeset in webkit [280812] by Russell Epstein
  • 1 copy in tags/Safari-612.1.27.0.4

Tag Safari-612.1.27.0.4.

5:07 PM Changeset in webkit [280811] by mmaxfield@apple.com
  • 13 edits in trunk/Source

Create a Language log channel
​https://bugs.webkit.org/show_bug.cgi?id=228764

Reviewed by Simon Fraser.

Source/WebKit:

  • Platform/Logging.h:
  • Shared/EntryPointUtilities/Cocoa/XPCService/XPCServiceMain.mm:

(WebKit::setAppleLanguagesPreference):

  • UIProcess/Launcher/mac/ProcessLauncherMac.mm:

(WebKit::ProcessLauncher::launchProcess):

  • UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::setOverrideLanguages):
(WebKit::WebProcessPool::initializeNewWebProcess):

  • UIProcess/WebProcessProxy.cpp:

(WebKit::WebProcessProxy::getLaunchOptions):

  • WebProcess/WebProcess.cpp:

(WebKit::WebProcess::initializeWebProcess):
(WebKit::WebProcess::userPreferredLanguagesChanged const):

Source/WTF:

There have been a variety of bug reports over the past months/years about the procedure
by which we determine navigator.language. It's actually somewhat convoluted, so this
patch adds a (debug) log channel for it so we can follow what it's doing easily.

To enable all the logging, run these commands:

% defaults write com.apple.WebKit.WebContent.Development WTFLogging Language
% defaults write com.apple.WebKit.WebContent.Development WebKit2Logging Language
% defaults write com.apple.WebKit.WebContent WTFLogging Language
% defaults write com.apple.WebKit.WebContent WebKit2Logging Language
% defaults write -g WTFLogging Language
% defaults write -g WebKit2Logging Language
% defaults write /Users/$USER/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist WTFLogging Language
% defaults write /Users/$USER/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist WebKit2Logging Language

  • wtf/Language.cpp:

(WTF::defaultLanguage):
(WTF::overrideUserPreferredLanguages):
(WTF::userPreferredLanguages):

  • wtf/Logging.cpp:
  • wtf/Logging.h:
  • wtf/cf/LanguageCF.cpp:

(WTF::platformUserPreferredLanguages):

  • wtf/cocoa/LanguageCocoa.mm:

(WTF::minimizedLanguagesFromLanguages):

4:59 PM Changeset in webkit [280810] by Robert Jenner
  • 2 edits in trunk/LayoutTests

[ Monterey Release wk2 ] platform/mac/fast/overflow/overflow-scrollbar-hit-test.html is a flaky crash
​https://bugs.webkit.org/show_bug.cgi?id=228200

Unreviewed test gardening.

  • platform/mac-wk2/TestExpectations:
4:48 PM Changeset in webkit [280809] by commit-queue@webkit.org
  • 2 edits in trunk/Source/JavaScriptCore

Fix yet another -Wreturn-type warning
​https://bugs.webkit.org/show_bug.cgi?id=228928

Unreviewed.

Patch by Michael Catanzaro <Michael Catanzaro> on 2021-08-09

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl):

4:46 PM Changeset in webkit [280808] by Yijia Huang
  • 6 edits in trunk/Source/JavaScriptCore

[ARM64] Clean up and fix Pre/Post-Indexed Address Mode to Air for ARM64 (Load Instruction)
​https://bugs.webkit.org/show_bug.cgi?id=228890

Reviewed by Keith Miller.

This patch cleans up and does minor fix to the previous patch (​https://bugs.webkit.org/show_bug.cgi?id=228047).

For the modifications in b3/B3Generate.cpp and b3/B3CanonicalizePrePostIncrements.cpp, we
need to convert post-index candidates to the canonical form. So, the address value needs to
be moved immediately before the load. This is subject to the dominance constraints that add
must be controlled equivalent to the load. So, similarly, if we need to move the offset to
just before the load, the dominance constraints must be satisfied. Since it is a constant
value, a better approach is to add a new constant value before the memory value. Then,
eliminate the dead code.

There is a bug in b3/B3CanonicalizePrePostIncrements.cpp. The insertionSet.execute(BasicBlock)
will reorder value indexes in the basic block. So, we should re-search for the value index in
the block every time after the execution.

In b3/B3LowerToAir.cpp, we need m_locked checks on address and base values. If they are already
locked, there is no need to convert the Load instruction to the pre/post-increment form.

  • b3/B3CanonicalizePrePostIncrements.cpp:

(JSC::B3::canonicalizePrePostIncrements):

  • b3/B3Generate.cpp:

(JSC::B3::generateToAir):

  • b3/B3LowerToAir.cpp:
  • b3/air/AirArg.h:

(JSC::B3::Air::Arg::isValidIncrementIndexForm):
(JSC::B3::Air::Arg::isValidForm const):
(JSC::B3::Air::Arg::isValidPreIndexForm): Deleted.
(JSC::B3::Air::Arg::isValidPostIndexForm): Deleted.

  • b3/air/opcode_generator.rb:
4:41 PM Changeset in webkit [280807] by Simon Fraser
  • 7 edits
    2 adds in trunk

Vertical scroll with mouse wheel in horizontal scroller fails to propagate to the document
​https://bugs.webkit.org/show_bug.cgi?id=228891
<rdar://81640239>

Reviewed by Antti Koivisto.

Source/WebCore:

If a page has a horizontal scrolling carousel with a non-passive wheel event handler, and a
user with a clicky scroll wheel mouse tries to vertically scroll over that carousel, then
we'd fail to propagate the scroll to the page. This affects apple.com/store.

This happened because we don't do latching for legacy mouse wheel events, so we hit the code
in EventHandler::handleWheelEventInAppropriateEnclosingBox(); this finds the carousel and
calls handleWheelEventInScrollableArea(), but that dispatches to the scrolling thread in way
that does not propagate the event to the nearest ancestor that can handle it.

