Context Navigation

← Previous Period
Next Period →

Timeline

Oct 17, 2021:

5:22 PM Changeset in webkit [284346] by Kocsen Chung

2 edits in branches/safari-612-branch/Source/JavaScriptCore

Cherry-pick r284212. rdar://problem/84351869

Wasm LLInt should zero bytecodeIndex before throwing
https://bugs.webkit.org/show_bug.cgi?id=231688
<rdar://84207898>

Reviewed by Yusuke Suzuki.

After r283852, the unwinder can now ask WebAssembly frames for their bytecodeIndex.
We do write to the bytecodeIndex when throwing from the wasm throw opcode, but we
failed to write when trapping (e.g. throwing an OOB or Unreachable). The value of
the bytecodeIndex in this is case is not interesting, since these exceptions can't be
caught from Wasm, all we need to know is ensure there isn't an invalid left-over
value in that stack slot, so we zero it.

llint/WebAssembly.asm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284212 268f45cc-cd09-0410-ab3c-d52691b4dbfc

5:21 PM Changeset in webkit [284345] by Kocsen Chung

3 edits in branches/safari-612-branch/Source/ThirdParty/libwebrtc

Cherry-pick r284082. rdar://problem/84351872

Override guessed color space for incoming H.264/265 streams
https://bugs.webkit.org/show_bug.cgi?id=231353
<rdar://problem/83969311>

Reviewed by Youenn Fablet.

When the VTDecompressionSession decodes incoming H.264/H.265 samples,
it puts guessed color space attachments on the CVPixelBuffer, and the
guesses are based on video resolution. WebRTC streams however default
to being sRGB. So this patch overrides a guess with what we know the
stream will be. (Once we support different color spaces in WebRTC
video streams we'll need to adjust this.)

Source/webrtc/sdk/objc/components/video_codec/RTCVideoDecoderH264.mm: (overrideColorSpaceAttachmentsIfNeeded): (decompressionOutputCallback):
Source/webrtc/sdk/objc/components/video_codec/RTCVideoDecoderH265.mm: (overrideColorSpaceAttachmentsIfNeeded): (h265DecompressionOutputCallback):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284082 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:15 PM Changeset in webkit [284344] by ddkilzer@apple.com

7 edits in trunk/Source

Build fix #3: Adopt attribution AVCaptureSession SPI for GPU process
https://bugs.webkit.org/show_bug.cgi?id=231621
<rdar://problem/80748535>

Unreviewed build fix.

Source/WebCore/PAL:

pal/spi/cocoa/TCCSPI.h:
Use HAVE(TCC_IOS_14_BIG_SUR_SPI).

Source/WebKit:

Shared/Cocoa/TCCSoftLink.h:

(tcc_identity_create):

Shared/Cocoa/TCCSoftLink.mm:

(tcc_identity_create):

Use HAVE(TCC_IOS_14_BIG_SUR_SPI).

Source/WTF:

wtf/PlatformHave.h:

(HAVE_TCC_IOS_14_BIG_SUR_SPI): Add.

Used for TCC.framework SPI available in iOS 14 and macOS 11 Big Sur and later.

3:51 PM Changeset in webkit [284343] by Alan Bujtas

2 edits in trunk/LayoutTests

IFC progression (inline box borders).

Unreviewed.

TestExpectations:

2:19 PM Changeset in webkit [284342] by ddkilzer@apple.com

2 edits in trunk/Source/WebKit

Follow-up: WebKit::LocalConnection::createCredentialPrivateKey leaks an NSMutableDictionary
<https://webkit.org/b/231814>
<rdar://problem/84307054>

Unreviewed follow-up to address Darin's comments.

UIProcess/WebAuthentication/Cocoa/LocalConnection.mm:

(WebKit::LocalConnection::createCredentialPrivateKey const):

Remove need for C-style cast by using a local variable for the mutable copy of the NSDictionary.

1:47 PM Changeset in webkit [284341] by mark.lam@apple.com

6 edits in trunk/Source/JavaScriptCore

Make LLIntAssembly.h more readable.
https://bugs.webkit.org/show_bug.cgi?id=231876

Reviewed by Yusuki Suzuki.

In this patch, I did the following:

Changed CodeOrigin to only dump the filename, and not the full path.

Deferred printing the ".loc" metadata in $asm.debugAnnotation till we format the line to dump in $asm.formatDump. This enabled the ".loc" metadata to be dumped on the same line as the asm instruction.

Changed $asm.codeOrigin to not dump multiple codeOrigin comments. The only times when there appears to be "multiple" codeOrigins for any given instruction is if the instruction before it was elided, thereby leaving the elided instruction's codeOrigin to be mis-attributed to the subsequent instruction.

Moved the MIPS Assembler.putStr method to asm.rb. This method was already commonly used in arm.rb and arm64.rb previously. Hence, it belongs in common code.

Also enhanced it to support indenting by the column width of ".loc" debug
annotations if $enableDebugAnnotations is true. This keeps the ".loc" column
on the left clear of other content, thereby making it easy to visually filter
out that column when scanning through the generated asm code.

Changed some code that called outp.puts directly to call $asm.putStr instead. This yields the nice alignment for easy visual filtering described in (4).

Changed $preferredCommentStartColumn to be at column 40 to make the generated asm code more compact. However, if the backend is the C_LOOP, then change it back to 60 because C_LOOP code is more verbose and need the extra space.

Demo time:
Before this patch, LLIntAssembly.h looks like this:
`
#if !OFFLINE_ASM_X86 && !OFFLINE_ASM_X86_WIN && !OFFLINE_ASM_X86_64 && !OFFLINE_ASM_X86_64_WIN && !OFFLINE_ASM_ARMv7 && !OFFLINE_ASM_ARM64 && OFFLINE_ASM_ARM64E && !OFFLINE_ASM_MIPS && !OFFLINE_ASM_RISCV64 && !OFFLINE_ASM_C_LOOP && !OFFLINE_ASM_C_LOOP_WIN && !OFFLINE_ASM_ARMv7k && !OFFLINE_ASM_ARMv7s && OFFLINE_ASM_JSVALUE64 && !OFFLINE_ASM_BIGINT32 && OFFLINE_ASM_GIGACAGE_ENABLED && !OFFLINE_ASM_ASSERT_ENABLED && !OFFLINE_ASM_TRACING && OFFLINE_ASM_ADDRESS64 && OFFLINE_ASM_JIT && OFFLINE_ASM_WEBASSEMBLY && OFFLINE_ASM_HAVE_FAST_TLS && OFFLINE_ASM_WEBASSEMBLY_B3JIT
OFFLINE_ASM_BEGIN
OFFLINE_ASM_GLOBAL_LABEL(llintPCRangeStart)
".file 1 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter.asm\"\n"
".file 2 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitBytecodes.asm\"\n"
".file 3 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm\"\n"
".file 4 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm\"\n"
".file 5 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitWasm.asm\"\n"
".file 6 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/WebAssembly.asm\"\n"
".file 7 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/usr/local/include/WebKitAdditions/LowLevelInterpreterAdditions.asm\"\n"
".loc 1 1672\n"

