Upgrade to upstream WebKit df289ce551 - #539
Merged
Merged
Conversation
…20/I010 frames <https://bugs.webkit.org/show_bug.cgi?id=322761> <rdar://176978345> Reviewed by Jean-Yves Avenard. copyVideoFrameBuffer used i420Frame->width() / i010Frame->width() as both the destination row pitch and the UV plane size. libyuv's I420ToNV12 / I010ToP010 round chroma dimensions up: they emit ((width + 1) / 2) * 2 bytes per UV row and (height + 1) / 2 UV rows. For odd width, libyuv writes one byte (I420) or two bytes (I010) past each UV row, with the final row's overrun landing past the end of the SharedMemory mapping. For odd height, an entire UV row's worth of data (~width or 2*width bytes) lands past the mapping. Round chroma dimensions up to match libyuv. SharedVideoFrameInfo::fromVideoFrameBuffer now sizes the UV plane via computeStrideUV<byteType>(frame) (sizeof(byteType) * (width rounded up to even)) and computeHeightUV(frame) ((height + 1) / 2). copyVideoFrameBuffer applies the same rounding to the strideUV it hands to libyuv, so writer row pitch matches the receiver's m_bytesPerRowPlaneB and rows no longer overlap. Re-land 319878@main, reverted by 319927@main for breaking ASan builds. The added tests make TestWebKitAPI a libwebrtc client, but its Configurations/Base.xcconfig searched neither the webrtc header directory nor the directory libwebrtc.dylib installs into, so the build failed first at `api/scoped_refptr.h` and then at `-lwebrtc`. Give it both search paths, so it resolves libwebrtc the same way WebCore.xcconfig and WebKit.xcconfig already do. Covered by added API tests. * Source/ThirdParty/libwebrtc/Configurations/libwebrtc.exp: * Source/ThirdParty/libwebrtc/Configurations/libwebrtc.xcconfig: * Source/ThirdParty/libwebrtc/Source/webrtc/webkit_sdk/WebKit/WebKitUtilities.mm: (webrtc::copyVideoFrameBuffer): * Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm: (WebCore::computeStrideY): (WebCore::computeStrideUV): (WebCore::computeWidthUV): (WebCore::computeHeightUV): (WebCore::SharedVideoFrameInfo::fromVideoFrameBuffer): * Tools/TestWebKitAPI/Configurations/Base.xcconfig: * Tools/TestWebKitAPI/Configurations/TestWebKitAPIBase.xcconfig: * Tools/TestWebKitAPI/Tests/WebCore/cocoa/SharedVideoFrame.mm: (TestWebKitAPI::TEST(SharedVideoFrame, PlaneAlphaSize)): (TestWebKitAPI::testSharedVideoFrameInfoRoundTrip): (TestWebKitAPI::TEST(SharedVideoFrame, OddWidthI420)): (TestWebKitAPI::TEST(SharedVideoFrame, OddHeightI420)): (TestWebKitAPI::TEST(SharedVideoFrame, OddWidthAndHeightI420)): (TestWebKitAPI::TEST(SharedVideoFrame, OddWidthI010)): (TestWebKitAPI::TEST(SharedVideoFrame, OddHeightI010)): (TestWebKitAPI::TEST(SharedVideoFrame, OddWidthAndHeightI010)): (TestWebKitAPI::TEST(WebCore, SharedVideoFramePlaneAlphaSize)): Deleted. Originally-landed-as: 305413.997@safari-7624.5-branch (881cd54). rdar://185368288 Canonical link: https://commits.webkit.org/320009@main
https://bugs.webkit.org/show_bug.cgi?id=322308 rdar://problem/185553192 Reviewed by Sam Sneddon. Relations could only be added. Bugzilla's 'relate' sent '{"add": [...]}' and radar's created a relationship, with no way to undo either, so a tool which records a dependency between two issues cannot later forget it and a stale relation has to be removed by hand. Add 'unrelate', which Bugzilla implements by sending '{"remove": [...]}' through the request 'relate' already builds and radar by deleting a relationship the radar already holds. 'duplicate-of' and 'original-of' are not removable this way, since they are recorded as a resolution rather than as a relationship. * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/__init__.py: * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/bugzilla.py: (Tracker): * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/__init__.py: * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/bugzilla.py: (Tracker): (Tracker._modify_relations): (Tracker.relate): (Tracker.unrelate): * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/issue.py: (Issue.unrelate): * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/mocks/bugzilla.py: (Bugzilla._issue): (Bugzilla._issue.related_for): * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/mocks/radar.py: (RadarModel.__init__): (RadarModel.commit_changes): (RadarModel.delete_relationship): * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/radar.py: (Tracker.remove_relationship): (Tracker): (Tracker.unrelate): (Tracker.relation_key): * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/bugzilla_unittest.py: (test_relate_simple): * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/radar_unittest.py: * Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tracker.py: (Tracker.unrelate): (Tracker): (Tracker.relation_key): Canonical link: https://commits.webkit.org/320010@main
…eplaced object rather than its value https://bugs.webkit.org/show_bug.cgi?id=322688 rdar://185960907 Reviewed by Tyler Wilcock. On the live AX tree, asking for a <textarea>'s or <input type=text>'s text marker range was giving back a range whose string was a single object replacement character (U+FFFC) and whose endpoints carried no useful index. This doesn't match the isolated tree, which returns a useful range derived from its shadow tree. textMarkerRange() now descends into the inner text element for native text controls, leaving out the trailing placeholder <br> to match other APIs like AXNumberOfCharacters. A special case is needed for a control with no value. Tests: accessibility/isolated-tree/mac/text-marker-range-for-text-control.html accessibility/mac/text-marker-range-for-text-control.html * LayoutTests/accessibility/isolated-tree/mac/text-marker-range-for-text-control-expected.txt: Added. * LayoutTests/accessibility/isolated-tree/mac/text-marker-range-for-text-control.html: Added. * LayoutTests/accessibility/mac/text-marker-range-for-text-control-expected.txt: Added. * LayoutTests/accessibility/mac/text-marker-range-for-text-control.html: Added. * Source/WebCore/accessibility/AccessibilityNodeObject.cpp: (WebCore::AccessibilityNodeObject::isNativeTextControl const): Deleted. (WebCore::AccessibilityNodeObject::text const): * Source/WebCore/accessibility/AccessibilityNodeObject.h: * Source/WebCore/accessibility/AccessibilityObject.cpp: (WebCore::AccessibilityObject::nativeTextControl const): (WebCore::AccessibilityObject::textMarkerRange const): * Source/WebCore/accessibility/AccessibilityObject.h: (WebCore::AccessibilityObject::isNativeTextControl const): * Source/WebCore/accessibility/AccessibilityObjectInlines.h: (WebCore::AccessibilityObject::textMarkerRange const): Deleted. * Source/WebCore/accessibility/AccessibilityRenderObject.cpp: (WebCore::AccessibilityRenderObject::setSelectedVisiblePositionRange): Canonical link: https://commits.webkit.org/320011@main
https://bugs.webkit.org/show_bug.cgi?id=322755 rdar://186016244 Reviewed by Yijia Huang. We are updating profiles at GC end phase since it is also clearing cells which will be dead after this GC end phase. So this is necessary, but updating many profiles are costly. We are iterating all live CodeBlocks and updating them takes long time. This patch speculatively updates profiles when marking CodeBlock from GC. So then values get updated and cleared concurrently. We still need to update the profiles at GC end phase, but it is likely that there are many empty profiled values remaining if we are not executing this CodeBlock after GC scan happens, so we can significantly reduce the cost of sequential execution of profile update. * Source/JavaScriptCore/bytecode/CodeBlock.cpp: (JSC::CodeBlock::visitChildren): Canonical link: https://commits.webkit.org/320012@main
rdar://186004521
Reviewed by Tyler Wilcock.
AccessibilityObject::replaceTextInRange resolved the character range
through rangeForCharacterRange, which walks CharacterOffsets. A
CharacterOffset names a node and a side of it, so at a block boundary
a single character index belongs to two of them: the position after
the <br> that ends the preceding block, and the position starting the
next block. The walk picked the former. That is not a caret position
-- a <br> ending a block is collapsed out by rendering and has nothing
after it -- so it canonicalized back over the <br>, one character
early. Resolving the same index through visiblePositionForIndex lands
on the position that renders where the caller means, so
replaceTextInRange now uses that.
Tests: accessibility/isolated-tree/mac/replace-range-at-block-boundary.html
accessibility/mac/replace-range-at-block-boundary.html
* LayoutTests/accessibility/isolated-tree/mac/replace-range-at-block-boundary-expected.txt: Added.
* LayoutTests/accessibility/isolated-tree/mac/replace-range-at-block-boundary.html: Added.
* LayoutTests/accessibility/mac/replace-range-at-block-boundary-expected.txt: Added.
* LayoutTests/accessibility/mac/replace-range-at-block-boundary.html: Added.
* Source/WebCore/accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::replaceTextInRange):
Canonical link: https://commits.webkit.org/320013@main
https://bugs.webkit.org/show_bug.cgi?id=322707 Reviewed by Ryosuke Niwa. The point of this assertion was to make sure that we do not forget to adopt a RefCounted object after constructing it. However, it also prevents ref'ing the object while it is in the middle of construction. Ref'ing the object while it is in the middle of construction is safer and something that happens routinely, especially when adopting our modern safer cpp programming patterns. This assertion was thus slowing down safer cpp adoption and we would keep addressing the crashes by adding calls to `relaxAdoptionRequirement()`, which disables the adoption requirement assertion for a specific object type. As a result, it makes little sense to keep this assertion around and I am thus removing it in this patch. * Source/WTF/wtf/NeverDestroyed.h: (WTF::NeverDestroyed::NeverDestroyed): (WTF::LazyNeverDestroyed::constructWithoutAccessCheck): (WTF::NeverDestroyed::MaybeRelax::MaybeRelax): Deleted. (): Deleted. (WTF::LazyNeverDestroyed::MaybeRelax::MaybeRelax): Deleted. * Source/WTF/wtf/Ref.h: (WTF::adoptRef): (WTF::adopted): Deleted. * Source/WTF/wtf/RefCountDebugger.h: (WTF::RefCountDebuggerImpl::~RefCountDebuggerImpl): (WTF::RefCountDebuggerImpl::willRef const): (WTF::RefCountDebuggerImpl::willDeref const): (WTF::RefCountDebuggerImpl::adopted): Deleted. (WTF::RefCountDebuggerImpl::relaxAdoptionRequirement): Deleted. * Source/WTF/wtf/RefCounted.h: (WTF::RefCountedBase::adopted): Deleted. (WTF::RefCountedBase::relaxAdoptionRequirement): Deleted. (WTF::adopted): Deleted. * Source/WTF/wtf/RefCountedWithInlineWeakPtr.h: (WTF::adopted): Deleted. * Source/WTF/wtf/RefPtr.h: (WTF::adoptRef): * Source/WTF/wtf/ThreadSafeRefCounted.h: (WTF::adopted): Deleted. * Source/WTF/wtf/ThreadSafeRefCountedWithSuppressingSaferCPPChecking.h: (WTF::adopted): Deleted. * Source/WTF/wtf/UniquelyOwnedPtr.h: (WTF::makeUniquelyOwned): * Source/WTF/wtf/glib/SocketConnection.cpp: (WTF::SocketConnection::SocketConnection): * Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp: (WebCore::MediaStreamTrack::MediaStreamTrack): * Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp: (WebCore::RTCPeerConnection::RTCPeerConnection): * Source/WebCore/Modules/notifications/NotificationResourcesLoader.cpp: (WebCore::NotificationResourcesLoader::ResourceLoader::ResourceLoader): * Source/WebCore/accessibility/AccessibilityMenuList.cpp: (WebCore::AccessibilityMenuList::create): * Source/WebCore/accessibility/AccessibilitySpinButton.cpp: (WebCore::AccessibilitySpinButton::create): * Source/WebCore/dom/EmptyScriptExecutionContext.h: * Source/WebCore/dom/Node.cpp: (WebCore::Node::Node): (WebCore::Node::~Node): * Source/WebCore/dom/Node.h: (WebCore::Node::ref const): (WebCore::Node::deref const): (WebCore::adopted): Deleted. * Source/WebCore/dom/NodeInlines.h: (WebCore::Node::relaxAdoptionRequirement): Deleted. * Source/WebCore/dom/Subscriber.cpp: (WebCore::Subscriber::Subscriber): * Source/WebCore/dom/messageports/MessagePortChannel.cpp: (WebCore::m_registry): * Source/WebCore/fileapi/Blob.cpp: (WebCore::Blob::stream): * Source/WebCore/loader/DocumentThreadableLoader.cpp: (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): * Source/WebCore/page/Frame.cpp: (WebCore::Frame::Frame): * Source/WebCore/page/Page.cpp: (WebCore::createMainFrame): * Source/WebCore/platform/graphics/Font.cpp: (WebCore::m_shouldNotBeUsedForArabic): * Source/WebCore/rendering/RenderScrollbar.cpp: (WebCore::RenderScrollbar::RenderScrollbar): * Source/WebCore/rendering/RenderWidget.cpp: (WebCore::RenderWidget::RenderWidget): * Source/WebCore/workers/WorkerOrWorkletGlobalScope.cpp: (WebCore::WorkerOrWorkletGlobalScope::WorkerOrWorkletGlobalScope): * Source/WebCore/workers/service/ServiceWorker.cpp: (WebCore::ServiceWorker::ServiceWorker): * Source/WebCore/workers/service/ServiceWorkerContainer.cpp: (WebCore::ServiceWorkerContainer::ensureSWClientConnection): * Source/WebCore/workers/service/ServiceWorkerRegistration.cpp: (WebCore::ServiceWorkerRegistration::ServiceWorkerRegistration): * Source/WebKit/NetworkProcess/Downloads/PendingDownload.cpp: (WebKit::PendingDownload::PendingDownload): * Source/WebKit/NetworkProcess/NetworkLoad.cpp: (WebKit::NetworkLoad::NetworkLoad): * Source/WebKit/NetworkProcess/NetworkSocketChannel.cpp: (WebKit::NetworkSocketChannel::NetworkSocketChannel): * Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerNavigationPreloader.cpp: (WebKit::ServiceWorkerNavigationPreloader::ServiceWorkerNavigationPreloader): * Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerToContextConnection.cpp: (WebKit::WebSharedWorkerServerToContextConnection::WebSharedWorkerServerToContextConnection): * Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionMenuItemCocoa.mm: (WebKit::WebExtensionMenuItem::WebExtensionMenuItem): * Source/WebKit/UIProcess/ProvisionalPageProxy.cpp: (WebKit::ProvisionalPageProxy::ProvisionalPageProxy): * Source/WebKit/WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp: (WebKit::WebIDBConnectionToServer::WebIDBConnectionToServer): * Source/WebKit/webpushd/PushService.mm: (WebPushD::PushService::PushService): Canonical link: https://commits.webkit.org/320014@main
https://bugs.webkit.org/show_bug.cgi?id=322782 rdar://184269255 Reviewed by Timothy Hatcher. -[UIWindow initWithFrame] is deprecated in iOS 26. Use -initWithWindowScene: instead, and have the class choose a foreground scene to use. * Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIOffscreenCocoa.mm: (WebKit::windowScene): (WebKit::WebExtensionContext::offscreenCreateDocument): Canonical link: https://commits.webkit.org/320015@main
…tes (month-before-day Expires values) https://bugs.webkit.org/show_bug.cgi?id=322546 rdar://185840799 Reviewed by Matthew Finkel. CFNetwork's cookie-date parser rejects a cookie-date containing a month-before-day date format. Unfortunately, this is the format JavaScript's Date.prototype.toString() method produces (at least in some locales). This causes cookies with an Expires attribute of that form to be silently ignored, converting the cookie from a persistent value to a session cookie (which disappears when the browser quits). This patch introduces an initial scan for month-first date formats, and fixes up the string if necessary. We perform the date fix-up prior to handing off to CFNetwork (or libSOUP) so that we only have to perform the cookie parsing logic once. The cURL ports never rejected month-before-day strings, so did not suffer from this behavior. While this patch is largely a workaround until CFNetwork and libSOUP fix their underlying implementations, it also allows us to improve behavior for downlevel shipment of Safari as well as Safari Technology Preview. This fix can only cover document.cookie cases. The Set-Cookie response-header path is parsed inside NSURLSession before WebKit sees the response, so there is no interception point; that half is fixed only by rdar://185837942. * LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/expires-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/expires.html: * Source/WebCore/WebCore.xcodeproj/project.pbxproj: * Source/WebCore/platform/Cookie.h: * Source/WebCore/platform/network/Cookie.cpp: (WebCore::CookieUtil::isMonthNameToken): (WebCore::CookieUtil::cookieStringWithDayFirstExpires): * Source/WebCore/platform/network/cocoa/NetworkStorageSessionCocoa.mm: (WebCore::parseDOMCookie): Repair the parsed cookie before adjusting it. * Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp: (WebCore::NetworkStorageSession::setCookiesFromDOM const): Canonical link: https://commits.webkit.org/320016@main
…te with gesture-driven swipe https://bugs.webkit.org/show_bug.cgi?id=322776 rdar://186040671 Reviewed by Wenson Hsieh. 319888@main started clamping the delta of the wheel events produced by the pan GR along any pinned axis, with the intention that a sideways scroll component during a simultaneous pan + transient zoom could not turn into a rubberband stretch (which makes the scrolling tree discard the orthogonal delta for the rest of the gesture). The wheel event in question feeds two systems, though; the swipe tracker maintained by view gesture controller, and the actual page. For the former, our clamping means we remove the signal used to determine PendingSwipeTracker::scrollEventCanBecomeSwipe(), and as such we inadvertently broke swiping -> page navigation when the horizontal axis is pinned, i.e. the common case at the default page scale. In this patch, we build a separate event per consumer. The swipe tracker gets the unclamped delta, and only the event that reaches the page is clamped. A more principled fix would be to make the scrolling tree _not_ discard the orthogonal component of a scroll delta from the motivation for 319888@main, but that is riskier and certainly not right in exactly the form I described. Test: AppKitGesturesTests.Basic.swipingAtPinnedStateShouldTriggerPageNavigation * Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm: (-[WKAppKitGestureController sendWheelEventForGesture:]): * Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift: Canonical link: https://commits.webkit.org/320017@main
https://bugs.webkit.org/show_bug.cgi?id=318480 rdar://180535979 Reviewed by Yusuke Suzuki. In 305413.1013@safari-7624.5-branch we fixed how result types were pushed onto the wasm value stack, widening them to the expected type rather than the last predecessor's type at the merge. This missed the case for unreachable expressions in the block, which is fixed in this patch. Originally-landed-as: 305413.1080@safari-7624.5-branch (f65ca49). rdar://185368954 Canonical link: https://commits.webkit.org/320018@main
