Timeline

Sep 27, 2021:

11:45 PM Changeset in webkit [283159] by mmaxfield@apple.com

• 22 edits
  2 moves in trunk

override-color has been renamed to override-colors
​https://bugs.webkit.org/show_bug.cgi?id=230789
<rdar://problem/83529354>

Reviewed by Devin Rousso.

LayoutTests/imported/w3c:

This is being upstreamed in ​https://github.com/web-platform-tests/wpt/pull/30962.

• web-platform-tests/css/css-fonts/font-palette-modify-2-expected.html:
• web-platform-tests/css/css-fonts/font-palette-modify-2.html:
• web-platform-tests/css/css-fonts/font-palette-modify-expected-mismatch.html:
• web-platform-tests/css/css-fonts/font-palette-modify.html:
• web-platform-tests/css/css-fonts/font-palette.html:
• web-platform-tests/css/css-fonts/parsing/font-palette-values-invalid.html:
• web-platform-tests/css/css-fonts/parsing/font-palette-values-valid.html:

Source/WebCore:

The spec was changed in
​https://github.com/w3c/csswg-drafts/commit/9de250d6692d07ddb8af3e3face37b909e5aad7b.
No browser has shipped the old name, so this is just a mechanical find/replace.

Updated existing tests.

• Sources.txt:
• WebCore.xcodeproj/project.pbxproj:
• css/CSSComputedStyleDeclaration.cpp:

(WebCore::ComputedStyleExtractor::valueForPropertyInStyle):

• css/CSSFontPaletteValuesOverrideColorsValue.cpp: Renamed from Source/WebCore/css/CSSFontPaletteValuesOverrideColorValue.cpp.

(WebCore::CSSFontPaletteValuesOverrideColorsValue::customCSSText const):
(WebCore::CSSFontPaletteValuesOverrideColorsValue::equals const):

• css/CSSFontPaletteValuesOverrideColorsValue.h: Renamed from Source/WebCore/css/CSSFontPaletteValuesOverrideColorValue.h.
• css/CSSFontPaletteValuesRule.cpp:

(WebCore::CSSFontPaletteValuesRule::initializeMapLike):
(WebCore::CSSFontPaletteValuesRule::cssText const):

• css/CSSProperties.json:
• css/CSSValue.cpp:

(WebCore::CSSValue::equals const):
(WebCore::CSSValue::cssText const):
(WebCore::CSSValue::destroy):

• css/CSSValue.h:

(WebCore::CSSValue::isFontPaletteValuesOverrideColorsValue const):
(WebCore::CSSValue::isFontPaletteValuesOverrideColorValue const): Deleted.

• css/StyleRule.cpp:

(WebCore::StyleRuleFontPaletteValues::StyleRuleFontPaletteValues):

• css/StyleRule.h:
• css/parser/CSSParserImpl.cpp:

(WebCore::CSSParserImpl::consumeFontPaletteValuesRule):

• css/parser/CSSPropertyParser.cpp:

(WebCore::consumeOverrideColorsDescriptor):
(WebCore::CSSPropertyParser::parseFontPaletteValuesDescriptor):
(WebCore::consumeOverrideColorDescriptor): Deleted.

• platform/graphics/FontPaletteValues.h:

(WebCore::FontPaletteValues::FontPaletteValues):
(WebCore::FontPaletteValues::overrideColors const):
(WebCore::FontPaletteValues::operator== const):
(WebCore::add):
(WebCore::FontPaletteValues::overrideColor const): Deleted.

• platform/graphics/cocoa/FontCacheCoreText.cpp:

(WebCore::addAttributesForFontPalettes):

10:24 PM Changeset in webkit [283158] by Antti Koivisto

• 31 edits in trunk/Source

[LFC] Use CheckedRef/Ptr instead of WeakPtr
​https://bugs.webkit.org/show_bug.cgi?id=230821

Reviewed by Alan Bujtas.

Source/WebCore:

WeakPtrs are used for layout boxes for safety only. Replace with simpler, faster CheckedPtr.

• display/DisplayTreeBuilder.cpp:

(WebCore::Display::TreeBuilder::build):

• editing/TextManipulationController.cpp:

(WebCore::TextManipulationController::replace):

This was leaving a text iterator in stack while mutating the render tree.

• layout/FormattingState.h:

(WebCore::Layout::FormattingState::addOutOfFlowBox):

• layout/LayoutState.cpp:

(WebCore::Layout::LayoutState::LayoutState):
(WebCore::Layout::LayoutState::formattingStateForFormattingContext const):
(WebCore::Layout::LayoutState::formattingStateForInlineFormattingContext const):
(WebCore::Layout::LayoutState::ensureInlineFormattingState):

• layout/LayoutState.h:

(WebCore::Layout::LayoutState::root const):
(WebCore::Layout::LayoutState::hasRoot const): Deleted.

• layout/floats/FloatAvoider.h:
• layout/floats/FloatingState.cpp:

(WebCore::Layout::FloatingState::FloatItem::FloatItem):
(WebCore::Layout::FloatingState::FloatingState):

• layout/floats/FloatingState.h:

(WebCore::Layout::FloatingState::root const):

• layout/formattingContexts/FormattingContext.cpp:

(WebCore::Layout::FormattingContext::FormattingContext):
(WebCore::Layout::FormattingContext::layoutOutOfFlowContent):

• layout/formattingContexts/FormattingContext.h:

(WebCore::Layout::FormattingContext::root const):

• layout/formattingContexts/block/BlockFormattingState.h:
• layout/formattingContexts/inline/InlineFormattingContext.cpp:

(WebCore::Layout::InlineFormattingContext::computeStaticPositionForOutOfFlowContent):

• layout/formattingContexts/inline/InlineLevelBox.h:

(WebCore::Layout::InlineLevelBox::layoutBox const):
(WebCore::Layout::InlineLevelBox::InlineLevelBox):

• layout/formattingContexts/inline/InlineLineBox.h:
• layout/formattingContexts/inline/display/InlineDisplayBox.h:

(WebCore::InlineDisplay::Box::layoutBox const):
(WebCore::InlineDisplay::Box::Box):

• layout/formattingContexts/table/TableGrid.cpp:

(WebCore::Layout::TableGrid::Column::Column):
(WebCore::Layout::TableGrid::Row::Row):
(WebCore::Layout::TableGrid::Cell::Cell):

• layout/formattingContexts/table/TableGrid.h:

(WebCore::Layout::TableGrid::Row::box const):

• layout/integration/LayoutIntegrationBoxTree.cpp:

(WebCore::LayoutIntegration::BoxTree::buildTree):
(WebCore::LayoutIntegration::BoxTree::appendChild):
(WebCore::LayoutIntegration::BoxTree::layoutBoxForRenderer):
(WebCore::LayoutIntegration::BoxTree::rendererForLayoutBox):

• layout/integration/LayoutIntegrationBoxTree.h:
• layout/integration/LayoutIntegrationInlineContent.cpp:

(WebCore::LayoutIntegration::InlineContent::InlineContent):
(WebCore::LayoutIntegration::InlineContent::rendererForLayoutBox const):
(WebCore::LayoutIntegration::InlineContent::containingBlock const):
(WebCore::LayoutIntegration::InlineContent::lineLayout const): Deleted.

• layout/integration/LayoutIntegrationInlineContent.h:

(WebCore::LayoutIntegration::InlineContent::lineLayout const):

• layout/integration/LayoutIntegrationLineLayout.cpp:

(WebCore::LayoutIntegration::LineLayout::constructContent):

• layout/integration/LayoutIntegrationLineLayout.h:
• layout/layouttree/LayoutBox.cpp:

(WebCore::Layout::Box::setCachedGeometryForLayoutState const):

• layout/layouttree/LayoutBox.h:
• layout/layouttree/LayoutReplacedBox.h:
• layout/layouttree/LayoutTreeBuilder.h:

Source/WTF:

• wtf/CheckedRef.h:

(WTF::CanMakeCheckedPtrBase::incrementPtrCount const):
(WTF::CanMakeCheckedPtrBase::decrementPtrCount const):
(WTF::CanMakeCheckedPtrBase::incrementPtrCount): Deleted.
(WTF::CanMakeCheckedPtrBase::decrementPtrCount): Deleted.

Make const so CheckedPtr<const Foo> works.

10:17 PM Changeset in webkit [283157] by Cameron McCormack

• 2 edits in trunk/Source/WebKit

Avoid building log messages when IPCMessages log stream is off
​https://bugs.webkit.org/show_bug.cgi?id=230878
<rdar://problem/83605670>

Reviewed by Alex Christensen.

• Platform/IPC/HandleMessage.h:

(IPC::logMessageImpl):

5:49 PM Changeset in webkit [283156] by Jean-Yves Avenard

• 5 edits in trunk/Source

Vorbis decoder can't be instantiated - Remove workaround added in bug 228139
​https://bugs.webkit.org/show_bug.cgi?id=230742
rdar://83484414

Reviewed by Eric Carlson.

Source/WebKit:

This is already covered by test; however this will fail on Monterey without the updated
CoreMedia framework.

• Scripts/process-entitlements.sh: Add new required entitlement.
• WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::initializeSandbox): Only have bug workaround on BigSur and earlier.

Source/WTF:

• wtf/PlatformUse.h: Add USE_VORBIS_AUDIOCOMPONENT_WORKAROUND

5:16 PM Changeset in webkit [283155] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina BigSur wk2 ] imported/w3c/web-platform-tests/mediacapture-streams/MediaStream-default-feature-policy.https.html is a flaky failure and crash.
​https://bugs.webkit.org/show_bug.cgi?id=230866.

Unreviewed test gardening.

• platform/mac-wk2/TestExpectations:

4:53 PM ApplePlansForWebKit2022Edition edited by Jon Davis

(diff)

4:44 PM Changeset in webkit [283154] by mmaxfield@apple.com

• 2 edits in trunk/LayoutTests/imported/w3c

Add test to make sure CSSFontPaletteValuesRule's attributes are readonly
​https://bugs.webkit.org/show_bug.cgi?id=230791
<rdar://problem/83530165>

Reviewed by Simon Fraser.

The spec enforces this in w3c/csswg-drafts@9ddf938. This is already the case in WebKit.

This is being upstreamed in ​https://github.com/web-platform-tests/wpt/pull/30964.

• web-platform-tests/css/css-fonts/parsing/font-palette-values-invalid.html:

4:44 PM OffscreenCanvas2021Update edited by Jon Davis

(diff)

4:42 PM GitHubandNewProcesses edited by Jon Davis

(diff)

4:41 PM ProtectedCollaborationTree edited by Jon Davis

(diff)

4:40 PM ProtectedCollaborationTree edited by Jon Davis

(diff)

4:39 PM ProtectedCollaborationTree edited by Jon Davis

(diff)

4:37 PM GPUProcess2021 created by Jon Davis

4:37 PM IntroductiontoLFC created by Jon Davis

4:36 PM WPTUpdate created by Jon Davis

4:34 PM September 2021 Meeting edited by Jon Davis

Schedule changes. (diff)

4:33 PM Changeset in webkit [283153] by Dewei Zhu

• 4 edits in trunk/Websites/perf.webkit.org

Summary page should support calculating summary using weighted mean.
​https://bugs.webkit.org/show_bug.cgi?id=230810

Reviewed by Ryosuke Niwa.

Add a way to specify weight for a platform or (plafform, metric) which will be used while calculating a summary.

• public/shared/statistics.js: Added 'weightedMean' function.

(Statistics.new.this.weightedMean):

• public/v3/pages/summary-page.js: Added support for specifying a weight for platform or (platform, metric).

(SummaryPage):
(SummaryPage.prototype._createConfigurationGroup):
(SummaryPageConfigurationGroup):

• unit-tests/statistics-tests.js: Added unit tests.

4:25 PM September 2021 Meeting edited by Jon Davis

(diff)

4:05 PM Changeset in webkit [283152] by Alan Coon

• 1 copy in tags/Safari-612.2.8

Tag Safari-612.2.8.

4:05 PM Changeset in webkit [283151] by Alan Coon

• 1 delete in tags/Safari-612.2.8

Delete tag.

3:51 PM Changeset in webkit [283150] by Eric Hutchison

• 3 edits in trunk/LayoutTests

[BigSur wk2 Debug iOS14 ] webrtc/video-mute.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=230865.

Unreviewed test gardening.

• platform/ios-14-wk2/TestExpectations:
• platform/mac-wk2/TestExpectations:

3:50 PM Changeset in webkit [283149] by Alan Coon

• 1 copy in tags/Safari-612.2.8

Tag Safari-612.2.8.

3:49 PM Changeset in webkit [283148] by Alan Coon

• 30 edits
  2 adds in branches/safari-612-branch

Cherry-pick r283098. rdar://problem/83584491

[JSC] Optimize PutByVal with for-in
​https://bugs.webkit.org/show_bug.cgi?id=230801

Reviewed by Saam Barati.

JSTests:

• stress/for-in-sentinel.js: Added. (shouldBe): (test):

Source/JavaScriptCore:

We found that some of Speedometer2 subtests are heavily using for-in with PutByVal or the other DFG nodes.
And we also found that we are using polluted non-good type for the property names from for-in: String | Other.
The reason is that we are returning null when op_enumerator_next finishes instead of string. And this design
forces DFG and FTL to return null from EnumeratorNextUpdatePropertyName at the end of iteration. This pollutes
the type of property names as String | Other instead of String, and leading to suboptimal DFG nodes.

In this patch, we add special sentinel string in vm.smallString.sentinelString(). We know that this string cell
pointer will be never returned from EnumeratorNextUpdatePropertyName in the normal for-in iteration. This is easy
since we are always allocating a JSString when creating JSPropertyNameEnumerator. So this string cell (not the content)
is always different from pre-allocated vm.smallString.sentinelString(). So, we use this special string pointer
as a sentinel instead of null so that we can avoid polluting return type of EnumeratorNextUpdatePropertyName.

To check the sentinel in LLInt / Baseline, this patch adds jeq_ptr, which performs cell pointer comparison and do
not check string content equality. We do not need to have an implementation in DFG since we already have CompareEqPtr
for existing jneq_ptr bytecode.

We also clean up DFG operation related to PutByVal.

----------------------------------------------------------------------------------------------------------------------------------
| subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) |
----------------------------------------------------------------------------------------------------------------------------------
| Elm-TodoMVC |116.010000 |112.701667 |0.971482 | 0.000000 (significant) |
| VueJS-TodoMVC |22.995000 |23.023333 |1.001232 | 0.907086 |
| EmberJS-TodoMVC |125.498333 |125.525000 |1.000212 | 0.932546 |
| BackboneJS-TodoMVC |45.700000 |45.975000 |1.006018 | 0.084799 |
| Preact-TodoMVC |16.681667 |16.610000 |0.995704 | 0.722758 |
| AngularJS-TodoMVC |123.753333 |123.740000 |0.999892 | 0.971431 |
| Vanilla-ES2015-TodoMVC |61.255000 |61.380000 |1.002041 | 0.300654 |
| Inferno-TodoMVC |58.646667 |58.948333 |1.005144 | 0.267611 |
| Flight-TodoMVC |73.283333 |72.801667 |0.993427 | 0.207389 |
| Angular2-TypeScript-TodoMVC |39.746667 |40.015000 |1.006751 | 0.449821 |
| VanillaJS-TodoMVC |50.096667 |49.823333 |0.994544 | 0.162020 |
| jQuery-TodoMVC |212.870000 |213.196667 |1.001535 | 0.371944 |
| EmberJS-Debug-TodoMVC |331.878333 |332.710000 |1.002506 | 0.094499 |
| React-TodoMVC |83.078333 |82.726667 |0.995767 | 0.076143 |
| React-Redux-TodoMVC |136.018333 |133.935000 |0.984683 | 0.000000 (significant) |
| Vanilla-ES2015-Babel-Webpack-TodoMVC |59.743333 |59.643333 |0.998326 | 0.393671 |
----------------------------------------------------------------------------------------------------------------------------------
a mean = 271.75873
b mean = 272.45804
pValue = 0.0263030803
(Bigger means are better.)
1.003 times better
Results ARE significant

• builtins/BuiltinNames.h:
• bytecode/BytecodeList.rb:
• bytecode/BytecodeUseDef.cpp: (JSC::computeUsesForBytecodeIndexImpl): (JSC::computeDefsForBytecodeIndexImpl):
• bytecode/LinkTimeConstant.h:
• bytecode/Opcode.h: (JSC::isBranch):
• bytecode/PreciseJumpTargetsInlines.h:
• bytecompiler/BytecodeGenerator.cpp: (JSC::GenericLabel<JSGeneratorTraits>::setLocation): (JSC::BytecodeGenerator::emitJumpIfSentinelString):
• bytecompiler/BytecodeGenerator.h:
• bytecompiler/NodesCodegen.cpp: (JSC::ForInNode::emitBytecode):
• dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
• dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock):
• dfg/DFGCapabilities.cpp: (JSC::DFG::capabilityLevel):
• dfg/DFGOperations.cpp: (JSC::DFG::putByVal): (JSC::DFG::putByValInternal): (JSC::DFG::putByValCellInternal): (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
• dfg/DFGOperations.h:
• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName):
• ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
• jit/JIT.cpp: (JSC::JIT::privateCompileMainPass):
• jit/JIT.h:
• jit/JITOpcodes.cpp: (JSC::JIT::emit_op_jeq_ptr):
• jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_jeq_ptr):
• jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_enumerator_next):
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/CommonSlowPaths.cpp: (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
• runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init):
• runtime/SmallStrings.cpp: (JSC::SmallStrings::initializeCommonStrings): (JSC::SmallStrings::visitStrongReferences):
• runtime/SmallStrings.h: (JSC::SmallStrings::sentinelString const):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@283098 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:49 PM Changeset in webkit [283147] by Alan Coon

• 4 edits in branches/safari-612-branch/Source/WebKit

Cherry-pick r283081. rdar://problem/83584464

Pending preconnect key should include User-Agent
​https://bugs.webkit.org/show_bug.cgi?id=230565

Reviewed by Chris Dumez.

