Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 12c9964c288d8b300efadf31272995b492622022
https://github.com/WebKit/WebKit/commit/12c9964c288d8b300efadf31272995b492622022
Author: Chris Dumez <[email protected]>
Date: 2026-10-07 (Wed, 07 Oct 2026)
Changed paths:
M Source/JavaScriptCore/CMakeLists.txt
M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
M
Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result
M
Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result
M
Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result
M
Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result
M
Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result
M
Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result
M
Source/JavaScriptCore/Scripts/wkbuiltins/builtins_generate_separate_header.py
M Source/WebCore/SaferCPPExpectations/ForwardDeclCheckerExpectations
M
Source/WebCore/SaferCPPExpectations/NoUncheckedPtrMemberCheckerExpectations
M Source/WebCore/SaferCPPExpectations/NoUncountedMemberCheckerExpectations
M Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations
M Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations
M Source/WebCore/SaferCPPExpectations/UnretainedLocalVarsCheckerExpectations
M Source/WebCore/bindings/IDLTypes.h
M Source/WebCore/bindings/js/DOMPromiseProxy.h
M Source/WebCore/bindings/js/GarbageCollectionController.cpp
M Source/WebCore/bindings/js/JSAudioBufferSourceNodeCustom.cpp
M Source/WebCore/bindings/js/JSCSSRuleCustom.h
M Source/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
M Source/WebCore/bindings/js/JSCustomElementInterface.cpp
M Source/WebCore/bindings/js/JSDOMBindingSecurity.cpp
M Source/WebCore/bindings/js/JSDOMBindingSecurityInlines.h
M Source/WebCore/bindings/js/JSDOMConvertBase.h
M Source/WebCore/bindings/js/JSDOMConvertEventListener.h
M Source/WebCore/bindings/js/JSDOMConvertInterface.h
M Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
M Source/WebCore/bindings/js/JSDOMIterator.h
M Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp
M Source/WebCore/bindings/js/JSDOMPromiseDeferred.h
M Source/WebCore/bindings/js/JSDOMWindowBase.cpp
M Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
M Source/WebCore/bindings/js/JSEventTargetCustom.h
M Source/WebCore/bindings/js/JSExecState.cpp
M Source/WebCore/bindings/js/JSExecState.h
M Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
M Source/WebCore/bindings/js/JSIDBTransactionCustom.cpp
M Source/WebCore/bindings/js/JSIntersectionObserverCustom.cpp
M Source/WebCore/bindings/js/JSLazyEventListener.cpp
M Source/WebCore/bindings/js/JSLocationCustom.cpp
M Source/WebCore/bindings/js/JSMessageChannelCustom.cpp
M Source/WebCore/bindings/js/JSNodeCustom.cpp
M Source/WebCore/bindings/js/JSOffscreenCanvasRenderingContext2DCustom.cpp
M Source/WebCore/bindings/js/JSPaintRenderingContext2DCustom.cpp
M Source/WebCore/bindings/js/JSRangeCustom.cpp
M Source/WebCore/bindings/js/JSSVGViewSpecCustom.cpp
M Source/WebCore/bindings/js/JSStaticRangeCustom.cpp
M Source/WebCore/bindings/js/JSStylePropertyMapReadOnlyCustom.cpp
M Source/WebCore/bindings/js/JSTrustedTypePolicyFactoryCustom.cpp
M Source/WebCore/bindings/js/JSWorkerGlobalScopeCustom.cpp
M Source/WebCore/bindings/js/JSWorkletGlobalScopeBase.cpp
M Source/WebCore/bindings/js/ScheduledAction.cpp
M Source/WebCore/bindings/js/ScriptBufferSourceProvider.h
M Source/WebCore/bindings/js/ScriptController.cpp
M Source/WebCore/bindings/js/ScriptControllerMac.mm
M Source/WebCore/bindings/js/ScriptModuleLoader.cpp
M Source/WebCore/bindings/js/SerializedScriptValue.cpp
M Source/WebCore/bindings/js/WebAssemblyScriptBufferSourceProvider.h
M Source/WebCore/bindings/js/WebCoreTypedArrayController.cpp
M Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
M Source/WebCore/bindings/scripts/test/JS/JSDOMWindow.cpp
M Source/WebCore/bindings/scripts/test/JS/JSExposedToWorkerAndWindow.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestAsyncIterable.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestCallTracer.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestConditionalIncludes.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestConditionallyReadWrite.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSON.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONInherit.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONInheritFinal.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestDomainSecurity.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestEnabledForContext.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestGenerateAddOpaqueRoot.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestLegacyNoInterfaceObject.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestLegacyOverrideBuiltIns.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyOverrideBuiltIns.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp
M
Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestNamespaceObject.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestReportExtraMemoryCost.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestSerializable.cpp
M Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp
M Source/WebCore/dom/Document.h
M Source/WebCore/dom/EmptyScriptExecutionContext.h
M Source/WebCore/dom/ScriptExecutionContext.h
M Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp
M Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h
M Source/WebCore/workers/WorkerGlobalScope.h
M Source/WebCore/worklets/WorkletGlobalScope.h
Log Message:
-----------
Address Safer C++ static analysis warnings in WebCore bindings code
https://bugs.webkit.org/show_bug.cgi?id=326601
Reviewed by Geoffrey Garen.
