Skip to content

attempt to upgrade - #4

Closed
Jarred-Sumner wants to merge 1490 commits into
oven-sh:mainfrom
WebKit:main
Closed

attempt to upgrade#4
Jarred-Sumner wants to merge 1490 commits into
oven-sh:mainfrom
WebKit:main

Conversation

@Jarred-Sumner

@Jarred-Sumner Jarred-Sumner commented May 8, 2022

Copy link
Copy Markdown
Collaborator

No description provided.

Constellation and others added 30 commits May 2, 2022 01:17
@Constellation
[JSC] Revive JSC's guard against speculation collection
32f9419 
https://bugs.webkit.org/show_bug.cgi?id=239939

Reviewed by Mark Lam.

r288815 dropped JSC's guard against structures in speculation collection, but this is wrong.
This patch reverts it back.

* Source/JavaScriptCore/bytecode/SpeculatedType.cpp:
(JSC::speculationFromCell):
* Source/JavaScriptCore/heap/StructureAlignedMemoryAllocator.cpp:
(JSC::StructureMemoryManager::StructureMemoryManager):
(JSC::StructureMemoryManager::tryMallocStructureBlock):
(JSC::StructureMemoryManager::freeStructureBlock):
(JSC::StructureAlignedMemoryAllocator::initializeStructureAddressSpace):
* Source/JavaScriptCore/runtime/JSCConfig.h:
* Source/JavaScriptCore/runtime/StructureID.h:
(JSC::StructureID::tryDecode const):

Canonical link: https://commits.webkit.org/250161@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293657 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@dcrousso
[Modern Media Controls] the overflow button sometimes flickers
9b920ba 
https://bugs.webkit.org/show_bug.cgi?id=239921
<rdar://problem/91329468>

Reviewed by Eric Carlson.

There are two things that control the visibility of the `OverflowButton`:
1. whether any of the "default" actions (e.g. playback speed, chapters, etc.) are possible
2. if any other buttons that have `contextMenuOptions` are dropped (i.e. there's not enough
room for it because the `<video>` is narrow or there are already too many buttons)

(1) is recalculated for most JS media events (e.g. whenever tracks are changed, if
the `readyState` changes, etc.).

(2) is recalculated in `layout` of `MediaControls`, which is (relatively) less frequent.

In the case that the only contextmenu options are provided by (2) (i.e. none of the "default"
actions are possible), the frequent recalculation of (1) will combined with the fact that
`layout` uses a `requestAnimationFrame` to delay/batch work will cause there to be a short
period of time after the recalculation of (1) and before the recalculation of (2) where
there are no contextmenu options, resulting in the `OverflowButton` being hidden.

* Modules/modern-media-controls/controls/overflow-button.js:
(OverflowButton):
(OverflowButton.prototype.set visible):
(OverflowButton.prototype.set visible.isEmpty): Added.
(OverflowButton.prototype.get contextMenuOptions):
(OverflowButton.prototype.addExtraContextMenuOptions): Renamed from `addContextMenuOptions`.
(OverflowButton.prototype.clearExtraContextMenuOptions): Renamed from `clearContextMenuOptions`.
(OverflowButton.prototype.set defaultContextMenuOptions):
* Modules/modern-media-controls/controls/inline-media-controls.js:
(InlineMediaControls.prototype.layout):
* Modules/modern-media-controls/controls/macos-fullscreen-media-controls.js:
(MacOSFullscreenMediaControls.prototype.layout):
Instead of having a single `_contextMenuOptions` that is modified by both (1) and (2), have
a separate member variable for each. This way, the recalculation of (1) doesn't also clear
the state left over from the last time (2) was calculated (which will be recalculated by (2)
shortly thereafter). Use both member variables to decide whether the `OverflowButton` should
be `visible`, allowing (1) and (2) to update independent of eachother.

Canonical link: https://commits.webkit.org/250162@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293658 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@shallawa
REGRESSION(r282117): RemoteRenderingBackend::willDestroyImageBuffer()…
d049154 
… can crash if the RemoteRenderingBackend has already been destroyed

https://bugs.webkit.org/show_bug.cgi?id=239107
rdar://91608298

Reviewed by Darin Adler.

Source/WebCore:

-- IOSurfacePool will be RefCounted.

-- ImageBufferIOSurfaceBackend::create() will pass the surfacePool
   of the CreationContext to ImageBufferIOSurfaceBackend constructor.

-- ImageBufferIOSurfaceBackend will hold a RefPtr<IOSurfacePool>.

-- ImageBufferIOSurfaceBackend destructor will call IOSurface::moveToPool()
   to return its surface to the IOSurfacePool if it was set.

* platform/graphics/ConcreteImageBuffer.h:
* platform/graphics/ImageBuffer.h:
* platform/graphics/ImageBufferBackend.h:
(WebCore::ImageBufferBackend::releaseGraphicsContext):
(WebCore::ImageBufferBackend::releaseBufferToPool): Deleted.
* platform/graphics/cg/IOSurfacePool.cpp:
(WebCore::IOSurfacePool::create):
* platform/graphics/cg/IOSurfacePool.h:
* platform/graphics/cg/ImageBufferIOSurfaceBackend.cpp:
(WebCore::ImageBufferIOSurfaceBackend::create):
(WebCore::ImageBufferIOSurfaceBackend::ImageBufferIOSurfaceBackend):
(WebCore::ImageBufferIOSurfaceBackend::~ImageBufferIOSurfaceBackend):
(WebCore::ImageBufferIOSurfaceBackend::releaseBufferToPool): Deleted.
* platform/graphics/cg/ImageBufferIOSurfaceBackend.h:

Source/WebKit:

After r282117, the assumption that RemoteRenderingBackend will outlive
all its RemoteImageBuffers became wrong. The RemoteRenderingBackend can
get destroyed under GPUConnectionToWebProcess::didClose() before the
callOnMainThread() of the ThreadSafeRefcounted image buffers have run.

This solution is to make the ImageBufferIOSurfaceBackend be responsible
of returning its IOSurface to the IOSurfacePool. So no need to call
willDestroyImageBuffer() from the RemoteImageBuffer destructor.

* GPUProcess/graphics/RemoteGraphicsContextGL.h:
* GPUProcess/graphics/RemoteImageBuffer.h:
(WebKit::RemoteImageBuffer::RemoteImageBuffer):
(WebKit::RemoteImageBuffer::m_renderingResourcesRequest):
(WebKit::RemoteImageBuffer::~RemoteImageBuffer):
* GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::RemoteRenderingBackend::willDestroyImageBuffer): Deleted.
* GPUProcess/graphics/RemoteRenderingBackend.h:
(WebKit::RemoteRenderingBackend::ioSurfacePool const):
* Shared/RemoteLayerTree/RemoteLayerBackingStore.mm:
(WebKit::RemoteLayerBackingStore::Buffer::discard):
* WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp:
(WebKit::ImageBufferShareableMappedIOSurfaceBackend::create):

Canonical link: https://commits.webkit.org/250163@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293659 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@mcatanzaro @webkit-commit-queue
[GLib] Make WebKitSettings XSS auditor functions no-op
91ecdce 
https://bugs.webkit.org/show_bug.cgi?id=239651

Patch by Michael Catanzaro <mcatanzaro@gnome.org> on 2022-05-02
Reviewed by Adrian Perez de Castro.

* Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitSettings.cpp:
(testWebKitSettings):
* Source/WebKit/UIProcess/API/glib/WebKitSettings.cpp:
(webKitSettingsSetProperty):
(webKitSettingsGetProperty):

Canonical link: https://commits.webkit.org/250164@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293660 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@philn @webkit-commit-queue
[GStreamer][Debug] media-recorder tests hitting an ASSERT
ef88848 
https://bugs.webkit.org/show_bug.cgi?id=239942

Patch by Philippe Normand <pnormand@igalia.com> on 2022-05-02
Reviewed by Xabier Rodriguez-Calvar.

Delay the track observing stopping until InternalSources are destroyed. Doing so during
PAUSED->READY was not safe in MediaRecording pipelines, because the transcoder changes its
state from a secondary thread.

* platform/mediastream/gstreamer/GStreamerMediaStreamSource.cpp:
(webkitMediaStreamSrcChangeState):

Canonical link: https://commits.webkit.org/250165@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293661 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@anttijk
REGRESSION: fast/css/stylesheet-candidate-nodes-crash.xhtml is a cons…
d032aa9 
…tant text failure

https://bugs.webkit.org/show_bug.cgi?id=239960
rdar://92293472

Reviewed by Alan Bujtas.

XML parser update has changed error reporting output slightly.
Remove the error report from the test output since testing that is not the purpose of this test.

* fast/css/stylesheet-candidate-nodes-crash-expected.txt:
* fast/css/stylesheet-candidate-nodes-crash.xhtml:

Canonical link: https://commits.webkit.org/250166@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293662 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@whsieh
[iOS] Add support for the "Markup Image" action when right clicking a…
d2a33ae 
…n image in editable content

https://bugs.webkit.org/show_bug.cgi?id=239948
rdar://92064672

Reviewed by Tim Horton.

Source/WebKit:

Insert a "Markup Image" menu action when right clicking an editable image element on iPad via trackpad, but only
when the image has relevant image analysis markup results. See below for more details.

Test: ImageAnalysisTests.MarkupImageUsingContextMenu

* UIProcess/WebPageProxy.h:
* UIProcess/ios/WKContentViewInteraction.mm:
(-[WKContentView prepareSelectionForContextMenuWithLocationInView:completionHandler:]):

In the case where a single image is selected in editable content, make this method additionally wait until we've
finished analyzing the selected image, such that the subsequent call to `-buildMenuForWebViewWithBuilder:` which
populates items in the right click context menu will include the "Markup Image" item if there are relevant
results.

(-[WKContentView buildMenuForWebViewWithBuilder:]):

Also move the location of this item to before the Format (B/I/U) menu items in both the callout bar and the
editing context menu.

* UIProcess/ios/WebPageProxyIOS.mm:
(WebKit::WebPageProxy::prepareSelectionForContextMenuWithLocationInView):
* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::prepareSelectionForContextMenuWithLocationInView):

In the case where an image element is clicked, just select the image element instead of trying to detect a
nearby word or link. We also immediately send a full editor state update here, such that the editor state's
`selectedEditableImage` will be up to date when the completion handler in the UI process is invoked.

Tools:

Add an API test to verify that the "Markup Image" is included in the context menu when right clicking an image
element inside an editable web view.

* TestWebKitAPI/Tests/WebKitCocoa/ImageAnalysisTests.mm:
(TestWebKitAPI::simulateEditContextMenuAppearance):
(TestWebKitAPI::TEST):

Canonical link: https://commits.webkit.org/250167@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293663 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@youennf
VPIO requires the same sample rate for microphone and speaker formats
ccee887 
https://bugs.webkit.org/show_bug.cgi?id=239956

Reviewed by Eric Carlson.

VPIO requires the speaker sample rate and microphone sample rate to be the same.
This is not guaranteed to be true : getUserMedia/applyConstraints may set the microphone sample rate to different values.
If audio rendering already started at capture start time, we use the audio rendering sample rate.
This is not strictly compliant, given required constraints but they are not widely used.
Applications that want to make sure to use a specific sample rate would need to pause audio rendering when starting to capture.
We reset exposed settings when starting to capture to expose the actual sample rate to JavaScript through MediaStreamTrack.getSettings().

Manually tested.

* platform/mediastream/mac/BaseAudioSharedUnit.h:
* platform/mediastream/mac/CoreAudioCaptureSource.cpp:

Canonical link: https://commits.webkit.org/250168@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293664 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@youennf
Register shared workers as service worker clients
fcd4e73 
https://bugs.webkit.org/show_bug.cgi?id=239846

Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

* web-platform-tests/service-workers/service-worker/claim-shared-worker-fetch.https-expected.txt:

Source/WebCore:

Make sure to register shared workers as service worker clients at launch time or when recreating the network process connection.

Covered by rebased test.

* workers/shared/context/SharedWorkerThread.cpp:
* workers/shared/context/SharedWorkerThreadProxy.cpp:
* workers/shared/context/SharedWorkerThreadProxy.h:

Canonical link: https://commits.webkit.org/250169@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293665 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@aoikonomopoulos
new-largeish-contiguous-array-with-size.js: pick up leakFactor
60be1fb 
https://bugs.webkit.org/show_bug.cgi?id=239963

Unreviewed gardening.

The //@ directives are implemented imperatively, so requireOptions
only has any effect if it precedes the run* statement. Also,
s/var leakFactor/leakFactor/ to avoid running into this:

  Exception: SyntaxError: Can't create duplicate variable: 'leakFactor'

With this fix, the leakFactor works as intended -- no failures in 200+
iterations.


* stress/new-largeish-contiguous-array-with-size.js:

Canonical link: https://commits.webkit.org/250170@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293666 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@JonWBedard
[git-webkit] log should support ranges
a06cdeb 
https://bugs.webkit.org/show_bug.cgi?id=239510
<rdar://problem/92031167>

Reviewed by Ryan Haddad.

* Tools/Scripts/libraries/webkitscmpy/setup.py: Bump version.
* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py: Ditto.
* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/command.py:
(FilteredCommand.replace): Break logic converting a substring into a revision or hash into a function.
(FilteredCommand.main): If an argument can be split by ..., convert it's substrings into revisions/hashes.

