Timeline

Oct 18, 2021:

11:45 PM Changeset in webkit [284437] by graouts@webkit.org

• 23 edits
  2 adds in trunk

box-shadow and text-shadow do not yield float values while interpolating
​https://bugs.webkit.org/show_bug.cgi?id=230347
<rdar://problem/83319111>

Reviewed by Simon Fraser.

LayoutTests/imported/w3c:

Add some new WPT tests for float and calc() values for box-shadow and text-shadow while
interpolating and update output for still-failing composite operations tests. The new tests
have already landed in WPT with ​https://github.com/web-platform-tests/wpt/pull/30823.

• web-platform-tests/css/css-backgrounds/animations/box-shadow-composition-expected.txt:
• web-platform-tests/css/css-backgrounds/animations/box-shadow-interpolation-expected.txt:
• web-platform-tests/css/css-backgrounds/animations/box-shadow-interpolation.html:
• web-platform-tests/css/css-backgrounds/box-shadow-calc-expected.html: Added.
• web-platform-tests/css/css-backgrounds/box-shadow-calc.html: Added.
• web-platform-tests/css/css-transitions/animations/text-shadow-composition-expected.txt:
• web-platform-tests/css/css-transitions/animations/text-shadow-interpolation-expected.txt:
• web-platform-tests/css/css-transitions/animations/text-shadow-interpolation.html:

Source/WebCore:

ShadowData members used integer values rather than floats and thus could not represent
float values while interpolating. We now use float values.

Test: imported/w3c/web-platform-tests/css/css-backgrounds/box-shadow-calc.html

• animation/CSSPropertyAnimation.cpp:

(WebCore::blendFunc):
(WebCore::shadowForBlending):

• css/CSSComputedStyleDeclaration.cpp:

(WebCore::ComputedStyleExtractor::valueForFilter):

• display/css/DisplayBoxDecorationPainter.cpp:

(WebCore::Display::BoxDecorationPainter::paintBoxShadow const):

• editing/Editor.cpp:

(WebCore::Editor::fontAttributesAtSelectionStart):

• platform/LengthPoint.h:

(WebCore::LengthPoint::isZero const):

• platform/mac/WebCoreNSFontManagerExtras.mm:

(WebCore::computedFontAttributeChanges):

• rendering/LegacyEllipsisBox.cpp:

(WebCore::LegacyEllipsisBox::paint):

• rendering/RenderBoxModelObject.cpp:

(WebCore::applyBoxShadowForBackground):
(WebCore::RenderBoxModelObject::boxShadowShouldBeAppliedToBackground const):
(WebCore::RenderBoxModelObject::paintBoxShadow):

• rendering/TextBoxPainter.cpp:

(WebCore::TextBoxPainter::debugTextShadow const):

• rendering/TextDecorationPainter.cpp:

(WebCore::TextDecorationPainter::paintTextDecoration):

• rendering/TextPainter.cpp:

(WebCore::ShadowApplier::shadowIsCompletelyCoveredByText):

• rendering/style/RenderStyle.cpp:

(WebCore::RenderStyle::setTextShadow):
(WebCore::RenderStyle::shadowExtent):
(WebCore::RenderStyle::shadowInsetExtent):
(WebCore::RenderStyle::getShadowHorizontalExtent):
(WebCore::RenderStyle::getShadowVerticalExtent):

• rendering/style/ShadowData.cpp:

(WebCore::ShadowData::ShadowData):
(WebCore::calculateShadowExtent):

• rendering/style/ShadowData.h:

(WebCore::ShadowData::ShadowData):
(WebCore::ShadowData::x const):
(WebCore::ShadowData::y const):
(WebCore::ShadowData::location const):
(WebCore::ShadowData::radius const):
(WebCore::ShadowData::paintingExtent const):
(WebCore::ShadowData::spread const):

• style/StyleBuilderCustom.h:

(WebCore::Style::BuilderCustom::applyTextOrBoxShadowValue):

11:32 PM Changeset in webkit [284436] by Cameron McCormack

• 6 edits
  4 adds in trunk

Make createImageBitmap() take EXIF orientation into account correctly
​https://bugs.webkit.org/show_bug.cgi?id=231063
<rdar://problem/83753956>

Reviewed by Myles Maxfield and Said Abou-Hallawa.

LayoutTests/imported/w3c:

• web-platform-tests/html/canvas/element/manual/imagebitmap/createImageBitmap-exif-orientation-expected.txt: Added.
• web-platform-tests/html/canvas/element/manual/imagebitmap/createImageBitmap-exif-orientation.html: Added.
• web-platform-tests/html/canvas/element/manual/imagebitmap/resources/squares.jpg: Added.

Source/WebCore:

Test: imported/w3c/web-platform-tests/html/canvas/element/manual/imagebitmap/createImageBitmap-exif-orientation.html

This makes us treat {imageOrientation:"none"} as meaning "apply EXIF
orientation without any additional transformation", and
{imageOrientation:"flipY"} as meaning "apply EXIF orientation and then
apply an additional vertical flip". This behavior matches Firefox;
​https://github.com/whatwg/html/issues/7210 is open on clarifying this
behavior in the HTML spec.

• html/ImageBitmap.cpp:

(WebCore::ImageBitmap::createPromise):
(WebCore::ImageBitmap::createFromBuffer):
(WebCore::imageOrientationForOrientation): Deleted.

• html/ImageBitmapOptions.h:

(WebCore::ImageBitmapOptions::resolvedImageOrientation const):

• html/ImageBitmapOptions.idl:
• platform/graphics/ImageOrientation.h:

(WebCore::ImageOrientation::withFlippedY const):

9:07 PM Changeset in webkit [284435] by commit-queue@webkit.org

• 29 edits
  12 adds in trunk

JSTests:
Test coverage for JSC shadow realms implementation
​https://bugs.webkit.org/show_bug.cgi?id=230602

Patch by Phillip Mates <Phillip Mates> on 2021-10-18
Reviewed by Yusuke Suzuki.

• modules/import-meta-syntax.js:

(shouldThrow):

• stress/eval-indirect.js: Added.

(shouldBe):
(shouldThrow):

• stress/import-syntax.js:
• stress/resources/shadow-realm-example-module.js: Added.

(putInGlobal):
(getFromGlobal):
(getAnObject):
(getCallCount):

• stress/shadow-realm-evaluate.js: Added.

(shouldBe):
(shouldThrow):
(assertionFn):
(shouldBe.String):
(shouldBe.globalObjectFor.doEval):
(shouldBe.globalObjectFor):

• stress/shadow-realm-import-value.js: Added.

(shouldBe):
(shouldThrow):
(async shouldThrowAsync):
(async const):
(doImport):

• stress/shadow-realm.js: Added.

(shouldBe):
(throw.new.Error):

• test262/config.yaml:

Source/JavaScriptCore:
shadow realms implementation
​https://bugs.webkit.org/show_bug.cgi?id=230602

Patch by Phillip Mates <Phillip Mates> on 2021-10-18
Reviewed by Yusuke Suzuki.

Implementation of the Shadow Realms proposal (stage 3 in TC39) [1]

Main APIs added are

• new ShadowRealm() creates an object that has its own global object and module graph.
• ShadowRealm.prototype.evaluate(sourceText) this allows for evaluating code in the context of the realm, which has its own module graph and global object.
• ShadowRealm.prototype.importValue(specifier, exportName) this allows importing module exports in the the context of the realm, which has its own module graph and global object.

The main detail of the Shadow Realm implementation is that values
passed between realms must be either primitives or wrapped callables.
Wrapped callables themselves are callables that check that their
arguments and return values are also either primitives or wrapped
callables. This detail is implemented via JS builtins + a few new
intrinsics.

Can be enabled using --useShadowRealm=true

[1]: ​https://github.com/tc39/proposal-shadowrealm

• CMakeLists.txt:
• DerivedSources-input.xcfilelist:
• DerivedSources-output.xcfilelist:
• DerivedSources.make:
• JavaScriptCore.xcodeproj/project.pbxproj:
• Sources.txt:
• builtins/BuiltinNames.h:
• builtins/ShadowRealmPrototype.js: Added.

(globalPrivate.wrap.wrapped):
(globalPrivate.wrap):
(evaluate):
(importValue):

• bytecode/BytecodeIntrinsicRegistry.h:
• bytecode/LinkTimeConstant.h:
• bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::emitIsShadowRealm):

• bytecompiler/NodesCodegen.cpp:
• jsc.cpp:

(JSC_DEFINE_HOST_FUNCTION):

• parser/Parser.cpp:

(JSC::Parser<LexerType>::parseMemberExpression):

• runtime/CommonIdentifiers.h:
• runtime/IndirectEvalExecutable.cpp:

(JSC::IndirectEvalExecutable::createImpl):
(JSC::IndirectEvalExecutable::create):
(JSC::IndirectEvalExecutable::tryCreate):

• runtime/IndirectEvalExecutable.h:
• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildrenImpl):
(JSC::JSGlobalObject::createWithCustomMethodTable):

• runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::shadowRealmPrototype const):
(JSC::JSGlobalObject::shadowRealmStructure const):

• runtime/JSGlobalObjectFunctions.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

• runtime/JSType.cpp:

(WTF::printInternal):

• runtime/JSType.h:
• runtime/OptionsList.h:
• runtime/ShadowRealmConstructor.cpp: Added.

(JSC::ShadowRealmConstructor::ShadowRealmConstructor):
(JSC::ShadowRealmConstructor::finishCreation):
(JSC::JSC_DEFINE_HOST_FUNCTION):

• runtime/ShadowRealmConstructor.h: Added.
• runtime/ShadowRealmObject.cpp: Added.

(JSC::ShadowRealmObject::ShadowRealmObject):
(JSC::ShadowRealmObject::visitChildrenImpl):
(JSC::ShadowRealmObject::create):
(JSC::ShadowRealmObject::finishCreation):

• runtime/ShadowRealmObject.h: Added.
• runtime/ShadowRealmPrototype.cpp: Added.

(JSC::ShadowRealmPrototype::ShadowRealmPrototype):
(JSC::ShadowRealmPrototype::finishCreation):
(JSC::JSC_DEFINE_HOST_FUNCTION):

• runtime/ShadowRealmPrototype.h: Added.
• runtime/VM.cpp:
• runtime/VM.h:

8:51 PM Changeset in webkit [284434] by Jean-Yves Avenard

• 3 edits
  3 adds in trunk

WebM with invalid size should fail to load with error
​https://bugs.webkit.org/show_bug.cgi?id=231886
rdar://77969801

Reviewed by Jer Noble.

Source/WebCore:

libwebm for some elements are using a std::string or a std::vector<uint8_t>
to store their content. Those have infallible memory allocators.
We limit the size we allow the parser to use to some reasonable values.

Test: media/media-webm-invalid-check.html

• platform/graphics/cocoa/SourceBufferParserWebM.cpp:

(WebCore::SourceBufferParserWebM::OnElementBegin):

LayoutTests:

• media/content/invalid-size.webm: Added.
• media/media-webm-invalid-check-expected.txt: Added.
• media/media-webm-invalid-check.html: Added.

8:43 PM Changeset in webkit [284433] by Cameron McCormack

• 3 edits in trunk/Source/ThirdParty/libwebrtc

Always set color space for incoming H.264/265 streams
​https://bugs.webkit.org/show_bug.cgi?id=231881
<rdar://problem/84350707>

Reviewed by Youenn Fablet.

Followup from ​https://bugs.webkit.org/show_bug.cgi?id=231353. In some
configurations, the "ColorInfoGuessedBy" attachment is not set on the
CVPixelBuffers coming out of the VTDecompressionSession, but the
guessed, incorrect color space attachments are still there. Since we
currently always have an sRGB stream, don't bother looking for
"ColorInfoGuessedBy".

• Source/webrtc/sdk/objc/components/video_codec/RTCVideoDecoderH264.mm:

(overrideColorSpaceAttachments):
(decompressionOutputCallback):
(overrideColorSpaceAttachmentsIfNeeded): Deleted.

• Source/webrtc/sdk/objc/components/video_codec/RTCVideoDecoderH265.mm:

(overrideColorSpaceAttachments):
(h265DecompressionOutputCallback):
(overrideColorSpaceAttachmentsIfNeeded): Deleted.

8:36 PM Changeset in webkit [284432] by Alan Bujtas

• 5 edits in trunk/Source/WebCore

[LFC][IFC] Adjust the logical right side of the line when box-decoration-break: clone is present
​https://bugs.webkit.org/show_bug.cgi?id=231873

Reviewed by Antti Koivisto.

This patch adds support for "box-decoration-break: clone" cases when the inline box is either not line spanning or
it shows up first on the line.

• layout/formattingContexts/inline/InlineLine.cpp:

(WebCore::Layout::Line::initialize):
(WebCore::Layout::Line::appendInlineBoxStart):
(WebCore::Layout::Line::appendInlineBoxEnd):
(WebCore::Layout::Line::appendTextContent):

• layout/formattingContexts/inline/InlineLine.h:

(WebCore::Layout::Line::contentLogicalRight const):
(WebCore::Layout::Line::inlineBoxListWithClonedDecorationEnd const):
(WebCore::Layout::Line::lineSpanningInlineBoxRunEnds const): Deleted.

• layout/formattingContexts/inline/InlineLineBoxBuilder.cpp:

(WebCore::Layout::LineBoxBuilder::constructAndAlignInlineLevelBoxes):

• layout/formattingContexts/inline/InlineLineBuilder.cpp:

(WebCore::Layout::LineBuilder::handleInlineContent):

8:31 PM Changeset in webkit [284431] by sihui_liu@apple.com

• 1 edit in branches/safari-612-branch/Source/WTF/Scripts/Preferences/WebPreferencesExperimental.yaml

Apply patch rdar://84349729

8:30 PM Changeset in webkit [284430] by sihui_liu@apple.com

• 1 edit in branches/safari-612-branch/Source/WTF/Scripts/Preferences/WebPreferencesExperimental.yaml

Apply patch rdar://84349729

8:16 PM Changeset in webkit [284429] by commit-queue@webkit.org

• 10 edits in trunk

Unreviewed, reverting r284413.
​https://bugs.webkit.org/show_bug.cgi?id=231936

BrokeSafariBuildByAddingANewEnum

Reverted changeset:

"[WebAuthn] Obtain consent to create new credential when
platform authenticator in excludedCredentials"
​https://bugs.webkit.org/show_bug.cgi?id=219813
​https://commits.webkit.org/r284413

7:55 PM Changeset in webkit [284428] by commit-queue@webkit.org

• 16 edits
  1 delete in trunk/Source

Unreviewed, reverting r284240.
​https://bugs.webkit.org/show_bug.cgi?id=231931

NeedDifferentArchitectureToWorkWithWebpushd

Reverted changeset:

"WebKit Managed Notifications: Skeleton NotificationProvider."
​https://bugs.webkit.org/show_bug.cgi?id=231786
​https://commits.webkit.org/r284240

7:44 PM Changeset in webkit [284427] by Wenson Hsieh

• 5 edits in trunk/Source/WebKit

GPU process occasionally crashes under StreamConnectionWorkQueue::processStreams() in layout tests
​https://bugs.webkit.org/show_bug.cgi?id=231897

Reviewed by Simon Fraser.

Certain layout tests (e.g. in LayoutTests/compositing) currently cause the GPU process to crash on the remote
rendering backend thread ("RemoteRenderingBackend work queue") in StreamConnectionWorkQueue::processStreams().
This happens because the dispatch() call to delete cached resources underneath ~RemoteRenderingBackend()
may fire after the destructor is finished running (thereby destroying m_workQueue itself). This leaves the
stream work queue in a bad state and causes various crashes when the function is eventually dispatched.

Since StreamConnectionWorkQueue is already ThreadSafeRefCounted, it doesn't make sense to directly store
StreamConnectionWorkQueue as a member of RemoteRenderingBackend; to fix these crashes, we make m_workQueue on
RemoteRenderingBackend a strong Ref, and additionally make StreamConnectionWorkQueue::processStreams() protect
itself to avoid destroying the work queue in the middle of processing.

• GPUProcess/graphics/RemoteRenderingBackend.cpp:

Drive-by fix: remove an unnecessary header include.

(WebKit::RemoteRenderingBackend::RemoteRenderingBackend):
(WebKit::RemoteRenderingBackend::~RemoteRenderingBackend):

Ensure that the work queue is protected through the final dispatch call that deletes cached resources, and also
explicitly stop() the work queue when this is done to ensure that the thread permanently stops waiting for
additional work.