When using an HTTPS proxy, the HTTP connection cache key used for connection coalescing in
CFNetwork includes the User-Agent (<rdar://problem/59434166>). This means we should also
include it in the preconnect cache key. Otherwise, we might delay the main resource load on
preconnect unnecessarily in cases where the User-Agent mismatches and the preconnect gets
thrown away. This can happen if (for instance) a page is force-loaded into desktop or mobile
mode on iOS, which causes a UA change after the call to decidePolicyForNavigationAction.

• NetworkProcess/NetworkLoadScheduler.cpp: (WebKit::mainResourceLoadKey): (WebKit::NetworkLoadScheduler::scheduleMainResourceLoad): (WebKit::NetworkLoadScheduler::unscheduleMainResourceLoad): (WebKit::NetworkLoadScheduler::startedPreconnectForMainResource): (WebKit::NetworkLoadScheduler::finishedPreconnectForMainResource):
• NetworkProcess/NetworkLoadScheduler.h:
• NetworkProcess/NetworkProcess.cpp: (WebKit::NetworkProcess::preconnectTo):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@283081 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:49 PM Changeset in webkit [283146] by Alan Coon

• 17 edits
  6 adds in branches/safari-612-branch

Cherry-pick r283035. rdar://problem/83584492

<video> element rendered incorrectly when provided with a portrait orientation stream in Safari 15
​https://bugs.webkit.org/show_bug.cgi?id=229792
<rdar://problem/82776741>

Reviewed by Eric Carlson.

Source/WebCore:

We need to swap the bounds for both m_rootLayer and m_sampleBufferDisplayLayer if the sample is rotated by 90.
We also need to ompute m_sampleBufferDisplayLayer position based on m_rootLayer coordinates.
This means we swap root layer bounds width and height before computing m_sampleBufferDisplayLayer position based on it.

Test: fast/mediastream/video-rotation.html

• platform/graphics/avfoundation/objc/LocalSampleBufferDisplayLayer.h:
• platform/graphics/avfoundation/objc/LocalSampleBufferDisplayLayer.mm: (WebCore::LocalSampleBufferDisplayLayer::setRootLayerBoundsAndPositions): (WebCore::LocalSampleBufferDisplayLayer::updateRootLayerBoundsAndPosition):
• platform/graphics/cg/ImageBufferUtilitiesCG.h:

Source/WebKit:

Helper routined used in WTR.

• Shared/API/c/cg/WKImageCG.cpp: (WKImageCreateDataURLFromImage):
• Shared/API/c/cg/WKImageCG.h:

Tools:

Add testRunner API to take a view port snapshot as a PNG data URL.
We can then use this data URL to validate some rendered pixel values.

• WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
• WebKitTestRunner/InjectedBundle/InjectedBundle.cpp: (WTR::InjectedBundle::didReceiveMessageToPage):
• WebKitTestRunner/InjectedBundle/TestRunner.cpp: (WTR::TestRunner::takeViewPortSnapshot): (WTR::TestRunner::viewPortSnapshotTaken):
• WebKitTestRunner/InjectedBundle/TestRunner.h:
• WebKitTestRunner/TestController.cpp: (WTR::TestController::takeViewPortSnapshot):
• WebKitTestRunner/TestController.h:
• WebKitTestRunner/TestInvocation.cpp: (WTR::TestInvocation::didReceiveMessageFromInjectedBundle):
• WebKitTestRunner/cocoa/TestControllerCocoa.mm: (WTR::TestController::takeViewPortSnapshot):

LayoutTests:

• fast/mediastream/video-rotation-expected.txt: Added.
• fast/mediastream/video-rotation.html: Added.
• platform/ios-simulator/fast/mediastream/video-rotation-expected.png: Added.
• platform/mac/fast/mediastream/video-rotation-expected.png: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@283035 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:49 PM Changeset in webkit [283145] by Alan Coon

• 4 edits in branches/safari-612-branch

Cherry-pick r282924. rdar://problem/83584505

Make SharedBuffer inherit from ThreadSafeRefCounted
​https://bugs.webkit.org/show_bug.cgi?id=230662
rdar://83419269

Source/WebCore:

The SourceBufferPrivateAVFObjC uses dispatch_async that takes an objective-C class.
This copies its argument rather than move it and we end up with the SharedBuffer
captured in the lambda to have its ref count be > 1.
The easiest workaround is to make SharedBuffer use thread-safe refcount.
Of course, this doesn't make a SharedBuffer a thread-safe class, but it allows
to safely move it between threads.

Already covered by existing tests.

Reviewed by Chris Dumez.

• platform/SharedBuffer.h:

LayoutTests:

Revert bug 230644.

Reviewed by Chris Dumez.

• platform/mac-wk1/TestExpectations:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@282924 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:49 PM Changeset in webkit [283144] by Alan Coon

• 2 edits in branches/safari-612-branch/LayoutTests

Cherry-pick r282895. rdar://problem/83584505

REGRESSION (r282865?): ASSERTION FAILED: Unsafe to ref/deref from different threads m_isOwnedByMainThread == isMainThread().
​https://bugs.webkit.org/show_bug.cgi?id=230644

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@282895 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:49 PM Changeset in webkit [283143] by Alan Coon

• 4 edits in branches/safari-612-branch

Revert r280963. rdar://problem/83587220

3:30 PM Changeset in webkit [283142] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[ macOS wk1 ] webanimations/relative-ordering-of-translate-and-rotate-properties-accelerated.html is a flaky image failure.
​https://bugs.webkit.org/show_bug.cgi?id=230863

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

3:27 PM Changeset in webkit [283141] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina BigSur arm64 ] imported/w3c/web-platform-tests/resource-timing/sizes-redirect-img.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=230862.

Unreviewed test gardening.

• platform/mac/TestExpectations:

3:19 PM Changeset in webkit [283140] by mmaxfield@apple.com

• 6 edits in trunk

Add support for CSSFontPaletteValuesRule.name
​https://bugs.webkit.org/show_bug.cgi?id=230787
<rdar://problem/83528540>

Reviewed by Tim Horton.

LayoutTests/imported/w3c:

This is being upstreamed in ​https://github.com/web-platform-tests/wpt/pull/30960.

• web-platform-tests/css/css-fonts/parsing/font-palette-values-valid.html:

Source/WebCore:

This was added to the CSS spec in
​https://github.com/w3c/csswg-drafts/commit/8868476c571d63b7f3f2718e22601a711a2d8683.

Test: web-platform-tests/css/css-fonts/parsing/font-palette-values-valid.html

• css/CSSFontPaletteValuesRule.cpp:

(WebCore::CSSFontPaletteValuesRule::name const):

• css/CSSFontPaletteValuesRule.h:
• css/CSSFontPaletteValuesRule.idl:

2:53 PM Changeset in webkit [283139] by sbarati@apple.com

• 100 edits
  1 copy
  1 add in trunk

Build an unlinked baseline JIT
​https://bugs.webkit.org/show_bug.cgi?id=229223
<rdar://problem/82321772>

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

This patch adds an "unlinked" baseline JIT to JSVALUE64 platforms. The JIT
code produced by this baseline JIT can be shared between all CodeBlocks that
share an UnlinkedCodeBlock. The benefit of this is, if we're creating a CodeBlock
from an UnlinkedCodeBlock that already compiled an unlinked baseline JIT
instance, this new CodeBlock just starts off executing in the baseline JIT
"for free".

To make this work, the code we emit now needs to be independent of a specific
CodeBlock instance. We use a CodeBlock instance for minimal profiling information
when compiling, but otherwise, the code is tied to the UnlinkedCodeBlock. When
we need CodeBlock specific information, we load it. This usually means things
like we'll load things from the Metadata dynamically. This patch also adds a
"linked constant pool" concept, and anytime we instantiate such a CodeBlock,
we also need to instantiate this "linked constant pool". This contains things
like our inline cache data structures (StructureStubInfo*), JSGlobalObject*,
etc.

Unlinked baseline JIT always runs ICs in the "data" mode. To make this work, I
made data ICs work on x86_64. To do this, we no longer call/ret to the IC.
Instead, we jump to the IC, and the IC jumps back by loading the "done" location
from the StructureStubInfo dynamically. This simplifies the design to not be
based on the arm64 calling convention, and keeps the same performance characteristics.

This patch also adds a new version of InlineAccess that is only used in baseline
JIT (for now). In the future, we can make the DFG/FTL also use this for Data
ICs. But we don't need to do that yet since those tiers don't use data ICs by
default. The baseline JIT now has a pure data IC approach to InlineAccess. So
instead of repatching code, we repatch fields we load dynamically.

This patch also cleans up a few things in OSR exit, where both DFG/FTL were
storing callee saves to the callee saves buffer in a weird place, and separate
from one another. I noticed this code can be simplified if we just store
callee saves at the end of the OSR exit handler, and from common JIT emission
code.

This patch also fixes a bug where we could end up with the wrong (and always
more negative) SP in the baseline JIT. This could happen when we OSR exit
from an inlined getter/setter. The OSR exit code puts the return PC when
returning to the call site of the getter/setter to be the inline cache's
"done location". However, this "done location" didn't used to restore SP.
This patch conservatively makes it so that we restore the SP at these sites.

This is measured as a 1% speedup on Speedometer2.

• CMakeLists.txt:
• JavaScriptCore.xcodeproj/project.pbxproj:
• Sources.txt:
• bytecode/AccessCase.cpp:

(JSC::AccessCase::fromStructureStubInfo):
(JSC::AccessCase::generateImpl):

• bytecode/BytecodeList.rb:
• bytecode/BytecodeOperandsForCheckpoint.h:

(JSC::valueProfileOffsetFor):

• bytecode/CallLinkInfo.cpp:

(JSC::CallLinkInfo::fastPathStart):
(JSC::CallLinkInfo::emitFastPathImpl):
(JSC::CallLinkInfo::emitFastPath):
(JSC::CallLinkInfo::emitTailCallFastPath):
(JSC::CallLinkInfo::emitDataICFastPath):
(JSC::CallLinkInfo::emitTailCallDataICFastPath):
(JSC::CallLinkInfo::emitDataICSlowPath):
(JSC::CallLinkInfo::initializeDataIC):
(JSC::CallLinkInfo::emitDirectFastPath):
(JSC::CallLinkInfo::emitDirectTailCallFastPath):

• bytecode/CallLinkInfo.h:

(JSC::CallLinkInfo::offsetOfMaxArgumentCountIncludingThis):
(JSC::CallLinkInfo::slowStub): Deleted.
(JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::setupWithUnlinkedBaselineCode):
(JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const):
(JSC::CodeBlock::setConstantRegisters):
(JSC::CodeBlock::finalizeJITInlineCaches):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::frameRegisterCount):
(JSC::CodeBlock::binaryArithProfileForPC):
(JSC::CodeBlock::unaryArithProfileForPC):
(JSC::CodeBlock::findPC):
(JSC::CodeBlock::jitSoon):
(JSC::CodeBlock::jitNextInvocation):
(JSC::CodeBlock::dumpMathICStats):
(JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
(JSC::CodeBlock::addJITAddIC): Deleted.
(JSC::CodeBlock::addJITMulIC): Deleted.
(JSC::CodeBlock::addJITSubIC): Deleted.
(JSC::CodeBlock::addJITNegIC): Deleted.
(JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
(JSC::CodeBlock::thresholdForJIT): Deleted.
(JSC::CodeBlock::jitAfterWarmUp): Deleted.

• bytecode/CodeBlock.h:

(JSC::CodeBlock::JITData::offsetOfJITConstantPool):
(JSC::CodeBlock::offsetOfJITData):
(JSC::CodeBlock::offsetOfArgumentValueProfiles):
(JSC::CodeBlock::offsetOfConstantsVectorBuffer):
(JSC::CodeBlock::baselineJITConstantPool):
(JSC::CodeBlock::checkIfJITThresholdReached):
(JSC::CodeBlock::dontJITAnytimeSoon):
(JSC::CodeBlock::llintExecuteCounter const):
(JSC::CodeBlock::offsetOfDebuggerRequests):
(JSC::CodeBlock::offsetOfShouldAlwaysBeInlined):
(JSC::CodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
(JSC::CodeBlock::addressOfNumParameters): Deleted.
(JSC::CodeBlock::isKnownCell): Deleted.
(JSC::CodeBlock::addMathIC): Deleted.
(JSC::CodeBlock::setJITCodeMap): Deleted.
(JSC::CodeBlock::jitCodeMap): Deleted.
(JSC::CodeBlock::switchJumpTable): Deleted.
(JSC::CodeBlock::stringSwitchJumpTable): Deleted.

• bytecode/CodeBlockInlines.h:

(JSC::CodeBlock::forEachValueProfile):
(JSC::CodeBlock::jitCodeMap):
(JSC::CodeBlock::baselineSwitchJumpTable):
(JSC::CodeBlock::baselineStringSwitchJumpTable):
(JSC::CodeBlock::dfgSwitchJumpTable):
(JSC::CodeBlock::dfgStringSwitchJumpTable):

• bytecode/ExecutableToCodeBlockEdge.h:
• bytecode/ExecutionCounter.cpp:

(JSC::ExecutionCounter<countingVariant>::setThreshold):

• bytecode/ExecutionCounter.h:

(JSC::ExecutionCounter::clippedThreshold):

• bytecode/GetByIdMetadata.h:

(JSC::GetByIdModeMetadataArrayLength::offsetOfArrayProfile):
(JSC::GetByIdModeMetadata::offsetOfMode):

• bytecode/GetByStatus.cpp:

(JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):

• bytecode/GetterSetterAccessCase.cpp:

(JSC::GetterSetterAccessCase::emitDOMJITGetter):

• bytecode/InByStatus.cpp:

(JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):

• bytecode/InlineAccess.cpp:

(JSC::InlineAccess::generateSelfPropertyAccess):
(JSC::InlineAccess::canGenerateSelfPropertyReplace):
(JSC::InlineAccess::generateSelfPropertyReplace):
(JSC::InlineAccess::isCacheableArrayLength):
(JSC::InlineAccess::generateArrayLength):
(JSC::InlineAccess::isCacheableStringLength):
(JSC::InlineAccess::generateStringLength):
(JSC::InlineAccess::generateSelfInAccess):
(JSC::InlineAccess::rewireStubAsJumpInAccess):
(JSC::InlineAccess::resetStubAsJumpInAccess):

• bytecode/InlineAccess.h:
• bytecode/IterationModeMetadata.h:

(JSC::IterationModeMetadata::offsetOfSeenModes):

• bytecode/LLIntCallLinkInfo.h:

(JSC::LLIntCallLinkInfo::offsetOfArrayProfile):

• bytecode/Opcode.h:
• bytecode/PolymorphicAccess.cpp:

(JSC::AccessGenerationState::succeed):
(JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
(JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions):
(JSC::PolymorphicAccess::regenerate):

• bytecode/PolymorphicAccess.h:

(JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): Deleted.