Canonical link: https://commits.webkit.org/250171@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293667 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@Loirooriol
[cssom] Enumerate all logical longhands in the computed style
3a802b0 
https://bugs.webkit.org/show_bug.cgi?id=239910

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Update test expectations.

* web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:
* web-platform-tests/css/css-cascade/all-prop-revert-layer-expected.txt:
* web-platform-tests/css/cssom/getComputedStyle-detached-subtree-expected.txt:

Source/WebCore:

Bug 210695 made computed styles enumerate most logical longhands, but
only the ones thefined in the css-logical spec were included. Other
specs, like css-scroll-snap, can also define logical longhands.

This patch fixes the logic, and instead of checking the spec, it checks
the "logical-property-group" field.

Tests: imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml.html
       imported/w3c/web-platform-tests/css/css-cascade/all-prop-revert-layer.html
       imported/w3c/web-platform-tests/css/cssom/getComputedStyle-detached-subtree.html

* css/makeprop.pl:
(isLogical):

LayoutTests:

Update test expectations.
all-prop-initial-xml-expected.txt for ios was clearly outdated, so just
removing it.

* platform/gtk/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:
* platform/gtk/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-detached-subtree-expected.txt:
* platform/ios/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt: Removed.
* platform/ios/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-detached-subtree-expected.txt:
* platform/mac-wk1/imported/w3c/web-platform-tests/css/css-cascade/all-prop-revert-layer-expected.txt:
* platform/wpe/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:
* platform/wpe/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-detached-subtree-expected.txt:

Canonical link: https://commits.webkit.org/250172@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293670 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@eric-carlson
[Cocoa] Allow more mime types in captive portal mode
59116d2 
https://bugs.webkit.org/show_bug.cgi?id=239859
rdar://91830683

Reviewed by Brent Fulgham.

Source/WTF:

* Scripts/Preferences/WebPreferences.yaml:

Tools:

* TestWebKitAPI/Tests/WebKit/cocoa/start-offset.ts: Added.
* TestWebKitAPI/Tests/WebKitCocoa/MediaLoading.mm:
(TestWebKitAPI::runVideoTest):
(TestWebKitAPI::testTransportStreamBytes):
(TestWebKitAPI::TEST):

Canonical link: https://commits.webkit.org/250173@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293671 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@fujii
HTML Parser: Wrong column number in CR-LF line ending style (DOS EOL …
548cf67 
…style) HTML files

https://bugs.webkit.org/show_bug.cgi?id=239947

Reviewed by Myles C. Maxfield.

Source/WebCore:

JS stack trace reported wrong column numbers in CR-LF line ending
HTML files. m_numberOfCharactersConsumedPriorToCurrentLine was the
number of characters included the preceding CR but the following
LF in those files.

In SegmentedString::advance, startNewLine() is called after
decrementing m_currentSubstring.length. In
SegmentedString::advancePastNewline, however, startNewLine() was
called before calling decrementAndCheckLength(). startNewLine()
should be called after decrementing.

Test: js/dom/line-column-numbers-cr-lf.html

* platform/text/SegmentedString.h:
(WebCore::SegmentedString::advancePastNewline):
Call startNewLine() after decrementAndCheckLength() is called.

LayoutTests:

* js/dom/line-column-numbers-cr-lf-expected.txt: Added.
* js/dom/line-column-numbers-cr-lf.html: Added.

Canonical link: https://commits.webkit.org/250174@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293672 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@ziransun
[selection] Set correct selection range for TEXTAREA when updating de…
3aebf07 
…fault value

https://bugs.webkit.org/show_bug.cgi?id=237525

Reviewed by  Chris Dumez.

LayoutTests/imported/w3c:

* web-platform-tests/html/semantics/forms/textfieldselection/selection-start-end-extra-expected.txt:

Source/WebCore:

Updating defaultValue should keep selectionStart/End. We need clamp them if the new value is shorter than the
selectionStart/End. This change is to be in line with [1] & [2].

[1] https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element:dom-textarea-defaultvalue-2
[2] https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#textFieldSelection:concept-textarea/input-relevant-value

Part of this change is an import of Chromium CL at
chromium/chromium@bb27a50

* html/HTMLTextAreaElement.cpp:
(WebCore::HTMLTextAreaElement::childrenChanged):
(WebCore::HTMLTextAreaElement::setValueCommon):
* html/HTMLTextFormControlElement.h:

Canonical link: https://commits.webkit.org/250175@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293673 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@litherum
[WebGPU] [tvOS] Neither MTLGPUFamilyApple6 nor MTLGPUFamilyApple7 exi…
2221ecf 
…st on tvOS

https://bugs.webkit.org/show_bug.cgi?id=239973
<rdar://problem/92599361>

Unreviewed build fix.


* WebGPU/HardwareCapabilities.mm:
(WebGPU::rawHardwareCapabilities):

Canonical link: https://commits.webkit.org/250176@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293674 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@achristensen07
Fix tvOS build
5c6a531 
https://bugs.webkit.org/show_bug.cgi?id=239973
<rdar://problem/92599361>

* WebGPU/HardwareCapabilities.mm:

Canonical link: https://commits.webkit.org/250177@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293675 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@youennf
PWA in iOS use old assets after publish new servicerWorker/assets
71835d2 
https://bugs.webkit.org/show_bug.cgi?id=199110
<rdar://problem/51992077>

Reviewed by Chris Dumez.

Source/WebCore:

In case a service worker is updated, its state will be waiting until activated.
In case we suspend clients and network process, the newly installed service worker wil remain waiting.
We will wait for the service worker to get activated when network process gets unsuspended, which might not happen if the network process gets stopped by the OS.
To prevent this, we now update the service worker registration as soon as the service worker install job is finished.
The migration from waiting to activated upon network process crash is not ideal: in theory we should fire an activate event on the waiting service worker.
That said, this is still somehow allowed, as failing to activate (say if service worker process is crashing when handling the event) is allowed.

Covered by new API test.

* workers/service/server/SWServer.cpp:

Tools:

* TestWebKitAPI/Tests/WebKitCocoa/ServiceWorkerBasic.mm:
* TestWebKitAPI/cocoa/HTTPServer.h:
* TestWebKitAPI/cocoa/HTTPServer.mm:

Canonical link: https://commits.webkit.org/250178@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293676 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@youennf
Cancel response stream if load is being cancelled by the web page
dcb1eb1 
https://bugs.webkit.org/show_bug.cgi?id=239968

Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

* web-platform-tests/service-workers/service-worker/fetch-event-respond-with-readable-stream.https-expected.txt:

Source/WebCore:

Add a cancel callback and use it to get the fetch client cancelling notification
to cancel the response body stream or response body load.

Covered by rebased test.

* Modules/fetch/FetchResponse.cpp:
(WebCore::FetchResponse::cancelStream):
* Modules/fetch/FetchResponse.h:
* bindings/js/ReadableStream.cpp:
(WebCore::ReadableStream::cancel):
* bindings/js/ReadableStream.h:
* workers/service/context/ServiceWorkerFetch.cpp:
(WebCore::ServiceWorkerFetch::processResponse):
* workers/service/context/ServiceWorkerFetch.h:

Source/WebKit:

Use the cancel callback to pipe the order to cancel the stream.

* WebProcess/Storage/WebServiceWorkerFetchTaskClient.cpp:
(WebKit::WebServiceWorkerFetchTaskClient::cancel):
(WebKit::WebServiceWorkerFetchTaskClient::setCancelledCallback):
* WebProcess/Storage/WebServiceWorkerFetchTaskClient.h:

Canonical link: https://commits.webkit.org/250179@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293679 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@Constellation
[JSC] Introduce shifting Structure encoding
7785d9d 
https://bugs.webkit.org/show_bug.cgi?id=239957

Reviewed by Mark Lam.

For platforms which have limited amount of virtual address space (<= 36 bits), this patch introduces
shifting Structure encoding. We align Structure on a 32-bytes boundary instead of 16 bytes so that
we can ensure that lower 5 bits are zero. Then, we can use 1 bit for nuke, and shifting 4 bits to
convert 36 bit address to 32 bit StructureID. By using this mechanism, we do not need to allocate
large virtual address space for these platforms. If we an address can have more than 36 bits, then
we should just reserve a larger address region since we have enough address space. Current Structure
size is 112 bytes, which is 3.5 atoms at 32 bytes / atom. Hence, this alignment costs us 16 bytes per
Structure.

* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/heap/Heap.cpp:
* Source/JavaScriptCore/heap/StructureAlignedMemoryAllocator.cpp:
* Source/JavaScriptCore/jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::emitNonNullDecodeStructureID):
* Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h:
* Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:
* Source/JavaScriptCore/runtime/JSCConfig.h:
* Source/JavaScriptCore/runtime/JSCell.h:
(JSC::JSCell::atomSize):
* Source/JavaScriptCore/runtime/Structure.h:
(JSC::Structure::atomSize):
* Source/JavaScriptCore/runtime/StructureID.h:
(JSC::StructureID::decode const):
(JSC::StructureID::tryDecode const):
(JSC::StructureID::encode):
* Source/JavaScriptCore/tools/IntegrityInlines.h:
(JSC::Integrity::auditStructureID):

Canonical link: https://commits.webkit.org/250180@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293680 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@whsieh
[macOS] The "Markup Image" services menu item should be gated on imag…
f55b041 
…e analysis results

https://bugs.webkit.org/show_bug.cgi?id=239933
rdar://92348202

Reviewed by Kate Cheney.

Source/WebKit:

Adjust some macOS-specific logic for appending the "Markup Image" menu item in the services menu, such that we
only add this new item in the case where the relevant image analysis APIs come back with a valid cropped image
result. See below for more details.

Test: ImageAnalysisTests.MarkupImageItemInServicesMenu

* UIProcess/WebContextMenuProxy.h:
(WebKit::WebContextMenuProxy::croppedImageResult const):

Move `m_croppedImageForContextMenu` into `WebContextMenuProxyMac` as `m_croppedImageResult`, so that it can be
easily used for both the new "Copy Cropped Image" and "Markup Image" items. This also allows us to simplify some
logic for resetting this cached image result since the whole `m_activeContextMenu` is always destroyed upon
presenting a context menu, so there's no need to separately clear out `m_croppedImageResult`.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::close):
(WebKit::WebPageProxy::showContextMenu):
* UIProcess/WebPageProxy.h:
* UIProcess/mac/WebContextMenuProxyMac.h:
* UIProcess/mac/WebContextMenuProxyMac.mm:
(WebKit::WebContextMenuProxyMac::setupServicesMenu):
(WebKit::WebContextMenuProxyMac::appendMarkupItemToControlledImageMenuIfNeeded):

Pull this logic out into a separate helper method, and change it so that:
- We run the image analysis prior to creating and adding the item.
- Only add the item if the image analysis returned a non-null CGImageRef.
- Store the CGImageRef on `m_croppedImageResult`, for use if the menu item is invoked.

(WebKit::WebContextMenuProxyMac::applyMarkupToControlledImage):
(WebKit::WebContextMenuProxyMac::getContextMenuFromItems):
* UIProcess/mac/WebPageProxyMac.mm:
(WebKit::WebPageProxy::handleContextMenuCopyCroppedImage):
(WebKit::WebPageProxy::setCroppedImageForContextMenu): Deleted.

Tools:

Add an API test to simulate clicking on the services menu button in an attachment-backed image element while
swizzling the relevant image analysis APIs to return a valid CGImageRef; verify that the "Markup Image" menu
item eventually shows up.

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/WebKitCocoa/ImageAnalysisTests.mm:
(TestWebKitAPI::createWebViewWithTextRecognitionEnhancements):
(TestWebKitAPI::iconImage):

Make this testing helper function work on both macOS and iOS.

(TestWebKitAPI::TEST):
(TestWebKitAPI::runMarkupTest):
* TestWebKitAPI/Tests/WebKitCocoa/image-controls.html: Added.

Canonical link: https://commits.webkit.org/250181@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293681 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@cdumez
static_reference_cast(const Ref<X, Y>&) causes unnecessary ref-counti…
a4eaf8e 
…ng churn

https://bugs.webkit.org/show_bug.cgi?id=239970

Reviewed by Geoffrey Garen.

This function was calling copyRef() to get a non-const Ref<> and then calling Ref::get() to construct a
new Ref<> of the destination type. The copyRef() would increase the ref count by 1, constructing the
new destination Ref<> would increase the ref count by 1 again and then the temporary Ref going out of
scope would decrease the ref count by one.

We now call static_reference_cast(Ref<X, Y>&&) with the result of the copyRef(), which will leak
the pointer from the Ref<> and adopt it in the destination Ref, thus avoiding unnecessary churn.

Also drop the static_reference_cast(Ref<X, Y>&) overload as it is no longer more efficient than the
static_reference_cast(const Ref<X, Y>&) one.

* Source/WTF/wtf/Ref.h:
(WTF::static_reference_cast):

Canonical link: https://commits.webkit.org/250182@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293682 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@cdumez
Use a strongly typed identifier for requests to mark surfaces as vola…
81cc716 
…tile

https://bugs.webkit.org/show_bug.cgi?id=239974

Reviewed by Simon Fraser.

* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::RemoteRenderingBackend::markSurfacesVolatile):
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h:
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.messages.in:
* Source/WebKit/Scripts/webkit/messages.py:
(types_that_cannot_be_forward_declared):
* Source/WebKit/Shared/MarkSurfacesAsVolatileRequestIdentifier.h: Added.
* Source/WebKit/WebKit.xcodeproj/project.pbxproj:
* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:
(WebKit::RemoteRenderingBackendProxy::markSurfacesVolatile):
(WebKit::RemoteRenderingBackendProxy::didMarkLayersAsVolatile):
* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h:
* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.messages.in:

Canonical link: https://commits.webkit.org/250183@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293683 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@dcrousso
[Modern Media Controls] REGRESSION(?) tapping a video to start playin…
196c26e 
…g for the first time doesn't start playing

https://bugs.webkit.org/show_bug.cgi?id=239918
<rdar://problem/91329117>

Reviewed by Jer Noble.

Source/WebCore:

This happens on iOS because the `<video>` has a `GestureRecognizer` that will attempt to
`play()`, and then the `PlayPauseButton` (which also has a `GestureRecognizer`) will attempt
to `togglePlayback()` (via `PlaybackSupport`), which will `pause()` because the `<video>` is
not `paused`.

When a `<video>` is `play()` for the first time, it may not actually start playing for a
moment (e.g. buffering) even though it will say it's `paused`.

Test: media/modern-media-controls/ios-inline-media-controls/touch/ios-inline-media-controls-shows-start-button.html

* Modules/modern-media-controls/media/media-controller.js:
(MediaController.prototype.togglePlayback):
Also check `hasPlayed` to decide whether to `play()` or `pause()`, as it's set when the first
`"play"` event is handled, as until then we're still not playing yet and should `play()`.

This could also be fixed in `PlaybackSupport` (and/or `StartSupport`), but doing it in
`togglePlayback` is a more general solution that fixes all present (and future) callsites.

LayoutTests:

* media/modern-media-controls/ios-inline-media-controls/touch/ios-inline-media-controls-shows-start-button.html: Added.
* media/modern-media-controls/ios-inline-media-controls/touch/ios-inline-media-controls-shows-start-button-expected.txt: Added.

* TestExpectations:

Canonical link: https://commits.webkit.org/250184@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293684 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@webkit-commit-queue
Unreviewed, reverting r293680.
1b50c3c 
https://bugs.webkit.org/show_bug.cgi?id=239983

crash on iOS

Reverted changeset:

"[JSC] Introduce shifting Structure encoding"
https://bugs.webkit.org/show_bug.cgi?id=239957
https://commits.webkit.org/r293680

Canonical link: https://commits.webkit.org/250185@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293685 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Justin Michaud
Add option to JSC shell to wait for a USR2 signal before exiting to a…
e383b0d 
…id in collection of vmmaps

https://bugs.webkit.org/show_bug.cgi?id=239919

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

* jsc.cpp:
(main):

Source/WTF:

* wtf/threads/Signals.h:
(WTF::toSystemSignal):

Canonical link: https://commits.webkit.org/250186@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293688 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@Loirooriol
[cssom] Don't index 'all' shorthand in computed styles
7189c33 
https://bugs.webkit.org/show_bug.cgi?id=239669

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Update test expectations.

* web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:
* web-platform-tests/css/cssom/getComputedStyle-detached-subtree-expected.txt:

Source/WebCore:

Computed styles should provide getters for both longhands and shorthands,
but only the former should be indexed.

However, the 'all' shorthand was being indexed as if it was a longhand.

Tests: imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml.html
       imported/w3c/web-platform-tests/css/cssom/getComputedStyle-detached-subtree.html

* css/makeprop.pl:
(skippedFromComputedStyle):

LayoutTests:

Update test expectations.

* platform/gtk/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:
* platform/gtk/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-detached-subtree-expected.txt:
* platform/ios/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:
* platform/ios/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-detached-subtree-expected.txt:
* platform/wpe/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:
* platform/wpe/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-detached-subtree-expected.txt:

Canonical link: https://commits.webkit.org/250187@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293689 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@achristensen07
Update some wpt tests with control characters in cookies
6fb9f95 
https://bugs.webkit.org/show_bug.cgi?id=239966
<rdar://92300855>

Reviewed by Chris Dumez.

This reflects a change in httpwg/http-extensions#1531

* web-platform-tests/cookies/name/name-ctl-expected.txt:
* web-platform-tests/cookies/name/name-ctl.html:
* web-platform-tests/cookies/resources/cookie-test.js:
* web-platform-tests/cookies/value/value-ctl-expected.txt:
* web-platform-tests/cookies/value/value-ctl.html:
* web-platform-tests/html/dom/documents/resource-metadata-management/document-cookie-expected.txt:
* web-platform-tests/html/dom/documents/resource-metadata-management/document-cookie.html:

Canonical link: https://commits.webkit.org/250188@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293691 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@Constellation
[JSC] Fix ASan crash due to CString ownership
cd664a5 
https://bugs.webkit.org/show_bug.cgi?id=239981

Reviewed by Darin Adler and Mark Lam.

We need to ensure that CString is kept alive.

* runtime/JSDateMath.cpp:
(JSC::DateCache::timeZoneDisplayName):

Canonical link: https://commits.webkit.org/250189@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293693 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@achristensen07
Revert all use of _setPrivacyProxyFailClosedForUnreachableNonMainHosts
d259b4e 
https://bugs.webkit.org/show_bug.cgi?id=239977
<rdar://92617943>

Reviewed by John Wilander.

Due to what is likely confusion about internal integration processes,
the powers that be have decided that the best course of action for now
is to restore the status quo and accept any consequences that may entail.

* NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
(WebKit::NetworkDataTaskCocoa::NetworkDataTaskCocoa):
* NetworkProcess/cocoa/NetworkSessionCocoa.mm:
(WebKit::NetworkSessionCocoa::createWebSocketTask):

Canonical link: https://commits.webkit.org/250190@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293697 268f45cc-cd09-0410-ab3c-d52691b4dbfc
megangardner and others added 18 commits May 7, 2022 05:27
@megangardner
Fix flakey test by using the old API on old systems.
297c01a 
https://bugs.webkit.org/show_bug.cgi?id=240195

Reviewed by Tim Horton.

Source/WebKit:

Turn fast/images/text-recognition/ios/show-data-detector-context-menu.html back on.

* UIProcess/ios/WKActionSheetAssistant.mm:
(-[WKActionSheetAssistant contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:contextMenuInteraction:previewForHighlightingMenuWithConfiguration:]):
(-[WKActionSheetAssistant contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:]): Deleted.
* UIProcess/ios/WKContentViewInteraction.mm:
(-[WKContentView contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:contextMenuInteraction:previewForHighlightingMenuWithConfiguration:]):
(-[WKContentView contextMenuInteraction:configuration:dismissalPreviewForItemWithIdentifier:contextMenuInteraction:previewForDismissingMenuWithConfiguration:]):
(-[WKContentView contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:]): Deleted.
(-[WKContentView contextMenuInteraction:configuration:dismissalPreviewForItemWithIdentifier:]): Deleted.
* UIProcess/ios/WebDataListSuggestionsDropdownIOS.mm:
(-[WKDataListSuggestionsDropdown contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:contextMenuInteraction:previewForHighlightingMenuWithConfiguration:]):
(-[WKDataListSuggestionsDropdown contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:]): Deleted.
* UIProcess/ios/forms/WKDateTimeInputControl.mm:
(-[WKDateTimePicker contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:contextMenuInteraction:previewForHighlightingMenuWithConfiguration:]):
(-[WKDateTimePicker contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:]): Deleted.
* UIProcess/ios/forms/WKFileUploadPanel.mm:
(-[WKFileUploadPanel contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:contextMenuInteraction:previewForHighlightingMenuWithConfiguration:]):
(-[WKFileUploadPanel contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:]): Deleted.
* UIProcess/ios/forms/WKFormSelectPicker.mm:
(-[WKSelectPicker contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:contextMenuInteraction:previewForHighlightingMenuWithConfiguration:]):
(-[WKSelectPicker contextMenuInteraction:configuration:highlightPreviewForItemWithIdentifier:]): Deleted.

Source/WTF:

* wtf/PlatformHave.h:

LayoutTests:

* platform/ios/TestExpectations:

Canonical link: https://commits.webkit.org/250393@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293947 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@cdumez
Modernize / Optimize HTMLInputElement a bit
167c815 
https://bugs.webkit.org/show_bug.cgi?id=240194

Reviewed by Darin Adler.

* Source/WebCore/html/ColorInputType.h:
* Source/WebCore/html/FileInputType.cpp:
(WebCore::FileInputType::firstElementPathForInputValue const):
(WebCore::FileInputType::files): Deleted.
(WebCore::FileInputType::canSetValue): Deleted.
(WebCore::FileInputType::getTypeSpecificValue): Deleted.
* Source/WebCore/html/FileInputType.h:
* Source/WebCore/html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::HTMLInputElement):
(WebCore::HTMLInputElement::endEditing):
(WebCore::HTMLInputElement::updateType):
(WebCore::HTMLInputElement::accessKeyAction):
(WebCore::HTMLInputElement::initializeInputType):
(WebCore::HTMLInputElement::parseAttribute):
(WebCore::HTMLInputElement::finishParsingChildren):
(WebCore::HTMLInputElement::appendFormData):
(WebCore::HTMLInputElement::reset):
(WebCore::HTMLInputElement::setChecked):
(WebCore::HTMLInputElement::setIndeterminate):
(WebCore::HTMLInputElement::value const):
(WebCore::HTMLInputElement::valueWithDefault const):
(WebCore::HTMLInputElement::setValue):
(WebCore::HTMLInputElement::defaultEventHandler):
(WebCore::HTMLInputElement::acceptMIMETypes const):
(WebCore::HTMLInputElement::acceptFileExtensions const):
(WebCore::HTMLInputElement::setShowAutoFillButton):
(WebCore::HTMLInputElement::files):
(WebCore::HTMLInputElement::setFiles):
(WebCore::HTMLInputElement::onSearch):
(WebCore::HTMLInputElement::prepareForDocumentSuspension):
(WebCore::HTMLInputElement::valueAsColor const):
(WebCore::HTMLInputElement::selectColor):
(WebCore::HTMLInputElement::suggestedColors const):
(WebCore::HTMLInputElement::dataList const):
(WebCore::HTMLInputElement::updateValueIfNeeded):
(WebCore::HTMLInputElement::isInRequiredRadioButtonGroup):
(WebCore::HTMLInputElement::radioButtonGroup const):
(WebCore::HTMLInputElement::checkedRadioButtonForGroup const):
(WebCore::HTMLInputElement::size const): Deleted.
(WebCore::HTMLInputElement::setValueForUser): Deleted.
(WebCore::HTMLInputElement::acceptMIMETypes): Deleted.
(WebCore::HTMLInputElement::acceptFileExtensions): Deleted.
(WebCore::HTMLInputElement::canReceiveDroppedFiles const): Deleted.
* Source/WebCore/html/HTMLInputElement.h:
(WebCore::HTMLInputElement::size const):
(WebCore::HTMLInputElement::setValueForUser):
(WebCore::HTMLInputElement::hasDirtyValue const):
(WebCore::HTMLInputElement::hasAutoFillStrongPasswordButton const):
(WebCore::HTMLInputElement::canReceiveDroppedFiles const):
* Source/WebCore/html/InputType.cpp:
(WebCore::InputType::files): Deleted.
(WebCore::InputType::setFiles): Deleted.
(WebCore::InputType::getTypeSpecificValue): Deleted.
(WebCore::InputType::canSetValue): Deleted.
(WebCore::InputType::valueAsColor const): Deleted.
(WebCore::InputType::selectColor): Deleted.
(WebCore::InputType::suggestedColors const): Deleted.
* Source/WebCore/html/InputType.h:
(WebCore::InputType::supportsValidation const):
(WebCore::InputType::InputType):
(WebCore::InputType::canHaveTypeSpecificValue const): Deleted.

Canonical link: https://commits.webkit.org/250394@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293948 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@rniwa
Explain now node reference counting works in Introduction.md
71de4b9 
https://bugs.webkit.org/show_bug.cgi?id=240202

Reviewed by Chris Dumez.

Added explanation on how Node reference counting works.

* Introduction.md:

Canonical link: https://commits.webkit.org/250395@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293949 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@rniwa
Explain now node reference counting works in Introduction.md
ba1d40b 
https://bugs.webkit.org/show_bug.cgi?id=240202

Unreviewed. Fix an obvious typo.

* Introduction.md:

Canonical link: https://commits.webkit.org/250396@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293950 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@heycam
Don't propagate GraphicsContextState change bits into TextPainter's g…
2804ea0 
…lyph display list recorder

https://bugs.webkit.org/show_bug.cgi?id=239952
<rdar://problem/92635604>

Source/WebCore:

Reviewed by Said Abou-Hallawa and Antti Koivisto.

In FontCascade::displayListForTextRun, we create a
DisplayList::Recorder, then call drawGlyphBuffer. We initialize the
DisplayList::Recorder with the GraphicsContextState of the
GraphicsContext we're drawing to. Just before this, we will have set the
current fill color on that GraphicsContext.

When GPUP DOM rendering is disabled, GraphicsContextCG responds to
setFillColor etc. by updating GraphicsContextState, including setting
the Change flag, then immediately updating the CGContext, and clearing
the Change flag.