The fix is to check that the ScrollableArea can handle the event, sharing some code that
already exists and was used by findEnclosingScrollableContainer(). This is a conservative
fix; it's possible that scrollableAreaCanHandleEvent() could be called down in
handleWheelEventInScrollableArea() but that will affect other call sites.

Test: fast/scrolling/mac/vertical-scroll-in-horizontal-scroller.html

  • page/EventHandler.cpp:

(WebCore::EventHandler::handleWheelEventInAppropriateEnclosingBox):
(WebCore::EventHandler::scrollableAreaCanHandleEvent):

  • page/EventHandler.h:
  • page/mac/EventHandlerMac.mm:

(WebCore::findEnclosingScrollableContainer):

LayoutTests:

  • fast/scrolling/mac/vertical-scroll-in-horizontal-scroller-expected.txt: Added.
  • fast/scrolling/mac/vertical-scroll-in-horizontal-scroller.html: Added.
  • tiled-drawing/scrolling/overflow-scroll-reduced-content.html: Convert this test to use

async scrolling. webkit.org/b/228898 tracks an existing problem that caused the test
to fail with non-async scrolling.

4:32 PM Changeset in webkit [280806] by Ayumi Kojima
  • 2 edits in trunk/LayoutTests

[ MacOS wk2 ] tiled-drawing/scrolling/scroll-snap/scroll-snap-momentum-in-non-snapping-axis.html is a flaky timeout.
​https://bugs.webkit.org/show_bug.cgi?id=228930

Unreviewed test gardening.

  • platform/mac-wk2/TestExpectations:
3:55 PM Changeset in webkit [280805] by Adrian Perez de Castro
  • 3 edits in releases/WebKitGTK/webkit-2.32/Source/JavaScriptCore

Merge r280770 - Adding missing REFERENCED_FROM_ASM annotations to facilitate LTO
​https://bugs.webkit.org/show_bug.cgi?id=228865

Patch by Michael Catanzaro <Michael Catanzaro> on 2021-08-09
Reviewed by Yusuke Suzuki.

When investigating why WebKitGTK fails to build with LTO (link-time optimization) enabled,
one of the GCC developers noticed that we are missing attribute (("used")) on several
C++ functions declared in LLIntSlowPaths.h and WasmSlowPaths.h that are called only from
asm. Without this attribute, GCC assumes the functions are unused and drops them, then
linking fails because they really are used.

  • llint/LLIntSlowPaths.h:
  • wasm/WasmSlowPaths.h:
3:55 PM Changeset in webkit [280804] by Adrian Perez de Castro
  • 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r273868 - Crash in removeSymbolElementsFromSubtree()
​https://bugs.webkit.org/show_bug.cgi?id=222397

Patch by Julian Gonzalez <​julian_a_gonzalez@apple.com> on 2021-03-03
Reviewed by Ryosuke Niwa.

Skip children in removeSymbolElementsFromSubtree(), so that
we don't see nodes that have been removed in disassociateAndRemoveClones.

Thanks to Darin Adler for the initial version of this patch
and Ryosuke Niwa for refinements.

  • svg/SVGUseElement.cpp:

(WebCore::removeSymbolElementsFromSubtree):

3:55 PM Changeset in webkit [280803] by Adrian Perez de Castro
  • 7 edits in releases/WebKitGTK/webkit-2.32/Source/JavaScriptCore

Merge r278856 - Add ldp and stp support for FP registers, plus some bug fixes.
​https://bugs.webkit.org/show_bug.cgi?id=226998
rdar://79313717

Reviewed by Robin Morisset.

This patch does the following:

  1. Add ldp and stp support for FP registers. This simply entails providing wrappers that take FPRegisterID and passing true for the V bit to the underlying loadStoreRegisterPairXXX encoding function. V is for vector (aka floating point). This will cause bit 26 in the instruction to be set indicating that it's loading / storing floating point registers.
  1. Add ARM64 disassembler support ldp and stp for FP registers. This includes fixing A64DOpcodeLoadStoreRegisterPair::mask to not exclude the FP versions of the instructions.
  1. Add ARM64Assembler query methods for determining if an immediate is encodable as the signed 12 bit immediate of ldp and stp instructions.
  1. Fix ldp and stp offset form to take an int instead of an unsigned. The immediate it takes is a 12-bit signed int, not unsigned.
  1. In loadStoreRegisterPairXXX encoding functions used by the forms of ldp and stp, RELEASE_ASSERT that the passed in immediate is encodable. Unlike ldur / stur, there is no form of ldp / stp that takes the offset in a register that can be used as a fail over. Hence, if the immediate is not encodable, this is a non-recoverable event. The client is responsible for ensuring that the offset is encodable.
  1. Added some testmasm tests for testing the offset form (as opposed to PreIndex and PostIndex forms) of ldp and stp. We currently only use the offset form in our JITs.
  • assembler/ARM64Assembler.h:

(JSC::ARM64Assembler::isValidLDPImm):
(JSC::ARM64Assembler::isValidLDPFPImm):
(JSC::ARM64Assembler::ldp):
(JSC::ARM64Assembler::ldnp):
(JSC::ARM64Assembler::isValidSTPImm):
(JSC::ARM64Assembler::isValidSTPFPImm):
(JSC::ARM64Assembler::stp):
(JSC::ARM64Assembler::stnp):
(JSC::ARM64Assembler::loadStoreRegisterPairPostIndex):
(JSC::ARM64Assembler::loadStoreRegisterPairPreIndex):
(JSC::ARM64Assembler::loadStoreRegisterPairOffset):
(JSC::ARM64Assembler::loadStoreRegisterPairNonTemporal):

  • assembler/AssemblerCommon.h:

(JSC::isValidSignedImm7):

  • assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::loadPair64):
(JSC::MacroAssemblerARM64::storePair64):

  • assembler/testmasm.cpp:

(JSC::testLoadStorePair64Int64):
(JSC::testLoadStorePair64Double):

  • disassembler/ARM64/A64DOpcode.cpp:

(JSC::ARM64Disassembler::A64DOpcodeLoadStoreRegisterPair::format):

  • disassembler/ARM64/A64DOpcode.h:
3:54 PM Changeset in webkit [280802] by Adrian Perez de Castro
  • 4 edits
    1 add in releases/WebKitGTK/webkit-2.32

Merge r280422 - [WPE][GTK] .asc file extension is appended to filename of text/plain downloads
​https://bugs.webkit.org/show_bug.cgi?id=228566

Patch by Michael Catanzaro <Michael Catanzaro> on 2021-07-29
Reviewed by Adrian Perez de Castro.