(WebKit::RemoteRenderingBackend::dispatch):

• GPUProcess/graphics/RemoteRenderingBackend.h:

Replace the IPC::StreamConnectionWorkQueue member with a Ref instead, so that it isn't immediately destroyed
when the rendering backend is destroyed, and can instead be protected by strong references on the stack.

• Platform/IPC/StreamConnectionWorkQueue.cpp:

(IPC::StreamConnectionWorkQueue::processStreams):

• Platform/IPC/StreamConnectionWorkQueue.h:

Add a boilerplate StreamConnectionWorkQueue::create() function that returns a Ref.

7:18 PM Changeset in webkit [284426] by Russell Epstein

• 3 edits
  1 add in branches/safari-612-branch

Cherry-pick r284348. rdar://problem/84398090

[JSC] PutByVal's child5 should be KnownInt32Use / Int52RepUse in FTL
​https://bugs.webkit.org/show_bug.cgi?id=231884
rdar://84357099

Reviewed by Robin Morisset.

JSTests:

• stress/put-by-val-known-int32.js: Added. (new.Uint8Array.1000000.map):

Source/JavaScriptCore:

The child5 of PutByVal should be KnownInt32Use or Int52RepUse.

• ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@284348 268f45cc-cd09-0410-ab3c-d52691b4dbfc

6:55 PM Changeset in webkit [284425] by sihui_liu@apple.com

• 14 edits
  5 adds in branches/safari-612-branch

Apply patch rdar://84349747

6:55 PM Changeset in webkit [284424] by sihui_liu@apple.com

• 28 edits
  4 copies
  4 adds in branches/safari-612-branch

Apply patch rdar://84349752

6:54 PM Changeset in webkit [284423] by sihui_liu@apple.com

• 65 edits
  2 copies
  8 adds in branches/safari-612-branch

Apply patch rdar://84349736

6:43 PM Changeset in webkit [284422] by ddkilzer@apple.com

• 1 edit
  1 delete in trunk/Source/WebInspectorUI

Web Inspector: Remove Source/WebInspectorUI/UserInterface/Controllers/WebInspectorExtensionController.js.orig
<​https://webkit.org/b/231896>

Reviewed by BJ Burg.

• UserInterface/Controllers/WebInspectorExtensionController.js.orig: Remove.

5:51 PM Changeset in webkit [284421] by eric.carlson@apple.com

• 5 edits in trunk/Source/WebCore

[macOS] Refactor CGDisplayStreamCaptureSource::createDisplayStream
​https://bugs.webkit.org/show_bug.cgi?id=231920
<rdar://problem/84393654>

Reviewed by Jer Noble.

No new tests, no functional change.

• platform/mediastream/mac/CGDisplayStreamCaptureSource.cpp:

(WebCore::CGDisplayStreamCaptureSource::startDisplayStream): Don't pass the frame
available handler or capture queue to createDisplayStream.
(WebCore::CGDisplayStreamCaptureSource::frameAvailableHandler): Remove a blank line.
(WebCore::CGDisplayStreamCaptureSource::captureQueue): New accessor.

• platform/mediastream/mac/CGDisplayStreamCaptureSource.h:

• platform/mediastream/mac/CGDisplayStreamScreenCaptureSource.h:
• platform/mediastream/mac/CGDisplayStreamScreenCaptureSource.mm:

(WebCore::CGDisplayStreamScreenCaptureSource::createDisplayStream): Parameters removed.

5:49 PM Changeset in webkit [284420] by achristensen@apple.com

• 3 edits in trunk/Source/WebCore

Remove "using namespace XPath;" from XPathGrammar.cpp
​https://bugs.webkit.org/show_bug.cgi?id=231318

Reviewed by Chris Dumez.

I did this by editing XPathGrammar.y and re-running bison.
We have the output of bison checked in to our repo to not have bison as a build dependency of WebKit.

• xml/XPathGrammar.cpp:

(xpathyylex):
(xpathyyerror):
(yysyntax_error):

• xml/XPathGrammar.y:
• xml/XPathResult.cpp:

(WebCore::XPathResult::XPathResult):

5:48 PM Changeset in webkit [284419] by Jonathan Bedard

• 14 edits
  1 add
  4 deletes in trunk/Tools

Unreviewed, reverting r284399.

Breaks commit message generation

Reverted changeset:

"[webkitperl] Stop using LoadAsModule.pm"
​https://bugs.webkit.org/show_bug.cgi?id=231868
​https://commits.webkit.org/r284399

5:44 PM Changeset in webkit [284418] by achristensen@apple.com

• 11 edits
  2 deletes in trunk

Remove TCPServer
​https://bugs.webkit.org/show_bug.cgi?id=231912

Reviewed by Chris Dumez.

Source/WTF:

• wtf/PlatformHave.h:

Tools:

It has been replaced by HTTPServer, which doesn't time out in its destructor when not everything is perfect,
and which does its logic on the main thread. It also doesn't use boringssl directly, so we can compile it on watchOS and tvOS.

• TestWebKitAPI/Sources.txt:
• TestWebKitAPI/TCPServer.cpp: Removed.
• TestWebKitAPI/TCPServer.h: Removed.
• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WebKitCocoa/Challenge.mm:

(testCertificate):
(testIdentity):

• TestWebKitAPI/Tests/WebKitCocoa/ContentRuleListNotification.mm:

(TEST):

• TestWebKitAPI/Tests/WebKitCocoa/HSTS.mm:

(TestWebKitAPI::hstsWebViewAndDelegate):
(TestWebKitAPI::hstsServer):
(TestWebKitAPI::TEST):
(TestWebKitAPI::hasRadar80550123): Deleted.

• TestWebKitAPI/Tests/WebKitCocoa/Proxy.mm:
• TestWebKitAPI/Tests/WebKitCocoa/ServiceWorkerTCPServer.h:

(ServiceWorkerTCPServer::respondToRequests):

• TestWebKitAPI/cocoa/HTTPServer.h:
• TestWebKitAPI/cocoa/HTTPServer.mm:

(TestWebKitAPI::HTTPServer::testCertificate):
(TestWebKitAPI::HTTPServer::testPrivateKey):

5:35 PM Changeset in webkit [284417] by Jonathan Bedard

• 2 edits in trunk/Tools

[Python-3] Invoke webkit-patch with Python 3 by default (Revert)
​https://bugs.webkit.org/show_bug.cgi?id=231591
<rdar://problem/84153640>

Reverted to fix webkitbot.

• Scripts/webkit-patch:

5:14 PM Changeset in webkit [284416] by Russell Epstein

• 1 copy in tags/Safari-613.1.5.1

Tag Safari-613.1.5.1.

5:14 PM Changeset in webkit [284415] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Mac ] inspector/css/modify-css-property.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=231924.

Unreviewed test gardening.

• platform/mac/TestExpectations:

5:12 PM Changeset in webkit [284414] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

Regression(r283935 - r283938): [ macOS wk1 ] imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-autofocus-multiple-times.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=231918

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

5:07 PM Changeset in webkit [284413] by commit-queue@webkit.org

• 9 edits in trunk

[WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
​https://bugs.webkit.org/show_bug.cgi?id=219813
<rdar://problem/72484635>

Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
of makeCredential (​https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
and return a different error depending on consent was obtained.

Source/WebKit:

A fixme to add this was inadvertently removed in ​https://bugs.webkit.org/attachment.cgi?id=393180&action=prettypatch

Patch by John Pascoe <J Pascoe> on 2021-10-18
Reviewed by Brent Fulgham.

Added api test TestWebKitAPI.WebAuthenticationPanel.LADuplicateCredentialWithConsent

• UIProcess/API/Cocoa/_WKWebAuthenticationPanel.h:
• UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:

(WebKit::LocalAuthenticator::makeCredential):

• UIProcess/WebAuthentication/Cocoa/WebAuthenticationPanelClient.mm:

(WebKit::wkWebAuthenticationPanelUpdate):

• UIProcess/WebAuthentication/WebAuthenticationFlags.h:

Tools:

This adds a test to confirm a different path is taken whenever consent is obtained.

Patch by John Pascoe <J Pascoe> on 2021-10-18
Reviewed by Brent Fulgham.

• TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:

(-[TestWebAuthenticationPanelDelegate panel:updateWebAuthenticationPanel:]):
(TestWebKitAPI::TEST):

5:06 PM Changeset in webkit [284412] by Russell Epstein

• 3 edits in branches/safari-612-branch/Source/JavaScriptCore

Cherry-pick r284369. rdar://problem/84394405

[JSC] Use USE(LARGE_TYPED_ARRAY)
​https://bugs.webkit.org/show_bug.cgi?id=231885

Reviewed by Sam Weinig.

Fix USE(ADDRESS64) with USE(LARGE_TYPED_ARRAY). USE(ADDRESS64) is not correct (it should be CPU(ADDRESS64)).
It is coverted by JSTests/stress/typed-array-large-eventually-oob.js.

• dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile):
• ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@284369 268f45cc-cd09-0410-ab3c-d52691b4dbfc

5:06 PM Changeset in webkit [284411] by Russell Epstein

• 6 edits
  1 copy in branches/safari-612-branch/Source

Apply patch. rdar://problem/84351866

4:54 PM Changeset in webkit [284410] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Windows EWS ] http/wpt/webxr/xrHandInput_gc.html is failing.
​https://bugs.webkit.org/show_bug.cgi?id=231921.

Unreviewed test gardening.

• platform/win/TestExpectations:

4:53 PM Changeset in webkit [284409] by commit-queue@webkit.org

• 3 edits in trunk/Tools

[ iOS15 ] TestWebKitAPI.WebKit.HTTPSProxy is a flaky, but frequent, timeout
​https://bugs.webkit.org/show_bug.cgi?id=231396

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-10-18
Reviewed by Chris Dumez.

Something was happening that was very timing dependent that was causing this test to time out.
I think it was because the proxy framer was receiving an incomplete HTTP request.
To fix this, I look at the bytes received and if it wasn't a complete HTTP request, wait for the rest of the message.
I was unable to reproduce the timeout after this change and only rarely reproduced the timeout without this change.

• TestWebKitAPI/Tests/WebKitCocoa/Proxy.mm:

(TestWebKitAPI::TEST):

• TestWebKitAPI/cocoa/HTTPServer.mm:

(TestWebKitAPI::proxyDefinition):

4:50 PM Changeset in webkit [284408] by Russell Epstein

• 2 edits in branches/safari-613.1.5-branch/Source/WebKit

Cherry-pick r284209. rdar://problem/84218823

[macOS] Crash on WP startup
​https://bugs.webkit.org/show_bug.cgi?id=231773
<rdar://84218823>

Unreviewed partial revert of ​https://trac.webkit.org/r283375.

• WebProcess/com.apple.WebProcess.sb.in:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@284209 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:41 PM Changeset in webkit [284407] by Russell Epstein

• 8 edits in branches/safari-613.1.5-branch/Source

Versioning.

WebKit-7613.1.5.1

3:21 PM Changeset in webkit [284406] by Chris Dumez

• 14 edits in trunk

Add a callback to know when the service worker loads via -[WKWebView _loadServiceWorker:]
​https://bugs.webkit.org/show_bug.cgi?id=231771
<rdar://problem/84274364>

Reviewed by Alex Christensen.

Source/WebCore:

• loader/FrameLoaderClient.h:
• workers/service/ServiceWorkerContainer.cpp:

(WebCore::ServiceWorkerContainer::willSettleRegistrationPromise):
(WebCore::ServiceWorkerContainer::jobFailedWithException):
(WebCore::ServiceWorkerContainer::jobResolvedWithRegistration):
(WebCore::ServiceWorkerContainer::jobFailedLoadingScript):

• workers/service/ServiceWorkerContainer.h:

Source/WebKit:

• UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _loadServiceWorker:completionHandler:]):
(-[WKWebView _loadServiceWorker:]): Deleted.

• UIProcess/API/Cocoa/WKWebViewPrivate.h:
• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::didFailProvisionalLoadForFrameShared):
(WebKit::WebPageProxy::didFinishServiceWorkerPageRegistration):
(WebKit::WebPageProxy::didFailLoadForFrame):
(WebKit::WebPageProxy::resetStateAfterProcessExited):
(WebKit::WebPageProxy::loadServiceWorker):

• UIProcess/WebPageProxy.h:
• UIProcess/WebPageProxy.messages.in:
• WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::didFinishServiceWorkerPageRegistration):

• WebProcess/WebCoreSupport/WebFrameLoaderClient.h:

Tools:

Add API test coverage.

• TestWebKitAPI/Tests/WebKitCocoa/ServiceWorkerBasic.mm:

3:21 PM Changeset in webkit [284405] by commit-queue@webkit.org

• 4 edits in trunk/Tools

[webkitperl] Fix webkitperl on Windows
​https://bugs.webkit.org/show_bug.cgi?id=231374

Patch by Basuke Suzuki <​basuke@mac.com> on 2021-10-18
Reviewed by Fujii Hironori.

Set WEBKIT_LIBRARIES environment variable before run if it is not defined.
Shell-style environment variables settings are not available on Windows. Replace them by setting
%ENV directly.

• Scripts/test-webkitperl:
• Scripts/webkitperl/auto-version_unittest/autoVersionTests.pl:
• Scripts/webkitperl/auto-version_unittest/versionStampTests.pl:

3:20 PM Changeset in webkit [284404] by Chris Dumez

• 39 edits
  3 adds
  1 delete in trunk/LayoutTests/imported/w3c

Resync web-platform-tests/tools from upstream
​https://bugs.webkit.org/show_bug.cgi?id=231907

Reviewed by Alex Christensen.

Resync web-platform-tests/tools from upstream 4250f160c0cb9ef2caba63.

• web-platform-tests/tools/*: Updated.

2:45 PM Changeset in webkit [284403] by Russell Epstein

• 83 edits
  8 copies
  40 adds in branches/safari-612-branch

Apply patch. rdar://problem/84351845

2:42 PM Changeset in webkit [284402] by Chris Dumez

• 10 edits
  10 adds in trunk/LayoutTests/imported/w3c

Resync web-platform-tests/common from upstream
​https://bugs.webkit.org/show_bug.cgi?id=231908

Reviewed by Alex Christensen.

Resync web-platform-tests/common from upstream 4250f160c0cb9ef2caba63.

• web-platform-tests/common/*: Updated.

2:38 PM Changeset in webkit [284401] by Russell Epstein

• 91 edits
  4 adds in branches/safari-612-branch

Cherry-pick r284230. rdar://problem/84351866

Allow WASM to use up to 4GB
​https://bugs.webkit.org/show_bug.cgi?id=229353
rdar://81603447

Reviewed by Yusuke Suzuki.

JSTests:

The big-wasm-memory/wasm-memory-requested... tests used to simply expect an OOM at 2GB.
They now expect success at 4GB, and failure at 4GB+1.
The exceptions they expect are now more specific, as previously there was a rounding issue that was causing the specific exceptions not to be thrown (resulting in the generic OOM exception later in the code).
Finally I made them only run on 64-bit platforms since we don't support typed arrays >=2GB on 32-bits, and I made them only run in one configuration since they can take a little bit of time.

I also added a few new tests, specifically checking our handling of large typed arrays, and especially of indices above INT32_MAX.

• stress/big-wasm-memory-grow-no-max.js: (test):
• stress/big-wasm-memory-grow.js: (test):
• stress/big-wasm-memory.js: (test):
• stress/typed-array-always-large.js: Added. (getArrayLength): (getByVal): (putByVal): (test):
• stress/typed-array-eventually-large.js: Added. (getArrayLength): (getByVal): (putByVal): (test):
• stress/typed-array-large-eventually-oob.js: Added. (getArrayLength): (getByVal): (putByVal): (test):
• wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js:
• wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js:

Source/JavaScriptCore:

While increasing MAX_ARRAY_BUFFER_SIZE to 4GB was easy, it was not remotely the only thing required to get this to work:

• 4GB is not representable in a uint32_t, so I changed all length of ArrayBuffer/TypedArray/etc.. to being UCPURegister.
• This also required changing NewTypedArray in all of LLInt/Baseline/DFG/FTL to accept a non-int32 size.

In order to avoid performance regressions, I had to add speculation in the DFG/FTL, which now have two versions of NewTypedArray (one that takes an Int32 and one that takes a StrictInt52)

• Similarly, GetArrayLength and GetTypedArrayByteOffset now can either return an Int32 or a larger number.

