Branch: refs/heads/safari-7613.3.9.0-branch
Home: https://github.com/WebKit/WebKit
Commit: 906929f11e55200ae29b7d5de82156d91d086e49
https://github.com/WebKit/WebKit/commit/906929f11e55200ae29b7d5de82156d91d086e49
Author: Alan Coon <[email protected]>
Date: 2022-08-03 (Wed, 03 Aug 2022)
Changed paths:
M Source/JavaScriptCore/Configurations/Version.xcconfig
M Source/ThirdParty/ANGLE/Configurations/Version.xcconfig
M Source/ThirdParty/libwebrtc/Configurations/Version.xcconfig
M Source/WebCore/Configurations/Version.xcconfig
M Source/WebCore/PAL/Configurations/Version.xcconfig
M Source/WebGPU/Configurations/Version.xcconfig
M Source/WebInspectorUI/Configurations/Version.xcconfig
M Source/WebKit/Configurations/Version.xcconfig
M Source/WebKitLegacy/mac/Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7613.4.1.0.1
Canonical link: https://commits.webkit.org/[email protected]
Commit: 5a8de3f50180a061d1140261ef82c825f7730952
https://github.com/WebKit/WebKit/commit/5a8de3f50180a061d1140261ef82c825f7730952
Author: Yusuke Suzuki <[email protected]>
Date: 2022-08-03 (Wed, 03 Aug 2022)
Changed paths:
A JSTests/stress/bigint-array-byte-offset.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Log Message:
-----------
Cherry-pick 1f3e8b70b999. rdar://problem/97264358
[AArch32][Aarch64] ASSERTION FAILED variant.intrinsic() == NoIntrinsic in
void JSC::DFG::ByteCodeParser::handleGetById
https://bugs.webkit.org/show_bug.cgi?id=242599
<rdar://96836847>
Reviewed by Mark Lam.
Previously all intrinsic getters are handled. So at this point, it should
be NoIntrinsic.
But after introducing 4GB TypedArray and BigInt64Array, this handling can
fail.
However, in this case, we should just continue using this generic path:
invoking a getter.
Thus, the current code is correct, and this assertion is stale.
This patch removes this stale assertion.
* JSTests/stress/bigint-array-byte-offset.js: Added.
(__f_2):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleGetById):
Canonical link: https://commits.webkit.org/252391@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: d5b48dbd85a070d0b0a1f27395f84755087b73bb
https://github.com/WebKit/WebKit/commit/d5b48dbd85a070d0b0a1f27395f84755087b73bb
Author: Chris Dumez <[email protected]>
Date: 2022-08-03 (Wed, 03 Aug 2022)
Changed paths:
M Source/WebCore/bindings/js/DOMPromiseProxy.h
Log Message:
-----------
Cherry-pick 4ac005fe82bb. rdar://problem/97276126
Do hardening in DOMPromiseProxy
https://bugs.webkit.org/show_bug.cgi?id=242528
<rdar://96204017>
Reviewed by Darin Adler.
Make sure we make a copy of the deferred promises before iterating over
them, in
case the code inside the loop modifies the Vector. Similarly, do a copy of
the
return value or exception the deferred promises are settled with, in case
|this|
goes away.
* Source/WebCore/bindings/js/DOMPromiseProxy.h:
(WebCore::DOMPromiseProxy<IDLType>::resolve):
(WebCore::DOMPromiseProxy<IDLAny>::resolve):
(WebCore::DOMPromiseProxy<IDLType>::resolveWithNewlyCreated):
(WebCore::DOMPromiseProxy<IDLType>::reject):
(WebCore::DOMPromiseProxy<IDLUndefined>::resolve):
(WebCore::DOMPromiseProxy<IDLUndefined>::reject):
(WebCore::DOMPromiseProxyWithResolveCallback<IDLType>::resolve):
(WebCore::DOMPromiseProxyWithResolveCallback<IDLType>::resolveWithNewlyCreated):
(WebCore::DOMPromiseProxyWithResolveCallback<IDLType>::reject):
Canonical link: https://commits.webkit.org/252305@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: 0e1154a51dcc5ab61c86e5eb764cd7147a7649d3
https://github.com/WebKit/WebKit/commit/0e1154a51dcc5ab61c86e5eb764cd7147a7649d3
Author: Alan Bujtas <[email protected]>
Date: 2022-08-03 (Wed, 03 Aug 2022)
Changed paths:
M Source/WebCore/rendering/LegacyLineLayout.cpp
Log Message:
-----------
Cherry-pick 4bfe200db44b. rdar://problem/97277370
Existing floatingObject->originatingLine() is not always an incorrect state
with security implication
https://bugs.webkit.org/show_bug.cgi?id=242493
Reviewed by Simon Fraser.