…cludes a whitespace at a soft line break https://bugs.webkit.org/show_bug.cgi?id=322442 rdar://185725689 Reviewed by Dominic Mazzoni. Layout drops the space a line soft-wraps at, but AccessibilityRenderObject::textRuns re-adds it to the end of the wrapping line's run, so that a range spanning the wrap still reads "foo bar" rather than "foobar". A line's range therefore ended one character past the line's rendered text, and AXStringForTextMarkerRange over the range AXTextMarkerRangeForLine returned included a space that renders on no line, e.g. for <p style="width: 4ch">aaa bbb</p>, "aaa " rather than "aaa". The live tree ends that range before the space. endOfLine() produces an upstream position, and AXTextMarker::operator CharacterOffset() maps an upstream marker through previousCharacterOffset(). With this commit, we do the same in the isolated tree by moving the returned range's end marker back over the wrap space, which also brings its length and end index in line with the live tree's (3, not 4). * LayoutTests/accessibility/isolated-tree/empty-final-line-range-expected.txt: Added. * LayoutTests/accessibility/isolated-tree/empty-final-line-range.html: Added. * LayoutTests/accessibility/mac/line-range-at-soft-break-excludes-space-expected.txt: Added. * LayoutTests/accessibility/mac/line-range-at-soft-break-excludes-space.html: Added. * Source/WebCore/accessibility/AXTextMarker.cpp: (WebCore::lineRangeWithout): (WebCore::AXTextMarker::characterRangeForLine const): (WebCore::AXTextMarker::markerRangeForLineIndex const): (WebCore::AXTextMarker::lineNumberForIndex const): (WebCore::AXTextMarker::lineRange const): (WebCore::lineRangeWithoutCollapsedTrailingNewline): Deleted. Canonical link: https://commits.webkit.org/320019@main
https://bugs.webkit.org/show_bug.cgi?id=322711 Reviewed by Nikolas Zimmermann. It's unused since 286605@main * Source/WebCore/platform/graphics/egl/BitmapTexture.cpp: (WebCore::BitmapTexture::swapTexture): (WebCore::BitmapTexture::reset): (WebCore::BitmapTexture::initializeStencil): (WebCore::BitmapTexture::createFboIfNeeded): (WebCore::BitmapTexture::bindAsSurface): (WebCore::BitmapTexture::~BitmapTexture): (WebCore::BitmapTexture::initializeDepthBuffer): Deleted. (WebCore::depthBufferFormat): Deleted. * Source/WebCore/platform/graphics/egl/BitmapTexture.h: * Source/WebCore/platform/graphics/egl/BitmapTexturePool.cpp: (WebCore::BitmapTexturePool::acquireTexture): Canonical link: https://commits.webkit.org/320020@main
…nserted https://bugs.webkit.org/show_bug.cgi?id=322720 Reviewed by Tim Nguyen. A Document's target element is only set by the scroll to the fragment algorithm; nothing sets it to null when the element is removed from the document. WebKit cleared it on removal since 2008 (23144@main) to avoid a dangling raw pointer, which is no longer a concern now that m_cssTarget is a WeakPtr. Gecko already behaved this way and Chromium made the same change in 2024, so this aligns all engines with the HTML Standard. Tests: imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-adoption.html imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/document-with-fragment-removed-target.html WPT PR: web-platform-tests/wpt#62238 Canonical link: https://commits.webkit.org/320021@main
…ng context https://bugs.webkit.org/show_bug.cgi?id=322710 rdar://185975255 Reviewed by Sam Weinig. Implement w3c/csswg-drafts#14338 This mostly affects cycle detection: @function --double(--len <length>) returns <length> { result: calc(var(--len) * 2); } font-size: --double(1em); used to be cycle because `em` unit was resolved in function context where we can't reference the property we are computing. In calling context it evaluates against parent font-size which is fine. A major benefit is that this allows significant code simplifications. We no longer need to instantiate a separate Style::Builder to resolve arguments. Arguments are now computed directly against the calling element, so first-valid() over the argument and the default becomes a plain loop instead of a synthesized -internal-first-valid() token stream that had to be substituted a second time. The hypothetical element the body is applied to now inherits a font, since font-relative units resolve against the element being styled rather than the parent style. A default can reference an earlier parameter, so parameters are tracked while they resolve. They are all seeded first, so referencing a later one gives the guaranteed-invalid value rather than the calling element's property of that name. A <dashed-function> in a default is looked up in the scope the function was defined in. Tests: imported/w3c/web-platform-tests/css/css-mixins/function-definition-scope.html imported/w3c/web-platform-tests/css/css-mixins/function-parameter-scoping.html imported/w3c/web-platform-tests/css/css-mixins/function-relative-units.html * LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-definition-scope-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-definition-scope.html: Added. * LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-scoping-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-scoping.html: Added. * LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-relative-units-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-relative-units.html: Added. * LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative.html: * Source/WebCore/style/StyleBuilder.cpp: (WebCore::Style::Builder::resolveCustomPropertyValue): (WebCore::Style::Builder::computeCustomPropertyValueForSyntax): * Source/WebCore/style/StyleBuilder.h: * Source/WebCore/style/StyleSubstitutionResolver.cpp: (WebCore::Style::SubstitutionResolver::propertyValueForVariableName): (WebCore::Style::SubstitutionResolver::resolveAndRegisterDashedFunctionArguments): (WebCore::Style::SubstitutionResolver::substituteDashedFunction): (WebCore::Style::createFirstValidVariableData): Deleted. * Source/WebCore/style/StyleSubstitutionResolver.h: Canonical link: https://commits.webkit.org/320022@main
https://bugs.webkit.org/show_bug.cgi?id=27545 rdar://94415937 Reviewed by Alan Baradlay. Add support for the <string> value of text-overflow, alongside the existing clip and ellipsis keywords, per the css-overflow-4 spec. text-overflow now mirrors block-ellipsis's representation: Style::TextOverflow is a variant-like type holding either the clip/ellipsis keywords or a custom string, replacing the old boolean TextOverflow enum. Rendering was updated so InlineDisplayLineBuilder::applyEllipsisIfNeeded reads the custom string from style when truncating overflowing inline content, the same way it already does for block-ellipsis. The generated ellipsis TextRun now also carries the line's actual base direction instead of defaulting to LTR, so a custom ellipsis string composed of mixed-direction characters is bidi-resolved against the correct paragraph direction (matters for RTL paragraphs and unicode-bidi: plaintext content whose resolved direction differs from the dir attribute). * LayoutTests/TestExpectations: * LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/text-overflow-computed-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/text-overflow-valid-expected.txt: * Source/WebCore/Headers.cmake: * Source/WebCore/Sources.txt: * Source/WebCore/WebCore.xcodeproj/project.pbxproj: * Source/WebCore/css/CSSProperties.json: * Source/WebCore/html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::shouldTruncateText const): (WebCore::HTMLInputElement::invalidateStyleOnFocusChangeIfNeeded): (WebCore::HTMLInputElement::createInnerTextStyle): * Source/WebCore/html/shadow/TextControlInnerElements.cpp: (WebCore::TextControlInnerElement::resolveCustomStyle): (WebCore::TextControlPlaceholderElement::resolveCustomStyle): * Source/WebCore/layout/formattingContexts/inline/InlineFormattingUtils.cpp: (WebCore::Layout::InlineFormattingUtils::lineEndingTruncationPolicy): * Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayLineBuilder.cpp: (WebCore::Layout::InlineDisplayLineBuilder::applyEllipsisIfNeeded): * Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp: (WebCore::LayoutIntegration::BoxTreeUpdater::adjustStyleIfNeeded): * Source/WebCore/layout/integration/inline/InlineIteratorLineBoxModernPath.h: (WebCore::InlineIterator::LineBoxIteratorModernPath::ellipsisText const): * Source/WebCore/rendering/HitTestResult.cpp: (WebCore::HitTestResult::innerTextIfTruncated const): * Source/WebCore/rendering/TextAutoSizing.cpp: (WebCore::TextAutoSizingHashTranslator::hash): * Source/WebCore/rendering/style/RenderStyleConstants.cpp: * Source/WebCore/rendering/style/RenderStyleConstants.h: * Source/WebCore/style/computed/StyleComputedStyleBase.h: * Source/WebCore/style/computed/data/StyleNonInheritedMiscData.cpp: (WebCore::Style::NonInheritedMiscData::NonInheritedMiscData): (WebCore::Style::NonInheritedMiscData::operator== const): (WebCore::Style::NonInheritedMiscData::dumpDifferences const): * Source/WebCore/style/computed/data/StyleNonInheritedMiscData.h: * Source/WebCore/style/values/overflow/StyleTextOverflow.cpp: Added. (WebCore::Style::CSSValueConversion<TextOverflow>::operator): * Source/WebCore/style/values/overflow/StyleTextOverflow.h: Added. (WebCore::Style::TextOverflow::TextOverflow): (WebCore::Style::TextOverflow::isClip const): (WebCore::Style::TextOverflow::isEllipsis const): (WebCore::Style::TextOverflow::isString const): (WebCore::Style::TextOverflow::switchOn const): * Source/WebCore/style/values/primitives/StyleKeyword+Mappings.h: * LayoutTests/imported/w3c/web-platform-tests/css/css-typed-om/the-stylepropertymap/properties/text-overflow-expected.txt: Canonical link: https://commits.webkit.org/320023@main
https://bugs.webkit.org/show_bug.cgi?id=322824 Another speculative revert for JetStream3 ~1% regression Reverted change: [JSC] add/sub of a zero immediate should be a mov https://bugs.webkit.org/show_bug.cgi?id=322504 319908@main (80fc868) Canonical link: https://commits.webkit.org/320024@main
…eTools. https://bugs.webkit.org/show_bug.cgi?id=321334 rdar://184365506 Reviewed by Elliott Williams and Dan Hecht. Mya (pronounced like Maya) is a new command line tool for examining the JSC and WebKit memory use in a running process. It attaches to a target by PID and captures snapshots of its memory (read-only Mach corpses of the process), and then enables queries on these snapshots via a REPL. Here is an example user work flow: # mya --help // Prints help text and exit. # mya --pid 12345 // Attach to the process, and take a snapshot. Attached to 12345 Captured Snapshot #1 of 12345 >>> snapshot list // Lists all existing snapshots. #1: pid 12345 ... // Only one so far. >>> snapshot // Take another snapshot, and switch to it. Captured Snapshot #2 of 12345 // Capture and switch to snapshot 2. >>> status // Shows current pid and snapshot being examined. Using snapshot 2 of pid 12345 // The snapshot command above switched us. >>> snapshot --pid 23456 Attached to 23456 // Attach and switch to this second process. Captured Snapshot #3 of 23456 // Capture and switch to snapshot 3. >>> snapshot list // Lists all existing snapshots. #1: pid 12345 ... #2: pid 12345 ... #3: pid 23456 ... >>> status // Shows current pid and snapshot being examined. Using snapshot 2 of pid 23456 // Note: the snapshot command above switched us. >>> detach // Detach from the current process. Detached from 23456 >>> snapshot // Fails. No attached process. Unable to capture snapshot. Not attached to any process. Use `attach` command or specify `--pid` argument for the snapshot command. >> snapshot info 1 // Show info on snapshot 1. ... >>> snapshot delete 2 // Delete snapshot 2. ... >>> snapshot diff 1 3 // Diff between snapshots 1 and 3. Not yet implemented. ... >> snapshot 1 // Select snapshot 1 for analysis. >>> thread list // Prints info on all thread in the current snapshot. Threads in snapshot #1 (pid 12345): INDEX TID STATE USER(ms) SYS(ms) SP STACK SIZE PAGES RESIDENT DIRTY NAME 1 0x12278c6 halted 23645.003 2937.065 0x16b7361e0 0x16af3c000-0x16b738000 7.98 MB 511 7 7 - 2 0x12278c7 halted 56.147 23.816 0x167386aa0 0x167304000-0x16738c000 544 KB 34 1 1 WebCore: ServiceWorker 3 0x12278c8 halted 0.211 0.472 0x105986b30 0x105904000-0x10598c000 544 KB 34 1 1 - >>> p/x &g_config // Prints the address of the g_config record. &g_config = 0x1f48e0000 The corpse management and analysis machinery lives in libJavaScriptCoreTools, a new static library built alongside the JavaScriptCore framework. Clients that need to do this type of snapshot analysis can link against it. By design, the corpse management and analysis code is not linked and packaged with the JavaScriptCore framework by default because they are not needed there. libJavaScriptCoreTools provides abstractions like Address, Process, Snapshot, Thread, Region, Symbol, etc. for inspecting and analyzing such WebKit and JSC corpses. Corpse Addresses are numbered based on the target process' address space mapping, not the client tool like mya. Currently, libJavaScriptCoreTools copies over memory from the corpse for inspection as an initial bootstrap implementation. In subsequent patches, we will introduce a Memory Manager that will make reading corpse memory more efficient. Symbol lookup resolves a name to an address by walking the dyld exports trie of each image loaded in the corpse. That needs no cooperation from the target and no debug information, but it only finds exported symbols. Everything read out of a corpse is untrusted input: a corrupted target could otherwise steer mya into unbounded work or bad reads. The parsing paths therefore bound the work they will do and reject implausible sizes, counts, and offsets rather than trusting what the target claims. mya and libJavaScriptCoreTools are only for Apple platforms, since they are built on Mach task APIs, which are only available on Apple platforms. Also, it is not a goal to support analysis of Rosetta processes. Some subset of functionality may still work, but only on a WYSIWYG basis. Tests: Source/JavaScriptCore/corpse/tests/ testLibJSCTools is a new test tool for libJavaScriptCoreTools, built with the other JSC test tools and run by: run-javascriptcore-tests --testlibjsctools A task may take a corpse of itself with no entitlement and no privilege, and the tests are built on that: they snapshot the running test process and check what the corpse reports against what that process already knows about itself. A symbol resolved out of the corpse, for instance, has to land on the address this process uses for it. The suites are: ByteParser ULEB128 and C string decoding, including the truncated and out of range encodings that untrusted data can hold. ExportsTrie terminal and edge decoding for every export kind and flag, the malformed tries that a corrupt corpse can present, and that a cyclic trie still terminates. Also fuzzed from a fixed seed on every run, under a watchdog, because the decoder's contract is to bound its work on any input at all. Address null, ordering, arithmetic, and the ptrauth and top-byte stripping that a pointer out of a corpse needs. Process attach, detach, re-attach, a pid that has exited, and a target running under Rosetta translation. Snapshot validity, identifier assignment, and that repeatedly snapshotting leaves no Mach port behind. Region a mapping of known size and residency, an unmapped hole, and an address inside the shared cache submap. Thread thread names and their truncation, and that a thread's stack pointer lies inside the stack region reported for it. Symbol g_config, malloc and environ resolved out of a corpse of this process, each compared against the address it has locally, plus the names that are deliberately not found: a symbol hidden from the linker, and a name given with its underscore already attached. For the build, libJavaScriptCoreTools, mya, and testLibJSCTools are deliberately put in jsc's dependency closure in the JavaScriptCore_executables XBS project. This is so that they can piggy-back off of jsc shell's build phase i.e. only trigger a build after JavaScriptCore.framework is done building, and trigger an install like the jsc shell is (albeit to their respective install destinations, which may defer). Update: fixes simulators and MacCatalyst builds to actually not install mya, and not build libJavaScriptCore. A stubbed version of testLibJSCTools is still being build and installed. This is to keep run-javascriptcore-tests from failing due to a missing testLibJSCTools executable. * Source/JavaScriptCore/CMakeLists.txt: * Source/JavaScriptCore/Configurations/Mya.xcconfig: Added. * Source/JavaScriptCore/Configurations/TestLibJSCTools.xcconfig: Added. * Source/JavaScriptCore/Configurations/libJavaScriptCoreTools.xcconfig: Added. * Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj: * Source/JavaScriptCore/Scripts/process-entitlements.sh: * Source/JavaScriptCore/corpse/CMakeLists.txt: Added. * Source/JavaScriptCore/corpse/CorpseAddress.h: Added. * Source/JavaScriptCore/corpse/CorpseByteParser.cpp: Added. * Source/JavaScriptCore/corpse/CorpseByteParser.h: Added. * Source/JavaScriptCore/corpse/CorpseClient.cpp: Added. * Source/JavaScriptCore/corpse/CorpseClient.h: Added. * Source/JavaScriptCore/corpse/CorpseError.cpp: Added. * Source/JavaScriptCore/corpse/CorpseError.h: Added. * Source/JavaScriptCore/corpse/CorpseExportsTrie.cpp: Added. * Source/JavaScriptCore/corpse/CorpseExportsTrie.h: Added. * Source/JavaScriptCore/corpse/CorpseProcess.cpp: Added. * Source/JavaScriptCore/corpse/CorpseProcess.h: Added. * Source/JavaScriptCore/corpse/CorpseRegion.cpp: Added. * Source/JavaScriptCore/corpse/CorpseRegion.h: Added. * Source/JavaScriptCore/corpse/CorpseSnapshot.cpp: Added. * Source/JavaScriptCore/corpse/CorpseSnapshot.h: Added. * Source/JavaScriptCore/corpse/CorpseSymbol.cpp: Added. * Source/JavaScriptCore/corpse/CorpseSymbol.h: Added. * Source/JavaScriptCore/corpse/CorpseThread.cpp: Added. * Source/JavaScriptCore/corpse/CorpseThread.h: Added. * Source/JavaScriptCore/corpse/tests/CorpseAddressTest.cpp: Added. * Source/JavaScriptCore/corpse/tests/CorpseAddressTest.h: Added. * Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.cpp: Added. * Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.h: Added. * Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.cpp: Added. * Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.h: Added. * Source/JavaScriptCore/corpse/tests/CorpseProcessTest.cpp: Added. * Source/JavaScriptCore/corpse/tests/CorpseProcessTest.h: Added. * Source/JavaScriptCore/corpse/tests/CorpseRegionTest.cpp: Added. * Source/JavaScriptCore/corpse/tests/CorpseRegionTest.h: Added. * Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.cpp: Added. * Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.h: Added. * Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.cpp: Added. * Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.h: Added. * Source/JavaScriptCore/corpse/tests/CorpseThreadTest.cpp: Added. * Source/JavaScriptCore/corpse/tests/CorpseThreadTest.h: Added. * Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.cpp: Added. * Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.h: Added. * Source/JavaScriptCore/corpse/tests/testLibJSCTools.cpp: Added. * Source/JavaScriptCore/mya/mya.cpp: Added. * Source/JavaScriptCore/shell/CMakeLists.txt: * Source/JavaScriptCore/shell/PlatformCocoa.cmake: * Tools/CISupport/ews-build/steps.py: * Tools/Scripts/run-javascriptcore-tests: * Tools/Scripts/webkitperl/BuildSubproject.pm: * Tools/Scripts/webkitpy/common/config/ports.py: * Tools/Scripts/webkitpy/common/config/ports_unittest.py: Canonical link: https://commits.webkit.org/320025@main
…` and `{scroll|view}-timeline-name` properties
https://bugs.webkit.org/show_bug.cgi?id=322739
rdar://186008235
Reviewed by Anne van Kesteren.
