Timeline

Sep 28, 2021:

11:32 PM Changeset in webkit [283212] by BJ Burg

• 5 edits
  1 add in trunk/Source/WebInspectorUI

Web Inspector: add settings option for 'Show Mock Web Extension Tab' in engineering builds
​https://bugs.webkit.org/show_bug.cgi?id=230923

Reviewed by Devin Rousso.

This is an engineering-only facility to quickly check the behavior of
WebInspectorExtensionTabContentView (aka Web Extension Tabs). The behavior
of these tabs differs from other tabs, so it is important to make this easy to verify.

• UserInterface/Base/Setting.js: Add new setting.
• UserInterface/Debug/Bootstrap.js:

(updateMockWebExtensionTab):
(WI.runBootstrapOperations):
Call the InspectorFrontendAPI commands that would be called by WebInspectorUIExtensionController
to register an extension and create a tab for it.

• UserInterface/Debug/MockWebExtensionTab.html: Added.

This is adapted from InspectorExtension-basic-tab.html as used in TestWebKitAPI.

• UserInterface/Protocol/InspectorFrontendAPI.js: Fix a typo in the headerdoc

for createTabForExtension.

• UserInterface/Views/SettingsTabContentView.js:

(WI.SettingsTabContentView.prototype._createEngineeringSettingsView):

11:23 PM Changeset in webkit [283211] by ysuzuki@apple.com

• 2 edits in trunk/Source/WTF

iOS simulator build should use PTHREAD_JIT_PERMISSIONS_API
​https://bugs.webkit.org/show_bug.cgi?id=230920
rdar://77494871

Reviewed by Filip Pizlo.

In AppleSilicon macOS, we should use PTHREAD_JIT_PERMISSIONS_API for OSS build.
However, we are not enabling that for iOS simulator build. This patch enables that.
This API exists after iOS 14.0 SDK.

• wtf/PlatformUse.h:

9:52 PM Changeset in webkit [283210] by mmaxfield@apple.com

• 18 edits in trunk/Source/WebCore

Factor out rare members of FontCreationContext into FontCreationContextRareData
​https://bugs.webkit.org/show_bug.cgi?id=230800
<rdar://problem/83538227>

Reviewed by Alan Bujtas.

FontCreationContext is used inside HashMap keys in font caches, so we want the type to be
small. Palettes and font features are rare, so we can move those into a heap-allocated
rare data object, thereby decreasing the size of FontCreationContext for most fonts.
Importantly, if palettes and font features aren't used, the RefPtr will just be null, and
no allocation is performed.

No new tests because there is no behavior change.

• css/CSSFontFace.h:
• css/CSSFontFaceSource.h:
• css/CSSSegmentedFontFace.h:
• loader/FontLoadRequest.h:
• loader/cache/CachedFont.h:
• loader/cache/CachedFontLoadRequest.h:
• loader/cache/CachedSVGFont.h:
• platform/graphics/FontCreationContext.h:

(WebCore::FontCreationContextRareData::create):
(WebCore::FontCreationContextRareData::fontFaceFeatures const):
(WebCore::FontCreationContextRareData::fontPaletteValues const):
(WebCore::FontCreationContextRareData::operator== const):
(WebCore::FontCreationContextRareData::operator!= const):
(WebCore::FontCreationContextRareData::FontCreationContextRareData):
(WebCore::FontCreationContext::FontCreationContext):
(WebCore::FontCreationContext::fontFaceFeatures const):
(WebCore::FontCreationContext::fontFaceCapabilities const):
(WebCore::FontCreationContext::fontPaletteValues const):
(WebCore::FontCreationContext::operator== const):
(WebCore::add):

• platform/graphics/FontPaletteValues.h:

(WebCore::FontPaletteValues::operator bool const):

• platform/graphics/cocoa/FontCacheCoreText.cpp:

(WebCore::addAttributesForFontPalettes):
(WebCore::preparePlatformFont):

• platform/graphics/cocoa/FontCacheCoreText.h:
• platform/graphics/freetype/FontCacheFreeType.cpp:
• platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:
• platform/graphics/mac/FontCustomPlatformData.h:
• workers/WorkerFontLoadRequest.h:

8:52 PM Changeset in webkit [283209] by Simon Fraser

• 3 edits in trunk/Source/WebKit

Crash in WebKit::DisplayLink::displayLinkCallback()
​https://bugs.webkit.org/show_bug.cgi?id=230917
<rdar://82528370>

Reviewed by Tim Horton.

We have evidence of a divide-by-zero crash in DisplayLink::notifyObserversDisplayWasRefreshed()
where m_currentUpdate.updatesPerSecond is zero. The only way I can see this happening
is if DisplayLink::DisplayLink() returns early, which should log. Protect against
this by initializing m_displayNominalFramesPerSecond to 60, and do another check,
with a log, in DisplayLink::addObserver() before we use m_displayNominalFramesPerSecond
for the first time.

Convert the logging to RELEASE_LOG_FAULT reports.

• UIProcess/mac/DisplayLink.cpp:

(WebKit::DisplayLink::DisplayLink):
(WebKit::DisplayLink::addObserver):

• UIProcess/mac/DisplayLink.h:

8:16 PM Changeset in webkit [283208] by Takashi Komori

• 2 edits in trunk/Source/WebCore

[Curl] Set CURL_LOCK_DATA_SSL_SESSION option to reduce SSL/TLS handshake time
​https://bugs.webkit.org/show_bug.cgi?id=230818

Reviewed by Fujii Hironori.

Set CURL_LOCK_DATA_SSL_SESSION option to reuse Session ID.
It reduces SSL/TLS handshake time.

Covered by existing tests.

• platform/network/curl/CurlContext.cpp:

(WebCore::CurlShareHandle::CurlShareHandle):
(WebCore::CurlShareHandle::mutexFor):

6:45 PM BuildingCairoOnWindows edited by Fujii Hironori

(diff)

6:33 PM Changeset in webkit [283207] by sbarati@apple.com

• 9 edits
  1 add in trunk

DoesGCCheck does not use enough bits for nodeIndex
​https://bugs.webkit.org/show_bug.cgi?id=230915
<rdar://83297515>

Reviewed by Mark Lam.

JSTests:

• stress/verify-can-gc-node-index.js: Added.

(gen):
(f):

Source/JavaScriptCore:

• dfg/DFGDoesGCCheck.h:

(JSC::DFG::DoesGCCheck::DoesGCCheck):
(JSC::DFG::DoesGCCheck::encode):
(JSC::DFG::DoesGCCheck::set):
(JSC::DFG::DoesGCCheck::expectDoesGC const):
(JSC::DFG::DoesGCCheck::isSpecial const):
(JSC::DFG::DoesGCCheck::special):
(JSC::DFG::DoesGCCheck::nodeOp):
(JSC::DFG::DoesGCCheck::nodeIndex):

• dfg/DFGOSRExit.cpp:

(JSC::DFG::OSRExit::compileExit):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileLoopHint):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

• ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

6:31 PM Changeset in webkit [283206] by commit-queue@webkit.org

• 2 edits
  5 adds in trunk/LayoutTests

[GLIB] Update test expectations and baselines. Unreviewed test gardening.
​https://bugs.webkit.org/show_bug.cgi?id=230927

Patch by Arcady Goldmints-Orlov <Arcady Goldmints-Orlov> on 2021-09-28

• platform/glib/TestExpectations:
• platform/glib/imported/w3c/web-platform-tests/content-security-policy/media-src/media-src-7_1-expected.txt: Added.
• platform/glib/imported/w3c/web-platform-tests/content-security-policy/media-src/media-src-7_2-expected.txt: Added.
• platform/glib/imported/w3c/web-platform-tests/content-security-policy/media-src/media-src-7_3.sub-expected.txt: Added.
• platform/glib/imported/w3c/web-platform-tests/content-security-policy/media-src/media-src-redir-bug.sub-expected.txt: Added.

5:26 PM Changeset in webkit [283205] by Alan Coon

• 5 edits in branches/safari-612-branch/Source

Cherry-pick r283156. rdar://problem/83648190

Vorbis decoder can't be instantiated - Remove workaround added in bug 228139
​https://bugs.webkit.org/show_bug.cgi?id=230742
rdar://83484414

Reviewed by Eric Carlson.

Source/WebKit:

This is already covered by test; however this will fail on Monterey without the updated
CoreMedia framework.

• Scripts/process-entitlements.sh: Add new required entitlement.
• WebProcess/cocoa/WebProcessCocoa.mm: (WebKit::WebProcess::initializeSandbox): Only have bug workaround on BigSur and earlier.

Source/WTF:

• wtf/PlatformUse.h: Add USE_VORBIS_AUDIOCOMPONENT_WORKAROUND

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@283156 268f45cc-cd09-0410-ab3c-d52691b4dbfc

5:26 PM Changeset in webkit [283204] by Brent Fulgham

• 5 edits in trunk/Source/WebKit

Remove unused "com.apple.security.exception.file*" rules from WebKit sandboxes
​https://bugs.webkit.org/show_bug.cgi?id=230918
<rdar://problem/66585844>

Reviewed by Per Arne Vollan.

The Sandbox implementation provides a mechanism where apps can extend the default app
sandbox with entitled extension properties attached to their binary at signing time.
WebKit does not need or use this feature. However, the rules were imported to our custom
sandbox when we stopped using the system one. We should remove these rules since we don't
need them, and they add to the size and complexity of the sandbox rule set.

• Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
• Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebAuthn.sb:
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:

5:25 PM Changeset in webkit [283203] by Alan Coon

• 8 edits in branches/safari-612-branch/Source

Versioning.

WebKit-7612.2.10

4:16 PM Changeset in webkit [283202] by Alan Coon

• 1 copy in branches/safari-613.1.3-branch

New branch.

3:32 PM Changeset in webkit [283201] by Alan Coon

• 1 copy in tags/Safari-612.2.9

Tag Safari-612.2.9.

3:23 PM Changeset in webkit [283200] by Alan Coon

• 1 copy in tags/Safari-612.2.6.1.2

Tag Safari-612.2.6.1.2.

3:19 PM Changeset in webkit [283199] by Devin Rousso

• 9 edits
  4 moves in trunk/Source/WebCore

Move DrawGlyphsRecorder outside of DisplayList
​https://bugs.webkit.org/show_bug.cgi?id=230912

Reviewed by Myles Maxfield.

There's really nothing about DrawGlyphsRecorder that's specific to display lists other
than it's currently only being used by DisplayList::Recorder.

This patch moves DrawGlyphsRecorder outside of namespace DisplayList (and the related
folder in the source tree). The next patch (<​https://webkit.org/b/230913>) will generalize
it to allow any GraphicsContext instead of just DisplayList::Recorder. This is being
done to make <attachment> drawing work in the GPUProcess (<​https://webkit.org/b/230781>).

• platform/graphics/DrawGlyphsRecorder.h: Renamed from Source/WebCore/platform/graphics/displaylists/DisplayListDrawGlyphsRecorder.h.
• platform/graphics/coretext/DrawGlyphsRecorderCoreText.cpp: Renamed from Source/WebCore/platform/graphics/displaylists/DisplayListDrawGlyphsRecorderCoreText.cpp.
• platform/graphics/harfbuzz/DrawGlyphsRecorderHarfBuzz.cpp: Renamed from Source/WebCore/platform/graphics/displaylists/DisplayListDrawGlyphsRecorderHarfBuzz.cpp.
• platform/graphics/win/DrawGlyphsRecorderWin.cpp: Renamed from Source/WebCore/platform/graphics/displaylists/DisplayListDrawGlyphsRecorderWin.cpp.

• platform/graphics/FontCascade.cpp:

(WebCore::FontCascade::displayListForTextRun const):

• platform/graphics/displaylists/DisplayListRecorder.h:

• Headers.cmake:
• PlatformAppleWin.cmake:
• PlatformWinCairo.cmake:
• SourcesCocoa.txt:
• WebCore.xcodeproj/project.pbxproj:
• platform/FreeType.cmake:

3:06 PM Changeset in webkit [283198] by Truitt Savell

• 2 edits in trunk/LayoutTests

Marking more tests crashing with uncaught exception 'NSInvalidArgumentException'
rdar://83592102

Unreviewed test gardening.

3:03 PM Changeset in webkit [283197] by mmaxfield@apple.com

• 2 edits in trunk/Source/WebCore

Negative integers in @font-palette-values are invalid
​https://bugs.webkit.org/show_bug.cgi?id=230788

Reviewed by Simon Fraser.
<rdar://problem/83528806>

Addressing post-commit review.

No new tests because there is no behavior change.

• platform/graphics/cocoa/FontCacheCoreText.cpp:

(WebCore::addAttributesForFontPalettes):

2:28 PM Changeset in webkit [283196] by BJ Burg

• 14 edits
  3 adds in trunk

[Cocoa] Add SPI to select a tab created by _WKInspectorExtension
​https://bugs.webkit.org/show_bug.cgi?id=230580
<rdar://problem/83372851>

Reviewed by Devin Rousso.

Source/WebInspectorUI:

Add a method to look up a WebInspectorExtensionTabContentView
by its extensionTabID and then show it with WI.tabBrowser.

• UserInterface/Controllers/WebInspectorExtensionController.js:

(WI.WebInspectorExtensionController.prototype.reloadForExtension):
Remove extra newlines.
(WI.WebInspectorExtensionController.prototype.showExtensionTab): Added.

• UserInterface/Protocol/InspectorFrontendAPI.js:

(InspectorFrontendAPI.showExtensionTab): Added.

Source/WebKit:

Add a new method for selecting an extension tab in WebInspectorUI
that was previously created by using
-[_WKInspectorExtension createNewTab:tabIconURL:sourceURL:completionHandler].

This is a straightforward plumbing exercise. The API test uses the new method
to test the existing _WKInspectorExtensionDelegate callback methods for
didShowTab and didHideTab.

New API test: WKInspectorExtensionDelegate.ShowAndHideTabCallbacks.

• UIProcess/API/Cocoa/_WKInspector.mm:

(-[_WKInspector showExtensionTabWithIdentifier:completionHandler:]):

• UIProcess/API/Cocoa/_WKInspectorExtensionHost.h:
• UIProcess/API/Cocoa/_WKRemoteWebInspectorViewController.mm:

(-[_WKRemoteWebInspectorViewController showExtensionTabWithIdentifier:completionHandler:]):

• UIProcess/Inspector/WebInspectorUIExtensionControllerProxy.cpp:

(WebKit::WebInspectorUIExtensionControllerProxy::showExtensionTab):

• UIProcess/Inspector/WebInspectorUIExtensionControllerProxy.h:
• WebProcess/Inspector/WebInspectorUIExtensionController.cpp:

(WebKit::WebInspectorUIExtensionController::showExtensionTab):

• WebProcess/Inspector/WebInspectorUIExtensionController.h:
• WebProcess/Inspector/WebInspectorUIExtensionController.messages.in:

Tools:

Create a new test file for _WKInspectorExtensionDelegate. Add a
new test case that exercises creating an extension tab, showing an
extension tab, and uses delegate callbacks for didShowTab/didHideTab.

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WebKitCocoa/InspectorExtension-TabIcon-30x30.png: Added.
• TestWebKitAPI/Tests/WebKitCocoa/InspectorExtension-basic-tab.html: Added.
• TestWebKitAPI/Tests/WebKitCocoa/WKInspectorExtensionDelegate.mm: Added.

(resetGlobalState):
(-[UIDelegateForTestingInspectorExtensionDelegate _webView:didAttachLocalInspector:]):
(-[InspectorExtensionDelegateForTesting inspectorExtension:didShowTabWithIdentifier:]):
(-[InspectorExtensionDelegateForTesting inspectorExtension:didHideTabWithIdentifier:]):
(TEST):

2:16 PM Changeset in webkit [283195] by Brent Fulgham

• 4 edits in trunk/Source/WebKit

Remove redundant sandbox exception rules for registering mach extensions
​https://bugs.webkit.org/show_bug.cgi?id=230909
<rdar://problem/66583587>

Reviewed by Per Arne Vollan.

The Sandbox implementation offers a mechanism for apps to extend their sandbox at compile
time. WebKit does not use those extensions in its sandbox design, so we should remove those
unused rules. They are left-over from importing the global App Sandbox rules long ago, and
are not needed by WebKit.

• Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
• Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:

2:13 PM Changeset in webkit [283194] by Kate Cheney

• 9 edits in trunk

PCM: different bundleID entries will override each other
​https://bugs.webkit.org/show_bug.cgi?id=230839

Reviewed by Alex Christensen.

Source/WebKit:

We recently added a bundleID column to PCM tables. We want to make
sure entries with different bundleIDs do not override each other,
so we should make it a part of the unique constraint on both PCM
tables that contain it. This requires creating new tables and
migrating existing data to them. Luckily this code already exists
in the ITP database, and we can just move it to the shared
DatabaseUtilities class.

• NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.cpp:

(WebKit::ResourceLoadStatisticsDatabaseStore::expectedTableAndIndexQueries):
(WebKit::stripIndexQueryToMatchStoredValue): Deleted.
(WebKit::expectedTableAndIndexQueries): Deleted.
(WebKit::ResourceLoadStatisticsDatabaseStore::currentTableAndIndexQueries): Deleted.
(WebKit::insertDistinctValuesInTableStatement): Deleted.
(WebKit::ResourceLoadStatisticsDatabaseStore::migrateDataToNewTablesIfNecessary): Deleted.

• NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.h:
• NetworkProcess/DatabaseUtilities.cpp:

(WebKit::DatabaseUtilities::stripIndexQueryToMatchStoredValue):
(WebKit::DatabaseUtilities::currentTableAndIndexQueries):
(WebKit::insertDistinctValuesInTableStatement):
(WebKit::DatabaseUtilities::migrateDataToNewTablesIfNecessary):

• NetworkProcess/DatabaseUtilities.h:
• NetworkProcess/PrivateClickMeasurement/PrivateClickMeasurementDatabase.cpp:

(WebKit::PCM::Database::Database):
(WebKit::PCM::Database::expectedTableAndIndexQueries):
(WebKit::PCM::Database::createUniqueIndices):
(WebKit::PCM::Database::needsUpdatedSchema):

• NetworkProcess/PrivateClickMeasurement/PrivateClickMeasurementDatabase.h:

Tools:

API test coverage for the case of existing PCM data with a bundleID
column but an expired unique index.

• TestWebKitAPI/Tests/WebKitCocoa/PrivateClickMeasurement.mm:

(addUnattributedPCMv4):
(addAttributedPCMv4):
(dumpedPCM):
(pollUntilPCMIsMigrated):
(emptyPcmDBPath):
(createAndPopulatePCMObservedDomainTable):
(setUpFromResourceLoadStatisticsDatabase):
(setUpFromPCMDatabase):
(TEST):
(setUp): Deleted.

2:10 PM Changeset in webkit [283193] by Cameron McCormack

• 7 edits in trunk

Preserve color space when structured cloning ImageBitmaps
​https://bugs.webkit.org/show_bug.cgi?id=230429
<rdar://problem/83293533>

Reviewed by Sam Weinig.

LayoutTests/imported/w3c:

The test added in ​https://bugs.webkit.org/show_bug.cgi?id=230429 was
buggy, in that by the time the "message" event handler ran, the
values for the various test configuration variables had changed. The
key bugfix here is checking for the right testID value in the message
event handler, but the test is rewritten more substantially to be a bit
clearer and less indented.

• web-platform-tests/html/canvas/element/manual/wide-gamut-canvas/canvas-display-p3-drawImage-ImageBitmap-cloned-expected.txt:
• web-platform-tests/html/canvas/element/manual/wide-gamut-canvas/canvas-display-p3-drawImage-ImageBitmap-cloned.html:

Source/WebCore:

The logic for serializing the CGColorSpace is copied and adapted from
the ArgumentCoder<CGColorSpaceRef> specialization, which we cannot
easily re-use.

• bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneSerializer::dumpImageBitmap):
(WebCore::CloneSerializer::write):
(WebCore::CloneDeserializer::read):
(WebCore::CloneDeserializer::readImageBitmap):

LayoutTests:

• fast/storage/serialized-script-value.html: Bump the current version

number.

2:00 PM Changeset in webkit [283192] by Kate Cheney

• 18 edits
  14 adds
  1 delete in trunk

CSP: Implement 'strict-dynamic' source expression
​https://bugs.webkit.org/show_bug.cgi?id=184031
<rdar://problem/38900632>

Reviewed by Brent Fulgham.

LayoutTests/imported/w3c:

Included passing tests and also expectations for partially passing
tests where the failures are unrelated to strict-dynamic because it
will help prevent regressions to the passing components.

• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_and_unsafe_eval_eval-expected.txt: Added.
• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_and_unsafe_eval_new_function-expected.txt: Added.
• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_discard_source_expressions-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_different_nonce-expected.txt: Added.
• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_source_expressions-expected.txt: Removed.

This doesn't go with a corresponding html file, so I deleted it.

• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_source_expressions.sub-expected.txt:

We strip cross origin blocked URIs before reporting them, so this test
times out because it never receives the correct blockedURI in the
report.

• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_report_only-expected.txt: Added.
• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_hashes-expected.txt: Added.
• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_in_img-src-expected.txt: Added.
• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_javascript_uri-expected.txt: Added.
• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_meta_tag-expected.txt: Added.
• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_non_parser_inserted-expected.txt: Added.
• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_non_parser_inserted_incorrect_nonce-expected.txt: Added.
• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted-expected.txt: Added.

Timing out because we don't specify the violation target ID in our
report. Tracking in rdar://83425187.

• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_parser_inserted_correct_nonce-expected.txt: Added.
• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_worker-importScripts.https-expected.txt: Added.
• web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_worker.https-expected.txt: Added.

Test failure related to workers, not strict-dynamic.

Source/WebCore:

Partially implements 'strict-dynamic' CSP source expression. strict-dynamic
allows scripts with specified nonces and hashes to run, as well as
descendents of those scripts, or "non parser inserted" scripts.
It ignores unsafe-inline and self source expressions.

This patch creates a new algorithm ContentSecurityPolicy::allScriptPoliciesAllow
which makes sure each loaded script is allowed by some part of the
policy. If it violates each of the script policies, then we block it
and report a violation.