Source/WebCore:

Our MIMETypeRegistry::preferredExtensionForMIMEType returns "asc" for text/plain, possibly
because "asc" sorts alphabetically ahead of all other possible file extensions for
text/plain, and we just pick the first one. So if the text file does not contain any file
extension, we give it a file extension for a GPG signature. Ouch.

I don't know how to fix it, but we don't need to, because we don't really want to append any
file extension for text/plain anyway. That's just annoying. If I download a file named
"backtrace" then I don't want it renamed to "backtrace.txt". That would be expected on
Windows, but certainly not from WebKitGTK. So I think it's reasonable to have a special case
for text/plain.

  • platform/xdg/MIMETypeRegistryXdg.cpp:

(WebCore::MIMETypeRegistry::preferredExtensionForMIMEType):

Tools:

  • TestWebKitAPI/Tests/WebKitGLib/TestDownloads.cpp:

(serverCallback):
(testDownloadTextPlainMIMEType):
(beforeAll):

  • TestWebKitAPI/Tests/WebKitGLib/resources/text: Added.
3:49 PM Changeset in webkit [280801] by Robert Jenner
  • 1 edit
    1 add in trunk/LayoutTests

(rebaseline) [ iOS ] 2 imported/w3c/web-platform-tests/css/cssom/* tests failing
​https://bugs.webkit.org/show_bug.cgi?id=228200

Unreviewed iOS 15 rebase being added to OpenSource.

  • platform/ios/imported/w3c/web-platform-tests/css/cssom/cssstyledeclaration-csstext-expected.txt: Added.
3:49 PM Changeset in webkit [280800] by Russell Epstein
  • 1 edit in branches/safari-612.1.15.4-branch/Source/Makefile

Speculative Build Fix. rdar://79147214

2:38 PM Changeset in webkit [280799] by keith_miller@apple.com
  • 2 edits in trunk/Source/JavaScriptCore

Revert bad assert about the number of upsilons going into a phi
​https://bugs.webkit.org/show_bug.cgi?id=228922

Reviewed by Yusuke Suzuki.

This assert was invalid because we sometimes emit unreachable phis
that don't have any incoming upsilons. Specifically for MultiGetByOffset.

  • ftl/FTLOutput.h:

(JSC::FTL::Output::phi):

2:24 PM Changeset in webkit [280798] by Russell Epstein
  • 12 edits
    2 adds in branches/safari-612.1.27.0-branch

Cherry-pick r280720. rdar://problem/81706814

MediaPlayerPrivateMediaStreamAVFObjC should skip enqueuing frames when not visible
​https://bugs.webkit.org/show_bug.cgi?id=228816
<rdar://81077972>

Reviewed by Eric Carlson.

Source/WebCore:

Do not create layers when not needed.
This prevents enqueuing frames in a AVSampleBufferDisplayLayer that will only buffer them, thus breaking camera capture/video decoding.
We do this by not calling ensureLayers when getting a new track. Instead we react upon player renderingCanBeAccelerated value.

It is also unnecessary and takes CPU cycles to enqueue frames when the video element is not visible.
HTMLMediaElement and RenderVideo thus pass to MediaPlayer a new flag telling whether the video element is visible in the view port.
MediaPlayerPrivateMediaStreamAVFObjC will then skip enqueueing frames if not needed.

Add getter and internals API to cover these changes.

Test: fast/mediastream/mediaPlayer-visibility.html

  • html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::isVisibleInViewportChanged):
  • platform/graphics/MediaPlayer.cpp: (WebCore::MediaPlayer::loadWithNextMediaEngine): (WebCore::MediaPlayer::setVisibleInViewport):
  • platform/graphics/MediaPlayer.h:
  • platform/graphics/MediaPlayerPrivate.h: (WebCore::MediaPlayerPrivateInterface::setVisibleInViewport):
  • platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
  • platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm: (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::enqueueVideoSample): (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::setVisible): (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::setVisibleInViewport): (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::checkSelectedVideoTrack): (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::paintCurrentFrameInContext):
  • rendering/RenderVideo.cpp: (WebCore::RenderVideo::updatePlayer):
  • testing/Internals.cpp: (WebCore::Internals::isPlayerVisibleInViewport const):
  • testing/Internals.h:
  • testing/Internals.idl:

LayoutTests:

  • fast/mediastream/mediaPlayer-visibility-expected.txt: Added.
  • fast/mediastream/mediaPlayer-visibility.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280720 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:24 PM Changeset in webkit [280797] by Russell Epstein
  • 3 edits
    2 adds in branches/safari-612.1.27.0-branch

Cherry-pick r280586. rdar://problem/81706593

Check that shadow root is connected in invalidateStyleAfterStyleSheetChange
​https://bugs.webkit.org/show_bug.cgi?id=227383

Patch by Rob Buis <​rbuis@igalia.com> on 2021-08-03
Reviewed by Antti Koivisto.

Source/WebCore:

Check that shadow root is connected in invalidateStyleAfterStyleSheetChange.

Test: fast/shadow-dom/shadow-tree-removal-crash.html

  • style/StyleScope.cpp: (WebCore::Style::Scope::updateActiveStyleSheets):

LayoutTests:

Add test for this.

  • fast/shadow-dom/shadow-tree-removal-crash-expected.txt: Added.
  • fast/shadow-dom/shadow-tree-removal-crash.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280586 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:24 PM Changeset in webkit [280796] by Russell Epstein
  • 2 edits in branches/safari-612.1.27.0-branch/Source/WebCore

Cherry-pick r280782. rdar://problem/81706720

WebGL 2.0 doesn't work on A8 devices (iPad mini 4, iPad Air 2)
​https://bugs.webkit.org/show_bug.cgi?id=228904
rdar://79198313

Reviewed by Anders Carlsson.