"\tbrk #0xc471\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1672

".loc 1 1681\n"

OFFLINE_ASM_GLOBAL_LABEL(vmEntryToJavaScript)
".loc 1 1066\n"

"\tpacibsp\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1066

".loc 1 1070\n"

"\tstp x29, x30, [sp, #-16]!\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1070

".loc 1 1075\n"

"\tmov x29, sp\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1075

".loc 1 1090\n"

"\tsub sp, x29, #176\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1090

".loc 3 169\n"

"\tmovz x13, #48040, lsl #0\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:169

".loc 3 169\n"

"\tadd x17, x1, x13, lsl #0\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:169

".loc 3 169\n"

"\tldr w4, [x17, #0]\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:169

".loc 3 170\n"

"\tcbnz w4, " LOCAL_LABEL_STRING(_offlineasm_doVMEntrycheckVMEntryPermission) "\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:170

".loc 3 172\n"

"\tstr x1, [sp, #0]\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:172

...

".loc 3 309\n"

"\tmov x3, x0\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:309

".loc 1 1\n"
#if OS(DARWIN)

"\tL_offlineasm_loh_adrp_1:\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1
"\tadrp x2, " LOCAL_REFERENCE(g_config) "@GOTPAGE\n"
"\tL_offlineasm_loh_ldr_1:\n"
"\tldr x2, [x2, " LOCAL_REFERENCE(g_config) "@GOTPAGEOFF]\n"

#elif OS(LINUX)

"\tadrp x2, :got:" LOCAL_REFERENCE(g_config) "\n"
"\tldr x2, [x2, :got_lo12:" LOCAL_REFERENCE(g_config) "]\n"

#else
#error Missing globaladdr implementation
#endif
".loc 1 1\n"

"\tadd x2, x2, #3072\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1

After this patch, LLIntAssembly.h looks like this:
`
#if !OFFLINE_ASM_X86 && !OFFLINE_ASM_X86_WIN && !OFFLINE_ASM_X86_64 && !OFFLINE_ASM_X86_64_WIN && !OFFLINE_ASM_ARMv7 && !OFFLINE_ASM_ARM64 && OFFLINE_ASM_ARM64E && !OFFLINE_ASM_MIPS && !OFFLINE_ASM_RISCV64 && !OFFLINE_ASM_C_LOOP && !OFFLINE_ASM_C_LOOP_WIN && !OFFLINE_ASM_ARMv7k && !OFFLINE_ASM_ARMv7s && OFFLINE_ASM_JSVALUE64 && !OFFLINE_ASM_BIGINT32 && OFFLINE_ASM_GIGACAGE_ENABLED && !OFFLINE_ASM_ASSERT_ENABLED && !OFFLINE_ASM_TRACING && OFFLINE_ASM_ADDRESS64 && OFFLINE_ASM_JIT && OFFLINE_ASM_WEBASSEMBLY && OFFLINE_ASM_HAVE_FAST_TLS && OFFLINE_ASM_WEBASSEMBLY_B3JIT

OFFLINE_ASM_BEGIN
OFFLINE_ASM_GLOBAL_LABEL(llintPCRangeStart)
".file 1 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter.asm\"\n"
".file 2 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitBytecodes.asm\"\n"
".file 3 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm\"\n"
".file 4 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm\"\n"
".file 5 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitWasm.asm\"\n"
".file 6 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/WebAssembly.asm\"\n"
".file 7 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/usr/local/include/WebKitAdditions/LowLevelInterpreterAdditions.asm\"\n"

".loc 1 1672\n" "brk #0xc471 \n" LowLevelInterpreter.asm:1672

".loc 1 1681\n" OFFLINE_ASM_GLOBAL_LABEL(vmEntryToJavaScript)
".loc 1 1066\n" "pacibsp \n" LowLevelInterpreter.asm:1066
".loc 1 1070\n" "stp x29, x30, [sp, #-16]! \n" LowLevelInterpreter.asm:1070
".loc 1 1075\n" "mov x29, sp \n" LowLevelInterpreter.asm:1075
".loc 1 1090\n" "sub sp, x29, #176 \n" LowLevelInterpreter.asm:1090
".loc 3 169\n" "movz x13, #48040, lsl #0 \n" LowLevelInterpreter64.asm:169

"add x17, x1, x13, lsl #0 \n"
"ldr w4, [x17, #0] \n"

".loc 3 170\n" "cbnz w4, " LOCAL_LABEL_STRING(_offlineasm_doVMEntrycheckVMEntryPermission) " \n" LowLevelInterpreter64.asm:170
".loc 3 172\n" "str x1, [sp, #0] \n" LowLevelInterpreter64.asm:172

...

".loc 3 309\n" "mov x3, x0 \n" LowLevelInterpreter64.asm:309

#if OS(DARWIN)

".loc 1 1\n" "L_offlineasm_loh_adrp_1: \n" LowLevelInterpreter.asm:1

"adrp x2, " LOCAL_REFERENCE(g_config) "@GOTPAGE \n"
"L_offlineasm_loh_ldr_1: \n"
"ldr x2, [x2, " LOCAL_REFERENCE(g_config) "@GOTPAGEOFF] \n"

#elif OS(LINUX)

"adrp x2, :got:" LOCAL_REFERENCE(g_config) " \n"
"ldr x2, [x2, :got_lo12:" LOCAL_REFERENCE(g_config) "] \n"

#else
#error Missing globaladdr implementation
#endif

".loc 1 1\n" "add x2, x2, #3072 \n"
`

offlineasm/asm.rb:
offlineasm/cloop.rb:
offlineasm/config.rb:
offlineasm/mips.rb:
offlineasm/parser.rb:

1:46 PM Changeset in webkit [284340] by ddkilzer@apple.com

5 edits
2 copies in trunk

Add tests for WTF::OSObjectPtr/adoptOSObject in Cocoa with and without ARC
<https://webkit.org/b/231819>
<rdar://problem/84312692>

Reviewed by Darin Adler.

Source/WTF:

wtf/OSObjectPtr.h:

(WTF::adoptOSObject):

Rename when building with ARC enabled to prevent leaks or over-releases when linking ARC and non-ARC code.
Add WARN_UNUSED_RETURN attribute to match WTF::adoptNS().