I also had to split them in the DFG/FTL, see GetTypedArrayLengthAsInt52 and GetTypedArrayByteOffsetAsInt52 for examples

• In turns, I had to add CheckInBoundsInt52 since CheckInBounds could not accept the result of GetTypedArrayLengthAsInt52
• I modified the runtime functions for GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX to accept non-Int32 indices, since for {Int8/UInt8/UInt8Clamped}Array, a maximum size of 4GB implies indices > 2B.
• I added a "mayBeLargeTypedArray" bit to ArrayProfile/UnlinkedArrayProfile/DFG::ArrayMode to track whether such a non-Int32 index was seen to allow proper speculation and specialization of fast paths in the DFG/FTL.

I then updated the runtime functions used by the slow paths to correctly update it.

Unfortunately I ran out of time to add all the speculations/update all the fast paths.
So the following will have to wait for a follow-up patch:

• Accepting large indices in the fast path of GetByVal in the LLInt
• Accepting large indices in the fast paths generated by AccessCase/PolymorphicAccess
• Accepting large indices in the fast paths generated by the DFG/FTL for each of GetByVal/PutByVal/DataViewGet/DataViewSet/AtomicsXXX

The current patch is functional, it will just have dreadful performance if trying to use indices >2B in a {Int8/UInt8/UInt8Clamped}Array.

Other minor changes in this patch:

• Fixed an undefined behavior in ArrayBuffer::createInternal where memcpy could be called on nullptr (the spec explicitly bans this even when length is 0)
• Replaced some repetitive and error-prone bounds checking by calls to WTF::isSumSmallerThanOrEqual, which is clearer, shorter, and reuse CheckedArithmetic facilities to avoid overflow issues.
• Fixed a variety of obsolete comments
• Added support for branch64(RelationalCondition cond, RegisterID left, Imm64 right)

(there was already support for the same but with TrustedImm64)

• Made various AbstractMacroAssembler function constexpr as part of the previous point

• assembler/AbstractMacroAssembler.cpp:
• assembler/AbstractMacroAssembler.h: (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr): (JSC::AbstractMacroAssembler::TrustedImmPtr::asIntptr): (JSC::AbstractMacroAssembler::TrustedImmPtr::asPtr): (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr): (JSC::AbstractMacroAssembler::ImmPtr::asTrustedImmPtr): (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32): (JSC::AbstractMacroAssembler::Imm32::Imm32): (JSC::AbstractMacroAssembler::Imm32::asTrustedImm32 const): (JSC::AbstractMacroAssembler::TrustedImm64::TrustedImm64): (JSC::AbstractMacroAssembler::Imm64::Imm64): (JSC::AbstractMacroAssembler::Imm64::asTrustedImm64 const): (JSC::AbstractMacroAssembler::canBlind): (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch):
• assembler/MacroAssembler.h: (JSC::MacroAssembler::branch64):
• assembler/MacroAssemblerARM64.h: (JSC::MacroAssemblerARM64::shouldBlindForSpecificArch): (JSC::MacroAssemblerARM64::branch64):
• assembler/MacroAssemblerARM64E.h: (JSC::MacroAssemblerARM64E::untagArrayPtrLength64): (JSC::MacroAssemblerARM64E::untagArrayPtrLength32): Deleted.
• assembler/MacroAssemblerX86Common.h: (JSC::MacroAssemblerX86Common::canBlind): (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
• bytecode/AccessCase.cpp: (JSC::AccessCase::needsScratchFPR const): (JSC::AccessCase::generateWithGuard):
• bytecode/ArrayProfile.h: (JSC::ArrayProfile::setMayBeLargeTypedArray): (JSC::ArrayProfile::mayBeLargeTypedArray const): (JSC::UnlinkedArrayProfile::UnlinkedArrayProfile): (JSC::UnlinkedArrayProfile::update):
• dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
• dfg/DFGArgumentsEliminationPhase.cpp:
• dfg/DFGArrayMode.cpp: (JSC::DFG::ArrayMode::refine const):
• dfg/DFGArrayMode.h: (JSC::DFG::ArrayMode::ArrayMode): (JSC::DFG::ArrayMode::mayBeLargeTypedArray const): (JSC::DFG::ArrayMode::withType const): (JSC::DFG::ArrayMode::withSpeculation const): (JSC::DFG::ArrayMode::withConversion const): (JSC::DFG::ArrayMode::withTypeAndConversion const): (JSC::DFG::ArrayMode::withArrayClassAndSpeculationAndMayBeLargeTypedArray const): (JSC::DFG::ArrayMode::speculationFromProfile): (JSC::DFG::ArrayMode::withSpeculationFromProfile const): (JSC::DFG::ArrayMode::withProfile const): (JSC::DFG::ArrayMode::operator== const): (JSC::DFG::ArrayMode::withArrayClass const): Deleted.
• dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleIntrinsicGetter):
• dfg/DFGClobberize.h: (JSC::DFG::clobberize):
• dfg/DFGCommon.h: (JSC::DFG::enableInt52):
• dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants):
• dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC):
• dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): (JSC::DFG::FixupPhase::convertToGetArrayLength): (JSC::DFG::FixupPhase::prependGetArrayLength): Deleted.
• dfg/DFGGenerationInfo.h:
• dfg/DFGHeapLocation.cpp: (WTF::printInternal):
• dfg/DFGHeapLocation.h:
• dfg/DFGIntegerRangeOptimizationPhase.cpp:
• dfg/DFGNode.h: (JSC::DFG::Node::hasStorageChild const): (JSC::DFG::Node::storageChildIndex): (JSC::DFG::Node::hasArrayMode):
• dfg/DFGNodeType.h:
• dfg/DFGOperations.cpp: (JSC::DFG::putByVal): (JSC::DFG::newTypedArrayWithSize): (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
• dfg/DFGOperations.h:
• dfg/DFGPredictionPropagationPhase.cpp:
• dfg/DFGSSALoweringPhase.cpp: (JSC::DFG::SSALoweringPhase::handleNode): (JSC::DFG::SSALoweringPhase::lowerBoundsCheck):
• dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute):
• dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds): (JSC::DFG::SpeculativeJIT::emitTypedArrayBoundsCheck): (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage): (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset): (JSC::DFG::SpeculativeJIT::compileGetArrayLength): (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize): (JSC::DFG::SpeculativeJIT::emitNewTypedArrayWithSizeInRegister): (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
• dfg/DFGSpeculativeJIT.h:
• dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compile):
• dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithInt52Size): (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52): (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffsetAsInt52): (JSC::DFG::SpeculativeJIT::compile):
• dfg/DFGTypeCheckHoistingPhase.cpp: (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks): (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
• dfg/DFGValidate.cpp:
• ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile):
• ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::validateAIState): (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::emitGetTypedArrayByteOffsetExceptSettingResult): (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset): (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffsetAsInt52): (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength): (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52): (JSC::FTL::DFG::LowerDFGToB3::compileCheckInBoundsInt52): (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal): (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray): (JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
• ftl/FTLOutput.h: (JSC::FTL::Output::load64NonNegative):
• jit/IntrinsicEmitter.cpp: (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
• jit/JITOperations.cpp: (JSC::putByVal): (JSC::getByVal):
• llint/LLIntOfflineAsmConfig.h:
• llint/LLIntSlowPaths.cpp: (JSC::LLInt::getByVal): (JSC::LLInt::LLINT_SLOW_PATH_DECL):
• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter32_64.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/ArrayBuffer.cpp: (JSC::SharedArrayBufferContents::SharedArrayBufferContents): (JSC::ArrayBufferContents::ArrayBufferContents): (JSC::ArrayBufferContents::tryAllocate): (JSC::ArrayBuffer::create): (JSC::ArrayBuffer::createAdopted): (JSC::ArrayBuffer::createFromBytes): (JSC::ArrayBuffer::tryCreate): (JSC::ArrayBuffer::createUninitialized): (JSC::ArrayBuffer::tryCreateUninitialized): (JSC::ArrayBuffer::createInternal): (JSC::ArrayBuffer::clampValue): (JSC::ArrayBuffer::clampIndex const): (JSC::ArrayBuffer::sliceWithClampedIndex const):
• runtime/ArrayBuffer.h: (JSC::ArrayBufferContents::sizeInBytes const): (JSC::ArrayBuffer::byteLength const): (JSC::ArrayBuffer::gcSizeEstimateInBytes const):
• runtime/ArrayBufferView.cpp: (JSC::ArrayBufferView::ArrayBufferView):
• runtime/ArrayBufferView.h: (JSC::ArrayBufferView::byteOffset const): (JSC::ArrayBufferView::byteLength const): (JSC::ArrayBufferView::verifyByteOffsetAlignment): (JSC::ArrayBufferView::verifySubRangeLength): (JSC::ArrayBufferView::clampOffsetAndNumElements): (JSC::ArrayBufferView::setImpl): (JSC::ArrayBufferView::setRangeImpl): (JSC::ArrayBufferView::getRangeImpl): (JSC::ArrayBufferView::zeroRangeImpl): (JSC::ArrayBufferView::calculateOffsetAndLength): Deleted.
• runtime/AtomicsObject.cpp:
• runtime/DataView.cpp: (JSC::DataView::DataView): (JSC::DataView::create):
• runtime/DataView.h:
• runtime/GenericTypedArrayView.h:
• runtime/GenericTypedArrayViewInlines.h: (JSC::GenericTypedArrayView<Adaptor>::GenericTypedArrayView): (JSC::GenericTypedArrayView<Adaptor>::create): (JSC::GenericTypedArrayView<Adaptor>::tryCreate): (JSC::GenericTypedArrayView<Adaptor>::createUninitialized): (JSC::GenericTypedArrayView<Adaptor>::tryCreateUninitialized): (JSC::GenericTypedArrayView<Adaptor>::subarray const): Deleted.
• runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext): (JSC::JSArrayBufferView::byteLength const): (JSC::JSArrayBufferView::slowDownAndWasteMemory): (JSC::JSArrayBufferView::possiblySharedImpl):
• runtime/JSArrayBufferView.h: (JSC::JSArrayBufferView::sizeOf): (JSC::JSArrayBufferView::ConstructionContext::length const): (JSC::JSArrayBufferView::length const):
• runtime/JSArrayBufferViewInlines.h: (JSC::JSArrayBufferView::byteOffsetImpl): (JSC::JSArrayBufferView::byteOffset): (JSC::JSArrayBufferView::byteOffsetConcurrently):
• runtime/JSCJSValue.h:
• runtime/JSCJSValueInlines.h: (JSC::JSValue::toIndex const): (JSC::JSValue::toTypedArrayIndex const):
• runtime/JSDataView.cpp: (JSC::JSDataView::create): (JSC::JSDataView::createUninitialized): (JSC::JSDataView::set): (JSC::JSDataView::setIndex):
• runtime/JSDataView.h:
• runtime/JSDataViewPrototype.cpp: (JSC::getData): (JSC::setData):
• runtime/JSGenericTypedArrayView.h:
• runtime/JSGenericTypedArrayViewConstructorInlines.h: (JSC::constructGenericTypedArrayViewWithArguments): (JSC::constructGenericTypedArrayViewImpl):
• runtime/JSGenericTypedArrayViewInlines.h: (JSC::JSGenericTypedArrayView<Adaptor>::create): (JSC::JSGenericTypedArrayView<Adaptor>::createWithFastVector): (JSC::JSGenericTypedArrayView<Adaptor>::createUninitialized): (JSC::JSGenericTypedArrayView<Adaptor>::validateRange): (JSC::JSGenericTypedArrayView<Adaptor>::setWithSpecificType): (JSC::JSGenericTypedArrayView<Adaptor>::set):
• runtime/JSObject.h: (JSC::JSObject::putByIndexInline): (JSC::JSObject::tryGetIndexQuickly const): (JSC::JSObject::trySetIndexQuickly): (JSC::JSObject::canSetIndexQuickly): Deleted.
• runtime/JSObjectInlines.h: (JSC::JSObject::getIndexQuicklyForTypedArray const): (JSC::JSObject::setIndexQuicklyForArrayStorageIndexingType): (JSC::JSObject::trySetIndexQuicklyForTypedArray): (JSC::JSObject::canSetIndexQuicklyForTypedArray const): Deleted.
• runtime/Operations.h: (JSC::getByValWithIndex):
• wasm/WasmPageCount.h:

Source/WebCore:

Some parts of WebCore use TypedArrays, and would not build after I made the length() function on typed arrays return UCPURegister instead of uint32_t.
Most fixes were trivial, the only exception is SerializedScriptValue.cpp, where I had to increment the version number, as ArrayBuffer (and ArrayBufferViews) now write/read their length in a 64-bit field (and same for the byteOffset of ArrayBufferView).

I also had to add a test in PixelBuffer.cpp that the size of the ArrayBuffer it will try to allocate is < INT32_MAX.
Otherwise, the test LayoutTests/fast/shapes/shape-outside-floats/shape-outside-imagedata-overflow.html which checks that very large images are properly rejected without crashing, would timeout.

No new tests, as the code is already extensively covered by existing tests, and I implemented no new features.

• Modules/webaudio/AudioBuffer.cpp: (WebCore::AudioBuffer::copyFromChannel): (WebCore::AudioBuffer::copyToChannel):
• Modules/webaudio/RealtimeAnalyser.cpp: (WebCore::RealtimeAnalyser::getByteFrequencyData): (WebCore::RealtimeAnalyser::getFloatTimeDomainData): (WebCore::RealtimeAnalyser::getByteTimeDomainData):
• bindings/js/SerializedScriptValue.cpp: (WebCore::CloneSerializer::dumpArrayBufferView): (WebCore::CloneSerializer::dumpImageBitmap): (WebCore::CloneSerializer::dumpIfTerminal): (WebCore::CloneDeserializer::readArrayBufferImpl): (WebCore::CloneDeserializer::readArrayBuffer): (WebCore::CloneDeserializer::readArrayBufferViewImpl): (WebCore::CloneDeserializer::readArrayBufferView):
• bindings/js/SerializedScriptValue.h: (WebCore::SerializedScriptValue::encode const): (WebCore::SerializedScriptValue::decode):
• fileapi/NetworkSendQueue.cpp: (WebCore::NetworkSendQueue::enqueue):
• platform/graphics/PixelBuffer.cpp: (WebCore::PixelBuffer::tryCreate):
• platform/graphics/iso/ISOBox.h:

Source/WTF:

Made some of CheckedArithmetic constexpr, and added isSumSmallerThanOrEqual since it is a commonly used test in ArrayBuffer and easy to get wrong in terms of overflow.

• wtf/CheckedArithmetic.h: (WTF::isInBounds): (WTF::convertSafely): (WTF::isSumSmallerThanOrEqual):

LayoutTests:

Rebaselined three following tests as different or fewer error messages appear on the console.
Also changed currentVersion in serialized-script-value.html from 9 to 10.

• fast/canvas/canvas-getImageData-invalid-result-buffer-crash-expected.txt:
• fast/storage/serialized-script-value.html:
• webaudio/OfflineAudioContext-bad-buffer-crash-expected.txt:
• webaudio/OfflineAudioContext/bad-buffer-length-expected.txt:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@284230 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:28 PM Changeset in webkit [284400] by Russell Epstein

• 13 edits in branches/safari-612-branch

Apply patch. rdar://problem/84313358

2:17 PM Changeset in webkit [284399] by basuke.suzuki@sony.com

• 14 edits
  2 copies
  3 adds
  1 delete in trunk/Tools

[webkitperl] Stop using LoadAsModule.pm
​https://bugs.webkit.org/show_bug.cgi?id=231868

Reviewed by Jonathan Bedard.

This module load a script file as module with a bit tricky way. It prevents the proper
usage of package after all. The purpose of this module is to test routines defined in the
script. It just be wrong with such way. If you have something to test, it should be separated
as a module and be imported to the script. Then unit test can load the module and can test
without any sort of trouble.

• Scripts/filter-build-webkit:

(setOutputFormatOption):
(shouldShowSubsequentLine): Moved to webkitperl/build/output.pm.
(shouldIgnoreLine): Ditto.

• Scripts/prepare-ChangeLog:

(generateFunctionLists):
(fetchBugXMLData):
(openChangeLogs):
(method_decl_to_selector):
(diffCommand):
(statusCommand):
(propertyChangeDescription):
(normalizeLineEndings):
(actuallyGenerateFunctionLists): Moved to webkitperl/changelog.
(computeModifiedFunctions): Ditto.
(fetchBugDescriptionFromBugXMLData): Ditto.
(fetchRadarURLFromBugXMLData): Ditto.
(get_function_line_ranges): Ditto.
(get_function_line_ranges_for_cpp): Ditto.
(delete_namespaces_from_ranges_for_cpp): Ditto.
(is_function_in_namespace): Ditto.
(get_function_line_ranges_for_java): Ditto.
(get_function_line_ranges_for_javascript): Ditto.
(get_function_line_ranges_for_perl): Ditto.
(get_function_line_ranges_for_python): Ditto.
(get_selector_line_ranges_for_css): Ditto.
(get_function_line_ranges_for_swift): Ditto.
(parseSwiftFunctionArgs): Ditto.
(attributeCommand): Ditto.
(extractLineRangeAfterChange): Ditto.
(extractLineRangeBeforeChange): Ditto.
(decodeEntities): Ditto.