But when GPUP DOM rendering is enabled, the GraphicsContext is a
DisplayList::Recorder for the layer we're painting in to. Because
DisplayList::Recorder applies its state changes lazily, it can be in the
situation where its GraphicsContextState has had the fill brush changed,
and the Change flag is still set. So DisplayList::Recorder starts off
with a GraphicsContextState with unapplied changes in it. We end up in
DisplayList::Recorder::drawGlyphsAndCacheFont, which calls
appendStateChangeItemIfNecessary, which sees that the Change bit is set,
and generates a SetInlineFillColor display list item, which is
recorded and then replayed the next time the same text is painted.
This recorded fill color then may be wrong for the next TextPainter
that wants to reuse the cached glyph display list.

Display list recorders should never be initialized with a
GraphicsContextState that has change flags set on it. We can assert
this, then make FontCascade explicitly clear those flags on the state
object it passes in to the DisplayList::Recorder.

Test: fast/text/glyph-display-list-color.html

* platform/graphics/FontCascade.cpp:
(WebCore::FontCascade::displayListForTextRun const):
* platform/graphics/GraphicsContextState.cpp:
(WebCore::GraphicsContextState::cloneForRecording const):
* platform/graphics/GraphicsContextState.h:
* platform/graphics/displaylists/DisplayListRecorder.cpp:
(WebCore::DisplayList::Recorder::Recorder):

Add setForceUseGlyphDisplayListForTesting and
cachedGlyphDisplayListsForTextNode functions on Internal for the
test to use:

* rendering/GlyphDisplayListCache.h:
(WebCore::GlyphDisplayListCache::getIfExists):
* rendering/TextPainter.cpp:
(WebCore::TextPainter::shouldUseGlyphDisplayList):
(WebCore::TextPainter::setForceUseGlyphDisplayListForTesting):
(WebCore::TextPainter::cachedGlyphDisplayListsForTextNodeAsText):
* rendering/TextPainter.h:
(WebCore::TextPainter::glyphDisplayListIfExists):
* testing/Internals.cpp:
(WebCore::Internals::setForceUseGlyphDisplayListForTesting):
(WebCore::Internals::cachedGlyphDisplayListsForTextNode):
* testing/Internals.h:
* testing/Internals.idl:

LayoutTests:

Reviewed by Antti Koivisto.

* fast/text/glyph-display-list-color-expected.txt: Added.
* fast/text/glyph-display-list-color.html: Added.

Canonical link: https://commits.webkit.org/250397@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293951 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Mark Lam
Force PAS_ASSERT to generate different crash sites for each assertion.
faada14 
https://bugs.webkit.org/show_bug.cgi?id=240209

Reviewed by Yusuke Suzuki.

Clang currently optimizes all crash sites into one in each function.  Hence, if we
get a crash address at the 1 crash site, we don't know which failed assertion got
us there.  This patch uses an asm statement to force Clang to emit a different
crash site for each assertion.

Benchmarks show that performance is neutral on both Jetstream2 and Speedometer2.

Size-wise, there is some increase.  The following is the "size" output on
JavaScriptCore on M1:

          __TEXT.   __DATA  __OBJC  others    dec       hex
    old   19628032  180224  0       18792448  38600704  24d0000
    new   19644416  180224  0       19251200  39075840  2544000

    diff  16384     0       0       458752    475136

The increase in the "others" categories are mostly in the String Table, Symbol
Table, and Function Start Addresses.  These take up disk space but should not
impact RAM usage unless they are accessed by a a debugger.

* libpas/src/libpas/pas_utils.h:
(pas_assertion_failed):

Canonical link: https://commits.webkit.org/250398@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293952 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@heycam @smfr
Use an OptionSet iterator to skip directly to GraphicsContextState::C…
80a54d2 
…hange bits to handle

https://bugs.webkit.org/show_bug.cgi?id=239954
<rdar://problem/92593424>

Patch by Cameron McCormack <heycam@apple.com> on 2022-05-07
Reviewed by Simon Fraser.

It would be rare for display list SetState items to have many Change
bits set on them. Instead of checking for all 15 bits in mergeChanges,
we can use OptionSet's iterator to skip directly to each changed bit.

Using ctz to turn the Change bit into a bit position helps the
compiler generate compact code to jump to each case in the switch
statement.

On an iPad I tested with, this is a ~2% win on the MotionMark Design
subtest, 5.5% on Leaves, and 1.4% overall.

* platform/graphics/GraphicsContextState.cpp:
(WebCore::toIndex):
(WebCore::GraphicsContextState::mergeChanges):

Canonical link: https://commits.webkit.org/250399@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293953 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@cdumez
Do WebKitAdditions header replacement only when a specific environmen…
64cdede 
…t variable is set

https://bugs.webkit.org/show_bug.cgi?id=240210
<rdar://92885915>

Reviewed by Tim Horton.

* Source/WebKit/Configurations/WebKit.xcconfig:
* Source/WebKit/mac/replace-webkit-additions-includes.py:
(check_should_do_replacement):
(main):
(is_supported_os): Deleted.

Canonical link: https://commits.webkit.org/250400@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293954 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@rniwa
Add helper functions to queue task on Node with GCReachableRef
1c71f2a 
https://bugs.webkit.org/show_bug.cgi?id=240204

Reviewed by Chris Dumez.

Added Node::queueTaskKeepingThisNodeAlive, which queues a task to the event loop while keeping "this" Node
and its JS wrapper alive, and Node::queueTaskToDispatchEvent, which queues a task to the event loop to
dispatch an event on "this" Node while keeping it and its JS wrapper alive, and deployed them in elements.

* Modules/model-element/HTMLModelElement.cpp:
(WebCore::HTMLModelElement::setSourceURL): Need to disambiguate which queueTaskToDispatchEvent to use
between Node and ActiveDOMObject.
(WebCore::HTMLModelElement::notifyFinished): Ditto.
* dom/Node.cpp:
(WebCore::Node::queueTaskKeepingThisNodeAlive): Added.
(WebCore::Node::queueTaskToDispatchEvent): Added.
* dom/Node.h:
* html/HTMLDetailsElement.cpp:
(WebCore::HTMLDetailsElement::parseAttribute): Use newly added functions.
* html/HTMLDialogElement.cpp:
(WebCore::HTMLDialogElement::close): Ditto.
(WebCore::HTMLDialogElement::queueCancelTask): Ditto.
* html/HTMLTextFormControlElement.cpp:
(WebCore::HTMLTextFormControlElement::scheduleSelectEvent): Ditto.

Canonical link: https://commits.webkit.org/250401@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293955 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@anttijk
Avoid resolving style for elements that only inherit changes from parent
99c3969 
https://bugs.webkit.org/show_bug.cgi?id=240132
<rdar://problem/92867346>

Reviewed by Sam Weinig.

Source/WebCore:

When an inherited property changes we need to update all descendant styles too. Currently this
is done by simply running the full style resolution for them including selector matching and
style building steps.

In the common case nothing changes in descendants expect the inherited properties. This patch implements
a fast-path mechanism that allows us to simply copy the relevant properties from the parent, skipping
all the other work. This is possible if we can prove that the value of these properties is not changed
by any rules targeting the child and that there are no other properties affected by this value change.

The mechanism is only implemented for the 'color' property for now. It can be expanded for other properties later.
It would be especially useful for custom properties.

* css/CSSProperties.json:
* css/makeprop.pl:

Add "fast-path-inherited" codegen property that disables the fast-path if the property is explicitly mutated.

(generateInitialValueSetter):
(generateValueSetter):
* rendering/style/RenderStyle.cpp:
(WebCore::RenderStyle::RenderStyle):
(WebCore::RenderStyle::fastPathInheritFrom):

Inherit fast path properties.

(WebCore::RenderStyle::fastPathInheritedEqual const):
(WebCore::RenderStyle::nonFastPathInheritedEqual const):

Test for fast-path property changes.

* rendering/style/RenderStyle.h:
(WebCore::RenderStyle::disallowsFastPathInheritance const):
(WebCore::RenderStyle::setDisallowsFastPathInheritance):

Track if can use the mechanism.

(WebCore::RenderStyle::NonInheritedFlags::operator== const):
* rendering/style/StyleInheritedData.cpp:
(WebCore::StyleInheritedData::operator== const):
(WebCore::StyleInheritedData::fastPathInheritedEqual const):
(WebCore::StyleInheritedData::nonFastPathInheritedEqual const):
(WebCore::StyleInheritedData::fastPathInheritFrom):
* rendering/style/StyleInheritedData.h:
* style/StyleBuilderCustom.h:
(WebCore::Style::BuilderCustom::applyValueFill):
(WebCore::Style::BuilderCustom::applyValueStroke):
* style/StyleBuilderState.cpp:
(WebCore::Style::BuilderState::colorFromPrimitiveValueWithResolvedCurrentColor const):

Color value 'currentcolor' is mostly resolved during use time but in the few places we still resolve it during style building
we need to disable the fast-path, since it makes other properties depend on 'color' property.

* style/StyleChange.cpp:
(WebCore::Style::determineChange):

New style change type for fast-path inheritance.

* style/StyleChange.h:
* style/StyleTreeResolver.cpp:
(WebCore::Style::TreeResolver::styleForStyleable):

Resolve by just copying properties from the parent.

(WebCore::Style::TreeResolver::computeDescendantsToResolve):
(WebCore::Style::TreeResolver::resolveElement):
(WebCore::Style::TreeResolver::determineResolutionType):

Use fast-path if the only reason we are resolving this element is that some supported inherited property changed.

(WebCore::Style::TreeResolver::resolveComposedTree):
(WebCore::Style::TreeResolver::shouldResolveElement): Deleted.
* style/StyleTreeResolver.h:

Tools:

* Scripts/webkitpy/style/checkers/jsonchecker.py:
(JSONCSSPropertiesChecker.check_codegen_properties):

Canonical link: https://commits.webkit.org/250402@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293956 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@rniwa
Introduction.md: Fix typos found by mcatanzaro
749987d 
https://bugs.webkit.org/show_bug.cgi?id=240211

Reviewed by Tim Nguyen.

Fixed typos.

* Introduction.md:

Canonical link: https://commits.webkit.org/250403@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293957 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@fujii
[WinCairo][WK1] accessibility/aria-combobox-control-owns-elements.htm…
1b01fc5 
…l is crashing after 250325@main

https://bugs.webkit.org/show_bug.cgi?id=240218
<rdar://problem/92929718>

Unreviewed test gardening.

* platform/wincairo-wk1/TestExpectations: Skip it.

Canonical link: https://commits.webkit.org/250404@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293958 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@Constellation
Introduce EventTrackingRegions::Event enum
36ca2e4 
https://bugs.webkit.org/show_bug.cgi?id=240206

Reviewed by Mark Lam.

We noticed that EventNames 260~ AtomStrings are allocated in scrolling thread only because we are using
eventNames() for EventTrackingRegions. But since use of it is limited, we can just use enum instead.

    1. We can make EventTrackingRegions more efficient by using enum instead of String.
    2. We can save memory by avoiding EventNames string allocations & AtomStringTable registration.
    3. We can make this parameter more strictly typed compared to accepting any kind of Strings

* Source/WebKit/Shared/RemoteLayerTree/RemoteScrollingCoordinatorTransaction.cpp:
(WebKit::dump):
* Source/WebKit/Shared/WebCoreArgumentCoders.cpp:
(IPC::ArgumentCoder<EventTrackingRegions>::decode):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp:
(WebKit::RemoteScrollingCoordinatorProxy::eventTrackingTypeForPoint const):
* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.h:
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::updateTouchEventTracking):
* Source/WebCore/page/DebugPageOverlays.cpp:
(WebCore::NonFastScrollableRegionOverlay::drawRect):
* Source/WebCore/page/Page.cpp:
(WebCore::Page::touchEventRectsForEventForTesting):
* Source/WebCore/page/Page.h:
* Source/WebCore/page/scrolling/ScrollingCoordinator.cpp:
(WebCore::ScrollingCoordinator::absoluteEventTrackingRegionsForFrame const):
* Source/WebCore/page/scrolling/ScrollingStateFrameScrollingNode.cpp:
(WebCore::ScrollingStateFrameScrollingNode::dumpProperties const):
* Source/WebCore/page/scrolling/ScrollingTree.cpp:
(WebCore::ScrollingTree::computeWheelProcessingSteps):
(WebCore::ScrollingTree::eventTrackingTypeForPoint):
* Source/WebCore/page/scrolling/ScrollingTree.h:
* Source/WebCore/platform/EventTrackingRegions.cpp:
(WebCore::EventTrackingRegions::eventName):
(WebCore::EventTrackingRegions::trackingTypeForPoint):
(WebCore::EventTrackingRegions::uniteSynchronousRegion):
* Source/WebCore/platform/EventTrackingRegions.h:
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::touchEventRectsForEvent):
* Source/WebCore/testing/Internals.h:

Canonical link: https://commits.webkit.org/250405@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293967 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@shallawa
[macOS] REGRESSION (r293825): Find highlight snapshots are incorrectl…
c15b51e 
…y scaled

https://bugs.webkit.org/show_bug.cgi?id=240203
rdar://92892014

Reviewed by Tim Horton.