Tools:

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
Add OSObjectPtrCocoa.mm and OSObjectPtrCocoaARC.mm source files to the project.
TestWebKitAPI/Tests/WTF/darwin/OSObjectPtr.cpp:

(TestWebKitAPI::TEST):

Make code work when compiled with ARC enabled.
Fix a pre-existing leak of dispatch_queue_t in RetainRelease test.
TestWebKitAPI/Tests/WTF/darwin/OSObjectPtrCocoa.mm: Add.
TestWebKitAPI/Tests/WTF/darwin/OSObjectPtrCocoaARC.mm: Add.
Add test files that #include OSObjectPtr.cpp.

1:19 PM Changeset in webkit [284339] by Fujii Hironori

11 edits in trunk/LayoutTests

[WinCairo] Unreviewed test gardening

platform/wincairo/fast/css/font-face-opentype-expected.txt:
platform/wincairo/fast/text/basic/015-expected.txt:
platform/wincairo/fast/text/whitespace/004-expected.txt:
platform/wincairo/fast/text/whitespace/005-expected.txt:
platform/wincairo/fast/text/whitespace/006-expected.txt:
platform/wincairo/fast/text/whitespace/007-expected.txt:
platform/wincairo/fast/text/whitespace/010-expected.txt:
platform/wincairo/fast/text/whitespace/011-expected.txt:
platform/wincairo/fast/text/whitespace/015-expected.txt:
platform/wincairo/fast/text/whitespace/016-expected.txt:

12:30 PM Changeset in webkit [284338] by Kocsen Chung

92 edits
26 deletes in branches/safari-612-branch

Restore state to r284288 due to build failures.

12:00 PM Changeset in webkit [284337] by BJ Burg

7 edits
2 deletes in trunk

[Cocoa] Web Inspector: remove _WKInspectorExtensionPrivateForTesting
https://bugs.webkit.org/show_bug.cgi?id=231784
<rdar://problem/84280608>

Reviewed by Timothy Hatcher.

Source/WebKit:

Promote the only method to be API for _WKInspectorExtension. It is needed
to implement some parts of the devtools API.

SourcesCocoa.txt:
UIProcess/API/Cocoa/_WKInspectorExtension.h:
UIProcess/API/Cocoa/_WKInspectorExtension.mm:

(-[_WKInspectorExtension evaluateScript:inTabWithIdentifier:completionHandler:]):

UIProcess/API/Cocoa/_WKInspectorExtensionPrivateForTesting.h: Removed.
UIProcess/API/Cocoa/_WKInspectorExtensionTesting.mm: Removed.
WebKit.xcodeproj/project.pbxproj:

Tools:

TestWebKitAPI/Tests/WebKitCocoa/WKInspectorExtension.mm:

(TEST):

9:54 AM Changeset in webkit [284336] by Simon Fraser

5 edits
6 adds in trunk

REGRESSION (r270850): Reference clip path clips in the wrong place when inside non-visible overflow
https://bugs.webkit.org/show_bug.cgi?id=231852
<rdar://83186229>

Reviewed by Tim Horton.
Source/WebCore:

When clipping CSS boxes with reference clip paths we need to give RenderSVGResourceClipper two
different rectangles; the objectBoundingBox that is used to compute clip path geometry,
and the bounds of the clipped content, so that the buffer-based clipping code path
can create an ImageBuffer of the appropriate size.

Previously, we confounded these two rectangles, resulting in various bugs.

Tests: css3/masking/reference-clip-path-bounds.html

css3/masking/reference-clip-path-objectBoundingBox-buffer-clip.html
css3/masking/reference-clip-path-objectBoundingBox-path-clip.html

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::setupClipPath):

rendering/svg/RenderSVGResourceClipper.cpp:

(WebCore::RenderSVGResourceClipper::applyResource):
(WebCore::RenderSVGResourceClipper::applyClippingToContext):

rendering/svg/RenderSVGResourceClipper.h:

LayoutTests:

Tests for reference clip-path with box-shadows and enclosing oveflow:hidden.

css3/masking/reference-clip-path-bounds-expected.html: Added.
css3/masking/reference-clip-path-bounds.html: Added.
css3/masking/reference-clip-path-objectBoundingBox-buffer-clip-expected.html: Added.
css3/masking/reference-clip-path-objectBoundingBox-buffer-clip.html: Added.
css3/masking/reference-clip-path-objectBoundingBox-path-clip-expected.html: Added.
css3/masking/reference-clip-path-objectBoundingBox-path-clip.html: Added.

9:38 AM Changeset in webkit [284335] by commit-queue@webkit.org

4 edits
2 adds in trunk

AX: WebKit should not expose redundant AXGroups with missing role when the label is the same as the contents
https://bugs.webkit.org/show_bug.cgi?id=169924

Patch by Tyler Wilcock <Tyler Wilcock> on 2021-10-17
Reviewed by Chris Fleizach.

Source/WebCore:

Don't expose groups with redundant accessibility text on the Mac.
Here's an example of one such group:

This group is not useful to accessibility clients. Instead, we
expose the text contents directly.

Test: accessibility/ignore-redundant-accessibility-text-groups.html

accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::textUnderElement const):
Instead of asserting when we try to get the text of an element in a
document that needs a style update, return an empty string.

accessibility/mac/AccessibilityObjectMac.mm:

(WebCore::shouldIgnoreGroup): Added.
(WebCore::AccessibilityObject::accessibilityPlatformIncludesObject const):

LayoutTests:

Add a test ensuring WebKit appropriately does and doesn't expose
groups with redundant accessibility text.

accessibility/mac/ignore-redundant-accessibility-text-groups-expected.txt: Added.
accessibility/mac/ignore-redundant-accessibility-text-groups.html: Added.

7:45 AM Changeset in webkit [284334] by Antti Koivisto

13 edits
2 adds in trunk

[LFC][Integration] Support background-clip:text on inline boxes
https://bugs.webkit.org/show_bug.cgi?id=231877

Reviewed by Alan Bujtas.

Source/WebCore:

Implement text mask painting.

Test: fast/inline/inline-background-clip-text.html

layout/integration/InlineIteratorBoxLegacyPath.h:

(WebCore::InlineIterator::BoxLegacyPath::firstLeafBoxForInlineBox const):
(WebCore::InlineIterator::BoxLegacyPath::lastLeafBoxForInlineBox const):

layout/integration/InlineIteratorBoxModernPath.h:

(WebCore::InlineIterator::BoxModernPath::firstLeafBoxForInlineBox const):
(WebCore::InlineIterator::BoxModernPath::lastLeafBoxForInlineBox const):
(WebCore::InlineIterator::BoxModernPath::isWithinInlineBox):

layout/integration/InlineIteratorInlineBox.cpp:

(WebCore::InlineIterator::InlineBox::firstLeafBox const):
(WebCore::InlineIterator::InlineBox::lastLeafBox const):
(WebCore::InlineIterator::InlineBox::endLeafBox const):

Add iterator support for getting leaf boxes of an inline box.

layout/integration/InlineIteratorInlineBox.h:
layout/integration/LayoutIntegrationCoverage.cpp:

(WebCore::LayoutIntegration::printReason):
(WebCore::LayoutIntegration::canUseForRenderInlineChild):

layout/integration/LayoutIntegrationCoverage.h:
rendering/RenderBoxModelObject.cpp:

(WebCore::RenderBoxModelObject::paintMaskForTextFillBox):

Paint the mask directly using TextBoxPainter instead of recursing to the general painting code.

rendering/TextBoxPainter.cpp:

(WebCore::TextBoxPainter::TextBoxPainter):

rendering/TextBoxPainter.h:

LayoutTests:

fast/inline/inline-background-clip-text-expected.html: Added.
fast/inline/inline-background-clip-text.html: Added.

