Branch: refs/heads/webkitglib/2.46
Home: https://github.com/WebKit/WebKit
Commit: cd14fb555f901101e4979a4a470cc704ee7b0a64
https://github.com/WebKit/WebKit/commit/cd14fb555f901101e4979a4a470cc704ee7b0a64
Author: Vitaly Dyachkov <[email protected]>
Date: 2024-09-03 (Tue, 03 Sep 2024)
Changed paths:
M LayoutTests/TestExpectations
M Source/WebCore/rendering/updating/RenderTreeBuilderInline.cpp
Log Message:
-----------
Cherry-pick 282788@main (3ea9a89c350e).
https://bugs.webkit.org/show_bug.cgi?id=278100
[Debug] ASSERTION FAILED: !flow.spannerMap().get(placeholder->spanner()) in
`fast/multicol/span/float-becomes-spanner-crash.html`
https://bugs.webkit.org/show_bug.cgi?id=278100
Reviewed by Alan Baradlay.
Prevent multicolumn spanner placeholder from being added to the spanner
map twice when splitting an inline flow.
* LayoutTests/TestExpectations:
* Source/WebCore/rendering/updating/RenderTreeBuilderInline.cpp:
(WebCore::RenderTreeBuilder::Inline::splitFlow):
Canonical link: https://commits.webkit.org/282788@main
Canonical link: https://commits.webkit.org/282416.51@webkitglib/2.46
Commit: f3df0b41cb7016b9de1447311153bd75e0b428ee
https://github.com/WebKit/WebKit/commit/f3df0b41cb7016b9de1447311153bd75e0b428ee
Author: Siwei Li <[email protected]>
Date: 2024-09-03 (Tue, 03 Sep 2024)
Changed paths:
M Source/WebKit/WPEPlatform/wpe/WPEMonitor.cpp
Log Message:
-----------
Cherry-pick 282785@main (8b4645f9b063).
https://bugs.webkit.org/show_bug.cgi?id=278660
[WPE] Set WPEMonitor's width and height at the same time
https://bugs.webkit.org/show_bug.cgi?id=278660
Reviewed by Adrian Perez de Castro.
Setting WPEMonitor's width and height at the same time by freezing
the notify signal before emitting and thawing it afterwards.
* Source/WebKit/WPEPlatform/wpe/WPEMonitor.cpp:
(wpe_monitor_set_size):
Canonical link: https://commits.webkit.org/282785@main
Canonical link: https://commits.webkit.org/282416.52@webkitglib/2.46
Commit: 7f0623979f532f898bbe8aba1dd137c6bf0bfaed
https://github.com/WebKit/WebKit/commit/7f0623979f532f898bbe8aba1dd137c6bf0bfaed
Author: Yusuke Suzuki <[email protected]>
Date: 2024-09-03 (Tue, 03 Sep 2024)
Changed paths:
A JSTests/wasm/stress/i31ref-wrong-size.js
M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
M Source/JavaScriptCore/wasm/WasmBBQJIT32_64.cpp
M Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp
Log Message:
-----------
Cherry-pick 282774@main (cb7f341491b7).
https://bugs.webkit.org/show_bug.cgi?id=278650
OOB in JSC::StackVisitor::readFrame in webkit
https://bugs.webkit.org/show_bug.cgi?id=278650
rdar://134700145
Reviewed by Keith Miller.
1. i31ref is actually JSValue. So it must be 8 bytes.
2. WasmBBQJIT is generating I64 for the result of I31GetU / I31GetS, that's
wrong. It should be I32.
* JSTests/wasm/stress/i31ref-wrong-size.js: Added.
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::toB3Type):
* Source/JavaScriptCore/wasm/WasmBBQJIT32_64.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::sizeOfType):
(JSC::Wasm::BBQJITImpl::BBQJIT::setGlobal):
(JSC::Wasm::BBQJITImpl::BBQJIT::addI31GetS):
(JSC::Wasm::BBQJITImpl::BBQJIT::addI31GetU):
* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::sizeOfType):
(JSC::Wasm::BBQJITImpl::BBQJIT::addI31GetS):
(JSC::Wasm::BBQJITImpl::BBQJIT::addI31GetU):
(JSC::Wasm::BBQJITImpl::BBQJIT::addStructNew):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitStore):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitMoveMemory):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitLoad):
Canonical link: https://commits.webkit.org/282774@main
Canonical link: https://commits.webkit.org/282416.53@webkitglib/2.46
Compare: https://github.com/WebKit/WebKit/compare/11ee713f38e9...7f0623979f53
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