We can't use the ANGLE Metal backend for WebGL 2 on A8 devices (e.g. iPad Mini 4
and iPad Air 2). In this case revert back to the OpenGL backend.

It would be better if this check was exposed as API from ANGLE, but
its only a small number of devices, and this code can be removed once
they are no longer supported.

  • platform/graphics/cocoa/GraphicsContextGLOpenGLCocoa.mm: (WebCore::platformSupportsMetal): Add a parameter to indicate WebGL 2, and check the Metal device family support. (WebCore::GraphicsContextGLOpenGL::GraphicsContextGLOpenGL):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280782 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:14 PM Changeset in webkit [280795] by mmaxfield@apple.com
  • 32 edits
    1 copy
    6 adds in trunk/Source

Support WTF logging channels
​https://bugs.webkit.org/show_bug.cgi?id=228768

Source/WebKit:

Reviewed by Fujii Hironori.

No new tests because there is no behavior change.

  • GPUProcess/GPUProcess.cpp:

(WebKit::GPUProcess::initializeGPUProcess):

  • GPUProcess/GPUProcessCreationParameters.cpp:

(WebKit::GPUProcessCreationParameters::encode const):
(WebKit::GPUProcessCreationParameters::decode):

  • GPUProcess/GPUProcessCreationParameters.h:
  • Shared/AuxiliaryProcess.cpp:

(WebKit::AuxiliaryProcess::initialize):

  • Shared/WebKit2Initialize.cpp:

(WebKit::InitializeWebKit2):

  • Shared/WebProcessCreationParameters.cpp:

(WebKit::WebProcessCreationParameters::encode const):
(WebKit::WebProcessCreationParameters::decode):

  • Shared/WebProcessCreationParameters.h:
  • UIProcess/Cocoa/GPUProcessProxyCocoa.mm:

(WebKit::GPUProcessProxy::platformInitializeGPUProcessParameters):

  • UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::platformInitializeWebProcess):

  • UIProcess/GPU/GPUProcessProxy.cpp:

(WebKit::GPUProcessProxy::platformInitializeGPUProcessParameters):

  • UIProcess/WebProcessPool.cpp:
  • WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::platformInitializeWebProcess):

Source/WebKitLegacy/mac:

Reviewed by Fujii Hironori.

  • WebView/WebView.mm:

(-[WebView _commonInitializationWithFrameName:groupName:]):

Source/WTF:

This patch builds on top of ​https://bugs.webkit.org/show_bug.cgi?id=228809, which added shared infrastructure
for logging. This patch simply triggers that shared infrastructure for WTF. There is no change in behavior -
the existing WTF logging channels currently are all implemented independently in custom ways, so this patch
just migrates them over to use the shared infrastructure.

Reviewed by Fujii Hironori.

  • WTF.xcodeproj/project.pbxproj:
  • wtf/Assertions.h:
  • wtf/CMakeLists.txt:
  • wtf/LogInitialization.cpp: Added.

(WTF::logChannels):

  • wtf/LogInitialization.h: Added.
  • wtf/Logging.cpp: Added.
  • wtf/Logging.h: Added.
  • wtf/MemoryPressureHandler.cpp:

(WTF::MemoryPressureHandler::singleton):

  • wtf/MemoryPressureHandler.h:
  • wtf/PlatformFTW.cmake:
  • wtf/PlatformGTK.cmake:
  • wtf/PlatformJSCOnly.cmake:
  • wtf/PlatformMac.cmake:
  • wtf/PlatformPlayStation.cmake:
  • wtf/PlatformWPE.cmake:
  • wtf/PlatformWin.cmake:
  • wtf/RefCountedLeakCounter.cpp:
  • wtf/cocoa/LoggingCocoa.mm: Copied from Source/WebKit/UIProcess/Cocoa/GPUProcessProxyCocoa.mm.

(WTF::logLevelString):

  • wtf/cocoa/MachSendRight.cpp:
  • wtf/cocoa/MainThreadCocoa.mm:
  • wtf/cocoa/MemoryPressureHandlerCocoa.mm:
  • wtf/unix/LoggingUnix.cpp: Added.

(WTF::logLevelString):

  • wtf/win/LoggingWin.cpp: Added.

(WTF::logLevelString):

2:08 PM Changeset in webkit [280794] by Wenson Hsieh
  • 3 edits
    4 moves in trunk/LayoutTests

Enable layout tests in editing/selection/ios by default in EWS
​https://bugs.webkit.org/show_bug.cgi?id=228916

Reviewed by Tim Horton.

Enable tests in editing/selection/ios in OpenSource EWS. This greatly improves pre-commit test coverage of
various WebKit2 editing behaviors that are currently only covered by Apple-internal post-commit testers.

  • fast/events/touch/ios/become-key-window-when-focusing-editable-area-expected.txt: Renamed from LayoutTests/editing/selection/ios/become-key-window-when-focusing-editable-area-expected.txt.
  • fast/events/touch/ios/become-key-window-when-focusing-editable-area.html: Renamed from LayoutTests/editing/selection/ios/become-key-window-when-focusing-editable-area.html.
  • fast/events/touch/ios/selection-handles-after-touch-end-expected.txt: Renamed from LayoutTests/editing/selection/ios/selection-handles-after-touch-end-expected.txt.
  • fast/events/touch/ios/selection-handles-after-touch-end.html: Renamed from LayoutTests/editing/selection/ios/selection-handles-after-touch-end.html.

Move a couple of tests that rely on touch events out of this directory, and into fast/events/touch/ios
instead.

  • platform/ios-wk2/TestExpectations:
  • platform/ios/TestExpectations:
1:45 PM Changeset in webkit [280793] by commit-queue@webkit.org
  • 2 edits in trunk/LayoutTests

[GLIB] Mark 2 imported/w3c/web-platform-tests/css/css-overflow/clip-* tests as failing.
​https://bugs.webkit.org/show_bug.cgi?id=228920

Unreviewed test gardening.