The float object's originating line is the line box where we see the float
first. Having duplicate originating line is an incorrect state which may lead
to a security issue. However re-assigning the same line should not be
considered one.
* Source/WebCore/rendering/LegacyLineLayout.cpp:
(WebCore::LegacyLineLayout::determineStartPosition):
Canonical link: https://commits.webkit.org/252269@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: 0a6cd9c47e963ee45f0dff2531add5c8c89cc44f
https://github.com/WebKit/WebKit/commit/0a6cd9c47e963ee45f0dff2531add5c8c89cc44f
Author: Youenn Fablet <[email protected]>
Date: 2022-08-03 (Wed, 03 Aug 2022)
Changed paths:
M Source/ThirdParty/libwebrtc/Source/webrtc/pc/rtp_sender.cc
Log Message:
-----------
Cherry-pick 4cfca4164256. rdar://problem/97276088
Update rtp_sender RestoreEncodingLayers function
https://bugs.webkit.org/show_bug.cgi?id=242506
rdar://96590018
Reviewed by Eric Carlson.
* Source/ThirdParty/libwebrtc/Source/webrtc/pc/rtp_sender.cc:
Canonical link: https://commits.webkit.org/252302@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: a0989c64649f4a2ed7e5956c100a1bac3d0c10ba
https://github.com/WebKit/WebKit/commit/a0989c64649f4a2ed7e5956c100a1bac3d0c10ba
Author: Kyle Piddington <[email protected]>
Date: 2022-08-03 (Wed, 03 Aug 2022)
Changed paths:
M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.h
M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.mm
M
Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/format_autogen.h
M
Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/gen_indices.metal
M
Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/mtl_default_shaders_src_autogen.inc
M
Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/mtl_default_shaders_src_autogen.metal
Log Message:
-----------
Cherry-pick 7bf231b1fd35. rdar://problem/97324250
[ANGLE] Bounds check index buffer generation
https://bugs.webkit.org/show_bug.cgi?id=242762
Bounds check element buffer access during triangle fan generation.
Out of bounds reads of the element buffer on both the CPU and GPU will
result in getting back
index zero, rather than reading garbage memory
Reviewed by Dean Jackson.
* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.h:
* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.mm:
(rx::mtl::IndexGeneratorUtils::generateTriFanBufferFromElementsArray):
(rx::mtl::IndexGeneratorUtils::generateTriFanBufferFromElementsArrayGPU):
(rx::mtl::IndexGeneratorUtils::generateTriFanBufferFromElementsArrayCPU):
*
Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/format_autogen.h:
*
Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/gen_indices.metal:
*
Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/mtl_default_shaders_src_autogen.inc:
*
Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/mtl_default_shaders_src_autogen.metal:
Canonical link: https://commits.webkit.org/252526@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: d845f4bfcf5bd821ee06f22990e8617b039662cc
https://github.com/WebKit/WebKit/commit/d845f4bfcf5bd821ee06f22990e8617b039662cc
Author: Saam Barati <[email protected]>
Date: 2022-08-03 (Wed, 03 Aug 2022)
Changed paths:
M Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp
M Source/JavaScriptCore/dfg/DFGGraph.cpp
Log Message:
-----------
Cherry-pick 8b320548f922. rdar://problem/97274970
Don't allow Flush/PhantomLocal to be the head variable in a block in
ThreadedCPS
https://bugs.webkit.org/show_bug.cgi?id=242096
Reviewed by Yusuke Suzuki.
Before this patch, we would allow Flush/PhantomLocal to be the node inside
the variableAtHead Operands
in a basic block. However, this causes some issues inside of our CFG
simplifcations phase.
CFG simplification will look at the variables at the head of the basic
blocks that it's going to
remove to indicate how we should preserve liveness in its predecessor. We
would then preserve
liveness using a Flush if the variableAtHead was Flushed, otherwise, we
would use a PhantomLocal.
However, the variable at the head might be a PhantomLocal, and it might be
a PhantomLocal
over a variable that's Flushed. However, in our IsFlushed analysis, we
never mark
PhantomLocals as IsFlushed, we only mark value producing nodes, Flush, or
Phis.