Fix all Safer C++ warnings in the generated JS bindings and in bindings/js,
without adding ref counting churn to hot paths:
- Interface conversion results are now Ref<T> / RefPtr<T>. The converter already
refs the object, so this only moves the deref after the implementation call.
- Trivial accessors are marked NODELETE and pure pointer conversions are marked
CLANG_POINTER_CONVERSION.
- Values that are passed straight to toJS(), which refs them before anything can
run, are produced inside the toJS() functor, so a single suppression in
JSDOMConvertBase.h covers them.
- Code that runs on the GC thread, and other provably safe hot paths, use
suppressions with comments.
- Cold paths use protect().
* Source/JavaScriptCore/CMakeLists.txt:
* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:
Export HeapProfiler.h, which HeapSnapshotBuilder's constructor depends on.
* Source/JavaScriptCore/Scripts/wkbuiltins/builtins_generate_separate_header.py:
Include FunctionExecutable.h, which the generated init() functions use.
*
Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
*
Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
*
Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
*
Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
*
Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
*
Source/JavaScriptCore/Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
Rebaseline.
* Source/WebCore/bindings/IDLTypes.h:
Use Ref<T> / RefPtr<T> as IDLInterface conversion results. Mark the
extractValueFromNullable() overloads that return references as pointer
conversions.
* Source/WebCore/bindings/js/JSDOMConvertInterface.h:
Transfer the converter's reference into the conversion result.
* Source/WebCore/bindings/js/JSDOMConvertBase.h:
Mark getPtrOrRef() as pointer conversions and suppress the warnings for values
that toJS() passes straight to the converter.
* Source/WebCore/bindings/scripts/CodeGeneratorJS.pm:
Pass interface arguments using .get(), produce interface and buffer source
results
inside the toJS() functor, pass the union setter functor inline so it binds to
convert()'s NOESCAPE parameter, protect cold-path arguments, and suppress the
warnings for indexed / named property access, security checks and GC-thread
code.
* Source/WebCore/bindings/scripts/test/JS/JSDOMWindow.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSExposedToWorkerAndWindow.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestAsyncIterable.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestCallTracer.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestConditionalIncludes.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestConditionallyReadWrite.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSON.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONInherit.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONInheritFinal.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestDomainSecurity.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestEnabledForContext.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestGenerateAddOpaqueRoot.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp:
*
Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestLegacyNoInterfaceObject.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestLegacyOverrideBuiltIns.cpp:
*
Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp:
*
Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp:
*
Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp:
*
Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp:
*
Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp:
*
Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp:
*
Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp:
*
Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp:
*
Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyOverrideBuiltIns.cpp:
*
Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp:
*
Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestNamespaceObject.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestReportExtraMemoryCost.cpp:
* Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp:
Rebaseline.