Track the style scope when parsing the `animation-timeline`, `scroll-timeline-name` and
`view-timeline-name` properties such that in a future patch we may correctly look up
progress-based timelines across style scopes and address bug 322013.
We simply change `Style::CustomIdent` to `Style::ScopedName` in `Style::SingleAnimationTimeline`
and `Style::ProgressTimelineName` and additionally switch from `AtomString` to `Style::ScopedName`
to represent a progress-based timeline's name.
* Source/WebCore/animation/CSSAnimation.cpp:
(WebCore::CSSAnimation::syncStyleOriginatedTimeline):
* Source/WebCore/animation/ScrollTimeline.cpp:
(WebCore::ScrollTimeline::create):
(WebCore::ScrollTimeline::createInactiveStyleOriginatedTimeline):
(WebCore::ScrollTimeline::ScrollTimeline):
(WebCore::ScrollTimeline::matchesAnonymousScrollFunctionForSource const):
* Source/WebCore/animation/ScrollTimeline.h:
(WebCore::ScrollTimeline::setName):
* Source/WebCore/animation/StyleOriginatedTimelinesController.cpp:
(WebCore::StyleOriginatedTimelinesController::registerNamedScrollTimeline):
(WebCore::StyleOriginatedTimelinesController::updateCSSAnimationsAssociatedWithNamedTimeline):
(WebCore::StyleOriginatedTimelinesController::registerNamedViewTimeline):
(WebCore::StyleOriginatedTimelinesController::attachAnimation):
(WebCore::StyleOriginatedTimelinesController::updateNamedTimelineMapForTimelineScope):
* Source/WebCore/animation/StyleOriginatedTimelinesController.h:
* Source/WebCore/animation/ViewTimeline.cpp:
(WebCore::ViewTimeline::create):
(WebCore::ViewTimeline::ViewTimeline):
(WebCore::ViewTimeline::matchesAnonymousViewFunctionForSubject const):
* Source/WebCore/animation/ViewTimeline.h:
* Source/WebCore/style/Styleable.cpp:
(WebCore::Styleable::updateCSSScrollTimelines const):
(WebCore::Styleable::updateCSSViewTimelines const):
* Source/WebCore/style/values/animations/StyleSingleAnimationTimeline.cpp:
(WebCore::Style::CSSValueConversion<SingleAnimationTimeline>::operator):
* Source/WebCore/style/values/animations/StyleSingleAnimationTimeline.h:
(WebCore::Style::SingleAnimationTimeline::SingleAnimationTimeline):
(WebCore::Style::SingleAnimationTimeline::isScopedName const):
(WebCore::Style::SingleAnimationTimeline::tryScopedName const):
(WebCore::Style::SingleAnimationTimeline::isCustomIdent const): Deleted.
(WebCore::Style::SingleAnimationTimeline::tryCustomIdent const): Deleted.
* Source/WebCore/style/values/scroll-animations/StyleProgressTimelineName.h:
Canonical link: https://commits.webkit.org/320026@main
https://bugs.webkit.org/show_bug.cgi?id=322526 Reviewed by Yusuke Suzuki. BBQ array.new_default of v128 still called operationWasmArrayNewEmpty. Pin a zero vector and use the existing store loop. * Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp: Canonical link: https://commits.webkit.org/320027@main
…l is failing https://bugs.webkit.org/show_bug.cgi?id=206001 Reviewed by Carlos Garcia Campos. The test fails because two divs of expected same size are actually different. One of the divs uses 'writing-mode: vertical-rl' with a custom 'OpenType @font-face' and 'width: 5ch'. This information is relevant because GLIB ports always build with OPENTYPE_VERTICAL enabled. A Font's constructor calls 'platformGlyphInit', which computes the font's zero-glyph width (used to resolve the CSS 'ch' unit) via 'FontInlines::widthForGlyph'. That method decides between the glyph's horizontal and vertical advance based on whether 'm_verticalData' is set, but at that point in construction it isn't set yet (it's only initialized further down in the constructor), so the width is always computed as horizontal, even for a genuinely vertical font. Simply moving initialization of 'm_verticalData' earlier doesn't work, as it creates side effects in a few tests that are legitimately passing (e.g fast/writing-mode/text-orientation-basic.html). Instead, this change leaves 'm_verticalData' initialization where it is and performs an independent 'OpenTypeVerticalData' lookup inside 'platformGlyphInit', with the goal of computing 'zero-glyph''s width correctly. As a result of this change, a few 'ch-units-vrl-XXX' tests which were wrongly passing before are now failing. * LayoutTests/platform/glib/TestExpectations: * Source/WebCore/platform/graphics/Font.cpp: (WebCore::m_shouldNotBeUsedForArabic): (WebCore::Font::platformGlyphInit): Canonical link: https://commits.webkit.org/320028@main
https://bugs.webkit.org/show_bug.cgi?id=322589 Reviewed by Carlos Garcia Campos. webkit-sysprof analyze reports 'theoretical FPS', the number of frames the engine produced over the analyzed duration. That says nothing about how long one frame took, nor where its time went. Add a 'frame cycle' reconstruction: a cycle runs from one LayerTreeHostRenderingUpdate of a process to the next, so the frame rate is 1 / cycle duration, and it splits into the rendering update, waiting for compositing, compositing and idle. The report gives the phase medians, how much of the analyzed duration the cycles cover, and the implied FPS while rendering, so a rate falling short can be told from a phase. Also add --explain, off by default, which prints what the report does and does not measure, and reject a timespan of no length rather than reporting zeroes for it. * Tools/Scripts/webkit-sysprof/README.md: * Tools/Scripts/webkit-sysprof/pyproject.toml: * Tools/Scripts/webkit-sysprof/webkitsysprof/__main__.py: (_add_subcommand): (build_parser): (main): * Tools/Scripts/webkit-sysprof/webkitsysprof/analyze/__init__.py: (_frame_rendering_reason): (_counted): (analyze): (_calculate_statistics): (_prepare_report): (_prepare_rendering_report): (_covered_duration): (_cycle_in_vblank_intervals): (_prepare_frame_cycle_report): (_calculate_frame_compositions_per_vblank): (_calculate_vblanks_per_rendering_update): (_render_text_report): (_analyzed_duration_sec): (_theoretical_fps_explanation): (_refresh_rate_explanation): (_percentile_strings): (_analyzed_cycles): (_render_frame_cycle_numbers): (_statistics_to_strings): (format_statistic): (_sysprof_data_to_high_level_representation): Deleted. (_statistics_to_strings.format_statistic): Deleted. * Tools/Scripts/webkit-sysprof/webkitsysprof/analyze/explanations.py: Added. * Tools/Scripts/webkit-sysprof/webkitsysprof/cycles/__init__.py: Added. (_MarkIndex): (_MarkIndex.__init__): (_MarkIndex.spans_within): (_MarkIndex.last_end_of_marks_beginning_within): (_marks_beginning_within): (within): (_compositing_indices_by_process): (_compositing_spans): (_own_compositing_end): (calculate_frame_cycles): (_cycles_of_one_process): * Tools/Scripts/webkit-sysprof/webkitsysprof/dump/__init__.py: (dump): (_marks_to_rows): * Tools/Scripts/webkit-sysprof/webkitsysprof/histogram/__init__.py: (delta_histogram): (_delta_times_ms): (_calculate_optimal_bins): (_plot_delta_time_distribution): (_calculate_delta_times_ms): Deleted. * Tools/Scripts/webkit-sysprof/webkitsysprof/parser/direct_parser.py: * Tools/Scripts/webkit-sysprof/webkitsysprof/summary/__init__.py: (_print_document_summary): * Tools/Scripts/webkit-sysprof/webkitsysprof/tests/frame_cycles_unittest.py: Added. (frame_cycle_report): (FrameCyclesTest): (FrameCyclesTest.test_phases_partition_every_resolved_cycle): (FrameCyclesTest.test_composition_ending_after_the_cycle_is_reported_as_an_overrun): (FrameCyclesTest.test_a_cycle_after_an_overrunning_composition_still_resolves): (FrameCyclesTest.test_cycles_without_compositing_marks_are_counted_but_not_analyzed): (FrameCyclesTest.test_the_gap_between_two_rendering_periods_is_reported_as_a_long_cycle): (FrameCyclesTest.test_the_compositing_mark_name_is_resolved_per_cycle): (FrameCyclesTest.test_compositing_is_over_when_the_last_compositing_mark_is): (FrameCyclesTest.test_compositing_overlapping_the_rendering_update_still_counts): (FrameCyclesTest.test_a_cycle_reaching_past_the_timespan_is_left_out_of_it): (FrameCyclesTest.test_a_capture_without_compositing_marks_keeps_its_cycles): (FrameCyclesTest.test_coverage_is_the_share_of_the_window_the_analyzed_cycles_took): (FrameCyclesTest.test_a_single_cycle_reports_no_percentiles_rather_than_failing): (FrameCyclesTest.test_no_cycles_at_all): (FrameCyclesTest.test_cycles_per_vblank_interval_is_unknown_without_vblank_marks): (FrameCyclesTest.test_cycles_are_restricted_to_the_ones_lying_within_the_timespan): (FrameCyclesTest.test_compositing_running_inside_the_rendering_update_still_resolves): (FrameCyclesTest.test_a_cycle_never_runs_between_two_processes): (FrameCyclesTest.test_a_cycle_spent_entirely_on_an_earlier_composition_is_analyzed): (FrameCyclesTest.test_coverage_merges_the_cycles_of_two_processes): (FrameCyclesTest.test_a_composition_begun_before_the_window_is_still_seen_in_it): (FrameCyclesTest.test_a_stall_is_seen_past_a_shorter_mark_of_the_same_name): (FrameCyclesTest.test_a_capture_of_negative_length_reports_no_rate): (FrameCyclesTest.test_no_cycles_says_so_rather_than_blaming_a_zero_median): (FrameCyclesTest.test_every_overrunning_composition_of_a_stall_is_counted): (FrameCyclesTest.test_a_cycle_running_a_sliver_of_an_inherited_composition_is_measured): (FrameCyclesTest.test_a_cycle_running_only_an_inherited_composition_is_measured): (FrameCyclesTest.test_a_cycle_composited_beside_its_update_only_is_measured_as_zero): (FrameCyclesTest.test_a_mark_ending_before_the_capture_keeps_its_own_end): (FrameCyclesTest.test_a_gap_between_two_compositions_is_a_wait_not_compositing): (FrameCyclesTest.test_two_renderers_of_one_kind_are_told_apart_by_their_process): (FrameCyclesTest.test_two_updates_at_one_instant_belong_to_two_processes): (FrameCyclesTest.test_a_report_without_a_rate_prints_no_rate): (FrameCyclesTest.test_a_steady_slow_capture_keeps_its_cycles): (FrameCyclesTest.test_the_composition_overrun_median_describes_the_overrunning_cycles): (FrameCyclesTest.test_an_unknown_refresh_rate_is_not_reported_as_zero): (FrameCyclesTest.test_a_zero_median_vblank_interval_is_not_reported_as_shared_timestamps): * Tools/Scripts/webkit-sysprof/webkitsysprof/tests/helpers.py: Added. (mark): (sysprof_data): (approx): (approx.__init__): (approx.__eq__): (approx.__repr__): (SysprofTestCase): (SysprofTestCase.setUp): (SysprofTestCase.stdout): * Tools/Scripts/webkit-sysprof/webkitsysprof/tests/subcommands_unittest.py: (SubcommandsTest): (SubcommandsTest.test_summary): (SubcommandsTest.test_dump_marks_csv): (SubcommandsTest.test_dump_counters_csv): (SubcommandsTest.test_dump_marks_json): (SubcommandsTest.test_dump_counters_json): (SubcommandsTest.test_analyze_text): (SubcommandsTest.test_analyze_text_with_explanations): (SubcommandsTest.test_analyze_json_percentiles_stay_within_the_data_range): (SubcommandsTest.test_analyze_json): (SubcommandsTest.test_analyze_json_frame_cycle_phases_add_up_to_cycle_duration): (SubcommandsTest.test_analyze_json_statistics_cover_all_relevant_marks): (SubcommandsTest.test_analyze_with_a_timespan_holding_vblanks_but_no_rendering_update): (SubcommandsTest.test_analyze_json_leaves_out_a_cycle_reaching_past_the_timespan): (SubcommandsTest.test_analyze_resolves_a_cycle_whose_compositing_marks_trimming_drops): (SubcommandsTest.test_explain_is_rejected_for_the_json_format_by_the_module_api): (SubcommandsTest.test_analyze_rejects_a_timespan_it_cannot_honour): (SubcommandsTest.test_analyze_clamps_a_timespan_reaching_past_the_capture): (SubcommandsTest.test_vblanks_per_rendering_update_does_not_depend_on_the_mark_order): (SubcommandsTest.test_a_capture_of_no_length_reports_no_rate): (SubcommandsTest.test_delta_histogram_deltas_come_from_the_requested_mark): (SubcommandsTest.test_delta_histogram_honours_the_timespan): (SubcommandsTest.test_analyze_json_counts_every_vblank_interval_of_the_timespan): (SubcommandsTest.test_frame_compositions_outside_the_vblank_range_are_left_out): (SubcommandsTest.test_frame_rendering_reasons_bucket_a_frame_that_named_none): (SubcommandsTest.test_frame_rendering_reasons_bucket_a_frame_that_named_none.did_render_frame): (SubcommandsTest.test_explain_reaches_the_report_through_the_command_line): (SubcommandsTest.test_a_capture_of_its_own_broken_timespan_is_no_usage_error): (SubcommandsTest.test_statistics_are_matched_by_wording_rather_than_word_position): (SubcommandsTest.test_explaining_an_empty_frame_cycle_section_still_explains_it): (SubcommandsTest.test_a_broken_capture_is_no_usage_error_even_with_a_timespan): (SubcommandsTest.test_a_window_meeting_the_capture_at_one_point_is_rejected): (SubcommandsTest.test_json_percentiles_keep_the_fiftieth): (SubcommandsTest.test_delta_histogram_keeps_the_processes_apart): (SubcommandsTest.test_composition_overrun_says_nothing_where_nothing_was_analyzed): (SubcommandsTest.test_an_update_ending_on_the_first_refresh_spans_it): (SubcommandsTest.test_refreshes_that_composited_nothing_are_samples_of_nothing): (SubcommandsTest.test_dump_csv_carries_every_column_of_a_row): (SubcommandsTest.test_a_window_without_refreshes_keeps_the_capture_interval): (SubcommandsTest.test_analyze_with_custom_timespan): (SubcommandsTest.test_analyze_with_custom_timespan_begin): (SubcommandsTest.test_analyze_with_custom_timespan_end): (_capture_stdout): Deleted. * Tools/Scripts/webkit-sysprof/webkitsysprof/tests/utils_unittest.py: Added. (UtilsTest): (UtilsTest.test_spans_are_merged_where_they_overlap_or_touch): (UtilsTest.test_a_timespan_bound_is_digits_and_nothing_else): (UtilsTest.test_percentiles_outside_the_range_of_the_quantiles_are_rejected): (UtilsTest.test_a_bare_bound_is_the_begin_of_the_timespan): (UtilsTest.test_vblank_intervals_do_not_depend_on_the_order_of_the_marks): (UtilsTest.test_reshaping_the_same_parsed_data_twice_yields_the_same_result): * Tools/Scripts/webkit-sysprof/webkitsysprof/utils/__init__.py: (msec_to_nsec): (UsageError): (mark_begin): (parse_timespan_argument): (parse_timespan_argument.parse_bound): (sysprof_data_with_marks_by_name): (check_timespan_holds_data): (trim_marks_by_name_to_timespan): (mark_in_timespan): (merged_spans): (sample_statistics): (percentiles): (mark_pid): (marks_by_process): (marks_in_time_order): (intervals_between_marks): (display_refreshes): (median_vblank_interval): (trim_sysprof_data_to_timespan): Deleted. Canonical link: https://commits.webkit.org/320029@main