We only have access to whether a script is parser-inserted in ScriptElement.
To avoid having to pass that value and the script nonce through a lot of
places, we check for script violations in
ScriptElement::requestClassicScript. To avoid unnecessarily blocking
scripts with correct nonces or non-parser inserted scripts in
ContentSecurityPolicy::allowScriptFromSource which is called later on,
we skip the extra check if strictDynamic is enabled. This is not
ideal and in the future we should figure out a way to put all checks
in one place.

• dom/ScriptElement.cpp:

Update m_parserInserted to be an enum.

(WebCore::ScriptElement::ScriptElement):
(WebCore::ScriptElement::didFinishInsertingNode):
(WebCore::ScriptElement::childrenChanged):
(WebCore::ScriptElement::prepareScript):
(WebCore::ScriptElement::requestClassicScript):
(WebCore::ScriptElement::executeClassicScript):
strict-dynamic checks happen here.

(WebCore::ScriptElement::ignoresLoadRequest const):

• dom/ScriptElement.h:

(WebCore::ScriptElement::isParserInserted const):
(WebCore::ScriptElement::insertedIntoAncestor const):

• page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::allScriptPoliciesAllow const):
Algorithm to check for policy violations. Here we check if the script
is non-parser inserted AND it does not have a recognized nonce or hash
AND it is not listed in the URL list of the policy. If it fails all
checks then the policy does not support it and we refuse to load it.

(WebCore::ContentSecurityPolicy::allowJavaScriptURLs const):
(WebCore::ContentSecurityPolicy::shouldPerformEarlyCSPCheck const):
(WebCore::ContentSecurityPolicy::allowNonParserInsertedScripts const):
(WebCore::ContentSecurityPolicy::allowInlineScript const):
To avoid blocking scripts that are OK with strict-dynamic, we should
skip unsafe-inline checks (which should be ignored per the spec).

(WebCore::ContentSecurityPolicy::allowScriptFromSource const):
(WebCore::ContentSecurityPolicy::reportViolation const):

• page/csp/ContentSecurityPolicy.h:
• page/csp/ContentSecurityPolicyDirectiveList.cpp:

(WebCore::checkNonParserInsertedScripts):
(WebCore::ContentSecurityPolicyDirectiveList::violatedDirectiveForParserInsertedScript const):
(WebCore::ContentSecurityPolicyDirectiveList::strictDynamicIncluded):
A separate function to tell us if strict-dynamic is included in the
CSP policies.

• page/csp/ContentSecurityPolicyDirectiveList.h:
• page/csp/ContentSecurityPolicyDirectiveNames.cpp:
• page/csp/ContentSecurityPolicyDirectiveNames.h:
• page/csp/ContentSecurityPolicySourceList.cpp:

(WebCore::ContentSecurityPolicySourceList::matches const):
(WebCore::ContentSecurityPolicySourceList::parseSource):
Ignore 'self' and 'unsafe-inline' directives if 'strict-dynamic' is
specified.

• page/csp/ContentSecurityPolicySourceList.h:

(WebCore::ContentSecurityPolicySourceList::allowNonParserInsertedScripts const):

• page/csp/ContentSecurityPolicySourceListDirective.h:

(WebCore::ContentSecurityPolicySourceListDirective::allowNonParserInsertedScripts const):

LayoutTests:

• TestExpectations:

1:34 PM Changeset in webkit [283191] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina BigSur wk1 Debug ] storage/websql/multiple-databases-garbage-collection.html is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230910.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

1:04 PM Changeset in webkit [283190] by commit-queue@webkit.org

• 2 edits in trunk/Tools

Added GlobalSign R3/R5 Root CA cert to webkitcorepy to resolve certain pip module download SSL error.
​https://bugs.webkit.org/show_bug.cgi?id=230904

Patch by Eddy Wong <​eddy_wong@apple.com> on 2021-09-28
Reviewed by Jonathan Bedard.

• Scripts/libraries/webkitcorepy/webkitcorepy/cacert.pem:

1:00 PM Changeset in webkit [283189] by Alan Coon

• 8 edits in branches/safari-612.2.6.1-branch/Source

Versioning.

WebKit-7612.2.6.1.2

12:53 PM Changeset in webkit [283188] by mmaxfield@apple.com

• 11 edits in trunk

Negative integers in @font-palette-values are invalid
​https://bugs.webkit.org/show_bug.cgi?id=230788
<rdar://problem/83528806>

Reviewed by Simon Fraser.

LayoutTests/imported/w3c:

This is being upstreamed at ​https://github.com/web-platform-tests/wpt/pull/30961.

• web-platform-tests/css/css-fonts/parsing/font-palette-values-invalid-expected.txt:
• web-platform-tests/css/css-fonts/parsing/font-palette-values-invalid.html:
• web-platform-tests/css/css-fonts/parsing/font-palette-values-valid-expected.txt:
• web-platform-tests/css/css-fonts/parsing/font-palette-values-valid.html:

Source/WebCore:

The spec made it illegal in
​https://github.com/w3c/csswg-drafts/commit/09b3c45238feb6c0e8526e010cd3780f4fc4900b.

Test: web-platform-tests/css/css-fonts/parsing/font-palette-values-invalid.html

• css/CSSFontPaletteValuesRule.cpp:

(WebCore::CSSFontPaletteValuesRule::basePalette const):
(WebCore::CSSFontPaletteValuesRule::initializeMapLike):
(WebCore::CSSFontPaletteValuesRule::cssText const):

• css/parser/CSSParserImpl.cpp:

(WebCore::CSSParserImpl::consumeFontPaletteValuesRule):

• css/parser/CSSPropertyParser.cpp:

(WebCore::consumeBasePaletteDescriptor):
(WebCore::consumeOverrideColorDescriptor):

• platform/graphics/FontPaletteValues.h:
• platform/graphics/cocoa/FontCacheCoreText.cpp:

(WebCore::addAttributesForFontPalettes):

12:15 PM Changeset in webkit [283187] by Brent Fulgham

• 9 edits in trunk/Source/WebKit

Explicitly deny 'system-privilege' in the sandbox profile as a hardening measure
​https://bugs.webkit.org/show_bug.cgi?id=230782
<rdar://problem/66582813>

Reviewed by Per Arne Vollan.

Although we do not need 'system-privilege', the default sandbox state includes it as a convenience
for backwards-compatibility.

Update our sandboxes to tell the kernel we don't need the support, except for one case in the
Networking process.

• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
• Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:
• Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebAuthn.sb:
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:
• WebAuthnProcess/mac/com.apple.WebKit.WebAuthnProcess.sb.in:
• WebProcess/com.apple.WebProcess.sb.in:

12:06 PM Changeset in webkit [283186] by youenn@apple.com

• 2 edits in trunk/Source/WebCore

[BigSur wk2 Debug iOS14 ] webrtc/video-mute.html is a flaky failure
​https://bugs.webkit.org/show_bug.cgi?id=230865
<rdar://problem/83594770>

Reviewed by Eric Carlson.

Covered by webrtc/video-mute.html being no longer flaky.

• Modules/mediastream/libwebrtc/LibWebRTCIceTransportBackend.cpp:

(WebCore::LibWebRTCIceTransportBackendObserver::start):

11:42 AM Changeset in webkit [283185] by Eric Hutchison

• 3 edits in trunk/LayoutTests

[ iOS, Mac ] imported/w3c/web-platform-tests/css/css-cascade/layer-counter-style-override.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=230905.

Unreviewed test gardening.

• platform/ios-wk2/TestExpectations:
• platform/mac-wk1/TestExpectations:

11:08 AM Changeset in webkit [283184] by sihui_liu@apple.com

• 47 edits
  1 copy
  1 add in trunk

Make StorageManager available in Worker
​https://bugs.webkit.org/show_bug.cgi?id=230675
<rdar://problem/83448115>

Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

• web-platform-tests/file-system-access/sandboxed_FileSystemBaseHandle-IndexedDB.https.any.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemBaseHandle-isSameEntry.https.any.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemBaseHandle-remove.https.any.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemDirectoryHandle-getDirectoryHandle.https.any.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemDirectoryHandle-getFileHandle.https.any.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemDirectoryHandle-iteration.https.any.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemDirectoryHandle-removeEntry.https.any.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemDirectoryHandle-resolve.https.any.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemFileHandle-getFile.https.any.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemFileHandle-sync-access-handle-lock.https.tentative.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemSyncAccessHandle-close.https.tentative.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemSyncAccessHandle-flush.https.tentative.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemSyncAccessHandle-getSize.https.tentative.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemSyncAccessHandle-read-write.https.tentative.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemSyncAccessHandle-truncate.https.tentative.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemWritableFileStream-piped.https.any.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemWritableFileStream-write.https.any.worker-expected.txt:
• web-platform-tests/file-system-access/sandboxed_FileSystemWritableFileStream.https.any.worker-expected.txt:
• web-platform-tests/storage/estimate-indexeddb.https.any.worker-expected.txt:
• web-platform-tests/storage/estimate-parallel.https.any.worker-expected.txt:
• web-platform-tests/storage/estimate-usage-details-caches.https.tentative.any.worker-expected.txt:
• web-platform-tests/storage/estimate-usage-details-indexeddb.https.tentative.any.worker-expected.txt:
• web-platform-tests/storage/estimate-usage-details.https.tentative.any.worker-expected.txt:
• web-platform-tests/storage/idlharness.https.any.worker-expected.txt:
• web-platform-tests/storage/persisted.https.any.worker-expected.txt:
• web-platform-tests/storage/storagemanager-estimate.https.any.worker-expected.txt:
• web-platform-tests/storage/storagemanager-persist.https.worker-expected.txt:
• web-platform-tests/storage/storagemanager-persisted.https.any.worker-expected.txt:

Source/WebCore:

Introduce WorkerStorageConnection class, which dispatches StorageManager task to main-thread StorageConnection
and dispatches result back to worker thread.

Rebaselined existing test.

• Modules/storage/DummyStorageProvider.h:
• Modules/storage/StorageConnection.h:

(WebCore::StorageConnection::persist):

• Modules/storage/StorageManager.cpp:

(WebCore::connectionInfo):

• Modules/storage/WorkerStorageConnection.cpp: Added.

(WebCore::WorkerStorageConnection::create):
(WebCore::WorkerStorageConnection::WorkerStorageConnection):
(WebCore::WorkerStorageConnection::scopeClosed):
(WebCore::WorkerStorageConnection::getPersisted):
(WebCore::WorkerStorageConnection::didGetPersisted):
(WebCore::WorkerStorageConnection::fileSystemGetDirectory):

• Modules/storage/WorkerStorageConnection.h: Copied from Source/WebCore/Modules/storage/StorageConnection.h.
• Sources.txt:
• WebCore.xcodeproj/project.pbxproj:
• dom/Document.h:
• dom/ScriptExecutionContext.h:

(WebCore::ScriptExecutionContext::permissionController):
(WebCore::ScriptExecutionContext::storageConnection): Deleted.

• page/NavigatorStorage.idl:
• page/WorkerNavigator.idl:
• workers/WorkerGlobalScope.cpp:

(WebCore::WorkerGlobalScope::prepareForDestruction):
(WebCore::WorkerGlobalScope::storageConnection):

• workers/WorkerGlobalScope.h:
• workers/WorkerLoaderProxy.h:

(WebCore::WorkerLoaderProxy::storageConnection):

• workers/WorkerMessagingProxy.cpp:

(WebCore::WorkerMessagingProxy::storageConnection):

• workers/WorkerMessagingProxy.h:

Source/WebKit:

• WebProcess/WebCoreSupport/WebStorageConnection.cpp:

(WebKit::WebStorageConnection::getPersisted):

• WebProcess/WebCoreSupport/WebStorageConnection.h:

11:06 AM Changeset in webkit [283183] by pvollan@apple.com

• 14 edits in trunk/Source/WebKit

Enable CFPrefs direct mode in all WebKit processes
​https://bugs.webkit.org/show_bug.cgi?id=230771
<rdar://problem/83510055>

Reviewed by Brent Fulgham.

We currently enable CFPrefs direct mode in the WebContent and GPU Process, and we should enable it in all WebKit processes.

• NetworkProcess/NetworkProcess.h:
• NetworkProcess/NetworkProcess.messages.in:
• NetworkProcess/cocoa/NetworkProcessCocoa.mm:

(WebKit::NetworkProcess::notifyPreferencesChanged):

• Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb:
• Resources/SandboxProfiles/ios/com.apple.WebKit.WebAuthn.sb:
• Shared/EntryPointUtilities/Cocoa/XPCService/XPCServiceMain.mm:

(WebKit::XPCServiceMain):
(WebKit::shouldEnableCFPrefsDirectMode): Deleted.

• UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::notifyPreferencesChanged):

• UIProcess/WebAuthentication/WebAuthnProcessProxy.cpp:

(WebKit::WebAuthnProcessProxy::singletonIfCreated):

• UIProcess/WebAuthentication/WebAuthnProcessProxy.h:
• WebAuthnProcess/WebAuthnProcess.cpp:

(WebKit::WebAuthnProcess::notifyPreferencesChanged):

• WebAuthnProcess/WebAuthnProcess.h:
• WebAuthnProcess/WebAuthnProcess.messages.in:
• WebAuthnProcess/mac/com.apple.WebKit.WebAuthnProcess.sb.in:

11:06 AM Changeset in webkit [283182] by pvollan@apple.com

• 3 edits in trunk/Source/WebKit

[GPUP] Add sandbox telemetry
​https://bugs.webkit.org/show_bug.cgi?id=230859
<rdar://problem/83591291>

Reviewed by Brent Fulgham.

Add more sandbox telemetry to the GPU process' sandbox on iOS and macOS.

• GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
• Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:

10:55 AM Changeset in webkit [283181] by pvollan@apple.com

• 2 edits in trunk/Source/WebKit

[macOS] Allow access to mach service for root in the Networking process
​https://bugs.webkit.org/show_bug.cgi?id=230843
<rdar://problem/83576091>

Reviewed by Alexey Proskuryakov.

Allow access to the mach service com.apple.trustd for root in the Networking process on macOS.

• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:

10:55 AM Changeset in webkit [283180] by youenn@apple.com

• 5 edits
  1 add in trunk

Validate DeviceIdHashSaltStorage persistent data
​https://bugs.webkit.org/show_bug.cgi?id=230852
<rdar://problem/83615408>

Reviewed by Eric Carlson.

Source/WebKit:

Add nullptr check to decoded data.
Covered by API test.

• UIProcess/DeviceIdHashSaltStorage.cpp:

(WebKit::DeviceIdHashSaltStorage::loadStorageFromDisk):

Tools:

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WebKit/GetUserMedia.mm:
• TestWebKitAPI/Tests/WebKit/invalidDeviceIDHashSalts: Added.

10:22 AM ControlFlowIntegrityinWebKit created by Jon Davis

10:22 AM WPEAndroid edited by Jon Davis

(diff)

10:22 AM ContributingtoWebInspector created by Jon Davis

10:21 AM Divingintobmalloc created by Jon Davis

10:21 AM Changeset in webkit [283179] by Chris Dumez

• 58 edits
  1 copy
  1 add in trunk

Move Cross-Origin-Opener-Policy handling to the NetworkProcess
​https://bugs.webkit.org/show_bug.cgi?id=230812
<rdar://83504842>

Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

Rebaseline a couple of WPT tests due to some extra logging.

• web-platform-tests/html/cross-origin-opener-policy/coop-coep-sandbox.https-expected.txt:
• web-platform-tests/html/cross-origin-opener-policy/coop-sandbox.https-expected.txt:

Source/WebCore:

Previous, COOP handling was fully implemented in the WebContent process. This meant that a
WebProcess for origin A could get a network response with COOP header from origin B, decide
that cross-origin isolation is needed and ask the UIProcess to process-swap. This was not a
good design given that the WebContent process is not a trusted process. We should not trust
the WebProcess for origin A to make the swap on behavior of origin B. Also, the network
response from origin B may contain sensitive headers that we don't want origin A's WebProcess
to see.

To address these issues, I have moved COOP handling from the WebContent process to the
NetworkProcess. As soon as the NetworkProcess gets the network response, it makes the decision
whether or not cross-origin isolation is needed. If isolation is needed, the network process
asks the UIProcess directly to continue the load in a new WebProcess instead of sending the
network response to the currently associated WebProcess. When the new WebProcess resumes the
load, the network process sends it the network response it already has.

I moved most of the COOP specification implementation from DocumentLoader.cpp/h to
CrossOriginOpenerPolicy.cpp/h so that we can leverage it from the NetworkResourceLoader in
the network process. We still have to do *some* COOP handling at DocumentLoader level
currently for non-initial navigations to about:blank given that those can trigger a browsing
context group switch but currently do not involve the network process. I also had to add
more information to NetworkResourceLoadParameters so that we are able to make appropriate
COOP decisions in the NetworkProcess.

No new tests, covered by existing COOP tests that are still passing.

• Headers.cmake:
• Sources.txt:
• WebCore.xcodeproj/project.pbxproj:
• dom/Document.h:

• loader/CrossOriginOpenerPolicy.cpp:

(WebCore::checkIfCOOPValuesRequireBrowsingContextGroupSwitch):
(WebCore::checkIfEnforcingReportOnlyCOOPWouldRequireBrowsingContextGroupSwitch):
(WebCore::computeResponseOriginAndCOOP):
(WebCore::enforceResponseCrossOriginOpenerPolicy):
(WebCore::obtainCrossOriginOpenerPolicy):
(WebCore::sendViolationReportWhenNavigatingToCOOPResponse):
(WebCore::sendViolationReportWhenNavigatingAwayFromCOOPResponse):
(WebCore::doCrossOriginOpenerHandlingOfResponse):
(WebCore::CrossOriginOpenerPolicyEnforcementResult::from):

• loader/CrossOriginOpenerPolicy.h:

(WebCore::CrossOriginOpenerPolicy::reportingEndpointForDisposition const):
(WebCore::CrossOriginOpenerPolicy::hasReportingEndpoint const):

• loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::willSendRequest):
(WebCore::DocumentLoader::doCrossOriginOpenerHandlingOfResponse):
(WebCore::DocumentLoader::responseReceived):
(WebCore::DocumentLoader::maybeLoadEmpty):
(WebCore::DocumentLoader::clearMainResource):

• loader/DocumentLoader.h:

(WebCore::DocumentLoader::crossOriginOpenerPolicy const):
(WebCore::DocumentLoader::isContinuingLoadAfterProvisionalLoadStarted const):
(WebCore::DocumentLoader::setIsContinuingLoadAfterProvisionalLoadStarted):
Move most of the COOP logic from DocumentLoader.cpp to CrossOriginOpenerPolicy.cpp, so that
it can be reused by NetworkResourceLoader in the network process.

• loader/EmptyClients.cpp:

(WebCore::EmptyFrameLoaderClient::dispatchDecidePolicyForResponse):

• loader/EmptyFrameLoaderClient.h:
• loader/FrameLoader.cpp:

(WebCore::FrameLoader::checkContentPolicy):
(WebCore::FrameLoader::load):

• loader/FrameLoader.h:
• loader/FrameLoaderClient.h:

• loader/NavigationAction.cpp:

(WebCore::NavigationAction::NavigationAction):

• loader/NavigationAction.h:

(WebCore::NavigationAction::requester const):
(WebCore::NavigationAction::isEmpty const):

• loader/NavigationRequester.cpp: Added.
• loader/NavigationRequester.h: Added.

Extracted NavigationAction::Requester to its own header and rename it to NavigationRequester,
so that its implementation can be shared between NavigationAction, NetworkResourceLoadParameters
and COOP.

• loader/ReportingEndpointsCache.cpp:

(WebCore::ReportingEndpointsCache::addEndPointsFromResponse):
(WebCore::ReportingEndpointsCache::addEndPointsFromReportToHeader):

• loader/ReportingEndpointsCache.h:
• loader/ShouldTreatAsContinuingLoad.h:
• page/Page.h:

Source/WebKit:

Implement COOP handling in the NetworkProcess, inside the NetworkResourceLoader class.
This was logic that was currently implemented at DocumentLoader-level, in the WebProcess.

• NetworkProcess/NetworkProcess.cpp:
• NetworkProcess/NetworkProcess.h:
• NetworkProcess/NetworkProcess.messages.in:
• NetworkProcess/NetworkResourceLoadParameters.cpp:

(WebKit::NetworkResourceLoadParameters::encode const):
(WebKit::NetworkResourceLoadParameters::decode):

• NetworkProcess/NetworkResourceLoadParameters.h:
• NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::doCrossOriginOpenerHandlingOfResponse):
(WebKit::toBrowsingContextGroupSwitchDecision):
(WebKit::NetworkResourceLoader::didReceiveResponse):
(WebKit::NetworkResourceLoader::sendDidReceiveResponsePotentiallyInNewBrowsingContextGroup):
(WebKit::NetworkResourceLoader::willSendRedirectedRequest):
(WebKit::NetworkResourceLoader::didRetrieveCacheEntry):

• NetworkProcess/NetworkResourceLoader.h:
• NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.cpp:

(WebKit::ServiceWorkerFetchTask::didReceiveResponse):

• Scripts/webkit/messages.py:

(types_that_cannot_be_forward_declared):
(headers_for_type):

• UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::triggerBrowsingContextGroupSwitchForNavigation):

• UIProcess/Network/NetworkProcessProxy.h:
• UIProcess/Network/NetworkProcessProxy.messages.in:
• UIProcess/ProvisionalPageProxy.cpp:

(WebKit::ProvisionalPageProxy::decidePolicyForResponse):

• UIProcess/ProvisionalPageProxy.h:
• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::continueNavigationInNewProcess):
(WebKit::WebPageProxy::decidePolicyForResponse):
(WebKit::WebPageProxy::decidePolicyForResponseShared):
(WebKit::WebPageProxy::triggerBrowsingContextGroupSwitchForNavigation):

• UIProcess/WebPageProxy.h:
• UIProcess/WebPageProxy.messages.in:
• WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::WebLoaderStrategy::scheduleLoadFromNetworkProcess):

• WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::dispatchDidStartProvisionalLoad):
(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForResponse):
(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction):

• WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::sendViolationReportWhenNavigatingToCOOPResponse):
(WebKit::WebPage::sendViolationReportWhenNavigatingAwayFromCOOPResponse):

• WebProcess/WebPage/WebPage.h:
• WebProcess/WebPage/WebPage.messages.in:

Source/WebKitLegacy/mac:

• WebCoreSupport/WebFrameLoaderClient.h:
• WebCoreSupport/WebFrameLoaderClient.mm:

(WebFrameLoaderClient::dispatchDecidePolicyForResponse):

Source/WebKitLegacy/win:

• WebCoreSupport/WebFrameLoaderClient.cpp:

(WebFrameLoaderClient::dispatchDecidePolicyForResponse):

• WebCoreSupport/WebFrameLoaderClient.h:

Tools:

Port COOP API tests from PSONSchemeHandler to HTTPServer. This was necessary since custom scheme handler
loads do not go via the networkProcess (Where COOP handling is now implemented).

• TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:

(-[PSONNavigationDelegate webView:didReceiveAuthenticationChallenge:completionHandler:]):
(-[PSONScheme webView:startURLSchemeTask:]):

• TestWebKitAPI/cocoa/HTTPServer.h:

10:21 AM September 2021 Meeting edited by Jon Davis

Removed Standards Discussion (diff)

10:20 AM WPEAndroid created by Jon Davis

10:19 AM SVGinWebKitStatusofCompositing created by Jon Davis

10:19 AM RenderingUIandPrivacychallengesinWebXRBrowsers created by Jon Davis

10:18 AM WebGL2ANGLEandthedirecttoMetalCompilerinWebKit created by Jon Davis

10:17 AM DialogInert created by Jon Davis

10:17 AM TVontheWeb created by Jon Davis

10:14 AM September 2021 Meeting edited by Jon Davis

Updated schedule (diff)

9:59 AM Changeset in webkit [283178] by fpizlo@apple.com

• 9 edits
  1 add
  1 delete in trunk/Source/bmalloc

[libpas] Fix coalescing of the large sharing pool and make it easy to introspect it (update to e4d20851ee9ff00f2962b349a9ff8465695a83d7)
​https://bugs.webkit.org/show_bug.cgi?id=230867

Reviewed by Yusuke Suzuki.

This adds the ability to enable the libpas status reporter, adds a large sharing pool dump to
the status report, and fixes a large sharing pool coalescing bug found by doing that. Previously
we weren't coalescing things that are not free+committed.

Also updates the export script that I use to keep the libpas git repo in sync with what's in WK.

The large sharing pool is the mechanism by which libpas can find memory that can be decommitted
across isolated large heaps, even if those large heaps share pages with one another. The main
data structure is a red-black tree of nodes that represent memory ranges. If there are two
adjacent ranges of memory that are both fully live and committed or both decommitted, then we
want those to be represented using a single node. That wasn't quite working right. Even the
libpas test for this was testing the wrong thing. This fixes the behavior and the test. It's
perf-neutral since large heaps usually have a small number of objects in them anyway.

The new status reporting functionality can be enabled with the WebKitPasStatusReporter
environment variable. This takes an integer that tells the amount of data in the report. Here
are the recognized values:

1 - just report number of heaps
2 - something in between 1 and 3
3 - report everything that the status reporter can report right now (per-page data for

segregated/bitfit heaps, lots of details for large heaps)

If the status reporter ever reported per-object information, it would be at level 4 or higher.
It's safe to pass 9999 or whatever if you just want the maximum report that libpas supports.
TL;DR for now you usually want WebKitPasStatusReporter=3.

• bmalloc/Environment.cpp:

(bmalloc::Environment::Environment):

• libpas/export.rb: Added.
• libpas/export.sh: Removed.
• libpas/src/libpas/pas_bitfit_directory.c:

(pas_bitfit_directory_construct): I needed to rationalize how we initialize disabled directories to make status reporting work.
(pas_bitfit_directory_get_first_free_view):

• libpas/src/libpas/pas_large_sharing_pool.c:

(states_match):

• libpas/src/libpas/pas_status_reporter.c:

(pas_status_reporter_dump_bitfit_directory):
(dump_large_sharing_pool_node_callback):
(pas_status_reporter_dump_large_sharing_pool):
(pas_status_reporter_dump_everything):

• libpas/src/libpas/pas_status_reporter.h:
• libpas/src/test/LargeSharingPoolDump.cpp:
• libpas/src/test/LargeSharingPoolDump.h:
• libpas/src/test/LargeSharingPoolTests.cpp:

(std::Range::Range):
(std::Range::operator== const):
(std::Range::operator!= const):
(std::operator<<):
(std::assertState):
(std::testGoodCoalesceEpochUpdate):
(addLargeSharingPoolTests):
(std::testBadCoalesceEpochUpdate): Deleted.

9:55 AM Changeset in webkit [283177] by Matt Lewis

• 5 edits in trunk/Tools

Move iOS, watchOS, and tvOS queues to latest releases
​https://bugs.webkit.org/show_bug.cgi?id=230837

Reviewed by Jonathan Bedard.

• CISupport/build-webkit-org/config.json:
• CISupport/build-webkit-org/factories_unittest.py:

(TestExpectedBuildSteps):

• CISupport/build-webkit-org/public_html/dashboard/Scripts/WebKitBuildbot.js:

(WebKitBuildbot):

• CISupport/build-webkit-org/public_html/dashboard/Styles/Main.css:

(table.queue-grid tr.platform.ios-simulator-14 img.logo): Deleted.
(table.queue-grid tr.platform.ios-14 img.logo): Deleted.
(table.queue-grid tr.platform.tvos-simulator-14 img.logo): Deleted.
(table.queue-grid tr.platform.tvos-14 img.logo): Deleted.
(table.queue-grid tr.platform.watchos-simulator-7 img.logo): Deleted.
(table.queue-grid tr.platform.watchos-7 img.logo): Deleted.

9:32 AM Changeset in webkit [283176] by aboya@igalia.com

• 2 edits in trunk/Source/WebCore

[MSE][GStreamer] Don't create MediaSourceTrackGStreamer objects twice for the same track
​https://bugs.webkit.org/show_bug.cgi?id=230829

Reviewed by Xabier Rodriguez-Calvar.

The existing code in
SourceBufferPrivateGStreamer::didReceiveInitializationSegment()
was not checking if the track already existing, creating and
immediately destroying a MediaSourceTrackGStreamer, which then crashed
on an assertion (ASSERTION FAILED: m_isRemoved).

This fixes the following two tests which were crashing with the former
assertion when running in Debug:

• media/media-source/media-mp4-h264-partial-abort.html
• media/media-source/media-source-abort-resets-parser.html

• platform/graphics/gstreamer/mse/SourceBufferPrivateGStreamer.cpp:

(WebCore::SourceBufferPrivateGStreamer::didReceiveInitializationSegment):

9:24 AM Changeset in webkit [283175] by commit-queue@webkit.org

• 3 edits in trunk

[GTK][WPE] Bump libsoup3 version to 3.0.0
​https://bugs.webkit.org/show_bug.cgi?id=230601

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2021-09-28
Reviewed by Philippe Normand.

• Source/cmake/OptionsGTK.cmake:
• Source/cmake/OptionsWPE.cmake:

9:22 AM Changeset in webkit [283174] by commit-queue@webkit.org

• 20 edits
  2 adds in trunk

Mostly fix Mac CMake build
​https://bugs.webkit.org/show_bug.cgi?id=230868

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-09-28
Reviewed by Don Olmstead.

Source/JavaScriptCore:

• shell/PlatformMac.cmake:

Source/ThirdParty/ANGLE:

• Compiler.cmake:
• Metal.cmake:

Source/ThirdParty/libwebrtc:

• CMakeLists.txt:

Source/WebCore:

• PlatformMac.cmake:
• platform/graphics/cg/ImageBufferUtilitiesCG.cpp:

(WebCore::encode):

Source/WebCore/PAL:

• pal/PlatformMac.cmake:

Source/WebKit:

• PlatformMac.cmake:

Source/WebKitLegacy:

• PlatformMac.cmake:

Source/WTF:

• wtf/PlatformMac.cmake:

Tools:

• DumpRenderTree/PlatformMac.cmake:
• DumpRenderTree/TestNetscapePlugIn/PlatformMac.cmake: Added.
• TestRunnerShared/PlatformMac.cmake: Added.

9:20 AM Changeset in webkit [283173] by youenn@apple.com

• 4 edits
  2 adds in trunk

applyConstraints throws OverconstrainedError if specify exact for deviceId
​https://bugs.webkit.org/show_bug.cgi?id=230819
<rdar://problem/83577361>

Reviewed by Eric Carlson.

Source/WebKit:

We were not setting properly the persistent device ID of remote sources.
Set values according provided device.

Test: fast/mediastream/applyConstraints-deviceId.html

• WebProcess/cocoa/RemoteRealtimeAudioSource.cpp:

(WebKit::RemoteRealtimeAudioSource::RemoteRealtimeAudioSource):

• WebProcess/cocoa/RemoteRealtimeVideoSource.cpp:

(WebKit::RemoteRealtimeVideoSource::RemoteRealtimeVideoSource):

LayoutTests:

• fast/mediastream/applyConstraints-deviceId-expected.txt: Added.
• fast/mediastream/applyConstraints-deviceId.html: Added.

9:17 AM Changeset in webkit [283172] by youenn@apple.com

• 2 edits in trunk/Tools

REGRESSION (r283102): [ MacOS Debug ] TestWebKitAPI.WebKit2.CaptureIndicatorDelay is failing
​https://bugs.webkit.org/show_bug.cgi?id=230847
<rdar://problem/83577251>

Reviewed by Saam Barati.

As identified by Saam, the promise resolution callback is racing with the stop function.
To prevent this, we check in a loop whether the page has a stream and call stop when that is the case.

• TestWebKitAPI/Tests/WebKit/GetUserMedia.mm:

(TestWebKitAPI::TEST):

• TestWebKitAPI/Tests/WebKit/getUserMedia.html:

9:09 AM Changeset in webkit [283171] by commit-queue@webkit.org

• 5 edits in trunk/Source/WebCore

Fix build with non-internal Monterey SDK
​https://bugs.webkit.org/show_bug.cgi?id=230872

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-09-28
Reviewed by Jonathan Bedard.

Source/WebCore:

• platform/mac/PlatformSpeechSynthesizerMac.mm:

(WebCore::speechSynthesisGetDefaultVoiceIdentifierForLocale):

Source/WebCore/PAL:

• pal/spi/cocoa/PassKitSPI.h:
• pal/spi/mac/SystemPreviewSPI.h:

8:40 AM Changeset in webkit [283170] by Antti Koivisto

• 14 edits
  4 adds in trunk

[CSS Cascade Layers] Add CSSOM interface
​https://bugs.webkit.org/show_bug.cgi?id=230882

Reviewed by Simon Fraser.

LayoutTests/imported/w3c:

• web-platform-tests/css/css-cascade/parsing/layer-expected.txt: Added.

Source/WebCore:

Add a minimal CSSLayerRule interface. This is yet unspecified (​https://github.com/w3c/csswg-drafts/issues/6576)
but the final version likely won't differ much or at all. This also matches Firefox.

This makes parsing and serialization WPT tests work.

• DerivedSources-input.xcfilelist:
• DerivedSources-output.xcfilelist:
• DerivedSources.make:
• Sources.txt:
• WebCore.xcodeproj/project.pbxproj:
• css/CSSLayerRule.cpp: Added.

(WebCore::CSSLayerRule::CSSLayerRule):
(WebCore::CSSLayerRule::create):
(WebCore::CSSLayerRule::cssText const):

The only available functionality is getting the cssText.

• css/CSSLayerRule.h: Added.
• css/CSSLayerRule.idl: Added.
• css/CSSRule.h:
• css/StyleRule.cpp:

(WebCore::StyleRuleBase::createCSSOMWrapper const):

Make the wrapper.

• css/StyleRuleType.h:

Update the type constant to match Firefox (this is not specified).

• css/StyleSheetContents.cpp:

(WebCore::StyleSheetContents::wrapperInsertRule):

Remember the return after succesful insert.

LayoutTests:

• TestExpectations:

8:36 AM Changeset in webkit [283169] by Philippe Normand

• 7 edits in trunk/Tools/buildstream

[Flatpak SDK] Update libsoup3 and friends
​https://bugs.webkit.org/show_bug.cgi?id=230891

Reviewed by Michael Catanzaro.

• elements/sdk/glib.bst: Bump to 2.70, the most recent stable version.
• elements/sdk/libsoup3.bst: Bump to 3.0.0.
• elements/sdk/rr.bst: Drive-by update to latest master.
• elements/sdk/wpebackend-fdo.bst: Update to 1.10.0.

8:32 AM Changeset in webkit [283168] by sbarati@apple.com

• 15 edits in trunk/Source/JavaScriptCore

Make byte codes with arithmetic profiles switch to using an index instead of a pointer in metadata
​https://bugs.webkit.org/show_bug.cgi?id=230798

Reviewed by Yusuke Suzuki.

This patch makes each bytecode that uses a BinaryArithProfile/UnaryArithProfile
have an index into a table instead of storing a pointer to the profile in its metadata.
Then, we can just load the profile using the index in the bytecode, which saves memory.

• bytecode/BytecodeList.rb:
• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::binaryArithProfileForPC):
(JSC::CodeBlock::unaryArithProfileForPC):

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::allocateSharedProfiles):

• bytecode/UnlinkedCodeBlock.h:
• bytecode/UnlinkedCodeBlockGenerator.cpp:

(JSC::UnlinkedCodeBlockGenerator::finalize):

• bytecode/UnlinkedCodeBlockGenerator.h:

(JSC::UnlinkedCodeBlockGenerator::addBinaryArithProfile):
(JSC::UnlinkedCodeBlockGenerator::addUnaryArithProfile):

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitUnaryOp):
(JSC::BytecodeGenerator::emitInc):
(JSC::BytecodeGenerator::emitDec):

• bytecompiler/BytecodeGenerator.h:
• jit/JITArithmetic.cpp:

(JSC::JIT::emit_op_negate):
(JSC::JIT::emit_op_add):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emit_op_sub):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/CommonSlowPaths.cpp:

(JSC::updateArithProfileForUnaryArithOp):
(JSC::JSC_DEFINE_COMMON_SLOW_PATH):

6:37 AM Changeset in webkit [283167] by Alexey Shvayka

• 3 edits
  3 adds in trunk

Speed up setting JSFunction's "prototype" property
​https://bugs.webkit.org/show_bug.cgi?id=230864

Reviewed by Yusuke Suzuki.

JSTests:

• microbenchmarks/class-creation.js: Added.
• microbenchmarks/function-prototype-put-non-reified.js: Added.
• microbenchmarks/function-prototype-put-reified.js: Added.

Source/JavaScriptCore:

This patch:

1. Removes "prototype" lookup from put(), which was non-inlineable and created an interim object with "constructor" field. Instead, the new value is put directly, with correct attributes, and respecting an altered receiver. This results in 2.8X perf boost for very common case of setting "prototype": Cat.prototype = new Animal.

2. Simplifies initialization of class constructor's prototype object, removing tentacles from getOwnPropertySlot() and extracting constructPrototypeObject() helper. Provides a fast path for op_define_data_property, speeding up class creation by ~40%, while reifies normal function's prototype with correct attributes for Object.defineProperty().

• runtime/JSFunction.cpp:

(JSC::constructPrototypeObject):
(JSC::JSFunction::getOwnPropertySlot):
(JSC::JSFunction::put):
(JSC::JSFunction::defineOwnProperty):

6:21 AM Changeset in webkit [283166] by Fujii Hironori

• 2 edits in trunk/Source/WebCore

Unreviewed, reverting r283136.

An assertion failure for WinCairo Debug

Reverted changeset:

"[Curl] Set CURL_LOCK_DATA_SSL_SESSION option to reduce
SSL/TLS handshake time"
​https://bugs.webkit.org/show_bug.cgi?id=230818
​https://commits.webkit.org/r283136

5:55 AM Changeset in webkit [283165] by Antti Koivisto

• 2 edits in trunk/Source/WebCore

REGRESSION(r283158): TestWebKitAPI.WebKit.AddAndRemoveDataDetectors is crashing on iOS
​https://bugs.webkit.org/show_bug.cgi?id=230890

Unreviewed.

• editing/cocoa/DataDetection.mm:

(WebCore::DataDetection::detectContentInRange):

Scope TextIterator so it is not in stack when DOM is being mutated.

5:44 AM Changeset in webkit [283164] by commit-queue@webkit.org

• 2 edits in trunk/Tools

Fix rounding issue in run-jsc-stress-tests
​https://bugs.webkit.org/show_bug.cgi?id=230889

Patch by Geza Lore <​gezalore@gmail.com> on 2021-09-28
Reviewed by Adrian Perez de Castro.

• Scripts/run-jsc-stress-tests:

3:29 AM Changeset in webkit [283163] by ysuzuki@apple.com

• 2 edits in trunk/Source/WTF

Unreviewed, fix Windows build
​https://bugs.webkit.org/show_bug.cgi?id=230876

• wtf/GenericTimeMixin.h:

(WTF::GenericTimeMixin::operator+=):
(WTF::GenericTimeMixin::operator-=):

3:15 AM Changeset in webkit [283162] by Antti Koivisto

• 7 edits
  3 copies
  31 adds
  10 deletes in trunk/LayoutTests

[CSS Cascade Layers] Import more WPT tests
​https://bugs.webkit.org/show_bug.cgi?id=230883

Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

Import new tests.

• resources/import-expectations.json:
• web-platform-tests/css/css-cascade/layer-counter-style-override-expected.txt: Added.
• web-platform-tests/css/css-cascade/layer-counter-style-override.html: Added.
• web-platform-tests/css/css-cascade/layer-font-face-override-expected.txt: Added.
• web-platform-tests/css/css-cascade/layer-font-face-override.html: Added.
• web-platform-tests/css/css-cascade/layer-keyframes-override-expected.txt: Added.
• web-platform-tests/css/css-cascade/layer-keyframes-override.html: Added.
• web-platform-tests/css/css-cascade/layer-property-override-expected.txt: Added.
• web-platform-tests/css/css-cascade/layer-property-override.html: Added.
• web-platform-tests/css/css-cascade/layer-scroll-timeline-override-expected.txt: Added.
• web-platform-tests/css/css-cascade/layer-scroll-timeline-override.html: Added.
• web-platform-tests/css/css-cascade/layer-stylesheet-sharing-expected.html: Added.
• web-platform-tests/css/css-cascade/layer-stylesheet-sharing.html: Added.
• web-platform-tests/css/css-cascade/layer-vs-inline-style-expected.txt: Added.
• web-platform-tests/css/css-cascade/layer-vs-inline-style.html: Added.
• web-platform-tests/css/css-cascade/parsing/layer.html: Added.
• web-platform-tests/css/css-cascade/parsing/w3c-import.log:
• web-platform-tests/css/css-cascade/presentational-hints-cascade-expected.txt: Added.
• web-platform-tests/css/css-cascade/presentational-hints-cascade.html: Added.
• web-platform-tests/css/css-cascade/w3c-import.log:
• web-platform-tests/css/support/parsing-testcommon.js:
• web-platform-tests/fonts/OWNERS: Removed.
• web-platform-tests/fonts/math/fraction-denominatordisplaystyleshiftdown6000-rulethickness1000.woff: Removed.
• web-platform-tests/fonts/math/fraction-denominatorshiftdown3000-rulethickness1000.woff: Removed.
• web-platform-tests/fonts/math/fraction-numeratordisplaystyleshiftup2000-rulethickness1000.woff: Removed.
• web-platform-tests/fonts/math/fraction-numeratorshiftup11000-rulethickness1000.woff: Removed.
• web-platform-tests/fonts/math/stack-axisheight7000.woff: Removed.
• web-platform-tests/fonts/math/stack-bottomdisplaystyleshiftdown5000.woff: Removed.
• web-platform-tests/fonts/math/stack-bottomshiftdown6000.woff: Removed.
• web-platform-tests/fonts/math/stack-topdisplaystyleshiftup3000.woff: Removed.
• web-platform-tests/fonts/math/stack-topshiftup9000.woff: Removed.
• web-platform-tests/fonts/noto/NotoNaskhArabic-regular.woff2: Added.
• web-platform-tests/fonts/noto/NotoSansAdlam-hinted/LICENSE_OFL.txt: Added.
• web-platform-tests/fonts/noto/NotoSansAdlam-hinted/NotoSansAdlam-Regular.ttf: Added.
• web-platform-tests/fonts/noto/NotoSansAdlam-hinted/README: Added.
• web-platform-tests/fonts/noto/NotoSansAdlam-hinted/w3c-import.log: Copied from LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/parsing/w3c-import.log.
• web-platform-tests/fonts/noto/NotoSansCypriot-hinted/LICENSE_OFL.txt: Added.
• web-platform-tests/fonts/noto/NotoSansCypriot-hinted/NotoSansCypriot-Regular.ttf: Added.
• web-platform-tests/fonts/noto/NotoSansCypriot-hinted/README: Added.
• web-platform-tests/fonts/noto/NotoSansCypriot-hinted/w3c-import.log: Copied from LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/parsing/w3c-import.log.
• web-platform-tests/fonts/noto/NotoSansDeseret-Regular.ttf: Added.
• web-platform-tests/fonts/noto/NotoSansMongolian-regular.woff2: Added.
• web-platform-tests/fonts/noto/NotoSansNko-regular-webfont.woff2: Added.
• web-platform-tests/fonts/noto/noto-sans-v8-latin-regular.woff: Added.
• web-platform-tests/fonts/noto/w3c-import.log: Copied from LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/parsing/w3c-import.log.

LayoutTests:

• TestExpectations:

2:49 AM Changeset in webkit [283161] by ysuzuki@apple.com

• 17 edits
  1 copy
  5 adds in trunk

[WTF] Add ApproximateTime
​https://bugs.webkit.org/show_bug.cgi?id=230876

Reviewed by Filip Pizlo.

JSTests:

• microbenchmarks/approximate-time-now.js: Added.
• microbenchmarks/monotonic-time-now.js: Added.
• microbenchmarks/wall-time-now.js: Added.

Source/JavaScriptCore:

This patch adds ApproximateTime, which offers monotonically increasing time but with coarse-grained resolution.
ApproximateTime::now() is faster than normal MonotonicTime::now(), so that we can use this when we do not care
about high resolution. For example, in Darwin x64, it is ~4x faster.
Internally, it is using mach_approximate_time() in Darwin, clock_gettime+CLOCK_MONOTONIC_COARSE in Linux, and
clock_gettime+CLOCK_MONOTONIC_FAST in FreeBSD. On the other platforms, we simply use the same source to MonotonicTime.

wall-time-now 102.2614+-0.2449
approximate-time-now 23.2583+-0.4083
monotonic-time-now 88.8518+-2.4106

We would like to use it in some places in JavaScriptCore in a subsequent patch: CodeBlock's creation time, GC time etc.