Source/WebCore:

takeSnapshots() depends on the snapshot ImageBuffer::resolutionScale() to
set the size of the TextIndicatorData image. r293825 scaled the size of
the ImageBuffer before creation and moved the scaling to the GraphicsContext.
So we have correct scaled pixels but the resolutionScale is 1. So we get
enlarged incorrect image.

The fix is to revert r293825 and fix the iOS snapshot without having to
change snapshotFrameRectWithClip().

* page/FrameSnapshotting.cpp:
(WebCore::snapshotFrameRectWithClip):

Source/WebKit:

In getShareableBitmapForImageBufferWithQualifiedIdentifier(), we used to
pass the backendSize as the srcRect and the backendSize as the destRect
to GraphicsContext::drawImageBuffer(). The backendSize is the logicalSize
scaled by the resolutionScale. But in ImageBufferCGBackend::draw() we
scale the srcRect by the resolutionScale one more time. This double-
scaled srcRect draws a srcRect whose size = backendSize * resolutionScale
to a destRect whose size = backendSize. And this results in shrinking the
desired snapshot image by 1 / resolutionScale.

* GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::RemoteRenderingBackend::getShareableBitmapForImageBufferWithQualifiedIdentifier):

Canonical link: https://commits.webkit.org/250406@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293968 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@dpino
Unreviewed, non-unified build fixes after r293562
b5e068b 
Source/WebCore:

* workers/shared/context/SharedWorkerThread.cpp:
* workers/shared/context/SharedWorkerThreadProxy.cpp:

Source/WebKit:

* NetworkProcess/SharedWorker/WebSharedWorkerServerConnection.h:
* WebProcess/Storage/WebSharedWorkerContextManagerConnection.cpp:
(WebKit::WebSharedWorkerContextManagerConnection::launchSharedWorker):

Source/WTF:

* wtf/text/StringCommon.h:

Canonical link: https://commits.webkit.org/250407@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293969 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@mrego
[WinCairo][WK1] accessibility/aria-combobox-control-owns-elements.htm…
de1f1bf 
…l is crashing after 250325@main

https://bugs.webkit.org/show_bug.cgi?id=240218
<rdar://problem/92929718>

Reviewed by Joanmarie Diggs.

Source/WebCore:

Fix a wrong ASSERT for AriaReflectionForElementReferencesEnabled.
If AriaReflectionForElementReferencesEnabled is disabled, and you set
one of the attributes that have reflection under that flag,
we'll hit an ASSERT in Element::attributeChanged().

The fact that we set such attribute doesn't mean that the flag
has to be enabled.

Removed the ASSERT and added an if to check if the flag is enabled,
otherwise we don't need to do anything with the map.

* dom/Element.cpp:
(WebCore::Element::attributeChanged):

LayoutTests:

* platform/wincairo-wk1/TestExpectations: Mark test as timeout as it
was before r293958.

Canonical link: https://commits.webkit.org/250408@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293970 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@magomez
[Nicosia] Canvas animations don't work with threaded rendering
87fc693 
https://bugs.webkit.org/show_bug.cgi?id=227760
<rdar://problem/80588913>

Reviewed by Adrian Perez de Castro.

Implement Nicosia::CairoOperationRecorder::draImageBuffer(), which is required in order to paint
canvas contents into a GraphicsContext.

* platform/graphics/nicosia/cairo/NicosiaCairoOperationRecorder.cpp:
(Nicosia::CairoOperationRecorder::drawImageBuffer):

Canonical link: https://commits.webkit.org/250409@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293971 268f45cc-cd09-0410-ab3c-d52691b4dbfc
@youennf
CoreAudioCaptureSource::settingsDidChange should not reconfigure the …
ccd2a70 
…audio unit if CoreAudioCaptureSource is not started

https://bugs.webkit.org/show_bug.cgi?id=240059

Reviewed by Eric Carlson.

We should only ask to reconfigure when source settings change if the source is actually started.
Otherwise, we can wait for the source to start to actually set the unit values and reconfigure if needed.
To make sure to correctly expose settings, we reset them in CoreAudioCaptureSource::settingsDidChange and in
CoreAudioCaptureSource::initializeToStartProducingData.
We also only use the audio unit sample rate if it is rendering audio, otherwise we can change the sample rate at will.

Manually tested.

* platform/mediastream/mac/CoreAudioCaptureSource.cpp:

Canonical link: https://commits.webkit.org/250410@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@293972 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Jarred-Sumner pushed a commit that referenced this pull request Jan 29, 2023
@Constellation
[JSC] Support wasm frames in btjs
560bfa8 
https://bugs.webkit.org/show_bug.cgi?id=251063
rdar://104585575

Reviewed by Mark Lam and Justin Michaud.

This patch enhances CallFrame::dump to support wasm frames in btjs stacktrace.
The example is as follows.

    frame #0: 0x00000001035fca78 JavaScriptCore`JSC::functionBreakpoint(globalObject=0x000000012f410068, callFrame=0x000000016fdfa9d0) at JSDollarVM.cpp:2273:9 [opt]
    frame #1: 0x000000010ec44204 0x10eccc5dc
    frame #2: 0x000000010eccc5dc callback#Dwaxn6 [Baseline bc#50](Undefined)
    frame #3: 0x000000010ec4ca84 wasm-stub [WasmToJS](Wasm::Instance: 0x10d29da40)
    frame #4: 0x000000010ed0c060 <?>.wasm-function[1] [OMG](Wasm::Instance: 0x10d29da40)
    frame #5: 0x000000010ed100d0 jsToWasm#CWTx6k [FTL bc#22](Cell[JSModuleEnvironment]: 0x12f524540, Cell[WebAssemblyFunction]: 0x10d06a3a8, 1, 2, 3)
    frame #6: 0x000000010ec881b0 #D5ymZE [Baseline bc#733](Undefined, Cell[Generator]: 0x12f55c180, 1, Cell[Object]: 0x12f69dfc0, 0, Cell[JSLexicalEnvironment]: 0x12f52cee0)
    frame #7: 0x000000010ec3c008 asyncFunctionResume#A4ayYg [LLInt bc#49](Undefined, Cell[Generator]: 0x12f55c180, Cell[Object]: 0x12f69dfc0, 0)
    frame #8: 0x000000010ec3c008 promiseReactionJobWithoutPromise#D0yDF1 [LLInt bc#25](Undefined, Cell[Function]: 0x12f44f3c0, Cell[Object]: 0x12f69dfc0, Cell[Generator]: 0x12f55c180)
    frame #9: 0x000000010ec80ec0 promiseReactionJob#EdShZz [Baseline bc#74](Undefined, Undefined, Cell[Function]: 0x12f44f3c0, Cell[Object]: 0x12f69dfc0, Cell[Generator]: 0x12f55c180)
    frame #10: 0x000000010ec3c728
    frame #11: 0x0000000103137560 JavaScriptCore`JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) [inlined] JSC::JITCode::execute(this=<unavailable>, vm=<unavailable>, protoCallFrame=<unavailable>) at JITCodeInlines.h:42:38 [opt]
    frame #12: 0x0000000103137524 JavaScriptCore`JSC::Interpreter::executeCall(this=<unavailable>, lexicalGlobalObject=<unavailable>, function=<unavailable>, callData=<unavailable>, thisValue=<unavailable>, args=<unavailable>) at Interpreter.cpp:1093:27 [opt]
    frame #13: 0x000000010349d6d0 JavaScriptCore`JSC::runJSMicrotask(globalObject=0x000000012f410068, identifier=(m_identifier = 81), job=JSValue @ x22, argument0=JSValue @ x26, argument1=JSValue @ x25, argument2=<unavailable>, argument3=<unavailable>) at JSMicrotask.cpp:98:9 [opt]
    frame #14: 0x00000001039dfc54 JavaScriptCore`JSC::VM::drainMicrotasks() (.cold.1) at VM.cpp:0:9 [opt]
    frame #15: 0x00000001035e58a4 JavaScriptCore`JSC::VM::drainMicrotasks() [inlined] JSC::MicrotaskQueue::dequeue(this=<unavailable>) at VM.cpp:0:9 [opt]
    frame #16: 0x00000001035e5894 JavaScriptCore`JSC::VM::drainMicrotasks(this=0x000000012f000000) at VM.cpp:1255:46 [opt]
    ...

* Source/JavaScriptCore/interpreter/CallFrame.cpp:
(JSC::CallFrame::dump const):

Canonical link: https://commits.webkit.org/259262@main
Jarred-Sumner pushed a commit that referenced this pull request May 9, 2024
@robert-jenner
[Gardening][site-isolation] Attempt #4 Enable more tests to run in si…
22dd032 
…te-isolation

rdar://127515199
https://bugs.webkit.org/show_bug.cgi?id=273715

Unreviewed test gardening.

* LayoutTests/platform/mac-site-isolation/TestExpectations:

Canonical link: https://commits.webkit.org/278516@main
Jarred-Sumner pushed a commit that referenced this pull request Jun 25, 2024
@alanbaradlay
Crash under RenderObject::createVisiblePosition() while dragging the …
883886e 
…volume scrubber on a video player

https://bugs.webkit.org/show_bug.cgi?id=275469
<rdar://129080145>

Reviewed by Antti Koivisto.

1. In EventHandler::mouseDragged we dispatch the "mouse move" event
2. JS triggers some mutation which makes the tree dirty
3. later in EventHandler::handleMouseMoveEvent() we call EventHandler::handleMouseDraggedEvent() (tree is dirty)
   which, through a few layers of functions calls VisiblePosition::canonicalPosition()
4. VisiblePosition::canonicalPosition() needs a clean tree so it calls Document::updateLayout() which is turn destroys some renderers (see #2)
5. In-between EventHandler::handleMouseDraggedEvent() and VisiblePosition::canonicalPosition(), we CheckPtr a renderer which gets destroyed at #4.

The fix (what we normally do with cases like this) is to make sure we clean the tree before entering VisiblePosition.

* Source/WebCore/page/EventHandler.cpp:
(WebCore::EventHandler::handleMouseDraggedEvent):

Canonical link: https://commits.webkit.org/280013@main
dylan-conway pushed a commit that referenced this pull request Sep 12, 2024
@Constellation
[JSC] ObjectAllocationSinking should not omit phi insertion when poin…
ba44420 
…ter follows to the same value

https://bugs.webkit.org/show_bug.cgi?id=279570
rdar://135851156

Reviewed by Keith Miller.

Let's consider the following FTL graph.

    BB#0
    @0 = NewObject()
    Jump #1

    BB#1
    PutByOffset(@0, 0, @x)
    Jump #2

    BB#2
    ...
    @z = ...
    @1 = GetByOffset(@x, 0)
    Branch(@1, #3, #4)

    BB#3
    PutByOffset(@0, 0, @z)
    Jump #5

    BB#4
    PutByOffset(@0, 0, @z)
    Jump #5

    BB#5
    Jump #2

Now, we would like to eliminate @0 object allocation. And we are
computing SSA for pointers of fields of the that object which gets
eliminated. Consider about @x's fields' SSA. PutByOffset becomes Def
and GetByOffset becomes Use. And the same field will get the same SSA
variable. So we first puts Defs and compute Phis based on that.

In ObjectAllocationSinking phase, we had a fast path when the both SSA
variable is following to the same value. Let's see BB#5. Because BB#3
and BB#4 defines Defs, dominance frontier BB#5 will need to introduce
Phi. But interestingly, both SSA variable is following to the same @z.
As a result, we were not inserting Phi for this case.

But this is wrong. Inserted Phi is a Def, and based on that, we will
further introduce Phis with that. If we omit inserting Phi in BB#5,
we will not insert Phi into BB#2 while BB#2 will merge BB#1's Def And
BB#5's Phi's Def. As a result, in BB#2, we think this variable is
following to BB#1's Def. But that's wrong and BB#5's Phi exists.

This patch removes this fast path to fix the issue.

* JSTests/stress/object-allocation-sinking-phi-insertion-for-pointers.js: Added.
(Queue):
(Queue.prototype.enqueue):
(Queue.prototype.dequeue):
(i.queue.dequeue):
* Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp:

Canonical link: https://commits.webkit.org/283558@main
Jarred-Sumner pushed a commit that referenced this pull request Feb 21, 2025
@msaboff
[Yarr] Improve processing of an alternation of strings
12c34ef 
https://bugs.webkit.org/show_bug.cgi?id=288102
rdar://145222010

Reviewed by Yusuke Suzuki.

Added the notion of a string list to a parsed RegExp that is in the form of
  /^(?:break|case|which|do|for)/ with an optional trailing $.
Such a RegExp will not backtrack and therefore we can streamline the code we emit for such a pattern.

This change involves recognizing beginning of string anchored alternations of strings while parsing and
then treating the generation of JIT code differently for these patterns.  This includes changing how
conditional branching works, specifically that instead of the "fall through on match" for each term,
to a "jump on match" for the whole alternation.