* Source/WebCore/bindings/js/JSAudioBufferSourceNodeCustom.cpp:
* Source/WebCore/bindings/js/JSCSSRuleCustom.h:
* Source/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp:
* Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp:
* Source/WebCore/bindings/js/JSIDBTransactionCustom.cpp:
* Source/WebCore/bindings/js/JSIntersectionObserverCustom.cpp:
* Source/WebCore/bindings/js/JSMessageChannelCustom.cpp:
* Source/WebCore/bindings/js/JSOffscreenCanvasRenderingContext2DCustom.cpp:
* Source/WebCore/bindings/js/JSRangeCustom.cpp:
* Source/WebCore/bindings/js/JSSVGViewSpecCustom.cpp:
* Source/WebCore/bindings/js/JSStaticRangeCustom.cpp:
* Source/WebCore/bindings/js/JSStylePropertyMapReadOnlyCustom.cpp:
* Source/WebCore/bindings/js/JSTrustedTypePolicyFactoryCustom.cpp:
* Source/WebCore/bindings/js/JSWorkerGlobalScopeCustom.cpp:
* Source/WebCore/bindings/js/WebCoreTypedArrayController.cpp:
Suppress the warnings for code that runs on the GC thread.
* Source/WebCore/bindings/js/JSCustomElementInterface.cpp:
* Source/WebCore/bindings/js/JSDOMBindingSecurity.cpp:
* Source/WebCore/bindings/js/JSDOMGlobalObject.cpp:
* Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp:
* Source/WebCore/bindings/js/JSDOMPromiseDeferred.h:
* Source/WebCore/bindings/js/JSDOMWindowBase.cpp:
* Source/WebCore/bindings/js/JSExecState.cpp:
* Source/WebCore/bindings/js/JSLazyEventListener.cpp:
* Source/WebCore/bindings/js/JSWorkletGlobalScopeBase.cpp:
* Source/WebCore/bindings/js/ScheduledAction.cpp:
* Source/WebCore/bindings/js/ScriptBufferSourceProvider.h:
* Source/WebCore/bindings/js/ScriptController.cpp:
* Source/WebCore/bindings/js/ScriptControllerMac.mm:
* Source/WebCore/bindings/js/ScriptModuleLoader.cpp:
* Source/WebCore/bindings/js/SerializedScriptValue.cpp:
* Source/WebCore/bindings/js/WebAssemblyScriptBufferSourceProvider.h:
Use protect() / smart pointers.
* Source/WebCore/bindings/js/DOMPromiseProxy.h:
* Source/WebCore/bindings/js/JSDOMBindingSecurityInlines.h:
* Source/WebCore/bindings/js/JSDOMConvertEventListener.h:
* Source/WebCore/bindings/js/JSDOMIterator.h:
* Source/WebCore/bindings/js/JSEventTargetCustom.h:
Suppress the warnings where the object is provably kept alive.
* Source/WebCore/bindings/js/GarbageCollectionController.cpp:
* Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:
* Source/WebCore/bindings/js/JSExecState.h:
* Source/WebCore/bindings/js/JSLocationCustom.cpp:
Include the headers for forward declared types.
* Source/WebCore/bindings/js/JSNodeCustom.cpp:
* Source/WebCore/bindings/js/JSPaintRenderingContext2DCustom.cpp:
Suppress the warnings for code that runs on the GC thread or where the object is
kept alive. Include CustomPaintCanvas.h.
* Source/WebCore/dom/Document.h:
* Source/WebCore/dom/EmptyScriptExecutionContext.h:
* Source/WebCore/dom/ScriptExecutionContext.h:
* Source/WebCore/workers/WorkerGlobalScope.h:
* Source/WebCore/worklets/WorkletGlobalScope.h:
Mark settingsValues(), quirks() and ensureQuirks() as NODELETE.
* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:
* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h:
Take Ref<> for the non-nullable gradient and pattern styles.
* Source/WebCore/SaferCPPExpectations/ForwardDeclCheckerExpectations:
* Source/WebCore/SaferCPPExpectations/NoUncheckedPtrMemberCheckerExpectations:
* Source/WebCore/SaferCPPExpectations/NoUncountedMemberCheckerExpectations:
* Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:
* Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:
* Source/WebCore/SaferCPPExpectations/UnretainedLocalVarsCheckerExpectations:
Update expectations.
Canonical link: https://commits.webkit.org/323069@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