• tools/JSDollarVM.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::JSDollarVM::finishCreation):

Source/WTF:

• WTF.xcodeproj/project.pbxproj:
• wtf/ApproximateTime.cpp: Copied from Source/WTF/wtf/ClockType.cpp.

(WTF::ApproximateTime::approximateWallTime const):
(WTF::ApproximateTime::approximateMonotonicTime const):
(WTF::ApproximateTime::dump const):

• wtf/ApproximateTime.h: Copied from Source/WTF/wtf/MonotonicTime.h.

(WTF::ApproximateTime::MarkableTraits::isEmptyValue):
(WTF::ApproximateTime::MarkableTraits::emptyValue):
(std::isnan):
(std::isinf):
(std::isfinite):

• wtf/CMakeLists.txt:
• wtf/ClockType.cpp:

(WTF::printInternal):

• wtf/ClockType.h:
• wtf/CurrentTime.cpp:

(WTF::MonotonicTime::fromMachAbsoluteTime):
(WTF::MonotonicTime::toMachAbsoluteTime const):
(WTF::ApproximateTime::fromMachApproximateTime):
(WTF::ApproximateTime::toMachApproximateTime const):
(WTF::ApproximateTime::now):

• wtf/MonotonicTime.h:
• wtf/Seconds.cpp:

(WTF::Seconds::operator+ const):
(WTF::Seconds::operator- const):

• wtf/Seconds.h:
• wtf/TimeWithDynamicClockType.cpp:

(WTF::TimeWithDynamicClockType::now):
(WTF::TimeWithDynamicClockType::approximateTime const):
(WTF::TimeWithDynamicClockType::approximateWallTime const):
(WTF::TimeWithDynamicClockType::approximateMonotonicTime const):

• wtf/TimeWithDynamicClockType.h:
• wtf/WallTime.h:

Tools:

• TestWebKitAPI/Tests/WTF/Time.cpp:

(WTF::operator<<):
(TestWebKitAPI::TEST):

2:39 AM Changeset in webkit [283160] by Alexey Shvayka

• 2 edits in trunk/Source/JavaScriptCore

Tweak isCallable() to early return true for InternalFunction instances
​https://bugs.webkit.org/show_bug.cgi?id=230869

Reviewed by Yusuke Suzuki.

With this change, isCallable() avoids calling into InternalFunction::getCallData(),
which is concurrency-aware and guaranteed to never return CallData::Type::None.
We have a similar optimization for JSFunction.

• runtime/JSCellInlines.h:

(JSC::JSCell::isCallableWithConcurrency):

Sep 27, 2021:

11:45 PM Changeset in webkit [283159] by mmaxfield@apple.com

• 22 edits
  2 moves in trunk

override-color has been renamed to override-colors
​https://bugs.webkit.org/show_bug.cgi?id=230789
<rdar://problem/83529354>

Reviewed by Devin Rousso.

LayoutTests/imported/w3c:

This is being upstreamed in ​https://github.com/web-platform-tests/wpt/pull/30962.

• web-platform-tests/css/css-fonts/font-palette-modify-2-expected.html:
• web-platform-tests/css/css-fonts/font-palette-modify-2.html:
• web-platform-tests/css/css-fonts/font-palette-modify-expected-mismatch.html:
• web-platform-tests/css/css-fonts/font-palette-modify.html:
• web-platform-tests/css/css-fonts/font-palette.html:
• web-platform-tests/css/css-fonts/parsing/font-palette-values-invalid.html:
• web-platform-tests/css/css-fonts/parsing/font-palette-values-valid.html:

Source/WebCore:

The spec was changed in
​https://github.com/w3c/csswg-drafts/commit/9de250d6692d07ddb8af3e3face37b909e5aad7b.
No browser has shipped the old name, so this is just a mechanical find/replace.

Updated existing tests.

• Sources.txt:
• WebCore.xcodeproj/project.pbxproj:
• css/CSSComputedStyleDeclaration.cpp:

(WebCore::ComputedStyleExtractor::valueForPropertyInStyle):

• css/CSSFontPaletteValuesOverrideColorsValue.cpp: Renamed from Source/WebCore/css/CSSFontPaletteValuesOverrideColorValue.cpp.

(WebCore::CSSFontPaletteValuesOverrideColorsValue::customCSSText const):
(WebCore::CSSFontPaletteValuesOverrideColorsValue::equals const):

• css/CSSFontPaletteValuesOverrideColorsValue.h: Renamed from Source/WebCore/css/CSSFontPaletteValuesOverrideColorValue.h.
• css/CSSFontPaletteValuesRule.cpp:

(WebCore::CSSFontPaletteValuesRule::initializeMapLike):
(WebCore::CSSFontPaletteValuesRule::cssText const):

• css/CSSProperties.json:
• css/CSSValue.cpp:

(WebCore::CSSValue::equals const):
(WebCore::CSSValue::cssText const):
(WebCore::CSSValue::destroy):

• css/CSSValue.h:

(WebCore::CSSValue::isFontPaletteValuesOverrideColorsValue const):
(WebCore::CSSValue::isFontPaletteValuesOverrideColorValue const): Deleted.

• css/StyleRule.cpp:

(WebCore::StyleRuleFontPaletteValues::StyleRuleFontPaletteValues):

• css/StyleRule.h:
• css/parser/CSSParserImpl.cpp:

(WebCore::CSSParserImpl::consumeFontPaletteValuesRule):

• css/parser/CSSPropertyParser.cpp:

(WebCore::consumeOverrideColorsDescriptor):
(WebCore::CSSPropertyParser::parseFontPaletteValuesDescriptor):
(WebCore::consumeOverrideColorDescriptor): Deleted.

• platform/graphics/FontPaletteValues.h:

(WebCore::FontPaletteValues::FontPaletteValues):
(WebCore::FontPaletteValues::overrideColors const):
(WebCore::FontPaletteValues::operator== const):
(WebCore::add):
(WebCore::FontPaletteValues::overrideColor const): Deleted.

• platform/graphics/cocoa/FontCacheCoreText.cpp:

(WebCore::addAttributesForFontPalettes):

10:24 PM Changeset in webkit [283158] by Antti Koivisto

• 31 edits in trunk/Source

[LFC] Use CheckedRef/Ptr instead of WeakPtr
​https://bugs.webkit.org/show_bug.cgi?id=230821

Reviewed by Alan Bujtas.

Source/WebCore:

WeakPtrs are used for layout boxes for safety only. Replace with simpler, faster CheckedPtr.

• display/DisplayTreeBuilder.cpp:

(WebCore::Display::TreeBuilder::build):

• editing/TextManipulationController.cpp:

(WebCore::TextManipulationController::replace):

This was leaving a text iterator in stack while mutating the render tree.

• layout/FormattingState.h:

(WebCore::Layout::FormattingState::addOutOfFlowBox):

• layout/LayoutState.cpp:

(WebCore::Layout::LayoutState::LayoutState):
(WebCore::Layout::LayoutState::formattingStateForFormattingContext const):
(WebCore::Layout::LayoutState::formattingStateForInlineFormattingContext const):
(WebCore::Layout::LayoutState::ensureInlineFormattingState):

• layout/LayoutState.h:

(WebCore::Layout::LayoutState::root const):
(WebCore::Layout::LayoutState::hasRoot const): Deleted.

• layout/floats/FloatAvoider.h:
• layout/floats/FloatingState.cpp:

(WebCore::Layout::FloatingState::FloatItem::FloatItem):
(WebCore::Layout::FloatingState::FloatingState):

• layout/floats/FloatingState.h:

(WebCore::Layout::FloatingState::root const):

• layout/formattingContexts/FormattingContext.cpp:

(WebCore::Layout::FormattingContext::FormattingContext):
(WebCore::Layout::FormattingContext::layoutOutOfFlowContent):

• layout/formattingContexts/FormattingContext.h:

(WebCore::Layout::FormattingContext::root const):

• layout/formattingContexts/block/BlockFormattingState.h:
• layout/formattingContexts/inline/InlineFormattingContext.cpp:

(WebCore::Layout::InlineFormattingContext::computeStaticPositionForOutOfFlowContent):

• layout/formattingContexts/inline/InlineLevelBox.h:

(WebCore::Layout::InlineLevelBox::layoutBox const):
(WebCore::Layout::InlineLevelBox::InlineLevelBox):

• layout/formattingContexts/inline/InlineLineBox.h:
• layout/formattingContexts/inline/display/InlineDisplayBox.h:

(WebCore::InlineDisplay::Box::layoutBox const):
(WebCore::InlineDisplay::Box::Box):

• layout/formattingContexts/table/TableGrid.cpp:

(WebCore::Layout::TableGrid::Column::Column):
(WebCore::Layout::TableGrid::Row::Row):
(WebCore::Layout::TableGrid::Cell::Cell):

• layout/formattingContexts/table/TableGrid.h:

(WebCore::Layout::TableGrid::Row::box const):

• layout/integration/LayoutIntegrationBoxTree.cpp:

(WebCore::LayoutIntegration::BoxTree::buildTree):
(WebCore::LayoutIntegration::BoxTree::appendChild):
(WebCore::LayoutIntegration::BoxTree::layoutBoxForRenderer):
(WebCore::LayoutIntegration::BoxTree::rendererForLayoutBox):

• layout/integration/LayoutIntegrationBoxTree.h:
• layout/integration/LayoutIntegrationInlineContent.cpp:

(WebCore::LayoutIntegration::InlineContent::InlineContent):
(WebCore::LayoutIntegration::InlineContent::rendererForLayoutBox const):
(WebCore::LayoutIntegration::InlineContent::containingBlock const):
(WebCore::LayoutIntegration::InlineContent::lineLayout const): Deleted.

• layout/integration/LayoutIntegrationInlineContent.h:

(WebCore::LayoutIntegration::InlineContent::lineLayout const):

• layout/integration/LayoutIntegrationLineLayout.cpp:

(WebCore::LayoutIntegration::LineLayout::constructContent):

• layout/integration/LayoutIntegrationLineLayout.h:
• layout/layouttree/LayoutBox.cpp:

(WebCore::Layout::Box::setCachedGeometryForLayoutState const):

• layout/layouttree/LayoutBox.h:
• layout/layouttree/LayoutReplacedBox.h:
• layout/layouttree/LayoutTreeBuilder.h:

Source/WTF:

• wtf/CheckedRef.h:

(WTF::CanMakeCheckedPtrBase::incrementPtrCount const):
(WTF::CanMakeCheckedPtrBase::decrementPtrCount const):
(WTF::CanMakeCheckedPtrBase::incrementPtrCount): Deleted.
(WTF::CanMakeCheckedPtrBase::decrementPtrCount): Deleted.

Make const so CheckedPtr<const Foo> works.

10:17 PM Changeset in webkit [283157] by Cameron McCormack

• 2 edits in trunk/Source/WebKit

Avoid building log messages when IPCMessages log stream is off
​https://bugs.webkit.org/show_bug.cgi?id=230878
<rdar://problem/83605670>

Reviewed by Alex Christensen.

• Platform/IPC/HandleMessage.h:

(IPC::logMessageImpl):

5:49 PM Changeset in webkit [283156] by Jean-Yves Avenard

• 5 edits in trunk/Source

Vorbis decoder can't be instantiated - Remove workaround added in bug 228139
​https://bugs.webkit.org/show_bug.cgi?id=230742
rdar://83484414

Reviewed by Eric Carlson.

Source/WebKit:

This is already covered by test; however this will fail on Monterey without the updated
CoreMedia framework.

• Scripts/process-entitlements.sh: Add new required entitlement.
• WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::initializeSandbox): Only have bug workaround on BigSur and earlier.

Source/WTF:

• wtf/PlatformUse.h: Add USE_VORBIS_AUDIOCOMPONENT_WORKAROUND

5:16 PM Changeset in webkit [283155] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina BigSur wk2 ] imported/w3c/web-platform-tests/mediacapture-streams/MediaStream-default-feature-policy.https.html is a flaky failure and crash.
​https://bugs.webkit.org/show_bug.cgi?id=230866.

Unreviewed test gardening.

• platform/mac-wk2/TestExpectations:

4:53 PM ApplePlansForWebKit2022Edition edited by Jon Davis

(diff)

4:44 PM Changeset in webkit [283154] by mmaxfield@apple.com

• 2 edits in trunk/LayoutTests/imported/w3c

Add test to make sure CSSFontPaletteValuesRule's attributes are readonly
​https://bugs.webkit.org/show_bug.cgi?id=230791
<rdar://problem/83530165>

Reviewed by Simon Fraser.

The spec enforces this in w3c/csswg-drafts@9ddf938. This is already the case in WebKit.

This is being upstreamed in ​https://github.com/web-platform-tests/wpt/pull/30964.

• web-platform-tests/css/css-fonts/parsing/font-palette-values-invalid.html:

4:44 PM OffscreenCanvas2021Update edited by Jon Davis

(diff)

4:42 PM GitHubandNewProcesses edited by Jon Davis

(diff)

4:41 PM ProtectedCollaborationTree edited by Jon Davis

(diff)

4:40 PM ProtectedCollaborationTree edited by Jon Davis

(diff)

4:39 PM ProtectedCollaborationTree edited by Jon Davis

(diff)

4:37 PM GPUProcess2021 created by Jon Davis

4:37 PM IntroductiontoLFC created by Jon Davis

4:36 PM WPTUpdate created by Jon Davis

4:34 PM September 2021 Meeting edited by Jon Davis

Schedule changes. (diff)

4:33 PM Changeset in webkit [283153] by Dewei Zhu

• 4 edits in trunk/Websites/perf.webkit.org

Summary page should support calculating summary using weighted mean.
​https://bugs.webkit.org/show_bug.cgi?id=230810

Reviewed by Ryosuke Niwa.

Add a way to specify weight for a platform or (plafform, metric) which will be used while calculating a summary.

• public/shared/statistics.js: Added 'weightedMean' function.

(Statistics.new.this.weightedMean):

• public/v3/pages/summary-page.js: Added support for specifying a weight for platform or (platform, metric).

(SummaryPage):
(SummaryPage.prototype._createConfigurationGroup):
(SummaryPageConfigurationGroup):

• unit-tests/statistics-tests.js: Added unit tests.

4:25 PM September 2021 Meeting edited by Jon Davis

(diff)

4:05 PM Changeset in webkit [283152] by Alan Coon

• 1 copy in tags/Safari-612.2.8

Tag Safari-612.2.8.

4:05 PM Changeset in webkit [283151] by Alan Coon

• 1 delete in tags/Safari-612.2.8

Delete tag.

3:51 PM Changeset in webkit [283150] by Eric Hutchison

• 3 edits in trunk/LayoutTests

[BigSur wk2 Debug iOS14 ] webrtc/video-mute.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=230865.

Unreviewed test gardening.

• platform/ios-14-wk2/TestExpectations:
• platform/mac-wk2/TestExpectations:

3:50 PM Changeset in webkit [283149] by Alan Coon

• 1 copy in tags/Safari-612.2.8

Tag Safari-612.2.8.

3:49 PM Changeset in webkit [283148] by Alan Coon

• 30 edits
  2 adds in branches/safari-612-branch

Cherry-pick r283098. rdar://problem/83584491

[JSC] Optimize PutByVal with for-in
​https://bugs.webkit.org/show_bug.cgi?id=230801

Reviewed by Saam Barati.

JSTests:

• stress/for-in-sentinel.js: Added. (shouldBe): (test):

Source/JavaScriptCore:

We found that some of Speedometer2 subtests are heavily using for-in with PutByVal or the other DFG nodes.
And we also found that we are using polluted non-good type for the property names from for-in: String | Other.
The reason is that we are returning null when op_enumerator_next finishes instead of string. And this design
forces DFG and FTL to return null from EnumeratorNextUpdatePropertyName at the end of iteration. This pollutes
the type of property names as String | Other instead of String, and leading to suboptimal DFG nodes.

In this patch, we add special sentinel string in vm.smallString.sentinelString(). We know that this string cell
pointer will be never returned from EnumeratorNextUpdatePropertyName in the normal for-in iteration. This is easy
since we are always allocating a JSString when creating JSPropertyNameEnumerator. So this string cell (not the content)
is always different from pre-allocated vm.smallString.sentinelString(). So, we use this special string pointer
as a sentinel instead of null so that we can avoid polluting return type of EnumeratorNextUpdatePropertyName.

To check the sentinel in LLInt / Baseline, this patch adds jeq_ptr, which performs cell pointer comparison and do
not check string content equality. We do not need to have an implementation in DFG since we already have CompareEqPtr
for existing jneq_ptr bytecode.

We also clean up DFG operation related to PutByVal.

----------------------------------------------------------------------------------------------------------------------------------
| subtest | ms | ms | b / a | pValue (significance using False Discovery Rate) |
----------------------------------------------------------------------------------------------------------------------------------
| Elm-TodoMVC |116.010000 |112.701667 |0.971482 | 0.000000 (significant) |
| VueJS-TodoMVC |22.995000 |23.023333 |1.001232 | 0.907086 |
| EmberJS-TodoMVC |125.498333 |125.525000 |1.000212 | 0.932546 |
| BackboneJS-TodoMVC |45.700000 |45.975000 |1.006018 | 0.084799 |
| Preact-TodoMVC |16.681667 |16.610000 |0.995704 | 0.722758 |
| AngularJS-TodoMVC |123.753333 |123.740000 |0.999892 | 0.971431 |
| Vanilla-ES2015-TodoMVC |61.255000 |61.380000 |1.002041 | 0.300654 |
| Inferno-TodoMVC |58.646667 |58.948333 |1.005144 | 0.267611 |
| Flight-TodoMVC |73.283333 |72.801667 |0.993427 | 0.207389 |
| Angular2-TypeScript-TodoMVC |39.746667 |40.015000 |1.006751 | 0.449821 |
| VanillaJS-TodoMVC |50.096667 |49.823333 |0.994544 | 0.162020 |
| jQuery-TodoMVC |212.870000 |213.196667 |1.001535 | 0.371944 |
| EmberJS-Debug-TodoMVC |331.878333 |332.710000 |1.002506 | 0.094499 |
| React-TodoMVC |83.078333 |82.726667 |0.995767 | 0.076143 |
| React-Redux-TodoMVC |136.018333 |133.935000 |0.984683 | 0.000000 (significant) |
| Vanilla-ES2015-Babel-Webpack-TodoMVC |59.743333 |59.643333 |0.998326 | 0.393671 |
----------------------------------------------------------------------------------------------------------------------------------
a mean = 271.75873
b mean = 272.45804
pValue = 0.0263030803
(Bigger means are better.)
1.003 times better
Results ARE significant

• builtins/BuiltinNames.h:
• bytecode/BytecodeList.rb:
• bytecode/BytecodeUseDef.cpp: (JSC::computeUsesForBytecodeIndexImpl): (JSC::computeDefsForBytecodeIndexImpl):
• bytecode/LinkTimeConstant.h:
• bytecode/Opcode.h: (JSC::isBranch):
• bytecode/PreciseJumpTargetsInlines.h:
• bytecompiler/BytecodeGenerator.cpp: (JSC::GenericLabel<JSGeneratorTraits>::setLocation): (JSC::BytecodeGenerator::emitJumpIfSentinelString):
• bytecompiler/BytecodeGenerator.h:
• bytecompiler/NodesCodegen.cpp: (JSC::ForInNode::emitBytecode):
• dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
• dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::parseBlock):
• dfg/DFGCapabilities.cpp: (JSC::DFG::capabilityLevel):
• dfg/DFGOperations.cpp: (JSC::DFG::putByVal): (JSC::DFG::putByValInternal): (JSC::DFG::putByValCellInternal): (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
• dfg/DFGOperations.h:
• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdatePropertyName):
• ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
• jit/JIT.cpp: (JSC::JIT::privateCompileMainPass):
• jit/JIT.h:
• jit/JITOpcodes.cpp: (JSC::JIT::emit_op_jeq_ptr):
• jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_jeq_ptr):
• jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_enumerator_next):
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/CommonSlowPaths.cpp: (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
• runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init):
• runtime/SmallStrings.cpp: (JSC::SmallStrings::initializeCommonStrings): (JSC::SmallStrings::visitStrongReferences):
• runtime/SmallStrings.h: (JSC::SmallStrings::sentinelString const):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@283098 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:49 PM Changeset in webkit [283147] by Alan Coon

• 4 edits in branches/safari-612-branch/Source/WebKit

Cherry-pick r283081. rdar://problem/83584464

Pending preconnect key should include User-Agent
​https://bugs.webkit.org/show_bug.cgi?id=230565

Reviewed by Chris Dumez.

When using an HTTPS proxy, the HTTP connection cache key used for connection coalescing in
CFNetwork includes the User-Agent (<rdar://problem/59434166>). This means we should also
include it in the preconnect cache key. Otherwise, we might delay the main resource load on
preconnect unnecessarily in cases where the User-Agent mismatches and the preconnect gets
thrown away. This can happen if (for instance) a page is force-loaded into desktop or mobile
mode on iOS, which causes a UA change after the call to decidePolicyForNavigationAction.

• NetworkProcess/NetworkLoadScheduler.cpp: (WebKit::mainResourceLoadKey): (WebKit::NetworkLoadScheduler::scheduleMainResourceLoad): (WebKit::NetworkLoadScheduler::unscheduleMainResourceLoad): (WebKit::NetworkLoadScheduler::startedPreconnectForMainResource): (WebKit::NetworkLoadScheduler::finishedPreconnectForMainResource):
• NetworkProcess/NetworkLoadScheduler.h:
• NetworkProcess/NetworkProcess.cpp: (WebKit::NetworkProcess::preconnectTo):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@283081 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:49 PM Changeset in webkit [283146] by Alan Coon

• 17 edits
  6 adds in branches/safari-612-branch

Cherry-pick r283035. rdar://problem/83584492

<video> element rendered incorrectly when provided with a portrait orientation stream in Safari 15
​https://bugs.webkit.org/show_bug.cgi?id=229792
<rdar://problem/82776741>

Reviewed by Eric Carlson.