The current code generated for the "case" elternative is:
   8:Term PatternCharacter checked-offset:(3) 'c'
               <156> 0x11381430c:    add      w1, w1, #2
               <160> 0x113814310:    cmp      w1, w2
               <164> 0x113814314:    b.hi     0x113814444 -> <468>
  10:Term PatternCharacter checked-offset:(4) 'c'
               <168> 0x113814318:    sub      x17, x0, #4
               <172> 0x11381431c:    ldr      w17, [x17, x1]
               <176> 0x113814320:    movz     w16, #0x6163
               <180> 0x113814324:    movk     w16, #0x6573, lsl #16 -> 0x65736163
               <184> 0x113814328:    cmp      w17, w16
               <188> 0x11381432c:    b.ne     0x113814444 -> <468>
  11:Term PatternCharacter checked-offset:(4) 'a' already handled
  12:Term PatternCharacter checked-offset:(4) 's' already handled
  13:Term PatternCharacter checked-offset:(4) 'e' already handled
  14:NestedAlternativeNext minimum-size:(5),checked-offset:(5)
               <192> 0x113814330:    movz     x16, #0x4444
               <196> 0x113814334:    movk     x16, #0x1381, lsl #16
               <200> 0x113814338:    movk     x16, #0x8001, lsl #32
               <204> 0x11381433c:    movk     x16, #0xc973, lsl #48 -> 0x113814444 JIT PC
               <208> 0x113814340:    stur     x16, [sp, #8]
               <212> 0x113814344:    b        0x113814404 -> <404>
With some additional backtracking code:
   9:NestedAlternativeNext minimum-size:(4),checked-offset:(4)
               <468> 0x113814444:    sub      w1, w1, #2
               <472> 0x113814448:    b        0x113814348 -> <216>

With this change, the processing of "case" becomes:
   9:StringListAlternativeNext minimum-size:(4),checked-offset:(4)
               <132> 0x12a8285c4:    sub      w1, w1, #1
               <136> 0x12a8285c8:    cmp      w1, w2
               <140> 0x12a8285cc:    b.hi     0x12a8285e8 -> <168>
  10:Term PatternCharacter checked-offset:(4) 'c'
               <144> 0x12a8285d0:    sub      x17, x0, #4
               <148> 0x12a8285d4:    ldr      w17, [x17, x1]
               <152> 0x12a8285d8:    movz     w16, #0x6163
               <156> 0x12a8285dc:    movk     w16, #0x6573, lsl #16 -> 0x65736163
               <160> 0x12a8285e0:    cmp      w17, w16
               <164> 0x12a8285e4:    b.eq     0x12a82866c -> <300>
  11:Term PatternCharacter checked-offset:(4) 'a' already handled
  12:Term PatternCharacter checked-offset:(4) 's' already handled
  13:Term PatternCharacter checked-offset:(4) 'e' already handled
  14:StringListAlternativeNext minimum-size:(5),checked-offset:(5)
With no backtracking code.

We are able to eliminate one branch and the saving of the continuation PC for backtracking.
The code size to process these string list RegExp is reduces.  For the example RegExp above,
the prior version created 1940 bytes (485 instructions) of code while the code created with this
1392 bytes (345 instructions) of code, a nearly 30% reduction in code.

This change is a ~18% progression on the new regexp-keyword-parsing microbenchmark:

                                 Baseline               YarrStringList

regexp-keyword-parsing      136.7065+-0.9807     ^    116.0161+-1.1791        ^ definitely 1.1783x faster

<geometric>                 136.7065+-0.9807     ^    116.0161+-1.1791        ^ definitely 1.1783x faster

* JSTests/microbenchmarks/regexp-keyword-parsing.js: Added.
(arrayToString):
(objectToString):
(dumpValue):
(compareArray):
(compareGroups):
(testRegExp):
(testRegExpSyntaxError):
(let.re.break.case.catch.continue.debugger.default.else.finally.if):
(let.re1.break.case.catch.continue.debugger.default.else.finally.if):
* JSTests/stress/regexp-parsing-tokens.js: Added.
(arrayToString):
(objectToString):
(dumpValue):
(compareArray):
(compareGroups):
(testRegExp):
(testRegExpSyntaxError):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
* Source/JavaScriptCore/yarr/YarrPattern.cpp:
(JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
(JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
(JSC::Yarr::PatternAlternative::dump):
(JSC::Yarr::PatternTerm::dump):
* Source/JavaScriptCore/yarr/YarrPattern.h:
(JSC::Yarr::PatternTerm::PatternTerm):
(JSC::Yarr::PatternAlternative::PatternAlternative):

Canonical link: https://commits.webkit.org/290791@main
190n pushed a commit that referenced this pull request Feb 25, 2025
@msaboff
[Yarr] Improve processing of an alternation of strings
5d4feea 
https://bugs.webkit.org/show_bug.cgi?id=288102
rdar://145222010

Reviewed by Yusuke Suzuki.

Added the notion of a string list to a parsed RegExp that is in the form of
  /^(?:break|case|which|do|for)/ with an optional trailing $.
Such a RegExp will not backtrack and therefore we can streamline the code we emit for such a pattern.

This change involves recognizing beginning of string anchored alternations of strings while parsing and
then treating the generation of JIT code differently for these patterns.  This includes changing how
conditional branching works, specifically that instead of the "fall through on match" for each term,
to a "jump on match" for the whole alternation.

Fixed a bug in the original version where we weren't properly checking the nested alternatives to see
if they only contain fixed single count PatternCharacter terms.

The current code generated for the "case" elternative is:
   8:Term PatternCharacter checked-offset:(3) 'c'
               <156> 0x11381430c:    add      w1, w1, #2
               <160> 0x113814310:    cmp      w1, w2
               <164> 0x113814314:    b.hi     0x113814444 -> <468>
  10:Term PatternCharacter checked-offset:(4) 'c'
               <168> 0x113814318:    sub      x17, x0, #4
               <172> 0x11381431c:    ldr      w17, [x17, x1]
               <176> 0x113814320:    movz     w16, #0x6163
               <180> 0x113814324:    movk     w16, #0x6573, lsl #16 -> 0x65736163
               <184> 0x113814328:    cmp      w17, w16
               <188> 0x11381432c:    b.ne     0x113814444 -> <468>
  11:Term PatternCharacter checked-offset:(4) 'a' already handled
  12:Term PatternCharacter checked-offset:(4) 's' already handled
  13:Term PatternCharacter checked-offset:(4) 'e' already handled
  14:NestedAlternativeNext minimum-size:(5),checked-offset:(5)
               <192> 0x113814330:    movz     x16, #0x4444
               <196> 0x113814334:    movk     x16, #0x1381, lsl #16
               <200> 0x113814338:    movk     x16, #0x8001, lsl #32
               <204> 0x11381433c:    movk     x16, #0xc973, lsl #48 -> 0x113814444 JIT PC
               <208> 0x113814340:    stur     x16, [sp, #8]
               <212> 0x113814344:    b        0x113814404 -> <404>
With some additional backtracking code:
   9:NestedAlternativeNext minimum-size:(4),checked-offset:(4)
               <468> 0x113814444:    sub      w1, w1, #2
               <472> 0x113814448:    b        0x113814348 -> <216>

With this change, the processing of "case" becomes:
   9:StringListAlternativeNext minimum-size:(4),checked-offset:(4)
               <132> 0x12a8285c4:    sub      w1, w1, #1
               <136> 0x12a8285c8:    cmp      w1, w2
               <140> 0x12a8285cc:    b.hi     0x12a8285e8 -> <168>
  10:Term PatternCharacter checked-offset:(4) 'c'
               <144> 0x12a8285d0:    sub      x17, x0, #4
               <148> 0x12a8285d4:    ldr      w17, [x17, x1]
               <152> 0x12a8285d8:    movz     w16, #0x6163
               <156> 0x12a8285dc:    movk     w16, #0x6573, lsl #16 -> 0x65736163
               <160> 0x12a8285e0:    cmp      w17, w16
               <164> 0x12a8285e4:    b.eq     0x12a82866c -> <300>
  11:Term PatternCharacter checked-offset:(4) 'a' already handled
  12:Term PatternCharacter checked-offset:(4) 's' already handled
  13:Term PatternCharacter checked-offset:(4) 'e' already handled
  14:StringListAlternativeNext minimum-size:(5),checked-offset:(5)
With no backtracking code.

We are able to eliminate one branch and the saving of the continuation PC for backtracking.
The code size to process these string list RegExp is reduces.  For the example RegExp above,
the prior version created 1940 bytes (485 instructions) of code while the code created with this
1392 bytes (345 instructions) of code, a nearly 30% reduction in code.

This change is a ~18% progression on the new regexp-keyword-parsing microbenchmark:

                                 Baseline               YarrStringList

regexp-keyword-parsing      136.7065+-0.9807     ^    116.0161+-1.1791        ^ definitely 1.1783x faster

<geometric>                 136.7065+-0.9807     ^    116.0161+-1.1791        ^ definitely 1.1783x faster

* JSTests/microbenchmarks/regexp-keyword-parsing.js: Added.
(arrayToString):
(objectToString):
(dumpValue):
(compareArray):
(compareGroups):
(testRegExp):
(testRegExpSyntaxError):
(let.re.break.case.catch.continue.debugger.default.else.finally.if):
(let.re1.break.case.catch.continue.debugger.default.else.finally.if):
* JSTests/stress/regexp-parsing-tokens.js: Added.
(arrayToString):
(objectToString):
(dumpValue):
(compareArray):
(compareGroups):
(testRegExp):
(testRegExpSyntaxError):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
* Source/JavaScriptCore/yarr/YarrPattern.cpp:
(JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
(JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
(JSC::Yarr::PatternAlternative::dump):
(JSC::Yarr::PatternTerm::dump):
* Source/JavaScriptCore/yarr/YarrPattern.h:
(JSC::Yarr::PatternTerm::PatternTerm):
(JSC::Yarr::PatternAlternative::PatternAlternative):

Canonical link: https://commits.webkit.org/290982@main
Jarred-Sumner pushed a commit that referenced this pull request Mar 1, 2025
@the-chenergy
Web Inspector: Automatically connect Web Inspector to ServiceWorker
a85f489 
https://bugs.webkit.org/show_bug.cgi?id=264576
rdar://114997939

Reviewed by BJ Burg.

(This work was done in collaboration with Razvan and was based on his
draft at WebKit@377f3e1.)

This commit enables automatically inspecting and pausing the
ServiceWorkerDebuggable. The idea is similar to the same functionalities
with the JSContext/JSGlobalObjectDebuggable. The general flow is:
1. When the debuggable is first created, we optionally mark it as
   inspectable.
2. As soon as the debuggable is marked inspectable, its main thread
   (the thread that it was created on) gets blocked.
3. When the auto-launched Web Inspector frontend finishes initializing,
   it notifies the backend.
   - It's important for the debuggable to wait for this signal because
     a genuine auto-inspection must appear attached to the debuggable
     before it begins execution, respecting any breakpoints set early on
     in its script (where auto-pausing is basically a breakpoint
     before line 1).
4. The backend unpauses the blocked debuggable. If auto-pausing was
   requested, tell the debugger agent to pause.

The service worker begins executing script unless its worker thread was
specified to start in the WorkerThreadStartMode::WaitForInspector.
During that waiting period, the worker thread can perform tasks sent
into its debugging run loop, until it's signaled to stop waiting and
continue to execute the script like normal. This commit makes use of
that interface to make the service worker pause (when justified, i.e.
developerExtrasEnabled) before running the above flow resembling
auto-inspecting a JSContext.

* Source/WebCore/workers/service/context/ServiceWorkerThread.cpp:
(WebCore::threadStartModeFromSettings):
(WebCore::ServiceWorkerThread::ServiceWorkerThread):
   - When there is potentially a remote inspector that would like to
     auto-inspect, make it so that the thread waits on start before
     executing its script.

* Source/WebCore/workers/service/context/ServiceWorkerThreadProxy.h:
* Source/WebCore/workers/service/context/ServiceWorkerThreadProxy.cpp:
(WebCore::ServiceWorkerThreadProxy::ServiceWorkerThreadProxy):
(WebCore::ServiceWorkerThreadProxy::threadStartedRunningDebuggerTasks):
   - Setting inspectability is step #1 in the above flow.
   - In step #2, calling `debuggable->setInspectable(true)` might block
     already, but we don't want that until the worker thread is setup
     and have the run loop be in debug mode, so we do that in a callback
     instead.
   - In step #4, when connection to the inspector completes or fails,
     the setInspectable call only returns then, so we unblock
     the worker thread to resume code execution.

* Source/WebCore/inspector/agents/worker/WorkerDebuggerAgent.h:
* Source/WebCore/inspector/WorkerInspectorController.h:
* Source/WebCore/inspector/WorkerInspectorController.cpp:
(WebCore::WorkerInspectorController::frontendInitialized):
(WebCore::WorkerInspectorController::connectFrontend):
(WebCore::WorkerInspectorController::disconnectFrontend):
(WebCore::WorkerInspectorController::createLazyAgents):
(WebCore::WorkerInspectorController::ensureDebuggerAgent):
* Source/WebCore/workers/service/context/ServiceWorkerDebuggable.cpp:
(WebCore::ServiceWorkerDebuggable::connect):
* Source/WebCore/workers/service/context/ServiceWorkerInspectorProxy.h:
* Source/WebCore/workers/service/context/ServiceWorkerInspectorProxy.cpp:
(WebCore::ServiceWorkerInspectorProxy::connectToWorker):
   - Mimic the logic for auto-inspecting a JSContext/JSGlobalObjectDebuggable.

* Source/JavaScriptCore/inspector/protocol/Inspector.json:
   - Step #3 in the above flow, notify the backend when frontend
     completes setting up.