We do this by traversing the Phi data flow graph to propagate IsFlushed.
And a Phi
can never transitively point to a PhantomLocal, so it will never indicate
if a
variable is flushed.
To fix this, we just make the variableAtHead contain a Phi instead of
a Flush/PhantomLocal in the situation where it used to be a
Flush/PhantomLocal.
This Phi is what the Flush/PhantomLocal used to point to. And the compiler
is
already prepared for variableAtHead to point to a Phi since that's
what happens for GetLocal. GetLocal will point to a Phi that's inside
variableAtHead. And now what's pointed to by variableAtHead will
properly indicate if the variable is flushed since it'll be a Phi or a
SetArgument node.
* Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp:
(JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
(JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
* Source/JavaScriptCore/dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dumpBlockHeader):
Canonical link: https://commits.webkit.org/252192@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: ec2fe2a686526772b66f7a437a8e06dc71231b7c
https://github.com/WebKit/WebKit/commit/ec2fe2a686526772b66f7a437a8e06dc71231b7c
Author: Yusuke Suzuki <[email protected]>
Date: 2022-08-03 (Wed, 03 Aug 2022)
Changed paths:
M Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp
Log Message:
-----------
Cherry-pick a3dd7dc5f60b. rdar://problem/97278973
[JSC] Drop wasm stale assertion
https://bugs.webkit.org/show_bug.cgi?id=242047
rdar://95866655
Reviewed by Mark Lam.
This patch drops stale assertion in addDelegateToUnreachable.
* Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp:
(JSC::Wasm::LLIntGenerator::addDelegateToUnreachable):
Canonical link: https://commits.webkit.org/251902@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: f04744decc111e77a7c01ded55093d343d5b2b7b
https://github.com/WebKit/WebKit/commit/f04744decc111e77a7c01ded55093d343d5b2b7b
Author: Alan Bujtas <[email protected]>
Date: 2022-08-03 (Wed, 03 Aug 2022)
Changed paths:
M Source/WebCore/rendering/RenderElement.cpp
M Source/WebCore/rendering/RenderLayer.cpp
M Source/WebCore/rendering/RenderLayer.h
Log Message:
-----------
Cherry-pick a8bfed275263. rdar://problem/97273521
Do not include unparented RenderLayers in RenderLayer::topLayerRenderLayers
https://bugs.webkit.org/show_bug.cgi?id=241963
<rdar://95098693>
Reviewed by Simon Fraser.
* Source/WebCore/rendering/RenderElement.cpp:
(WebCore::findNextLayer):
(WebCore::layerNextSiblingRespectingTopLayer):
* Source/WebCore/rendering/RenderLayer.cpp:
* Source/WebCore/rendering/RenderLayer.h:
Canonical link: https://commits.webkit.org/251848@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: 7f676a460181db52d1b44e9b8a103f626ae90384
https://github.com/WebKit/WebKit/commit/7f676a460181db52d1b44e9b8a103f626ae90384
Author: Yusuke Suzuki <[email protected]>
Date: 2022-08-03 (Wed, 03 Aug 2022)
Changed paths:
M Source/JavaScriptCore/jsc.cpp
M Source/JavaScriptCore/runtime/InitializeThreading.cpp
M Source/JavaScriptCore/shell/playstation/TestShell.cpp
M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.cpp
M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.h
M Source/JavaScriptCore/wasm/WasmMemory.cpp
M Source/WebKit/WebProcess/WebProcess.cpp
Log Message:
-----------
Cherry-pick bb92169c6b02. rdar://problem/97264328
[JSC] Activate wasm fault handler when signaling memory is used
https://bugs.webkit.org/show_bug.cgi?id=242358
rdar://96056675
Reviewed by Mark Lam.
https://github.com/WebKit/WebKit/commit/42ad6e4af024381a287ea6a587da469ef43f2819
broke JavaScriptCore.framework's wasm signal handler
since it is no longer installed. This patch activates that handler when
wasm memory is created with signaling requirement, which is
Signaling or Shared memory. We do not activate this in JSC::initialize
since LLDB has a bug that it cannot handle mach exception.
We defer this initialization only when we use Wasm::Memory with necessary
features.