• bytecode/PutByStatus.cpp:

(JSC::PutByStatus::computeForStubInfo):

• bytecode/StructureStubInfo.cpp:

(JSC::StructureStubInfo::initGetByIdSelf):
(JSC::StructureStubInfo::initPutByIdReplace):
(JSC::StructureStubInfo::initInByIdSelf):
(JSC::StructureStubInfo::addAccessCase):
(JSC::StructureStubInfo::reset):
(JSC::StructureStubInfo::visitWeakReferences):
(JSC::StructureStubInfo::propagateTransitions):
(JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):

• bytecode/StructureStubInfo.h:

(JSC::StructureStubInfo::offsetOfByIdSelfOffset):
(JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure):
(JSC::StructureStubInfo::inlineAccessBaseStructure):
(JSC::StructureStubInfo::offsetOfDoneLocation):

• bytecode/SuperSampler.cpp:

(JSC::printSuperSamplerState):

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
(JSC::UnlinkedCodeBlock::hasIdentifier):
(JSC::UnlinkedCodeBlock::thresholdForJIT):
(JSC::UnlinkedCodeBlock::allocateSharedProfiles):

• bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedCodeBlock::constantRegister):
(JSC::UnlinkedCodeBlock::instructionAt const):
(JSC::UnlinkedCodeBlock::bytecodeOffset):
(JSC::UnlinkedCodeBlock::instructionsSize const):
(JSC::UnlinkedCodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
(JSC::UnlinkedCodeBlock::outOfLineJumpOffset):
(JSC::UnlinkedCodeBlock::binaryArithProfile):
(JSC::UnlinkedCodeBlock::unaryArithProfile):
(JSC::UnlinkedCodeBlock::llintExecuteCounter):

• bytecode/UnlinkedMetadataTable.h:

(JSC::UnlinkedMetadataTable::offsetInMetadataTable):

• bytecode/ValueProfile.h:

(JSC::ValueProfileBase::ValueProfileBase):
(JSC::ValueProfileBase::clearBuckets):
(JSC::ValueProfile::offsetOfFirstBucket):

• dfg/DFGCommonData.h:
• dfg/DFGJITCode.cpp:
• dfg/DFGJITCode.h:
• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::link):

• dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareOSREntry):

• dfg/DFGOSRExit.cpp:

(JSC::DFG::OSRExit::compileExit):

• dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::handleExitCounts):
(JSC::DFG::callerReturnPC):
(JSC::DFG::reifyInlinedCallFrames):
(JSC::DFG::adjustAndJumpToTarget):

• dfg/DFGOperations.cpp:

(JSC::DFG::JSC_DEFINE_JIT_OPERATION):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePutPrivateName):
(JSC::DFG::SpeculativeJIT::compileValueAdd):
(JSC::DFG::SpeculativeJIT::compileValueSub):
(JSC::DFG::SpeculativeJIT::compileValueNegate):
(JSC::DFG::SpeculativeJIT::compileValueMul):
(JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

• ftl/FTLCompile.cpp:

(JSC::FTL::compile):

• ftl/FTLJITCode.h:
• ftl/FTLLink.cpp:

(JSC::FTL::link):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::addMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

• ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

• generator/Metadata.rb:
• jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::storeProperty):
(JSC::AssemblyHelpers::emitVirtualCall):
(JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject):

• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBuffer):

• jit/BaselineJITCode.cpp: Added.

(JSC::MathICHolder::addJITAddIC):
(JSC::MathICHolder::addJITMulIC):
(JSC::MathICHolder::addJITSubIC):
(JSC::MathICHolder::addJITNegIC):
(JSC::MathICHolder::adoptMathICs):
(JSC::BaselineJITCode::BaselineJITCode):
(JSC::BaselineJITCode::~BaselineJITCode):

• jit/BaselineJITCode.h: Added.

(JSC::JITConstantPool::add):
(JSC::JITConstantPool::size const):
(JSC::JITConstantPool::at const):

• jit/BaselineJITPlan.cpp:

(JSC::BaselineJITPlan::finalize):

• jit/CCallHelpers.cpp:

(JSC::CCallHelpers::logShadowChickenTailPacketImpl):
(JSC::CCallHelpers::logShadowChickenTailPacket):

• jit/CCallHelpers.h:
• jit/CallFrameShuffleData.cpp:

(JSC::CallFrameShuffleData::setupCalleeSaveRegisters):

• jit/CallFrameShuffleData.h:
• jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::CallFrameShuffler):
(JSC::CallFrameShuffler::prepareForTailCall):

• jit/CallFrameShuffler.h:

(JSC::CallFrameShuffler::snapshot const):

• jit/JIT.cpp:

(JSC::JIT::JIT):
(JSC::JIT::emitEnterOptimizationCheck):
(JSC::JIT::emitNotifyWriteWatchpoint):
(JSC::JIT::emitVarReadOnlyCheck):
(JSC::JIT::assertStackPointerOffset):
(JSC::JIT::resetSP):
(JSC::JIT::emitPutCodeBlockToFrameInPrologue):
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
(JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters):
(JSC::JIT::emitRestoreCalleeSaves):
(JSC::JIT::compileAndLinkWithoutFinalizing):
(JSC::JIT::link):
(JSC::JIT::finalizeOnMainThread):
(JSC::JIT::privateCompile):
(JSC::JIT::frameRegisterCountFor):
(JSC::JIT::stackPointerOffsetFor):

• jit/JIT.h:
• jit/JITArithmetic.cpp:

(JSC::JIT::emit_compareAndJumpSlowImpl):
(JSC::JIT::emit_compareAndJumpSlow):
(JSC::JIT::emit_op_negate):
(JSC::JIT::emit_op_add):
(JSC::JIT::emitMathICFast):
(JSC::JIT::emitMathICSlow):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emit_op_sub):

• jit/JITCall.cpp:

(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEval):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileTailCall):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):

• jit/JITCall32_64.cpp:

(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEval):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):

• jit/JITCode.h:

(JSC::JITCode::useDataIC):
(JSC::JITCode::pcToCodeOriginMap):

• jit/JITCompilationKey.cpp:

(JSC::JITCompilationKey::dump const):

• jit/JITCompilationKey.h:

(JSC::JITCompilationKey::JITCompilationKey):
(JSC::JITCompilationKey::operator! const):
(JSC::JITCompilationKey::isHashTableDeletedValue const):
(JSC::JITCompilationKey::operator== const):
(JSC::JITCompilationKey::hash const):
(JSC::JITCompilationKey::profiledBlock const): Deleted.

• jit/JITInlineCacheGenerator.cpp:

(JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
(JSC::JITInlineCacheGenerator::finalize):
(JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath):
(JSC::JITGetByIdGenerator::JITGetByIdGenerator):
(JSC::generateGetByIdInlineAccess):
(JSC::JITGetByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath):
(JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITDelByValGenerator::generateFastPath):
(JSC::JITDelByIdGenerator::generateFastPath):
(JSC::JITInByValGenerator::generateFastPath):
(JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITInstanceOfGenerator::generateFastPath):
(JSC::JITGetByValGenerator::generateFastPath):
(JSC::JITPutByValGenerator::generateFastPath):
(JSC::JITPrivateBrandAccessGenerator::generateFastPath):

• jit/JITInlineCacheGenerator.h:
• jit/JITInlines.h:

(JSC::JIT::isOperandConstantDouble):
(JSC::JIT::isOperandConstantInt):
(JSC::JIT::isKnownCell):
(JSC::JIT::getConstantOperand):
(JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
(JSC::JIT::linkSlowCaseIfNotJSCell):
(JSC::JIT::advanceToNextCheckpoint):
(JSC::JIT::emitJumpSlowToHotForCheckpoint):
(JSC::JIT::isOperandConstantChar):
(JSC::JIT::emitValueProfilingSite):
(JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
(JSC::JIT::emitArrayProfilingSiteWithCell):
(JSC::JIT::emitLoadDouble):
(JSC::JIT::emitJumpSlowCaseIfNotJSCell):
(JSC::JIT::emitGetVirtualRegister):
(JSC::JIT::jumpTarget):
(JSC::JIT::loadPtrFromMetadata):
(JSC::JIT::load32FromMetadata):
(JSC::JIT::load8FromMetadata):
(JSC::JIT::store8ToMetadata):
(JSC::JIT::store32ToMetadata):
(JSC::JIT::materializePointerIntoMetadata):
(JSC::JIT::loadConstant):
(JSC::JIT::loadGlobalObject):
(JSC::JIT::loadCodeBlockConstant):
(JSC::JIT::copiedGetPutInfo): Deleted.
(JSC::JIT::copiedArithProfile): Deleted.

• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_mov):
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emit_op_typeof_is_undefined):
(JSC::JIT::op_ret_handlerGenerator):
(JSC::JIT::emit_op_to_primitive):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::valueIsFalseyGenerator):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jeq_ptr):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::valueIsTruthyGenerator):
(JSC::JIT::emit_op_throw):
(JSC::JIT::op_throw_handlerGenerator):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_numeric):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_debug):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_enter):
(JSC::JIT::op_enter_handlerGenerator):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emitSlow_op_jeq):
(JSC::JIT::emitSlow_op_jneq):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_loop_hint):
(JSC::JIT::emitSlow_op_check_traps):
(JSC::JIT::op_check_traps_handlerGenerator):
(JSC::JIT::emit_op_new_regexp):
(JSC::JIT::emitNewFuncCommon):
(JSC::JIT::emitNewFuncExprCommon):
(JSC::JIT::emit_op_new_array):
(JSC::JIT::emit_op_new_array_with_size):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_tail):
(JSC::JIT::emit_op_profile_control_flow):
(JSC::JIT::emit_op_get_argument):
(JSC::JIT::emit_op_get_prototype_of):

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_typeof_is_undefined):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::compileOpEqJumpSlow):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_throw):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_numeric):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_enter):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_tail):

• jit/JITOperations.cpp:

(JSC::JSC_DEFINE_JIT_OPERATION):

• jit/JITOperations.h:
• jit/JITPlan.cpp:

(JSC::JITPlan::key):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::generateGetByValSlowCase):
(JSC::JIT::slow_op_get_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::slow_op_get_private_name_prepareCallGenerator):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emitSlow_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emitSlow_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::slow_op_del_by_id_prepareCallGenerator):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::slow_op_del_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::slow_op_get_by_id_prepareCallGenerator):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::slow_op_put_by_id_prepareCallGenerator):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitSlow_op_has_private_name):
(JSC::JIT::emitSlow_op_has_private_brand):
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emitResolveClosure):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::generateOpResolveScopeThunk):
(JSC::JIT::slow_op_resolve_scopeGenerator):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::generateOpGetFromScopeThunk):
(JSC::JIT::slow_op_get_from_scopeGenerator):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::slow_op_put_to_scopeGenerator):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_get_internal_field):
(JSC::JIT::emit_op_enumerator_next):
(JSC::JIT::emit_op_enumerator_get_by_val):
(JSC::JIT::emit_enumerator_has_propertyImpl):
(JSC::JIT::emitWriteBarrier):
(JSC::JIT::emitPutGlobalVariable): Deleted.
(JSC::JIT::emitPutGlobalVariableIndirect): Deleted.
(JSC::JIT::emitPutClosureVar): Deleted.

• jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emitSlow_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emitSlow_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_get_internal_field):

• jit/Repatch.cpp:

(JSC::tryCacheGetBy):
(JSC::tryCachePutBy):
(JSC::tryCacheInBy):
(JSC::unlinkCall):

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::jitCompileAndSetHeuristics):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/CacheableIdentifier.h:
• runtime/CacheableIdentifierInlines.h:

(JSC::CacheableIdentifier::createFromIdentifierOwnedByCodeBlock):

• runtime/CachedTypes.cpp:

(JSC::CachedCodeBlock::numBinaryArithProfiles const):
(JSC::CachedCodeBlock::numUnaryArithProfiles const):
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
(JSC::CachedCodeBlock<CodeBlockType>::encode):

• runtime/CommonSlowPaths.cpp:

(JSC::updateArithProfileForUnaryArithOp):

• runtime/FunctionExecutable.h:
• runtime/Options.cpp:

(JSC::Options::recomputeDependentOptions):

• runtime/OptionsList.h:
• runtime/ScriptExecutable.cpp:

(JSC::ScriptExecutable::prepareForExecutionImpl):

• wasm/WasmLLIntTierUpCounter.h:

(JSC::Wasm::LLIntTierUpCounter::optimizeAfterWarmUp):
(JSC::Wasm::LLIntTierUpCounter::optimizeSoon):

• wasm/WasmTierUpCount.cpp:

(JSC::Wasm::TierUpCount::TierUpCount):

• wasm/WasmTierUpCount.h:

(JSC::Wasm::TierUpCount::optimizeAfterWarmUp):
(JSC::Wasm::TierUpCount::optimizeNextInvocation):
(JSC::Wasm::TierUpCount::optimizeSoon):

Source/WTF:

• wtf/Bag.h:
• wtf/Packed.h:

(WTF::PackedAlignedPtr::operator* const):

Tools:

• Scripts/run-jsc-stress-tests:

2:50 PM Changeset in webkit [283138] by Truitt Savell

• 2 edits in trunk/LayoutTests

6 editing spelling tests crashing with uncaught exception 'NSInvalidArgumentException'
rdar://83592102

Unreviewed test gardening.

2:33 PM Changeset in webkit [283137] by Truitt Savell

• 2 edits in trunk/LayoutTests

8 editing/ tests crashing with Assertion failed
rdar://83591040

Unreviewed test gardening.

2:28 PM Changeset in webkit [283136] by Takashi.Komori@sony.com

• 2 edits in trunk/Source/WebCore

[Curl] Set CURL_LOCK_DATA_SSL_SESSION option to reduce SSL/TLS handshake time
​https://bugs.webkit.org/show_bug.cgi?id=230818

Reviewed by Fujii Hironori.

Set CURL_LOCK_DATA_SSL_SESSION option to reuse Session ID.
It reduces SSL/TLS handshake time.

Covered by existing tests.

• platform/network/curl/CurlContext.cpp:

(WebCore::CurlShareHandle::CurlShareHandle):

2:27 PM Changeset in webkit [283135] by commit-queue@webkit.org

• 2 edits in trunk/Source/JavaScriptCore

[JSC][32bit] Fix build after r283098
​https://bugs.webkit.org/show_bug.cgi?id=230856

Unreviewed build fix.

Patch by Xan López <Xan Lopez> on 2021-09-27

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_jeq_ptr): remove unused (broken) line.

2:21 PM Changeset in webkit [283134] by ntim@apple.com

• 6 edits in trunk/Source/WebCore

Rename Style::queuePostResolutionCallback to Style::deprecatedQueuePostResolutionCallback
​https://bugs.webkit.org/show_bug.cgi?id=230851

Reviewed by Simon Fraser.

The HTML5 event loop should be used instead.
Also fix pre-existing webkit-style errors.

• html/HTMLFormControlElement.cpp:

(WebCore::HTMLFormControlElement::didAttachRenderers):
(WebCore::HTMLFormControlElement::didRecalcStyle):

• html/HTMLFrameOwnerElement.cpp:

(WebCore::HTMLFrameOwnerElement::scheduleInvalidateStyleAndLayerComposition):

• html/HTMLPlugInImageElement.cpp:

(WebCore::HTMLPlugInImageElement::scheduleUpdateForAfterStyleResolution):

• style/StyleTreeResolver.cpp:

(WebCore::Style::deprecatedQueuePostResolutionCallback):
(WebCore::Style::queuePostResolutionCallback): Deleted.

• style/StyleTreeResolver.h:

2:07 PM Changeset in webkit [283133] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[ iOS 14 & 15 ] fast/images/image-subsampling.html is a flaky image failure.
​https://bugs.webkit.org/show_bug.cgi?id=230857

Unreviewed test gardening.

• platform/ios-wk2/TestExpectations:

2:05 PM Changeset in webkit [283132] by Sam Sneddon

• 3 edits in trunk/Tools

Port._natural_sort_key should sort a01 before a001
​https://bugs.webkit.org/show_bug.cgi?id=230764

Reviewed by Jonathan Bedard.

• Scripts/webkitpy/port/base.py:

(Port._natural_sort_key):

• Scripts/webkitpy/port/base_unittest.py:

(NaturalCompareTest.test_natural_compare):
(KeyCompareTest.test_test_key):

1:47 PM September 2021 Meeting edited by Jon Davis

Added placeholders for more session transcripts (diff)

1:18 PM Changeset in webkit [283131] by Alan Coon

• 8 edits in branches/safari-612-branch/Source

Versioning.

WebKit-7612.2.9

1:06 PM WebKit2021-2022Igalia edited by Jon Davis

Added notes captured (diff)

12:50 PM Changeset in webkit [283130] by mmaxfield@apple.com

• 10 edits in trunk

The CSS Fonts spec has deleted CSSRule.FONT_PALETTE_VALUES_RULE
​https://bugs.webkit.org/show_bug.cgi?id=230786
<rdar://problem/83528219>

Reviewed by Antti Koivisto.