* Source/WebCore/workers/service/context/ServiceWorkerDebuggable.h:
  - Allow service workers to be auto-inspected. (This is checked at https://github.com/rcaliman-apple/WebKit/blob/eng/Web-Inspector-Automatically-connect-Web-Inspector-to-ServiceWorker/Source/JavaScriptCore/inspector/remote/RemoteInspectionTarget.cpp#L95)

* Source/WTF/wtf/PlatformEnableCocoa.h:
   - Add feature flag just in case.

Canonical link: https://commits.webkit.org/291167@main
robobun pushed a commit that referenced this pull request Jan 22, 2026
@hyjorc1
[JSC][WASM][Debugger] Avoid RefPtr operations during thread suspensio…
4a78281 
…n to fix deadlock

https://bugs.webkit.org/show_bug.cgi?id=305674
rdar://168319182

Reviewed by Yusuke Suzuki.

The WASM debugger can deadlock when Thread #8 suspends Thread #4 via
thread_suspend() while Thread #4 is in the middle of ref counting operations.
The suspended thread may hold a WordLock (used for thread-safe ref counting),
and when the suspending thread tries to create a RefPtr copy, it blocks
waiting for the same lock.

The deadlock sequence:
1. Thread #4 acquires WordLock in strongDeref() destructor
2. Thread #8 suspends Thread #4 via thread_suspend() Mach kernel trap
3. Thread #4 is frozen mid-unlock, WordLock never released
4. Thread #8's lambda calls vm.apiLock().ownerThread(), creating RefPtr copy
5. RefPtr copy triggers strongRef() which tries to acquire same WordLock
6. Deadlock: Thread #4 suspended holding lock, Thread #8 blocked waiting

The fix adds ownerThreadUID() methods that return the thread UID directly
without creating temporary RefPtr objects, avoiding all ref counting
operations and the associated lock contention.

Canonical link: https://commits.webkit.org/305766@main
@claude claude Bot mentioned this pull request Jun 12, 2026
Open
springmin pushed a commit to springmin/WebKit that referenced this pull request Jul 19, 2026
@lauromoura
[WebDriver] Improve driver logging coverage
a917f43 
https://bugs.webkit.org/show_bug.cgi?id=316798

Reviewed by BJ Burg.

To improve traceability, this commit adds RELEASE_LOG statements
covering the following areas of Source/WebDriver:

- Browser startup and lifetime (for glib ports)
- HTTP request and response
- Driver->Browser Automation.json commands and replies.

The added log statements cover mainly data like the request path, body
size, response status, and duration. The actual body with payload like
field values or JS code to be executed is omitted. For deeper
inspection, the existing LOG() statements that inspect the actual
payload are kept.

We opted for RELEASE_LOG instead of LOG due to the WebDriver-related
channels being low-volume in comparison to hotter ones internal to the
browser. On top of that, it should be easier for reporters to provide
release logs, helping get more useful bug reports.

Example output:

Started WebSocket BiDi server with host local and port 60782
Started HTTP server with host local and port 60781
HTTP request POST /session (body=303 bytes)
Spawning local browser: /sdk/webkit/WebKitBuild/WPE/Release/bin/MiniBrowser with 2 argument(s)
Connecting to RemoteInspector at 127.0.0.1:54821
Connected to RemoteInspector at 127.0.0.1:54821 after 1 attempt(s)
    SEND inspector oven-sh#1: Automation.createBrowsingContext (52 bytes)
    RECV inspector oven-sh#1: ok
HTTP response 200 in 196ms
HTTP request POST /session/fbc9c527-945d-4030-852e-50c5f1852557/url (body=43 bytes)
    SEND inspector oven-sh#2: Automation.resolveBrowsingContext (149 bytes)
    RECV inspector oven-sh#2: ok
    SEND inspector oven-sh#3: Automation.waitForNavigationToComplete (207 bytes)
    RECV inspector oven-sh#3: ok
    SEND inspector oven-sh#4: Automation.isShowingJavaScriptDialog (135 bytes)
    RECV inspector oven-sh#4: ok
    SEND inspector oven-sh#5: Automation.navigateBrowsingContext (212 bytes)
    RECV inspector oven-sh#5: ok
HTTP response 200 in 124ms

* Source/WebDriver/SessionHost.cpp:
(WebDriver::SessionHost::inspectorDisconnected):
(WebDriver::SessionHost::sendCommandToBackend):
(WebDriver::SessionHost::dispatchMessage):
* Source/WebDriver/WebDriverService.cpp:
(WebDriver::printUsageStatement):
(WebDriver::WebDriverService::run):
(WebDriver::WebDriverService::handleRequest):
* Source/WebDriver/glib/SessionHostGlib.cpp:
(WebDriver::SessionHost::launchBrowser):
(WebDriver::SessionHost::connectToBrowser):
(WebDriver::SessionHost::connectionDidClose):
(WebDriver::SessionHost::setTargetList):

Canonical link: https://commits.webkit.org/316784@main
springmin pushed a commit to springmin/WebKit that referenced this pull request Aug 3, 2026
@aperezdc
Update Skia to 2026-06-18 (741e480402db12ca9c9baf068d21991749b9964a)
3245b6b 
https://bugs.webkit.org/show_bug.cgi?id=320024

Unreviewed Skia update.