* Source/JavaScriptCore/jsc.cpp:
(runJSC):
* Source/JavaScriptCore/runtime/InitializeThreading.cpp:
(JSC::initialize):
* Source/JavaScriptCore/shell/playstation/TestShell.cpp:
(setupTestRun):
* Source/JavaScriptCore/wasm/WasmFaultSignalHandler.cpp:
(JSC::Wasm::activateSignalingMemory):
(JSC::Wasm::initializeSignalingMemory): Deleted.
* Source/JavaScriptCore/wasm/WasmFaultSignalHandler.h:
* Source/JavaScriptCore/wasm/WasmMemory.cpp:
(JSC::Wasm::MemoryHandle::MemoryHandle):
* Source/WebKit/WebProcess/WebProcess.cpp:
(WebKit::WebProcess::initializeWebProcess):
Canonical link: https://commits.webkit.org/252164@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: da4179b034adba7de371ff71e5c902b8bcc53b2c
https://github.com/WebKit/WebKit/commit/da4179b034adba7de371ff71e5c902b8bcc53b2c
Author: Brandon Stewart <[email protected]>
Date: 2022-08-03 (Wed, 03 Aug 2022)
Changed paths:
M Source/WebCore/crypto/SubtleCrypto.cpp
Log Message:
-----------
Cherry-pick c29e5a28c176. rdar://problem/97276107
Ensure promise is not garbage collected
https://bugs.webkit.org/show_bug.cgi?id=242287
Reviewed by Tim Nguyen.
We need to ensure that the promise always remains alive when in use.
Adding a RefPtr guarantees that it will not be garbage collected.
* Source/WebCore/crypto/SubtleCrypto.cpp:
(WebCore::SubtleCrypto::unwrapKey):
Canonical link: https://commits.webkit.org/252091@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: b9a715e45910d40433ce8b415102f223d7a68e7a
https://github.com/WebKit/WebKit/commit/b9a715e45910d40433ce8b415102f223d7a68e7a
Author: Yusuke Suzuki <[email protected]>
Date: 2022-08-03 (Wed, 03 Aug 2022)
Changed paths:
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
Log Message:
-----------
Cherry-pick cb3e9788095c. rdar://problem/97276414
[JSC] Clean up delegate's error message
https://bugs.webkit.org/show_bug.cgi?id=242099
Reviewed by Saam Barati.
This patch fixes error message for delegate wasm opcode, it is not br or
br_if.
* Source/JavaScriptCore/wasm/WasmFunctionParser.h:
(JSC::Wasm::FunctionParser<Context>::parseDelegateTarget):
(JSC::Wasm::FunctionParser<Context>::parseExpression):
(JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
Canonical link: https://commits.webkit.org/251944@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: 5ddcf36b601c7229c3a36940c81f8f2a27ed88a0
https://github.com/WebKit/WebKit/commit/5ddcf36b601c7229c3a36940c81f8f2a27ed88a0
Author: Yusuke Suzuki <[email protected]>
Date: 2022-08-03 (Wed, 03 Aug 2022)
Changed paths:
M Source/WebCore/bindings/js/JSDOMGuardedObject.cpp
Log Message:
-----------
Cherry-pick ecad671df9fc. rdar://problem/97274999
Refine JSDOMGuardedObject
https://bugs.webkit.org/show_bug.cgi?id=242282
rdar://94649571
Reviewed by Mark Lam.
This patch fixes the following issues.
1. JSDOMGuardedObject should emit write-barrier after storing a reference
to JSDOMGlobalObject.
2. Regardless of m_guarded status, we should unregister itself from
JSDOMGlobalObject if JSDOMGlobalObject
is live since we register it in the constructor.
* Source/WebCore/bindings/js/JSDOMGuardedObject.cpp:
(WebCore::DOMGuardedObject::DOMGuardedObject):
(WebCore::DOMGuardedObject::clear):
(WebCore::DOMGuardedObject::removeFromGlobalObject):
Canonical link: https://commits.webkit.org/252086@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: 4689200da72bb53cb9333f911ab6019645cb7155
https://github.com/WebKit/WebKit/commit/4689200da72bb53cb9333f911ab6019645cb7155
Author: Alan Coon <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
M Source/WebCore/bindings/js/JSDOMGuardedObject.cpp
Log Message:
-----------
Revert ecad671df9fc. rdar://problem/97274999
This reverts commit 5ddcf36b601c7229c3a36940c81f8f2a27ed88a0.