Oct 16, 2021:

10:58 PM Changeset in webkit [284333] by Alan Bujtas

4 edits in trunk/Source/WebCore

[LFC][IFC] Adjust the logical right side of the line with line spanning inline boxes
https://bugs.webkit.org/show_bug.cgi?id=231862

Reviewed by Antti Koivisto.

This patch is in preparation for supporting "box-decoration-break: clone".

The line spanning inline box takes up space on the line (see line logical width)
The inline box may be getting closed on the line (do not double account for the end width, see handleInlineContent )
When we commit the inline box closing, turn the ending into just a normal run (see appendInlineBoxEnd )

layout/formattingContexts/inline/InlineLine.cpp:

(WebCore::Layout::Line::initialize):
(WebCore::Layout::Line::appendInlineBoxStart):
(WebCore::Layout::Line::appendInlineBoxEnd):
(WebCore::Layout::Line::appendTextContent):
(WebCore::Layout::Line::appendNonReplacedInlineLevelBox):
(WebCore::Layout::Line::appendLineBreak):
(WebCore::Layout::Line::appendWordBreakOpportunity):

layout/formattingContexts/inline/InlineLine.h:

(WebCore::Layout::Line::contentLogicalRight const):
(WebCore::Layout::Line::lineSpanningInlineBoxRunEnds const):
(WebCore::Layout::Line::lastRunLogicalRight const):

layout/formattingContexts/inline/InlineLineBuilder.cpp:

(WebCore::Layout::LineBuilder::handleInlineContent):
(WebCore::Layout::LineBuilder::rebuildLineForTrailingSoftHyphen):

9:52 PM Changeset in webkit [284332] by ysuzuki@apple.com

4 edits in trunk/Source/JavaScriptCore

[JSC] Use SourceID in SamplingProfiler
https://bugs.webkit.org/show_bug.cgi?id=231855

Reviewed by Mark Lam.

SamplingProfiler was still using intptr_t. We replace it with SourceID.
We also define internalSourceID and aggregatedExternalSourceID in SourceID.h.
They are special SourceID internally used in SamplingProfiler.

bytecode/SourceID.h:
runtime/SamplingProfiler.cpp:

(JSC::SamplingProfiler::StackFrame::sourceID):
(JSC::SamplingProfiler::reportTopFunctions):

runtime/SamplingProfiler.h:

9:03 PM Changeset in webkit [284331] by ddkilzer@apple.com

9 edits in trunk/Source/WebKit

[WebAuthn] Many Objective-C classes leak their instance variables
<https://webkit.org/b/231834>
<rdar://problem/84317190>

Reviewed by Brent Fulgham.

UIProcess/API/Cocoa/_WKAuthenticationExtensionsClientInputs.mm:

(-[_WKAuthenticationExtensionsClientInputs dealloc]):

UIProcess/API/Cocoa/_WKPublicKeyCredentialCreationOptions.mm:

(-[_WKPublicKeyCredentialCreationOptions dealloc]):

UIProcess/API/Cocoa/_WKPublicKeyCredentialDescriptor.mm:

(-[_WKPublicKeyCredentialDescriptor dealloc]):

UIProcess/API/Cocoa/_WKPublicKeyCredentialEntity.mm:

(-[_WKPublicKeyCredentialEntity dealloc]):

UIProcess/API/Cocoa/_WKPublicKeyCredentialParameters.mm:

(-[_WKPublicKeyCredentialParameters dealloc]):

UIProcess/API/Cocoa/_WKPublicKeyCredentialRelyingPartyEntity.mm:

(-[_WKPublicKeyCredentialRelyingPartyEntity dealloc]):

UIProcess/API/Cocoa/_WKPublicKeyCredentialRequestOptions.mm:

(-[_WKPublicKeyCredentialRequestOptions dealloc]):

UIProcess/API/Cocoa/_WKPublicKeyCredentialUserEntity.mm:

(-[_WKPublicKeyCredentialUserEntity dealloc]):

Add -dealloc methods that release instance variables.

9:00 PM Changeset in webkit [284330] by rmorisset@apple.com

91 edits
3 adds in trunk

Allow WASM to use up to 4GB
https://bugs.webkit.org/show_bug.cgi?id=229353
rdar://81603447

Reviewed by Yusuke Suzuki.

JSTests:

The big-wasm-memory/wasm-memory-requested... tests used to simply expect an OOM at 2GB.
They now expect success at 4GB, and failure at 4GB+1.
The exceptions they expect are now more specific, as previously there was a rounding issue that was causing the specific exceptions not to be thrown (resulting in the generic OOM exception later in the code).
Finally I made them only run on 64-bit platforms since we don't support typed arrays >=2GB on 32-bits, and I made them only run in one configuration since they can take a little bit of time.

I also added a few new tests, specifically checking our handling of large typed arrays, and especially of indices above INT32_MAX.

stress/big-wasm-memory-grow-no-max.js:

(test):

stress/big-wasm-memory-grow.js:

(test):

stress/big-wasm-memory.js:

(test):

stress/typed-array-always-large.js: Added.

(getArrayLength):
(getByVal):
(putByVal):
(test):

stress/typed-array-eventually-large.js: Added.

(getArrayLength):
(getByVal):
(putByVal):
(test):

stress/typed-array-large-eventually-oob.js: Added.

(getArrayLength):
(getByVal):
(putByVal):
(test):

wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js:
wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js:

Source/JavaScriptCore:

While increasing MAX_ARRAY_BUFFER_SIZE to 4GB was easy, it was not remotely the only thing required to get this to work:

4GB is not representable in a uint32_t, so I changed all length of ArrayBuffer/TypedArray/etc.. to being size_t.
This also required changing NewTypedArray in all of LLInt/Baseline/DFG/FTL to accept a non-int32 size.

In order to avoid performance regressions, I had to add speculation in the DFG/FTL, which now have two versions of NewTypedArray (one that takes an Int32 and one that takes a StrictInt52)

Similarly, GetArrayLength and GetTypedArrayByteOffset now can either return an Int32 or a larger number.

