Upgrade to upstream WebKit 6b879687ee

.submitproject-append

@@ -5,6 +5,7 @@
     includedSubdirectoryPatterns = Tools/ImageDiff
     includedSubdirectoryPatterns = Tools/MiniBrowser
     includedSubdirectoryPatterns = Tools/TestRunnerShared
+    includedSubdirectoryPatterns = Tools/TestWebKitAPI
     includedSubdirectoryPatterns = Tools/WebKitTestRunner
     excludedSubdirectoryPatterns = Tools/WebKitTestRunner/gtk
     excludedSubdirectoryPatterns = Tools/WebKitTestRunner/glib

.wkdev-sdk-version

@@ -1 +1 @@
-2.53-v9-c666b76
+2.53-v11-80e4002

CMakeLists.txt

@@ -61,6 +61,12 @@ if (SWIFT_REQUIRED)
     endif ()
     add_compile_options($<$<COMPILE_LANGUAGE:Swift>:--original-swift-compiler=${ORIGINAL_Swift_COMPILER}>)
     add_link_options($<$<LINK_LANGUAGE:Swift>:--original-swift-compiler=${ORIGINAL_Swift_COMPILER}>)
+
+    if (APPLE)
+        # When Swift is used as a linker frontend, disable dSYM generation. The
+        # objects being linked still contain debug info.
+        add_link_options("$<$<LINK_LANGUAGE:Swift>:-gnone>")
+    endif ()
     # The static archive rule (<CMAKE_Swift_CREATE_STATIC_LIBRARY>) uses neither
     # <FLAGS> nor link options, so inject the flag directly into the template.
     string(REPLACE "<CMAKE_Swift_COMPILER>"

Configurations/CommonBase.xcconfig

@@ -137,13 +137,10 @@ WK_SWIFT_MEMORY_SAFETY_ERROR_FLAGS[sdk=*26.3*] = ;
 // rdar://168992837 requires us to tell swiftc to tell clang how to set version macros
 // when interpreting C++ headers as clang modules, so that we get identical feature
 // enablement to C++ interpretation of those headers (otherwise we get mismatched data members etc.)
-WK_SWIFT_CLANG_DEPLOYMENT_TARGET = $(WK_SWIFT_CLANG_DEPLOYMENT_TARGET_$(WK_PLATFORM_NAME);
+WK_SWIFT_CLANG_DEPLOYMENT_TARGET = $(WK_SWIFT_CLANG_DEPLOYMENT_TARGET_$(WK_PLATFORM_NAME));
 WK_SWIFT_CLANG_DEPLOYMENT_TARGET_macosx = -clang-target $(CURRENT_ARCH)-apple-macos$(MACOSX_DEPLOYMENT_TARGET);
 
 // rdar://170129992: remove -track-system-dependencies when resolved
-OTHER_SWIFT_FLAGS = $(inherited) $(WK_AVAILABILITY_OVERLAY_SWIFT_FLAGS) -Xcc -fvisibility=hidden -Werror ExistentialAny -Werror NoUseUnstructuredThrowingTask -Werror NoUsage -enable-upcoming-feature ExistentialAny $(WK_SWIFT_MEMORY_SAFETY_FLAGS) $(WK_SWIFT_MEMORY_SAFETY_ERROR_FLAGS) $(WK_SWIFT_CLANG_DEPLOYMENT_TARGET) $(WK_SANITIZER_OTHER_SWIFT_FLAGS) -enable-upcoming-feature InternalImportsByDefault -enable-upcoming-feature MemberImportVisibility -track-system-dependencies -enable-experimental-feature ImportCxxMembersLazily;
-// Work around rdar://157581667 on affected toolchains.
-OTHER_SWIFT_FLAGS[sdk=*26.2*] = $(inherited) -Xcc -fno-modulemap-allow-subdirectory-search;
-OTHER_SWIFT_FLAGS[sdk=*26.3*] = $(inherited) -Xcc -fno-modulemap-allow-subdirectory-search;
+OTHER_SWIFT_FLAGS = $(inherited) $(WK_AVAILABILITY_OVERLAY_SWIFT_FLAGS) -Xcc -fvisibility=hidden -Werror ExistentialAny -Werror NoUseUnstructuredThrowingTask -Werror NoUsage -enable-upcoming-feature ExistentialAny $(WK_SWIFT_MEMORY_SAFETY_FLAGS) $(WK_SWIFT_MEMORY_SAFETY_ERROR_FLAGS) $(WK_SWIFT_CLANG_DEPLOYMENT_TARGET) $(WK_SANITIZER_OTHER_SWIFT_FLAGS) -enable-upcoming-feature InternalImportsByDefault -enable-upcoming-feature MemberImportVisibility -track-system-dependencies -enable-experimental-feature ImportCxxMembersLazily -enable-experimental-feature SuppressedAssociatedTypes -enable-experimental-feature SuppressedAssociatedTypesWithDefaults;
 