https://bugs.webkit.org/show_bug.cgi?id=322699 Reviewed by Ryosuke Niwa. WebEvent subclassed CanMakeThreadSafeCheckedPtr with CheckedPtrDeleteCheckException::Yes, because CanMakeCheckedPtr only works as intended for heap-allocated objects: WebEvent and its subclasses were routinely stack-allocated, so operator delete never ran, setDidBeginCheckedPtrDeletion() was never called, and the delete check in ~CanMakeCheckedPtrBase() could not hold. Make the hierarchy always heap-allocated instead. WebEvent now derives from ThreadSafeRefCounted<WebEvent> and each concrete class is created through a static create() returning Ref<>. CanMakeThreadSafeCheckedPtr, WTF_OVERRIDE_DELETE_FOR_CHECKED_PTR and the CheckedPtrDeleteCheckException::Yes exception are all removed from WebEvent. Refcounting is thread-safe because EventDispatcher handles wheel and touch events on the IPC background queue before hopping to the main thread, which is also why the class opted into the thread-safe checked-ptr variant previously. Each subclass previously took a WebEvent&& and move-constructed its base, which forced callers to materialize a stack WebEvent - precisely what the delete check cannot tolerate, and impossible once the base is refcounted, since ThreadSafeRefCountedBase holds a std::atomic<unsigned> and so has no copy or move constructor. That pattern is replaced by plain data structs: WebEventData for the fields common to every event, plus a per-class WebMouseEventData / WebKeyboardEventData / WebWheelEventData / WebTouchEventData / WebGestureEventData. Each event class stores exactly one of these and its accessors delegate to it. The per-port WebEventFactory functions returned event values, and each NativeWebXEvent constructor sliced its base from one. They now return a WebXEventInit (a WebEventData plus a WebXEventData), which both WebXEvent::create() and NativeWebXEvent::create() consume, so a native event is still only parsed once. Fields that no constructor on a given platform ever set are no longer stored, and their accessors return the constant instead: pointerId/pointerType on MAC, unmodifiedText/macCharCode/ isSystemKey on GTK and WPE, and directionInvertedFromDevice/momentumEndType off COCOA. This is what makes "the data struct is exactly the serialized fields" true on every platform. The IPC wire format is unchanged. Each event class is [RefCounted] in WebEvent.serialization.in with two members, eventData() and xData(), whose fields are declared in the same order as before, so the same values are encoded in the same sequence. Predicted mouse events are deliberately still not serialized - WebMouseEvent keeps them outside its data struct - because putting them on the wire would switch on a currently dormant PointerEvent.getPredictedEvents() path for mouse. The data structs are [CustomHeader] since they live in their event class's header rather than one named after themselves. Three sites copied an event and then mutated the copy, which was safe only while events had value semantics: EventDispatcher coalescing touch moves, WebPageProxy::sendWheelEvent capturing the event before adjusting its position, and the remote-frame transform in WebPageIOS. They now call an explicit copy(). WebTouchEvent::copy() is a deep copy because transformToRemoteFrameCoordinates() mutates the coalesced and predicted children in place. Relatedly, processNextQueuedMouseEvent() appended the event into the very vector the event was about to own, which as a Ref would have been a reference cycle; it now appends a copy. Every concrete class gets its own WTF_MAKE_TZONE_ALLOCATED. Allocating subclasses through WebEvent's allocator would compile, but TZoneHeap's operator new only takes the fast path when size == sizeof(the declaring type), so every event would have fallen through to operatorNewSlow and lost TZone's per-type isolation. WebWheelEvent::Granularity and ::MomentumEndType move to namespace scope as WebWheelEventGranularity and WebWheelEventMomentumEndType, with using aliases left in the class, because a namespace-scope WebWheelEventData cannot name enums nested inside WebWheelEvent. All existing WebWheelEvent::Granularity spellings keep working. The two remaining CheckedPtr clients become RefPtr: CurrentEvent::m_previousCurrentEvent in WebPage.cpp and the local in PluginView.cpp. Both are synchronous and the event is guaranteed live, so an owning reference is both cheaper and safer than a checked one. The g_currentEvent global stays a raw pointer so that dispatching an event, which happens for every mouse move, does not touch a refcount. * Source/WebKit/Shared/NativeWebGestureEvent.h: * Source/WebKit/Shared/NativeWebKeyboardEvent.h: * Source/WebKit/Shared/NativeWebMouseEvent.h: * Source/WebKit/Shared/NativeWebTouchEvent.h: * Source/WebKit/Shared/NativeWebWheelEvent.h: * Source/WebKit/Shared/RemoteWebTouchEvent.h: * Source/WebKit/Shared/RemoteWebTouchEvent.serialization.in: * Source/WebKit/Shared/WebEvent.cpp: (WebKit::generateSignpostIdentifier): (WebKit::WebEvent::WebEvent): * Source/WebKit/Shared/WebEvent.h: (WebKit::WebEvent::type const): (WebKit::WebEvent::shiftKey const): (WebKit::WebEvent::controlKey const): (WebKit::WebEvent::altKey const): (WebKit::WebEvent::metaKey const): (WebKit::WebEvent::capsLockKey const): (WebKit::WebEvent::modifiers const): (WebKit::WebEvent::timestamp const): (WebKit::WebEvent::authorizationToken const): (WebKit::WebEvent::signpostIdentifier const): * Source/WebKit/Shared/WebEvent.serialization.in: * Source/WebKit/Shared/WebEventConversion.cpp: (WebKit::WebKit2PlatformMouseEvent::WebKit2PlatformMouseEvent): (WebKit::WebKit2PlatformTouchEvent::WebKit2PlatformTouchEvent): * Source/WebKit/Shared/WebKeyboardEvent.cpp: (WebKit::WebKeyboardEvent::create): (WebKit::WebKeyboardEvent::WebKeyboardEvent): * Source/WebKit/Shared/WebKeyboardEvent.h: (WebKit::WebKeyboardEvent::windowsVirtualKeyCode const): (WebKit::WebKeyboardEvent::setWindowsVirtualKeyCode): (WebKit::WebKeyboardEvent::nativeVirtualKeyCode const): (WebKit::WebKeyboardEvent::macCharCode const): (WebKit::WebKeyboardEvent::handledByInputMethod const): (WebKit::WebKeyboardEvent::isAutoRepeat const): (WebKit::WebKeyboardEvent::isKeypad const): (WebKit::WebKeyboardEvent::isSystemKey const): * Source/WebKit/Shared/WebMouseEvent.cpp: (WebKit::WebMouseEvent::create): (WebKit::WebMouseEvent::copy const): (WebKit::WebMouseEvent::WebMouseEvent): * Source/WebKit/Shared/WebMouseEvent.h: (WebKit::WebMouseEvent::button const): (WebKit::WebMouseEvent::buttons const): (WebKit::WebMouseEvent::setPosition): (WebKit::WebMouseEvent::deltaX const): (WebKit::WebMouseEvent::deltaY const): (WebKit::WebMouseEvent::deltaZ const): (WebKit::WebMouseEvent::clickCount const): (WebKit::WebMouseEvent::eventNumber const): (WebKit::WebMouseEvent::menuTypeForEvent const): (WebKit::WebMouseEvent::isTouchEvent const): (WebKit::WebMouseEvent::force const): (WebKit::WebMouseEvent::inputSource const): (WebKit::WebMouseEvent::canInitiateDrag const): (WebKit::WebMouseEvent::syntheticClickType const): (WebKit::WebMouseEvent::pointerId const): (WebKit::WebMouseEvent::gestureWasCancelled const): (WebKit::WebMouseEvent::setCoalescedEvents): (WebKit::WebMouseEvent::setPredictedEvents): (WebKit::WebMouseEvent::WebMouseEvent): Deleted. (WebKit::WebMouseEvent::position const): Deleted. (WebKit::WebMouseEvent::coalescedEvents const): Deleted. (WebKit::WebMouseEvent::predictedEvents const): Deleted. * Source/WebKit/Shared/WebTouchEvent.cpp: (WebKit::WebTouchEvent::create): (WebKit::WebTouchEvent::WebTouchEvent): (WebKit::WebTouchEvent::copy const): (WebKit::WebTouchEvent::transformToRemoteFrameCoordinates): * Source/WebKit/Shared/WebTouchEvent.h: (WebKit::WebTouchEvent::setCoalescedEvents): (WebKit::WebTouchEvent::setPredictedEvents): (WebKit::WebTouchEvent::position const): (WebKit::WebTouchEvent::isPotentialTap const): (WebKit::WebTouchEvent::isGesture const): (WebKit::WebTouchEvent::gestureScale const): (WebKit::WebTouchEvent::gestureRotation const): (WebKit::WebTouchEvent::canPreventNativeGestures const): (WebKit::WebTouchEvent::setCanPreventNativeGestures): (WebKit::WebTouchEvent::WebTouchEvent): Deleted. * Source/WebKit/Shared/WebWheelEvent.cpp: (WebKit::WebWheelEvent::create): (WebKit::WebWheelEvent::copy const): (WebKit::WebWheelEvent::WebWheelEvent): * Source/WebKit/Shared/WebWheelEvent.h: (WebKit::WebWheelEvent::position const): (WebKit::WebWheelEvent::setPosition): (WebKit::WebWheelEvent::globalPosition const): (WebKit::WebWheelEvent::delta const): (WebKit::WebWheelEvent::wheelTicks const): (WebKit::WebWheelEvent::granularity const): (WebKit::WebWheelEvent::directionInvertedFromDevice const): (WebKit::WebWheelEvent::momentumEndType const): (WebKit::WebWheelEvent::phase const): (WebKit::WebWheelEvent::momentumPhase const): (WebKit::WebWheelEvent::hasPreciseScrollingDeltas const): (WebKit::WebWheelEvent::ioHIDEventTimestamp const): (WebKit::WebWheelEvent::rawPlatformDelta const): (WebKit::WebWheelEvent::setRawPlatformDelta): (WebKit::WebWheelEvent::scrollCount const): (WebKit::WebWheelEvent::inputSource const): (WebKit::WebWheelEvent::momentumFastScrollMultiplier const): (WebKit::WebWheelEvent::setMomentumFastScrollMultiplier): * Source/WebKit/Shared/WebWheelEventCoalescer.cpp: (WebKit::WebWheelEventCoalescer::coalesce): (WebKit::WebWheelEventCoalescer::nextEventToDispatch): (WebKit::WebWheelEventCoalescer::shouldDispatchEvent): (WebKit::WebWheelEventCoalescer::takeOldestEventBeingProcessed): (WebKit::operator<<): Deleted. * Source/WebKit/Shared/WebWheelEventCoalescer.h: * Source/WebKit/Shared/gtk/NativeWebKeyboardEventGtk.cpp: (WebKit::NativeWebKeyboardEvent::create): (WebKit::NativeWebKeyboardEvent::NativeWebKeyboardEvent): (): Deleted. * Source/WebKit/Shared/gtk/NativeWebMouseEventGtk.cpp: (WebKit::NativeWebMouseEvent::create): (WebKit::NativeWebMouseEvent::NativeWebMouseEvent): * Source/WebKit/Shared/gtk/NativeWebTouchEventGtk.cpp: (WebKit::NativeWebTouchEvent::create): (WebKit::NativeWebTouchEvent::NativeWebTouchEvent): (): Deleted. * Source/WebKit/Shared/gtk/NativeWebWheelEventGtk.cpp: (WebKit::NativeWebWheelEvent::create): (WebKit::NativeWebWheelEvent::NativeWebWheelEvent): * Source/WebKit/Shared/gtk/WebEventFactory.cpp: (WebKit::WebEventFactory::createWebMouseEvent): (WebKit::WebEventFactory::createWebKeyboardEvent): (WebKit::WebEventFactory::createWebTouchEvent): (WebKit::WebEventFactory::createWebWheelEvent): * Source/WebKit/Shared/gtk/WebEventFactory.h: * Source/WebKit/Shared/ios/NativeWebKeyboardEventIOS.mm: (WebKit::NativeWebKeyboardEvent::create): (WebKit::NativeWebKeyboardEvent::NativeWebKeyboardEvent): * Source/WebKit/Shared/ios/NativeWebMouseEventIOS.mm: (WebKit::NativeWebMouseEvent::create): (WebKit::NativeWebMouseEvent::NativeWebMouseEvent): (): Deleted. * Source/WebKit/Shared/ios/NativeWebTouchEventIOS.mm: (WebKit::NativeWebTouchEvent::extractCoalescedWebTouchEvents): (WebKit::NativeWebTouchEvent::extractPredictedWebTouchEvents): (WebKit::NativeWebTouchEvent::create): (WebKit::NativeWebTouchEvent::NativeWebTouchEvent): (): Deleted. * Source/WebKit/Shared/ios/WebIOSEventFactory.h: * Source/WebKit/Shared/ios/WebIOSEventFactory.mm: (WebKit::WebIOSEventFactory::createWebKeyboardEvent): (WebKit::WebIOSEventFactory::createWebMouseEvent): (WebKit::WebIOSEventFactory::createWebWheelEvent): * Source/WebKit/Shared/libwpe/NativeWebKeyboardEventLibWPE.cpp: (WebKit::NativeWebKeyboardEvent::create): (WebKit::NativeWebKeyboardEvent::NativeWebKeyboardEvent): * Source/WebKit/Shared/libwpe/NativeWebMouseEventLibWPE.cpp: (WebKit::NativeWebMouseEvent::create): (WebKit::NativeWebMouseEvent::NativeWebMouseEvent): * Source/WebKit/Shared/libwpe/NativeWebTouchEventLibWPE.cpp: (WebKit::NativeWebTouchEvent::create): (WebKit::NativeWebTouchEvent::NativeWebTouchEvent): * Source/WebKit/Shared/libwpe/NativeWebWheelEventLibWPE.cpp: (WebKit::NativeWebWheelEvent::create): (WebKit::NativeWebWheelEvent::NativeWebWheelEvent): * Source/WebKit/Shared/libwpe/WebEventFactory.cpp: (WebKit::WebEventFactory::createWebKeyboardEvent): (WebKit::WebEventFactory::createWebMouseEvent): (WebKit::WebEventFactory::createWebWheelEvent): (WebKit::WebEventFactory::createWebTouchEvent): * Source/WebKit/Shared/libwpe/WebEventFactory.h: * Source/WebKit/Shared/mac/NativeWebGestureEventMac.mm: (WebKit::NativeWebGestureEvent::create): (WebKit::NativeWebGestureEvent::NativeWebGestureEvent): * Source/WebKit/Shared/mac/NativeWebKeyboardEventMac.mm: (WebKit::NativeWebKeyboardEvent::create): (WebKit::NativeWebKeyboardEvent::NativeWebKeyboardEvent): * Source/WebKit/Shared/mac/NativeWebMouseEventMac.mm: (WebKit::NativeWebMouseEvent::create): (WebKit::NativeWebMouseEvent::NativeWebMouseEvent): * Source/WebKit/Shared/mac/NativeWebWheelEventMac.mm: (WebKit::NativeWebWheelEvent::create): (WebKit::NativeWebWheelEvent::NativeWebWheelEvent): * Source/WebKit/Shared/mac/WebEventFactory.h: * Source/WebKit/Shared/mac/WebEventFactory.mm: (WebKit::WebEventFactory::createWebMouseEvent): (WebKit::WebEventFactory::createWebWheelEvent): (WebKit::WebEventFactory::createWebKeyboardEvent): * Source/WebKit/Shared/mac/WebGestureEvent.cpp: (WebKit::WebGestureEvent::create): (WebKit::WebGestureEvent::WebGestureEvent): (WebKit::WebGestureEvent::isGestureEventType): (WebKit::WebGestureEvent::isGestureEventType const): Deleted. * Source/WebKit/Shared/mac/WebGestureEvent.h: (WebKit::WebGestureEvent::position const): (WebKit::WebGestureEvent::gestureScale const): (WebKit::WebGestureEvent::gestureRotation const): (WebKit::WebGestureEvent::phase const): (WebKit::WebGestureEvent::WebGestureEvent): Deleted. * Source/WebKit/Shared/win/NativeWebKeyboardEventWin.cpp: (WebKit::NativeWebKeyboardEvent::create): (WebKit::NativeWebKeyboardEvent::NativeWebKeyboardEvent): * Source/WebKit/Shared/win/NativeWebMouseEventWin.cpp: (WebKit::NativeWebMouseEvent::create): (WebKit::NativeWebMouseEvent::NativeWebMouseEvent): * Source/WebKit/Shared/win/NativeWebTouchEventWin.cpp: (WebKit::NativeWebTouchEvent::create): (WebKit::NativeWebTouchEvent::NativeWebTouchEvent): * Source/WebKit/Shared/win/NativeWebWheelEventWin.cpp: (WebKit::NativeWebWheelEvent::create): (WebKit::NativeWebWheelEvent::NativeWebWheelEvent): * Source/WebKit/Shared/win/WebEventFactory.cpp: (WebKit::WebEventFactory::createWebMouseEvent): (WebKit::WebEventFactory::createWebWheelEvent): (WebKit::WebEventFactory::createWebKeyboardEvent): (WebKit::WebEventFactory::createWebTouchEvent): * Source/WebKit/Shared/win/WebEventFactory.h: * Source/WebKit/Shared/wpe/NativeWebKeyboardEventWPE.cpp: (WebKit::NativeWebKeyboardEvent::create): (WebKit::NativeWebKeyboardEvent::NativeWebKeyboardEvent): Deleted. (): Deleted. * Source/WebKit/Shared/wpe/NativeWebMouseEventWPE.cpp: (WebKit::NativeWebMouseEvent::create): (WebKit::NativeWebMouseEvent::NativeWebMouseEvent): Deleted. * Source/WebKit/Shared/wpe/NativeWebTouchEventWPE.cpp: (WebKit::NativeWebTouchEvent::create): (WebKit::NativeWebTouchEvent::NativeWebTouchEvent): * Source/WebKit/Shared/wpe/NativeWebWheelEventWPE.cpp: (WebKit::NativeWebWheelEvent::create): (WebKit::NativeWebWheelEvent::NativeWebWheelEvent): Deleted. * Source/WebKit/Shared/wpe/WebEventFactoryWPE.cpp: (WebKit::WebEventFactory::createWebMouseEvent): (WebKit::WebEventFactory::createWebWheelEvent): (WebKit::WebEventFactory::createWebKeyboardEvent): (WebKit::WebEventFactory::createWebTouchEvent): * Source/WebKit/UIProcess/API/C/playstation/WKPagePrivatePlayStation.cpp: (WKPageHandleKeyboardEvent): (WKPageHandleMouseEvent): (WKPageHandleWheelEvent): * Source/WebKit/UIProcess/API/C/wpe/WKPagePrivateWPE.cpp: (WKPageHandleKeyboardEvent): (WKPageHandleMouseEvent): * Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp: (webkitWebViewBaseKeyPressEvent): (webkitWebViewBaseKeyReleaseEvent): (webkitWebViewBaseKeyPressed): (webkitWebViewBaseKeyReleased): (webkitWebViewBaseHandleMouseEvent): (webkitWebViewBaseButtonPressed): (webkitWebViewBaseButtonReleased): (webkitWebViewBaseScrollEvent): (handleScroll): (webkitWebViewBaseEnter): (webkitWebViewBaseMotion): (webkitWebViewBaseLeave): (webkitWebViewBaseTouchEvent): (webkitWebViewBaseSynthesizeCompositionKeyPress): (webkitWebViewBaseSynthesizeMouseEvent): (webkitWebViewBaseSynthesizeKeyEvent): (webkitWebViewBaseSynthesizeWheelEvent): (webkitWebViewBaseSynthesizeTouchEvent): * Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp: (WebKit::PageClientImpl::doneWithTouchEvent): * Source/WebKit/UIProcess/API/wpe/WPEWebViewLegacy.cpp: (WKWPE::ViewLegacy::ViewLegacy): (WKWPE::ViewLegacy::handleKeyboardEvent): (WKWPE::ViewLegacy::synthesizeCompositionKeyPress): * Source/WebKit/UIProcess/API/wpe/WPEWebViewPlatform.cpp: (WKWPE::ViewPlatform::handleEvent): (WKWPE::ViewPlatform::handleGesture): (WKWPE::ViewPlatform::synthesizeCompositionKeyPress): * Source/WebKit/UIProcess/Automation/win/WebAutomationSessionWin.cpp: (WebKit::doMouseButtonEvent): (WebKit::WebAutomationSession::platformSimulateKeyboardInteraction): (WebKit::WebAutomationSession::platformSimulateKeySequence): * Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp: (WebKit::RemoteScrollingCoordinatorProxy::handleWheelEvent): (WebKit::RemoteScrollingCoordinatorProxy::continueWheelEventHandling): * Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.h: * Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h: * Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm: (WebKit::RemoteLayerTreeEventDispatcher::willHandleWheelEvent): (WebKit::RemoteLayerTreeEventDispatcher::handleWheelEvent): (WebKit::RemoteLayerTreeEventDispatcher::continueWheelEventHandling): * Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.h: * Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.mm: (WebKit::RemoteScrollingCoordinatorProxyMac::handleWheelEvent): * Source/WebKit/UIProcess/ViewGestureController.h: * Source/WebKit/UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::setInitialFocus): (WebKit::removeOldRedundantEvent): (WebKit::WebPageProxy::sendMouseEvent): (WebKit::WebPageProxy::handleMouseEvent): (WebKit::WebPageProxy::dispatchMouseDidMoveOverElementAsynchronously): (WebKit::WebPageProxy::processNextQueuedMouseEvent): (WebKit::WebPageProxy::processNextQueuedGestureEvent): (WebKit::WebPageProxy::handleNativeWheelEvent): (WebKit::WebPageProxy::handleWheelEvent): (WebKit::WebPageProxy::continueWheelEventHandling): (WebKit::WebPageProxy::sendWheelEvent): (WebKit::WebPageProxy::wheelEventHandlingCompleted): (WebKit::WebPageProxy::sendKeyEvent): (WebKit::WebPageProxy::handleKeyboardEvent): (WebKit::WebPageProxy::sendGestureEvent): (WebKit::WebPageProxy::handleGestureEvent): (WebKit::WebPageProxy::processNextQueuedTouchEvent): (WebKit::WebPageProxy::handleTouchEvent): (WebKit::WebPageProxy::touchEventHandlingCompleted): (WebKit::WebPageProxy::Internals::currentlyProcessedMouseDownEvent): (WebKit::WebPageProxy::mouseEventHandlingCompleted): (WebKit::WebPageProxy::gestureEventHandlingCompleted): (WebKit::WebPageProxy::keyEventHandlingCompleted): * Source/WebKit/UIProcess/WebPageProxy.h: * Source/WebKit/UIProcess/WebPageProxyInternals.h: (WebKit::QueuedTouchEvents::QueuedTouchEvents): * Source/WebKit/UIProcess/gtk/PointerLockManager.cpp: (WebKit::PointerLockManager::handleMotion): * Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm: (-[WKContentView _touchEventsRecognized]): * Source/WebKit/UIProcess/ios/WKMouseInteraction.mm: (-[WKMouseInteraction createMouseEventWithType:wasCancelled:]): (-[WKMouseInteraction handleGameControllerMouseMove:deltaY:]): * Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm: (-[WKAppKitGestureController sendWheelEventForGesture:]): (-[WKAppKitGestureController startMomentumIfNeededForGesture:]): * Source/WebKit/UIProcess/mac/ViewGestureControllerMac.mm: (WebKit::ViewGestureController::PendingSwipeTracker::scrollEventCanStartSwipe): (WebKit::ViewGestureController::PendingSwipeTracker::scrollEventCanEndSwipe): (WebKit::ViewGestureController::PendingSwipeTracker::scrollEventCanInfluenceSwipe): (WebKit::ViewGestureController::PendingSwipeTracker::scrollEventGetScrollingDeltas): (WebKit::ViewGestureController::handleScrollWheelEvent): * Source/WebKit/UIProcess/mac/WKFullScreenWindowController.mm: (-[WKFullScreenWindowController finishedEnterFullScreenAnimation:]): * Source/WebKit/UIProcess/mac/WebPageProxyMac.mm: (WebKit::WebPageProxy::shouldDelayWindowOrderingForEvent): (WebKit::WebPageProxy::acceptsFirstMouse): (WebKit::WebPageProxy::interruptSyntheticMomentumScrolling): * Source/WebKit/UIProcess/mac/WebViewImpl.mm: (WebKit::WebViewImpl::becomeFirstResponder): (WebKit::WebViewImpl::acceptsFirstMouse): (WebKit::WebViewImpl::shouldDelayWindowOrderingForEvent): (WebKit::WebViewImpl::scheduleMouseDidMoveOverElement): (WebKit::WebViewImpl::pressureChangeWithEvent): (WebKit::WebViewImpl::tryToSwipeWithEvent): (WebKit::WebViewImpl::scrollWheel): (WebKit::WebViewImpl::performKeyEquivalent): (WebKit::WebViewImpl::keyUp): (WebKit::WebViewImpl::keyDown): (WebKit::WebViewImpl::flagsChanged): (WebKit::WebViewImpl::nativeMouseEventHandler): * Source/WebKit/UIProcess/win/WebPageProxyWin.cpp: (WebKit::WebPageProxy::dispatchPendingCharEvents): * Source/WebKit/UIProcess/win/WebView.cpp: (WebKit::WebView::onMouseEvent): (WebKit::WebView::onWheelEvent): (WebKit::WebView::onKeyEvent): * Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm: (WebKit::PDFPlugin::showContextMenuAtPoint): * Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.mm: (WebKit::PDFPluginBase::showContextMenuAtPoint): * Source/WebKit/WebProcess/Plugins/PluginView.cpp: (WebKit::PluginView::handleEvent): * Source/WebKit/WebProcess/WebPage/EventDispatcher.cpp: (WebKit::EventDispatcher::internalWheelEvent): (WebKit::EventDispatcher::wheelEvent): (WebKit::EventDispatcher::gestureEvent): (WebKit::TouchEventData::TouchEventData): (WebKit::EventDispatcher::touchEvent): (WebKit::EventDispatcher::dispatchWheelEventViaMainThread): * Source/WebKit/WebProcess/WebPage/EventDispatcher.h: * Source/WebKit/WebProcess/WebPage/EventDispatcher.messages.in: * Source/WebKit/WebProcess/WebPage/MomentumEventDispatcher.cpp: (WebKit::MomentumEventDispatcher::handleWheelEvent): (WebKit::MomentumEventDispatcher::dispatchSyntheticMomentumEvent): (WebKit::MomentumEventDispatcher::didStartMomentumPhase): * Source/WebKit/WebProcess/WebPage/MomentumEventDispatcher.h: * Source/WebKit/WebProcess/WebPage/WebPage.cpp: (WebKit::WebPage::mouseEvent): (WebKit::WebPage::performHitTestForMouseEvent): (WebKit::WebPage::handleWheelEvent): (WebKit::WebPage::dispatchWheelEventWithoutScrolling): (WebKit::WebPage::keyEvent): (WebKit::WebPage::touchEvent): (WebKit::WebPage::setInitialFocus): * Source/WebKit/WebProcess/WebPage/WebPage.h: * Source/WebKit/WebProcess/WebPage/WebPage.messages.in: * Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm: (WebKit::transformEventIfNecessary): (WebKit::WebPage::dispatchAsynchronousTouchEvents): * Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm: (WebKit::WebPage::shouldDelayWindowOrderingEvent): (WebKit::WebPage::requestAcceptsFirstMouse): Canonical link: https://commits.webkit.org/320030@main
https://bugs.webkit.org/show_bug.cgi?id=322614 Reviewed by Carlos Alberto Lopez Perez. The test reports two types that reach IPC on the ports using Unix domain sockets and cannot be described. UnixFileDescriptor is their IPC::Attachment, the role MachSendRight has on Darwin (Platform/IPC/Attachment.h); attachments are passed out of band by a hand-written coder and have no members, which is why MachSendRight is already allowlisted. It was also spelled two ways, and only the unqualified form is registered. GTlsCertificateFlags is a GIO C flags enum, and the generator only parses enum class, the same reason WebCore::ContextMenuAction is allowlisted. Describing it would mean mirroring GIO's flags in WebKit. Allowlist both and unskip. GTK and WPE report identical sets, so one line covers them. * LayoutTests/ipc/serialized-type-info.html: * LayoutTests/platform/glib/TestExpectations: * Source/WebKit/Shared/WebGL.serialization.in: * Source/WebKit/Shared/XR/PlatformXR.serialization.in: * Source/WebKit/Shared/glib/CoreIPCGUnixFDList.serialization.in: * Source/WebKit/Shared/glib/DMABufBufferAttributes.serialization.in: Canonical link: https://commits.webkit.org/320031@main
…cted`s in Swift https://bugs.webkit.org/show_bug.cgi?id=322806 rdar://186056463 Reviewed by Adrian Taylor. Add new CxxExpected and CxxConsumingExpected Swift protocols to be able to easily interoperate with `std::expected` types. Test: Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTests.swift * Source/WebKit/Shared/WTFExpected+Extras.swift: Added. (CxxExpectedBase.has_value): (CxxExpectedBase.__valueUnsafe): (CxxExpectedBase.__errorUnsafe): (CxxExpected.value): (CxxConsumingExpected.__take(_:)): (CxxConsumingExpected.consume() throws(CxxUnexpected<Failure>:)): * Source/WebKit/WebKit.xcodeproj/project.pbxproj: * Tools/TestWebKitAPI/Helpers/WTFExpected+Extras.swift: Added. (CxxExpectedBase.has_value): (CxxExpectedBase.__valueUnsafe): (CxxExpectedBase.__errorUnsafe): (CxxExpected.value): (CxxConsumingExpected.__take(_:)): (CxxConsumingExpected.consume() throws(CxxUnexpected<Failure>:)): * Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.cpp: (SwiftCxxInteropTestbed::sharedProbeRefCount): (SwiftCxxInteropTestbed::makeIntExpected): (SwiftCxxInteropTestbed::makeIntUnexpected): (SwiftCxxInteropTestbed::makeCopyCountingProbeExpected): (SwiftCxxInteropTestbed::makeCopyCountingProbeUnexpected): (SwiftCxxInteropTestbed::makeSharedProbeHolderExpected): (SwiftCxxInteropTestbed::makeMoveOnlyProbeExpected): (SwiftCxxInteropTestbed::makeMoveOnlyProbeUnexpected): (SwiftCxxInteropTestbed::makeSelfReferentialProbeExpected): * Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.h: (SwiftCxxInteropTestbed::takeMoveOnlyProbeValue): (SwiftCxxInteropTestbed::takeSelfReferentialProbeValue): * Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: * Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTests.swift: (Cxx.__take(_:)): (SwiftCxxInteropTests.expectedExposesItsValue): (SwiftCxxInteropTests.unexpectedThrowsItsError): (SwiftCxxInteropTests.readingTheValueLeavesTheExpectedAlone): (SwiftCxxInteropTests.readingAnUnexpectedLeavesTheErrorInPlace): (SwiftCxxInteropTests.readingACopyableValueCopiesItExactlyOnce): (SwiftCxxInteropTests.theValueOutlivesTheExpectedItWasReadFrom): (SwiftCxxInteropTests.readingAnUnexpectedNeverTouchesTheValue): (SwiftCxxInteropTests.valueHoldingAManagedReferenceLeavesTheCallersCountAlone): (SwiftCxxInteropTests.noncopyableValueCanBeConsumed): (SwiftCxxInteropTests.consumingAnUnexpectedThrowsItsError): (SwiftCxxInteropTests.consumedNoncopyableValueIsRelocatedWithItsMoveConstructor): Canonical link: https://commits.webkit.org/320032@main
https://bugs.webkit.org/show_bug.cgi?id=322823 Unreviewed gardening. * LayoutTests/platform/glib/TestExpectations: * LayoutTests/platform/gtk/TestExpectations: * LayoutTests/platform/wpe/TestExpectations: Canonical link: https://commits.webkit.org/320033@main
https://bugs.webkit.org/show_bug.cgi?id=321274 rdar://184322389 Reviewed by Sam Weinig. Ensure we don't enter an infinite loop under `UnitBezier::solveCurveX()` by enforcing a minimal value for `epsilon` larger than 0. Test: imported/w3c/web-platform-tests/css/css-transitions/transition-duration-infinite-cancelation.html * LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-duration-infinite-cancelation-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-duration-infinite-cancelation.html: Added. * Source/WebCore/platform/graphics/UnitBezier.h: (WebCore::UnitBezier::solveCurveX): Canonical link: https://commits.webkit.org/320034@main
https://bugs.webkit.org/show_bug.cgi?id=317644 Reviewed by Adrian Perez de Castro. This patch adds the packages 'monado-cli', 'monado-service' and 'libopenxr1-monado' to the APT dependencies list. All these packages are available on the currently supported distributions, except for Debian 12. Thus, the packages are guarded by 'aptIfExists'. * Tools/glib/dependencies/apt: Canonical link: https://commits.webkit.org/320035@main
https://bugs.webkit.org/show_bug.cgi?id=322829 Reviewed by Ross Kirsling. The LINKER: prefix is built into CMake and arranges for tools to pass arguments through compiler drivers directly to linkers. In the case of the PlayStation port, this LINKER: prefix is being substituted for -Xlinker, but it appears that -Wl is more likely correct. Canonical link: https://commits.webkit.org/320036@main
https://bugs.webkit.org/show_bug.cgi?id=322769 rdar://186031593 Reviewed by Mike Wyrzykowski. Both strings appear in WGSL diagnostics. * Source/WebGPU/WGSL/GlobalVariableRewriter.cpp: (WGSL::nameForPrimitiveKind): * Source/WebGPU/WGSL/Types.h: Canonical link: https://commits.webkit.org/320037@main
https://bugs.webkit.org/show_bug.cgi?id=321751 Reviewed by Adrian Perez de Castro. The reporter fixed this upstream, just add a test. Canonical link: https://commits.webkit.org/320038@main
https://bugs.webkit.org/show_bug.cgi?id=322866 rdar://186115028 Reviewed by Aakash Jain. EWS computes a flakiness verdict for every layout-test failure it cannot explain as a pre-existing failure, then throws it away: `SHOULD_IGNORE_FLAKY_TESTS` is `False`, so a convicted test stays in `failing_tests_filtered` and still blames the pull request. A recent 48-hour window produced 1292 such convictions across 4737 builds. Act on them. `INCLUDED_FLAKY_VERDICTS` names the verdicts a queue ignores a failure for, one entry per verdict rather than one boolean for all three, so a verdict can be withdrawn from production without reverting the read path. All three are included. The results-db log reports `Ignored` and `Would have ignored` separately and counts the tests each applied to, not every conviction. `AUTHORS_FOR_DIRTY_TREE_FLAKE` rises from 1 to 2. A build's first run reports its own flakes before its re-run reads them back, so a `DirtyTree` conviction could rest on one author's stack of pull requests excusing its own regression. Requiring a second author makes the evidence independent of the change under test. * Tools/CISupport/ews-build/results_db.py: (ResultsDatabase): (ResultsDatabase._is_intra_build_flake): (ResultsDatabase._is_inter_build_flake): * Tools/CISupport/ews-build/steps.py: (RunWebKitTests): (RunWebKitTests.filter_failures_using_results_db): * Tools/CISupport/ews-build/steps_unittest.py: (TestFilterLayoutTestFailuresUsingResultsDB.test_a_verdict_in_the_included_set_removes_the_failure): (TestFilterLayoutTestFailuresUsingResultsDB): (TestFilterLayoutTestFailuresUsingResultsDB.test_a_verdict_outside_the_included_set_is_recorded_without_ignoring_the_failure): (TestFilterLayoutTestFailuresUsingResultsDB.test_the_ignore_message_covers_both_categories): (TestFilterLayoutTestFailuresUsingResultsDB.test_a_flaky_verdict_is_recorded_without_ignoring_the_failure): Deleted. Canonical link: https://commits.webkit.org/320087@main