Patch by Arcady Goldmints-Orlov <Arcady Goldmints-Orlov> on 2021-08-09

  • platform/glib/TestExpectations:
1:41 PM WebKitGTK/2.32.x edited by Adrian Perez de Castro
(diff)
1:19 PM Changeset in webkit [280792] by Russell Epstein
  • 1 edit in branches/safari-612.1.15.4-branch/Source/Makefile

Speculative Build Fix. rdar://79147214

1:07 PM Changeset in webkit [280791] by Russell Epstein
  • 8 edits in trunk/Source

Versioning.

WebKit-7612.2.1

1:06 PM Changeset in webkit [280790] by Kate Cheney
  • 16 edits in trunk

Add console logging to encourage the use of authenticated encryption in WebCrypto
​https://bugs.webkit.org/show_bug.cgi?id=228879
<rdar://problem/80655397>

Reviewed by Brent Fulgham.

Source/WebCore:

Warn about risks of using AES-CBC and AES-CTR modes in WebCrypto,
based on recommendations in
​https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/encrypt.
We should encourage authenticated encryption instead.

  • crypto/SubtleCrypto.cpp:

(WebCore::SubtleCrypto::encrypt):
(WebCore::SubtleCrypto::decrypt):

LayoutTests:

Update layout tests.

  • crypto/subtle/aes-cbc-cfb-decrypt-malformed-parameters-expected.txt:
  • crypto/subtle/aes-cbc-cfb-encrypt-malformed-parameters-expected.txt:
  • crypto/subtle/aes-cbc-generate-key-encrypt-decrypt-expected.txt:
  • crypto/subtle/aes-cbc-import-key-decrypt-expected.txt:
  • crypto/subtle/aes-cbc-import-key-encrypt-expected.txt:
  • crypto/subtle/aes-ctr-encrypt-malformed-parameters-expected.txt:
  • crypto/subtle/aes-ctr-generate-key-encrypt-decrypt-expected.txt:
  • crypto/subtle/aes-ctr-import-key-decrypt-expected.txt:
  • crypto/subtle/aes-ctr-import-key-encrypt-expected.txt:
  • crypto/subtle/decrypt-malformed-parameters-expected.txt:
  • crypto/subtle/encrypt-malformed-parameters-expected.txt:
  • TestExpectations:

We should probably not change imported test expectations, this marks
those tests as having console logging go to stderr. Additionally, some
tests call encrypt/decrypt functions up to 1000 times to test for
crashing, we should probably not log console to stdout in that case.

12:06 PM Changeset in webkit [280789] by Said Abou-Hallawa
  • 18 edits
    4 deletes in trunk

Ease sandboxing restrictions for Mail to allow HEIF image decoding
​https://bugs.webkit.org/show_bug.cgi?id=228812
<rdar://80967782>

Reviewed by Per Arne Vollan.

Source/WebCore:

No need to pass kCGImageSourceEnableRestrictedDecoding to ImageIO anymore.

  • platform/graphics/cg/ImageDecoderCG.cpp:

(WebCore::createImageSourceOptions):

Source/WebCore/PAL:

Delete unneeded SPIs and their soft-linking.

  • PAL.xcodeproj/project.pbxproj:
  • pal/cf/VideoToolboxSoftLink.cpp:
  • pal/cf/VideoToolboxSoftLink.h:
  • pal/cocoa/MediaToolboxSoftLink.cpp:
  • pal/cocoa/MediaToolboxSoftLink.h:
  • pal/spi/cg/ImageIOSPI.h:
  • pal/spi/cocoa/VideoToolboxSPI.h: Removed.

Source/WebKit:

If the running application is Mail, add a sandbox extension to allow HEIF
image decoding. There is no plan right now to enable HEIF in WebKit. So
do not try to support decoding it outside Mail.

  • Shared/WebProcessCreationParameters.cpp:

(WebKit::WebProcessCreationParameters::encode const):
(WebKit::WebProcessCreationParameters::decode):

  • Shared/WebProcessCreationParameters.h:
  • UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::platformInitializeWebProcess):

  • WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::platformInitializeWebProcess):
(WebKit::WebProcess::initializeSandbox):
(WebKit::restrictImageAndVideoDecoders): Deleted.

LayoutTests:

Delete the only HEIF ref test since the HEIF format has not been enabled
in WebKit and it requires a sandbox extension to be decoded correctly on
recent macOS versions.

  • TestExpectations:
  • fast/images/heic-as-background-image-expected.html: Removed.
  • fast/images/heic-as-background-image.html: Removed.
  • fast/images/resources/green-400x400.heic: Removed.
  • platform/ios/TestExpectations:
  • platform/mac/TestExpectations:
11:59 AM Changeset in webkit [280788] by Russell Epstein
  • 2 edits in branches/safari-612.1.27.0-branch/Source/WebKit

Cherry-pick r280753. rdar://problem/81700429

Page on mhlw.go.jp triggers WebContent termination by GPU process
​https://bugs.webkit.org/show_bug.cgi?id=228885
<rdar://81603231>

Reviewed by Wenson Hsieh.

​https://www.mhlw.go.jp/stf/seisakunitsuite/bunya/0000164708_00001.html triggered an issue
where RemoteRenderingBackend::finalizeRenderingUpdate() would be called when the
GPU process had just processed a "switching to next item buffer" meta command,
but had not yet received the new item buffer. This triggered the
MESSAGE_CHECK(initialHandle, "Missing initial shared display list handle");
in RemoteRenderingBackend::wakeUpAndApplyDisplayList().

Protect against this by having finalizeRenderingUpdate() check that
arguments.itemBufferIdentifier had been received, which is similar to what happens
inside the loop in wakeUpAndApplyDisplayList() already.

Not easily testable.