LayoutTests/imported/w3c:

The test is being upstreamed at ​https://github.com/web-platform-tests/wpt/pull/30959.

• web-platform-tests/css/css-fonts/idlharness-expected.txt:
• web-platform-tests/css/css-fonts/parsing/font-palette-values-invalid-expected.txt:
• web-platform-tests/css/css-fonts/parsing/font-palette-values-invalid.html:
• web-platform-tests/css/css-fonts/parsing/font-palette-values-valid.html:
• web-platform-tests/interfaces/css-fonts.idl:

Source/WebCore:

Update WebKit according to
​https://github.com/w3c/csswg-drafts/commit/45bda92646e0438c1fcd44497144aa86f0df1b61.

Test: web-platform-tests/css/css-fonts/parsing/font-palette-values-invalid.html

• css/CSSRule.h:
• css/CSSRule.idl:
• css/StyleRuleType.h:

12:33 PM WebKit2021-2022Igalia edited by Jon Davis

Added link to the slide deck (diff)

12:33 PM Changeset in webkit [283129] by commit-queue@webkit.org

• 100 edits
  2 deletes in trunk

Unreviewed, reverting r283102, r283103 and r283104.
​https://bugs.webkit.org/show_bug.cgi?id=230854

It regresses JetStream2 on iOS devices

Reverted changesets:

"Build an unlinked baseline JIT"
​https://bugs.webkit.org/show_bug.cgi?id=229223
​https://commits.webkit.org/r283102

"Unreviewed, fix CLoop build"
​https://bugs.webkit.org/show_bug.cgi?id=229223
​https://commits.webkit.org/r283103

"Unreviewed, fix CLoop build part 2"
​https://bugs.webkit.org/show_bug.cgi?id=229223
​https://commits.webkit.org/r283104

11:53 AM Changeset in webkit [283128] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[ iOS 14 ] remote-layer-tree/ios/uiview-tree-basic.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=230850

Unreviewed test gardening.

• platform/ios-wk2/TestExpectations:

11:34 AM OffscreenCanvas2021Update created by Jon Davis

11:34 AM GitHubandNewProcesses created by Jon Davis

11:33 AM ProtectedCollaborationTree created by Jon Davis

11:17 AM ApplePlansForWebKit2022Edition created by Jon Davis

11:17 AM WebKit2021-2022Igalia created by Jon Davis

11:16 AM September 2021 Meeting edited by Jon Davis

Added Transcript placeholders for day 1 (diff)

10:59 AM Changeset in webkit [283127] by Andres Gonzalez

• 2 edits in trunk/Source/WebCore

Boundary check of AccessibilityMathMLElement::mathOverObject is incorrect
​https://bugs.webkit.org/show_bug.cgi?id=230828
<rdar://problem/83571752>

Reviewed by Chris Fleizach.

• accessibility/AccessibilityMathMLElement.cpp:

(WebCore::AccessibilityMathMLElement::mathOverObject):

10:27 AM September 2021 Meeting edited by Jon Davis

Updated more titles (diff)

10:18 AM Changeset in webkit [283126] by Jonathan Bedard

• 5 edits in trunk/Tools

Exception in run-webkit-tests: Bad file descriptor (Revert)
​https://bugs.webkit.org/show_bug.cgi?id=229994
<rdar://problem/82826083>

Unreviewed revert.

Revert of 241391@main, 241474@main, 241546@main and 241782@main

• Scripts/webkitpy/common/system/filesystem.py:

(FileSystem.rmtree):

• Scripts/webkitpy/port/server_process.py:

(ServerProcess.write):
(ServerProcess._wait_for_data_and_update_buffers_using_select):

• Scripts/webkitpy/port/simulator_process.py:

(SimulatorProcess):
(SimulatorProcess._start):

• Scripts/webkitpy/xcode/simulated_device.py:

(SimulatedDevice.launch_app):

10:13 AM Changeset in webkit [283125] by commit-queue@webkit.org

• 2 edits in trunk/LayoutTests

[ MacOS ] inspector/dom/getAccessibilityPropertiesForNode.html is failing
​https://bugs.webkit.org/show_bug.cgi?id=230840

Patch by Tyler Wilcock <Tyler Wilcock> on 2021-09-27
Reviewed by Ryan Haddad.

Remove expanded property from expected output for this test.
Following ​https://trac.webkit.org/changeset/283078/webkit, we don't
expose expanded in this case anymore.

• inspector/dom/getAccessibilityPropertiesForNode-expected.txt:

10:05 AM September 2021 Meeting edited by Jon Davis

Updated presentation titles (diff)

9:55 AM Changeset in webkit [283124] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina BigSur wk1 Debug ] webrtc/datachannel/datachannel-gc.html is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230848.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

9:43 AM Changeset in webkit [283123] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina Debug wk1 EWS ] svg/filters/big-height-filter.svg is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230846.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

9:35 AM Changeset in webkit [283122] by pvollan@apple.com

• 2 edits in trunk/Source/WebKit

[iOS][GPUP] Remove access to unused mach services in sandbox
​https://bugs.webkit.org/show_bug.cgi?id=230832
<rdar://problem/83573640>

Reviewed by Brent Fulgham.

Remove access to mach services on iOS in the GPU process that are unused, according to telemetry.

• Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:

9:29 AM Changeset in webkit [283121] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina Debug wk1 EWS ] storage/indexeddb/mozilla/cursor-mutation.html is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230844.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

9:27 AM Changeset in webkit [283120] by Antti Koivisto

• 11 edits in trunk

[CSS Cascade Layers] Support @layer statement before @import statements
​https://bugs.webkit.org/show_bug.cgi?id=230826

Reviewed by Simon Fraser.

LayoutTests/imported/w3c:

• web-platform-tests/css/css-cascade/layer-import-expected.txt:

Source/WebCore:

Support case like

@layer a, b;
@import url(foo.css);

Before this patch @import rules could only be preceded by a @charset rule.

• css/StyleRule.cpp:

(WebCore::StyleRuleLayer::createStatement):
(WebCore::StyleRuleLayer::createBlock):
(WebCore::StyleRuleLayer::create): Deleted.

Some clarifying renaming.

• css/StyleRule.h:
• css/StyleSheetContents.cpp:

(WebCore::StyleSheetContents::parserAppendRule):

Add a new m_layerRulesBeforeImportRules vector and put any early layer statements there.

(WebCore::StyleSheetContents::ruleAt const):
(WebCore::StyleSheetContents::ruleCount const):
(WebCore::StyleSheetContents::clearRules):
(WebCore::StyleSheetContents::wrapperInsertRule):
(WebCore::StyleSheetContents::wrapperDeleteRule):

• css/StyleSheetContents.h:
• css/parser/CSSParserImpl.cpp:

(WebCore::computeNewAllowedRules):
(WebCore::CSSParserImpl::consumeImportRule):
(WebCore::CSSParserImpl::consumeLayerRule):

Parsing support.

• css/parser/CSSParserImpl.h:
• style/RuleSet.cpp:

(WebCore::Style::RuleSet::Builder::addChildRules):
(WebCore::Style::RuleSet::Builder::addRulesFromSheet):

Register layers before imports.

(WebCore::Style::RuleSet::Builder::registerLayers):

Factor into a function.

• style/RuleSet.h:

9:19 AM Changeset in webkit [283119] by BJ Burg

• 11 edits
  1 copy in trunk/Source/WebKit

[Cocoa] backport showConsole() and showResources() for RemoteWebInspectorUI
​https://bugs.webkit.org/show_bug.cgi?id=230573
<rdar://problem/83365814>

Reviewed by Devin Rousso.

These methods already exist for _WKInspector. A test will be added in
future patch that tests _WKInspectorExtensionDelegate shown/hidden callback methods.

• UIProcess/API/Cocoa/_WKInspectorIBActions.h: Copied from Source/WebKit/UIProcess/API/Cocoa/_WKInspector.h.

Added. API and SPI that are shared between local and remote Web Inspector
should go in this class. Since these methods are used to implement IBActions for a
detached Web Inspector window, the protocol is named _WKInspectorIBActions.
Hoist showResources() and showConsole() to this shared protocol.

• UIProcess/API/Cocoa/_WKInspectorExtensionHost.h:
• UIProcess/API/Cocoa/_WKInspector.h: Remove methods that are

part of the _WKInspectorIBActions protocol.

• UIProcess/API/Cocoa/_WKRemoteWebInspectorViewController.mm:

(-[_WKRemoteWebInspectorViewController showConsole]):
(-[_WKRemoteWebInspectorViewController showResources]):
Added. Call into RemoteWebInspectorUIProxy.

• UIProcess/Inspector/RemoteWebInspectorUIProxy.h:
• UIProcess/Inspector/RemoteWebInspectorUIProxy.cpp:

(WebKit::RemoteWebInspectorUIProxy::showConsole):
(WebKit::RemoteWebInspectorUIProxy::showResources):
Added. Send an IPC message to the Inspector web process.

• WebProcess/Inspector/RemoteWebInspectorUI.h:
• WebProcess/Inspector/RemoteWebInspectorUI.messages.in:

Add new messages.

• WebProcess/Inspector/RemoteWebInspectorUI.cpp:

(WebKit::RemoteWebInspectorUI::showConsole):
(WebKit::RemoteWebInspectorUI::showResources):
Added. Backport the implementation from WebInspectorUI.

9:12 AM Changeset in webkit [283118] by Lauro Moura

• 2 edits in trunk/LayoutTests

Garden passing flexbox abspos tests since updated in 242101@main

Unreviewed test gardening.

These tests are passing in all platforms according to
results.webkit.org.

• TestExpectations:

9:09 AM Changeset in webkit [283117] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina BigSur wk1 Debug ] media/track/audio-track.html is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230842.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

9:06 AM Changeset in webkit [283116] by youenn@apple.com

• 14 edits
  1 add in trunk/Source

iPadOS 15 / iOS 15 unable to decode VP9 stream
​https://bugs.webkit.org/show_bug.cgi?id=230604
<rdar://problem/83391595>

Reviewed by Eric Carlson.

Source/WebCore:

Export a utility function to know whether HW VP9 is supported by VTB.
No change of behavior.

• platform/graphics/cocoa/VP9UtilitiesCocoa.h:
• platform/graphics/cocoa/VP9UtilitiesCocoa.mm:

(WebCore::vp9HardwareDecoderAvailable):

Source/WebKit:

Update code to retrieve some parameters when synchronously creating the GPU process connection.
The sole parameter is currently to know the HW VP9 decoder availability.
If HW VP9 decoder is not supported by GPUProcess code, we fallback to SW libvpx.

Manually tested.

• GPUProcess/GPUProcess.cpp:

(WebKit::GPUProcess::createGPUConnectionToWebProcess):

• GPUProcess/GPUProcess.h:
• GPUProcess/GPUProcess.messages.in:
• Shared/GPUProcessConnectionInitializationParameters.h: Added.
• UIProcess/GPU/GPUProcessProxy.cpp:

(WebKit::GPUProcessProxy::getGPUProcessConnection):

• WebKit.xcodeproj/project.pbxproj:
• WebProcess/GPU/GPUProcessConnection.cpp:

(WebKit::GPUProcessConnection::GPUProcessConnection):

• WebProcess/GPU/GPUProcessConnection.h:

(WebKit::GPUProcessConnection::create):
(WebKit::GPUProcessConnection::hasVP9HardwareDecoder const):

• WebProcess/GPU/GPUProcessConnectionInfo.h:

(WebKit::GPUProcessConnectionInfo::encode const):
(WebKit::GPUProcessConnectionInfo::decode):

• WebProcess/GPU/webrtc/LibWebRTCCodecs.cpp:

(WebKit::LibWebRTCCodecs::setCallbacks):

• WebProcess/WebProcess.cpp:

(WebKit::WebProcess::ensureGPUProcessConnection):

9:03 AM Changeset in webkit [283115] by Andres Gonzalez

• 9 edits in trunk/Source/WebCore

Fix for crash in accessibility/Mac/search-predicate-for-adhoc-radio-groups.html in isolated tree mode.
​https://bugs.webkit.org/show_bug.cgi?id=230754
<rdar://problem/83498599>

Reviewed by Chris Fleizach.

Test: accessibility/Mac/search-predicate-for-adhoc-radio-groups.html

The crash was caused by the call in isRadioButtonInDifferentAdhocGroup
to axObject->element()->getNameAttribute(), since element() should not
be called off of the main thread. That brins up the question of how to
get element attributes on the AX thread. For that purpose, I added the
attributeValue method to the AXCoreObject interface, and removed the
related methods that take QualifiedNames and return an AtomString, since
they cannot be used off of the main thread.

• accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::attributeValue const):
(WebCore::AccessibilityObject::setIsIgnoredFromParentDataForChild):
(WebCore::Accessibility::isRadioButtonInDifferentAdhocGroup):

• accessibility/AccessibilityObject.h:
• accessibility/AccessibilityObjectInterface.h:
• accessibility/AccessibilityTableCell.cpp:

(WebCore::AccessibilityTableCell::columnHeaders):
(WebCore::AccessibilityTableCell::rowHeaders):

• accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(-[WebAccessibilityObjectWrapper accessibilityIdentifier]):

• accessibility/isolatedtree/AXIsolatedObject.cpp:

(WebCore::AXIsolatedObject::initializeAttributeData):
(WebCore::AXIsolatedObject::attributeValue const):
(WebCore::AXIsolatedObject::hasAttribute const): Deleted.
(WebCore::AXIsolatedObject::getAttribute const): Deleted.

• accessibility/isolatedtree/AXIsolatedObject.h:
• accessibility/isolatedtree/AXIsolatedTree.h:

9:01 AM Changeset in webkit [283114] by youenn@apple.com

• 20 edits
  4 adds in trunk

Make sure to reset presenting application pid in case of mediaserverd crash
​https://bugs.webkit.org/show_bug.cgi?id=230822
<rdar://83474184>

Reviewed by Eric Carlson.

Source/WebCore:

Before the patch, we were asking MediaSessionHelper client to set the pid in case of mediaserverd crash.
Given GPUProcess is the only one receiving the notification now, only the GPUProcess client could do it,
which was not the case as MediaSessionManager in WebProcess was responsible to do so.

Instead of relying on MediaSessionHelper client to do the setup, we now let MediaSessionHelper do it on its own.
Everything will happen in GPUProcess which should also be faster.

We also make sure to reset the affine transform of m_sampleBufferDisplayLayer so that rotation is applied correctly
after mediaserverd crash.

Manually tested by crashing mediaserverd.
Test: fast/mediastream/video-rotation-gpu-process-crash.html (covers affine transform change).

• platform/audio/ios/MediaSessionHelperIOS.h:
• platform/audio/ios/MediaSessionHelperIOS.mm:

(MediaSessionHelperiOS::providePresentingApplicationPID):
(MediaSessionHelperiOS::mediaServerConnectionDied):

• platform/audio/ios/MediaSessionManagerIOS.h:
• platform/audio/ios/MediaSessionManagerIOS.mm:
• platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:

(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::enqueueVideoSample):

Source/WebKit:

Add API to crash GPUProcess from WebKitTestRunner.

Make sure to forward to MediaPlayer the fact that the layer failed.
This was handled for GPUProcess crash but not for other cases like mediaserverd crashes.

• UIProcess/API/C/WKContext.cpp:

(WKContextTerminateGPUProcess):

• UIProcess/API/C/WKContextPrivate.h:
• UIProcess/GPU/GPUProcessProxy.cpp:

(WebKit::GPUProcessProxy::terminateForTesting):

• UIProcess/GPU/GPUProcessProxy.h:
• WebProcess/GPU/webrtc/SampleBufferDisplayLayer.cpp:

(WebKit::SampleBufferDisplayLayer::setDidFail):

Tools:

Add test runner API to crash GPUProcess.

• WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
• WebKitTestRunner/InjectedBundle/TestRunner.cpp:

(WTR::TestRunner::terminateGPUProcess):

• WebKitTestRunner/InjectedBundle/TestRunner.h:
• WebKitTestRunner/TestController.cpp:

(WTR::TestController::terminateGPUProcess):

• WebKitTestRunner/TestController.h:
• WebKitTestRunner/TestInvocation.cpp:

(WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle):

LayoutTests:

• fast/mediastream/video-rotation-gpu-process-crash-expected.txt: Added.
• fast/mediastream/video-rotation-gpu-process-crash.html: Added.
• platform/ios-simulator/fast/mediastream/video-rotation-gpu-process-crash-expected.png: Added.
• platform/mac/fast/mediastream/video-rotation-gpu-process-crash-expected.png: Added.