https://bugs.webkit.org/show_bug.cgi?id=322843 rdar://186085377 Reviewed by Alan Baradlay. Stop checking explicitly for ellipsis text-overflow, and instead check for non-clip text-overflow. Transfer non-clip text-overflow value into the inner text element. Tests: imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-notref.html imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input.html * LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-expected-mismatch.html: Added. * LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-notref.html: Added. * LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input.html: Added. * Source/WebCore/html/HTMLInputElement.cpp: (WebCore::HTMLInputElement::shouldTruncateText const): (WebCore::HTMLInputElement::invalidateStyleOnFocusChangeIfNeeded): (WebCore::HTMLInputElement::createInnerTextStyle): Canonical link: https://commits.webkit.org/320088@main
https://bugs.webkit.org/show_bug.cgi?id=322877 rdar://186123945 * Source/WTF/wtf/linux/HighPriorityThreads.cpp: Canonical link: https://commits.webkit.org/320089@main
https://bugs.webkit.org/show_bug.cgi?id=322846 rdar://186085908 Reviewed by Sammy Gill. Upstream commit: web-platform-tests/wpt@f01d702 These directories were imported together because some text-overflow tests were moved from css-ui to css-overflow. * LayoutTests/imported/w3c/web-platform-tests/css/css-overflow * LayoutTests/imported/w3c/web-platform-tests/css/css-ui Canonical link: https://commits.webkit.org/320090@main
https://bugs.webkit.org/show_bug.cgi?id=322879 rdar://186126542 * Source/WTF/wtf/CMakeLists.txt: Canonical link: https://commits.webkit.org/320091@main
https://bugs.webkit.org/show_bug.cgi?id=322882 rdar://186128125 * JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js: Canonical link: https://commits.webkit.org/320092@main
… version of the static analyzer https://bugs.webkit.org/show_bug.cgi?id=322817 Reviewed by Mike Wyrzykowski and David Kilzer. * Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm: (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::resetStallForTime): * Source/WebCore/platform/graphics/cocoa/MediaPlayerPrivateWebM.mm: (WebCore::MediaPlayerPrivateWebM::setDuration): * Source/WebCore/workers/service/background-fetch/BackgroundFetch.h: * Source/WebKit/NetworkProcess/Authentication/cocoa/AuthenticationManagerCocoa.mm: (WebKit::AuthenticationManager::initializeConnection): * Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp: (WebKit::NetworkCORSPreflightChecker::startPreflight): (WebKit::NetworkCORSPreflightChecker::completePreflight): * Source/WebKit/NetworkProcess/NetworkContentRuleListManager.cpp: (WebKit::NetworkContentRuleListManager::contentExtensionsBackend): * Source/WebKit/NetworkProcess/NetworkLoad.cpp: (WebKit::NetworkLoad::didReceiveResponse): * Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp: (WebKit::NetworkLoadChecker::NetworkLoadChecker): * Source/WebKit/NetworkProcess/cocoa/WebSocketTaskCocoa.mm: (WebKit::WebSocketTask::WebSocketTask): * Source/WebKit/NetworkProcess/storage/BackgroundFetchStoreImpl.cpp: (WebKit::BackgroundFetchStoreImpl::initializeFetches): * Source/WebKit/NetworkProcess/storage/BackgroundFetchStoreManager.cpp: (WebKit::BackgroundFetchStoreManager::storeFetch): * Source/WebKit/NetworkProcess/storage/IDBStorageRegistry.cpp: (WebKit::IDBStorageRegistry::removeConnectionToClient): * Source/WebKit/Shared/API/c/WKSharedAPICast.h: (WebKit::toURLRef): * Source/WebKit/UIProcess/API/C/WKContext.cpp: (WKContextSetHistoryClient): (WKContextSetDownloadClient): * Source/WebKit/UIProcess/API/C/WKPage.cpp: (WKPageCopySessionState): (WKPageSetPageUIClient): (WKPageSetPageNavigationClient): * Source/WebKit/UIProcess/Authentication/AuthenticationChallengeProxy.cpp: (WebKit::AuthenticationChallengeProxy::AuthenticationChallengeProxy): * Source/WebKit/UIProcess/Cocoa/GroupActivities/GroupActivitiesSessionNotifier.mm: * Source/WebKit/UIProcess/Cocoa/NavigationState.mm: (WebKit::tryInterceptNavigation): * Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm: (WebKit::WebPageProxy::getWebArchiveDataWithSelectedFrames): (WebKit::WebPageProxy::getAttributedStringsForRemoteFrames): * Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm: (WebKit::WebPasteboardProxy::createOneWebArchiveFromFrames): * Source/WebKit/UIProcess/Cocoa/WebProcessProxyCocoa.mm: (WebKit::WebProcessProxy::sendAudioComponentRegistrations): * Source/WebKit/UIProcess/Downloads/DownloadProxy.cpp: (WebKit::DownloadProxy::cancel): (WebKit::DownloadProxy::didFinish): (WebKit::DownloadProxy::didFail): * Source/WebKit/UIProcess/Inspector/Agents/InspectorBrowserAgent.cpp: (WebKit::InspectorBrowserAgent::InspectorBrowserAgent): * Source/WebKit/UIProcess/Inspector/Agents/InspectorStorageAgent.cpp: (WebKit::InspectorStorageAgent::InspectorStorageAgent): * Source/WebKit/UIProcess/WebAuthentication/AuthenticatorManager.cpp: (WebKit::AuthenticatorManager::clearStateAsync): (WebKit::AuthenticatorManager::dispatchPanelClientCall const): * Source/WebKit/UIProcess/WebAuthentication/AuthenticatorTransportService.cpp: (WebKit::AuthenticatorTransportService::startDiscovery): (WebKit::AuthenticatorTransportService::restartDiscovery): * Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm: (WebKit::LocalAuthenticator::continueMakeCredentialAfterUserVerification): * Source/WebKit/UIProcess/WebAuthentication/Mock/MockHidConnection.cpp: (WebKit::MockHidConnection::send): (WebKit::MockHidConnection::feedReports): (WebKit::MockHidConnection::continueFeedReports): * Source/WebKit/UIProcess/WebAuthentication/Mock/MockNfcService.mm: (WebKit::MockNfcService::receiveStartPolling): * Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp: (WebKit::CtapAuthenticator::makeCredential): (WebKit::CtapAuthenticator::continueSilentlyCheckCredentials): (WebKit::CtapAuthenticator::continueMakeCredentialAfterCheckExcludedCredentials): (WebKit::CtapAuthenticator::getAssertion): (WebKit::CtapAuthenticator::continueGetAssertionAfterCheckAllowCredentials): (WebKit::CtapAuthenticator::continueGetAssertionAfterResponseReceived): (WebKit::CtapAuthenticator::continueGetNextAssertionAfterResponseReceived): (WebKit::CtapAuthenticator::continueRequestPinAfterGetKeyAgreement): (WebKit::CtapAuthenticator::continueSetupPinAfterGetKeyAgreement): * Source/WebKit/UIProcess/WebAuthentication/fido/CtapHidDriver.cpp: (WebKit::CtapHidDriverWorker::transact): (WebKit::CtapHidDriverWorker::write): (WebKit::CtapHidDriver::transact): (WebKit::CtapHidDriver::continueAfterChannelAllocated): * Source/WebKit/UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::didNotifyUserActivation): (WebKit::WebPageProxy::didHandleFirstUserGesture): (WebKit::WebPageProxy::didConsumeUserActivation): * Source/WebKit/UIProcess/WebPageProxyMessageReceiverRegistration.cpp: (WebKit::WebPageProxyMessageReceiverRegistration::transferMessageReceivingFrom): * Source/WebKit/UIProcess/WebPageProxyMessageReceiverRegistration.h: * Source/WebKit/UIProcess/WebProcessProxy.cpp: (WebKit::WebProcessProxy::shouldSendPendingMessage): * Source/WebKit/UIProcess/mac/WebViewImpl.mm: (-[WKDOMPasteMenuDelegate menuDidClose:]): (WebKit::WebViewImpl::validateUserInterfaceItem): (WebKit::WebViewImpl::requestCandidatesForSelectionIfNeeded): (WebKit::WebViewImpl::firstRectForCharacterRange): (WebKit::WebViewImpl::showInlinePredictionsForCandidate): (WebKit::WebViewImpl::showInlinePredictionsForCandidates): (WebKit::WebViewImpl::createFlagsChangedEventMonitor): * Source/WebKit/WebProcess/FileAPI/BlobRegistryProxy.cpp: (WebKit::BlobRegistryProxy::registerInternalFileBlobURL): (WebKit::BlobRegistryProxy::registerInternalBlobURL): (WebKit::BlobRegistryProxy::registerBlobURL): (WebKit::BlobRegistryProxy::registerInternalBlobURLOptionallyFileBacked): (WebKit::BlobRegistryProxy::unregisterBlobURL): (WebKit::BlobRegistryProxy::registerInternalBlobURLForSlice): (WebKit::BlobRegistryProxy::registerBlobURLHandle): (WebKit::BlobRegistryProxy::unregisterBlobURLHandle): (WebKit::BlobRegistryProxy::blobType): (WebKit::BlobRegistryProxy::blobSize): * Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp: (WebKit::WebFullScreenManager::setPIPStandbyElement): * Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp: (WebKit::ImageBufferShareableMappedIOSurfaceBackend::create): * Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBitmapBackend.h: * Source/WebKit/WebProcess/GPU/media/AudioVideoRendererRemote.cpp: (WebKit::AudioVideoRendererRemote::prepareToSeek): (WebKit::AudioVideoRendererRemote::finishSeek): (WebKit::AudioVideoRendererRemote::notifyTimeReachedAndStall): * Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp: (WebKit::MediaPlayerPrivateRemote::load): (WebKit::MediaPlayerPrivateRemote::networkStateChanged): (WebKit::MediaPlayerPrivateRemote::setReadyState): (WebKit::MediaPlayerPrivateRemote::volumeChanged): (WebKit::MediaPlayerPrivateRemote::muteChanged): (WebKit::MediaPlayerPrivateRemote::timeChanged): (WebKit::MediaPlayerPrivateRemote::durationChanged): (WebKit::MediaPlayerPrivateRemote::rateChanged): (WebKit::MediaPlayerPrivateRemote::playbackStateChanged): (WebKit::MediaPlayerPrivateRemote::engineFailedToLoad): (WebKit::MediaPlayerPrivateRemote::characteristicChanged): (WebKit::MediaPlayerPrivateRemote::sizeChanged): (WebKit::MediaPlayerPrivateRemote::currentTimeChanged): (WebKit::MediaPlayerPrivateRemote::firstVideoFrameAvailable): (WebKit::MediaPlayerPrivateRemote::renderingModeChanged): (WebKit::MediaPlayerPrivateRemote::acceleratedRenderingStateChanged): (WebKit::MediaPlayerPrivateRemote::addRemoteAudioTrack): (WebKit::MediaPlayerPrivateRemote::removeRemoteAudioTrack): (WebKit::MediaPlayerPrivateRemote::addRemoteTextTrack): (WebKit::MediaPlayerPrivateRemote::removeRemoteTextTrack): (WebKit::MediaPlayerPrivateRemote::addRemoteVideoTrack): (WebKit::MediaPlayerPrivateRemote::removeRemoteVideoTrack): (WebKit::MediaPlayerPrivateRemote::currentPlaybackTargetIsWirelessChanged): (WebKit::MediaPlayerPrivateRemote::mediaPlayerKeyNeeded): (WebKit::MediaPlayerPrivateRemote::waitingForKeyChanged): (WebKit::MediaPlayerPrivateRemote::initializationDataEncountered): (WebKit::MediaPlayerPrivateRemote::reportGPUMemoryFootprint): (WebKit::MediaPlayerPrivateRemote::resourceNotSupported): (WebKit::MediaPlayerPrivateRemote::getRawCookies const): (WebKit::MediaPlayerPrivateRemote::prefersSpatialAudioExperienceChanged): (WebKit::MediaPlayerPrivateRemote::soundStageSizeDidChange): (WebKit::MediaPlayerPrivateRemote::audioOutputDeviceChanged): (WebKit::MediaPlayerPrivateRemote::sceneIdentifierDidChange): * Source/WebKit/WebProcess/GPU/webrtc/AudioMediaStreamTrackRendererInternalUnitManager.cpp: (WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::~AudioMediaStreamTrackRendererInternalUnitManagerProxy): (WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::createRemoteUnit): (WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::start): (WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::stop): (WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::setLastDeviceUsed): (WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::deleteUnitForTesting): * Source/WebKit/WebProcess/GPU/webrtc/LibWebRTCCodecs.cpp: (WebKit::createRemoteDecoder): (WebKit::createRemoteEncoder): * Source/WebKit/WebProcess/InjectedBundle/InjectedBundle.cpp: (WebKit::InjectedBundle::addOriginAccessAllowListEntry): (WebKit::InjectedBundle::removeOriginAccessAllowListEntry): (WebKit::InjectedBundle::resetOriginAccessAllowLists): * Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp: (WebKit::InjectedBundlePageLoaderClient::willLoadDataRequest): (WebKit::InjectedBundlePageLoaderClient::willPerformClientRedirectForFrame): * Source/WebKit/WebProcess/InjectedBundle/mac/InjectedBundleMac.mm: (WebKit::InjectedBundle::initialize): * Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp: (WebKit::WebLoaderStrategy::scheduleLoadFromNetworkProcess): (WebKit::WebLoaderStrategy::loadResourceSynchronously): (WebKit::WebLoaderStrategy::startPingLoad): (WebKit::WebLoaderStrategy::preconnectTo): (WebKit::WebLoaderStrategy::isResourceLoadFinished): (WebKit::WebLoaderStrategy::setCaptureExtraNetworkLoadMetricsEnabled): (WebKit::WebLoaderStrategy::responseFromResourceLoadIdentifier): (WebKit::WebLoaderStrategy::intermediateLoadInformationFromResourceLoadIdentifier): (WebKit::WebLoaderStrategy::networkMetricsFromResourceLoadIdentifier): * Source/WebKit/WebProcess/Network/WebSocketProvider.cpp: (WebKit::WebSocketProvider::countWebSocketChannelsForTesting): * Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetworkManager.cpp: (WebKit::LibWebRTCNetworkManager::networksChanged): * Source/WebKit/WebProcess/Network/webrtc/RTCDataChannelRemoteManager.cpp: (WebKit::RTCDataChannelRemoteManager::postTaskToHandler): * Source/WebKit/WebProcess/Network/webrtc/WebRTCMonitor.cpp: (WebKit::WebRTCMonitor::startUpdating): (WebKit::WebRTCMonitor::stopUpdating): * Source/WebKit/WebProcess/Storage/WebSWClientConnection.cpp: (WebKit::WebSWClientConnection::addRoutes): * Source/WebKit/WebProcess/WebCoreSupport/ShareableBitmapUtilities.cpp: (WebKit::createShareableBitmap): (WebKit::createShareableBitmapAsync): * Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp: (WebKit::WebChromeClient::testProcessIncomingSyncMessagesWhenWaitingForSyncReply): (WebKit::WebChromeClient::registerBlobPathForTesting): * Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp: (WebKit::WebLocalFrameLoaderClient::loadStorageAccessQuirksIfNeeded): (WebKit::WebLocalFrameLoaderClient::sendH2Ping): (WebKit::WebLocalFrameLoaderClient::didExceedNetworkUsageThreshold): (WebKit::WebLocalFrameLoaderClient::removeStorageAccess): * Source/WebKit/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp: (WebKit::WebPlatformStrategies::windowSubscribeToPushService): (WebKit::WebPlatformStrategies::windowUnsubscribeFromPushService): (WebKit::WebPlatformStrategies::windowGetPushSubscription): (WebKit::WebPlatformStrategies::windowGetPushPermissionState): * Source/WebKit/WebProcess/WebPage/WebCookieCache.cpp: (WebKit::WebCookieCache::cookiesForDOM): * Source/WebKit/WebProcess/WebPage/WebCookieJar.cpp: (WebKit::WebCookieJar::cookies const): (WebKit::WebCookieJar::setCookies): (WebKit::WebCookieJar::remoteCookiesEnabledSync const): (WebKit::WebCookieJar::remoteCookiesEnabled const): (WebKit::WebCookieJar::cookieRequestHeaderFieldValueDigest const): (WebKit::WebCookieJar::getRawCookies const): (WebKit::WebCookieJar::setRawCookie): (WebKit::WebCookieJar::deleteCookie): (WebKit::WebCookieJar::getCookiesAsync const): (WebKit::WebCookieJar::setCookieAsync const): (WebKit::WebCookieJar::addChangeListenerWithAccess): (WebKit::WebCookieJar::removeChangeListener): * Source/WebKit/WebProcess/WebPage/WebFrame.cpp: (WebKit::WebFrame::startDownload): * Source/WebKit/WebProcess/WebPage/WebPage.cpp: (WebKit::WebPage::loadAndDecodeImage): (WebKit::WebPage::hasStorageAccess): (WebKit::WebPage::requestStorageAccess): (WebKit::WebPage::setLoginStatus): (WebKit::WebPage::isLoggedIn): (WebKit::WebPage::useRedirectionForCurrentNavigation): * Source/WebKit/WebProcess/WebStorage/StorageAreaMap.cpp: (WebKit::StorageAreaMap::removeItem): (WebKit::StorageAreaMap::clear): Canonical link: https://commits.webkit.org/320093@main