Canonical link: https://commits.webkit.org/[email protected]
Commit: c40feebe3ec9423c815ba97c1ddce06f2d3bcb0c
https://github.com/WebKit/WebKit/commit/c40feebe3ec9423c815ba97c1ddce06f2d3bcb0c
Author: Alan Coon <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
Log Message:
-----------
Revert cb3e9788095c. rdar://problem/97276414
This reverts commit b9a715e45910d40433ce8b415102f223d7a68e7a.
Canonical link: https://commits.webkit.org/[email protected]
Commit: 4fe1d9022ac2b2825a5a973446bbd929986cc47c
https://github.com/WebKit/WebKit/commit/4fe1d9022ac2b2825a5a973446bbd929986cc47c
Author: Alan Coon <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
M Source/WebCore/crypto/SubtleCrypto.cpp
Log Message:
-----------
Revert c29e5a28c176. rdar://problem/97276107
This reverts commit da4179b034adba7de371ff71e5c902b8bcc53b2c.
Canonical link: https://commits.webkit.org/[email protected]
Commit: 48c7d101542e5a93e5f8e6293776503e69053277
https://github.com/WebKit/WebKit/commit/48c7d101542e5a93e5f8e6293776503e69053277
Author: Alan Coon <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
M Source/JavaScriptCore/jsc.cpp
M Source/JavaScriptCore/runtime/InitializeThreading.cpp
M Source/JavaScriptCore/shell/playstation/TestShell.cpp
M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.cpp
M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.h
M Source/JavaScriptCore/wasm/WasmMemory.cpp
M Source/WebKit/WebProcess/WebProcess.cpp
Log Message:
-----------
Revert bb92169c6b02. rdar://problem/97264328
This reverts commit 7f676a460181db52d1b44e9b8a103f626ae90384.
Canonical link: https://commits.webkit.org/[email protected]
Commit: 56a09fd49f6d3ab92bb59bbbbcead90e9f1511dd
https://github.com/WebKit/WebKit/commit/56a09fd49f6d3ab92bb59bbbbcead90e9f1511dd
Author: Alan Coon <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
M Source/WebCore/rendering/RenderElement.cpp
M Source/WebCore/rendering/RenderLayer.cpp
M Source/WebCore/rendering/RenderLayer.h
Log Message:
-----------
Revert a8bfed275263. rdar://problem/97273521
This reverts commit f04744decc111e77a7c01ded55093d343d5b2b7b.
Canonical link: https://commits.webkit.org/[email protected]
Commit: 8d69488c42130c281c688f4c3aae8adacff0042f
https://github.com/WebKit/WebKit/commit/8d69488c42130c281c688f4c3aae8adacff0042f
Author: Alan Coon <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
M Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp
Log Message:
-----------
Revert a3dd7dc5f60b. rdar://problem/97278973
This reverts commit ec2fe2a686526772b66f7a437a8e06dc71231b7c.
Canonical link: https://commits.webkit.org/[email protected]
Commit: 3173037ff62e00d679c0d0fc774cbffb4b303c4c
https://github.com/WebKit/WebKit/commit/3173037ff62e00d679c0d0fc774cbffb4b303c4c
Author: Alan Coon <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
M Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp
M Source/JavaScriptCore/dfg/DFGGraph.cpp
Log Message:
-----------
Revert 8b320548f922. rdar://problem/97274970
This reverts commit d845f4bfcf5bd821ee06f22990e8617b039662cc.
Canonical link: https://commits.webkit.org/[email protected]
Commit: f5a3937896b0693de73f5c87143fad4d200acf30
https://github.com/WebKit/WebKit/commit/f5a3937896b0693de73f5c87143fad4d200acf30
Author: Alan Coon <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.h
M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.mm
M
Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/format_autogen.h
M
Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/gen_indices.metal
M
Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/mtl_default_shaders_src_autogen.inc
M
Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/mtl_default_shaders_src_autogen.metal
Log Message:
-----------
Revert 7bf231b1fd35. rdar://problem/97324250
This reverts commit a0989c64649f4a2ed7e5956c100a1bac3d0c10ba.
Canonical link: https://commits.webkit.org/[email protected]
Commit: 4548b55ba462c5eef6c27eb2aaff09e6c3fa9c1e
https://github.com/WebKit/WebKit/commit/4548b55ba462c5eef6c27eb2aaff09e6c3fa9c1e
Author: Alan Coon <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
M Source/ThirdParty/libwebrtc/Source/webrtc/pc/rtp_sender.cc
Log Message:
-----------
Revert 4cfca4164256. rdar://problem/97276088
This reverts commit 0a6cd9c47e963ee45f0dff2531add5c8c89cc44f.