8:57 AM Changeset in webkit [283113] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Windows ] svg/as-background-image/svg-as-background-body.html is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230838.

Unreviewed test gardening.

• platform/win/TestExpectations:

8:50 AM Changeset in webkit [283112] by commit-queue@webkit.org

• 2 edits in trunk/Tools

prepare-ChangeLog does not show the correct result with using --git-commit
​https://bugs.webkit.org/show_bug.cgi?id=230816

Patch by Hoa Dinh <​dvh@apple.com> on 2021-09-27
Reviewed by Jonathan Bedard.

When we pass the parameter --git-commit, we need to use the correct reference version when
computing the difference between the version before and after the change.
This patch fixes it by passing the version before the specified commit.

Also, when --git-commit is used, we need compare against the correct version of the file.
This patch fixes that part by calling git to retrieve the accurate version.

• Scripts/prepare-ChangeLog:

(originalFile):
(generateFunctionLists):

8:41 AM Changeset in webkit [283111] by Kate Cheney

• 178 edits in trunk

Send CSP violation reports to the DOM window
​https://bugs.webkit.org/show_bug.cgi?id=230728

Reviewed by Brent Fulgham.

LayoutTests/imported/w3c:

Rebaseline CSP tests now that many are no longer timing out. In some
cases this will require removing console logging because in general
for CSP tests we dump console logging to stderr to avoid flakiness.

• web-platform-tests/content-security-policy/base-uri/report-uri-does-not-respect-base-uri.sub-expected.txt:
• web-platform-tests/content-security-policy/blob/blob-urls-do-not-match-self.sub-expected.txt:
• web-platform-tests/content-security-policy/blob/self-doesnt-match-blob.sub-expected.txt:
• web-platform-tests/content-security-policy/blob/star-doesnt-match-blob.sub-expected.txt:
• web-platform-tests/content-security-policy/child-src/child-src-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub-expected.txt:
• web-platform-tests/content-security-policy/child-src/child-src-redirect-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/child-src/child-src-worker-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-beacon-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-beacon-redirect-to-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-eventsource-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-eventsource-redirect-to-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-websocket-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-xmlhttprequest-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-xmlhttprequest-redirect-to-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/default-src/default-src-inline-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/font-src/font-stylesheet-font-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/form-action/form-action-src-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/form-action/form-action-src-get-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/form-action/form-action-src-javascript-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/frame-src/frame-src-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/frame-src/frame-src-cross-origin-load.sub-expected.txt:
• web-platform-tests/content-security-policy/frame-src/frame-src-redirect-expected.txt:
• web-platform-tests/content-security-policy/frame-src/frame-src-same-document-meta.sub-expected.txt:
• web-platform-tests/content-security-policy/frame-src/frame-src-same-document.sub-expected.txt:
• web-platform-tests/content-security-policy/frame-src/frame-src-self-unique-origin-expected.txt:
• web-platform-tests/content-security-policy/generic/304-response-should-update-csp.sub-expected.txt:
• web-platform-tests/content-security-policy/generic/directive-name-case-insensitive.sub-expected.txt:
• web-platform-tests/content-security-policy/generic/generic-0_1-img-src-expected.txt:
• web-platform-tests/content-security-policy/generic/generic-0_1-script-src-expected.txt:
• web-platform-tests/content-security-policy/generic/generic-0_10_1.sub-expected.txt:
• web-platform-tests/content-security-policy/generic/generic-0_2_2.sub-expected.txt:
• web-platform-tests/content-security-policy/generic/generic-0_2_3-expected.txt:
• web-platform-tests/content-security-policy/generic/generic-0_8_1.sub-expected.txt:
• web-platform-tests/content-security-policy/generic/only-valid-whitespaces-are-allowed-expected.txt:
• web-platform-tests/content-security-policy/generic/policy-inherited-correctly-by-plznavigate-expected.txt:
• web-platform-tests/content-security-policy/img-src/img-src-self-unique-origin-expected.txt:
• web-platform-tests/content-security-policy/img-src/report-blocked-data-uri.sub-expected.txt:
• web-platform-tests/content-security-policy/inheritance/document-write-iframe-expected.txt:
• web-platform-tests/content-security-policy/inheritance/frame-src-javascript-url-expected.txt:
• web-platform-tests/content-security-policy/inheritance/iframe-srcdoc-inheritance-expected.txt:
• web-platform-tests/content-security-policy/inheritance/inherited-csp-list-modifications-are-local-expected.txt:
• web-platform-tests/content-security-policy/inheritance/javascript-url-srcdoc-cross-origin-iframe-inheritance-expected.txt:
• web-platform-tests/content-security-policy/inheritance/location-reload-expected.txt:
• web-platform-tests/content-security-policy/media-src/media-src-7_1_2.sub-expected.txt:
• web-platform-tests/content-security-policy/media-src/media-src-7_2_2.sub-expected.txt:
• web-platform-tests/content-security-policy/media-src/media-src-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/meta/combine-header-and-meta-policies.sub-expected.txt:
• web-platform-tests/content-security-policy/navigate-to/form-action/form-action-blocks-navigate-to-allows.sub-expected.txt:
• web-platform-tests/content-security-policy/navigate-to/form-action/form-action-blocks-navigate-to-blocks.sub-expected.txt:
• web-platform-tests/content-security-policy/navigation/javascript-url-navigation-inherits-csp-expected.txt:
• web-platform-tests/content-security-policy/navigation/to-javascript-parent-initiated-parent-csp-expected.txt:
• web-platform-tests/content-security-policy/object-src/object-src-no-url-blocked-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/report-to-directive-allowed-in-meta.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/reporting-api-report-only-sends-reports-on-violation.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-only-sends-reports-to-first-endpoint.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-1.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-2.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/reporting-api-sends-reports-on-violation.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/reporting-api-works-on-frame-src.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting/report-same-origin-with-cookies-expected.txt:
• web-platform-tests/content-security-policy/reporting/report-uri-effective-directive-expected.txt:
• web-platform-tests/content-security-policy/script-src/hash-always-converted-to-utf-8/iso-8859-1-expected.txt:
• web-platform-tests/content-security-policy/script-src/hash-always-converted-to-utf-8/iso-8859-3-expected.txt:
• web-platform-tests/content-security-policy/script-src/hash-always-converted-to-utf-8/iso-8859-7-expected.txt:
• web-platform-tests/content-security-policy/script-src/hash-always-converted-to-utf-8/iso-8859-9-expected.txt:
• web-platform-tests/content-security-policy/script-src/hash-always-converted-to-utf-8/utf-8-lone-surrogate-expected.txt:
• web-platform-tests/content-security-policy/script-src/injected-inline-script-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/script-src/javascript-window-open-blocked-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-1_1-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-1_10-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-1_2-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-1_2_1-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-1_4_1-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-report-only-policy-works-with-external-hash-policy-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-report-only-policy-works-with-hash-policy-expected.txt:
• web-platform-tests/content-security-policy/script-src/scriptnonce-and-scripthash.sub-expected.txt:
• web-platform-tests/content-security-policy/script-src/scriptnonce-basic-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/script-src/scriptnonce-ignore-unsafeinline.sub-expected.txt:
• web-platform-tests/content-security-policy/script-src/srcdoc-doesnt-bypass-script-src.sub-expected.txt:
• web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
• web-platform-tests/content-security-policy/securitypolicyviolation/inside-dedicated-worker-expected.txt:
• web-platform-tests/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image.sub-expected.txt:
• web-platform-tests/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-image-from-script.sub-expected.txt:
• web-platform-tests/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-image.sub-expected.txt:
• web-platform-tests/content-security-policy/securitypolicyviolation/upgrade-insecure-requests-reporting.https-expected.txt:
• web-platform-tests/content-security-policy/style-src/injected-inline-style-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/inline-style-allowed-while-cloning-objects.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/inline-style-attribute-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-error-event-fires-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-hash-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-imported-style-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-injected-inline-style-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-injected-stylesheet-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-inline-style-attribute-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-inline-style-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-inline-style-nonce-blocked-error-event-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-inline-style-nonce-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-none-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-stylesheet-nonce-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/stylehash-basic-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/stylenonce-allowed.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/stylenonce-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/svg/object-in-svg-foreignobject.sub-expected.txt:
• web-platform-tests/content-security-policy/svg/svg-inline.sub-expected.txt:
• web-platform-tests/content-security-policy/unsafe-eval/eval-scripts-setInterval-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/unsafe-eval/eval-scripts-setTimeout-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_allowed-href-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_allowed-href_blank-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_allowed-window_location-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_allowed-window_open-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-href-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-href_blank-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-window_location-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-window_open-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_wrong_hash-href-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_wrong_hash-href_blank-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_wrong_hash-window_location-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_wrong_hash-window_open-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/script_event_handlers_allowed-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/script_event_handlers_denied_missing_unsafe_hashes-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/script_event_handlers_denied_wrong_hash-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/style_attribute_denied_missing_unsafe_hashes-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/style_attribute_denied_wrong_hash-expected.txt:
• web-platform-tests/content-security-policy/worker-src/dedicated-worker-src-child-fallback-blocked.sub-expected.txt:

Source/WebCore:

No new tests. This will fix numerous test timeouts.

Many imported CSP tests are timing out because they wait for security
violation events to be sent to the DOM window. This patch bubbles up
violation reports so attached documents will also report violations
to the window.

• dom/Document.cpp:

(WebCore::Document::enqueueSecurityPolicyViolationEvent):

• page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportViolation const):
We should only report the name of the violated directive to match
the spec, which specifies this should be "a non-empty string
representing the directive whose enforcement caused the violation."

LayoutTests:

Unskip tests that are no longer timing out after this fix. Rebaseline
tests that previously expected a different violated directive text.

• TestExpectations:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-https-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-https-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/script-blocked-sends-multiple-reports-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-enforced-policy-and-blocked-by-report-policy-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-enforced-policy-and-blocked-by-report-policy2-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securityviolationpolicy-block-frame-using-child-src-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securityviolationpolicy-block-frame-using-default-src-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securityviolationpolicy-block-frame-using-frame-src-expected.txt:
• http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt:
• http/tests/security/contentSecurityPolicy/report-blocked-data-uri-expected.txt:
• http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt:
• http/tests/security/contentSecurityPolicy/report-blocked-uri-and-do-not-follow-redirect-when-sending-report-expected.txt:
• http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin-expected.txt:
• http/tests/security/contentSecurityPolicy/report-blocked-uri-expected.txt:
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-expected.txt:
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled-expected.txt:
• http/tests/security/contentSecurityPolicy/report-multiple-violations-01-expected.txt:
• http/tests/security/contentSecurityPolicy/report-multiple-violations-02-expected.txt:
• http/tests/security/contentSecurityPolicy/report-only-expected.txt:
• http/tests/security/contentSecurityPolicy/report-only-from-header-expected.txt:
• http/tests/security/contentSecurityPolicy/report-only-upgrade-insecure-expected.txt:
• http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-expected.txt:
• http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled-expected.txt:
• http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https-expected.txt:
• http/tests/security/contentSecurityPolicy/report-uri-expected.txt:
• http/tests/security/contentSecurityPolicy/report-uri-from-child-frame-expected.txt:
• http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript-expected.txt:
• http/tests/security/contentSecurityPolicy/report-uri-from-javascript-expected.txt:
• http/tests/security/contentSecurityPolicy/report-uri-scheme-relative-expected.txt:
• http/tests/security/contentSecurityPolicy/same-origin-plugin-document-blocked-in-child-window-report-expected.txt:

8:36 AM Changeset in webkit [283110] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina BigSur wk1 Debug ] Assertion Failure: WebGL tests are flaky crashes.
​https://bugs.webkit.org/show_bug.cgi?id=230835.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

8:13 AM Changeset in webkit [283109] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina Debug wk1 EWS] performance-api/performance-observer-order.html is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230833.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

7:59 AM Changeset in webkit [283108] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina Debug wk1 EWS ] storage/websql/multiple-transactions-on-different-handles.html is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230831.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

7:45 AM Changeset in webkit [283107] by Eric Hutchison

• 2 edits in trunk/LayoutTests

imported/w3c/web-platform-tests/webrtc/RTCDataChannel-close.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=230696.

Unreviewed test gardening.

• platform/ios-14-wk2/TestExpectations:

5:34 AM Changeset in webkit [283106] by youenn@apple.com

• 2 edits in trunk/Source/WebKit

Rename RemoteCaptureSampleManager::RemoteAudio thread appropriately
​https://bugs.webkit.org/show_bug.cgi?id=230745

Reviewed by Eric Carlson.

No change of behavior.

• WebProcess/cocoa/RemoteCaptureSampleManager.cpp:

(WebKit::RemoteCaptureSampleManager::RemoteAudio::startThread):

4:25 AM Changeset in webkit [283105] by ntim@apple.com

• 9 edits in trunk/Source

Replace Node::isInert() with RenderStyle::effectiveInert()
​https://bugs.webkit.org/show_bug.cgi?id=230686

Reviewed by Antti Koivisto.

This replaces Node::isInert() in favor of RenderStyle::effectiveInert() which is more accurate. We can't use it in
Element::isFocusable(), since there's a bug with invalidation when accessing the cached computedStyle, hence
the Node::deprecatedIsInert() method.

Source/WebCore:

• accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::defaultObjectInclusion const):

• dom/Element.cpp:

(WebCore::Element::isFocusable const):

• dom/Node.cpp:

(WebCore::Node::canStartSelection const):
(WebCore::Node::deprecatedIsInert const): Added.

• dom/Node.h:
• dom/Position.cpp:

(WebCore::Position::nodeIsInertOrUserSelectNone):
(WebCore::Position::nodeIsUserSelectAll):

• rendering/RenderObject.cpp:

(WebCore::RenderObject::collectSelectionGeometriesInternal):

Source/WebKit:

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::selectionPositionInformation):

2:07 AM Changeset in webkit [283104] by ysuzuki@apple.com

• 2 edits in trunk/Source/JavaScriptCore

Unreviewed, fix CLoop build part 2
​https://bugs.webkit.org/show_bug.cgi?id=229223

• llint/LowLevelInterpreter64.asm:

1:55 AM Changeset in webkit [283103] by ysuzuki@apple.com

• 3 edits in trunk/Source/JavaScriptCore

Unreviewed, fix CLoop build
​https://bugs.webkit.org/show_bug.cgi?id=229223

• llint/LLIntOfflineAsmConfig.h:
• llint/LowLevelInterpreter64.asm:

12:52 AM Changeset in webkit [283102] by sbarati@apple.com

• 99 edits
  1 copy
  1 add in trunk

Build an unlinked baseline JIT
​https://bugs.webkit.org/show_bug.cgi?id=229223
<rdar://problem/82321772>

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

This patch adds an "unlinked" baseline JIT to JSVALUE64 platforms. The JIT
code produced by this baseline JIT can be shared between all CodeBlocks that
share an UnlinkedCodeBlock. The benefit of this is, if we're creating a CodeBlock
from an UnlinkedCodeBlock that already compiled an unlinked baseline JIT
instance, this new CodeBlock just starts off executing in the baseline JIT
"for free".

To make this work, the code we emit now needs to be independent of a specific
CodeBlock instance. We use a CodeBlock instance for minimal profiling information
when compiling, but otherwise, the code is tied to the UnlinkedCodeBlock. When
we need CodeBlock specific information, we load it. This usually means things
like we'll load things from the Metadata dynamically. This patch also adds a
"linked constant pool" concept, and anytime we instantiate such a CodeBlock,
we also need to instantiate this "linked constant pool". This contains things
like our inline cache data structures (StructureStubInfo*), JSGlobalObject*,
etc.

Unlinked baseline JIT always runs ICs in the "data" mode. To make this work, I
made data ICs work on x86_64. To do this, we no longer call/ret to the IC.
Instead, we jump to the IC, and the IC jumps back by loading the "done" location
from the StructureStubInfo dynamically. This simplifies the design to not be
based on the arm64 calling convention, and keeps the same performance characteristics.

This patch also adds a new version of InlineAccess that is only used in baseline
JIT (for now). In the future, we can make the DFG/FTL also use this for Data
ICs. But we don't need to do that yet since those tiers don't use data ICs by
default. The baseline JIT now has a pure data IC approach to InlineAccess. So
instead of repatching code, we repatch fields we load dynamically.

This patch also cleans up a few things in OSR exit, where both DFG/FTL were
storing callee saves to the callee saves buffer in a weird place, and separate
from one another. I noticed this code can be simplified if we just store
callee saves at the end of the OSR exit handler, and from common JIT emission
code.