  • GPUProcess/graphics/RemoteRenderingBackend.cpp: (WebKit::RemoteRenderingBackend::finalizeRenderingUpdate):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280753 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:59 AM Changeset in webkit [280787] by Russell Epstein
  • 2 edits in branches/safari-612.1.27.0-branch/Source/WebCore

Cherry-pick r280727. rdar://problem/81700728

Crash at WebKit::WebPage::requestTextRecognition caused by accessibility invocation.
​https://bugs.webkit.org/show_bug.cgi?id=228864
rdar://80679512

Reviewed by Chris Fleizach.

  • accessibility/AXImage.cpp: (WebCore::AXImage::imageOverlayElements): It was calling requestTextRecognition with *element(), but element() can return nullptr, which would lead to the crash.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280727 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:59 AM Changeset in webkit [280786] by Russell Epstein
  • 7 edits in branches/safari-612.1.27.0-branch/Source

Cherry-pick r280723. rdar://problem/81700532

[Cocoa] Remove support for AVAssetImageGenerator
​https://bugs.webkit.org/show_bug.cgi?id=228560
<rdar://problem/81336280>

Reviewed by Eric Carlson.

Source/WebCore:

A much more minimal approach to removing support for AVAssetImageGenerator.

The only time we use an AVAssetImageGenerator (as opposed to an AVPlayerItemVideoOutput)
is when the latter does not currently have an available image enqueued. Because painting
is a synchronous operation, we use a synchronous API (the generator) to create an image
for that operation. However, this can create deadlocks if (for example) the resource needs
to load data on the main thread in order to complete the painting operation.

Instead, allow the main runloop to spin while waiting (up to 1_s) for the video output
to receive a decoded frame.

Drive-by fixes:

  • Don't create an AVPlayerLayer at AVPlayer-creation; this causes the AVPlayerItemVideoOutput to never receive a decoded frambe (as the layer is not in a CALayer-heirarchy).
  • preferredRenderingMode() shouldn't be "none" when the page isn't visible. We already just mark the layer as "hidden" in that case.
  • Don't tear down the AVPlayerItemVideoOutput when creating an AVPlayerLayer; it'll just get re-created anyway.
  • platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp: (WebCore::MediaPlayerPrivateAVFoundation::preferredRenderingMode const): (WebCore::MediaPlayerPrivateAVFoundation::setUpVideoRendering):
  • platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
  • platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm: (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer): (WebCore::MediaPlayerPrivateAVFoundationObjC::paintCurrentFrameInContext): (WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoOutput): (WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithVideoOutput): (WebCore::MediaPlayerPrivateAVFoundationObjC::waitForVideoOutputMediaDataWillChange): (WebCore::MediaPlayerPrivateAVFoundationObjC::outputMediaDataWillChange): (-[WebCoreAVFPullDelegate outputMediaDataWillChange:]): (-[WebCoreAVFPullDelegate setParent:]):

Source/WebKit:

Drive-by fix: we're passing the wrong value into acceleratedRenderingStateChanged(), and
we're not setting the correct initial value on MediaPlayerPrivateRemote creation.

  • GPUProcess/media/RemoteMediaPlayerProxy.h:
  • WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp: (WebKit::MediaPlayerPrivateRemote::MediaPlayerPrivateRemote): (WebKit::MediaPlayerPrivateRemote::acceleratedRenderingStateChanged):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280723 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:59 AM Changeset in webkit [280785] by Russell Epstein
  • 12 edits
    1 delete in branches/safari-612.1.27.0-branch

Cherry-pick r280624. rdar://problem/81700532

Unreviewed, reverting r280531 and r280589.

caused

Reverted changesets:

"[Cocoa] Remove support for AVAssetImageGenerator"
​https://bugs.webkit.org/show_bug.cgi?id=228560
​https://commits.webkit.org/r280531

"REGRESSION (r280531): multiple modern-media-controls tests
have become flaky timeouts"
​https://bugs.webkit.org/show_bug.cgi?id=228714
​https://commits.webkit.org/r280589

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280624 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:24 AM Changeset in webkit [280784] by stephan.szabo@sony.com
  • 2 edits in trunk/Source/WebKitLegacy/win

[WinCairo][Debug] Build fix after r280756
​https://bugs.webkit.org/show_bug.cgi?id=228918

Reviewed by Darin Adler.

  • WebView.cpp: Update call to initializeLogChannelsIfNecessary
11:22 AM Changeset in webkit [280783] by Robert Jenner
  • 1 edit
    2 adds in trunk/LayoutTests

(rebaseline) [ iOS ] 2 imported/w3c/web-platform-tests/css/cssom/* tests failing
​https://bugs.webkit.org/show_bug.cgi?id=228200

Uneviewed test gardening.

  • platform/ios/imported/w3c/web-platform-tests/css/cssom/css-style-attr-decl-block-expected.txt: Added.
11:16 AM Changeset in webkit [280782] by dino@apple.com
  • 2 edits in trunk/Source/WebCore

WebGL 2.0 doesn't work on A8 devices (iPad mini 4, iPad Air 2)
​https://bugs.webkit.org/show_bug.cgi?id=228904
rdar://79198313

Reviewed by Anders Carlsson.

We can't use the ANGLE Metal backend for WebGL 2 on A8 devices (e.g. iPad Mini 4
and iPad Air 2). In this case revert back to the OpenGL backend.

It would be better if this check was exposed as API from ANGLE, but
its only a small number of devices, and this code can be removed once
they are no longer supported.

  • platform/graphics/cocoa/GraphicsContextGLOpenGLCocoa.mm:

(WebCore::platformSupportsMetal): Add a parameter to indicate WebGL 2, and
check the Metal device family support.
(WebCore::GraphicsContextGLOpenGL::GraphicsContextGLOpenGL):

10:09 AM Changeset in webkit [280781] by Russell Epstein
  • 8 edits in branches/safari-612.1.27.0-branch/Source

Versioning.

WebKit-7612.1.27.0.4

9:39 AM Changeset in webkit [280780] by Kocsen Chung
  • 8 edits in trunk/Source

Versioning.