• Scripts/run-leaks:

(main):
(removeMatchingRecords):
(runLeaks): Moved to webkitperl/leaks.pm.
(parseLeaksOutput): Ditto.
(reportError): Deleted. Use Carp::croak instead.

• Scripts/webkitdirs.pm:

(determineBaseProductDir):
(determineCurrentSVNRevision):
(chdirWebKit):
(determineSourceDir): Moved to webkitperl/dirs.pm.
(setSourceDir): Ditto.
(sourceDir): Ditto.

• Scripts/webkitperl/LoadAsModule.pm: Removed.
• Scripts/webkitperl/build/output.pm: Extracted from Tools/Scripts/filter-build-webkit.

(shouldShowSubsequentLine):
(shouldIgnoreLine):

• Scripts/webkitperl/changelog.pm: Extracted from Tools/Scripts/prepare-ChangeLog.

(actuallyGenerateFunctionLists):
(extractLineRangeAfterChange):
(extractLineRangeBeforeChange):
(attributeCommand):
(fetchBugDescriptionFromBugXMLData):
(fetchRadarURLFromBugXMLData):
(computeModifiedFunctions):
(get_function_line_ranges):
(get_function_line_ranges_for_cpp):
(delete_namespaces_from_ranges_for_cpp):
(is_function_in_namespace):
(get_function_line_ranges_for_java):
(get_function_line_ranges_for_javascript):
(get_function_line_ranges_for_perl):
(get_function_line_ranges_for_python):
(get_selector_line_ranges_for_css):
(get_function_line_ranges_for_swift):
(parseSwiftFunctionArgs):
(decodeEntities):

• Scripts/webkitperl/dirs.pm: Extracted from Tools/Scripts/webkitdirs.

(sourceDir):
(setSourceDir):
(determineSourceDir):

• Scripts/webkitperl/filter-build-webkit_unittest/shouldIgnoreLine_unittests.pl:
• Scripts/webkitperl/leaks.pm: Copied from Tools/Scripts/run-leaks.

(runLeaks):
(parseLeaksOutput):

• Scripts/webkitperl/prepare-ChangeLog_unittest/extractLineRangeBeforeAndAfterChange.pl:
• Scripts/webkitperl/prepare-ChangeLog_unittest/fetchRadarURLFromBugXMLData.pl:
• Scripts/webkitperl/prepare-ChangeLog_unittest/filenameWithParentheses.pl:
• Scripts/webkitperl/prepare-ChangeLog_unittest/generateFunctionLists.pl:
• Scripts/webkitperl/prepare-ChangeLog_unittest/parser_unittests.pl:

(convertAbsolutePathToRelativeUnixPath):

• Scripts/webkitperl/run-leaks_unittest/run-leaks-report-v1.0.pl:
• Scripts/webkitperl/run-leaks_unittest/run-leaks-report-v2.0-new.pl:
• Scripts/webkitperl/run-leaks_unittest/run-leaks-report-v2.0-old.pl:

1:51 PM Changeset in webkit [284398] by Jonathan Bedard

• 4 edits in trunk/Tools

[run-api-tests] Use temporary symlink when listing tests
​https://bugs.webkit.org/show_bug.cgi?id=230560

Reviewed by Dewei Zhu.

• Scripts/webkitpy/api_tests/manager.py:

(Manager._collect_tests): Copy binary when listing tests to make debuging easier.

• Scripts/webkitpy/common/system/filesystem.py:

(FileSystem.copyfile): Return copyfile result.
(FileSystem.copymode): Invoke shutil.copymode.

• Scripts/webkitpy/common/system/filesystem_mock.py:

(MockFileSystem.copymode):

1:50 PM Changeset in webkit [284397] by svillar@igalia.com

• 4 edits in trunk

[css-flexbox] Do not clamp flex base size with {min|max}-{height|width}
​https://bugs.webkit.org/show_bug.cgi?id=225590
<rdar://problem/78100329>

Reviewed by Manuel Rego Casasnovas.

Source/WebCore:

When computing flex base size we should not clamp it with neither min-{height|width}
nor max-{height|width}. That would be done later and will be called the hypothetical
main size.

For most of the cases we were already doing it, however there are some particular cases
in which we have to call the generic layout code which does clamp the sizes using min
and max sizes. In order to make those code paths work, we reset the min|max values to
their initial ones (so they effectively become inactive) and then we set the original
values back after computing the base size.

This is a reland of r279271 which was pretty similar but caused a visual regression in
GMail. After r284359 this is no longer a problem of this patch.

This fixes 3 WPT flexbox tests.

• rendering/RenderFlexibleBox.cpp:

(WebCore::ScopedUnboundedBoxWithFlexBasisAsChildMainSize::ScopedUnboundedBoxWithFlexBasisAsChildMainSize):
renamed from ScopedFlexBasisAsChildMainSize. Resets min|max-size to their initial values.
(WebCore::ScopedUnboundedBoxWithFlexBasisAsChildMainSize::~ScopedUnboundedBoxWithFlexBasisAsChildMainSize):
ditto. Restores min|max-size original values.
(WebCore::RenderFlexibleBox::computeFlexBaseSizeForChild):
(WebCore::ScopedFlexBasisAsChildMainSize::ScopedFlexBasisAsChildMainSize): Deleted.
(WebCore::ScopedFlexBasisAsChildMainSize::~ScopedFlexBasisAsChildMainSize): Deleted.

LayoutTests:

• TestExpectations: Unskipped 3 tests that are now passing.

1:41 PM Changeset in webkit [284396] by sbarati@apple.com

• 2 edits in trunk/Source/JavaScriptCore

Don't load metadata base pointer in EXTRA_CTI_THUNKS
​https://bugs.webkit.org/show_bug.cgi?id=231850

Reviewed by Yusuke Suzuki.

We were loading the metadata table base pointer dynamically. But in
unlinked baseline JIT, it's already pinned in a register. Let's just
use the register instead of recomputing what's already there. This is
a small speedup in throughput of unlinked baseline JIT code for scope
operations.

• jit/JITPropertyAccess.cpp:

(JSC::JIT::generateOpResolveScopeThunk):
(JSC::JIT::generateOpGetFromScopeThunk):

1:34 PM Changeset in webkit [284395] by Andres Gonzalez

• 2 edits in trunk/Tools

Set isolated tree mode to secondary AX thread in LayoutTests.
​https://bugs.webkit.org/show_bug.cgi?id=231763

Reviewed by Chris Fleizach.

Isolated tree mode was enabled for LayoutTests but set to run on the
main thread. Change it to run on the AX thread.

• WebKitTestRunner/InjectedBundle/mac/AccessibilityControllerMac.mm:

(WTR::AccessibilityController::updateIsolatedTreeMode):

1:25 PM Changeset in webkit [284394] by Russell Epstein

• 2 edits in branches/safari-613.1.6-branch/Source/WebKit

Cherry-pick r284382. rdar://problem/84384768

Web process occasionally crashes under RemoteDisplayListRecorderProxy::recordRestore()
​https://bugs.webkit.org/show_bug.cgi?id=231900

Reviewed by Tim Horton.

It's apparently possible for a RemoteImageBufferProxy in the web process to outlive RemoteRenderingBackendProxy.
Before the IPC stream refactoring in r284079, we were robust against this possibility because
RemoteImageBufferProxy checked for a null rendering backend in canAppendItemOfType and returned false, which
prevented us from trying to call into the rendering backend. However, I accidentally omitted this null check
in the new RemoteDisplayListRecorderProxy, which currently assumes that m_renderingBackend is always non-null
when sending any IPC stream messages.

Fix this crash by restoring the null check for the weak m_renderingBackend pointer. I only observed this crash
once locally and, unfortunately, haven't been able to come up with a test case that consistently reproduces it.

• WebProcess/GPU/graphics/RemoteDisplayListRecorderProxy.h: (WebKit::RemoteDisplayListRecorderProxy::send):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@284382 268f45cc-cd09-0410-ab3c-d52691b4dbfc

1:08 PM Changeset in webkit [284393] by Russell Epstein

• 21 edits
  1 add in branches/safari-612-branch

Cherry-pick r283238. rdar://problem/83955650

MediaStream canvas.captureStream() fails for WebGL
​https://bugs.webkit.org/show_bug.cgi?id=230613
<rdar://82307293>

Patch by Kimmo Kinnunen <​kkinnunen@apple.com> on 2021-09-29
Reviewed by Youenn Fablet.

.:

Add a manual test to interact with media stream
captureStream() behavior until the implementation is
testable.

• ManualTests/mediastream/mediastream-canvas-to-video.html: Added.

Source/WebCore:

Remove previous incorrect behavior of turning on "preservesDrawingBuffer"
and sampling the drawing buffer. The drawing buffer is not what should
ever be touched, rather it's the display buffer that should be available.

Implement sampling of WebGL display buffer for
media stream capture. The upon sampling, obtain a shared
reference to the
display buffer, passes it to media sample consuming process and mark
the WebGL context display buffer non-eligible for recycling as
new drawing buffer.

Currently the implementation is displayed correctly for
WebGL contents that is premultiplied. Unpremultiplied
content is fixed in the associated bugs.

Note: there are bugs preventing robust use of the API,
listed in the associated bugs. As such, testing is not expanded
in this bug.

Tested by
ManualTests/mediastream/mediastream-canvas-to-video.html (added)

​https://webrtc.github.io/samples/src/content/capture/canvas-video/
(Refresh the page or hide the window until MediaPlayer initialization
flakyness lets rendering happen)

The test LayoutTests/fast/mediastream/captureStream/canvas3d.html
cannot yet be used to test the implementation as the rest of the
captureStream() and playback implementation is so flaky.

• Modules/mediastream/CanvasCaptureMediaStreamTrack.cpp: (WebCore::CanvasCaptureMediaStreamTrack::Source::canvasChanged):
• html/HTMLCanvasElement.cpp: (WebCore::HTMLCanvasElement::toMediaSample):
• html/canvas/WebGLRenderingContextBase.cpp: (WebCore::WebGLRenderingContextBase::paintCompositedResultsToMediaSample):
• html/canvas/WebGLRenderingContextBase.h: (WebCore::WebGLRenderingContextBase::isPreservingDrawingBuffer const):
• platform/graphics/GraphicsContextGL.cpp:
• platform/graphics/GraphicsContextGL.h:
• platform/graphics/RemoteGraphicsContextGLProxyBase.cpp: (WebCore::RemoteGraphicsContextGLProxyBase::paintCompositedResultsToMediaSample):
• platform/graphics/RemoteGraphicsContextGLProxyBase.h:
• platform/graphics/avfoundation/objc/MediaSampleAVFObjC.h:
• platform/graphics/avfoundation/objc/MediaSampleAVFObjC.mm: (WebCore::MediaSampleAVFObjC::createImageSample):
• platform/graphics/cocoa/GraphicsContextGLIOSurfaceSwapChain.cpp: (WebCore::GraphicsContextGLIOSurfaceSwapChain::present):
• platform/graphics/cocoa/GraphicsContextGLIOSurfaceSwapChain.h:
• platform/graphics/cocoa/GraphicsContextGLOpenGLCocoa.mm: (WebCore::GraphicsContextGLOpenGL::paintCompositedResultsToMediaSample):
• platform/graphics/cocoa/RemoteGraphicsContextGLProxyBaseCocoa.mm: (WebCore::RemoteGraphicsContextGLProxyBase::paintCompositedResultsToMediaSample):
• platform/graphics/opengl/GraphicsContextGLOpenGL.cpp: (WebCore::GraphicsContextGLOpenGL::paintCompositedResultsToMediaSample):
• platform/graphics/opengl/GraphicsContextGLOpenGL.h:

LayoutTests:

Add new expectations, a warning was removed.
CONSOLE MESSAGE: Turning drawing buffer preservation for the WebGL canvas being captured

• fast/mediacapturefromelement/CanvasCaptureMediaStream-webgl-events-expected.txt:
• fast/mediastream/captureStream/canvas3d-expected.txt:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@283238 268f45cc-cd09-0410-ab3c-d52691b4dbfc

12:59 PM Changeset in webkit [284392] by Russell Epstein

• 14 edits
  2 adds
  1 delete in branches/safari-612-branch/Source

Apply patch. rdar://problem/84124701

12:59 PM Changeset in webkit [284391] by Russell Epstein

• 12 edits in branches/safari-612-branch/Source

Apply patch. rdar://problem/84124706

12:33 PM Changeset in webkit [284390] by sihui_liu@apple.com

• 32 edits
  3 copies
  4 adds in branches/safari-612-branch

Apply patch rdar://84349756

12:33 PM Changeset in webkit [284389] by sihui_liu@apple.com

• 1 edit in branches/safari-612-branch/Source/WebKit/NetworkProcess/storage/FileSystemStorageError.h

Apply patch rdar://84351861

12:29 PM Changeset in webkit [284388] by commit-queue@webkit.org

• 4 edits in trunk

[ iOS15 Monterey ] TestWTF.WTF_URLExtras.URLExtras is a constant failure
​https://bugs.webkit.org/show_bug.cgi?id=231454

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-10-18
Reviewed by Chris Dumez.

Source/WTF:

• wtf/PlatformHave.h:

Tools:

The behavior of NSURL changed to disallow empty punycode in the host.
This is fine, but we need to update our test expectations.

• TestWebKitAPI/Tests/WTF/cocoa/URLExtras.mm:

(TestWebKitAPI::TEST):

11:55 AM Changeset in webkit [284387] by commit-queue@webkit.org

• 7 edits
  4 adds in trunk

AX: Return AXEmptyGroup subrole for groups with no accessible content
​https://bugs.webkit.org/show_bug.cgi?id=231528

Patch by Tyler Wilcock <Tyler Wilcock> on 2021-10-18
Reviewed by Andres Gonzalez.

Source/WebCore:

Return a subrole of "AXEmptyGroup" for groups without any exposed
children. WebKit can calculate this more efficiently than AX clients,
so it makes more sense to do here.

Test: accessibility/mac/empty-group-computation.html

• accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(-[WebAccessibilityObjectWrapper subrole]):

LayoutTests:

• accessibility/mac/aria-divs-not-ignored-expected.txt:
• accessibility/mac/aria-divs-not-ignored.html:

Expect a subrole of AXEmptyGroup because this group has no content.

• accessibility/roles-exposed.html:

Changed some math testcases to use valid MathML markup. Otherwise
they'd be considered to have no children, and therefore be given
a subrole of AXEmptyGroup, which is not what this test is intended
to exercise.

• accessibility/mac/empty-group-computation-expected.txt: Added.
• accessibility/mac/empty-group-computation.html: Added.

• platform/mac/accessibility/lists-expected.txt: Added.
• platform/mac/accessibility/plugin-expected.txt: Added.

Add these Mac-specific expectations for these tests because this patch
only causes Mac to expose the AXEmptyGroup subrole.

• platform/mac/accessibility/svg-element-with-aria-role-expected.txt:

Add an expected subrole of AXEmptyGroup.

10:53 AM Changeset in webkit [284386] by Ayumi Kojima

• 5 edits in trunk/LayoutTests

[ iOS 15 ] Rebaselining 4 fast tests.
​https://bugs.webkit.org/show_bug.cgi?id=231901

Unreviewed test gardening.

• platform/ios/fast/backgrounds/border-radius-split-background-expected.txt:
• platform/ios/fast/backgrounds/border-radius-split-background-image-expected.txt:
• platform/ios/fast/borders/border-styles-split-expected.txt:
• platform/ios/fast/text/basic/015-expected.txt:

10:30 AM Changeset in webkit [284385] by Russell Epstein

• 14 edits in branches/safari-613.1.6-branch/Source

Cherry-pick r284383. rdar://problem/84377173

Revert r284216
​https://webkit.org/b/231523
<rdar://84342878>

Source/WebCore:

• CMakeLists.txt:
• Configurations/WebCore.xcconfig:
• Sources.txt:
• SourcesCocoa.txt:
• WebCore.xcodeproj/project.pbxproj:

Source/WebKit:

There is an internal build configuration that doesn't know how to find libWebCoreStatic.a
and I have reason to believe that this is not necessary anyways.