This patch also fixes a bug where we could end up with the wrong (and always
more negative) SP in the baseline JIT. This could happen when we OSR exit
from an inlined getter/setter. The OSR exit code puts the return PC when
returning to the call site of the getter/setter to be the inline cache's
"done location". However, this "done location" didn't used to restore SP.
This patch conservatively makes it so that we restore the SP at these sites.

This is measured as a 1% speedup on Speedometer2.

• CMakeLists.txt:
• JavaScriptCore.xcodeproj/project.pbxproj:
• Sources.txt:
• bytecode/AccessCase.cpp:

(JSC::AccessCase::fromStructureStubInfo):
(JSC::AccessCase::generateImpl):

• bytecode/BytecodeList.rb:
• bytecode/BytecodeOperandsForCheckpoint.h:

(JSC::valueProfileOffsetFor):

• bytecode/CallLinkInfo.cpp:

(JSC::CallLinkInfo::fastPathStart):
(JSC::CallLinkInfo::emitFastPathImpl):
(JSC::CallLinkInfo::emitFastPath):
(JSC::CallLinkInfo::emitTailCallFastPath):
(JSC::CallLinkInfo::emitDataICFastPath):
(JSC::CallLinkInfo::emitTailCallDataICFastPath):
(JSC::CallLinkInfo::emitDataICSlowPath):
(JSC::CallLinkInfo::initializeDataIC):
(JSC::CallLinkInfo::emitDirectFastPath):
(JSC::CallLinkInfo::emitDirectTailCallFastPath):

• bytecode/CallLinkInfo.h:

(JSC::CallLinkInfo::offsetOfMaxArgumentCountIncludingThis):
(JSC::CallLinkInfo::slowStub): Deleted.
(JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::setupWithUnlinkedBaselineCode):
(JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const):
(JSC::CodeBlock::setConstantRegisters):
(JSC::CodeBlock::finalizeJITInlineCaches):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::frameRegisterCount):
(JSC::CodeBlock::binaryArithProfileForPC):
(JSC::CodeBlock::unaryArithProfileForPC):
(JSC::CodeBlock::findPC):
(JSC::CodeBlock::jitSoon):
(JSC::CodeBlock::jitNextInvocation):
(JSC::CodeBlock::dumpMathICStats):
(JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
(JSC::CodeBlock::addJITAddIC): Deleted.
(JSC::CodeBlock::addJITMulIC): Deleted.
(JSC::CodeBlock::addJITSubIC): Deleted.
(JSC::CodeBlock::addJITNegIC): Deleted.
(JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
(JSC::CodeBlock::thresholdForJIT): Deleted.
(JSC::CodeBlock::jitAfterWarmUp): Deleted.

• bytecode/CodeBlock.h:

(JSC::CodeBlock::JITData::offsetOfJITConstantPool):
(JSC::CodeBlock::offsetOfJITData):
(JSC::CodeBlock::offsetOfArgumentValueProfiles):
(JSC::CodeBlock::offsetOfConstantsVectorBuffer):
(JSC::CodeBlock::baselineJITConstantPool):
(JSC::CodeBlock::checkIfJITThresholdReached):
(JSC::CodeBlock::dontJITAnytimeSoon):
(JSC::CodeBlock::llintExecuteCounter const):
(JSC::CodeBlock::offsetOfDebuggerRequests):
(JSC::CodeBlock::offsetOfShouldAlwaysBeInlined):
(JSC::CodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
(JSC::CodeBlock::addressOfNumParameters): Deleted.
(JSC::CodeBlock::isKnownCell): Deleted.
(JSC::CodeBlock::addMathIC): Deleted.
(JSC::CodeBlock::setJITCodeMap): Deleted.
(JSC::CodeBlock::jitCodeMap): Deleted.
(JSC::CodeBlock::switchJumpTable): Deleted.
(JSC::CodeBlock::stringSwitchJumpTable): Deleted.

• bytecode/CodeBlockInlines.h:

(JSC::CodeBlock::forEachValueProfile):
(JSC::CodeBlock::jitCodeMap):
(JSC::CodeBlock::baselineSwitchJumpTable):
(JSC::CodeBlock::baselineStringSwitchJumpTable):
(JSC::CodeBlock::dfgSwitchJumpTable):
(JSC::CodeBlock::dfgStringSwitchJumpTable):

• bytecode/ExecutableToCodeBlockEdge.h:
• bytecode/ExecutionCounter.cpp:

(JSC::ExecutionCounter<countingVariant>::setThreshold):

• bytecode/ExecutionCounter.h:

(JSC::ExecutionCounter::clippedThreshold):

• bytecode/GetByIdMetadata.h:

(JSC::GetByIdModeMetadataArrayLength::offsetOfArrayProfile):
(JSC::GetByIdModeMetadata::offsetOfMode):

• bytecode/GetByStatus.cpp:

(JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):

• bytecode/GetterSetterAccessCase.cpp:

(JSC::GetterSetterAccessCase::emitDOMJITGetter):

• bytecode/InByStatus.cpp:

(JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):

• bytecode/InlineAccess.cpp:

(JSC::InlineAccess::generateSelfPropertyAccess):
(JSC::InlineAccess::canGenerateSelfPropertyReplace):
(JSC::InlineAccess::generateSelfPropertyReplace):
(JSC::InlineAccess::isCacheableArrayLength):
(JSC::InlineAccess::generateArrayLength):
(JSC::InlineAccess::isCacheableStringLength):
(JSC::InlineAccess::generateStringLength):
(JSC::InlineAccess::generateSelfInAccess):
(JSC::InlineAccess::rewireStubAsJumpInAccess):
(JSC::InlineAccess::resetStubAsJumpInAccess):

• bytecode/InlineAccess.h:
• bytecode/IterationModeMetadata.h:

(JSC::IterationModeMetadata::offsetOfSeenModes):

• bytecode/LLIntCallLinkInfo.h:

(JSC::LLIntCallLinkInfo::offsetOfArrayProfile):

• bytecode/Opcode.h:
• bytecode/PolymorphicAccess.cpp:

(JSC::AccessGenerationState::succeed):
(JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
(JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions):
(JSC::PolymorphicAccess::regenerate):

• bytecode/PolymorphicAccess.h:

(JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): Deleted.

• bytecode/PutByStatus.cpp:

(JSC::PutByStatus::computeForStubInfo):

• bytecode/StructureStubInfo.cpp:

(JSC::StructureStubInfo::initGetByIdSelf):
(JSC::StructureStubInfo::initPutByIdReplace):
(JSC::StructureStubInfo::initInByIdSelf):
(JSC::StructureStubInfo::addAccessCase):
(JSC::StructureStubInfo::reset):
(JSC::StructureStubInfo::visitWeakReferences):
(JSC::StructureStubInfo::propagateTransitions):
(JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):

• bytecode/StructureStubInfo.h:

(JSC::StructureStubInfo::offsetOfByIdSelfOffset):
(JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure):
(JSC::StructureStubInfo::inlineAccessBaseStructure):
(JSC::StructureStubInfo::offsetOfDoneLocation):

• bytecode/SuperSampler.cpp:

(JSC::printSuperSamplerState):

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
(JSC::UnlinkedCodeBlock::hasIdentifier):
(JSC::UnlinkedCodeBlock::thresholdForJIT):
(JSC::UnlinkedCodeBlock::allocateSharedProfiles):

• bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedCodeBlock::constantRegister):
(JSC::UnlinkedCodeBlock::instructionAt const):
(JSC::UnlinkedCodeBlock::bytecodeOffset):
(JSC::UnlinkedCodeBlock::instructionsSize const):
(JSC::UnlinkedCodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
(JSC::UnlinkedCodeBlock::outOfLineJumpOffset):
(JSC::UnlinkedCodeBlock::binaryArithProfile):
(JSC::UnlinkedCodeBlock::unaryArithProfile):
(JSC::UnlinkedCodeBlock::llintExecuteCounter):

• bytecode/UnlinkedMetadataTable.h:

(JSC::UnlinkedMetadataTable::offsetInMetadataTable):

• bytecode/ValueProfile.h:

(JSC::ValueProfileBase::ValueProfileBase):
(JSC::ValueProfileBase::clearBuckets):
(JSC::ValueProfile::offsetOfFirstBucket):

• dfg/DFGCommonData.h:
• dfg/DFGJITCode.cpp:
• dfg/DFGJITCode.h:
• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::link):

• dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareOSREntry):

• dfg/DFGOSRExit.cpp:

(JSC::DFG::OSRExit::compileExit):

• dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::handleExitCounts):
(JSC::DFG::callerReturnPC):
(JSC::DFG::reifyInlinedCallFrames):
(JSC::DFG::adjustAndJumpToTarget):

• dfg/DFGOperations.cpp:

(JSC::DFG::JSC_DEFINE_JIT_OPERATION):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePutPrivateName):
(JSC::DFG::SpeculativeJIT::compileValueAdd):
(JSC::DFG::SpeculativeJIT::compileValueSub):
(JSC::DFG::SpeculativeJIT::compileValueNegate):
(JSC::DFG::SpeculativeJIT::compileValueMul):
(JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

• ftl/FTLCompile.cpp:

(JSC::FTL::compile):

• ftl/FTLJITCode.h:
• ftl/FTLLink.cpp:

(JSC::FTL::link):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::addMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

• ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

• generator/Metadata.rb:
• jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::storeProperty):
(JSC::AssemblyHelpers::emitVirtualCall):
(JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject):

• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBuffer):

• jit/BaselineJITCode.cpp: Added.

(JSC::MathICHolder::addJITAddIC):
(JSC::MathICHolder::addJITMulIC):
(JSC::MathICHolder::addJITSubIC):
(JSC::MathICHolder::addJITNegIC):
(JSC::MathICHolder::adoptMathICs):
(JSC::BaselineJITCode::BaselineJITCode):
(JSC::BaselineJITCode::~BaselineJITCode):

• jit/BaselineJITCode.h: Added.

(JSC::JITConstantPool::add):
(JSC::JITConstantPool::size const):
(JSC::JITConstantPool::at const):

• jit/BaselineJITPlan.cpp:

(JSC::BaselineJITPlan::finalize):

• jit/CCallHelpers.cpp:

(JSC::CCallHelpers::logShadowChickenTailPacketImpl):
(JSC::CCallHelpers::logShadowChickenTailPacket):

• jit/CCallHelpers.h:
• jit/CallFrameShuffleData.cpp:

(JSC::CallFrameShuffleData::setupCalleeSaveRegisters):

• jit/CallFrameShuffleData.h:
• jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::CallFrameShuffler):
(JSC::CallFrameShuffler::prepareForTailCall):

• jit/CallFrameShuffler.h:

(JSC::CallFrameShuffler::snapshot const):

• jit/JIT.cpp:

(JSC::JIT::JIT):
(JSC::JIT::emitEnterOptimizationCheck):
(JSC::JIT::emitNotifyWriteWatchpoint):
(JSC::JIT::emitVarReadOnlyCheck):
(JSC::JIT::assertStackPointerOffset):
(JSC::JIT::resetSP):
(JSC::JIT::emitPutCodeBlockToFrameInPrologue):
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
(JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters):
(JSC::JIT::emitRestoreCalleeSaves):
(JSC::JIT::compileAndLinkWithoutFinalizing):
(JSC::JIT::link):
(JSC::JIT::finalizeOnMainThread):
(JSC::JIT::privateCompile):
(JSC::JIT::frameRegisterCountFor):
(JSC::JIT::stackPointerOffsetFor):

• jit/JIT.h:
• jit/JITArithmetic.cpp:

(JSC::JIT::emit_compareAndJumpSlowImpl):
(JSC::JIT::emit_compareAndJumpSlow):
(JSC::JIT::emit_op_negate):
(JSC::JIT::emit_op_add):
(JSC::JIT::emitMathICFast):
(JSC::JIT::emitMathICSlow):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emit_op_sub):

• jit/JITCall.cpp:

(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEval):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileTailCall):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):

• jit/JITCall32_64.cpp:

(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEval):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):

• jit/JITCode.h:

(JSC::JITCode::useDataIC):
(JSC::JITCode::pcToCodeOriginMap):

• jit/JITCompilationKey.cpp:

(JSC::JITCompilationKey::dump const):

• jit/JITCompilationKey.h:

(JSC::JITCompilationKey::JITCompilationKey):
(JSC::JITCompilationKey::operator! const):
(JSC::JITCompilationKey::isHashTableDeletedValue const):
(JSC::JITCompilationKey::operator== const):
(JSC::JITCompilationKey::hash const):
(JSC::JITCompilationKey::profiledBlock const): Deleted.

• jit/JITInlineCacheGenerator.cpp:

(JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
(JSC::JITInlineCacheGenerator::finalize):
(JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath):
(JSC::JITGetByIdGenerator::JITGetByIdGenerator):
(JSC::generateGetByIdInlineAccess):
(JSC::JITGetByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath):
(JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITDelByValGenerator::generateFastPath):
(JSC::JITDelByIdGenerator::generateFastPath):
(JSC::JITInByValGenerator::generateFastPath):
(JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITInstanceOfGenerator::generateFastPath):
(JSC::JITGetByValGenerator::generateFastPath):
(JSC::JITPutByValGenerator::generateFastPath):
(JSC::JITPrivateBrandAccessGenerator::generateFastPath):

• jit/JITInlineCacheGenerator.h:
• jit/JITInlines.h:

(JSC::JIT::isOperandConstantDouble):
(JSC::JIT::isOperandConstantInt):
(JSC::JIT::isKnownCell):
(JSC::JIT::getConstantOperand):
(JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
(JSC::JIT::linkSlowCaseIfNotJSCell):
(JSC::JIT::advanceToNextCheckpoint):
(JSC::JIT::emitJumpSlowToHotForCheckpoint):
(JSC::JIT::isOperandConstantChar):
(JSC::JIT::emitValueProfilingSite):
(JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
(JSC::JIT::emitArrayProfilingSiteWithCell):
(JSC::JIT::emitLoadDouble):
(JSC::JIT::emitJumpSlowCaseIfNotJSCell):
(JSC::JIT::emitGetVirtualRegister):
(JSC::JIT::jumpTarget):
(JSC::JIT::loadPtrFromMetadata):
(JSC::JIT::load32FromMetadata):
(JSC::JIT::load8FromMetadata):
(JSC::JIT::store8ToMetadata):
(JSC::JIT::store32ToMetadata):
(JSC::JIT::materializePointerIntoMetadata):
(JSC::JIT::loadConstant):
(JSC::JIT::loadGlobalObject):
(JSC::JIT::loadCodeBlockConstant):
(JSC::JIT::copiedGetPutInfo): Deleted.
(JSC::JIT::copiedArithProfile): Deleted.

• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_mov):
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emit_op_typeof_is_undefined):
(JSC::JIT::op_ret_handlerGenerator):
(JSC::JIT::emit_op_to_primitive):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::valueIsFalseyGenerator):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jeq_ptr):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::valueIsTruthyGenerator):
(JSC::JIT::emit_op_throw):
(JSC::JIT::op_throw_handlerGenerator):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_numeric):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_debug):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_enter):
(JSC::JIT::op_enter_handlerGenerator):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emitSlow_op_jeq):
(JSC::JIT::emitSlow_op_jneq):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_loop_hint):
(JSC::JIT::emitSlow_op_check_traps):
(JSC::JIT::op_check_traps_handlerGenerator):
(JSC::JIT::emit_op_new_regexp):
(JSC::JIT::emitNewFuncCommon):
(JSC::JIT::emitNewFuncExprCommon):
(JSC::JIT::emit_op_new_array):
(JSC::JIT::emit_op_new_array_with_size):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_tail):
(JSC::JIT::emit_op_profile_control_flow):
(JSC::JIT::emit_op_get_argument):
(JSC::JIT::emit_op_get_prototype_of):

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_typeof_is_undefined):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::compileOpEqJumpSlow):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_throw):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_numeric):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_enter):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_tail):

• jit/JITOperations.cpp:

(JSC::JSC_DEFINE_JIT_OPERATION):

• jit/JITOperations.h:
• jit/JITPlan.cpp:

(JSC::JITPlan::key):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::generateGetByValSlowCase):
(JSC::JIT::slow_op_get_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::slow_op_get_private_name_prepareCallGenerator):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emitSlow_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emitSlow_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::slow_op_del_by_id_prepareCallGenerator):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::slow_op_del_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::slow_op_get_by_id_prepareCallGenerator):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::slow_op_put_by_id_prepareCallGenerator):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitSlow_op_has_private_name):
(JSC::JIT::emitSlow_op_has_private_brand):
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emitResolveClosure):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::generateOpResolveScopeThunk):
(JSC::JIT::slow_op_resolve_scopeGenerator):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::generateOpGetFromScopeThunk):
(JSC::JIT::slow_op_get_from_scopeGenerator):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::slow_op_put_to_scopeGenerator):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_get_internal_field):
(JSC::JIT::emit_op_enumerator_next):
(JSC::JIT::emit_op_enumerator_get_by_val):
(JSC::JIT::emit_enumerator_has_propertyImpl):
(JSC::JIT::emitWriteBarrier):
(JSC::JIT::emitPutGlobalVariable): Deleted.
(JSC::JIT::emitPutGlobalVariableIndirect): Deleted.
(JSC::JIT::emitPutClosureVar): Deleted.

• jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emitSlow_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emitSlow_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_get_internal_field):

• jit/Repatch.cpp:

(JSC::tryCacheGetBy):
(JSC::tryCachePutBy):
(JSC::tryCacheInBy):
(JSC::unlinkCall):

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::jitCompileAndSetHeuristics):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/CacheableIdentifier.h:
• runtime/CacheableIdentifierInlines.h:

(JSC::CacheableIdentifier::createFromIdentifierOwnedByCodeBlock):

• runtime/CachedTypes.cpp:

(JSC::CachedCodeBlock::numBinaryArithProfiles const):
(JSC::CachedCodeBlock::numUnaryArithProfiles const):
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
(JSC::CachedCodeBlock<CodeBlockType>::encode):

• runtime/CommonSlowPaths.cpp:

(JSC::updateArithProfileForUnaryArithOp):

• runtime/FunctionExecutable.h:
• runtime/Options.cpp:

(JSC::Options::recomputeDependentOptions):

• runtime/OptionsList.h:
• runtime/ScriptExecutable.cpp:

(JSC::ScriptExecutable::prepareForExecutionImpl):

• wasm/WasmLLIntTierUpCounter.h:

(JSC::Wasm::LLIntTierUpCounter::optimizeAfterWarmUp):
(JSC::Wasm::LLIntTierUpCounter::optimizeSoon):

• wasm/WasmTierUpCount.cpp:

(JSC::Wasm::TierUpCount::TierUpCount):

• wasm/WasmTierUpCount.h:

(JSC::Wasm::TierUpCount::optimizeAfterWarmUp):
(JSC::Wasm::TierUpCount::optimizeNextInvocation):
(JSC::Wasm::TierUpCount::optimizeSoon):

Source/WTF:

• wtf/Bag.h:
• wtf/Packed.h:

(WTF::PackedAlignedPtr::operator* const):

Tools:

• Scripts/run-jsc-stress-tests:

12:48 AM Changeset in webkit [283101] by ysuzuki@apple.com

• 4 edits in trunk/Source/JavaScriptCore

[JSC] Use op_jeq_ptr for empty JSPropertyNameEnumerator check
​https://bugs.webkit.org/show_bug.cgi?id=230817

Reviewed by Saam Barati.

We use op_jeq_ptr for empty JSPropertyNameEnumerator check instead of stricteq for smaller
bytecode size and efficient branching in LLInt and Baseline. In DFG and FTL, both will get
the same nodes.

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitJumpIfEmptyPropertyNameEnumerator):

• bytecompiler/BytecodeGenerator.h:
• bytecompiler/NodesCodegen.cpp:

(JSC::ForInNode::emitBytecode):

12:08 AM Changeset in webkit [283100] by Martin Robinson

• 6 edits
  2 adds in trunk

Mandatory scroll snapping doesn't work correctly in tables with position:sticky
​https://bugs.webkit.org/show_bug.cgi?id=227300
<rdar://problem/79971196>

Reviewed by Simon Fraser.

Source/WebCore:

Add a mode for mapLocalToContainer which ignores sticky offsets. This will be
used by more code in the future.

Test: css3/scroll-snap/scroll-snap-drag-scrollbar-thumb-with-sticky.html

• page/scrolling/ScrollSnapOffsetsInfo.cpp:

(WebCore::updateSnapOffsetsForScrollableArea): Pass the IgnoreStickyOffsets flag.

• rendering/RenderBox.cpp:

(WebCore::RenderBox::mapLocalToContainer const): When the IgnoreStickyOffsets flag is
passed, explicitly remove sticky offsets from the container offset.

• rendering/RenderObjectEnums.h: Add the IgnoreStickyOffests flag.

LayoutTests:

Add a test which exercises the original bug.

• css3/scroll-snap/scroll-snap-drag-scrollbar-thumb-with-sticky-expected.txt: Added.
• css3/scroll-snap/scroll-snap-drag-scrollbar-thumb-with-sticky.html: Added.
• platform/ios/TestExpectations: Skip this test on iOS, which doesn't support thumb dragging.

Sep 26, 2021:

11:47 PM Changeset in webkit [283099] by Cameron McCormack

• 9 edits
  114 deletes in trunk/LayoutTests

Remove old test files from canvas WPTs that were moved
​https://bugs.webkit.org/show_bug.cgi?id=230811
<rdar://problem/83554404>

Reviewed by Tim Horton.

LayoutTests/imported/w3c:

A bunch of canvas test moved directories in
​https://github.com/web-platform-tests/wpt/pull/23996. When we re-
imported canvas WPTs in bug 229750, these old files were left behind.
We can remove them since they all now live under
html/canvas/element/manual/.

• web-platform-tests/html/canvas/element/building-paths/canvas_complexshapes_arcto_001.htm: Removed.
• web-platform-tests/html/canvas/element/building-paths/canvas_complexshapes_beziercurveto_001.htm: Removed.
• web-platform-tests/html/canvas/element/context-attributes/getContextAttributes-expected.txt: Removed.
• web-platform-tests/html/canvas/element/context-attributes/getContextAttributes.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-bitmap-orientation-none.tentative-expected.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-bitmap-orientation-none.tentative.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-bitmap-swap-width-height-orientation-none.tentative-expected.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-bitmap-swap-width-height-orientation-none.tentative.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-bitmap-swap-width-height.tentative-expected.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-bitmap-swap-width-height.tentative.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-bitmap.tentative-expected.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-bitmap.tentative.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-blob.tentative-expected.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-blob.tentative.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-element-orientation-none.tentative-expected.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-element-orientation-none.tentative.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-element-swap-width-height-orientation-none.tentative-expected.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-element-swap-width-height-orientation-none.tentative.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-element-swap-width-height.tentative-expected.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-element-swap-width-height.tentative.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-element.tentative-expected.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-element.tentative.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-with-src-rect.tentative-expected.html: Removed.
• web-platform-tests/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-with-src-rect.tentative.html: Removed.
• web-platform-tests/html/canvas/element/drawing-paths-to-the-canvas/canvas_complexshapes_ispointInpath_001.htm: Removed.
• web-platform-tests/html/canvas/element/drawing-paths-to-the-canvas/drawFocusIfNeeded_001-expected.txt: Removed.
• web-platform-tests/html/canvas/element/drawing-paths-to-the-canvas/drawFocusIfNeeded_001.html: Removed.
• web-platform-tests/html/canvas/element/drawing-paths-to-the-canvas/drawFocusIfNeeded_002-expected.txt: Removed.
• web-platform-tests/html/canvas/element/drawing-paths-to-the-canvas/drawFocusIfNeeded_002.html: Removed.
• web-platform-tests/html/canvas/element/drawing-paths-to-the-canvas/drawFocusIfNeeded_003-expected.txt: Removed.
• web-platform-tests/html/canvas/element/drawing-paths-to-the-canvas/drawFocusIfNeeded_003.html: Removed.
• web-platform-tests/html/canvas/element/drawing-paths-to-the-canvas/drawFocusIfNeeded_004-expected.txt: Removed.
• web-platform-tests/html/canvas/element/drawing-paths-to-the-canvas/drawFocusIfNeeded_004.html: Removed.
• web-platform-tests/html/canvas/element/drawing-paths-to-the-canvas/drawFocusIfNeeded_005-expected.txt: Removed.
• web-platform-tests/html/canvas/element/drawing-paths-to-the-canvas/drawFocusIfNeeded_005.html: Removed.
• web-platform-tests/html/canvas/element/image-smoothing/imagesmoothing-expected.txt: Removed.
• web-platform-tests/html/canvas/element/image-smoothing/imagesmoothing.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/canvas-createImageBitmap-resize-expected.txt: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/canvas-createImageBitmap-resize.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/canvas-createImageBitmap-video-resize-expected.txt: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/canvas-createImageBitmap-video-resize.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/common.sub.js: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-blob-invalidtype-expected.txt: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-blob-invalidtype.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-bounds-expected.txt: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-bounds.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-drawImage-closed-expected.txt: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-drawImage-closed.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-drawImage-expected.txt: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-drawImage.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-flipY-expected.txt: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-flipY.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-in-worker-transfer-expected.txt: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-in-worker-transfer.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-invalid-args-expected.txt: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-invalid-args.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-origin.sub-expected.txt: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-origin.sub.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-serializable-expected.txt: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-serializable.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-sizeOverflow-expected.txt: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-sizeOverflow.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-transfer-expected.txt: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-transfer.html: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-worker.js: Removed.
• web-platform-tests/html/canvas/element/imagebitmap/transfer-worker.js: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-semitransparent-p3d65.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-semitransparent-rec2020.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-semitransparent-srgb.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-srgb-fullcolor.ogv: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-srgb-transparent.bmp: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-srgb-transparent.ico: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-srgb-transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-srgb-transparent.webp: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-srgb.bmp: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-srgb.gif: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-srgb.ico: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-srgb.jpg: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-srgb.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-srgb.svg: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/pattern-srgb.webp: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_AdobeRGB_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_AdobeRGB_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_DisplayP3_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_DisplayP3_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_ProPhoto_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_ProPhoto_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_Rec2020_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_Rec2020_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_interlaced_AdobeRGB_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_interlaced_AdobeRGB_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_interlaced_DisplayP3_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_interlaced_DisplayP3_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_interlaced_ProPhoto_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_interlaced_ProPhoto_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_interlaced_Rec2020_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_interlaced_Rec2020_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_interlaced_sRGB_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_interlaced_sRGB_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_sRGB_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_16bit_sRGB_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_8bit_AdobeRGB_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_8bit_AdobeRGB_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_8bit_DisplayP3_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_8bit_DisplayP3_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_8bit_ProPhoto_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_8bit_ProPhoto_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_8bit_Rec2020_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_8bit_Rec2020_transparent.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_8bit_sRGB_opaque.png: Removed.
• web-platform-tests/html/canvas/element/wide-gamut-canvas/resources/png-16bit/2x2_8bit_sRGB_transparent.png: Removed.

LayoutTests:

• TestExpectations:
• platform/glib/TestExpectations:
• platform/glib/imported/w3c/web-platform-tests/html/canvas/element/image-smoothing/imagesmoothing-expected.txt: Removed.
• platform/glib/imported/w3c/web-platform-tests/html/canvas/element/imagebitmap/canvas-createImageBitmap-resize-expected.txt: Removed.
• platform/glib/imported/w3c/web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-drawImage-expected.txt: Removed.
• platform/glib/imported/w3c/web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-flipY-expected.txt: Removed.
• platform/glib/imported/w3c/web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-invalid-args-expected.txt: Removed.
• platform/glib/imported/w3c/web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-serializable-expected.txt: Removed.
• platform/glib/imported/w3c/web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-transfer-expected.txt: Removed.
• platform/ios-14/TestExpectations:
• platform/ios-simulator-wk2/TestExpectations:
• platform/ios-wk2/TestExpectations:
• platform/ios/TestExpectations:
• platform/mac-wk1/imported/w3c/web-platform-tests/html/canvas/element/imagebitmap/createImageBitmap-flipY-expected.txt: Removed.
• platform/mac/TestExpectations:

10:02 PM Changeset in webkit [283098] by ysuzuki@apple.com

• 30 edits
  2 adds in trunk

[JSC] Optimize PutByVal with for-in
​https://bugs.webkit.org/show_bug.cgi?id=230801

Reviewed by Saam Barati.

JSTests:

• stress/for-in-sentinel.js: Added.

(shouldBe):
(test):

Source/JavaScriptCore:

We found that some of Speedometer2 subtests are heavily using for-in with PutByVal or the other DFG nodes.
And we also found that we are using polluted non-good type for the property names from for-in: String | Other.
The reason is that we are returning null when op_enumerator_next finishes instead of string. And this design
forces DFG and FTL to return null from EnumeratorNextUpdatePropertyName at the end of iteration. This pollutes
the type of property names as String | Other instead of String, and leading to suboptimal DFG nodes.

In this patch, we add special sentinel string in vm.smallString.sentinelString(). We know that this string cell
pointer will be never returned from EnumeratorNextUpdatePropertyName in the normal for-in iteration. This is easy
since we are always allocating a JSString when creating JSPropertyNameEnumerator. So this string cell (not the content)
is always different from pre-allocated vm.smallString.sentinelString(). So, we use this special string pointer
as a sentinel instead of null so that we can avoid polluting return type of EnumeratorNextUpdatePropertyName.

To check the sentinel in LLInt / Baseline, this patch adds jeq_ptr, which performs cell pointer comparison and do
not check string content equality. We do not need to have an implementation in DFG since we already have CompareEqPtr
for existing jneq_ptr bytecode.

We also clean up DFG operation related to PutByVal.

---

| subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) |

---

| Elm-TodoMVC |116.010000 |112.701667 |0.971482 | 0.000000 (significant) |
| VueJS-TodoMVC |22.995000 |23.023333 |1.001232 | 0.907086 |
| EmberJS-TodoMVC |125.498333 |125.525000 |1.000212 | 0.932546 |
| BackboneJS-TodoMVC |45.700000 |45.975000 |1.006018 | 0.084799 |
| Preact-TodoMVC |16.681667 |16.610000 |0.995704 | 0.722758 |
| AngularJS-TodoMVC |123.753333 |123.740000 |0.999892 | 0.971431 |
| Vanilla-ES2015-TodoMVC |61.255000 |61.380000 |1.002041 | 0.300654 |
| Inferno-TodoMVC |58.646667 |58.948333 |1.005144 | 0.267611 |
| Flight-TodoMVC |73.283333 |72.801667 |0.993427 | 0.207389 |
| Angular2-TypeScript-TodoMVC |39.746667 |40.015000 |1.006751 | 0.449821 |
| VanillaJS-TodoMVC |50.096667 |49.823333 |0.994544 | 0.162020 |
| jQuery-TodoMVC |212.870000 |213.196667 |1.001535 | 0.371944 |
| EmberJS-Debug-TodoMVC |331.878333 |332.710000 |1.002506 | 0.094499 |
| React-TodoMVC |83.078333 |82.726667 |0.995767 | 0.076143 |
| React-Redux-TodoMVC |136.018333 |133.935000 |0.984683 | 0.000000 (significant) |
| Vanilla-ES2015-Babel-Webpack-TodoMVC |59.743333 |59.643333 |0.998326 | 0.393671 |

---

a mean = 271.75873
b mean = 272.45804
pValue = 0.0263030803
(Bigger means are better.)
1.003 times better
Results ARE significant

• builtins/BuiltinNames.h:
• bytecode/BytecodeList.rb:
• bytecode/BytecodeUseDef.cpp:

(JSC::computeUsesForBytecodeIndexImpl):
(JSC::computeDefsForBytecodeIndexImpl):

• bytecode/LinkTimeConstant.h:
• bytecode/Opcode.h:

(JSC::isBranch):

• bytecode/PreciseJumpTargetsInlines.h:
• bytecompiler/BytecodeGenerator.cpp:

(JSC::GenericLabel<JSGeneratorTraits>::setLocation):
(JSC::BytecodeGenerator::emitJumpIfSentinelString):

• bytecompiler/BytecodeGenerator.h:
• bytecompiler/NodesCodegen.cpp:

(JSC::ForInNode::emitBytecode):

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

• dfg/DFGOperations.cpp:

(JSC::DFG::putByVal):
(JSC::DFG::putByValInternal):
(JSC::DFG::putByValCellInternal):
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):

• dfg/DFGOperations.h:
• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

• jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

• jit/JIT.h:
• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_jeq_ptr):

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_jeq_ptr):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_enumerator_next):

• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/CommonSlowPaths.cpp:

(JSC::JSC_DEFINE_COMMON_SLOW_PATH):

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

• runtime/SmallStrings.cpp:

(JSC::SmallStrings::initializeCommonStrings):
(JSC::SmallStrings::visitStrongReferences):

• runtime/SmallStrings.h:

(JSC::SmallStrings::sentinelString const):

9:40 PM Changeset in webkit [283097] by Jean-Yves Avenard

• 7 edits in trunk

[MSE] appending to the source buffer will not throw when the source buffer is full.
​https://bugs.webkit.org/show_bug.cgi?id=230672
rdar://problem/83496195

Reviewed by Eric Carlson.