I also had to split them in the DFG/FTL, see GetTypedArrayLengthAsInt52 and GetTypedArrayByteOffsetAsInt52 for examples

In turns, I had to add CheckInBoundsInt52 since CheckInBounds could not accept the result of GetTypedArrayLengthAsInt52
I modified the runtime functions for GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX to accept non-Int32 indices, since for {Int8/UInt8/UInt8Clamped}Array, a maximum size of 4GB implies indices > 2B.
I added a "mayBeLargeTypedArray" bit to ArrayProfile/UnlinkedArrayProfile/DFG::ArrayMode to track whether such a non-Int32 index was seen to allow proper speculation and specialization of fast paths in the DFG/FTL.

I then updated the runtime functions used by the slow paths to correctly update it.

Unfortunately I ran out of time to add all the speculations/update all the fast paths.
So the following will have to wait for a follow-up patch:

Accepting large indices in the fast path of GetByVal in the LLInt
Accepting large indices in the fast paths generated by AccessCase/PolymorphicAccess
Accepting large indices in the fast paths generated by the DFG/FTL for each of GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX

The current patch is functional, it will just have dreadful performance if trying to use indices >2B in a {Int8/UInt8/UInt8Clamped}Array.

Other minor changes in this patch:

Fixed an undefined behavior in ArrayBuffer::createInternal where memcpy could be called on nullptr (the spec explicitly bans this even when length is 0)
Replaced some repetitive and error-prone bounds checking by calls to WTF::isSumSmallerThanOrEqual, which is clearer, shorter, and reuse CheckedArithmetic facilities to avoid overflow issues.
Fixed a variety of obsolete comments
Added support for branch64(RelationalCondition cond, RegisterID left, Imm64 right)

(there was already support for the same but with TrustedImm64)

Made various AbstractMacroAssembler function constexpr as part of the previous point

assembler/AbstractMacroAssembler.cpp:
assembler/AbstractMacroAssembler.h:

(JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
(JSC::AbstractMacroAssembler::TrustedImmPtr::asIntptr):
(JSC::AbstractMacroAssembler::TrustedImmPtr::asPtr):
(JSC::AbstractMacroAssembler::ImmPtr::ImmPtr):
(JSC::AbstractMacroAssembler::ImmPtr::asTrustedImmPtr):
(JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32):
(JSC::AbstractMacroAssembler::Imm32::Imm32):
(JSC::AbstractMacroAssembler::Imm32::asTrustedImm32 const):
(JSC::AbstractMacroAssembler::TrustedImm64::TrustedImm64):
(JSC::AbstractMacroAssembler::Imm64::Imm64):
(JSC::AbstractMacroAssembler::Imm64::asTrustedImm64 const):
(JSC::AbstractMacroAssembler::canBlind):
(JSC::AbstractMacroAssembler::shouldBlindForSpecificArch):

assembler/MacroAssembler.h:

(JSC::MacroAssembler::branch64):

assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::shouldBlindForSpecificArch):
(JSC::MacroAssemblerARM64::branch64):

assembler/MacroAssemblerARM64E.h:

(JSC::MacroAssemblerARM64E::untagArrayPtrLength64):
(JSC::MacroAssemblerARM64E::untagArrayPtrLength32): Deleted.

assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::canBlind):
(JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):

bytecode/AccessCase.cpp:

(JSC::AccessCase::needsScratchFPR const):
(JSC::AccessCase::generateWithGuard):

bytecode/ArrayProfile.h:

(JSC::ArrayProfile::setMayBeLargeTypedArray):
(JSC::ArrayProfile::mayBeLargeTypedArray const):
(JSC::UnlinkedArrayProfile::UnlinkedArrayProfile):
(JSC::UnlinkedArrayProfile::update):

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGArgumentsEliminationPhase.cpp:
dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::refine const):

dfg/DFGArrayMode.h:

(JSC::DFG::ArrayMode::ArrayMode):
(JSC::DFG::ArrayMode::mayBeLargeTypedArray const):
(JSC::DFG::ArrayMode::withType const):
(JSC::DFG::ArrayMode::withSpeculation const):
(JSC::DFG::ArrayMode::withConversion const):
(JSC::DFG::ArrayMode::withTypeAndConversion const):
(JSC::DFG::ArrayMode::withArrayClassAndSpeculationAndMayBeLargeTypedArray const):
(JSC::DFG::ArrayMode::speculationFromProfile):
(JSC::DFG::ArrayMode::withSpeculationFromProfile const):
(JSC::DFG::ArrayMode::withProfile const):
(JSC::DFG::ArrayMode::operator== const):
(JSC::DFG::ArrayMode::withArrayClass const): Deleted.

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicGetter):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGCommon.h:

(JSC::DFG::enableInt52):

dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::convertToGetArrayLength):
(JSC::DFG::FixupPhase::prependGetArrayLength): Deleted.

dfg/DFGGenerationInfo.h:
dfg/DFGHeapLocation.cpp:

(WTF::printInternal):

dfg/DFGHeapLocation.h:
dfg/DFGIntegerRangeOptimizationPhase.cpp:
dfg/DFGNode.h:

(JSC::DFG::Node::hasStorageChild const):
(JSC::DFG::Node::storageChildIndex):
(JSC::DFG::Node::hasArrayMode):

dfg/DFGNodeType.h:
dfg/DFGOperations.cpp:

(JSC::DFG::putByVal):
(JSC::DFG::newTypedArrayWithSize):
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):

dfg/DFGOperations.h:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSSALoweringPhase.cpp:

(JSC::DFG::SSALoweringPhase::handleNode):
(JSC::DFG::SSALoweringPhase::lowerBoundsCheck):

dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
(JSC::DFG::SpeculativeJIT::emitTypedArrayBoundsCheck):
(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
(JSC::DFG::SpeculativeJIT::cageTypedArrayStorage):
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
(JSC::DFG::SpeculativeJIT::compileGetArrayLength):
(JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
(JSC::DFG::SpeculativeJIT::emitNewTypedArrayWithSizeInRegister):
(JSC::DFG::SpeculativeJIT::compileNewTypedArray):

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByVal):
(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithInt52Size):
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52):
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffsetAsInt52):
(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGTypeCheckHoistingPhase.cpp:

(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):

dfg/DFGValidate.cpp:
ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::validateAIState):
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::emitGetTypedArrayByteOffsetExceptSettingResult):
(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffsetAsInt52):
(JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckInBoundsInt52):
(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

ftl/FTLOutput.h:

(JSC::FTL::Output::load64NonNegative):

jit/IntrinsicEmitter.cpp:

(JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):

jit/JITOperations.cpp:

(JSC::putByVal):
(JSC::getByVal):

llint/LLIntOfflineAsmConfig.h:
llint/LLIntSlowPaths.cpp:

(JSC::LLInt::getByVal):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
runtime/ArrayBuffer.cpp:

(JSC::SharedArrayBufferContents::SharedArrayBufferContents):
(JSC::ArrayBufferContents::ArrayBufferContents):
(JSC::ArrayBufferContents::tryAllocate):
(JSC::ArrayBuffer::create):
(JSC::ArrayBuffer::createAdopted):
(JSC::ArrayBuffer::createFromBytes):
(JSC::ArrayBuffer::tryCreate):
(JSC::ArrayBuffer::createUninitialized):
(JSC::ArrayBuffer::tryCreateUninitialized):
(JSC::ArrayBuffer::createInternal):
(JSC::ArrayBuffer::clampValue):
(JSC::ArrayBuffer::clampIndex const):
(JSC::ArrayBuffer::sliceWithClampedIndex const):

runtime/ArrayBuffer.h:

(JSC::ArrayBufferContents::sizeInBytes const):
(JSC::ArrayBuffer::byteLength const):
(JSC::ArrayBuffer::gcSizeEstimateInBytes const):

runtime/ArrayBufferView.cpp:

(JSC::ArrayBufferView::ArrayBufferView):

runtime/ArrayBufferView.h:

(JSC::ArrayBufferView::byteOffset const):
(JSC::ArrayBufferView::byteLength const):
(JSC::ArrayBufferView::verifyByteOffsetAlignment):
(JSC::ArrayBufferView::verifySubRangeLength):
(JSC::ArrayBufferView::clampOffsetAndNumElements):
(JSC::ArrayBufferView::setImpl):
(JSC::ArrayBufferView::setRangeImpl):
(JSC::ArrayBufferView::getRangeImpl):
(JSC::ArrayBufferView::zeroRangeImpl):
(JSC::ArrayBufferView::calculateOffsetAndLength): Deleted.

runtime/AtomicsObject.cpp:
runtime/DataView.cpp:

(JSC::DataView::DataView):
(JSC::DataView::create):

runtime/DataView.h:
runtime/GenericTypedArrayView.h:
runtime/GenericTypedArrayViewInlines.h:

(JSC::GenericTypedArrayView<Adaptor>::GenericTypedArrayView):
(JSC::GenericTypedArrayView<Adaptor>::create):
(JSC::GenericTypedArrayView<Adaptor>::tryCreate):
(JSC::GenericTypedArrayView<Adaptor>::createUninitialized):
(JSC::GenericTypedArrayView<Adaptor>::tryCreateUninitialized):
(JSC::GenericTypedArrayView<Adaptor>::subarray const): Deleted.

runtime/JSArrayBufferView.cpp:

(JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
(JSC::JSArrayBufferView::byteLength const):
(JSC::JSArrayBufferView::slowDownAndWasteMemory):
(JSC::JSArrayBufferView::possiblySharedImpl):

runtime/JSArrayBufferView.h:

(JSC::JSArrayBufferView::sizeOf):
(JSC::JSArrayBufferView::ConstructionContext::length const):
(JSC::JSArrayBufferView::length const):

runtime/JSArrayBufferViewInlines.h:

(JSC::JSArrayBufferView::byteOffsetImpl):
(JSC::JSArrayBufferView::byteOffset):
(JSC::JSArrayBufferView::byteOffsetConcurrently):

runtime/JSCJSValue.h:
runtime/JSCJSValueInlines.h:

(JSC::JSValue::toIndex const):
(JSC::JSValue::toTypedArrayIndex const):

runtime/JSDataView.cpp:

(JSC::JSDataView::create):
(JSC::JSDataView::createUninitialized):
(JSC::JSDataView::set):
(JSC::JSDataView::setIndex):

runtime/JSDataView.h:
runtime/JSDataViewPrototype.cpp:

(JSC::getData):
(JSC::setData):

runtime/JSGenericTypedArrayView.h:
runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::constructGenericTypedArrayViewWithArguments):
(JSC::constructGenericTypedArrayViewImpl):

runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::create):
(JSC::JSGenericTypedArrayView<Adaptor>::createWithFastVector):
(JSC::JSGenericTypedArrayView<Adaptor>::createUninitialized):
(JSC::JSGenericTypedArrayView<Adaptor>::validateRange):
(JSC::JSGenericTypedArrayView<Adaptor>::setWithSpecificType):
(JSC::JSGenericTypedArrayView<Adaptor>::set):

runtime/JSObject.h:

(JSC::JSObject::putByIndexInline):
(JSC::JSObject::tryGetIndexQuickly const):
(JSC::JSObject::trySetIndexQuickly):
(JSC::JSObject::canSetIndexQuickly): Deleted.

runtime/JSObjectInlines.h:

(JSC::JSObject::getIndexQuicklyForTypedArray const):
(JSC::JSObject::setIndexQuicklyForArrayStorageIndexingType):
(JSC::JSObject::trySetIndexQuicklyForTypedArray):
(JSC::JSObject::canSetIndexQuicklyForTypedArray const): Deleted.

runtime/Operations.h:

(JSC::getByValWithIndex):

wasm/WasmPageCount.h:

Source/WebCore:

Some parts of WebCore use TypedArrays, and would not build after I made the length() function on typed arrays return UCPURegister instead of uint32_t.
Most fixes were trivial, the only exception is SerializedScriptValue.cpp, where I had to increment the version number, as ArrayBuffer (and ArrayBufferViews) now write/read their length in a 64-bit field (and same for the byteOffset of ArrayBufferView).

I also had to add a test in PixelBuffer.cpp that the size of the ArrayBuffer it will try to allocate is < INT32_MAX.
Otherwise, the test LayoutTests/fast/shapes/shape-outside-floats/shape-outside-imagedata-overflow.html which checks that very large images are properly rejected without crashing, would timeout.

No new tests, as the code is already extensively covered by existing tests, and I implemented no new features.

Modules/webaudio/AudioBuffer.cpp:

(WebCore::AudioBuffer::copyFromChannel):
(WebCore::AudioBuffer::copyToChannel):

Modules/webaudio/RealtimeAnalyser.cpp:

(WebCore::RealtimeAnalyser::getByteFrequencyData):
(WebCore::RealtimeAnalyser::getFloatTimeDomainData):
(WebCore::RealtimeAnalyser::getByteTimeDomainData):

bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneSerializer::dumpArrayBufferView):
(WebCore::CloneSerializer::dumpImageBitmap):
(WebCore::CloneSerializer::dumpIfTerminal):
(WebCore::CloneDeserializer::readArrayBufferImpl):
(WebCore::CloneDeserializer::readArrayBuffer):
(WebCore::CloneDeserializer::readArrayBufferViewImpl):
(WebCore::CloneDeserializer::readArrayBufferView):

bindings/js/SerializedScriptValue.h:

(WebCore::SerializedScriptValue::encode const):
(WebCore::SerializedScriptValue::decode):

fileapi/NetworkSendQueue.cpp:

(WebCore::NetworkSendQueue::enqueue):

platform/graphics/PixelBuffer.cpp:

(WebCore::PixelBuffer::tryCreate):

platform/graphics/iso/ISOBox.h:

Source/WTF:

Made some of CheckedArithmetic constexpr, and added isSumSmallerThanOrEqual since it is a commonly used test in ArrayBuffer and easy to get wrong in terms of overflow.

wtf/CheckedArithmetic.h:

(WTF::isInBounds):
(WTF::convertSafely):
(WTF::isSumSmallerThanOrEqual):

LayoutTests:

Rebaselined three following tests as different or fewer error messages appear on the console.
Also changed currentVersion in serialized-script-value.html from 9 to 10.

fast/canvas/canvas-getImageData-invalid-result-buffer-crash-expected.txt:
fast/storage/serialized-script-value.html:
webaudio/OfflineAudioContext-bad-buffer-crash-expected.txt:
webaudio/OfflineAudioContext/bad-buffer-length-expected.txt:

8:58 PM Changeset in webkit [284329] by ddkilzer@apple.com

3 edits in trunk/Source/WebKit

_WKRemoteWebInspectorViewController leaks an instance variable and should use a weak delegate
<https://webkit.org/b/231830>
<rdar://problem/84316056>

Reviewed by Brent Fulgham.

UIProcess/API/Cocoa/_WKRemoteWebInspectorViewController.h:
Use a weak reference for the delegate.
UIProcess/API/Cocoa/_WKRemoteWebInspectorViewController.mm:

(-[_WKRemoteWebInspectorViewController dealloc]): Add.

Fix leak by releasing _configuration instance variable.

4:41 PM Changeset in webkit [284328] by timothy_horton@apple.com

2 edits in trunk/LayoutTests

Unreviewed, revert r284181

No longer needed because the root cause was reverted.

platform/mac-wk2/TestExpectations:

4:36 PM Changeset in webkit [284327] by Alan Bujtas

4 edits
2 adds in trunk

[LFC][IFC] Adjust the logical left side of the line with line spanning inline boxes
https://bugs.webkit.org/show_bug.cgi?id=231851

Reviewed by Antti Koivisto.

Source/WebCore:

This is in preparation for supporting "box-decoration-break: clone", where the
line spanning inline boxes do take up some space on the line with their horizontal margin, border and padding.

Test: fast/inline/inline-box-with-left-decoration-clone.html

layout/formattingContexts/inline/InlineLine.cpp:

(WebCore::Layout::Line::initialize):
(WebCore::Layout::Line::Run::Run):

layout/formattingContexts/inline/InlineLine.h:

LayoutTests:

fast/inline/inline-box-with-left-decoration-clone-expected.html: Added.
fast/inline/inline-box-with-left-decoration-clone.html: Added.

4:35 PM Changeset in webkit [284326] by timothy_horton@apple.com

8 edits
2 deletes in trunk/Source

Unreviewed, reverting r284143.

Caused a series of assertions in layout tests in EWS

Reverted changeset:

"Scroll To Text Fragment directive parsing"
https://bugs.webkit.org/show_bug.cgi?id=231410
https://commits.webkit.org/r284143

3:32 PM Changeset in webkit [284325] by timothy_horton@apple.com

2 edits in trunk/Source/WebKit

WebKit ignores inherited GCC_PREPROCESSOR_DEFINITIONS
https://bugs.webkit.org/show_bug.cgi?id=231867

Reviewed by Sam Weinig.

Configurations/BaseTarget.xcconfig:

Add a $(inherited) here like in every other project, so that we don't
just drop defines that come from above.

3:18 PM Changeset in webkit [284324] by commit-queue@webkit.org

2 edits in trunk

Add github username for tetsuharuohzeki to contributors.json
https://bugs.webkit.org/show_bug.cgi?id=231864

Patch by Tetsuharu Ohzeki <Tetsuharu Ohzeki> on 2021-10-16
Reviewed by Fujii Hironori.

metadata/contributors.json:

2:14 PM Changeset in webkit [284323] by Alan Bujtas

9 edits in trunk/Source/WebCore

[LFC][IFC] Add "line spanning line box start items" to Line
https://bugs.webkit.org/show_bug.cgi?id=231551

Reviewed by Antti Koivisto.

This patch is in preparation for supporting box-decoration-break: clone, where the line spanning
inline boxes may take up space on the line (border/padding).
This patch moves the construction of the spanning inline boxes to an earlier step, from LineBox to Line.

layout/formattingContexts/inline/InlineLineBuilder.cpp:

(WebCore::Layout::LineBuilder::initialize):

1:32 PM Changeset in webkit [284322] by Simon Fraser

4 edits in trunk

Page zoom is messed up after navigating back from a PDF
https://bugs.webkit.org/show_bug.cgi?id=231841
<rdar://72666365>

Reviewed by Tim Horton.

Source/WebKit:

A navigation back from a PDF is a FrameLoadType::Back, so resetting
m_mainFramePluginHandlesPageScaleGesture only for FrameLoadType::Standard is wrong.

For all navigations, the plugins seem to call
pluginScaleFactorDidChange/pluginZoomFactorDidChange/
mainFramePluginHandlesPageScaleGestureDidChange so it's safe to reset them for all
navigation types.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::didCommitLoadForFrame):

Tools:

TestWebKitAPI/Tests/WebKitCocoa/PageZoom.mm:

(TestWebKitAPI::TEST):

1:16 PM Changeset in webkit [284321] by commit-queue@webkit.org

2 edits in trunk/Source/WebKit

Unreviewed, reverting r284300.
https://bugs.webkit.org/show_bug.cgi?id=231866

broke-apple-silicon-performance

Reverted changeset:

"[macOS] Add telemetry for system calls in WP"
https://bugs.webkit.org/show_bug.cgi?id=231836
https://commits.webkit.org/r284300

11:37 AM Changeset in webkit [284320] by Russell Epstein

16 edits in branches/safari-612-branch

Revert "Apply patch. rdar://problem/83953730"

This reverts commit ee910ccd94f646fb5f318a78cfd6910432830a1e.

11:16 AM Changeset in webkit [284319] by ddkilzer@apple.com

2 edits in trunk/Source/WebKit

WebKit::LocalConnection::createCredentialPrivateKey leaks an NSMutableDictionary
<https://webkit.org/b/231814>
<rdar://problem/84307054>

Reviewed by Kate Cheney.

UIProcess/WebAuthentication/Cocoa/LocalConnection.mm:

(WebKit::LocalConnection::createCredentialPrivateKey const):

Use RetainPtr<> and adoptNS to fix the leak.

10:16 AM Changeset in webkit [284318] by Alan Bujtas

3 edits in trunk/LayoutTests

Undo some rebaseline in r284296.