• Configurations/adattributiond.xcconfig:
• Shared/API/Cocoa/WKMain.h:
• Shared/API/Cocoa/WKMain.mm: (WKAdAttributionDaemonMain):
• Sources.txt:
• SourcesCocoa.txt:
• WebKit.xcodeproj/project.pbxproj:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@284383 268f45cc-cd09-0410-ab3c-d52691b4dbfc

10:29 AM Changeset in webkit [284384] by Ayumi Kojima

• 1 edit
  4 deletes in trunk/LayoutTests

Unreviewed, reverting r284377.

Reverting because the expected.txt files are in the wrong
folders for rebaselining

Reverted changeset:

"[ iOS 15 ] Rebaselining 4 fast tests."
​https://bugs.webkit.org/show_bug.cgi?id=231901
​https://commits.webkit.org/r284377

10:25 AM Changeset in webkit [284383] by achristensen@apple.com

• 14 edits in trunk/Source

Revert r284216
​https://webkit.org/b/231523
<rdar://84342878>

Source/WebCore:

• CMakeLists.txt:
• Configurations/WebCore.xcconfig:
• Sources.txt:
• SourcesCocoa.txt:
• WebCore.xcodeproj/project.pbxproj:

Source/WebKit:

There is an internal build configuration that doesn't know how to find libWebCoreStatic.a
and I have reason to believe that this is not necessary anyways.

• Configurations/adattributiond.xcconfig:
• Shared/API/Cocoa/WKMain.h:
• Shared/API/Cocoa/WKMain.mm:

(WKAdAttributionDaemonMain):

• Sources.txt:
• SourcesCocoa.txt:
• WebKit.xcodeproj/project.pbxproj:

10:19 AM Changeset in webkit [284382] by Wenson Hsieh

• 2 edits in trunk/Source/WebKit

Web process occasionally crashes under RemoteDisplayListRecorderProxy::recordRestore()
​https://bugs.webkit.org/show_bug.cgi?id=231900

Reviewed by Tim Horton.

It's apparently possible for a RemoteImageBufferProxy in the web process to outlive RemoteRenderingBackendProxy.
Before the IPC stream refactoring in r284079, we were robust against this possibility because
RemoteImageBufferProxy checked for a null rendering backend in canAppendItemOfType and returned false, which
prevented us from trying to call into the rendering backend. However, I accidentally omitted this null check
in the new RemoteDisplayListRecorderProxy, which currently assumes that m_renderingBackend is always non-null
when sending any IPC stream messages.

Fix this crash by restoring the null check for the weak m_renderingBackend pointer. I only observed this crash
once locally and, unfortunately, haven't been able to come up with a test case that consistently reproduces it.

• WebProcess/GPU/graphics/RemoteDisplayListRecorderProxy.h:

(WebKit::RemoteDisplayListRecorderProxy::send):

10:18 AM Changeset in webkit [284381] by Russell Epstein

• 1 copy in branches/safari-613.1.6-branch

New branch.

10:17 AM Changeset in webkit [284380] by Antti Koivisto

• 7 edits
  2 adds in trunk

background-clip:text doesn't paint correctly for inline box spanning multiple lines
​https://bugs.webkit.org/show_bug.cgi?id=231891

Reviewed by Alan Bujtas.

Source/WebCore:

'background-clip: text' paints to a wrong position if the inline box spans multiple lines.

Test: fast/inline/inline-background-clip-text-multiline.html

• rendering/InlineBoxPainter.cpp:

(WebCore::InlineBoxPainter::paintFillLayer):

• rendering/RenderBox.cpp:

(WebCore::RenderBox::paintFillLayer):

• rendering/RenderBoxModelObject.cpp:

(WebCore::RenderBoxModelObject::getBackgroundRoundedRect const):
(WebCore::RenderBoxModelObject::backgroundRoundedRectAdjustedForBleedAvoidance const):

No need to pass box size separately as it now always matches the passed in border rect.

(WebCore::RenderBoxModelObject::paintFillLayerExtended):

The 'rect' parameter used to be either the border box rect of the box being painted or,
in the case of multiline inline box background image, the image strip being painted.

Make the 'rect' parameter to always be the border box and pass the background image strip
separately.

Use the background image strip only during background image painting.

• rendering/RenderBoxModelObject.h:

(WebCore::RenderBoxModelObject::paintFillLayerExtended):

LayoutTests:

• fast/inline/inline-background-clip-text-multiline-expected.html: Added.
• fast/inline/inline-background-clip-text-multiline.html: Added.

10:16 AM Changeset in webkit [284379] by Russell Epstein

• 8 edits in trunk/Source

Versioning.

WebKit-7613.1.7

10:14 AM Changeset in webkit [284378] by Jonathan Bedard

• 2 edits in trunk/Tools

[webkitscmpy] Allow repositories to define custom setup commands (Follow0-up)
​https://bugs.webkit.org/show_bug.cgi?id=231345
<rdar://problem/83960249>

Unreviewed follow-up fix.

• Scripts/git-webkit: Do not specify OpenSource in Tools/Scripts path.

9:21 AM Changeset in webkit [284377] by Ayumi Kojima

• 1 edit
  4 adds in trunk/LayoutTests

[ iOS 15 ] Rebaselining 4 fast tests.
​https://bugs.webkit.org/show_bug.cgi?id=231901

Unreviewed test gardening.

• fast/backgrounds/border-radius-split-background-expected.txt: Added.
• fast/backgrounds/border-radius-split-background-image-expected.txt: Added.
• fast/borders/border-styles-split-expected.txt: Added.
• fast/text/basic/015-expected.txt: Added.

9:11 AM Changeset in webkit [284376] by achristensen@apple.com

• 2 edits in trunk/Tools

Regression (r284304) : [ iOS 15 Release ] http/tests/privateClickMeasurement tests are failing
​https://bugs.webkit.org/show_bug.cgi?id=231898

Use the SPI I made to keep the tests having old behavior of using the network process instead of the daemon.

• WebKitTestRunner/TestController.cpp:

(WTR::TestController::configureWebsiteDataStoreTemporaryDirectories):

9:07 AM Changeset in webkit [284375] by sihui_liu@apple.com

• 30 edits
  2 copies
  5 adds in branches/safari-612-branch

Apply patch rdar://83954608

8:49 AM Changeset in webkit [284374] by Simon Fraser

• 2 edits
  1 move
  4 deletes in trunk/LayoutTests

Cleanup css3/filters/backdrop/backdrop-filter-with-clip-path.html expected results
​https://bugs.webkit.org/show_bug.cgi?id=217804

Reviewed by Alexey Proskuryakov.

Change the test to use invert() instead of blur() on backdrop-filter.

Test still fails on iOS; looks like some pixel snapping issues.

• css3/filters/backdrop/backdrop-filter-with-clip-path-expected.html: Renamed from LayoutTests/platform/ios/css3/filters/backdrop/backdrop-filter-with-clip-path-expected.html.
• css3/filters/backdrop/backdrop-filter-with-clip-path-expected.txt: Removed.
• css3/filters/backdrop/backdrop-filter-with-clip-path.html:
• platform/glib/css3/filters/backdrop/backdrop-filter-with-clip-path-expected.txt: Removed.
• platform/mac/css3/filters/backdrop/backdrop-filter-with-clip-path-expected.png: Removed.
• platform/wpe/css3/filters/backdrop/backdrop-filter-with-clip-path-expected.txt: Removed.

8:30 AM Changeset in webkit [284373] by ddkilzer@apple.com

• 4 edits in trunk/Source

Bug 231882: WebKit::GPUConnectionToWebProcess::setTCCIdentity() leaks a tcc_identity_t
<​https://webkit.org/b/231882>
<rdar://problem/84350854>

Reviewed by Chris Dumez.

Source/WebCore/PAL:

• pal/spi/cocoa/TCCSPI.h:
• Properly declare tcc_identity_t as an OSObject.

Source/WebKit:

• GPUProcess/cocoa/GPUConnectionToWebProcessCocoa.mm:

(WebKit::GPUConnectionToWebProcess::setTCCIdentity):

• Use WTF::adoptOSObject() to fix the leak.
• Expand the scope of !PLATFORM(MACCATALYST) since none of this code needs to run on the MacCatalyst platform.

7:57 AM Changeset in webkit [284372] by Ms2ger@igalia.com

• 2 edits in trunk

Add my github username to contributors.json
​https://bugs.webkit.org/show_bug.cgi?id=231893

Unreviewed.

• metadata/contributors.json:

7:57 AM Changeset in webkit [284371] by commit-queue@webkit.org

• 23 edits
  3 adds in trunk/Source

Cocoa GraphicsContextGLOpenGL should not use WebGLLayer
​https://bugs.webkit.org/show_bug.cgi?id=231804

Patch by Kimmo Kinnunen <​kkinnunen@apple.com> on 2021-10-18
Reviewed by Dean Jackson.

Source/WebCore:

Move the "swap chain", e.g. the display buffer IOSurface
from WebGLLayer to GraphicsContextGLOpenGL.
Instantiate WebGLLayer only in new class WebProcessGraphicsContextGLOpenGL,
which is used when WebGL is run in-process in WebContent process.
Simply set the CALayer.contents when new display buffer is ready and
call "setNeedsDisplay" directly.

No new tests, a refactor.

• PlatformMac.cmake:
• SourcesCocoa.txt:
• WebCore.xcodeproj/project.pbxproj:
• platform/graphics/RemoteGraphicsContextGLProxyBase.h:
• platform/graphics/cocoa/GraphicsContextGLOpenGLCocoa.mm:

(WebCore::GraphicsContextGLOpenGL::GraphicsContextGLOpenGL):
(WebCore::GraphicsContextGLOpenGL::~GraphicsContextGLOpenGL):
(WebCore::GraphicsContextGLOpenGL::isValid const):
(WebCore::GraphicsContextGLOpenGL::reshapeDisplayBufferBacking):
(WebCore::GraphicsContextGLOpenGL::prepareForDisplay):
(WebCore::GraphicsContextGLOpenGL::readCompositedResults):
(WebCore::GraphicsContextGLOpenGL::paintCompositedResultsToMediaSample):
(WebCore::GraphicsContextGLOpenGL::create): Deleted.
(WebCore::GraphicsContextGLOpenGL::createForGPUProcess): Deleted.
GraphicsContextGLOpenGL for GPUProcess is now a new class, described
in WebKit ChangeLog.

• platform/graphics/cocoa/RemoteGraphicsContextGLProxyBaseCocoa.mm:

(WebCore::RemoteGraphicsContextGLProxyBase::platformInitialize):
(WebCore::RemoteGraphicsContextGLProxyBase::paintCompositedResultsToMediaSample):
(WebCore::RemoteGraphicsContextGLProxyBase::platformSwapChain): Deleted.

• platform/graphics/cocoa/WebGLLayer.h:
• platform/graphics/cocoa/WebGLLayer.mm:

(-[WebGLLayer initWithDevicePixelRatio:contentsOpaque:]):
(-[WebGLLayer display]):
(-[WebGLLayer swapChain]): Deleted.
(-[WebGLLayer prepareForDisplay]): Deleted.
(WebGLLayerSwapChain::present): Deleted.
CALayer.contents and setNeedsDisplay is called directly when
a graphics context has new display buffer.

• platform/graphics/cocoa/WebProcessGraphicsContextGLOpenGLCocoa.mm: Added.

(WebCore::GraphicsContextGLOpenGL::create):

• platform/graphics/opengl/GraphicsContextGLOpenGL.cpp:

(WebCore::GraphicsContextGLOpenGL::isValid const):
Add a new function that checks if the constructor exited early.
Before, m_contextObj would be consulted but this is not protected
so it's not so useful. Also it wasn't very accurate, as some constructor
early exists ran after m_contextObj was set. Use m_texture to detect
fully constructed object for now.

• platform/graphics/opengl/GraphicsContextGLOpenGL.h:
• platform/graphics/texmap/GraphicsContextGLTextureMapper.cpp:

(WebCore::GraphicsContextGLOpenGL::create):
(WebCore::GraphicsContextGLOpenGL::createForGPUProcess): Deleted.
GraphicsContextGLOpenGL for GPUProcess is now a new class, described
in WebKit ChangeLog. Remove the HostWindow arguments for
GraphicsContextGLOpenGL, it's not used.

Source/WebKit:

Implement changes so that GPU process side GraphicsContextGLOpenGL,
the new class GPUProcessGraphicsContextGL, does not use
WebGLLayer. Instead, the swap chain is in GraphicsContextGLOpenGL
and the GPUProcessGraphicsContextGL exposes a function to extract
the display buffer out to be sent to WebContent process.

• GPUProcess/graphics/GPUProcessGraphicsContextGL.h: Added.

Add a simpler class for GPUProcess side GraphicsContextGLOpenGL
instance, one that can get the display buffer from the instance.

• GPUProcess/graphics/RemoteGraphicsContextGL.h:
• GPUProcess/graphics/RemoteGraphicsContextGLCocoa.cpp:

(WebKit::RemoteGraphicsContextGLCocoa::platformWorkQueueInitialize):
(WebKit::RemoteGraphicsContextGLCocoa::prepareForDisplay):

• GPUProcess/graphics/RemoteGraphicsContextGLWin.cpp:

(WebKit::RemoteGraphicsContextGLWin::platformWorkQueueInitialize):

• SourcesCocoa.txt:
• WebKit.xcodeproj/project.pbxproj:
• WebProcess/GPU/graphics/RemoteGraphicsContextGLProxy.cpp:

(WebKit::RemoteGraphicsContextGLProxy::~RemoteGraphicsContextGLProxy):
(WebKit::RemoteGraphicsContextGLProxy::prepareForDisplay):
Move Cocoa implemenation to an Objective-C++ file.

• WebProcess/GPU/graphics/cocoa/RemoteGraphicsContextGLProxyCocoa.mm: Added.

(WebKit::RemoteGraphicsContextGLProxy::prepareForDisplay):
Set the display buffer contents directly to the WebGLLayer after
prepare.

• WebProcess/InjectedBundle/API/mac/WKWebProcessPlugInBrowserContextController.mm:
• WebProcess/Plugins/PDF/PDFPluginPasswordField.mm:
• WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemoteModelHosting.mm:

(WebKit::PlatformCALayerRemoteModelHosting::dumpAdditionalProperties):
Unified build fixes.

6:18 AM Changeset in webkit [284370] by Carlos Garcia Campos

• 8 edits
  2 adds in trunk/Source

[GLIB] Simplify SleepDisabler by checking if we are under sandbox
​https://bugs.webkit.org/show_bug.cgi?id=231670

Reviewed by Adrian Perez de Castro.

Source/WebCore/PAL:

Current implementation always tries to connect to ScreenSaver interface and if that fails tries with the portal
one. It's simpler to check if we are under sandbox and it avoids a connection that we know is always going to
fail.

• pal/system/glib/SleepDisablerGLib.cpp:

(PAL::SleepDisablerGLib::SleepDisablerGLib):
(PAL::SleepDisablerGLib::acquireInhibitor):
(PAL::SleepDisablerGLib::releaseInhibitor):
(PAL::SleepDisablerGLib::acquireInhibitorViaScreenSaverProxy): Deleted.
(PAL::SleepDisablerGLib::acquireInhibitorViaInhibitPortalProxy): Deleted.
(PAL::SleepDisablerGLib::releaseInhibitorViaScreenSaverProxy): Deleted.
(PAL::SleepDisablerGLib::releaseInhibitorViaInhibitPortalProxy): Deleted.

• pal/system/glib/SleepDisablerGLib.h:

Source/WebKit:

Move functions to check if running inside a sandbox to WTF.

• UIProcess/Launcher/glib/ProcessLauncherGLib.cpp:

(WebKit::isInsideDocker): Deleted.
(WebKit::isInsideFlatpak): Deleted.
(WebKit::isInsideSnap): Deleted.

Source/WTF:

Move function to check if running inside a sandbox and add shouldUsePortal() to check whether portal sandbox
should be used. WEBKIT_USE_PORTAL environment variable can be used to force the use of portals when not running
under the sandbox.

• wtf/PlatformGTK.cmake:
• wtf/PlatformWPE.cmake:
• wtf/glib/Sandbox.cpp: Added.

(WTF::isInsideFlatpak):
(WTF::isInsideDocker):
(WTF::isInsideSnap):
(WTF::shouldUsePortal):

• wtf/glib/Sandbox.h: Added.