Source/WebCore:

We need to swap the bounds for both m_rootLayer and m_sampleBufferDisplayLayer if the sample is rotated by 90.
We also need to ompute m_sampleBufferDisplayLayer position based on m_rootLayer coordinates.
This means we swap root layer bounds width and height before computing m_sampleBufferDisplayLayer position based on it.

Test: fast/mediastream/video-rotation.html

• platform/graphics/avfoundation/objc/LocalSampleBufferDisplayLayer.h:
• platform/graphics/avfoundation/objc/LocalSampleBufferDisplayLayer.mm: (WebCore::LocalSampleBufferDisplayLayer::setRootLayerBoundsAndPositions): (WebCore::LocalSampleBufferDisplayLayer::updateRootLayerBoundsAndPosition):
• platform/graphics/cg/ImageBufferUtilitiesCG.h:

Source/WebKit:

Helper routined used in WTR.

• Shared/API/c/cg/WKImageCG.cpp: (WKImageCreateDataURLFromImage):
• Shared/API/c/cg/WKImageCG.h:

Tools:

Add testRunner API to take a view port snapshot as a PNG data URL.
We can then use this data URL to validate some rendered pixel values.

• WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
• WebKitTestRunner/InjectedBundle/InjectedBundle.cpp: (WTR::InjectedBundle::didReceiveMessageToPage):
• WebKitTestRunner/InjectedBundle/TestRunner.cpp: (WTR::TestRunner::takeViewPortSnapshot): (WTR::TestRunner::viewPortSnapshotTaken):
• WebKitTestRunner/InjectedBundle/TestRunner.h:
• WebKitTestRunner/TestController.cpp: (WTR::TestController::takeViewPortSnapshot):
• WebKitTestRunner/TestController.h:
• WebKitTestRunner/TestInvocation.cpp: (WTR::TestInvocation::didReceiveMessageFromInjectedBundle):
• WebKitTestRunner/cocoa/TestControllerCocoa.mm: (WTR::TestController::takeViewPortSnapshot):

LayoutTests:

• fast/mediastream/video-rotation-expected.txt: Added.
• fast/mediastream/video-rotation.html: Added.
• platform/ios-simulator/fast/mediastream/video-rotation-expected.png: Added.
• platform/mac/fast/mediastream/video-rotation-expected.png: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@283035 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:49 PM Changeset in webkit [283145] by Alan Coon

• 4 edits in branches/safari-612-branch

Cherry-pick r282924. rdar://problem/83584505

Make SharedBuffer inherit from ThreadSafeRefCounted
​https://bugs.webkit.org/show_bug.cgi?id=230662
rdar://83419269

Source/WebCore:

The SourceBufferPrivateAVFObjC uses dispatch_async that takes an objective-C class.
This copies its argument rather than move it and we end up with the SharedBuffer
captured in the lambda to have its ref count be > 1.
The easiest workaround is to make SharedBuffer use thread-safe refcount.
Of course, this doesn't make a SharedBuffer a thread-safe class, but it allows
to safely move it between threads.

Already covered by existing tests.

Reviewed by Chris Dumez.

• platform/SharedBuffer.h:

LayoutTests:

Revert bug 230644.

Reviewed by Chris Dumez.

• platform/mac-wk1/TestExpectations:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@282924 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:49 PM Changeset in webkit [283144] by Alan Coon

• 2 edits in branches/safari-612-branch/LayoutTests

Cherry-pick r282895. rdar://problem/83584505

REGRESSION (r282865?): ASSERTION FAILED: Unsafe to ref/deref from different threads m_isOwnedByMainThread == isMainThread().
​https://bugs.webkit.org/show_bug.cgi?id=230644

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@282895 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3:49 PM Changeset in webkit [283143] by Alan Coon

• 4 edits in branches/safari-612-branch

Revert r280963. rdar://problem/83587220

3:30 PM Changeset in webkit [283142] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[ macOS wk1 ] webanimations/relative-ordering-of-translate-and-rotate-properties-accelerated.html is a flaky image failure.
​https://bugs.webkit.org/show_bug.cgi?id=230863

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

3:27 PM Changeset in webkit [283141] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina BigSur arm64 ] imported/w3c/web-platform-tests/resource-timing/sizes-redirect-img.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=230862.

Unreviewed test gardening.

• platform/mac/TestExpectations:

3:19 PM Changeset in webkit [283140] by mmaxfield@apple.com

• 6 edits in trunk

Add support for CSSFontPaletteValuesRule.name
​https://bugs.webkit.org/show_bug.cgi?id=230787
<rdar://problem/83528540>

Reviewed by Tim Horton.

LayoutTests/imported/w3c:

This is being upstreamed in ​https://github.com/web-platform-tests/wpt/pull/30960.

• web-platform-tests/css/css-fonts/parsing/font-palette-values-valid.html:

Source/WebCore:

This was added to the CSS spec in
​https://github.com/w3c/csswg-drafts/commit/8868476c571d63b7f3f2718e22601a711a2d8683.

Test: web-platform-tests/css/css-fonts/parsing/font-palette-values-valid.html

• css/CSSFontPaletteValuesRule.cpp:

(WebCore::CSSFontPaletteValuesRule::name const):

• css/CSSFontPaletteValuesRule.h:
• css/CSSFontPaletteValuesRule.idl:

2:53 PM Changeset in webkit [283139] by sbarati@apple.com

• 100 edits
  1 copy
  1 add in trunk

Build an unlinked baseline JIT
​https://bugs.webkit.org/show_bug.cgi?id=229223
<rdar://problem/82321772>

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

This patch adds an "unlinked" baseline JIT to JSVALUE64 platforms. The JIT
code produced by this baseline JIT can be shared between all CodeBlocks that
share an UnlinkedCodeBlock. The benefit of this is, if we're creating a CodeBlock
from an UnlinkedCodeBlock that already compiled an unlinked baseline JIT
instance, this new CodeBlock just starts off executing in the baseline JIT
"for free".

To make this work, the code we emit now needs to be independent of a specific
CodeBlock instance. We use a CodeBlock instance for minimal profiling information
when compiling, but otherwise, the code is tied to the UnlinkedCodeBlock. When
we need CodeBlock specific information, we load it. This usually means things
like we'll load things from the Metadata dynamically. This patch also adds a
"linked constant pool" concept, and anytime we instantiate such a CodeBlock,
we also need to instantiate this "linked constant pool". This contains things
like our inline cache data structures (StructureStubInfo*), JSGlobalObject*,
etc.

Unlinked baseline JIT always runs ICs in the "data" mode. To make this work, I
made data ICs work on x86_64. To do this, we no longer call/ret to the IC.
Instead, we jump to the IC, and the IC jumps back by loading the "done" location
from the StructureStubInfo dynamically. This simplifies the design to not be
based on the arm64 calling convention, and keeps the same performance characteristics.

This patch also adds a new version of InlineAccess that is only used in baseline
JIT (for now). In the future, we can make the DFG/FTL also use this for Data
ICs. But we don't need to do that yet since those tiers don't use data ICs by
default. The baseline JIT now has a pure data IC approach to InlineAccess. So
instead of repatching code, we repatch fields we load dynamically.

This patch also cleans up a few things in OSR exit, where both DFG/FTL were
storing callee saves to the callee saves buffer in a weird place, and separate
from one another. I noticed this code can be simplified if we just store
callee saves at the end of the OSR exit handler, and from common JIT emission
code.

This patch also fixes a bug where we could end up with the wrong (and always
more negative) SP in the baseline JIT. This could happen when we OSR exit
from an inlined getter/setter. The OSR exit code puts the return PC when
returning to the call site of the getter/setter to be the inline cache's
"done location". However, this "done location" didn't used to restore SP.
This patch conservatively makes it so that we restore the SP at these sites.

This is measured as a 1% speedup on Speedometer2.

• CMakeLists.txt:
• JavaScriptCore.xcodeproj/project.pbxproj:
• Sources.txt:
• bytecode/AccessCase.cpp:

(JSC::AccessCase::fromStructureStubInfo):
(JSC::AccessCase::generateImpl):

• bytecode/BytecodeList.rb:
• bytecode/BytecodeOperandsForCheckpoint.h:

(JSC::valueProfileOffsetFor):

• bytecode/CallLinkInfo.cpp:

(JSC::CallLinkInfo::fastPathStart):
(JSC::CallLinkInfo::emitFastPathImpl):
(JSC::CallLinkInfo::emitFastPath):
(JSC::CallLinkInfo::emitTailCallFastPath):
(JSC::CallLinkInfo::emitDataICFastPath):
(JSC::CallLinkInfo::emitTailCallDataICFastPath):
(JSC::CallLinkInfo::emitDataICSlowPath):
(JSC::CallLinkInfo::initializeDataIC):
(JSC::CallLinkInfo::emitDirectFastPath):
(JSC::CallLinkInfo::emitDirectTailCallFastPath):

• bytecode/CallLinkInfo.h:

(JSC::CallLinkInfo::offsetOfMaxArgumentCountIncludingThis):
(JSC::CallLinkInfo::slowStub): Deleted.
(JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::setupWithUnlinkedBaselineCode):
(JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const):
(JSC::CodeBlock::setConstantRegisters):
(JSC::CodeBlock::finalizeJITInlineCaches):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::frameRegisterCount):
(JSC::CodeBlock::binaryArithProfileForPC):
(JSC::CodeBlock::unaryArithProfileForPC):
(JSC::CodeBlock::findPC):
(JSC::CodeBlock::jitSoon):
(JSC::CodeBlock::jitNextInvocation):
(JSC::CodeBlock::dumpMathICStats):
(JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
(JSC::CodeBlock::addJITAddIC): Deleted.
(JSC::CodeBlock::addJITMulIC): Deleted.
(JSC::CodeBlock::addJITSubIC): Deleted.
(JSC::CodeBlock::addJITNegIC): Deleted.
(JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
(JSC::CodeBlock::thresholdForJIT): Deleted.
(JSC::CodeBlock::jitAfterWarmUp): Deleted.

• bytecode/CodeBlock.h:

(JSC::CodeBlock::JITData::offsetOfJITConstantPool):
(JSC::CodeBlock::offsetOfJITData):
(JSC::CodeBlock::offsetOfArgumentValueProfiles):
(JSC::CodeBlock::offsetOfConstantsVectorBuffer):
(JSC::CodeBlock::baselineJITConstantPool):
(JSC::CodeBlock::checkIfJITThresholdReached):
(JSC::CodeBlock::dontJITAnytimeSoon):
(JSC::CodeBlock::llintExecuteCounter const):
(JSC::CodeBlock::offsetOfDebuggerRequests):
(JSC::CodeBlock::offsetOfShouldAlwaysBeInlined):
(JSC::CodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
(JSC::CodeBlock::addressOfNumParameters): Deleted.
(JSC::CodeBlock::isKnownCell): Deleted.
(JSC::CodeBlock::addMathIC): Deleted.
(JSC::CodeBlock::setJITCodeMap): Deleted.
(JSC::CodeBlock::jitCodeMap): Deleted.
(JSC::CodeBlock::switchJumpTable): Deleted.
(JSC::CodeBlock::stringSwitchJumpTable): Deleted.

• bytecode/CodeBlockInlines.h:

(JSC::CodeBlock::forEachValueProfile):
(JSC::CodeBlock::jitCodeMap):
(JSC::CodeBlock::baselineSwitchJumpTable):
(JSC::CodeBlock::baselineStringSwitchJumpTable):
(JSC::CodeBlock::dfgSwitchJumpTable):
(JSC::CodeBlock::dfgStringSwitchJumpTable):

• bytecode/ExecutableToCodeBlockEdge.h:
• bytecode/ExecutionCounter.cpp:

(JSC::ExecutionCounter<countingVariant>::setThreshold):

• bytecode/ExecutionCounter.h:

(JSC::ExecutionCounter::clippedThreshold):

• bytecode/GetByIdMetadata.h:

(JSC::GetByIdModeMetadataArrayLength::offsetOfArrayProfile):
(JSC::GetByIdModeMetadata::offsetOfMode):

• bytecode/GetByStatus.cpp:

(JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):

• bytecode/GetterSetterAccessCase.cpp:

(JSC::GetterSetterAccessCase::emitDOMJITGetter):

• bytecode/InByStatus.cpp:

(JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):

• bytecode/InlineAccess.cpp:

(JSC::InlineAccess::generateSelfPropertyAccess):
(JSC::InlineAccess::canGenerateSelfPropertyReplace):
(JSC::InlineAccess::generateSelfPropertyReplace):
(JSC::InlineAccess::isCacheableArrayLength):
(JSC::InlineAccess::generateArrayLength):
(JSC::InlineAccess::isCacheableStringLength):
(JSC::InlineAccess::generateStringLength):
(JSC::InlineAccess::generateSelfInAccess):
(JSC::InlineAccess::rewireStubAsJumpInAccess):
(JSC::InlineAccess::resetStubAsJumpInAccess):

• bytecode/InlineAccess.h:
• bytecode/IterationModeMetadata.h:

(JSC::IterationModeMetadata::offsetOfSeenModes):

• bytecode/LLIntCallLinkInfo.h:

(JSC::LLIntCallLinkInfo::offsetOfArrayProfile):

• bytecode/Opcode.h:
• bytecode/PolymorphicAccess.cpp:

(JSC::AccessGenerationState::succeed):
(JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
(JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions):
(JSC::PolymorphicAccess::regenerate):

• bytecode/PolymorphicAccess.h:

(JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): Deleted.

• bytecode/PutByStatus.cpp:

(JSC::PutByStatus::computeForStubInfo):

• bytecode/StructureStubInfo.cpp:

(JSC::StructureStubInfo::initGetByIdSelf):
(JSC::StructureStubInfo::initPutByIdReplace):
(JSC::StructureStubInfo::initInByIdSelf):
(JSC::StructureStubInfo::addAccessCase):
(JSC::StructureStubInfo::reset):
(JSC::StructureStubInfo::visitWeakReferences):
(JSC::StructureStubInfo::propagateTransitions):
(JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):

• bytecode/StructureStubInfo.h:

(JSC::StructureStubInfo::offsetOfByIdSelfOffset):
(JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure):
(JSC::StructureStubInfo::inlineAccessBaseStructure):
(JSC::StructureStubInfo::offsetOfDoneLocation):

• bytecode/SuperSampler.cpp:

(JSC::printSuperSamplerState):

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
(JSC::UnlinkedCodeBlock::hasIdentifier):
(JSC::UnlinkedCodeBlock::thresholdForJIT):
(JSC::UnlinkedCodeBlock::allocateSharedProfiles):

• bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedCodeBlock::constantRegister):
(JSC::UnlinkedCodeBlock::instructionAt const):
(JSC::UnlinkedCodeBlock::bytecodeOffset):
(JSC::UnlinkedCodeBlock::instructionsSize const):
(JSC::UnlinkedCodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
(JSC::UnlinkedCodeBlock::outOfLineJumpOffset):
(JSC::UnlinkedCodeBlock::binaryArithProfile):
(JSC::UnlinkedCodeBlock::unaryArithProfile):
(JSC::UnlinkedCodeBlock::llintExecuteCounter):

• bytecode/UnlinkedMetadataTable.h:

(JSC::UnlinkedMetadataTable::offsetInMetadataTable):

• bytecode/ValueProfile.h:

(JSC::ValueProfileBase::ValueProfileBase):
(JSC::ValueProfileBase::clearBuckets):
(JSC::ValueProfile::offsetOfFirstBucket):

• dfg/DFGCommonData.h:
• dfg/DFGJITCode.cpp:
• dfg/DFGJITCode.h:
• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::link):

• dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareOSREntry):

• dfg/DFGOSRExit.cpp:

(JSC::DFG::OSRExit::compileExit):

• dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::handleExitCounts):
(JSC::DFG::callerReturnPC):
(JSC::DFG::reifyInlinedCallFrames):
(JSC::DFG::adjustAndJumpToTarget):

• dfg/DFGOperations.cpp:

(JSC::DFG::JSC_DEFINE_JIT_OPERATION):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePutPrivateName):
(JSC::DFG::SpeculativeJIT::compileValueAdd):
(JSC::DFG::SpeculativeJIT::compileValueSub):
(JSC::DFG::SpeculativeJIT::compileValueNegate):
(JSC::DFG::SpeculativeJIT::compileValueMul):
(JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

• ftl/FTLCompile.cpp:

(JSC::FTL::compile):

• ftl/FTLJITCode.h:
• ftl/FTLLink.cpp:

(JSC::FTL::link):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::addMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

• ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

• generator/Metadata.rb:
• jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::storeProperty):
(JSC::AssemblyHelpers::emitVirtualCall):
(JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject):

• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBuffer):

• jit/BaselineJITCode.cpp: Added.

(JSC::MathICHolder::addJITAddIC):
(JSC::MathICHolder::addJITMulIC):
(JSC::MathICHolder::addJITSubIC):
(JSC::MathICHolder::addJITNegIC):
(JSC::MathICHolder::adoptMathICs):
(JSC::BaselineJITCode::BaselineJITCode):
(JSC::BaselineJITCode::~BaselineJITCode):

• jit/BaselineJITCode.h: Added.

(JSC::JITConstantPool::add):
(JSC::JITConstantPool::size const):
(JSC::JITConstantPool::at const):

• jit/BaselineJITPlan.cpp:

(JSC::BaselineJITPlan::finalize):

• jit/CCallHelpers.cpp:

(JSC::CCallHelpers::logShadowChickenTailPacketImpl):
(JSC::CCallHelpers::logShadowChickenTailPacket):

• jit/CCallHelpers.h:
• jit/CallFrameShuffleData.cpp:

(JSC::CallFrameShuffleData::setupCalleeSaveRegisters):

• jit/CallFrameShuffleData.h:
• jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::CallFrameShuffler):
(JSC::CallFrameShuffler::prepareForTailCall):

• jit/CallFrameShuffler.h:

(JSC::CallFrameShuffler::snapshot const):

• jit/JIT.cpp:

(JSC::JIT::JIT):
(JSC::JIT::emitEnterOptimizationCheck):
(JSC::JIT::emitNotifyWriteWatchpoint):
(JSC::JIT::emitVarReadOnlyCheck):
(JSC::JIT::assertStackPointerOffset):
(JSC::JIT::resetSP):
(JSC::JIT::emitPutCodeBlockToFrameInPrologue):
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
(JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters):
(JSC::JIT::emitRestoreCalleeSaves):
(JSC::JIT::compileAndLinkWithoutFinalizing):
(JSC::JIT::link):
(JSC::JIT::finalizeOnMainThread):
(JSC::JIT::privateCompile):
(JSC::JIT::frameRegisterCountFor):
(JSC::JIT::stackPointerOffsetFor):

• jit/JIT.h:
• jit/JITArithmetic.cpp:

(JSC::JIT::emit_compareAndJumpSlowImpl):
(JSC::JIT::emit_compareAndJumpSlow):
(JSC::JIT::emit_op_negate):
(JSC::JIT::emit_op_add):
(JSC::JIT::emitMathICFast):
(JSC::JIT::emitMathICSlow):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emit_op_sub):

• jit/JITCall.cpp:

(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEval):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileTailCall):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):

• jit/JITCall32_64.cpp:

(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEval):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):

• jit/JITCode.h:

(JSC::JITCode::useDataIC):
(JSC::JITCode::pcToCodeOriginMap):

• jit/JITCompilationKey.cpp:

(JSC::JITCompilationKey::dump const):

• jit/JITCompilationKey.h:

(JSC::JITCompilationKey::JITCompilationKey):
(JSC::JITCompilationKey::operator! const):
(JSC::JITCompilationKey::isHashTableDeletedValue const):
(JSC::JITCompilationKey::operator== const):
(JSC::JITCompilationKey::hash const):
(JSC::JITCompilationKey::profiledBlock const): Deleted.

• jit/JITInlineCacheGenerator.cpp:

(JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
(JSC::JITInlineCacheGenerator::finalize):
(JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath):
(JSC::JITGetByIdGenerator::JITGetByIdGenerator):
(JSC::generateGetByIdInlineAccess):
(JSC::JITGetByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath):
(JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITDelByValGenerator::generateFastPath):
(JSC::JITDelByIdGenerator::generateFastPath):
(JSC::JITInByValGenerator::generateFastPath):
(JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITInstanceOfGenerator::generateFastPath):
(JSC::JITGetByValGenerator::generateFastPath):
(JSC::JITPutByValGenerator::generateFastPath):
(JSC::JITPrivateBrandAccessGenerator::generateFastPath):

• jit/JITInlineCacheGenerator.h:
• jit/JITInlines.h:

(JSC::JIT::isOperandConstantDouble):
(JSC::JIT::isOperandConstantInt):
(JSC::JIT::isKnownCell):
(JSC::JIT::getConstantOperand):
(JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
(JSC::JIT::linkSlowCaseIfNotJSCell):
(JSC::JIT::advanceToNextCheckpoint):
(JSC::JIT::emitJumpSlowToHotForCheckpoint):
(JSC::JIT::isOperandConstantChar):
(JSC::JIT::emitValueProfilingSite):
(JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
(JSC::JIT::emitArrayProfilingSiteWithCell):
(JSC::JIT::emitLoadDouble):
(JSC::JIT::emitJumpSlowCaseIfNotJSCell):
(JSC::JIT::emitGetVirtualRegister):
(JSC::JIT::jumpTarget):
(JSC::JIT::loadPtrFromMetadata):
(JSC::JIT::load32FromMetadata):
(JSC::JIT::load8FromMetadata):
(JSC::JIT::store8ToMetadata):
(JSC::JIT::store32ToMetadata):
(JSC::JIT::materializePointerIntoMetadata):
(JSC::JIT::loadConstant):
(JSC::JIT::loadGlobalObject):
(JSC::JIT::loadCodeBlockConstant):
(JSC::JIT::copiedGetPutInfo): Deleted.
(JSC::JIT::copiedArithProfile): Deleted.

• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_mov):
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emit_op_typeof_is_undefined):
(JSC::JIT::op_ret_handlerGenerator):
(JSC::JIT::emit_op_to_primitive):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::valueIsFalseyGenerator):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jeq_ptr):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::valueIsTruthyGenerator):
(JSC::JIT::emit_op_throw):
(JSC::JIT::op_throw_handlerGenerator):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_numeric):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_debug):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_enter):
(JSC::JIT::op_enter_handlerGenerator):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emitSlow_op_jeq):
(JSC::JIT::emitSlow_op_jneq):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_loop_hint):
(JSC::JIT::emitSlow_op_check_traps):
(JSC::JIT::op_check_traps_handlerGenerator):
(JSC::JIT::emit_op_new_regexp):
(JSC::JIT::emitNewFuncCommon):
(JSC::JIT::emitNewFuncExprCommon):
(JSC::JIT::emit_op_new_array):
(JSC::JIT::emit_op_new_array_with_size):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_tail):
(JSC::JIT::emit_op_profile_control_flow):
(JSC::JIT::emit_op_get_argument):
(JSC::JIT::emit_op_get_prototype_of):

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_typeof_is_undefined):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::compileOpEqJumpSlow):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_throw):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_numeric):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_enter):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_tail):

• jit/JITOperations.cpp:

(JSC::JSC_DEFINE_JIT_OPERATION):

• jit/JITOperations.h:
• jit/JITPlan.cpp:

(JSC::JITPlan::key):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::generateGetByValSlowCase):
(JSC::JIT::slow_op_get_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::slow_op_get_private_name_prepareCallGenerator):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emitSlow_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emitSlow_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::slow_op_del_by_id_prepareCallGenerator):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::slow_op_del_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::slow_op_get_by_id_prepareCallGenerator):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::slow_op_put_by_id_prepareCallGenerator):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitSlow_op_has_private_name):
(JSC::JIT::emitSlow_op_has_private_brand):
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emitResolveClosure):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::generateOpResolveScopeThunk):
(JSC::JIT::slow_op_resolve_scopeGenerator):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::generateOpGetFromScopeThunk):
(JSC::JIT::slow_op_get_from_scopeGenerator):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::slow_op_put_to_scopeGenerator):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_get_internal_field):
(JSC::JIT::emit_op_enumerator_next):
(JSC::JIT::emit_op_enumerator_get_by_val):
(JSC::JIT::emit_enumerator_has_propertyImpl):
(JSC::JIT::emitWriteBarrier):
(JSC::JIT::emitPutGlobalVariable): Deleted.
(JSC::JIT::emitPutGlobalVariableIndirect): Deleted.
(JSC::JIT::emitPutClosureVar): Deleted.

• jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emitSlow_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emitSlow_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_get_internal_field):

• jit/Repatch.cpp:

(JSC::tryCacheGetBy):
(JSC::tryCachePutBy):
(JSC::tryCacheInBy):
(JSC::unlinkCall):

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::jitCompileAndSetHeuristics):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/CacheableIdentifier.h:
• runtime/CacheableIdentifierInlines.h:

(JSC::CacheableIdentifier::createFromIdentifierOwnedByCodeBlock):

• runtime/CachedTypes.cpp:

(JSC::CachedCodeBlock::numBinaryArithProfiles const):
(JSC::CachedCodeBlock::numUnaryArithProfiles const):
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
(JSC::CachedCodeBlock<CodeBlockType>::encode):

• runtime/CommonSlowPaths.cpp:

(JSC::updateArithProfileForUnaryArithOp):

• runtime/FunctionExecutable.h:
• runtime/Options.cpp:

(JSC::Options::recomputeDependentOptions):

• runtime/OptionsList.h:
• runtime/ScriptExecutable.cpp:

(JSC::ScriptExecutable::prepareForExecutionImpl):

• wasm/WasmLLIntTierUpCounter.h:

(JSC::Wasm::LLIntTierUpCounter::optimizeAfterWarmUp):
(JSC::Wasm::LLIntTierUpCounter::optimizeSoon):

• wasm/WasmTierUpCount.cpp:

(JSC::Wasm::TierUpCount::TierUpCount):

• wasm/WasmTierUpCount.h:

(JSC::Wasm::TierUpCount::optimizeAfterWarmUp):
(JSC::Wasm::TierUpCount::optimizeNextInvocation):
(JSC::Wasm::TierUpCount::optimizeSoon):

Source/WTF:

• wtf/Bag.h:
• wtf/Packed.h:

(WTF::PackedAlignedPtr::operator* const):

Tools:

• Scripts/run-jsc-stress-tests:

2:50 PM Changeset in webkit [283138] by Truitt Savell

• 2 edits in trunk/LayoutTests

6 editing spelling tests crashing with uncaught exception 'NSInvalidArgumentException'
rdar://83592102

Unreviewed test gardening.

2:33 PM Changeset in webkit [283137] by Truitt Savell

• 2 edits in trunk/LayoutTests

8 editing/ tests crashing with Assertion failed
rdar://83591040

Unreviewed test gardening.

2:28 PM Changeset in webkit [283136] by Takashi.Komori@sony.com

• 2 edits in trunk/Source/WebCore

[Curl] Set CURL_LOCK_DATA_SSL_SESSION option to reduce SSL/TLS handshake time
​https://bugs.webkit.org/show_bug.cgi?id=230818

Reviewed by Fujii Hironori.

Set CURL_LOCK_DATA_SSL_SESSION option to reuse Session ID.
It reduces SSL/TLS handshake time.

Covered by existing tests.

• platform/network/curl/CurlContext.cpp:

(WebCore::CurlShareHandle::CurlShareHandle):

2:27 PM Changeset in webkit [283135] by commit-queue@webkit.org

• 2 edits in trunk/Source/JavaScriptCore

[JSC][32bit] Fix build after r283098
​https://bugs.webkit.org/show_bug.cgi?id=230856

Unreviewed build fix.

Patch by Xan López <Xan Lopez> on 2021-09-27

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_jeq_ptr): remove unused (broken) line.

2:21 PM Changeset in webkit [283134] by ntim@apple.com

• 6 edits in trunk/Source/WebCore

Rename Style::queuePostResolutionCallback to Style::deprecatedQueuePostResolutionCallback
​https://bugs.webkit.org/show_bug.cgi?id=230851

Reviewed by Simon Fraser.

The HTML5 event loop should be used instead.
Also fix pre-existing webkit-style errors.

• html/HTMLFormControlElement.cpp:

(WebCore::HTMLFormControlElement::didAttachRenderers):
(WebCore::HTMLFormControlElement::didRecalcStyle):

• html/HTMLFrameOwnerElement.cpp:

(WebCore::HTMLFrameOwnerElement::scheduleInvalidateStyleAndLayerComposition):

• html/HTMLPlugInImageElement.cpp:

(WebCore::HTMLPlugInImageElement::scheduleUpdateForAfterStyleResolution):

• style/StyleTreeResolver.cpp:

(WebCore::Style::deprecatedQueuePostResolutionCallback):
(WebCore::Style::queuePostResolutionCallback): Deleted.

• style/StyleTreeResolver.h:

2:07 PM Changeset in webkit [283133] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[ iOS 14 & 15 ] fast/images/image-subsampling.html is a flaky image failure.
​https://bugs.webkit.org/show_bug.cgi?id=230857

Unreviewed test gardening.

• platform/ios-wk2/TestExpectations:

2:05 PM Changeset in webkit [283132] by Sam Sneddon

• 3 edits in trunk/Tools

Port._natural_sort_key should sort a01 before a001
​https://bugs.webkit.org/show_bug.cgi?id=230764

Reviewed by Jonathan Bedard.

• Scripts/webkitpy/port/base.py:

(Port._natural_sort_key):

• Scripts/webkitpy/port/base_unittest.py:

(NaturalCompareTest.test_natural_compare):
(KeyCompareTest.test_test_key):

1:47 PM September 2021 Meeting edited by Jon Davis

Added placeholders for more session transcripts (diff)

1:18 PM Changeset in webkit [283131] by Alan Coon

• 8 edits in branches/safari-612-branch/Source

Versioning.

WebKit-7612.2.9

1:06 PM WebKit2021-2022Igalia edited by Jon Davis

Added notes captured (diff)

12:50 PM Changeset in webkit [283130] by mmaxfield@apple.com

• 10 edits in trunk

The CSS Fonts spec has deleted CSSRule.FONT_PALETTE_VALUES_RULE
​https://bugs.webkit.org/show_bug.cgi?id=230786
<rdar://problem/83528219>

Reviewed by Antti Koivisto.

LayoutTests/imported/w3c:

The test is being upstreamed at ​https://github.com/web-platform-tests/wpt/pull/30959.

• web-platform-tests/css/css-fonts/idlharness-expected.txt:
• web-platform-tests/css/css-fonts/parsing/font-palette-values-invalid-expected.txt:
• web-platform-tests/css/css-fonts/parsing/font-palette-values-invalid.html:
• web-platform-tests/css/css-fonts/parsing/font-palette-values-valid.html:
• web-platform-tests/interfaces/css-fonts.idl:

Source/WebCore:

Update WebKit according to
​https://github.com/w3c/csswg-drafts/commit/45bda92646e0438c1fcd44497144aa86f0df1b61.

Test: web-platform-tests/css/css-fonts/parsing/font-palette-values-invalid.html

• css/CSSRule.h:
• css/CSSRule.idl:
• css/StyleRuleType.h:

12:33 PM WebKit2021-2022Igalia edited by Jon Davis

Added link to the slide deck (diff)

12:33 PM Changeset in webkit [283129] by commit-queue@webkit.org

• 100 edits
  2 deletes in trunk

Unreviewed, reverting r283102, r283103 and r283104.
​https://bugs.webkit.org/show_bug.cgi?id=230854

It regresses JetStream2 on iOS devices

Reverted changesets:

"Build an unlinked baseline JIT"
​https://bugs.webkit.org/show_bug.cgi?id=229223
​https://commits.webkit.org/r283102

"Unreviewed, fix CLoop build"
​https://bugs.webkit.org/show_bug.cgi?id=229223
​https://commits.webkit.org/r283103

"Unreviewed, fix CLoop build part 2"
​https://bugs.webkit.org/show_bug.cgi?id=229223
​https://commits.webkit.org/r283104

11:53 AM Changeset in webkit [283128] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[ iOS 14 ] remote-layer-tree/ios/uiview-tree-basic.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=230850

Unreviewed test gardening.

• platform/ios-wk2/TestExpectations:

11:34 AM OffscreenCanvas2021Update created by Jon Davis

11:34 AM GitHubandNewProcesses created by Jon Davis

11:33 AM ProtectedCollaborationTree created by Jon Davis

11:17 AM ApplePlansForWebKit2022Edition created by Jon Davis

11:17 AM WebKit2021-2022Igalia created by Jon Davis

11:16 AM September 2021 Meeting edited by Jon Davis

Added Transcript placeholders for day 1 (diff)

10:59 AM Changeset in webkit [283127] by Andres Gonzalez

• 2 edits in trunk/Source/WebCore

Boundary check of AccessibilityMathMLElement::mathOverObject is incorrect
​https://bugs.webkit.org/show_bug.cgi?id=230828
<rdar://problem/83571752>

Reviewed by Chris Fleizach.

• accessibility/AccessibilityMathMLElement.cpp:

(WebCore::AccessibilityMathMLElement::mathOverObject):

10:27 AM September 2021 Meeting edited by Jon Davis

Updated more titles (diff)

10:18 AM Changeset in webkit [283126] by Jonathan Bedard

• 5 edits in trunk/Tools

Exception in run-webkit-tests: Bad file descriptor (Revert)
​https://bugs.webkit.org/show_bug.cgi?id=229994
<rdar://problem/82826083>

Unreviewed revert.

Revert of 241391@main, 241474@main, 241546@main and 241782@main

• Scripts/webkitpy/common/system/filesystem.py:

(FileSystem.rmtree):

• Scripts/webkitpy/port/server_process.py:

(ServerProcess.write):
(ServerProcess._wait_for_data_and_update_buffers_using_select):

• Scripts/webkitpy/port/simulator_process.py:

(SimulatorProcess):
(SimulatorProcess._start):

• Scripts/webkitpy/xcode/simulated_device.py:

(SimulatedDevice.launch_app):

10:13 AM Changeset in webkit [283125] by commit-queue@webkit.org

• 2 edits in trunk/LayoutTests

[ MacOS ] inspector/dom/getAccessibilityPropertiesForNode.html is failing
​https://bugs.webkit.org/show_bug.cgi?id=230840

Patch by Tyler Wilcock <Tyler Wilcock> on 2021-09-27
Reviewed by Ryan Haddad.

Remove expanded property from expected output for this test.
Following ​https://trac.webkit.org/changeset/283078/webkit, we don't
expose expanded in this case anymore.

• inspector/dom/getAccessibilityPropertiesForNode-expected.txt:

10:05 AM September 2021 Meeting edited by Jon Davis

Updated presentation titles (diff)

9:55 AM Changeset in webkit [283124] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina BigSur wk1 Debug ] webrtc/datachannel/datachannel-gc.html is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230848.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

9:43 AM Changeset in webkit [283123] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina Debug wk1 EWS ] svg/filters/big-height-filter.svg is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230846.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

9:35 AM Changeset in webkit [283122] by pvollan@apple.com

• 2 edits in trunk/Source/WebKit

[iOS][GPUP] Remove access to unused mach services in sandbox
​https://bugs.webkit.org/show_bug.cgi?id=230832
<rdar://problem/83573640>

Reviewed by Brent Fulgham.

Remove access to mach services on iOS in the GPU process that are unused, according to telemetry.

• Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb:

9:29 AM Changeset in webkit [283121] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina Debug wk1 EWS ] storage/indexeddb/mozilla/cursor-mutation.html is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230844.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

9:27 AM Changeset in webkit [283120] by Antti Koivisto

• 11 edits in trunk

[CSS Cascade Layers] Support @layer statement before @import statements
​https://bugs.webkit.org/show_bug.cgi?id=230826

Reviewed by Simon Fraser.

LayoutTests/imported/w3c:

• web-platform-tests/css/css-cascade/layer-import-expected.txt:

Source/WebCore:

Support case like

@layer a, b;
@import url(foo.css);

Before this patch @import rules could only be preceded by a @charset rule.

• css/StyleRule.cpp:

(WebCore::StyleRuleLayer::createStatement):
(WebCore::StyleRuleLayer::createBlock):
(WebCore::StyleRuleLayer::create): Deleted.

Some clarifying renaming.

• css/StyleRule.h:
• css/StyleSheetContents.cpp:

(WebCore::StyleSheetContents::parserAppendRule):

Add a new m_layerRulesBeforeImportRules vector and put any early layer statements there.

(WebCore::StyleSheetContents::ruleAt const):
(WebCore::StyleSheetContents::ruleCount const):
(WebCore::StyleSheetContents::clearRules):
(WebCore::StyleSheetContents::wrapperInsertRule):
(WebCore::StyleSheetContents::wrapperDeleteRule):

• css/StyleSheetContents.h:
• css/parser/CSSParserImpl.cpp:

(WebCore::computeNewAllowedRules):
(WebCore::CSSParserImpl::consumeImportRule):
(WebCore::CSSParserImpl::consumeLayerRule):

Parsing support.

• css/parser/CSSParserImpl.h:
• style/RuleSet.cpp:

(WebCore::Style::RuleSet::Builder::addChildRules):
(WebCore::Style::RuleSet::Builder::addRulesFromSheet):

Register layers before imports.

(WebCore::Style::RuleSet::Builder::registerLayers):

Factor into a function.

• style/RuleSet.h:

9:19 AM Changeset in webkit [283119] by BJ Burg

• 11 edits
  1 copy in trunk/Source/WebKit

[Cocoa] backport showConsole() and showResources() for RemoteWebInspectorUI
​https://bugs.webkit.org/show_bug.cgi?id=230573
<rdar://problem/83365814>

Reviewed by Devin Rousso.

These methods already exist for _WKInspector. A test will be added in
future patch that tests _WKInspectorExtensionDelegate shown/hidden callback methods.

• UIProcess/API/Cocoa/_WKInspectorIBActions.h: Copied from Source/WebKit/UIProcess/API/Cocoa/_WKInspector.h.

Added. API and SPI that are shared between local and remote Web Inspector
should go in this class. Since these methods are used to implement IBActions for a
detached Web Inspector window, the protocol is named _WKInspectorIBActions.
Hoist showResources() and showConsole() to this shared protocol.

• UIProcess/API/Cocoa/_WKInspectorExtensionHost.h:
• UIProcess/API/Cocoa/_WKInspector.h: Remove methods that are

part of the _WKInspectorIBActions protocol.

• UIProcess/API/Cocoa/_WKRemoteWebInspectorViewController.mm:

(-[_WKRemoteWebInspectorViewController showConsole]):
(-[_WKRemoteWebInspectorViewController showResources]):
Added. Call into RemoteWebInspectorUIProxy.

• UIProcess/Inspector/RemoteWebInspectorUIProxy.h:
• UIProcess/Inspector/RemoteWebInspectorUIProxy.cpp:

(WebKit::RemoteWebInspectorUIProxy::showConsole):
(WebKit::RemoteWebInspectorUIProxy::showResources):
Added. Send an IPC message to the Inspector web process.

• WebProcess/Inspector/RemoteWebInspectorUI.h:
• WebProcess/Inspector/RemoteWebInspectorUI.messages.in:

Add new messages.

• WebProcess/Inspector/RemoteWebInspectorUI.cpp:

(WebKit::RemoteWebInspectorUI::showConsole):
(WebKit::RemoteWebInspectorUI::showResources):
Added. Backport the implementation from WebInspectorUI.

9:12 AM Changeset in webkit [283118] by Lauro Moura

• 2 edits in trunk/LayoutTests

Garden passing flexbox abspos tests since updated in 242101@main

Unreviewed test gardening.

These tests are passing in all platforms according to
results.webkit.org.

• TestExpectations:

9:09 AM Changeset in webkit [283117] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina BigSur wk1 Debug ] media/track/audio-track.html is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230842.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

9:06 AM Changeset in webkit [283116] by youenn@apple.com

• 14 edits
  1 add in trunk/Source

iPadOS 15 / iOS 15 unable to decode VP9 stream
​https://bugs.webkit.org/show_bug.cgi?id=230604
<rdar://problem/83391595>

Reviewed by Eric Carlson.

Source/WebCore:

Export a utility function to know whether HW VP9 is supported by VTB.
No change of behavior.

• platform/graphics/cocoa/VP9UtilitiesCocoa.h:
• platform/graphics/cocoa/VP9UtilitiesCocoa.mm:

(WebCore::vp9HardwareDecoderAvailable):

Source/WebKit:

Update code to retrieve some parameters when synchronously creating the GPU process connection.
The sole parameter is currently to know the HW VP9 decoder availability.
If HW VP9 decoder is not supported by GPUProcess code, we fallback to SW libvpx.

Manually tested.

• GPUProcess/GPUProcess.cpp:

(WebKit::GPUProcess::createGPUConnectionToWebProcess):

• GPUProcess/GPUProcess.h:
• GPUProcess/GPUProcess.messages.in:
• Shared/GPUProcessConnectionInitializationParameters.h: Added.
• UIProcess/GPU/GPUProcessProxy.cpp:

(WebKit::GPUProcessProxy::getGPUProcessConnection):

• WebKit.xcodeproj/project.pbxproj:
• WebProcess/GPU/GPUProcessConnection.cpp:

(WebKit::GPUProcessConnection::GPUProcessConnection):

• WebProcess/GPU/GPUProcessConnection.h:

(WebKit::GPUProcessConnection::create):
(WebKit::GPUProcessConnection::hasVP9HardwareDecoder const):

• WebProcess/GPU/GPUProcessConnectionInfo.h:

(WebKit::GPUProcessConnectionInfo::encode const):
(WebKit::GPUProcessConnectionInfo::decode):

• WebProcess/GPU/webrtc/LibWebRTCCodecs.cpp:

(WebKit::LibWebRTCCodecs::setCallbacks):

• WebProcess/WebProcess.cpp:

(WebKit::WebProcess::ensureGPUProcessConnection):

9:03 AM Changeset in webkit [283115] by Andres Gonzalez

• 9 edits in trunk/Source/WebCore

Fix for crash in accessibility/Mac/search-predicate-for-adhoc-radio-groups.html in isolated tree mode.
​https://bugs.webkit.org/show_bug.cgi?id=230754
<rdar://problem/83498599>

Reviewed by Chris Fleizach.

Test: accessibility/Mac/search-predicate-for-adhoc-radio-groups.html

The crash was caused by the call in isRadioButtonInDifferentAdhocGroup
to axObject->element()->getNameAttribute(), since element() should not
be called off of the main thread. That brins up the question of how to
get element attributes on the AX thread. For that purpose, I added the
attributeValue method to the AXCoreObject interface, and removed the
related methods that take QualifiedNames and return an AtomString, since
they cannot be used off of the main thread.

• accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::attributeValue const):
(WebCore::AccessibilityObject::setIsIgnoredFromParentDataForChild):
(WebCore::Accessibility::isRadioButtonInDifferentAdhocGroup):

• accessibility/AccessibilityObject.h:
• accessibility/AccessibilityObjectInterface.h:
• accessibility/AccessibilityTableCell.cpp:

(WebCore::AccessibilityTableCell::columnHeaders):
(WebCore::AccessibilityTableCell::rowHeaders):

• accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(-[WebAccessibilityObjectWrapper accessibilityIdentifier]):

• accessibility/isolatedtree/AXIsolatedObject.cpp:

(WebCore::AXIsolatedObject::initializeAttributeData):
(WebCore::AXIsolatedObject::attributeValue const):
(WebCore::AXIsolatedObject::hasAttribute const): Deleted.
(WebCore::AXIsolatedObject::getAttribute const): Deleted.

• accessibility/isolatedtree/AXIsolatedObject.h:
• accessibility/isolatedtree/AXIsolatedTree.h:

9:01 AM Changeset in webkit [283114] by youenn@apple.com

• 20 edits
  4 adds in trunk

Make sure to reset presenting application pid in case of mediaserverd crash
​https://bugs.webkit.org/show_bug.cgi?id=230822
<rdar://83474184>

Reviewed by Eric Carlson.

Source/WebCore:

Before the patch, we were asking MediaSessionHelper client to set the pid in case of mediaserverd crash.
Given GPUProcess is the only one receiving the notification now, only the GPUProcess client could do it,
which was not the case as MediaSessionManager in WebProcess was responsible to do so.

Instead of relying on MediaSessionHelper client to do the setup, we now let MediaSessionHelper do it on its own.
Everything will happen in GPUProcess which should also be faster.