WebKit-7612.2.1

9:06 AM Changeset in webkit [280779] by commit-queue@webkit.org
  • 2 edits in trunk/LayoutTests

[GLIB] fast/events/check-defocus-event-order-when-triggered-by-mouse-click.html fails due to rounded corners
​https://bugs.webkit.org/show_bug.cgi?id=228877

Patch by Arcady Goldmints-Orlov <Arcady Goldmints-Orlov> on 2021-08-09
Reviewed by Adrian Perez de Castro.

In the test, move the cursor to the center of the input element to be
clicked on to avoid issues with rounded corners.

  • fast/events/check-defocus-event-order-when-triggered-by-mouse-click.html:
8:59 AM Changeset in webkit [280778] by commit-queue@webkit.org
  • 2 edits in trunk/Source/WebCore

-Warray-bounds, -Wstringop-truncation warnings in Packed.h
​https://bugs.webkit.org/show_bug.cgi?id=226557
<rdar://problem/79103658>

Patch by Michael Catanzaro <Michael Catanzaro> on 2021-08-09
Reviewed by Adrian Perez de Castro.

Suppressing the -Warray-bounds warning introduces the -Wstringop-truncation warning, which
cannot be suppressed with pragmas. The only solution I found is -Wno-stringop-truncation. I
could apply it globally, but this warning does not have many false positives, so I think
it's better to suppress the warning only for WebSocket.cpp. Unfortunately we have to remove
it from the unified build in order to add custom flags, but it seems worth it to avoid
suppressing the warning globally.

  • CMakeLists.txt:
8:22 AM Changeset in webkit [280777] by Lauro Moura
  • 2 edits in trunk/LayoutTests

[GLIB] Garden accessibility/selected-state-changed-notifications.html timeouts

Unreviewed test gardening.

  • platform/glib/TestExpectations:
8:15 AM Changeset in webkit [280776] by jer.noble@apple.com
  • 8 edits in trunk/Source

[Cocoa|GPU] platformLayer() not always added to remotedly hosted context; black video while playing
​https://bugs.webkit.org/show_bug.cgi?id=228873
<rdar://81271107>

Reviewed by Eric Carlson.

Source/WebCore:

Coalesce calls to renderingModeChanged() by setting a flag to call renderingModeChanged() in
the next run loop, and call into this coalescing method, setNeedsRenderingModeChanged(),
whenever the MediaPlayerPrivateAVFoundation subclasses create or destroy a video layer
or software painting context. This ensures that the MediaPlayerClient is always notified
when the rendering mode changes, regardless of why that change occurred.

Drive-by fix: replace the call in createVideoLayer() to "callOnMainThread()"
with "ensureOnMainThread()". The call to "callOnMainThread()" was added to avoid a
deadlock in WebKitLegacy, and "ensureOnMainThread()" has the correct behavior there, but
will be synchronous in WebKit.

  • platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:

(WebCore::MediaPlayerPrivateAVFoundation::setUpVideoRendering):
(WebCore::MediaPlayerPrivateAVFoundation::setNeedsRenderingModeChanged):
(WebCore::MediaPlayerPrivateAVFoundation::renderingModeChanged):
(WebCore::MediaPlayerPrivateAVFoundation::prepareForRendering):

  • platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
  • platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:

(WebCore::MediaPlayerPrivateAVFoundationCF::destroyVideoLayer):
(WebCore::AVFWrapper::createAVCFVideoLayer):
(WebCore::AVFWrapper::createImageGenerator):
(WebCore::AVFWrapper::destroyImageGenerator):

  • platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer):
(WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer):
(WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer):
(WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoOutput):
(WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoOutput):

Source/WebKit:

Currently, the RemoteMediaPlayerProxy will insert its MediaPlayer's platformLayer() into the
remotely hosted context when it receives a "firstVideoFrameAvailable()" notification.
However this is problematic for two reasons: AVPlayerLayer may not become "ready for
playback" when it is not in an active CALayer heirarchy, and for
MediaPlayerPrivateAVFoundation, firstVideoFrameAvailable() is only fired during
updateStates(), which is not guaranteed to occur unless another state change occurs.

Instead, reparent the MediaPlayer's platformLayer() when we receive a
mediaPlayerRenderingModeChanged() notification, which notifies the client whenever a
platformLayer() is created or destroyed.

  • GPUProcess/media/RemoteMediaPlayerProxy.cpp:
  • GPUProcess/media/cocoa/RemoteMediaPlayerProxyCocoa.mm:

(WebKit::RemoteMediaPlayerProxy::mediaPlayerFirstVideoFrameAvailable):
(WebKit::RemoteMediaPlayerProxy::mediaPlayerRenderingModeChanged):

6:10 AM Changeset in webkit [280775] by aboya@igalia.com
  • 2 edits in trunk/Source/WebCore

[MSE][GStreamer] Update tracks synchronously
​https://bugs.webkit.org/show_bug.cgi?id=228825

Reviewed by Xabier Rodriguez-Calvar.

A mistake introduced with the WebKitMediaSrc v2 patch made the call to
updateTracks() in MediaPlayerPrivateGStreamer asynchronous.

This introduced a subtle race condition in which the "resize" event
may be handled before updateTracks() is called, therefore m_hasVideo
has not yet been set to true, and querying the video size from the
"resize" event handler returns 0x0.

This fixes a timeout flake in media/media-source/media-source-resize.html.

  • platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::handleStreamCollectionMessage):

5:49 AM Changeset in webkit [280774] by imanol
  • 6 edits in trunk

Implement fullscreen in WPEView
​https://bugs.webkit.org/show_bug.cgi?id=227951

Reviewed by Adrian Perez de Castro.

Notify DOM fullscreen enter request to libwpe and handle exit fullscreen from libwpe.