https://bugs.webkit.org/show_bug.cgi?id=322730 Reviewed by Darin Adler. Makes CSSTokenizer and CSSTokenizerInputStream operate on StringView rather than String and StringImpl. Biggest change is in CSSTokenizer::preprocessString where we now check the string for null characters and unpair surrogates before allocating a replacement, making sure to do the minimum required based on character type. * Source/WebCore/css/parser/CSSCustomPropertySyntax.cpp: * Source/WebCore/css/parser/CSSParser.h: * Source/WebCore/css/parser/CSSTokenizer.cpp: * Source/WebCore/css/parser/CSSTokenizer.h: * Source/WebCore/css/parser/CSSTokenizerInputStream.cpp: * Source/WebCore/css/parser/CSSTokenizerInputStream.h: * Source/WebCore/css/typedom/CSSUnparsedValue.cpp: * Source/WebCore/style/StyleCustomProperty.cpp: * Source/WebCore/svg/SVGLengthValue.cpp: Canonical link: https://commits.webkit.org/320094@main
https://bugs.webkit.org/show_bug.cgi?id=322869 Unreviewed. Update safer C++ expectations. * Source/JavaScriptCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations: Canonical link: https://commits.webkit.org/320095@main
…mEventDispatcher https://bugs.webkit.org/show_bug.cgi?id=318487 rdar://174662710 Reviewed by Simon Fraser. m_momentumEventDispatcher can be accessed from two threads, which could lead to a race condition: * On the scrolling thread, RemoteLayerTreeEventDispatcher::didRefreshDisplay gets called. It grabs the pointer of m_momentumEventDispatcher to call into it * Just before m_momentumEventDispatcher->displayDidRefresh is called, the scrolling thread gets pre-empted for the main thread. It calls RemoteLayerTreeEventDispatcher::invalidate, which sets m_momentumEventDispatcher to nullptr, freeing the object * Then the scrolling thread resumes execution at RemoteLayerTreeEventDispatcher::didRefreshDisplay, which calls calls m_momentumEventDispatcher->displayDidRefresh on the freed object Note the race window is *very* small - didRefreshDisplay needs to be preempted at the exact instruction that calls m_momentumEventDispatcher->displayDidRefresh. 263321@main tweaked the order of operations to avoid needing a lock and null check around m_momentumEventDispatcher: > Rather than adding a lock to use around accesses to m_momentumEventDispatcher > and adding null checks, fix the teardown order to ensure that m_momentumEventDispatcher > is always non-null in the scrolling thread code. But it's almost too easy to accidentally change the order of operations, so this patch properly fixes it by guarding m_momentumEventDispatcher with a lock. Any operations involving it needs to acquire the lock first. No tests - tiny race window makes it almost impossible to write a test that reliably triggers the race condition. * Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h: * Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm: (WebKit::RemoteLayerTreeEventDispatcher::invalidate): (WebKit::RemoteLayerTreeEventDispatcher::cacheWheelEventScrollingAccelerationCurve): (WebKit::RemoteLayerTreeEventDispatcher::scrollingThreadHandleWheelEvent): (WebKit::RemoteLayerTreeEventDispatcher::didRefreshDisplay): (WebKit::RemoteLayerTreeEventDispatcher::windowScreenDidChange): (WebKit::RemoteLayerTreeEventDispatcher::stopDisplayDidRefreshCallbacks): (WebKit::RemoteLayerTreeEventDispatcher::flushMomentumEventLoggingSoon): Originally-landed-as: 305413.1103@safari-7624.5-branch (d586a22). rdar://185367169 Canonical link: https://commits.webkit.org/320096@main
…playLink callbacks for RemoteLayerTree DisplayLink clients rdar://183949932 Reviewed by Charlie Wolfe. The UI process crashes on the CVDisplayLink thread in when calling displayLinkFired() on a DisplayLink::Client that was freed while still registered. Two independent teardown paths can leave a client registered at destruction. These are: 1. A client would not be removed if existingDisplayLink() returned null, this was fixed in 314099@main. 2. More importantly, 316606.145@safari-7625-branch dropped the if (mED) guard around startOrStopDisplayLink() when stopping the displayDidRefresh callbacks. That method is re-entered during teardown since invalidate() destroys mED and its destructor calls back through into stopDisplayDidRefreshCallbacks(). Without the guard, startOrStopDisplayLink() re-adds the DisplayLink client that invalidate() just removed via removeDisplayLinkClient(). The client is then freed, so the next display refresh invokes displayLinkFired() on a freed client, producing a UAF. In this patch, we fix the latter by re-introducing the if (mED) guard dropped in the regressing commit. * Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm: (WebKit::RemoteLayerTreeEventDispatcher::stopDisplayDidRefreshCallbacks): Originally-landed-as: 7a268c48ba0a. rdar://185365990 Canonical link: https://commits.webkit.org/320097@main
Unreviewed. * LayoutTests/TestExpectations: * LayoutTests/platform/glib/TestExpectations: * LayoutTests/platform/gtk/TestExpectations: Canonical link: https://commits.webkit.org/320098@main
…r after an empty match for unicode RegExps https://bugs.webkit.org/show_bug.cgi?id=322889 Reviewed by Yusuke Suzuki. DFGStrengthReductionPhase folds String.prototype.replace with a constant string, RegExp and replacement by replaying the match loop at compile time. After an empty match it advanced by one code unit regardless of the /u and /v flags, while replaceUsingRegExpSearch advances past a surrogate pair, so "a\u{1F600}b".replace(/(?:)/gu, "-") changed its result once the function reached the DFG. Advance past a lead/trail pair after an empty match when the RegExp is unicode, the same way the runtime does. Test: JSTests/stress/dfg-string-replace-regexp-unicode-empty-match-surrogate-pair.js * JSTests/stress/dfg-string-replace-regexp-unicode-empty-match-surrogate-pair.js: Added. (shouldBe): (replaceUnicodeSets): (replaceAllUnicode): (replaceLoneLead): (replaceNonUnicode): * Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp: (JSC::DFG::StrengthReductionPhase::handleNode): Canonical link: https://commits.webkit.org/320099@main
… a vmtx table https://bugs.webkit.org/show_bug.cgi?id=206001 Reviewed by Carlos Garcia Campos. Follow-up to 320028@main. Resolve the CSS 'ch' unit from the '0' glyph's vertical advance only when the font has vertical metrics (i.e vmtx table). 'ch-unit-017.html' keeps passing because its @font-face features vertical metrics. This change also allows to restore five tests that were passing before 320028@main. * LayoutTests/platform/glib/TestExpectations: * Source/WebCore/platform/graphics/Font.cpp: (WebCore::Font::platformGlyphInit): (WebCore::Font::setZeroWidth): * Source/WebCore/platform/graphics/Font.h: Canonical link: https://commits.webkit.org/320100@main
https://bugs.webkit.org/show_bug.cgi?id=322838 Reviewed by Justin Michaud. Several ipc/ tests were skipped because their payload hardcoded Cocoa's CGColorSpace serialization. On Skia, DestinationColorSpace is serialized as the bytes SkColorSpace::serialize() writes, which coreipc.js had no way to produce. Add IPC.serializedSRGBColorSpace() to the testing API, returning those bytes from the serializer itself. coreipc.js gains an sRGBColorSpace() helper that produces the CG variant or the Skia bytes as the running build requires. serializeTemplate() no longer throws for sk_sp<SkColorSpace>, a wrapper the generator registers as an ordinary type but spells as a template; it is now serialized through the normal type path. Unskip the eight tests that then pass. * LayoutTests/ipc/coreipc.js: (export.sRGBColorSpace): (export.ArgumentSerializer): * LayoutTests/ipc/decode-feConvolveMatrix-kernelSize-overflow.html: * LayoutTests/ipc/empty-svgfilterrenderer-expression-crash.html: * LayoutTests/ipc/fecolormatrix-type-values-mismatch-crash.html: * LayoutTests/ipc/insufficient-svgfilter-inputs-crash.html: * LayoutTests/ipc/invalid-feConvolveMatrix-crash.html: * LayoutTests/ipc/invalid-svgfilter-expression-crash.html: * LayoutTests/ipc/nested-display-list-draw-control-part-crash.html: * LayoutTests/ipc/restore-empty-stack-crash.html: * LayoutTests/platform/glib/TestExpectations: * Source/WebKit/WebProcess/WebPage/IPCTestingAPI.cpp: (WebKit::IPCTestingAPI::JSIPC::staticFunctions): (WebKit::IPCTestingAPI::JSIPC::serializedSRGBColorSpace): Canonical link: https://commits.webkit.org/320101@main
https://bugs.webkit.org/show_bug.cgi?id=321756 Reviewed by Claudio Saavedra. Add some helpers to test the various image decoders. Fix: - PNGImageDecoder::readChunks() stored the acTL frame count before validating it, so a malformed APNG could advertise up to 2^32 - 1 frames through frameCount() while the frame buffer cache held a single entry. - PNGImageDecoder::initFrameBuffer() and frameComplete(), and the same compositing logic in GIFImageDecoder::frameComplete(), read the previous frame's backing store; a frame evicted from the frame cache has none, so null-check it first. - JPEGXLImageDecoder::clearDecodedPixelDataIfNeeded() built an end iterator from clearBeforeFrame without clamping it to the cache size. - WEBPImageDecoder::frameBufferAtIndex() blindly indexed the cache after decode(), but decode() leaves the cache untouched when it bails out early. - ICOImageDecoder::decodeAtIndex() dereferenced the embedded PNG sub-decoder's firstFrameBuffer(), which can be null * LayoutTests/fast/images/animated-image-mp4-crash.html: * LayoutTests/fast/images/apng-acTL-frame-count-overflow-expected.txt: Added. * LayoutTests/fast/images/apng-acTL-frame-count-overflow.html: Added. * LayoutTests/fast/images/apng-acTL-zero-frame-count-expected.txt: Added. * LayoutTests/fast/images/apng-acTL-zero-frame-count.html: Added. * LayoutTests/fast/images/apng-decode-after-frame-cache-eviction-expected.txt: Added. * LayoutTests/fast/images/apng-decode-after-frame-cache-eviction.html: Added. * LayoutTests/fast/images/resources/apng-acTL-frame-count-overflow.png: Added. * LayoutTests/fast/images/resources/apng-acTL-zero-frame-count.png: Added. * LayoutTests/fast/images/resources/apng-frame-cache-eviction.png: Added. * LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash-expected.txt: Added. * LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash.html: Added. * LayoutTests/http/tests/images/resources/ico-png-subimage.ico: Added. * Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp: (WebCore::GIFImageDecoder::frameComplete): * Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp: (WebCore::ICOImageDecoder::decodeAtIndex): * Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp: (WebCore::JPEGXLImageDecoder::clearDecodedPixelDataIfNeeded): * Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp: (WebCore::PNGImageDecoder::frameBufferAtIndex): (WebCore::PNGImageDecoder::readChunks): (WebCore::PNGImageDecoder::initFrameBuffer): (WebCore::PNGImageDecoder::frameComplete): * Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp: (WebCore::WEBPImageDecoder::frameBufferAtIndex): * Source/WebCore/testing/Internals.cpp: (WebCore::Internals::forceDecodeImageFrameAtIndex): * Source/WebCore/testing/Internals.h: * Source/WebCore/testing/Internals.idl: * Tools/TestWebKitAPI/PlatformGTK.cmake: * Tools/TestWebKitAPI/PlatformWPE.cmake: * Tools/TestWebKitAPI/Tests/WebCore/ImageDecoderTests.cpp: Added. (TestWebKitAPI::append32): (TestWebKitAPI::crc32For): (TestWebKitAPI::appendChunk): (TestWebKitAPI::redScanlines): (TestWebKitAPI::storedZlibStream): (TestWebKitAPI::makeAnimatedPNG): (TestWebKitAPI::makeTwoFrameAPNG): (TestWebKitAPI::createDecoder): (TestWebKitAPI::TEST(ImageDecoder, APNGRejectedFrameCountIsNotReported)): (TestWebKitAPI::TEST(ImageDecoder, APNGZeroFrameCountStillDecodesDefaultImage)): (TestWebKitAPI::TEST(ImageDecoder, APNGValidFrameCountIsReported)): (TestWebKitAPI::TEST(ImageDecoder, ClearFrameBufferCacheThenDecodeAgain)): (TestWebKitAPI::TEST(ImageDecoder, FrameIndexPastEndIsHandled)): (TestWebKitAPI::TEST(ImageDecoder, PartialDataThenFullData)): (TestWebKitAPI::makeICOWithPNGSubImage): (TestWebKitAPI::TEST(ImageDecoder, ICOWithPartiallyReceivedPNGSubImage)): * LayoutTests/platform/ios/TestExpectations: * LayoutTests/platform/mac/TestExpectations: Canonical link: https://commits.webkit.org/320102@main
https://bugs.webkit.org/show_bug.cgi?id=322610 rdar://185914243 Reviewed by Sam Weinig. Drop the StringView::trim(). Leading whitespace is skipped with CSSParserTokenRange::consumeWhitespace() and each consumer already ends with consumeIncludingWhitespace(), so the trailing run is gone before atEnd() is checked. The tokenizer treats exactly space, tab, LF, FF and CR as whitespace, matching isASCIIWhitespace(), so accepted inputs do not change. All-whitespace input now leaves the range empty, so MetaConsumer::consume() fails and we return SyntaxError as before. * Source/WebCore/svg/SVGLengthValue.cpp: (WebCore::SVGLengthValue::setValueAsString): Canonical link: https://commits.webkit.org/320103@main
https://bugs.webkit.org/show_bug.cgi?id=322899 rdar://186150753 Reviewed by Keith Miller. iterator_next fast path's result needs to be stored to getValue checkpoint's ValueProfile. Test: JSTests/stress/for-of-mixed-element-types-value-profile.js * JSTests/stress/for-of-mixed-element-types-value-profile.js: Added. (events): (walk): * Source/JavaScriptCore/jit/JITCall.cpp: (JSC::JIT::emit_op_iterator_next): Canonical link: https://commits.webkit.org/320104@main
…PU OOB read https://bugs.webkit.org/show_bug.cgi?id=313946 rdar://174681215 Reviewed by Dan Glastonbury. Track highest validated indices and not simply the maximum indices past to writeBuffer on an index buffer. Otherwise a writeBuffer(0xFF) call will allow an OOB read for any future write calls. * Source/WebGPU/WebGPU/Buffer.h: * Source/WebGPU/WebGPU/Buffer.mm: (WebGPU::Buffer::drawIndexedValidated): (WebGPU::Buffer::needsIndexValidation): (WebGPU::Buffer::indirectBufferInvalidated): Test: * LayoutTests/fast/webgpu/index-buffer-cache-invalidation-expected.txt: Added. * LayoutTests/fast/webgpu/index-buffer-cache-invalidation.html: Added. Originally-landed-as: 305413.1117@safari-7624.5-branch (f6253b9). rdar://185368400 Canonical link: https://commits.webkit.org/320105@main
…ixture from pytest-asyncio https://bugs.webkit.org/show_bug.cgi?id=321148 Reviewed by Sam Sneddon and Carlos Alberto Lopez Perez. Rolls back to pytest-async 0.19.0, matching the vendored version in the WPT tests and providing the proper `event_loop` fixture needed by WebDriverBiDi tests that wait for a given event. Previously, pytest-asyncio was updated from 0.18.3 to 1.1.1 in 315890@main, which focused on the pytest 7->8 bump for python 3.14 compatibility. While the pytest bump was required, the pytest-asyncio was too much, introducing those breaking changes. This commit also removes the backports.asyncio_runner dependency, originally added as a follow-up fix in 317620@main, as it's not needed anymore (only with pytest-asyncio >= 1.1.0). * Tools/Scripts/webkitpy/__init__.py: * WebDriverTests/TestExpectations.json: Canonical link: https://commits.webkit.org/320106@main