Source/WebCore:

Tests: media/media-source/media-source-append-buffer-full-quota-exceeded-error.html

• platform/graphics/PlatformTimeRanges.cpp:

(WebCore::PlatformTimeRanges::findWithEpsilon): add method.
(WebCore::PlatformTimeRanges::copyWithEpsilon const): add method.

• platform/graphics/PlatformTimeRanges.h:
• platform/graphics/SourceBufferPrivate.cpp:

(WebCore::SourceBufferPrivate::evictCodedFrames):

LayoutTests:

• media/media-source/media-source-append-buffer-full-quota-exceeded-error-expected.txt:
• media/media-source/media-source-append-buffer-full-quota-exceeded-error.html:

9:37 PM WikiStart edited by Simon Fraser

(diff)

9:25 PM Changeset in webkit [283096] by commit-queue@webkit.org

• 28 edits
  1 delete in trunk

Unreviewed, reverting r283095.
​https://bugs.webkit.org/show_bug.cgi?id=230815

We should land the original patch since this does not work
with bytecode cache

Reverted changeset:

"[JSC] Optimize PutByVal with for-in"
​https://bugs.webkit.org/show_bug.cgi?id=230801
​https://commits.webkit.org/r283095

9:14 PM Changeset in webkit [283095] by ysuzuki@apple.com

• 28 edits
  1 add in trunk

[JSC] Optimize PutByVal with for-in
​https://bugs.webkit.org/show_bug.cgi?id=230801

Reviewed by Saam Barati.

JSTests:

• stress/for-in-sentinel.js: Added.

(shouldBe):
(test):

Source/JavaScriptCore:

We found that some of Speedometer2 subtests are heavily using for-in with PutByVal or the other DFG nodes.
And we also found that we are using polluted non-good type for the property names from for-in: String | Other.
The reason is that we are returning null when op_enumerator_next finishes instead of string. And this design
forces DFG and FTL to return null from EnumeratorNextUpdatePropertyName at the end of iteration. This pollutes
the type of property names as String | Other instead of String, and leading to suboptimal DFG nodes.

In this patch, we add special sentinel string in vm.smallString.sentinelString(). We know that this string cell
pointer will be never returned from EnumeratorNextUpdatePropertyName in the normal for-in iteration. This is easy
since we are always allocating a JSString when creating JSPropertyNameEnumerator. So this string cell (not the content)
is always different from pre-allocated vm.smallString.sentinelString(). So, we use this special string pointer
as a sentinel instead of null so that we can avoid polluting return type of EnumeratorNextUpdatePropertyName.

To check the sentinel in LLInt / Baseline, this patch adds jeq_ptr, which performs cell pointer comparison and do
not check string content equality. We do not need to have an implementation in DFG since we already have CompareEqPtr
for existing jneq_ptr bytecode.

We also clean up DFG operation related to PutByVal.

---

| subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) |

---

| Elm-TodoMVC |116.010000 |112.701667 |0.971482 | 0.000000 (significant) |
| VueJS-TodoMVC |22.995000 |23.023333 |1.001232 | 0.907086 |
| EmberJS-TodoMVC |125.498333 |125.525000 |1.000212 | 0.932546 |
| BackboneJS-TodoMVC |45.700000 |45.975000 |1.006018 | 0.084799 |
| Preact-TodoMVC |16.681667 |16.610000 |0.995704 | 0.722758 |
| AngularJS-TodoMVC |123.753333 |123.740000 |0.999892 | 0.971431 |
| Vanilla-ES2015-TodoMVC |61.255000 |61.380000 |1.002041 | 0.300654 |
| Inferno-TodoMVC |58.646667 |58.948333 |1.005144 | 0.267611 |
| Flight-TodoMVC |73.283333 |72.801667 |0.993427 | 0.207389 |
| Angular2-TypeScript-TodoMVC |39.746667 |40.015000 |1.006751 | 0.449821 |
| VanillaJS-TodoMVC |50.096667 |49.823333 |0.994544 | 0.162020 |
| jQuery-TodoMVC |212.870000 |213.196667 |1.001535 | 0.371944 |
| EmberJS-Debug-TodoMVC |331.878333 |332.710000 |1.002506 | 0.094499 |
| React-TodoMVC |83.078333 |82.726667 |0.995767 | 0.076143 |
| React-Redux-TodoMVC |136.018333 |133.935000 |0.984683 | 0.000000 (significant) |
| Vanilla-ES2015-Babel-Webpack-TodoMVC |59.743333 |59.643333 |0.998326 | 0.393671 |

---

a mean = 271.75873
b mean = 272.45804
pValue = 0.0263030803
(Bigger means are better.)
1.003 times better
Results ARE significant

• builtins/BuiltinNames.h:
• bytecode/BytecodeList.rb:
• bytecode/BytecodeUseDef.cpp:

(JSC::computeUsesForBytecodeIndexImpl):
(JSC::computeDefsForBytecodeIndexImpl):

• bytecode/LinkTimeConstant.h:
• bytecode/Opcode.h:

(JSC::isBranch):

• bytecode/PreciseJumpTargetsInlines.h:
• bytecompiler/BytecodeGenerator.cpp:

(JSC::GenericLabel<JSGeneratorTraits>::setLocation):
(JSC::BytecodeGenerator::emitJumpIfSentinelString):

• bytecompiler/BytecodeGenerator.h:
• bytecompiler/NodesCodegen.cpp:

(JSC::ForInNode::emitBytecode):

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

• dfg/DFGOperations.cpp:

(JSC::DFG::putByVal):
(JSC::DFG::putByValInternal):
(JSC::DFG::putByValCellInternal):
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):

• dfg/DFGOperations.h:
• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

• jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

• jit/JIT.h:
• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_jeq_ptr):

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_jeq_ptr):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_enumerator_next):

• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/CommonSlowPaths.cpp:

(JSC::JSC_DEFINE_COMMON_SLOW_PATH):

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

• runtime/SmallStrings.cpp:

(JSC::SmallStrings::initializeCommonStrings):
(JSC::SmallStrings::visitStrongReferences):

• runtime/SmallStrings.h:

(JSC::SmallStrings::sentinelString const):

8:01 PM Changeset in webkit [283094] by Lauro Moura

• 36 edits in trunk/LayoutTests

[WPE] Rebaseline a number of text-only failures

Unreviewed test gardening.

Most are 1-pixel differences after some recent LFC-related commits.

• platform/glib/fast/css/getComputedStyle/computed-style-font-family-expected.txt:
• platform/glib/fast/encoding/charset-replacement-expected.txt:
• platform/wpe/TestExpectations:
• platform/wpe/css2.1/t0805-c5518-brdr-t-01-e-expected.txt:
• platform/wpe/css2.1/t0805-c5519-brdr-r-00-a-expected.txt:
• platform/wpe/css2.1/t0805-c5519-brdr-r-01-e-expected.txt:
• platform/wpe/css2.1/t0805-c5520-brdr-b-01-e-expected.txt:
• platform/wpe/css2.1/t0805-c5521-brdr-l-00-a-expected.txt:
• platform/wpe/css2.1/t0805-c5521-brdr-l-01-e-expected.txt:
• platform/wpe/css2.1/t0905-c414-flt-02-c-expected.txt:
• platform/wpe/css2.1/t0905-c414-flt-03-c-expected.txt:
• platform/wpe/css2.1/t0905-c414-flt-04-c-expected.txt:
• platform/wpe/css2.1/t0905-c414-flt-fit-01-d-g-expected.txt:
• platform/wpe/css2.1/t0905-c5525-fltblck-00-d-ag-expected.txt:
• platform/wpe/css2.1/t0905-c5525-fltblck-01-d-expected.txt:
• platform/wpe/css2.1/t0905-c5525-fltcont-00-d-g-expected.txt:
• platform/wpe/css2.1/t0905-c5525-flthw-00-c-g-expected.txt:
• platform/wpe/css2.1/t0905-c5525-fltwidth-00-c-g-expected.txt:
• platform/wpe/css2.1/t0905-c5525-fltwidth-02-c-g-expected.txt:
• platform/wpe/css2.1/t0905-c5525-fltwidth-03-c-g-expected.txt:
• platform/wpe/css2.1/t0905-c5525-fltwrap-00-b-expected.txt:
• platform/wpe/css2.1/t0905-c5526-flthw-00-c-g-expected.txt:
• platform/wpe/css2.1/t090501-c414-flt-01-b-expected.txt:
• platform/wpe/css2.1/t100304-c43-rpl-bbx-01-d-g-expected.txt:
• platform/wpe/css2.1/t1202-counter-04-b-expected.txt:
• platform/wpe/css2.1/t1202-counter-09-b-expected.txt:
• platform/wpe/css2.1/t1202-counters-04-b-expected.txt:
• platform/wpe/css2.1/t1202-counters-09-b-expected.txt:
• platform/wpe/fast/attachment/attachment-select-on-click-expected.txt:
• platform/wpe/fast/attachment/attachment-select-on-click-inside-user-select-all-expected.txt:
• platform/wpe/fast/borders/rtl-border-05-expected.txt:
• platform/wpe/fast/css/font-face-implicit-local-font-expected.txt:
• platform/wpe/fast/css/font-face-locally-installed-expected.txt:
• platform/wpe/fast/css/font-face-opentype-expected.txt:
• platform/wpe/fast/css/font-face-unicode-range-expected.txt:

7:46 PM Changeset in webkit [283093] by Cameron McCormack

• 1 edit
  2 deletes in trunk/LayoutTests/imported/w3c

Remove canvas HitRegions tests
​https://bugs.webkit.org/show_bug.cgi?id=230809
<rdar://problem/83553485>

Reviewed by Alan Bujtas.

These were removed upstream in
​https://github.com/web-platform-tests/wpt/pull/30850.

• web-platform-tests/html/canvas/element/hit-regions/addHitRegions-NotSupportedError-01-expected.txt: Removed.
• web-platform-tests/html/canvas/element/hit-regions/addHitRegions-NotSupportedError-01.html: Removed.
• web-platform-tests/html/canvas/element/hit-regions/hitregions-members-exist-expected.txt: Removed.
• web-platform-tests/html/canvas/element/hit-regions/hitregions-members-exist.html: Removed.
• web-platform-tests/html/canvas/element/hit-regions/w3c-import.log: Removed.
• web-platform-tests/html/canvas/element/manual/hit-regions/addHitRegions-NotSupportedError-01-expected.txt: Removed.
• web-platform-tests/html/canvas/element/manual/hit-regions/addHitRegions-NotSupportedError-01.html: Removed.
• web-platform-tests/html/canvas/element/manual/hit-regions/hitregions-members-exist-expected.txt: Removed.
• web-platform-tests/html/canvas/element/manual/hit-regions/hitregions-members-exist.html: Removed.
• web-platform-tests/html/canvas/element/manual/hit-regions/w3c-import.log: Removed.

6:28 PM Changeset in webkit [283092] by Lauro Moura

• 1 edit
  16 adds in trunk/LayoutTests

[GLIB] Update baselines after 242013@main

Unreviewed test gardening.

These tests were updated to use the application bundle ID, which is
not used by the GLIB ports.

• platform/glib/http/tests/contentextensions/block-private-click-measurement-expected.txt: Added.
• platform/glib/http/tests/privateClickMeasurement/attribution-conversion-through-cross-site-image-redirect-expected.txt: Added.
• platform/glib/http/tests/privateClickMeasurement/attribution-conversion-through-fetch-keepalive-expected.txt: Added.
• platform/glib/http/tests/privateClickMeasurement/attribution-conversion-through-image-redirect-ephemeral-expected.txt: Added.
• platform/glib/http/tests/privateClickMeasurement/attribution-conversion-through-image-redirect-with-priority-expected.txt: Added.
• platform/glib/http/tests/privateClickMeasurement/attribution-conversion-through-image-redirect-without-priority-expected.txt: Added.
• platform/glib/http/tests/privateClickMeasurement/conversion-disabled-in-ephemeral-session-expected.txt: Added.
• platform/glib/http/tests/privateClickMeasurement/private-click-measurement-with-source-nonce-null-content-expected.txt: Added.
• platform/glib/http/tests/privateClickMeasurement/private-click-measurement-with-source-nonce-wrong-content-type-expected.txt: Added.
• platform/glib/http/tests/privateClickMeasurement/second-attribution-converted-with-higher-priority-expected.txt: Added.
• platform/glib/http/tests/privateClickMeasurement/second-attribution-converted-with-lower-priority-expected.txt: Added.
• platform/glib/http/tests/privateClickMeasurement/second-conversion-with-higher-priority-expected.txt: Added.
• platform/glib/http/tests/privateClickMeasurement/second-conversion-with-lower-priority-expected.txt: Added.
• platform/glib/http/tests/privateClickMeasurement/store-private-click-measurement-expected.txt: Added.

2:38 PM Changeset in webkit [283091] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina Debug wk1 EWS ] media/modern-media-controls/media-controls/media-controls-placard-compressed-metrics.html is a flay crash.
​https://bugs.webkit.org/show_bug.cgi?id=230808.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

2:23 PM Changeset in webkit [283090] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina Debug wk1 EWS ] Media tests flakily crashing.
​https://bugs.webkit.org/show_bug.cgi?id=230807.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

2:20 PM Changeset in webkit [283089] by commit-queue@webkit.org

• 104 edits
  2 deletes in trunk

Unreviewed, reverting r283083 and r283088.
​https://bugs.webkit.org/show_bug.cgi?id=230806

Windows pors are crashing

Reverted changesets:

"Build an unlinked baseline JIT"
​https://bugs.webkit.org/show_bug.cgi?id=229223
​https://commits.webkit.org/r283083

"Make byte codes with arithmetic profiles switch to using an
index instead of a pointer in metadata"
​https://bugs.webkit.org/show_bug.cgi?id=230798
​https://commits.webkit.org/r283088

10:23 AM Changeset in webkit [283088] by sbarati@apple.com

• 15 edits in trunk/Source/JavaScriptCore

Make byte codes with arithmetic profiles switch to using an index instead of a pointer in metadata
​https://bugs.webkit.org/show_bug.cgi?id=230798

Reviewed by Yusuke Suzuki.

This patch makes each bytecode that uses a BinaryArithProfile/UnaryArithProfile
have an index into a table instead of storing a pointer to the profile in its metadata.
Then, we can just load the profile using the index in the bytecode, which saves memory.

• bytecode/BytecodeList.rb:
• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::binaryArithProfileForPC):
(JSC::CodeBlock::unaryArithProfileForPC):

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::allocateSharedProfiles):

• bytecode/UnlinkedCodeBlock.h:
• bytecode/UnlinkedCodeBlockGenerator.cpp:

(JSC::UnlinkedCodeBlockGenerator::finalize):

• bytecode/UnlinkedCodeBlockGenerator.h:

(JSC::UnlinkedCodeBlockGenerator::addBinaryArithProfile):
(JSC::UnlinkedCodeBlockGenerator::addUnaryArithProfile):

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitUnaryOp):
(JSC::BytecodeGenerator::emitInc):
(JSC::BytecodeGenerator::emitDec):

• bytecompiler/BytecodeGenerator.h:
• jit/JITArithmetic.cpp:

(JSC::JIT::emit_op_negate):
(JSC::JIT::emit_op_add):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emit_op_sub):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/CommonSlowPaths.cpp:

(JSC::updateArithProfileForUnaryArithOp):
(JSC::JSC_DEFINE_COMMON_SLOW_PATH):

6:47 AM Changeset in webkit [283087] by Antti Koivisto

• 3 edits
  2 adds in trunk

Line iterator firstRun/lastRun may return runs from wrong lines
​https://bugs.webkit.org/show_bug.cgi?id=230770
<rdar://problem/83509753>

Reviewed by Alan Bujtas.

Source/WebCore:

In some situation line iterator firstRun/lastRun could return runs from different lines.
This could lead to inconsistencies like firstRun being non-null while lastRun is null.

Test: editing/iterator-line-start-end.html

• layout/integration/LayoutIntegrationLineIteratorModernPath.h:

(WebCore::LayoutIntegration::LineIteratorModernPath::firstRun const):
(WebCore::LayoutIntegration::LineIteratorModernPath::lastRun const):

Take care to only return runs from this line.

LayoutTests:

• editing/iterator-line-start-end-expected.txt: Added.
• editing/iterator-line-start-end.html: Added.