% git log --pretty='%h %s' 1717654ff51b534411f80c19c356f4aabb8d3721..741e480402db12ca9c9baf068d21991749b9964a
741e480402 [graphite] Specialize colorspace conversions more
6fc9900b00 [graphite] Set labels on MTLDepthStencilState objects
f571b44f35 [graphite] Guard call to setFailureResultForFinishedProc if Recording is null
66ff2b6da1 Roll ANGLE from 7ed31165b1c1 to 317ae3119bf1 (8 revisions)
42dccc8774 Roll Skia Infra from 7da602a3d377 to dce9b47ff97e (16 revisions)
ab3af195f0 Roll debugger-app-base from e8f6bad3ec15 to 7d52f7d9b6c7
2c943903bf Roll vulkan-deps from c7b30c06b593 to 4210d7fc52f6 (14 revisions)
8cbe9fea4e Manual roll ANGLE from d2c3236e24be to 7ed31165b1c1 (12 revisions)
b97d56c11b Fix ordering of file names
766f21ae61 Move SkEnumBitMask.h from src/core to include/private
cc90b9d472 Roll recipe dependencies (trivial).
5fbb9bbd88 Roll recipe dependencies (trivial).
1ae2466c9e Specialize sk_is_trivially_relocatable for raw_ptr and raw_ref
486a611577 Roll vulkan-deps from a1cacc287360 to c7b30c06b593 (3 revisions)
fab98382a2 Add MiraclePtr exclusion annotations for C ABI structs
ec7a1e1ff8 Support explicit "unknown" chunks in `SkPngRustCodec`
6e84902d56 Roll Dawn from cb71d4a32458 to cbf8e7390fe1 (23 revisions)
db07f74520 Roll ANGLE from 9464aca6502c to d2c3236e24be (27 revisions)
127db09779 Roll Skia Infra from c7f1fbb895a5 to 7da602a3d377 (30 revisions)
84f36b024c Roll SwiftShader from 5b0479bd2d15 to 2843cbcc714f (1 revision)
90e4619a6c Roll debugger-app-base from ecbc8d84afd7 to e8f6bad3ec15
046277850e Roll jsfiddle-base from 2b12e98d3730 to 3c8958265e84
8dd207d443 Roll vulkan-deps from 9bb7338f0e04 to a1cacc287360 (13 revisions)
b6c7a5bc83 Reland "[Ganesh] TextureOp quad illegal memory access"
f5a2921fe2 Re-enable copyright formatting in presubmit
066bfbac72 [graphite] Track resources before adding barriers to VulkanCommandBuffer
9c7d18a286 Backfill SkQP CtsEnforcement::kNextRelease bump to 202704
5d19002eb7 Add error handling and initialization to the DWFM
79f93fd5f3 Roll vulkan-deps from 8dc044c0ebf3 to 9bb7338f0e04 (4 revisions)
026f6a6be2 Roll ANGLE from 227bb03bda93 to 9464aca6502c (18 revisions)
af00e308db Roll Skia Infra from c0a69acfa708 to c7f1fbb895a5 (18 revisions)
e5b1bd57b0 Roll Dawn from c5326b9181c6 to cb71d4a32458 (3 revisions)
f4bfdaade5 Use regular ICU function names in SkBidiFactory_icu_subset.cpp
481c18d8a1 Roll recipe dependencies (trivial).
da379fdf72 Handle w<=0 conics
5e976cb2f0 Revert "[Ganesh] TextureOp quad illegal memory access"
000c7129c9 Roll recipe dependencies (trivial).
6d4b5da00e Roll recipe dependencies (trivial).
92e1602cd0 Roll vulkan-deps from e5233e15a0ea to 8dc044c0ebf3 (6 revisions)
2ffd155313 CanvasKit: Add a wrapper for SkPathBuilder::setFillType that does not clone the SkPathBuilder
30031df246 Refactor PNG gainmap support to `SkPngCodecBase`
7b3761e8e8 [infra] MacMinis on 14.7 were updated to 14.8
ce2b7315cc Manual roll Dawn from 5dad4a08d684 to c5326b9181c6 (27 revisions)
b046b341fc [graphite] Disable blending for inner fills
789ec7583e [Fonts] Add EBDT/EBLC monochrome bitmap support to Fontations backend
4b24321eb3 [Fonts] Add EBDT monochrome bitmap test font generation
ba79ddd3c8 [infra] Remove GalaxyS9, Nexus7, and Pixel10 tasks
148b2b1948 [Ganesh] TextureOp quad illegal memory access
d7196b0b49 Add missing file for opts target
9c2b837884 Roll recipe dependencies (trivial).
ef17057bb7 Roll vulkan-deps from 6fd80c6ab534 to e5233e15a0ea (10 revisions)
500025456b Roll ANGLE from 81a96a84e6e6 to 227bb03bda93 (17 revisions)
ad2d02546f Roll Skia Infra from 09ad6a8da9bf to c0a69acfa708 (11 revisions)
5ff1316f4e Roll recipe dependencies (trivial).
d2addcfb3b Roll recipe dependencies (trivial).
c1215a40c1 Roll recipe dependencies (trivial).
cb1035ff14 Roll recipe dependencies (trivial).
3b92263daf Roll vulkan-deps from 5d7fd70ddbd6 to 6fd80c6ab534 (5 revisions)
8f6c453abc Roll recipe dependencies (trivial).
70acf6a5e7 Revert "Specialize sk_is_trivially_relocatable for raw_ptr and raw_ref"
1f40c1099b Generate dawn_files.bzl dynamically instead of hardcoding the lists
53fb0da879 Add some pixel buffer sizing asserts to SkWuffsCodec
98677a483d Fix Bazel build visibility
c8d9f80f13 [Fontations] Roll Fontations
7128af6057 Roll recipe dependencies (trivial).
6b4ac3bfb3 Roll recipe dependencies (trivial).
3c88455963 Roll Skia Infra from f8dc57844d37 to 09ad6a8da9bf (14 revisions)
1a85d00c61 Roll Dawn from 9533d3296a2a to 5dad4a08d684 (1 revision)
2516121f2c Roll vulkan-deps from fdbd11044b7e to 5d7fd70ddbd6 (3 revisions)
4dd566c83d Roll debugger-app-base from fd083daaa58b to ecbc8d84afd7
6478f8ec2b Roll jsfiddle-base from ab54cf0d0a66 to 2b12e98d3730
945d11ef39 Roll shaders-base from 9f862803ee5b to 2ca02a2612d9
0a3b8549cb Roll skottie-base from a61634294908 to 870493f76166
f46928e7f5 Roll vulkan-deps from 7bfc18a5a2d4 to fdbd11044b7e (1 revision)
4e2c9b5e4d Roll SKP CIPD package from 564 to 565
c526676072 Manual roll ANGLE from 8e09325ebad4 to 81a96a84e6e6 (10 revisions)
139c8c1f65 Manual roll Dawn from 181bf8634c1d to 9533d3296a2a (11 revisions)
42355271a3 Roll vulkan-deps from 973a663c1394 to 7bfc18a5a2d4 (4 revisions)
9ef46390c2 Roll vulkan-deps from d8ab95e03469 to 973a663c1394 (10 revisions)
60bc1a3fae Fix merge issues with src/base rename
ba3ee9b265 Resolved a Data Race on fStream in SkTypeface_Mac
fc46d066b5 Move files from src/base to src/core
6a4be3addd [graphite] Use stable collection for static bindings
1bef4577a7 Roll ICU to 78.2
8c89bf2b0e Roll recipe dependencies (trivial).
ac22a35e25 Specialize sk_is_trivially_relocatable for raw_ptr and raw_ref
282e2123d0 Roll recipe dependencies (trivial).
81a3d4583c Roll vulkan-deps from d3bbae038752 to d8ab95e03469 (6 revisions)
73e00cc3ee Export SkFontMgr::Request methods across the DLL boundary
cadbde1ec4 Roll Skia Infra from 6f4bd209e70a to f8dc57844d37 (10 revisions)
e44ad36fad Roll ANGLE from 2b192e062b1d to 8e09325ebad4 (15 revisions)
e26379234c Roll fiddler-base from 51e85c2ffa70 to 0231316fe504
0a80bfee0d Roll jsfiddle-base from 7331278a3593 to ab54cf0d0a66
f3cca00771 Roll Dawn from dbeb90630035 to 181bf8634c1d (17 revisions)
48a20bbdfd Roll debugger-app-base from 0aa48372c923 to fd083daaa58b
62df060cfb Roll recipe dependencies (trivial).
cd9b570850 Roll recipe dependencies (trivial).
a8f381f1eb Roll recipe dependencies (trivial).
a2228b926c Roll recipe dependencies (trivial).
0c0df6e447 [infra] Don't push nonexistent lottie-samples asset for SkottieTracing
7326aa2867 Roll vulkan-deps from eb0415a66313 to d3bbae038752 (6 revisions)
093ecf7606 Roll recipe dependencies (trivial).
9e1db2ce88 Roll recipe dependencies (trivial).
f61acb31ed Enable dangling pointer detector in Skia
bd2c7ecd8a Reapply "[infra] Use "adb push --sync" to copy to Android devices"
398922b044 Revert "[infra] Use "adb push --sync" to copy to Android devices"
9eb91ed6e4 [infra] Use "adb push --sync" to copy to Android devices
82e4c1b1a2 Roll vulkan-deps from 1ebd280d7a28 to eb0415a66313 (6 revisions)
d963571e92 Roll ANGLE from 0c063596e689 to 2b192e062b1d (8 revisions)
d0777b67d9 Roll Skia Infra from 9aaa7e56e7b8 to 6f4bd209e70a (14 revisions)
1a4d3fe60a Roll Dawn from 926483c39198 to dbeb90630035 (20 revisions)
99c18e9172 Roll recipe dependencies (trivial).
d2b9e48baf Move `include/private/base` to `include/private`.
69bf37867c Roll vulkan-deps from f253d7659dd3 to 1ebd280d7a28 (9 revisions)
eabdf12318 Fix AGTM PCHIP slopes for duplicate points
fc2311fe73 Roll ANGLE from 7f76f214a5a4 to 0c063596e689 (17 revisions)
887ee0a584 Roll Skia Infra from 5feb27468419 to 9aaa7e56e7b8 (55 revisions)
62e5a74536 Roll debugger-app-base from d2178d1c149d to 0aa48372c923
c4c7ea815f Roll Dawn from 841e08144fb8 to 926483c39198 (40 revisions)
4c122c0a97 Roll jsfiddle-base from d568314f3014 to 7331278a3593
618ec49cff Roll vulkan-deps from e97d808085af to f253d7659dd3 (5 revisions)
5faf4562e7 Roll recipe dependencies (trivial).
9f02102df2 [skcapture] Refactor Image and Surface to track SkPixelStorage directly
3e71fda50b Make agents build Skia with less noise
a97920edbc [graphite] Support affine transform and more corner radii in rrect clip
0a2804c8c1 Roll Skia Infra from aa3b5a254aa6 to 5feb27468419 (21 revisions)
9c5ec22c5c Roll vulkan-deps from 2f96412cd516 to e97d808085af (3 revisions)
e7265e9417 [infra] Fix RecreateSKPs
d0b99494e5 Added a strided/scattered glyph advance access function
65f3587693 Roll ANGLE from dc32cd831434 to 7f76f214a5a4 (7 revisions)
7b5147b152 Roll Dawn from 58263faefe3c to 841e08144fb8 (14 revisions)
aeed11c350 Roll SwiftShader from d26a3e6606c0 to 5b0479bd2d15 (1 revision)
065b3bea39 Roll jsfiddle-base from 9e1524dc815b to d568314f3014
fcab6babf1 Roll debugger-app-base from 8e5327247e09 to d2178d1c149d
688ca258ab Roll vulkan-deps from 537ea5cb1a35 to 2f96412cd516 (9 revisions)
f6a9a592ef Created an RAII Wrapper for SkCanvas->fScratchGlyphRunBuilder
0a882a1e07 [ganesh] Fix AsyncReadPixelsContextShutdown expectation on protected contexts
eac15152bf Avoid improper mask formats for SDFT runs
c1dde7b585 Reland oven-sh#4 "MiraclePtr: Add raw_ptr definitions"
560143de0a Reland "Add public API to query a serialized key for external format usage"
51992f3120 Add GM to test new Graphite rrect clip support
22c683d223 [ganesh] Track async task execution for callbacks
43f1357351 [graphite] Add DrawAtlas Indirection Types
9d94f46e7f Use an assert release on stride length
01e9da83b6 Roll partition_alloc
0ea3dae686 Roll vulkan-deps from 646f0b0196b1 to 537ea5cb1a35 (6 revisions)
d17c51db4e Roll ANGLE from 0bcdad042d68 to dc32cd831434 (6 revisions)
b415735a0e Roll Dawn from 23cf554e645f to 58263faefe3c (2 revisions)
9659a87f50 Roll skottie-base from 867c02555f37 to a61634294908
a56d5a4e11 Roll vulkan-deps from 11839f4fa73a to 646f0b0196b1 (2 revisions)
101faf7d9d Roll vulkan-deps from 940d8e3840d0 to 11839f4fa73a (1 revision)
294ac0cb2a Roll vulkan-deps from 763d7fb65f73 to 940d8e3840d0 (1 revision)
08e68cc65a Manual roll Dawn from a36d189db2e8 to 23cf554e645f (11 revisions)
91ee612cf5 Roll vulkan-deps from 8b51d6332f98 to 763d7fb65f73 (9 revisions)
a145861ad1 Reject Slugs that have creationMatrix with perspective
9eecbdc30f Manual roll ANGLE from 1184faa057e3 to 0bcdad042d68 (8 revisions)
cd4b3739bd Roll vulkan-deps from 78036a90f143 to 8b51d6332f98 (5 revisions)
a47a9a2c8a Avoid ULP issue on big rrects
6e003d7f69 Revert "Add public API to query a serialized key for external format usage"
d3e581be96 Roll ANGLE from 8240611f3d68 to 1184faa057e3 (10 revisions)
494f1bf55f Roll Dawn from 075626b4b324 to a36d189db2e8 (16 revisions)
1b96a90703 Roll vulkan-deps from 69c770f1ec4d to 78036a90f143 (7 revisions)
59556fdb8c Revert "[graphite] use textureSize intrinsic instead of uniforms"
8eb107046f Add public API to query a serialized key for external format usage
928ded2a31 Avoid chopping cubics with w=0
0df2ab117e Roll recipe dependencies (trivial).
9d4ed11e54 Revert "[graphite] hoist textureSize call out of switch statement"
fd7a0a9ea1 Add staging SkMalloc.h file to private includes
dcf3ebf072 [ganesh] Prevent overflow in StrokeTessellateOp
fec0c21c76 [infra] Remove Mac12 jobs
cecc0e0da9 Roll vulkan-deps from 090b0d3106c4 to 69c770f1ec4d (1 revision)
611e3f8ceb Roll Skia Infra from a4cbcf5ccc36 to aa3b5a254aa6 (8 revisions)
6dfa39c8eb Roll ANGLE from 1a7742a98d71 to 8240611f3d68 (10 revisions)
c4326e7c64 Roll Dawn from fac99d48e5f5 to 075626b4b324 (17 revisions)
0e73eb4da5 Roll debugger-app-base from d263d5e89fa5 to 8e5327247e09
4fdb859c8d Roll jsfiddle-base from e97ab14ddb65 to 9e1524dc815b
c42efa24f1 Roll recipe dependencies (trivial).
0020aae33f Roll vulkan-deps from 85acfedb927a to 090b0d3106c4 (4 revisions)
c21280541a Add agent skills for dealing with fuzz issues
3151df0dc0 [graphite] Consistently ignore path inversion when stroking
4d00e2b30d Revert "SkFlattenable::Register now performs a sorted insert"
5f56f9c9c7 Fix assertion in GetLoopUnrollInfo
2dfc12e0af Remove SafeStack jobs
3e4a1af226 Manual roll Dawn from 447aee490e30 to fac99d48e5f5 (6 revisions)
349f974b14 SkFlattenable::Register now performs a sorted insert
641cdb6aed Avoid underflow in modulo in loops
46a16fa03a [ganesh] Fix maxLCDOffset calculation
d114bf06df Improve agent docs for gn builds
86241e8b8e Fix bazel Dawn build
2b8cfcc5ea [graphite] Disable blending for opaque kSrcOver w/o analytic coverage
1021f2559a Fix perspective handling in SmallPathRenderer
5b8678e808 Roll recipe dependencies (trivial).
ce34ec9371 Roll vulkan-deps from df40808ccc75 to 85acfedb927a (8 revisions)
6dedf863d3 Roll recipe dependencies (trivial).
bab903e97f Roll ANGLE from 196d1b79eadb to 1a7742a98d71 (18 revisions)
40394e55de Roll Skia Infra from 1c6aa5aaba53 to a4cbcf5ccc36 (19 revisions)
b2464cbb9b Roll Dawn from 63f25feec51e to 447aee490e30 (53 revisions)
d625048c85 Roll recipe dependencies (trivial).
c1dbe08654 Roll recipe dependencies (trivial).
4be5546ed8 Roll recipe dependencies (trivial).
403ba7f67e Roll recipe dependencies (trivial).
32da743297 Roll vulkan-deps from 24496a44b9f4 to df40808ccc75 (3 revisions)
d6cd9a774c Update Linux Clang to 22.1.0 (fixing MSAN)
81f3f56901 Roll recipe dependencies (trivial).
2c50fbfb03 [graphite] Guard SDF inset with define
8ff9bdc2a4 [graphite] Share ShaderCaps init code across backends
060555fd70 Merge 2 release notes into RELEASE_NOTES.md
d30d2a1958 Update Skia milestone to 151
bf6fa29148 Roll recipe dependencies (trivial).
279b17fe9f Roll ANGLE from 8a5e64de9fd3 to 196d1b79eadb (5 revisions)
86d685c697 Roll Skia Infra from 2da962880dc7 to 1c6aa5aaba53 (8 revisions)
e60d5c8a2f Roll debugger-app-base from c74d26054770 to d263d5e89fa5
eee0a5b472 Roll vulkan-deps from d418e8ba7c95 to 24496a44b9f4 (9 revisions)
70f9d90bc8 Roll recipe dependencies (trivial).
cb57d863c4 Roll recipe dependencies (trivial).
d7fa1dcd53 Roll recipe dependencies (trivial).
7ec37cf3ae Initialize variables in SkRemoteGlyphCacheTest
95dbfa24e0 Turn off LCD in SDF slugs when downscaling too far
8c8a82b7bd [graphite] hoist textureSize call out of switch statement
5a01ce655d Roll partition_alloc
aace90ee2e Manual roll ANGLE from c01fdb7503e3 to 8a5e64de9fd3 (8 revisions)
886ce5fe90 [bzl] Update dawn_files.bzl after Dawn roll
ed03b304e1 Make Windows ASAN use dynamic ASAN libraries not static ones
e4281d5a79 Roll vulkan-deps from b57006f9536e to d418e8ba7c95 (1 revision)
8f073c306e Manual roll Dawn from ce586f1e2a62 to 63f25feec51e (61 revisions)
c97e939eb5 Roll ANGLE from 31b176246d7e to c01fdb7503e3 (12 revisions)
90b8d641b2 Roll Skia Infra from db195a05b659 to 2da962880dc7 (4 revisions)
659b67960f Roll vulkan-deps from d8c0b6852f61 to b57006f9536e (4 revisions)
32b547c81b Roll vulkan-deps from dcdce5027a08 to d8c0b6852f61 (3 revisions)
91e53285f4 Roll vulkan-deps from b766d9ede7dd to dcdce5027a08 (1 revision)
33a1c4f3e0 Roll vulkan-deps from 016cfd464461 to b766d9ede7dd (5 revisions)
c0b70b7ffb Roll recipe dependencies (trivial).
0aee4675e0 [graphite] Fix null deref in QueueManager::addRecording when !Recording
d7a4ca22a9 Use std::make_unique where we aren't
c072b212e3 Use const references in a few more places
e202cf3ef8 Address potential MSAN issue in SkScalerContext
87c0eddb36 Fix SkVx::isFinite on new MSVC
9459b2f287 Fix docs for MSAN (and address 2 minor issues)
dc01525ac4 Roll vulkan-deps from 3cececf546e2 to 016cfd464461 (4 revisions)
04b084c10b Reland "[graphite] BufferSubAllocator respects failed mapping on reset"
b854499783 Reland "Reconstruct subRun bounds from glyphs"
c329e877d1 Revert "[graphite] BufferSubAllocator respects failed mapping on reset"
c480ba2eb2 Revert "Reconstruct subRun bounds from glyphs"
d9d6b440c4 Update deps for agents repos
4715553483 Roll ANGLE from 9566f50cb827 to 31b176246d7e (7 revisions)
087c3cc37c Roll vulkan-deps from 000daaa61385 to 3cececf546e2 (6 revisions)
c5de7569a5 Roll Skia Infra from 5c22c771f011 to db195a05b659 (8 revisions)
71c38003fc Roll SwiftShader from bea72feae3cf to d26a3e6606c0 (1 revision)
f93ed13d77 Reconstruct subRun bounds from glyphs
7a5bd9b331 Roll recipe dependencies (trivial).
8f47b24d40 Add core_skills.json for skia

Canonical link: https://commits.webkit.org/317806@main
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.