 OTHER_LIBTOOLFLAGS = -no_warning_for_no_symbols;

Configurations/Version.xcconfig

@@ -23,7 +23,7 @@
 
 MAJOR_VERSION = 626;
 MINOR_VERSION = 1;
-TINY_VERSION = 4;
+TINY_VERSION = 6;
 MICRO_VERSION = 0;
 NANO_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION);

JSTests/microbenchmarks/object-rest-clone.js

@@ -0,0 +1,8 @@
+var cities = ["a", "b", "c", "d", "e", "f", "g", "h"];
+var state = { id: 1, name: "x", age: 3, city: "z", zip: 0, flag: true, score: 1.5, tag: "t" };
+for (var i = 0; i < 1e4; ++i) {
+    var { ...next } = state;
+    next.city = cities[i & 7];
+    next.zip = i;
+    state = next;
+}

JSTests/microbenchmarks/regexp-lookbehind-fixed-count-group.js

@@ -0,0 +1,10 @@
+let text = "abababab-abab-ababab-ab-abababab-".repeat(300);
+let re = /(?<=(?:ab){3})-/g;
+let result = 0;
+for (let i = 0; i < 1e4; ++i) {
+    re.lastIndex = 0;
+    while (re.exec(text))
+        result++;
+}
+if (result !== 3 * 300 * 1e4)
+    throw new Error("Bad result: " + result);

JSTests/microbenchmarks/regexp-lookbehind-lookahead.js

@@ -0,0 +1,10 @@
+let text = "doable unable readable unreadable stable unstable notable untenable capable ".repeat(40);
+let re = /(?<=\b(?!un)\w+)able/g;
+let result = 0;
+for (let i = 0; i < 1e4; ++i) {
+    re.lastIndex = 0;
+    while (re.exec(text))
+        result++;
+}
+if (result !== 200 * 1e4)
+    throw new Error("Bad result: " + result);

JSTests/microbenchmarks/regexp-lookbehind-quantified-group.js

@@ -0,0 +1,10 @@
+let text = "1,234,567 12,345 999 1,000,000 42 7,777,777,777 ".repeat(200);
+let re = /(?<=\b(?:\d{1,3},)+\d{3}) /g;
+let result = 0;
+for (let i = 0; i < 1e4; ++i) {
+    re.lastIndex = 0;
+    while (re.exec(text))
+        result++;
+}
+if (result !== 4 * 200 * 1e4)
+    throw new Error("Bad result: " + result);