Canonical link: https://commits.webkit.org/[email protected]
Commit: aacf31fbf06793c9b40ae174fc8ef052e21c3c12
https://github.com/WebKit/WebKit/commit/aacf31fbf06793c9b40ae174fc8ef052e21c3c12
Author: Alan Coon <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
M Source/WebCore/rendering/LegacyLineLayout.cpp
Log Message:
-----------
Revert 4bfe200db44b. rdar://problem/97277370
This reverts commit 0e1154a51dcc5ab61c86e5eb764cd7147a7649d3.
Canonical link: https://commits.webkit.org/[email protected]
Commit: 3682b2ac1aa53d31507359fabed5006f6037d480
https://github.com/WebKit/WebKit/commit/3682b2ac1aa53d31507359fabed5006f6037d480
Author: Alan Coon <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
M Source/WebCore/bindings/js/DOMPromiseProxy.h
Log Message:
-----------
Revert 4ac005fe82bb. rdar://problem/97276126
This reverts commit d5b48dbd85a070d0b0a1f27395f84755087b73bb.
Canonical link: https://commits.webkit.org/[email protected]
Commit: aa1ca57c1ce961c141264b1c5da88749ccf13a61
https://github.com/WebKit/WebKit/commit/aa1ca57c1ce961c141264b1c5da88749ccf13a61
Author: Alan Coon <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
R JSTests/stress/bigint-array-byte-offset.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Log Message:
-----------
Revert 1f3e8b70b999. rdar://problem/97264358
This reverts commit 5a8de3f50180a061d1140261ef82c825f7730952.
Canonical link: https://commits.webkit.org/[email protected]
Commit: d9bb630d3a1040355e2475da4c68c21dede81529
https://github.com/WebKit/WebKit/commit/d9bb630d3a1040355e2475da4c68c21dede81529
Author: Alan Coon <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
M Source/JavaScriptCore/Configurations/Version.xcconfig
M Source/ThirdParty/ANGLE/Configurations/Version.xcconfig
M Source/ThirdParty/libwebrtc/Configurations/Version.xcconfig
M Source/WebCore/Configurations/Version.xcconfig
M Source/WebCore/PAL/Configurations/Version.xcconfig
M Source/WebGPU/Configurations/Version.xcconfig
M Source/WebInspectorUI/Configurations/Version.xcconfig
M Source/WebKit/Configurations/Version.xcconfig
M Source/WebKitLegacy/mac/Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7613.3.9.0.15
Canonical link: https://commits.webkit.org/[email protected]
Commit: fdaaccf6d7791cf2c329b0370a08ed9788265089
https://github.com/WebKit/WebKit/commit/fdaaccf6d7791cf2c329b0370a08ed9788265089
Author: Yusuke Suzuki <[email protected]>
Date: 2022-08-04 (Thu, 04 Aug 2022)
Changed paths:
A JSTests/stress/map-clear-get.js
A JSTests/stress/set-clear-has.js
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp
M Source/JavaScriptCore/runtime/HashMapImpl.h
M Source/JavaScriptCore/runtime/HashMapImplInlines.h
M Source/JavaScriptCore/runtime/JSMap.h
M Source/JavaScriptCore/runtime/JSModuleLoader.cpp
M Source/JavaScriptCore/runtime/JSSet.h
M Source/JavaScriptCore/runtime/MapConstructor.cpp
M Source/JavaScriptCore/runtime/MapPrototype.cpp
M Source/JavaScriptCore/runtime/SetConstructor.cpp
M Source/JavaScriptCore/runtime/SetPrototype.cpp
M Source/JavaScriptCore/runtime/WeakMapImplInlines.h
M Source/WebCore/bindings/js/JSDOMMapLike.cpp
M Source/WebCore/bindings/js/JSDOMSetLike.cpp
M Source/WebCore/bindings/js/SerializedScriptValue.cpp
Log Message:
-----------
Cherry-pick 1ed1e4a336e1. rdar://problem/98068082
[JSC] Make JSMap and JSSet construction more simple and efficient
https://bugs.webkit.org/show_bug.cgi?id=243557
rdar://98068082
Reviewed by Mark Lam and Saam Barati.
