Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: cb2788ad87c813797b9bf0d0f876c2534e8c9142
https://github.com/WebKit/WebKit/commit/cb2788ad87c813797b9bf0d0f876c2534e8c9142
Author: Adrian Perez de Castro <[email protected]>
Date: 2026-08-04 (Tue, 04 Aug 2026)
Changed paths:
M Source/JavaScriptCore/runtime/JSStringInlines.h
Log Message:
-----------
Cherry-pick 318454@main (a5c78b4fff5c).
https://bugs.webkit.org/show_bug.cgi?id=320887
REGRESSION(312307@main): [JSC] Clang reports unsafe buffer usage in
JSStringInlines.h
https://bugs.webkit.org/show_bug.cgi?id=320887
Reviewed by Keith Miller.
* Source/JavaScriptCore/runtime/JSStringInlines.h:
(JSC::JSString::tryFindLastOneChar const): Change plain arrays to use
bounds-checked std::array instances.
Canonical link: https://commits.webkit.org/318454@main
Canonical link: https://commits.webkit.org/317695.46@webkitglib/2.54
Commit: b6922ca758e13f513d524f3ddd95e529fc5f544d
https://github.com/WebKit/WebKit/commit/b6922ca758e13f513d524f3ddd95e529fc5f544d
Author: Pawel Lampe <[email protected]>
Date: 2026-08-04 (Tue, 04 Aug 2026)
Changed paths:
M Source/WebCore/platform/graphics/FontCache.cpp
M Source/WebCore/platform/graphics/FontCascadeCache.h
M Source/WebCore/platform/graphics/FontCascadeFonts.cpp
M Source/WebCore/platform/graphics/FontCascadeFonts.h
M Source/WebCore/platform/graphics/FontCustomPlatformData.h
M Source/WebCore/platform/graphics/FontPlatformData.cpp
M Source/WebCore/platform/graphics/skia/FontCacheSkia.cpp
M Source/WebCore/platform/graphics/skia/FontCustomPlatformDataSkia.cpp
M Source/WebCore/platform/graphics/skia/FontPlatformDataSkia.cpp
Log Message:
-----------
Cherry-pick 318476@main (6b324fb4b79e).
https://bugs.webkit.org/show_bug.cgi?id=319590
[Skia] Memory growth on every page load when fonts with variations are used
https://bugs.webkit.org/show_bug.cgi?id=319590
Reviewed by Carlos Garcia Campos.
This change adds a small cache for font variation typefaces, so that
variation-specific typefaces can be shared. This way, a lot of memory
can be saved if font variations are used often.
Canonical link: https://commits.webkit.org/318476@main
Canonical link: https://commits.webkit.org/317695.47@webkitglib/2.54
Commit: cc9be033e33e857d3c696eeb3dc0d2675bcce727
https://github.com/WebKit/WebKit/commit/cc9be033e33e857d3c696eeb3dc0d2675bcce727
Author: Carlos Alberto Lopez Perez <[email protected]>
Date: 2026-08-04 (Tue, 04 Aug 2026)
Changed paths:
M Source/JavaScriptCore/runtime/VM.cpp
Log Message:
-----------
Cherry-pick 318487@main (bff3814d76f7).
https://bugs.webkit.org/show_bug.cgi?id=320559
[JSC][Linux] Don't re-read /proc/self/maps when handling checkpoint OSR
side state
https://bugs.webkit.org/show_bug.cgi?id=320559
Reviewed by Yusuke Suzuki and Justin Michaud.
VM::pushCheckpointOSRSideState() has an ASSERT_ENABLED block that checks
that the side state stack remains ordered. To do so, it needs the current
thread stack bounds.
It obtained them using StackBounds::currentThreadStackBounds(), which does
not cache the result. On Linux, this calls pthread_getattr_np(), which glibc
implements for the main thread by opening and parsing /proc/self/maps.
Each call makes the kernel generate a list of the process memory mappings
and then makes glibc parse that list.
While running wasm/stress/type-index-abstract-heap-types-nulls-and-casts.js
in wasm-eager mode, profiling showed about ~45% of samples in kernel code
generating /proc/self/maps and another ~30% in libc parsing it. The test
opened /proc/self/maps hundreds of times through repeated calls to
VM::pushCheckpointOSRSideState().
Thread::m_stack is initialized using StackBounds::currentThreadStackBounds()
and cached for the lifetime of the thread.
Thread::currentSingleton().stack()
therefore provides the cached bounds without repeating the OS query.
logSanitizeStack() in the same file already uses this cached value.
Switch both call sites in VM.cpp to the cached bounds. This keeps the
relevant stack consistency assertions checks without asking the operating
system to recalculate information that the thread already stores.
popAllCheckpointOSRSideStateUntil() is not assertion-only: it uses the
bounds as part of its normal operation. This change therefore also avoids
the same cost in release builds.
With this change, on a Release+Asserts WPE build, `run-jsc-stress-tests \
--filter wasm.yaml/wasm/stress/type-index-abstract-heap-types` completes
in about five minutes. Previously, it could take around one hour, and the
tests would usually time out.
*
JSTests/wasm/stress/type-index-abstract-heap-types-concrete-vs-abstract.js:
* JSTests/wasm/stress/type-index-abstract-heap-types-globals-and-tables.js:
* JSTests/wasm/stress/type-index-abstract-heap-types-nulls-and-casts.js:
* JSTests/wasm/stress/type-index-abstract-heap-types-subtype-validation.js:
* Source/JavaScriptCore/runtime/VM.cpp:
(JSC::VM::pushCheckpointOSRSideState):
(JSC::VM::popAllCheckpointOSRSideStateUntil):
Canonical link: https://commits.webkit.org/318487@main
Canonical link: https://commits.webkit.org/317695.48@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/81f97cb0016d...cc9be033e33e
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