  • UIProcess/API/wpe/WPEView.cpp:

(WKWPE::m_backend):
(WKWPE::View::setFullScreen):

  • UIProcess/API/wpe/WPEView.h:
5:35 AM Changeset in webkit [280773] by ysuzuki@apple.com
  • 2 edits in trunk/Source/WebCore

Unreviewed, remove WTFLogAlways
​https://bugs.webkit.org/show_bug.cgi?id=228858

  • html/parser/HTMLConstructionSite.cpp:

(WebCore::WhitespaceCache::lookup):

4:20 AM WebKitGTK/2.32.x edited by Adrian Perez de Castro
(diff)
4:05 AM Changeset in webkit [280772] by Cameron McCormack
  • 7 edits in trunk/Source/WebCore

Cache recently atomized all-whitespace strings for use by the HTML parser
​https://bugs.webkit.org/show_bug.cgi?id=228858

Reviewed by Yusuke Suzuki.

We have a memory optimization where the HTML parser will atomize any
text node string that is all whitespace. This can be expensive,
as we need to loop over the string's characters three times: to detect
that it is indeed all whitespace, to hash the string, and to compare
to any existing entry in the atom hash table.

Many whitespace strings encountered during parsing have a limited
form -- they have a few runs of consecutive equal whitespace
characters, e.g. it's common to see a newline followed by a number
of space characters. We can take advantage of this by compressing
the whitespace string into a simple run-length encoded form while
we loop over the characters to check that the string is all
whitespace. Unlike a hash, this encoded form perfectly identifies the
string content.

We add a WhitespaceCache that is owned by the Document, which stores
the most recently atomized all-whitespace string encountered by the
parser for a given length, and keys it with the encoded form. The
parser can then look up the WhitespaceCache and find an AtomString
without the need to perform a lookup in the atom hash table.

The WhitespaceCache continues to hold on to the cached whitespace
atoms for the life of the document. The WhitespaceCache itself
takes a bit over 1 KiB when empty, and if completely populated would
take a bit over 2 KiB plus 8 KiB of atom string data (a 1 byte string,
plus a 2 byte string, plus a 3 byte string, etc.). This doesn't seem
high enough to be worth clearing this out just to avoid memory usage
from text nodes that have been removed from the document.

We have the Document own the WhitespaceCache so that it's not just the
initial document load, but any uses of innerHTML or other fragment
parsing APIs, that can re-use previously atomized whitespace strings.

The choice of WhitespaceCache::maximumCachedStringLength = 128 is
somewhat arbitrary. The value must be <= 255 to avoid overflowing
the specific 64 bit code format used to encode the whitespace string.
Testing on Speedometer shows whitespace strings only up to length 26,
but it may be worth testing other content to see if it's worth
reducing maximumCachedStringLength.

When running Speedometer 2, no entries in the cache ever get replaced
by a different whitespace string of the same length, and 16 unique
whitespace string lengths are encountered.

We don't compute codes for 16 bit strings, since 16 bit strings passed
in to WhitespaceCache::lookup() are almost always the entirety of an
HTMLToken's data, and HTMLToken tracks whether any 16 bit characters are
present. If there are any, then we know the string cannot be all
whitespace, and we use a WhitespaceMode value of NotAllWhitespace to
skip the atomization altogether.

This patch is an almost 1% improvement on Speedometer 2.

  • dom/Document.cpp:

(WebCore::m_whitespaceCache):

  • dom/Document.h:

(WebCore::Document::whitespaceCache):

  • html/parser/HTMLConstructionSite.cpp:

(WebCore::HTMLConstructionSite::HTMLConstructionSite):
(WebCore::HTMLConstructionSite::insertTextNode):
(WebCore::WhitespaceCache::codeForString):
(WebCore::WhitespaceCache::lookup):

  • html/parser/HTMLConstructionSite.h:
  • html/parser/HTMLTreeBuilder.cpp:

(WebCore::HTMLTreeBuilder::insertPhoneNumberLink):
(WebCore::HTMLTreeBuilder::linkifyPhoneNumbers):
(WebCore::HTMLTreeBuilder::processCharacterBufferForInBody):

  • html/parser/HTMLTreeBuilder.h:
3:53 AM Changeset in webkit [280771] by Cameron McCormack
  • 2 edits in trunk/Source/WebCore

Increase inline size of HTMLToken::Attribute::value
​https://bugs.webkit.org/show_bug.cgi?id=228910
<rdar://problem/81686150>

Reviewed by Yusuke Suzuki.

Some attributes we encounter during HTML parsing are longer than 32
characters, and this shows up on profiles.

This patch improves Speedometer 2 by a modest amount (~0.3%).

  • html/parser/HTMLToken.h:
3:53 AM Changeset in webkit [280770] by commit-queue@webkit.org
  • 3 edits in trunk/Source/JavaScriptCore

Adding missing REFERENCED_FROM_ASM annotations to facilitate LTO
​https://bugs.webkit.org/show_bug.cgi?id=228865

Patch by Michael Catanzaro <Michael Catanzaro> on 2021-08-09
Reviewed by Yusuke Suzuki.

When investigating why WebKitGTK fails to build with LTO (link-time optimization) enabled,
one of the GCC developers noticed that we are missing attribute (("used")) on several
C++ functions declared in LLIntSlowPaths.h and WasmSlowPaths.h that are called only from
asm. Without this attribute, GCC assumes the functions are unused and drops them, then
linking fails because they really are used.

  • llint/LLIntSlowPaths.h:
  • wasm/WasmSlowPaths.h:
2:58 AM Changeset in webkit [280769] by imanol
  • 4 edits in trunk/Source/WebKit

Allow custom IPC::Attachment messaging in ConnectionUnix.cpp
​https://bugs.webkit.org/show_bug.cgi?id=227740

Reviewed by Žan Doberšek.

In order to share AHardwareBuffer handles via IPC we need to use the AHardwareBuffer_sendHandleToUnixSocket()
and AHardwareBuffer_recvHandleFromUnixSocket() functions. This is not currently compatible with the Attachment
API used in UnixConnection, as those functions use custom messaging into the socked fd.

This patch adds a CustomWriterType Attachment that allows custom messaging going into the socket fd.

  • Platform/IPC/unix/ConnectionUnix.cpp:
Note: See TracTimeline for information about the timeline view.