https://bugs.webkit.org/show_bug.cgi?id=322655 Reviewed by Philippe Normand. The Thunder parser's inner parsebin sorted its autoplug candidates by rank alone so a decoder (dav1ddec) could outrank a parser (av1parse). In this case it was causing a "better" decoder (vaav1dec) to be skipped and fall back to software decoding. Sort parsers before decoders, matching gst-plugins-base's own parsebin. * Source/WebCore/platform/graphics/gstreamer/eme/WebKitThunderParser.cpp: (compareParserAndDecoderFactories): (webkitMediaThunderParserConstructed): Canonical link: https://commits.webkit.org/320107@main
https://bugs.webkit.org/show_bug.cgi?id=322914 rdar://186179555 Reviewed by Mark Lam. Skip PGO profiling for JavaScriptCoreTools to fix PGO instrument binary build. * Source/JavaScriptCore/Configurations/libJavaScriptCoreTools.xcconfig: Canonical link: https://commits.webkit.org/320108@main
Unreviewed. * LayoutTests/TestExpectations: * LayoutTests/platform/glib/TestExpectations: * LayoutTests/platform/gtk/TestExpectations: Canonical link: https://commits.webkit.org/320109@main
https://bugs.webkit.org/show_bug.cgi?id=322907 Reviewed by Tim Nguyen. Remove unused tryResolved() from CSS::CustomIdent. It was remnant from when the ident() function was not a substitution function. * Source/WebCore/css/values/primitives/CSSCustomIdent.h: (WebCore::CSS::CustomIdent::tryResolved const): Deleted. Canonical link: https://commits.webkit.org/320110@main
…clarations https://bugs.webkit.org/show_bug.cgi?id=322887 Reviewed by Yusuke Suzuki. Module-scoped function declarations are instantiated when the module is linked: CyclicModuleRecord::initializeEnvironment links each UnlinkedFunctionExecutable into a FunctionExecutable, wraps it in a JSFunction and stores it in the module environment. When the module is later evaluated, CodeBlock::finishCreation links every functionDecl of the module program again and keeps the second FunctionExecutable in m_functionDecls, even though no op_new_func in the module body ever reads it. Every heap-allocated function declaration in a module thus costs two FunctionExecutables, one of which is dead on arrival. When linking a ModuleCode CodeBlock, look the declaration up in the module environment first. If the slot still holds a JSFunction whose executable was linked from the same UnlinkedFunctionExecutable for this module, reuse that executable; otherwise (stack-allocated declarations, block-scoped declarations that shadow a module-level name, bindings reassigned before evaluation) link a new one as before. Loading 1000 synthetic modules with 17 module-scoped function declarations each, a heap snapshot after evaluation shows FunctionExecutable 47,060 -> 30,060 (6.02 MB -> 3.85 MB), and the number of FunctionExecutables sharing an UnlinkedFunctionExecutable drops from 17,000 to 0. Peak RSS goes from 92.0 MB to 89.9 MB, and parse + link + evaluate time for the same modules did not change (92-97 ms before, 92-95 ms after). Tests: JSTests/modules/module-function-declaration-executable-reuse-jettison.js JSTests/modules/module-function-declaration-executable-reuse-jettison/a.js JSTests/modules/module-function-declaration-executable-reuse.js JSTests/modules/module-function-declaration-executable-reuse/a.js JSTests/modules/module-function-declaration-executable-reuse/b.js JSTests/modules/module-function-declaration-executable-reuse/same-1.js JSTests/modules/module-function-declaration-executable-reuse/same-2.js JSTests/modules/module-function-declaration-executable-reuse/same-setter.js * JSTests/modules/module-function-declaration-executable-reuse-jettison.js: Added. * JSTests/modules/module-function-declaration-executable-reuse-jettison/a.js: Added. (export.f): (export.g): (export.h): (s): (h): (Promise.resolve.then): (f): * JSTests/modules/module-function-declaration-executable-reuse.js: Added. * JSTests/modules/module-function-declaration-executable-reuse/a.js: Added. (export.f): (export.g): (export.h): (export.k): (export.setG): (export.setH): (export.setK): (export.gen): (export.async asyncFn): (export.async asyncGen): (captured): (export.callCaptured): (local): (f): * JSTests/modules/module-function-declaration-executable-reuse/b.js: Added. (setG): * JSTests/modules/module-function-declaration-executable-reuse/same-1.js: Added. (export.f): (export.setF): * JSTests/modules/module-function-declaration-executable-reuse/same-2.js: Added. (export.f): (export.setF): * JSTests/modules/module-function-declaration-executable-reuse/same-setter.js: Added. * Source/JavaScriptCore/bytecode/CodeBlock.cpp: (JSC::instantiatedModuleFunctionExecutable): (JSC::CodeBlock::finishCreation): Canonical link: https://commits.webkit.org/320111@main
Preview Builds
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merges upstream WebKit main at
df289ce551(2026-08-30): 103 commits since the previous merge base6b879687ee(2026-08-28), 33 of them touching JavaScriptCore, WTF, bmalloc or cmake.git merge-base origin/main upstream/mainreports6b879687eedirectly. This merge commit hasdf289ce551as its second parent.The companion Bun PR is oven-sh/bun#40941. It needs two source changes:
0d9f8faf36removesRefCountedBase::relaxAdoptionRequirement()(and the adoption assertion it disabled), so Bun's nine calls to it (FetchHeadersconstruction inbindings.cpp,ScriptExecutionContextconstructors) go away; anddf289ce551downcasts aModuleCodecode block's scope toJSModuleEnvironmentinCodeBlock::finishCreation, which Bun'snode:vmSourceTextModuleviolated by linking aModuleProgramCodeBlockagainst the global scope to validatecachedData(the linked block was never used; Bun now validates by decoding only).Conflict resolutions
bytecode/ArrayProfile.h(1e5465e49a): upstream drops theConcurrentJSLock.hinclude becauseArrayProfileno longer takes a lock. The fork's quoted-include form of the remainingStructure.hinclude is kept.runtime/JSModuleNamespaceObject.cpp(81b5126daf): both sides add includes at the same spot. The fork'sJSModuleRecord.handSyntheticModuleRecord.h(lazy synthetic exports) and upstream'sJSWebAssemblyGlobal.handWebAssemblyModuleRecord.h(live Wasm mutable globals in namespace objects) are all kept. Upstream's new Wasm branch ingetOwnPropertySlotCommonlands after the fork's lazy-export materialization, so a materialized value still goes through it.shell/CMakeLists.txt(96b6729497): upstream declares the Apple-onlymyaexecutable right afterjsc, where the fork declarestestFFI. Both blocks are kept,testFFIfirst.mya,JavaScriptCoreToolsandtestLibJSCToolsare all underif (APPLE)and are not in thejsc/testFFItarget set the release scripts build, so the macOS cross build only configures them.yarr/YarrInterpreter.cpp,yarr/YarrJIT.cpp,yarr/YarrPattern.cpp(1c9b16dd56): kept at the fork's version (Yarr: JIT lookbehinds, first-code-point alternation dispatch, Boyer-Moore and /u·/v spec alignment, RegExp correctness fixes #299 policy, as in Upgrade to upstream WebKit 47f7250137c6 #455, Upgrade to upstream WebKit 8c4fd56347 #503 and Upgrade to upstream WebKit 6b879687ee #528). Upstream fixeslastIndexbeing ignored under/sand^.*under/msby loading the initial start from the frame and refusing the DotStarEnclosure optimization for/mspatterns. The fork's enclosure already honourslastIndexunder/sand re-checks a leading^under/mby scanning to the next line start, so it keeps the optimization. Upstream's newregexp-dot-star-enclosure-dot-all-last-index.jspasses on the fork's JIT and with--useRegExpJIT=false.dfg/DFGStrengthReductionPhase.cpp(d545f589c8, auto-merged, then reverted to the fork's version): upstream adds a surrogate-pair step after an empty/umatch in theString.prototype.replaceconstant fold. The fork already advances withadvanceStringIndex(..., eitherUnicode)there (Yarr: JIT lookbehinds, first-code-point alternation dispatch, Boyer-Moore and /u·/v spec alignment, RegExp correctness fixes #299), so the added check was a no-op. Dropped to keep one code path. Upstream's newdfg-string-replace-regexp-unicode-empty-match-surrogate-pair.jspasses.Checked and unchanged:
runtime/JSType.h,.github/workflows, the release tarball names.Verification
bun run jsc:build:debug(Linux x64, debug + ASAN, clang 21): builds, thejscshell runs.jscwith the options their headers name: the twoarguments-elimination-*load-varargs*tests,for-of-mixed-element-types-value-profile.js(--forceUnlinkedDFG=0), the twomodule-function-declaration-executable-reuse*tests (-m), the Yarr and DFG StringReplace tests above in JIT and interpreter mode.bun run build:local: Bun (mained950b88abplus the two changes above) links and runs against this tree. Bun's test suites on that debug + ASAN build are listed in the companion PR (Upgrade WebKit to df289ce551 bun#40941): every failure is a 5 s timeout under debug + ASAN or fails the same way at the current pin.Upstream changes
Each commit appears once under the most specific heading that applies.
Needs a Bun-side change
df289ce551[PERF] [BEHAVIOR] [API]: aModuleCodeCodeBlockreuses theFunctionExecutablethatCyclicModuleRecord::initializeEnvironmentalready linked for a module-scoped function declaration, instead of linking a second one that noop_new_funcreads. Upstream: 1000 modules x 17 declarations,FunctionExecutablecount 47,060 to 30,060. Block-scoped shadows and bindings reassigned before evaluation still link a new one.CodeBlock::finishCreationnow requires a module program's scope to be itsJSModuleEnvironment(uncheckedDowncast); Bun'snode:vmSourceTextModulepassed the global scope when validatingcachedDataand is fixed in the companion PR.0d9f8faf36[API]: removes theRefCountedadoption requirement assertion.RefCountedBase::adopted(),RefCountedBase::relaxAdoptionRequirement(), the freeWTF::adopted()overloads (Ref.h,RefCounted.h,ThreadSafeRefCounted.h,RefCountedWithInlineWeakPtr.h) andNeverDestroyed'sMaybeRelaxhelper are gone.adoptRef()no longer callsadopted(). Ref'ing an object during its own construction is now allowed. Bun: drop the ninerelaxAdoptionRequirement()calls.API and ABI changes
1e5465e49a[API] [PERF]:ArrayProfilereads and updates no longer take theConcurrentJSLocker.observedArrayModes(),mayStoreToHole(),outOfBounds(),mayInterceptIndexedAccesses(),usesOriginalArrayStructures(),mayBeLargeTypedArray(),mayBeResizableOrGrowableSharedTypedArray()andmayBeRegExpMatchesArray()lose their locker parameter, andDFG::ArrayMode::fromObservedandrefinefollow. Bun does not referenceArrayProfile.18e08875ba[INFRA]:ThreadSafeWeakPtrconstructor and destructor gainNODELETE(safer C++ annotation). Empty on MSVC and older clang.05b6f71120[API]:wtf/darwin/DispatchExtras.haddsdispatchQueueCreateWithAutoreleasePool()and WebKit's dispatch queues use it. Cocoa only. Bun creates no dispatch queues through WTF.98007ce320[API] [PERF]:JSWebAssemblyInstanceexposes the wrapper-table layout for an inlineref.funcin BBQ and OMG (offsetOfFunctionWrappers,B3AbstractHeapRepositoryentry). Bun does not reference these.565aa489f1[API] [PERF]:JSWebAssemblyArraygains a fill helper so ref arrays are filled without a per-elementset().Behavior changes and correctness fixes
26aa84fcd5[FIX]: DFG OSR availability.LoadVarargs/ForwardVarargsnowkillHeaps()before replacing the count and argument operands, and arguments elimination treats a candidate as live out of a block when bytecode says it is live at the terminal (acatchentry the CFG does not model). A strict-modeargumentsobject eliminated toPhantomClonedArgumentscould be rematerialized on OSR exit from stack slots a second inlined varargs call had overwritten.26f0db0fe1[FIX] [PERF]: Baselineop_iterator_next's fast array path wrote its value profile to thecomputeNextcheckpoint instead ofgetValue, so the DFG kept predicting afor-ofloop variable from the LLInt's sample and re-speculated the same wrong type on every recompilation. The non-x64/arm64 slow-path call is removed.d545f589c8[FIX]: see the conflict note. Already covered by the fork.1c9b16dd56[FIX]: see the conflict note. Already covered by the fork.0fb9b2cf50[PERF]:CodeBlock::visitChildrenupdates non-lazy and lazy value profile predictions from the GC marker threads on the first visit of a Baseline code block, so the serialized update at GC end has less to do.9dcbd254af,261bcb42d8,36058b8e69[FIX] [BEHAVIOR]: Wasm validator. Block argument and result types always widen to the block's declared types (also forloopparameters),delegatewidens likeend, and an unreachableend(includingifwithoutelse) widens to the signature. A subtype that leaked through a block boundary could let a laterref.test/ref.castbe folded away. Three newJSTests/wasm/stresstests.929f6e81e0[FIX]: OMG excludeswasmBoundsCheckingSizeRegisterfrom the callee saves it restores on a tail call, so an unused pinned register is not clobbered (tail-call-unused-pins.js).6f7bb45088,81b5126daf[BEHAVIOR]: Wasm ESM integration. Imports from the reservedwasm:andwasm-js:module names throwLinkError, and a mutable global exported from a Wasm module reads as its current value through a module namespace object. Bun loads.wasmthrough its own loader and does not useWebAssemblyModuleRecord.d3e6e0f710,98007ce320,5f47279d0d,565aa489f1,ad023b35ce[PERF]: Wasm.i31refis fast-pathed in the JS-to-Wasm entry stub,ref.funcis inlined in BBQ and OMG, BBQ inlinesarray.new_defaultforv128, ref arrays are filled in bulk, and custom section names are compared without allocating aString.Build and infrastructure
96b6729497[INFRA]: re-lands Mya (an Apple-only memory analyzer) andlibJavaScriptCoreTools(Source/JavaScriptCore/corpse), all underif (APPLE)inSource/JavaScriptCore/CMakeLists.txtandshell/CMakeLists.txt. The first landing in the previous range was reverted before Upgrade to upstream WebKit 6b879687ee #528 took it.382a689967adds a PGO xcconfig for the tools library. Not in thejsctarget set the release scripts build.881e23eaa3[INFRA]: reverts80fc868e73(the MacroAssembleradd/subzero-immediate peephole from the previous range) inMacroAssemblerARM64.h,MacroAssemblerX86_64.handtestmasm.cpp. The fork's YarrJIT did not depend on it either way.f54ee018c7,120664e901[INFRA]: JSCOnly build fixes for the LinuxHighPriorityThreads(an unused constant, the header added toWTF_PUBLIC_HEADERS).0c7b760ec6[INFRA]: PlayStation linker prefix.3708229519[INFRA]: a CocoaUnifiedWebPreferences.yamlandPlatformEnableCocoa.hchange for the offscreen web extension API.fcd8c65d09,87a413dfec[INFRA]: safer C++ annotations in the inspector agents and expectations lists.Omitted (no JSCOnly footprint)
The remaining 70 commits touch WebCore, WebKit, WebDriver, Tools, LayoutTests or the GLib/GStreamer ports only.