Unreviewed.

platform/mac-bigsur/fast/text/capitalize-boundaries-expected.txt:
platform/mac-catalina/fast/text/capitalize-boundaries-expected.txt:

9:14 AM Changeset in webkit [284317] by Alan Bujtas

4 edits in trunk/Source/WebCore

[LFC][IFC] Move overflowing content creation to LineBuilder::initialize
https://bugs.webkit.org/show_bug.cgi?id=231540

Reviewed by Antti Koivisto.

LineBuilder::initialize is going to handle all overflowing content initialization.
This is in preparation for adding spanning inline box items to the line (to support box-decoration-break: clone).

layout/formattingContexts/inline/InlineLineBuilder.cpp:

(WebCore::Layout::LineBuilder::layoutInlineContent):
(WebCore::Layout::LineBuilder::computedIntrinsicWidth):
(WebCore::Layout::LineBuilder::initialize):
(WebCore::Layout::LineBuilder::placeInlineContent):
(WebCore::Layout::LineBuilder::candidateContentForLine):

layout/formattingContexts/inline/InlineLineBuilder.h:
layout/formattingContexts/inline/InlineTextItem.h:

(WebCore::Layout::InlineTextItem::right const):

7:55 AM Changeset in webkit [284316] by Angelos Oikonomopoulos

2 edits in trunk

Add my github username to contributors.json
https://bugs.webkit.org/show_bug.cgi?id=231861

Unreviewed.

metadata/contributors.json:

5:39 AM Changeset in webkit [284315] by Antti Koivisto

7 edits in trunk/Source/WebCore

Use inline iterator for SVG reverse BiDI reordering
https://bugs.webkit.org/show_bug.cgi?id=231858

Reviewed by Alan Bujtas.

Share code.

layout/integration/InlineIteratorLogicalOrderTraversal.cpp:

(WebCore::InlineIterator::makeLineLogicalOrderCache):
(WebCore::InlineIterator::nextLeafOnLineInLogicalOrder):
(WebCore::InlineIterator::previousLeafOnLineInLogicalOrder):

No need to test for the cache, it is always there.

layout/integration/InlineIteratorLogicalOrderTraversal.h:

(WebCore::InlineIterator::leafBoxesInLogicalOrder):

Make template and move to header.

rendering/LegacyInlineFlowBox.cpp:

(WebCore::LegacyInlineFlowBox::collectLeafBoxesInLogicalOrder const): Deleted.

Not needed anymore.

rendering/LegacyInlineFlowBox.h:
rendering/svg/SVGRootInlineBox.cpp:

(WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation):
(WebCore::reverseInlineBoxRangeAndValueListsIfNeeded):
(WebCore::SVGRootInlineBox::reorderValueListsToLogicalOrder):
(WebCore::SVGRootInlineBox::reorderValueLists): Deleted.

Call the generic version.

rendering/svg/SVGRootInlineBox.h:

3:35 AM Changeset in webkit [284314] by Simon Fraser

3 edits
2 adds in trunk

Make sure child layers of top layer elements are rendered and correctly z-ordered (top-layer-stacking.html fails)
https://bugs.webkit.org/show_bug.cgi?id=231832

Reviewed by Antoine Quint.
Source/WebCore:

Top layer elements should create CSS stacking context, per https://fullscreen.spec.whatwg.org/#rendering

I decided to call isInTopLayerOrBackdrop() twice to avoid calling it every time this function
is called. It's a cheap function.

Test: fast/layers/dialog-is-stacking-context.html

style/StyleAdjuster.cpp:

(WebCore::Style::Adjuster::adjust const):

LayoutTests:

Ref test that compares a dialog with positioned children and one with children place
with margins.

fast/layers/dialog-is-stacking-context-expected.html: Added.
fast/layers/dialog-is-stacking-context.html: Added.

3:22 AM Changeset in webkit [284313] by graouts@webkit.org

6 edits in trunk

Accelerated animations on ::backdrop shouldn't affect <dialog> (backdrop-animate-002.html fails)
https://bugs.webkit.org/show_bug.cgi?id=230008
<rdar://problem/82975766>

Reviewed by Simon Fraser and Tim Nguyen.

Source/WebCore:

We did not know how to access the ::backdrop renderer when running accelerated animations. To do so we now
implement full support to access the renderer for known pseudo-elements on Styleable with a new renderer()
method, including ::backdrop. We also make Styleable::fromRenderer() aware of ::backdrop such that the various
call sites for this function that deal with accelerated transform animations access the right element.

animation/KeyframeEffect.cpp:

(WebCore::KeyframeEffect::renderer const):

style/Styleable.cpp:

(WebCore::Styleable::fromRenderer):
(WebCore::Styleable::renderer const):

style/Styleable.h:

(WebCore::Styleable::fromRenderer): Deleted.

LayoutTests:

TestExpectations: Mark the previously failing test as passing.

3:16 AM Changeset in webkit [284312] by graouts@webkit.org

8 edits
2 adds in trunk

CSS Animations creation and sorting is incorrect and may lead to crash
https://bugs.webkit.org/show_bug.cgi?id=231812
<rdar://problem/82980774>

Reviewed by Dean Jackson.

LayoutTests/imported/w3c:

Mark two progressions in a test that now passes entirely.

web-platform-tests/css/css-animations/Element-getAnimations-dynamic-changes.tentative-expected.txt:

Source/WebCore:

When we parse CSS properties related to CSS Animations, we create as many Animation objects as the maximum number
of values in one of the CSS Animations properties. These Animation objects are stored in an AnimationList which
is owned by RenderStyle and that we use to store all provided values such that they can be read back through the
computed style.

Upon finishing parsing those CSS properties, RenderStyle::adjustAnimations() is called and does two things that
were not quite correct.

First, it would attempt to remove animations that were in fact created for no good reason using the
Animation::isEmpty() method. That method was not quite right as it was only checking if the animation
name wasn't set but not whether the animation was explicitly marked as a "none" animation. This meant
that "none" animations could be considered as bogus animations and any animations after that one would
be mistakenly cleared.

Second, it would finish process the list of remaning animations by making sure that mis-matched CSS properties,
for instance three values for animation-duration and four values for animation-name, would be correctly represented
throughout the Animation objects. However, the function performing this work, AnimationList::fillUnsetProperties(),
used to reset the animation's name in case it wasn't explicitly set, which meant that Animation objects that did not
have a matching animation-name would end up with a valid one. This meant that further down the line, in
Styleable::updateCSSAnimations(), we couldn't distinguish Animation objects that were created without a
matching animation-name and discard those.

We've fixed those incorrect behaviors and we now have the expected number of animations created resulting in an additional
WPT PASS result.

Additionally, this also showed some issues around sorting CSS Animations in compareCSSAnimations() where we weren't
making a pointer comparison. This is now fixed and we now pass another WPT PASS result.

Test: webanimations/css-animation-sorting-crash.html