JSTests/microbenchmarks/temporal-plain-month-day-lunisolar-month-code.js

@@ -0,0 +1,59 @@
+// Regression benchmark for the chinese/dangi monthCode path in nonISOCalendarDateToISO
+// (CalendarICUBridge.cpp). ICU4C cannot say which ordinal a month code occupies, so the bridge
+// anchors on the start of the reference year and walks month by month; each advance jumps to
+// day 29 and then steps, since a lunar month is 29 or 30 days. The walk is memoized per
+// (calendar, year, monthCode), and the month length per month start.
+//
+// One phase per thing to protect:
+//   steady - a single input, so both memos hit every time
+//   warm   - four distinct keys over both calendars, still inside the walk memo
+//   cold   - every month code for both calendars, more keys than either memo holds
+//
+// The resolved day is checked once per case up front rather than in the loops: the day getter
+// is a second ICU round trip that touches neither memo, so accumulating it would dilute what
+// the loops measure.
+
+const steadyCase = { calendar: "chinese", monthCode: "M07", day: 15 };
+
+const warmCases = [
+    { calendar: "chinese", monthCode: "M03", day: 15 },
+    { calendar: "chinese", monthCode: "M05L", day: 15 },
+    { calendar: "dangi", monthCode: "M07", day: 15 },
+    { calendar: "dangi", monthCode: "M11", day: 15 },
+];
+
+const coldCases = [];
+for (const calendar of ["chinese", "dangi"]) {
+    for (let month = 1; month <= 12; ++month) {
+        const monthCode = "M" + (month < 10 ? "0" : "") + month;
+        coldCases.push({ calendar, monthCode, day: 15 });
+        coldCases.push({ calendar, monthCode: monthCode + "L", day: 15 });
+    }
+}
+
+if (coldCases.length !== 48)
+    throw "Bad case count: " + coldCases.length;
+
+// Day 15 is inside every lunar month, and under the default constrain overflow a leap month
+// absent from the reference year falls back to the non-leap month, so every case resolves to
+// day 15 rather than throwing.
+for (const fields of [steadyCase, ...warmCases, ...coldCases]) {
+    const day = Temporal.PlainMonthDay.from(fields).day;
+    if (day !== 15)
+        throw "Bad day for " + fields.calendar + " " + fields.monthCode + ": " + day;
+}
+
+let sink = null;
+for (var i = 0; i < 10000; ++i)
+    sink = Temporal.PlainMonthDay.from(steadyCase);
+for (var i = 0; i < 2000; ++i) {
+    for (var j = 0; j < warmCases.length; ++j)
+        sink = Temporal.PlainMonthDay.from(warmCases[j]);
+}
+for (var i = 0; i < 5; ++i) {
+    for (var j = 0; j < coldCases.length; ++j)
+        sink = Temporal.PlainMonthDay.from(coldCases[j]);
+}
+
+if (!sink)
+    throw "Bad result: " + sink;

JSTests/stress/absence-propertycondition-and-non-reified-static-property-tables.js

@@ -0,0 +1,52 @@
+// Absence PropertyCondition should consult non-reified static property tables;
+// otherwise, the Abstract Interpreter folds GetById past Symbol.prototype's
+// static `description`.
+
+function assert(cond) {
+    if (!cond)
+        throw new Error("Assertion failed");
+}
+
+function assertThrows(fn) {
+    try {
+        fn();
+    } catch (e) {
+        return;
+    }
+
+    throw "Expected an exception";
+}
+
+let K = {};
+K.y = 13.37;
+Object.prototype.description = K;
+
+function setup(a) { return a.description; }
+noInline(setup);
+let setupObj = {};
+for (let i = 0; i < 50_000; i++) setup(setupObj);
+
+let o_warm  = Object(Symbol("warm")); o_warm.x  = 1;
+let o_leak  = Object(Symbol("leak")); o_leak.x  = 1;
+let o_crash = Object(Symbol());       o_crash.x = 1;
+
+function f(a, n) {
+    let b = a;
+    if (n > 0) {
+        let r = a.description;
+        let v = r.y;
+        return v;
+    }
+    b.x; b.x; b.x;
+    return undefined;
+}
+noInline(f);
+
+assert(f(o_warm, 1) === undefined);
+for (let i = 0; i < 500_000; i++) f(o_warm, 0);
+
+var hole = f(o_leak, 1);
+assert(hole === undefined);
+assert(typeof hole === "undefined");
+
+assertThrows(() => f(o_crash, 1));

JSTests/stress/arith-abs-checked-input-range.js

@@ -0,0 +1,42 @@
+let enteredFirstBranch = 0;
+let enteredBoundsBranch = 0;
+let lastIndex = 0;
+
+function probe(x)
+{
+    const target = new Uint8Array(new ArrayBuffer(32));
+
+    let dead = x;
+    dead++;
+    dead++;
+
+    const first = Math.abs(x + 2);
+    if (first < 1) {
+        enteredFirstBranch++;
+        const index = first + 16;
+        lastIndex = index;
+        if (index < target.length) {
+            enteredBoundsBranch++;
+            return target[index];
+        }
+    }
+    return 0;
+}
+noInline(probe);
+
+for (let i = 0; i < 30000; ++i)
+    probe(-2);
+
+enteredFirstBranch = 0;
+enteredBoundsBranch = 0;
+lastIndex = 0;
+
+const result = probe(2147483646);
+if (result !== 0)
+    throw new Error(`Bad result: ${result}`);
+if (enteredFirstBranch)
+    throw new Error(`Entered first branch: ${enteredFirstBranch}`);
+if (enteredBoundsBranch)
+    throw new Error(`Entered bounds branch: ${enteredBoundsBranch}`);
+if (lastIndex)
+    throw new Error(`Computed wrapped index: ${lastIndex}`);