6:17 AM Changeset in webkit [284369] by ysuzuki@apple.com

• 3 edits in trunk/Source/JavaScriptCore

[JSC] Use USE(LARGE_TYPED_ARRAY)
​https://bugs.webkit.org/show_bug.cgi?id=231885

Reviewed by Sam Weinig.

Fix USE(ADDRESS64) with USE(LARGE_TYPED_ARRAY). USE(ADDRESS64) is not correct (it should be CPU(ADDRESS64)).
It is coverted by JSTests/stress/typed-array-large-eventually-oob.js.

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

6:07 AM Changeset in webkit [284368] by Philippe Normand

• 21 edits in trunk

[GStreamer] fast/mediastream/video-rotation tests are failing due to missing TestController::takeViewPortSnapshot
​https://bugs.webkit.org/show_bug.cgi?id=231059

Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

Add video orientation and mirroring support to the GStreamer mock video source, all the way
to the media player. The video sink had to be adapted, to catch tag events and trigger
orientation update in the player.

• platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp:

(webKitGLVideoSinkSetMediaPlayerPrivate):

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::getVideoOrientation):
(WebCore::MediaPlayerPrivateGStreamer::updateVideoOrientation):
(WebCore::MediaPlayerPrivateGStreamer::updateVideoSizeAndOrientationFromCaps):

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
• platform/graphics/gstreamer/MediaSampleGStreamer.cpp:

(WebCore::MediaSampleGStreamer::MediaSampleGStreamer):
(WebCore::MediaSampleGStreamer::createImageSample):

• platform/graphics/gstreamer/MediaSampleGStreamer.h:

(WebCore::MediaSampleGStreamer::create):
(WebCore::MediaSampleGStreamer::createImageSample):

• platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp:
• platform/mediastream/gstreamer/MockRealtimeVideoSourceGStreamer.cpp:

(WebCore::MockRealtimeVideoSourceGStreamer::updateSampleBuffer):

Source/WebKit:

Implement setOrientationForMediaCapture for GStreamer ports. Because media capture runs in
the WebProcess for those ports, we need a new IPC message, sent from the UIProcess to the
WebProcess.

• UIProcess/API/C/WKPage.cpp:

(WKPageSetMockCameraOrientation):
(WKPageIsMockRealtimeMediaSourceCenterEnabled):

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::setOrientationForMediaCapture):

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::setOrientationForMediaCapture):

• WebProcess/WebPage/WebPage.h:
• WebProcess/WebPage/WebPage.messages.in:

Tools:

Implement takeViewPortSnapshot for WPE and GTK, the WebView snapshot is exported to PNG and
serialized as a data URL.

• WebKitTestRunner/TestController.cpp:
• WebKitTestRunner/gtk/TestControllerGtk.cpp:

(WTR::TestController::takeViewPortSnapshot):

• WebKitTestRunner/wpe/TestControllerWPE.cpp:

(WTR::TestController::takeViewPortSnapshot):

LayoutTests:

The video-rotation.html test was prone to flakyness in GStreamer ports, so a few changes were made:

• don't append canvas to the page, that can "poison" future viewport snapshots
• wait for a timeupdate before checking the first snapshot, that gives us some margin, so

the player might have repainted

• catch validation errors so they're not logged to the console, that would introduce result

diffs in case the first validation was not successful

• try at most 100 validations attempts. Ideally it would be nicer to rely on the

requestVideoFrameCallback API for this.

• fast/mediastream/video-rotation.html:
• platform/glib/TestExpectations:

5:43 AM Changeset in webkit [284367] by Carlos Garcia Campos

• 10 edits
  1 add in trunk

[GTK][a11y] Add implementation of component interface when building with ATSPI
​https://bugs.webkit.org/show_bug.cgi?id=230257

Reviewed by Adrian Perez de Castro.

Source/WebCore:

• SourcesGTK.txt:
• accessibility/atspi/AccessibilityAtspiEnums.h:
• accessibility/atspi/AccessibilityObjectAtspi.cpp:

(WebCore::AccessibilityObjectAtspi::interfacesForObject):
(WebCore::AccessibilityObjectAtspi::path):
(WebCore::AccessibilityObjectAtspi::buildInterfaces const):

• accessibility/atspi/AccessibilityObjectComponentAtspi.cpp: Added.

(WebCore::AccessibilityObjectAtspi::hitTest const):
(WebCore::AccessibilityObjectAtspi::elementRect const):
(WebCore::AccessibilityObjectAtspi::focus const):
(WebCore::AccessibilityObjectAtspi::opacity const):
(WebCore::AccessibilityObjectAtspi::scrollToMakeVisible const):
(WebCore::AccessibilityObjectAtspi::scrollToPoint const):

• accessibility/atspi/AccessibilityRootAtspi.cpp:

(WebCore::AccessibilityRootAtspi::registerObject):
(WebCore::AccessibilityRootAtspi::serialize const):
(WebCore::AccessibilityRootAtspi::frameRect const):

• accessibility/atspi/AccessibilityRootAtspi.h:
• accessibility/atspi/xml/Component.xml:

Tools:

Add unit tests for component interface.

• TestWebKitAPI/Tests/WebKitGtk/TestWebKitAccessibility.cpp:

(testComponentHitTest):
(testComponentScrollTo):
(beforeAll):

5:26 AM Changeset in webkit [284366] by ntim@apple.com

• 15 edits
  2 adds in trunk

Fix mouse selection on modal <dialog> text nodes
​https://bugs.webkit.org/show_bug.cgi?id=231741

Reviewed by Antti Koivisto.

Tests:

• editing/selection/modal-dialog-select-paragraph.html (tests this bug)
• imported/w3c/web-platform-tests/inert/inert-node-is-unselectable.tentative.html (tests what

the canStartSelection check was supposed to fix)

The inert check in Node::canStartSelection() was too restrictive, which caused this bug to happen because
we set the root node as inert and then reset it for the modal <dialog> itself, causing the text in the
<dialog> to be unselectable. Instead, just mirror how -webkit-user-select: none; is implemented by
introducing RenderStyle::userSelectIncludingInert().

Source/WebCore:

• dom/Node.cpp:

(WebCore::computeEditabilityFromComputedStyle):
(WebCore::Node::canStartSelection const):

• dom/Position.cpp:

(WebCore::Position::nodeIsUserSelectNone):
(WebCore::Position::nodeIsUserSelectAll):
(WebCore::Position::isCandidate const):
(WebCore::Position::nodeIsInertOrUserSelectNone): Deleted.

• dom/Position.h:
• dom/PositionIterator.cpp:

(WebCore::PositionIterator::isCandidate const):

• page/EventHandler.cpp:

(WebCore::EventHandler::updateSelectionForMouseDownDispatchingSelectStart):
(WebCore::EventHandler::canMouseDownStartSelect):
(WebCore::EventHandler::selectCursor):

• page/Frame.cpp:

(WebCore::Frame::rangeForPoint):

• rendering/RenderElement.cpp:

(WebCore::RenderElement::selectionColor const):
(WebCore::RenderElement::selectionBackgroundColor const):

• rendering/RenderLayer.cpp:

(WebCore::RenderLayer::calculateClipRects const):

• rendering/RenderObject.cpp:

(WebCore::RenderObject::collectSelectionGeometriesInternal):

• rendering/style/RenderStyle.h:

(WebCore::RenderStyle::userSelectIncludingInert const):

Source/WebKit:

• WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp:

(WebKit::InjectedBundleNodeHandle::isSelectableTextNode const):

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::selectionPositionInformation):

LayoutTests:

• editing/selection/modal-dialog-select-paragraph-expected.txt: Added.
• editing/selection/modal-dialog-select-paragraph.html: Added.

4:33 AM Changeset in webkit [284365] by eocanha@igalia.com

• 4 edits in trunk

[GLIB][GStreamer] test http/tests/security/webaudio-render-remote-audio-allowed-crossorigin-redirect.html is a flaky timeout since r278004
​https://bugs.webkit.org/show_bug.cgi?id=229219
<rdar://problem/82059333>

Reviewed by Philippe Normand.

Source/WebCore:

Forward EOS from webaudio appsink to the main pipeline. For some reason, some intermediate
GstBin isn't forwarding the GST_MESSAGE_EOS emitted by the appsink added by webaudio, so
the code at MediaPlayerPrivateGStreamer::handleMessage() can't detect EOS properly and signal
it to the player and the HTMLMediaElement.

• platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp:

(WebCore::AudioSourceProviderGStreamer::handleNewDeinterleavePad): Listen to the EOS signal of each created appsink and forward it to the main pipeline bus as GST_MESSAGE_EOS.
(WebCore::AudioSourceProviderGStreamer::handleRemovedDeinterleavePad): Remove the signal handler on pad destruction.

LayoutTests:

Give some more time to the frequency analyzer to detect activity.

• http/tests/security/webaudio-render-remote-audio-allowed-crossorigin-redirect.html:

3:47 AM Changeset in webkit [284364] by ysuzuki@apple.com

• 4 edits in trunk

Remove AVOID_NATIVE_INT128_T
​https://bugs.webkit.org/show_bug.cgi?id=231888

Reviewed by Mark Lam.

Source/WTF:

• wtf/Int128.h:

Tools:

We can test Int128 without AVOID_NATIVE_INT128_T.

• TestWebKitAPI/Tests/WTF/Int128.cpp:

(TestWebKitAPI::TestUnary):
(TestWebKitAPI::TestBinary):
(TestWebKitAPI::ToNative):
(TestWebKitAPI::FromNative):
(TestWebKitAPI::TestVsNative):
(TestWebKitAPI::TEST):

3:40 AM Changeset in webkit [284363] by commit-queue@webkit.org

• 2 edits in trunk

Add my github username to contributors.json
​https://bugs.webkit.org/show_bug.cgi?id=231889

Patch by Rob Buis <​rbuis@igalia.com> on 2021-10-18
Reviewed by Manuel Rego Casasnovas.

• metadata/contributors.json:

3:23 AM Changeset in webkit [284362] by commit-queue@webkit.org

• 2 edits in trunk

Add my github username to contributors.json
​https://bugs.webkit.org/show_bug.cgi?id=231887

Unreviewed.

Patch by Xan Lopez <Xan Lopez> on 2021-10-18

• metadata/contributors.json: add my github username.

3:16 AM Changeset in webkit [284361] by commit-queue@webkit.org

• 44 edits in trunk

Implement parsing and animation support for offset-distance, offset-position, offset-anchor
​https://bugs.webkit.org/show_bug.cgi?id=231491

Patch by Kiet Ho <Kiet Ho> on 2021-10-18
Reviewed by Antoine Quint.

LayoutTests/imported/w3c:

Updated relevant test expectations.

• web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:
• web-platform-tests/css/cssom/cssstyledeclaration-csstext-expected.txt:
• web-platform-tests/css/cssom/getComputedStyle-detached-subtree-expected.txt:
• web-platform-tests/css/motion/animation/offset-anchor-composition-expected.txt:
• web-platform-tests/css/motion/animation/offset-anchor-interpolation-expected.txt:
• web-platform-tests/css/motion/animation/offset-distance-composition-expected.txt:
• web-platform-tests/css/motion/animation/offset-distance-interpolation-expected.txt:
• web-platform-tests/css/motion/animation/offset-position-composition-expected.txt:
• web-platform-tests/css/motion/animation/offset-position-interpolation-expected.txt:
• web-platform-tests/css/motion/animation/offset-position-interpolation.html: Fixed test to accept other length expressions as equivalent.
• web-platform-tests/css/motion/inheritance-expected.txt:
• web-platform-tests/css/motion/offset-supports-calc-expected.txt:
• web-platform-tests/css/motion/parsing/offset-anchor-computed-expected.txt:
• web-platform-tests/css/motion/parsing/offset-anchor-parsing-valid-expected.txt:
• web-platform-tests/css/motion/parsing/offset-anchor-parsing-valid.html: Fixed test to accept "center" as an alternative to "center center", "calc(20% + 10px) center" as an alternative to "calc(10px + 20%) center".
• web-platform-tests/css/motion/parsing/offset-distance-computed-expected.txt:
• web-platform-tests/css/motion/parsing/offset-distance-parsing-valid-expected.txt:
• web-platform-tests/css/motion/parsing/offset-position-computed-expected.txt:
• web-platform-tests/css/motion/parsing/offset-position-parsing-valid-expected.txt:
• web-platform-tests/css/motion/parsing/offset-position-parsing-valid.html: Fixed test to accept "center" as an alternative to "center center", "calc(20% + 10px) center" as an alternative to "calc(10px + 20%) center".
• web-platform-tests/css/motion/parsing/offset-shorthand-expected.txt:
• web-platform-tests/web-animations/animation-model/animation-types/accumulation-per-property-002-expected.txt:
• web-platform-tests/web-animations/animation-model/animation-types/addition-per-property-002-expected.txt:
• web-platform-tests/web-animations/animation-model/animation-types/interpolation-per-property-002-expected.txt:

Source/WebCore:

Tests: imported/w3c/web-platform-tests/css/motion/animation/offset-anchor-composition.html

imported/w3c/web-platform-tests/css/motion/animation/offset-anchor-interpolation.html
imported/w3c/web-platform-tests/css/motion/animation/offset-distance-composition.html
imported/w3c/web-platform-tests/css/motion/animation/offset-distance-interpolation.html
imported/w3c/web-platform-tests/css/motion/animation/offset-position-composition.html
imported/w3c/web-platform-tests/css/motion/animation/offset-position-interpolation.html
imported/w3c/web-platform-tests/css/motion/inheritance.html
imported/w3c/web-platform-tests/css/motion/offset-supports-calc.html
imported/w3c/web-platform-tests/css/motion/parsing/offset-anchor-computed.html
imported/w3c/web-platform-tests/css/motion/parsing/offset-anchor-parsing-valid.html
imported/w3c/web-platform-tests/css/motion/parsing/offset-distance-computed.html
imported/w3c/web-platform-tests/css/motion/parsing/offset-distance-parsing-valid.html
imported/w3c/web-platform-tests/css/motion/parsing/offset-position-computed.html
imported/w3c/web-platform-tests/css/motion/parsing/offset-position-parsing-valid.html

• animation/CSSPropertyAnimation.cpp:

(WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap):

• css/CSSComputedStyleDeclaration.cpp:

(WebCore::valueForPosition):
(WebCore::valueForPositionOrAuto):
(WebCore::ComputedStyleExtractor::valueForPropertyInStyle):

• css/CSSProperties.json:
• css/parser/CSSPropertyParser.cpp:

(WebCore::consumePositionOrAuto):
(WebCore::CSSPropertyParser::parseSingleValue):

• rendering/style/RenderStyle.h:

(WebCore::RenderStyle::offsetDistance const):
(WebCore::RenderStyle::setOffsetDistance):
(WebCore::RenderStyle::initialOffsetDistance):
(WebCore::RenderStyle::offsetPosition const):
(WebCore::RenderStyle::setOffsetPosition):
(WebCore::RenderStyle::initialOffsetPosition):
(WebCore::RenderStyle::offsetAnchor const):
(WebCore::RenderStyle::setOffsetAnchor):
(WebCore::RenderStyle::initialOffsetAnchor):

• rendering/style/StyleRareNonInheritedData.cpp:

(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
(WebCore::StyleRareNonInheritedData::operator== const):

• rendering/style/StyleRareNonInheritedData.h:
• style/StyleBuilderConverter.h:

(WebCore::Style::BuilderConverter::convertPosition):
(WebCore::Style::BuilderConverter::convertPositionOrAuto):

Source/WTF:

• Scripts/Preferences/WebPreferencesExperimental.yaml: Add new preference for CSS Motion Path support.

LayoutTests:

Update platform-specific test expectations to accommodate for newly added CSS properties.

• platform/gtk/imported/w3c/web-platform-tests/css/cssom/cssstyledeclaration-csstext-expected.txt:
• platform/gtk/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-detached-subtree-expected.txt:
• platform/ios-wk2/imported/w3c/web-platform-tests/css/cssom/cssstyledeclaration-csstext-expected.txt:
• platform/ios-wk2/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-detached-subtree-expected.txt:
• platform/ios/imported/w3c/web-platform-tests/css/cssom/cssstyledeclaration-csstext-expected.txt:
• platform/wpe/imported/w3c/web-platform-tests/css/cssom/cssstyledeclaration-csstext-expected.txt:
• platform/wpe/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-detached-subtree-expected.txt:

3:11 AM Changeset in webkit [284360] by ntim@apple.com

• 8 edits
  6 adds
  2 deletes in trunk/LayoutTests/imported/w3c

Re-import shadow-dom WPT
​https://bugs.webkit.org/show_bug.cgi?id=231845

Reviewed by Antoine Quint.