This patch makes the initial buffer of JSMap / JSSet nullptr so that we can
make allocation of them
simpler and efficient for non-using case. It cleans up many code in module
loader etc. And it paves
the way to allocating them from DFG and FTL efficiently. It also cleans up
SerializedScriptValue
implementation.
* JSTests/stress/map-clear-get.js: Added.
(shouldBe):
(test):
* JSTests/stress/set-clear-has.js: Added.
(shouldBe):
(set clear):
(set shouldBe):
(set new):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp:
(JSC::AbstractModuleRecord::finishCreation):
* Source/JavaScriptCore/runtime/HashMapImpl.h:
(JSC::HashMapBuffer::tryCreate):
(JSC::HashMapImpl::HashMapImpl):
(JSC::HashMapBuffer::create): Deleted.
(JSC::HashMapImpl::shouldRehashAfterAdd const): Deleted.
* Source/JavaScriptCore/runtime/HashMapImplInlines.h:
(JSC::shouldShrink):
(JSC::shouldRehash):
(JSC::nextCapacity):
(JSC::HashMapImpl<HashMapBucketType>::finishCreation):
(JSC::HashMapImpl<HashMapBucketType>::add):
(JSC::HashMapImpl<HashMapBucketType>::addNormalized):
(JSC::HashMapImpl<HashMapBucketType>::remove):
(JSC::HashMapImpl<HashMapBucketType>::clear):
(JSC::HashMapImpl<HashMapBucketType>::setUpHeadAndTail):
(JSC::HashMapImpl<HashMapBucketType>::addNormalizedNonExistingForCloning):
(JSC::HashMapImpl<HashMapBucketType>::addNormalizedNonExistingForCloningInternal):
(JSC::HashMapImpl<HashMapBucketType>::addNormalizedInternal):
(JSC::HashMapImpl<HashMapBucketType>::findBucketAlreadyHashedAndNormalized):
(JSC::HashMapImpl<HashMapBucketType>::rehash):
(JSC::HashMapImpl<HashMapBucketType>::makeAndSetNewBuffer):
(JSC::HashMapImpl<HashMapBucketType>::assertBufferIsEmpty):
(JSC::shouldRehashAfterAdd): Deleted.
(JSC::HashMapImpl<HashMapBucketType>::assertBufferIsEmpty const): Deleted.
* Source/JavaScriptCore/runtime/JSMap.h:
* Source/JavaScriptCore/runtime/JSModuleLoader.cpp:
(JSC::JSModuleLoader::finishCreation):
* Source/JavaScriptCore/runtime/JSSet.h:
* Source/JavaScriptCore/runtime/MapConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/MapPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/SetConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/SetPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/WeakMapImplInlines.h:
(JSC::WeakMapImpl<WeakMapBucket>::shouldRehashAfterAdd const):
* Source/WebCore/bindings/js/JSDOMMapLike.cpp:
(WebCore::getBackingMap):
* Source/WebCore/bindings/js/JSDOMSetLike.cpp:
(WebCore::getBackingSet):
* Source/WebCore/bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneDeserializer::deserialize):
Canonical link: https://commits.webkit.org/253133@main
Canonical link: https://commits.webkit.org/[email protected]
Commit: 1052ae177e9a79520810f3017e78be36bbb175c3
https://github.com/WebKit/WebKit/commit/1052ae177e9a79520810f3017e78be36bbb175c3
Author: Alan Coon <[email protected]>
Date: 2022-08-09 (Tue, 09 Aug 2022)
Changed paths:
M Source/JavaScriptCore/Configurations/Version.xcconfig
M Source/ThirdParty/ANGLE/Configurations/Version.xcconfig
M Source/ThirdParty/libwebrtc/Configurations/Version.xcconfig
M Source/WebCore/Configurations/Version.xcconfig
M Source/WebCore/PAL/Configurations/Version.xcconfig
M Source/WebGPU/Configurations/Version.xcconfig
M Source/WebInspectorUI/Configurations/Version.xcconfig
M Source/WebKit/Configurations/Version.xcconfig
M Source/WebKitLegacy/mac/Configurations/Version.xcconfig
Log Message:
-----------
Versioning.
WebKit-7613.3.9.0.16
Canonical link: https://commits.webkit.org/[email protected]
Compare: https://github.com/WebKit/WebKit/compare/50f30150aef5...1052ae177e9a
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