JSTests/stress/arith-checked-int-must-generate-dce.js

@@ -0,0 +1,73 @@
+//@ requireOptions("--useConcurrentJIT=0", "--thresholdForFTLOptimizeAfterWarmUp=1000")
+
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error("FAIL: got " + actual + ", expected " + expected);
+}
+
+function mulOverflow(k) {
+    let y = k;
+    y = y * y;
+    return (y | 0) === y;
+}
+noInline(mulOverflow);
+
+function mulNegativeZero(a, b) {
+    let y = a;
+    y = y * b;
+    return Object.is(y | 0, y);
+}
+noInline(mulNegativeZero);
+
+function divNonInteger(a, b) {
+    let y = a;
+    y = y / b;
+    return (y | 0) === y;
+}
+noInline(divNonInteger);
+
+function modNegativeZero(a, b) {
+    let y = a;
+    y = y % b;
+    return Object.is(y | 0, y);
+}
+noInline(modNegativeZero);
+
+function negateOverflow(k) {
+    let y = k;
+    y = -y;
+    return (y | 0) === y;
+}
+noInline(negateOverflow);
+
+function negateNegativeZero(k) {
+    let y = k;
+    y = -y;
+    return Object.is(y | 0, y);
+}
+noInline(negateNegativeZero);
+
+function absOverflow(k) {
+    let y = k;
+    y = Math.abs(y);
+    return (y | 0) === y;
+}
+noInline(absOverflow);
+
+for (let i = 0; i < testLoopCount; ++i) {
+    mulOverflow(3);
+    mulNegativeZero(3, 2);
+    divNonInteger(6, 3);
+    modNegativeZero(7, 3);
+    negateOverflow(3);
+    negateNegativeZero(3);
+    absOverflow(-3);
+}
+
+shouldBe(mulOverflow(65536), false);
+shouldBe(mulNegativeZero(0, -1), false);
+shouldBe(divNonInteger(7, 2), false);
+shouldBe(modNegativeZero(-3, 3), false);
+shouldBe(negateOverflow(-2147483648), false);
+shouldBe(negateNegativeZero(0), false);
+shouldBe(absOverflow(-2147483648), false);

JSTests/stress/destructuring-pattern-deep-recursion.js

@@ -0,0 +1,27 @@
+function shouldThrowRangeError(script) {
+    let error;
+    try {
+        (0, eval)(script);
+    } catch (e) {
+        error = e;
+    }
+    if (!(error instanceof RangeError))
+        throw new Error("Expected RangeError, got " + error);
+}
+
+const depth = 12000;
+const open = "[".repeat(depth);
+const close = "]".repeat(depth);
+
+shouldThrowRangeError("let " + open + "z" + close + " = [];");
+shouldThrowRangeError("var " + open + "z" + close + " = [];");
+shouldThrowRangeError("(function (" + open + "z" + close + ") {})([]);");
+shouldThrowRangeError("try { throw []; } catch (" + open + "z" + close + ") {}");
+shouldThrowRangeError("let " + "{a:".repeat(depth) + "z" + "}".repeat(depth) + " = {};");
+
+let [[[a]]] = [[[42]]];
+if (a !== 42)
+    throw new Error("shallow array destructuring broken");
+let { b: { c } } = { b: { c: 7 } };
+if (c !== 7)
+    throw new Error("shallow object destructuring broken");

JSTests/stress/dfg-getscope-fold-stale-cfa-state.js

@@ -0,0 +1,29 @@
+function opt(a1, a2, a3, a4, a5) {
+    try {
+        class Trans extends Array {
+        };
+        function inline() {
+            try {
+                a2(["Āሴ￿", a5]);
+            } catch (x) {
+            };
+        };
+        inline();
+    } catch (x) {
+    };
+    function foo(a, b) {
+        for (var x = 0; x < 10000; x++) {
+        };
+        return a == b;
+    }
+    foo(-1, a5);
+    class C {
+    };
+}
+
+for (let i = 0; i < 10000; i++) {
+    try {
+        opt(Function.prototype.apply, Function.prototype.toString, 1.1, '💩', Object.defineProperty);
+    } catch (e) {
+    }
+}