Upstream commit: ​https://github.com/web-platform-tests/wpt/commit/deaab24d4e359f4264ba8843fa87a558ed9e0b81

The flakiness of focus-pseudo-matches-on-shadow-host.html was due to not waiting for the "update rendering"
steps for autofocus to happen, which is flaky with the new autofocus behavior. This has been fixed by a Gecko
committer who had the issue on their side as well:

​https://github.com/web-platform-tests/wpt/commit/7555902a6e5c2b2f285bc6d0e2e05b5f3229af6a

• resources/resource-files.json:
• web-platform-tests/shadow-dom/declarative/declarative-shadow-dom-attachment.tentative.html:
• web-platform-tests/shadow-dom/focus/blur-on-shadow-host-delegatesFocus-expected.txt: Added.
• web-platform-tests/shadow-dom/focus/blur-on-shadow-host-delegatesFocus.html: Added.
• web-platform-tests/shadow-dom/focus/click-focus-delegatesFocus-click-method-expected.txt: Removed.
• web-platform-tests/shadow-dom/focus/click-focus-delegatesFocus-click-method.html: Removed.
• web-platform-tests/shadow-dom/focus/click-focus-delegatesFocus-click-expected.txt: Added.
• web-platform-tests/shadow-dom/focus/click-focus-delegatesFocus-click.html: Added.
• web-platform-tests/shadow-dom/focus/focus-pseudo-matches-on-shadow-host.html:
• web-platform-tests/shadow-dom/focus/focus-pseudo-on-shadow-host-2.html:
• web-platform-tests/shadow-dom/focus/focus-selector-delegatesFocus-expected.txt:
• web-platform-tests/shadow-dom/focus/focus-selector-delegatesFocus.html:
• web-platform-tests/shadow-dom/focus/focus-tab-on-shadow-host-expected.txt: Added.
• web-platform-tests/shadow-dom/focus/focus-tab-on-shadow-host.html: Added.
• web-platform-tests/shadow-dom/focus/w3c-import.log:

3:07 AM Changeset in webkit [284359] by svillar@igalia.com

• 5 edits in trunk

[css-flexbox] Improve & simplify the flex-basis computation
​https://bugs.webkit.org/show_bug.cgi?id=230755

Reviewed by Manuel Rego Casasnovas.

Source/WebCore:

The flex-basis computation code was a bit convoluted. It had some pre-computations for items
with intrinsic main size that were causing several issues due to reentrancy. Actually those
computations where not needed at all for the flex basis computation but for a later stage, the
computation of the hyphotetical main size in which we need to compute 'min-{width|height}: auto'.

That's why the code that was executed before the flex-basis computation is now part of
computeFlexItemMinMaxSizes(). As we are no longer doing a layout before computing the flex-basis,
a layout has to be added to those cases in which the main size is the block size of the child. Apart
from that the flex-basis computation uses a newly defined RAII class to set the main size of the item
to the value specified by flex-basis which is what the specs mandate.

Last but not least, the computeInnerFlexBaseSizeForChild() method was renamed to computeFlexBaseSizeForChild()
which fits better with the terminology used in the specs.

Flex basis computation is already covered by the WPT test suite, there is no need for extra tests. This patch
fixes the only flex-basis-* test case that was not passing.

• rendering/RenderFlexibleBox.cpp:

(WebCore::RenderFlexibleBox::computeMainAxisExtentForChild): Removed obsolete comment. Added
a layoutIfNeeded() as we cannot be sure that the item was already laid out any more.
(WebCore::ScopedFlexBasisAsMainSize::ScopedFlexBasisAsChildMainSize): New RAII class.
(WebCore::ScopedFlexBasisAsMainSize::~ScopedFlexBasisAsChildMainSize):
(WebCore::RenderFlexibleBox::computeFlexBaseSizeForChild): Renamed from computeInnerFlexBaseSizeForChild.
(WebCore::RenderFlexibleBox::computeFlexItemMinMaxSizes): Added relayoutChildren parameter.
(WebCore::RenderFlexibleBox::constructFlexItem): Moved code to computeFlexItemMinMaxSizes().
(WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
(WebCore::RenderFlexibleBox::computeInnerFlexBaseSizeForChild): Deleted.

• rendering/RenderFlexibleBox.h:

LayoutTests:

• TestExpectations: Unskipped flex-basis-011.html which is now working fine.

2:39 AM Changeset in webkit [284358] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebCore

[MediaStream] Mock video source background not fully filled for custom video resolution
​https://bugs.webkit.org/show_bug.cgi?id=231863

Patch by Philippe Normand <​pnormand@igalia.com> on 2021-10-18
Reviewed by Xabier Rodriguez-Calvar.

The video frame buffer matches the captureSize, so its background should do the same.
this->size() is the final size of the media source, applied to the frame buffer before
notification to observers.

• platform/mock/MockRealtimeVideoSource.cpp:

(WebCore::MockRealtimeVideoSource::generateFrame):

1:42 AM Changeset in webkit [284357] by sihui_liu@apple.com

• 28 edits
  4 moves in branches/safari-612-branch/Source

Apply patch rdar://83956117

1:42 AM Changeset in webkit [284356] by sihui_liu@apple.com

• 44 edits
  1 copy
  1 add in branches/safari-612-branch

Apply patch rdar://83953160

1:42 AM Changeset in webkit [284355] by sihui_liu@apple.com

• 49 edits
  9 copies
  6 adds in branches/safari-612-branch

Apply patch rdar://83955623

1:41 AM Changeset in webkit [284354] by sihui_liu@apple.com

• 37 edits
  10 copies
  1 add in branches/safari-612-branch

Apply patch rdar://83952929

1:41 AM Changeset in webkit [284353] by sihui_liu@apple.com

• 8 edits in branches/safari-612-branch/Source

Apply patch rdar://83955481

1:41 AM Changeset in webkit [284352] by sihui_liu@apple.com

• 16 edits in branches/safari-612-branch

Apply patch rdar://83953730

1:41 AM Changeset in webkit [284351] by sihui_liu@apple.com

• 88 edits
  13 copies
  2 adds in branches/safari-612-branch

Apply patch rdar://83955868

1:25 AM Changeset in webkit [284350] by magomez@igalia.com

• 2 edits in trunk

Add my github username to contributors.json

Unreviewed.

• metadata/contributors.json:

1:17 AM Changeset in webkit [284349] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebKit

Use-after-move of m_sockets in NetworkRTCProvider::close()
<​https://webkit.org/b/231779>
<rdar://problem/84278026>

Reviewed by Youenn Fablet.

• NetworkProcess/webrtc/NetworkRTCProvider.cpp:

(WebKit::NetworkRTCProvider::close):

• Replace WTFMove() with std::exchange() to make it clear that m_sockets will be emptied, then iterate on sockets to close them. Update ASSERT() to check that no sockets were added to m_sockets during the loop.

1:12 AM Changeset in webkit [284348] by ysuzuki@apple.com

• 3 edits
  1 add in trunk

[JSC] PutByVal's child5 should be KnownInt32Use / Int52RepUse in FTL
​https://bugs.webkit.org/show_bug.cgi?id=231884
rdar://84357099

Reviewed by Robin Morisset.

JSTests:

• stress/put-by-val-known-int32.js: Added.

(new.Uint8Array.1000000.map):

Source/JavaScriptCore:

The child5 of PutByVal should be KnownInt32Use or Int52RepUse.

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):

1:05 AM Changeset in webkit [284347] by dino@apple.com

• 25 edits
  13 copies
  3 adds in trunk

[WebXR] Stubs for WebXR Hand Input Module
​https://bugs.webkit.org/show_bug.cgi?id=231123
<rdar://problem/83802135>

Reviewed by Sam Weinig.

Source/WebCore:

Add the IDL and stub implementations for the WebXR
Hand Input module:
​https://immersive-web.github.io/webxr-hand-input/

The important class is WebXRHand, which is owned by
and accessible from the WebXRInputSource, which
itself is owned by the WebXRSession.

Test: http/wpt/webxr/xrHandInput_gc.html

• CMakeLists.txt: Add new files.
• DerivedSources-input.xcfilelist:
• DerivedSources-output.xcfilelist:
• DerivedSources.make:
• Sources.txt:
• WebCore.xcodeproj/project.pbxproj:

• Modules/webxr/WebXRSession.idl: Add a custom mark function that creates an opaque root.
• bindings/js/JSWebXRSessionCustom.cpp:

• Modules/webxr/WebXRFrame+HandInput.idl: Add new hand-related methods.
• Modules/webxr/WebXRFrame.cpp:

(WebCore::WebXRFrame::getJointPose):
(WebCore::WebXRFrame::fillJointRadii):
(WebCore::WebXRFrame::fillPoses):

• Modules/webxr/WebXRFrame.h:

• Modules/webxr/WebXRHand.cpp: New files.

(WebCore::WebXRHand::create):
(WebCore::WebXRHand::WebXRHand):
(WebCore::WebXRHand::get):
(WebCore::WebXRHand::Iterator::Iterator):
(WebCore::WebXRHand::Iterator::next):
(WebCore::WebXRHand::session):

• Modules/webxr/WebXRHand.h:

(WebCore::WebXRHand::size):
(WebCore::WebXRHand::createIterator):

• Modules/webxr/WebXRHand.idl:

• Modules/webxr/WebXRInputSource+HandInput.idl: Add WebXRHand accessor.
• Modules/webxr/WebXRInputSource.cpp:

(WebCore::WebXRInputSource::update):

• Modules/webxr/WebXRInputSource.h:

(WebCore::WebXRInputSource::hand const):

• Modules/webxr/WebXRJointPose.cpp: New files.

(WebCore::WebXRJointPose::create):
(WebCore::WebXRJointPose::WebXRJointPose):

• Modules/webxr/WebXRJointPose.h:

(WebCore::WebXRJointPose::radius const):

• Modules/webxr/WebXRJointPose.idl:

• Modules/webxr/WebXRJointSpace.cpp: New files.

(WebCore::WebXRJointSpace::create):
(WebCore::WebXRJointSpace::WebXRJointSpace):
(WebCore::WebXRJointSpace::nativeOrigin const):

• Modules/webxr/WebXRJointSpace.h:

(WebCore::WebXRJointSpace::jointName const):

• Modules/webxr/WebXRJointSpace.idl:

• Modules/webxr/WebXRSpace.h: New virtual identifier for joint space subclass.

(WebCore::WebXRSpace::isJointSpace const):

• Modules/webxr/WebXRSystem.cpp: Add a comment regarding the testing of

optional features (where the "hand-tracking" feature should be checked).
(WebCore::WebXRSystem::resolveRequestedFeatures const):

• Modules/webxr/XRHandJoint.h: New file.
• Modules/webxr/XRHandJoint.idl:

• bindings/js/WebCoreBuiltinNames.h: Expose new mappings from published names

to internal names.

• platform/xr/PlatformXR.h: Add "simulateHands" field to frame data for testing.
• testing/FakeXRInputSourceInit.h: And similarly to the fake input source.
• testing/FakeXRInputSourceInit.idl:

• testing/WebFakeXRInputController.cpp: Allow the test system to fake a hand.

(WebCore::WebFakeXRInputController::WebFakeXRInputController):
(WebCore::WebFakeXRInputController::getFrameData):

• testing/WebFakeXRInputController.h:

Source/WTF:

Add an ENABLE_WEBXR_HANDS compile time flag and a WebXRHandsEnabled preference.

• Scripts/Preferences/WebPreferencesExperimental.yaml:
• wtf/PlatformEnable.h:
• wtf/PlatformEnableCocoa.h:

LayoutTests:

New test that checks an XRHand object can survive garbage collection.

• http/wpt/webxr/xrHandInput_gc-expected.txt: Added.
• http/wpt/webxr/xrHandInput_gc.html: Added.

Oct 17, 2021:

5:22 PM Changeset in webkit [284346] by Kocsen Chung

• 2 edits in branches/safari-612-branch/Source/JavaScriptCore

Cherry-pick r284212. rdar://problem/84351869

Wasm LLInt should zero bytecodeIndex before throwing
​https://bugs.webkit.org/show_bug.cgi?id=231688
<rdar://84207898>

Reviewed by Yusuke Suzuki.

After r283852, the unwinder can now ask WebAssembly frames for their bytecodeIndex.
We do write to the bytecodeIndex when throwing from the wasm throw opcode, but we
failed to write when trapping (e.g. throwing an OOB or Unreachable). The value of
the bytecodeIndex in this is case is not interesting, since these exceptions can't be
caught from Wasm, all we need to know is ensure there isn't an invalid left-over
value in that stack slot, so we zero it.

• llint/WebAssembly.asm:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@284212 268f45cc-cd09-0410-ab3c-d52691b4dbfc

5:21 PM Changeset in webkit [284345] by Kocsen Chung

• 3 edits in branches/safari-612-branch/Source/ThirdParty/libwebrtc

Cherry-pick r284082. rdar://problem/84351872

Override guessed color space for incoming H.264/265 streams
​https://bugs.webkit.org/show_bug.cgi?id=231353
<rdar://problem/83969311>

Reviewed by Youenn Fablet.

When the VTDecompressionSession decodes incoming H.264/H.265 samples,
it puts guessed color space attachments on the CVPixelBuffer, and the
guesses are based on video resolution. WebRTC streams however default
to being sRGB. So this patch overrides a guess with what we know the
stream will be. (Once we support different color spaces in WebRTC
video streams we'll need to adjust this.)

• Source/webrtc/sdk/objc/components/video_codec/RTCVideoDecoderH264.mm: (overrideColorSpaceAttachmentsIfNeeded): (decompressionOutputCallback):
• Source/webrtc/sdk/objc/components/video_codec/RTCVideoDecoderH265.mm: (overrideColorSpaceAttachmentsIfNeeded): (h265DecompressionOutputCallback):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@284082 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:15 PM Changeset in webkit [284344] by ddkilzer@apple.com

• 7 edits in trunk/Source

Build fix #3: Adopt attribution AVCaptureSession SPI for GPU process
​https://bugs.webkit.org/show_bug.cgi?id=231621
<rdar://problem/80748535>

Unreviewed build fix.

Source/WebCore/PAL:

• pal/spi/cocoa/TCCSPI.h:
• Use HAVE(TCC_IOS_14_BIG_SUR_SPI).

Source/WebKit:

• Shared/Cocoa/TCCSoftLink.h:

(tcc_identity_create):

• Shared/Cocoa/TCCSoftLink.mm:

(tcc_identity_create):

• Use HAVE(TCC_IOS_14_BIG_SUR_SPI).

Source/WTF:

• wtf/PlatformHave.h:

(HAVE_TCC_IOS_14_BIG_SUR_SPI): Add.

• Used for TCC.framework SPI available in iOS 14 and macOS 11 Big Sur and later.

3:51 PM Changeset in webkit [284343] by Alan Bujtas

• 2 edits in trunk/LayoutTests

IFC progression (inline box borders).

Unreviewed.

• TestExpectations:

2:19 PM Changeset in webkit [284342] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebKit

Follow-up: WebKit::LocalConnection::createCredentialPrivateKey leaks an NSMutableDictionary
<​https://webkit.org/b/231814>
<rdar://problem/84307054>

Unreviewed follow-up to address Darin's comments.

• UIProcess/WebAuthentication/Cocoa/LocalConnection.mm:

(WebKit::LocalConnection::createCredentialPrivateKey const):

• Remove need for C-style cast by using a local variable for the mutable copy of the NSDictionary.

1:47 PM Changeset in webkit [284341] by mark.lam@apple.com

• 6 edits in trunk/Source/JavaScriptCore

Make LLIntAssembly.h more readable.
​https://bugs.webkit.org/show_bug.cgi?id=231876

Reviewed by Yusuki Suzuki.

In this patch, I did the following:

1. Changed CodeOrigin to only dump the filename, and not the full path.

2. Deferred printing the ".loc" metadata in $asm.debugAnnotation till we format the line to dump in $asm.formatDump. This enabled the ".loc" metadata to be dumped on the same line as the asm instruction.

3. Changed $asm.codeOrigin to not dump multiple codeOrigin comments. The only times when there appears to be "multiple" codeOrigins for any given instruction is if the instruction before it was elided, thereby leaving the elided instruction's codeOrigin to be mis-attributed to the subsequent instruction.

4. Moved the MIPS Assembler.putStr method to asm.rb. This method was already commonly used in arm.rb and arm64.rb previously. Hence, it belongs in common code.