We also make sure to reset the affine transform of m_sampleBufferDisplayLayer so that rotation is applied correctly
after mediaserverd crash.

Manually tested by crashing mediaserverd.
Test: fast/mediastream/video-rotation-gpu-process-crash.html (covers affine transform change).

• platform/audio/ios/MediaSessionHelperIOS.h:
• platform/audio/ios/MediaSessionHelperIOS.mm:

(MediaSessionHelperiOS::providePresentingApplicationPID):
(MediaSessionHelperiOS::mediaServerConnectionDied):

• platform/audio/ios/MediaSessionManagerIOS.h:
• platform/audio/ios/MediaSessionManagerIOS.mm:
• platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:

(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::enqueueVideoSample):

Source/WebKit:

Add API to crash GPUProcess from WebKitTestRunner.

Make sure to forward to MediaPlayer the fact that the layer failed.
This was handled for GPUProcess crash but not for other cases like mediaserverd crashes.

• UIProcess/API/C/WKContext.cpp:

(WKContextTerminateGPUProcess):

• UIProcess/API/C/WKContextPrivate.h:
• UIProcess/GPU/GPUProcessProxy.cpp:

(WebKit::GPUProcessProxy::terminateForTesting):

• UIProcess/GPU/GPUProcessProxy.h:
• WebProcess/GPU/webrtc/SampleBufferDisplayLayer.cpp:

(WebKit::SampleBufferDisplayLayer::setDidFail):

Tools:

Add test runner API to crash GPUProcess.

• WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
• WebKitTestRunner/InjectedBundle/TestRunner.cpp:

(WTR::TestRunner::terminateGPUProcess):

• WebKitTestRunner/InjectedBundle/TestRunner.h:
• WebKitTestRunner/TestController.cpp:

(WTR::TestController::terminateGPUProcess):

• WebKitTestRunner/TestController.h:
• WebKitTestRunner/TestInvocation.cpp:

(WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle):

LayoutTests:

• fast/mediastream/video-rotation-gpu-process-crash-expected.txt: Added.
• fast/mediastream/video-rotation-gpu-process-crash.html: Added.
• platform/ios-simulator/fast/mediastream/video-rotation-gpu-process-crash-expected.png: Added.
• platform/mac/fast/mediastream/video-rotation-gpu-process-crash-expected.png: Added.

8:57 AM Changeset in webkit [283113] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Windows ] svg/as-background-image/svg-as-background-body.html is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230838.

Unreviewed test gardening.

• platform/win/TestExpectations:

8:50 AM Changeset in webkit [283112] by commit-queue@webkit.org

• 2 edits in trunk/Tools

prepare-ChangeLog does not show the correct result with using --git-commit
​https://bugs.webkit.org/show_bug.cgi?id=230816

Patch by Hoa Dinh <​dvh@apple.com> on 2021-09-27
Reviewed by Jonathan Bedard.

When we pass the parameter --git-commit, we need to use the correct reference version when
computing the difference between the version before and after the change.
This patch fixes it by passing the version before the specified commit.

Also, when --git-commit is used, we need compare against the correct version of the file.
This patch fixes that part by calling git to retrieve the accurate version.

• Scripts/prepare-ChangeLog:

(originalFile):
(generateFunctionLists):

8:41 AM Changeset in webkit [283111] by Kate Cheney

• 178 edits in trunk

Send CSP violation reports to the DOM window
​https://bugs.webkit.org/show_bug.cgi?id=230728

Reviewed by Brent Fulgham.

LayoutTests/imported/w3c:

Rebaseline CSP tests now that many are no longer timing out. In some
cases this will require removing console logging because in general
for CSP tests we dump console logging to stderr to avoid flakiness.

• web-platform-tests/content-security-policy/base-uri/report-uri-does-not-respect-base-uri.sub-expected.txt:
• web-platform-tests/content-security-policy/blob/blob-urls-do-not-match-self.sub-expected.txt:
• web-platform-tests/content-security-policy/blob/self-doesnt-match-blob.sub-expected.txt:
• web-platform-tests/content-security-policy/blob/star-doesnt-match-blob.sub-expected.txt:
• web-platform-tests/content-security-policy/child-src/child-src-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub-expected.txt:
• web-platform-tests/content-security-policy/child-src/child-src-redirect-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/child-src/child-src-worker-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-beacon-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-beacon-redirect-to-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-eventsource-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-eventsource-redirect-to-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-websocket-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-xmlhttprequest-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/connect-src/connect-src-xmlhttprequest-redirect-to-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/default-src/default-src-inline-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/font-src/font-stylesheet-font-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/form-action/form-action-src-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/form-action/form-action-src-get-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/form-action/form-action-src-javascript-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/frame-src/frame-src-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/frame-src/frame-src-cross-origin-load.sub-expected.txt:
• web-platform-tests/content-security-policy/frame-src/frame-src-redirect-expected.txt:
• web-platform-tests/content-security-policy/frame-src/frame-src-same-document-meta.sub-expected.txt:
• web-platform-tests/content-security-policy/frame-src/frame-src-same-document.sub-expected.txt:
• web-platform-tests/content-security-policy/frame-src/frame-src-self-unique-origin-expected.txt:
• web-platform-tests/content-security-policy/generic/304-response-should-update-csp.sub-expected.txt:
• web-platform-tests/content-security-policy/generic/directive-name-case-insensitive.sub-expected.txt:
• web-platform-tests/content-security-policy/generic/generic-0_1-img-src-expected.txt:
• web-platform-tests/content-security-policy/generic/generic-0_1-script-src-expected.txt:
• web-platform-tests/content-security-policy/generic/generic-0_10_1.sub-expected.txt:
• web-platform-tests/content-security-policy/generic/generic-0_2_2.sub-expected.txt:
• web-platform-tests/content-security-policy/generic/generic-0_2_3-expected.txt:
• web-platform-tests/content-security-policy/generic/generic-0_8_1.sub-expected.txt:
• web-platform-tests/content-security-policy/generic/only-valid-whitespaces-are-allowed-expected.txt:
• web-platform-tests/content-security-policy/generic/policy-inherited-correctly-by-plznavigate-expected.txt:
• web-platform-tests/content-security-policy/img-src/img-src-self-unique-origin-expected.txt:
• web-platform-tests/content-security-policy/img-src/report-blocked-data-uri.sub-expected.txt:
• web-platform-tests/content-security-policy/inheritance/document-write-iframe-expected.txt:
• web-platform-tests/content-security-policy/inheritance/frame-src-javascript-url-expected.txt:
• web-platform-tests/content-security-policy/inheritance/iframe-srcdoc-inheritance-expected.txt:
• web-platform-tests/content-security-policy/inheritance/inherited-csp-list-modifications-are-local-expected.txt:
• web-platform-tests/content-security-policy/inheritance/javascript-url-srcdoc-cross-origin-iframe-inheritance-expected.txt:
• web-platform-tests/content-security-policy/inheritance/location-reload-expected.txt:
• web-platform-tests/content-security-policy/media-src/media-src-7_1_2.sub-expected.txt:
• web-platform-tests/content-security-policy/media-src/media-src-7_2_2.sub-expected.txt:
• web-platform-tests/content-security-policy/media-src/media-src-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/meta/combine-header-and-meta-policies.sub-expected.txt:
• web-platform-tests/content-security-policy/navigate-to/form-action/form-action-blocks-navigate-to-allows.sub-expected.txt:
• web-platform-tests/content-security-policy/navigate-to/form-action/form-action-blocks-navigate-to-blocks.sub-expected.txt:
• web-platform-tests/content-security-policy/navigation/javascript-url-navigation-inherits-csp-expected.txt:
• web-platform-tests/content-security-policy/navigation/to-javascript-parent-initiated-parent-csp-expected.txt:
• web-platform-tests/content-security-policy/object-src/object-src-no-url-blocked-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/report-to-directive-allowed-in-meta.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/reporting-api-report-only-sends-reports-on-violation.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-only-sends-reports-to-first-endpoint.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-1.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-2.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/reporting-api-sends-reports-on-violation.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting-api/reporting-api-works-on-frame-src.https.sub-expected.txt:
• web-platform-tests/content-security-policy/reporting/report-same-origin-with-cookies-expected.txt:
• web-platform-tests/content-security-policy/reporting/report-uri-effective-directive-expected.txt:
• web-platform-tests/content-security-policy/script-src/hash-always-converted-to-utf-8/iso-8859-1-expected.txt:
• web-platform-tests/content-security-policy/script-src/hash-always-converted-to-utf-8/iso-8859-3-expected.txt:
• web-platform-tests/content-security-policy/script-src/hash-always-converted-to-utf-8/iso-8859-7-expected.txt:
• web-platform-tests/content-security-policy/script-src/hash-always-converted-to-utf-8/iso-8859-9-expected.txt:
• web-platform-tests/content-security-policy/script-src/hash-always-converted-to-utf-8/utf-8-lone-surrogate-expected.txt:
• web-platform-tests/content-security-policy/script-src/injected-inline-script-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/script-src/javascript-window-open-blocked-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-1_1-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-1_10-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-1_2-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-1_2_1-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-1_4_1-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-report-only-policy-works-with-external-hash-policy-expected.txt:
• web-platform-tests/content-security-policy/script-src/script-src-report-only-policy-works-with-hash-policy-expected.txt:
• web-platform-tests/content-security-policy/script-src/scriptnonce-and-scripthash.sub-expected.txt:
• web-platform-tests/content-security-policy/script-src/scriptnonce-basic-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/script-src/scriptnonce-ignore-unsafeinline.sub-expected.txt:
• web-platform-tests/content-security-policy/script-src/srcdoc-doesnt-bypass-script-src.sub-expected.txt:
• web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect.sub-expected.txt:
• web-platform-tests/content-security-policy/securitypolicyviolation/inside-dedicated-worker-expected.txt:
• web-platform-tests/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image.sub-expected.txt:
• web-platform-tests/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-image-from-script.sub-expected.txt:
• web-platform-tests/content-security-policy/securitypolicyviolation/securitypolicyviolation-block-image.sub-expected.txt:
• web-platform-tests/content-security-policy/securitypolicyviolation/upgrade-insecure-requests-reporting.https-expected.txt:
• web-platform-tests/content-security-policy/style-src/injected-inline-style-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/inline-style-allowed-while-cloning-objects.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/inline-style-attribute-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-error-event-fires-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-hash-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-imported-style-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-injected-inline-style-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-injected-stylesheet-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-inline-style-attribute-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-inline-style-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-inline-style-nonce-blocked-error-event-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-inline-style-nonce-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-none-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/style-src-stylesheet-nonce-blocked-expected.txt:
• web-platform-tests/content-security-policy/style-src/stylehash-basic-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/stylenonce-allowed.sub-expected.txt:
• web-platform-tests/content-security-policy/style-src/stylenonce-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/svg/object-in-svg-foreignobject.sub-expected.txt:
• web-platform-tests/content-security-policy/svg/svg-inline.sub-expected.txt:
• web-platform-tests/content-security-policy/unsafe-eval/eval-scripts-setInterval-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/unsafe-eval/eval-scripts-setTimeout-blocked.sub-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_allowed-href-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_allowed-href_blank-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_allowed-window_location-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_allowed-window_open-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-href-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-href_blank-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-window_location-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-window_open-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_wrong_hash-href-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_wrong_hash-href_blank-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_wrong_hash-window_location-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/javascript_src_denied_wrong_hash-window_open-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/script_event_handlers_allowed-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/script_event_handlers_denied_missing_unsafe_hashes-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/script_event_handlers_denied_wrong_hash-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/style_attribute_denied_missing_unsafe_hashes-expected.txt:
• web-platform-tests/content-security-policy/unsafe-hashes/style_attribute_denied_wrong_hash-expected.txt:
• web-platform-tests/content-security-policy/worker-src/dedicated-worker-src-child-fallback-blocked.sub-expected.txt:

Source/WebCore:

No new tests. This will fix numerous test timeouts.

Many imported CSP tests are timing out because they wait for security
violation events to be sent to the DOM window. This patch bubbles up
violation reports so attached documents will also report violations
to the window.

• dom/Document.cpp:

(WebCore::Document::enqueueSecurityPolicyViolationEvent):

• page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::reportViolation const):
We should only report the name of the violated directive to match
the spec, which specifies this should be "a non-empty string
representing the directive whose enforcement caused the violation."

LayoutTests:

Unskip tests that are no longer timing out after this fix. Rebaseline
tests that previously expected a different violated directive text.

• TestExpectations:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-cross-origin-https-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/report-frame-ancestors-same-origin-https-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/script-blocked-sends-multiple-reports-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-enforced-policy-and-blocked-by-report-policy-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-enforced-policy-and-blocked-by-report-policy2-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-allowed-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scripthash-blocked-by-legacy-enforced-policy-and-blocked-by-report-policy2-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked-by-enforced-policy-and-allowed-by-report-policy-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securityviolationpolicy-block-frame-using-child-src-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securityviolationpolicy-block-frame-using-default-src-expected.txt:
• http/tests/security/contentSecurityPolicy/1.1/securityviolationpolicy-block-frame-using-frame-src-expected.txt:
• http/tests/security/contentSecurityPolicy/report-and-enforce-expected.txt:
• http/tests/security/contentSecurityPolicy/report-blocked-data-uri-expected.txt:
• http/tests/security/contentSecurityPolicy/report-blocked-file-uri-expected.txt:
• http/tests/security/contentSecurityPolicy/report-blocked-uri-and-do-not-follow-redirect-when-sending-report-expected.txt:
• http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin-expected.txt:
• http/tests/security/contentSecurityPolicy/report-blocked-uri-expected.txt:
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-expected.txt:
• http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled-expected.txt:
• http/tests/security/contentSecurityPolicy/report-multiple-violations-01-expected.txt:
• http/tests/security/contentSecurityPolicy/report-multiple-violations-02-expected.txt:
• http/tests/security/contentSecurityPolicy/report-only-expected.txt:
• http/tests/security/contentSecurityPolicy/report-only-from-header-expected.txt:
• http/tests/security/contentSecurityPolicy/report-only-upgrade-insecure-expected.txt:
• http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-expected.txt:
• http/tests/security/contentSecurityPolicy/report-same-origin-with-cookies-when-private-browsing-enabled-expected.txt:
• http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https-expected.txt:
• http/tests/security/contentSecurityPolicy/report-uri-expected.txt:
• http/tests/security/contentSecurityPolicy/report-uri-from-child-frame-expected.txt:
• http/tests/security/contentSecurityPolicy/report-uri-from-inline-javascript-expected.txt:
• http/tests/security/contentSecurityPolicy/report-uri-from-javascript-expected.txt:
• http/tests/security/contentSecurityPolicy/report-uri-scheme-relative-expected.txt:
• http/tests/security/contentSecurityPolicy/same-origin-plugin-document-blocked-in-child-window-report-expected.txt:

8:36 AM Changeset in webkit [283110] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina BigSur wk1 Debug ] Assertion Failure: WebGL tests are flaky crashes.
​https://bugs.webkit.org/show_bug.cgi?id=230835.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

8:13 AM Changeset in webkit [283109] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina Debug wk1 EWS] performance-api/performance-observer-order.html is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230833.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

7:59 AM Changeset in webkit [283108] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Catalina Debug wk1 EWS ] storage/websql/multiple-transactions-on-different-handles.html is a flaky crash.
​https://bugs.webkit.org/show_bug.cgi?id=230831.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

7:45 AM Changeset in webkit [283107] by Eric Hutchison

• 2 edits in trunk/LayoutTests

imported/w3c/web-platform-tests/webrtc/RTCDataChannel-close.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=230696.

Unreviewed test gardening.

• platform/ios-14-wk2/TestExpectations:

5:34 AM Changeset in webkit [283106] by youenn@apple.com

• 2 edits in trunk/Source/WebKit

Rename RemoteCaptureSampleManager::RemoteAudio thread appropriately
​https://bugs.webkit.org/show_bug.cgi?id=230745

Reviewed by Eric Carlson.

No change of behavior.

• WebProcess/cocoa/RemoteCaptureSampleManager.cpp:

(WebKit::RemoteCaptureSampleManager::RemoteAudio::startThread):

4:25 AM Changeset in webkit [283105] by ntim@apple.com

• 9 edits in trunk/Source

Replace Node::isInert() with RenderStyle::effectiveInert()
​https://bugs.webkit.org/show_bug.cgi?id=230686

Reviewed by Antti Koivisto.

This replaces Node::isInert() in favor of RenderStyle::effectiveInert() which is more accurate. We can't use it in
Element::isFocusable(), since there's a bug with invalidation when accessing the cached computedStyle, hence
the Node::deprecatedIsInert() method.

Source/WebCore:

• accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::defaultObjectInclusion const):

• dom/Element.cpp:

(WebCore::Element::isFocusable const):

• dom/Node.cpp:

(WebCore::Node::canStartSelection const):
(WebCore::Node::deprecatedIsInert const): Added.

• dom/Node.h:
• dom/Position.cpp:

(WebCore::Position::nodeIsInertOrUserSelectNone):
(WebCore::Position::nodeIsUserSelectAll):

• rendering/RenderObject.cpp:

(WebCore::RenderObject::collectSelectionGeometriesInternal):

Source/WebKit:

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::selectionPositionInformation):

2:07 AM Changeset in webkit [283104] by ysuzuki@apple.com

• 2 edits in trunk/Source/JavaScriptCore

Unreviewed, fix CLoop build part 2
​https://bugs.webkit.org/show_bug.cgi?id=229223

• llint/LowLevelInterpreter64.asm:

1:55 AM Changeset in webkit [283103] by ysuzuki@apple.com

• 3 edits in trunk/Source/JavaScriptCore

Unreviewed, fix CLoop build
​https://bugs.webkit.org/show_bug.cgi?id=229223

• llint/LLIntOfflineAsmConfig.h:
• llint/LowLevelInterpreter64.asm:

12:52 AM Changeset in webkit [283102] by sbarati@apple.com

• 99 edits
  1 copy
  1 add in trunk

Build an unlinked baseline JIT
​https://bugs.webkit.org/show_bug.cgi?id=229223
<rdar://problem/82321772>

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

This patch adds an "unlinked" baseline JIT to JSVALUE64 platforms. The JIT
code produced by this baseline JIT can be shared between all CodeBlocks that
share an UnlinkedCodeBlock. The benefit of this is, if we're creating a CodeBlock
from an UnlinkedCodeBlock that already compiled an unlinked baseline JIT
instance, this new CodeBlock just starts off executing in the baseline JIT
"for free".

To make this work, the code we emit now needs to be independent of a specific
CodeBlock instance. We use a CodeBlock instance for minimal profiling information
when compiling, but otherwise, the code is tied to the UnlinkedCodeBlock. When
we need CodeBlock specific information, we load it. This usually means things
like we'll load things from the Metadata dynamically. This patch also adds a
"linked constant pool" concept, and anytime we instantiate such a CodeBlock,
we also need to instantiate this "linked constant pool". This contains things
like our inline cache data structures (StructureStubInfo*), JSGlobalObject*,
etc.

Unlinked baseline JIT always runs ICs in the "data" mode. To make this work, I
made data ICs work on x86_64. To do this, we no longer call/ret to the IC.
Instead, we jump to the IC, and the IC jumps back by loading the "done" location
from the StructureStubInfo dynamically. This simplifies the design to not be
based on the arm64 calling convention, and keeps the same performance characteristics.

This patch also adds a new version of InlineAccess that is only used in baseline
JIT (for now). In the future, we can make the DFG/FTL also use this for Data
ICs. But we don't need to do that yet since those tiers don't use data ICs by
default. The baseline JIT now has a pure data IC approach to InlineAccess. So
instead of repatching code, we repatch fields we load dynamically.

This patch also cleans up a few things in OSR exit, where both DFG/FTL were
storing callee saves to the callee saves buffer in a weird place, and separate
from one another. I noticed this code can be simplified if we just store
callee saves at the end of the OSR exit handler, and from common JIT emission
code.

This patch also fixes a bug where we could end up with the wrong (and always
more negative) SP in the baseline JIT. This could happen when we OSR exit
from an inlined getter/setter. The OSR exit code puts the return PC when
returning to the call site of the getter/setter to be the inline cache's
"done location". However, this "done location" didn't used to restore SP.
This patch conservatively makes it so that we restore the SP at these sites.

This is measured as a 1% speedup on Speedometer2.

• CMakeLists.txt:
• JavaScriptCore.xcodeproj/project.pbxproj:
• Sources.txt:
• bytecode/AccessCase.cpp:

(JSC::AccessCase::fromStructureStubInfo):
(JSC::AccessCase::generateImpl):

• bytecode/BytecodeList.rb:
• bytecode/BytecodeOperandsForCheckpoint.h:

(JSC::valueProfileOffsetFor):

• bytecode/CallLinkInfo.cpp:

(JSC::CallLinkInfo::fastPathStart):
(JSC::CallLinkInfo::emitFastPathImpl):
(JSC::CallLinkInfo::emitFastPath):
(JSC::CallLinkInfo::emitTailCallFastPath):
(JSC::CallLinkInfo::emitDataICFastPath):
(JSC::CallLinkInfo::emitTailCallDataICFastPath):
(JSC::CallLinkInfo::emitDataICSlowPath):
(JSC::CallLinkInfo::initializeDataIC):
(JSC::CallLinkInfo::emitDirectFastPath):
(JSC::CallLinkInfo::emitDirectTailCallFastPath):

• bytecode/CallLinkInfo.h:

(JSC::CallLinkInfo::offsetOfMaxArgumentCountIncludingThis):
(JSC::CallLinkInfo::slowStub): Deleted.
(JSC::CallLinkInfo::addressOfMaxArgumentCountIncludingThis): Deleted.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::setupWithUnlinkedBaselineCode):
(JSC::CodeBlock::isConstantOwnedByUnlinkedCodeBlock const):
(JSC::CodeBlock::setConstantRegisters):
(JSC::CodeBlock::finalizeJITInlineCaches):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::frameRegisterCount):
(JSC::CodeBlock::binaryArithProfileForPC):
(JSC::CodeBlock::unaryArithProfileForPC):
(JSC::CodeBlock::findPC):
(JSC::CodeBlock::jitSoon):
(JSC::CodeBlock::jitNextInvocation):
(JSC::CodeBlock::dumpMathICStats):
(JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
(JSC::CodeBlock::addJITAddIC): Deleted.
(JSC::CodeBlock::addJITMulIC): Deleted.
(JSC::CodeBlock::addJITSubIC): Deleted.
(JSC::CodeBlock::addJITNegIC): Deleted.
(JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
(JSC::CodeBlock::thresholdForJIT): Deleted.
(JSC::CodeBlock::jitAfterWarmUp): Deleted.

• bytecode/CodeBlock.h:

(JSC::CodeBlock::JITData::offsetOfJITConstantPool):
(JSC::CodeBlock::offsetOfJITData):
(JSC::CodeBlock::offsetOfArgumentValueProfiles):
(JSC::CodeBlock::offsetOfConstantsVectorBuffer):
(JSC::CodeBlock::baselineJITConstantPool):
(JSC::CodeBlock::checkIfJITThresholdReached):
(JSC::CodeBlock::dontJITAnytimeSoon):
(JSC::CodeBlock::llintExecuteCounter const):
(JSC::CodeBlock::offsetOfDebuggerRequests):
(JSC::CodeBlock::offsetOfShouldAlwaysBeInlined):
(JSC::CodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
(JSC::CodeBlock::addressOfNumParameters): Deleted.
(JSC::CodeBlock::isKnownCell): Deleted.
(JSC::CodeBlock::addMathIC): Deleted.
(JSC::CodeBlock::setJITCodeMap): Deleted.
(JSC::CodeBlock::jitCodeMap): Deleted.
(JSC::CodeBlock::switchJumpTable): Deleted.
(JSC::CodeBlock::stringSwitchJumpTable): Deleted.

• bytecode/CodeBlockInlines.h:

(JSC::CodeBlock::forEachValueProfile):
(JSC::CodeBlock::jitCodeMap):
(JSC::CodeBlock::baselineSwitchJumpTable):
(JSC::CodeBlock::baselineStringSwitchJumpTable):
(JSC::CodeBlock::dfgSwitchJumpTable):
(JSC::CodeBlock::dfgStringSwitchJumpTable):

• bytecode/ExecutableToCodeBlockEdge.h:
• bytecode/ExecutionCounter.cpp:

(JSC::ExecutionCounter<countingVariant>::setThreshold):

• bytecode/ExecutionCounter.h:

(JSC::ExecutionCounter::clippedThreshold):

• bytecode/GetByIdMetadata.h:

(JSC::GetByIdModeMetadataArrayLength::offsetOfArrayProfile):
(JSC::GetByIdModeMetadata::offsetOfMode):

• bytecode/GetByStatus.cpp:

(JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):

• bytecode/GetterSetterAccessCase.cpp:

(JSC::GetterSetterAccessCase::emitDOMJITGetter):

• bytecode/InByStatus.cpp:

(JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):

• bytecode/InlineAccess.cpp:

(JSC::InlineAccess::generateSelfPropertyAccess):
(JSC::InlineAccess::canGenerateSelfPropertyReplace):
(JSC::InlineAccess::generateSelfPropertyReplace):
(JSC::InlineAccess::isCacheableArrayLength):
(JSC::InlineAccess::generateArrayLength):
(JSC::InlineAccess::isCacheableStringLength):
(JSC::InlineAccess::generateStringLength):
(JSC::InlineAccess::generateSelfInAccess):
(JSC::InlineAccess::rewireStubAsJumpInAccess):
(JSC::InlineAccess::resetStubAsJumpInAccess):

• bytecode/InlineAccess.h:
• bytecode/IterationModeMetadata.h:

(JSC::IterationModeMetadata::offsetOfSeenModes):

• bytecode/LLIntCallLinkInfo.h:

(JSC::LLIntCallLinkInfo::offsetOfArrayProfile):

• bytecode/Opcode.h:
• bytecode/PolymorphicAccess.cpp:

(JSC::AccessGenerationState::succeed):
(JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
(JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions):
(JSC::PolymorphicAccess::regenerate):

• bytecode/PolymorphicAccess.h:

(JSC::AccessGenerationState::preserveLiveRegistersToStackForCallWithoutExceptions): Deleted.

• bytecode/PutByStatus.cpp:

(JSC::PutByStatus::computeForStubInfo):

• bytecode/StructureStubInfo.cpp:

(JSC::StructureStubInfo::initGetByIdSelf):
(JSC::StructureStubInfo::initPutByIdReplace):
(JSC::StructureStubInfo::initInByIdSelf):
(JSC::StructureStubInfo::addAccessCase):
(JSC::StructureStubInfo::reset):
(JSC::StructureStubInfo::visitWeakReferences):
(JSC::StructureStubInfo::propagateTransitions):
(JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo):

• bytecode/StructureStubInfo.h:

(JSC::StructureStubInfo::offsetOfByIdSelfOffset):
(JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure):
(JSC::StructureStubInfo::inlineAccessBaseStructure):
(JSC::StructureStubInfo::offsetOfDoneLocation):

• bytecode/SuperSampler.cpp:

(JSC::printSuperSamplerState):

• bytecode/UnlinkedCodeBlock.cpp:

(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
(JSC::UnlinkedCodeBlock::hasIdentifier):
(JSC::UnlinkedCodeBlock::thresholdForJIT):
(JSC::UnlinkedCodeBlock::allocateSharedProfiles):

• bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedCodeBlock::constantRegister):
(JSC::UnlinkedCodeBlock::instructionAt const):
(JSC::UnlinkedCodeBlock::bytecodeOffset):
(JSC::UnlinkedCodeBlock::instructionsSize const):
(JSC::UnlinkedCodeBlock::loopHintsAreEligibleForFuzzingEarlyReturn):
(JSC::UnlinkedCodeBlock::outOfLineJumpOffset):
(JSC::UnlinkedCodeBlock::binaryArithProfile):
(JSC::UnlinkedCodeBlock::unaryArithProfile):
(JSC::UnlinkedCodeBlock::llintExecuteCounter):

• bytecode/UnlinkedMetadataTable.h:

(JSC::UnlinkedMetadataTable::offsetInMetadataTable):

• bytecode/ValueProfile.h:

(JSC::ValueProfileBase::ValueProfileBase):
(JSC::ValueProfileBase::clearBuckets):
(JSC::ValueProfile::offsetOfFirstBucket):

• dfg/DFGCommonData.h:
• dfg/DFGJITCode.cpp:
• dfg/DFGJITCode.h:
• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::link):

• dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareOSREntry):

• dfg/DFGOSRExit.cpp:

(JSC::DFG::OSRExit::compileExit):

• dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::handleExitCounts):
(JSC::DFG::callerReturnPC):
(JSC::DFG::reifyInlinedCallFrames):
(JSC::DFG::adjustAndJumpToTarget):

• dfg/DFGOperations.cpp:

(JSC::DFG::JSC_DEFINE_JIT_OPERATION):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePutPrivateName):
(JSC::DFG::SpeculativeJIT::compileValueAdd):
(JSC::DFG::SpeculativeJIT::compileValueSub):
(JSC::DFG::SpeculativeJIT::compileValueNegate):
(JSC::DFG::SpeculativeJIT::compileValueMul):
(JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

• ftl/FTLCompile.cpp:

(JSC::FTL::compile):

• ftl/FTLJITCode.h:
• ftl/FTLLink.cpp:

(JSC::FTL::link):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::addMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

• ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

• generator/Metadata.rb:
• jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::storeProperty):
(JSC::AssemblyHelpers::emitVirtualCall):
(JSC::AssemblyHelpers::emitVirtualCallWithoutMovingGlobalObject):

• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBuffer):

• jit/BaselineJITCode.cpp: Added.

(JSC::MathICHolder::addJITAddIC):
(JSC::MathICHolder::addJITMulIC):
(JSC::MathICHolder::addJITSubIC):
(JSC::MathICHolder::addJITNegIC):
(JSC::MathICHolder::adoptMathICs):
(JSC::BaselineJITCode::BaselineJITCode):
(JSC::BaselineJITCode::~BaselineJITCode):

• jit/BaselineJITCode.h: Added.

(JSC::JITConstantPool::add):
(JSC::JITConstantPool::size const):
(JSC::JITConstantPool::at const):

• jit/BaselineJITPlan.cpp:

(JSC::BaselineJITPlan::finalize):

• jit/CCallHelpers.cpp:

(JSC::CCallHelpers::logShadowChickenTailPacketImpl):
(JSC::CCallHelpers::logShadowChickenTailPacket):

• jit/CCallHelpers.h:
• jit/CallFrameShuffleData.cpp:

(JSC::CallFrameShuffleData::setupCalleeSaveRegisters):

• jit/CallFrameShuffleData.h:
• jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::CallFrameShuffler):
(JSC::CallFrameShuffler::prepareForTailCall):

• jit/CallFrameShuffler.h:

(JSC::CallFrameShuffler::snapshot const):

• jit/JIT.cpp:

(JSC::JIT::JIT):
(JSC::JIT::emitEnterOptimizationCheck):
(JSC::JIT::emitNotifyWriteWatchpoint):
(JSC::JIT::emitVarReadOnlyCheck):
(JSC::JIT::assertStackPointerOffset):
(JSC::JIT::resetSP):
(JSC::JIT::emitPutCodeBlockToFrameInPrologue):
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
(JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters):
(JSC::JIT::emitRestoreCalleeSaves):
(JSC::JIT::compileAndLinkWithoutFinalizing):
(JSC::JIT::link):
(JSC::JIT::finalizeOnMainThread):
(JSC::JIT::privateCompile):
(JSC::JIT::frameRegisterCountFor):
(JSC::JIT::stackPointerOffsetFor):

• jit/JIT.h:
• jit/JITArithmetic.cpp:

(JSC::JIT::emit_compareAndJumpSlowImpl):
(JSC::JIT::emit_compareAndJumpSlow):
(JSC::JIT::emit_op_negate):
(JSC::JIT::emit_op_add):
(JSC::JIT::emitMathICFast):
(JSC::JIT::emitMathICSlow):
(JSC::JIT::emit_op_div):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emit_op_sub):

• jit/JITCall.cpp:

(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEval):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileTailCall):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):

• jit/JITCall32_64.cpp:

(JSC::JIT::emitPutCallResult):
(JSC::JIT::compileSetupFrame):
(JSC::JIT::compileCallEval):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileOpCall):
(JSC::JIT::compileOpCallSlowCase):
(JSC::JIT::emit_op_iterator_open):
(JSC::JIT::emitSlow_op_iterator_open):
(JSC::JIT::emit_op_iterator_next):
(JSC::JIT::emitSlow_op_iterator_next):

• jit/JITCode.h:

(JSC::JITCode::useDataIC):
(JSC::JITCode::pcToCodeOriginMap):

• jit/JITCompilationKey.cpp:

(JSC::JITCompilationKey::dump const):

• jit/JITCompilationKey.h:

(JSC::JITCompilationKey::JITCompilationKey):
(JSC::JITCompilationKey::operator! const):
(JSC::JITCompilationKey::isHashTableDeletedValue const):
(JSC::JITCompilationKey::operator== const):
(JSC::JITCompilationKey::hash const):
(JSC::JITCompilationKey::profiledBlock const): Deleted.

• jit/JITInlineCacheGenerator.cpp:

(JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
(JSC::JITInlineCacheGenerator::finalize):
(JSC::JITInlineCacheGenerator::generateBaselineDataICFastPath):
(JSC::JITGetByIdGenerator::JITGetByIdGenerator):
(JSC::generateGetByIdInlineAccess):
(JSC::JITGetByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITGetByIdWithThisGenerator::generateBaselineDataICFastPath):
(JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITDelByValGenerator::generateFastPath):
(JSC::JITDelByIdGenerator::generateFastPath):
(JSC::JITInByValGenerator::generateFastPath):
(JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITInstanceOfGenerator::generateFastPath):
(JSC::JITGetByValGenerator::generateFastPath):
(JSC::JITPutByValGenerator::generateFastPath):
(JSC::JITPrivateBrandAccessGenerator::generateFastPath):

• jit/JITInlineCacheGenerator.h:
• jit/JITInlines.h:

(JSC::JIT::isOperandConstantDouble):
(JSC::JIT::isOperandConstantInt):
(JSC::JIT::isKnownCell):
(JSC::JIT::getConstantOperand):
(JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
(JSC::JIT::linkSlowCaseIfNotJSCell):
(JSC::JIT::advanceToNextCheckpoint):
(JSC::JIT::emitJumpSlowToHotForCheckpoint):
(JSC::JIT::isOperandConstantChar):
(JSC::JIT::emitValueProfilingSite):
(JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):
(JSC::JIT::emitArrayProfilingSiteWithCell):
(JSC::JIT::emitLoadDouble):
(JSC::JIT::emitJumpSlowCaseIfNotJSCell):
(JSC::JIT::emitGetVirtualRegister):
(JSC::JIT::jumpTarget):
(JSC::JIT::loadPtrFromMetadata):
(JSC::JIT::load32FromMetadata):
(JSC::JIT::load8FromMetadata):
(JSC::JIT::store8ToMetadata):
(JSC::JIT::store32ToMetadata):
(JSC::JIT::materializePointerIntoMetadata):
(JSC::JIT::loadConstant):
(JSC::JIT::loadGlobalObject):
(JSC::JIT::loadCodeBlockConstant):
(JSC::JIT::copiedGetPutInfo): Deleted.
(JSC::JIT::copiedArithProfile): Deleted.

• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_mov):
(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emit_op_typeof_is_undefined):
(JSC::JIT::op_ret_handlerGenerator):
(JSC::JIT::emit_op_to_primitive):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::valueIsFalseyGenerator):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jeq_ptr):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::valueIsTruthyGenerator):
(JSC::JIT::emit_op_throw):
(JSC::JIT::op_throw_handlerGenerator):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_numeric):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_debug):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_enter):
(JSC::JIT::op_enter_handlerGenerator):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emitSlow_op_jeq):
(JSC::JIT::emitSlow_op_jneq):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_loop_hint):
(JSC::JIT::emitSlow_op_check_traps):
(JSC::JIT::op_check_traps_handlerGenerator):
(JSC::JIT::emit_op_new_regexp):
(JSC::JIT::emitNewFuncCommon):
(JSC::JIT::emitNewFuncExprCommon):
(JSC::JIT::emit_op_new_array):
(JSC::JIT::emit_op_new_array_with_size):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_tail):
(JSC::JIT::emit_op_profile_control_flow):
(JSC::JIT::emit_op_get_argument):
(JSC::JIT::emit_op_get_prototype_of):

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_new_object):
(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof_custom):
(JSC::JIT::emit_op_typeof_is_undefined):
(JSC::JIT::emit_op_set_function_name):
(JSC::JIT::emit_op_jfalse):
(JSC::JIT::emit_op_jtrue):
(JSC::JIT::emit_op_jeq_null):
(JSC::JIT::emit_op_jneq_null):
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emitSlow_op_eq):
(JSC::JIT::compileOpEqJumpSlow):
(JSC::JIT::emitSlow_op_neq):
(JSC::JIT::emitSlow_op_jstricteq):
(JSC::JIT::emitSlow_op_jnstricteq):
(JSC::JIT::emit_op_eq_null):
(JSC::JIT::emit_op_neq_null):
(JSC::JIT::emit_op_throw):
(JSC::JIT::emit_op_to_number):
(JSC::JIT::emit_op_to_numeric):
(JSC::JIT::emit_op_to_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::emit_op_enter):
(JSC::JIT::emit_op_create_this):
(JSC::JIT::emit_op_to_this):
(JSC::JIT::emit_op_profile_type):
(JSC::JIT::emit_op_log_shadow_chicken_tail):

• jit/JITOperations.cpp:

(JSC::JSC_DEFINE_JIT_OPERATION):

• jit/JITOperations.h:
• jit/JITPlan.cpp:

(JSC::JITPlan::key):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::generateGetByValSlowCase):
(JSC::JIT::slow_op_get_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::slow_op_get_private_name_prepareCallGenerator):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emitSlow_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emitSlow_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::slow_op_put_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::slow_op_put_private_name_prepareCallGenerator):
(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::slow_op_del_by_id_prepareCallGenerator):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::slow_op_del_by_val_prepareCallGenerator):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::slow_op_get_by_id_prepareCallGenerator):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::slow_op_get_by_id_with_this_prepareCallGenerator):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::slow_op_put_by_id_prepareCallGenerator):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitSlow_op_has_private_name):
(JSC::JIT::emitSlow_op_has_private_brand):
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emitResolveClosure):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::generateOpResolveScopeThunk):
(JSC::JIT::slow_op_resolve_scopeGenerator):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::generateOpGetFromScopeThunk):
(JSC::JIT::slow_op_get_from_scopeGenerator):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::slow_op_put_to_scopeGenerator):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_get_internal_field):
(JSC::JIT::emit_op_enumerator_next):
(JSC::JIT::emit_op_enumerator_get_by_val):
(JSC::JIT::emit_enumerator_has_propertyImpl):
(JSC::JIT::emitWriteBarrier):
(JSC::JIT::emitPutGlobalVariable): Deleted.
(JSC::JIT::emitPutGlobalVariableIndirect): Deleted.
(JSC::JIT::emitPutClosureVar): Deleted.

• jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emit_op_put_getter_by_val):
(JSC::JIT::emit_op_put_setter_by_val):
(JSC::JIT::emit_op_del_by_id):
(JSC::JIT::emit_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_val):
(JSC::JIT::emitSlow_op_del_by_id):
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_get_private_name):
(JSC::JIT::emitSlow_op_get_private_name):
(JSC::JIT::emit_op_put_private_name):
(JSC::JIT::emitSlow_op_put_private_name):
(JSC::JIT::emit_op_set_private_brand):
(JSC::JIT::emitSlow_op_set_private_brand):
(JSC::JIT::emit_op_check_private_brand):
(JSC::JIT::emitSlow_op_check_private_brand):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
(JSC::JIT::emit_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emit_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emit_op_put_by_id):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::emit_op_in_by_id):
(JSC::JIT::emitSlow_op_in_by_id):
(JSC::JIT::emit_op_in_by_val):
(JSC::JIT::emitSlow_op_in_by_val):
(JSC::JIT::emitHasPrivate):
(JSC::JIT::emitHasPrivateSlow):
(JSC::JIT::emitVarInjectionCheck):
(JSC::JIT::emit_op_resolve_scope):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::emit_op_get_from_arguments):
(JSC::JIT::emit_op_get_internal_field):

• jit/Repatch.cpp:

(JSC::tryCacheGetBy):
(JSC::tryCachePutBy):
(JSC::tryCacheInBy):
(JSC::unlinkCall):

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::jitCompileAndSetHeuristics):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):

• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/CacheableIdentifier.h:
• runtime/CacheableIdentifierInlines.h:

(JSC::CacheableIdentifier::createFromIdentifierOwnedByCodeBlock):

• runtime/CachedTypes.cpp:

(JSC::CachedCodeBlock::numBinaryArithProfiles const):
(JSC::CachedCodeBlock::numUnaryArithProfiles const):
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
(JSC::CachedCodeBlock<CodeBlockType>::encode):

• runtime/CommonSlowPaths.cpp:

(JSC::updateArithProfileForUnaryArithOp):

• runtime/FunctionExecutable.h:
• runtime/Options.cpp:

(JSC::Options::recomputeDependentOptions):

• runtime/OptionsList.h:
• runtime/ScriptExecutable.cpp:

(JSC::ScriptExecutable::prepareForExecutionImpl):

• wasm/WasmLLIntTierUpCounter.h:

(JSC::Wasm::LLIntTierUpCounter::optimizeAfterWarmUp):
(JSC::Wasm::LLIntTierUpCounter::optimizeSoon):

• wasm/WasmTierUpCount.cpp:

(JSC::Wasm::TierUpCount::TierUpCount):

• wasm/WasmTierUpCount.h:

(JSC::Wasm::TierUpCount::optimizeAfterWarmUp):
(JSC::Wasm::TierUpCount::optimizeNextInvocation):
(JSC::Wasm::TierUpCount::optimizeSoon):

Source/WTF:

• wtf/Bag.h:
• wtf/Packed.h:

(WTF::PackedAlignedPtr::operator* const):

Tools:

• Scripts/run-jsc-stress-tests:

12:48 AM Changeset in webkit [283101] by ysuzuki@apple.com

• 4 edits in trunk/Source/JavaScriptCore

[JSC] Use op_jeq_ptr for empty JSPropertyNameEnumerator check
​https://bugs.webkit.org/show_bug.cgi?id=230817

Reviewed by Saam Barati.

We use op_jeq_ptr for empty JSPropertyNameEnumerator check instead of stricteq for smaller
bytecode size and efficient branching in LLInt and Baseline. In DFG and FTL, both will get
the same nodes.

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitJumpIfEmptyPropertyNameEnumerator):

• bytecompiler/BytecodeGenerator.h:
• bytecompiler/NodesCodegen.cpp:

(JSC::ForInNode::emitBytecode):

12:08 AM Changeset in webkit [283100] by Martin Robinson

• 6 edits
  2 adds in trunk

Mandatory scroll snapping doesn't work correctly in tables with position:sticky
​https://bugs.webkit.org/show_bug.cgi?id=227300
<rdar://problem/79971196>

Reviewed by Simon Fraser.

Source/WebCore:

Add a mode for mapLocalToContainer which ignores sticky offsets. This will be
used by more code in the future.

Test: css3/scroll-snap/scroll-snap-drag-scrollbar-thumb-with-sticky.html

• page/scrolling/ScrollSnapOffsetsInfo.cpp:

(WebCore::updateSnapOffsetsForScrollableArea): Pass the IgnoreStickyOffsets flag.

• rendering/RenderBox.cpp:

(WebCore::RenderBox::mapLocalToContainer const): When the IgnoreStickyOffsets flag is
passed, explicitly remove sticky offsets from the container offset.

• rendering/RenderObjectEnums.h: Add the IgnoreStickyOffests flag.

LayoutTests:

Add a test which exercises the original bug.

• css3/scroll-snap/scroll-snap-drag-scrollbar-thumb-with-sticky-expected.txt: Added.
• css3/scroll-snap/scroll-snap-drag-scrollbar-thumb-with-sticky.html: Added.
• platform/ios/TestExpectations: Skip this test on iOS, which doesn't support thumb dragging.