Also enhanced it to support indenting by the column width of ".loc" debug
annotations if $enableDebugAnnotations is true. This keeps the ".loc" column
on the left clear of other content, thereby making it easy to visually filter
out that column when scanning through the generated asm code.

5. Changed some code that called outp.puts directly to call $asm.putStr instead. This yields the nice alignment for easy visual filtering described in (4).

6. Changed $preferredCommentStartColumn to be at column 40 to make the generated asm code more compact. However, if the backend is the C_LOOP, then change it back to 60 because C_LOOP code is more verbose and need the extra space.

Demo time:
Before this patch, LLIntAssembly.h looks like this:
`
#if !OFFLINE_ASM_X86 && !OFFLINE_ASM_X86_WIN && !OFFLINE_ASM_X86_64 && !OFFLINE_ASM_X86_64_WIN && !OFFLINE_ASM_ARMv7 && !OFFLINE_ASM_ARM64 && OFFLINE_ASM_ARM64E && !OFFLINE_ASM_MIPS && !OFFLINE_ASM_RISCV64 && !OFFLINE_ASM_C_LOOP && !OFFLINE_ASM_C_LOOP_WIN && !OFFLINE_ASM_ARMv7k && !OFFLINE_ASM_ARMv7s && OFFLINE_ASM_JSVALUE64 && !OFFLINE_ASM_BIGINT32 && OFFLINE_ASM_GIGACAGE_ENABLED && !OFFLINE_ASM_ASSERT_ENABLED && !OFFLINE_ASM_TRACING && OFFLINE_ASM_ADDRESS64 && OFFLINE_ASM_JIT && OFFLINE_ASM_WEBASSEMBLY && OFFLINE_ASM_HAVE_FAST_TLS && OFFLINE_ASM_WEBASSEMBLY_B3JIT
OFFLINE_ASM_BEGIN
OFFLINE_ASM_GLOBAL_LABEL(llintPCRangeStart)
".file 1 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter.asm\"\n"
".file 2 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitBytecodes.asm\"\n"
".file 3 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm\"\n"
".file 4 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm\"\n"
".file 5 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitWasm.asm\"\n"
".file 6 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/WebAssembly.asm\"\n"
".file 7 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/usr/local/include/WebKitAdditions/LowLevelInterpreterAdditions.asm\"\n"
".loc 1 1672\n"

"\tbrk #0xc471\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1672

".loc 1 1681\n"

OFFLINE_ASM_GLOBAL_LABEL(vmEntryToJavaScript)
".loc 1 1066\n"

"\tpacibsp\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1066

".loc 1 1070\n"

"\tstp x29, x30, [sp, #-16]!\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1070

".loc 1 1075\n"

"\tmov x29, sp\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1075

".loc 1 1090\n"

"\tsub sp, x29, #176\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1090

".loc 3 169\n"

"\tmovz x13, #48040, lsl #0\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:169

".loc 3 169\n"

"\tadd x17, x1, x13, lsl #0\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:169

".loc 3 169\n"

"\tldr w4, [x17, #0]\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:169

".loc 3 170\n"

"\tcbnz w4, " LOCAL_LABEL_STRING(_offlineasm_doVMEntrycheckVMEntryPermission) "\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:170

".loc 3 172\n"

"\tstr x1, [sp, #0]\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:172

...

".loc 3 309\n"

"\tmov x3, x0\n" JavaScriptCore/llint/LowLevelInterpreter64.asm:309

".loc 1 1\n"
#if OS(DARWIN)

"\tL_offlineasm_loh_adrp_1:\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1
"\tadrp x2, " LOCAL_REFERENCE(g_config) "@GOTPAGE\n"
"\tL_offlineasm_loh_ldr_1:\n"
"\tldr x2, [x2, " LOCAL_REFERENCE(g_config) "@GOTPAGEOFF]\n"

#elif OS(LINUX)

"\tadrp x2, :got:" LOCAL_REFERENCE(g_config) "\n"
"\tldr x2, [x2, :got_lo12:" LOCAL_REFERENCE(g_config) "]\n"

#else
#error Missing globaladdr implementation
#endif
".loc 1 1\n"

"\tadd x2, x2, #3072\n" JavaScriptCore/llint/LowLevelInterpreter.asm:1

`

After this patch, LLIntAssembly.h looks like this:
`
#if !OFFLINE_ASM_X86 && !OFFLINE_ASM_X86_WIN && !OFFLINE_ASM_X86_64 && !OFFLINE_ASM_X86_64_WIN && !OFFLINE_ASM_ARMv7 && !OFFLINE_ASM_ARM64 && OFFLINE_ASM_ARM64E && !OFFLINE_ASM_MIPS && !OFFLINE_ASM_RISCV64 && !OFFLINE_ASM_C_LOOP && !OFFLINE_ASM_C_LOOP_WIN && !OFFLINE_ASM_ARMv7k && !OFFLINE_ASM_ARMv7s && OFFLINE_ASM_JSVALUE64 && !OFFLINE_ASM_BIGINT32 && OFFLINE_ASM_GIGACAGE_ENABLED && !OFFLINE_ASM_ASSERT_ENABLED && !OFFLINE_ASM_TRACING && OFFLINE_ASM_ADDRESS64 && OFFLINE_ASM_JIT && OFFLINE_ASM_WEBASSEMBLY && OFFLINE_ASM_HAVE_FAST_TLS && OFFLINE_ASM_WEBASSEMBLY_B3JIT

OFFLINE_ASM_BEGIN
OFFLINE_ASM_GLOBAL_LABEL(llintPCRangeStart)
".file 1 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter.asm\"\n"
".file 2 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitBytecodes.asm\"\n"
".file 3 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm\"\n"
".file 4 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm\"\n"
".file 5 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/DerivedSources/JavaScriptCore/InitWasm.asm\"\n"
".file 6 \"/Users/mlam/ws1/OpenSource/Source/JavaScriptCore/llint/WebAssembly.asm\"\n"
".file 7 \"/Users/mlam/ws1/OpenSource/WebKitBuild/Release/usr/local/include/WebKitAdditions/LowLevelInterpreterAdditions.asm\"\n"

".loc 1 1672\n" "brk #0xc471 \n" LowLevelInterpreter.asm:1672

".loc 1 1681\n" OFFLINE_ASM_GLOBAL_LABEL(vmEntryToJavaScript)
".loc 1 1066\n" "pacibsp \n" LowLevelInterpreter.asm:1066
".loc 1 1070\n" "stp x29, x30, [sp, #-16]! \n" LowLevelInterpreter.asm:1070
".loc 1 1075\n" "mov x29, sp \n" LowLevelInterpreter.asm:1075
".loc 1 1090\n" "sub sp, x29, #176 \n" LowLevelInterpreter.asm:1090
".loc 3 169\n" "movz x13, #48040, lsl #0 \n" LowLevelInterpreter64.asm:169

"add x17, x1, x13, lsl #0 \n"
"ldr w4, [x17, #0] \n"

".loc 3 170\n" "cbnz w4, " LOCAL_LABEL_STRING(_offlineasm_doVMEntrycheckVMEntryPermission) " \n" LowLevelInterpreter64.asm:170
".loc 3 172\n" "str x1, [sp, #0] \n" LowLevelInterpreter64.asm:172

...

".loc 3 309\n" "mov x3, x0 \n" LowLevelInterpreter64.asm:309

#if OS(DARWIN)

".loc 1 1\n" "L_offlineasm_loh_adrp_1: \n" LowLevelInterpreter.asm:1

"adrp x2, " LOCAL_REFERENCE(g_config) "@GOTPAGE \n"
"L_offlineasm_loh_ldr_1: \n"
"ldr x2, [x2, " LOCAL_REFERENCE(g_config) "@GOTPAGEOFF] \n"

#elif OS(LINUX)

"adrp x2, :got:" LOCAL_REFERENCE(g_config) " \n"
"ldr x2, [x2, :got_lo12:" LOCAL_REFERENCE(g_config) "] \n"

#else
#error Missing globaladdr implementation
#endif

".loc 1 1\n" "add x2, x2, #3072 \n"
`

• offlineasm/asm.rb:
• offlineasm/cloop.rb:
• offlineasm/config.rb:
• offlineasm/mips.rb:
• offlineasm/parser.rb:

1:46 PM Changeset in webkit [284340] by ddkilzer@apple.com

• 5 edits
  2 copies in trunk

Add tests for WTF::OSObjectPtr/adoptOSObject in Cocoa with and without ARC
<​https://webkit.org/b/231819>
<rdar://problem/84312692>

Reviewed by Darin Adler.

Source/WTF:

• wtf/OSObjectPtr.h:

(WTF::adoptOSObject):

• Rename when building with ARC enabled to prevent leaks or over-releases when linking ARC and non-ARC code.
• Add WARN_UNUSED_RETURN attribute to match WTF::adoptNS().

Tools:

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• Add OSObjectPtrCocoa.mm and OSObjectPtrCocoaARC.mm source files to the project.
• TestWebKitAPI/Tests/WTF/darwin/OSObjectPtr.cpp:

(TestWebKitAPI::TEST):

• Make code work when compiled with ARC enabled.
• Fix a pre-existing leak of dispatch_queue_t in RetainRelease test.
• TestWebKitAPI/Tests/WTF/darwin/OSObjectPtrCocoa.mm: Add.
• TestWebKitAPI/Tests/WTF/darwin/OSObjectPtrCocoaARC.mm: Add.
• Add test files that #include OSObjectPtr.cpp.

1:19 PM Changeset in webkit [284339] by Fujii Hironori

• 11 edits in trunk/LayoutTests

[WinCairo] Unreviewed test gardening

• platform/wincairo/fast/css/font-face-opentype-expected.txt:
• platform/wincairo/fast/text/basic/015-expected.txt:
• platform/wincairo/fast/text/whitespace/004-expected.txt:
• platform/wincairo/fast/text/whitespace/005-expected.txt:
• platform/wincairo/fast/text/whitespace/006-expected.txt:
• platform/wincairo/fast/text/whitespace/007-expected.txt:
• platform/wincairo/fast/text/whitespace/010-expected.txt:
• platform/wincairo/fast/text/whitespace/011-expected.txt:
• platform/wincairo/fast/text/whitespace/015-expected.txt:
• platform/wincairo/fast/text/whitespace/016-expected.txt:

12:30 PM Changeset in webkit [284338] by Kocsen Chung

• 92 edits
  26 deletes in branches/safari-612-branch

Restore state to r284288 due to build failures.

12:00 PM Changeset in webkit [284337] by BJ Burg

• 7 edits
  2 deletes in trunk

[Cocoa] Web Inspector: remove _WKInspectorExtensionPrivateForTesting
​https://bugs.webkit.org/show_bug.cgi?id=231784
<rdar://problem/84280608>

Reviewed by Timothy Hatcher.

Source/WebKit:

Promote the only method to be API for _WKInspectorExtension. It is needed
to implement some parts of the devtools API.

• SourcesCocoa.txt:
• UIProcess/API/Cocoa/_WKInspectorExtension.h:
• UIProcess/API/Cocoa/_WKInspectorExtension.mm:

(-[_WKInspectorExtension evaluateScript:inTabWithIdentifier:completionHandler:]):

• UIProcess/API/Cocoa/_WKInspectorExtensionPrivateForTesting.h: Removed.
• UIProcess/API/Cocoa/_WKInspectorExtensionTesting.mm: Removed.
• WebKit.xcodeproj/project.pbxproj:

Tools:

• TestWebKitAPI/Tests/WebKitCocoa/WKInspectorExtension.mm:

(TEST):

9:54 AM Changeset in webkit [284336] by Simon Fraser

• 5 edits
  6 adds in trunk

REGRESSION (r270850): Reference clip path clips in the wrong place when inside non-visible overflow
​https://bugs.webkit.org/show_bug.cgi?id=231852
<rdar://83186229>

Reviewed by Tim Horton.
Source/WebCore:

When clipping CSS boxes with reference clip paths we need to give RenderSVGResourceClipper two
different rectangles; the objectBoundingBox that is used to compute clip path geometry,
and the bounds of the clipped content, so that the buffer-based clipping code path
can create an ImageBuffer of the appropriate size.

Previously, we confounded these two rectangles, resulting in various bugs.

Tests: css3/masking/reference-clip-path-bounds.html

css3/masking/reference-clip-path-objectBoundingBox-buffer-clip.html
css3/masking/reference-clip-path-objectBoundingBox-path-clip.html

• rendering/RenderLayer.cpp:

(WebCore::RenderLayer::setupClipPath):

• rendering/svg/RenderSVGResourceClipper.cpp:

(WebCore::RenderSVGResourceClipper::applyResource):
(WebCore::RenderSVGResourceClipper::applyClippingToContext):

• rendering/svg/RenderSVGResourceClipper.h:

LayoutTests:

Tests for reference clip-path with box-shadows and enclosing oveflow:hidden.

• css3/masking/reference-clip-path-bounds-expected.html: Added.
• css3/masking/reference-clip-path-bounds.html: Added.
• css3/masking/reference-clip-path-objectBoundingBox-buffer-clip-expected.html: Added.
• css3/masking/reference-clip-path-objectBoundingBox-buffer-clip.html: Added.
• css3/masking/reference-clip-path-objectBoundingBox-path-clip-expected.html: Added.
• css3/masking/reference-clip-path-objectBoundingBox-path-clip.html: Added.

9:38 AM Changeset in webkit [284335] by commit-queue@webkit.org

• 4 edits
  2 adds in trunk

AX: WebKit should not expose redundant AXGroups with missing role when the label is the same as the contents
​https://bugs.webkit.org/show_bug.cgi?id=169924

Patch by Tyler Wilcock <Tyler Wilcock> on 2021-10-17
Reviewed by Chris Fleizach.

Source/WebCore:

Don't expose groups with redundant accessibility text on the Mac.
Here's an example of one such group:

<div aria-label="1">1</div>

This group is not useful to accessibility clients. Instead, we
expose the text contents directly.

Test: accessibility/ignore-redundant-accessibility-text-groups.html

• accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::textUnderElement const):
Instead of asserting when we try to get the text of an element in a
document that needs a style update, return an empty string.

• accessibility/mac/AccessibilityObjectMac.mm:

(WebCore::shouldIgnoreGroup): Added.
(WebCore::AccessibilityObject::accessibilityPlatformIncludesObject const):

LayoutTests:

Add a test ensuring WebKit appropriately does and doesn't expose
groups with redundant accessibility text.

• accessibility/mac/ignore-redundant-accessibility-text-groups-expected.txt: Added.
• accessibility/mac/ignore-redundant-accessibility-text-groups.html: Added.

7:45 AM Changeset in webkit [284334] by Antti Koivisto

• 13 edits
  2 adds in trunk

[LFC][Integration] Support background-clip:text on inline boxes
​https://bugs.webkit.org/show_bug.cgi?id=231877

Reviewed by Alan Bujtas.

Source/WebCore:

Implement text mask painting.

Test: fast/inline/inline-background-clip-text.html

• layout/integration/InlineIteratorBoxLegacyPath.h:

(WebCore::InlineIterator::BoxLegacyPath::firstLeafBoxForInlineBox const):
(WebCore::InlineIterator::BoxLegacyPath::lastLeafBoxForInlineBox const):

• layout/integration/InlineIteratorBoxModernPath.h:

(WebCore::InlineIterator::BoxModernPath::firstLeafBoxForInlineBox const):
(WebCore::InlineIterator::BoxModernPath::lastLeafBoxForInlineBox const):
(WebCore::InlineIterator::BoxModernPath::isWithinInlineBox):

• layout/integration/InlineIteratorInlineBox.cpp:

(WebCore::InlineIterator::InlineBox::firstLeafBox const):
(WebCore::InlineIterator::InlineBox::lastLeafBox const):
(WebCore::InlineIterator::InlineBox::endLeafBox const):

Add iterator support for getting leaf boxes of an inline box.

• layout/integration/InlineIteratorInlineBox.h:
• layout/integration/LayoutIntegrationCoverage.cpp:

(WebCore::LayoutIntegration::printReason):
(WebCore::LayoutIntegration::canUseForRenderInlineChild):

• layout/integration/LayoutIntegrationCoverage.h:
• rendering/RenderBoxModelObject.cpp:

(WebCore::RenderBoxModelObject::paintMaskForTextFillBox):

Paint the mask directly using TextBoxPainter instead of recursing to the general painting code.

• rendering/TextBoxPainter.cpp:

(WebCore::TextBoxPainter::TextBoxPainter):

• rendering/TextBoxPainter.h:

LayoutTests:

• fast/inline/inline-background-clip-text-expected.html: Added.
• fast/inline/inline-background-clip-text.html: Added.